Boeing 737 MAX certification
The Boeing 737 MAX gained its type certification from the FAA and EASA in March 2017. Within two years, the aircraft was involved in two fatal accidents, Lion Air Flight 610 and Ethiopian Airlines Flight 302, and grounded worldwide in March 2019.
Under a system known as the Organization Designation Authorization, the FAA allowed manufacturers like Boeing to act on its behalf, while the agency retains legal authority to issue a type certificate. The goal for Boeing was to ensure the aircraft retains a compatible type rating with all other aircraft in the 737 family, thus avoiding costly simulator training and the need to learn about new systems like the MCAS.
On March 11, 2019, a U.S. federal grand jury issued a subpoena on behalf of the U.S. Justice Department for documents related to development of the 737 MAX. On March 19, 2019, the U.S. Department of Transportation requested the Office of Inspector General to conduct an audit on the 737 MAX certification process. Over the next several months, The Seattle Times's award-winning coverage of the ongoing crisis revealed how management decisions at Boeing and the FAA pushed for cost-saving solutions, but ultimately produced a flawed design with insufficient oversight. The FAA found that Boeing had violated regulations in deciding to not fix a known defect with the aircraft.
In November 2019, the FAA suspended Boeing's authority to issue individual airworthiness certificates for MAX aircraft. In February 2020, the DOJ was conducting an ongoing investigation into whether Boeing lied to the FAA. In March 2020, the House of Representatives criticized Boeing's culture of concealment and its undue influence over the FAA, as exemplified during certification and in the aftermath of the crashes. In June 2020, the U.S. Inspector General report said that Boeing downplayed MCAS for years, and the FAA missed it.
By convention, aviation regulators worldwide accept the certification of aircraft from the country of manufacture and do not review those certifications in much detail. However, since the fatal accidents and grounding of 737 MAX several aviation authorities, particularly the European EASA, will conduct their assessments and validation tests of the MAX prior to authorizing it in their controlled airspace. As of October 2019 the disagreements over various system revision details, Level of Involvement between the two leading aviation authorities, FAA and EASA, as well as Boeing's new recommendation of simulator training could delay the 737 MAX return to service.
Certification
Initial certification
Type rating
In the U.S., the MAX shares a compatible type rating throughout the Boeing 737 series.The impetus for Boeing to build the 737 MAX was serious competition from the Airbus A320neo, which was a threat to win a major order for aircraft from American Airlines, a traditional customer for Boeing airplanes. Boeing decided to update its 737, designed in the 1960s, rather than designing a clean sheet aircraft, which would have cost much more and taken years longer. Boeing's goal was to ensure the 737 MAX would not need a new type rating, which would require significant additional pilot training, adding unacceptably to the overall cost of the airplane for customers.
The 737 was first certified by the FAA in 1967. Like every new 737 model since then, the MAX has been approved partially with the original requirements and partially with more current regulations, enabling certain rules and requirements to be grandfathered in. Chief executive Dai Whittingham of the independent trade group UK Flight Safety Committee disputed the idea that the MAX was just another 737, saying, "It is a different body and aircraft but certifiers gave it the same type rating."
On May 15, 2019, during a senate hearing, FAA acting administrator Daniel Elwell defended their certification process of Boeing aircraft. However the FAA criticized Boeing for not mentioning the MCAS in the 737 MAX's manuals. Representative Rick Larsen responded saying that "the FAA needs to fix its credibility problem" and that the committee would assist them in doing so.
Crew manuals
In 2013, a Boeing meeting urged participants to consider MCAS,, as a simple add-on to the existing stability function: "If we emphasize MCAS is a new function there may be greater certification and training impact". Boeing also played down the scope of MCAS to regulators. The company "never disclosed the revamp of MCAS to FAA officials involved in determining pilot training needs".On March 30, 2016, Mark Forkner, then MAX's chief technical pilot, requested senior FAA officials to remove MCAS from the pilot's manual. Boeing had presented MCAS as being existing technology, but inquiries and certification authorities have raised doubts about its technology readiness. The officials had been briefed on the original version of MCAS but not that MCAS was being significantly overhauled. Because Boeing offered Southwest Airlines a $1-million-per-plane rebate if training was ultimately required, pressure on Boeing executives and engineers increased. In 2017, as the airliner's five-year certification was nearly completed, Forkner wrote to an FAA official, "Delete MCAS". Boeing considered MCAS part of the flight control system, based on the fundamental design philosophy of retaining commonality with the 737NG. However, MCAS was left in the glossary of the 1,600-page flight manual. Top Boeing officials believed MCAS operated only far beyond the normal flight envelope, and was unlikely to activate in normal flight. Boeing had also failed to answer questions raised by Canadian test pilots on behalf of Transport Canada before the airplane was certified.
On November 6, 2018, after the Lion Air accident, Boeing published a service bulletin in which MCAS was mentioned as a "pitch trim system." In reference to the Lion Air accident, Boeing said the system could be triggered by erroneous angle of attack information when the aircraft is under manual control, and reminded pilots of various indications and effects that can result from this erroneous information. Only four days later, on November 10, 2018, Boeing acknowledged the existence of MCAS in a message to operators.
From November 2018 to March 2019, months between the accidents, the FAA Aviation Safety Reporting System received numerous U.S. pilot complaints of the aircraft's unexpected behaviors, and how the crew manual lacked any description of the system. Most air regulatory agencies, including the FAA, Transport Canada and EASA, did not require specific training on MCAS. Brazil's national civil aviation agency "was one of the only civil aviation authorities to require specific training for the operation of the 737-8 Max". Pilots of the 737 Next Generation received an hour-long iPad lesson to fly on the MAX.
Simulator training
On May 17, after discovering 737 MAX flight simulators could not adequately replicate MCAS activation, Boeing corrected the software to improve the force feedback of the manual trim wheel and to ensure realism. This led to a debate on whether simulator training is a prerequisite prior to the aircraft's eventual return to service. On May 31, Boeing proposed that simulator training for pilots flying on the 737 MAX would not be mandatory. Computer training is deemed sufficient by the FAA Flight Standardization Board, the US Airline Pilots Association and Southwest Airlines pilots, but Transport Canada and American Airlines urged use of simulators. On June 19, in a testimony before the U.S. House Committee on Transportation and Infrastructure, Chesley Sullenberger advocated for simulator training. "Pilots need to have first-hand experience with the crash scenarios and its conflicting indications before flying with passengers and crew." The "differences training" is the subject of worry by senior industry training experts. Textron-owned simulator maker TRU Simulation + Training anticipated a transition course but not mandatory simulator sessions in minimum standards being developed by Boeing and the FAA.On July 24, Boeing indicated that some regulatory agencies may mandate simulator training before return to service, and also expected some airlines to require simulator sessions even if these are not mandated.
On August 22, 2019, the FAA announced that it would invite pilots from around the world, intended to be a representative cross-section of "ordinary" 737 pilots, to participate in simulator tests as part of the recertification process, at a date to be determined. The evaluation group sessions are one of the final steps in the validation of flight-control computer software updates and will involve around 30 pilots, including some first officers with multi-crew pilot licenses which emphasize simulator experience rather than flight hours. The FAA hopes that the feedback from pilots with more varied experience will enable it to determine more effective training standards for the aircraft.
On January 7, 2020, Boeing reversed its position and now recommends that pilots receive training in a MAX flight simulator. The FAA will conduct tests using pilots from US and foreign airlines, to determine flight training and emergency procedures. National aviation authorities will consider Boeing's recommendation but will also rely on the outcome of tests and expert opinions. According to The Seattle Times as of this policy reversal, only 34 full-motion 737 MAX flight simulators have been deployed worldwide.The FAA agrees with Boeing on requiring simulator training for pilots, as the MAX returns to service.
On January 9, 2020, Boeing turned over a hundred internal messages of employees criticizing the FAA and the 737 MAX's development. The majority of them being made before either crash. Some messages read that Boeing was trying to get airlines and regulators, including Lion Air, to avoid simulator training, as well as general frustration with Boeing management.
The FAA stated that "the tone and content of some of the language contained in the documents is disappointing," while Boeing said that the messages "do not reflect the company we are and need to be, and they are completely unacceptable."
Rejected improvements
During the development of the MAX, some systems that could have improved situation awareness related to the accidents did not make it. Boeing also successfully appealed safety concerns raised by FAA safety specialists about the separation of cables into different zones of the aircraft, to avoid failures due to a common cause. The appeal raised doubts about the independence of the FAA.According to The Seattle Times, Boeing convinced the FAA, during MAX certification in 2014, to grant exceptions to federal crew alerting regulations, specifically relating to the "suppression of false, unnecessary" information. DeFazio, Chair of the House Committee on Transportation and Infrastructure, said that Boeing considered adding a more robust alerting system for MCAS but finally shelved the idea.
In its final report, the NTSB had also recommended to implement information filtering in the crew alert systems. "For example, the erroneous AOA output experienced during the two accident flights resulted in multiple alerts and indications to the flight crews, yet the crews lacked tools to identify the most effective response. Thus, it is important that system interactions and the flight deck interface be designed to help direct pilots to the highest priority action."
On October 2, 2019, The Seattle Times and The New York Times reported that a Boeing engineer, Curtis Ewbank, filed an internal ethics complaint alleging that company managers rejected a backup system for determining speed, which might have alerted pilots to problems linked to two deadly crashes of 737 MAX. A similar backup system is installed on the larger Boeing 787 jet, but it was rejected for the 737 MAX because it could increase costs and training requirements for pilots. Ewbank said the backup system could have reduced risks that contributed to two fatal crashes, though he could not be sure that it would have prevented them. A backup speed system "could also detect when sensors measuring the direction of the plane's nose weren't working". He also said in his complaint that Boeing management was more concerned with costs and keeping the MAX on schedule than on safety. An attorney representing families of the Ethiopian crash victims will seek sworn evidence from the whistleblower.
As of May 2020, FAA, along with EASA and Transport Canada have asked Boeing to implement some of these improvements to be retrofitted on all aircraft once the airplane returns to service.
Boeing 737 safety analysis
Recognized civil aviation development practices, such as those of SAE International ARP4754 and ARP4761, require a safety process with quantitative assessments of availability, reliability, and integrity, validation of requirements, and verification of implementation. Such processes rely on engineering judgment and the application of these practices varies within the industry. Redundancy is a technique that may be used to achieve the quantitative safety requirements.Aviation safety risk is defined in AC 25.1309-1, an FAA document describing acceptable means for showing compliance with the airworthiness requirements of § 25.1309 of the Federal Aviation Regulations. A catastrophic failure must have an extremely improbable rate, defined as one in a billion flight hours, also stated as less than 10−9 per flight hour.
By this measure, as of 2005, the Boeing 737 had an actual fatal accident rate of 1 in 80 million flight hours, missing the requirements by an order of magnitude.
In the two years of the 737 MAX's commercial service prior to its grounding, the global fleet of nearly 400 aircraft flew 500,000 flights and suffered two hull loss incidents. As of March 11, 2019, the 737 MAX's accident rate was second behind the Concorde, with four accidents per million flights, compared to the 737NG 0.2 accidents per million flights.
MCAS and MAX safety risk analysis
In response to the Lion Air crash, the FAA conducted an internal study of the safety of the 737 MAX. The study, not made public, used the Transport Airplane Risk Assessment Methodology and was completed on December 3, 2018, slightly more than a month after the accident. Just over a year later, on December 11, 2019, the US House Committee on Transportation and Infrastructure released the study and described its conclusion by stating, "if left uncorrected, the MCAS design flaw in the 737 Max could result in as many as 15 future fatal crashes over the life of the fleet".Boeing stated that, based on the TARAM analysis:
The FAA report was refuted by MIT professor Arnold Barnett based on the loss of two aircraft out of only 400 delivered. He said there would be 24 crashes per year for a fleet size of 4,800, thus the FAA underestimated the risk by a factor of 72.
On March 6, 2019, four days prior to the Ethiopian crash, Boeing and the FAA declined to comment regarding their safety analysis of MCAS for a story in The Seattle Times. On March 17, a week after the crash, The Seattle Times published the following flaws as identified by aviation engineers:
- Boeing's service bulletin informed airlines that the MCAS could deflect the tail in increments up to 2.5°, more than the 0.6° told to the FAA in the safety assessment;
- MCAS could reset itself after each pilot response to repeatedly pitch the aircraft down;
- The capability of MCAS had been downplayed, and its failure assessment was rated as "hazardous", one level below "catastrophic"
- MCAS relied on a single angle of attack sensor.
Documentation made public at the House hearing on October 30, 2019, "established that Boeing was also already well aware, before the Lion Air accident, that if a pilot did not react to unintended MCAS activation within 10 seconds, the result could be catastrophic."
US Congress inquiries
In March 2019, Congress announced an investigation into the FAA approval process. Members of Congress and government investigators expressed concern about FAA rules that allowed Boeing to extensively "self-certify" aircraft. FAA acting Administrator Daniel Elwell said "We do not allow self-certification of any kind". Initially, as a new system or a new device on the amended type certificate, the FAA retained the oversight of MCAS. However, the FAA later released it to the Boeing Organization Designation Authorization based on comfort level and thorough examination, Elwell said in March. "We were able to assure that the ODA members at Boeing had the expertise and the knowledge of the system to continue going forward." However, several FAA insiders believed the delegation went too far.Senate
On April 2, 2019, after receiving reports from whistle-blowers regarding the training of FAA inspectors who reviewed the 737 MAX type certificate, the Senate Commerce Committee launched a second Congressional investigation; it focuses on FAA training of the inspectors. The FAA provided misleading statements to Congress about the training of its inspectors, most possibly those inspectors that oversaw the Max certification, according to the findings of an Office of Special Counsel investigation released in September.In February 2020, three Senate Transportation Committee members introduced a "Restoring Aviation Accountability" bill, which would specifically require implementation of the Joint Authorities Technical Review's recommendations, and more generally would set up a commission to review the FAA safety delegation process and assess alternative certification schemes that could provide more robust oversight.
House of Representatives
On June 7, the delayed escalation on the defective AoA Disagree alert on 737 MAX was investigated. The Chair of the House Transportation and Infrastructure Committee and the Chair of the Aviation Subcommittee sent letters to Boeing, United Technologies Corp., and the FAA, requesting a timeline and supporting documents related to awareness of the defect, and when airlines were notified.In September 2019, a Congress panel asked Boeing's CEO to make several employees available for interviews, to complement the documents and the senior management perspective already provided. The same month, Boeing's board called for changes to improve safety. Representative Peter DeFazio, chairman of the House Transportation and Infrastructure Committee, said Boeing declined his invitation to testify at a House hearing. "Next time, it won't just be an invitation, if necessary," he said. Later, in the same month, the House Transportation and Infrastructure Committee announced that Boeing CEO, Dennis Muilenburg, will testify before Congress accompanied by John Hamilton, chief engineer of Boeing's Commercial Airplanes division and Jennifer Henderson, 737 chief pilot. In October 2019, the House asked Boeing to allow a flight deck systems engineer who filed an internal ethics complaint to be interviewed.
On October 18, Peter DeFazio said "The outrageous instant message chain between two Boeing employees suggests Boeing withheld damning information from the FAA". Boeing expressed regret over its ex-pilot's messages after their publication in media. Boeing's media room released a statement about Forkner's meaning of the instant messages, obtained through his attorney because the company has not been able to talk to him directly. The transcript of the messages indicates, according to experts, a problem with the simulator rather than an MCAS erratic activation.
On October 25, 2019, Peter DeFazio commented the Lion Air accident report, saying "And I will be introducing legislation at the appropriate time to ensure that unairworthy commercial airliners no longer slip through our regulatory system".
The aviation subcommittee and full committee hearings follow:
The Subcommittee on Aviation met on June 19, 2019, to hold a hearing titled, "Status of the Boeing 737 MAX: Stakeholder Perspectives".
"The hearing is intended to gather views and perspectives from aviation stakeholders regarding the Lion Air Flight 610 and Ethiopian Airlines Flight 302 accidents, the resulting international grounding of the Boeing 737 MAX aircraft, and actions needed to ensure the safety of the aircraft before returning them to service. The Subcommittee will hear testimony from Airlines for America, Allied Pilots Association, Association of Flight Attendants—CWA, Captain Chesley Sullenberger, and Randy Babbitt."
On July 17, representatives of crash victims' families, in testimony to the House Transportation and Infrastructure Committee – Aviation Subcommittee, called on regulators to re-certificate the MAX as a completely new aircraft. They also called for wider reforms to the certification process, and asked the committee to grant protective subpoenas so that whistle-blowers could testify even if they had agreed to a gag order as a condition of a settlement with Boeing. In a July 31 senate hearing, the FAA defended its administrative actions following the Lion Air accident, noting that standard protocol in ongoing crash investigations limited the information that could be provided in the airworthiness directive.
On October 29, 2019, Muilenburg and Hamilton appeared at the House hearing under the title "Aviation Safety and the Future of Boeing's 737 MAX", which was the first time that Boeing executives addressed Congress about the MAX accidents. The hearing came on the heels of the removal of Dennis Muilenburg's title as chairman of the Boeing board a week before and was intended to examine issues associated with the design, development, certification, and operation of the Boeing 737 MAX following two accidents in the last year. The committee first heard from Boeing on actions taken to improve safety and the company's interaction with relevant federal regulators. The second panel was composed of government officials and aviation experts discussing the status of Boeing 737 MAX and relevant safety recommendations."
On October 30, the House made public a 2015 internal email discussion between Boeing employees raising concerns about MCAS design in the exact scenario blamed for the two crashes: "Are we vulnerable to single AOA sensor failures with the MCAS implementation?" Committee members discussed another internal document, stating that a reaction longer than 10 seconds to an MCAS malfunction "found the failure to be catastrophic." The hearings' key revelation was insider knowledge of vulnerabilities amid a hectic rate of production.
After the testimony of Boeing's CEO, Peter DeFazio and Rick Larsen, leader of its aviation sub-panel, wrote a letter to other lawmakers on November 4, saying that unanswered questions remain: "Mr. Muilenburg left a lot of unanswered questions, and our investigation has a long way to go to get the answers everyone deserves Mr. Muilenburg's answers to our questions were consistent with a culture of concealment and opaqueness and reflected the immense pressure exerted on Boeing employees during the development and production of the 737 Max".
On December 11, 2019, during a hearing of the House Committee on Transportation titled "The Boeing 737 MAX: Examining the Federal Aviation Administration's Oversight of the Aircraft's Certification," an internal FAA review dated December 3, 2018, was released, which predicted a high MAX accident rate, if it kept flying with MCAS unchanged. The findings were first reported by The Wall Street Journal in July 2019, The FAA assumed that the emergency airworthiness directive sufficed until Boeing delivered a fix. Over a question whether a mistake was made in this regard, the FAA's chief Stephen Dickson responded, "Obviously the result was not satisfactory." Peter DeFazio said that the committee's investigation "has uncovered a broken safety culture within Boeing and an FAA that was unknowing, unable, or unwilling to step up, regulate and provide appropriate oversight of Boeing".
But perhaps most chillingly, we have learned that shortly after the issuance of the airworthiness directive, the FAA performed an analysis that concluded that, if left uncorrected, the MCAS design flaw in the 737 MAX could result in as many as 15 future fatal crashes over the life of the fleet—and that was assuming that 99 out of 100 flight crews could comply with the airworthiness directive and successfully react to the cacophony of alarms and alerts recounted in the National Transportation Safety Board's report on the Lion Air tragedy within 10 seconds. Such an assumption, we know now, was tragically wrong.
Despite its own calculations, the FAA rolled the dice on the safety of the traveling public and let the 737 MAX continue to fly until Boeing could overhaul its MCAS software. Tragically, the FAA's analysis—which never saw the light of day beyond the closed doors of the FAA and Boeing—was correct. The next crash would occur just five months later, when Ethiopian Airlines flight 302 plummeted to earth in March 2019.
In January 2020, Kansas Rep. Sharice Davids, member of the House Transportation Committee and is vice chair of its aviation subcommittee, said: "The newly released messages from Boeing employees are incredibly disturbing and show a coordinated effort inside the company to deceive the American public and federal regulators, who are in place to keep passengers safe. It's further proof that Boeing put profit over safety in the development of the 737 MAX. In addition to the public safety concerns these messages raise, Boeing's callousness has now cost thousands of Kansans their livelihood and endangered the economy of our state, which is dependent on aerospace."
On March 6, 2020, the House Transportation Committee said that a "culture of concealment" at the company and poor oversight by federal regulators contributed to the crashes. In a preliminary summary of its nearly yearlong investigation, the committee said multiple factors had led to the crashes, but focused on the MCAS which Boeing had failed to classify as safety critical, part of a strategy designed to avoid closer scrutiny by regulators as the company developed the plane. The panel said that Boeing had undue influence over the Federal Aviation Administration, and that FAA managers rejected safety concerns raised by their own technical experts. The preliminary report was prepared by the Democratic Staff of the House Committee on Transportation and Infrastructure.
US Office of Special Counsel inquiries
The Office of Special Counsel is an organization investigating whistleblower reports. Its report infers that safety inspectors "assigned to the 737 Max had not met qualification standards". The OSC sided with the whistleblower, pointing out that internal FAA reviews had reached the same conclusion. In a letter to President Trump, the OSC found that 16 of 22 FAA pilots conducting safety reviews, some of them assigned to the MAX two years ago, "lacked proper training and accreditation."Safety inspectors participate in Flight Standardization Boards, that ensure pilot competency by developing training and experience requirements. FAA policy requires both formal classroom training and on-the-job training for safety inspectors.
Special Counsel Henry J. Kerner wrote in the letter to the President, "This information specifically concerns the 737 Max and casts serious doubt on the FAA's public statements regarding the competency of agency inspectors who approved pilot qualifications for this aircraft".
In September, Daniel Elwell disputed the conclusions of the OSC, which found that aviation safety inspectors assigned to the 737 MAX certifications did not meet training requirements. To clarify the facts, lawmakers asked the FAA to provide additional information:
We are particularly concerned about the Special Counsel's findings that inconsistencies in training requirements have resulted in the FAA relaxing safety inspector training requirements and thereby adopting "a position that encourages less qualified, accredited, and trained safety inspectors." We request that the FAA provide documents confirming that all FAA employees serving on the FSB for the Boeing 737-MAX and the Gulfstream VII had the required foundational training in addition to any other specific training requirements.
US Cabinet inquiries
The FBI has joined the criminal investigation into the certification as well. FBI agents reportedly visited the homes of Boeing employees in "knock-and-talks".At the request of Peter DeFazio, and Chair of the Subcommittee on Aviation Rick Larsen, the U.S. Department of Transportation Inspector General opened an investigation into FAA approval of the Boeing 737 MAX aircraft series, focusing on potential failures in the safety-review and certification process.
A report released on October 23 says that the FAA faces a "significant oversight challenge" to ensure that manufacturers carrying out delegated certification activities "maintain high standards and comply with FAA safety regulations", and that it plans to introduce a "new process that represents a significant change in its approach" by March 2020.
In April 2019, U.S. Secretary of Transportation, Elaine L. Chao, who boarded a MAX flight on March 12 amid calls to ground the aircraft, created the Special Committee to Review the FAA's Aircraft Certification Process to review of Organization Designation Authorization, which granted Boeing authority to review systems on behalf of the FAA, during the certification of the 737 MAX 8. The committee recommended integrating human performance factors and consider all levels of pilot experience, but defended the ODA against any reforms. Relatives of those on board the accident flights condemned the report for calling the ODA an "effective" process.
FAA inquiries
The general public and worldwide regulators are concerned by the MAX grounding; consequently, the FAA is re-evaluating its certification process. The FAA was seeking consensus with other regulators to approve the return to service to avoid suspicion of undue cooperation with Boeing. The International Air Transport Association had also made a similar statement calling for more coordination and consensus with training and return to service requirements. Since June 2019, the FAA has reiterated many times that it does not have a timetable on when the 737 MAX will return to service, stating that it is guided by a "thorough process, not a prescribed timeline."The FAA certifies the design of aircraft and components that are used in civil aviation operations. The FAA is "performance-based, proactive, centered on managing risk, and focused on continuous improvement." As with any other FAA certification, the MAX certification included: reviews to show that system designs and the MAX complied with FAA regulations; ground tests and flight tests; evaluation of the airplane's required maintenance and operational suitability; collaboration with other civil aviation authorities on aircraft approval.
In March 2019, reports emerged that Boeing performed the original System Safety Analysis, and FAA technical staff felt that managers pressured them to sign off on it. Boeing managers also pressured engineers to limit safety testing during the analysis. A 2016 Boeing survey found almost 40% of 523 employees working in safety certification felt "potential undue pressure" from managers.
On October 2, 2019, The Seattle Times reported that Boeing convinced FAA regulators to relax certification requirements in 2014, that would have added to the development cost to the MAX. In October 2019, according to current and former FAA officials, instead of increasing its oversight powers, the FAA "has been pressing ahead with plans to further reduce its hands-on oversight of aviation safety".
In November 2019, the FAA announced that it had withdrawn Boeing's authority, previously held under the Organization Designation Authorization, to issue airworthiness certificates for individual new 737 MAX aircraft. The FAA denied allegations that the ODA enabled plane makers to police themselves or self-certify their aircraft. After the overall grounding is lifted, the FAA will issue such certificates directly; aircraft already delivered to customers will not be affected. In the same month, the FAA pushed back at Boeing's attempts to publicize a certification date, saying the agency will take all the time it needs.
On December 9, 2019, in an internal email sent to employees in the FAA's Aircraft Certification Service, it was revealed that the agency was moving to create a new safety branch to address shortcomings in its oversight following the two MAX crashes and a controversial reorganization. The email obtained by The Washington Post emphasized the complexities of aviation safety, but did not mention the MAX directly as it was written in bureaucratic language.
Technical Advisory Board
The Technical Advisory Board, a multi-agency panel, was created shortly after the second crash, as a panel of government flight-safety experts for independently reviewing Boeing's redesign of the MAX. It includes experts from the United States Air Force, the Volpe National Transportation Systems Center, NASA and FAA. "The TAB is charged with evaluating Boeing and FAA efforts related to Boeing's software update and its integration into the 737 Max flight control system. The TAB will identify issues where further investigation is required prior to FAA approval of the design change", said the FAA.The TAB reviewed Boeing's MCAS software update and system safety assessment.
On November 8, the TAB presented its preliminary report to the FAA, finding that the MCAS design changes are compliant with the regulations and safe.
Joint Authorities Technical Review
On April 19, 2019 a multinational "Boeing 737 MAX Flight Control System Joint Authorities Technical Review" team was commissioned by the FAA to investigate how it approved MCAS, whether changes need to be made in the FAA's regulatory process and whether the design of MCAS complies with regulations. On June 1, Ali Bahrami, FAA Associate Administrator for Aviation Safety, chartered the JATR to include representatives from FAA, NASA and the nine civil aviation authorities of Australia, Brazil, Canada, China, Europe, Indonesia, Japan, Singapore and UAE.On September 27, the JATR chair Christopher A. Hart said that FAA's process for certifying new airplanes is not broken, but needs improvements rather than a complete overhaul of the entire system. He added "This will be the safest airplane out there by the time it has to go through all the hoops and hurdles".
The JATR said that FAA's "limited involvement" and "inadequate awareness" of the automated MCAS safety system "resulted in an inability of the FAA to provide an independent assessment". The panel report added that Boeing staff performing the certification were also subject to "undue pressures... which further erodes the level of assurance in this system of delegation".
About the nature of MCAS, "the JATR team considers that the STS/MCAS and EFS functions could be considered as stall identification systems or stall protection systems, depending on the natural stall characteristics of the aircraft".
The report recommends that FAA reviews the jet's stalling characteristics without MCAS and associated system to determine the plane's safety and consequently if a broader design review was needed.
"Boeing elected to meet the objectives of SAE International's Aerospace Recommended Practice 4754A, Guidelines for Development of Civil Aircraft and Systems, for development assurance of the B737 MAX. The use of ARP4754A is consistent with the guidance contained in FAA Advisory Circular 20-174, Development of Civil Aircraft and Systems. The JATR team identified areas where the Boeing processes can be improved to more robustly meet the development assurance objectives of ARP4754A.The JATR found that Boeing did not carry out a thorough verification by stress-testing of the MCAS. The JATR also found that Boeing exerted "undue pressures" on Boeing Organization Designation Authorization engineering unit members.
An integrated SSA to investigate the MCAS as a complete function was not performed. The safety analyses were fragmented among several documents, and parts of the SSA from the B737 NG were reused in the B737 MAX without sufficient evaluation.
The JATR team identified specific areas related to the evolution of the design of the MCAS where the certification deliverables were not updated during the certification program to reflect the changes to this function within the flight control system. In addition, the design assumptions were not adequately reviewed, updated, or validated; possible flight deck effects were not evaluated; the SSA and functional hazard assessment were not consistently updated; and potential crew workload effects resulting from MCAS design changes were not identified."
Return to Service
Regulators
FAA
In August 2019, reports emerged of friction between Boeing and certain international air-safety authorities. A Boeing briefing was stopped short by the FAA, EASA, and other regulators, on the grounds that Boeing had "failed to provide technical details and answer specific questions about modifications in the operation of MAX flight-control computers." A U.S. official confirmed frustration with some of Boeing's answers.On September 18, 2019, FAA administrator Stephen Dickson said that he would not certify the MAX until he flew the aircraft himself. He said he will fly the plane using the new software following the certification flight.
In October 2019, the FAA requested that Boeing turn over internal documents and explain why it did not disclose the Forkner messages earlier. The FAA is aware of "more potentially damaging messages from Boeing employees that the company has not turned over to the agency".
On December 11, 2019, Dickson announced that MAX would not be recertified before 2020, and reiterated that FAA did not have a timeline. The following day, Dickson met with Boeing chief executive Dennis Muilenburg to discuss Boeing's unrealistic timeline and the FAA's concerns that Boeing's public statements may be perceived as attempting to force the FAA into quicker action.
In January 2020, Boeing targeted mid-2020 for recertification, but the FAA expressed that it was "pleased" with progress made and may approve the aircraft sooner within the United States.
In February 2020, the FAA explained why the agency waited for empirical evidence to draw a common link to the crashes before grounding the airplane. It also set out the remaining steps in the process to ungrounding the aircraft: after remaining minor issues are resolved, a certification flight will be conducted and flight data will be assessed. Operational validation, including assessment of Boeing's training proposals by international and U.S. crews, as well as by the FAA administrator and his deputy in person, will then proceed, followed by documentation steps. The grounding order is expected to be rescinded no less than 30 days after the certification flight, though the FAA stressed again that it was working to a process, not a timeline. U.S. airlines will then need to obtain FAA approval for their training programs. Each aircraft will be issued with an airworthiness certificate and will be required to conduct a validation flight without passengers.
In February 2020, the FAA said it would issue an airworthiness directive requiring to perform "enhanced inspections and fixes to portions of an outside panel that helps protect the engines on Boeing's 737 Max from lightning strikes".
Boeing conducted numerous test flights in 2020, before a series of FAA recertification flights from June 28 to July 1, 2020. These were performed by a 737 MAX 7, flying from Boeing Field, Seattle, to Boeing's test facilities at Moses Lake and back.
EASA
The EASA and Transport Canada announced they will independently verify FAA recertification of the 737 MAX.For product certifications, the EASA is already in the process of significantly changing its approach to the definition of Level of Involvement with Design Organisations. Based on an assessment of risk, an applicant makes a proposal for the Agency's involvement "in the verification of the compliance demonstration activities and data". EASA considers the applicant's proposal in determining its LOI.
In a letter sent to the FAA on April 1, 2019, EASA stated four conditions for recertification: "1. Design changes proposed by Boeing are EASA approved 2. Additional and broader independent design review has been satisfactorily completed by EASA 3. Accidents of JT610 and ET302 are deemed sufficiently understood 4. B737 MAX flight crews have been adequately trained."
In a May 22 statement, the EASA reaffirmed the need to independently certify the 737 MAX software and pilot training. In addition to system analysis mentioned above, EASA raised concerns with the autopilot not engaging or disengaging upon request, or that the manual trim wheel is electronically counteracted upon, or requires substantial physical force to overcome the aerodynamic effects in flight.
In September 2019, the European Union received parliamentary questions for written answers about the independent testing and re-certification of critical parts of the Boeing 737 MAX by the EASA:
EASA stated it was satisfied with changes to the flight control computer architecture; improved crew procedures and training are considered a simplification but still work in progress; the integrity of the angle of attack system is still not appropriately covered by Boeing's response. The EASA recommends a flight test to evaluate aircraft performance with and without the MCAS. EASA said it will send its own test pilots and engineers to fly certification flight tests of the modified 737 MAX. EASA also said it prefers a design that takes readings from three independent Angle of Attack sensors. EASA's leaders want Boeing and the FAA to commit for longer-term safety enhancements. Mr. Ky is said to seek a third source of the angle of attack. EASA is contemplating the installation of a third sensor or equivalent system at a later stage, once the planes return to service.
- Could the Commission confirm whether these tests will extend beyond the MCAS flight software issue to the real problem of the aerodynamic instability flaw which the MCAS software was created to address?
- Does the Commission have concerns about the limited scope of the FAA's investigation into the fatal loss of control, and is EASA basing its re-certification of the 737 Max on that investigation?
- What assurances can the Commission give that the de facto delegation of critical elements of aircraft certification to the same company that designed and built the aircraft, and the practice of delegated oversight, does not exist in Europe?
On 18 October, EASA Executive Director Patrick Ky said: "For me it is going to be the beginning of next year, if everything goes well. As far as we know today, we have planned for our flight tests to take place in mid-December which means decisions on a return to service for January, on our side".
Other authorities
Canada accepted FAA's MAX certification in June 2017 under a bilateral agreement. However, Canadian Minister of Transport Garneau said in March 2019, that Transport Canada will do its own certification of Boeing's software update "even if it's certified by the FAA.". On October 4, 2019, the head of civil aviation for Transport Canada, said that global regulators are considering the requirements for the 737 MAX to fly again, weighing in the "startle factors" that can overwhelm pilots lacking sufficient exposure in simulation scenarios. He also said that Transport Canada raised questions over the architecture of the angle of attack system. On November 19, 2019, an engineering manager in aircraft integration and safety assessment at Transport Canada emailed FAA, EASA and Brazil's National Civil Aviation Agency, calling for removal of key software from the 737 MAX by stating "The only way I see moving forward at this point is that Boeing's MCAS system has to go," although the views were at the working level and had not been subject to systematic review by Transport Canada.India's regulator DGCA will conduct its own validation tests of the MAX before authorizing it in India's airspace. Arun Kumar, Director General of DGCA, said India will adopt a "wait and watch" policy and not hurry to reauthorize the plane to fly. He also said an independent validation will be performed to ensure safety and MAX pilots will have to train on a simulator. India's SpiceJet has already received 13 MAX jets and has 155 more on order.
The UAE's director general of the General Civil Aviation Authority, Said Mohammed al-Suwaidi, announced GCAA will conduct its own assessment, rather than follow the FAA. The UAE regulator had yet not seen Boeing's fixes in detail. He did not expect the 737 MAX to be back in service in 2019.
Australia's Civil Aviation Safety Authority said that the FAA decision would be an important factor in allowing the MAX to fly, but CASA will make its own decision. In October 2019 SilkAir flew its six 737 MAXs from Singapore to Alice Springs Airport for storage during Singapore's wet season.
According to the first Brazil's government statement on the MAX issue, the National Civil Aviation Agency of Brazil has been working closely with the FAA on getting the airplane back into service by the end of 2019. It is worth noting that Brazil's largest domestic airline, Gol Transportes Aéreos, is a major MAX customer with an order over 100 aircraft.
Certification activities
In early October 2019, CEO Muilenburg said that Boeing's own test pilots had completed more than 700 flights with the MAX. As of October 28, Boeing had conducted "over 800 test and production flights with the updated MCAS software, totaling more than 1,500 hours".Certification flight tests, because of the ongoing safety review, are unlikely before November.
Boeing made "dry runs" of the certification test flights on October 17, 2019.
In December 2019, The Air Current reported on pilots attempting the procedure with "inconsistent, confusing" results.
The FAA has identified new risks of failure during thorough testing. As a result, Boeing will make the overall flight-control computer more redundant and both computers will operate on each flight instead of alternating between flights. The planes were said to be unlikely to resume operations until 2020. On October 8, Boeing was fixing a flaw discovered in the redundant-computer architecture of the 737 MAX flight-control system.
, the FAA and the EASA were still reviewing changes to the MAX software, raising questions about the return to service forecast. The FAA will review Boeing's "final system description", which specifies the architecture of the flight control system and the changes that Boeing have made, and perform an "integrated system safety analysis"; the updated avionics will be assessed for pilot workload. The FAA is specifically looking at six "non-normal" checklists that could be resequenced or changed. The assessment of these checklists with pilots could happen at the end of October, according to an optimistic forecast.
Final simulator-based assessments are expected to start in November. On October 22, FAA Administrator Steve Dickson said in news conference that the agency has received the "final software load" and "complete system description" of revisions; several weeks of work are anticipated for certification activities.
As of mid-November 2019, Boeing still needed to complete an audit of its software documentation. A key certification test flight will follow the audit. In a memo and a video dated November 14, FAA's Steve Dickson instructed his staff to "take whatever time is needed" in their review, repeating that approval is "not guided by a calendar or schedule."
On December 6, 2019, the FAA posted an updated Master minimum equipment list for the 737 MAX; in particular, both flight computers must be operational before flight, as they now compare each other's sensors prior to activating MCAS. In April 2020, the second revision to the list removed several exemptions and fault tolerances to ensure greater availability of the aircraft's redundant systems.
Other issues discovered during the grounding
At the request of the FAA, Boeing audited key systems on the MAX. In January 2020, Boeing discovered that electrical wiring bundles were too close together and could cause a short circuit that could theoretically lead to a runaway stabilizer. The EASA wants the wiring fixed on all 400 grounded aircraft and future deliveries. Boeing and the FAA disagreed with EASA at first, but the FAA said to Boeing in March 2020 that the wiring is not compliant.A manufacturing fault was also found to have affected the lightning protection foil on two panels covering the engine pylons on certain MAX aircraft manufactured between February 2018 and June 2019. On February 26, 2020, the FAA has proposed a corresponding airworthiness directive to mandate repairs to all affected aircraft.
In January 2020, the FAA proposed a $5.4 million fine against Boeing for installing nonconforming slat tracks. The tracks are used to guide the movement of slats, which are panels located on the leading edge of aircraft's wings for additional lift during take-off and landing. Boeing's supplier did not comply with aviation regulations nor with Boeing's quality assurance system. Boeing is alleged to have issued airworthiness certificates for 178 MAX aircraft despite knowing that the slat tracks had failed a strength test.
In February 2020, traces of debris were discovered within the fuel tanks of aircraft produced during the groundings.
Projections
Financial analysts forecast a jet surplus that could result when the MAX does return to service; new aircraft will be delivered while airlines move stand-in aircraft back into storage.Boeing initially hoped that flights could resume by July 2019; by June 3, CEO Dennis Muilenburg expected to have the planes flying by the end of 2019 but declined to provide a timeline. On July 18, Boeing reaffirmed Muilenburg's prediction, hoping to return the MAX to flight during the fourth quarter of 2019. Boeing indicated that this was its best estimate and that the date could still slip.
By July 2019, United Airlines purchased 19 used 737-700s to fill in for MAX aircraft, to be delivered in December 2019. United had expected to receive 30 MAX aircraft by the end of 2019 and a further 28 in 2020.
In September 2019, Boeing CEO Dennis Muilenburg stated that the MAX might return in phases around the world due to the current state of regulatory divide on approving the airplane. Later that same month Boeing told its suppliers that the plane could return to service by November. On November 11, 2019, the company stated that deliveries would resume in December 2019 and commercial flights in January 2020. In January 2020, Boeing said it was not expecting the airplane's recertification until mid 2020.
On January 14, 2020, American Airlines cancelled more of its MAX flights until June 3. On January 16, Southwest Airlines removed the MAX from its schedule until June 6, to allow pilots to spend time in simulators as newly recommended. On January 22, United Airlines announced that it was not expecting to return the MAX to service until after the peak summer season.
By late April, Southwest Airlines had removed the MAX from its schedule until October 30, based on Boeing's "recent communication on the MAX return to service date". Boeing hoped to obtain regulatory approval in August, though that could be pushed back to the fall according to sources.