The Boeing 737 MAX Aircraft: Costs, Consequences, and Lessons from its Design, Development, and Certification -Preliminary Investigative Findings- Prepared by the Democratic Staff of the House Committee on Transportation and Infrastructure for Chair Peter A. DeFazio, Subcommittee on Aviation Chair Rick Larsen, and Members of the Committee March 2020 -Preliminary Investigative SummaryOn March 8, 2017, the Federal Aviation Administration (FAA) granted an amended type certificate to The Boeing Company (Boeing) for the 737-8 aircraft, the first of the 737 MAX family, which is the successor to the company’s 737 Next Generation (NG) aircraft.1 The 737 MAX was the 12th derivative model of the 737 aircraft, which was first certified in 1967.2 The 737 MAX entered revenue passenger service with Malindo Air, a Malaysian air carrier, two months after its FAA certification.3 Seventeen months later the 737 MAX suffered its first fatal crash. On October 29, 2018, Indonesian carrier Lion Air operating flight 610 from Soekarno–Hatta International Airport in Jakarta to Depati Amir Airport in Pangkal Pinang, crashed into the Java Sea 13 minutes after takeoff, killing all 189 passengers and crew.4 One Indonesian rescue diver also died during recovery efforts.5 Less than five months later, on March 10, 2019, in strikingly similar circumstances, Ethiopian Airlines flight 302—another 737 MAX aircraft—crashed six minutes after takeoff on a flight from Addis Ababa, Ethiopia, to Nairobi, Kenya, killing all 157 passengers and crew, including eight U.S. citizens.6 For two brand-new aircraft, of a brand-new derivative model, to crash within five months of each other was extraordinary and unprecedented in modern times. While multiple factors led to these accidents, both crashes shared a key contributing factor: a new software system called the Maneuvering Characteristics Augmentation System (MCAS), which Boeing developed to address stability issues in certain flight conditions induced by the plane’s new, larger engines, and their relative placement on the 737 MAX aircraft compared to the engines’ placement on the 737 NG.7 The FAA grounded the 737 MAX three days after the Ethiopian Airlines crash, following similar actions taken by China, the European Union, and Canada, among others.8 Despite optimistic predictions at the time—that a simple software fix would allow the 737 MAX to return quickly to “Type Certificate Data Sheet A16WE,” Federal Aviation Administration (FAA), Department of Transportation (DOT), March 8, 2017, accessed here: https://rgl.faa.gov/Regulatory_and_Guidance_Library/rgMakeModel.nsf/0/0970d54d00efbb9a862580de006a83cc/$FI LE/A16WE_Rev_58.pdf. 2 Ibid. 3 Fridaus Hashim, “Malindo operates world’s first 737 Max flight,” FlightGlobal, May 22, 2017, accessed here: https://www.flightglobal.com/orders-and-deliveries/malindo-operates-worlds-first-737-max-flight/124109.article. 4 Final Aircraft Accident Investigation Report, PT. Lion Mentari Airlines, Boeing 737-8 (MAX); PK-LQP, Tanjunk Karawang, West Java, Republic of Indonesia, National Transportation Safety Committee, October 29, 2018, released October 2019, pp. 19-27. 5 “Lion Air: Indonesian rescue diver dies while searching for victims of jet crash near Jakarta,” ABC Australia, November 3, 2018, accessed here: https://www.abc.net.au/news/2018-11-03/indonesian-rescue-diver-dies-in-lion-airjet-crash-search/10463266. 6 Aircraft Accident Investigation Preliminary Report, Ethiopian Airlines Group, B737-8 (MAX) Registered ET-AVJ, 28 NM South East of Addis Ababa, Bole International Airport, March 10, 2019, Report No. AI-01/19, pp. 9-12, accessed here: http://www.ecaa.gov.et/home/wp-content/uploads/2019/07/Preliminary-Report-B737-800MAX-ET-AVJ.pdf. 7 Ralph Vertabedian, “How a 50-year-old design cam back to haunt Boeing with its troubled 737 MAX jet,” LA Times (3/15/19) accessed here: https://www.latimes.com/local/california/la-fi-boeing-max-design-20190315-story.html. 8 Luz Lazo, Michael Laris, Lori Arantani and Damian Paletta, “FAA’s emergency order grounding Boeing jets came after the agency identified similarities between crashes in Ethiopia, Indonesia,” Washington Post, March 13, 2019, accessed here: https://www.washingtonpost.com/local/trafficandcommuting/canada-grounds-boeing-737-max-8-leaving-us-aslast-major-user-of-plane/2019/03/13/25ac2414-459d-11e9-90f0-0ccfeec87a61_story.html. 1 1 service9 —the aircraft has been grounded for nearly one year, with even more new safety issues emerging since.10 Within days of the Ethiopian Airlines crash, the House Committee on Transportation and Infrastructure (Committee), under the leadership of Chair Peter A. DeFazio and the Subcommittee on Aviation Chair Rick Larsen, launched an investigation into the design, development, and certification of the 737 MAX aircraft and related matters that led to the tragic deaths of 346 people.11 Since then, the Committee has held five hearings on issues related to the 737 MAX; written 19 oversight related letters, including nine records request letters; received an estimated 600,000 pages of records from Boeing, the FAA, airlines, and others; conducted 20 official interviews with current Boeing employees and FAA officials, including a transcribed interview with the FAA’s Associate Administrator for Aviation Safety; and spoken with a wide range of aviation experts, engineers, software development experts, and former FAA and Boeing employees. The Committee’s investigation has also been informed by records and information provided by numerous whistleblowers who have contacted the Committee directly with their concerns. While the Committee’s investigation is progressing, it is not yet complete; there are still more interviews to conduct and records to review. Nonetheless, as the one-year anniversary of the Ethiopian Airlines crash approaches, the Committee wishes to provide an update and publish preliminary investigative findings to help inform Members of the Committee and the public. Further, the Committee continues to consider legislative action to (1) rectify the problems our investigation has discovered related to the design, development, and certification of the 737 MAX, (2) create a more robust FAA oversight structure and improved certification process, and (3) ensure the safety of the flying public. -Preliminary Investigative ThemesThe Committee’s preliminary findings identify five central themes that affected the design, development, and certification of the 737 MAX and FAA’s oversight of Boeing. Acts, omissions, and errors occurred across multiple stages and areas of the development and certification of the 737 MAX. These themes are present throughout the investigative findings listed below. 1) Production Pressures. There was tremendous financial pressure on Boeing and subsequently the 737 MAX program to compete with Airbus’ A320neo aircraft.12 Among other things, this pressure See Dawn Gilbertson, “Boeing 737 MAX: How will airlines convince skittish passengers it’s safe to fly again,” USA Today, April 7, 2019, accessed here: https://www.usatoday.com/story/travel/flights/2019/04/06/boeing-737-max-8passengers-return-airlines-safety-crashes-fix-airplanes/3376865002 and Sam Roecker, “Boeing 737 MAX MCAS Update Ready For Certification,” Simple Flying, April 18, 2019, accessed here: https://simpleflying.com/boeing-737-max-updatecomplete. 10 Natalie Kitroeff and David Gelles, “It’s Not Just Software: New Safety Risks Under Scrutiny on Boeing’s 737 Max,” NY Times, January 29, 2020, accessed here: https://www.nytimes.com/2020/01/05/business/boeing-737-max.html. 11 “As Part of Investigation into Boeing 737 MAX Certification Process, Committee Sends Records Requests to FAA, Boeing,” Committee on Transportation and Infrastructure, April 1, 2019, accessed here: https://transportation.house.gov/news/press-releases/as-part-of-investigation-into-boeing-737-max-certificationprocess-committee-sends-records-requests-to-faa-boeing. 12 David Gelles, Natalie Kitroeff, Jack Nicas and Rebecca R. Ruiz, “Boeing Was ‘Go, Go, Go’ to Beat Airbus With the 737 MAX,” NY Times, March 29, 2019, accessed here: https://www.nytimes.com/2019/03/23/business/boeing-737max-crash.html. 9 2 resulted in extensive efforts to cut costs, maintain the 737 MAX program schedule, and not slow down the 737 MAX production line. The Committee’s investigation has identified several instances where the desire to meet these goals and expectations jeopardized the safety of the flying public. 2) Faulty Assumptions. Boeing made fundamentally faulty assumptions about critical technologies on the 737 MAX, most notably with MCAS. Based on incorrect assumptions, Boeing permitted MCAS—software designed to automatically push the plane’s nose down in certain conditions—to rely on a single angle of attack (AOA) sensor for automatic activation, and assumed pilots, who were unaware of the system’s existence in most cases, would be able to mitigate any malfunction. Partly based on those assumptions, Boeing failed to classify MCAS as a safety-critical system, which would have offered greater scrutiny during its certification. The operation of MCAS also violated Boeing’s own internal design guidelines established during development. 3) Culture of Concealment. In several critical instances, Boeing withheld crucial information from the FAA, its customers, and 737 MAX pilots. This included hiding the very existence of MCAS from 737 MAX pilots13 and failing to disclose that the AOA disagree alert was inoperable on the majority of the 737 MAX fleet, despite having been certified as a standard cockpit feature.14 This alert notified the crew if the aircraft’s two AOA sensor readings disagreed, an event that occurs only when one is malfunctioning. Boeing also withheld knowledge that a pilot would need to diagnose and respond to a “stabilizer runaway” condition caused by an erroneous MCAS activation in 10 seconds or less, or risk catastrophic consequences.15 4) Conflicted Representation. The Committee has found that the FAA’s current oversight structure with respect to Boeing creates inherent conflicts of interest that have jeopardized the safety of the flying public. The Committee’s investigation documented several instances where Boeing authorized representatives (ARs)—Boeing employees who are granted special permission to represent the interests of the FAA and to act on the agency’s behalf in validating aircraft systems and designs’ compliance with FAA requirements—failed to take appropriate actions to represent the interests of the FAA and to protect the flying public.16 5) Boeing’s Influence Over the FAA’s Oversight. Multiple career FAA officials have documented examples to the Committee where FAA management overruled the determination of the FAA’s own technical experts at the behest of Boeing. In these cases, FAA technical and safety experts determined that certain Boeing design approaches on its transport category aircraft were Benjamin Shang, “Boeing’s CEO explains why the company didn’t tell 737 Max pilots about the software system that contributed to 2 fatal crashes,” Business Insider, April 29, 2019, accessed here: https://www.businessinsider.com/boeings-ceo-on-why-737-max-pilots-not-told-of-mcas-2019-4. 14 Julie Johnsson, Ryan Beene and Mary Schlangenstein, “Boeing Held Off for Months on Disclosing Faulty Alert on 737 Max,” Bloomberg, May 5, 2019, accessed here: https://www.bloomberg.com/news/articles/2019-05-05/boeingleft-airlines-faa-in-dark-on-737-alert-linked-to-crash. 15 Boeing Coordination Sheet, Revision D, 3/30/16 TBC-T&I 29160 – TBC-T&I 29166 at TBC-T&I 29166, accessed at p. 164 here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 16 See, for example, AR concurring in Boeing plan to treat MCAS as part of speed trim function to avoid greater FAA certification requirements and pilot training impacts on the 737 MAX program in Boeing internal email, “Subject: PRG – 37MAXFCO-PDR_AI22 – MCAS/Speed Trim,” June 7, 2013, accessed at p. 93 here: https://transportation.house.gov/imo/media/doc/Compressed%20Updated%202020.01.09%20Boeing%20Production. pdf. 13 3 potentially unsafe and failed to comply with FAA regulation, only to have FAA management overrule them and side with Boeing instead.17 These five recurring themes paint a disturbing picture of Boeing’s development and production of the 737 MAX and the FAA’s ability to provide appropriate oversight of Boeing’s 737 MAX program. These issues must be addressed by both Boeing and the FAA in order to correct poor certification practices that have emerged, faulty analytical assumptions that have surfaced, notably insufficient transparency by Boeing, and inadequate oversight of Boeing by the FAA. -Preliminary Investigative FindingsListed below are the Committee’s preliminary investigative findings that are grouped into six distinct categories: FAA oversight, Boeing production pressures, Maneuvering Characteristics Augmentation System (MCAS), AOA Disagree alert, 737 MAX pilot training, and post-Lion Air responses by both Boeing and the FAA. FAA Oversight –The FAA failed in its oversight responsibilities to ensure the safety of the traveling public. ▪ The Committee has documented at least three instances in Boeing’s 737 MAX program where Boeing ARs failed to represent the interests of the FAA in carrying out their FAAdelegated functions. For example, at least one AR concurred on a decision not to emphasize MCAS as a “new function” because of Boeing’s fears that “there may be a greater certification and training impact” if the company did and the Committee has no evidence the AR shared this information with the FAA.18 In addition, the Committee has found no evidence to date that any Boeing ARs who were aware of the fact that Boeing had evidence suggesting a slow pilot reaction time to address a runaway stabilizer event caused by uncommanded MCAS activation could result in catastrophic consequences informed the FAA of this critical information. The Committee also discovered that one AR who was aware that Boeing knowingly delivered aircraft with inoperable AOA Disagree alerts to its customers took no action to inform the FAA. Not all of these instances violated FAA regulations or guidance, but they indicate that Boeing ARs are not communicating with the FAA enough about issues of concern. ▪ At times, FAA management has undercut the authority and judgment of its own technical experts and sided with Boeing on design issues that failed to adequately address safety issues and appear to have violated FAA regulations or guidance. These issues go beyond the 737 MAX program. The Committee is aware of at least one example where FAA technical “Amid Committee’s Ongoing Investigation into the Certification of the 737 MAX, Chairs DeFazio and Larsen Raise New and Serious Concerns to FAA About Other Safety-related Issues,” Press Release, Committee on Transportation and Infrastructure, November 7, 2019, accessed here: https://transportation.house.gov/news/press-releases/amidcommittees-ongoing-investigation-into-the-certification-of-the-737-max-chairs-defazio-and-larsen-raise-new-andserious-concerns-to-faa-about-other-safety-related-issues-. (Hereafter referenced as Committee Press Release, Nov. 7, 2019). 18 Boeing internal email, “Subject: PRG – 37MAXFCO-PDR_AI22 – MCAS/Speed Trim,” June 7, 2013, accessed at p. 93 here: https://transportation.house.gov/imo/media/doc/Compressed%20Updated%202020.01.09%20Boeing%20Production. pdf. 17 4 experts were overruled by FAA management regarding a lightening protection safety feature on another Boeing aircraft, the 787 Dreamliner.19 ▪ The FAA’s safety oversight was hampered by poor, disjointed FAA communication among the agency’s own internal offices responsible for certifying new aircraft regarding critical 737 MAX systems, such as MCAS. This lack of information impeded the ability of FAA employees to make informed decisions. From FAA leadership down, ineffective communication and lack of coordination on key certification and safety issues jeopardized the safety of the flying public. ▪ The FAA failed to fully exercise its safety oversight authority. The agency did not ask enough questions or scrutinize sufficiently Boeing responses regarding critical certification related issues involving pilot training and technical design issues. ▪ In at least one instance, the FAA failed in its duty to hold Boeing accountable for violations of FAA regulations in the 737 MAX program.20 Boeing Production Pressure – Costs, schedule, and production pressures at Boeing undermined safety of the 737 MAX. ▪ Boeing’s business objective for the 737 MAX from the start was to build an airplane that required no simulator training for pilots who were already flying the 737 NG. The company demanded less than 16 hours of computer-based instruction on the differences between the 737 NG and 737 MAX for pilots transitioning between the two aircraft. This program directive played a pivotal role in shaping Boeing’s focus on costs and competitiveness and undermined safety.21 ▪ Boeing received an FAA exception to allow the company to not install on the 737 MAX an Engine Indicating and Crew Alerting System (EICAS)—a system common in newly type certificated aircraft since 1982 that displays for pilots aircraft system faults and failures and helps pilots prioritize responding to multiple or simultaneous indications. The FAA accepted Boeing’s argument about the impracticality and the economic expense of installing EICAS on the 737 MAX.22 The 737 family, including the 737 MAX, is the only Boeing commercial Committee Press Release, Nov. 7, 2019. Letter from FAA Acting Administrator Daniel Elwell to Chair Peter DeFazio, July 11, 2019, (on file with Committee (regarding the mandatory installation of functional AOA Disagree alerts on all Boeing 737 MAX aircraft). 21 Boeing internal e-mail, “Subject: 737MAX Firm Configuration Status/Help Needed,” May 4, 2013, (see “Differences Pilot Training” section), TBC T&I 048706-048708, accessed here: https://www.govinfo.gov/content/pkg/CHRG116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 22 See “Safety Recommendation Report: Assumptions Used in the Safety Assessment Process and the Effects of Multiple Alerts and Indications on Pilot Performance,” National Transportation Safety Board (NTSB), September 19, 2019, accessed here: https://www.ntsb.gov/investigations/AccidentReports/Reports/ASR1901.pdf; Boeing slide presentation to FAA, “BCA Airplane Programs Organization Designation Authorization (ODA) Technical Review Board 737 MAX Impractical Exception Proposal – Flight Crew Alerting, 25.1322(b)(2), (b)(3), (c)(2), (d)(1), and (d)(2),” June 7, 2013, FAA-DEFAZIO-000032891 (on file with Committee); see also Dominic Gates, Steve Miletich, & Lewis Kamb, “Boeing pushed FAA to relax 737 MAX certification requirements for crew alerts,” Seattle Times, October 2, 2019, accessed here: https://www.seattletimes.com/business/boeing-aerospace/boeing-pushed-faa-to-arelax-737-max-certificationrequirements-for-crew-alerts. 19 20 5 aircraft line that does not have an EICAS system installed, which might have helped to alleviate pilot confusion in the Lion Air and Ethiopian Airlines accidents.23 ▪ In 2012, in order to lower costs of the 737 MAX program, Boeing reduced the work hours involved in avionics regression testing on the 737 MAX by 2,000 hours, flight test support by 3,000 hours, and the engineering flight deck simulator (E-CAB) by 8,000 hours, equivalent to the reduction of 6.5 full time employees over a one year period.24 ▪ In 2013, a Boeing engineer raised the issue of installing on the 737 MAX a synthetic airspeed indicator—a computer-based indication of speed that can be compared to actual airspeed measures—as had been done on the 787 Dreamliner. However, this request was rejected by Boeing management due to cost concerns and because synthetic airspeed would have been a new feature on the plane, and its introduction may have jeopardized the 737 MAX program’s directive not to have any simulator training for the 737 MAX.25 ▪ In June and July 2018, senior Boeing leadership rebuffed concerns made by a Renton, Washington, Boeing plant supervisor about production pressures at the 737 MAX production plant and their potential effects on safety.26 The employee who raised those concerns recommended temporarily halting production at the plant to address safety concerns. Despite those warnings, Boeing ramped up production instead.27 ▪ A Boeing internal survey conducted in 2016 at the height of the 737 MAX’s certification activities, and provided to the Committee from a whistleblower, found that 39 percent of Boeing employees that responded perceived “undue pressure” and 29 percent were concerned about consequences if they reported potential undue pressure, painting a disturbing picture of cultural issues at Boeing that can undermine safety and oversight.28 Dominic Gates, Steve Miletich, & Lewis Kamb, “Boeing pushed FAA to relax 737 MAX certification requirements for crew alerts,” Seattle Times, October 2, 2019, accessed here: https://www.seattletimes.com/business/boeingaerospace/boeing-pushed-faa-to-arelax-737-max-certification-requirements-for-crew-alerts. 24 Boeing internal power-point presentation, “FCOI Model Leads Meeting – 737 MAX,” July 12, 2012, TBC T&I 011073. 25 Boeing internal emails, “Subject: Synthetic Airspeed,” February 26, 2013, p.1, accessed here: https://transportation.house.gov/imo/media/doc/Compressed%20Updated%202020.01.09%20Boeing%20Production. pdf. 26 See The Boeing 737 MAX: Examining the Federal Aviation Administration’s Oversight of the Aircraft’s Certification: Hearing Before the H. Comm. on Transp. & Infrastructure, 116th Cong. (2019) (statement of Edward Pierson, Retired Boeing employee) accessed here: https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=110296. 27 See The Boeing Company, Q4 2017 Earnings Call, January 31, 2018, p. 19, accessed here: https://s2.q4cdn.com/661678649/files/doc_transcripts/2018/Q417-Earnings-Transcript.pdf (announcing jump in production rates from 42 to 47 planes per month); The Boeing Company, Q2 2018 Earnings Call, July 25, 2018, p. 6, available here: https://s2.q4cdn.com/661678649/files/doc_financials/quarterly/2018/q2/2Q18-Earnings-CallTranscript-Final.pdf (announcing increase in production rates from 52 to 57 planes per month). 28 Boeing presentation of November 2016, “Undue Pressure: Key Learnings and Next Steps,” accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 23 6 MCAS – Boeing failed to appropriately classify MCAS as a safety-critical system, concealed critical information about MCAS from pilots, and sought to diminish focus on MCAS as a “new system” in order to avoid greater FAA scrutiny and increased pilot training requirements. ▪ Both Boeing and the FAA failed to appropriately designate MCAS a safety-critical system. In May 2019, then-Acting FAA Administrator Dan Elwell acknowledged this point at a hearing before the Committee.29 ▪ In 2012, Boeing developed initial concepts for an MCAS annunciator to inform pilots when the MCAS failed, but never implemented it.30 ▪ In June 2013, Boeing employees formulated a plan to help avoid increased FAA certification and pilot training requirements for the 737 MAX by describing MCAS as “an addition to [the existing] Speed Trim [system].”31 The Boeing meeting minutes, summarized in an e-mail, warned: “If we emphasize MCAS is a new function there may be a greater certification and training impact.”32 According to the e-mail that summarized the meeting minutes, a Boeing AR concurred with this plan.33 ▪ In 2015, a Boeing AR raised the question of whether MCAS was “vulnerable to single AOA sensor failures….”34 Despite this, the aircraft was delivered with MCAS dependent on a single AOA sensor. ▪ After Boeing redesigned MCAS in 2016 to increase its power to move the aircraft’s stabilizer at low speed, Boeing never reevaluated a single- and multiple-failure analysis of MCAS.35 ▪ In March 2016, Boeing sought, and the FAA approved, removal of references to MCAS from Boeing’s Flight Crew Operations Manual (FCOM),36 ensuring 737 MAX pilots were unaware of this new software and its potential effect on the aircraft’s handling without pilot command. Status of the Boeing 737 MAX: Hearing Before the Subcomm. On Aviation of the H. Comm. on Transp. & Infrastructure, 116th Cong 28-29 (2019), accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg37277/pdf/CHRG116hhrg37277.pdf. 30 “Preliminary Design Decision Memo,” High Speed Pitch-Up, Revision A, November 8, 2012, TBC-T&I 010920, TBC-T&I 010926, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG116hhrg38282.pdf. 31 Boeing internal email, “Subject: PRG – 37MAXFCO-PDR_AI22 – MCAS/Speed Trim,” June 7, 2013, accessed at p. 93 here: https://transportation.house.gov/imo/media/doc/Compressed%20Updated%202020.01.09%20Boeing%20Production. pdf. 32 Ibid. 33 Ibid. 34 See Boeing internal email, AOA Sensor email string – TBC-T&I 10584-10585, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf (“Are we vulnerable to single AOA sensor failures with the MCAS implementation or is there some checking that occurs”). 35 See Boeing presentation to FAA, “MCAS Development and Certification Overview,” transmitted March 1, 2019, TBC-T&I130073, TBC-T&I130111 accessed here: https://www.govinfo.gov/content/pkg/CHRG116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 36 Email from Mark Forkner to FAA, “Subject: MCAS lives in both FCCs,” March 3, 2016 (on file with Committee) (released publicly by the FAA). 29 7 ▪ Boeing’s design of MCAS violated its own internal requirements which demanded that the system “not have any objectionable interaction with the piloting of the airplane” and “not interfere with dive recovery,” which occurred in both 737 MAX crashes.37 AOA Disagree Alert – Boeing intentionally concealed information from the FAA, its customers, and pilots about inoperable AOA Disagree alerts installed on most of the 737 MAX fleet, despite their functioning being “mandatory” on all 737 MAX aircraft, and the FAA has failed to hold Boeing accountable for these actions. ▪ Boeing has publicly blamed its software supplier for an issue that tied the AOA Disagree alert, which was standard on all 737 MAX aircraft, to an optional AOA Indicator display.38 However, the Committee has learned Boeing accepted and verified the software configuration resulting in this outcome at the time it was completed in May 2015.39 ▪ In August 2017, five months after the 737 MAX was certified by the FAA and three months after it entered revenue service, Boeing issued a problem report to its supplier complaining that the 737 MAX’s AOA Disagree alert was tied to an optional AOA Indicator display and therefore was not functioning on the vast majority of the 737 MAX fleet worldwide.40 ▪ Rather than immediately informing the FAA and Boeing customers about this issue, and advising Boeing to fix the problem via a software update as soon as possible, a Boeing AR consented to Boeing’s plan to postpone the software update until 2020, three years later, so it could be done in conjunction with the rollout of Boeing’s planned 737 MAX-10 aircraft.41 ▪ Although Boeing prepared a “Fleet Team Digest” to inform its customers about the inoperable AOA Disagree alert, the company never sent it, keeping its customers in the dark about the inoperable alert.42 ▪ Boeing provided Lion Air a Flight Crew Operations Manual (FCOM) on August 16, 2018, one year after learning that the AOA Disagree alert was not functioning on most 737 MAX aircraft, highlighting the operation of the AOA Disagree alert. Boeing failed to indicate that it knew the AOA Disagree alert on the Lion Air 737 MAX aircraft was not operational.43 Boeing Coordination Sheet, Revision D, 3/30/16 TBC-T&I 29160 – TBC-T&I 29166 at TBC-T&I 29166, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 38 The Boeing Company, Press Statement, “Boeing Statement on AOA Disagree Alert,” May 5, 2019, accessed here: https://boeing.mediaroom.com/news-releases-statements?item=130431. 39 Letter to Chair DeFazio and Subcommittee Chair Larsen from attorney for Rockwell Collins, June 20, 2019, and supporting documents, including Collins 00075. On file with Committee. 40 See: Boeing narrative on AOA Disagree alert. On file with Committee. TBC-T&I 267826 – TBC-T&I 267833, at TBC-T&I 267830; and Alan Levin, “Boeing Failure to Fix 737 MAX Warning Light May Draw FAA Penalty,” Bloomberg, February 21, 2020, accessed here: https://www.bloomberg.com/news/articles/2020-02-21/boeing-failureto-fix-737-max-cockpit-light-may-draw-faa-penaltye. 41 Boeing narrative on AOA Disagree alert. On file with Committee. TBC-T&I 267826 – TBC-T&I 267833, at TBCT&I 267830 - TBC-T&I 267831. 42 Boeing narrative on AOA Disagree alert. On file with Committee. TBC-T&I 267826 – TBC-T&I 267833, at TBCT&I 267831. 43 Lion Air Flight Crew Operations Manual, 8/16/18, accessed at pp. 175-177 here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 37 8 ▪ Boeing did not acknowledge that the AOA Disagree alerts on an estimated 80 percent of the 737 MAX fleet were inoperative until after the Lion Air crash in October 2018.44 ▪ Although the AOA Disagree alert was not a safety-critical component, Boeing knowingly delivered 737 MAX aircraft to its customers that did not conform to the airplane’s type certificate, and the FAA has failed to take any measures to hold Boeing accountable for these actions. ▪ Then-Acting FAA Administrator Dan Elwell informed the Committee in July 2019 that “[a]lthough an AOA disagree message was not necessary to meet FAA safety regulations, once it was made part of the approved type design, it was required to be installed and functional on all 737 MAX airplanes Boeing produced.”45 737 MAX Pilot Training – Boeing’s economic incentives affected the company’s transparency with the FAA, customers, and 737 MAX pilots regarding pilot training requirements. ▪ Boeing’s own analysis showed that if pilots took more than 10 seconds to identify and respond to a “stabilizer runaway” condition caused by uncommanded MCAS activation the result could be catastrophic. The Committee has found no evidence that Boeing shared this information with the FAA, customers, or 737 MAX pilots. ▪ The 10-second reaction time and the potential for it to result in catastrophic consequences was discovered early on in the development of the 737 MAX program.46 ▪ Multiple Boeing ARs were aware of these findings and never reported them to the FAA. ▪ As early as 2013, Boeing senior leadership’s core requirement for the 737 MAX program was that simulator-based differences training would not be required for pilots transitioning from flying the 737 NG to the 737 MAX.47 ▪ Early on in the 737 MAX program, Boeing recognized that the addition of MCAS to the pilot’s flight controls system posed a risk to Level B (non-simulator) training.48 ▪ Boeing had tremendous financial incentive to ensure that no regulatory determination requiring pilot simulator training for the 737 MAX was made. This incentive included a Boeing contract with Southwest Airlines, its U.S. launch customer, that would have cost Boeing more than $1 million per aircraft it delivered to Southwest if pilot simulator training Alan Levin, “Boeing Failure to Fix 737 MAX Warning Light May Draw FAA Penalty,” Bloomberg, February 21, 2020, accessed here: https://www.bloomberg.com/news/articles/2020-02-21/boeing-failure-to-fix-737-max-cockpit-lightmay-draw-faa-penalty. 45 Letter from FAA Acting Administrator Daniel Elwell to Chair Peter DeFazio, regarding the mandatory installation of functional AOA Disagree alerts on all Boeing 737 MAX aircraft, July 11, 2019. On file with committee. 46 Coordination Sheet—Revision D—TBC-T&I 029160–029166, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 47 Email string on Level B Training Intent—TBC-T&I 048705, 048706, 048707, 048708, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 48 Ibid. 44 9 was required for Southwest pilots transitioning to the 737 MAX from the 737 NG.49 At the time of the Lion Air crash, Southwest had ordered or pre-ordered an estimated 280 737 MAX aircraft from Boeing.50 ▪ In July 2014, two years before the FAA made a decision regarding pilot training requirements for the 737 MAX, and at a time when the FAA was questioning Boeing on its presumption that no simulator training would be required, Boeing issued a press release asserting: “Pilots already certified on the Next-Generation 737 will not require a simulator course to transition to the 737 MAX.”51 Boeing made similar claims in marketing materials it provided to potential customers.52 ▪ In March 2017, the month the 737 MAX was certified by the FAA, Boeing’s 737 Chief Technical Pilot responded to colleagues about the prospects of 737 MAX simulator training, saying: “Boeing will not allow that to happen. We’ll go face to face with any regulator who tries to make that a requirement.”53 ▪ In May and June 2017, as some foreign carriers asked Boeing about providing simulator training for their pilots transitioning from flying the 737 NG to the 737 MAX, e-mails show Boeing’s 737 Chief Technical Pilot strongly opposed such training, and in one case even successfully talked a carrier out of using such training for its pilots on the 737 MAX.54 ▪ Even after the fatal Lion Air crash, Boeing maintained that its “rationale” for removing reference to MCAS from the 737 MAX FCOM was still “valid,”55 and Boeing asserted that the addition of MCAS on the 737 MAX did “not affect pilot knowledge, skills, abilities, or flight safety.”56 Boeing even sought to downgrade pilot training related to post-Lion Air changes to MCAS software to “Level A,” which would only require pilots to review printed materials when transitioning to the 737 MAX from the 737 NG.57 On March 1, 2019, the FAA reminded Boeing that the original level of differences training proposed in 2016 by Boeing—before the Lion Air crash—was Level B differences training. The FAA informed Boeing that the software changes to MCAS “may not meet the definition of Level A David Shepardson and Tracy Rucinski, “U.S. lawmakers question Boeing’s $1 mln rebate clause for Southwest 737 MAX orders,” Reuters, October 30, 2019, accessed here: https://www.reuters.com/article/us-boeing-airplanesouthwest/u-s-lawmakers-question-boeings-1-mln-rebate-clause-for-southwest-737-max-orders-idUSKBN1X92D4. 50 Ibid. 51 “Boeing Selects Supplier for 737 MAX Full-Flight Simulator,” Boeing Press Release, July 11, 2014, accessed here: https://boeing.mediaroom.com/2014-07-11-Boeing-Selects-Supplier-for-737-MAX-Full-Flight-Simulator. 52 Slide presentation to Ethiopian Air—TBC-T&I 001999–002000; 002018, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 53 Boeing e-mail production, page 28, accessed here: https://transportation.house.gov/imo/media/doc/Compressed%20Updated%202020.01.09%20Boeing%20Production. pdf. 54 Boeing e-mail production, pages 14, 32, 33, and 78; accessed here: https://transportation.house.gov/imo/media/doc/Compressed%20Updated%202020.01.09%20Boeing%20Production. pdf. 55 Boeing Letter of January 30, 2019—TBC-T&I 297017–297018, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 56 Boeing Letter of January 30, 2019—TBC-T&I 297017–297018, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 57 Boeing Letter of January 30, 2019—TBC-T&I 297017–297018, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 49 10 differences” training and advised Boeing that the company’s “evaluation is proceeding at risk.”58 Nine days later, Ethiopian Airlines flight 302 crashed killing all 157 people on board. Response to Lion Air Accident - Both Boeing and the FAA gambled with the public’s safety in the aftermath of the Lion Air crash, resulting in the death of 157 more individuals on Ethiopian Airlines flight 302 less than five months later. ▪ Boeing and the FAA failed to learn critical lessons even after the Lion Air crash. In the days after the Lion Air crash, both Boeing and the FAA issued advisories for 737 MAX pilots that failed to mention the existence of MCAS, by name, on the aircraft. ▪ In the time between the Lion Air crash and the FAA’s grounding of the 737 MAX, the FAA repeatedly justified its decision not to ground the 737 MAX earlier saying it did not have appropriate data to make that decision.59 However, there were multiple red flags and clear data points that should have informed the FAA’s decision-making. ▪ After the Lion Air crash, the FAA learned that Boeing had failed to fix an inoperable AOA Disagree alert on an estimated 80 percent of the 737 MAX fleet and decided not to inform the FAA or its customers about the non-functioning alert for more than 14 months, which should have raised concerns about Boeing’s transparency with the FAA.60 ▪ In December 2018, after the Lion Air crash, the FAA received a briefing from Boeing that should have raised additional red flags. Boeing acknowledged in this briefing that prior to certification, the company had not evaluated the effects of a combination of failures leading to unintended MCAS activation in simulator tests nor their combined flight deck effects on pilots. Boeing also acknowledged that it had not reevaluated its single- and multiple-failure analysis of MCAS after engineers made design changes to its control law and Boeing had determined that loss of one AOA sensor followed by an erroneous AOA sensor had been “deemed potentially catastrophic before crew recognition of issue.”61 ▪ In the aftermath of the Lion Air crash, the FAA conducted a risk assessment based on the Transport Aircraft Risk Assessment Methodology (TARAM) which calculated that without a fix to MCAS, during the lifetime of the 737 MAX fleet, there would be an estimated 15 more FAA Letter of March 1, 2019—TBC-T&I 297019–297020, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 59 Robert Wall, Andrew Tangel, and Andy Pasztor, “The FAA Has No Current Plans to Ground Boeing’s 737 MAX After Deadly Crash,” The Wall Street Journal, March 11, 2019, accessed here: https://www.wsj.com/articles/the-faahas-no-current-plans-to-ground-boeings-737-max-11552341654 and Status of the Boeing 737 MAX: Hearing Before the Subcommittee on Aviation of the H. Comm. On Transp. & Infrastructure, 116th Cong. (2019) (statement of Daniel K. Elwell, Acting Administrator, Federal Aviation Administration) accessed here: https://www.govinfo.gov/content/pkg/CHRG116hhrg37277/pdf/CHRG-116hhrg37277.pdf, p. 24. 60 See: Alan Levin, “Boeing Failure to Fix 737 MAX Warning Light May Draw FAA Penalty,” Bloomberg, February 21, 2020, accessed here: https://www.bloomberg.com/news/articles/2020-02-21/boeing-failure-to-fix-737-max-cockpitlight-may-draw-faa-penalty; and “Boeing Statement on AOA Disagree Alert,” accessed here: https://boeing.mediaroom.com/news-releases-statements?item=130431. 61 MCAS Development and Certification Overview—TBC-T&I 130073–130074; 130075–130117, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 58 11 fatal, catastrophic accidents.62 However, the FAA permitted the 737 MAX to continue flying anyway while Boeing and the FAA worked on designing and validating a fix to the MCAS software. That judgment proved tragically wrong. Ethiopian Airlines flight 302 crashed less than five months after the Lion Air crash. -Preliminary Investigative Findings ConclusionBoeing’s design and development of the 737 MAX was marred by technical design failures, lack of transparency with both regulators and customers, and efforts to obfuscate information about the operation of the aircraft. During development of the 737 MAX, Boeing engineers raised safety concerns about MCAS being tied to a single AOA sensor. Another Boeing engineer raised concerns about not having a synthetic airspeed sensor on the 737 MAX. In the wake of the Lion Air and Ethiopian Airlines tragedies, Boeing has now acknowledged some of these issues by planning to have two AOA sensors feed into MCAS, for instance.63 In January 2020, despite the fact that Boeing’s internal directive for the 737 MAX program made crystal clear that nothing should jeopardize Level B non-simulator pilot training requirements, Boeing reversed course by recommending that pilot simulator training on the 737 MAX will be needed before it returns to service.64 Boeing’s responses to safety issues raised in the 737 MAX program have consistently been too late. The Committee’s investigation has also found that the FAA’s certification review of Boeing’s 737 MAX was grossly insufficient and that the FAA failed in its duty to identify key safety problems and to ensure that they were adequately addressed during the certification process. The combination of these problems doomed the Lion Air and Ethiopian Airlines flights. In the weeks after the Lion Air crash, Boeing defended its development of MCAS to the FAA, writing that there was “no process violation or non-compliance” on multiple issues, including: removal of reference to MCAS from the FCOM; Boeing’s evaluation of “repeated unintended MCAS” activation; the fact Boeing did not evaluate “loss of one AOA followed by erroneous AOA” in the simulator; and the fact that the analysis Boeing did conduct was “completed prior to the design change to MCAS control law.”65 The fact that multiple technical design missteps or certification blunders were deemed “compliant” by the FAA points to a critical need for legislative and regulatory reforms. Developing a transport category commercial aircraft that is compliant with FAA regulations but fundamentally flawed and unsafe highlights an aviation oversight system in desperate need of repair. David Slotnick, “The FAA said the Boeing 737 MAX had a high risk of crashing, but let the plane continue flying anyway,” Business Insider, December 11, 2019, accessed here: https://www.businessinsider.com/boeing-737-max-faaanalysis-likely-to-crash-2019-12 (also on file with the committee). 63 Boeing website, accessed here: https://www.boeing.com/commercial/737max/737-max-software-updates.page. 64 Natalie Kitroeff and David Gelles, “In Reversal, Boeing Recommends 737 MAX Simulator Training for Pilots,” NY Times, January 8, 2020, accessed here: https://www.nytimes.com/2020/01/07/business/boeing-737-max-simulatortraining.html. 65 MCAS Development and Certification Overview—TBC-T&I 130073–130074; 130075–130117, accessed here: https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 62 12 These preliminary investigative findings make clear that Boeing must create and maintain an effective and vigorous safety culture and the FAA must develop a more aggressive certification and oversight structure to ensure safe aircraft designs and to regain the confidence of the flying public. We hope these preliminary findings will help pave the way for legislative reforms as the Committee’s investigation continues to identify the actions and events that undermined the design, development, and certification of the 737 MAX aircraft and led to the tragic death of 346 people. 13