[Senate Hearing 116-353]
[From the U.S. Government Publishing Office]
S. Hrg. 116-353
THE STATE OF AIRLINE SAFETY: FEDERAL OVERSIGHT OF COMMERCIAL AVIATION
=======================================================================
HEARING
before the
SUBCOMMITTEE ON AVIATION AND SPACE
of the
COMMITTEE ON COMMERCE,
SCIENCE, AND TRANSPORTATION
UNITED STATES SENATE
ONE HUNDRED SIXTEENTH CONGRESS
FIRST SESSION
__________
MARCH 27, 2019
__________
Printed for the use of the Committee on Commerce, Science, and
Transportation
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Available online: http://www.govinfo.gov
______
U.S. GOVERNMENT PUBLISHING OFFICE
42-445 PDF WASHINGTON : 2023
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
ONE HUNDRED SIXTEENTH CONGRESS
FIRST SESSION
ROGER WICKER, Mississippi, Chairman
JOHN THUNE, South Dakota MARIA CANTWELL, Washington,
ROY BLUNT, Missouri Ranking
TED CRUZ, Texas AMY KLOBUCHAR, Minnesota
DEB FISCHER, Nebraska RICHARD BLUMENTHAL, Connecticut
JERRY MORAN, Kansas BRIAN SCHATZ, Hawaii
DAN SULLIVAN, Alaska EDWARD MARKEY, Massachusetts
CORY GARDNER, Colorado TOM UDALL, New Mexico
MARSHA BLACKBURN, Tennessee GARY PETERS, Michigan
SHELLEY MOORE CAPITO, West Virginia TAMMY BALDWIN, Wisconsin
MIKE LEE, Utah TAMMY DUCKWORTH, Illinois
RON JOHNSON, Wisconsin JON TESTER, Montana
TODD YOUNG, Indiana KYRSTEN SINEMA, Arizona
RICK SCOTT, Florida JACKY ROSEN, Nevada
John Keast, Staff Director
Crystal Tully, Deputy Staff Director
Steven Wall, General Counsel
Kim Lipsky, Democratic Staff Director
Chris Day, Democratic Deputy Staff Director
Renae Black, Senior Counsel
------
SUBCOMMITTEE ON AVIATION AND SPACE
TED CRUZ, Texas, Chairman KYRSTEN SINEMA, Arizona, Ranking
JOHN THUNE, South Dakota BRIAN SCHATZ, Hawaii
ROY BLUNT, Missouri TOM UDALL, New Mexico
JERRY MORAN, Kansas GARY PETERS, Michigan
CORY GARDNER, Colorado TAMMY DUCKWORTH, Illinois
MARSHA BLACKBURN, Tennessee JON TESTER, Montana
SHELLEY MOORE CAPITO, West Virginia JACKY ROSEN, Nevada
MIKE LEE, Utah
C O N T E N T S
----------
Page
Hearing held on March 27, 2019................................... 1
Statement of Senator Cruz........................................ 1
Statement of Senator Sinema...................................... 2
Statement of Senator Wicker...................................... 3
Statement of Senator Cantwell.................................... 4
Statement of Senator Thune....................................... 37
Statement of Senator Klobuchar................................... 39
Statement of Senator Moran....................................... 41
Statement of Senator Blumenthal.................................. 43
Statement of Senator Blunt....................................... 44
Statement of Senator Duckworth................................... 47
Statement of Senator Moore Capito................................ 49
Statement of Senator Markey...................................... 51
Statement of Senator Rosen....................................... 53
Statement of Senator Udall....................................... 56
Article dated June 15, 2018 from the Seattle Times entitled,
``Troublesome advanced engines for Boeing, Airbus jets have
disrupted airlines and shaken travelers''.................. 57
Witnesses
Hon. Daniel K. Elwell, Acting Administrator, Federal Aviation
Administration................................................. 6
Prepared statement........................................... 7
Hon. Robert L. Sumwalt III, Chairman, National Transportation
Safety Board................................................... 11
Prepared statement........................................... 12
Hon. Calvin L. Scovel III, Inspector General, U.S. Department of
Transportation................................................. 19
Prepared statement........................................... 21
Appendix
Response to written questions submitted to Hon. Daniel K. Elwell
by:
Hon. John Thune.............................................. 73
Hon. Maria Cantwell.......................................... 74
Hon. Amy Klobuchar........................................... 74
Hon. Tom Udall............................................... 74
Hon. Tammy Duckworth......................................... 76
Hon. Jon Tester.............................................. 79
Response to written questions submitted to Hon. Calvin L. Scovel
III by:
Hon. John Thune.............................................. 81
Hon. Maria Cantwell.......................................... 81
Hon. Tammy Duckworth......................................... 82
Hon. Jon Tester.............................................. 83
THE STATE OF AIRLINE SAFETY: FEDERAL OVERSIGHT OF COMMERCIAL AVIATION
----------
WEDNESDAY, MARCH 27, 2019
U.S. Senate,
Subcommittee on Aviation and Space,
Committee on Commerce, Science, and Transportation,
Washington, DC.
The Subcommittee met, pursuant to notice, at 3:02 p.m. in
room SH-216, Hart Senate Office Building, Hon. Ted Cruz,
Chairman of the Subcommittee, presiding.
Present: Senators Cruz [presiding], Wicker, Thune, Blunt,
Moran, Moore Capito, Sinema, Cantwell, Blumenthal, Markey,
Duckworth, Klobuchar, Udall, and Rosen.
OPENING STATEMENT OF HON. TED CRUZ,
U.S. SENATOR FROM TEXAS
Senator Cruz. Well, good afternoon. The subcommittee will
come to order.
Our hearing is entitled The State of Airline Safety:
Federal Oversight of Commercial aviation. Welcome to each of
the witnesses.
On March 10, 2019, Ethiopian Airlines Flight 302 departed
Addis Ababa Airport with 157 souls onboard. Among them were
parents and children, reverends and international aid workers,
and college students with their entire lives ahead of them, but
at 8:44 a.m., 6 minutes after takeoff, what should have been a
routine two-hour flight turned into a tragedy. Flight 302
crashed, killing all 157 people.
Although devastating on its own, the tragedy of Flight 302
was compounded by the fact that something like this had
happened less than six months earlier.
Lion Air Flight 610 had been in the air just 12 minutes
before plunging into the Java Sea at 6:32 a.m. on October 29,
2018, killing all 189 people onboard.
The 346 men, women, and children lost in these tragic
crashes came from 35 different countries, ranged in age from
the elderly to the unborn, and had professions as diverse as
their backgrounds, but they did have one thing in common. They
were all traveling on a brand-new plane, a Boeing 737 Max.
It is truly unfortunate that today's hearing is necessary
and I wish we didn't have to be here today, but our first
priority in aviation must always be the safety of the flying
public.
The fact of the matter is that these crashes and subsequent
reports on how the 737 Max was approved have badly shaken
consumer confidence.
In aviation, as in other industries, where a small mistake
can have catastrophic consequences, trust is the currency of
the realm. Trust of the flying public in the safety of the
aircraft they step onto, trust of our international partners in
the diligence and thoroughness of our regulatory bodies, and
increasingly trust of our regulatory bodies in the quality and
truthfulness of the data and certifications provided and
performed by industry.
Not only have the recent crashes shaken the confidence of
the public but the questions that have been raised in the
aftermath about FAA's oversight of aircraft manufacturers, the
certification process for planes, and the close relationship
between industry and regulator threaten to erode trust in the
entire system.
It is incumbent on us as legislators, as regulators, and as
industry leaders to work to ensure that that does not occur.
Today's hearing takes the first step down that road by
seeking to answer some fundamental questions.
First, we need to understand exactly what happened, both in
these specific crashes and with the certification process for
the Max aircraft, so that we can take action to keep something
like these tragic crashes from occurring again.
Second, we need to look at the aviation safety space more
broadly and identify where we can and should make improvements.
We need to answer, at least begin to answer questions like is
the FAA taking the right approach to the oversight and
certification of aircraft manufacturing, operations, and
repair, particularly with regard to designated authority.
Also answering how safe is commercial aviation, both in the
United States and internationally, and how can we increase the
level of safety even further, and how can we restore the
confidence and trust of the flying public, both in the United
States and internationally?
As our witnesses today will highlight in their testimony,
commercial aviation in the United States today is as safe as it
ever has been worldwide and particularly in the United States.
The likelihood of being in a fatal commercial plane crash
is infinitesimally low and this is a record that we can and
should be proud of, but this record is also exactly what makes
the recent crashes and reports of lenient oversight by the FAA
so frustrating.
As a nation, we have been on such a promising upward trend
in safety that, although these crashes occurred in foreign
countries, the questions that have been raised about the
integrity of our regulatory processes strikes right to the
heart of aviation safety here at home.
We need to do better and I firmly believe that we can. With
that, I'll recognize the Ranking Member of the Aviation and
Space Subcommittee, Senator Sinema.
STATEMENT OF HON. KYRSTEN SINEMA,
U.S. SENATOR FROM ARIZONA
Senator Sinema. Well, thank you, Chairman Cruz, for holding
this timely and important hearing.
I look forward to building a strong relationship and
working closely with you on this and other issues in our
Subcommittee's jurisdiction.
Thank you to our witnesses for joining us today.
The United States airspace and U.S. aviation are the safest
in the world. The United States is the leader in aviation and
aviation safety, thanks to the dedication of thousands of
skilled individuals on the manufacturing floor, on the ground
at airports, in control towers, and in the air.
Our safety also relies on the advocacy of concerned
citizens, like the families of Continental Flight 3407, who
tirelessly advocate for safer skies. Thank you for being here
today and for your work on this important issue.
The aviation industry is a major economic driver. Safe,
affordable, and convenient air travel is critical to the well-
being of industry, job creation, and economic growth. The
system is successful because it is safe and people know and
trust that it is safe.
Tragedies, like the Ethiopian Airlines and Lion Air crashes
are unimaginable in the U.S. and must remain so, but they and
other recent incidents raise important questions about
maintaining a safe national airspace system and U.S. leadership
in aviation and safety.
It's imperative that we quickly fix any problems within
FAA's oversight, evaluation, and approval processes to ensure
safety in American skies, restore trust, and maintain U.S.
global leadership in aviation and aviation safety.
Thank you, Mr. Chairman. I yield back.
Senator Cruz. I now recognize the Chairman of the Full
Committee, Senator Wicker.
STATEMENT OF HON. ROGER WICKER,
U.S. SENATOR FROM MISSISSIPPI
Senator Wicker. Thank you, Senator Cruz, and I want to
thank Senator Cruz and Senator Sinema for holding this
Subcommittee hearing on the timely subject of aviation safety.
As both the Chair and Ranking Member mentioned in their
remarks, the remarkable safety record of U.S. passenger airline
travel is a testament to decades of hard work and painful
lessons learned by a great many stakeholders.
Today's hearing represents the beginning of this year's
work in this area. The Committee intends to hold a second
hearing on aviation safety to hear from non-government
witnesses, including Boeing.
We understand that the investigations into the Ethiopian
Airlines and Lion Air crashes are ongoing and may limit certain
details from being discussed in this forum. However, our
witnesses can cover a lot of information today, including
addressing the FAA's response to these tragedies, the
certification process, pilot training, and broader concerns
about the increasing complexity and automation of aircraft
systems.
The FAA has long been considered the gold standard
internationally when it comes to safety. It is vital that we
work with our partners throughout the world to promote safe air
transportation. The committee will continue to discuss robust
oversight to ensure the safety of our aviation system.
Thank you, Mr. Chairman.
Senator Cruz. I now recognize the Ranking Member of the
Full Committee, Senator Cantwell.
STATEMENT OF HON. MARIA CANTWELL,
U.S. SENATOR FROM WASHINGTON
Senator Cantwell. Thank you, Mr. Chairman, and thank you
for holding this important hearing today to discuss the
paramount issue of aviation safety here in the United States
and around the world.
I thank the witnesses for being here and their insights
today and I, too, want to recognize the families of the Colgan
Air Flight 3407 who are here today because it is their
continued persistence about getting aviation right that is so
admirable. I thank them and thank you all for being here.
The incidents that led us here today of the crash of Lion
Air 610 last October and the Ethiopian Flight 302 are horrible
human tragedies. I want to extend my deepest sympathies to the
families and everyone impacted by this horrific incident.
These two accidents cost 346 lives, leaving behind
countless individuals and loved ones who I know want to make
sure this is never repeated.
The human toll is why we work every day to ensure that
every possible step is taken to determine the causes that
contributed to these incidents and through the crash
investigations, other Federal investigations, and ongoing
congressional oversight, I believe we all share the same goal,
to make sure these accidents are never repeated.
It is critical that all those involved look at the causes
of the accident and work so that everyone has the full picture
of what happened.
Investigators in Indonesia and Ethiopia, with the help from
NTSB and FAA and other international partners, are working
through the evidence to determine the causes of these accidents
and even though, as my colleagues have mentioned, global
commercial aviation has experienced unprecedented periods of
safety over the last decade, these two accidents are horrific
reminders that we must remain vigilant in our oversight and
focus on safety.
So I look forward to hearing the information from the
witnesses that is available for us today and I also commend
yesterday's Secretary Chao's indication that she will seek a
previously authorized authority by the last 2018 FAA bill which
authorizes the establishment of a special committee of aviation
experts to review the recommendations on the Federal Aviation
Administration procedure process.
So I look forward to their analysis as I do the analysis of
all the investigations that are ongoing. Safety remains
paramount and I look forward to working with all my colleagues
on this very serious issue.
Senator Cruz. Thank you.
I'll now introduce each of the witnesses. The first witness
is Mr. Daniel K. Elwell, who is currently the Acting
Administrator of the Federal Aviation Administration. Before
becoming Acting Administrator, Mr. Elwell served as the Deputy
Administrator of the FAA from June 2017 to January 2018, and as
a Senior Advisor to the Secretary of Transportation Elaine Chao
prior to that.
Mr. Elwell began his career in aviation in the United
States Air Force where he received his Bachelor of Science
degree in International Affairs from the U.S. Air Force
Academy. He achieved the rank of Lieutenant Colonel and retired
from military service as a command pilot.
After retiring from the military, Mr. Elwell was a
commercial pilot for 16 years with American Airlines, flying
DC-10, MD-80, and Boeing 757-767 aircraft, and he then served
at the FAA as Assistant Administrator for Policy, Planning, and
Environment from 2006 to 2008.
From 2008 to 2013, Mr. Elwell served as Vice President of
the Aerospace Industries Association and from 2013 to 2015 as
Senior Vice President for Safety, Security, and Operations at
Airlines for America.
Our second witness is the Honorable Robert Sumwalt.
Following his nomination by President Trump and confirmation by
the Senate, Robert L. Sumwalt was sworn in as Chairman of the
National Transportation Safety Board on August 10, 2017.
Prior to joining the NTSB, Chairman Sumwalt was a pilot for
more than 30 years, during which time he flew for commercial
carriers that included Piedmont Airlines and U.S. Airways and
accumulated over 14,000 flight hours.
He began his tenure at the NTSB in August 2006 when he was
appointed to the Board by President George W. Bush and
designated as Vice Chairman. In 2011, he was reappointed for an
additional five-year term as a board member by President Obama.
Chairman Sumwalt earned his undergraduate degree from the
University of South Carolina and a Master's of Aeronautical
Science with Distinction from Embry-Riddle Aeronautical
University.
He has been awarded an Honorary Doctor of Science degree
from the University of South Carolina and an Honorary Doctorate
from Embry-Riddle.
Our third witness is the Honorable Calvin Scovel. Mr.
Scovel was sworn in as Inspector General of the Department of
Transportation on October 26, 2006.
Prior to joining the DOT, he served 29 years of Active Duty
service in the U.S. Marine Corps where he retired as a
Brigadier General.
During his military career, he served as a senior judge on
the U.S. Navy Marine Corps Court of Appeals and as an Assistant
Judge Advocate General of the Navy for Military Justice and as
a senior advisor for the 4th Marine Expeditionary Brigade.
His tenure as the DOT Inspector General has spanned the
Administrations of three Presidents and four Secretaries of
Transportation, during which time he has overseen audits and
investigations dealing with all aspects of the Nation's
transportation system.
Mr. Scovel received a law degree from Duke University, a
Bachelor's degree from the University of North Carolina at
Chapel Hill, a Master's degree from the Naval War College, and
he is a recipient of the Secretary of Transportation's Gold
Medal for Outstanding Achievement.
Administrator Elwell, we'll begin with your testimony.
STATEMENT OF HON. DANIEL K. ELWELL, ACTING ADMINISTRATOR,
FEDERAL AVIATION ADMINISTRATION
Mr. Elwell. Chairman Cruz, Chairman Wicker, Ranking Member
Sinema, Members of the Subcommittee, thank you for the
opportunity to appear before you today.
On behalf of the U.S. Department of Transportation and the
Federal Aviation Administration, I extend our deepest sympathy
to the families of the passengers and the crews of Ethiopian
Airlines 302 and Lion Air 610.
Safety is at the core of the FAA's mission. It is our first
priority. We have worked tirelessly to take a more proactive
data-driven approach to oversight that instills a safety above
all else culture at the FAA and the aviation community we
regulate.
This approach has made the U.S. aviation system the safest
in the world. Since 1997, the risk of a fatal commercial
aviation accident in the United States has been cut by 94
percent and in the past 10 years, we've experienced one
commercial airline passenger fatality in the United States in
over 90 million flights. That's a remarkable record, but we
know we must never stop pursuing improvement. We must never
become complacent because one fatality is one too many.
I speak to you today as both a former military and airline
pilot and as a public servant who has dedicated his life to the
pursuit of aviation safety. I am proud to lead the dedicated
professionals of the FAA who share the same passion and sense
of mission to make America's aviation system the safest.
Because we know our fact-based data-driven approach works,
we have applied this guiding principle in our response to the
recent Boeing 737 Max accidents.
I would like to provide you with an overview of the FAA's
certification and oversight processes as well as our current
actions with respect to the 737 Max and the next steps the FAA
will take to foster safety enhancements here and abroad.
Safety is not just a set of programs that can be
established or implemented. It is a way of living and working
and it requires the open and transparent exchange of
information. It takes collaboration, communication, and common
safety objectives to allow the FAA and the aviation community
to jointly identify system hazards and to implement safety
solutions.
Decades of experience have proven that this approach yields
knowledge that we would not otherwise obtain. FAA aircraft
certification has always relied on the exchange of information
and technical data with industry.
Some version of our certification process has been in place
for over 60 years. This does not mean that the process remains
static. To keep pace with technology and advances in safety,
the general regulations have been modified more than 90 times.
The rules applicable to large transport aircraft, like the 737
Max, have been amended more than 130 times.
The FAA focuses its efforts on those areas that present the
highest risk within the system. Our certification processes are
extensive, well-established, and have consistently produced
safe aircraft designs for decades.
Boeing first applied for an amended certificate for the 737
Max in January 2012. From initial application to final
certification, it took about 5 years. The FAA was fully
involved in the process, including participation in 133 of the
297 flight tests, some of which encompassed tests of the
aircraft MCAS system which has been the subject of recent
attention.
In the immediate aftermath of the Lion Air accident, the
FAA issued an Emergency Airworthiness Directive that requires
operators of the 737 Max to revise their flight manuals to
reinforce to flight crews how to recognize and respond to
uncommanded stabilizer trim movement.
The FAA continues to seek and evaluate any additional data
that might help us understand the underlying factors that led
to the recent 737 Max accidents.
We will take immediate and appropriate action based on the
facts. U.S. and international operators of the 737 Max are
relying on the FAA to get it right.
I want to assure you and everyone else that the FAA will go
wherever the facts lead us in our pursuit of safety. The 737
Max will return to service for U.S. carriers only when the
FAA's analysis of the facts and technical data indicate that it
is appropriate to do so.
In our quest for continuous safety improvement, the FAA
welcomes external review of our systems, processes, and
recommendations. As recent events have reminded us, aviation
safety has no borders or boundaries. The FAA is resolute in its
commitment to maintaining the U.S. air transportation system as
the gold standard of the world.
That concludes my statement. I'm ready to answer any
questions.
[The prepared statement of Mr. Elwell follows:]
Prepared Statement of Hon. Daniel K. Elwell, Acting Administrator,
Federal Aviation Administration
Chairman Cruz, Ranking Member Sinema, Members of the Subcommittee:
Thank you for the opportunity to appear before you today to discuss
the current state of aviation safety. On behalf of the United States
Department of Transportation and the Federal Aviation Administration,
we extend our deepest sympathy to the families of the victims of the
recent Ethiopian Airlines accident, as well as the Lion Air accident.
Safety is the core of the Federal Aviation Administration's mission
and our top priority. With the support of this Committee, we have
worked tirelessly to take a more proactive, data-driven approach to
oversight that instills a safety above all approach inside the FAA and
within the aviation community that we regulate. The result of this
approach is that the United States has the safest air transportation
system in the world. Since 1997, the risk of a fatal commercial
aviation accident in the United States has been cut by 95 percent. And
in the past ten years, there has only been one commercial airline
passenger fatality in the United States in over 90 million flights. But
a healthy safety culture requires commitment to continuous improvement.
Our commitment to safety and fact-based, data-driven decision
making has been the guiding principle in the FAA's response to the two
fatal accidents involving the Boeing 737 MAX airplane outside the
United States. Today, I would like to provide you with an overview of
the FAA's certification and oversight processes, our current actions
with respect to the 737 MAX, and the next steps that the FAA will take
to foster safety enhancements here and abroad.
The FAA is a Data-Driven Agency Focused on Safety
As the aerospace system and its components become increasingly more
complex, we know that our oversight approach needs to evolve to ensure
that the FAA remains the global leader in achieving aviation safety. In
order to maintain the safest air transportation system in the world,
during the past two decades the FAA has been evolving from a
prescriptive and more reactive approach for its safety oversight
responsibilities to one that is performance-based, proactive, centered
on managing risk, and focused on continuous improvement. A key part of
this transition has been the adoption of safety management systems, or
SMS, within the FAA. The evolution toward SMS began internally at the
FAA more than 15 years ago, starting with the FAA's Air Traffic
Organization and expanding across the FAA to include all of our lines
of business. Consistent with recommendations of the International Civil
Aviation Organization (ICAO), we have been working with industry
towards implementation of SMS in various sectors. For example, as of
March 9, 2018, scheduled commercial air carriers, regulated under 14
CFR part 121, are required to have an SMS.
Safety is not just a set of programs that can be ``established'' or
``implemented.'' It is a way of living and working, and it requires the
open and transparent exchange of information. We know that it takes
collaboration, communication, and common safety objectives to allow the
FAA and the aviation community to come together, to identify system
hazards, and to implement safety solutions. This approach gives us
knowledge that we would not otherwise have about events and risks.
Sharing safety issues, trends, and lessons learned is critical to
recognizing whatever might be emerging as a risk in the system. The
more data we have, the more we can learn about the system, which in
turn allows us to better manage and improve the system.
To be clear, the SMS approach does not diminish the FAA's role as a
safety regulator. Any party that the FAA regulates remains responsible
for compliance with the FAA's regulatory standards, and the FAA does
not hesitate to take enforcement action when it is warranted.
Aircraft Certification
One of the FAA's core functions, aircraft certification, has always
relied on the exchange of information and technical data. The FAA
certifies the design of aircraft and components that are used in civil
aviation operations. Some version of our certification process has been
in place and served us well for over 60 years. This does not mean the
process has remained static. To the contrary, since 1964, the
regulations covering certification processes have been under constant
review. As a result, the general regulations have been modified over 90
times, and the rules applicable to large transport aircraft, like the
Boeing 737 MAX, have been amended over 130 times. The regulations and
our policies have evolved in order to adapt to an ever-changing
industry that uses global partnerships to develop new, more efficient,
and safer aviation products and technologies.
The FAA focuses its efforts on areas that present the highest risk
within the system. The FAA reviews the applicant's design descriptions
and project plans, determines where FAA involvement will derive the
most safety benefit, and coordinates its intentions with the applicant.
When a particular decision or event is critical to the safety of the
product or to the determination of compliance, the FAA is involved
either directly or through the use of our designee system.
The designee program was originally authorized by Congress in 1958
and is critical to the success and effectiveness of the certification
process. Under this program, the FAA may delegate a matter related to
aircraft certification to a qualified private person. This is not self-
certification; the FAA retains strict oversight authority. The program
allows the FAA to leverage its resources through delegation. Last fall,
Congress specifically directed the FAA to make full use of this
authority in the FAA Reauthorization Act of 2018. In aircraft
certification, both individual and organizational designees support the
FAA. The FAA determines the level of involvement of the designees and
the level of FAA participation needed based on many variables. These
variables include the designee's understanding of the compliance
policy; consideration of any novel or unusual certification areas; or
instances where adequate standards may not be in place.
The Organization Designation Authorization (ODA) program is the
means by which the FAA may authorize an organization to act as a
representative of the FAA, allowing that organization to conduct
inspections and tests and issue certificates on behalf of the FAA.
Currently, there are 79 ODA holders. ODA certification processes allow
an applicant greater flexibility and control over schedules than
applicants whose projects are directly managed by the FAA. The FAA has
a rigorous process for issuing an ODA. ODA holders must have
demonstrated experience and expertise in FAA certification processes, a
qualified staff, and an FAA-approved procedures manual before they are
appointed. The procedures manual defines an ODA holder's authority and
limitations, and identifies the functions it may perform.
The FAA determines its level of involvement on a project-by-project
basis. There are many issues that will always require direct FAA
involvement, including equivalent level of safety determinations, and
rulemakings required to approve special conditions. The FAA may choose
to be involved in other project areas after considering factors such as
our confidence in the applicant, the applicant's experience, the
applicant's internal processes, and confidence in the designees.
Something that is not well understood about the certification
process is that it is the applicant's responsibility to ensure that an
aircraft conforms to FAA safety regulations. It is the applicant who is
required to develop aircraft design plans and specifications, and
perform the appropriate inspections and tests necessary to establish
that an aircraft design complies with the regulations. The FAA is
responsible for determining that the applicant has shown that the
overall design meets the safety standards. We do that by reviewing data
and by conducting risk-based evaluations of the applicant's work.
The FAA is directly involved in the testing and certification of
new and novel features and technologies. When a new design, or a change
to an existing design, of aircraft is being proposed, the designer must
apply to the FAA for a design approval. While an applicant usually
works on its design before discussing it with the FAA, we encourage
collaborative discussions well in advance of presenting a formal
application. Once an applicant approaches us, a series of meetings are
held both to familiarize the FAA with the proposed design, and to
familiarize the applicant with the certification requirements. A number
of formal and informal meetings are held on issues ranging from
technical to procedural. Once the application is made, issue papers are
developed to provide a structured way of documenting the resolution of
technical, regulatory, and administrative issues that are identified
during the process.
Once the certification basis is established for a proposed design,
the FAA and the applicant develop and agree to a certification plan and
initial schedule. In order to receive a type certificate, the applicant
must conduct an extensive series of tests and reviews to show that the
product is compliant with existing standards and any special
conditions, including lab tests, flight tests, and conformity
inspections. These analyses, tests, and inspections happen at a
component-level and an airplane-level, all of which are subject to FAA
oversight. If the FAA finds that a proposed new type of aircraft
complies with safety standards, it issues a type certificate. Or, in
the case of a change to an existing aircraft design, the FAA issues an
amended type certificate.
Facts Concerning the Boeing 737 MAX
The certification processes described above are extensive, well-
established, and have consistently produced safe aircraft designs for
decades. The Boeing Company has designed and built 14 variations of its
original model 737 since the FAA issued the original type certificate
in 1967. The FAA followed its standard procedures in determining that
the 737 MAX project would qualify as an amended type certificate
project, and identifying what items would be delegated to the Boeing
ODA to approve and which would be retained by the FAA for approval.
Boeing first applied for an amended type certificate for this aircraft
in January 2012. As a result of regular meetings between the FAA and
Boeing teams, the FAA determined in February 2012 that the project
qualified as an amended type certificate project eligible for
management by the Boeing ODA. The FAA was directly involved in the
System Safety Review of the Maneuvering Characteristics Augmentation
System (MCAS).
The process from initial application to final certification took
five years; the FAA added the 737 MAX to the 737 type certificate in
March 2017. The process included 297 certification flight tests, some
of which encompassed tests of the MCAS functions. FAA engineers and
flight test pilots were involved in the MCAS operational evaluation
flight test. The certification process was detailed and thorough, but,
as is the case with newly certified products, time yields more data to
be applied for continued analysis and improvement. As we obtain
pertinent information, identify potential risk, or learn of a system
failure, we analyze it, we find ways to mitigate the risk, and we
require operators to implement the mitigation. And that is what has
happened in the case of the 737 MAX.
737 MAX Accidents and the Decision to Ground the Fleet
On October 29, 2018, a Boeing 737 MAX operated by Lion Air as
flight JT610 crashed after taking off from Soekarno-Hatta Airport in
Jakarta, Indonesia. Flight JT610 departed from Jakarta with an intended
destination of Pangkal Pinang, Indonesia. It departed Jakarta at 6:20
a.m. (local time), and crashed into the Java Sea approximately 13
minutes later. One hundred and eighty-four passengers and five
crewmembers were on board. There were no survivors. An Indonesian-led
investigation into the cause of this accident is ongoing, supported by
the National Transportation Safety Board (NTSB), FAA, and Boeing.
On November 7, 2018, based on all available and relevant
information, including evidence from the Lion Air accident
investigation and analysis performed by Boeing, the FAA issued an
Emergency Airworthiness Directive. The airworthiness directive requires
operators of the 737 MAX to revise their flight manuals to reinforce to
flight crews how to recognize and respond to uncommanded stabilizer
trim movement and MCAS events. The FAA continued to evaluate the need
for software and/or other design changes to the aircraft including
operating procedures and training as additional information was
received from the ongoing Lion Air accident investigation. On January
21, 2019, Boeing submitted a proposed MCAS software enhancement to the
FAA for certification. To date, the FAA has tested this enhancement to
the 737 MAX flight control system in both the simulator and the
aircraft. The testing, which was conducted by FAA flight test engineers
and flight test pilots, included aerodynamic stall situations and
recovery procedures. The FAA's ongoing review of this software
installation and training is an agency priority, as will be the roll-
out of any software, training, or other measures to operators of the
737 MAX.
On March 10, 2019, Ethiopian Airlines flight ET302, also a Boeing
737 MAX, crashed at 8:44 a.m. (local time), six minutes after takeoff.
The flight departed from Bole International Airport in Addis Ababa,
Ethiopia with an intended destination of Nairobi, Kenya. The accident
site is near Bishoftu, Ethiopia. One hundred and forty-nine passengers
and eight crewmembers were on board. None survived. An Ethiopian-led
investigation into the cause of this accident is ongoing, supported by
the NTSB, FAA, and Boeing.
Following the second accident, the FAA gathered all of the data it
had and continued to review information from the investigation as it
became available. On March 11, 2019, the FAA issued a Continuous
Airworthiness Notification to the International Community (CANIC) for
737 MAX operators. The CANIC included a list of all of the activities
the FAA had completed in support of the continued operational safety of
the 737 MAX fleet. These activities included the airworthiness
directive issued on November 7, 2018, ongoing oversight of Boeing's
flight control system enhancements, and updated training requirements
and flight crew manuals.
After issuing the CANIC, the FAA continued to evaluate all
available data and aggregate safety performance from operators and
pilots of the 737 MAX, none of which provided any data to support
grounding the aircraft. The FAA's initial review of flight safety data
for U.S. operators showed no systemic performance issues and provided
no basis to order grounding the aircraft. This review included analysis
of recent Aviation Safety Reporting System reports that reference MCAS
and/or controllability issues with the Boeing 737 MAX. In no case did
the reporting party state that the problems experienced were due to the
MCAS system. Also, at that time, other civil aviation authorities had
not provided any data to the FAA that warranted action.
On March 13, 2019, however, the Ethiopian Airlines investigation
developed new information from the wreckage concerning the aircraft's
configuration just after takeoff that, taken together with newly
refined data from satellite-based tracking of the aircraft's flight
path, indicated some similarities between the Ethiopian Airlines and
Lion Air accidents that warranted further investigation of the
possibility of a shared cause that needed to be better understood and
addressed. Accordingly, the FAA made the decision to ground all 737 MAX
airplanes operated by U.S. airlines or in U.S. territory pending
further investigation, including examination of information from the
aircraft's flight data recorders and cockpit voice recorders.
Next Steps
The FAA will continue to support the ongoing Lion Air and Ethiopian
Airlines accident investigations, review the evidence and data
obtained, and take immediate and appropriate action based on the facts.
U.S. and international operators of the 737 MAX are relying on the FAA
to get it right. I want to assure this Committee and everyone else
concerned that the FAA will go wherever the facts lead us, in the
interest of safety. The 737 MAX will return to service for U.S.
carriers and in U.S. airspace only when the FAA's analysis of the facts
and technical data indicate that it is appropriate. In our quest for
continuous safety improvement, the FAA welcomes external review of our
systems, processes, and recommendations. We will work with the newly
established Special Committee to Review FAA's Aircraft Certification
Process, cooperate fully with the Inspector General's review, and
continue our work with the congressionally-mandated Safety Oversight
and Certification Advisory Committee and ODA Expert Review Panel.
As recent events have reminded us, aviation does not have borders
or boundaries. The FAA is focused on continuous safety improvement here
at home and internationally through our ongoing engagement with other
civil aviation authorities and industry stakeholders throughout the
world. Aviation remains the safest mode of transportation globally, and
we promote this level of safety by sharing issues, trends, and lessons
learned throughout the world. The United States is the gold standard in
aviation safety. The FAA is resolute in its commitment to maintaining
that standard.
This concludes my prepared statement. I will be happy to answer
your questions.
Senator Cruz. Thank you.
Mr. Sumwalt.
STATEMENT OF HON. ROBERT L. SUMWALT III, CHAIRMAN, NATIONAL
TRANSPORTATION SAFETY BOARD
Mr. Sumwalt. Thank you, Chairman Wicker, Chairman Cruz,
Ranking Member Cantwell, Ranking Member Sinema, and Members of
the Subcommittee.
Thank you for allowing the NTSB to testify today about this
very important topic.
As you are well aware, in the past five months, there have
been two crashes involving the Boeing 737 Max and tragically
these two accidents have claimed 346 lives.
My testimony this afternoon will focus on the NTSB's
involvement with each of these crash investigations.
Now unlike the NTSB's involvement in domestic aviation
accidents where we have the statutory responsibility to
investigate each and every accident that occurs in this
country, our involvement with international investigations is
vastly different.
The NTSB's role in accidents outside the U.S. is governed
by Annex 13 to the Convention on International Civil Aviation,
to which 192 countries, including the U.S., are signatories.
Annex 13 states that a safety investigation is to be led by
the country in which the accident occurs, known as the state of
occurrence. Thus, the National Transportation Safety Committee
of Indonesia is leading the investigation into last year's Lion
Air crash, and likewise the Ethiopia Accident Investigation
Bureau is leading the investigation into this month's Ethiopian
Airlines crash.
When the accident involves a U.S.-operated or U.S.-
registered aircraft or U.S.-designed or manufactured aircraft,
as these aircraft were, the NTSB appoints an accredited
representative. This is a highly skilled NTSB investigator
whose purpose is to coordinate the input of all U.S. interests,
including the NTSB, the FAA, and companies, such as
manufacturers, and others that can provide technical
assistance.
It's important to note that the state of occurrence leads
the investigation and controls the release of information from
that investigation, not the NTSB.
Although the state of occurrence is responsible for leading
the investigation, NTSB participation in foreign accident
investigations enables safety deficiencies to be promptly
addressed by the FAA, the manufacturer, or the operator as well
as through NTSB safety recommendations, when necessary.
Following last year's Lion Air crash, we immediately
dispatched investigators to Indonesia to participate in the
Indonesian Government's investigation. An NTSB investigator was
stationed onboard one of the search vessels to help identify
recovered aircraft components.
Once the cockpit voice recorder was recovered in January,
we recalled four investigators who were furloughed during the
partial government shutdown. Their role was to assist with the
recorder download and analysis.
We responded immediately to the Ethiopian Airlines crash by
sending a team of investigators to Ethiopia and once the
recorders were sent to our aviation counterparts in France, the
BEA, we dispatched investigators to France to assist with the
recorder download and readout.
Because the U.S. is the state of design and certification
of the Boeing 737, we are also examining the U.S. design
certification process as part of our participation in these
foreign-led investigations. As always, if we uncover safety
deficiencies, we are poised to quickly issue safety
recommendations.
Now here at home, the scheduled passenger airlines have
displayed a remarkable safety record over the past decade but
as we know too well at the NTSB, complacency is an unforgiving
enemy.
My written testimony outlines other areas of NTSB aviation-
related concerns which I've submitted for the record, and I'll
be delighted to answer questions about those issues as well as
the issue at hand.
Thank you very much.
[The prepared statement of Mr. Sumwalt follows:]
Prepared Statement of Hon. Robert L. Sumwalt III, Chairman,
National Transportation Safety Board
Good afternoon, Chairman Cruz, Ranking Member Sinema, and the
Members of the Subcommittee. Thank you for inviting the National
Transportation Safety Board (NTSB) to testify before you today.
The NTSB is an independent Federal agency charged by Congress with
investigating every civil aviation accident in the United States and
significant accidents in other modes of transportation--highway, rail,
marine, and pipeline. We determine the probable cause of the accidents
we investigate, and we issue safety recommendations aimed at preventing
future accidents. In addition, we conduct special transportation safety
studies and special investigations and coordinate the resources of the
Federal Government and other organizations to assist victims and their
family members who have been impacted by major transportation
disasters.
Our Office of Aviation Safety investigates all civil domestic air
carrier, commuter, and air taxi accidents; general aviation accidents;
and certain public-use aircraft accidents, amounting to approximately
1,400 investigations annually. We also participate in the investigation
of major airline accidents in foreign countries that involve U.S.
carriers, US-manufactured or -designed equipment, or US-registered
aircraft.
This testimony will provide information regarding our role in
international investigations and our current participation in both
recent accidents involving Boeing 737 MAX 8 (MAX 8) aircraft in
Indonesia and Ethiopia. I will also address the state of aviation
safety from the NTSB's perspective based on our investigations,
including a description of safety issues we have identified and
recommendations we have made, as well as a description of the work we
are doing with emerging transportation technologies in aviation.
Foreign Investigations of Boeing 737-MAX 8 Crashes
The NTSB participates in the investigation of aviation accidents
and serious incidents outside the United States in accordance with the
Chicago Convention of the International Civil Aviation Organization
(ICAO) and the Standards and Recommended Practices (SARPS) provided in
Annex 13 to the Convention.\1\ If an accident or serious incident
occurs in a foreign state involving a civil aircraft of U.S. Registry,
a U.S. operator, or an aircraft of U.S. design or U.S. manufacture,
where the foreign state is a signatory to the ICAO Convention, that
state is responsible for the investigation and controls the release of
all information regarding the investigation.
---------------------------------------------------------------------------
\1\ ICAO is a UN specialized agency, which manages the
administration and governance of the Convention on International Civil
Aviation (Chicago Convention), (https://www.icao.int/about-icao/Pages/
default.aspx).
---------------------------------------------------------------------------
In accordance with the ICAO Annex 13 SARPS, upon receipt of a
formal notification of the accident or serious incident that may
involve significant issues, the NTSB may designate a U.S. Accredited
Representative and appoint advisors to carry out the obligations,
receive the investigative information and updates in accordance with
the Annex, provide consultation, and receive safety recommendations
from the state of occurrence. The advisors may include NTSB
investigators with subject matter expertise, as well as others from
U.S. manufacturers, operators, and the Federal Aviation Administration
(FAA).
The key objectives of our participation in international aviation
accident investigations are to:
Identify safety deficiencies affecting U.S. aviation
interests;
Capture safety lessons learned to prevent accidents in the
US; and
Enable credible and comprehensive accident investigations
where U.S. interests are concerned.
Given the international nature of air transportation and the
leading role the United States plays in developing aviation
technologies, our participation in foreign investigations is essential
to enhancing aviation safety worldwide. In 2018, we appointed
Accredited Representatives to 324 international investigations and
traveled to support work on 17 of these investigations.\2\
---------------------------------------------------------------------------
\2\ There were 202 accidents in 2018 where the NTSB appointed an
Accredited Representative, 97 incidents, and 25 other safety-related
occurrences. NTSB traveled in support of 8 of these accidents, 8
incidents, and one safety-related occurrence.
---------------------------------------------------------------------------
On October 29, 2018, a MAX 8, operated by Lion Air, crashed into
the Java Sea shortly after takeoff from Soekamo-Hatta International
Airport, in Jakarta, Indonesia. All 189 passengers and crew on board
died. The National Transportation Safety Committee of Indonesia is
leading the investigation and released a preliminary report on November
27, 2018.\3\ On March 10, 2019, a MAX 8, operated by Ethiopian
Airlines, crashed after takeoff from Addis Ababa Bole International
Airport in Ethiopia. All 157 passengers and crew, including 8 American
citizens, died. The investigation is being led by the Ethiopia Accident
Investigation Bureau.
---------------------------------------------------------------------------
\3\ National Transportation Safety Committee of Indonesia,
Preliminary Report No. KNKT.18.10.35.04.
---------------------------------------------------------------------------
Because the MAX 8 was designed and manufactured in the US, in
accordance with ICAO Annex 13, the U.S. has a right to participate in
both of these investigations. Accordingly, the NTSB appointed
Accredited Representatives to assist both of the ongoing foreign
investigations involving MAX 8 aircraft.
Following last year's Lion Air crash, the NTSB immediately
dispatched investigators to Indonesia to participate in the Indonesian
government's investigation. During the search for the critical ``black
boxes''--flight data recorder (FDR) and cockpit voice recorder (CVR)--
an NTSB investigator was stationed onboard one of the search vessels.
Once the CVR was recovered on January 14, 2019, NTSB recalled four
investigators from furlough due to the partial government shutdown to
assist with proper transcription of that recorder's content.\4\
---------------------------------------------------------------------------
\4\ Due to lapse of appropriations from December 22, 2018, through
January 25, 2019, the NTSB furloughed all investigative staff. In
accordance with provisions of the Anti-Deficiency Act (including
sections 1341(a)(1)(B) and 1342 of Title 31, United States Code),
allowable agency functions were limited to those where ``failure to
perform those functions would result in an imminent threat to the
safety of human life or the protection of property.'' Due to the
potential safety issues associated with the Lion Air crash, the NTSB
responded by recalling from furlough four investigative staff to
participate in the CVR readout.
---------------------------------------------------------------------------
In response to the Ethiopian Airlines crash, the NTSB also
appointed an Accredited Representative, and dispatched him with a team
of investigators to Ethiopia. Furthermore, we sent recorder, flight
crew operations and human factors investigators to France once the
recorders were sent to the Bureau d'Enquetes et d'Analyses pour la
Securite de l'Aviation Civile (BEA) for download and readout.
Also in accordance with ICAO Annex 13, technical advisors from the
FAA, Boeing, and General Electric have accompanied NTSB investigators
to the Lion Air and Ethiopian Air accident sites to provide their
specialized technical knowledge regarding the aircraft and its systems.
Although the NTSB is actively involved in these investigations,
ICAO Annex 13 requires that, as the states of occurrence, Indonesia and
Ethiopia are responsible for their respective investigations. As such,
they control the release of all investigative information related to
those accidents. Although the state of occurrence is responsible for
leading the investigation, NTSB participation in foreign accident
investigations enables safety deficiencies to be promptly addressed by
the FAA, the manufacturer, or the operator, as well as through NTSB
safety recommendations when necessary. As the state of design and
certification of the aircraft involved in these accidents, we are
examining the U.S. design certification process to ensure any
deficiencies are captured and addressed, potentially up to and
including NTSB safety recommendations.
Commercial Aviation Safety in the United States
For the last decade, the U.S. aviation system has experienced a
record level of safety, and an overall decline in the number of US-
registered civil aviation accidents.\5\ Aviation deaths in the United
States decreased from 412 in 2016 to 350 in 2017. Nearly 94 percent of
aviation fatalities (330 instances in 2017) occur in general aviation
accidents, with the remainder primarily in Title 14 Code of Federal
Regulations (CFR) Part 135 operations, which includes charters, air
taxis, and air medical services flights. Until 2018, there had been no
passenger fatalities as a result of accidents involving U.S. air
carriers operating under the provisions of 14 CFR Part 121 since the
crash of Colgan Air flight 3407 in 2009.\6\ Over the last several
decades, significant advances in technology, important legislative and
regulatory changes, and more comprehensive crew training have
contributed to the current level of aviation safety. Following the
Colgan Air crash, in 2010 Congress required FAA to make substantive
regulatory changes addressing airline pilot fatigue, as well as airline
pilot qualifications; FAA pilot records; airline flight crew and
dispatcher training; FAA oversight and surveillance of air carriers;
pilot mentoring, professional development and leadership; and flight
crewmember pairing and crew resource management techniques.\7\ There
are still provisions related to NTSB recommendations from our
investigation of flight 3407 that have not been implemented, such as
the creation of a pilot training records database. We continue to see
accidents and incidents that remind us of the need to be ever-vigilant
in improving safety.
---------------------------------------------------------------------------
\5\ National Transportation Safety Board, 2017 preliminary aviation
statistics. Accident data for calendar year 2018 are still being
validated and have not yet been released.
\6\ National Transportation Safety Board, Loss of Control on
Approach, Colgan Air, Inc., Operating as Continental Connection Flight
3407, Bombardier DHC 8 400, N200WQ, Rpt. No. AAR-10/01 (Washington, DC:
NTSB, 2012). In 2013, there were two fatal accidents involving
nonscheduled cargo flights operating under Part 121--National Air Cargo
crash after takeoff at Bagram Air Base, Afghanistan, and United Parcel
Service flight 1354 crash during approach in Birmingham, Alabama.
\7\ The Airline Safety and Federal Aviation Administration
Extension Act of 2010 (Pub. L. 111-216). Congressional Research
Service, Federal Civil Aviation Programs: In Brief, R42781.
---------------------------------------------------------------------------
Most Wanted List--Improve the Safety of Part 135 Aircraft Flight
Operations
On February 4, 2019, we announced our Most Wanted List of
Transportation Safety Improvements for 2019-2020.\8\ This list
identifies 10 focus areas for transportation safety improvements based
on safety issues identified through our investigations. Many of the
issues on the Most Wanted List address multimodal challenges for
improving safety, including many that have been identified in some of
our aviation accident investigations, such as alcohol and other drug
impairment, distraction, occupant protection, fatigue, medical fitness,
and safe shipment of hazardous materials. One issue area is specific to
aviation: improving the safety of Part 135 aircraft flight operations.
---------------------------------------------------------------------------
\8\ National Transportation Safety Board, 2019-2020 Most Wanted
List.
---------------------------------------------------------------------------
Regardless of the purpose of the flight or the type of aircraft,
all passenger-carrying flights should be safe. However, currently, air
medical service, air taxi, charter, and on-demand operators are not
required to meet some of the same safety requirements as commercial
airline operators. On March 12, 2019, the NTSB issued three new safety
recommendations and reiterated six previous safety recommendations to
the FAA as a result of the investigation of an accident that occurred
on May 15, 2017, in Teterboro, New Jersey.\9\ In this accident, a
Learjet 35A, operated by a Part 135 operator, departed controlled
flight while on a circling approach to Teterboro Airport, and impacted
a commercial building and parking lot. The pilot-in-command and the
second-in-command died; there were no passengers on the aircraft and no
one on the ground was injured. While the aircraft was operating as a
Part 91 positioning flight at the time of the accident, the accident
raised concerns about the safety of Part 135 operations and the need
for effective flight data monitoring (FDM) programs, safety management
systems (SMS), procedures to identify pilots who do not comply with
standard operating procedures, programs to address pilots with
performance deficiencies, and the need for enhanced guidance for crew
resource management training and leadership training for upgrading
captains.
---------------------------------------------------------------------------
\9\ National Transportation Safety Board, Departure From Controlled
Flight, Trans-Pacific Air Charter, LLC, Learjet 35A, N452DA, Teterboro,
New Jersey (Abstract), Rpt. No. AAR-19/02 (Washington, D.C.: NTSB,
2019)
---------------------------------------------------------------------------
The safety issues identified in the Teterboro accident were not
new; the NTSB previously identified these issues and made
recommendations to address FDM equipment and programs and SMS as a
result of the investigation of the November 10, 2015, crash of
Execuflight flight 1526 in Akron, Ohio.\10\ The recommendations were
reiterated following the October 26, 2016, crash of Ravn Connect flight
3153 in Togiak, Alaska, and we have again reiterated these important
recommendations.\11\ A list of the safety recommendations we have made
regarding these operations is appended to this testimony.
Implementation of these and other recommendations could prevent or
mitigate many of the Part 135 crashes that the NTSB investigates, and
that is why improving the safety of Part 135 aircraft operations is
included on the Most Wanted List.
---------------------------------------------------------------------------
\10\ National Transportation Safety Board, Crash During
Nonprecision Instrument Approach to Landing, Execuflight Flight 1526,
British Aerospace HS 125-700A, N237WR, Rpt. No. AAR 16/02 (Washington,
D.C.: NTSB 2016).
\11\ National Transportation Safety Board, Collision with Terrain,
Hageland Aviation Services, Inc., dba Ravn Connect Flight 3153, Cessna
208B, N208SD, Rpt. No. AAR 18/02 (Washington, D.C.: NTSB 2018).
---------------------------------------------------------------------------
Most Wanted List--Reduce Fatigue-Related Accidents
Fatigue is a pervasive problem in transportation that degrades a
person's ability to stay awake, alert, and attentive to the demands of
safely controlling a vehicle, vessel, aircraft, or train. By including
``Reduce Fatigue-Related Accidents'' on our Most Wanted List, we are
calling for a comprehensive approach to combatting fatigue in
transportation, focusing on research, education, and training;
technology; sleep disorder treatment; hours-of-service regulations; and
on-and off-duty scheduling policies and practices.
Over the last 20 years, NTSB has investigated many air carrier
accidents involving fatigued flight crews, including Colgan Air flight
3407. As a result of that investigation, we recommended that the FAA
require operators to address fatigue risks associated with
commuting.\12\ The FAA's final rule for Fatigue Risk Management Plans
for Part 121 Air Carriers did not address this recommendation. In 2006,
we issued a safety recommendation to the FAA as a result of our
investigation of the October 19, 2004 aviation crash in Kirksville,
Missouri, to ``Modify and simplify the flight crew hours-of-service
regulations to take into consideration factors such as length of duty
day, starting time, workload and other factors shown by recent
research, scientific evidence, and current industry experience to
affect crew alertness.'' \13\ On January 4, 2012, the FAA published a
final rule which prescribed new flight-and duty-time regulations for
all flight crewmembers and certificate holders conducting passenger
operations under Part 121, but excluded operators who conduct cargo
operations.\14\ The NTSB disagrees with this exclusion, as many of the
fatigue-related accidents that we have investigated over the years
involved cargo operators. We also believe that, because of the time of
day that cargo operations typically occur, such operations are in
greater need of these requirements. The NTSB believes that the FAA
should include all Part 121, including cargo operations, under these
requirements.
---------------------------------------------------------------------------
\12\ National Transportation Safety Board, Safety Recommendation A-
10-016.
\13\ National Transportation Safety Board, Collision with Trees and
Crash Short of the Runway, Corporate Airlines Flight 5966 BAE Systems
BAE-J3201, N875JX Kirksville, Missouri, Rpt. No. AAR-06/01 (Washington,
D.C.: NTSB, 2006. Safety Recommendation A-06-010.
\14\ Federal Aviation Administration, Flightcrew Member Duty and
Rest Requirements, 14 CFR Parts 117, 119, and 121.
---------------------------------------------------------------------------
Current Part 121 Investigations
The NTSB is currently investigating two fatal accidents involving
Part 121 operations.
Southwest Flight 1380 Engine Failure--Philadelphia, Pennsylvania
On April 17, 2018, Southwest Airlines flight 1380, a Boeing 737-
700, experienced a failure of the left engine after departing New
York's LaGuardia Airport.\15\ A fan blade in the left engine failed,
which resulted in the loss of the engine inlet and cowling. Fragments
from the cowling and engine inlet struck the fuselage and a window,
causing a rapid depressurization. The crew conducted an emergency
descent and diverted to Philadelphia International Airport. There were
144 passengers and five crewmembers onboard. One passenger was fatally
injured and eight passengers had minor injuries.
---------------------------------------------------------------------------
\15\ National Transportation Safety Board, Southwest Airlines
Engine Accident.
---------------------------------------------------------------------------
On November 14, 2018, the NTSB held an investigative hearing to
obtain more information regarding the engine fan blade design and
development history, engine fan blade inspection methods and
procedures, and engine fan blade containment design and certification
criteria.\16\ The investigation into this accident is ongoing.
---------------------------------------------------------------------------
\16\ National Transportation Safety Board, Investigative Hearing:
CFM International engine failure on Southwest Airlines flight 1380.
---------------------------------------------------------------------------
Atlas Air Flight 3591 Crash--Baytown, Texas
On February 23, 2019, Atlas Air flight 3591, a Boeing 767-375BCF,
entered a rapid descent from 6,000 feet and crashed into Trinity Bay,
about 40 miles southeast of its intended destination, George Bush
Intercontinental Airport, in Houston, Texas.\17\ The two pilots and one
nonrevenue jumpseat pilot were killed, and the airplane was highly
fragmented after impact. The flight was being operated as a Part 121
domestic cargo flight, which originated from Miami International
Airport.
---------------------------------------------------------------------------
\17\ National Transportation Safety Board, Atlas Air #3591 crashed
into Trinity Bay.
---------------------------------------------------------------------------
Based on data from the cockpit voice recorder, the flight data
recorder, radar data, and other sources, the flight was normal from
Miami to the Houston terminal area. As the flight approached Houston,
the pilots were advised of an area of light to heavy precipitation
along the flight route and that they could expect vectors around the
weather. About one minute before the crash, data indicated some small
vertical accelerations during descent. Shortly after, the engine thrust
increased to maximum thrust, and the airplane pitched nose up. The
airplane then pitched nose down over the next 18 seconds in response to
nose-down elevator deflection. The stall warning (stick shaker) did not
activate. Data indicated that the airplane entered a rapid descent,
reaching an airspeed of about 430 knots. A security camera video
captured the airplane in a steep, generally wings-level attitude until
impact with the bay. The investigation into this accident is ongoing.
Emerging Transportation Technologies
Advances in technology are transforming transportation and hold
promise for improving transportation safety, but they also pose new
challenges. Among those advancing technologies are commercial space
transportation and unmanned aircraft systems (UASs).
Commercial Space
We have been involved in commercial space accident investigations
for over 25 years, since leading the investigation of a procedural
anomaly associated with the launch of an Orbital Sciences Corporation
Pegasus expendable launch vehicle in 1993.\18\ Most recently, we led
the investigation of the fatal in-flight breakup of SpaceShipTwo in
October 2014.\19\ Foremost among the safety issues identified in the
2014 accident was the need to consider and protect against human error
for safe manned spaceflight, which is the responsibility of designers,
operators, and regulators. We made recommendations to the FAA and the
commercial spaceflight industry to establish human factors guidance for
commercial space operators and to strengthen the FAA's evaluation
process for experimental permit applications by promoting stronger
collaboration between FAA technical staff and commercial space vehicle
operators.
---------------------------------------------------------------------------
\18\ National Transportation Safety Board, Commercial Space Launch
Incident, Launch Procedure Anomaly, Orbital Sciences Corporation,
Pegaus/SCD-1, Rpt. No. SIR 93/02 (Washington, D.C.: NTSB 1993).
\19\ National Transportation Safety Board. In-Flight Breakup During
Test Flight, Scaled Composites SpaceShipTwo, N339SS, Near Koehn Dry
Lake, California, October 31, 2014, Rpt. No. AAR 15/02 (Washington,
D.C.: NTSB 2015).
---------------------------------------------------------------------------
Our work in commercial space transportation supports our broader
mission of improving transportation safety through investigating
accidents and serious incidents, collaborating with others to conduct
outreach and education related to commercial space vehicles, and
developing and disseminating accident investigation techniques in
commercial space within the international community. To develop and
maintain the necessary investigative expertise and tools in this
emerging segment of transportation, we are focused on training for NTSB
staff and continuing outreach with commercial space stakeholders.
Unmanned Aircraft Systems
The growing number of UASs and reports of near-collisions with
manned aircraft have raised safety concerns regarding UAS integration
into the national airspace system. In August 2010, we revised our 14
CFR Part 830 regulations to indicate that accident and incident
notification requirements also apply to unmanned aircraft.\20\ An
advisory to operators was released in July 2016 clarifying the
reporting requirements (i.e., if there is death or serious injury, the
aircraft weighs more than 300 pounds and sustains substantial damage,
or other specific serious incidents occur).\21\
---------------------------------------------------------------------------
\20\ 49 CFR Sec. 830.2 (2010).
\21\ National Transportation Safety Board, Advisory to Operators of
Civil Unmanned Aircraft Systems in the United States, July 29, 2016.
---------------------------------------------------------------------------
On September 21, 2017, the pilot of a U.S. Army UH-60 helicopter
reported an in-flight collision with a small UAS just east of Midland
Beach, Staten Island, New York. The helicopter sustained damage to its
main rotor blade, window frame, and transmission deck. We determined
that the probable cause of the incident was the failure of the UAS
pilot to see and avoid the helicopter due to his intentional flight
beyond visual line of sight. Contributing to the incident was the UAS
pilot's incomplete knowledge of regulations and safe operating
practices.\22\ As the number and complexity of UAS operations continues
to grow, it is inevitable that the number of NTSB UAS investigations
will also increase.
---------------------------------------------------------------------------
\22\ National Transportation Safety Board, Inflight collision of
UAS and helicopter, Staten Island, NY.
---------------------------------------------------------------------------
We are also using UASs as an accident investigation tool in all
modes. The NTSB appreciates this Committee's and Congress' support of a
provision in our 2018 reauthorization that authorized the agency to
acquire small UASs for investigative purposes.\23\ UASs are rapidly
becoming a standard tool in the domestic and international accident
investigation community. Small UASs can be very rapidly deployed, which
allows wreckage fields to be documented quickly and thoroughly when the
accident area must be cleared expeditiously for safety or operational
purposes. In addition, small UASs can access unique points of view
useful to the investigator as well as areas otherwise inaccessible.
Data collected is shared immediately, allowing investigators, managers,
and support staff in distant locations instant access to accident site
information in order to help focus the investigation on critical
aspects of the accident.
---------------------------------------------------------------------------
\23\ 49 USC Sec. 1113(b)(1)(J) (2018).
---------------------------------------------------------------------------
Conclusion
Thank you again for the opportunity to be here today to discuss the
work that the NTSB is doing to make transportation safer. I will be
happy to answer any questions.
______
Appendix to NTSB Chairman Sumwalt's Testimony Concerning Commercial
Aviation Safety--Recommendations to Improve the Safety of Part 135
Aircraft Flight Operations
A-10-029 Open--Acceptable Alternate Response TO THE FEDERAL AVIATION
ADMINISTRATION: Require Title 14 Code of Federal Regulations Part 121,
135, and 91K operators to (1) routinely download and analyze all
available sources of safety information, as part of their flight
operational quality assurance program, to identify deviations from
established norms and procedures; (2) provide appropriate protections
to ensure the confidentiality of the deidentified aggregate data; and
(3) ensure that this information is used for safety-related and not
punitive purposes.
A-13-012 Open--Acceptable Response TO THE FEDERAL AVIATION
ADMINISTRATION: Require the installation of a crash-resistant flight
recorder system on all newly manufactured turbine-powered,
nonexperimental, nonrestricted-category aircraft that are not equipped
with a flight data recorder and a cockpit voice recorder and are
operating under Title 14 Code of Federal Regulations Parts 91, 121, or
135. The crash-resistant flight recorder system should record cockpit
audio and images with a view of the cockpit environment to include as
much of the outside view as possible, and parametric data per aircraft
and system installation, all as specified in Technical Standard Order
C197, ``Information Collection and Monitoring Systems.''
A-13-013 Open--Acceptable Response TO THE FEDERAL AVIATION
ADMINISTRATION: Require all existing turbine-powered, nonexperimental,
nonrestricted-category aircraft that are not equipped with a flight
data recorder or cockpit voice recorder and are operating under Title
14 Code of Federal Regulations Parts 91, 121, or 135 to be retrofitted
with a crash-resistant flight recorder system. The crash-resistant
flight recorder system should record cockpit audio and images with a
view of the cockpit environment to include as much of the outside view
as possible, and parametric data per aircraft and system installation,
all as specified in Technical Standard Order C197, ``Information
Collection and Monitoring Systems.''
A-15-007 Open--Unacceptable Response TO THE FEDERAL AVIATION
ADMINISTRATION: Require that all existing aircraft operated under Title
14 Code of Federal Regulations (CFR) Part 121 or 135 and currently
required to have a cockpit voice recorder and a flight data recorder be
retrofitted with a crash-protected cockpit image recording system
compliant with Technical Standard Order TSOC176a, ``Cockpit Image
Recorder Equipment,'' TSO-C176a or equivalent. The cockpit image
recorder should be equipped with an independent power source consistent
with that required for cockpit voice recorders in 14 CFR 25.1457.
A-15-008 Open--Unacceptable Response TO THE FEDERAL AVIATION
ADMINISTRATION: Require that all newly manufactured aircraft operated
under Title 14 Code of Federal Regulations (CFR) Part 121 or 135 and
required to have a cockpit voice recorder and a flight data recorder
also be equipped with a crash-protected cockpit image recording system
compliant with Technical Standard Order TSO-C176a, ``Cockpit Image
Recorder Equipment,'' or equivalent. The cockpit image recorder should
be equipped with an independent power source consistent with that
required for cockpit voice recorders in 14 CFR 25.1457.
A-16-034 Open--Acceptable Response TO THE FEDERAL AVIATION
ADMINISTRATION: Require all Title 14 Code of Federal Regulations Part
135 operators to install flight data recording devices capable of
supporting a flight data monitoring program.
A-16-035 Open--Acceptable Alternate Response TO THE FEDERAL AVIATION
ADMINISTRATION: After the action in Safety Recommendation A-16-34 is
completed, require all Title 14 Code of Federal Regulations Part 135
operators to establish a structured flight data monitoring program that
reviews all available data sources to identify deviations from
established norms and procedures and other potential safety issues.
A-16-036 Open--Acceptable Response TO THE FEDERAL AVIATION
ADMINISTRATION: Require all Title 14 Code of Federal Regulations Part
135 operators to establish safety management system programs.
A-17-035 Open--Acceptable Response TO THE FEDERAL AVIATION
ADMINISTRATION: Implement ways to provide effective terrain awareness
and warning system (TAWS) protections while mitigating nuisance alerts
for single-engine airplanes operated under Title 14 Code of Federal
Regulations Part 135 that frequently operate at altitudes below their
respective TAWS class design alerting threshold.
A-17-038 Open--Acceptable Response TO THE FEDERAL AVIATION
ADMINISTRATION: Expand the application of Federal Aviation
Administration Order 8900.1, volume 3, chapter 19, section 6, ``Safety
Assurance System: Flight Training Curriculum Segments,'' paragraphs 3-
1251(B) and 3-1252, which address controlled flight into terrain-
avoidance training programs for Title 14 Code of Federal Regulations
(CFR) Part 135 helicopter operations, to all 14 CFR Part 135
operations.
A-18-013 Open--Acceptable Response TO THE FEDERAL AVIATION
ADMINISTRATION: Although controlled flight into terrain (CFIT)-
avoidance training programs are not required by Federal regulation for
Title 14 Code of Federal Regulations Part 135 fixed-wing operations,
work with Part 135 operators in Alaska to improve any voluntarily
implemented training programs aimed at reducing the risk of CFIT
accidents involving continuation of flight under visual flight rules
(VFR) into instrument meteorological conditions, with special attention
paid to the human factors issues identified in recent Alaska accident
investigations, including, but not limited to, (1) the challenges of
flying in mountainous terrain in Alaska and low-altitude VFR flight in
an area subject to rapid changes in weather; and (2) limitations of the
Alaska infrastructure, particularly weather observations,
communications, and navigation aids.
A-18-014 Open--Acceptable Response TO THE FEDERAL AVIATION
ADMINISTRATION: Work with Title 14 Code of Federal Regulations Part 135
certificate holders that operate under visual flight rules in the
aircraft's required terrain awareness and warning system (TAWS) class
to (1) ensure that management and pilots are aware of the risks
associated with distraction (from continuous nuisance alerts) and
complacency (brought about by routine use of the terrain inhibit
feature); (2) develop plans for mitigating those risks and minimizing
nuisance alerts; and (3) develop procedures that specifically address
when pilots should test, inhibit, and uninhibit the TAWS alerts,
considering the operator's typical operations and the TAWS
manufacturer's guidance.
A-18-017 Open--Await Response TO THE FEDERAL AVIATION ADMINISTRATION:
Ensure that Alaska airports that are served by Title 14 Code of Federal
Regulations (CFR) Part 135 operators and have instrument approaches are
equipped with weather-reporting capabilities to enable instrument
flight rules operations in accordance with 14 CFR 135.225(a).
A-19-007 Open--Await Response TO THE FEDERAL AVIATION ADMINISTRATION:
Require all Title 14 Code of Federal Regulations Part 135 operators to
establish programs for flight crewmembers who have demonstrated
performance deficiencies or experienced failures during training and
administer additional oversight and training to address and correct
performance deficiencies.
A-19-008 Open--Await Response TO THE FEDERAL AVIATION ADMINISTRATION:
Develop guidance for Title 14 Code of Federal Regulations Part 135
operators to help them create and implement effective crew resource
management training programs.
Senator Cruz. Thank you.
Mr. Scovel.
STATEMENT OF HON. CALVIN L. SCOVEL III, INSPECTOR GENERAL, U.S.
DEPARTMENT OF TRANSPORTATION
Mr. Scovel. Chairman Wicker, Ranking Member Cantwell,
Chairman Cruz, Ranking Member Sinema, Members of the
Subcommittee, thank you for inviting me to testify on the
Federal Aviation Administration's Oversight of Commercial
Aviation.
As you know, FAA is charged with safely overseeing the
busiest and most complex aviation system in the world. Yet
recent accidents highlight important concerns about FAA's
safety oversight. Most notable are the two devastating crashes
of Boeing 737 Max 8 aircraft in Indonesia and Ethiopia.
In addition, last April, a Southwest Airlines engine
failure resulted in the first passenger fatality at a U.S. air
carrier in over 9 years.
On behalf of the Office of Inspector General, we grieve the
victims of these accidents and express our deep condolences to
their families.
Secretary Elaine L. Chao, along with several Members of
Congress, including Senator Blumenthal, recently requested that
my office audit FAA's certification process for the Max 8
aircraft. We appreciate the Secretary's and your continued
confidence in our independence and objectivity. We have already
begun this work and will keep you informed on our results.
Today, my statement will focus on our recent and ongoing
work related to a number of important aviation safety
challenges.
First, FAA must take steps to reduce hazards associated
with flight deck automation. Pilots now rely on automated
flight systems as much as 90 percent of the time. While
airlines have long used automation safely, FAA is responsible
for ensuring air carriers meet requirements for these systems.
This includes ensuring pilots are trained, tested, and
proficient in the use of automation.
Notably, FAA now requires U.S. commercial pilots to be
trained in how to respond to abnormal flight conditions, such
as recovering from a stall or other unexpected event. Air
carriers should have implemented these requirements earlier
this month. Providing effective oversight of this training will
be vital to maintain the margin of safety.
Second, FAA must remain vigilant as its systems and
strategies for safety oversight evolve. Over the years, FAA has
increasingly shifted toward working with industry to meet
shared safety goals.
For example, FAA now delegates more of its aircraft
certification to approved manufacturers through its
congressionally authorized Organization Designation
Authorization Program or ODA.
However, my office has identified weaknesses with FAA's
oversight of ODA. For example, in 2015, we reported that its
oversight was not based on risk. In response to our
recommendations, FAA plans to revamp its ODA oversight process
by the end of July 2019. Sustained management attention will
remain essential to ensure that ODA companies comply with
safety regulations.
In addition, FAA now requires air carriers to play a larger
role in identifying and mitigating safety risks. For example,
in 2015, FAA required U.S. commercial carriers to establish
safety management systems to proactively manage risks.
However, recent events, including last year's Southwest
engine failure, have raised concerns that FAA's oversight may
not ensure that carriers meet their responsibilities under
these systems.
FAA also introduced its new Compliance Program in 2015. The
program calls for FAA to work with air carriers to address the
root causes of safety violations rather than imposing
enforcement actions. This is a significant change in the way
FAA and the carriers conduct business.
As it works to leverage both collaboration and enforcement,
FAA must be able to accurately assess whether an air carrier is
willing and able to take timely corrective actions.
Finally, I want to note other critical safety areas that
require FAA's attention. For example, FAA must continue its
work to reduce safety risks in the air and on the ground at
airports, including preventing near-misses on the runway.
In addition, FAA faces challenges in safely integrating
unmanned aircraft systems in the same airspace as manned
aircraft. Furthermore, FAA must protect its flight-critical and
safety-critical IT systems from a growing number of cyber
threats, and, last, FAA can do more to ensure essential
aircraft parts, such as landing gear, meet safety standards by
carefully implementing the Suspected Unapproved Parts program.
As always, my office remains committed to supporting FAA
and the Secretary as they work to maintain aviation safety and
protect the traveling public.
This concludes my prepared statement. I'd be happy to
answer any questions you or members of the Subcommittee may
have.
[The prepared statement of Mr. Scovel follows:]
Prepared Statement of Hon. Calvin L. Scovel III, Inspector General,
U.S. Department of Transportation
Perspectives on Overseeing the Safety
of the U.S. Air Transportation System
Chairman Cruz, Ranking Member Sinema, and Members of the
Subcommittee:
Thank you for inviting me to testify on the state of aviation
safety and the Federal Aviation Administration's (FAA) oversight of
commercial aviation. FAA is charged with safely overseeing the busiest
and most complex air transportation system in the world, which carries
over 2.5 million people on approximately 45,000 flights every day.
However, recent events have brought new attention to FAA's safety
oversight and its regulatory role. Most notable are the two fatal
accidents involving Boeing 737 MAX 8 aircraft that occurred in October
2018 and earlier this month. The Office of Inspector General expresses
our deepest condolences to the families of the victims of these
accidents. A number of other incidents have also raised safety
concerns. These include the April 2018 Southwest Airlines engine
failure--which resulted in the first fatality at a U.S. commercial
passenger air carrier \1\ in over 9 years--and several safety incidents
at airports, such as the near miss of an Air Canada Flight in San
Francisco in July 2017.
---------------------------------------------------------------------------
\1\ This was the first passenger fatality at a part 121 air carrier
since February 12, 2009 (14 CFR Part 121, Operating Requirements:
Domestic, Flag, and Supplemental Operations).
---------------------------------------------------------------------------
As Secretary of Transportation Elaine L. Chao has stated, safety is
and must remain the Department's top priority. Last week, Secretary
Chao requested that our office audit the activities that resulted in
the certification of the Boeing 737 MAX 8 aircraft. In addition, we
have received requests from Congress to examine other related issues,
including FAA's decision-making process that led to grounding the MAX 8
aircraft in the United States. My office has already begun this work
and will keep you apprised of our results.
As the Nation's regulator of aviation safety, FAA is responsible
for effectively overseeing a vast range of safety-critical areas. To
its credit, FAA has taken steps in recent years to help its safety
efforts keep pace with a rapidly evolving and diverse aviation
industry. Yet, as my office's work has shown, both new and longstanding
safety issues present significant challenges to FAA's oversight of the
National Airspace System (NAS).
My testimony today will focus on FAA's efforts related to (1)
reducing hazards associated with flight deck automation, (2)
implementing FAA and industry's evolving safety oversight systems, and
(3) addressing other safety-critical watch items.
Summary
Notwithstanding the Nation's safety record, important safety
issues--both new and longstanding--need FAA's attention. First, with
pilots relying on automated flight systems as much as 90 percent of the
time, it is critical that FAA ensure that air carriers meet its
requirements for these systems, including training pilots on how to
respond to abnormal flight conditions when automation or other systems
fail. Second, FAA faces new challenges as its systems and strategies
for safety oversight evolve and air carriers take on a larger role in
identifying and mitigating safety risks. To maintain the highest level
of safety, FAA must implement effective risk-based oversight of
organizations that perform certification work on the Agency's behalf,
effectively leverage collaboration and enforcement, and maintain a
strong safety culture. At the same time, our recent and ongoing work
has also identified other watch areas that are essential to enhancing
oversight of the NAS. These include reducing safety risks on the ground
and in the air at airports, integrating Unmanned Aircraft Systems (UAS)
in the same airspace as manned aircraft, protecting safety-critical
information technology systems, and eliminating suspected unapproved
parts from the aviation supply chain.
Strengthening FAA Oversight To Reduce Hazards Associated With Flight
Deck Automation
Advances in aircraft automation have significantly contributed to
safety and changed the way airline pilots perform their duties. Rather
than manually flying an aircraft, pilots now monitor flight deck
systems. Generally, new automation technologies are added to gain
operational or efficiency advantages, such as reducing pilot workload,
adding more capability, increasing fuel economy, and allowing access to
airports surrounded by challenging terrain. FAA has estimated that
automation is used 90 percent of the time in flight.\2\ Figure 1 below
shows the advances in flight deck technology between the Boeing 737-200
(pictured left) and 737 MAX 8 aircraft (pictured right).
---------------------------------------------------------------------------
\2\ Estimates according to FAA senior officials, as noted in our
2016 report (see footnote 2).
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
---------------------------------------------------------------------------
Source: Copyright Boeing
While airlines have long used automation safely, our 2016 report
\3\ noted accidents in which pilots who typically fly with automation
made errors when confronted with an unexpected event or transitioning
to manual flying.\4\ As a result, reliance on automation is a growing
concern among industry experts, who have questioned whether pilots
receive enough training and experience to maintain manual flying
proficiency. In addition, preliminary reports on the recent Boeing 737
MAX 8 accidents have suggested a possible link to one of the aircraft's
automation systems, raising concerns about pilots' abilities to
recognize and react to unexpected events.
---------------------------------------------------------------------------
\3\ Enhanced FAA Oversight Could Reduce Hazards Associated With
Increased Use of Flight Deck Automation (OIG Report No. AV2016013),
January 7, 2016. Requested by the Ranking Members of the House
Committee on Transportation and Infrastructure and its Subcommittee on
Aviation. OIG reports as well as the current status of our
recommendations are available at http://www.oig.dot.gov/.
\4\ For example, in July 2013, Asiana Airlines Flight 214 crashed
short of a runway at San Francisco International Airport. The National
Transportation Safety Board determined that the crew did not
appropriately understand the aircraft's automation systems, allowed
airspeed to decay due to improper monitoring, and failed to perform a
proper go-around response.
---------------------------------------------------------------------------
As shown in table 1, pilots' use of automation may range from none
to high. While no single level of automation is appropriate for all
flight environments, pilots must understand automated systems and make
appropriate decisions when encountering unusual situations, such as
when automation fails or an emergency arises.
Table 1. Levels of Flight Deck Automation
----------------------------------------------------------------------------------------------------------------
Auto-pilot a
Level Engaged Auto-throttle b Engaged Overview
----------------------------------------------------------------------------------------------------------------
Full Auto-flight X X The aircraft's control is fully
automated based on information
preprogrammed by the pilots.
----------------------------------------------------------------------------------------------------------------
Tactical Auto-flight X X The aircraft's autopilot is engaged,
but pilots can direct changes to
heading, speed, and altitude using a
control panel.
----------------------------------------------------------------------------------------------------------------
Manual X The pilot is manually controlling the
aircraft based on guidance
assistance from the preprogrammed
flight directors. This is primarily
used for takeoff, initial departure,
and landings.
----------------------------------------------------------------------------------------------------------------
All Automation Off/Full The pilot is manually controlling the
Manual aircraft without the assistance of
flight directors. This would be used
to avoid collisions with other
aircraft or to recover from an
undesired aircraft state such as a
stall.
----------------------------------------------------------------------------------------------------------------
a Auto-pilot helps automate the process of guiding and controlling an aircraft.
b Modern auto-throttles can control power from takeoff to touchdown. Source: OIG analysis of air carrier and
manufacturer data.
To promote safety and provide a basis for oversight while
maintaining flexibility for different aircraft and systems, FAA has
established certain requirements governing the use of flight deck
automation during commercial operations. In particular, FAA developed
limitations regarding minimum altitudes at which autopilot can be
engaged and how automated systems within the cockpit are configured.
For example, during takeoff and climb below 500 feet, FAA restricts the
use of autopilot unless the carrier is granted explicit FAA
authorization to use it sooner. Further, air carriers must obtain FAA
authorization in order to use certain advanced flight procedures \5\
that rely on automation.
---------------------------------------------------------------------------
\5\ These include Area Navigation (known as RNAV), a method of
flying in which aircraft use satellite signals to fly any desired
flight path, as well as Required Navigation Performance (RNP)
procedures, which add monitoring and alerting capabilities for pilots
that allow aircraft to fly more precise flight paths.
---------------------------------------------------------------------------
In addition, FAA requires that pilots be trained, tested, and
proficient in all aircraft they operate, including any onboard
automated flight deck systems. The Agency also now requires all part
121 \6\ pilots to be trained in specific abnormal flight conditions,
which include stall and upset recovery and loss of reliable airspeed
(see table 2 for an overview of FAA's new requirements). These FAA
requirements were based on accident investigations and National
Transportation Safety Board (NTSB) recommendations. Air carriers had to
comply with this rule by March 12, 2019.
---------------------------------------------------------------------------
\6\ 14 CFR Part 121, Operating Requirements: Domestic, Flag, and
Supplemental Operations.
Table 2. New Manual Flying Training Requirements for 2019
------------------------------------------------------------------------
Training Maneuvers Overview
------------------------------------------------------------------------
Upset Prevention and Aircraft upset is an unsafe condition that
Recovery may result in loss of control (LOC).
Training focuses on the pilot's manual
handling skills to prevent upset, as well
as training to recover from this
condition.
------------------------------------------------------------------------
Manually Controlled Arrival Pilots will be both trained and evaluated
and Departure on their ability to manually fly a
departure sequence and arrival into an
airport.
------------------------------------------------------------------------
Slow Flight Pilots will be trained to understand the
performance of the aircraft and the way it
handles at airspeeds just above the stall
warning.
------------------------------------------------------------------------
Loss of Reliable Airspeed Training will focus on the recognition and
appropriate response to an automation
system malfunction that results in a loss
of reliable airspeed, which increases risk
of aircraft stall and/or upset.
------------------------------------------------------------------------
Recovery From Stall/ Training will provide pilots the knowledge
Stickpusher Activation and skills to avoid undesired aircraft
conditions that increase the risk of
encountering a stall or, if not avoided,
to respond correctly and promptly.
------------------------------------------------------------------------
Recovery From Bounced A poorly executed approach and touchdown
Landing can generate a shallow bounce (skip) or a
high, hard bounce that can quickly develop
into a hard landing accident.
------------------------------------------------------------------------
Source: OIG analysis of FAA requirements
FAA requires these training maneuvers to be performed in flight
simulators. However, the recent Boeing 737 MAX 8 accidents have raised
questions about the availability and capabilities of these training
simulators. For example, FAA determined training for the new Boeing MAX
series could be completed in existing simulators. However, according to
FAA, existing simulators do not fully replicate the 737 MAX aircraft,
and no U.S. airline currently has a MAX simulator.
Overall, FAA has taken steps to emphasize the importance of pilots'
manual flying and monitoring skills, as we recommended in 2016.
Continued vigilance in these areas can help ensure that air carriers
create and maintain a culture that emphasizes pilots' authority and
manual flying skills.
Remaining Vigilant as FAA and Industry Safety Oversight Systems Evolve
In recent years, FAA has worked to revamp its strategy for
overseeing the safety of the aviation industry. In particular, FAA has
increasingly shifted to working with industry to meet shared safety
goals, including delegating responsibilities for aircraft certification
and requiring air carriers to proactively identify and mitigate their
safety risks. Enhancing risk-based oversight, effectively leveraging
industry collaboration and enforcement, and fostering a strong safety
culture will remain key challenges for FAA as it works to implement its
new oversight strategies and ensure the safety of the traveling public.
Enhancing FAA's Oversight of the Aircraft Certification Process
The U.S. civil aviation industry is vital to the Nation's economy
and encompasses more than 230,000 aircraft, 1,600 approved
manufacturers, and 5,200 aircraft operators, among others. Recognizing
that it is not possible for FAA employees to oversee every facet of
such a large industry, public law \7\ allows the Agency to delegate
certain functions, such as approving new aircraft designs and
certifying aircraft components, to private individuals or
organizations. In 2009, FAA fully implemented the Organization
Designation Authorization (ODA) program to standardize its oversight of
organizations (e.g., manufacturers) that are approved to perform
certain functions on its behalf.
---------------------------------------------------------------------------
\7\ 49 U.S.C. Sec. 44702(d).
---------------------------------------------------------------------------
While delegation is an essential part of meeting FAA's
certification goals, robust oversight is essential to ensure that ODA
companies maintain high standards and comply with FAA safety
regulations. However, our work over the years on the ODA program has
identified management weaknesses with a number of FAA's oversight
processes. To its credit, the Agency has taken action to improve its
oversight in response to our recommendations. For example, our 2011
report \8\ identified inconsistencies in how FAA aircraft certification
offices interpreted FAA's role and tracked ODA personnel. In
particular, not all FAA offices consulted FAA's database to pre-screen
performance histories of prospective ODA personnel. In addition, under
ODA, FAA engineers have expanded enforcement responsibilities, but the
Agency had not ensured that they were adequately trained to perform
these duties. In response to our findings, FAA clarified guidance on
tracking ODA employee performance history and improved its training and
guidance for enforcement. As a result, FAA engineers responsible for
overseeing ODA employees were better positioned to detect instances of
regulatory noncompliance and take enforcement actions.
---------------------------------------------------------------------------
\8\ FAA Needs To Strengthen Its Risk Assessment and Oversight
Approach for Organization Designation Authorization and Risk-Based
Resource Targeting Programs (OIG Report No. AV2011136), June 29, 2011.
Requested by Representative Daniel Lipinski.
---------------------------------------------------------------------------
In 2015,\9\ we reported that FAA's oversight of ODA program
controls was not systems- and risk-based,\10\ as recommended by an
aviation rulemaking committee.\11\ For example, FAA had not provided
oversight teams with tools or guidance on data they should use to
identify the highest-risk areas. Another gap in FAA's oversight
pertained to companies that produce and supply components to other
manufacturers. FAA performed oversight of only 4 percent of personnel
conducting certification work on the Agency's behalf at suppliers in
the period we reviewed.
---------------------------------------------------------------------------
\9\ FAA Lacks an Effective Staffing Model and Risk-Based Oversight
Process for Organization Designation Authorization (OIG Report No.
AV2016001), October 15, 2015. Requested by Representative Peter
DeFazio.
\10\ Systems-based oversight shifts from focusing on individual
project engineering work to holistically assessing whether ODA
companies have the people, processes, procedures, and facilities in
place to produce safe products. This allows FAA to focus its oversight
on the highest-risk areas, such as new, innovative aircraft designs.
\11\ The Aircraft Certification Process Review and Reform (ACPRR)
Aviation Rulemaking Committee, a joint FAA and industry group, was
formed in response to a congressional mandate to study the aircraft
certification process.
---------------------------------------------------------------------------
In responding to our 2015 report, FAA recognized the need to
improve its oversight of organizations performing certifications or
other functions on its behalf. By July 2019, FAA plans to introduce a
new process that represents a significant change in its oversight
approach. For example, FAA's new process will include identifying
system elements (such as training and company self-audit processes) and
developing new evaluation criteria. While revamping FAA's oversight
process will be an important step, continued management attention will
be key to ensure the Agency identifies and monitors the highest-risk
areas of aircraft certification.
Overseeing Air Carriers' New Systems for Managing Safety Risks
FAA's safety oversight strategy depends, in part, on air carriers'
ability to identify hazards and implement corrective actions that
mitigate risk. For example, in 2015, FAA established requirements \12\
for U.S. part 121 air carriers to implement a formal, top-down approach
to managing safety risks, known as a safety management system (SMS).
Specifically, under SMS, air carriers must identify root causes for
hazards and proactively manage risk to prevent accidents.
---------------------------------------------------------------------------
\12\ 14 CFR Part 5, Safety Management Systems. This requires part
121 carriers to implement SMS.
---------------------------------------------------------------------------
While air carriers were required to implement SMS by March 2018,
recent events--including the April 2018 Southwest Airlines fatal engine
failure--have raised concerns that FAA's oversight may not ensure air
carriers sufficiently meet their risk-mitigation responsibilities. NTSB
is currently investigating the accident, but its preliminary reports
indicate similarities with a 2016 engine incident on a Southwest
Airlines aircraft. We are currently assessing \13\ FAA's oversight of
Southwest Airlines' systems for managing risk, including a focus on
aircraft weight and balance issues that can affect critical phases of
flight, as well as other matters. We expect to report on our findings
later this year. Ultimately, while air carriers' SMS are an important
part of maintaining the safety of the NAS, FAA must exercise
appropriate regulatory oversight and intervene in a timely manner to
ensure air carriers take sufficient actions to identify and reduce
safety risks.
---------------------------------------------------------------------------
\13\ Audit Initiated of FAA's Safety Oversight of Southwest
Airlines, June 20, 2018. Self-initiated.
---------------------------------------------------------------------------
Effectively Leveraging Collaboration and Enforcement in FAA's New Air
Carrier Safety Oversight Program
As FAA continues to move towards allowing air carriers to play a
more collaborative role in safety oversight, strong management
attention is critical to ensure the Agency's evolving strategy advances
its safety goals. In particular, in 2015, FAA implemented a new
``Compliance Philosophy'' as part of its safety oversight strategy. The
Compliance Program, as it is now known, is based on the premise that
the greatest safety risk in the industry does not arise from a specific
event or its outcome, but rather from an operator who is unwilling or
unable to comply with rules and best practices for safety. The
overarching goals of the new program are to achieve rapid compliance,
eliminate a safety risk or deviation, and ensure positive and permanent
changes.
FAA's Compliance Program emphasizes the Agency's preference for
collaborating with air carriers through education and training instead
of penalizing carriers as a means to address discrepancies. This
program calls for FAA to work with air carriers to address the root
causes of violations of safety regulations rather than to impose
enforcement actions--a significant change in the way FAA and the
airlines previously addressed compliance and safety issues. A key issue
we will assess in upcoming audits is whether the Compliance Program is
suitable for all air carriers, regardless of current working
relationships or unique business models and operating environments.
An important component of the Compliance Program is working with
carriers to identify the root cause of a violation. However, our
ongoing audit \14\ related to Allegiant Airlines has highlighted the
complex challenges FAA faces in implementing its new oversight approach
and addressing the root cause of the air carrier's maintenance
violations. Specifically, a longstanding maintenance issue at Allegiant
Airlines resulted in a series of mid-air engine shutdowns, aborted
takeoffs, and unscheduled landings. Our ongoing work focuses on the
degree to which FAA's inspectors documented adjustments to their
surveillance, effectively examined the root cause, or convinced the
airline through collaboration to perform additional tests to operate at
a higher level of safety. Overall, while FAA's Compliance Program
offers a new strategy for addressing risk, such as potentially
insufficient maintenance, the Agency's oversight must remain robust to
ensure airlines implement effective corrective actions. A key challenge
FAA faces moving forward is effectively leveraging both collaboration
and enforcement and accurately assessing whether an air carrier is
willing and able to correct its deficiencies.
---------------------------------------------------------------------------
\14\ Revised Notification--Review of FAA's Oversight of Air Carrier
Maintenance Programs, May 9, 2018. Requested by Representatives Peter
DeFazio, Rick Larsen, Nita Lowey, David Price, Mike Quigley, Katherine
Clark, Pete Aguilar, Jacky Rosen, and Cheri Bustos and Senator Bill
Nelson.
---------------------------------------------------------------------------
Maintaining a Strong Safety Culture To Adequately Support FAA's
Changing Oversight Methods
The success of FAA's evolving oversight methods depends on a strong
safety culture within both the Agency and industry. According to FAA, a
positive safety culture is one that is actively promoted by all levels
of management and demonstrates a commitment to safety over competing
goals and demands. Within such a culture, people acknowledge their
accountability and act on their individual responsibility for
safety.\15\
---------------------------------------------------------------------------
\15\ FAA Order 8000.369B, Safety Management System, March 18, 2016.
---------------------------------------------------------------------------
However, as early as 2015, FAA's Office of Audit and Evaluation
cautioned about changes in airline safety culture and the potential
impacts on safety and airline maintenance workforces. FAA guidance
recognizes the impact that a single inspector can have on safety
culture and establishes standards that require inspectors to act
impartially and avoid the appearance of preferential treatment when
they perform their official duties. Nonetheless, our recent work \16\
identified concerns regarding an FAA inspector's oversight of American
Airlines' flight test program, which is used to verify the
airworthiness of aircraft following major repairs. We found that an
inspector had developed a personal relationship with the head of the
carrier's flight test program and appeared to give the carrier
preferential treatment when safety concerns were raised. The inspector
also worked with the carrier to suppress future complaints. Ensuring
that FAA's inspector workforce meets standards of impartiality remains
a key oversight challenge for the Agency to strengthen its safety
culture and effectively identify and mitigate risks.
---------------------------------------------------------------------------
\16\ FAA Has Not Fully Addressed Safety Concerns Regarding the
American Airlines Flight Test Program (OIG Report No. AV2018060), July
10, 2018. Self-initiated.
---------------------------------------------------------------------------
Addressing Other New and Longstanding Safety Challenges
While working to address the urgent safety concerns highlighted by
the recent Boeing 737 MAX 8 accidents, FAA must remain vigilant about
other emerging and longstanding areas that are critical to maintaining
the safety of the NAS. These include improving safety on the ground and
in the air at airports, integrating UAS in the same airspace as manned
aircraft, protecting flight-critical systems that directly affect the
safety of aviation passengers from cyberattacks, and identifying and
removing suspected unapproved parts from the aviation supply chain.
Reducing Runway Safety Risks at Airports
Incidents in which collisions between passenger aircraft were
narrowly avoided at our Nation's major airports have renewed attention
to runway safety. For example, in July 2017, a commercial pilot at the
San Francisco International Airport attempted to land on a taxiway
where four other aircraft were awaiting takeoff.\17\ Much of our work
in this area has focused on FAA's efforts to reduce runway incursions--
incidents involving unauthorized aircraft, vehicles, or people on a
runway--which has been a longstanding challenge for FAA.
---------------------------------------------------------------------------
\17\ NTSB News Release, Flight Crew Misidentifies Runway, Causes
Taxiway Overflight, September 25, 2018. NTSB determined an Air Canada
flight crew's lack of awareness caused the overflight of the taxiway.
---------------------------------------------------------------------------
While FAA has undertaken a number of safety initiatives since 2007,
reports of incursions have increased, with a 92-percent rise in total
incursions reported between Fiscal Years 2011 and 2018 (see figure
2).\18\ In addition, while the number of serious runway incursions is
relatively low, there have been several incidents where two aircraft
have come within a few feet of colliding with each other, posing
significant safety risks.
---------------------------------------------------------------------------
\18\ We have not analyzed how factors such as changes in
operational levels and new reporting systems may have contributed to
the increase in runway incursions.
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
---------------------------------------------------------------------------
Source: OIG analysis of FAA data
Last year, we reported \19\ that FAA had completed 10 of the 22
runway safety initiatives recommended during a joint Government-
industry forum,\20\ including educating pilots on signs, markings, and
other visual aids at airports with identified risk factors.\21\
However, the Agency faces challenges in fully implementing the
initiatives still in progress, including dedicating funding and fully
implementing new technologies,\22\ which could take years to complete.
In addition, FAA did not establish quantifiable goals to measure the
initiatives' effectiveness in reducing runway incursions. As a result,
FAA will be limited in its ability to prioritize and adjust the
initiatives based on their effectiveness. We made three
recommendations, including updating target action dates for initiatives
still in progress and developing metrics to measure their
effectiveness. FAA plans to implement these recommendations by May
2019. Effectively analyzing data, identifying risks, and tracking
mitigation actions will remain critical to reduce runway risks.
---------------------------------------------------------------------------
\19\ FAA Faces Challenges in Implementing and Measuring the
Effectiveness of Its 2015 Runway Safety Call to Action Initiatives (OIG
Report No. AV2018058), June 27, 2018. Self-initiated.
\20\ FAA initiated a Call to Action forum in 2015 with
representatives from industry, labor, and Government. The forum
resulted in 22 initiatives intended to mitigate runway incursions and
improve safety.
\21\ According to FAA, risk factors that contribute to runway
incursions may include unclear taxiway markings, airport signage, and
more complex issues such as the runway or taxiway layout.
\22\ For example, one initiative calls for testing and using new
Next Generation Air Transportation System technologies for issuing taxi
instructions, such as Data Communications.
---------------------------------------------------------------------------
Strengthening Oversight of UAS in the NAS
The growing demand for UAS commercial operations--ranging from
filmmaking and precision agriculture to package delivery--represents a
substantial economic opportunity for the United States but also
presents one of FAA's most significant safety challenges. Since
initiating UAS registrations in December 2015, FAA has processed more
than 1.1 million UAS registrations for commercial operators and
hobbyists. Reports of UAS sightings by pilots and other sources have
increased significantly in the past few years--from 238 in 2014 to more
than 2,350 in 2018.
The Agency has taken many steps to accommodate UAS in the NAS, such
as passing a rule \23\ permitting small UAS (i.e., under 55 lbs.) to
fly commercially, with a number of operational restrictions.\24\
However, much work remains to safely integrate UAS into the same
airspace as manned aircraft. For example, FAA's rule allows commercial
UAS operators to apply for a waiver to conduct higher-risk operations
at night, over people, and/or beyond visual line of sight, if the
Agency determines the proposed operations can be performed safely. Yet,
as we reported last year,\25\ our analysis of FAA inspections found
multiple instances of commercial operators flying their UAS over people
and in airspace with manned aircraft without authorization to do so,
including over exhibitions and concerts and while performing building
inspections.\26\
---------------------------------------------------------------------------
\23\ 14 CFR Part 107 (June 2016).
\24\ The rule does not permit several potential UAS operations that
are highly valued by industry but considered to be higher risk by FAA,
such as operating a small UAS beyond line of sight or over people.
\25\ Opportunities Exist for FAA To Strengthen Its Review and
Oversight Processes for Unmanned Aircraft System Waivers (OIG Report
No. AV2019005), November 7, 2018. Self-initiated.
\26\ Our analysis of FAA's inspection record database shows no
indication that formal enforcement actions were pursued for any of
these specific incidents.
---------------------------------------------------------------------------
Moreover, we found that FAA faces several challenges in developing
a risk-based oversight system for commercial UAS operations. While the
Agency had developed guidance for its inspectors in planning annual
inspections of some UAS operators, FAA's UAS oversight was neither
data-driven nor proactive and lacked key elements of a risk-based
oversight system. For example, we reported that FAA's guidance did not
include risk or operational factors (e.g., operating location or
frequency of operations) to consider when choosing operators for
inspection. Furthermore, FAA had not yet collected sufficient
inspection data to conduct a meaningful assessment of safety hazards
and develop an overall, baseline risk profile of commercial UAS
operating in the NAS. In response to our recommendations, FAA has
recently required new, mandated inspections of UAS operators based on
data. The Agency must continue to enhance its data collection and
analysis to mitigate safety risks in this rapidly evolving industry.
Implementing Congressionally Mandated Aviation Cybersecurity
Initiatives To Protect Safety-Critical Systems
Enhancing the safety and security of the NAS also depends on
strengthening the Agency's ability to protect against a growing number
of cybersecurity threats to FAA's safety-critical systems.
Specifically, FAA operates a network of more than 300 information
technology systems. This complex network has evolved over the years
into an amalgam of diverse legacy radars and newer satellite-based
systems for tracking aircraft, as well as a new initiative for
controllers and pilots to share information through data link
communications.
In 2016, the FAA Extension, Safety, and Security Act \27\ directed
FAA to establish a new ``total systems'' approach to enhance its
ongoing cybersecurity efforts for securing the NAS, including aircraft
systems. Our recent work \28\ shows that FAA has taken initial steps to
address the act's requirements, such as completing a strategic plan
with cybersecurity goals and objectives, developing a risk model to
assess FAA operations, and establishing a research and development
(R&D) plan to outline further cyber initiatives. However, FAA will be
challenged to continue to implement the risk model across all of its
lines of operations, establish priorities for its cyber R&D efforts,
and coordinate ongoing efforts with other agencies (such as the
Departments of Defense [DOD] and Homeland Security [DHS]) to maximize
the Federal investment in cybersecurity research and implement
corrective actions to protect the NAS. Accordingly, we will soon begin
a review \29\ of FAA's role and authority in the Aviation Cybersecurity
Initiative, a joint taskforce that includes DOD and DHS aimed at
identifying and mitigating cyber vulnerabilities in the aviation
industry.
---------------------------------------------------------------------------
\27\ Pub. L. No. 114-190 (2016).
\28\ FAA Has Made Progress but Additional Actions Remain To
Implement Congressionally Mandated Cyber Initiatives (OIG Report No.
AV2019021), March 20, 2019. Requested by the House Committee on
Transportation and Infrastructure.
\29\ This was requested by the Chairman of the House Committee on
Transportation and Infrastructure.
---------------------------------------------------------------------------
Strengthening the Investigative Process and Proactively Removing
Suspected Unapproved Parts From the Aviation Supply Chain
The safety of the NAS also depends on efforts by FAA and the
aviation industry to ensure that U.S. aircraft are properly maintained
and airworthy. A single passenger aircraft can contain as many as
400,000 parts, and FAA and the aviation industry are responsible for
ensuring that all these parts meet established standards and are safe
for use. Part of this responsibility is to detect and monitor for
Suspected Unapproved Parts (SUPs)--aircraft parts that may have been
manufactured without FAA approval, including counterfeit parts.
However, our work has identified longstanding challenges with FAA's
processes for overseeing and reducing the risk of SUPs. For example, we
reported in 2017 \30\ that FAA's process for monitoring and
investigating SUPs was not as effective as it could be because of
recordkeeping weaknesses and the lack of management controls to capture
and accurately report the number of SUPs cases. As a result, FAA could
not accurately account for the number of SUPs or track safety-related
trends about the risks posed by unapproved parts.
---------------------------------------------------------------------------
\30\ Enhancements Are Needed to FAA's Oversight of the Suspected
Unapproved Parts Program (OIG Report No. AV2017049), May 30, 2017.
Requested by the Ranking Members of the House Committee on
Transportation and Infrastructure and its Subcommittee on Aviation.
---------------------------------------------------------------------------
Furthermore, FAA's oversight of industry actions to remove
unapproved parts was ineffective because the Agency did not confirm
that operators took appropriate action to remove unapproved parts from
their inventories. For example, an FAA inspector investigated a case to
determine whether tens of thousands of privately owned commercial
aircraft parts, which were for sale online, were unapproved. These
included safety-critical parts, such as landing gear. However, the
inspector did not physically account for the location and quantities of
the parts but instead accepted a letter from the owner stating that he
had removed the ad from his eBay site and had not sold any parts. FAA
concurred with all 11 of our recommendations to strengthen its SUPs
program and is working to complete actions to address the remaining
three open recommendations by the end of May. Going forward, enhancing
the margin of safety will require FAA's sustained management attention
to ensure that the hundreds of thousands of aircraft parts installed on
airplanes are manufactured or repaired according to safety standards.
Conclusion
From certifying a new aircraft to aircraft maintenance to pilot
training and beyond, aviation safety is a complex, wide-reaching effort
with many moving parts. As the recent Boeing 737 MAX 8 and other
accidents draw significant attention to FAA's safety oversight, and as
the aviation industry continues to evolve, FAA must ensure it can
proactively adapt to new oversight challenges, while also addressing
longstanding concerns in safety-critical areas. A strong commitment to
risk-based oversight--built on the foundation of a rock-solid safety
culture--will be vital to ensure FAA continues to maintain one of the
safest aviation systems in the world. As always, we remain committed to
supporting FAA and the Secretary as they seek to uphold and enhance the
safety of the NAS and protect the traveling public. We will continue to
update you on our work on these and related matters.
This concludes my prepared statement. I would be happy to address
any questions from you or Members of the Subcommittee at this time.
Senator Cruz. Thank you, gentlemen. We appreciate your
testimony.
Acting Administrator Elwell, although the investigations of
both of these crashes are still ongoing, the investigators have
gathered enough data to confirm similarities between the two
crashes.
The most prominent link seems to be a new software unique
to the Boeing 737 Max called the Maneuvering Characteristics
Augmentation System, more commonly known as MCAS.
From the FAA's perspective, was there any information on
this new MCAS System that was required to be included or was
included in the ``short self-administered online course'' that
pilots are required to go through before flying the Max?
Mr. Elwell. Mr. Chairman, thank you for that question.
The MCAS System is indeed, as I mentioned, of great
attention in both of these tragic accidents and the MCAS is
actually a sub-device to a system called the Speed Trim System
that is in the NG, a prior 737.
What the MCAS does is it--the 737 Max is a fly-by-wire
aircraft. Fly-by-wire aircraft, the controls, the yoke, the
controls, the flight controls needs to feel right to a pilot
and so what the MCAS does is it gives inputs to the flight
controls when necessary in a very thin envelope, thin piece of
the flight envelope and certain regimes so that the pilots, the
yoke feels exactly like it should, and in this case, the MCAS
made the Max feel exactly like the NG to fly.
So for that reason, we gave it an amended type certificate
because of its similarity to the NG, because of what the MCAS
System aided the pilots in the feel and the flight of the
airplane.
We have for a certification of this type a Flight
Standardization Board comprised of pilots from Europe, Canada,
the United States, who come together and fly the aircraft that
is being amended, in this case 737 NG, and the new aircraft,
and they fly it and are monitored by engineers and experts
specifically to see if they have or notice differences in the
flight characteristics, the handling characteristics of the new
airplane because that would trigger us to need flight training
for this new device.
Senator Cruz. Administrator Elwell, let me try to refocus
you back on the specific question I asked, which is, was there
any information on the MCAS that was included in the short
self-administered online course the pilots were required to go
through?
Mr. Elwell. There was not specific instruction on the MCAS
to my knowledge specifically because it was not a system that
went directly to what the pilots flew on the Max, the
difference between the Max and the NG.
Senator Cruz. Well, that might be true in ordinary
circumstances, but as I understand it on previous versions of
the 737, when the pilot pulled back on the yoke, it cutoff the
electronic control of the stabilizers but with the MCAS, it did
not, and presumably pilots would not know this if it was not
included in their training and they were not made aware of
that, is that correct?
Mr. Elwell. So, Senator, the MCAS gives input to the flight
controls, as I said, in a very small flight envelope.
In this case we're talking about here, errant information
to that system would make it give input where it's not needed
and where it's not wanted and only in manual flight and pilots
are trained when they get an input into their flight controls
that they did not ask for, that is not appropriate for the
regime of flight, then they go through procedures.
In this case, it's called runaway stabilizer trim procedure
and that is what would be done in this instance. In normal
operation for the MCAS, you would never----
Senator Cruz. Did these pilots'----
Mr. Elwell.--feel the input.
Senator Cruz.--training or procedure let them know that
pulling back the yoke would not disengage this system?
Mr. Elwell. I'm not quite sure what you're referring to
about pulling back the yoke and stopping it because that's not
actually----
Senator Cruz. So I'm reading a quote from the New York
Times on February 3, 2019, where the Times reported ``Older
737s had a way of addressing certain control problems with the
stabilizers. Pulling back on the yoke or control column would
cutoff electronic control of the stabilizers, allowing the
pilots to control them manually,'' and that was not true with
the 737 Max.
Now is that correct factually? I'm relying on the Times
reporting here.
Mr. Elwell. So I don't believe that's correct. The same
ways to deal with the MCAS inappropriate input is the same
thing a pilot would do for runaway stab trim for an NG. It's
the same input and the same procedure. In fact, the procedure
for runaway stab trim does not change from the NG to the Max.
It presents itself the same way and it's dealt with the same
way.
Senator Cruz. Now the MCAS System itself relied on angle of
attack sensors that, as the Washington Post reported, ``angle
of attack sensors have been flagged as problems on more than 50
times on U.S. commercial airplanes over the past five years.''
How did the FAA come to the conclusion that it was
appropriate to certify an anti-stall software system, the MCAS,
that not only drew data from a sensor that had a history of
problems but also that didn't have redundancy?
Mr. Elwell. So the AOA vanes are an input to the MCAS
System. The MCAS System is actually not an anti-stall system.
It's not a system unto itself. It is a supplement to, as I
said, the speed trim system that existed in the NG, does the
same thing that the STS does in the NG.
I am not aware of AOAs being a problem, 50 malfunctions of
an AOA or 50 maintenance procedures to an AOA across the gamut
of flight where AOA vanes are in all the flights that use AOA.
It is not in--you talk about numbers of hundreds of thousands
of flights.
Senator Cruz. Unless there is a system where the
malfunction then causes the plane to crash, then that is a
serious issue.
Mr. Elwell. Well, sir, it is still yet to be determined if
the malfunctioning of the AOA caused the crash. We actually
don't know the cause of the crash. There's a lot more to find
out through the investigation.
But I am confident in--well, I'm confident in the AOA vanes
that are produced and put on airplanes and I'm confident in the
MCAS System. Now where we need to go is we need to get all the
information, all the data from the accident to determine the
interaction between all of them, and it isn't just airframe or
it isn't just the AOA. It isn't just the MCAS.
There's quite a few more factors in any investigation that
we have to determine. We have to gather the data. We're a data-
driven organization and we make our decisions based on the data
collected. We still have a lot of data to collect, sir.
Senator Cruz. Senator Sinema.
Senator Sinema. Thank you, Mr. Chair.
My first question is for Mr. Elwell, but I welcome
responses from any of our guests.
According to media reports, the initial failure
classification for the MCAS enabled its safety evaluation to be
delegated to Boeing and during--well, according to media
reports, during testing, FAA did not completely and properly
review technical documents provided by Boeing.
So how do we ensure that FAA can take over safety
evaluation if issues are discovered during the testing and
evaluation phase?
Mr. Elwell. Thank you for that question, Senator.
What you're referring to is the Organizational Designation
Authorization. In the course of a certification, such as an
amended type cert that the 737 Max went through, the FAA
determines what aspects of the delegation or what aspects of
the certification can be delegated and usually those are normal
well-known legacy-type systems, and in the case of the 737 Max,
we, the FAA, retained MCAS for review at the beginning of the
certification process.
As the process goes on, ODA is amended and is amended many
times in the course of a certification as the FAA reviews and
certifies the expertise of the manufacturer to take on more of
the delegated authority under very strict review by the FAA and
we at times in the course of a certification will find areas
that we want to pay more attention to and we will retain those
items.
So it is an active constantly changing dynamic in a
certification and that's what happened during the certification
of the Max.
Senator Sinema. A second question then for you, Mr. Elwell.
So MCAS is new to the Boeing Max aircraft and I was
wondering if you could talk to us about why the system was not
included in pilot training materials and who makes the
determination regarding what is included in pilot training
materials?
Mr. Elwell. So when we're doing a new certification,
whether it's an amended or a new type, there's a Flight
Standardization Board that is a group of experts and pilots and
engineers whose responsibility it is to determine, and in this
case an amended type certificate, if the handling
characteristics of the new aircraft require flight training or
if the differences between the new aircraft and the one that
it's amending does not require flight training.
What the MCAS did was correct for some very slight
modifications that the Max had. The Max has slightly larger
diameter engines with not a whole lot of extra thrust, similar
thrust, but because of the width of the engines, they had to go
forward on the wing, and because of the diameter of the
engines, the nose wheel had to be extended six inches.
These are not big changes as far as the FAA's concerned for
an amended certificate, but what we need to do is put pilots in
simulators and fly the aircraft that's being amended and the
new aircraft and after many scenarios, flights in all regimes,
sim flights in all regimes with these pilots, there was a
consensus opinion from the pilots, European, Canadian, American
pilots, that there was no market difference in the handling
characteristics of these two aircraft and that is what we need
to determine what kind of flight training or not is needed and
there was, by the recommendation of the Flight Standardization
Board--understand this is a Board that has been used dozens and
dozens of times, and their unanimous opinion was flight
training was not needed.
They didn't flight test the MCAS per se because, as I said,
the MCAS is a device that is a supplement to another system
that is designed, specifically designed for the yoke to feel
correctly to the pilot in all regimes of flight.
Senator Sinema. My last question is for each of the
witnesses and I wonder if you have suggestions for legislative
or regulatory changes that can ensure an aircraft is
independently and appropriately evaluated for operational
safety. Is there more we need to do?
Mr. Scovel. Thank you, Senator Sinema.
Yes, there may be. However, for me as Inspector General to
offer suggestions today would be entirely premature.
As you know, Secretary Chao, Senator Blumenthal, and other
congressional requesters have asked my office to start at the
very beginning thinking of these as bookends. First, we want to
look at the certification process.
I can outline very quickly for you what that will entail.
We want to look at the key decisions made by FAA when
certifying the airplane and the timeline. We want to determine
when MCAS was added to the aircraft and why FAA approved it or
the extent of FAA's involvement in Boeing's decision to approve
it, how FAA reached the decision that pilots did not need
additional training or that the details about the new system
did not need to be included in the airplane's manual. That's
the first bookend.
The second bookend in my view will be how FAA responded to
the recent accidents and that's specifically Senator
Blumenthal's question.
Clearly, confidence in FAA as the gold standard for
aviation safety has been shaken. We can help provide
information to the Secretary and to the Congress to determine
how best to restore FAA to that position.
The second bookend we hope will shed some light on the
obvious question as to why FAA was the last safety regulator to
decide to ground the 737 Max.
Other safety regulators around the world decided that in
their role as safety regulators they needed to drive risk to
zero and they did that by grounding the aircraft.
Acting Administrator Elwell has testified that they were
continuing the hunt for data in order to inform that decision.
So that disparity, that apparent disparity in the safety
regulator's role should be another question, I respectfully
submit, for the Congress and the Secretary.
We hope to present information to all of you to help inform
your decisionmaking.
Mr. Sumwalt. Ranking Member Sinema, thank you for your
question.
The NTSB has looked at that issue as it relates to
particular crashes. For example, coming out of the 2013 Asiana
crash at San Francisco, we recommended that the FAA convene a
special certification design review of how the Boeing 777
Automated Flight Control System controls air speed and we
wanted the FAA to look at that and we've classified that
recommendation as open alternate acceptable response.
Coming out of the 787 battery fire event that we
investigated that same year, we talked about the use of
engineering designees. Since 1999, we've issued eight
recommendations to the FAA concerning the use of engineering
designees. Three are still open. The remaining four have been
closed acceptably.
We do want the FAA to provide certification to engineers
with written guidance and training to address opportunities to
improve the certification process outcomes and so that would be
where we stand on that.
Senator Sinema. Thank you. Thank you.
Senator Cruz. Mr. Elwell, you told Senator Sinema that part
of certification was based on pilots flying simulators in
multiple different scenarios.
Did any of those scenarios include angle of attack sensors
malfunctioning and reporting the wrong data to the MCAS System?
Mr. Elwell. Sir, I can get an answer for you on that, but I
don't believe so. I believe that they were all in the normal,
the full range of the flight envelope for flight
characteristics.
Again, the issue of an AOA vane giving the MCAS the wrong
information causing it to give nose down input to the
stabilizer trim presents as a scenario. All pilots are trained
on it and familiar with it. It's called runaway stabilizer trim
and the actions that they take to defeat it are the same as
they would find in any other cause of a stab trim malfunction
which would be the motor going off when it shouldn't. So it is
indistinguishable to the pilot.
[Mr. Elwell's answer follows:]
The flight control system, of which the Maneuvering Characteristics
Augmentation System (MCAS) is a part, was extensively tested, including
in potential failure modes of MCAS and stalls.
Senator Cruz. Chairman Wicker.
Chairman Wicker. Thank you, Senator Cruz.
Mr. Sumwalt, the Indonesian Civil Aviation Authority has
issued a preliminary report. How long did that take after the
Lion Air crash?
Mr. Sumwalt. The accident occurred, Senator, on October 29
and I believe the preliminary report was issued on November 27,
so about 30 days.
Chairman Wicker. Do you think we can expect a preliminary
report, then, from Ethiopia within about a month?
Mr. Sumwalt. I do. Our investigators are very engaged with
the Ethiopian Government. We're working very closely with them,
providing assistance in the development of a draft report, and
we do expect it in the very near future.
Chairman Wicker. I assume you're getting all the
cooperation you need from the Ethiopian Government----
Mr. Sumwalt. Yes, sir, we are.
Chairman Wicker.--and from the Indonesian Government?
Mr. Sumwalt. Absolutely.
Chairman Wicker. What do you know about the Lion Air crash
that you don't know about the Ethiopian Air crash at this
point?
Mr. Sumwalt. Well, I've read the Lion Air preliminary
report that was issued in November. I will say a very ticklish
issue is that there's a law, an actual law, 49 U.S.C. 1114
subsection f, that prohibits anyone from disclosing information
concerning a foreign investigation unless that information has
been cleared by the host country.
So I am not the one to speak about either of those two
accidents.
Chairman Wicker. Mr. Scovel, are you going to have a
recommendation about that law? Do you have an opinion about
that law? Is it a problem?
Mr. Scovel. Conceivably, it might be. Certainly in the
desire of the Congress and the Administration to foster
transparency and determine the best route ahead. At this point,
I certainly don't have a recommendation for you.
Chairman Wicker. OK. Well, if the witnesses would get back
to us on that, we'd appreciate it. You have some time to
consider that.
Now there was a nose-down input, Mr. Sumwalt. In other
words, the pilots experienced the MCAS System kicking in and
pushing the nose down. I understand it was some 21 times before
the plane eventually crashed. Is that your understanding, sir?
Mr. Sumwalt. Which accident are you referring to?
Senator Wicker. Lion Air.
Mr. Sumwalt. I think that's about right, based on my read.
Chairman Wicker. Over what period of time would that have
been?
Mr. Sumwalt. I'm not sure, sir.
Chairman Wicker. What should the pilots have done there?
Mr. Sumwalt. Well, I flew the 737 for 10 years and I do
believe that there is a procedure, at least for the Flintstone
version of the 737 I flew, a very old 737, but I do believe
that the first thing you would do is oppose that motion by
pulling the yoke back and that should engage a stab brake. Now
apparently that feature is not on the Max----
Chairman Wicker. Mr. Elwell, what should they have done?
What should the pilot have done, based on 21 times of the
system kicking in and pushing the nose down?
Mr. Elwell. Mr. Chairman, I did not fly the 737, so I can
only speak to the airplane--all the different airplanes I flew,
but----
Chairman Wicker. Oh, I'm actually asking about this
aircraft. Do you know? If you don't know, that's fine.
Mr. Elwell. Sir, I'll have to get back to you on the
specifics. There is a non-normal checklist, an NNC on runway--
--
Chairman Wicker. I think that would be helpful for us to
know, based on the expertise at this table, what should have
occurred in the cockpit, based on that nose-down input?
Mr. Elwell, then discuss, if you don't mind, the point that
Mr. Scovel mentioned and a lot of us have about the decision
made by other countries initially to ground the aircraft, what
data they had. Was this just an abundance of caution or was it
based on facts that these agencies had that we didn?t have here
in the United States? Help us understand the decision there.
Mr. Elwell. Yes, sir. It is a very important question.
The FAA, to make a decision to ground a fleet of aircraft,
is going to do that on data-based information that we have to
warrant grounding. I can't speak to the reasoning that the
other nations took. I know that in communication with those
countries, they, in our request of what data they might have,
they did not have any data for us. In fact, there were several
countries in communications with us who, after grounding the
aircraft, asked us what data we had and what we might suggest
for them for ungrounding when the time was right.
Chairman Wicker. Was your decision based on data or just--
--
Mr. Elwell. Our decision----
Chairman Wicker.--what everybody else was doing? What was
that data?
Mr. Elwell. So on that Wednesday morning, mid-morning, we
received data that gave us refined flight track. We had initial
flight track data Monday that was unreliable and it was
actually--we were not able to interpret it and to create a
flight track.
That data was refined on Tuesday night into Wednesday by
the company that actually produced the data or received the
data through their satellite system and with the help of the
NTSB and Boeing, that data was refined to the point where we
could have a flight track, a 6-minute flight track of the
Ethiopian Air flight, and we found information on the ground
that corroborated for us in a briefing on Wednesday morning
that the flight track of Ethiopian Airlines was very similar to
the flight track of Lion Air and that data told us that there
was very possibly a link between the two flights and when you
have the possibility of a link between two accidents of the
same type aircraft, it's prudent to ground them until you find
what that link is, mitigate that link.
The important thing to know about using data, we may have
been, I think someone said, the last country to ground the
aircraft, but the United States and Canada were the first
countries to ground the aircraft with data for cause and
purpose and that's important because when you ground a fleet of
aircraft for a reason, a definable reason, then you have
something by which to unground them when you've mitigated that
or you've solved it or you've found that link.
Chairman Wicker. Mr. Chairman, I know we're over, but Mr.
Sumwalt seems to be nodding his head.
Are you in agreement with the approach that Mr. Elwell has
outlined as having been taken by the FAA?
Mr. Sumwalt. Well, the NTSB was not involved in the
grounding decision.
Chairman Wicker. Right.
Mr. Sumwalt. We supplied data that they could use to make
that decision.
Chairman Wicker. Thank you. Thank you, Mr. Chair.
Senator Cruz. Senator Cantwell.
Senator Cantwell. Thank you, Mr. Chairman.
Administrator Elwell, did you say in answering an earlier
question of Senator Sinema that the FAA retained the authority
over the MCAS System, that it wasn't delegated?
Mr. Elwell. I said that originally we retained it as a new
system and then released it to the ODA, to the delegation
designation.
Senator Cantwell. So if someone is characterizing it as
delegated, then it was delegated?
Mr. Elwell. Right. So initially as a new system or a new
device on the amended type certificate, we retained the
oversight of that and then over time released that to the ODA
when we had the comfort level and the oversight and we've
examined it thoroughly and we were able to assure that the ODA
members of Boeing had the expertise and the knowledge of the
system to continue going forward.
Senator Cantwell. And so that kind of information is
something you can make available to members now or is that
something that will be part of the investigation?
Mr. Elwell. I'm sure, Senator, that we could get that
information to you on exactly the timing and how that went,
and, of course, in the investigations and the audits that are
ongoing about the certification process here, this will all be
very transparent and clear.
Senator Cantwell. Well, I do think transparency is
important.
Mr. Elwell. Absolutely.
Senator Cantwell. So I read statements where you're saying
it wasn't delegated or I hear your answer here and then I read
things in the press that say it was delegated and I think the
public wants to understand the system and obviously Mr. Scovel
and various IG reports is reviewing that and I appreciate those
reports and that review.
As I mentioned in my opening statement, I appreciate
Secretary Chao convening some experts of aviation analysis to
also look at that system and review.
So, anyway, we'll look forward to getting that information
from you on what that looked like as the FAA retains that
oversight and then once they were certain then delegated. I'm
not sure what they delegated but you will get that to us.
This larger question in my mind is Mr. Scovel also
mentioned that pilots rely on automated flight systems, that
the FAA ensure that carriers meet its requirements to train
pilots on how to respond to abnormal flight conditions, and I
think you also, Mr. Scovel, mentioned stall situations.
So how is the FAA making sure that that is achieved in
particularly this area of human and machine interface? I think
that the public wants to understand, and I think it's probably
across a lot of transportation sectors, want to understand what
we're doing on testing to make sure that these safety factors
of functionality are there, particularly when the functionality
is between a machine and a human interface, how are we testing
for that, and in this case, how were we testing?
Mr. Elwell. Yes, Senator. The FAA is intensely interested
in the interface between the pilot and the machine and over
time that relationship has changed and as aircraft become more
automated, we have this--clearly automation is one of the most
important aspects for the amazing increase in improvement in
safety we've seen over decades.
But automation brings with it certain challenges and as the
IG has pointed out, if most of the time automation is on in an
aircraft, there's always been this concern that, well, then
pilot skills degrade.
So when I was flying in the airlines, we had within the
airline itself, we had some rules about making sure that you
hand flew frequently enough to keep that sharpness but
certainly we look very, very closely at the training
requirements and the human interface and what automation does,
the safety benefits, and what the challenges are with it. So we
watch that very closely.
Senator Cantwell. And so you think there was enough of that
training involved here?
Mr. Elwell. Senator, I do, I do, because the MCAS,
remember, the MCAS operates in manual mode. It's not automated.
It's not during with autopilot on. It actually--as I said
earlier, it makes the--its whole purpose is to give the pilot
the proper feel with a fly by-wire yoke while he or she is
flying.
So it interjects in manual mode. It does not interject in
automatic mode, and as I said, when that MCAS is doing things
that it's not supposed to do, pilots feel it. It presents
itself as uncommanded pitch trim and pilots of large aircraft
are trained from the beginning of their careers how to handle
that.
Senator Cantwell. Well, I mention this and I mentioned the
Colgan Air families who are here because I think that's been
their main mantra, that there wasn't enough training on that
particular system or at least from a co-pilot perspective, and
I think I saw that Captain Sully had also made similar comments
recently.
We've had a lot of debate here about this as it relates to
making sure that two pilots are, but I really do want to
understand the FAA's role and certainly Mr. Scovel's review of
that human-machine interface because my guess is we're going to
continue to move forward but we have to get this right. We have
to get this right.
So thank you, Mr. Chairman. I see my time has expired.
Senator Cruz. Senator Thune.
STATEMENT OF HON. JOHN THUNE,
U.S. SENATOR FROM SOUTH DAKOTA
Senator Thune. Thank you, Mr. Chairman.
Mr. Elwell, as you know, the FAA Reauthorization Act of
2018 contains several bipartisan provisions aimed at improving
and modernizing FAA's aircraft certification process, to
include the establishment of an organization designation
authorization office within FAA's Office of Aviation Safety
designed to improve operational safety by strengthening
oversight of ODA holders delegated to perform certain functions
on behalf of FAA.
Could you provide a timeline on when you expect this office
to be fully established?
Mr. Elwell. Thank you for that question, Senator Thune.
Absolutely. In fact, we already established the new ODA
Office, as you mentioned, prescribed in last year's FAA bill.
On March 5, we created and stood up the office.
Senator Thune. And as a followup, the FAA bill also
established an expert review panel to survey ODA holders and
evaluate the effectiveness of the ODA process.
You have an update on when you expect this review panel to
be established?
Mr. Elwell. I don't have it off the top of my head,
Senator, but I will certainly get that information to you. It
may already be in place, but I don't have that in my notes.
Senator Thune. Thank you. That would be great if you could
get us that information.
Boeing recently--I would direct this to you, Mr. Elwell,
too. Boeing recently stated that the 737 Max Series aircraft
was certified, and I quote, ``Certified in accordance with the
identical FAA requirements and processes that have governed
certification of all previous new airplanes and derivatives.''
Could you provide some examples of other aircraft models
where the FAA has certified a variant aircraft in a manner
similar to the process that was used for the 737 Max?
Mr. Elwell. Well, Senator, the process to determine whether
it is an amended type certificate or a new type is the same,
regardless of the manufacturer, the type which you're amending,
or making that determination, and it goes to the points I made
earlier about flyability.
So, first and foremost, the criteria to examine as to
whether there's a fundamental difference in the thrust, weight,
flight characteristics of the applicant for an amended type.
Those, as I said, are tried and true methods that we've used
for decades on amended certificates.
I know sometimes, in my case when I flew the Super 80, we
added to our fleet type the Super 80s from another airline in a
merger. They had a different cockpit layout but the plane was
fundamentally the same. There are a couple of different options
but it handled the same.
So it was an amended type and we went through differences
training because the flight deck had some different things in
it that we needed to get used to, but that's the fundamental
things that we look at.
Senator Thune. You look at--so as a follow up, was there
anything specific about the design of the 737 Max that
differentiates the model certification process from some of
those examples that you just mentioned?
Mr. Elwell. Well, sir, the 737 Max is and required
certainly an amended type certificate and again primarily
because of the new modern complexities that it brought to the
table. It did bring the MCAS into the equation but the MCAS was
a supplement or an addition to a system that already existed in
the NG.
The engine position on the wing was different and it's what
required actually--it's what necessitated the addition of MCAS
and there was some differences in the screens, what was on the
screens, but fundamentally the aircraft layout, the handling
and the performance of the aircraft was the same, and thus the
decision to make it an amended type certificate.
Senator Thune. OK. Mr. Sumwalt, you mentioned in your
testimony both the benefits and safety concerns related to the
integration of UAFs in the Nation's airspace.
As you know, the FAA Reauthorization Act of 2018 included
numerous provisions related to the safe operation of this
emerging technology.
Are there any pending regulatory actions that the FAA in
particular that you see as most important to ensuring the safe
integration of drones into our airspace?
Mr. Sumwalt. Thank you for that question, Senator Thune.
As you're aware, the FAA recently enacted Part 107 to the
Federal Aviation Regulations which imposes more regulatory
requirements for drone operators and we see that as a positive.
Senator Thune. OK. All right. Thank you. I see my time's
expired, Mr. Chairman. Thank you all for your willingness to be
here today and take questions.
Senator Cruz. Senator Klobuchar.
STATEMENT OF HON. AMY KLOBUCHAR,
U.S. SENATOR FROM MINNESOTA
Senator Klobuchar. Thank you very much, Mr. Chairman. Thank
you to all of you.
The two tragic airplane crashes included, by the way, a
beloved community member from St. Cloud, Minnesota, Mucaad
Hussein, and I know his family is grief stricken, and following
these crashes, as many of my colleagues have talked about, it
is very important that we figure out our certification process
and get it right so we can prevent similar tragedies in the
future.
Mr. Elwell, I know you've been asked about this but let me
try it a different way.
Are there any safety measures the FAA may have
miscalculated when evaluating the safety features of the Boeing
737 Max?
Mr. Elwell. Well, Senator Klobuchar, thank you for that
question.
We certify aircraft in a way that we have refined, as I
said, for large aircraft, large commercial aircraft. It has
been refined 130 times, over 130 times since we started doing
these.
In every certification we learn something new, from every
IG audit, from every----
Senator Klobuchar. Was this consistent with how you've done
other certifications in other situations, the Boeing situation?
Mr. Elwell. Yes, ma'am. This was an amended type
certification that followed the procedures we use to determine
and then to execute----
Senator Klobuchar. But if you learn something else after
this investigation or other things come out, you may change
that process?
Mr. Elwell. Absolutely. That's how we get better.
Senator Klobuchar. And, Mr. Scovel, what is your office's
timeline for this audit?
Mr. Scovel. Thanks, Senator.
We always shoot for 10 months. This is a very tall order
for us, as I'm sure you can appreciate. We have a highly
skilled team of aviation safety auditors who we'll turn to. If
we can meet 10 months, I optimistically say great. It may well
be some months after that. We will get to it as soon as we
possibly can because we really truly appreciate your interest
on all these matters.
Senator Klobuchar. Thank you.
Mr. Scovel. Thanks.
Senator Klobuchar. Mr. Elwell, back to you, according to a
recent New York Times article, Boeing charged airlines extra
for critical safety features. These were optional add-ons.
Following the crashes, does the FAA plan to update the
requirements for aircraft safety features or take other action
to mandate that these features are not optional?
Mr. Elwell. Well, Senator Klobuchar, when we certify an
aircraft, whether it's amended or a new type, critical safety
features, that's an important term. If something is a critical
safety feature on an aircraft, a passenger aircraft that we
certify, it's not optional.
So critical safety features----
Senator Klobuchar. I see.
Mr. Elwell.--are part of the certification package and I
think what you're referring to is AOA displays on the CRTs in
the cockpit, and I can tell you as a pilot that's flown
aircraft, several aircraft in the military and the civilian
world, I had aircraft that had AOA displays in the cockpit and
I had aircraft that didn't, and it all depends on what the rest
of the display says.
In today's modern airplanes, and you've got 12-inch CRTs in
the cockpit,----
Senator Klobuchar. But is it possible this could be decided
that these aren't just optional, that they should be mandatory
if it's discovered after these investigations?
Mr. Elwell. Absolutely.
Senator Klobuchar. OK. And then do you know an estimate of
how many safety features that the FAA lists as optional right
now that detects sensor malfunctions or could you tell it to me
later in writing?
Mr. Elwell. I could tell it to you later, Senator
Klobuchar.
Senator Klobuchar. OK. All right. Chairman Sumwalt, what
role does the U.S. play in setting international safety
standards when it comes to training for foreign pilots?
I know you'd answered some questions about training for my
colleagues, but do we have any role there? I'm just thinking
because we had someone from Minnesota was killed.
Mr. Sumwalt. Sure. Senator Klobuchar, we are, as I've
mentioned, we are member state to the International Civil
Aviation Organization that sets recommended practices and
standards and so it would be ICAO that would outline those
international training standards that other member states would
be expected to comply with.
Senator Klobuchar. And could you weigh in on those training
standards?
Mr. Sumwalt. We could. The FAA is officially the U.S.
representative to ICAO, but we work closely with them with our
relationship with ICAO.
Senator Klobuchar. I see. So you'd be involved in that, Mr.
Elwell?
Mr. Elwell. Yes, Senator, we would.
Senator Klobuchar. OK. I'll follow up on that later.
One last question I had of you, Chairman Sumwalt. In your
testimony, you highlighted reducing fatigue-related accidents
as one of the NTSB's most wanted transportation safety
improvements for 2019 to 2020.
As you know, I've led the Safe Skies Act, supported by
Captain Sullenberger, among many, along with Senators Cantwell,
Blumenthal, Markey, and Duckworth, to take the rest
requirements that we put in place for passenger pilots and
apply them to cargo pilots.
This is something unrelated to these two crashes but part
of airline safety and something that I know the Colgan families
have also supported. So could you comment on that?
Mr. Sumwalt. Absolutely. I want to thank you and Senator
Blumenthal for your advocacy on that.
The NTSB does not agree that there should be a different
standard for passenger-carrying airlines and cargo airlines
with respect to the fatigue rules. The FAA, as you know, did
enact a fatigue rule in 2012 for passenger carriers that did
not relate to cargo carriers, and we disagree with that
disconnect.
Senator Klobuchar. OK. Well, I hope you win. So we're going
to keep pushing for this bill.
Mr. Sumwalt. Thank you.
Senator Klobuchar. Thank you.
Senator Cruz. Senator Moran.
STATEMENT OF HON. JERRY MORAN,
U.S. SENATOR FROM KANSAS
Senator Moran. Chairman, thank you very much. Thank you for
conducting this hearing.
Press and media reports, Mr. Elwell, indicate that Boeing
was implementing changes in the Max after the first crash and
that is at least an explanation for why they may be close to
having a ``fix'' for that Max.
Is there anything, a requirement that--first of all, is the
FAA notified of that effort to make corrections to the Max
after the first crash?
Mr. Elwell. Senator, yes, the Boeing Company submitted an
application for a software update to the MCAS, an MCAS software
update after the Lion Air accident.
Senator Moran. And is there a corresponding duty to warn
either on the part of Boeing Corporation or the FAA either
pilots or airlines, a duty to warn or a notification that there
may be something wrong and a fix is on its way?
Mr. Elwell. So nine days after the Lion Air accident, the
FAA put out an Emergency Airworthiness Directive followed by a
communique to all authorities around the world who fly the Max
and what we pointed out was--back up a little bit.
The FAA's role, primary role in any accident investigation
is for continual operational safety. In other words, if in the
course of an accident something of immediate import is
discovered, we don't wait for the end of the accident for the
final report. We act immediately and in this case, the initial
data suggested that a reminder was needed and that's what the
Emergency AD was, a reminder was needed for pilots and
operators of this aircraft to apply standard runaway stab trim
procedures should this be encountered and that's what the
Emergency AD was.
Now the software update that you're referring to is Boeing
came to us with this and we talked to them about it. We
accepted their application. They began work, but we determined
that the issues that this software update was making, the
things that it was improving upon for MCAS, did not warrant
anything more than the announcement that this was in progress.
Senator Moran. OK. Mr. Elwell, I'll stay with you for a
moment longer.
I suppose that there's always a question of why we would
have a private company certify their product. In this instance,
it happens in the aviation world. It happens all the time.
What's the justification for that? We use ODAs,
Organization Designation Authorizations, regularly. Would the
FAA be able to certify aircraft without the use of that
designation?
Mr. Elwell. Senator Moran, that is a very important
question, but let me go back to what you said in the question
that we allow companies to certify their aircraft.
Senator Moran. I know I misspoke in the way that you would
phrase it and I understand the distinction. I'm not trying to
discount the importance of an ODA.
In fact, I'm hoping that you'll confirm to me the
importance with proper oversight, with FAA certification
required, the actions that are taken by private companies to
provide the information necessary to certify is important and
how would we do this in aviation without that process?
Mr. Elwell. So the concept of ODA, as I said, has been
around for 60 years and some form of delegation has been around
since the 1920s. It is part of the fabric of what we've used to
become as safe as we are today, and I don't want to give the
impression that ODA is some resource, a way for us to sort of
stretch our resources.
We have very strict oversight on every participant in an
ODA program and we make sure that they are experts in the
field, that they have the appropriate understanding of FAA regs
and manuals, they have professional integrity is checked,
everything.
But to your point, if we had no ODA at all, it would be an
estimation that would require roughly 10,000 more employees to
do that role at the FAA and about $1.8 billion for our
Certification Office in the FAA.
Senator Moran. How does that compare with--that process,
that designation process compare to Europe and others across
the globe when it comes to the use of that process?
Mr. Elwell. So it's another excellent question. The
European Aviation Safety Agency is the next, you know, biggest
certification body in the world and they leverage ODA much more
than we do. So it's used around the world.
Senator Moran. So in this arena, there's nothing unusual to
this process?
Mr. Elwell. No.
Senator Moran. It has been ongoing a long time and used
globally, is that true?
Mr. Elwell. Couldn't have said it better myself.
Senator Moran. Thank you. Thank you, Mr. Chairman.
Senator Cruz. Senator Blumenthal.
STATEMENT OF HON. RICHARD BLUMENTHAL,
U.S. SENATOR FROM CONNECTICUT
Senator Blumenthal. Thanks, Mr. Chairman, and I want to
thank the leadership of the Committee for having this hearing.
Thank you for being here today, gentlemen, and I want to thank
particularly the Inspector General, Calvin Scovel. We are lucky
to have a professional of your caliber doing this investigation
and I look forward to the results.
I've been deeply disappointed, in fact shocked, that in
grounding these aircraft, American safety officials in effect
lagged instead of led the world. The same information was
available to our FAA as was accessible to every other country
that grounded its airline days ahead of us and that put
American passengers in peril.
But as important, maybe more so, is the system that led to
in effect outsourcing safety to the manufacturers of these
aircraft. Call it delegation or shifting, as you did. The fact
is that the FAA decided to do safety on the cheap, which is
neither cheap nor safe, and put the fox in charge of the
henhouse. That was true of the 737 Max 8.
In its rush to produce that aircraft because of competition
from Airbus, critical safety features were disregarded, and I'm
going to be introducing legislation that will reform this
system which is so fatally riddled with flaws. There needs to
be rigorous reform so that the FAA is put back in charge of
safety.
You said, Mr. Elwell, that the system is fact-based and
data-driven. The FAA should have the facts and should be
driving the data and making decisions. If the manufacturer has
the facts and the data, not the FAA, if its employees chosen,
hired, paid, fired by the manufacturer are the ones making
these critical decisions and the FAA lacks all of the facts and
data necessary to properly oversee them and overrule them, this
system of oversight is failing.
I will tell you I read some of the pilot reports. They're
public. NASA has them. They provided them to me. They are
chilling. If I'd been a passenger on one of those planes and I
knew about these incidents, I would have wanted a parachute.
Pilots of the airlines struggled to regain control of those
aircraft in the same way that the pilots of the fatally crashed
aircraft did. They succeeded, the others didn't.
So I look forward to your support for legislation that will
fundamentally change this flawed system.
Mr. Elwell, have you reviewed those pilot reports?
Mr. Elwell. Senator, thank you for your comments.
I reviewed the reports. There were----
Senator Blumenthal. Did you review them at the time that
they were received by NASA?
Mr. Elwell. The reports--I did not personally. The reports
were reviewed as they were written and received. There were 24
reports.
Senator Blumenthal. Were they reported to you after the
first crash because many of them followed the first crash?
Mr. Elwell. The ASRS reports were reviewed and compared
against the FDR data or FOQA data that we look at. ASRS reports
are reports from pilots on experiences when they are on a trip.
We take them very seriously. We review them. We have event
review teams that sit down with the pilot and none of the 24
reports associated with the Max related to the MCAS or related
to what the pilots experienced in either accident.
Senator Blumenthal. Well, I am familiar with the reports
that were given to me----
Mr. Elwell. Yes, sir.
Senator Blumenthal.--and my time is limited here. Let me
just ask you. Were you contacted by anyone in the
Administration before making your decision to ground those
aircraft?
Mr. Elwell. From the moment, Senator, of the Ethiopian
accident until we grounded on Wednesday morning, I kept
Secretary Chao and the President briefed and fully apprised on
all of our activities, which included, I would add, a full----
Senator Blumenthal. Did she order you to ground the
aircraft?
Mr. Elwell. I'm sorry?
Senator Blumenthal. Did she order you or otherwise
recommend what your decision should be in grounding the
aircraft?
Mr. Elwell. Senator, the decision to ground, to make an
emergency grounding of a fleet of aircraft is vested in the
FAA. I made that decision.
Senator Blumenthal. And one last question. I don't know
whether you've seen a ProPublica report. It's just come to my
attention. I think it came out today, which reports your
contacts with airlines.
Could you provide us copies of the e-mails between yourself
and industry representatives and also a copy of your financial
disclosure forms? I understand you had a consulting business
while you were a part of the FAA, is that correct?
Mr. Elwell. That's not correct, Senator. I'm happy to
supply any and all communications.
Senator Blumenthal. I want to give you a full opportunity
to respond to the article that's just been provided to me, but
it says that on those financial disclosure forms, you reported
some income as a special government employee while you were a
member of the FAA.
Mr. Elwell. Happy to provide any and all information.
Senator Blumenthal. Thank you. Thank you, Mr. Chairman.
Senator Cruz. Senator Blunt.
STATEMENT OF HON. ROY BLUNT,
U.S. SENATOR FROM MISSOURI
Senator Blunt. Thank you, Mr. Chairman.
So, Mr. Elwell, I think established in the questions with
Senator Moran the long history of delegating certification. Let
me ask a couple more questions about that.
The Seattle Times recently reported that FAA technical
experts and safety engineers said in interviews that they were
urged to delegate more responsibility to Boeing during the 737
Max certification process or to speed it up.
Does the FAA still retain the mandate to certify aviation
technologies that are new or novel?
Mr. Elwell. Yes, Senator, we do. That is our authority and
it's our sole authority. We do not allow self-certification of
any kind.
Senator Blunt. Were there any deviations from that policy
in regards to the Boeing 737 Max?
Mr. Elwell. Sir, none of which I'm aware. We have a very
good whistleblower program at the FAA. We encourage all levels
of employees to report any activity that they find that doesn't
go with our safety culture and I looked into this personally.
There were no comments made by employees to our knowledge. I
can't speak to the Seattle Times article.
Senator Blunt. And it's your view that FAA managers did
conduct the kind of reviews of that delegated authority that
they're expected to conduct?
Mr. Elwell. Absolutely. Yes, sir.
Senator Blunt. Well, let's go back to the investigation
going on right now. I think, Mr. Sumwalt, you said that--I
think you said that we were cooperating closely with the
investigation, the Ethiopian investigation.
Is that cooperating closely, is that the right phrase?
Mr. Sumwalt. Well, I'd actually say we're actively engaged.
We have investigators on the ground in Ethiopia that are
assisting and advising the Ethiopian Government as well as
helping them to put together a draft interim report.
Senator Blunt. Are they cooperating closely with you then?
Mr. Sumwalt. Yes, sir, they are.
Senator Blunt. And are you getting access to all the
information you'd like to have access to?
Mr. Sumwalt. At this time, we are.
Senator Blunt. I know it's a much smaller agency than your
agency in terms of budget and size and experience. How would
you compare this investigation to other investigations you've
been involved in and what are you doing to make up differences,
if there are differences?
Mr. Sumwalt. Well, I don't want to sound like I'm bragging
because I'm not. The NTSB has a lot of experience with
investigating crashes. We've been in business for 52 years. So
we have a lot of experience, but as an accredited
representative to foreign investigations, we often find that
other countries do not have the resources that we do. So we are
very experienced with working with other countries, other
states to help them, and I think that this investigation is
going as it should.
The Ethiopians, again this is, like I wasn't bragging and
this next statement is not a derogatory statement, they don't
have the experience that we have because they haven't
investigated the number of crashes that we have over the years.
They're a relatively new agency. So they are proceeding very
deliberately and very cautiously.
Senator Blunt. There was another comment made earlier about
a prohibition unless information's been cleared by the host
country. I believe the way I heard that, that was for you to
share that information with others.
Does that suggest that there's information that's not being
shared with you?
Mr. Sumwalt. I have no indication at all that the
Ethiopians are not sharing with us the information that we need
to make sure that we are aware of the safety-related
information that we need to feed back to the FAA or feed back
to Boeing to ensure continued airworthiness safety.
Senator Blunt. And those earlier comments were about
whether you could publicly share that information without the
host government agreeing with that, is that right?
Mr. Sumwalt. That is correct. However, the law does further
state that nothing in this subsection shall restrict the Board
at any time from referring to a foreign accident investigation
information in making safety recommendations.
So, in other words, if we identify safety-related
information that we need to make a safety recommendation, then
we can use that information, but we would always want to
coordinate that ahead of time with the state of occurrence.
Senator Blunt. So you don't feel unduly restricted by that
prohibition of releasing information?
Mr. Sumwalt. I do not, but it is--and to be clear, as
you've characterized it, it is for the public release of
information is what the law is specifically calling for.
Senator Blunt. That's helpful for me.
Mr. Scovel, do you want to comment on that?
Mr. Scovel. Thank you, Senator Blunt.
Not on that particular question. Thanks for recognizing my
signal just for a moment. I may have information that may help
you and the Committee in understanding the Seattle Times point
that you mentioned in an earlier question, and I want to refer
back to our 2015 Audit Report on ODA.
In the course of that work, we reviewed four ODA company
self audits that identified employee concerns about undue
pressure which could lead to rushing safety-critical tasks to
meet production schedules.
Now I want to clarify these were not U.S. DOT Inspector
General audits. These were company self audits that were
required by FAA as part of its oversight process for ODA.
It's unclear to us what FAA may have known about those
company self audits. As I mentioned, there were four of them.
Two involved Boeing in fact, one in the Seattle area dating to
2013 and the other was from Boeing's Charleston, South
Carolina, facility in 2014. The remaining two concerned Bell
Helicopter, both in Ft. Worth, 2013 and 2014.
We didn't step into the shoes of the safety regulator. It's
not in our lane to do that, but when we learned about the self
audits, we determined that it would be appropriate for us to
make a recommendation to FAA that they find the best way to use
those company self audits in order to enhance their oversight
of the companies' ODA processes.
Senator Blunt. When would you have made that
recommendation?
Mr. Scovel. That was in 2015, sir.
Senator Blunt. Mr. Elwell, do you know what the follow up
from the FAA was on that recommendation?
Mr. Scovel. I can help you on that, too, sir. I'll pass to
my colleague to take an answer on that, but I also have what is
the auditor's answer, as well.
Senator Blunt. And what was it?
Mr. Scovel. We made the recommendation and FAA concurred.
They took action to our satisfaction to address the
recommendation, the intent behind it, and so we closed that
recommendation.
What remains to be done, and this is the typical audit
process, is to see how it's effectively implemented going
forward. So when we close a recommendation, it means that the
agency is poised to execute it but it may in some cases be a
matter of years before we return to see the effectiveness of
that implementation.
Senator Blunt. Mr. Elwell, do you want to add anything?
Mr. Elwell. I'd like to thank the Inspector General. We did
an audit of our whistleblower program and so I need to go back
and look at this self audit information that General Scovel's
talking about and----
Senator Blunt. Then you'll respond to the record with what
you find?
Mr. Elwell. Absolutely.
Senator Blunt. Thank you.
Senator Cruz. Senator Duckworth.
STATEMENT OF HON. TAMMY DUCKWORTH,
U.S. SENATOR FROM ILLINOIS
Senator Duckworth. Thank you, Mr. Chairman.
And, Mr. Elwell, I want to touch on the training aspect of
pilots in general of aircraft certified by the FAA and then
also about the specific Max 8 aircraft.
Would it be a true statement to say that U.S. pilots
properly trained would know how to respond to an uncommanded
nose-down pitch rate on an aircraft with an automated--I'll
give you an example. I flew the Blackhawk.
Mr. Elwell. Yes, ma'am.
Senator Duckworth. It went through a real problem in the
beginning of its development and to this day, I know the
procedure for uncommanded nose-down rate, right.
Mr. Elwell. Mm-hmm.
Senator Duckworth. So I know it by heart. I will always
know it until the day I die.
Is that something that most pilots would be able to
basically say what those steps or those memory items if they're
properly trained under U.S. system?
Mr. Elwell. Yes, Senator Duckworth, our American U.S.-
trained pilots of large commercial aircraft know that procedure
and if I might,----
Senator Duckworth. Yes.
Mr. Elwell.--I wanted to amplify what we were doing prior
to the grounding on Wednesday, one of the things we were doing,
I was doing, is talking to the heads of all of the pilot groups
that flew the Max and asking did they have reservations about
the Max.
This is in addition to data we got from 57--over 50,000 Max
flights in North America, Canada and the U.S., and in those
data reports, and those are data reports that are coming right
off the airplanes, there was not a single case in North America
of an MCAS malfunction or what we found happened in Lion Air,
but that wasn't enough.
I called and talked to the presidents of the Southwest
Airline Pilots Organization, ALPA, over 53,000 pilots, and APA,
the American Airlines Pilots Group, and asked them what is your
experience flying the Max? What are your pilots saying? They
said to a person, to a group we are absolutely confident in the
safety of this aircraft and our pilots' level of training in
flying it.
If I hadn't had that information, the data, and the
affidavits from those unions or from those pilot groups, I
would not have been able--that's part of the data package I had
to wait for the data from the accidents to justify a grounding.
Senator Duckworth. Let me then ask you about--so we talked
a bit about just responding to an uncommanded nose-down
attitude. That aside, there's another procedure. My experience
as a Blackhawk pilot, we have the stabilator that would slow
down, killed a bunch of pilots, hurt a bunch of people, but the
automatic control system, the basic procedure is reset. If it
doesn't reset, turn it off, manual control, slow to zero at
about 40 knots indicated airspeed. I know nothing you ever flew
ever went as slow as 40 knots indicated airspeed as I did, slow
and low pilots.
The question I have for you is, while the MCAS is not
specifically referenced in the aircraft manual for the Max 8,
the procedure to shut off stabilizer trim switches are in the
manual as a response to this, is that correct, and this is
something that American pilots would be trained on?
Mr. Elwell. Yes, ma'am.
Senator Duckworth. Is this something that FAA, through
ICAO, would ensure that other pilots in other countries should
also be trained on?
Mr. Elwell. When we interact at ICAO, it is usually not to
the specificity of a fleet type, but we do use our influence at
ICAO and our influence at the International Civil Aviation
Organization is substantial and we use it at any opportunity we
get to raise the safety level around the world.
In fact, we don't have the final reports on either of these
accidents, but I have already set in motion at the FAA
activities to go to the Assembly and, as you know, I'm sure,
ICAO meets every 3 years and we're already examining what we
bring to the Assembly this year, our country, our pilots, to
help raise the safety bar, which is, as you know, we're
responsible for aviation safety in the United States, but there
are no boundaries, there's no border. It's a global endeavor.
We care deeply about other countries and we have over a
hundred technical assistance agreements around the world. We
have 20 bilateral aviation safety agreements with 47 countries.
We're very, very passionate not just about safety in the U.S.
but that every country raises their safety bar.
Senator Duckworth. So are you saying that we need to look
at strengthening the International Aviation Safety Assessment
Program and do you plan on doing that in the next ICAO meeting?
Mr. Elwell. The International Aviation Safety Assessment
Program, I think, is sound. It's very good. The IASA that we do
with countries around the world--because what we do is we
evaluate the Civil Aviation Authority and a healthy Civil
Aviation Authority tells you that that country has a good
culture for everything--airports, pilots, airlines--but by
working to help raise the standards overall, then when we do an
IASA in a country and we do a rating, we'll be rating against
higher standards and I think that that's appropriate and it's
well worth our attention.
Senator Duckworth. Thank you. I'm out of time, Mr.
Chairman. Thank you.
Senator Cruz. Senator Capito.
STATEMENT OF HON. SHELLEY MOORE CAPITO,
U.S. SENATOR FROM WEST VIRGINIA
Senator Moore Capito. Thank you, Mr. Chairman. Thank all of
you for being here.
Mr. Elwell, let me just make sure I understand exactly
because some of the questioning from Senator Duckworth is
similar to what I was going to ask you.
So the plane, the 737 Max 8 with MCAS, has been flying
since 2017, is that correct?
Mr. Elwell. Yes, ma'am.
Senator Moore Capito. OK. And you said, and I have a report
here that says, in the wake of the Airworthiness Directive and
discovery of possible issue with MCAS on Boeing 737 Max, this
is quoted from an article in Bloomberg, I believe, it says, ``A
number of pilot groups raised concerns over whether or not
pilots had been sufficiently made aware of the system that is
unique to that aircraft.''
Did you just say that nobody had raised issues about this
system previous to either one of these accidents or maybe in
between the two of them?
Mr. Elwell. Senator, what I was remarking upon is we look
at the data that comes off aircraft that's called FOQA data and
please don't ask me what the letters mean, but what that is, is
data that literally comes off the flight data recorder. It's
ones and zeroes that come off of aircraft and airlines get that
data.
They use that data in their safety management systems and
when we ask for that data and we ask for it to be filtered on
certain parameters, they give that data to us and what I'm
saying is there were no incidents on Max flights in North
America. There was no incident of this happening.
Now when I say also that the pilot reports that Senator
Blumenthal mentioned earlier, the ASRS or the NASA reports, I
personally read--there were 24 of them. I read every one of
them and I'm not the key expert in this determination, but they
were all looked at and determined and I concurred none of them
went to the MCAS. None of them demonstrated an MCAS malfunction
and that's what I meant.
Now what you're referring to----
Senator Moore Capito. What am I referring to?
Mr. Elwell. Senator, I believe what you're referring to is
when the accident first happened, there were some pilots who
said we would have liked to have read about that MCAS. We would
liked to have known that. That wasn't in the manual. One of the
things that we did in our Emergency AD was direct to have MCAS
explained in the flight operating manual.
Senator Moore Capito. OK. So that was in between the first
accident and the second accident?
Mr. Elwell. Yes, ma'am.
Senator Moore Capito. OK. Then let me ask then you about
the training then that occurred after that. It's given in a
short self-administered online course. How does that work? Are
you in a testing center? Are you on your own in your own laptop
and you just check box, box, box? How's that administered? How
is a self--I mean, we've all taken self-administered computer
tests. How do you ensure that this is absorbed and that the
person actually taking it is the person taking it?
Mr. Elwell. Well, first of all, as a former pilot myself, I
will tell you that when you go through differences training and
that's what that is, differences training,----
Senator Moore Capito. Mm-hmm.
Mr. Elwell.--that isn't something you pencil with because
it's the aircraft you fly.
Senator Moore Capito. Right.
Mr. Elwell And our pilots in the United States are
incredible professionals. Now they can do that. They can do
that when they go to the Academy, when they go to the school--
--
Senator Moore Capito: Right.
Mr. Elwell.--for their respective airline. They can do that
in recurrent training. They can do it in initial training. I
imagine, and although I can't tell you now if this is the case,
that they could also do it on their computers at home, but all
of that training has a test at the end, a quiz at the end to
test for knowledge, and the important thing to note here is
that the determination was made because of the flying
characteristics of the Max versus the NG that this iPad
training that you read about was what was needed by pilots to
be able to fly the plane.
Senator Moore Capito. So was that required then in between
the two in the United States?
Mr. Elwell. It was always required.
Senator Moore Capito. It was always required.
Mr. Elwell. Yes, ma'am.
Senator Moore Capito. Let me ask you about another sort of
thing that you've seen out in the press and I don't really have
it specifically here and in terms of the fix to the airplane.
There are certain fixes that are going to be offered to
certain airlines and there may be different pricing and how
much is it going to be. There has been sort of a conflicting
story in the media. How do you respond to that? Do you know
anything about that?
Mr. Elwell. So, Senator, I read those reports or I read
those articles, and those I don't believe were characterized as
fixes. Those are options.
When an airline or anybody purchases an airplane like
anything else, there are options. As I was explaining before,
if it is a safety-critical display in the cockpit and we
certify it, it's required. It's not an option.
Senator Moore Capito. Right.
Mr. Elwell. So, you know, AOA displays, some airlines and
some pilot training, the pilots and pilot training groups, for
instance, the Navy, you know, love AOA displays in the
cockpits. The Air Force not so much.
It is a matter of every piece of real estate in a cockpit
is precious and you put one gauge up there, you're sacrificing
another.
Senator Moore Capito. Right.
Mr. Elwell. These are important distinctions and in this
case, those displays are not safety-critical because there are
other ways for pilots to gauge their energy state and that's
what an AOA gauge does. It tells you your energy state.
Senator Moore Capito. Well, not understanding the
technicalities of it, I would say that being a member of the
general flying public, it's hard to believe that a safety item
that could possibly be connected to taking down two jets and
killing over 300 people would ever be characterized as any kind
of an option.
Mr. Elwell. Right.
Senator Moore Capito. So I want you to have the chance to--
and I understand it is more technically involved than what I'm
representing, but that's how it's perceived to the flying
public.
Thank you.
Mr. Elwell. Thank you.
Senator Cruz. Senator Markey.
STATEMENT OF HON. EDWARD MARKEY,
U.S. SENATOR FROM MASSACHUSETTS
Senator Markey. Thank you, Mr. Chairman.
Mr. Elwell, as the safety agency entrusted to provide the
safest, most efficient aerospace system in the world, the FAA
must ensure that aviation safety is not a luxury that can be
bought and sold for an extra fee, but for Boeing, critical
safety features that could have saved the lives of 346 souls on
two of their 737 Max 8s were yet another profit center deemed
optional, like premium seats or extra bathrooms or fancy
lighting. That's wrong, just plain wrong, Mr. Elwell.
Boeing sold two safety features, the angle of attack
indicator and the warning lights, to the airlines for an
additional fee, not as a standard part of the aircraft. These
features could have alerted the pilots and aviation mechanics
that the doomed aircraft had faulty sensors which preliminary
findings suggest are the cause of these two aviation disasters.
Let's be clear. In our automobiles, we don't pay more for
seatbelts, for airbags, or in medicine for childproof caps.
Those aren't optional. Those are all built-in as safety
features to protect people, to protect families, and so should
all critical safety features on aircraft.
Administrator Elwell, do you believe that Boeing's practice
of selling the angle of attack indicator and warning lights as
separate optional features may have contributed to the Lion Air
and Ethiopian Airline crashes? Yes or no?
Mr. Elwell. Well, Senator, thank you for that question.
The AOA indicator, the AOA vane is not an optional piece of
equipment on the airplane. We look in the certification process
that we've been using for decades that we've refined over 130
times is geared toward one thing, the safest possible----
Senator Markey. Should all of the safety features have been
mandatory that could have alerted pilots and mechanics to
issues with the sensors? Should they have been mandatory? Yes
or no?
Mr. Elwell. Senator, safety-critical pieces of equipment on
an aircraft are mandatory. That's what certification does. If
it's safety-critical,----
Senator Markey. So you don't think that they should have
been mandatory? Is that what you're saying? Is that what you
just said? They should not have been mandatory?
Mr. Elwell. Sir, I'm saying that any----
Senator Markey. Yes or no? Should they have been mandatory?
Yes or no?
Mr. Elwell. Sir, the distinction between what goes in a
flight deck and what stays out is a discussion and whether or
not a display is safety-critical or not is a distinction that
FAA is qualified to make.
Senator Markey. Do you believe that charging additional
fees for these safety features and other safety features, like
backup fire extinguishers in the cargo hole and oxygen masks
for flight crews, may discourage airlines from equipping their
airlines with important safety systems? Yes or no?
Mr. Elwell. Well, Senator Markey, I find it hard to believe
that a safety company like an airline would save a couple
thousand dollars on an option that might improve safety on a--
--
Senator Markey. It may be hard for you to believe, but it's
happening and as a result, the safety agency has a
responsibility to make sure that an airline doesn't place----
Mr. Elwell. Absolutely.
Senator Markey.--profit over people's safety. Do you agree
with that?
Mr. Elwell. Senator Markey, I would tell you that----
Senator Markey. Do you think the FAA has the responsibility
to tell these airlines that they cannot change safety for
profits when it's clear that that safety device plays a huge
role in protecting the plane and its passengers? Yes or no?
Mr. Elwell. Senator Markey, that is our fundamental
responsibility.
Senator Markey. Yes or no? Should that be mandatory?
Mr. Elwell. Senator Markey, the fundamental role of the FAA
is to determine what the safety-critical aspects of every part
on that airplane----
Senator Markey. Should the FAA ban the practice of airlines
selling safety features ala carte to the airlines? Yes or no?
Mr. Elwell. Senator Markey, I will tell you that if there
is any manufacturer that sells a safety-critical part ala
carte, we will not permit it.
Senator Markey. Well, if you change the rules so that they
cannot do this, then that will be progress, but if business as
usual continues, then passengers are going to continue to be
vulnerable. So from my perspective, safety should never be ala
carte. Safety should never be optional. Safety should always be
mandatory and that's why I have sent a letter with 16 of my
colleagues to Boeing demanding that they never again have any
safety option as something that is discretionary with their own
profit model.
It is absolutely unacceptable and it's unacceptable for the
FAA to delegate to an airline what is safe, what is not, what
they can afford, what they cannot. This should not be an
option. Seatbelts, airbags, or whatever's in an airline should
never be optional.
So my view is that until the FAA finally stands up and says
that this is something that must change, then we are going to
have problems, big problems, and that's why I'm introducing
legislation with my colleagues to ensure that this never
happens again and that when something is determined to be a
safety feature that it no longer is an option for the airline
to include it or else we will just continue to see continued
repetition of what is happening because ultimately
overconfidence breeds complacency and complacency breeds
disaster.
We've seen it here and we'll see it again, unless we
mandate safety as something which is not optional.
Thank you, Mr. Chairman.
Senator Cruz. Senator Rosen.
STATEMENT OF HON. JACKY ROSEN,
U.S. SENATOR FROM NEVADA
Senator Rosen. Thank you, Chairman Cruz, and thank you to
all the witnesses for being here.
You know, I spent most of my career working as a computer
programmer and systems analyst with the focus on software. In
fact, in the 1980s, I worked for Hughes Aviation working out of
the General Aviation Terminal in Las Vegas, helping them write
programming that would assist in airplane maintenance and
inventory.
So from that perspective, I am very concerned about what
I've read and heard regarding the software for the 737 Max 8s
and Max 9s. Pilots have told me that there's significantly more
new software on these planes than usual and this is because
planes don't actually fly like a 737 without the software. The
physics of the plane is just a little bit different.
So, Mr. Scovel, let's talk a little bit about new
certification. Is this really a 737 or does it require a new
original certificate, and given that this plane, which is
equipped with highly advanced software and is flying today in
2019, I just want to say today is 2019, is flying off an
original certificate that was issued, and I'm sure you know
this well, in 1967. The Beatles were the top of the charts in
1967, no cell phones, no technology, very different, so
different kind of plane.
So do you think there could be some loopholes in the
current certification system that makes it perhaps a little bit
too easy for an airplane manufacturer to continue to buy this
or get a new original certificate?
I want to ask one other thing. If you can or supply this in
writing, can you tell us how many derivative certificates have
been issued for the 737 since it's originally been certified
over 50 years ago? It kind of seems like we had a canoe in 1967
and today you're certifying the cruise ship. They're not the
same.
Mr. Scovel. Thank you, Senator.
To your second question, I will defer to Mr. Elwell. I
believe he and FAA are in a better position than I am or my
office is to give you that particular number.
Senator Rosen. You can supply that in writing.
Mr. Scovel. Yes, ma'am.
Senator Rosen. That would be fine. Thank you.
Mr. Scovel. Be happy to.
Senator Rosen. And then you can answer the first question
about running off the 1967 certification.
Mr. Scovel. Right. I don't know the answer to your
question. We have not completed that audit work yet. We can
include it as a point that we will cover and we'd be happy to
report back to you and the rest of Congress and the Secretary.
Senator Rosen. Does it seem reasonable to think that you
should have a new certification or some updates since 1967,
except updates to the user manual, and that's fine. I'll look
for that in writing.
I want to go on to enforcement versus compliance at the
FAA. So some have argued that in recent years, the FAA's safety
philosophy has moved from one of enforcement to one of
compliance where, instead of penalizing safety violations
without penalty, the agency has instead given industry the
opportunity to correct the safety violations without penalty in
order to comply with FAA regulations.
So, Mr. Elwell, would you say that this is an accurate
characterization of the FAA's current approach?
Mr. Elwell. Thank you, Senator Rosen.
Compliance is the end game, enforcement is a tool, and when
we have a stakeholder in the system that is unwilling or unable
to comply with our regulations, enforcement is aggressively----
Senator Rosen. So would you say that this is the current
approach, enforcement versus compliance? Yes or no? Do you
think?
Mr. Elwell. Senator Rosen, what I'm saying is that
compliance is the end game and that's why it's called the
Compliance Program because we have enforcement as a tool but we
also work with people to fix their problems because it's much--
we've found in our years of safety regulation that it is a much
more productive model, and this is not something that we just
changed a couple years ago. This is an organic development of
our safety philosophy over decades, that when you work with
somebody who has made an honest mistake to get----
Senator Rosen. So we're going to say that's a no. So you're
working on compliance. So if that's not the case and the FAA's
robustly enforcing safety regulations, what steps can we now
take to ensure that rules are in place to prevent this from
happening again, and if proactive enforcement is paramount, why
did it take the first Max 8 crash for the FAA even to begin the
process of requiring Boeing to make software changes to prevent
these deadly malfunctions?
Mr. Elwell. Senator Rosen, the process by which we improve
safety is an oversight process that it is constantly refined,
ongoing. It involves compliance activities and it involves
enforcement.
What we have with Lion Air and Ethiopia are two tragic
accidents, the reasons for which we still don't know.
You can be assured by the FAA and by me that when the
results of these accidents come out, anything that we can
change and make better, we will. That's what we do. That is the
primary reason for our existence is to improve safety, but we
have to get all the data. We have to get all of the results
from the accident investigation. We don't know the cause, the
primary causes of these accidents, but when we do, you have my
assurance that we will take the action necessary that they
don't happen again.
Senator Rosen. Thank you. I have one last question about
the software.
You mentioned that it masks, it masks the problem for the
pilots, so that the pilots feel like the plane is flying the
way it should. It'd be like if I was driving my car and a wheel
flew off but my steering wheel still felt as if I had four
wheels.
So why would you have software that would mask a problem
like this? Can you explain?
Mr. Elwell. Senator Rosen, thank you for asking that
question because if that's the impression I gave on what MCAS
does, then I'm sorry because that's not what it does. It
doesn't mask a problem.
Senator Rosen. Well, you said it makes the plane feel like
it's flying to the pilot like it should.
Mr. Elwell. Well, see, what fly-by-wire technology does and
that's what the Max is, you know, when planes were first
designed and flown, the yoke was connected to cables and
pulleys and so you had direct interaction, physical interaction
with the flight controls. Pilots had the feel, sort of like
when you're driving your car, you turn the wheel.
Senator Rosen. Right. So the instrument's telling you one
thing and the feel's telling you another with the MCAS?
Mr. Elwell. No, that's not quite how it works. What the
MCAS does is it is a computer program that feeds information to
the yoke so that the input the pilot makes to the yoke is
proportional to what the flight controls do. It doesn't mask
any problem. What it does is give the proper feel to a pilot
because he doesn't have those cables and pulleys.
Senator Rosen. So he would feel as if the nose were going
down, going up, whatever he would feel?
Mr. Elwell. He would feel it and in fact that is what
happened and that's what happens if any computer or any device,
even the pitch trim motor, does something to the nose of the
airplane, the pilot's going to feel it.
Senator Rosen. Would feel that in his----
Mr. Elwell. Yes, yes, absolutely.
Senator Rosen. Thank you very much. I appreciate it.
Senator Cruz. Senator Udall.
STATEMENT OF HON. TOM UDALL,
U.S. SENATOR FROM NEW MEXICO
Senator Udall. Thank you, Chairman Cruz and Ranking Member
Sinema, for holding this important hearing, and I know you guys
have been here for two hours. So I'll try to just get to the
point here.
I first requested an aviation hearing on aviation safety
last April when in Albuquerque we lost a shining light, a woman
by the name of Jennifer Riordan. She was flying home from
Philadelphia on a Southwest Airlines flight when a fan blade
caused an engine to fail, you guys are nodding you understand
this one, shattered a window and partially pulled Mrs. Riordan
out of the plane.
This incident was shocking but it was not the first time
this engine type failed, and I know that this is just a first
of a series of conversations on how we can improve the
oversight of the Federal Aviation Administration, including
rethinking, if necessary, the airworthiness certification
process.
Another important issue we must discuss is the integrity of
the engines that are used. Many of us may not be aware but
yesterday, Southwest Airlines 727 Max engine, a CFM Leap 1B,
had an emergency landing during a flight to the Southern
California Logistics Airport. This is at least the third
Southwest Airlines that has had an emergency airline caused by
engine troubles, all stemming from the same manufacturer of
engines.
Mr. Chairman, I would seek unanimous consent to add an
article on these engine troubles from the Seattle Times to the
record.
Senator Cruz. Without objection.
[Seattle Times newspaper article follows:]
The Seattle Times--Originally published June 15, 2018 at 6:00 am /
Updated June 18, 2018 at 10:37 am
Troublesome advanced engines for Boeing, Airbus jets have disrupted
airlines and shaken travelers
By Dominic Gates--Seattle Times aerospace reporter
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
In 2014, Air New Zealand and Boeing showed off the first delivered
787-9 Dreamliner at Paine Field in Everett as finishing touches were
put on the casing of a Rolls-Royce Trent 1000 engine. (Mike Siegel/The
Seattle Times)
A slew of technical problems with the three latest-technology jet
engines is widely disrupting operations at airlines, bleeding cash from
the engine makers and grounding significant numbers of Airbus and
Boeing jets.
A slew of technical problems with the three most advanced models of
jet aircraft engines is widely disrupting operations at airlines,
bleeding cash from the engine makers and grounding significant numbers
of Airbus and Boeing jets.
The most difficult of the issues has this month left almost 50
Boeing 787 Dreamliners sold to some of the world's top airlines sitting
powerless on the ground, waiting for engines before they can fly again.
And if the problem isn't contained, it could derail Boeing's plan
to raise the 787 production rate next year.
British engine manufacturer Rolls-Royce has been inspecting its
Trent 1000 engines on the Dreamliners for cracked turbine blades deep
inside, and taking off those with cracks for repair.
The number discovered to have problems has ``outstripped our
ability to support the customers with spare engines,'' said Trent 1000
project director Gary Moore in an interview.
``We are causing a very disproportionate amount of disruption at
this moment.''
Steve Udvar-Hazy, chairman of Air Lease Corp. and a leading figure
in the airline world, said disruption from the grounded jets is
compounded by airlines having to reroute some of the Dreamliners they
can still fly.
Flights across the Pacific, in particular, can no longer fly normal
routes because, in case of an engine emergency, safety agencies now
limit Dreamliners powered by one of the Trent 1000 engine models under
scrutiny to flying no more than 2.3 hours from the nearest airport--
down from 5.5 hours previously.
``It's having a huge impact. It affects a lot of the key 787
operators,'' said Udvar-Hazy. ``There's a lot of scrambling going on.''
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
No quick fixes
The impact won't be short term.
Rolls is returning the repaired engines to airlines with only a
temporary fix. A permanent modification won't be available until the
end of the year at the earliest.
``Those engines will have to come back to us when the final fix is
available,'' said Moore.
Meanwhile, repeated technical problems with another engine--Pratt &
Whitney's Geared Turbofan (GTF), the innovative new design that will
power close to half of the Airbus A320neo fleet--have caused Pratt to
fall way behind in deliveries, leaving engineless planes to stack up on
the ground at Airbus factories.
At a gathering of the world's top airline executives in Sydney this
month, Guillaume Faury, the new president of Airbus Commercial
Aircraft, said that by the end of June the European jetmaker will have
about 100 otherwise completed A320neos sitting grounded without engines
outside its final-assembly plants in Toulouse, France, and Hamburg,
Germany.
``We have an industrial crisis to manage,'' Faury told trade
publication Aviation Week.
In comparison, the problems with the third engine--CFM
International's LEAP engine, which powers the rest of the Airbus
A320neos and all of Boeing's 737 MAXs--are less severe.
Boeing says it's been able to minimize the impact on MAX
deliveries. But CFM had to remove dozens of LEAP engines from A320neos
for repair, and LEAP deliveries to Airbus are running up to six weeks
behind schedule.
Problems emerge late
These latest engines, all marvels of sophisticated engineering,
incorporate significantly new technologies: new alloys in the Trent
1000, a gearbox to slow the fan speed in the GTF, ceramics in the
hottest part of the LEAP.
All were certified as safe by the Federal Aviation Administration
(FAA) and its European equivalent, the European Aviation Safety Agency
(EASA).
And all three are powering the latest generation of fuel-efficient
Airbus and Boeing aircraft where production rates are rising sharply to
levels never before anticipated: heading up to 14 jets per month for
the widebody 787, and to 60 jets per month and higher for the
narrowbody 737 and A320 aircraft.
``The new technology aircraft bring tremendous economics and
operating performance to the airlines, but they are only as good as the
engines,'' said Udvar-Hazy. ``We have never seen this unprecedented
number of aircraft scheduled to be produced at the very time when we
have all these engine issues.''
Unfortunately, so-called ``teething problems'' with new technology
may not show up until the engines have been used for several thousand
hours in all kinds of climate conditions.
``The issue with engine certification is that's there's really no
substitute for in-service experience,'' Hazy said.
FAA spokesman Les Dorr said the safety agency monitors newly
certified engines after they enter service for issues ``that were not
evident in the certification phase.''
Most Read Business Stories
1 Apple says it plans to turn Seattle into `key engineering hub'
with 2,000 new workers
2 Seattle is `a notable exception' for stalled home prices
3 Sellers in Amazon's bookstore feel beaten up by counterfeit Wild
West
4 Housing crunch sends bigger populations to smaller towns
5 Nintendo's Doug Bowser begins his reign, enjoying jokes about his
namesake Mario nemesis
And when engine makers come up with fixes to such issues, they
cannot be installed on airplanes until the FAA analyzes, tests and
certifies the changes.
``Engine modifications undergo the same scrutiny. . .as original
designs,'' Dorr said.
Airline trouble
The public's belief in airplane and jet-engine safety is
understandably shaken by terrifying accidents such as the April engine
explosion on a Southwest Airlines 737 that killed a female passenger
when shrapnel from the engine shattered the window by her seat,
depressurizing the plane and partially sucking her out of the aircraft.
Yet that was the first U.S. airline-passenger fatality due to an
accident in more than nine years, and the first in Southwest's history.
The engine that exploded, the CFM-56, has been in service since 1997,
has flown for some 350 million flight hours and has a reliability
record second to none.
Statistically, flying is the safest form of modern travel.
Jet engines have become so immensely reliable that four-engine
airliners are fading into the past. Planes with just two engines safely
traverse vast expanses of oceans every day. If one engine fails in
flight, those jets readily fly for hours on the remaining engine to the
nearest airport.
And all the newest engines send critical performance data to the
ground in real time while in the air, so any irregularities are quickly
detected.
The latest engine issues have produced in-flight engine shutdowns
and aborted take-offs but no incidents that put passengers at risk. So
for the airlines, the risk is more to the reliable operation of the
airplanes than their safety.
Still, even the potential for the flaws to affect both engines of a
twin-engine plane while in flight was enough to spook safety regulators
to issue directives restricting flights on both the Rolls and Pratt
engines.
And the trouble created for the airlines, for Airbus and Boeing,
and especially for the engine makers, is serious and very expensive.
To satisfy the safety regulators and mitigate the impact on airline
operations, Rolls, Pratt and CFM are throwing engineering resources and
money at the technical problems.
``It's a very painful thing for all of them,'' said Udvar-Hazy.
On Friday, Rolls updated its projection of the cost of dealing with
the Trent engine crisis to a total of almost $950 million.
787 engine flaw
The latest hit to Rolls came when it was still dealing with the
fallout from an earlier Trent 1000 technical problem: corroded turbine
blades in the hot rear section of the engine.
After redesigning those blades with a new base metal and a new
coating, retrofitting the engines in service is still ongoing.
The more recent, and now more pressing, problem showed up when
cracks were found in the roots of the blades of the Intermediate-
Pressure Compressor (IPC), behind the fan at the front of the engine.
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Technicians make adjustments to a Rolls-Royce. . . (Mike Siegel/The
Seattle Times) More
Moore pointed to a design flaw: The vibrating frequency of the
compressor blades resonated with the frequency of the engine at high
thrust, magnifying the vibration to a level that over time caused the
cracks to develop.
The immediate need was to inspect the susceptible engines--
initially the ``Package C'' version of the Trent 1000, a total of 383
engines--and remove any with cracks for repair.
The problem intensified when fractured blades and excessive
vibration led to several inflight engine shutdowns and aborted
takeoffs.
In response, safety regulators gave Rolls until June 9 to complete
an initial set of inspections on Package C engines that have clocked
more than 300 flights, though all will have to be inspected eventually.
Two days after that deadline passed, Rolls announced that the
problem had spread: It found cracks in the IPC blades in a small number
of engines that are a different Trent 1000 variant, the ``Package B''
model.
That adds another 166 Dreamliner engines that must be inspected.
Intense response
Rolls must act fast or its rival GE, which also builds Dreamliner
engines, will grab its market share.
Within a month of finding the original IPC problem, Rolls engineers
developed and certified an ultrasonic inspection method to detect the
invisible cracks in the interior of the blades without taking the
engines off the wing.
It opened facilities in Singapore and the U.K. dedicated solely to
those repairs--dismantling the engines, replacing the cracked blades,
treating the remaining blades to close up any invisible micro-cracks,
and applying a protective lubricant.
British Airways, Air New Zealand, Virgin Atlantic, Norwegian and
LATAM Airlines of Chile were among the airlines forced to ground jets
when engines were removed for repair with no replacements.
Willie Walsh, chief executive of British Airways parent IAG, said
six of the airline's 26 Dreamliners are currently grounded, and he now
expects he won't get all of those back in service until late July.
``I have no issue with Boeing, who have been proactive and
supportive . . . I am however, very unhappy with Rolls-Royce,'' Walsh
said, via e-mail. ``They have yet to give us confidence that they are
on top of the problem.''
British Airways and Virgin Atlantic leased Airbus A330 aircraft to
fill the schedule gap. Air New Zealand leased two Boeing 777s to fill
in. Norwegian leased a four-engine Airbus A340 gas-guzzler to fly its
Paris-Los Angeles route.
Rolls hopes by year end to certify a permanent fix--a redesigned
blade with tolerances tweaked to shift its resonant frequency.
More on Aerospace
Bombardier sells CRJ jet program to Mitsubishi for $550M
SpaceX launches hefty rocket with 24 satellites, experiments
`I'm having a bad dream': Air Canada reviews how crew left
passenger on parked plane
The inside story of MCAS: How Boeing's 737 MAX system gained power
and lost safeguards / Times Watchdog
Trump shifts to talk of Air Force One
SpaceX, Boeing continue to struggle with spacecraft designs, as
watchdog raises safety concerns
Moore said Rolls engineers are now testing the first modified
hardware in a development engine at a facility in Derby, U.K., to
verify that ``we have moved the blade's frequency to a point where I no
longer have concerns.''
A second test engine will be used to confirm that the engine's
overall operation is unaffected by the change to the blades.
Next year, Rolls plans to gradually remove all those repaired
engines once again to install the permanent modifications.
Meanwhile, Boeing deployed teams worldwide with Rolls-Royce to try
to mitigate the disruption at affected airlines and tapped senior
executive Keith Leverkuhn to work directly with Rolls.
``Keith and I talk every day,'' said Moore.
Knife-edge seal
For Pratt & Whitney's new GTF engine, developed starting in the
early 2000s at a cost of more than $10 billion, the advance worry was
that it might run into trouble with the engine's big technology
innovation: the gearbox that allows the fan to run slower and more
efficiently.
It turns out the gearbox has operated smoothly with no issues.
However, the GTF did run into a rash of other ``teething problems.''
Though Pratt developed fixes for all of them and the latest engines
it's building are up to date with those fixes, GTF production has been
hampered and delayed, and deliveries to Airbus were interrupted.
Spokeswoman Jenny Dervin said the latest problem arose after a
batch of engineering changes were introduced last December to improve
the durability of the High Pressure Compressor (HPC).
Instead, the changes caused ``the knife-edge seal'' in the HPC's
aft hub to fracture, resulting in sudden vibration and engine stall in
some A320neos. This led to several inflight engine shutdowns and
aborted take-offs.
``By the end of January, we knew we'd have to recall the engines,''
Dervin said.
Only 98 engines had been built with the defective seals--43 in
service and another 55 still at the Airbus final assembly plants.
In February, EASA issued an airworthiness directive prohibiting
airlines from flying any plane that had the defect on both engines.
India's air-safety regulator grounded planes having even one such
engine.
By now, no GTF engines flying anywhere have the defective seal. For
Pratt, what remains is to clear the backlog of engines to be delivered
to Airbus.
Loss of a thin coating
For CFM's LEAP engine, and specifically for Boeing's 737 MAX, the
introduction into service has been smoother. On the MAX and the Airbus
A320neo, LEAP engines are now powering 342 aircraft with 56 airlines.
However, the LEAP was hit by one technical glitch related to a key
innovation: a ceramic composite lining that shrouds the hottest part of
the engine, the first rotor of the High-Pressure Turbine just aft of
the fuel combustion chamber.
This ceramic material requires a thin protective coating. Rick
Lowden, a research scientist at Oak Ridge National Laboratory, which
developed the ceramic material, said that without such a coating,
moisture in the gas emerging from the combustor will oxidize the
ceramics and gradually ``eat it away.''
CFM spokeswoman Jamie Jewell said engineers found a ``premature
loss'' of this coating in service.
``This is not a safety or operational issue,'' Jewell said, adding
that the problem hasn't caused any incidents during thousands of hours
of engine tests and more than a million engine in-service flight hours.
To fix it, CFM designed a new coating. That's being introduced into
full-rate production for aircraft deliveries starting this month.
And about 60 LEAP engines were removed from A320neos for
modification, none from 737 MAXs.
``Each of those removals were scheduled in advance and we are
supporting the removals with around 70 spare engines,'' Jewell said.
Boeing said that there have been some delays in delivery of MAX
engines but so far no airplane deliveries are late.
Flying hotter, tighter and harder
Airlines today operate jet engines harder than ever before. They're
built to tighter tolerances and operate at higher pressures and hotter
temperatures.
They fly many more flights and much longer flights than in the
past.
Boeing projects that the 2016 worldwide airliner fleet of 23,500
jets will double in the next two decades, swelling the number of
engines in the sky.
But near term, the plans by Airbus and Boeing to hike A320neo, 737
MAX and 787 production significantly in the next two years cannot
happen until the engine makers sort out their problems and ramp up
production.
To deliver the reliability airlines demand on the narrowbody jets,
Pratt & Whitney and CFM must hope no further teething pains develop.
Rolls-Royce faces a more existential crisis.
It's separately going through a drastic financial and corporate
restructuring costing $670 million and on Thursday announced layoffs of
4,600 employees over the next two years.
A Rolls nightmare would be if the same blade-durability problems
show up later on the remaining variants of the Trent engine: the newest
version for the 787 the Trent TEN, or the Trent XWB for the Airbus
A350, or the Trent 7000 for the Airbus A330neo.
To survive, Rolls needs to convince airlines soon that the Trent's
technical problems are finally contained.
Senator Udall. My first question will be to Mr. Scovel.
As you heard, a constituent of mine was killed last year in
the Southwest Airlines accident because of a CFM engine
failure. You have initiated an audit of the safety practices.
What is your timeline for completing this audit and will
you include this most recent engine failure in your inquiry?
Mr. Scovel. Thank you, Senator.
For your first question, our timeline, we anticipate
completing our review of Southwest Airlines maintenance
practices by the end of this summer. We're looking not only at
maintenance practices but also at certain operational issues to
include and weight balance questions, and also a concern that
was brought to our attention about Southwest's acquisition of a
certain number of used aircraft and the fact that they may be
flying in the United States reportedly without proper
documentation. We don't know. That's one of the things that we
need to look into to complete our audit.
Senator Udall. And are you going to use the most recent
engine failure in your inquiry?
Mr. Scovel. We'll see what we can derive from that. The one
last night, sir, off the 737?
Senator Udall. All three of the ones I mentioned.
Mr. Scovel. For the first two, yes and we'll see what
information is available to us regarding the most recent one.
Yes, sir.
Senator Udall. Chairman Sumwalt, in your testimony, you
referenced a Southwest Airlines accident that took the life of
Ms. Riordan. I know the initial investigative hearing was held
in November, but I'm concerned about the impact that the
government shutdown may have had on the investigation. As you
can imagine, the Riordan family is anxious to receive the
information from the investigation.
Can you tell me when the final report will be ready?
Mr. Sumwalt. Yes, sir. Thank you for that question.
I was the board member on scene in Philadelphia. I'm very
familiar with that tragic event. In November, we pointed out in
the investigative hearing that we had some modeling and some
structural analysis to do. We have completed that. We're in the
process now of drafting the final report.
So the report will be completed later this year. I will say
if we find any need for any urgent safety recommendations, we
are postured to be able to do that.
Senator Udall. Great. Thank you.
Mr. Scovel, one other question for you. As you know, Boeing
is one of the largest, most powerful companies in the country,
and a major government contractor with deep and wide
connections in Washington. This plane was key to Boeing's
future financial success. The company was locked in an intense
competition with Airbus. Reporting has indicated that the FAA
faced vigorous lobbying to approve the design and features of
this plane so it could get it to market as soon as possible.
Political appointees were urging career staff to get the
work done and a huge portion of that safety review work was
taken on by Boeing itself so that it was self-certifying its
own safety.
Given the size of Boeing and their political power, do you
think the FAA is truly capable of regulating them in an
independent way, and what changes need to be made in the
relationship between this company and its regulator to ensure
that the safety of the flying public remains the paramount
interest, not the quarterly profits of this company?
Mr. Scovel. Senator, FAA has authority, complete authority
currently to exercise responsibility over----
Senator Udall. Are they too cozy? Are they too cozy? That's
my pointed question right there with the industry.
Mr. Scovel. I don't have information yet to directly answer
your question. The focus of the first part of our ongoing audit
will be the certification process that FAA and Boeing employed
to approve the 737 Max. We hope to have some information
that'll inform your decisionmaking on that when we complete our
audits.
Senator Udall. Well, it is good. It's really important and
in this age where we talk about captured regulators and things
like that that you weigh in on these kinds of issues about are
they truly capable of doing their job.
Thank you, and thank you for the courtesies, Mr. Chairman,
for going over.
Senator Cruz. Thank you, Senator Udall.
Mr. Elwell, there were a couple of factual issues that came
up during the course of the hearing that we're going to follow
up with written questions and ask you to clarify.
One factual issue on which there was dispute, as you and I
discussed, the New York Times and others have reported that on
the earlier versions of the 737 when you pull back the yoke
that it disengaged the stabilization system but that that did
not happen on the 737 Max.
Your testimony to me, if I understood correctly, was that
that was not correct, although I heard Chairman Sumwalt
disagree on that point.
So we're going to ask you in writing to clarify how the
system operates. I think it's important to have a shared set
of--an agreed set of facts and to understand.
Likewise, when I asked you about the simulations that
pilots did as part of the certification, I asked in particular
if any of those simulations involved a faulty sensor producing
faulty data and how to respond to it.
My recollection is you were not certain as to the answer of
that. So I'm going you to go and verify and give us a clear
answer to that.
[Mr. Ellwell's answer follows:]
The MCAS system is designed to assist pilots during manual
operation. On earlier versions of the 737, and on the 737 MAX, pulling
back on the yoke disables the speed trim system, but does not disable
the MCAS on the 737 MAX.
Senator Cruz. I want to read to you some portions of an
article from Reuters from March 19, 2019, that purports to
describe what happened on the Lion Air crash and Reuters
reported, ``The pilots of the doomed Lion Air Boeing 737 Max
scrambled through a handbook to understand why the jet was
lurching downwards in the final minutes before it hit the
water, killing all 189 people onboard, three people with
knowledge of the cockpit voice recorder contents said.''
The article goes on to describe, ``The captain was at the
controls of Lion Air Flight JT610 when the nearly new jet took
off from Jakarta and the first officer was handling the radio,
according to preliminary report issued in November. Just two
minutes into the flight, the first officer reported a ``flight
control problem'' to the air traffic control and said the
pilots intended to maintain an altitude of 5,000 feet.
First officer did not specify the problem but one source
said airspeed was mentioned on the cockpit voice recording and
a second source said an indicator showed a problem on the
captain's display but not on the first officer's. The captain
asked the first officer to check the Quick Reference Handbook,
which contains checklists for abnormal events, the first source
said.
For the next nine minutes, the jet warned the pilot it was
in a stall and pushed the nose down in response, the report
showed. A stall is when the air flow over a plane's wing is too
weak to generate lift and keep it flying.
The captain fought to climb but the computer still
incorrectly sensing a stall continued to push the nose down
using the plane's trim system. Normally trim adjusts an
aircraft's control surfaces to ensure it flies straight and
level.
They didn?t seem to know that the trim was moving down, the
third source said. They talked only about airspeed and
altitude. That was the only thing they talked about.''
Do you have any reason to doubt that account of what
occurred in the final minutes of that flight?
Mr. Elwell. Well, Senator, the information I have is that
actually there has not been--and I would defer to Chairman
Sumwalt on this, but----
Senator Cruz. Please chime in, as well.
Mr. Elwell.--that the cockpit voice recorder is not
available to--I certainly haven't seen a readout and if I did,
to Chairman Sumwalt's point earlier, I wouldn't be at the
liberty to even talk about it.
But I would--and this actually is linked to what you said
earlier about the confusion about whether the 737 Max, when you
pull back, it stops, and I will admit to not having flown it
and maybe not getting that right, but what certainly--and I
will react to what you read, but I will qualify it by saying it
is entirely possible that what was written is not accurate.
But I will tell you, as I said numerous times in this
hearing, pilots of large aircraft are trained from day one when
the pitch of the aircraft is doing something you're not telling
it to do, you do runaway pitch trim checklist and in every
plane I've ever flown, it's called the Memory Item. You're not
fumbling through books. It's a time-critical procedure and you
go to that. You do it in the sim when you fly. It's a memory
item.
So some of what you read there, I can't tell you if that's
accurate. I can't tell you if that's straight from the
investigation or CVR. It disturbs me because it is not the way
I was trained and what I would expect pilots to do in that
situation.
Senator Cruz. You have any explanation for why something
like this might have happened, if the report is accurate?
Look, I'm not a pilot, but certainly the picture that is
painted there of the pilot frantically looking through the
checklist as the nose continues to adjust downward and as the
pilot is unable to correct that problem, that is not an image
that instills comfort or confidence, and it does not suggest
that the pilot is aware of how to correct for the system that
is adjusting the nose downward.
Do you have any explanation in terms of the training that
pilots undergo, how that would come to be?
Mr. Elwell. Mr. Chairman, it would be inappropriate for me
to comment any further on, first, an article whose veracity I
can't ascertain right now, and I've no comment on--other than,
yes, it sounds like a terrible situation, but I have no way of
knowing that that account is accurate. So it would be
inappropriate for me to comment on it.
Senator Cruz. But there's nothing in the pilot training
that the FAA required about the MCAS System and how to correct
for it, is that accurate?
Mr. Elwell. Senator, the MCAS is not something you fly.
It's not something you would get in a simulator and fly the
MCAS.
Senator Cruz. I didn't say you'd fly the MCAS. I said
there's nothing in the pilot training about the MCAS System
adjusting the nose of the plane downward and how to compensate
for that in the event of a malfunctioning sensor. Is that
accurate that the training does not include that?
Mr. Elwell. Senator, Senator, I would actually say that it
is accounted for in the training and the accounting for that in
the training is that that MCAS--inappropriate input of the MCAS
is runaway pitch trim and runaway pitch trim is trained and
trained and trained by every pilot who flies a large aircraft.
Senator Cruz. Chairman Sumwalt, do you have any additional
points on this line of inquiry?
Mr. Sumwalt. No, sir, I do not.
Senator Cruz. OK. One final avenue of questions, Mr.
Scovel.
I want to draw your attention to a June 22, 2012,
memorandum from your office titled FAA Transport Airplane
Directorate, Seattle, Washington. Are you familiar with this
document?
Mr. Scovel. Yes, I am, Mr. Chairman.
Senator Cruz. Good. The 2012 memorandum specifically states
that your office's investigation ``substantiated employee
allegations that TAD,'' which is the FAA's Transport Airplane
Directorate, ``and FAA Headquarters managers have not always
supported TAD employee efforts to hold Boeing accountable,''
and it further discusses TAD employee concerns that Boeing
employees in the Boeing Certificate Office might have
``delivery of airplanes as part of their performance
standards.''
The concerns described in that memo paint a troubling
picture of agency capture. Do the concerns in the 2012 memo, do
you still have those concerns, and do you see an ongoing
pattern like that described in the 2012 memo?
Mr. Scovel. Mr. Chairman, I'm confident they fully describe
my office's findings at the time in 2010, 2011, and early 2012,
when we were doing the investigation work that led to that
memorandum from the Office of Inspector General to FAA.
I don't know in 2019 whether those conditions still
prevail.
Senator Cruz. Well, this Subcommittee will eagerly await
your investigation and assessment of that question because it
is a critical question for evaluating ongoing safety.
Senator Blumenthal.
Senator Blumenthal. Thanks, Mr. Chairman.
Let me just ask a few questions pursuing that same avenue,
Inspector General Scovel.
I'm assuming that that issue of agency capture or improper
influence will be part of the investigation you're doing in
response to my request, correct?
Mr. Scovel. Yes, it certainly will be, and I should add
we're always on the lookout for it. We've called it out in the
past.
Senator Blumenthal. That's your job.
Mr. Scovel. It is. We've done it several times with
individual FAA employees in their roles as inspectors at
Southwest, at American most recently, and in a report that we
issued last summer, and in the 2012 report involving FAA
employees at the FAA ODA Oversight Office in Seattle.
Senator Blumenthal. So you'll be looking for any calls or
contacts from Boeing or airlines or anyone else that may have
impacted the FAA decisionmaking?
Mr. Scovel. It's part of the certification process and
that's what you and the Secretary and others have requested.
That's the mail we're going to answer, sir.
Senator Blumenthal. Mr. Elwell, when we finished, we were
talking about the decision to ground the airplanes, which you
said was your own exclusively, correct? How did it happen then
that it was announced by the President?
Mr. Elwell. Senator Blumenthal, as I testified earlier,
from the moment of the Ethiopian accident and I became first
aware of it till I grounded the airplanes, I briefed and kept
the Secretary and the President apprised of all of our actions,
as I would always do with something this significant, and
shortly after--leading up to and then shortly after making the
decision to ground the aircraft, I again briefed the Secretary
and the President and the President, it came to my attention,
was very shortly thereafter going to an already-planned press
event and as is his prerogative as Commander-in-Chief, he
talked about the briefing that I gave and what my intentions
were and it actually preceded the official announcement of the
Emergency Order.
Senator Blumenthal. So you briefed him----
Mr. Elwell. So that was the timing.
Senator Blumenthal. You briefed him directly?
Mr. Elwell. I briefed the President and the Secretary on my
decision and the data and the actions that led up to it.
Senator Blumenthal. Had he contacted you or anyone else in
the White House contacted you previously to that time?
Mr. Elwell. I kept the White House or the President and the
Secretary fully briefed and apprised of my actions leading up
to the grounding.
Senator Blumenthal. So between the time of the second crash
and the announcement of your decision, there were contacts
between you and the White House?
Mr. Elwell. I briefed the Secretary and the President on
the developments and kept them apprised.
Senator Blumenthal. And they gave you their views as to
whether the plane should be grounded?
Mr. Elwell. Well, sir, I briefed them on where I was going
with my data collection and my thinking right up until I
grounded the aircraft.
Senator Blumenthal. And let me repeat my question in case
it wasn't clear.
Mr. Elwell. Yes, sir.
Senator Blumenthal. Did they indicate to you, did they
express to you their views on whether that plane should be
grounded?
Mr. Elwell. Well, Secretary Chao never gave me any--told me
to ground or anything like that and consistent with
longstanding Executive Branch practice over many
Administrations, I'm not going to go into details of
conversations I had with the President.
Senator Blumenthal. Well, what's your claim of the reason
to refuse to answer that question?
Mr. Elwell. Well,----
Senator Blumenthal. Is that executive privilege? There is
no executive privilege.
Mr. Elwell. No, Senator. No, Senator. I'm just saying that
consistent with longstanding Executive Branch practice, many,
many Administrations, I'm not going to sit and get into details
about my conversations with the President. It's a longstanding
Executive Branch practice.
Senator Blumenthal. Really?
Mr. Elwell. Yes, sir.
Senator Blumenthal. Well, are you telling me that you are
not going to tell this committee what the President told you
about grounding the aircraft before you made that decision?
Mr. Elwell. Senator, I am just simply saying that I'm not
going to get into details about conversations I had with the
President. It's a longstanding Executive Branch practice.
Senator Blumenthal. I'm not aware of that longstanding--is
that grounded in law and, if so, what law?
Mr. Elwell. Well, sir, I am not a lawyer, but I'm not going
to talk about conversations that I had with the President.
Senator Blumenthal. Well, I can't force you to. I don't
think we can order you because we don't have that authority as
of right now, but I'm going to pursue that issue.
Mr. Elwell. Yes, sir.
Senator Blumenthal. Let me ask you. Under the ODA, is there
protection for whistleblowers if and when they come forward?
Mr. Elwell. Sir, it is my understanding that there's
protection for whistleblowers at all times, ODA or otherwise.
Senator Blumenthal. Well, let me rephrase it. Is there
protection for whistleblowers at Boeing? In other words, the
Boeing employees who have responsibility, they're hired, fired,
potentially disciplined, if they make decisions adverse to the
company' interests?
Mr. Elwell. Well, Senator Blumenthal, that is an excellent
question, and I'm not sitting here knowing. I don't know
Boeing's policies with regard to employee whistleblowers. There
may in fact be in the agreement, the ODA Agreement that we have
with the manufacturer a requirement for them to take on our
whistleblower protections, but I will get back to you. I'm not
sure sitting here.
Senator Blumenthal. I appreciate your getting back to me.
You're not aware of any protection for whistleblowers as you
sit here?
Mr. Elwell. I'm not aware that there is or there aren't,
but I will get back to you, sir.
Senator Blumenthal. Are you aware of any whistleblowers
coming forward about the Boeing 737 Max 8?
Mr. Elwell. I'm not aware of whistleblower complaints
particularly to what was being discussed earlier about
management pressure particularly. I've not gotten any from FAA
employees. In fact, one charge that was in one article that it
was claimed that FAA employees in Seattle were being rated
against production rates and I did look into that to see if
there was any evidence of that or any complaints in that area
and the answer was no.
Senator Blumenthal. Are you aware of any incentive bonuses
or payments by Boeing for certification decisions?
Mr. Elwell. You mean Boeing incentives to their employees?
Senator Blumenthal. Well, they're the ones who are employed
in this Certification Program, the ODA, right?
Mr. Elwell. Correct. And I'm not aware of that.
Senator Blumenthal. OK. I just have a couple more
questions. I really appreciate it, Mr. Chairman.
You and I talked in a briefing that you were kind enough to
provide some time ago and you indicated in response to one of
my questions about the government shutdown that it was not in
any way responsible for the delays in the development of new
software for the MCAS System, correct?
Mr. Elwell. Yes, sir.
Senator Blumenthal. So you are saying that any reports of
the impact of the government shutdown on any of the issues
involved here is not true?
Mr. Elwell. Well, Senator Blumenthal, I remember the
question and we actually got the question. The reason I was
able to answer you is because we had had that inquiry earlier
and we checked and for the work that we had to do on the
software update, we actually recalled the individuals. There
was no delay in the certification or the work on that and
because of our role of continuous operational safety, there
was--the shutdown did not impact our examination or
participation in continual operational safety post Lion Air.
Senator Blumenthal. And I think you explained to me that
the reason was that those employees were deemed to be essential
to safety----
Mr. Elwell. Yes, sir.
Senator Blumenthal.--and therefore essential employees, as
well.
Mr. Elwell. Yes, sir.
Senator Blumenthal. Just a couple more questions. On the
issue of training, and I appreciate the courage and strength of
the families coming to Congress and I'm struck by I guess the
feeling I would have that the training here really could and
should have been better for these pilots, and I know that the
investigation will go into the technical issues, but as a
passenger and a layman, my feeling was the training should have
been better. Would you agree?
Mr. Elwell. Senator Blumenthal, foreign accidents, as
Chairman Sumwalt mentioned, bring with them investigative
challenges. We are at the very earliest stage in the Ethiopian
accident.
Our responsibility of continuous operational safety means
that if anything comes out of these investigations that goes
directly to training, we would know about it so that we could
relay that information to the pilots and the system we oversee.
Of course, we don't oversee and regulate the training of
foreign practices but we do audit the Civil Aviation
Authorities of countries that fly to the U.S. and I believe
that this is an area that we will look into very, very
carefully because I believe we can use the FAA's credibility
internationally and despite what you might read in the press, I
believe that the FAA still is the gold standard, still has the
credibility around the world to make change.
We fight for it all the time. Our goal is to raise the
safety bar everywhere and that?s what I'm going to try to do
for the rest of my time in government service.
Senator Blumenthal. Well, I'm hoping and I am going to take
that answer as a yes because I think very unequivocally the
training should have been better and I welcome steps to make
sure it is better in the future. Thank you.
Senator Cruz. And let me follow up on Senator Blumenthal's
questions, both about training and whistleblowers. I want to
ask in particular about a March 12 article in the Dallas
Morning News that was entitled Several Boeing 737 Max 8 Pilots
in the U.S. Complained About Suspected Safety Flaw, and the
article begins by saying, ``Pilots repeatedly voiced safety
concerns about the Boeing 737 Max 8 fleet to Federal
authorities with one captain calling the flight manual
``inadequate and almost criminally insufficient'' several
months before Sunday's Ethiopian air crash that killed 157
people.
Are you familiar with these pilot complaints that are being
referenced in the Dallas Morning News story?
Mr. Elwell. Mr. Chairman, I am. That is a report, part of
the group of 24 reports that I reviewed personally and that the
FAA has reviewed. They are ASRS reports, otherwise known as
NASA reports. They were the first foray in our efforts to have
voluntary reporting and the history is important on voluntary
reporting with regard to ASRS reports.
I wrote many of them in my time as a commercial airline
pilot and the reason that they were in place is we wanted to
see if pilots could make reports of mistakes that they've made
in the field out in the system and be indemnified as long as it
was an honest mistake. Could we gather enough data and
information to make safety enhancements and make the system
better? It's been one of the most successful programs that
we've issued.
Now when I did them, I handwrote them. They weren't
Flintstone but they were--I handwrote them. Now they're
computer-entered and we looked at every one of those reports.
Now I don't know if the one you just quoted went to an event
review team, but when we find in these reports charges or
problems that need to be addressed more robustly, that's what
we have. We have an event review team. We bring the person who
made the report in with airline officials, with FAA officials,
and we sit down and we review the report.
That particular report, as I said, there have been 57,000
flights since we introduced the Max in the U.S. and that, to my
knowledge, is the only report of its kind from a pilot about
the inadequacy of the manuals. Like anything, we do a risk-
based analysis. We look at the body of reports and the body of
data.
I will look into whether or not that individual and his
complaint was addressed appropriately and get back to you.
Senator Cruz. OK. I would very much appreciate that. I will
say as someone who flies myself every week on commercial
airlines and my family flies every week and millions of
Americans fly regularly on these planes, we need the flying
public to have confidence about safety and I'll also note in
the state of Texas, tens of thousands, if not hundreds of
thousands of jobs depend upon the aviation industry and so that
confidence is critically important, and I have to say as a
passenger, I would certainly find it troubling.
[Mr. Elwell's answer follows:]
ASRS report 1593017 notes that a Boeing 737 MAX Captain expressed
concern that the flight manual did not fully describe the Maneuvering
Characteristics Augmentation System (MCAS) and the Angle of Attack
(AOA) system. Although we investigated this report and determined the
assertions were not actionable, the certification of the MCAS software
fix will include additional information on the MCAS function.
Senator Cruz. This is according to the Dallas Morning News,
a captain, if the captain is describing the training manual as
``inadequate and almost criminally insufficient,'' that is a
pretty serious charge and so I would appreciate your getting
back with the basis of that.
Does that complaint that is referenced and those other
complaints, does that trouble--I want to give Chairman Sumwalt
and Mr. Scovel an opportunity to comment on that story and
those allegations.
Mr. Sumwalt. Chairman Cruz, in a former life, I was a
consultant to the NASA Aviation Safety Reporting System and one
of the caveats that ASRS puts around their data is that they
are unverified and that there are various reporting biases
known and unknown. They put these caveats on every ASRS
request.
If you were to request data, they would put those caveats
there and it would not surprise me if, after the Lion Air
crash, when pilots said, oh, my goodness, I never knew about
this MCAS System and this really bothers me and I'm going to
fill out the report.
So I think it's imposrtant to keep all of this in
perspective. So that report in its own doesn't necessarily
concern me, but what we do want to look at is to look at the
training adequacy overall.
Senator Cruz. Mr. Scovel.
Mr. Scovel. Thanks, and I appreciate the perspectives of
both the Administrator and the Chairman.
We will be looking, as I mentioned at the very beginning of
the hearing, into documentation, what was included in the
manuals and the decisionmaking that went into that and beyond
that to the actual training for pilots.
I am aware of the ASRS entry that you mentioned. My staff
and I were reviewing that the other week. So we're factoring it
into our questions.
Senator Cruz. Are you able to shed any light on those
complaints?
Mr. Scovel. I'm not.
Senator Cruz. That one in particular certainly stands out.
Mr. Scovel. I'm not, but it does go to the question of what
did they know and when did they know it. So this is after the
Lion Air incident. Some things were bubbling up within ASRS, as
both my colleagues have testified. Was that factored into FAA's
decisionmaking going forward? We can consider all that fairly,
I think.
Senator Cruz. Well, I want to thank each of you for being
here, for testifying on very short notice. These issues are of
grave concerns to Americans across the country and to the
Senate. So I appreciate your testimony.
The hearing record is going to remain open for two weeks
and during that time, Senators are asked to submit any
questions for the record and upon receipt, each of the
witnesses are requested to submit your written answers to the
Committee as soon as possible.
And with that, this hearing is adjourned.
[Whereupon, at 5:35 p.m., the hearing was adjourned.]
A P P E N D I X
Response to Written Questions Submitted by Hon. John Thune to
Hon. Daniel K. Elwell
Question 1. Mr. Elwell, you mentioned in your testimony that in
response to the October 29 Lion Air Crash, FAA issued an Emergency
Airworthiness Directive on November 7 requiring 737 MAX operators to
revise flight manuals to reinforce training on how to recognize and
respond to stabilizer trim movement not initiated by the crew.
Could you describe current training procedures for recognition and
response to these ``runaway'' stabilizer trim events on Boeing 737
models?
Answer. The procedure for runaway stabilizer trim directs the pilot
to perform the following tasks:
1. Control Column, hold firmly
2. Disengage autopilot and control airplane pitch manually with
control column and electric trim
3. Disengage autothrottle
4. If runaway trim continues, turn off both of the stab trim cutout
switches
a. If runaway trim continues, grasp the trim wheel and perform
stabilizer trim manually
This procedure is to be performed immediately by either memory or
by quick reference checklist and as such training for this procedure is
covered in initial ground training and on a recurrent basis thereafter.
The training program is developed by the air carrier and approved by
the FAA.
Question 2. How did the training procedures required by the
Emergency Airworthiness Directive issued in November 2018 differ from
the procedures described above?
Answer. The Emergency Airworthiness Directive issued on November 7,
2018, reinforced the application of existing flight crew procedures to
be used in those circumstances when uncommanded stabilizer trim is
encountered.
Question 3. Mr. Elwell, the notice of proposed rulemaking for
Remote Identification of Unmanned Aircraft Systems was delayed from May
1 of this year to July 21. As you know, this rulemaking is a critical
component of integrating unmanned aircraft systems into U.S. airspace.
Could you speak to how this delay might affect other pending
regulatory actions related to UAS?
Answer. The FAA plans to finalize its policy concerning remote
identification of small UAS--by way of rulemaking, standards
development, or other activities that other Federal agencies may
propose--prior to finalizing the proposed rule permitting operations of
small UAS over people and operations at night, published in the Federal
Register on February 13, 2019.
Question 4. As a follow-up, do you foresee any potential challenges
related to this rulemaking that could cause further delays?
Answer. The remote identification of UAS is a complex issue. The
rulemaking the FAA is developing must ensure that the safety and
security of the National Airspace System is maintained, while proposing
requirements for the identification of UAS that are technologically
feasible and not cost prohibitive. This balancing requires
consideration of the interests and concerns of many diverse
stakeholders, including our Federal interagency security partners;
State and local law enforcement; the development and production
timelines of UAS manufacturers; UAS operators ranging from large
industry to small businesses to recreational flyers, and more. We are
working to ensure that the rule we propose addresses the concerns we
have heard from our interagency security partners, while also
reflecting the current and future state of UAS development, innovation,
and industry/public adoption.
______
Response to Written Questions Submitted by Hon. Maria Cantwell to
Hon. Daniel K. Elwell
Question. Please provide additional detail on the work that FAA did
on MCAS, and the work that was then delegated.
Answer. The FAA conducted several types of technical reviews
associated with the Stabilizer Trim System (STS) and related
Maneuvering Characteristics Augmentation System (MCAS) functionality.
These included project scope reviews (known as familiarization),
reviews of System Functionality and aspects of Software Development
Assurance, and reviews of the System Safety Assessment (SSA) status for
the STS.
These reviews allowed us to consider intended function, evaluate
the related guidance material, and assess system failure conditions and
appropriate crew actions. These reviews and further discussions with
Boeing did not identify any unique or new/novel regulatory aspects,
areas outside of ODA authorization, or other areas requiring FAA
involvement. As a result, the FAA delegated the responsibility for
determining MCAS regulatory compliance to the ODA.
Aggressive maneuvers (wind up turns) and full stalls were flown by
FAA test pilots during FAA certification testing in simulators and in
the aircraft. Several dozen FAA certification flights were flown by FAA
test pilots in the aircraft between May 2016 and November 2016 to
evaluate: Maneuvering Characteristics, Stall Characteristics, Stall
Identification and various failure modes of the flight control system,
including failures to the speed trim (MCAS) system. In all of these
tests, MCAS was active and routinely performing its intended function.
______
Response to Written Question Submitted by Hon. Amy Klobuchar to
Hon. Daniel K. Elwell
Question. At the hearing, we discussed how the FAA allows
manufacturers to sell certain safety features as optional add-ons to
airlines for an additional charge. As you know, neither of the two
Boeing 737 Max aircraft involved in the recent Ethiopian Airlines and
Lion Air crashes had an angle of attack indicator or a disagree light.
How many safety features listed by the FAA as ``optional'' detect
sensor malfunctions like we saw in these recent crashes?
Answer. Required safety standards and features for large aircraft
are established in 14 CFR part 25 (``Airworthiness Standards: Transport
Category Airplanes''). Features required to meet those safety standards
are mandatory on all FAA-certified aircraft, including the Boeing 737
MAX. There are no optional safety standards or features.
______
Response to Written Questions Submitted by Hon. Tom Udall to
Hon. Daniel K. Elwell
Question 1. The Boeing 737 first made flight in 1967 and there have
been a significant number of changes to the original configuration of
the 737. Can you outline the number of different air craft
certification configurations that Boeing has applied for?
Answer. Boeing has applied for 14 models of the 737.
(1) 737-100 Series (1967)
(2) 737-200 Series (1967)
(3) 737-200C Series (1968)
(4) 737-300 Series (1984)
(5) 737-400 Series (1988)
(6) 737-500 Series (1990)
(7) 737-700 Series (1997)
(8) 737-800 Series (1998)
(9) 737-600 Series (1998)
(10) 737-700C Series (2000)
(11) 737-900 Series (2001)
(12) 737-900ER Series (2007)
(13) 737-8 MAX (March 2017)
(14) 737-9 MAX (February 2018)
Question 2. Administrator Elwell, Mr. Scovel pointed out in his
testimony that the 2015 DOT Inspector General report found that the
QUOTE ``FAA performed oversight of only 4 percent of personnel
conduction certification work on the Agency's behalf at suppliers in
the period [it] reviewed.'' It is my understanding that the FAA is
revamping this process. But do you have the staffing necessary to
increase the oversight necessary?
Answer. Yes. The FAA has the personnel necessary to perform the
referenced oversight functions under current processes.
What are the FAA's plans to increase training opportunities to
ensure that staff with these responsibilities will have the expertise
necessary to perform oversight of highly technical systems?
Answer. The FAA supports its technical staff through access to
leading providers of training and through engagement opportunities with
other technical experts, including standards bodies, industry
associations, conferences, and universities. The FAA also has Chief
Scientific and Technical Advisors (CSTA) who provide in-depth seminars
and workshops for their individual areas of expertise. The CSTA program
was established in 2002 to address rapid technological advances in
aviation safety. CSTAs possess high levels of knowledge and skill in
specialized disciplines. When needed, the CSTAs support FAA
certification staff in evaluating complex technical issues.
Question 3. What are you doing to retain current employees?
Answer. Retaining employees when industry is doing well is a
challenge. There are, however, many factors as to why employees may
choose to stay with the agency. One of these factors is the clarity and
importance of the mission. We also utilize internal and external
resources to provide professional development and training
opportunities. We have several programs to provide mentoring and
temporary management assignments for employees actively seeking
advancement.
Do you have resources to bring on additional staff?
Answer. The Aircraft Certification Service has the resources to
hire sufficient staff under current processes.
And, if so, what are you doing by way of recruitment efforts to
bring more of these employees on board?
Answer. The FAA is collaborating with academic partners to provide
a focused curriculum related to aviation safety to facilitate job
opportunities for qualified candidates. We participate in job fairs,
seminars, and science and technology conferences. In addition, we
support science, technology, engineering, and mathematics (STEM)
activities across the Nation to promote aviation safety and
certification professions.
Question 4. If you are able, please tell us the direct chain of
reporting for the Boeing Max 800 process and if the managers who were
responsible for this certification are still charged with these
responsibilities.
Answer. The Boeing Aviation Safety Oversight Office, Boeing
Certificate Management Office, Seattle Aircraft Evaluation Group, and
Northwest Flight Test Section are the FAA offices responsible for the
airplane level certification and production of the 737 MAX. The
development of the certification basis for the 737 MAX, including any
applicable regulation or policy developed during a certification
project, e.g., through issue papers, also involves the FAA Transport
Standards Branch.
The office responsible for the oversight of the Boeing Organization
Designation Authorization (ODA) and related certification projects is
the Boeing Aviation Safety Oversight Office. There are three first line
managers and one branch manager for the office. The 737 MAX
certification was a 5-year project that started in 2012. Since 2012, we
have had a number of changes in personnel, consistent with any large
organization.
Question 5. It is important to receive clarification on some issues
that circulated about the Boeing Max 8 jets. I will ask you a series of
Yes/No questions. The New York Times reported on March 19th that senior
FAA employees were unaware of the changes in the software that is in
question. Can you confirm if this software was certified by the FAA?
Answer. Yes, the software described in the article was approved by
the FAA.
Did any FAA employees sign off on training manuals?
Answer. Yes, the recommended training was approved by the FAA.
Question 6. Boeing has said the redundancy for the system in
question were the pilots--even though many pilots were unaware of the
changes made to the 737 Max. Given your experience as a pilot, are you
aware of another example of any other component with critical safety
mission not to have some kind of redundancy built-in?
Answer. In reference to system failures that can jeopardize
controlled flight, there are single failures that require pilot
response or action, including:
Engine failure (at any time, but especially during takeoff
ground roll)
Landing gear failure to deploy
Engine or cargo fire
Failure of an air data computer
Flight control surface jam
Failure of certain components in flight control systems
(actuator, control structural items such as a rod or actuator
mount, cable break, etc.)
Question 7. Does FAA still maintain the others grounded ``too
early?''
Answer. The FAA made its grounding decision on March 13 based on
refined satellite data and evidence found at the accident scene. This
information solidified the similarities between the Lion Air and
Ethiopian Airlines accidents. The FAA stands by its decision-making on
grounding the 737 MAX.
Question 8. Is it appropriate for the POTUS and the CEO of Boeing
to be discussing a matter like this vs leaving it up to the career
expert?
Answer. The FAA's primary focus is safety. We value and rely upon
the advice of FAA career aviation safety experts.
Were the same people who approved the design the ones
deciding to ground?
Answer. The decision to ground the 737 MAX was made by me after
receiving enhanced satellite data showing the flight path of Ethiopian
Flight 302 and conferring with FAA safety experts. I was not with the
FAA at the time the 737 MAX design was approved.
______
Response to Written Questions Submitted by Hon. Tammy Duckworth to
Hon. Daniel K. Elwell
Question 1. Please describe the Federal regulatory rules, process
and procedures for addressing an aircraft design single-point-of-
failure, including the threshold for grounding such aircraft.
Answer. 14 CFR Sec. Sec. 25.1309, 25.671, and 25.901, advisory
circulars, and other FAA guidance material prevent the FAA from
approving proposed designs in which a single system failure (non-
structural) would be catastrophic or prevent continued safe flight and
landing. Beyond this, single system points-of-failure that are not
catastrophic are governed by the reliability requirements of 14 CFR
Sec. 25.1309.
Manufacturers must show proposed airplane systems meet safety
standards through a FAA hazard assessment and safety analysis. As part
of this analysis, the manufacturer must show that ``catastrophic''
failure conditions are extremely improbable.
The FAA makes safety-based, data-driven decisions. In determining
whether a condition discovered after certification is unsafe, we employ
a standardized process called Monitor Safety/Analyze Data (MSAD) for
determining mandatory design changes and appropriate timeframes to
implement those changes based on risk exposure. The results of the risk
assessments conducted under MSAD could lead to an aircraft grounding
decision.
Question 2. What is the basis for certification by FAA of a
derivative aircraft and how does FAA determine pilot training
requirements for derivative aircraft?
Answer. The FAA decides whether to process an application as an
amended type certificate (ATC) based on an evaluation of the airplane
design changes in accordance with 14 CFR Sec. 21.19, which describes
changes requiring a new type certificate. The FAA evaluates the
proposed design changes, considers the examples in the guidance
material, and reviews determinations made on previous certification
programs.
The FAA determines pilot training requirements for derivative
aircraft using the Flight Standardization Board (FSB) in accordance
with established processes outlined in FAA Order 8900.1 and FAA
Advisory Circular (AC) 120-53B. Aircraft operational suitability is
determined in accordance with FAA Order 8110.4C.
Question 3. For the purposes of FAA aircraft certification, who
determines whether a design change is ``significant'' such that it
would preclude the aircraft from a derivative certification? Please
describe in detail precisely how FAA make this determination and what
constitutes a requirement for a new type certificate?
Answer. The managing Aircraft Certification Office (ACO) determines
if the proposed design is eligible for an amended type certificate
(ATC) (derivative aircraft certification) or if the proposed design
changes require a new type certificate. The FAA decides to process an
application as an ATC based on an evaluation of the proposed airplane
design changes in accordance with 14 CFR Sec. 21.19, which describes
proposed changes that will require a new type certificate.
Additionally, AC 21.101-1B, ``Establishing the Certification Basis of
Changed Aeronautical Products,'' provides examples of substantial
design changes for transport airplanes.
The FAA evaluates the proposed design changes, considers the
examples in the advisory circular, and reviews determinations made on
previous certification programs in order to determine eligibility for
an ATC.
Question 4. When a new system(s) for a derivative aircraft is
disclosed to the FAA by an Original Equipment Manufacturer (OEM), how
does the FAA evaluate that system(s) to determine changes to pilot
training, aircraft and pilot manuals and handbooks, and the potential
nullification of the derivative certification of the aircraft?
Answer. The OEM presents technical briefings on new systems to the
FAA. The OEM proposes a pilot type rating determination and pilot
training recommendations after formally identifying differences between
the base aircraft (old) and candidate aircraft (new) using the process
outlined in Advisory Circular (AC) 120-53B. The Flight Standardization
Board then evaluates the proposed training in accordance with this AC
(AC 120-53B).
Question 5. When a system is implemented on a derivative aircraft
design with the intention of artificially retaining the handling
qualities of the original design, what Federal requirements govern the
publication and training of that system?
Answer. At all times, the aircraft must meet the existing design
and performance requirements. The FAA evaluates handling qualities in
accordance with AC 120-53B using the T2 Test (handling qualities
comparison), between the base and candidate aircraft. Any additional
training requirements are evaluated during T3 Test (differences) by the
Flight Standardization Board.
Question 6. When the FAA certifies a derivative aircraft, which
type certificated aircraft is considered as the baseline for design
change comparisons? In the case of the Boeing 737 MAX, was it the most
recent type certified aircraft like the 737 NG or the original type
design?
Answer. When an applicant applies for an amended type certificate
(ATC) of a previously certificated model, it is responsible for
proposing the baseline. That baseline may or may not be the most
recently certificated model of that aircraft. Since the baseline 737-
800 model was introduced in 1998, many enhancements have been
implemented in derivative models. In the case of the 737 MAX, the 737
NG was the baseline model.
Question 7. Are derivative aircraft required to comply with 14 CFR
Part 25 regulations at the time the amended type certificate is awarded
or at the time of the original type certificate?
Answer. Only the proposed design change and areas affected by the
change must comply with the 14 CFR regulations in place at the time of
application, in accordance with 14 CFR Sec. 21.101 and FAA AC 21.101-
1B. The applicant also can petition the FAA for an exemption or
``equivalent level of safety determination'' for particular
requirements. These are addressed on a case-by-case basis.
Question 8. Please point to the safeguards that FAA has in place to
ensure that external pressures, such as time or competition, do not
play any role in the quality of the certification or evaluation of a
derivative aircraft.
Answer. Through our public rulemaking process, the FAA prevents
special interests from having undue influence in the development of
standards and agency decisions regarding whether proposed designs meet
those standards. Additionally, we have established processes for all
FAA employees to elevate concerns if they feel that safety is being
compromised. The FAA Office of Audit and Evaluation, established by
Congress, provides a whistleblower hotline to report safety concerns.
Complaints are investigated and responses to any findings are provided
to this office. 14 CFR 183.57(c) and FAA Order 8100.15 place
responsibility on the ODA holder to ensure that ODA unit members can
perform their authorized functions without conflicting restraints or
interference. ODA unit members also regularly interact with their FAA
counterparts during certification projects and are able to communicate
concerns directly. During regular FAA evaluations of ODAs, unit members
are questioned about undue pressure and if they have the latitude to
perform their duties appropriately.
The FAA may also suspend or terminate an ODA at any time. Some
reasons why the FAA may suspend or terminate an ODA include:
ODA holder fails to properly perform the duties granted in
the authorization;
ODA holder does not exercise the care or judgment required
to properly exercise the ODA;
ODA holder displays a lack of integrity;
ODA holder qualifications lapse;
ODA holder does not take corrective action as required by
the FAA;
ODA holder or ODA unit does not complete required FAA
training;
Misconduct including, but not limited to, carelessness,
collusion, conflict of interest, compromise or any other act
that would jeopardize the proper functioning of the delegated
functions.
FAA Order 8100.15B, Ch. 7-2. ODA holders have limited
administrative appeal rights within the FAA to appeal the suspension or
termination of an ODA.
Question 9. Is FAA considering any changes to its existing
certification process for aircraft currently in certification and for
future designs?
Answer. Safety is the core of FAA's mission and our top priority.
We have a longstanding, well-established, data-driven certification
process that consistently results in safe aircraft and we remain
committed to our proven processes. We continue to evaluate the
information we learn from the 737 MAX accident investigations to
determine if certification process changes may be needed. The
Department of Transportation's Office of the Inspector General is
conducting an audit of the FAA's certification processes, and the
Secretary of Transportation has established a Special Committee to
Review FAA's Aircraft Certification Process. We look forward to
assessing any recommendations for improvements these activities may
identify.
Question 10. Is the pitch stability of the Boeing 737 MAX series
aircraft equal to the pitch stability of older models of the Boeing 737
aircraft?
Answer. The pitch stability and pitch maneuvering characteristics
were flight tested and determined to meet part 25 requirements and
equivalent to the previous 737 NG model.
Question 11. Did Boeing implement the Maneuvering Characteristics
Augmentation System (MCAS) flight control law on the 737 MAX series to
improve aircraft handling characteristics and achieve the pitch
stability that FAA requires to certify an aircraft for use as a
passenger aircraft? Did Boeing implement MCAS to allow pilots' type
certificate to transfer from 737 NG to 737 MAX aircraft? Please provide
the Committee with any associated documentation for the purpose or
justification for MCAS.
Answer. The purpose of MCAS is to make the 737 MAX compliant with
FAA regulations on performance and handling characteristics, for
example, maneuvering stability and aerodynamic stall characteristics.
The MCAS provides performance and handling characteristics consistent
with the predecessor Boeing 737 NG models. As part of the flight
control system, MCAS was determined to be compliant with FAA
regulations.
Question 12. During the certification process, did the FAA or
Boeing under delegated authority, determine that it could not certify
the Boeing 737 MAX series aircraft to be used as a passenger aircraft
because of the lack of pitch stability?
Answer. No. The FAA flight tested the 737 MAX in all regimes of
flight, including stalls, and no lack of pitch stability was found. If
a lack of pitch stability was found, the FAA would have required Boeing
to address the issue prior to the amended type certificate being
issued.
Question 13. Did the FAA require Boeing to install an automated
stability system in order to receive certification for the Boeing 737
MAX series to be used as a passenger aircraft?
Answer. The FAA did not require the installation of an automated
stability system. Boeing, as the applicant, defines the scope of
changes at the airplane level. The FAA through its Certification Basis
determination concurred with the scope of the changes.
Question 14. When a pilot overrides the MCAS flight control law and
manually controls the 737 MAX, does the pitch stability of the 737 MAX,
while being manually operated, change to unsafe levels for a passenger
aircraft?
Answer. An aircraft is required to be controllable in all regimes
of flight. The MCAS operates as part of the flight control system, not
independently. The MCAS function is active only during manual flight,
when the flaps are up and the aircraft is at an elevated angle-of
attack. Manual flight with MCAS active was extensively flight tested
and found to be safe and compliant with part 25.
______
Response to Written Questions Submitted by Hon. Jon Tester to
Hon. Daniel K. Elwell
Safety Features as Options and Transparency
Question 1. Did FAA know which safety features on the 737 MAX were
offered by Boeing as options versus as mandatory equipment?
Answer. Features and equipment that are required for safety are not
optional on any aircraft the FAA certifies. 14 CFR part 25
``Airworthiness Standards: Transport Category Airplanes'' contains the
design standards.
Question 2. Does FAA know what the cost is to Boeing for AOA
redundancy and pilot alert equipment? And what Boeing charges customers
to install on the 737 MAX?
Answer. The FAA does not have information on pricing related to
optional equipment on Boeing aircraft.
Question 3. Did FAA determine that any Boeing-designated
``options'' should to be installed as mandatory equipment? If yes,
which equipment was switched to be mandatory standard equipment?
Answer. Required safety standards and features for large aircraft
are established in 14 CFR part 25 (``Airworthiness Standards: Transport
Category Airplanes''). Features required to meet those safety standards
are mandatory on all FAA-certified aircraft, including the Boeing 737
MAX. There are no optional safety standards or features.
Question 4. Has FAA ever gone back to the manufacturer and required
that equipment that the manufacturer identified as ``optional'' instead
be included as standard for safety reasons? If so, what equipment for
which plane?
Answer. The FAA has the statutory authority to promulgate new rules
to mandate equipment enhancements and updates based on new data and
operational experience. There are cases where optional equipment later
became mandatory on transport category aircraft after specific safety
benefits were established. For example, the FAA promulgated new rules
to mandate new equipment including terrain awareness and warning
systems (TAWS), enhanced ground proximity warning systems (EGPWS), and
traffic collision avoidance systems (TCAS).
Question 5. Does FAA plan to require that AOA redundancy and pilot
alert equipment be standard equipment? Why/why not?
Answer. We continue to evaluate the information we learn from the
737 MAX accident investigations to determine if certification process
changes or specific equipment capabilities may be needed. The
Department of Transportation's Office of the Inspector General is
conducting an audit of the FAA's certification processes, and the
Secretary of Transportation has established a Special Committee to
Review FAA's Aircraft Certification Process. We look forward to
assessing any recommendations for improvements these activities may
identify.
Question 6. Should air passengers know in advance which safety
options airlines opt NOT to pay for on planes in their fleet? Why or
Why not?
Answer. Features and equipment that are required for safety are not
optional on any aircraft the FAA certifies. 14 CFR part 25 contains the
design standards for transport category aircraft. This is a single
level of safety, and the same requirements apply to all aircraft
certified under part 25. The FAA does not regulate the cost of, or
communicate to passengers on, optional equipment the operator has or
has not chosen to install.
Pilot Training and Documentation
Question 7. On what basis did FAA determine that no additional
training for the 737 MAX 8 was needed?
Answer. The FAA did require additional training for the 737 MAX 8.
The FAA has processes and procedures to determine requirements for
pilot training and type rating. During certification of the 737 MAX,
the FAA followed its standard process in establishing a Flight
Standardization Board (FSB) as the mechanism to evaluate manufacturer-
proposed training for a new aircraft or type derivative. FSBs are
chaired by FAA experts and utilize qualified pilots from the FAA,
industry, and other aviation authorities to evaluate the aircraft. The
FAA conducted this FSB as a joint evaluation with Transport Canada
(TCCA), the European Aviation Safety Agency (EASA) and participation
from U.S. operators. FSB pilots unanimously concluded that for the 737
MAX, additional computer-based training was necessary beyond the
training required for a Boeing 737 NG pilot to fly the 737 MAX.
Instrumentation, Performance and Certification
Question 8. Did FAA know about the lack of simultaneous and cross-
check readings of the AOA sensors on the 737-MAX 8, i.e., the absence
of displaying the readings of both sensors (versus just one at a time)
and the lack of a ``disagree light'' being activated if the sensors are
at odds with one another?
Answer. When the AOA indicator display is present on a 737 model,
the left primary flight display (PFD) shows the left AOA reading, and
the right PFD shows the right AOA reading. These readings do not
display side-by-side on one display. It is important to note that AOA
and other air data inputs (i.e., airspeed and calculated Mach) are
direct inputs to the MCAS flight control function within the flight
control computers and not dependent on any display of information on
the pilots' PFDs. There is no regulatory requirement for the AOA
indicators or the AOA disagree message.
Is that configuration consistent with current standards?
Answer. The AOA indicator display and AOA DISAGREE message were
consistent with current standards.
Did anyone raise any concerns about this configuration?
Answer. FAA carefully considered the configuration before
determining it met applicable standards.
Did FAA raise this point of vulnerability with Boeing? If no, why
not?
Answer. There is no regulatory requirement for manufacturers to
install an AOA disagree message because there are no pilot procedures
associated with the display of the message.
Question 9. Who determined that the introduction of enlarged
engines and their changed placement did not require a new certification
for the aircraft? What were the factors/rationale justifying that
decision?
Answer. The managing Aircraft Certification Office (ACO) followed
FAA regulations and policy in making the determination that the
proposed design was eligible for an Amended Type Certificate (ATC). The
FAA issued an ATC based on the evaluation of the proposed airplane
design changes in accordance with 14 CFR Sec. 21.19, which describes
changes requiring a new type certificate. Additionally, FAA Advisory
Circular (AC) 21.101-1B, ``Establishing the Certification Basis of
Changed Aeronautical Products,'' provides examples of substantial
design changes for transport airplanes.
In making a determination of a proposed type certification, the FAA
evaluates the proposed design changes, considers the examples in the
advisory circular, and reviews determinations made on previous
certification programs.
Question 10. FAA statements re: the functioning of MCAS appear to
be conflicting. Can or cannot MCAS be disabled on the 737-MAXs?
Answer. MCAS is an integrated sub-system of the flight control
system and cannot be disabled by itself. Automatic movement of the
horizontal stabilizer--including that caused by MCAS--can be disabled
through use of the STAB TRIM cut-off switches. When automatic movement
of the horizontal stabilizer is disabled, MCAS cannot move the
horizontal stabilizer. The pilot can still move the stabilizer
manually, if necessary.
Question 11. How does FAA decide which systems are delegated to
firms for certification?
Answer. The FAA determines the level of involvement during an
Organization Designation Authorization (ODA) project based on many
variables. These include the ODA's performance and experience with the
compliance requirements, consideration of any novel or unusual
certification areas, or instances where adequate standards may not be
in place.
Question 12. In the hearing, you testified that FAA managers did
review the delegation of authority as required. Does that mean that the
role of FAA managers is to review the delegation of authority OR do FAA
managers review/verify that a firm's certification decision is
appropriate? If the latter, on what basis does the FAA make a
determination that a certification done by a firm meets U.S.
requirements?
Answer. The FAA reviews delegation of authority and appropriateness
of certification decisions, including individual delegation decisions.
This is accomplished in response to review of applicant certification
proposals. The FAA responses are reviewed by management or by delegated
staff on behalf of FAA management. The basis for ascertaining that the
ODA makes certification decisions that meet FAA requirements is
accomplished through approval of the ODA procedures and oversight of
the ODA. FAA managers approve the ODA manual, which defines an ODA
holder's authority and limitations and identifies the functions it may
perform. The FAA-approved ODA manual establishes criteria for FAA
involvement on each certification project. The FAA reviews the ODA's
system for making decisions through oversight of system, personnel,
procedures, activities and overall performance. FAA managers ensure the
FAA's oversight program for the ODA is in place and is operating in
accordance with FAA Order 8100.15. The ODA holder is responsible as the
project applicant to show compliance to the airworthiness standards.
______
Response to Written Question Submitted by Hon. John Thune to
Hon. Calvin L. Scovel III
Question. Inspector General Scovel, the recent Federal Aviation
Administration (FAA) Reauthorization Act of 2018 contained several
bipartisan provisions aimed at improving and modernizing FAA's aircraft
certification process. This included the establishment of an
Organization Designation Authorization Office within FAA's Office of
Aviation Safety, improving operational safety by strengthening
oversight of ODA holders delegated to perform certain functions on
behalf of the FAA.
Additionally, you mentioned in your testimony that FAA has taken
several steps to improve certification oversight in response to
recommendations made by the Department of Transportation Office of
Inspector General (DOT OIG), some of which were due to be implemented
earlier this year.
Beyond the work done in both the FAA Reauthorization and in
response to recommendations made by DOT OIG, do see a need for further
action to be taken regarding FAA's aircraft certification process, and
if so, what are those actions?
Answer. The actions FAA has already taken to address our prior
recommendations are steps in the right direction. The key will be FAA's
effective implementation of those recommendations and provisions of the
FAA Reauthorization Act of 2018, which we will be reviewing during our
audit of FAA's certification of the Boeing 737 MAX aircraft. We have
just begun our latest audit work, and as such, it is too early to say
what additional actions the FAA needs to take to improve its
certification processes. We will keep the Committee apprised of our
progress.
______
Response to Written Questions Submitted by Hon. Maria Cantwell to
Hon. Calvin L. Scovel III
General Scovel, your office has examined the performance of the ODA
system and other issues within the certification system many times.
Several times, including in 2011 and 2015, your office issued
recommendations to FAA on ways to improve the system.
Question 1. Did FAA adopt the recommendations from your office?
Answer. Yes. Overall, FAA has been responsive to and adopted our
recommendations. However, one key recommendation--for FAA to implement
a new, more systems-and risk-based oversight approach--remains open.
The Agency expects to complete implementing our recommendation in July
2019.
Question 2. Overall, would you call the ODA system safe? Are there
improvements that still need to be implemented?
Answer. Overall, the U.S. air transportation system is remarkably
safe. However, recent events have raised concerns about FAA's oversight
of the ODA program and its effectiveness. Improvements such as fully
implementing our open recommendation will be a good start. We initiated
an audit of FAA's certification of the Boeing 737 MAX on March 27,
2019. While our audit is still in the early stages, we plan to address
this issue in our review. We will be available to provide your office
with more substantive information once we have an opportunity to
develop our observations and findings.
Question 3. What would happen if delegation ended--does FAA have
the tools it would need to continue to carry out its certification
responsibilities?
Answer. Currently there are about 80 companies with delegated
authority. The practice of delegation has served the industry well for
years. ODA offers the Agency the opportunity to leverage outside
expertise that it might not otherwise have access to and make the best
use of limited resources and expertise. According to FAA, if ODA did
not exist, the Agency would have to hire roughly 10,000 more employees
to fulfill its aircraft certification mission.
Question 4. Has your office compared the way the ODA system works
with the way certification happens in Europe? Which system has a more
rigorous degree of oversight agency involvement?
Answer. We have not conducted a comparative analysis of how FAA's
ODA process compares to systems used in Europe.
______
Response to Written Questions Submitted by Hon. Tammy Duckworth to
Hon. Calvin L. Scovel III
Question 1. Please describe the Federal regulatory rules, process
and procedures for addressing an aircraft design single-point-of-
failure, including the threshold for grounding such aircraft.
Answer. FAA is responsible for ensuring the safety of the traveling
public, including eliminating single points of failure and grounding
aircraft for safety reasons. We initiated an audit of FAA's
certification of the Boeing 737 MAX on March 27, 2019. While our audit
is still in the early stages, our ongoing work will shed additional
light on the processes, policies, and procedures for addressing these
issues.
Question 2. What is the basis for certification by FAA of a
derivative aircraft and how does FAA determine pilot training
requirements for derivative aircraft?
Answer. FAA is responsible for determining the classification and
certification of derivative aircraft. Also, in conjunction with
manufacturers, FAA determines training requirements for pilots. We will
explore these issues in greater detail in our ongoing review of how the
Boeing 737 MAX was certified.
Question 3. For the purposes of FAA aircraft certification, who
determines whether a design change is ``significant'' such that it
would preclude the aircraft from a derivative certification? Please
describe in detail precisely how FAA make this determination and what
constitutes a requirement for a new type certificate?
Answer. FAA has the ultimate authority to determine whether a
design change is significant and whether it would preclude the aircraft
from being certified as a derivative. This is an issue we will examine
in our ongoing review of how the Boeing 737 MAX was certified. We will
be available to provide your office with more substantive information
once we have an opportunity to develop our observations and findings.
Question 4. When a new system(s) for a derivative aircraft is
disclosed to the FAA by an Original Equipment Manufacturer (OEM), how
does the FAA evaluate that system(s) to determine changes to pilot
training, aircraft and pilot manuals and handbooks, and the potential
nullification of the derivative certification of the aircraft?
Answer. FAA works closely with the aircraft manufacturer to
determine changes to pilot training as well as manuals and handbooks.
This is an important question that has been raised with the Boeing 737
MAX incidents. We will examine this and related issues in our ongoing
review.
Question 5. When a system is implemented on a derivative aircraft
design with the intention of artificially retaining the handling
qualities of the original design, what Federal requirements govern the
publication and training of that system?
Answer. We are in the early stages of our review of the
certification of the Boeing 737 MAX, and as such, it is too early to
say whether our review will address this issue. But please be assured
that we will keep the Committee apprised of our progress.
Question 6. When the FAA certifies a derivative aircraft, which
type certificated aircraft is considered as the baseline for design
change comparisons? In the case of the Boeing 737 MAX, was it the most
recent type certified aircraft like the 737 NG or the original type
design?
Answer. FAA certifies derivative aircraft, but we have just begun
our review of the 737 MAX certification. While our audit is still in
the early stages, we plan to examine what make/model is considered as
the ``baseline'' for the desired change and what other factors the
Agency considers when making certification decisions for derivative
aircraft.
Question 7. Are derivative aircraft required to comply with 14 CFR
Part 25 regulations at the time the amended type certificate is awarded
or at the time of the original type certificate?
Answer. This is an issue we will explore in detail in our ongoing
audit of the Boeing 737 MAX certification.
Question 8. Please point to the safeguards that FAA has in place to
ensure that external pressures, such as time or competition, do not
play any role in the quality of the certification or evaluation of a
derivative aircraft.
Answer. Safeguards against external pressures such as time and
competition are important. FAA addresses this issue in its oversight
procedures, but we do not know the effectiveness of any controls or
safeguards in place. This is an issue we will explore in greater detail
as we examine the certification of the Boeing 737 MAX.
Question 9. Is FAA considering any changes to its existing
certification process for aircraft currently in certification and for
future designs?
Answer. We are unaware of any changes FAA may be considering at
this time. However, given the attention to this issue and the number of
external reviews that are ongoing, there could be a number of changes
to FAA's processes in the future.
Question 10. Is the pitch stability of the Boeing 737 MAX series
aircraft equal to the pitch stability of older models of the Boeing 737
aircraft?
Answer. The issue of pitch stability is an important question in
the recent 737 MAX accidents. Preliminary reports suggest that there
may be a difference in stability compared to earlier models. This is an
issue we will examine in our ongoing review of the 737 MAX
certification.
Question 11. Did Boeing implement the Maneuvering Characteristics
Augmentation System (MCAS) flight control law on the 737 MAX series to
improve aircraft handling characteristics and achieve the pitch
stability that FAA requires to certify an aircraft for use as a
passenger aircraft? Did Boeing implement MCAS to allow pilots' type
certificate to transfer from 737 NG to 737 MAX aircraft? Please provide
the Committee with any associated documentation for the purpose or
justification for MCAS.
Answer. Based on reports, it appears that Boeing implemented MCAS
to improve aircraft handling characteristics and to address concerns
about pitch stability to certify the aircraft. We will look into all
the reasons Boeing implemented MCAS in our review of the 737 MAX
certification.
Question 12. During the certification process, did the FAA or
Boeing under delegated authority, determine that it could not certify
the Boeing 737 MAX series aircraft to be used as a passenger aircraft
because of the lack of pitch stability?
Answer. We have just begun our review of 737 MAX certification. We
are aware of concerns regarding the pitch stability of the 737 MAX, and
will examine these issues in greater detail during our review.
Question 13. Did the FAA require Boeing to install an automated
stability system in order to receive certification for the Boeing 737
MAX series to be used as a passenger aircraft?
Answer. We do not know at this juncture exactly what FAA required
Boeing to do, but we will determine whether FAA required Boeing to
install an automated system to obtain certification.
Question 14. When a pilot overrides the MCAS flight control law and
manually controls the 737 MAX, does the pitch stability of the 737 MAX,
while being manually operated, change to unsafe levels for a passenger
aircraft?
Answer. We are in the early stages of our review of the 737 MAX,
but we will address the issue of whether or not the pilot can manually
override MCAS. We recognize this is an important question in resolving
problems with the Boeing 737 MAX.
______
Response to Written Questions Submitted by Hon. Jon Tester to
Hon. Calvin L. Scovel III
Scope of OIG Review
Question 1. What factors will the OIG examine to determine if the
FAA's relationship with Boeing was appropriate to fulfill its oversight
role and responsibilities?
Answer. In addition to assembling a timeline of the Boeing 737 MAX
certification, we will examine the ODA process, including the roles and
responsibilities between FAA and Boeing and how key decisions were
made.
Question 2. Is the OIG investigating if FAA allowed Boeing to take
shortcuts to improve its competitiveness vis-a-vis international
aircraft suppliers?
Answer. Our ongoing audit if FAA's certification of the Boeing 737
MAX will be reviewing all of the factors that went into the
certification of the 737 MAX and will be alert for any factors that
indicate shortcuts were taken.
Question 3. Is the OIG looking at the impact and implications of
market competition on:
a. Boeings' decision-making and production schedules of the 737-MAX
8?
b. FAA's delegation of self-certification to Boeing?
Answer. Our current review is focused on building a timeline for
the certification of the 737 MAX and delegated authority. We will
examine any factors that may have influenced key decisions.
Question 4. Are reports that the number of aircrafts delivered is a
factor in employees' performance reviews (and presumably bonus awards)
true? If so, how will you determine if that situation impacted the
planes' safety-related systems and pilot training requirements?
Answer. We do not know whether the number of aircraft delivered was
a factor in performance reviews at Boeing. This is an issue we will
examine in our ongoing review of how the Boeing 737 MAX was certified.
We will be available to provide your office with more substantive
information once we have an opportunity to develop our observations and
findings.
Instrumentation, Performance and Certification
Question 5. Did FAA know about the lack of simultaneous and cross-
check readings of the AOA sensors on the 737-MAX 8, i.e., the absence
of displaying the readings of both sensors (versus just one at a time)
and the lack of a ``disagree light'' being activated if the sensors are
at odds with one another?
a. Is that configuration consistent with current standards?
b. Did anyone raise any concerns about this configuration?
c. Did FAA raise this point of vulnerability with Boeing? If no,
why not?
Answer. We cannot say at this time what Boeing and FAA knew given
that we are in the early stages of our review of the 737 MAX
certification. The issues raised about instrumentation and warnings are
important questions that we will explore in our review.
Question 6. Who determined that the introduction of enlarged
engines and their changed placement did not require a new certification
for the aircraft? What were the factors/rationale justifying that
decision?
Answer. FAA is ultimately responsible for decisions about
certification. We do not yet know the factors that drove these
decisions. However, we will explore these questions in our review of
the 737 MAX certification.
Question 7. FAA statements re: the functioning of MCAS appear to be
conflicting. Can or cannot MCAS be disabled on the 737-MAXs?
Answer. After careful review and consideration, DOT-OIG believes
FAA is most appropriately situated to provide a response to this
question.
Question 8. How does FAA decide which systems are delegated to
firms for certification?
Answer. FAA works closely with the manufacturer and decides what
systems are delegated for certification. According to FAA, factors such
as performance issues and areas critical to safety would lead to a
higher level of FAA involvement and oversight.
Question 9. In the hearing, Acting Administrator Elwell testified
that FAA managers did review the delegation of authority as required.
Does that mean that the role of FAA managers is to review the
delegation of authority OR do FAA managers review/verify that a firm's
certification decision is appropriate? If the latter, on what basis
does the FAA make a determination that a certification done by a firm
meets U.S. requirements?
Answer. After careful review and consideration, DOT-OIG believes
FAA is most appropriately situated to provide a response to this
question.
[all]