Exactly one year after a Lion Air Boeing 737 Max crashed in Indonesia, killing 189 people, Boeing CEO Dennis Muilenburg is testifying before the Senate Commerce Committee to explain how the plane was built and certified despite fatal flaws being present.
It is his first public testimony since each of the two jets crashed in October 2018 and in March. Each flight crashed within minutes of taking off. A combined 346 people were killed. Both crashes have been attributed to an automated system known as MCAS, or Maneuvering Characteristics Augmentation System.
The system, which was designed to compensate for the fact that the Max had larger engines than previous versions of the 737, could be triggered by a single faulty angle-of-attack sensor. When it activated erroneously, it could point the jet’s nose down, potentially causing it to crash.
Muilenburg and John Hamilton, the chief engineer in Boeing’s commercial airplane division, are testifying at a Senate hearing titled “Aviation Safety and the Future of Boeing’s 737 Max.” Later in the day, representatives from the National Transportation Safety Board (NTSB) and the Joint Authorities Technical Review (JATR) — an international panel which investigated the FAA’s actions to certify the 737 Max — will also testify.
The hearings come as Boeing has faced increasing criticism for its design and process of certifying the jet. The FAA has also been criticized for lax oversight of the plane maker.
At times, the hearing seemed to be as much about the FAA’s regulation of plane makers as it was about Boeing.
Sen. Roger Wicker of Mississippi, who chairs of the Senate Commerce Committee, opened the hearing by describing the need to understand how the plane was certified, as well as recent developments including the release of internal messages suggesting Boeing may have known about issues with the automated system.
Messages released have “reflected a disturbing level of casualness and flippancy that seem to corroborate these criticisms,” he said.
Sen. Maria Cantwell of Washington, the ranking member on the committee, blasted the falling adherence to safety standards in her opening statement.
“One thing is crystal clear: if you want to be the leader in aviation manufacturing, you have to be the leader in aviation safety,” she said. “We cannot have a race for commercial airplanes become a race to the bottom in terms of safety.”
She also pointed out the need to fully regulate automated flight programs.
“More software and more automation without robust third-party testing and validation will lead us to where we are today.”
In his opening statement, Muilenburg admitted that Boeing made major missteps.
“We know we made mistakes and got some things wrong,” he said. “We own that, and we are fixing them.”
He added: “While the Ethiopian Airlines accident is still under investigation by authorities in Ethiopia, we know that both accidents involved the repeated activation of a flight-control software function called MCAS, which responded to erroneous signals from a sensor that measures the airplane’s angle of attack.”
The testimony and questions were, at times, emotional.
“These loved ones lost lives because of an accident that was not only preventable, but was the result of a pattern of deliberate concealment,” Sen. Richard Blumenthal of Connecticut said. “My anger has only grown.”
“Boeing came to my office shortly after these crashes and said they were the result of pilot error. Those pilots never had a chance,” Blumenthal continued. “Those loved ones never had a chance. They were in flying coffins as a result of Boeing deciding that it was going to conceal MCAS from the pilots.”
Blumenthal opened his testimony by asking family members of crash victims, present at the hearing, to hold up photos of their loved ones.
Sen. Shelley Moore Capito of West Virginia asked Muilenburg why no one from Boeing — the chief engineer and the chief pilot, who were aware of MCAS’ potential issues — raised concerns after the first crash, which could have prevented the second.
“If we knew everything then that we did now, we would have made a different decision,” he said.
Muilenburg noted that Boeing and the FAA issued an emergency bulletin about the effect of MCAS activation following the first crash, and began work on a software fix.
Sen. Wicker opened the hearing by questioning Muilenburg on recently released emails and instant messages between Boeing employees discussing the MCAS system and its disclosure to regulators.
While Muilenburg suggested that Boeing was not aware that the MCAS defects would lead to a crash, Hamilton admitted that, looking back, testing of the software and hardware involved was inadequate.
“We did test the MCAS un-commanded inputs to the stabilizing system,” Hamilton said. “We assessed that hazard level.”
“Which, now do you think is wrong,” Sen. Cantwell asked.
“In hindsight, Senator, yes.”
“We relied on long standing safety standards,” Muilenburg said, defending the process of certifying the plane.
“The original concept for the MCAS design was an extension of the speed trim system on teh 737 NG,” the previous generation, Muilenburg said, which relied on a single sensor. “We’ve learned there are some things we can improve. One of those is moving to a dual sensor” activation, Muilenburg said in response to a question from Senator John Thune.
“How frequently are new automated systems left out of the training manuals that you give to pilots,” Sen. Amy Klobuchar of Minnesota asked.
“More information in the training manuals is not necessarily safer,” Muilenburg replied. “But, as we understand from these accidents, we need to provide more information aon MCAS to enhance safety.”
“Our approach is to train pilots on the effects of a failure mode,” he added. “That is what’s in the training manual. We train pilots to respond to the effects of the failure, not to diagnose the cause.”
“It seems like every week there’s a report that an airline is going to have that plane flying again,” asked Senator Jerry Moran. “What is the status?”
“We’re testing the final software updates. When ready, and with the FAA’s approval, we’ll proceed to a certification flight.” Muilenburg answered. “It will return to service when it’s safe.”
“My thoughts have changed” regarding regulation of Boeing, Muilenburg said in response to a question from Senator Gary Peters. “We all have the same objective, we all want the safest industry possible. We could look at the balance” between regulation and independence, he said. A recent New York Times report found that Boeing lobbied to gain more independence from regulators as recently as 2018.
“We have not blamed the pilots. That is not our company position and it never will be. We are responsible for our airplanes. We own that,” Muilenburg said in response to reports that the company had blamed pilot error for the first crash. However, Muilenburg had previously pointed to pilot actions as a potential contributor to the crashes.
Sen. Tammy Duckworth, a former helicopter pilot for the US Army, was sharp in her criticism “Pilots need time and altitude, they had neither.” she said. “You have not told the whole truth.”
She highlighted the importance of Boeing and the company’s legacy, while excoriating Muilenburg and his company. “Boeing is the company that built the flying fortress that saved Europe. I remember watching B-17s fly. It is a storied aircraft [manufacturer] that has rescued the free world. And yet you knew about the problems, continued to put the system into place, and when we asked about it, you’ve told us half-truths.”
Sen. Jon Tester asked pointed questions about the system of allowing Boeing to self-certify aspects of its airplanes. “I would walk before I would get on a 737 Max. I would walk. There’s no way.”
Sen. Jacky Rosen noted that Brazilian regulators noted MCAS as a major change, and highlighted it in training manuals for pilots. However, that information was not flagged for customers in other countries. Muilenburg simply replied “that’s how the process is supposed to work.”
He stopped short of committing to implementing a future standard practice of flagging changes requested by one domestic regulator to other international agencies.
Rosen also noted that there have been so many derivatives of the original 737, certified in 1967, and asked if Boeing thought the 737 Max was characteristically the same plane as the original.
“The safety standards have evolved, as the airplane has evolved. But as pilots transition from earlier versions of the 737 to the newer versions, the airplane behaves and handles the same way,” Hamilton replied.
Additionally, Robert Sumwalt, chairman of the NTSB, and Christopher Hart, chairman of the JATR, are testifying to discuss the FAA’s certification process for the 737 Max.
Sumwalt noted that Boeing failed to account for certain pilot behavior in their assumptions, citing a list of recommendations the NTSB previously released related to assumptions of pilot reactions during certain emergencies, particularly those with multiple failures.