By Steven P. Bradford
Following crashes of Lion Air Flight 610 and Ethiopian Airlines Flight 302, the Federal Aviation Administration (“FAA”) issued an Emergency Order grounding Boeing 737-8 and -9 (“Boeing MAX”) aircraft.[1] The order was rescinded on November 18, 2020, allowing Boeing MAX aircraft to resume flight operations once airlines complete prescribed corrective actions to remedy the system identified as the common cause in the two accidents.[2] While detecting and rectifying the faulty system will prevent future mishaps, it is incumbent upon rule-makers to identify processes that allowed a faulty system to be certified.
In developing a fuel-efficient replacement for the 737,[3] Boeing filed patent applications in 2009 for a new aircraft design with an elliptically-shaped fuselage.[4] In 2010, Boeing’s primary competitor, Airbus, unveiled fuel-efficient engines for incorporation onto existing airframes.[5] Anxious that Airbus would corner the market on fuel-efficient aircraft, Boeing pivoted to modify its 737 design rather than design a new aircraft.[6] This strategy saved time in the design process, and shortened the certification timetable.[7] Certification of new designs can take up to nine years,[8] but amended type certificates, granted to aircraft modified from already certified designs,[9] takes three to five years.[10] Boeing did not have time to design and certify a new aircraft with an elliptically-shaped fuselage; rather, Boeing had to modify its existing 737 design and pursue an amended type certificate to remain competitive.[11] To further expedite the certification process, Boeing made use of a program authorized by federal statute called Organization Designation Authorization (“ODA”), which aims to increase efficiency and decrease FAA workload[12] by delegating aspects of the certification process to external organizations, including the manufacturer.[13]
As a result, the Boeing MAX received an amended type certificate in March 2017,[14] only a year after Airbus’s fuel-efficient aircraft entered service.[15] However, this shortened process contributed to the crash of two aircraft in two years of flight operations. Investigations identified multiple factors contributing to the mishaps, including the amended type certification process.[16] This incident raised the question: at what point do amendments to an existing design become so significant that the aircraft should be treated as a new design?[17]
New type certificates are required if “the FAA finds that the proposed change in design . . . is so extensive that a substantially complete investigation of compliance with the applicable regulations is required.”[18] Conversely, the Changed Product Rule authorizes the granting of amended type certificates if the FAA determines changes are not significant.”[19] Significant changes are those where the general aircraft configuration is not retained, or assumptions used in the previous certification are no longer valid.[20] To clarify this nebulous standard, the FAA published a non-exhaustive list of significant versus non-significant changes.[21] However, federal regulation still does not clearly distinguish significant from non-significant, or delineate between amendments and new designs. In fact, representatives from the FAA, NASA, and civil aviation authorities from several countries found that “there are no criteria for determining when the core attributes of an existing design make it fundamentally incapable of supporting [] advancements . . . and therefore warrant consideration of a . . . certification under a new type certificate.”[22]
Determining whether a change is significant is further complicated by the ODA program, delegating aspects of certification to the manufacturer. Here, the FAA delegated to Boeing testing of the Maneuvering Characteristics Augmentation System (MCAS) integrated into the flight controls, later found to be responsible for the Lion Air and Ethiopian Airlines accidents.[23] As MCAS proceeded through certification at Boeing, it was tweaked, made more robust, and given greater authority to move flight control surfaces without pilot input.[24] However, communication between Boeing working groups and with the FAA was so poor that the FAA did not fully understand the extent of changes made to MCAS since it was first disclosed, nor the authority it had over flight control surfaces.[25] Had the FAA been aware of MCAS’s ultimate capabilities, it likely would have required additional evaluation.[26] Simply put, poor communication left the FAA unaware of the MCAS capabilities and unable to accurately determine whether its inclusion in Boeing MAX aircraft constituted a significant change from previous 737s. While ODA programs are not inherently flawed,[27] poor communication and institutional pressure impaired the decision making of ODA representatives tasked with certifying systems and components on behalf of the FAA.[28]
The proposed Aircraft Certification Reform and Accountability Act seeks to better define what constitutes a significant change. The act asks the FAA to weigh whether modifications to flight control systems should preclude the issuance of an amended type certificate,[29] essentially asking if all flight controls modifications should be classified as “significant” changes. The act directs the FAA to “improve the process of issuing amended type certificates,”[30] but does not mandate specific procedural changes. While acknowledging clarification is necessary, the FAA stated that future research and coordination is required before making any changes to certification policy.[31] Therefore, changes to 14 C.F.R Subpart B governing certifications are still several years away, based on timelines set forth in the proposed act.[32] Much of the act discusses cultural changes to the FAA and aircraft manufacturers in an effort to foster greater collaboration between working groups, urging a holistic approach to aircraft design to understand how changes to one system will affect other systems. In addition to cultural changes, the support the act has received thus far, as well as congressional and FAA finding detailed in reports written after the grounding of Boeing MAX aircraft, procedural changes to the certification process should be anticipated in the future.
[1] U.S. Dep’t of Transp., FAA Emergency Order of Prohibition 2 (Mar. 13, 2019), https://www.faa.gov/news/updates/media/Emergency_Order.pdf.
[2] U.S. Dep’t of Transp., FAA Recission of Emergency Order of Prohibition 1–2 (Nov. 18, 2020) https://www.faa.gov/foia/electronic_reading_room/boeing_reading_room/media/737_MAX_Rescission_of_Grounding_Order.pdf. See also Airworthiness Directives; The Boeing Company Airplanes, 85 Fed. Reg. 47698 (Aug. 6, 2020) (to be codified at 14 C.F.R. pt. 39); FAA Notice 8900.570, at 2 (Nov. 18, 2020), https://www.faa.gov/documentLibrary/media/Notice/N_8900.570_FAAWeb.pdf.
[3] Boeing Firms Up 737 Replacement Studies by Appointing Team, Flight Global (Mar. 3, 2006), https://www.flightglobal.com/boeing-firms-up-737-replacement-studies-by-appointing-team/66022.article.
[4] U.S. Patent Application No. 12/624,322 (filed Nov. 23, 2009).
[5] Press Release, Airbus, Airbus offers new fuel saving engine options for A320 Family (Dec. 1, 2010), https://www.airbus.com/newsroom/press-releases/en/2010/12/airbus-offers-new-fuel-saving-engine-options-for-a320-family.html.
[6] Darryl Campbell, Redline: The many human errors that brought down the Boeing 737 Max, The Verge (May 2, 2019), https://www.theverge.com/2019/5/2/18518176/boeing-737-max-crash-problems-human-error-mcas-faa.
[7] Id. See generally 49 U.S.C. § 44704(a) (outlining requirements for type certificates).
[8] Airworthiness Certification, FAA (Dec. 6, 2019), https://www.faa.gov/aircraft/air_cert/airworthiness_certification/.
[9] Amended Type Certificate, FAA (Aug. 10, 2011), https://www.faa.gov/aircraft/air_cert/design_approvals/amend_tc/; FAA Order No. 8110.4C ch. 6, at 87 (Oct. 12, 2005), https://www.faa.gov/documentLibrary/media/Order/FAA_Order_8110_4C_Chg_6.pdf.
[10] Airworthiness Certification, supra note 8.
[11]Campbell, supra note 6.
[12] FAA Order 8100.15A (June 10, 2011), https://www.faa.gov/documentLibrary/media/Order/8100.15A.pdf.
[13] See 49 U.S.C. § 44702(d).
[14] Press Release, Boeing, Boeing 737 MAX 8 Earns FAA Certification (Mar. 9, 2017), https://boeing.mediaroom.com/2017-03-09-Boeing-737-MAX-8-Earns-FAA-Certification; Firdaus Hashim, Malindo Operates World’s First 737 Max Flight, Flight Global (May 22, 2017), https://www.flightglobal.com/malindo-operates-worlds-first-737-max-flight/124109.article.
[15] Andreas Spaeth, Onboard Lufthansa’s First Airbus A320neo Flight, Airways Magazine (Jan. 25, 2016), https://airwaysmag.com/traveler/lufthansa-first-airbus-a320neo-flight/.
[16] Staff of H. Comm. on Trans. and Infrastructure, 116th Cong., The Design, Development, & Certification of the Boeing 737 MAX 12–14 (2020), https://transportation.house.gov/imo/media/doc/2020.09.15%20FINAL%20737%20MAX%20Report%20for%20Public%20Release.pdf.
[17] See id. at 43–45.
[18] 14 C.F.R. § 21.19 (2020).
[19] 14 C.F.R. § 21.101 (2020); see Joint Auths. Tech. Rev., Boeing 737 MAX Flight Control System Observations, Findings, and Recommendations 6–11 (2019) (referring to the applicable sections of the C.F.R. as the Changed Product Rule).
[20] 14 C.F.R. §21.101(b)(1); FAA Order 8110.48A, at 4-2 (July 21, 2017), https://www.faa.gov/documentLibrary/media/Order/FAA_Order_8110_48A.pdf.
[21] FAA Advisory Circular 21.101-1B appx. A. (Mar. 11, 2016) https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_21.101-1B.pdf.
[22] Joint Auths. Tech. Rev., supra note 19, at 7.
[23] Id. at 26. A description of the system implicated in the two mishaps exceeds the scope of this discussion. However, for a brief, non-technical overview of the Maneuvering Characteristics Augmentation System (MCAS) identified by the FAA as the common cause of the Lion Air and Ethiopian Airlines accidents, its intended function, interaction with pilot inputs, and its effects on flight characteristics, see Campbell, supra note 6.
[24] Staff of H. Comm. on Trans. and Infrastructure, supra note 16, at 103; Jack Nicas et al., Boeing Built Deadly Assumptions in 737 Max, Blind to a Late Design Change, N.Y. Times (June 1, 2019), https://www.nytimes.com/2019/06/01/business/boeing-737-max-crash.html (noting that when initially designed, MCAS could only move the stabilizer approximately 0.6 degrees, but when certified, MCAS could move the stabilizer up to 2.5 degrees).
[25] Joint Auths. Tech. Rev., supra note 19, at 13–14.
[26] Id. at 13–14, 23–24.
[27] Joint Auths. Tech. Rev., supra note 19, at VII (noting that the act of delegating testing and evaluation to industry representatives is a well-established practice for the majority of civil aviation administrative bodies around the world).
[28] Id. at VII; Staff of H. Comm. on Trans. and Infrastructure, supra note 16, at 56–84 (discussing FAA oversight of the certification process and delegation of authority to Boeing).
[29] Aircraft Certification Reform and Accountability Act, H.R. 8408, 116th Cong. § 18(b)(3) (2020).
[30] H.R. 8408 § 18(b)(2) (2020).
[31] FAA, Summary of the FAA’s Review of the Boeing 737 MAX: Return to Service of the Boeing 737 MAX Aircraft 75 (2020), https://www.faa.gov/foia/electronic_reading_room/boeing_reading_room/media/737_RTS_Summary.pdf.
[32] H.R. 8408 § 18(b) (2020) (setting a deadline of 18 months after enactment for the FAA to submit a report to Congress regarding amended type certificates, and 24 months to improve the process of issuing amended type certificates).
Post Image: Undelivered Boeing 737 MAX aircraft that were grounded by aviation agencies, seen at parking lot at Boeing Field in Seattle, Washington, in April 2019. Via Wikimedia Commons.