Building Safe Airplanes

Just this year IATA has made reference to “patchwork of measures”, a “patchwork of confusing or even contradictory requirements” and the “patchwork of local rules and regulations”.

Patchwork is again front and centre in the ongoing crisis with the Boeing 737 MAX, most immediately is its return to service: EASA will not lift the MAX’s grounding without conducting its own analysis, instead of reviewing the FAA’s work. The world’s two preeminent safety authorities will have different timelines for putting the MAX back in the air. This is not entirely unprecedented — the Douglas DC-10 comes to mind — but it is problematic nonetheless.

Thus the patchwork: do airlines that normally adhere to FAA standards instead wait for EASA, out of cohesion, an abundance of caution, or to placate the public? What do airlines and authorities outside of the US and EU do?

As problematic as this division may be for the MAX’s return to service, the wider consequences are even more troubling.

Most worrisome are the long-term implications for the global regulatory order, relations between regulators and changes to wider commercial aviation as a result of the MAX. To describe this outcome, “patchwork” is an understatement: it will be a fracture, a fragmentation.

Amongst the failures in the MAX saga was disregarding a key industry principle: redundancy. For the aircraft, MCAS took inputs from only one angle-of-attack sensor. Boeing has since made MCAS dependent on two sensors to prevent MCAS activating based off one faulty sensor. For aviation, aircraft have only been certified from one authority.

The extreme scenario is that aircraft in the future will have to be independently certified by multiple authorities. But the ideological arguments in favour of expanding certification oversight are undermined by the practical: there is not enough regulatory capacity for authorities to certify other aircraft manufactured and presently regulated in countries not under their jurisdiction. EASA, for the MAX certification, was a validating authority, which by definition means it examines only certain aspects: engines, for example.

Worse, it doesn’t even seem that regulators have sufficient resources to certify aircraft currently under their own purview. Regulators are under-funded and have to woo expertise that could make substantially more in the private sector, from systems engineering to aircraft pilots – professions that are already facing their own shortages despite favourable stability and income.

The FAA’s “resource shortfalls…. may have contributed to an inadequate number of FAA specialists being involved in the B737 MAX certification program,” stated the Joint Authorities Technical Review, a non-binding report from international regulators completed in October 2019.

The JATR called for the FAA to ensure it has “sufficient number of experienced specialists” and that “decisions to retain responsibility for finding compliance are not constrained by a lack of experienced engineers”.

The extreme scenario is that aircraft in the future will have to be independently certified by multiple authorities…

THE DIGITAL REVOLUTION AND THE INTERNET OF PLANES MEANS THAT CERTIFICATION REQUIRES NEW SKILLS

Exacerbating the problem is the growing complexity of aircraft as they evolve from mechanical machines to digital devices, although still relatively simple in the larger scheme of computing. People will again be in short supply. Google, Facebook and any number of other companies pay more for coders. Their workplace amenities and flexible hours foster a freewheeling corporate culture that makes aerospace’s traditional engineering companies appear stuffy.

Regulatory challenges do not excuse Boeing and the MAX, but oversight is in the spotlight given the extensive self-certification the FAA allowed Boeing. This is a non-starter for a public — and a substantial part of the industry — that thinks there should be a firm division between the regulator and the regulated.

US Senator Richard Blumenthal likened the Boeing-FAA relationship to “the fox guarding the henhouse”. Yet even outside of Boeing and the FAA there is a view that self-certification is not inherently flawed. “With adequate FAA engagement and oversight, the extent of delegation does not in itself compromise safety,” the JATR said.

Unsaid is that self-certification may be inevitable from a staffing perspective, and further challenged by costs. Deputy FAA administrator Daniel Elwell, previously the agency’s acting administrator, told a March US Senate hearing that ending self-certification would require an additional 10,000 employees and $1.8 billion in funding to the certification office’s current 1,300 employees and $239 million budget. The FAA’s total annual budget — already a political hostage — has been around $18 billion.

It is the same view at EASA. “We cannot afford to go through every single line of source code,” EASA executive director Patrick Ky told Aviation Week, adding: “Honestly, we don’t have the resources, and we don’t want to recertify all the US products. Boeing is one thing, but there are hundreds of U.S. products that we would then have to certify and validate.”

Aircraft certification cannot be fully duplicated or even triplicated, but certifying authorities can be expected to play a larger role in overseeing other authorities’ certifications. External presence invites criticism that a particular focus, disagreement or rejection becomes politically motivated. This is further challenged since external authorities will only be able to focus on some aspects of certification, and those parts could vary from programme to programme, giving the impression of inconsistency for ulterior motives.

The pessimists would identify the typical division as the FAA being linked with Boeing and US politics, and EASA affiliated with Airbus and EU-level and nation-level politics. Boeing’s effective takeover of Embraer’s commercial division and the winding down of Bombardier’s civil aircraft reduces potential combinations of conflict.

CHINA’S AVIATION INDUSTRY, AND ITS GROWING CERTIFYING AUTHORITY, ADDS A NEW ELEMENT

The MAX saga has so far publicly involved FAA and EASA. Unclear is the role of China’s CAAC, which on a Sunday convened to ground the MAX — the first authority to do so.. At the time of the grounding, China had the largest pool of in-service MAXs.

CAAC will continue its rise as a regulator and certifying body with the upcoming Comac C919, which China expects other authorities will approve — not for political reasons but for genuine competency and safety. Russia’s regulatory presence can be expected to also rise, but not as prominently as China’s. More distant is the joint Sino-Russian widebody C929.

A growing CAAC oversight would be commensurate with China’s objective to be a world leader by having a role in global institutions and practices, where it has historically been underrepresented. In aviation that has already begun to manifest itself with former CAAC director Fang Liu being elected and reelected Secretary General of ICAO.

There is a notion that FAA, EASA or CAAC stepping up oversight of other programme certifications will inevitably raise the matter of politics and conflict of interest. To counter that, some would like to see an empowered neutral regulator.

Canada has long been perceived as a neutral party. Despite vested economic interest and geographical proximity to the US, Canada has stood up to the US on aviation matters. Although in the early days of the MAX grounding Canada initially supported the FAA, additional information saw it break rank and later voice disagreement with the FAA.

Although not a safety matter, Canada was the target of Boeing’s WTO complaint against the Bombardier C Series (now Airbus A220). Canada has intrinsic bridging capability between the FAA and EASA since Canada has dual national languages of English and French, although EASA’s predominant working language is English.

Brexit will see the UK CAA become larger in size and function since it cannot rely on EASA for certain capabilities. The CAA received plaudits for mounting 2019’s repatriation of Thomas Cook passengers, although many, including Ryanair CEO Michael O’Leary, question why this was done at taxpayer expense. Nonetheless, it shows the CAA evolving responsibilities, although the Thomas Cook repatriation was a social initiative and not about safety oversight.

Brexit’s potential empowerment of the CAA also saddles it with the task to rapidly ramp up its workforce and oversight of baseline matters. It may be some time before the CAA can consider a broader remit.

Australia gained recognition and further credibility for its role in leading the extended search for missing Malaysia Airlines flight MH370. It is asked if Australia’s CASA could take a broader role in oversight, but as with most countries there are human and financial resources hurdles.

At the same time as this fracture amongst the largest regulators, fragmentation is expected at a regional level. Initially this may be more out of onus than policy. Consider Singapore and the United Arab Emirates, respectively home to SilkAir with 37 737 MAX orders and flydubai with 250 orders. All of their flights are international and most will overfly airspace from multiple countries. Destination and overflight countries will observe the major regulators, but may also be encouraged by Singapore and the UAE providing more confidence about the MAX’s safety.

Philosophically this makes for nice regional cohesion, but has the practical impact of ensuring MAXs do not face restrictions or different policies – the patchwork. More long-term, any uncertainty about global regulators may see a state call upon the larger authority in its region.

At the extreme end of fragmentation is the United States’ Broward county, home to Fort Lauderdale-Hollywood International Airport. Before the FAA grounding last March, Mayor Mark Bogen wanted to ban MAX flights at the airport or at least publicise — and infer — danger.

“If we can’t legally stop the aircraft from landing here in Fort Lauderdale, then I’ve asked the County Attorney to amend our contracts with airlines flying the jet, and I want warning signs placed at terminal gates so passengers will know they’re boarding this type of aircraft,” he said.

This too easily comes across as small town politics. To take the argument at face value: even Bogen acknowledges legal uncertainty about his idea, but could it be similar to California requiring products sold in its state to disclose ingredients that are potentially harmful?

Bogen was back in the headlines in November, this time saying he would contact Boeing and give them a list of repairs including the ability to turn off MCAS. Bogen is a one-man task force and still determined to have Boeing make changes: “If they don’t, I am going to go to my commissioners. I am going to go to other mayors, as well, of other cities and seek to ban that plane,” he told NBC. “We will do whatever we can within our power to seek that plane from not landing at the airport here in Fort Lauderdale.”

By then the FAA weighed in, saying: “If an airport restricts certain aircraft or operations when the Federal Aviation Administration (FAA) has determined those to be safe, that action would violate federal law.” That appears to be the police putting the mall cop in his place, but the risk is this very discord occurring publicly and Bogen’s inferred distrust with the FAA. The other side of the argument is that regulators and standard practices need to be challenged. Does aviation need more Mayor Bogens? Should the mall cop spend a day running special forces? And how should aviation respond to this kind of media narrative?

Any uncertainty about global regulators may see a state call upon the larger authority in its region…

GRANDFATHERED VARIANT CERTIFICATION IS RECEIVING SUBSTANTIAL SCRUTINY

The MAX shows the commercial pressure on certifying authorities. It leaves a legacy that accepted practices may need to be re-evaluated while previously unconsidered areas be questioned. This applies to aircraft certification but also daily operations.

The biggest conversation is about airframers producing aircraft variants whose certification can be grandfathered based on previous approval, as was the MAX, which piggybacked on 737 NG certification, which used previous 737 certification. This has been extrapolated to an argument that Boeing lost its engineering-led focus to instead concentrate on maximising shareholder return and growing the stock price to the benefit of management. The best way to achieve that, the argument goes, is to shun new aircraft developments and instead produce derivatives.

Whichever way that corporate debate is assessed, the regulatory system failed. Derivative designs should not inherently have reduced safety or be put through a less rigorous certification. There is an argument derivatives are at least partly favoured for their easier and cheaper certification, but the certification process is only one part of total research and development costs. A new aircraft takes longer to design, however, and it is more expensive to establish the supply chain and final assembly.

The derivative debate has occurred before, but for the wrong reason: commercial implications over safety practicality. It is a typical example of aviation calling for a “level playing field” by reducing everyone to the lowest common denominator rather than fix structural differences to create a stronger outcome for all.

Airbus in the 1990s lobbied the since disbanded European Joint Aviation Authorities to decline grandfather rights to the 737 NG, or at least consider having the A320 family held to the same lower grandfathered standard as the 737.

One contentious item was the A320 conforming to the requirement for a two second “thinking time” built into V1 takeoff decision speeds whereas the 737 NG, using grandfathered rights, could have a one second time, as Flight International wrote in 1995.

Airbus at the time argued that in some scenarios the one second difference could impose payload restrictions and require the A319 to have fewer seats than the 737-700. Airbus told Flight International it would consider asking for the lower V1 thinking time. “We believe that this is fair play, not only for us, but for the passengers,” Philippe Jarry, then Airbus vice president of marketing, said.

Derivative designs should not inherently have reduced safety…

Cross-regulatory influence has resulted in physical changes. JAA pressure saw the 737 NG’s overwing exits redesigned to swing outwards and upwards instead of older models where the hatch has to be removed and placed in the cabin, which could slow or impede evacuation. The redesign allowed the 737-800 to carry 189 passengers whereas the Airbus equivalent, the A320, at the time was certified to 180 despite having wider overwing and main door exits.

The JAA in the 1980s disagreed with the FAA allowing grandfather certification for the 747-400’s upper deck floor, which the JAA wanted strengthened to protect the flight control cables that run through it, according to a 1996 Flight article that said 747-400s registered in Europe ended up having a strengthened upper deck floor.

There is historical precedent for external authorities to shape original aircraft design, extending their reach beyond grandfathering debates. A singular force was David “DP” Davies, who for 33 years was the chief test pilot for the UK, or as The Times referenced, “the test pilots’ test pilot”. Amongst his legacies is influencing Boeing in mid-production to extend the 707’s fin by 36 inches, and retrofit existing aircraft. Davies also battled Britain’s Air Registration Board for automatic stick-shakers on the 727.

Davies brought global change, but his remit – to assess aircraft entering the British register – meant he was not involved in early phases of aircraft development. Even the certifying authority is not heavily engaged during the design process, something that FAA administrator Stephen Dickson is considering changing.

“The current approach is: you’re answering all these questions and then it’s, ‘OK FAA, here’s my final exam. Grade my paper,’” he told the Wall Street Journal. Dickson sees potential to evolve from a “transactional” regulatory approach to “holistic” in which the regulator talks with aircraft developers during the design process: more a PhD supervisor guiding students.

Dickson will not go into regulatory overhaul details until the MAX is back in the air, the Journal said. But the notion of earlier communication was a recommendation of the Joint Authorities Technical Review. Its fourth of twelve recommendations calls for “early FAA involvement to ensure the FAA is aware of all design assumptions, the aircraft design, and all changes to the design”. The recommendation also suggests “feedback paths…throughout its development and certification”, which overlaps with Dickson’s call for dialogue during design and not just certification.

There was “undue pressure” on Boeing’s in-house certifying unit, assigned under FAA Organization Designation Authorization, according to the JATR, which does not state the cause of the pressure. But there are larger concerns that airframers and airlines are exerting pressure on regulators for commercial reasons, and that the regulators are not standing up to them.

The JATR recommends removing undue pressure in the Boeing Organisational Design Approval, although this is a narrow recommendation confined by the JATR’s scope. The MAX saga may be the impetus for regulators to more closely analyse or even fight commercial pressure.

Airline management may quietly concede that for a greater safety buffer, pilots should not be certified on different, even if similar, aircraft variants. But since regulators have approved commonality, airlines will use it to their advantage, and are already: Airbus operators are cross-fleeting pilots and crew between widebodies and also to the A320 narrowbody families.

Most recently, a cornerstone of the Air France-KLM management plan was fleet simplification based on what a presentation said was a “common pilot type rating” that would reduce Air France from “nine cockpits” to “five to seven cockpits” and KLM from five to three. This would also bring efficiency to spare parts and scheduling, but only pilots were mentioned.

Even the certifying authority is not heavily engaged during the design process…

FUNDAMENTALLY, REGULATIONS HAVE TO TAKE HUMAN FACTORS INTO ACCOUNT — AT ALL TIMES

A key flaw with the MAX is that it was essentially designed for a super-human pilot that, if he or she even exists, is not reflective of the typical pilot. Heavy aircraft performance would make it difficult or even impossible to counter certain MAX scenarios since incredible force was needed to pull up the control column or turn the stabiliser trim wheel.

These actions were necessary in a chaotic flight deck environment, the result of the specific scenarios but also from aircraft becoming more complicated and producing a higher and perhaps insurmountable workload. The JATR made repeated calls for flight deck, human factors and human system integration to be a part of aircraft design and development, and for the FAA to increase its experts in this area.

The regulatory system may have to consider pressure in ways it has not before. The industry is changing. Does growing competition and resulting financial pressure lead to unacceptably short turnaround times to inspect aircraft, or create pressure to hasten any fix? With more of the world’s fleet not covered by in-house MRO, is maintenance adequate? EASA’s executive director Patrick Ky sees ICAO taking the lead on correcting weaknesses at some pilot training schools.

Pressure from airlines can be in the other direction: to ensure safety. Emirates President Tim Clark met with the FAA’s Dickson about certification for the 777X, of which Emirates has orders for 126, making it the largest customer. “I want one aircraft to go through hell on Earth, basically, to make sure it all works,” Clark said after meeting with Dickson.

Clark also said: “The FAA will take its time and do it the way it wants to do it rather than being guided by the manufacturer.” Yet his statement could be seen as a forewarning for the FAA and Boeing to have the right regulator-regulated relationship.

More than any other airline executive, Clark speaks candidly about technical and engineering developments and is often seen as a voice of reason. It is unclear if Emirates’ regulator in the UAE, the GCAA, accompanied Clark in his meeting with Dickson, and how common it is for airlines to directly meet with a foreign regulator about aircraft certification. This is not to fault Clark’s meeting but show perhaps another square in the patchwork of the regulatory sphere with an airline so publicly weighing in.

A successful outcome of lessons learned from the MAX is not just about fixing the MAX to the point, as some argue, that it will be the world’s safest aircraft. The result also has to be improvements to the regulatory system that will prevent untold crashes although that will never be known or quantified.

There is considerable work ahead over a long time, arguments to be had, pushbacks and patchworks. Yet for most of the public, a successful regulatory system is never apparent. It is thankless. It is, nonetheless, vital.