Introduction

The first Boeing 737 aircraft was introduced in January 1967. Since then, the original design has undergone many variations. It is the world’s most produced commercial jet aircraft model, with the 10,000^th 737 having been built in March 2018.

The newest variants, marketed as the 737 MAX,^[1] completed a first flight in January 2016 and became, according to Boeing, the fastest-selling airplane in the company’s history. Three Canadian air carriers, Air Canada, WestJet and Sunwing Airlines, operate 737 MAX aircraft.

The 737 MAX was grounded worldwide in March 2019, following two incidents involving 737 MAX 8 airplanes. The first took place on 29 October 2018, when Lion Air flight 610 crashed within minutes of taking off from Jakarta, Indonesia. The second took place on 10 March 2019 and involved Ethiopian Airlines flight 302, which also crashed minutes after taking off, this time from Addis Ababa, Ethiopia.

Subsequent reports by Indonesia’s Komite Nasional Keselamatan Transportasi (KNKT), the United States (U.S.) National Transportation Safety Board (NTSB) and the Joint Authorities Technical Review (JATR)^[2] pointed to issues surrounding the Maneuvering Characteristics Augmentation System (MCAS). The MCAS is a software system that was developed for the 737 MAX to address issues identified at the preliminary design stage, in which the redesigned engines and engine nacelles caused the airplane to pitch under certain circumstances. Essentially, the MCAS was designed to push the airplane’s nose down if it detected an undesired pitch-up that threatened flight stability.

The NTSB report specifically attempted to identify the causes of both crashes. It indicated that in both incidents, incorrect information processed by an angle-of-attack sensor resulted in the MCAS pitching the airplane’s nose down to avoid a perceived pitch-up. The flight crew in both cases were unable to fully counter repeated nose down commands from the system. The report also indicated that a similar issue occurred on the Lion Air aircraft’s previous flight, although in that case the flight crew were able to disable the trim inputs and complete the flight using manual trim.

All three reports pointed to issues with the certification process for the new 737 design, specifically the MCAS. The NTSB recommended that the type certification process be reviewed to require manufacturers to ensure that aircraft are equipped with fail-safe systems in the event that a flight crew’s response to an alert or indicator is inconsistent with the response assumed by the manufacturer. The JATR made 12 recommendations, including that the Federal Aviation Administration (FAA) review the Changed Product Rule, which allows areas deemed unaffected by a design change to not be reassessed.

It is in this context that, on 20 February 2020, the House of Commons Standing Committee on Transport, Infrastructure and Communities (the Committee) adopted the following motion:

That, the committee undertake a study of four meetings in regard to Transport Canada’s aircraft certification process, including, but not limited to, the nature of Transport Canada’s relationship to the Federal Aviation Administration and other certifying bodies, as well as the role of airplane manufacturers in the certification process.

Between 25 February 2020 and 12 March 2020, the Committee held three meetings on this subject and heard from 18 witnesses.

The study having been interrupted by restrictions imposed by the COVID‑19 pandemic, and Parliament having been subsequently prorogued, the Committee adopted the following motion on 29 October 2020:

That, pursuant to Standing Order 108(2), the committee undertake a study on Transport Canada’s aircraft certification process, including, but not limited to, the nature of Transport Canada’s relationship to the Federal Aviation Administration and other certifying bodies, as well as the role of airplane manufacturers in the certification process; that no fewer than two meetings be set aside for this study; and that the evidence and documentation received by the committee during the first session of the 43^rd Parliament on the subject be taken into consideration by the committee in the current session.

The Committee held three meetings on this subject, from 24 November 2020 to 16 February 2021. It heard from ten witnesses and received one brief. In accordance with the latter motion, the evidence and documentation received by the Committee between 25 February 2020 and 12 March 2020 have also been taken into consideration.

The Certification Process in Canada

As the Committee heard from many witnesses, Canada is a respected world leader in aircraft certification.[3] More specifically, it was expressed that Canada has an enviable safety record in relation to commercial passenger aircraft.[4]

Nicholas Robinson, Director General of Civil Aviation with Transport Canada, explained that the certification of an aircraft is a lengthy and complex process whose aim is to ensure that the aircraft is in compliance with Canada’s airworthiness standards and regulations. In the case of an aircraft that is manufactured in Canada, Transport Canada is deemed the certifying authority; as such, it is responsible for the aircraft’s certification. In the case of an aircraft that is manufactured outside of Canada, such as the 737 MAX, Transport Canada’s role becomes that of the validating authority. As such, it reviews the certification decisions of the aircraft manufacturer’s home country, the State of design. During this validation process, Transport Canada must ensure that the aircraft is in compliance with Canadian standards and regulations.

For an aircraft to operate in Canada, it must have a document—known as a Flight Authority—attesting to its fitness for flight. This requirement is outlined in section 605.03(1) of the Canadian Aviation Regulations (CARs). The Flight Authority usually comes in the form of a Certificate of Airworthiness (CoA).

Transport Canada Civil Aviation (TCCA) can issue, on behalf of the Minister of Transport, a CoA in relation to a specific aircraft. In order to be eligible, the aircraft must generally be of a design type that has received certification from the minister by way of a Type Certificate. The aircraft must also be shown to conform to the design specifications of its design type, and to be safe for flight.

Domestic Approval Process for a Type Certificate

A Type Certificate is generally requested by a manufacturer; it is issued by the TCCA on behalf of the Minister of Transport to confirm that the aircraft design meets all applicable standards. The following is a summary of the type certification process for aircraft in Canada that must be followed to fly an aircraft domestically or to sell a Canadian-manufactured aircraft to international customers.

The TCCA acts as a delegate for the Minister of Transport in relation to the certification process. The TCCA determines whether a potential applicant meets the eligibility criteria for the category of aeronautical product that is being proposed before agreeing to review an Application for Design Approval.

Once an application is formally submitted, the TCCA reviews the applicant’s initial conceptual designs or foreign type certificate documents. The TCCA then sets out a certification strategy in collaboration with the applicant that outlines the regulatory and design standards that need to be met. This is referred to as the “certification basis.” As Michael Deer, Airworthiness Specialist with Bell Textron Canada Limited, told the Committee, “early and open communication between Transport Canada specialists and [the applicant’s] specialists is encouraged to ensure engagement and common understanding of our design compliance with the applicable standards.”

Once the strategy is in place, the TCCA and the applicant determine how compliance will be demonstrated, and to whom. It is during this phase that the TCCA’s level of involvement is determined. The applicant’s compliance may be based on its own findings, through a system of delegates from the applicant organization selected by Transport Canada, with ministerial representatives acting as supervisors. At any time throughout the process, the TCCA can review its level of involvement. Witnesses from the manufacturing sector told the Committee that communication between the applicant and Transport Canada remains constant throughout the process.[5]

The aircraft is then built and tested. Once the applicant has demonstrated that it has complied with the certification basis, it must sign a declaration of demonstration of conformity.

The final phase is the issuance of a Type Certificate for the aircraft type. Certificates that have been issued can be found on Transport Canada’s website. The TCCA also prepares a Type Certificate Data Sheet which outlines the specifications of the aircraft type. This must include operating limits, such as speed, occupancy and altitude, engine and fuel types to be used for aircraft of this model, as well as any requirements, exemptions or special conditions that were specific to the certification basis.

At that point, the applicant becomes solely responsible for the aircraft’s continued airworthiness. Any changes to the approved type design, as minor as they may be, must be accepted by the TCCA. Any significant change to the aircraft requires a Supplemental Type Certificate, the process for which mirrors that of a new Type Certificate. It is important to note that the process for a Supplemental Type Certificate reviews the entire finished and modified aircraft, not just the new modifications. This allows the TCCA to review any impact these may have on unrelated systems or specifications.

The Canadian Validation of the Boeing 737 MAX

The current Type Certificate Data Sheet (TCDS) for the Boeing 737 was first approved by Transport Canada in 1985. TCDS A-146 was initially issued for the Boeing 737‑300 Series. Since then, it has been updated several times to include subsequent generations of the 737. The most recent, the 737‑8 Series, marketed by Boeing as the 737 MAX—and otherwise known as the 737 MAX 8—was approved on 23 June 2017. Transport Canada’s TCDS A-146 was based on the information contained in the FAA’s TCDS A16WE.

The Transport Canada Flight Technical and Operator Certification section of the Civil Aviation Standards Branch issued an Operational Evaluation Report (OER) for the 737 MAX on 30 November 2017. According to this OER, the 737 MAX^[6] was subjected to joint evaluations by the TCCA, the FAA and the European Aviation Safety Agency (EASA) in 2016 and 2017.

These evaluations were meant to address whether Boeing’s training programs for the new aircraft were suitable for use by Canadian operations, whether any additional pilot qualifications or training were required in comparison to previous 737 models and whether the 737 MAX was operationally suitable.

Concerns with the Delegation System and the Potential for Self-Certification

The example of the 737 MAX has raised important questions about the delegation system, particularly as it was revealed that Boeing, acting as delegate for the certification of its own aircraft, withheld critical information from the FAA.[7] Mr. Perry raised the concern that the increasing technical complexity of modern aircraft results in a situation in which “it's actually the manufacturer that understands them the best.”

The Hon. Marc Garneau, Minister of Transport, however, pointed out that Boeing was allowed to choose its own delegates in the case of the 737 MAX. Although delegates are indeed supplied from within the applicant company under the Canadian system, Minister Garneau clarified that they are nonetheless carefully selected by Transport Canada. Mr. Robinson added that Transport Canada maintains a close working relationship with manufacturers, with constant discussions and in-concert problem-solving. He does not believe that the communication breakdown that occurred between the FAA and Boeing could take place under the Canadian system. In the context of increasingly complex aircraft, Mr. Robinson also stressed the importance of having the certification and validation process in the hands of experts such as Transport Canada’s national aircraft certification group.

Manufacturers were quick to defend Canada’s delegate system, with Mr. Deer telling the Committee: “At the end of the day, our delegates are the ones who are making the findings of compliance, but the product will never get approved unless Transport Canada involvement has been completed and they are satisfied that the product is safe.”

Throughout the Committee’s study, more specific concerns were raised regarding the potential for commercial pressure to be exercised during the certification or validation process. This was not only a key finding of the U.S. House Committee Report,[8] but was raised in regard to two concern papers written by Transport Canada in relation to its validation of the 737 MAX. Both letters included the following paragraph:

Please note that in order to meet its delivery commitments to the Canadian operators, Boeing has requested Transport Canada to issue its 737-8 MAX ATC in June 2017. To avoid delivery delays to our operators, Transport Canada will review and discuss FAA position on this concern paper during its upcoming 737-9 validation activities. Therefore, this concern paper will remain open when the 737-8 MAX ATC is issued by Transport Canada.[9]

The content of these papers will be discussed further in this report. However, in regard to the perception of commercial pressure, David Turnbull, Director of National Aircraft Certification with Transport Canada, indicated that it is not uncommon for Transport Canada to take delivery dates into account when prioritizing its next steps in a certification process. He stressed, however, that the TCCA is “not necessarily constrained” by such dates and will continue to work through them if issues of concern remain outstanding. Mr. Robinson insisted that delivery dates serve to help prioritize, but that the “process is determined by the regulations and the standards we set.”

Mr. Deer told the Committee that the Canadian delegation system requires an absence of commercial pressures, with the members of a delegation authority signing a commitment to that effect.

Supplemental Type Certificates and the Changed Product Rule

The Committee heard many recommendations regarding the “changed product rule,” which allows for reduced scrutiny of minor modifications to a previously certified component. As Jodi Diamant, Chief Engineer, Airworthiness & Certification for Pratt & Whitney Canada, indicated, this process begins with evaluating the extent of the changes and determining whether full certification is appropriate.

Mr. Turnbull noted that this issue was addressed in detail by the JATR Report, which found that “the current changed product rule lacks an adequate assessment of how proposed design changes integrate with existing systems and the associated impact of this interaction at the aircraft level.”[10] The report recommended a revised top-down approach to the rule, “whereby every change is evaluated from an integrated whole aircraft system perspective.”[11] According to Gilles Primeau, appearing as an individual, such an approach would mean testing a changed system along with all other systems with which it interfaces, rather than testing it in isolation. He claimed that using that approach would have required additional scrutiny into the MCAS system. Mr. Primeau also recommended restrictions on “grandfathering” rules to ensure that full recertification be required for any system that was previously considered critical and is interfaced with a new or modified component.

Transport Canada representatives confirmed that the changed product rule is being re‑evaluated, and that this process was even being considered prior to the incidents involving the 737 MAX.[12] According to Mr. Turnbull:

[w]e have to find a more systemic approach to evaluating the failures and the consequences a little differently than we did in the past in order to keep up with the evolution in technology. Part of the challenge with the changed product rule issues that we acknowledge is that, arguably, as you introduce new technologies into an older design, you should perhaps migrate to a more modern design assurance approach, where you look at not just the area that has changed but at how that changed area affects the entire aircraft as well.

Several witnesses from the manufacturing sector expressed confidence in the changed product rule and explained that its application in Canada requires an evaluation of the level of change being made to a component. While this evaluation is initially made by the manufacturer, it is reviewed by Transport Canada, which makes a final decision on the need for additional certification requirements.[13] David Curtis, President and Chief Executive Officer of Viking Air Limited, told the Committee that the De Havilland Canada Dash 8 is an example of the process’s success: an aircraft that has been in production for more than 20 years, with more than 700 built, that has evolved from 37 seats to 90 seats through an “incredibly robust process.”

In his brief, Mr. Primeau points to several design characteristics of the 737 MAX that, in his view, do not reflect current practices and meet only the barest safety standards. Mr Turnbull, however, told the Committee that Transport Canada’s role as a regulator is not to impose design choices on the manufacturer, but to evaluate whether the design meets Canadian safety standards.

The Maneuvering Characteristics Augmentation System (MCAS)

As previously mentioned, the MCAS is a software system that was developed for the 737 MAX to address issues identified at the preliminary design stage. Essentially, the MCAS was designed to push the aircraft’s nose down if it detected an undesired pitch-up that threatened flight stability. Multiple reports identified the MCAS as having been responsible for the Lion Air and Ethiopian Air crashes and specifically raised concerns with the initial FAA certification of the system.

Sylvain Alarie, appearing as an individual, expressed to the Committee his view that the “mistake” made in the certification process for the 737 MAX was in the categorization of the MCAS software as posing a minor risk that would only “slightly” increase the pilots’ workload. According to Mr. Primeau, a higher risk classification would have required future 737 MAX pilots to undergo simulator training, resulting in a $1 million rebate per aircraft. Chris Moore, also appearing as an individual, estimated that Transport Canada would not have validated the 737 MAX if Boeing had accurately presented its hazard category as potentially catastrophic, with a solution in development.

Mr. Turnbull explained that Transport Canada had, in fact, inquired into the MCAS during its initial validation in 2016. Although he maintained that the decision to validate the aircraft was correct based on the information that was provided, he also indicated that a breakdown in communication between Boeing and the FAA on the MCAS’ functionality did impact the Canadian validation process.

Mr. Turnbull also told the Committee that, contrary to widespread media reports, the 737 MAX does not rely on the MCAS for stable flight. In fact, he stated that removing the MCAS entirely was considered during the recertification stage, but the FAA found that the MCAS was required to fulfil “strict compliance to a very specific requirement” in relation to control column force during a stall.

Training Material

Once an aircraft is certified or verified, the manufacturer proposes a training program. In the case of a modified but previously approved aircraft, this program would serve to bridge a pilot’s knowledge and training from one model to the next. The proposed program is then reviewed by a joint operational evaluation board (JOEB) to ensure that it is sufficient. The JOEB typically includes “naïve candidates” who are line pilots with no predisposed knowledge or biases (in the case of the revalidation process for the 737 MAX, this board included two representatives selected by the three Canadian operators and their pilots’ associations).[14] Finally, the JOEB prepares a report establishing a minimum training program, which is provided to airlines and local authorities who then use it as a baseline in developing a program specifically tailored to their own situation and needs, and to the experience of their pilots.[15]

As Mr. Turnbull told the Committee, training requirements are based on the design of the aircraft. As such, lack of clarity in the design of the aircraft will have an impact on the training material. This, witnesses said, is what happened with the 737 MAX, as Boeing withheld critical information about the MCAS’s functionality.

Mr. Curtis explained that changes to an aircraft’s control systems are typically considered a major modification and would require a higher level of oversight. Scott Wilson, Vice‑President, Flight Operations, WestJet Airlines Ltd., considered it “unusual” for the MCAS not to have been included in training materials or properly explained to operators, while Mr. Primeau called the omission “unacceptable,” considering the software’s capabilities.

In discussing the revalidation of the 737 MAX, Mr. Turnbull indicated that Transport Canada was behind a strong push to mandate simulator training for the aircraft, which successfully convinced Boeing to change its position in early 2020. Mr. Primeau expressed support for this.

Involvement of Airlines, Pilots and Flight Crew

Witnesses representing Canadian air operators told the Committee that they are not usually involved in discussions surrounding the certification of an aircraft.[16] Captain John Hudson, Acting Director of Flight Operations for Sunwing Airlines, explained that air operators have very different expertise from Transport Canada pilots: “we are not test pilots for aircraft certification; we are operators … I think you have to be very careful when you start to involve the operator too much in the initial certification of an aircraft.” He also explained that, despite not being involved in certification, operators are generally in close communication throughout the process with manufacturers, other operators, and Transport Canada in order to begin preparing their training programs for future aircraft.

As discussed previously, training programs developed for new aircraft are based on reports by a JOEB, which can include the participation of line pilots. In addition to these “naïve candidate” pilots, TCCA employs its own test pilots to participate in certification processes through conducting test flights and developing work plans. Many TCCA inspectors are also pilots and would be involved in the JOEB process to ensure that training manuals and mitigation procedures are workable in a real-life scenario.[17]

With respect to the revalidation process for the 737 MAX, Rob Giguere, Chief Executive Officer of the Air Canada Pilots Association, and Tim Perry, President of Air Line Pilots Association Canada, both expressed their satisfaction with Transport Canada’s collaborative approach. Mr. Giguere indicated that he hoped this level of involvement by pilots’ associations would be reflected in future certification and validation processes. He added that “experienced front-line pilots should be an integral part of certification and of training design.” Mr. Perry also recommended a more formalized involvement of line pilots in the certification process by pointing out key differences between Transport Canada’s certification pilots and line pilots. The latter, according to him, have a unique perspective on the development of systems and procedures, as they are the ones who ultimately will be responsible for implementing them in an emergency. He added that, despite the occasional selection of “naïve candidates” during JOEB processes, “involvement of line pilots in the certification or validation process is more the exception than the rule.”

The Committee also heard about the importance of consulting cabin crew during the certification or validation process. While flight attendant unions were involved in the 737 MAX revalidation process,[18] Jordan Bray‑Stone, chairperson of the Health and Safety Committee, Airline Division, of the Canadian Union of Public Employees, indicated that this was not the norm. According to him, a lack of consultation with cabin crew during the initial purchase of 737 MAX aircraft has resulted in numerous safety shortcomings, including the selection of an interior option that “maximizes seating to the detriment of functional lavatories, galleys and, most of all, cabin crew jump seats.” This can pose difficulties for flight crew in reaching or remaining in their jump-seats during an emergency. Mr. Bray-Stone recommended that cabin crew representatives be consulted as important stakeholders and receive regular briefings during the design phase of certification or validation.

Recommendation 1

That Transport Canada be required to conduct full recertification for any aeronautical system that was previously considered critical and is interfaced with a new or modified component.

Recommendation 2

That Transport Canada formalise a process to consider the involvement of line pilots in the aircraft certification process for commercial aircraft where line pilots may have the ability to participate.

Recommendation 3

That Transport Canada ensure that cabin crew representatives are consulted as important stakeholders and receive regular briefings during the design phase of aircraft certification or validation.

Recommendation 4

That Transport Canada examines the role of delegate representatives in the certification of aircraft and ensures that it pursues a more active role for independent safety regulators.

Approval of Internationally Manufactured Aircraft

As indicated above, an applicant seeking Canadian certification of a foreign aircraft design must submit a copy of the Type Certificate documents from the originating country, or their equivalent, during the initial phase of the certification process.

Canada is a member of various international agreements and arrangements to facilitate the certification process among countries and currently enjoys a particularly close working relationship with the aviation authorities of the U.S., the European Union and Brazil, which together form the quadrilateral Certification Management Team (CMT). According to the CMT’s Collaboration Strategy, established in May 2016, the team’s objective is to harmonize the four authorities’ respective certification processes and build confidence to reduce the need for additional technical assessments.

In addition to the CMT, Transport Canada has bilateral arrangements with each of the three other authorities. For example, the Bilateral Aviation Safety Agreement (BASA) with the U.S., signed in 2000, aims to reduce the economic burden of perceived redundancies in technical inspections, evaluations, and testing in relation to airworthiness and environmental testing and approval of aeronautical products. The Implementation Procedures for Airworthiness (IPA), revised on 10 November 2016, further elaborate on processes for design and production approval, and on technical assistance between Canada and the U.S.

Much like the CMT, the BASA and IPA reflect a trend toward policy alignment and cooperation. In fact, on 19 November 2018, the TCCA and the FAA established a Validation Improvement Roadmap toward further integration.[19] According to this plan, efforts have been underway in the last few years to increase the number of changes that could be made to an aircraft design in one country without the need for a technical review by the other. The stated goal is to eventually establish a common certification basis wherein the certification of an aircraft—or another aeronautical product—by one organization would be accepted by the other as a matter of course.

Reliance on Certifying Authority

A recurring theme throughout this study was the concern over Canada’s reliance on the certifying authority when validating an aircraft. In the context of the validation of the 737 MAX, Paul Njoroge, appearing as an individual, said that “Transport Canada depended too much on what was decided and documented by the FAA and Boeing,” acting “like a mere rubber-stamping authority.”

Regarding the role of the FAA in the 737 MAX’s recertification process following the two deadly crashes, Mr. Moore raised concerns that the FAA had appeared to be “cheerleaders for Boeing.” To that effect, the U.S. House Committee on Transportation and Infrastructure found a troubling safety culture within Boeing during its own study. The U.S. House Committee’s final report found that Boeing’s designated authority system “creates inherent conflicts of interest and too often, as this report has revealed, hinders ARs [Authorized Representatives] from consistently representing the interests of the FAA. Boeing's corporate interests often influence the actions of ARs and present barriers to enhancing aviation safety for the benefit of the flying public.”[20] The final report adds that “Boeing does not appear to have fully accepted the lessons from the MAX accidents or taken responsibility for design errors”[21] and instead “remains focused first and foremost on returning the Max to service instead of focusing on accountability and fixing past mistakes and processes that led to the design, certification and production of an unsafe airplane.”[22]^,[23]

Mr. Primeau also expressed concerns regarding Boeing’s pattern of “not providing sufficient answers”, be it to Transport Canada, to experts, or to the families of victims of the Lion Air and Air Ethiopian crashes. He suggested that an important step forward would be to allow for certification or validation processes to be more forcefully stopped at any point in order to fully address concerns.

The Committee heard that it is extremely difficult for a validating authority to identify potential issues on its own if neither the manufacturer nor the certifying authority has raised concerns.[24] Despite that difficulty, Transport Canada did identify issues of concern, as one Concern Paper sent to the FAA claims that Boeing was deviating from standard methodology and procedure, without providing any clarification.[25] Another such paper states that Boeing’s responses to a previous letter are contradictory.[26]

Mr. Giguere worried that the delegation of aircraft certification to manufacturers “amounts to self-certification and relies on the behaviour of manufacturers to make responsible decisions.” He suggested that, instead of relying on “what may be a flawed regulatory process of another jurisdiction,” Canada should independently certify aircraft that are flying in Canadian skies. Mr. Perry concurred while Mr. Njoroge told the Committee that Transport Canada should make its own decisions without relying on Boeing and the FAA.

Transport Canada officials nevertheless maintained confidence in the current validation process.[27] Mr. Wilson pointed out that Canada’s process was so thorough that it did not validate the 737 MAX until nearly three months after the European Union. Mr. Turnbull acknowledged that the initial certification was not done properly in the case of the 737 MAX, which had a negative impact on Canada’s validation process. Nevertheless, he expressed confidence in what he maintained is a “scalable” process, saying that Transport Canada may in the future undertake “a greater depth of review in certain areas,” based on lessons learned. Mr. Robinson also indicated that FAA-certified aircraft would be subject to increased involvement by Transport Canada moving forward.

Jim Quick, President and Chief Executive Officer of the Aerospace Industries Association of Canada, recommended that the TCCA be restructured as a stand-alone branch within Transport Canada “with proper autonomy, authority and accountability.” According to Mr. Quick, this branch should be headed by a senior-level official with relevant aviation experience, following a clear mission statement. He also pointed out that while Canada’s aviation industry shows an average growth of 5% per year,[28] the TCCA’s funding has not increased for several years. He said: “While we have the best people, we don't have enough of them, so how would we, from a global competitiveness standpoint, move forward?.”[29] He proposed the establishment of a high-level stakeholder team, including both industry and Transport Canada representatives, to identify and address the TCCA’s staffing and funding requirements.

Ms. Diamant, supported by Mr. Deer, recommended that Transport Canada establish requirements for safety management systems in regard to the manufacturing sector. More broadly, Mr. Quick recommended the reestablishment of the Canadian Aviation Regulatory Advisory Council as a form of joint government-industry review panel that could propose regulatory changes as needed.

Mutual Recognition of Aircraft Certification

As Mr. Robinson told the Committee, the validation process for a foreign-designed aircraft is distinct from a state of design’s certification process. Although the validating authority’s level of involvement can vary from case to case, he indicated that Transport Canada typically participates in the FAA’s certification process while also conducting its own flight tests of a U.S.-manufactured aircraft. Mr. Alarie also indicated that, in his experience, it is common for Transport Canada, the FAA and the EASA to be involved in each other’s certification processes.

The Committee heard that “from-scratch” certification of a new aircraft is extremely time- and capital-intensive, with the certification of the Airbus 220 having taken approximately 160,000 person hours to complete.[30]

In order to simplify the validation process for aircraft originating from certain trusted countries, Canada has entered into several bilateral agreements. As Mr. Turnbull stated, the development of such agreements is “based on a fundamental understanding” that both certifying authorities will reach “an equivalent level of safety.” According to witnesses, the Canadian aerospace industry benefits greatly from these agreements, notably due to Transport Canada’s reputation and influence worldwide, which can open doors for Canadian-manufactured aircraft to international markets.[31] Validating authorities also benefit, as aircraft certified by trusted partners require less review, allowing for a faster and more efficient validation process.[32] Several witnesses stated that Canada’s withdrawal from such processes would be extremely detrimental to the Canadian aerospace industry and to Transport Canada’s reputation internationally.[33]

Mr. Primeau recommended that, in order to improve the international system of mutual recognition, national certification authorities exchange permanent representatives.

Validation Improvement Roadmap

As previously indicated, the TCCA and the FAA established a Validation Improvement Roadmap on 19 November 2018. This document outlines plans toward further integration, so as to increase the number of changes that could be made to an aircraft design in one country without the need for a technical review by the other. The stated goal is to eventually reach “full acceptance by the VA [Validating Authority], with reduced or no further technical review or additional issuance of validation approvals.”[34]

Mr. Moore raised concerns with this Validation Improvement Roadmap as, in essence, its goal is a common certification basis wherein the certification of an aircraft—or another aeronautical product—by one organization would be accepted by the other as a matter of course.

In response to questions on this issue, Mr. Turnbull referred to the roadmap as a “work in progress,” applicable only to certain products, rather than to large transport aircraft. He also indicated that he has concerns with the stated goal of the document, as such a level of reciprocity would cause Transport Canada to “lose the ability to calibrate” its decisions based on the actions of other authorities. At a subsequent appearance before the Committee, he added that Transport Canada had intended to have the wording changed prior to the incidents involving the Boeing 737 MAX.

Concern Papers

Throughout the Committee’s study, much attention was paid to the issue of concern papers and the ability of Transport Canada to validate an aircraft without receiving a response from the certifying authority. Concern papers, also referred to as concern letters, are documents written by a validating authority to the original certifying authority. Their purpose, according to Minister Garneau, is to obtain clarification or to express disagreement with part of the certification process. These papers remain “open” until a satisfactory response is provided by the certifying authority.

The two Concern Papers referred to during this study were C‑FT‑03 on the issue of “Interpretation of stall identification” and C‑FT‑04 relating to “Automatic Flight Control System Anomaly”.[35] These two papers were sent to the FAA and remained “open”, and therefore not resolved, at the time of Transport Canada’s validation of the 737 MAX.

C‑FT‑03 highlights issues raised following a Transport Canada test flight on 9 November 2016. When undergoing the stall characteristic assessment, Transport Canada adopted a technique, proposed by Boeing and the FAA, of “curtailing pilot elevator input once the elevator feel shift is actuated” without making any attempt to arrest the nose down pitch. Transport Canada pilots felt this was contrary to U.S. airworthiness standards. As such, the concern paper made the following request: “FAA is requested to share its past 737 certification experience and interpretation with respect to “nose down pitch not readily arrested” in conjunction with the Boeing/FAA technique of stopping further elevator input once the force gradient increases. The logic behind this accepted technique and compliance with 14 CFR 25.201 was not shared by Boeing or FAA during our validation activity for the 737-8 MAX.”[36]

C‑FT-04 raises the issue of an anomaly in the Automatic Flight Control System (AFCS) that was also identified by Transport Canada pilots during flight testing on 9 November 2016. During a rapid descent test, the aircraft’s Level Change mode unexpectedly pitched the nose up, deviated from the selected altitude and initiated a climb. Transport Canada was concerned that this was inconsistent with the aircraft’s normal operation and wondered whether the opposite situation could occur, in which an aircraft would unexpectedly pitch its nose down during a climb, despite a higher altitude having been selected by the pilot.[37] In this letter, Transport Canada stated that it received a response from Boeing in March 2017, confirming that the situation experienced by the test pilots was in accordance with the aircraft’s design:

Boeing stated that the 737‑8 MAX level change control laws have been changed from normal AFCS operation, and are unique to the emergency descent scenario. Boeing also mentioned that when the emergency descent functionality of the fly-by-wire-spoiler system is invoked in level change mode, the AFCS tightens its speed control gains considerably and the normal logic associated with altitude protections is no longer present. Now, at a time of high workload during a level off from an emergency descent, the aircraft is allowed to climb away from the altitude selector as it aggressively tracks any significantly lower command speed changes the crew might select.

Furthermore, Boeing advised Transport Canada that the altitude protections associated with a climb to an altitude when below the altitude selector have also been removed if the emergency descent level change mode is still in effect. In this case, the aircraft will not trade speed while attempting to prevent a descent following a reduction in available thrust during a climb to an altitude selector set higher. This too is contrary to the previously certified AFCS functionality on the 737 NG and the normal AFCS functionality of the 737-8 MAX.[38]

Despite Boeing’s assurances that the aircraft’s automatic pitch upward was an intentional design element, the concern paper states that Transport Canada is “concerned that this functionality will come as a surprise to flight crews during non-normal operational use of the aircraft, and will further increase workload during times when the crew’s workload margins are already reduced. We do not consider training mitigations appropriate for a design feature that will not be seen routinely by flight crews.”[39] It also indicates that Transport Canada continued to question the functionality’s compliance with both Canadian and U.S. airworthiness regulations.

As indicated previously, both of the above-cited concern papers indicated that they would remain open after validation of the aircraft, in order to avoid delivery delays.

In his testimony before the Committee, Minister Garneau confirmed that he was aware of these concern papers when the 737 MAX was initially validated. That said, Mr. Wilson, as well as Murray Strom, Vice-President of Flight Operations for Air Canada, indicated that airlines were not made aware of the letters, although the latter indicated that this was not unusual. Mr. Moore expressed to the Committee his view that “Canadians have a right to know why Transport Canada issued a concern paper about the anti-stall system before the crash but didn't use their authority to take effective action when they stated that they did not agree with the FAA interpretation.”

Transport Canada representatives, as well as the Minister of Transport, were clear in their views that concern papers are common and do not necessarily imply a significant safety concern,[40] a position supported by both Mr. Perry and Mr. Wilson.

Mr. Turnbull explained that the questions posed by these particular letters of concern were primarily related to the methodology used by the FAA to arrive at its certification of the 737‑8 MAX, and that Transport Canada was mainly attempting to determine whether the system should be categorized as stall identification or stall protection, which would have required a higher level of scrutiny. Mr. Robinson suggested that the terminology of “concern” letter has caused confusion and will perhaps be changed. He indicated that if such a document identified a serious safety risk, validation would not proceed until that risk had been addressed.

At his final appearance on this study, Mr. Turnbull confirmed that no concern papers remained outstanding at the time of the 737 MAX’s revalidation in early 2021.

Recommendation 5

That Transport Canada produce a report on lessons learned from the Boeing 737 MAX groundings focused on the National Aircraft Certification’s approach to certifying and validating aeronautical products, including design, implementation and oversight of its delegation program and subsequent revalidation process within six months and that it share this report with the Committee.

Recommendation 6

That the Government of Canada conduct a high-level stakeholder consultation, including industry and labour representatives, regarding the staffing and funding needs of Transport Canada Civil Aviation.

Recommendation 7

That the Government of Canada re-establish the Canadian Aviation Regulatory Advisory Council as a form of joint government-industry-labour review panel and that this council be tasked with reviewing the requirements for safety management systems in regard to the aerospace manufacturing sector.

Recommendation 8

That Transport Canada Civil Aviation undertake further formalizing international collaboration with other aviation authorities regarding certification/validation issues, including a formal exchange of permanent representatives.

Recommendation 9

That Transport Canada Civil Aviation review its policies to ensure that certification or validation of an aircraft does not occur until all significant issues or concerns are fully addressed.

Recommendation 10

That the Committee express concern with the FAA’s certification of Boeing aircraft in light of findings by U.S. authorities.

Recommendation 11

That Transport Canada review its international agreements with regards to harmonization of aircraft certification with other jurisdictions.

Recommendation 12

That Transport Canada pursue additional technical assessment during validation of FAA certified aircraft.

Responding to Incidents Relating to Certified or Validated Aircraft: The Example of the Boeing 737 MAX

The Canadian Transportation Accident Investigation and Safety Board (TSB), while not involved in the certification process itself, can issue safety communications related to certification in the course of its investigative role. These communications can take the form of safety advisory letters or board recommendations. The TSB then assesses the response from the Minister of Transport and conducts annual reassessments of any updated response.[41]

In the case of aviation incidents that do not take place in Canada, the TSB’s role is determined by ICAO’s Annex 13. As Natasha Van Themsche, Director, Air Investigations with the TSB, explained to the Committee, the country in which the incident takes place should theoretically be responsible for the investigation. An investigation team includes the State of Registry or State of the Operator of the aircraft, the state in which the aircraft was built, as well as the state in which the engines were designed and built. A state whose citizens were aboard the aircraft at the time of the incident can also play a role, but is limited to visiting the scene of the incident, receiving factual information that is ready to be publicly released, and receiving a copy of the investigation’s final report.

When asked whether the TSB should play a larger role in incidents that take place on foreign soil but in which Canada has a direct interest, Kathleen Fox, Chair of the TSB, replied that “[i]t would really be up to ICAO to make the changes so that when a country like Canada, or another state, has a significant number of fatalities, as well as recognized expertise to contribute, we should be able to play a more active role in the investigation.”

Mr. Primeau, in his brief, also laments the limited role Canada was able to play in the design changes made to the 737 MAX during its recertification. He proposes that the ICAO framework be modernized to reflect the interconnected nature of modern aircraft manufacturing, and to provide access to a larger pool of international expertise during certification and recertification.

Lion Air Flight 610

The first major incident involving a 737 MAX took place on 29 October 2018, when Lion Air flight 610 crashed within minutes of taking off from Jakarta, Indonesia. As the certifying authority for the state of design, the FAA issued an airworthiness directive that amended the procedures to help pilots counteract the unwanted activation of the 737 MAX’s MCAS system. The new procedure required pilots to memorize two of the five steps required to exercise the runaway trim-stabilizer procedure.[42]

As Mr. Moore explained, it has since come to light that the FAA performed a risk assessment analysis on continued operations of the 737 MAX following the issuance of the airworthiness directive. According to the U.S. Transportation Committee’s final report, the FAA’s analysis concluded that, assuming a failure to supplement the FAA’s Emergency Airworthiness Directive with other actions or changes to the MCAS, an estimated 30-year lifetime of the 737 MAX fleet could result in more than 15 fatal crashes, resulting in more than 2,900 deaths.[43] Mr. Robinson confirmed that Transport Canada received the findings of the FAA’s report, but did not request the detailed analysis until after the Ethiopian Air crash.

Exceeding the requirements set out by the FAA’s airworthiness directive, Transport Canada mandated that pilots must memorize all five steps to the runaway trim stabilizer procedure.[44] In reaching this decision, Transport Canada cooperated with the three Canadian carriers operating the 737 MAX, Air Canada, Sunwing, and WestJet, and implemented the new mandate within two weeks of the Lion Air crash.[45] Captain Hudson told the Committee that this collaborative, made-in-Canada solution “significantly mitigated any residual risk surrounding MCAS and runaway stabilizer events on the [737] MAX.”

Mr. Primeau indicated that the preliminary report following the Lion Air crash “showed not only the MCAS but also the stab trim system doing something really, really abnormal” and that, in his view, the entire fleet should have been grounded at that point. On this subject, Minister Garneau pointed out that no country took the step of grounding the 737 MAX after the Lion Air crash.

Ethiopian Airlines Flight 302

The second major incident involving the 737 MAX took place on 10 March 2018, when Ethiopian Airlines flight 302 crashed minutes after taking off from Addis Ababa, Ethiopia. Mr. Robinson told the Committee that Transport Canada began to collect data from the FAA and Boeing immediately after the crash. Minister Garneau explained that it was not possible to determine the cause of the crash at the time and that “pilot error, terrorism, mechanical or electrical issues” had not been ruled out.

The 737 MAX was restricted from Canadian airspace on 13 March 2018. Mr. Njoroge told the Committee that by waiting so long after the crash to ground the aircraft, Minister Garneau “portrayed excessive hubris, analogous to the behaviour exhibited by many within the FAA and Boeing before and after the 737 MAX crashes.” Minister Garneau and Mr. Robinson explained that the decision to ground the 737 MAX was made on 13 March 2018 following the receipt of satellite data provided to Transport Canada by Aireon, a global air traffic surveillance system company. The Aireon data provided a 3D profile of Ethiopian Air flight 302, which demonstrated similarities with the Lion Air crash. Based on this evidence, the decision to close Canadian airspace to the 737 MAX was made immediately. While unusual at the time, review of Aireon data by Transport Canada has since become standard practice, particularly following the investigation into Ukraine International Airlines flight 752, which was shot down over Iran on 8 January 2020.

When asked whether Canada had followed suit with U.S. policy when it waited to ground the aircraft, Minister Garneau insisted that his decision was not only independent of the United States, but preceded the FAA’s decision by several hours.

Following the Ethiopian Air crash, Canada participated actively in several reviews and evaluations to determine and address the cause of the 737 MAX crashes. These included the Joint Operational Technical Review, the Certification management Team and the Joint Operations Evaluation Board.[46] Minister Garneau told the Committee that Canada successfully spearheaded a number of changes, including the requirement for simulator training for 737 MAX pilots, stall testing to validate safe flight-handing characteristics with the MCAS system off, as well as a procedural change to reduce excessive cockpit distraction and workload conditions by allowing the crew to disable the stick shaker warning within the cockpit. Mr. Turnbull also told the Committee that his team “were front and centre in having a very strong voice to speak to the nature of the concerns that related to the application of the changed product rule.”

The Ethiopian Air crash also served as a reminder to Transport Canada of the importance of addressing the human impact of aviation incidents. As Mr. Robinson told the Committee, this tragedy highlighted a need for improvement and directly impacted the way in which Transport Canada engaged with the families of victims after the downing of Ukraine International Airlines Flight PS752 in Iran on 8 January 2020.

Recommendation 13

That the Government of Canada work with the families of the Canadian victims of Ethiopian Airlines Flight 302 to commemorate the victims.

Recommendation 14

That Canada, through its permanent representation at ICAO, pursues amendments to Annex 13 to allow for greater participation in incident investigations by states with expertise or a significant number of fatalities in the incident.

Conclusion

Throughout this study, witnesses representing Canada’s aviation industry told the Committee of their confidence in the current certification system and in the competence of the TCCA. That being said, serious concerns about the Boeing 737 MAX certification process have been raised in various reports following the tragic Lion Air and Ethiopian Airline crashes. These events have also stimulated reflection in Canada regarding the foreign aircraft validation process; specifically the level of involvement of the TCCA in this process.

Recognizing that the safety of passengers and crews must always be the first priority, witnesses believe that the aircraft certification and validation process in Canada needs to be even more robust.