Guy Norris, Sean Broderick Some problems are similar to the 787 and 737 MAX issues highlighted by regulators.
Guy Norris, Sean Broderick
The FAA is concerned about the 777-9’s 787-derived common core system avionics, among other issues. Credit: Joe Walker
The FAA’s lingering concerns over how Boeing is managing 777-9 certification may not damage the model’s commercial prospects much, but they signify a consequential change in how new aircraft are being scrutinized and how much the U.S. manufacturer is struggling to adjust.
Eleven months of discussion over when Boeing can start counting test flights toward certification—type inspection authorization (TIA), in FAA terms—has not led to an agreement. In an unusually blunt letter to Boeing’s top FAA-designated liaison, the FAA’s Boeing Aviation Safety Oversight Office chief, Ian Won, detailed 11 unresolved issues and expressed the agency’s big-picture concern.
“The technical data required for type certification has not reached a point where it appears the aircraft type design is mature and can be expected to meet the applicable regulations,” Won wrote to Tom Galantowicz, lead administrator of Boeing’s Organization Designation Authorization (ODA) unit, the team of 1,500 Boeing employees empowered by the FAA to conduct certification work on the agency’s behalf.
Also off the table is “a phased TIA of limited scope with a small number of certification flight test plans proposed,” the agency adds—an approach taken during the 787’s development.
The Seattle Times first reported the letter’s contents.
Issues flagged by the FAA include specific problems with the 777-9, notably an uncommanded pitch-up event experienced during a December flight and the “maturity” of the common core system (CCS) avionics developed by GE Aviation.
While such technical issues can be significant, they are not uncommon during an aircraft’s development. Far more troubling is Boeing’s apparent failure to follow its own procedures or to correct mistakes made on its last two commercial programs, the 787 and 737 MAX families.
For example, the agency says Boeing has not provided a preliminary safety assessment for review as required by the manufacturer’s documented ODA process. Reviews of the 787 and 737 MAX certification and Boeing’s ODA, prompted by the global grounding of those fleets to address safety issues, found incomplete or inadequate safety assessments helped set the stage for in-service problems (AW&ST Nov. 11-24, 2019, p. 22).
Compounding the FAA’s concern is that Boeing’s ODA unit, which is supposed to be a resource-leveraging extension of the agency, did not view the issues as red flags that should hold up TIA.
“Despite these shortfalls . . . the ODA believes [Boeing’s] position proposing that the program proceed with Phase 1 of the TIA warrants FAA consideration,” Won wrote.
On the heels of the 737 MAX grounding, Boeing’s approach is raising some eyebrows.
“Overall, it makes me wonder if Boeing has learned anything in the last two years,” a former FAA engineer with transport-aircraft program certification experience says.
Boeing declined to comment on the specific issues raised by the FAA.
“Boeing is fully focused on safety as our highest priority throughout 777X development,” the company says. “As we subject the airplane to a comprehensive test program to demonstrate its safety and reliability, we are working through a rigorous development process to ensure we meet all applicable requirements. We continue to communicate transparently with the FAA and other global regulators about 777-9 certification.”
777-8: 34
777-9: 300
Total: 334
Source: Aviation Week Network Fleet Discovery
Typically, TIA approval comes within weeks or a few months of first flight, starting the clock ticking toward the formal completion of type certification or, in the case of major derivatives such as the 777-9, amended type certification. The 737-8, the initial 737 MAX variant to be certified, was granted TIA in March 2016, six weeks after its first flight. Even the troubled 787 was granted initial, phased TIA within three months of its first flight in December 2009 and full TIA within five months.
Among the differences now is a changing regulatory process prompted by two fatal 737-8 accidents, Lion Air Flight 610 in October 2018 and Ethiopian Airlines Flight 302 in March 2019, that grounded the 737 MAX fleet and prompted changes to the aircraft and within both Boeing and the FAA (AW&ST Dec. 23, 2019-Jan. 12, 2020, p. 88). These include increased scrutiny for all aircraft certification programs—and derivatives of current designs in particular. Boeing’s 2015 777 type certificate amendment application requests adding the 777-9 as a derivate of the 777-300ER, which the FAA approved in 2004.
Among Boeing’s organizational changes is a revamped engineering structure designed to ensure commercial pressure does not compromise aircraft development—a direct result of Boeing consciously downplaying differences between previous 737 variants and the 737 MAX to avoid FAA scrutiny and new, costly pilot-training requirements (AW&ST Jan. 27-Feb. 9, 2020, p. 20).
The decisions helped set the stage for an inadequately vetted flight control system software design; investigators determined that the design played a key role in both 737-8 accident sequences. The issues led to the model’s global grounding and calls by regulators to modify and validate the problematic design. Regulators in some jurisdictions, including China and India, still have not approved Boeing’s software and pilot-training changes.
Despite anticipating heavy regulatory scrutiny in the wake of the 737 MAX saga, Boeing was confident its revised engineering and safety oversight structure would clear the way for 777-9 TIA approval early in 2021. However, following calls from the European Union Aviation Safety Agency (EASA) for modifications to the flight control system and the uncommanded pitch event—first disclosed publicly in the May letter—Boeing conceded certification would take longer than expected. In January 2021 it announced first deliveries would be delayed until the end of 2023.
The magnitude of the $6.5 billion program charge and 12-16-months of additional development time were a surprise when revealed in January. The FAA’s letter puts them into perspective.
Boeing’s stance that certification should proceed surprised the FAA. Credit: David Ryder/Getty Images
Among the technical issues highlighted, the CCS may present the most significant challenge. Based on a similar system developed for the 787, the 777-9 CCS is an integrated modular architecture that consolidates computing functions for several avionics and utility systems. However, despite years of ground testing and—at the time of the FAA’s letter—15 months of flight testing since the aircraft’s January 2020 first flight, the agency said Boeing had yet to complete the Design Assurance Review for the FAA to conduct compliance findings. Without this, the agency’s letter says, “It is difficult for the FAA to determine if the system is mature and will provide only uncorrupted data for FAA certification testing.”
The letter also raises the specter of potential safety issues with the CCS, despite the solid safety record of the closely related 787 system. “Incorrect reuse of 787 data was noted by the FAA in Boeing’s CCS engineering safety assessment,” the FAA letter says. “The assessment also stated that the data is not yet mature enough to show compliance [and] lists many open problem reports against safety documentation, assessments and requirements.”
The CCS also reveals the frequently overlooked pitfall awaiting manufacturers taking the derivative rather than an all-new approach to product development. The business case for Boeing’s decision to replace its own 747-400 and outflank the Airbus A350-1000 with a 777-300ER derivative was well founded. But at the same time, it faced significant challenges that—in retrospect—the company may have underestimated.
When it first launched the 777X in 2013, Boeing originally hoped to start deliveries in late 2019 or early 2020. But development issues with assembly of the all-new composite wing and a durability problem on the aircraft’s General Electric GE9X engine subsequently pushed this target back to mid-2021 (AW&ST June 17-30, 2019, p. 38).
In 2020, the company announced it was sliding first delivery back further to 2022, as the 737 MAX grounding and COVID-19 pandemic took their toll on Boeing’s internal resources. Issues such as the uncommanded pitch event created more timeline pressure.
Boeing plans to address the pitch-event issue with a software change. “[But] software load dates are continuously sliding, and the FAA needs better visibility into the causes of the delays,” the FAA letter says. “[The] FAA is yet to see how Boeing fully implements all the corrective actions identified by the root cause investigation . . . to ensure the ‘maturity’ and safety/airworthiness of the aircraft.”
Another factor is the EASA-driven changes to the flight control system actuator controls electronics. “[EASA] has not yet agreed on a way forward on the Model 777-9. The FAA’s concern is due to the addition of late changes. Boeing needs to ensure the changes do not introduce new, inadvertent failure modes,” the FAA letter says.
Other aspects of the aircraft’s design and certification basis also remain in flux, despite the long-running development effort.
“Design maturity is in question as design changes are ongoing and potentially significant,” Won wrote.
Examples of late changes include modifications to the stabilizer design/architecture associated with the removal of the “green band” range of the horizontal stabilizer trim indicator. The green band denotes the takeoff trim range, and in previous Boeing aircraft sounds a horn if takeoff is attempted with the stabilizer trim outside this range.
Other pending design changes cited by the FAA include: several modifications to indications and flight deck alerts related to flight control module failures, loss of airspeed protection, failure in flight director-only mode and a variety of other situations.
Holding off on TIA is not just prudent based on the outstanding issues but also benefits Boeing in the long run, the FAA says. If TIA were granted now, Boeing would likely have to conduct a significant amount of software regression testing, change its impact analysis and add extra certification flight tests.
“The additional activity will require the FAA to expend additional resources to review the changes and may reduce our resources to support other certification programs/activities, potentially with a higher priority,” the FAA letter says.
Based on the program’s current status, the 777-9 amended type certification date “is realistically going to be mid-to-late-2023,” the letter says.
Boeing says this is consistent with its most recent delivery guidance.
“We are still confident [the 777-9] will be certified in the fourth quarter of 2023,” Boeing CEO Dave Calhoun said at the Bernstein Strategic Decisions Conference in early June. “We don’t have a load of technical glitches. . . . We don’t have that kind of stuff because we’ve been flying [and] doing the things that we’ve been doing. I like the status [and] I like the progress we’re making against the certification.
Calhoun added that Boeing “will not question” the FAA’s timeline.
While Boeing seems unlikely to get certification tests of the 777-9 underway soon, the slow path to approval should provide some benefits. Although there is now less room for Boeing to maneuver if more issues crop up, the later delivery and certification schedule should still converge in a period when the long-range, high-capacity market is ready to take the 777-9 as long-haul traffic recovers from its current slump (AW&ST Jan. 27-Feb. 9, 2020, p. 18).
It also provides both Boeing and the FAA with a real-world opportunity to restore faith in each other and with other regulators and key stakeholders.
The FAA’s refusal to grant TIA underpins the regulator’s increasingly rigorous stance on certification (AW&ST Jan. 25-Feb. 7, p. 45). The message is clear: The FAA will no longer simply rubber-stamp Boeing’s certification work. This meticulous approach is more than grandstanding; it is the careful and thorough execution of a precise certification process. The result will ultimately benefit the broader industry—but not without consequences such as longer, more rigorous product-development processes as confidence is restored and a new normal is created.
“I would venture that it takes 2-3 years for us to iron out all those changes between [Boeing and the FAA] and reaffirm confidence in ODA,” Calhoun told Aviation Week in early June, before the existence of the FAA letter was reported. “We have to. I have never doubted it for a minute. I don’t think my counterparts at the FAA have either, because of the record and because of the transparency that it brings. I think it’s going to take us a few years to reconcile all of that oversight and get it back [to] what it needs to be.”
