Opinion: Why FAA And Boeing Should Take New 777-9 Certification Path

Boeing 777-9
Credit: Boeing

The FAA’s May 13 letter to Boeing’s FAA-designated safety oversight liaison indicates that Boeing continues to struggle with its delegation—or authority granted by the safety agency to perform certain certification functions such as approving engineering design data on its behalf (AW&ST July 12-25, p. 14). The troubling situation begs the question: Is there a better way?

During certification, the FAA, or an Organization Designation Authorization (ODA) of company employees acting on the agency’s behalf, will issue a Type Inspection Authorization (TIA) for regulatory compliance-testing when two general conditions are met. The applicant must demonstrate that its aircraft is safe and conforms to the design presented to the agency. TIA issuance is a turning point in any program. It is serious business. The agency has lost test pilots and engineers, and the TIA process is intended to mitigate risk. It signifies that the FAA accepts the manufacturer’s declaration of safety and airworthiness and authorizes FAA flight-test pilots and engineers to begin compliance-testing.

The fact that the letter is addressed to Boeing’s ODA lead administrator is troubling. That person is—or should be—the FAA’s bulwark inside the company in lockstep with the FAA. Their duty includes holding the line when necessary, which can be a difficult task because of enormous financial and schedule pressure associated with all aircraft programs.

An ODA is a de facto branch of the FAA, separate from the applicant while at the same time housed within the applicant’s organization and staffed by its employees. In the Boeing 777-9 case, it appears the ODA suggested to the FAA, on Boeing’s behalf, that the prototype airplane is ready for certification testing. The FAA clearly disagrees and felt it necessary to scold the Boeing ODA.

The FAA’s letter declares in numerous ways that the type design is not adequately “mature” for TIA issuance; the term is used six times in the letter. Ultimately, TIA issuance is a judgment call made after the FAA has gathered and reviewed all the necessary data and consulted with stakeholders. Emphasizing lack of maturity in a program that Boeing and its ODA feel is ready for certification testing is the FAA’s way of expressing concern with Boeing and its ODA.

The letter raises 11 technical and process-related issues, but one stands out: an “un-commanded pitch event” in December 2020. “After the un-commanded pitch event, the FAA is yet to see how Boeing fully implements all the corrective actions identified by the root cause investigation,” the letter says.

The agency is often and correctly described as a technical organization in a political world. It must assure aviation safety with robust professional oversight while fostering a public perception of safety. The FAA is hypersensitive to public perception. It is not a stretch to see reports of an uncommanded pitch event in flight test evoking memories of the two Boeing 737 MAX accidents caused by uncommanded pitch events. The FAA’s displeasure over Boeing’s poor performance in implementing corrective action goes beyond technical nuance. It implies that Boeing is insensitive to the FAA’s accountability to the public.

A letter such as this would certainly have been coordinated within the FAA up to the highest levels. It clearly indicates that all is not well with Boeing, their ODA and especially their relationship with the FAA.

Aircraft Certification, the FAA organization responsible for all aircraft designs, production and continued operational safety, has fewer than 1,400 employees. Although the delegation is frequently attacked as “the fox guarding the hen house,” it is absolutely essential for industry competitiveness and FAA effectiveness in assuring safety. 

If the FAA letter is any indication of how unhealthy Boeing’s ODA is, especially after the tragedies and difficult lessons of the Lion Air and Ethiopian Airlines 737 MAX accidents, the agency may have to examine alternatives. One option is to staff the FAA for more direct Boeing oversight, which may not be practical for various reasons.

Another viable option exists and has been highly successful in other cases: a third-party ODA. Airplane modifiers hire properly authorized ODAs to approve their supplemental type certificates in a timely manner. With slight modifications to FAA policy for ODA holders, the agency could authorize a third-party ODA, contracted by Boeing but collocated with the FAA.

Such an ODA would benefit from autonomy and physical distance from the financial pressures of a huge corporation as well as from being nested within the FAA for constant oversight and guidance.

Mike Borfitz is an ODA administrator and has been an FAA Aircraft Certification Office manager and a Boeing Associate Technical Fellow for Certification and Safety.

The views expressed are not necessarily those of Aviation Week.

Comments

7 Comments
Thank you for sharing Mike!
Nice article.
A third party ODA would be what is called a qualified entity in EASA basic regulation (Regulation 2018/1139). The regulation defines the requirements for a qualified entity. Qualified entities may be used by EASA or the National Authorities. They perform technical tasks for EASA or the Authorities and may even issue certificates .
Best regards,
Yves
At Boeing, as with other mega companies, the management decisions are strictly based on what they perceive to be financial needs of the company, not on manufacturing and delivering products and goods to the public.
Unfortunately, Boeing is not alone, they are more in front of the public than other similar mega companies. As long as Washington is merger happy - and they will be due to large funding for re-elections - we will see lowering the quality of manufacturing products. No help for the public.
I am not sure that I understand the advantage of a "third-party" ODA. Whether the ODA is "in house" or "contracted out", the in built conflict of interest remains because the company still pays the bill. And in the age of Zoom it is also difficult to see how physical distance from the corporation headquarters would make much difference.
Further to the point; consider how bonds are given their "investment rating". The company issuing the bond pays for it. If a rating agency continues to issue "low" (read realistic) ratings, the company seeking to issue the bond will simply shop around until it finds someone who will give them what they are paying for - an investment grade rating. In the proverbial "race to the bottom" the good rating company goes out of business and the one which produces rubbish flourishes. There is little reason to believe that this would not also happen with third-party ODAs.
"YVEMOR" - is this the same person I've known for a long, long time? Thank you for your comment and it's great to see you still kicking around!
To GWROBLE:
I attached a link to an FAA press release for your reference, hope it "sticks". I pasted 2 articles regarding the FAA going after Boeing for undue pressure on the ODA Administrators. When it gets so bad that the FAA has to get involved, it's REALLY bad. That was last year, and THIS year we have the ODA Lead Administrator making a big mistake by proposing something to the FAA when he should have been able to successfully push back on the 777-9 program on all the items the FAA listed in their response. I don't really blame the individual, I think the Boeing culture may need some tough love.

The primary advantage of a third party ODA is simply the fact that a well supported ODA Administrator can say "No" and not feel exposed or threatened.

I can go a bit deeper, I've had some experience with being told "You're not a team player" inside Boeing. If Boeing can't provide the ODA with the distance needed to act properly on behalf of the FAA, maybe a bit more distance will help.

~~~~~~~~~~~~~~~~~~~~~~~~~
Boeing failed to ensure ODA administrators were in a position to effectively represent the FAA’s interests, the FAA alleges.

The FAA further alleges that between September 2018 and May 2019, non-ODA Boeing managers exerted undue pressure or interfered with ODA unit members.

The second civil penalty, for $184,522, alleges Boeing on Feb. 26, 2020 failed to follow its quality control processes and subjected ODA members to undue pressure or interfered with an airworthiness inspection of a Boeing 787-9.
https://www.faa.gov/news/press_releases/news_story.cfm?newsId=25156
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The $1.21 million payment settles two cases, one alleging the company improperly structured its ODA program and exerted undue pressure or interfered with ODA unit members. The other case alleged it failed to follow its quality-control processes and unduly pressured or interfered with ODA members during an aircraft airworthiness inspection.

“The FAA will be vigilant in its oversight of Boeing’s engineering and production activities, and is actively implementing the certification reform and oversight provisions of the 2020 Aircraft Certification, Safety, and Accountability Act,” said the agency in a statement. “This legislation will allow FAA to assess even greater civil penalties against manufacturers that exert undue pressure on ODA unit members.”

https://www.ainonline.com/aviation-news/air-transport/2021-02-26/boeing-pay-661-million-faa-penalties
ODA and Delegated Option Authorization before it does not work. It is a license to cheat, period. Thousands have died because if it. The solution might be as simple as an aircraft specific FAA sub section that must be funded by a surcharge on the manufacturer with ODA, i.e. the manufacturer pays the costs incurred by the FAA to hire train, and compensate engineers whose job it is to strictly insure compliance. They work for the FAA not any manufacturer or third party organization.
The other thing that needs to be abandoned is 10 to the minus 9th, a calculation made by the manufacturer that allow it to avoid the requirement of redundancy. It is a fiction and a figment of the engineering group's imagination that has also resulted in thousands of deaths. In short if an engineer calculates the chances of failure are one in a billion, there is no need for redundancy even though the regulations may require it. The FAA needs as big an overhaul for safety as the manufacturers but neither is likely to come true.
Arthur
To Arthur (USER-2788752),

I’m not too sure I can agree with much of your note. Here’s why:
• First & foremost, I’m not aware of thousands dying because of ODAs “license to cheat”. Do you have numbers? FAA enforcement actions? NTSB reports & recommendations? You made that statement twice to there must be some basis for it.
• Next, your argument is essentially “the fox is guarding the henhouse”, which has been the cry since Day 1. FAA delegation began nearly a century ago, in 1927, with medical examiners. Designated Engineering Representatives were authorized in 1940 and the first organizational delegation was authorized in 1956. (https://www.faa.gov/about/history/deldes_background/). That is a long, long time for delegation to survive as an integral part of our industry without the FAA or its predecessors reeling it back in.
• In my FAA time I have personally taken action against a designee who exceeded his authority, so the FAA is watchful. See https://law.justia.com/cases/federal/appellate-courts/F2/936/583/402547/. Yes, it is possible for someone to take advantage when the FAA looks the other way, and it happens, but usually there is a price to pay. In aviation, we live on our reputations, which can be hard earned. But ultimately those of us who stick around long enough agree that safety must be paramount, and BS artists are often found out pretty quickly.
• Continuing, the FAA Aircraft Certification Service (AIR) has a bit under 1400 employees. Accounting for administrative staff and management, let’s just say 1200 are “boots on the ground”, working directly with manufacturers and designees.
• Those 1200 engineers & inspectors are accountable for the design & manufacturing approvals AND the continued operational safety of everything manufactured in the United States that flies; every airplane, helicopter, balloon, etc, every nut & bolt, every windshield, etc etc. The GA & Part 135 fleet size is a little over 200,000 (https://www.faa.gov/data_research/aviation_data_statistics/general_aviation/CY2019/) and the Boeing fleet alone exceeds 14,000 (http://www.boeing.com/resources/boeingdotcom/company/about_bca/pdf/statsum.pdf)
• There is no way AIR can directly oversee that many aircraft and manufacturers PLUS the manufacturers of aircraft, engines, propellers, avionics, etc. The FAA has no choice but to ensure the accountability for aviation safety resides where it belongs. Which take us to:
• In 1984, SCOTUS declared “. . . the duty to ensure that an aircraft conforms to FAA safety regulations lies with the manufacturer and operator, while the FAA retains responsibility for policing compliance.” (Ref https://supreme.justia.com/cases/federal/us/467/797/). That does not get the FAA off the hook BUT it properly drops the accountability right in the lap of the certificate holder.
• The FAA is so badly outnumbered that they must depend on two basic characteristics of successful manufacturers and designees: PERFORMANCE and INTEGRITY. Performance: be professional & competent, do the right things for the right reasons, and Integrity: when you make a mistake, “fess up, take corrective action and perform.
• Moving on, your comment that the FAA should hire oversight people and charge the manufacturers is not as easy as one might think. For starters, the FAA is not authorized by law to shift to a “fee for service” mode. Next, in my experience it takes roughly 5 years for an FAA employee to figure out how the system works, and that’s just scratching the surface, so it’s about far more than training and diplomas. Last, with the right people in place, that’s not too far from a third party ODA, which I describe in my opinion piece. So why not stick with what we have right now today?
• As for 10e-9 it appears you believe simple redundancy is better than a calculated safety probability. That’s a pretty simplistic approach, I believe. Three unreliable components can easily be far less safe than a single highly reliable component. A case in point, maybe anecdotal, is the Airbus vs Boeing approach to overwater operations of the A340 vs 777. Airbus tried to make the argument that more is better, that 4 engines are better & safer than two. The upshot is, the twin engine 777, A330 and A350 are going strong while the A340 went out of production 10 years ago, and the 747 & A380 are staggering to their final days. The 10e-9 approach depends on deep, deep analyses and tests, with service histories carefully tracked to improve reliability and lower costs. It truly does work but the industry will pay attention to a better idea if you can offer something.
• Our industry provides the safest means of mass transportation the world has ever seen. Mistakes are made, bad actors at the individual and corporate levels are out there but they eventually get caught. And I’m proud to say the vast majority of people I’ve worked with in my 41 years care, really care, about the integrity of our industry.
• Thank you for your comment. Please feel free to come back at me but be sure you do it with something more substantial than an opinion.