Why did the FAA allow Boeing to self-regulate?

Question

Amidst the Boeing 737 MAX crisis, and finding out after those two fatal crashes that Boeing's 737MAX had been issued self regulation power by the FAA, it has always bothered me, why did the FAA do that in the first place?

I could perfectly understand that the FAA couldn't keep up with the advancement in technologies from aircraft manufacturers, but why give this self-regulatory power? This was clearly a recipe for disaster.

If the FAA couldn't keep up, why not instead pass this regulation approval to a coalition of representatives of multiple organizations like NASA, AIA, AOPA, ICAO, etc.

Even random pertinent staff from other companies could be selected in the same fashion there is jury selection for impartiality.

Giving thoughts to this, I think all aircraft should be approved in this manner in a global participation collaboration, and I think it would achieve faster certification and more perfect aircraft.

Answer 1

The MAX fiasco wasn't a case of the FAA being behind the technology, or a case of "self regulation" in the sense of Boeing being left completely alone.

It was a case of the relationship between the regulator and OEM becoming a bit too intimate and comfortable, resulting in the FAA accepting a flawed risk/failure effects analysis to justify a system architecture that might not normally get past them. In this particular case the single AOA vane input channel for the MCAS system, justified because the event risk case was piggybacked onto an existing failure mode (stab trim runaway).

In other words, the FAA accepted Boeing's analysis that the existing failure procedures for stab trim runway (only a "major" event classification event IIRC, in the minor/major/hazardous/catastrophic risk assessment structure), and the associated risk category, made the single channel input acceptable from a risk perspective. In the spinning galaxy of technical and political issues revolving around the whole MCAS story, that's the basic root issue when you dig all the way down.

These sorts of problems that come up during certification, and clever bandaid solutions implemented to deal with them, are nothing new. When you see strakes and VGs and vortilons on wings and tails, they are usually band aids to fix a problem that came up unexpectedly during flight testing and avoided a major redesign. MCAS was a bandaid solution using software and some hardware integrated into the stab trim and stall protection system.

Boeing had a wing flutter problem during the 747-8 certification, where unanticipated aerolastic wing flex problems resulted in a low frequency vibration of the entire wing, fixed by the most amazing band-aid I've ever heard of, using the normally dormant fly-by-wire ailerons as active flutter dampers in cruise, almost entirely with software. You can bet there were a lot of reports provided to the FAA to get that certified.

In the case of MCAS, there was a fairly unique set of circumstances, and a system architecture was approved that shouldn't have been, basically because of too much trust, and key individuals dropping the ball.

And this is the conundrum. The regulating agency will grant a certain amount of trust in the OEM, because the staff level would have to triple if the regulator is going to review and challenge every detail of an OEM's design proposal.

Typically senior engineers within the OEM are granted a delegated approval status by the regulator for smaller mods, and they also become the primary engineering interface with the regulator for approval of the major stuff (in Canada they are called Design Approval Delegates, or DADs). Normally there's a reasonable balance struck when all parties are operating in good faith. This was a case where that failed, but it does work reasonably well 99.9% of the time.

Answer 2

The FAA does not have enough resources to post inspectors to all the situations that require them, so it relies on the concept of delegation through designation to do its job. That ranges from Designated Examiners for people seeking pilot licenses or ratings, to Designated Airworthiness Representatives for issues related to aircraft inspections, etc. It is a normal practice that cannot be replaced by simply swelling the ranks of the FAA with many more employees. In airline manufacturing environments, some employees become the FAA's designated personnel to perform those functions.

Answer 3

Boeing isn't just any manufacturer. It's a vital supplier of US DoD. It's essential to the US to have a successful domestic manufacturer for large commercial airframes, not just out of pride, but also to use that expertise for its military needs.

In simple terms, this means Boeing is "too big to fail", it has to stay in business and afloat. This has resulted in some preferential treatment when it came to the MAX case; the company's executives were spared prosecution to avoid disrupting the business.

Multi-agency, and especially multi-national regulations and approvals always take much longer to achieve. One agency is always quicker than two. Zero is even quicker than one. The purpose of regulation isn't to make airplanes as safe as possible - it's to strike a balance between safety and commercial needs.

In Boeing's case, the FAA has allowed this balance to shift a bit towards commerce. Some major decisions that require FAA approval were treated as minor ones that don't. Boeing still follows the same rules as all others, it's just that they get more trust and less micromanagement.

Answer 4

Where did the FAA fail?

The catch here is it didn't necessarily fail due to a lack of regulation. Had Boeing made a 7107 (imaginary for the sake of argument) instead of the 737-MAX, it would have required complying with all the regulations the FAA has for a brand new type of airplane. But the 737 is the most popular passenger aircraft in the world (it's been around since 1967!), and is ubiquitous in terms of ecosystem (piloting, maintenance, etc.). Boeing was banking on that when they started the MAX program.

“Our marching orders are no training impact on this airplane. Period,” Richard Reed, a former Federal Aviation Administration engineer, recalled a senior Boeing official telling him during a meeting in the early years of the MAX’s development.

The key piece of the puzzle here is that the FAA has a process where airplane manufacturers and can avoid all sorts of regulatory red tape by making a new model of an already approved airplane. Those compliance costs add up quickly, creating a financial incentive to avoid them. As such, Boeing essentially took a 737 and started massaging it, while catering to the FAA's rules regarding redesign. The best example of this is that the cockpits were virtually identical.

"FAA-approved this for two-and-a-half hours of computer-based training for the transition between the two aircraft," Wilson continued. "All the overhead panel switches are the same. The only minor difference is, because of the change in the display, is to move some of the center console items here on the forward console."

Boeing's decision silo

The failure to regulate MCAS (the system that caused the crashes) was due to a series of seemingly small decisions that lead up to the fatal flaw taking shape. I went into detail on this answer, but the TL;DR is that the MAX changed just a bit too much related to the handling vs previous 737 models. MCAS was designed to make small control changes to smooth those differences out. MCAS would not get any dedicated indicators (as a standard option) for the sake of the "same cockpit" narrative.

Due to a failure of internal Boeing communication, MCAS was made four times more powerful than the original spec, and could activate at lower altitudes. Add in issues with the system that told MCAS what the plane's angle of attack was, and you have a recipe for disaster. Because that was not properly communicated outside the group that made the change (something known as a corporate silo), Boeing scarcely mentioned it and airlines left it out of manuals, meaning few pilots even knew the system existed. The FAA accepted that pilots could use known indicators and procedures (runaway stabilizer) to turn it off in a safe amount of time.

It wasn't until you have two crashes of the same airplane type that this methodology of recertification falls apart. Boeing wasn't required to disclose the existence of MCAS, or what decisions lead to its eventual unsafe state. The FAA noted that in their report (12.2.2 sec 4, emphasis mine)

Based on the JATR team’s observations and findings related to the FAA type certification process, JATR team members recommend that the FAA review and update guidance pertaining to the type certification process with particular emphasis on early FAA involvement to ensure the FAA is aware of all design assumptions, the aircraft design, and all changes to the design in cases where a changed product process is used. The FAA should consider adding feedback paths in the process to ensure that compliance, system safety, and flight deck/human factors aspects are considered for the aircraft design throughout its development and certification.

In short, Boeing didn't "self-regulate", as much as know the existing system well enough to avoid enough questions being asked to catch the MCAS problem before it became deadly.