STATEMENT OF DANIEL K. ELWELL
ACTING ADMINISTRATOR, FEDERAL AVIATION ADMINISTRATION
BEFORE THE
COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE
UNITED STATES HOUSE OF REPRESENTATIVES
STATUS OF THE BOEING 737 MAX
MAY 15, 2019
Chairman DeFazio, Ranking Member Graves, Members of the Committee:
Thank you for the opportunity to appear before you today to discuss aviation safety and the issues surrounding the Boeing 737 MAX. On behalf of the United States Department of Transportation and the Federal Aviation Administration, we would like to take this opportunity to, once again, extend our deepest sympathy to the families of the victims of the Ethiopian Airlines and Lion Air accidents.
Safety is the core of the Federal Aviation Administration’s mission and our top priority. With the support of this Committee, we have worked tirelessly to take a more proactive, data-driven approach to oversight that prioritizes safety above all else inside the FAA and within the aviation community that we regulate. The result of this approach is that the United States has the safest air transportation system in the world. Since 1997, the risk of a fatal commercial aviation accident in the United States has been cut by 94 percent. And in the past ten years, there has been one commercial airline passenger fatality in the United States in over 90 million flights. But, one fatality is one too many, and a healthy safety culture requires commitment to continuous improvement.
Our commitment to safety and fact-based, data-driven decision making has been the guiding principle in the FAA’s response to the two fatal accidents involving the Boeing 737 MAX airplane outside the United States. Today, I would like to provide you with an overview of the FAA’s certification and oversight processes, our current actions with respect to the 737 MAX, and the steps that the FAA is taking to foster safety enhancements here and abroad.
The FAA is a Data-Driven Agency Focused on Safety
As the aerospace system and its components become increasingly more complex, we know that our oversight approach needs to evolve to ensure that the FAA remains the global leader in achieving aviation safety. In order to maintain the safest air transportation system in the world, during the past two decades the FAA has been evolving from a prescriptive and more reactive approach for its safety oversight responsibilities to one that is performance-based, proactive, centered on managing risk, and focused on continuous improvement. A key part of this transition has been the adoption of safety management systems, or SMS, within the FAA. The evolution toward SMS began internally at the FAA more than 15 years ago, starting with the FAA’s Air Traffic Organization and expanding across the FAA to include all of our lines of business. Consistent with recommendations of the International Civil Aviation Organization (ICAO), we have been working towards implementation of SMS in various sectors. For example, as of March 9, 2018, scheduled commercial air carriers, regulated under 14 CFR part 121, are required to have an SMS.
Safety is not just a set of programs that can be “established” or “implemented.” It is a way of living and working, and it requires the open and transparent exchange of information. We know that it takes collaboration, communication, and common safety objectives to allow the FAA and the aviation community to come together, to identify system hazards, and to implement safety solutions. This approach gives us knowledge that we would not otherwise have about events and risks. Sharing safety issues, trends, and lessons learned is critical to recognizing whatever might be emerging as a risk in the system. The more data we have, the more we can learn about the system, which in turn allows us to better manage and improve the system.
To be clear, the SMS approach does not diminish the FAA’s role as a safety regulator. Any party that the FAA regulates remains responsible for compliance with the FAA’s regulatory standards, and the FAA does not hesitate to take enforcement action when it is warranted.
Aircraft Certification
Information sharing is a cornerstone of aviation safety and has significantly contributed to the United States’ outstanding safety record. One of the FAA’s core functions, aircraft certification, has always relied on the exchange of information and technical data. The FAA certifies the design of aircraft and components that are used in civil aviation operations. Some version of our certification process has been in place and served us well for over 60 years. This does not mean the process has remained static. To the contrary, since 1964, the regulations covering certification processes have been under constant review. As a result, the general regulations have been modified over 90 times, and the rules applicable to large transport aircraft, like the Boeing 737 MAX, have been amended over 130 times. The regulations and our policies have evolved in order to adapt to an ever-changing industry that uses global partnerships to develop new, more efficient, and safer aviation products and technologies. What has not changed is that, for any new project, the FAA identifies all safety standards and makes all key decisions regarding certification of the aircraft.
The FAA focuses its efforts on areas that present the highest risk within the system. The FAA reviews the applicant’s design descriptions and project plans, determines where FAA involvement will derive the most safety benefit, and coordinates its intentions with the applicant. When a particular decision or event is critical to the safety of the product or to the determination of compliance, the FAA is involved either directly or through the use of our designee system.
The use of designation, in some form, has been a vital part of our safety system since the 1920s. Congress has continually expanded the designee program since creation of the FAA in 1958, and it is critical to the success and effectiveness of the certification process.Under this program, the FAA may delegate a matter related to aircraft certification to a qualified private person.This is not self-certification; the FAA retains strict oversight authority.The program allows the FAA to leverage its resources and technical expertise while holding the applicant accountable for compliance. During the past few years, Congress has endorsed FAA’s delegation authority, including in the FAA Reauthorization Act of 2018, which directed the FAA to delegate more certification tasks to the designees we oversee.
In aircraft certification, both individual and organizational designees support the FAA.The FAA determines the level of involvement of the designees and the level of FAA participation needed based on many variables.These variables include the designee’s understanding of the compliance policy; consideration of any novel or unusual certification areas; or instances where adequate standards may not be in place.
The Organization Designation Authorization (ODA) program is the means by which the FAA may authorize an organization to act as a representative of the FAA under strict FAA oversight. Currently, there are 79 ODA holders. ODA certification processes allow FAA to leverage industry expertise in the conduct of the certification activities and focus on important safety matters. The FAA has a rigorous process for issuing an ODA and only grants this authorization to mature companies with a proven history of designing products that meet FAA safety standards. ODA holders must have demonstrated experience and expertise in FAA certification processes, a qualified staff, and an FAA-approved procedures manual before they are appointed. The FAA delegates authority on a project-by-project basis, and the manual defines the process and procedures to which the ODA must adhere when executing the delegated authority. The ODA holder is responsible to ensure that ODA staff are free to perform their authorized functions without conflicts of interest or undue pressure.
There are many issues that will always require direct FAA involvement, including equivalent level of safety determinations, and rulemakings required to approve special conditions. The FAA may choose to be involved in other project areas after considering factors such as our confidence in the applicant, the applicant’s experience, the applicant’s internal processes, and confidence in the designees.
Something that is not well understood about the certification process is that it is the applicant’s responsibility to ensure that an aircraft complies with FAA safety regulations. It is the applicant who is required to develop aircraft design plans and specifications, and perform the appropriate inspections and tests necessary to establish that an aircraft design complies with the regulations. The FAA is responsible for determining that the applicant has shown that the overall design meets the safety standards. We do that by reviewing data and by conducting risk-based evaluations of the applicant's work.
The FAA is directly involved in the testing and certification of new and novel features and technologies. When a new design, or a change to an existing design, of an aircraft is being proposed, the designer must apply to the FAA for a design approval. While an applicant usually works on its design before discussing it with the FAA, we encourage collaborative discussions well in advance of presenting a formal application. Once an applicant informs the FAA of the intent to develop and certify a product, a series of meetings are held both to familiarize the FAA with the proposed design, and to familiarize the applicant with the certification requirements. A number of formal and informal meetings are held on issues ranging from technical to procedural. Once the application is made, issue papers are developed to provide a structured way of documenting the resolution of technical, regulatory, and administrative issues that are identified during the process.
Once the certification basis is established for a proposed design, the FAA and the applicant develop and agree to a certification plan and initial schedule. In order to receive a type certificate, the applicant must conduct an extensive series of tests and reviews to show that the product is compliant with existing standards and any special conditions, including lab tests, flight tests, and conformity inspections. These analyses, tests, and inspections happen at a component-level and an airplane-level, all of which are subject to FAA oversight. If the FAA finds that a proposed new type of aircraft complies with safety standards, it issues a type certificate. Or, in the case of a change to an existing aircraft design, the FAA issues an amended type certificate.
Facts Concerning the Boeing 737 MAX
While the FAA is always striving to improve safety, the certification processes described above are extensive, well-established, and have consistently produced safe aircraft designs for decades. The Boeing Company has designed and built 14 variations of its original model 737 since the FAA issued the original type certificate in 1967. Following standard certification procedures, and based on the information Boeing provided, the FAA determined in February 2012 that the 737 MAX qualified as an amended type certificate project eligible for management by the Boeing ODA. The formal application was submitted in June 2012. Under such an arrangement, FAA subject matters experts are directly involved in safety related aspects of the project. For example, the FAA was directly involved in the System Safety Review of the Maneuvering Characteristics Augmentation System (MCAS).
The process from initial application to final certification took five years; the 737 MAX was certified in March 2017. The process included 297 certification flight tests, some of which encompassed tests of the MCAS functions. FAA engineers and flight test pilots were involved in the MCAS operational evaluation flight test. During the FAA’s continued oversight of airworthiness standards, as we obtain pertinent information, identify potential risk, or learn of a system failure, we analyze it, mitigate the risk, update the certification requirements and require operators to implement the mitigation.
737 MAX Accidents and the Decision to Ground the Fleet
On October 29, 2018, a Boeing 737 MAX 8 operated by Lion Air as flight JT610 crashed after taking off from Soekarno-Hatta Airport in Jakarta, Indonesia. Flight JT610 departed from Jakarta with an intended destination of Pangkal Pinang, Indonesia. It departed Jakarta at 6:20 a.m. (local time), and crashed into the Java Sea approximately 13 minutes later. One hundred and eighty-four passengers and five crewmembers were on board. There were no survivors. An Indonesian-led investigation into the cause of this accident is ongoing, supported by the National Transportation Safety Board (NTSB), FAA, and Boeing. A preliminary report prepared by the Indonesian National Transportation Safety Committee was released in November 2018.
On November 7, 2018, based on all available and relevant information, including evidence from the Lion Air accident investigation and analysis performed by Boeing, the FAA issued an Emergency Airworthiness Directive. The airworthiness directive requires operators of the 737 MAX to revise their flight manuals to reinforce and emphasize to flight crews how to recognize and respond to uncommanded stabilizer trim movement and MCAS events. The FAA continued to evaluate the need for software and/or other design changes to the aircraft including operating procedures and training as additional information was received from the ongoing Lion Air accident investigation. On January 21, 2019, Boeing submitted a proposed plan for an MCAS software enhancement to the FAA for certification. To date, the FAA has tested a prototype of this enhancement to the 737 MAX flight control system in both the simulator and the aircraft. FAA flight test engineers and flight test pilots performed a preliminary evaluation of the prototype which included aerodynamic stall situations and recovery procedures.
On March 10, 2019, Ethiopian Airlines flight ET302, also a Boeing 737 MAX 8, crashed at 8:44 a.m. (local time), six minutes after takeoff. The flight departed from Bole International Airport in Addis Ababa, Ethiopia with an intended destination of Nairobi, Kenya. The accident site is near Bishoftu, Ethiopia. One hundred and forty-nine passengers and eight crewmembers were on board. None survived. An Ethiopian-led investigation into the cause of this accident is ongoing, supported by the NTSB, FAA, and Boeing. A preliminary report prepared by the Aircraft Accident Investigation Bureau of Ethiopia was released in April 2019.
Following the second accident, the FAA gathered all of the data it had, regarding 737 MAX operations in the United States and continued to review information from the investigation as it became available. On March 11, 2019, the FAA issued a Continuous Airworthiness Notification to the International Community (CANIC) for 737 MAX operators. The CANIC included a list of all of the activities the FAA had completed in support of the continued operational safety of the 737 MAX fleet. These activities included the airworthiness directive issued on November 7, 2018, ongoing oversight of Boeing’s flight control system enhancements, and updated training requirements and flight crew manuals.
After issuing the CANIC, the FAA continued to evaluate all available data and aggregate safety performance from operators and pilots of the 737 MAX, none of which provided any data to support grounding the aircraft. Also, at that time, other civil aviation authorities had not provided any data to the FAA that warranted action. The FAA’s initial review of flight safety data for U.S. operators showed no systemic performance issues and provided no basis to order grounding the aircraft.
On March 13, 2019, however, the Ethiopian Airlines investigation developed new information from the wreckage concerning the aircraft’s configuration just after takeoff that, taken together with newly refined data from satellite-based tracking of the aircraft’s flight path, indicated some similarities between the Ethiopian Airlines and Lion Air accidents that warranted further investigation of the possibility of a shared cause that needed to be better understood and addressed. Accordingly, the FAA made the decision to ground all 737 MAX airplanes operated by U.S. airlines or in U.S. territory pending further investigation, including examination of information from the aircraft’s flight data recorders and cockpit voice recorders.
Post-Grounding Actions
On March 19, 2019, Secretary Chao asked the U.S. Department of Transportation’s Inspector General to conduct an audit of the certification for the Boeing 737 MAX 8, with the goal specifically to compile an objective and detailed factual history of the activities that resulted in the certification of the Boeing 737 MAX 8 aircraft. That audit is ongoing, with the cooperation of the FAA.
On March 20, 2019, the FAA issued a second CANIC with updated information for operators of the 737 MAX. Specifically, the CANIC notified operators that Boeing had begun work on a Service Bulletin that would specify the installation of new flight control computer operational program software and had developed flightcrew training related to this software. Boeing is still to submit the final software package for certification. The FAA’s ongoing review of this software installation and training is an agency priority, as will be the roll-out of any software, training, or other measures to operators of the 737 MAX.
On March 25, 2019, Secretary Chao announced the establishment of a Special Committee to review the FAA’s procedures for the certification of new aircraft, including the Boeing 737 MAX. The Special Committee to Review FAA’s Aircraft Certification Process is an independent body whose findings and recommendations will be presented directly to the Secretary and the FAA Administrator. The Special Committee is formed within the structure of the Safety Oversight and Certification Advisory Committee (SOCAC) created by section 202 of the FAA Reauthorization Act of 2018.
Further, on April 2, 2019, the FAA announced it was establishing a Joint Authorities Technical Review (JATR) to conduct a comprehensive review of the certification of the automated flight control system on the Boeing 737 MAX. The JATR is chaired by former NTSB Chairman Christopher Hart and comprises a team of experts from the FAA, National Aeronautics and Space Administration (NASA), and the aviation authorities of Australia, Brazil, Canada, China, the European Union, Indonesia, Japan, Singapore, and the United Arab Emirates. On April 29, the JATR initiated its review, with members tasked to provide the FAA with their findings regarding the adequacy of the certification process and any recommendations to improve the process. Completion of the JATR’s work is not a prerequisite for returning the 737 MAX to service.
Additionally, on April 12, 2019, the FAA convened a meeting at the agency’s Washington, D.C. headquarters with safety representatives of the three U.S.-based commercial airlines that have the Boeing 737 MAX in their fleets, as well as the pilot unions for those airlines. The meeting covered three major agenda items: a review of the publicly available preliminary findings of the investigations into the Lion Air and Ethiopian Airlines accidents; an overview of the anticipated software enhancements to the MCAS system; and, an overview of pilot training. Each presentation corresponding to the agenda, delivered by FAA subject matter experts, allowed for an open exchange between all participants. This meeting was an opportunity for the FAA to hear individual views from operators and pilots of the 737 MAX as the agency evaluates what needs to be done before the FAA makes a decision to return the aircraft to service in the United States.
The FAA recently solicited public comment on a draft report prepared by the FAA’s Boeing 737 MAX Flight Standardization Board (FSB). The FSB is a panel that FAA utilizes to evaluate and determine the sufficiency of proposed training developed by Boeing and related to the proposed software enhancements for the 737 MAX aircraft. An FSB is generally comprised of qualified pilots from FAA’s Certificate Management Offices, foreign authorities, and industry. The FSB report outlines the minimum guidelines for an air carrier training program. The comment period on the draft report has been extended multiple times to ensure ample opportunity for public input. The FAA will review this input before making a final assessment.
On May 6, 2019, the FAA initiated a multi-agency Technical Advisory Board (TAB) review of the MCAS software update and system safety assessment in order to determine sufficiency. The TAB consists of a team of experts from the U.S. Air Force, NASA, Volpe National Transportation Systems Center, and the FAA. None of the TAB experts have been involved in any aspect of the Boeing 737 MAX certification. The TAB is charged with evaluating Boeing and FAA efforts related to the software update and its integration into the flight control system. The TAB will identify issues where further investigation is required prior to approval of the design change. Although the JATR is broadly considering certification of the flight control systems, the TAB is evaluating the proposed technical solutions. The TAB’s recommendations will directly inform the FAA’s decision concerning the 737 MAX fleet’s return to service.
On May 23, 2019, the FAA will host a meeting of Directors General of civil aviation authorities from around the world to discuss the FAA’s activities toward ensuring the safe return of the 737 MAX to service. This meeting is part of the FAA’s efforts to work with other civil aviation authorities to address specific concerns related to the 737 MAX, in keeping with the FAA’s longstanding cooperation with its international partners. As recent events have reminded us, aviation does not have borders or boundaries. The FAA is focused on continuous safety improvement here at home and internationally through our ongoing engagement with other civil aviation authorities and industry stakeholders throughout the world. Aviation remains the safest mode of transportation in the United States and globally, and we advance this level of safety by sharing issues, trends, and lessons learned throughout the world. The United States is the gold standard in aviation safety. The FAA is resolute in its commitment to maintaining that standard. In our quest for continuous safety improvement, the FAA welcomes external review of our systems, processes, and recommendations. And the 737 MAX will return to service for U.S. carriers and in U.S. airspace only when the FAA’s analysis of the facts and technical data indicate that it is safe to do so.
This concludes my prepared statement. I will be happy to answer your questions.