EASA Chief Confirms Progress In Boeing 777X Certification Talks

FRANKFURT/WASHINGTON—European Union Aviation Safety Agency (EASA) Executive Director Patrick Ky says much progress has been made toward joint certification of the Boeing 777X with the U.S. Federal Aviation Administration (FAA). 

Ky told Aviation Week in an interview that “we identified a certain number of issues on which we had a different interpretation of the rules, and on each of those issues, now we have a solution.”

Boeing has been forced to push out entry-into-service of the 777X by a total of five years. The latest two-year delay was attributed partially to the longer than expected time it was going to take the aircraft to be certified both in the U.S. and Europe. Boeing CEO Dave Calhoun said in early 2021, “we’ve made the decision to implement certain modifications to the aircraft design. Our decision to make these modifications, which will involve firmware and hardware changes to the actuator control electronics, reflects our current judgment of global regulators’ compliance expectations.” However, what Boeing decided back then was still not enough to get EASA on board and negotiations have continued since then.  

Ky declined to discuss technical details of the 777X certification talks. Sources with knowledge of the situation told Aviation Week that the heart of the issue was a disagreement between Boeing and EASA over the vulnerability of the 777X flight control system to potential common mode failures caused by events such as lightning strikes, software errors, incorrect maintenance, explosions, or electro-magnetic interference. EASA’s view was that Boeing fly-by-wire systems, which traditionally employ triple redundant architectures designed to survive at least two failures, were insufficiently protected. Instead, the agency backed the approach used in Airbus aircraft, such as the A320, which typically use five dissimilar computers running four dissimilar software packages.  

The 777X flight control system and its supporting systems architecture is an evolution of the heritage 777 system with new elements added from the 787. Like the 787, but unlike the 777, the 777X fly-by-wire flight control system operates in all three axes (pitch, roll and yaw). Although pitch control law is identical between the 777 and 787, the roll control law in the 777X is derived from that used in the 787.

Boeing has insisted throughout that the long in-service safety and reliability record of the 777 and 787 flight control system validates its design approach to the 777X. However, in response to EASA’s initial concerns, the company did change out some circuit cards and power supplies in the aircraft’s BAE Systems-developed integrated flight control electronics unit, which includes the flight control computers and actuator control electronics.

Ky said, “we had a lot of discussions with the FAA and Boeing. Some were more difficult than others, but what matters is we are agreeing on a common way forward.” The three parties—Boeing, EASA, and FAA—did not select the same approach for every open item, according to Ky. “Sometimes it can be a change in the design. Other times it can be the in-service safety records of similar types of components or architecture, which [shows] this is not a safety critical issue. In other cases, we do not change the architecture. We use other methodologies such as a software development assurance, to guarantee that the desired safety level will be the same,” he said.

Ky warned that new issues may emerge during the further course of the 777X certification that may lead to further discussions. “In the coming months, I am sure there will be tensions again, there will be disagreements, but that is what it is about,” he said. “It is part of the game.” Ky added, “certification projects are certification projects. Up until the end, there can be changes we’re not expecting. But so far, I think we have a common view with Boeing and the FAA on what needs to be done in order to reach the safety level that we all want.”

Following broad criticism that the FAA did not have the necessary level of oversight in the 737 MAX certification process, EASA had taken a more independent view on under what conditions the 737 MAX should be returned to service and has taken a deeper dive into 777X systems analytics than in previous programs.

But Ky said the subsequent process has brought the FAA and EASA closer again. “It is in difficult discussions that you build the relationship. Because of different points of views on topics, it forced people to sit down together and to try to explain their points in several ways,” Ky said. “It has inevitably created tensions at some stage, of course, but because we have a common solution, there is a sense of we have been working together on this.”

That approach has also been key for the ongoing certification campaign of the Airbus A321XLR. “We spent a lot of time on this and had a very controversial discussion with Airbus about it in particular on the flammability of the rear center tank (RCT),” Ky said. “We wanted to make sure that the FAA would be fully on board with us in the discussion. We are in that case of course the primary certification authority and the FAA is the validating authority. But it would not make sense for us to propose a new design that Airbus is implementing, and the FAA comes three months later with different requirements. We were very keen to associate the FAA to all the discussions we were having with Airbus.”

As in the case of the 777X, “we found a good way to work together with the FAA and Airbus. We are converging on a common understanding of what is a suitable design of the RCT in terms of safety and flammability and how we can move forward on the certification of the XLR.” Ky did not reveal technical details of the proposed solution.