Testimony – Before the Senate Committee on Commerce, Science, & Transportation, Subcommittee on Aviation and Space concerning the State of Airline Safety: Federal Oversight of Commercial Aviation

Chairman Cruz, Ranking Member Sinema, Members of the Subcommittee:

Thank you for the opportunity to appear before you today to discuss the current state of aviation safety.On behalf of the United States Department of Transportation and the Federal Aviation Administration, we extend our deepest sympathy to the families of the victims of the recent Ethiopian Airlines accident, as well as the Lion Air accident.

Safety is the core of the Federal Aviation Administrations mission and our top priority.With the support of this Committee, we have worked tirelessly to take a more proactive, data-driven approach to oversight that instills a safety above all approach inside the FAA and within the aviation community that we regulate.The result of this approach is that the United States has the safest air transportation system in the world.Since 1997, the risk of a fatal commercial aviation accident in the United States has been cut by 95 percent.And in the past ten years, there has only been one commercial airline passenger fatality in the United States in over 90 million flights.But a healthy safety culture requires commitment to continuous improvement.

Our commitment to safety and fact-based, data-driven decision making has been the guiding principle in the FAAs response to the two fatal accidents involving the Boeing 737 MAX airplane outside the United States.Today, I would like to provide you with an overview of the FAAs certification and oversight processes, our current actions with respect to the 737 MAX, and the next steps that the FAA will take to foster safety enhancements here and abroad.

As the aerospace system and its components become increasingly more complex, we know that our oversight approach needs to evolve to ensure that the FAA remains the global leader in achieving aviation safety.In order to maintain the safest air transportation system in the world, during the past two decades the FAA has been evolving from a prescriptive and more reactive approach for its safety oversight responsibilities to one that is performance-based, proactive, centered on managing risk, and focused on continuous improvement.A key part of this transition has been the adoption of safety management systems, or SMS, within the FAA.The evolution toward SMS began internally at the FAA more than 15 years ago, starting with the FAAs Air Traffic Organization and expanding across the FAA to include all of our lines of business. Consistent with recommendations of the International Civil Aviation Organization (ICAO), we have been working with industry towards implementation of SMS in various sectors.For example, as of March 9, 2018, scheduled commercial air carriers, regulated under 14 CFR part 121, are required to have an SMS.

Safety is not just a set of programs that can be established or implemented. It is a way of living and working, and it requires the open and transparent exchange of information.We know that it takes collaboration, communication, and common safety objectives to allow the FAA and the aviation community to come together, to identify system hazards, and to implement safety solutions.This approach gives us knowledge that we would not otherwise have about events and risks.Sharing safety issues, trends, and lessons learned is critical to recognizing whatever might be emerging as a risk in the system. The more data we have, the more we can learn about the system, which in turn allows us to better manage and improve the system.

To be clear, the SMS approach does not diminish the FAAs role as a safety regulator.Any party that the FAA regulates remains responsible for compliance with the FAAs regulatory standards, and the FAA does not hesitate to take enforcement action when it is warranted.

One of the FAAs core functions, aircraft certification, has always relied on the exchange of information and technical data.The FAA certifies the design of aircraft and components that are used in civil aviation operations. Some version of our certification process has been in place and served us well for over 60 years. This does not mean the process has remained static. To the contrary, since 1964, the regulations covering certification processes have been under constant review.As a result, the general regulations have been modified over 90 times, and the rules applicable to large transport aircraft, like the Boeing 737 MAX, have been amended over 130 times.The regulations and our policies have evolved in order to adapt to an ever-changing industry that uses global partnerships to develop new, more efficient, and safer aviation products and technologies.

The FAA focuses its efforts on areas that present the highest risk within the system.The FAA reviews the applicants design descriptions and project plans, determines where FAA involvement will derive the most safety benefit, and coordinates its intentions with the applicant.When a particular decision or event is critical to the safety of the product or to the determination of compliance, the FAA is involved either directly or through the use of our designee system.

The designee program was originally authorized by Congress in 1958 and is critical to the success and effectiveness of the certification process. Under this program, the FAA may delegate a matter related to aircraft certification to a qualified private person.This is not self-certification; the FAA retains strict oversight authority.The program allows the FAA to leverage its resources through delegation. Last fall, Congress specifically directed the FAA to make full use of this authority in the FAA Reauthorization Act of 2018.In aircraft certification, both individual and organizational designees support the FAA. The FAA determines the level of involvement of the designees and the level of FAA participation needed based on many variables.These variables include the designees understanding of the compliance policy; consideration of any novel or unusual certification areas; or instances where adequate standards may not be in place.

The Organization Designation Authorization (ODA) program is the means by which the FAA may authorize an organization to act as a representative of the FAA, allowing that organization to conduct inspections and tests and issue certificates on behalf of the FAA.Currently, there are 79 ODA holders. ODA certification processes allow an applicant greater flexibility and control over schedules than applicants whose projects are directly managed by the FAA. The FAA has a rigorous process for issuing an ODA.ODA holders must have demonstrated experience and expertise in FAA certification processes, a qualified staff, and an FAA-approved procedures manual before they are appointed. The procedures manual defines an ODA holders authority and limitations, and identifies the functions it may perform.

The FAA determines its level of involvement on a project-by-project basis.There are many issues that will always require direct FAA involvement, including equivalent level of safety determinations, and rulemakings required to approve special conditions.The FAA may choose to be involved in other project areas after considering factors such as our confidence in the applicant, the applicants experience, the applicants internal processes, and confidence in the designees.

Something that is not well understood about the certification process is that it is the applicants responsibility to ensure that an aircraft conforms to FAA safety regulations.It is the applicant who is required to develop aircraft design plans and specifications, and perform the appropriate inspections and tests necessary to establish that an aircraft design complies with the regulations.The FAA is responsible for determining that the applicant has shown that the overall design meets the safety standards.We do that by reviewing data and by conducting risk-based evaluations of the applicants work.

The FAA is directly involved in the testing and certification of new and novel features and technologies.When a new design, or a change to an existing design, of aircraft is being proposed, the designer must apply to the FAA for a design approval.While an applicant usually works on its design before discussing it with the FAA, we encourage collaborative discussions well in advance of presenting a formal application.Once an applicant approaches us, a series of meetings are held both to familiarize the FAA with the proposed design, and to familiarize the applicant with the certification requirements.A number of formal and informal meetings are held on issues ranging from technical to procedural.Once the application is made, issue papers are developed to provide a structured way of documenting the resolution of technical, regulatory, and administrative issues that are identified during the process.

Once the certification basis is established for a proposed design, the FAA and the applicant develop and agree to a certification plan and initial schedule. In order to receive a type certificate, the applicant must conduct an extensive series of tests and reviews to show that the product is compliant with existing standards and any special conditions, including lab tests, flight tests, and conformity inspections.These analyses, tests, and inspections happen at a component-level and an airplane-level, all of which are subject to FAA oversight.If the FAA finds that a proposed new type of aircraft complies with safety standards, it issues a type certificate.Or, in the case of a change to an existing aircraft design, the FAA issues an amended type certificate.

The certification processes described above are extensive, well-established, and have consistently produced safe aircraft designs for decades.The Boeing Company has designed and built 14 variations of its original model 737 since the FAA issued the original type certificate in 1967.The FAA followed its standard procedures in determining that the 737 MAX project would qualify as an amended type certificate project, and identifying what items would be delegated to the Boeing ODA to approve and which would be retained by the FAA for approval. Boeing first applied for an amended type certificate for this aircraft in January 2012.As a result of regular meetings between the FAA and Boeing teams, the FAA determined in February 2012 that the project qualified as an amended type certificate project eligible for management by the Boeing ODA. The FAA was directly involved in the System Safety Review of the Maneuvering Characteristics Augmentation System (MCAS).

The process from initial application to final certification took five years; the FAA added the 737 MAX to the 737 type certificate in March 2017.The process included 297 certification flight tests, some of which encompassed tests of the MCAS functions.FAA engineers and flight test pilots were involved in the MCAS operational evaluation flight test.The certification process was detailed and thorough, but, as is the case with newly certified products, time yields more data to be applied for continued analysis and improvement.As we obtain pertinent information, identify potential risk, or learn of a system failure, we analyze it, we find ways to mitigate the risk, and we require operators to implement the mitigation.And that is what has happened in the case of the 737 MAX.

On October 29, 2018, a Boeing 737 MAX operated by Lion Air as flight JT610 crashed after taking off from Soekarno-Hatta Airport in Jakarta, Indonesia.Flight JT610 departed from Jakarta with an intended destination of Pangkal Pinang, Indonesia.It departed Jakarta at 6:20 a.m. (local time), and crashed into the Java Sea approximately 13 minutes later.One hundred and eighty-four passengers and five crewmembers were on board.There were no survivors. An Indonesian-led investigation into the cause of this accident is ongoing, supported by the National Transportation Safety Board (NTSB), FAA, and Boeing.

On November 7, 2018, based on all available and relevant information, including evidence from the Lion Air accident investigation and analysis performed by Boeing, the FAA issued an Emergency Airworthiness Directive.The airworthiness directive requires operators of the 737 MAX to revise their flight manuals to reinforce to flight crews how to recognize and respond to uncommanded stabilizer trim movement and MCAS events.The FAA continued to evaluate the need for software and/or other design changes to the aircraft including operating procedures and training as additional information was received from the ongoing Lion Air accident investigation.On January 21, 2019, Boeing submitted a proposed MCAS software enhancement to the FAA for certification.To date, the FAA has tested this enhancement to the 737 MAX flight control system in both the simulator and the aircraft.The testing, which was conducted by FAA flight test engineers and flight test pilots, included aerodynamic stall situations and recovery procedures.The FAAs ongoing review of this software installation and training is an agency priority, as will be the roll-out of any software, training, or other measures to operators of the 737 MAX.

On March 10, 2019, Ethiopian Airlines flight ET302, also a Boeing 737 MAX, crashed at 8:44 a.m. (local time), six minutes after takeoff.The flight departed from Bole International Airport in Addis Ababa, Ethiopia with an intended destination of Nairobi, Kenya.The accident site is near Bishoftu, Ethiopia.One hundred and forty-nine passengers and eight crewmembers were on board.None survived.An Ethiopian-led investigation into the cause of this accident is ongoing, supported by the NTSB, FAA, and Boeing.

Following the second accident, the FAA gathered all of the data it had and continued to review information from the investigation as it became available.On March 11, 2019, the FAA issued a Continuous Airworthiness Notification to the International Community (CANIC) for 737 MAX operators.The CANIC included a list of all of the activities the FAA had completed in support of the continued operational safety of the 737 MAX fleet.These activities included the airworthiness directive issued on November 7, 2018, ongoing oversight of Boeings flight control system enhancements, and updated training requirements and flight crew manuals.

After issuing the CANIC, the FAA continued to evaluate all available data and aggregate safety performance from operators and pilots of the 737 MAX, none of which provided any data to support grounding the aircraft.The FAAs initial review of flight safety data for U.S. operators showed no systemic performance issues and provided no basis to order grounding the aircraft.This review included analysis of recent Aviation Safety Reporting System reports that reference MCAS and/or controllability issues with the Boeing 737 MAX.In no case did the reporting party state that the problems experienced were due to the MCAS system.Also, at that time, other civil aviation authorities had not provided any data to the FAA that warranted action.

On March 13, 2019, however, the Ethiopian Airlines investigation developed new information from the wreckage concerning the aircrafts configuration just after takeoff that, taken together with newly refined data from satellite-based tracking of the aircrafts flight path, indicated some similarities between the Ethiopian Airlines and Lion Air accidents that warranted further investigation of the possibility of a shared cause that needed to be better understood and addressed. Accordingly, the FAA made the decision to ground all 737 MAX airplanes operated by U.S. airlines or in U.S. territory pending further investigation, including examination of information from the aircrafts flight data recorders and cockpit voice recorders.

The FAA will continue to support the ongoing Lion Air and Ethiopian Airlines accident investigations, review the evidence and data obtained, and take immediate and appropriate action based on the facts.U.S. and international operators of the 737 MAX are relying on the FAA to get it right.I want to assure this Committee and everyone else concerned that the FAA will go wherever the facts lead us, in the interest of safety.The 737 MAX will return to service for U.S. carriers and in U.S. airspace only when the FAAs analysis of the facts and technical data indicate that it is appropriate.In our quest for continuous safety improvement, the FAA welcomes external review of our systems, processes, and recommendations. We will work with the newly established Special Committee to Review FAAs Aircraft Certification Process, cooperate fully with the Inspector Generals review, and continue our work with the congressionally-mandated Safety Oversight and Certification Advisory Committee and ODA Expert Review Panel.

As recent events have reminded us, aviation does not have borders or boundaries.The FAA is focused on continuous safety improvement here at home and internationally through our ongoing engagement with other civil aviation authorities and industry stakeholders throughout the world.Aviation remains the safest mode of transportation globally, and we promote this level of safety by sharing issues, trends, and lessons learned throughout the world. The United States is the gold standard in aviation safety.The FAA is resolute in its commitment to maintaining that standard.

This concludes my prepared statement.I will be happy to answer your questions.