“This was raised by one of your engineers,” Rep. Peter A. DeFazio (D-Ore.) said to Boeing chief executive Dennis Muilenburg, and John Hamilton, chief engineer of the company’s commercial airplanes division.
Wednesday’s five-and-a-half hour hearing was far more intense than Muilenburg’s appearance before a Senate committee Tuesday. He sat almost level with families of the crash victims, who groaned at Muilenburg’s repeated evocation of his boyhood on an Iowa farm and were angered when Hamilton stumbled over the date of the second crash.Lawmakers raked through the documents they had gathered, asking Muilenburg to account for opportunities seemingly missed to avert the crashes. One congressman returned for several rounds of questioning to establish a single fact, while others assailed Muilenburg for taking home $30 million last year.
Rep. Paul Mitchell (R-Mich.), a former chief executive at another company, said that if he was in the same circumstances as Muilenburg he would resign. Muilenburg said he would not.
“I feel responsible to see this though,” Muilenburg said.
DeFazio, chairman of the House Transportation Committee, read to Muilenburg from a December 2015 email sent while the Max was in the middle of its safety certification process with the Federal Aviation Administration.
It concerned critical sensors, known as angle of attack (AOA) indicators, that are supposed to give pilots, and airplane systems, reliable information to help understand how the aircraft’s nose is pointed in relation to oncoming wind.
But in both crashes, faulty data from a single sensor caused an automated feature known as the Maneuvering Characteristics Augmentation System, or MCAS, to fire by mistake, repeatedly forcing the planes’ noses down as pilots struggled to regain control. Boeing’s decision to have MCAS rely on just one sensor, and not both of them, has been a key question in the crash investigations.
“Are we vulnerable to single AOA sensor failures with the MCAS implementation or is there some checking that occurs?” the engineer asked in the email, read by DeFazio and projected on a screen in the hearing room.
“Did you ever receive this communication and did you respond to that engineer?” DeFazio asked.
Hamilton said he did not receive it, though he became aware of it recently. He said it demonstrates Boeing’s openness to hearing safety concerns.
“I think it highlights our engineers do raise questions, in an open culture. They question things,” Hamilton said. He said the company “followed our thorough process” and determined that a single sensor was reliable.
But DeFazio cut him off, saying the critical sensors “are pretty delicate little things” jutting out from the front of the planes, and said Boeing has now changed MCAS to rely on both sensors, rather than just one.
“The question is, why wasn’t it that way from day one?” DeFazio said. “If you can do it now, with an extra wire or a software fix or whatever, why didn’t you do it from day one? Why not have that redundancy?”
Muilenburg responded, “Mr. Chairman, we’ve asked ourselves that same question, over and over, and if back then we knew everything that we know now, we would have made a different decision.”
That response echoed language Muilenburg used during Tuesday’s Senate hearing when Sen. Ron Johnson (R-Wis.) asked: “Why didn’t we ground that aircraft a lot sooner so that another tragedy would not happen?”
Johnson was speaking of the time between the Oct. 29, 2018, Indonesia crash and March 10, when the Ethiopian Airlines plane went down.
“Senator, we have asked that question over and over, and if we knew everything back then that we know now, we would have made a different decision,” Muilenburg said Tuesday. He said the decision was made with the “data we had” and that the FAA had emerged from a safety review process with Boeing and “confirmed the continuing air worthiness of the airplane, and issued that officially. That was the safety case that was built.”
The FAA declined to comment.
Rep. Rick Larsen (D-Wash) said “one undeniable conclusion” thus far is “the process by which the Federal Aviation Administration evaluates and certifies aircraft is itself in need of repair.”
But Rep. Sam Graves (R-Mo.) said lawmakers should wait until all the investigations into the two crashes are completed before reaching conclusions. He said the causes of a crash are often like “Swiss cheese” with holes representing different problems.
“I don’t blame the pilots, and I don’t absolve Boeing,” he said.
Muilenburg appeared to become emotional at the House hearing Wednesday when he described meeting with the families of those killed in the crashes.
“We wanted to listen, and each of the families told us the stories about the lives that were lost, and those were heartbreaking,” he said.
DeFazio said that Boeing had information that undercut the safety assumptions the company relied on in designing MCAS.
DeFazio said both Boeing and the FAA assumed pilots would react to a problem with MCAS within 4 seconds. “But Boeing had information . . . that some pilots might react in 10 seconds or longer and if that happened, the results would be catastrophic and result in the loss of the aircraft, as happened twice,” he said.
At issue, DeFazio explained ahead of Wednesday’s hearing, is whether Boeing had deliberately withheld that information.
National Transportation Safety Board officials last month said Boeing had made inaccurate assumptions about the dangers of MCAS and overestimated pilots’ ability to handle problems with the feature, and that the FAA had accepted Boeing’s assertions.
The committee investigation found a Boeing “coordination sheet,” dated June 11, 2018, which read: “A slow reaction time scenario (>10 seconds) found the failure to be catastrophic …”
“Was the FAA aware of this document?” DeFazio asked.
Muilenburg said he could not speak to the specific document but that “we made some mistakes on MCAS” and are “revisiting these decades-long industry standards.”
The FAA declined to comment.
Ultimately, pilots were left in the dark about MCAS because references to the feature were removed from the plane’s manual.
Transportation committee staff also projected an image of a “preliminary” MCAS alert for the cockpit from 2012. But it was not installed in the planes.
Muilenburg said it was “very common” to consider such ideas early. Hamilton said the point of the indicator “was to signal an MCAS failure. It’s important to note that, in these accidents the MCAS system did not fail,” so the indicator would not have lit up. The “functionality was incorporated” in another light, he said.
DeFazio said reforms are needed in FAA oversight. Hamilton said the agency has already made adjustments.
“They are taking lessons learned from these accidents and applying criteria to us that goes above and beyond what the current guidance and regulatory standards are,” Hamilton said. “So I would say we are working to a higher level of standard already.”
After the hearing, DeFazio stepped down from the dais and talked with some of the family members. And Nadia Milleron, whose daughter, Samya, died on the Ethiopian Airlines crash, confronted Muilenburg before he left the room.
“I was asking him to be transparent,” she said.