Aviation: manufacturer - regulator relationship in the spotlight
In the days since the crash of Ethiopian Airlines flight 302, attention has rightly focused on the aircraft involved, a Boeing 737-MAX8. The MAX8 has a system known as MCAS (Maneuvering Characteristics Augmentation System), which has been implicated in last year's loss of Lion Air flight JT610 in Indonesia and questions are being asked about whether it was a factor in the Ethiopian tragedy too. The Aviation Oracle's recent story - 737-MAX - a story as strange as fiction - looks at MCAS and explains why it was implemented in layman's terms.
However, after investigations into ET302 got underway concerns were raised about the relationship between Boeing and the Federal Aviation Authority, the US Government agency that signs-off the certification of all airliners built in the country. Indeed, these concerns have become so intense that the US Department of Transportation has requested an audit of the certification of the Boeing 737-MAX8. US transportation secretary Elaine Chao said in a memo to the DoT: "To help inform the Department's decision making and to help the FAA in ensuring its safety procedures are implemented effectively, this is to confirm my request that the Office of Inspector General proceed with an audit to compile an objective and detailed factual history of the activities that resulted in the certification of the Boeing 737 Max 8 aircraft."
Meanwhile European and Canadian authorities have said they too will seek assurances over the safety of the 737-MAX.
Aviation authorities are questioning the basis on which the 737-MAX was certified. (Steve Lynes)
European Aviation Safety Agency (EASA) executive Patrick Ky told an EU committee that "we will not allow the aircraft to fly if we have not found acceptable answers to all our questions." A Transport Canada spokesperson added that it would it would independently certify the 737-MAX in the future rather than accept validation by the US Federal Aviation Authority (FAA). It is highly unusual for either the European or Canadian authorities to take such action because they typically follow the FAA's lead when it comes to certifying aircraft designed in the USA. To avoid repetition, the agency overseeing aviation regulation the aircraft's country of origin will normally take the lead and other agencies accept the certification granted by their counterparts.
Two major issues
Type certification is an extremely complex and expensive undertaking, and authorities across the globe have similar objectives - to ensure the aircraft design and the procedures used to operate it are safe, before any passengers are carried. At the heart of the challenges over 737-MAX certification that are currently being raised are two major issues:
Is the 737-MAX safe, or are design changes necessary before it re-enters commercial service?
Was the 737-MAX certification completed in compliance with the regulations and with appropriate transparency?
The answer to the former question will only become clear as the investigations into the losses of Lion Air flight 610 and Ethiopian Airlines flight 302 run their courses. It is inappropriate to speculate on the findings, but MCAS is already implicated in the first accident and software changes are already on the way. Whether they will sufficiently resolve questions over the 737-MAX's airworthiness to the satisfaction of aviation safety regulators around the globe - and enable the aircraft to return to the air - is unclear at present.
The answer to the latter question - whether the certification of the 737-MAX was completed correctly within the regulations and with appropriate transparency - is currently causing quite a brouhaha among aviation industry observers. In particular, a practice known as ODA has come under the spotlight.
Organization Designation Authorization
The FAA has a program known as Organization Designation Authorization (ODA), which enables some aspects of the oversight and certification of new aircraft to be undertaken outside of the authority.
Was the FAA too far removed from the certification of the 737-MAX? The debate rages on. (Aka the Beav)
The FAA says that "ODA holders are typically authorized to conduct the types of FAA functions which they would normally seek from the FAA. For example, aircraft manufacturers may be authorized to approve design changes in their products."
Boeing holds FAA ODA approval, and that meant the part of the responsibility for overseeing the certification of the 737-MAX could be borne by its own staff.
The FAA calls the third parties that act as its surrogates Designees. The FAA can delegate matters related to issuing certificates, or the examination, testing and inspection necessary to issue a certificate to designees - qualified private persons and organisations acting on behalf of the agency. A designee can be delegated responsibility in the areas of engineering design, manufacturing, operations or maintenance - the former two relevant to Boeing and the 737-MAX The US federal government has used this approach to examine, test and inspect aircraft as part of the system for managing aviation safety since 1927.
But what this all means in the case of the 737-MAX is that in some areas, Boeing's own employees were responsible for determining whether aircraft certification had been completed correctly and within the regulations and whether it was safe to enter service. Boeing's designees made recommendations which were passed to the FAA and it was their data that the agency used to approve commercial operation of the new aircraft.
Now that ODA has come to the attention of the world's media, claims have inevitably been raised that it creates a conflict of interest. Aircraft manufacturers have a vested interest in getting new designs into service as quickly as possible so that they can ramp up production and start earning cash. And it has been suggested that when design reviews or testing reveals shortcomings, manufacturers might select the most expedient rather than the most robust option to solve a problem.
Why ODAs?
Before we go on it is vital to understand that there is no evidence of impropriety at this stage - no one is saying that Boeing tried to 'cheat the system' when the 737-MAX was certified. Secondly, it is equally important to recognise that the designee program has been in operation since the 1940s and was improved in 2009 when ODAs were introduced. There are no suggestions that either have been responsible for past certification shortcomings. And ODAs aren't just an American thing - Europe, through EASA's Design Organisation Approval (DOA), supports very similar processes that again are not implicated in oversight or malpractice. Every major aircraft type certified since the programs were introduced, including the airliners produced by Boeing and Airbus, has used ODAs or DOAs.
Before an organisation or individual is granted designee status, it must demonstrate to that is has appropriate integrity, experience, resources and facilities as well as a suitable organisational model. In addition, individuals must also be fully conversant with the certification regulations, have significant experience (typically five years or more) of working in the area they are overseeing, be of good standing in the industry, and have proven good relationships with the administrator. Designees are pre-screened, go through a substantial training regime and are subject to ongoing eligibility assessments. ODAs are audited against a comprehensive set of procedures and record keeping, and authority could be withdrawn if shortcomings arise.
So the US and European design approval programs are not just a convenient means of avoiding oversight.
Boeing has FAA ODA authority, so some aspects of the 737-MAX certification were overseen by its own staff. (John Crowley)
When performing their delegated function, designees are legally distinct from and act independent of the organizations that employ them. They are expected to insist on consistency and safety, even when it might involve cost for the manufacturer.
When asking whether designees are a good idea, considering who knows a new aircraft best is a significant question to address. Is it staff who have been embedded in the project from day one, or is it inspectors who by the nature of their job move from project to project over time? So although ODA programs undoubtedly help reduce staff and cost for the regulator, they also allow increased in-depth understanding of individual aircraft development programs.
The corollary of course is that manufacturer's staff might be too close to a project and may miss something important that an independent reviewer might catch. And that's why the designee process is not a total capitulation of authority from airworthiness authority to the manufactures. Rather it enables responsibility for oversight to be given to manufacturer's staff who have more effective insight into the detail while still retaining the same ethos, with checks and balances in place to ensure the transfer is not abused.
Safety first
Aircraft manufacturers have an absolute interest in their aircraft being safe. The cost of a crash, in terms of reputation and future orders, is far far higher than the cost savings likely to be obtained taking a short cut to certification. The cost of the fall out from the losses of Lion Air 610 and Ethiopian 302 will end up being far greater than any airframe or software fix during pre-service testing, even if making changes had entailed delay in the 737-MAX's first commercial operation.
It is possible that there were oversights and omissions involved in the design and implementation of the 737-MAX MCAS, a system that is now considered to have played a part in the loss of Lion Air flight 610. What these are, if there any, will be identified and corrected as part of the accident investigation process. It is far from a foregone conclusion that if the FAA had been more closely involved in the certification process for the 737-MAX - that if designees had not been used - such problems would have been averted.
Text © The Aviation Oracle