The families of victims of Ethiopian Airlines 302 sent a letter to US Transportation Secretary Elaine Chao:
October 23, 2019
The Honorable Elaine L. Chao
U.S. Department of Transportation
1200 New Jersey Avenue, SE
Washington DC 20590
Stephen Dickson, Administrator
Federal Aviation Administration
U.S. Department of Transportation
800 Independence Avenue, SW
Washington, DC 20591
Re: Request to revoke Boeing’s ODA and to hold certification decision makers accountable
Dear Secretary Chao and Administrator Dickson:
We hereby demand that the FAA revoke Organization Designation Authority (ODA) from Boeing and remedy all the problems identified in the recent Joint Authorities Technical Review report before considering whether to unground the Boeing 737 MAX 8. We also request that those involved with certifying the MAX 8 and the decision against grounding it after the Lion Air crash be removed and/or recuse themselves from the analysis underlying any return to service decision. Many families of those killed on flight ET302 on March 10 agree with this letter, but are unable to sign because they are dealing with the burdens and grief traveling to and from Ethiopia to receive their loved ones remains and hold final services.
According to news reports, Boeing has provided the FAA with the final software load and complete system description of revisions to the airplane. Administrator Dickson has stated that the FAA will be working to evaluate the submission over the next several weeks. However, neither FAA nor Boeing has changed any personnel, systems or evaluation processes that allowed this flawed aircraft to fly.
Any evaluation process limited to a mere examination of Boeing’s recent submission is incomplete and would demonstrate FAA’s lack of interest in fixing broader problems with itself, Boeing and improvements aviation safety system.
Revocation of Boeing’s ODA
The ODA program allows Boeing to perform certification functions on behalf of the Administrator. Granting an ODA application requires not only expertise but a history of trust and competence free from conflicts of interest. The Administrator may terminate the ODA for any reason including the fact that the ODA holder has not properly performed its duties.
Unlike a true safety regulator, Boeing’s safety culture, to the extent it exists, has deteriorated as it prioritized profits over safety and unduly pressured employees to certify safety compliance. It hid information from the FAA, was not forthcoming with documents, and misinterpreted regulations for its benefit.
These are not characteristics of a company that can be trusted to act on behalf of the Administrator.
The Joint Authorities Technical Review report of October 11 found that Boeing management exerted undue pressure on ODA unit engineers performing certification activities which, as a result, “erodes the level of assurance in this system of delegation.” (pg VII). The Wall Street Journal recently reported that internal Boeing surveys revealed that one in three employees felt potential undue pressure from managers regarding safety related approvals. Boeing engineer Curtis Ewbank filed a complaint that asserted ““Boeing management was more concerned with cost and schedule than safety or quality.” He further asserted that Boeing CEO Dennis Muilenburg publicly misrepresented the safety of the MAX 8.
Boeing minimized or hid the true power of the MCAS system, convincing FAA to delete mention of it in the Flight Crew Operating Manual and therefore hiding its existence from the Flight Standardization Board (FSB). The company concealed, for an inordinate amount of time, text messages that showed the MCAS system, in simulators, was causing egregious problems.
The JATR report found many problems with certification processes at the Boeing ODA that have not been corrected. Examples are many:
Failure to update MCAS certification deliverables to reflect changes within the flight control system (pg VI);
Failure to adequately review, update or validate MCAS design assumptions (pg VI);
Failure to evaluate possible flight deck effects of MCAS (pg VI);
Failure to perform and update a crew workload assessment in relation to AOA failures and MCAS functions, instead relying on assumptions from previous programs (pg VI);
Failure to evaluate MCAS as a complete and integrated function (pg VIII);
Reliance on unsupportable assumptions, such as a three second pilot response time (pg 14);
Inconsistently interpreting and applying regulatory guidance material to wrongly minimize the importance of MCAS (pg 17);
Failing to determine whether the MCAS was a stall identification or a stall protection system (pg 18);
Minimizing the content of operating procedures that are subject to FAA scrutiny and approval;
Failure to ensure that flight simulators accurately represented the behavior of the MAX 8 (pg 21);
Failure to consider MCAS as a novelty so as to highlight it to FAA technical staff as different from the MAS installed on the B737-C2 tanker (pg 23).
Failure to updated and describe the expansion of the MCAS function for the low Mach portion of the flight envelope and for compliance with stall-related rules (pg 24);
Failure to require Boeing engineers to sign off on approval forms so that persons responsible for decisions can be identified (pg 29);
Failure to establish an independent safety group to coordinate systems safety analysis within the MAX development program (pg 33);
Failure to provide engineers with any documentation that provides a consistent methodology for the system safety assessment process to be followed across systems (pp 34-35);
Failure to align Boeing’s development assurance process with industry best practices for integrated systems (pg 37);
Improperly using pilots for verification and validation activities rather than engineers (pg 37);
Improperly relying on original aircraft and system level assumptions to when carrying out certification functions on new and changed aircraft (pg 40).
A competent and trustworthy certification organization would not exhibit this litany of problems.
The conflict of interest, undue pressure on certification engineers and the mistakes made by the Boeing in self-certifying the MAX clearly show that the company cannot be trusted with an ODA designation. FAA should revoke Boeing’s ODA and directly supervise the Boeing engineers involved with certification activities.
Removal of those involved in the MAX certification process
Despite the errors of those in FAA, such as Mr. Ali Bahrami, no one has been held accountable for the mistakes and incompetence that led to the deaths of our loved ones. True leadership means accountability. If there is no accountability, you are giving the green light to continuing the mistakes and incompetence of the past.
We hereby demand that you remove any and all personnel that signed off on any findings that allowed the MAX to fly with the MCAS system and without fully addressing whether the aircraft is inherently unstable. We and the flying public cannot be confident in any future decisions unless those who made mistakes are removed from the process.
You have an opportunity to change FAA and leapfrog to new levels of safety and technical excellence previously considered out of reach. Past FAA leadership allowed technical expertise to erode so that competent engineers with relevant subject matter expertise either do not exist or do not have sufficient experience to professionally manage the certification process. This fact should not be considered a barrier to revoking Boeing’s ODA and achieve excellence in safety and innovation.
We note that FAA has submitted a proposed budget to Congress which contains no funding increases for additional personnel or to competitively pay competent personnel. That fact erodes our confidence in your desire to make significant improvements. You should add significant funding requests to fix the problems with insufficient personnel and expertise as well as all other problems identified in the JATR report.
We ask that you use this moment in history to fix the erosion and degradation of FAA’s abilities. This moment will determine whether you are viewed as leaders achieving new levels of excellence or apologists for and defenders of mediocrity and incompetence.
Michael Stumo and Nadia Milleron (parents of ET302 victim Samya Rose Stumo)
Javier DeLuis (brother of ET302 victim Graziella de Luis Ponce)
Amber Tansky (sister of ET302 victim Micah John Messent)
Claudia Chimenti (sister of ET302 victim Virginia Chimenti)