Transport Committee on Feb. 16th, 2021

[David Turnbull]

The notion of a third sensor did come up. However, it is not the role of the regulator per se to impose the design solution on the applicant. This is how the certification process works. The applicant will propose a design solution, and it's the regulator's job to ascertain whether that solution meets the standard. Design changes were implemented on the 737 MAX, which were found to meet the safety standards and to mitigate the specific concerns that were discovered in the post-accident investigation, without the addition of a third source.

You are correct that other aircraft do indeed have three sources, but that is not the only way that the system can be designed. We evaluated the aircraft with the existing number of sensors and the improvements that were made, and we found them acceptable.

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

Thank you, Mr. Turnbull.

[The Chair, Liberal, Vance Badawey]

Thank you, Mr. Turnbull.

Thank you, Mr. Bachrach. Well done.

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

Thank you, Mr. Chair.

[The Chair, Liberal, Vance Badawey]

We're now going to move on to our second round. We're going to start with Mr. Soroka from the Conservatives for five minutes, followed by Mr. Sidhu from the Liberals for five minutes, Mr. Barsalou-Duval for two and a half minutes, and then Mr. Bachrach for two and a half minutes.

Mr. Soroka, the floor is yours for five minutes.

[Gerald Soroka, Conservative, Yellowhead, AB]

Thank you, Mr. Chair.

Thank you to our two presenters today.

My first concern, which I've heard from a lot of people, is that this aircraft has been in service for many decades and it's had many modifications over the years, but when it came to the certification process, I'm just wondering, as are many others, if that was just a rubber stamp because it's been the safest aircraft for many decades. Is that potentially the case?

Either witness can answer that.

[Nicholas Robinson]

I'll take it, Mr. Chair.

No, it wasn't a rubber stamp. I'll refer back to one of the key issues that have found us here today, which was that the company, Boeing, was withholding information from the FAA with regard to the full extent of the MCAS system. The validation approach that we took was similar to the validation approach we took on many aircraft that we reviewed from other certification authorities.

In this case, we had a manufacturer that didn't fully articulate to the certifying authority, the FAA, the full extent of MCAS.

[Gerald Soroka, Conservative, Yellowhead, AB]

Okay. We did talk a bit about the changes that were made in the aircraft. Could you explain some of the changes that were made before recertification to make this plane safe?

[David Turnbull]

Yes, certainly. There were a number of changes, some of which were not directly related to the accident. There were some discoveries with respect to the need to separate some wire bundles to prevent some common failures. A lot of the work was done with respect to software changes to the flight control computer, specifically with MCAS, to limit the power and the frequency in which MCAS can fire. MCAS can only fire once per flight now.

The use of the electric trim switch on the control column can actually disable MCAS, which was not the case before. Its authority in terms of the degree and the rate to which it can change the angle of the horizontal stabilizer is limited to allow the pilot to overcome that input. There are some features added that allow a comparison between the left and right AOA sensors that will prevent the propagation of errors through to the following systems.

A lot of it, in addition to those changes to the flight control computer, involved changes to the procedures to allow for improved pilot awareness—in other words, situational awareness in failure modes or failure scenarios that can still occur. One of the key findings of the accidents and our post-accident investigation was the degree to which the pilots in general were not prepared and not trained to deal with the types of failures that are deemed possible. That's a common theme.

We also discovered that the simulators that were used for training were not programmed to demonstrate the faults that actually occurred in the accidents. That has been fixed.

Then, of course, Transport Canada went above and beyond and recognized that the erroneous firing of the stick shaker, which is part of the stall warning system, is deemed to be extremely distracting and definitely a negative in respect to pilot workload. The failure case, which is still possible within the aircraft, trips off a number of what we call “cockpit effects” that the pilot has to deal with. In our judgment—and the EASA agreed with us—the ability to disable that erroneously firing stick shaker was a required improvement to reduce the pilot workload in these foreseeable failure scenarios to an acceptable level.

That's a sort of very high-level summary.

[Gerald Soroka, Conservative, Yellowhead, AB]

You brought up the training requirements. I know that the Minister of Transport has said that, in order for this plane to get certified, there had to be training. Was this specifically just on the MCAS system or were there other training requirements as well?

[David Turnbull]

It goes beyond that. That's a good question.

As I said, some of the failure modes that occurred are still possible within the aircraft. The objective here in general, as is always the case in aircraft certification—or should be the case—is to make the training commensurate with the design. In other words, if there are systems that rely on pilot intervention—in other words, the pilot is expected to intervene to correct a failure situation—it is critical that the training be customized to emphasize that reliance on the training.

That was something that was noticed and was missed in the original job.

[The Chair, Liberal, Vance Badawey]

Thank you, Mr. Turnbull and Mr. Soroka.

We're now going to move on to Mr. Sidhu.

Mr. Sidhu, you have five minutes.

[Maninder Sidhu, Liberal, Brampton East, ON]

Thank you, Mr. Chair, and thank you to our witnesses for joining us today.

For either Mr. Turnbull or Mr. Robinson, what impact would you say the Boeing MAX file has had with regard to international co-operation by different aviation authorities?

[Nicholas Robinson]

I'll go back to my opening remarks, in that the coordination and collaboration between international authorities has been significant from the beginning of this process. The FAA are the certifying authority, but as my colleague Dave pointed out in some of the changes that were just outlined there, I would say that the other three authorities were also leaders in ensuring that those changes were made to that aircraft.

The four authorities together continuously meet and met to discuss this aircraft, to discuss the review of the aircraft and to exchange ideas of the aircraft. They met within the group of four but also bilaterally and trilaterally at times.

Now that we are committed to looking at the reviews—particularly, I would say, the joint authorities technical review that we as well as other certification authorities participated on—we're committed to working with the United States in making sure that those recommendations are implemented in a consistent manner that has harmony across the four authorities.

[Maninder Sidhu, Liberal, Brampton East, ON]

Mr. Turnbull, you mentioned earlier there were many differences between our own system and that of the FAA.

Can you elaborate more on that?

[David Turnbull]

I wouldn't express that there were many differences. We each have a delegation system. At their very root, or the reason for their existence, they are similar. The key comes down to, in my view, the degree of oversight that is carried out by the authority. We both delegate responsibilities, but in our system and in the FAA, as it should be, the fact you've delegated authority does not preclude, or alleviate the responsibility of the regulator to understand the design. That's key to this issue.

Clearly, in the case of the 737 MAX, there were issues about the aircraft design that were not known and not understood by the FAA. That's the fundamental starting point of where this happened. As I've explained previously to an earlier question, our delegation system has traditionally evolved to a point where we consider a certification project as a partnership with our delegated applicants. We work hand-in-hand with them, and we work on this together.

The decision at the end, the individual decision of delegates to make the individual determination of compliance to all the standards the aircraft must meet, is truly given and done by them, but that decision is not made without our full knowledge and concurrence right to the end of the project.

The possibility of there being something unknown or not understood in our system, and to a great degree with many of the certifications that come from the FAA, are of that nature. Something happened with respect to the dynamic between Boeing and the FAA in that particular instance. We all know the story. It's not the way it's supposed to work.

[Maninder Sidhu, Liberal, Brampton East, ON]

Thank you for that Mr. Turnbull.

Mr. Turnbull or Mr. Robinson, what other countries have given approval for the Boeing MAX to fly again? Can you provide some insight into that?

[Nicholas Robinson]

I can speak specifically to the four certifying partners, Brazil, the Europeans, us and the FAA. The FAA has certified the aircraft, and all three other partners have validated the aircraft. This will allow other authorities, and you can imagine global authorities all over the world, to determine when they're going to approve the aircraft.

I'll also note that this aircraft was relatively new. Unlike some other aircraft, when it was grounded, there will be some authorities that won't need to allow this aircraft to return, simply because it was not flying in their airspace.

We can provide the latest information we have to the committee at a later date, but I wouldn't want to list off all the countries right now, because it's changing as individuals are completing their reviews.

[The Chair, Liberal, Vance Badawey]

Thank you, Mr. Robinson.

We're going to move on to Mr. Barsalou-Duval, for two and a half minutes.

[Xavier Barsalou-Duval, Bloc, Pierre-Boucher—Les Patriotes—Verchères, QC]

Thank you, Mr. Chair.

I'm going to continue the line of questioning around aircraft safety. My question is for Mr. Turnbull.

The activator is a mechanism that triggers the actuator, which raises and lowers the aircraft's horizontal stabilizer. The Boeing 737 MAX is equipped with only one activator, when most aircraft with a similar capacity are equipped with at least two activators to ensure the aircraft functions properly.

Would you say it's safer to have a single-activator system or a multi-activator system, as is found in most other aircraft?

[David Turnbull]

I'm trying to understand your question. Actuators of what? Are you speaking to the AOA vane, or are you speaking to the actuator that controls the horizontal stabilizer?

[Xavier Barsalou-Duval, Bloc, Pierre-Boucher—Les Patriotes—Verchères, QC]

The one that controls the horizontal stabilizer.

[David Turnbull]

Okay.

[Xavier Barsalou-Duval, Bloc, Pierre-Boucher—Les Patriotes—Verchères, QC]

Is it better to have one or more?

[David Turnbull]

I'm not going to be able to get into the details of which aircraft have different numbers of actuators. Some of my specialists who report to me would know that. All I can say is that the compliance to the standards includes an analysis of all the failure modes. It includes a thorough look at the redundancy certain systems have. Aircraft systems can be designed with different layers of redundancy. It's dependent on the probability of failures; that determines whether they meet the requirements.