FAA and Boeing defend oversight of 737 MAX

By Michael Laris, Luz Lazo, Ashley Halsey III and Lori Aratani / The Washington Post

WASHINGTON — Under grilling Wednesday about two deadly crashes involving the Boeing 737 Max 8 jet, federal transportation officials promised renewed oversight, and Boeing detailed software upgrades and increased training for pilots. But both also defended the system that certified the aircraft and Boeing reiterated that its product is safe.

Facing questions on Capitol Hill, Daniel Elwell, the acting administrator of the Federal Aviation Administration, defended the federal government’s approach of delegating broad oversight powers to Boeing. More than 2,000 miles away, in Renton, Washington, Mike Sinnett, Boeing’s vice president of product strategy and development, said new updates give him “complete confidence in the safety” of the 737 Max.

The company’s newest model of plane has been involved in two crashes in less than five months, killing 346 people.

“The 737 is a safe airplane,” Sinnett said. “The 737 family is a safe airplane family, and the 737 Max builds on that history of safety that we have seen for almost 50 years,” Sinnett said at a briefing before company officials met with more than 200 pilots, technical leaders, airline representatives and regulators from around the world.

Boeing said it will take about an hour for technicians to load a software update for the planes. The update is meant to fix an automated anti-stalling safety feature that investigators believe may have contributed to the Oct. 29 crash in Indonesia and the March 10 crash in Ethiopia. All 737 Max pilots will undergo new training.

It will be up to the world’s aviation authorities to decide what happens next, and when.

“Returning to flight will be at the regulators’ discretion,” Sinnett said, explaining what he described as the “rigor and the thoroughness of the design and testing” that went into the updates.

But congressional hearings Wednesday and ongoing federal probes demonstrated how many questions remain about the broad safety assurances Boeing and the FAA made about the plane.

“Overconfidence breeds complacency, and complacency breeds disaster. We’ve seen it here, and we will see it again unless we mandate safety as something which is not optional,” Sen. Edward Markey, D-Mass., said at a sometimes tense hearing of the subcommittee on aviation and space.

More broadly, the company’s software fixes will change the way the automated anti-stall feature, known as MCAS, receives information, requiring feeds from both outside sensors before it is triggered. Following the two crashes, aviation experts expressed surprise that in an industry that stresses redundancy, the feature could be triggered by information from just one sensor.

Investigators of the Lion Air crash in Indonesia suspect that the automated feature received incorrect information from one sensor, prompting it to force the plane’s nose down over and over even as pilots struggled to pull it up.

Even with the changes, both the FAA and Boeing will need to rebuild trust among lawmakers, the public and aviation authorities around the world, observers said. The United States, for example, was the last major country to ground the plane.

For both Boeing and the FAA, “the credibility is damaged,” said Thomas Anthony, a former FAA investigator who runs the University of Southern California’s Aviation Safety and Security Program. “The only way they can regain the credibility is to prove their commitment, to establish a process that can identify hazards, listen to all users, and make transparent changes.”

The Justice Department’s criminal division is looking into the 737 Max, and the Transportation Department’s inspector general is investigating the way the certification was handled, as is Congress and a special committee set up by Transportation Secretary Elaine Chao.

Transportation Department Inspector General Calvin Scovel said the FAA hadn’t given its oversight teams “tools or guidance on data they should used to identify the high-risk areas” they should prioritize. He said the FAA would introduce a new process in July that would represent a “significant change” in its approach, by developing “new evaluation criteria” and particular areas of focus for oversight, such as training and the way companies “self- audit.”

“Recent accidents highlight important concerns about FAA’s safety oversight,” said Scovel, whose office has launched an audit of FAA’s certification process. He said he hopes to have the work complete in 10 months, but said the complexity of the task could cause it to take longer.

Shem Malmquist, a Boeing 777 captain and a visiting professor at the Florida Institute of Technology, said a critical step would be for U.S. regulators to recognize and act on their own flaws.

“It’s as simple as that the regulations haven’t kept up with the industry,” Malmquist said. “The question is why are we using outdated standards to try to certify modern aircraft that have complex computer systems.”

“We have a good regulatory agency. We have an excellent aerospace company,” he added. “It’s just a matter of updating the standards to match reality and maybe have a regulatory framework that keeps up with changes in technology — because right now it doesn’t.”

Congress has, for many years, instructed the FAA to hand over more of its safety oversight to companies such as Boeing, which have pushed hard for the changes on Capitol Hill. The stated goal was increasing efficiency at the agency, which critics within the industry and in Congress said was too slow in certifying the extraordinarily complex aircraft, slowing economic growth.

But crashes raised questions about the process Boeing, with the FAA’s help, used to certify that planes were safe and that pilots understood the aircraft’s automated features.

“At this time last year, the FAA was widely viewed as the ‘gold standard’ for safety in the aviation industry, but it is becoming clear that these tragedies resulted from a cascading chain of failures — from manufacturer to regulator to airline,” Sen. Tammy Duckworth, D-Ill., said. “We must ensure each and every weakness in this chain is addressed, not just one of them. And we must work end the culture of coziness in aviation safety oversight to help prevent similar tragedies from happening again.”

At a Senate Appropriations Committee hearing Wednesday morning, Chao defended the FAA’s system for delegating oversight authority, which was set up in 2005 and is known as the Organizational Designation Authorization program.

Sen. Susan Collins, R-Maine, pressed Chao on Boeing’s relationship with the FAA, citing concerns that using the program “to accelerate the commercial aims of Boeing or other manufacturers sacrifices, potentially, the safety of the traveling public.”

Chao said efforts to rely more on the companies themselves have gone on for many years, adding that Congress took further action last year.

“More authority was given to the FAA to work with those who build the planes who actually know what is going on in this process,” Chao said. “The FAA does not build planes; they certify.”

But Chao added: “I am of course concerned about any allegations of coziness, with any company, manufacturer, whatever.”

While the FAA is a professional organization, with 44,000 people whose “main mission every day” is safety, “these questions, when they arise, if they arise, are troubling, because we should have absolute confidence in the regulators that they are certifying properly.”

Chao said she expects ongoing probes “will yield some answers.”

The FAA has previously said its “experts, including chief scientists, engineers and flight test pilots conducted in-flight testing” of the 737 Max’s flight control system, including the MCAS.

In testimony prepared for Wednesday’s hearing, Elwell added that the overall process included 297 certification flight tests and noted that the FAA was “directly involved in the System Safety Review of” the MCAS features.

At the heart of inquiries into the FAA’s role overseeing the plane — and into Boeing’s work developing the aircraft and working with regulators to certify it — are questions about exactly what information Boeing had about the risks of the automated features, what information the FAA required from the company, and what information Boeing provided the FAA.

He said the certification process was robust, but later events added critical new information.

“The certification process was detailed and thorough, but, as is the case with newly certified products, time yields more data to be applied for continued analysis and improvement,” Elwell said. “As we obtain pertinent information, identify potential risk, or learn of a system failure, we analyze it, we find ways to mitigate the risk, and we require operators to implement the mitigation. And that is what has happened in the case of the 737 MAX.”

He also emphasized to lawmakers: “We actually don’t know the cause of the crash. There’s a lot more to find out through the investigation.”

With more than 380 of the jets grounded worldwide, and some airlines demanding they be reimbursed for their losses, Boeing is anxious to get them back in the air. The company has suspended delivery of all new 737 Max planes, though production continues. At least one carrier, Indonesia’s national airline, Garuda Indonesia, has canceled an order for 50 of the Max planes.

In developing the software update, Boeing said its testers used simulators to create “the most challenging scenarios” possible, and saw what would happen with various human and technical errors.

Simulator “pilots worked with the software design team to incorporate multiple layers of protection in the event of sensor errors or other erroneous inputs. They assessed a broad range of piloting techniques, in order to ensure that normal airmanship skills are sufficient to control the airplane,” a Boeing spokesman said.

They then put the updates in a real plane for an “engineering verification” flight with several steep or otherwise problematic maneuvers on Feb. 7, then held a certification flight with the FAA on March 12, two days after the Ethiopian Airlines flight crashed.

MCAS, which stands for maneuvering characteristics augmentation system, is a new feature on Boeing’s 737 Max planes designed to compensate for changes in the plane’s design by automatically pushing the plane’s nose downward if it appears it is too high and at risk of stalling. To do that, MCAS relies on information from one of two “angle-of-attack” sensors mounted on the plane’s nose.

In the case of the Lion Air crash, investigators suspect that the MCAS system received incorrect information from one sensor, prompting it to force the plane’s nose down even as pilots were trying to pull it up. In the wake of that crash, the FAA issued an emergency order warning that erroneous inputs from angle-of-attack inputs “can potentially make the horizontal stabilizers pitch the nose of the airplane downward, making the aircraft difficult to control.” U.S. operators were ordered to revise flight manuals so crews would have procedures for dealing with such an occurrence.

In the Oct. 29 Lion Air crash, a malfunctioning sensor and an automated response from the aircraft’s software impeded the pilots’ efforts to control the ill-fated Indonesian flight from plunging into the sea, killing all 189 people on board, according to a preliminary investigative report.

The angle of attack sensor was showing erroneous readings throughout the time the plane was airborne. With the sensor insisting the nose was too high, the MCAS kicked in, sending the plane down as the cockpit crew fought to regain control, according to the preliminary report.

Every time the flight crew pulled the nose back to level, within seconds, the MCAS tipped it back downward.

Black-box data released by Indonesian investigators showed pilots were pulling back on the control column, attempting to raise the plane’s nose, applying almost 100 pounds of pressure to it before they crashed into the Java Sea just 12 minutes after takeoff.

Pilots have mixed opinions on whether the new instruments are necessary.

John Cox, an airline safety consultant with the aviation consulting firm Safety Operating Systems, said the pilot community has long debated whether the additional display and warning light are needed.

“It’s not an easy yes-or-no question,” said Cox, a former pilot. “If you look at most airplanes around the world, most airlines don’t have it.”

He said pilots with military backgrounds often prefer to have the gauges because they are standard on many high-performance military aircraft, but pilots who come from the civilian ranks don’t necessarily see a need for them.

In the United States, only American Airlines paid extra to have both the warning light and angle of attack indicators installed in their cockpits. Southwest Airlines had the indicator light, but it was only after the Lion Air crash that it opted to also include the indicator in the cockpit as well.

Officials at American Airlines said they included them because their pilots prefer to fly with them.

Both airlines declined to say how much the extra features cost, as did Boeing.

United’s Max 9 jets aren’t equipped with the instruments because officials did not think they were necessary.

“We did not install these features because our aircraft is already equipped with anti-stall indicators, which are proven and safe,” a spokesman said. “None of United’s airplanes have angle of attack on their primary flight display, as pilots are trained to use airspeed, pitch and power for the safe operation of aircraft.”

The Washington Post’s Aaron Gregg contributed to this report.