US Senate Aviation Safety Whistleblower Report
Under the leadership of Chair Maria Cantwell, the Democratic staff of the Senate Committee on Commerce, Science, and Transportation is releasing this report as part of the Committee’s continued investigation of the design and certification of the 737 MAX, and oversight of the Federal Aviation Administration’s implementation of Congressionally-mandated safety reforms under the Aircraft Certification, Safety, and Accountability Act.
Click here to link to the Senate website to read the full report.
EXECUTIVE SUMMARY
On October 28, 2018, a brand new 737 MAX-8 aircraft certified less than two years prior by the U.S. Federal Aviation Administration (FAA), took off from Jakarta, Indonesia and within 13 minutes had plunged into the sea killing all 189 onboard Lion Air Flight 610. Just 133 days later, on March 10, 2019, another 737 MAX-8, Ethiopian Airlines Flight 302, crashed to the earth merely 6 minutes after takeoff from Addis Ababa, Ethiopia, leaving 157 dead.
These tragedies involving U.S.-manufactured aircraft followed a period in which the United States commercial aviation system experienced an unprecedented level of safety. According to the FAA, in the 20 years prior to 2018, commercial aviation fatalities decreased in the United States by 95 percent as measured by fatalities per 100 million passengers. In 2017 there were 4.1 billion passengers travelling by air internationally on scheduled commercial services. With a rate of 12.2 fatalities per billion passengers, this was the safest year ever on the record for global aviation. The 737 MAX crashes disrupted this trend line and called into question U.S. aviation safety oversight, presenting a historic challenge for U.S. policymakers.
In response, Congress passed the Aircraft Certification, Safety, and Accountability Act, which was enacted into law on December 27, 2020.1 The Senate Committee on Commerce, Science, and Transportation (“the Committee”) played a leading role in drafting this bipartisan legislation which made clear that a course correction on safety oversight was required in light of the 737 MAX tragedies.
This important safety reform legislation followed multiple, extensive investigations, including by the Committee, of the circumstances leading to and following two crashes involving the 737 MAX. The Committee’s investigation and aviation safety work has been informed by whistleblowers—frontline officials from the Federal Aviation Administration (“FAA”) and engineers from industry.
Whistleblowers perform a critical public service by exposing wrongdoing in the government and private sector. Here, seven individuals—all of whom have agreed to be identified in this report—contacted the Committee to convey their experiences and recommendations regarding the aircraft safety and certification environment at the FAA and within the industry. These seven individuals have a diverse range of experience in the U.S. aircraft certification ecosystem, with technical expertise from the FAA, engineering experience at Boeing and GE, and other direct knowledge of aviation production, management, safety, and compliance processes.
The Committee staff interviewed these whistleblowers multiple times over the course of months, and they provided the Committee with their written statements and reports detailing their concerns. The Committee appreciates the whistleblowers’ willingness to engage in this process and contribute to this report.
Some whistleblowers provided critical information and recommendations that shaped the Committee’s approach to drafting aviation safety legislative reform passed into law in December 2020. These include: Dr. Martin Bickeboeller, a current Boeing senior engineer, Mike Dostert, a current FAA engineer, G. Michael Collins, a former FAA engineer, Curtis Ewbank, a former Boeing engineer, and Ed Pierson, a former Boeing senior manager.
The Committee sought to honor these whistleblowers by addressing many of their concerns when drafting the Aircraft Certification, Safety, and Accountability Act. The law took the important step of extending Federal whistleblower protections, similar to those that were available to Federal aviation safety workers and airline employees, to employees, contractors, and suppliers of aircraft manufacturers.
After the enactment of the safety reform law, other whistleblowers engaged with the Committee and provided instructive insight for oversight of the law’s implementation, including Joe Jacobsen, a former FAA engineer, and Richard Kucera, a former GE Aviation engineer.
Whistleblowers like Mr. Kucera provided information indicating systemic problems continue to exist, including understaffed FAA offices charged with certification oversight responsibility for manufacturers and the continued risk of undue pressure under the FAA’s system of delegated authority.
These whistleblowers also provided the Committee with their written statements and reports detailing their concerns. These individuals spoke with Committee staff multiple times to further educate staff on their claims. The Committee appreciates the whistleblowers’ willingness to engage in this process and describe their experiences for this report.
Undue pressure on line engineers and production staff
FAA’s certification process suffers from undue pressure on line engineers and production staff. This issue exists across different manufacturers and products.
According to whistleblowers, GE Aviation’s GE9X engine program suffered from undue pressure on production staff acting on behalf of the FAA. For example, Mr. Kucera described being placed in an untenable position where he was responsible for conducting engine conformity tests on behalf of FAA, while also being charged with preparing GE engines to pass these same tests. This “would cross a line that should not be crossed,” in his words. There were also scheduling pressures on production staff in the Boeing 787 program, which led to quality issues in the supply chain—problems that still persist. Boeing production staff experienced “relentless” schedule pressure in the 737 MAX program as well, raising safety concerns. Currently, the FAA office overseeing Boeing is investigating the continued problem of undue pressure under FAA’s Organization Designation Authorization (“ODA”) program.
Line engineers with technical expertise ignored
Line engineers with specific technical expertise were not listened to during the certification process for the 737 MAX and 787 programs. Whistleblowers described how warnings from specialized Boeing engineers were ignored. For example, Dr. Bickeboeller, a senior engineer at Boeing, stressed that his warnings of such supply chain non-compliances as part of the 787 project were still not adequately addressed by Boeing or the FAA. At the FAA, senior engineers who raised safety concerns were sidelined during the 737 MAX certification. According to Mr. Collins, an FAA aerospace engineer had reported to FAA management the risk of “catastrophic failure due to uncontrolled fire” posed by the absence of a fireproof enclosure on the 787 Dreamliner’s lithium- ion battery. After the 787 was grounded by the FAA in response to fires started by the airplane system’s lithium-ion battery, Mr. Collins reported “the design changes the FAA mandated to allow the 787 to fly again included a steel battery containment box that was vented overboard; as originally proposed by the FAA aerospace engineer.”
Boeing oversight office in Seattle lacks enough safety engineers
FAA has failed to provide a sufficient number of safety engineers to the FAA office in Seattle overseeing the Boeing Organization Designation Authorization (“ODA”). The Boeing ODA is the largest and most complex in the United States. In February 2021, the Department of Transportation Office of Inspector General (“DOT OIG”) findings showed the FAA office in Seattle has been chronically understaffed with only 25 engineers and technical project managers to oversee approximately 1,500 Boeing engineers who act on behalf of FAA. Under section 104 of the Aircraft Certification, Safety, and Accountability Act, Congress instructed FAA to examine and address any shortfall in the agency’s technical and engineering expertise to carry out its certification responsibilities, but FAA missed the statutory deadline of September 22, 2021 and continues to not complete the workforce review.
FAA certification processes do not require compliance with latest airworthiness standards
Whistleblowers point to gaps in the FAA certification process that have resulted in aircraft designs that do not meet the most recent airworthiness standards and less scrutiny of safety critical features. For instance, Mr. Ewbank cited gaps in the “Changed Product Rule” which allowed FAA to certify the 737 MAX according to dated airworthiness standards, like those for flight crew alerting systems. He asserts that flaws about the aircraft’s older crew alerting system were “creatively hidden or outright withheld” from FAA during the certification process. The aircraft’s unique flight control system (“MCAS”) also did not receive proper scrutiny, part of a “slice and dice” approach Boeing took with the 737 MAX certification according to Mr. Ewbank.
FAA’s strong oversight eroded under the ODA program
FAA’s oversight of the certification process has eroded under the ODA program, the agency’s latest system of delegated authority. Although by statute FAA retains responsibility for certifying that designs meet safety standards, the agency has, over time, increasingly delegated away its authority. The agency’s system of delegation dates back a century, but recent efforts to utilize full organization-level delegation are new. In particular, under the ODA program FAA has embraced a “systems oversight” approach instead of directly supervising the engineering work of individual designees. In collaboration with industry, FAA has emphasized achieving efficiencies, through increased delegation, as a top priority. With this approach, FAA certified two transport category aircraft, the 787 and 737 MAX, which subsequently were been grounded because of safety issues at significant costs. For example, in addition to the loss of 346 lives and incredible pain for the victims’ families, the 737 MAX crashes and grounding cost Boeing more than $20 billion and inflicted significant reputational harm to the U.S. aviation safety oversight system.
FAA and industry struggle with technical engineering capacity necessary for complex aircraft systems
FAA and industry are facing new challenges from complex aircraft systems involving human factors and automation. However, according to Mr. Ewbank, with the 737 MAX, FAA faced problems of technical capability and expertise to be able to certify complex aircraft systems. He observed that computer technology and human-machine interfaces require a “significant amount of technical knowledge at the FAA.” For the aviation manufacturing industry, companies face increased competition for engineering and technical expertise to further innovation in aircraft systems. While automated flight control systems can enhance safety, increased reliance on automation creates new safety challenges. These range from failure of pilots to correctly operate automated flight systems, to software malfunctions that generate faulty data, to the degradation of manual piloting skills.
Recommendations
During the Committee hearing titled “Implementation of Aviation Safety Reform” that took place on November 3, 2021, the Committee identified that the FAA has not fully implemented key provisions of the reform law and missed critical statutory deadlines. A theme throughout this report is that FCAA must take immediate action to implement outstanding items under the Aircraft Certification, Safety, and Accountability Act, which address key whistleblower concerns. Below is a list of key recommendations with a complete list found later in this report.
Strengthen FAA direct oversight of the ODA program
As required by section 107 of the Aircraft Certification, Safety, and Accountability Act, FAA should immediately strengthen direct supervision of the ODA delegation system, including starting January 1, 2020, FAA direct approval of individual ODA unit members—who are employed by industry but act on behalf of the FAA. FAA must also assign FAA safety advisors to enable direct supervision of and communication with ODA unit members, safeguards found under FAA’s prior system of delegation with designated engineers. This reform was immediately effective with the law’s enactment.
Take measures to address undue pressure at Boeing ODA
FAA should take immediate action to address undue pressure at the Boeing ODA with existing statutory authority. Ian Won, Acting Manager of the FAA Boeing Aviation Safety Oversight Office (“BASOO”), is investigating the Boeing ODA and instances of undue pressure. FAA should act upon any findings from this investigation.
An independent expert panel tasked by section 103 of the Aircraft Certification, Safety, and Accountability Act is reviewing the Boeing ODA’s safety culture, undue pressure, and capability to perform FAA-delegated functions. FAA must carefully review the panel’s recommendations and report back to Congress on implementation, but the agency should not delay in taking action.
Ensure sufficient FAA technical and engineering capacity for safety oversight
FAA should complete a workforce review to determine gaps in staffing levels, as mandated by section 104 of the Aircraft Certification, Safety, and Accountability Act, and then properly staff the BASOO, which currently has an insufficient number of engineers and technical staff to oversee the Boeing ODA, the largest and most complex in the United States. The workforce review must account for new safety responsibilities required by the new law. FAA missed the workforce review deadline of September 22, 2021.
Limit delegation to industry until human factors assumptions are validated
FAA should immediately implement interim measures to effectuate section 106 of the Aircraft Certification, Safety, and Accountability Act, which prohibits FAA from delegating industry certification tasks related to safety critical design features until the FAA reviews and verifies all underlying human factors assumptions. This limitation on delegation was immediately effective upon the law’s enactment.
Require that manufacturers adopt formal safety management systems with root cause analysis followed by corrective action
FAA must require, without delay, that aviation manufacturers implement safety management systems (“SMS”), an organization-wide approach to managing safety risk required by section 102 of the Aircraft Certification, Safety, and Accountability Act, and strengthen the agency’s oversight over SMS programs to ensure, among other items, manufacturers are conducting root cause analysis. The law required that FAA initiate a rulemaking within 30 days of enactment. FAA has started the rulemaking process, but has not taken the substantive step of issuing a notice of proposed rulemaking.
Measure and improve FAA safety culture for frontline staff
FAA must conduct its annual safety culture assessment as required by section 132 of the Aircraft Certification, Safety, and Accountability Act. This survey will measure line employee’s opinions on FAA safety culture and implementation of the voluntary safety reporting program mandated under the new law. According to Administrator Stephen Dickson’s testimony to the Committee on November 3, 2021, FAA has not yet conducted the annual survey with the end of the calendar year approaching.
Mandate integrated aircraft safety analysis of designs
FAA should continue to update the “Changed Product Rule” in conjunction with international partners, as required by sections 115 and 117 of the Aircraft Certification, Safety, and Accountability Act, so that proposals for variants of existing aircraft designs (amended type certificates) have to undergo an integrated system safety analysis, taking in consideration the cumulative effects of proposed design changes to the aircraft, human factors issues, and impacts on training for pilots and maintenance personnel.
