What can we gather from more than three hours of testimony by Boeing executives and government safety officials before the US Senate Commerce Committee today? Mostly that the format is terrible for getting real answers to the critical questions surrounding the 737MAX crashes, subsequent grounding and potential, eventual return to service.
The sound bites are both good and bad. Boeing CEO Dennis Muilenburg had a few comments that he’d likely prefer a mulligan on, while NTSB Chairman Sumwalt continues to deliver objective and useful commentary on the topic. Also, some Senators are much better than others at asking questions.
MCAS, AoA Disagreement, and a lack of training
For example, does it make sense For Senator Cantwell suggest that “I don’t know how much we should be trusting things on the outside of a plane to give commands to the inside of the plane when [those components] can be damaged?” The point she’s likely trying to make is a good one: Depending on a single input system that could be damaged without the pilots having the ability to visibly verify suck is an increased risk level that the planes probably should not be included in the design scope. Indeed, Boeing agrees with that (now) and is fixing the MCAS system to account for multiple inputs and potential disagree of those systems.
But she did not give Muilenburg much opportunity to respond to that statement as she ran out of time during the questioning.
Responding to a question from Senator Klobuchar regarding the omission of the MCAS details from the training curriculum approved by the FAA, content excluded at the request of Boeing engineers, Muilenburg offered an interesting response:
One of the things we’ve learned from both of these accidents is that we need to provide additional information on MCAS to the pilots. Just to give you some context, as we develop our training manuals our idea is to provide training to pilots to respond to the effects of failures rather than trying to diagnose the cause of the failures. That’s a very important distinction. So more information in the training manuals is not necessarily safer. But, as we understand from both of these incidents, we need to provide more information on MCAS to enhance safety.
That the pilots were expected to respond to symptoms they’d never trained for based on circumstances that were not in the manual nor the differences curriculum raises significant questions about the overall goals of Boeing’s process and the FAA approval of such.
Safety for sale??
Senator Markey was one of a few hammering on the idea that Boeing charged extra on the 737 MAX for certain safety-related indicators on the flight deck, specifically related to the AoA disagreement light and the AoA indicator:
The Indonesian crash report released last week specifically cited the lack of a disagree light on the 737 MAX as contributing to the Lion Air tragedy. Shamefully, the law allows Boeing to treat these safety-related technologies as a la carte addons that airlines can only obtain for an additional fee… These tragic crashes have made it all too clear that there should not be a distinction between critical and non-critical safety features.
Responding to that position Muilenburg led with, “We don’t sell safety. That is not our business model.” That’s probably not exactly how he wanted that phrase to come out. The main offering of the company is a safe and reliable product. He did go on to note, again, that more information is not always better, “The AoA indicator is a system we have offered as an option to airlines. Some airlines don’t want it. It is not necessarily a safety improvement. It takes up space on the flight deck displays. And more information on the displays is not necessarily safer. So that is not necessarily a safety feature.”
Eventually Muilenburg admitted that the company has since changed its policies and no longer will charge for either the AoA disagree light – which is now a standard feature – nor the AoA option on the displays for airlines who choose such. That’s what Markey meant by “safety for sale” and what Muilenburg probably should have addressed initially.
Those chat messages
The presence of the chat messages between two pilots concerned about the behavior of MCAS in the simulators and “jedi mind tricking” regulators to not include mention of MCAS in the documentation is rather damning. Yet, somehow, Muilenburg managed to claim he was not aware of the specific conversation logs when they were produced in February, despite being presented to the Department of Justice at that time. No doubt he wouldn’t read all of the documents produced, but someone in the General Counsel’s office probably should’ve created a packet with the most critical pages. And this should’ve been in that set. his claims of ignorance against the information did not look good on screen. Moreover, Muilenburg acknowledges that one of the pilots, Mr. Forkner, no longer works for Boeing and as a result the company has not been able to speak with him about those messages. But the other party to the conversation, Me. Gustavsson, remains a Boeing employee today. Surely in the 8 months since the document was produced for discovery or even just in the couple weeks since it made headlines the company found a way to get him in front of the CEO to understand what was going on at that time, right? Alas, that did not happen. Muilenburg and Gustavsson have not spoken.
There’s plenty more from Muilenburg and he successfully deflected the most pressing questions, such as whether the current regulatory capture scenario goes too far in delegating authority to the manufacturers.
Following his testimony, however, Chairman Robert Sumwalt represented the NTSB at the hearings. Much like the last set of hearings in May 2019, Sumwalt was direct about his organizations understanding of the problems and how they should be resolved.
Flawed tests in the certification process
Did Boeing test the MCAS system? Yes. The company drew up the necessary test framework and the FAA accepted it. But Sumwalt’s description of that test protocol is brutal.
The systems safety assumptions used by Boeing for the MCAS and ultimately accepted by the FAA did not use realistic pilot recognition and corrective actions in response to uncommanded flight control inputs. Quite simply, the assumptions that Boeing used did not consider or account for the impact that multiple flight deck alerts or indications could have on pilots’ responses to uncommanded MCAS activation.
He later repeats that concern that the tests “only simulating the [stabilizer trim] moving; they did not test with all the other warnings happening.” Given Muilenburg’s testimony just prior about how more information is not necessarily better, how it can lead to distraction and confusion for pilots, choosing to not test against that full scenario certainly does not play well for the manufacturer. It is as if the company knew the risk of presenting too much data so it didn’t, even when it knew the pilots would be faced with such during an emergency.
That the FAA didn’t think to question (or somehow did and accepted the answer) whether this was a realistic example of the MCAS activation scenario is also embarrassing for the agency.
Reversing Regulatory Capture
One of the biggest topics the Senators focused on was the ability for Boeing to perform most of the certification work itself, under the auspices of the FAA’s ODA program. Multiple times they asked Muilenburg about ending or drastically curtailing the program. His response, each and every time, was that the ODA program delivers a more safe aviation environment to the traveling public. He also failed to provide much in the way of specific data to support that claim.
More telling, however, was a comment in the second half of the testimony. Chris Hart chaired the FAA’s Joint Authorities Technical Review (JATR) of the certification process and how things went so wrong. During the closing round of questions Hart offered up a rather concerning view of the FAA’s capabilities:
The leading technologists in these rapidly advancing technologies are not going to be with the regulators. That’s why this is not an FAA problem, this is an international problem, Because the regulators are not able to hire and retain the leading technologists. They’re going to be with the companies.
If the regulators no longer truly understand the technology and systems that they’re in charge of the system risks a very ugly collapse.
Other bits, too
Over three hours of testimony there were plenty of other choice sound bites. These were just a few of the highlights I thought worth calling attention to.