New requirements, more conservative approaches and evolving international relationships force OEMs to build more time into certification.
Sean Broderick, Guy Norris
The global civil aircraft certification landscape was already shifting as regulators evaluated a steady flow of new ideas and emerging technologies. A series of recent missteps exposed gaping holes in some long-trusted processes, triggering a new round of sweeping changes that are likely to disrupt even the most experienced company’s product-approval plans for at least a decade.
The most significant errors led to two fatal accidents involving Boeing 737-8s, the newest variant of a well-established workhorse fleet with a largely positive 50-year safety record. The 2018 and 2019 disasters and a subsequent worldwide grounding resulted from mistakes made within both the FAA and Boeing during the aircraft’s development and approval processes.
Lawmakers and the FAA—neither known for rapid responses—are moving quickly to ensure similar shortcomings do not threaten future programs.
A 2020 law made prescriptive changes to how the FAA approves products and, more broadly, oversees companies developing them. The mandates added to a list of related projects, such as a years-long effort to update the system safety assessment process and harmonize it with European Union Aviation Safety Agency (EASA) requirements. The directives also introduced some limits on delegation or regulators’ reliance on industry to validate rulebook compliance.
The immediate ramifications are evident in the expanding and increasingly uncertain timelines of major certification programs. Boeing’s woes are numerous and well-documented, affecting initial approvals of the 777-9, 737-7 and 737-10 as well as the FAA’s sign-off on a plan to inspect, repair and deliver—after more than a year of no customer handovers—some 120 787s that were not built to specifications (AW&ST May 2-15, p. 24). But the heightened regulatory scrutiny extends beyond the company that triggered it—and beyond the U.S.
More stringent guidance on how to comply with a decade-old standard for software validation is holding up Gulfstream’s progress toward Type Inspection Authorization, which is when test flights begin counting toward FAA certification requirements.
Airbus points to regulatory hurdles as a major reason that first deliveries of its hotly anticipated A321XLR will come in 2024, not 2023 (AW&ST June 27-July 10, p. 26). The model features an additional center fuel tank that uses part of the fuselage for a wall—a design that goes beyond the FAA and EASA rulebooks. Both agencies must develop special conditions as a result, a process that requires significant regulatory deliberation.
Rolls-Royce says the last of nine improvements developed over the past five years to address Trent 1000 TEN turbine blade reliability issues will not be ready until 2023—three years after its original target. The lone remaining hurdle: regulatory approval.
“It just takes a while,” Chris Cholerton, president of Rolls-Royce Civil Aerospace tells Aviation Week, noting that all testing is done and the new blade has performed better than expected. “It is just a case of continuing through the whole regulatory validation clearance process, which we’ll get through sooner or later.”
Manufacturers are responding the only way they can.
“We need to plan for additional time, because that’s what it’s going to take,” says a former senior FAA safety executive who now works with a major OEM. “Regulatory changes have to get in place, and then you have to go through a program or two to figure out how it’s really impacting us. I think it’s probably a 10-year cycle.”
The added time stems from myriad factors. Much of the back-and-forth between the FAA and an applicant during a certification program are structured—the agency agrees to respond to a request or submission in a certain number of days, for instance. In the past, quick responses were common. Now, however, the agency is likely to take as much time as it is allotted on each issue, one airframe manufacturing source says.
In the U.S., new requirements for “transport airplanes”—which Congress defines as those that could carry 30 or more passengers and their cargo-hauling equivalents—are changing some certification basics. The 2020 law requires the FAA to review all “critical design” features in a transport-category aircraft before delegating the ability to determine compliance to applicants, for instance. The law also mandates additional system safety assessments for all proposed “significant” changes from an earlier, approved version of an aircraft family. This adds work for derivative programs, such as the 737-7, 737-10 and 777-9, the initial member of a planned 777X family.
The FAA is proactively making changes as well. For instance, its Technical Advisory Board (TAB) process, once limited to examining specific safety issues, became part of every new-aircraft review program starting with the 777-9 in early 2020 (AW&ST Jan. 25-Feb. 7, 2021, p. 45). TABs are groups of experts that review specific aspects of an aircraft’s design. The 777-9 TAB’s first task was to review pilot human factors-related issues, including safety assessments and flight control systems.
Although some new processes such as TAB usage are well-defined, others are still in their infancy. One of the criticisms to stem from the 737 MAX investigation is that the FAA gave too much leeway to agency managers and, in some cases, the company during technical disputes. The resulting push to ensure that possible safety issues are elevated to appropriate organizational levels and given adequate analysis is posing challenges, however.
“Every airplane I ever worked on had somebody who didn’t like some of the decisions that were made in a particular area,” the former FAA certification manager says. “To me, that’s a strength. That means we’re actually wrestling with this and trying to find a solution. But now what I’m seeing is if one person has a minority opinion, the rest of the team sits back and says, ‘Let’s see what the response is from higher up.’”
In the past, the appropriate manager would weigh in and, if necessary, make the decision. But in the aftermath of the 737 MAX saga, the FAA recognizes that a more thorough process is needed.
“Every blown whistle has to go through some sort of vetting process involving both FAA and manufacturers,” another former FAA official says. “There has to be a level of trust that isn’t quite there right now.”
One possibility is setting up review teams led by one of the agency’s chief scientists or a similarly experienced official. The group would evaluate the issue and make its recommendation to the head of certification. Such an approach would combine expertise with appropriate distance from the FAA group tasked with the issue and the applicant. Sources with knowledge of the agency’s thinking tell Aviation Week that the idea is one of several on the table.
The Airbus A321XLR’s range-extending rear center tank needs special rules from regulators. Credit: Stefan Kruijer/Airbus
Another factor driving change is the evolving relationships among global regulators, particularly the FAA and EASA. What some see as a zero-sum game in which one regulator sits atop the global aviation safety ladder is better described as a steadily leveling playing field.
Twenty years ago, EASA did not exist. In February 2001, two years before EASA opened its doors, the FAA’s top safety official, Tom McSweeney, used a Royal Aeronautical Society speech to express concern about the proposed agency, including its ability “to be an independent safety regulator.”
The 2008 U.S.-EU Bilateral Aviation Safety Agreement (BASA)—which is regularly updated and has involved countless hours of work between the two agencies to harmonize their approaches—has all but erased any doubts that plagued EASA’s early days. Factor in the European agency’s experience as a so-called state of design responsible for approving products developed by Airbus and Rolls-Royce, among others, and its emergence as a global regulatory leader is obvious.
“There is no competition, because it doesn’t make any sense to say: ‘I’m the gold standard, and you are the silver standard,’” EASA Executive Director Patrick Ky told reporters at the recent FAA-EASA International Aviation Safety Summit. “What matters is that our products—all our products—are as safe as possible.”
But competition is not the same as conflict. While FAA and EASA officials emphasize that relations between the two agencies are, in Ky’s words, “quite healthy,” they also acknowledge—both directly and indirectly—that tensions exist as well.
Acting FAA Administrator Billy Nolen used his summit-opening keynote speech to laud the 2008 BASA’s benefits. The bilateral pact is “the bedrock of our partnership, allowing us to validate each other’s certifications of aviation products and parts . . . and maximize reliance on each other for approvals and monitoring of repair stations and maintenance,” he said. “We must recommit ourselves to this framework. Its structure and process push us to collaborate, while holding each aviation authority accountable. When we collaborate, both sides can devote more resources to areas that pose a higher safety risk.”
Against a backdrop of increased involvement from EASA in a few FAA-led programs, notably the 737 MAX service return and 777-9 certifications, Nolen’s remarks suggest the importance of following procedures such as product validations—and the roles that each regulator plays—that are spelled out in the BASA. At least part of the 777-9’s elongated certification timeline is linked to producing satisfactory answers to issues that EASA had raised.
Sources within the FAA have expressed concern privately that the European agency’s involvement extends beyond the validating-authority boundaries established in the BASA. EASA maintains that it is simply doing its due diligence and welcomes similar scrutiny from its U.S. counterpart.
“The relationship with the FAA is healthy in the fact that they challenge on topics like the Airbus A321XLR, for instance, and we challenge them—[like on] 777X,” Ky said. “What matters is that we converge with the highest expectation in terms of safety levels.”
Disagreements between the agencies sometimes come down to different interpretations of agreed-upon, but not identical standards. An EASA analysis of the agencies’ large-aircraft certification standards—its Certification Specification 25 and the FAA’s Part 25—found that the FAA’s rules did not have about 60 requirements contained in the European equivalent. A similar FAA analysis found that EASA’s rules did not have about 50 requirements in the U.S. version.
The BASA spells out how to address different standards and guidance. But in an era when performance-based regulations are gaining favor, codifying what constitutes compliance—which can be inherently subjective—grows increasingly more difficult. The issue led an industry working group operating under the General Aviation Manufacturers Association banner to issue a white paper in December 2020 with recommendations on how regulators can become more aligned and eliminate unpleasant surprises for manufacturers in the process.
Among the shifts in how U.S.-developed products are certified, the most far-reaching will have an impact on delegation. At the most advanced level, FAA delegation grants companies Organization Designation Authorization (ODA) authority, setting up what is supposed to be an independent unit within the company. That unit acts as an extension of the FAA by performing tests and validating results, for instance.
Introduced in 2009, ODA is the modern version of a program that began in the 1920s. The push to leverage companies’ considerable technical expertise and resources to conduct more certification work gained significant momentum in the 1990s and 2000s. Congress—at industry’s urging—responded by expanding the FAA’s delegation authority several times.
ODA’s role in major FAA certification programs is difficult to overstate. Boeing, Bell, Cessna, Cirrus Aircraft, General Electric, Gulfstream Aerospace, Piper Aircraft, Pratt & Whitney and Sikorsky Aircraft are among the companies with ODAs designated to conduct type certification work. In transport-category aircraft projects, the percentage of work delegated to the ODAs—measured in certification plans and deliverables within each plan—routinely tops 90% and has for years. The FAA estimated that more than 95% of certification work on the 747-400 program was delegated, a 1993 U.S. government report said. The 737 MAX development program included more than 90 certification plans and 1,700 deliverables, another government report said, citing Boeing and FAA data.
Although lauded by industry and the FAA, delegation’s expansion raised red flags long before the 737 MAX accidents. A 2015 Transportation Department auditors’ report highlighted several issues. Among them: The agency’s staffing model did not factor in certain risk-related variables such as a company’s size or a project’s complexity.
Investigations stemming from the 737 MAX accidents spotlighted an even bigger problem. ODA members surveyed within Boeing said they often felt pressured to push projects along rather than raise possible safety concerns. Those who wanted to speak up had no clear path to a sympathetic FAA ear.
Boeing developed a plan to inspect and repair all undelivered 787s. Credit: Jennifer Buchanan/Boeing
Several provisions in the 2020 law target these issues, putting new limits on what the FAA can delegate, ordering broader programmatic changes to how the agency oversees ODAs. The FAA now must approve each staff member companies assign to ODAs, for instance—a provision meant to ensure that each ODA “unit member” has sufficient technical background to represent the FAA.
New guidance also seeks to establish boundaries about what constitutes interference with an ODA unit member. The definition goes beyond applying direct pressure, such as demanding that a project remain on schedule regardless of potential issues, and includes possible conflicts that parallel projects may create. The language targets issues that Boeing created during the 737 MAX’s development, such as a general mandate to limit new pilot training compared with the previous versions. This led managers to push for leaving details of new, automated flight control software functionality out of pilot training and manuals—a move the FAA approved. The functionality, the Maneuvering Characteristics Augmentation System, played key roles in both fatal 737 MAX accidents, leading to its modification and subsequent inclusion in all 737 MAX pilot training.
Some of the new ODA requirements are limited to companies that design transport aircraft with maximum takeoff weights of 150,000 lb. or greater—Congress’ way of singling out Boeing and its U.S.-based engine suppliers, GE Aviation and Pratt & Whitney. The FAA is investigating issues raised by ODA unit members within Boeing and GE.
ODA will remain an important part of large-airplane certification programs. But the new oversight requirements and limits on what the FAA can delegate or must review before handing it over to a company means more work for the agency—and more time needed for certification.
“Any time you deal with new requirements, at first, it’s a bit of a setback from a schedule standpoint,” Honeywell Aerospace President and CEO Mike Madsen said at a UBS investor conference in early June. “I think you figure it out, and you get good at it. Ultimately, your cycle times get better than they were before.”
Improvements will come from learning the new process and manufacturers’ push to satisfy customer demands, Madsen said.
“The pressure for developing an aircraft more rapidly is never going to go away,” he said. “I don’t think we are going to say: ‘Okay, now it’s 10 years or 12 years [to develop new aircraft].’ The world won’t wait for better.”
