ICAO's USOAP audits member States to ensure effective oversight of the Safety Annexes to the Chicago Convention.
by Ruwantissa Abeyratne
The Issue
On Thursday, July 11, the United States Senate announced that Boeing CEO Dave Calhoun must appear before the committee again as they draft legislation aimed at enhancing the US Federal Aviation Administration’s oversight of manufacturers and improving quality control. This hearing is anticipated to occur next month.
Earlier in May this year, federal regulators determined that Boeing employees could continue performing some safety analyses on the company’s aircraft, but only for three more years rather than the five-year extension the company had requested.
 |
| KLM Boeing 777 Touches Down on Kaagbaan at Amsterdam Schiphol - Morning Arrival [ Photo: Etienne Jong/ Unsplash] |
Officials from the Federal Aviation Administration (FAA) explained that the decision was made to enhance oversight of Boeing.
For over a decade, the rules have allowed employees of aircraft manufacturers to be authorized to carry out specific tasks for the FAA. This practice faced increased scrutiny following two fatal crashes of Boeing 737 Max jets and claims that Boeing employees had misled regulators about a critical flight system on the aircraft.
The History
In 2018 and 2019 Boeing faced multiple liabilities as a result of two air crashes of its 737 MAX 8 aircraft – an upgrade of its standard 737 aircraft – within a span of 5 months. On 29 October 2018, the Indonesian carrier Lion Air operated Flight 610 – a scheduled domestic flight operated from Soekarno–Hatta International Airport in Jakarta to Depati Amir Airport in Pangkal Pinang, which crashed into the Java Sea 12 minutes after takeoff, killing all 189 passengers and crew. On 10 March 2019 a Boeing 737 MAX 8 aircraft of Ethiopian Airlines operating an international flight bearing number ET 302 crashed six minutes after takeoff, killing all 157 people aboard.
It is believed that at the heart of the defect in the aircraft was a piece of computer application called MCAS, (Maneuvering Characteristics Augmentation System) which the pilots were unable to override. MCAS – a seemingly sophisticated piece of digital application – is meant to act as an automated safety feature on the 737 MAX 8 that is calculated to prevent the plane from entering into a stall or losing lift. In both the Lion Air and Ethiopian Airlines flights the angle of attack sensor – a small blade sticking out of the cockpit which records the angle of the aircraft in flight – had erroneously told the MAX 8’s flight computers that the aircraft was climbing much more sharply than it was, pushing the aircraft into a nosedive. As a result, pilots were left wrestling with an aircraft that was repeatedly plunging towards the ground for no reason.
Yet another incident occurred in January 2024 when an Alaska Airlines Boeing 737 MAX aircraft experienced a fuselage rupture seven minutes after takeoff, at an altitude of 3 miles (4.8 kilometers) above Oregon, forcing the pilots to perform an emergency landing. Although none of the 171 passengers or six crew members sustained serious injuries, the sudden cabin pressure drop triggered the deployment of oxygen masks. National Transportation Safety Board Chair Jennifer Homendy noted that the two seats next to the damaged section were unoccupied.
As a result of this incident, The FAA mandated the grounding of certain Boeing Max aircraft operated by U.S. airlines or flown into the country by foreign carriers until they undergo inspections. This emergency order impacted approximately 171 planes globally.
The Rules
In 2019, consequent to the two crashes, I gave a public lecture in Montreal invoking the relevant rules of aircraft certification and oversight, saying they are inconsistent with the practice of delegation of oversight by aeronautical authorities to aircraft manufacturers. The rules are as follow:
Article 33 of the Chicago Convention provides that certificates of airworthiness and certificates of competency and licenses issued or rendered valid by the contracting State in which the aircraft is registered, would be recognized as valid by the other contracting States, provided that the requirements under which such certificates or licenses were issued or rendered valid are equal to or above the minimum standards which may be established from time to time pursuant to the Convention.
Annex 8 (Airworthiness of Aircraft) to The Chicago Convention which addresses issues of airworthiness of aircraft provides that the State of manufacture is required to ensure that each aircraft, including parts manufactured by sub-contractors, conforms to the approved design, and that the State taking responsibility for the production of parts manufactured under the design approval has to ensure that the parts conform to the approved design.
Standard 3.2.1 of Annex 8 specifically addresses the issue of certification and continued validity of the Certificate of Airworthiness and requires that the State of Registry must ensure that each aircraft complies with the appropriate airworthiness requirements of the State of Design and the State of Manufacture. The aircraft must be certified to conform to the standards of design and manufacture set forth by these states to ensure safety. This standard mandates that the State of Registry must certify that an aircraft adheres to the specified design and manufacturing standards, ensuring its airworthiness and compliance with international safety norms.
There are other relevant provisions in the Annex which require that the State of Design has to ensure that, where the State of Manufacture of an aircraft is other than the State of Design, there is an agreement acceptable to both States to ensure that the manufacturing organization cooperates with the organization responsible for the type design in assessing information received on experience with operating the aircraft . The State of Manufacture of an aircraft is obligated to ensure that, where it is not the State of Design, there is an agreement acceptable to both States to ensure that the manufacturing organization cooperates with the organization responsible for the type design in assessing information received on experience with operating the aircraft .
There is also a requirement (not specifically aimed at manufacturers) that compliance with the Standards prescribed as above is required to be established by flight or other tests conducted upon an aeroplane or aeroplanes of the type for which a Certificate of Airworthiness is sought, or by calculations based on such tests, provided that the results obtained by calculations are equal in accuracy to, or conservatively represent, the results of direct testing . The determination of data that would ensure reasonable safety performance of the aircraft are enshrined in the requirement that such data will be determined and scheduled in the flight manual to provide operators with the necessary information for the purpose of determining the total mass of the aeroplane on the basis of the values, peculiar to the proposed flight, of the relevant operational parameters, in order that the flight may be made with reasonable assurance that a safe minimum performance for that flight will be achieved .
Of some relevance to the Lion Air and Ethiopian Airlines flights is the requirement in Annex 8 to the effect that after the end of the period during which the take-off power may be used, the aircraft should be capable of continuing to climb, with the critical power-unit inoperative and the remaining power-units operated within their maximum continuous power limitations, up to a height that it can maintain and at which it can carry out a circuit of the aerodrome . Standard 2.3.1. of Part III of the Annex prescribes that the aircraft has to be controllable and maneuverable under all anticipated operating conditions, and it shall be possible to make smooth transitions from one flight condition to another (e.g. turns, sideslips, changes of engine power, changes of aeroplane configurations) without requiring exceptional skill, alertness or strength on the part of the pilot even in the event of failure of any power-unit. A technique for safely controlling the aeroplane is required to be established for all stages of flight and aeroplane configurations for which performance is scheduled.
The Role of the FAA
One of the critical and contentious issues that was seemingly inconsistent with these Standards was that the FAA had delegated its certification task to manufacturer of the aircraft, giving rise to the relevance of the legal maxim which forms the principles of natural justice – Nemo debet esse judex in propria causa- which states that no one should be a judge in his own cause. The 737 Max was approved under the FAA’s “Organizational Designation Authorization” (ODA) program, which allows aircraft manufacturers to certify parts of their own designs with limited federal oversight. Arguably, the FAA may not have sufficient resources to handle within the Agency the task of certifying all aircraft manufactured in the United States and therefore applied this principle and, as a practice The FAA had long delegated some safety certification duties to companies and individuals, as resource limitations have meant that agency employees can’t personally monitor every aspect of certification processes. The downside of this practice is that The ODA program, gives companies such as Boeing unprecedented authority to certify the airworthiness, and accordingly the safety, of their own planes.
The New York Times reported in October 2019 that the program, since its introduction in 2005 had ineluctably faced repeated criticism from the Transportation Department’s inspector general who had warned in 2015 that under the program the agency was not prioritizing oversight of “the highest-risk areas,” such as new aircraft designs, and that it didn’t have an adequate system for determining whether the teams overseeing certifications were sufficiently staffed.
The New York Times went on to say that during the 737 Max certification process in July 2015, the agency “handed nearly complete control to Boeing” as the company was “racing to finish the plane” to compete with a rival manufacturer Airbus and its Airbus 320 NEO aircraft. “FAA engineers determined after the October 2018 737 Max crash that they did not “fully understand the automated system” that contributed to the crash, and that the regulator “had never independently assessed the risks” of the system before approving the jet the previous year”.
My Take
There are quite a few anomalies that have to be considered, some of which concern the International Civil Aviation Organization (ICAO). As the watchdog and specialized agency of the United Nations on international civil aviation, the ICAO Council is responsible for the adoption of all 19 Annexes to the Chicago Convention. However, except for Annex 2 (Rules of the Air) States are not obligated to adhere to Standards or follow them as the Chicago Convention effectively precludes any mandatory quality or characteristics of the provisions of the Annexes. Therefore one could assume that the FAA is not legally bound to follow the provisions pertaining to the certification of aircraft, hence the delegation to the manufacturer. In other words, the Annexes are purely discretionary instruments.
However, the Chicago Convention identifies, as aims and objective of ICAO inter alia, to develop principles and techniques of air navigation. In the face of this contradiction in terms, it is heartening, even at this late stage, that the United States Senate is considering legislation that would enhance FAA oversight.
ICAO’s Universal Safety Oversight Audit Program (USOAP) is designed to audit each member State as to whether they exercise effective oversight of the implementation of the Standards of the Safety Annexes to the Chicago Convention. Since the reports of these audits are not publicized but considered inter se, it is difficult to ascertain whether this issue has been considered by ICAO with the FAA.
It now seems opportune that the legitimacy of the Annexes be reviewed.
Finally, one of the questions that would arise in the B737 MAX 8 issue is whether an aircraft manufacturer must merely ensure that an aircraft is safe to fly and that there is no attendant responsibility for the manufacturer to make an aircraft “safe” to crash. This distinguishes between the manufacturer’s liability for not making the aircraft perform safe navigation, and not making the aircraft “safe” to land, for instance, in water in an emergency. In other words, the manufacturer would be liable for avionics but not necessarily liable for fixing an apparatus that could be deployed in a landing on water. This principle was enunciated in the 1966 analogy of Evans v. General Motors Corp where the court held that it was unreasonable to expect a manufacturer to make a motor vehicle accident proof or fool-proof when the danger to be avoided is obvious to all. What the court held was that the vehicle must be reasonably fit to carry out its major function of providing safe transport, but it cannot be expected that it would be equipped with a pontoon if it accidentally fell into the water.
The above analogy does not apply where the defect would lie in the core function of the vehicle – that of providing safe transport. In other worlds a car cannot be equipped by the manufacturer with defective brakes or a defective steering wheel. Similarly, an aircraft manufacturer cannot claim immunity from liability if a defective piece of avionics equipment is installed in an aircraft.
Dr. Abeyratne teaches aerospace law at McGill University. Among the numerous books he has published are Air Navigation Law (2012) and Aviation Safety Law and Regulation (to be published in 2023). He is a former Senior Legal Counsel at the International Civil Aviation Organization.
Post a Comment