Evidence of meeting #3 for Transport, Infrastructure and Communities in the 43rd Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was aircraft.
A recording is available from Parliament.
Liberal
The Chair Liberal Vance Badawey
I'd like to call this meeting to order.
Welcome, everybody. We are here today between 3:30 and five o'clock to discuss the Max 8.
We have members of the Department of Transport with us: Mr. Nicholas Robinson, director general, civil aviation, and Mr. David Turnbull, director of national aircraft certification.
Welcome, gentlemen.
Are you going to go first, Mr. Robinson? You have 10 minutes. We'll follow that with questions. Go ahead.
Nicholas Robinson Director General, Civil Aviation, Department of Transport
Good day, Mr. Chair, Vice-Chair and committee members.
Let me begin by introducing myself. My name is Nicholas Robinson and I am the Director General of Civil Aviation at Transport Canada, responsible for aviation safety.
I am joined here today by my colleague David Turnbull, who is the Director of National Aircraft Certification at Transport Canada.
We are pleased to be here today to support this study related to aircraft certification.
Mr. Chair, let me start off by saying that Canada has one of the safest civil aviation systems in the world. We have achieved this by an unwavering commitment to safety and as a result of an exceptional level of expertise and technical experience that allows for us to make evidence-based safety decisions in this very highly complex, continuously evolving environment.
The certification of an aircraft involves careful examination of the proposed design to verify that the aircraft complies with airworthiness standards and regulations, in short, all the things we expect an aircraft to have to make it safe to fly in Canada.
In the case of a Canadian company manufacturing an aircraft or an aeronautical product such as an engine, for instance, Transport Canada is deemed the certifying authority. That means that state authorities globally look to Canada to ensure the product meets the high safety standards that we set.
This process is aligned with the recommended practice that the International Civil Aviation Organization, commonly referred to as ICAO, has set out in annex 8 of their convention, whereby states do not perform the same in-depth determination of compliance that the state of design has already completed. Instead, states may accept the original certification or use it as the basis for validating the certification.
The certification of an aerospace product is not done overnight. From the application date to the approval, the overall process takes years. Transport Canada works closely with the manufacturer during that period.
In examining past projects we can expect that the testing and analysis phase takes approximately two or more years to complete.
As an example, Transport Canada's certification of the A220 aircraft, formerly known as the Bombardier C Series 300 or 100, took well over 150,000 person-hours to complete over multiple years.
When it comes to products that are not Canadian made, Transport Canada's role consists of validating the certification decisions made by the state of design—the home country of the manufacturer. This ensures that the aircraft or product is safe for use in Canada and complies with our Canadian regulations and our own expectations.
Much like in the case when Canada is certifying a product, we are looking at another major certifying authority, such as Europe's, which is commonly referred to as EASA, the U.S. FAA, or Brazil's ANAC, to lead in the review. In the case of the Boeing 737 Max, the U.S. is the state of design of this aircraft. This means that the Federal Aviation Administration, the FAA, is the certifying authority, and we and other states are validating that certification.
Now, I would like to speak more specifically to the two tragic accidents that took place involving the Boeing 737 Max aircraft.
First and foremost, Mr. Chair, our thoughts continue to go out to the victims and the families of those who have been impacted by the Lion Air and Ethiopian Airlines accidents. Canada is working hard so that other families don't have to suffer through a similar tragedy such as these.
Transport Canada's actions related to the Boeing 737 Max aircraft were first made in response to the October 2018 Lion Air accident. Following that tragedy, Canada developed and implemented, in strong collaboration with our three Canadian operators that fly the Max, which are Air Canada, Sunwing and WestJet, enhanced training requirements for pilots, which exceeded the standards implemented by the American AD and other countries.
These standards were intended to address the runaway trim stabilizer condition that has been identified as a contributing factor in the Lion Air accident and discussed widely in media reports. This was on top of the actions the U.S. undertook as the state of design, and Canada was the only country to put these additional measures in place.
Following the Ethiopian Airlines accident that occurred on March 10, 2019, Transport Canada officials immediately began to assess the risks and the need for additional actions beyond those already taken globally, as well as those taken independently in Canada. Upon receiving and analyzing new satellite data, the department made the determination to close Canadian airspace to the aircraft, the Boeing 737 Max, commencing on March 13, 2019. We received that new data that same morning.
This action demonstrates that Canada makes evidence-based decisions and that we do not hesitate to take action when safety issues are identified. Transport Canada is continuing its independent review and validation of the Boeing 737 Max changes while we continue to work extensively with the state of design and civil aviation authorities in Europe and Brazil and across the globe to realize a possible global return to service of this aircraft. To that end, Canada is taking a leadership role with international authorities to address all factors necessary to achieve a safe return to service. The scope of our review and our concerns have been communicated to the FAA, and Transport Canada officials continue to seek information and assurance on these points.
There are three key areas of concern for Transport Canada that are broader than the maneuvering characteristics augmentation system, commonly referred to as MCAS, which has been commonly reported. These are acceptable levels of pilot workload, the flight control system or architecture for the aircraft, and a minimum training requirement for crew members to operate this aircraft safely.
Until our questions and concerns are satisfactorily addressed, Transport Canada will not lift the airspace restriction on this aircraft.
Additionally, Canada joined the FAA, the National Aeronautics and Space Administration, or NASA, and other civil airworthiness authorities in conducting a comprehensive technical review of the Boeing 737 MAX flight control system. On October 11, 2019, the FAA published the Joint Authorities Technical Review's independent report of the certification process of the aircraft, which includes recommendations brought forward by the review committee.
Our transportation experts continue to work tirelessly on the review of this aircraft, and I am proud of the leadership they have taken to date. Mr. Chair, allow me to assure you and the committee that Transport Canada remains steadfast in its commitment that the Boeing 737 Max will not be permitted to fly in Canada until all concerns have been addressed by the manufacturer and the FAA, and that adequate safety measures for flight crews are in place.
I trust that the foregoing information will serve to shed some light on the aircraft certification process at large as well as on Transport Canada's involvement in the ongoing Boeing 737 Max review. We look forward today to addressing additional questions the committee may have on either subject.
Thank you.
David Turnbull Director, National Aircraft Certification, Department of Transport
I have no opening remarks prepared. I'm prepared to receive questions.
Liberal
The Chair Liberal Vance Badawey
Once again, thank you, gentlemen.
We are going to start off with the Conservatives.
Mrs. Block, you have six minutes.
Conservative
Kelly Block Conservative Carlton Trail—Eagle Creek, SK
Thank you very much.
I didn't realize I was going to be asking questions first, but I am very grateful for the opportunity. It's good to be back at the transportation committee table.
I want to thank our witnesses for their opening remarks.
I want to acknowledge that it's been less than 18 months since the tragedy that claimed the lives of 189 people, as well as less than 12 months from the time of the tragedy that claimed the lives of 157 people. As you mentioned, our thoughts and prayers remain with those families who have lost loved ones. Not only were they left to grapple with their grief, but they were also left with far too many questions, I think many of which still need to be answered as the 737 Max remains grounded.
From your testimony, I think we see that there has been much work done, and I am pleased that the transportation committee is undertaking this study. It has agreed to adopt the motion that was introduced in the last Parliament to this committee, but was blocked by the members opposite, with absolutely no rationale given for that.
This is a non-partisan issue and it is something that I think we all agree on. We need to try to understand the process of certification that takes place not only here in Canada but also with our partners around the world when it comes to allowing other aircraft to serve our country.
You mentioned in your opening remarks that you had joined the FAA, the National Aeronautics and Space Administration and other civil airworthiness authorities in conducting a comprehensive technical review of the Boeing 737 Max flight control system, and that independent report includes recommendations that were brought forward.
Could you list those recommendations for us?
Director General, Civil Aviation, Department of Transport
Mr. Chair, we could provide all of those recommendations. There are a number of different recommendations, 12, in the report, and we could provide you with those. Those are public.
We are working with the other authorities globally to look at how we may address those recommendations. We could provide those to you.
Conservative
Director, National Aircraft Certification, Department of Transport
I could go over the top three.
Director, National Aircraft Certification, Department of Transport
We'll provide the entire list. The JATR report came out with 12 separate recommendations. Some of them somewhat overlap the others, so I'll attempt to briefly describe them at a high level.
The fist one relates to the application of what we call the changed product rule, which is a regulation that deals with how we determine the applicable standards to an aircraft that is changed or modified. Some people use the term “derivative model” when you have one existing model and you do a modification to create a new model. This will happen successively over a number of years. In the case of the 737, it has gone through numerous generations or reiterations of the design.
That recommendation speaks to the fact that we struggle internationally with a common interpretation or application of the rule. Despite the fact that the rule has been completely harmonized and from a regulatory perspective remains common between the various authorities, it is the actual application of the rule that is sometimes open to interpretation.
The basic gist of the issue is this. At what point, when you're adding successive changes or additions to an aircraft, do you go back and establish that you have to apply the newer standards and also the newer interpretations of the standards or processes we use that have been developed over time to evaluate the aircraft?
In the case of the 737, it's been alleged that the aircraft was derived or added to in numerous cases, and yet in some cases the standards remained the older standards that were applicable to the previous derivatives, and that possibly the scope of the review, in the context of evaluating the new changes, was not as wide as it should be. That is an area which we already had on the table prior to these accidents, actually; it's not a surprise to us at all that the changed product rule is an area that will require further honing and international harmonization.
The next one—and again, I'm boiling the 12 down to three themes, just for brevity here—is the delegation systems, of course. I'm sure you've heard discussions about that. One of the recommendations speaks to another look at or another examination of the various delegation systems that exist. Do the authorities have sufficient expertise and a sufficient degree of oversight into what these delegated entities are doing? Also, are there enough systems and protections in place to avoid any undue pressure on these delegates, who are employees of the company?
The third theme speaks to what we call development assurance practices. It links back to the changed product rule topic to some extent. As aircraft have evolved in complexity, modern aircraft today involve systems that are no longer separated. The term we use is “federated”. They have systems that are typically driven by software and are highly interactive. In other words, they speak to each other.
In the old days, we used to go in and analyze discrete failures that we could predetermine. In a modern, more complex aircraft, we have to take what's called a design assurance approach, which admits that we have to find a more systemic approach to evaluating the failures and the consequences a little differently than we did in the past, in order to keep up with the evolution in technology.
Part of the challenge with the changed product rule issues that we acknowledge is that, arguably, as you introduce new technologies into an older design, you should perhaps migrate to a more modern design assurance approach, where you look at not just the area that has changed but at how that changed area affects the entire aircraft as well. That's another area where design development assurance practices are well in place for a brand new or what we call “clean sheet” airplane, but they may not necessarily be applied with the same rigour when we're talking about a derivative of a pre-existing aircraft.
At a high level, those are the main hit points in the JATR report.
Liberal
Liberal
Churence Rogers Liberal Bonavista—Burin—Trinity, NL
Thank you, Mr. Chair, and welcome to our witnesses, Mr. Robinson and Mr. Turnbull.
In light of these tragic events, of course, and these tragedies that occurred with the Max 8, this is very challenging for all of us, as Ms. Block said. It's something that weighs heavily on people's minds when you try to discuss these kinds of issues. We're always sensitive to the feelings of the families and the people who were impacted by this kind of tragedy. Also, of course, for all of us, uppermost in our minds is the safety of future flights should these aircraft ever return to commercial flying.
I want to focus on the crash that took place in Ethiopia. I have a couple of questions around that one.
First of all, why did the minister want to see data from Aireon before taking the decision to ground the Canadian fleet? Was there a specific reason for that?
Director General, Civil Aviation, Department of Transport
Following the Ethiopian Airlines crash on the Sunday, as part of our continuing airworthiness process, we immediately began to collect information on what led to the crash. What were the conditions when the flight was happening? What happened to the flight? How far in their flight segment were they? Did we have any sort of performance information on the aircraft? We gained this information through talking with the state of design authority, which is the FAA. They were gathering information from Boeing. We were gathering information from where the accident took place and any other sources of information we had.
This is part of a regular process that we do when an accident happens. We try to gather as much information and then take a particular action if we feel that it's necessary.
We weren't specifically waiting for the Aireon data. In fact, Aireon data wasn't part of our toolbox that we used in looking at aircraft accidents until Ethiopian 302. It's a relatively new available piece of information.
I'll assure the committee, Mr. Chair, that it is actually something we go to right away after accidents. I can point to the accident: the downing of flight PS752 in Iran. That accident occurred in the evening. We had the Aireon data in hand that morning because we learned ways we can improve. We learn after each accident.
We received that Aireon data on March 13. Along with all the other evidence we gathered, that was the piece of the puzzle that allowed us to move forward without reservation and make the determination to close the airspace in Canada. Transport Canada made the determination.
That information was so important because it showed—when we looked at the Lion Air accident and the Ethiopian Airlines accident—clear performance similarities across the two accidents that would have occurred only if there was a clear similarity of failure there. That's why we made the determination at that point.
Liberal
Churence Rogers Liberal Bonavista—Burin—Trinity, NL
How unusual is it to have a catastrophic problem with software, as appears to have happened in the case of the Max 8? Has anything comparable ever happened again?
The other part of that is that you said in your statement that on top of the actions the U.S. undertook as the state of design.... Then you said that Canada was the only country to put additional measures in place. I find that a little perplexing. Why would that be the case?
Director General, Civil Aviation, Department of Transport
Mr. Chair, on the first question about how usual is something like this catastrophic failure, it's not usual at all. This is an exceptional case. We've been looking at this aircraft and examining a possible safe return to service of this aircraft for almost a year now. We continue to examine this. This is not usual practice within our field.
Can you identify the second question again?
Liberal
Churence Rogers Liberal Bonavista—Burin—Trinity, NL
It was where you said that this was on top of the actions the U.S. undertook as the state of design and Canada was the only country to put additional measures in place.
What were these additional measures that you made reference to?
Director General, Civil Aviation, Department of Transport
Typically, the state of design will look at the event that happened with an aircraft and propose a mitigation measure based on their risk analysis and what they see needs to be done to mitigate that risk.
The FAA proposed a mitigation measure through an AD, an airworthiness directive. States looked at that AD and accepted it. That's the usual practice. Less usual is when a state will look and say that they'll accept that AD, but that there's also something more that they may wish to do.
Canada accepted that AD absolutely. We agreed with what the FAA was putting forward, but we worked with our three Canadian operators, Air Canada, Sunwing and WestJet, to further address the issues we saw around ensuring that our aircrew had the appropriate reaction time to this event and knew the appropriate procedures to mitigate this runaway trim stabilizer procedure. We said we're going to make a change. Aircrew had to memorize all five steps to mitigate that risk, as opposed to what was currently there, where they would memorize—or they were told to memorize—two of those five steps, and the other steps were available within the quick reference handbook on the flight deck.
We put that measure in place on November 8, 2018. It was implemented with all our airlines on November 9, 2018, about a week and a couple of days following the Lion Air accident.
Liberal
Bloc
Xavier Barsalou-Duval Bloc Pierre-Boucher—Les Patriotes—Verchères, QC
Thank you very much, Mr. Chair.
I quite liked the information you presented. I see that you are taking the Boeing 737 MAX 8 situation seriously. It can be reassuring to people to know that you take the accidents seriously. You are doing reviews. You are analyzing information that has been gathered. You will not lift the restrictions before you are sure there are no other problems. That is very good, very positive.
However, I wonder if the problem is much bigger than the Boeing 737 MAX 8. I did a bit of research and found that Transport Canada's certification work relied heavily on a kind of mutual recognition of work that is done here and there. Transport Canada looks at work that has been done in the United States, work that the Federal Aviation Administration, the FAA, is doing. A lot of the certification work done by the FAA is recognized.
I wonder, given the incident with the Boeing 737 MAX 8, if that close collaboration and recognition of the work done by the FAA will be reconsidered? Does this raise any questions about the certification that is done here?
Director General, Civil Aviation, Department of Transport
It is a bit difficult for me to answer that question in my second language. Allow me to respond in English.
The validation process is fully independent of what the state of design does with regard to their certification, and it allows us for a continuum of involvement. We can choose, depending on how a state of design certifies. When we look at that certification, we can feel fairly assured with the information that's being presented to us. We can have a minimal level of involvement if we see there is very little risk that we've determined as part of that certification. On the other end, it also permits us to have a very significant involvement in validating the work of that state of design. A perfect example of that is the ongoing work of the 737 Max right now. We've chosen, as a validating state, to conduct our own flight test, as opposed to observing or taking the information from the FAA's flight test. We have chosen to observe or actively participate in a number of the different testing phases, as well as looking in more detail at a number of different envelopes within the certification process that the FAA is undertaking.
That's what this process allows us. The process itself does allow for the flexibility of the validating state to determine how involved it wants to be.
Bloc
Xavier Barsalou-Duval Bloc Pierre-Boucher—Les Patriotes—Verchères, QC
In short, you are essentially saying that you generally have the latitude to choose whether to rely on the information provided by the authorities of the state of design or to run your own tests. That is the current operating practice. Sometimes, when you consider the case to be too risky, you conduct further research, but sometimes you rely on the information provided by the state of design.
Does that sum up what you were saying?
Director General, Civil Aviation, Department of Transport
Yes, we have that latitude.
Bloc
Xavier Barsalou-Duval Bloc Pierre-Boucher—Les Patriotes—Verchères, QC
Okay. You have the latitude to ask questions.
However, if I understand correctly, there is a multilateral recognition plan between Brazil, the European Union, Canada and the United States to accelerate the accreditation process and, I imagine, for that recognition to be applied automatically from one country to another.
In the Boeing 737 MAX situation, the FAA, which does not have enough staff to conduct accreditation research, disclosed that it contracted Boeing to certify its own planes. I find that rather surprising. Is that approach something we agree on? Does this approach cast doubt on the process currently in place?
Director, National Aircraft Certification, Department of Transport
Generally speaking, we do what is necessary.
The ongoing development of the bilateral agreements is based on a fundamental understanding that we recognize through experience that although we may have differences in interpretation, the net results yield an equivalent level of safety. That's the foundation of it.
Our foundation with the FAA and our bilateral agreements go all the way back to 1938. Things will happen and things have happened, incidents that have caused concern and that have caused us to ask these very valuable questions, but the principle of relying on our international partners is fundamental to the way we operate.
As Nick explained, we don't have to throw out the process we have right now. It is scalable. Think of it as a volume button. When things like this happen, we can turn the volume up; we can increase our involvement. When we're investigating an approval, as we are currently with the 737 Max 8, we are, of course, continuing to follow the FAA's lead. They must certify. They must present that which they will accept from Boeing. They are the certifying authority. We will follow, but in following, in many cases, we are talking directly to Boeing. FAA is always in the room. We have the opportunity to maybe get around those concerns, to not be as directly concerned about the degree to which the FAA was directly cognizant of what Boeing is doing or has done and rather to go directly to the source, to an appropriate degree, to find out for ourselves.
That's why I'm quite confident in saying yes, we rely on our bilateral partners. Yes, we have faith and trust in the FAA, but we will investigate independently to determine and validate. It's trust and verify.