On May 15, the House Aviation Subcommittee held its first hearing on the process by which the Federal Aviation Administration certified the Boeing 737 MAX as airworthy and other issues relating to the new aircraft, which was involved in fatal crashes in October 2018 and March 2019 and which has since been pulled from service around the world.

It is important to note that this was a hearing of the Aviation Subcommittee, not the full Transportation and Infrastructure Committee. This meant that fewer members were able to attend and ask questions, and also that it was chaired by subcommittee chairman Rick Larsen (D-WA), not full committee chairman Peter DeFazio (D-OR), and thus Larsen was the one in charge of setting the tone and making sure that members stayed on point.

Larsens’s district includes the city of Everett, Washington, and Everett is the location of the world’s largest building 99 acres in area and averaging 110 feet high. This is the Boeing factory built in 1966 to handle 747 production and which has also built the 767, 777 and some of the 787 airframes. In that building, and on the rest of the 780-acre Boeing Everett campus, the aerospace company employs about 30,000 people and for the most part, those are well-paying union jobs. Even though the 737 MAX itself is build at the older, smaller Renton facility 34 miles to the south, the bottom line is that Larsen, much more than most members, has reason to keep the tone of his hearings on this subject dispassionate and not to let them devolve into Boeing-bashing for the sake of Boeing-bashing by members who want to get their video clips on social media.

There were only two witnesses acting FAA Administrator Dan Elwell (prepared testimony here) and National Transportation Safety Board chairman Robert Sumwalt (prepared testimony here). Elwell’s written testimony provides a background on the safety certification process used for the 737 MAX, while Sumwalt’s written testimony summarizes the crash investigation information released to date by the Indonesian and Ethiopian investigative authorities looking into the 737 MAX accidents.

Background. The 737 MAX is the latest iteration of the workhorse 737 family of aircraft dating back over 50 years. The four MAX variants replace the NG (“Next Generation”) series of 737 variants that were rolled out starting in the late 1990s.

Since Boeing no longer makes the 717 or 757, the 737 family is now the only narrow-body, single-aisle airliner they make. And since McDonnell-Douglas was bought by Boeing and the DC-9 family and its MD-80 and MD-90 descendants have expired, that means that the 737 family is the only narrow-body, single-aisle plane made by any U.S. manufacturer. For the 737 family, as of Boeing’s April order reporting, there were only 19 pre-MAX planes on order but not yet delivered (14 800s and 5 900ERs). The focus going forward is the astonishingly high number of 4,621 MAX variants that have been ordered but not yet delivered.

Given how high the profile of the MAX controversy has been, it is notable that so far, only Garuda Indonesia appears to have canceled its orders for future MAX planes (49 future deliveries). Everyone is waiting to see what happens next. But this is also having a spillover effect into Boeing’s other lines of business they reported this week that no one placed any orders for any kind of Boeing aircraft at all in April. CNN quoted an aviation analyst suggesting that other customers may be holding back new orders of 777s, 787s and the like to see if Boeing has to reduce prices while they wait out the MAX investigations.

Accident similarities. The initial reports on the two accidents (as summarized by Sumwalt), and other information made public since the accidents, indicate that in both instances:

• A failure of an angle of attack (AoA) sensor caused the pilot’s instruments to read that the plane was flying at a very different angle (measured as the plane of the wing vs the plane of the relative wind) than the copilot’s instruments told the copilot. (On one of the crashes it was a faulty sensor; in the other crash, the sensor was most likely taken out by a bird strike.) There are two AoA sensors (left and right) on the MAX and in both cases the left sensor failed while the right sensor remained accurate, but apparently the left sensor was the one in use on both occasions, and its failure triggered a correction system.
• The sensor failure caused an automatic trim adjustment subsystem called MCAS (maneuvering characteristics augmentation system) to activate and try to adjust the angle of the plane automatically by activating stabilizers for short periods of time. The “stick shaker” haptic notification that a stall may be imminent was also activated, to make sure that the pilot instantly became alerted.
• The MCAS system was new to the 737 MAX and was not explained in the flight manual, so pilots were likely unaware that the MCAS system was trying to adjust the angle of the plane.
• In the previous model of the 737, one airline insisted on having Boeing install optional AoA indicator panels on both the pilot and copilot side as an extra feature. That airline later asked for the addition of an AoA “disagree light” that would light up whenever the sensor on the pilot’s side and the sensor on the copilot’s side were disagreeing, which would be an obvious indication that a sensor was probably faulty or broken. Apparently, for the MAX, the AoA disagree light became standard but somehow (Boeing and a contractor disagree on how this happened), the disagree light was never hooked up to anything unless the airline also wanted to install the separate AoA indicators, which few did.
• In both the Lion Air and Ethiopian Air crashes, the pilots fought escalating automatic AND (aircraft nose down) actions forced by the MCAS system with manual ANU (aircraft nose up) trim adjustments, in varying ways (the Ethiopian crew turned the automatic system off for a while and then turned it back on; the Lion crew left it on), and in both cases, the aircraft oscillated up and down until diving and crashing.
• Boeing is currently working on a fix for the MCAS software that relies on both the left and right AoA sensors and will shut down the MCAS system if the two sensors differ, and the FAA is testing that software fix.

Hearing. In the opening statements, Larsen tried to play the neutral referee, asking for clarity from the FAA on the steps of the certification process and emphasizing that the FAA has a credibility problem that it needs to fix. DeFazio was a little more confrontational, noting that the FAA hasn’t sent the committee many of the documents it has requested and that Boeing has, to date, sent none, and pointing out (accurately) that Congress has a long history of only forcing much-needed safety reforms as a reactive measure after tragic accidents.

Ranking Republican Sam Graves (R-MO), himself a pilot with an commercial rating (ATP certificate), emphasized the degree to which pilot error was likely at least a contributing factor to both crashes and criticized the styles of airline pilot training in many foreign countries: “the accident reports reaffirm my belief that pilots trained in the United States would have successfully handled the situation. The reports compound my concerns about quality training standards in other countries.”

(An article in the Seattle Times shortly after the hearing responds to some of Graves’ points, stating “That case for pilot error as the major cause of the crashes seems close to a surrogate for what Boeing has only hinted at, and may be a key part of the manufacturers legal defense in liability lawsuits.Yet two flight-simulator sessions replicating the conditions on the doomed flights contradict Graves contention that better trained pilots would have escaped disaster. And some Western-trained pilots criticize the report as based on unverified assumptions and minimizing the intense stress Boeings runaway flight-control system imposed on the two flight crews.”)

Questions raised, and answered (or not). The hearing Q&A raised a number of issues, and put Elwell on point to respond to many unanswered questions in writing when an answer is available. Among the questions:

Why wasn’t the MCAS system more prominent? DeFazio and others repeatedly asked why the MCAS system (new to the MAX), which took over when the (false) sensor readings came in and started to push the plane towards the ground to compensate for the false readings, wasn’t considered a “safety critical” system and included in the updated flight manual for the 737 MAX and emphasized in updated pilot training guidelines. Elwell admitted that in his personal opinion, the MCAS should have been a safety critical feature, and should have been mentioned in the updated MAX flight manual.

Larsen’s questioning led off with putting Elwell on the spot about a Wall Street Journal article published the day before the hearing alleging that “An internal Federal Aviation Administration review has tentatively determined that senior agency officials didnt participate in or monitor crucial safety assessments of a flight-control system for Boeing Co.s 737 MAX jet later implicated in two fatal crashes, according to industry and government officials.” Elwell responded “there’s nothing in that article that led me to anything that I’m aware of” and his colleague Earl Lawrence, who runs the FAA’s safety certification programs, added “I’m not aware of the internal assessment that the article refers to.” This led to more discussion of…

Should the ODA system be reformed? The MAX crashes have led to much discussion of the way in which the FAA allows U.S. manufacturers to carry out parts of the certification process themselves. This process, which dates back to the 1920s in one form or another, is currently based on the Organization Delegation Authorization (ODA) system by which the FAA certifies a manufacturer as an ODA and, in the words of this recent CRS report, “allows FAA to rely on ODA holders to certify compliance for type certification of aircraft, aircraft engines, propellers, aircraft instruments and equipment, and certifications to mass-produce and issue airworthiness certificates for production aircraft and aircraft components.”

Lawrence explained that safety certification is a four-step process: 1. Setting safety standards (rules and requirements a design must meet). 2. Defining the test protocols that will demonstrate compliance with the standards. 3. Performing the tests and calculations. 4. Reviewing the tests and calculations to determine if the results are compliant with the safety standards. Lawrence said that under ODA, “Only in that third level the actual doing of a test is where delegation is used. FAA is fully responsible for setting the standards that all tests must comply with, and setting the standards for the minimum safety for that aircraft, and then reviewing it all in the end. We never give up that authority.”

Subcommittee ranking member Garrett Graves (R-LA) tossed Larsen a softball question where he said that the news media had inaccurately been referring to ODA as “self-certification,” and Elwell responded “We don’t have a program of self-certification. ODA empowers private individuals at a company that has an ODA program to do certain tasks and make certain decisions. They are delegated with that authority that we then oversee and this isn’t something that we give lightly.”

Larsen made reference to testimony that Elwell gave at an earlier Senate hearing that, if the FAA were required to perform all that testing themselves currently performed by non-FAA employees under ODA authority, the FAA would need to hire about 10,000 new personnel that would cost an extra $1.8 billion in federal appropriations per year.

Larsen and DeFazio also raised the question as to whether or not ODAs should report to FAA managers, or FAA engineers. This, along with the precise decision chain by which the MCAS system was not deemed to be important enough to be mentioned in the flight manual or require any extra training, will be addressed in future in-house and external reviews of the MAX certification process.

(For more on the certification process, see the Eno Aviation Working Group’s 2017 report Safer, Faster, Cheaper: Aviation Certification for the 21st Century.)

Why did FAA take so long to ground the MAX? Rep. Eleanor Holmes Norton (D-DC) and others asked why it took the FAA longer than almost any other national aviation safety body to ground the MAX after the second crash. Elwell kept insisting that the FAA’s decision was completely data-driven and that they grounded the MAX immediately after working out the specific common factors between the two crashes. Elwell also indicated that the FAA had already decided to ground the MAX and that President Trump merely announced the decision and did not, actually, order it himself.

Were pilot flight hours an issue? Rep. Paul Mitchell (R-MI) brought up the number of flight hours required or stated by pilots. He pointed out that the first officer of the Ethiopian Airlines flight had just 360 flight hours, far short of the number of hours that would be required to serve as first officer of any U.S.-certified airline (the post-Colgan rule in the U.S. is 1,500 hours of flight time). At the same time, the number of hours reported by the Ethiopian Airlines captain was suspiciously high he reported 8,100 flight hours but was only 29 years old (reportedly). The FAA caps airline flight hours at 1,000 per year, and even if other countries don’t, that is an awful lot of flight hours for a 29-year old, which led Mitchell to wonder or not he had cooked his log books.

When does a new version of an old plane become a new plane? DeFazio showed a side-by-side photograph of the cockpit of the original 737-100 from 50 years ago (all analog dials and hydraulic controls) with the cockpit of the MAX (all digital screens and fly-by-wire controls). DeFazio asked “I think if you took the 737-100 and compared it to a MAX, you would say, wow, these are different types. But we sort of gradually got there, kept moving, and moving, and moving through 14 variations and never determined that it would have to go through a more rigorous process as a new type, and including pilot retraining, and those sorts of things. I mean, doesn’t that raise some questions about how you kind of get this creep over 14 variations over however many years that is.”

Elwell explained that each new certification is to the last model, so the MAX variants are certified as modifications to the NG family, as NG was to the models of the Classic family, and back to the 100 and 20, and that “if you had the NG and the MAX side-by-side, then you could see the similarities.”

Rep. Dan Lipsnski (D-IL) honed in on this as well, noting that the engines on the MAX are farther forward than they were on previous iterations, which caused the need for the MCAS system, and asked why this didn’t require the MAX to have a new type certificate. Elwell explained that MCAS was put in so that the MAX would feel like the NG even though the engines were farther forward, which carried the plane’s center of gravity forward: “its test flights demonstrated that in a high angle of attack regime, the yoke didn’t feel the same to the pilots as the NG.The MCAS pushed the nose over, so that controllability and the feel in the yolk would be the same. And the flight test pilots deem that it was identical. And then, the Flight Standardization Board pilots, which were actually line pilots that we enlisted to fly both planes found, came to the same conclusion.”