The head of the Federal Aviation Administration fiercely defended the agency’s oversight of the Boeing 737 MAX Wednesday, insisting during intense and sometimes combative Senate testimony that the agency retained final authority over approval of the plane’s safety.
“We do not allow self-certification of any kind,” FAA acting Administrator Daniel Elwell said, even as he confirmed that his agency delegated review of a new safety system on Boeing’s 737 MAX to the company itself, as The Seattle Times reported in an investigation earlier this month.
His acknowledgment came during questioning from lawmakers over the FAA’s role in approving the 737 MAX and the underlying safety software, known as Maneuvering Characteristics Augmentation System (MCAS). That system was a new feature on the 737 MAX to help the plane avoid a potential stall that could be caused by the larger engines on the jet, and it’s now suspected as a potential factor in two deadly crashes since October.
Elwell told a panel convened by the Senate’s Aviation and Space subcommittee that the FAA initially retained the MCAS system to review internally. But as the certification process proceeded on the 737 MAX, the agency delegated the review of the system to Boeing under a program called Organization Designation Authorization (ODA).
“Initially, as a new system or a new device on the amended type certificate, we retained the oversight of that — then over time released that to the ODA when we had the comfort level and the oversight and we examined it thoroughly,” Elwell said in response to a question by Sen. Maria Cantwell, D-Wash. “We were able to assure that the ODA members at Boeing had the expertise and the knowledge of the system to continue going forward.”
But in the face of rapidly growing automation and “weaknesses” that have been discovered in the ODA process, the FAA plans to significantly revamp its oversight procedures by July, the Transportation Department’s inspector general, Calvin Scovel III, told the panel without providing details.
“FAA must take steps to reduce hazards associated with flight-deck automation,” Scovel said. “Pilots now rely on automated flight systems as much as 90 percent of the time.”
Pilots must be trained and proficient in responding to problems, he said.
The Seattle Times investigation earlier this month detailed concerns among FAA employees that FAA managers had pushed their engineers to delegate wide responsibility for assessing the safety of the 737 MAX to Boeing itself. The Times reported that the original safety analysis that Boeing delivered to the FAA for a new flight-control system had several crucial flaws, including understating the power of the new system to move the horizontal tail to push the nose down to avert a stall.
The analysis also failed to account for how the system could reset itself each time a pilot responded, thereby missing the potential impact of the system repeatedly pushing the airplane’s nose downward, among other problems.
The MCAS is now under scrutiny after two deadly crashes of the jet in less than five months that resulted in the FAA’s March 13 order to ground the plane.
Asked about that article and the possibility that the FAA had pushed employees to delegate and move quickly, Elwell said a review of internal whistleblower reports at the FAA found no such reports by technical staff of undue pressure on them.
The MCAS system is designed to take information from one of the plane’s two angle-of-attack sensors. In a situation in which the sensor indicates a potential stall, the MCAS system can activate to push the nose of the plane down.
In the crash of a Lion Air flight in October that killed all 189 people aboard, data show that the angle-of-attack sensors on the plane disagreed. When MCAS kicked in, the pilots battled to keep the plane flying straight, with the safety system continuously pushing the nose down. An Ethiopian Airlines 737 MAX crashed under similar circumstances on March 10, killing all 157 people aboard.
Elwell testified that he doesn’t believe simulator tests in the FAA certification process examined a situation in which an angle-of-attack sensor would fail.
He said the issue of an angle-of-attack sensor triggering the MCAS safety system on the 737 MAX presents just like a runaway-stabilizer situation. He said that’s a problem pilots would know about and that actions to defeat the problem would be the same as past training, something pilots of large aircraft would be trained on since day one.
“It is indistinguishable to the pilot,” Elwell said.
Boeing has defended the original design of MCAS by making a similar point. The company has been working on an enhancement to the program so that MCAS will rely on two sensors, instead of one, and that the power of the system will be limited. The company is also planning to introduce training on the changes.
U.S. Sen. Ted Cruz, R-Texas, who chaired the hearing, said the crashes of Boeing’s 737 MAX aircraft and reports about the certification process of the airplane “have badly shaken consumer confidence.” Sen. Richard Blumenthal, D- Connecticut, said he will push legislation to put the FAA back in charge of safety, saying the current system essentially left “the fox in charge of the hen house” on the 737 MAX.
Elwell said eliminating the delegation process used by the industry would require about 10,000 more FAA employees and that the agency’s certification office would need an additional $1.8 billion.
The hearing was the first of what are expected to be several congressional hearings into the safety of the 737 MAX and the FAA’s safety-certification process.