A safety review panel established by the US Federal Aviation Administration has issued a report detailing various alleged shortcomings with the design and certification of the 737 Max.
Released 11 October, the 51-page report takes aim at Boeing's design decisions and the FAA's certification processes, and recommends sweeping changes to how the FAA does business.
It warns that the FAA office overseeing Boeing may be unable to adequately review Boeing's multiple aircraft programmes due to understaffing.
It also calls for a review of the 737 Max's certification – something already under way – and warns that today's certification standards fail to reflect complex aircraft systems.
More broadly, the report urges the FAA to evaluate how it certifies new variants of existing aircraft, including whether aircraft like the 737 Max should require entirely new type certificates.
"We welcome this scrutiny and are confident that our openness to these efforts with further bolster aviation safety," says FAA administrator Steve Dickson in a statement. "I will review every recommendation and take appropriate action."
The FAA formed the so-called Joint Authorities Technical Review Panel (JATR) in April to examine certification of the Max's Maneuvering Characteristics Augmentation System – technology implicated as contributing to two 737 Max 8 crashes.
The JATR panel was formed with representatives from at least nine countries or regions, including Australia, Brazil, Canada, the European Union, Japan, Indonesia, Singapore and the United Arab Emirates, the FAA has said.
MCAS apparently put two aircraft, a Lion Air 737 Max and an Ethiopian Airlines 737 Max, into dives from which pilots could not recover, killing 346 people. The systems apparently activated due to failure of a single angle-of-attack indicator on both aircraft. The pilots' responses and training have also come under scrutiny.
"Boeing is committed to working with the FAA in reviewing the recommendations and helping to continuously improve the process and approach used to validate and certify airplanes going forward," the Chicago-based airframer says in a statement. "Safety is a core value for everyone at Boeing."
But the panel's report alleges numerous lapses in design and certification of the 737 Max.
NEW TYPE CERTIFICATES?
It urges the FAA to evaluate if new variants of existing aircraft are "incompatible" with today's safety regulations, and if so, whether new variants should be certified as wholly new aircraft under new type certificates.
The panel notes some 737 Max design and certification elements are "rooted in the original 1967 certification". The Max has some modern updates, but lacks other design enhancements developed over 50 years, the report says.
"There are no criteria for determining when the core attributes of an existing design make it fundamentally incapable of supporting the safety advancements introduced by the latest amendments to airworthiness standards," the report says.
The panel also urges the FAA to review its staffing, noting the agency's Boeing Aviation Safety Oversight Office, which certificates Boeing aircraft, has only two technical staff assigned to each Boeing programme.
That office "may not be sufficiently staffed to review all the Boeing programmes (737, 747, 767, 777, and 787)," says the report.
FAA "resource shortfalls" may have contributed to an insufficient number of FAA specialists being involved in the Max certification, the report says.
The panel avoids broadly judging the FAA's Organisation Designation Authorisation (ODA). Under that policy the FAA outsources some certification work to experts at companies applying for certification.
But it urges the FAA to review Boeing's ODA and questions if communication shortcomings partly hindered the FAA's ability to address risks created by MCAS.
Michel Merluzeau, an aerospace analyst with consultancy AIR, says the FAA has long struggled to hire and retain the expert engineers needed to oversee a massive industry.
"How can you have long-term stability from staff, and competence... when you can't find the people?" he asks.
He envisions a future system in which fully-independent third-party companies – which could attract experts with competitive pay – would assist with certification, sitting between the regulator and the regulated.
"The private sector can probably put this together," Merluzeau says.
With production continuing amid the grounding, Boeing has been stockpiling 737 Max at various airports
Gary He/EPA/EFE/Shutterstock
Much of the JATR's report focuses on certification of MCAS, which it says was based on "data, architecture, and assumptions" from a previous aircraft.
Boeing designed MCAS "without sufficient detailed aircraft-level evaluation of the appropriateness of such reuse, and without additional safety margins and features to address conditions, omissions, or errors not foreseen in the analyses," the report says.
It notes that MCAS information was removed from the Max's operating manual during certification, meaning the FAA's flight standardisation board did not require pilots to complete MCAS training.
Boeing has said it equipped the Max with MCAS to make that aircraft feel to pilots like earlier-generation 737NGs. MCAS moves the Max's elevator, nosing-down the aircraft in certain flight circumstances.
"This is a case of using the control surface in a new way that the regulations never accounted for and should have required an issue paper for further analysis by the FAA," says the JATR report.
"However, because the information and discussions about MCAS were so fragmented and were delivered to disconnected groups within the process, it was difficult to recognise the impacts and implications of this system," it adds.
The panel urges the FAA to review the Max's compliance with flight control system certifications and to evaluate the Max's stall characteristics.
Boeing
The report warns that some FAA regulations have become outdated and do not adequately apply to aircraft that have been progressively updated over decades, like the Max.
Specifically, it highlights concerns about certification of systems added to such aircraft over many years, how those systems integrate and how pilots respond when systems go haywire.
The panel urges the FAA to revisit how much time pilots need to cope with cascading alarms and failures. The standard assumed reaction time has long been 3s, but today's pilots, faced with complex, interwoven systems, may need more, the report says.
"Although existing standards have served the industry well for decades, the JATR members recommend an examination of whether those standards are as appropriate for the complex integrated systems in today's airplanes," says JATR chair Christopher Hart in the report's cover letter. "Inherent in this issue is the adequacy of training."
