Good day, Mr. Chair, Vice-Chair and committee members.
Let me begin by introducing myself. My name is Nicholas Robinson and I am the Director General of Civil Aviation at Transport Canada, responsible for aviation safety.
I am joined here today by my colleague David Turnbull, who is the Director of National Aircraft Certification at Transport Canada.
We are pleased to be here today to support this study related to aircraft certification.
Mr. Chair, let me start off by saying that Canada has one of the safest civil aviation systems in the world. We have achieved this by an unwavering commitment to safety and as a result of an exceptional level of expertise and technical experience that allows for us to make evidence-based safety decisions in this very highly complex, continuously evolving environment.
The certification of an aircraft involves careful examination of the proposed design to verify that the aircraft complies with airworthiness standards and regulations, in short, all the things we expect an aircraft to have to make it safe to fly in Canada.
In the case of a Canadian company manufacturing an aircraft or an aeronautical product such as an engine, for instance, Transport Canada is deemed the certifying authority. That means that state authorities globally look to Canada to ensure the product meets the high safety standards that we set.
This process is aligned with the recommended practice that the International Civil Aviation Organization, commonly referred to as ICAO, has set out in annex 8 of their convention, whereby states do not perform the same in-depth determination of compliance that the state of design has already completed. Instead, states may accept the original certification or use it as the basis for validating the certification.
The certification of an aerospace product is not done overnight. From the application date to the approval, the overall process takes years. Transport Canada works closely with the manufacturer during that period.
In examining past projects we can expect that the testing and analysis phase takes approximately two or more years to complete.
As an example, Transport Canada's certification of the A220 aircraft, formerly known as the Bombardier C Series 300 or 100, took well over 150,000 person-hours to complete over multiple years.
When it comes to products that are not Canadian made, Transport Canada's role consists of validating the certification decisions made by the state of design—the home country of the manufacturer. This ensures that the aircraft or product is safe for use in Canada and complies with our Canadian regulations and our own expectations.
Much like in the case when Canada is certifying a product, we are looking at another major certifying authority, such as Europe's, which is commonly referred to as EASA, the U.S. FAA, or Brazil's ANAC, to lead in the review. In the case of the Boeing 737 Max, the U.S. is the state of design of this aircraft. This means that the Federal Aviation Administration, the FAA, is the certifying authority, and we and other states are validating that certification.
Now, I would like to speak more specifically to the two tragic accidents that took place involving the Boeing 737 Max aircraft.
First and foremost, Mr. Chair, our thoughts continue to go out to the victims and the families of those who have been impacted by the Lion Air and Ethiopian Airlines accidents. Canada is working hard so that other families don't have to suffer through a similar tragedy such as these.
Transport Canada's actions related to the Boeing 737 Max aircraft were first made in response to the October 2018 Lion Air accident. Following that tragedy, Canada developed and implemented, in strong collaboration with our three Canadian operators that fly the Max, which are Air Canada, Sunwing and WestJet, enhanced training requirements for pilots, which exceeded the standards implemented by the American AD and other countries.
These standards were intended to address the runaway trim stabilizer condition that has been identified as a contributing factor in the Lion Air accident and discussed widely in media reports. This was on top of the actions the U.S. undertook as the state of design, and Canada was the only country to put these additional measures in place.
Following the Ethiopian Airlines accident that occurred on March 10, 2019, Transport Canada officials immediately began to assess the risks and the need for additional actions beyond those already taken globally, as well as those taken independently in Canada. Upon receiving and analyzing new satellite data, the department made the determination to close Canadian airspace to the aircraft, the Boeing 737 Max, commencing on March 13, 2019. We received that new data that same morning.
This action demonstrates that Canada makes evidence-based decisions and that we do not hesitate to take action when safety issues are identified. Transport Canada is continuing its independent review and validation of the Boeing 737 Max changes while we continue to work extensively with the state of design and civil aviation authorities in Europe and Brazil and across the globe to realize a possible global return to service of this aircraft. To that end, Canada is taking a leadership role with international authorities to address all factors necessary to achieve a safe return to service. The scope of our review and our concerns have been communicated to the FAA, and Transport Canada officials continue to seek information and assurance on these points.
There are three key areas of concern for Transport Canada that are broader than the maneuvering characteristics augmentation system, commonly referred to as MCAS, which has been commonly reported. These are acceptable levels of pilot workload, the flight control system or architecture for the aircraft, and a minimum training requirement for crew members to operate this aircraft safely.
Until our questions and concerns are satisfactorily addressed, Transport Canada will not lift the airspace restriction on this aircraft.
Additionally, Canada joined the FAA, the National Aeronautics and Space Administration, or NASA, and other civil airworthiness authorities in conducting a comprehensive technical review of the Boeing 737 MAX flight control system. On October 11, 2019, the FAA published the Joint Authorities Technical Review's independent report of the certification process of the aircraft, which includes recommendations brought forward by the review committee.
Our transportation experts continue to work tirelessly on the review of this aircraft, and I am proud of the leadership they have taken to date. Mr. Chair, allow me to assure you and the committee that Transport Canada remains steadfast in its commitment that the Boeing 737 Max will not be permitted to fly in Canada until all concerns have been addressed by the manufacturer and the FAA, and that adequate safety measures for flight crews are in place.
I trust that the foregoing information will serve to shed some light on the aircraft certification process at large as well as on Transport Canada's involvement in the ongoing Boeing 737 Max review. We look forward today to addressing additional questions the committee may have on either subject.
I didn't realize I was going to be asking questions first, but I am very grateful for the opportunity. It's good to be back at the transportation committee table.
I want to thank our witnesses for their opening remarks.
I want to acknowledge that it's been less than 18 months since the tragedy that claimed the lives of 189 people, as well as less than 12 months from the time of the tragedy that claimed the lives of 157 people. As you mentioned, our thoughts and prayers remain with those families who have lost loved ones. Not only were they left to grapple with their grief, but they were also left with far too many questions, I think many of which still need to be answered as the 737 Max remains grounded.
From your testimony, I think we see that there has been much work done, and I am pleased that the transportation committee is undertaking this study. It has agreed to adopt the motion that was introduced in the last Parliament to this committee, but was blocked by the members opposite, with absolutely no rationale given for that.
This is a non-partisan issue and it is something that I think we all agree on. We need to try to understand the process of certification that takes place not only here in Canada but also with our partners around the world when it comes to allowing other aircraft to serve our country.
You mentioned in your opening remarks that you had joined the FAA, the National Aeronautics and Space Administration and other civil airworthiness authorities in conducting a comprehensive technical review of the Boeing 737 Max flight control system, and that independent report includes recommendations that were brought forward.
Could you list those recommendations for us?
We'll provide the entire list. The JATR report came out with 12 separate recommendations. Some of them somewhat overlap the others, so I'll attempt to briefly describe them at a high level.
The fist one relates to the application of what we call the changed product rule, which is a regulation that deals with how we determine the applicable standards to an aircraft that is changed or modified. Some people use the term “derivative model” when you have one existing model and you do a modification to create a new model. This will happen successively over a number of years. In the case of the 737, it has gone through numerous generations or reiterations of the design.
That recommendation speaks to the fact that we struggle internationally with a common interpretation or application of the rule. Despite the fact that the rule has been completely harmonized and from a regulatory perspective remains common between the various authorities, it is the actual application of the rule that is sometimes open to interpretation.
The basic gist of the issue is this. At what point, when you're adding successive changes or additions to an aircraft, do you go back and establish that you have to apply the newer standards and also the newer interpretations of the standards or processes we use that have been developed over time to evaluate the aircraft?
In the case of the 737, it's been alleged that the aircraft was derived or added to in numerous cases, and yet in some cases the standards remained the older standards that were applicable to the previous derivatives, and that possibly the scope of the review, in the context of evaluating the new changes, was not as wide as it should be. That is an area which we already had on the table prior to these accidents, actually; it's not a surprise to us at all that the changed product rule is an area that will require further honing and international harmonization.
The next one—and again, I'm boiling the 12 down to three themes, just for brevity here—is the delegation systems, of course. I'm sure you've heard discussions about that. One of the recommendations speaks to another look at or another examination of the various delegation systems that exist. Do the authorities have sufficient expertise and a sufficient degree of oversight into what these delegated entities are doing? Also, are there enough systems and protections in place to avoid any undue pressure on these delegates, who are employees of the company?
The third theme speaks to what we call development assurance practices. It links back to the changed product rule topic to some extent. As aircraft have evolved in complexity, modern aircraft today involve systems that are no longer separated. The term we use is “federated”. They have systems that are typically driven by software and are highly interactive. In other words, they speak to each other.
In the old days, we used to go in and analyze discrete failures that we could predetermine. In a modern, more complex aircraft, we have to take what's called a design assurance approach, which admits that we have to find a more systemic approach to evaluating the failures and the consequences a little differently than we did in the past, in order to keep up with the evolution in technology.
Part of the challenge with the changed product rule issues that we acknowledge is that, arguably, as you introduce new technologies into an older design, you should perhaps migrate to a more modern design assurance approach, where you look at not just the area that has changed but at how that changed area affects the entire aircraft as well. That's another area where design development assurance practices are well in place for a brand new or what we call “clean sheet” airplane, but they may not necessarily be applied with the same rigour when we're talking about a derivative of a pre-existing aircraft.
At a high level, those are the main hit points in the JATR report.
Following the Ethiopian Airlines crash on the Sunday, as part of our continuing airworthiness process, we immediately began to collect information on what led to the crash. What were the conditions when the flight was happening? What happened to the flight? How far in their flight segment were they? Did we have any sort of performance information on the aircraft? We gained this information through talking with the state of design authority, which is the FAA. They were gathering information from Boeing. We were gathering information from where the accident took place and any other sources of information we had.
This is part of a regular process that we do when an accident happens. We try to gather as much information and then take a particular action if we feel that it's necessary.
We weren't specifically waiting for the Aireon data. In fact, Aireon data wasn't part of our toolbox that we used in looking at aircraft accidents until Ethiopian 302. It's a relatively new available piece of information.
I'll assure the committee, Mr. Chair, that it is actually something we go to right away after accidents. I can point to the accident: the downing of flight PS752 in Iran. That accident occurred in the evening. We had the Aireon data in hand that morning because we learned ways we can improve. We learn after each accident.
We received that Aireon data on March 13. Along with all the other evidence we gathered, that was the piece of the puzzle that allowed us to move forward without reservation and make the determination to close the airspace in Canada. Transport Canada made the determination.
That information was so important because it showed—when we looked at the Lion Air accident and the Ethiopian Airlines accident—clear performance similarities across the two accidents that would have occurred only if there was a clear similarity of failure there. That's why we made the determination at that point.
Typically, the state of design will look at the event that happened with an aircraft and propose a mitigation measure based on their risk analysis and what they see needs to be done to mitigate that risk.
The FAA proposed a mitigation measure through an AD, an airworthiness directive. States looked at that AD and accepted it. That's the usual practice. Less usual is when a state will look and say that they'll accept that AD, but that there's also something more that they may wish to do.
Canada accepted that AD absolutely. We agreed with what the FAA was putting forward, but we worked with our three Canadian operators, Air Canada, Sunwing and WestJet, to further address the issues we saw around ensuring that our aircrew had the appropriate reaction time to this event and knew the appropriate procedures to mitigate this runaway trim stabilizer procedure. We said we're going to make a change. Aircrew had to memorize all five steps to mitigate that risk, as opposed to what was currently there, where they would memorize—or they were told to memorize—two of those five steps, and the other steps were available within the quick reference handbook on the flight deck.
We put that measure in place on November 8, 2018. It was implemented with all our airlines on November 9, 2018, about a week and a couple of days following the Lion Air accident.
Generally speaking, we do what is necessary.
The ongoing development of the bilateral agreements is based on a fundamental understanding that we recognize through experience that although we may have differences in interpretation, the net results yield an equivalent level of safety. That's the foundation of it.
Our foundation with the FAA and our bilateral agreements go all the way back to 1938. Things will happen and things have happened, incidents that have caused concern and that have caused us to ask these very valuable questions, but the principle of relying on our international partners is fundamental to the way we operate.
As Nick explained, we don't have to throw out the process we have right now. It is scalable. Think of it as a volume button. When things like this happen, we can turn the volume up; we can increase our involvement. When we're investigating an approval, as we are currently with the 737 Max 8, we are, of course, continuing to follow the FAA's lead. They must certify. They must present that which they will accept from Boeing. They are the certifying authority. We will follow, but in following, in many cases, we are talking directly to Boeing. FAA is always in the room. We have the opportunity to maybe get around those concerns, to not be as directly concerned about the degree to which the FAA was directly cognizant of what Boeing is doing or has done and rather to go directly to the source, to an appropriate degree, to find out for ourselves.
That's why I'm quite confident in saying yes, we rely on our bilateral partners. Yes, we have faith and trust in the FAA, but we will investigate independently to determine and validate. It's trust and verify.
Thank you, Mr. Robinson and Mr. Turnbull, for appearing before the committee today.
I'd like to follow on my colleague's question on the validation process.
On November 19, 2018, after the Lion Air crash, Transport Canada and the FAA signed the “Validation Improvement Roadmap”, as you know, which expressed a vision that both authorities are committed to taking progressive steps to reduce, if not eliminate in-depth technical involvement by the validating authority based on level of risk.
I'm curious. Does Transport Canada intend to continue with this road map towards harmonization in light of these events?
Was it a mistake to sign on to this agreement at a time when concerns about the safety of the 737 Max were already being expressed?
Let me back up a bit and explain what the operational evaluation does for you.
At each change to an aircraft design and, in this case, stepping from what we call the NG version, or the previous generation to the Max, the manufacturer will propose a training program that bridges, from the pilot's perspective, the knowledge and awareness they have to operate the aircraft from one model to the next.
The OE, in its simplest form, is a joint board that evaluates the appropriateness of that training material to get a pilot who has flown the NG to fly on the Max. It's as simple as that. If the OE board determines that the training proposed is sufficient, then the conclusion is that it is operationally suitable.
If there are issues when the evaluators go through the process.... There are always naive candidates who are selected. We try not to get people in there who have predisposed knowledge or are biased in any way. We're putting regular, average line pilots in there. They do the evaluation. If there are issues, if they struggle and are failing on the simulator, that is a clear indication that the training proposed by the manufacturer is not sufficient, and there will be an iterative process to improve the training.
I understand your question better now. In fact, it was mentioned earlier by one of our esteemed members that it was a software failure. Actually, it wasn't, and most aircraft accidents are a combination of various things.
In terms of one of the things we've learned and one of the things we questioned very early on—and I think this is more to your point—it's that given what we now understand and that we didn't as well as we should have, perhaps, about the MCAS, that system, its failure modes and the resulting effects in the cockpit with an AOA disconnect, an angle of attack indicator disconnect, what we've learned from there has implications with respect to the design itself, the basic architecture, but also with respect to whether the training was indeed sufficient.
In other words, were the changes between, in this case, the NG and the Max, adequately reflected in the training material? You see, the key to all of this is that the training material in the OE is a direct result of the design. It's not the other way around. You design the airplane, it has functionality, and you create training material that reflects the design. If there are aspects of the design that are not sufficiently covered by the training material, that may be what comes out of this.
We spoke about the JOEB process. That's where we have line pilots taking the training and evaluating it. Their results are telling us whether the training is adequate enough.
What we haven't spoken about is that we also have a great number of pilots in our own program. We have pilots as part of our national aircraft certification group who do test flights and participate in the certification process along with flying the aircraft or developing work plans with regard to the certification of the aircraft. We have our own inspectors as well, many of them pilots, who will be part of that JOEB process as well and will be looking at those aircraft manuals and mitigation procedures for evaluation. In a real-life scenario, are they going to work, are they workable? Pilots are a part of the regular process.
I want to specifically mention a bit of a difference that we also have in this process. There's been a great deal of review with regard to the Boeing 737 Max. At the beginning, we said that this wasn't a process where we were going to have Transport Canada focus and work with other authorities in our bilateral arrangements and let our Canadian authorities know what the outcomes were. From the beginning, the three operators who operate the Max as well as those three associations that have pilots operating the Max in Canada have been part of the process. They've been feeding us their input and feedback as part of the process. They're very interested, of course, as many of their livelihoods are tied to the Max, and they want to see how the validation process is proceeding, so we've been working with them on a regular basis. We often meet with our operators on a weekly basis to tell them how we're progressing. A lot of those individuals are pilots themselves, and many of them are typed on this aircraft and work with the aircrew associations to let them know the process.
They've had some questions. They've been briefed by Boeing and other authorities on the process. They've come to us and said, “I want to understand this particular mitigation procedure that you're exploring. I don't understand why Canada is looking or why we have an issue, and we want a different mitigation procedure. We think there's an issue here.” What we've done is taken those opportunities to sit down with them. We've reviewed all the things we have found and said this is what has led us to say that we're going to take a leadership role and demand that the FAA and others look at particular incidents that we see that need to be addressed. In many cases that's been very beneficial.
I hope that the committee may have some opportunity to speak to those Canadian operators as well as those Canadian associations to hear their involvement in this process, because they've been very much involved.
My question is for you, Mr. Robinson.
The first accident occurred on October 29, 2018, and the second on March 10, 2019. I think the public started to become quite concerned after the second accident since the first could have been a simple mistake.
In the wake of these incidents, in an article in La Presse in May 2019, you said, “We have full confidence in the FAA and its process”. Shortly thereafter, there was a lot of international news, including at Agence France-Presse and elsewhere.
In September 2019, Agence France-Presse reported that it was Boeing employees who inspected the MCAS anti-stall system in question in the accidents. We also learned that since 2016, under a new procedure referred to as ODA, Boeing selected the engineers who inspected its own planes and the FAA simply provided the seal of approval.
In February 2020, a former technical director who worked for the company for 30 years, said the company did as much work for as little money and as quickly as possible to get its planes in the air.
In the meantime, are you still as confident in the FAA's certification process?
Well, let me now respond as to why that is the case. That's because we are continuously looking at improving not only our certification standards and our validation standards, but also our safety standards overall.
That's why we propose additional regulations. We've moved forward most recently on flight and duty time regulations to ensure that aircrews are getting adequate rest in order to operate those aircraft. That was a safety....
We're looking at moving forward in improving the runway and safety area—that's the area at the top of and bottom of a runway—to ensure that if by chance an aircraft, because of weather, because of an operational incident, has to exit the runway, there is a certain level of ground that is pre-prepared to allow that aircraft to exit so it doesn't end up in a ravine and we have a horrible tragedy there. We're continuing to look at that.
It's not only the 705 operations, our large commercial operations, we're also very proud of our general aviation safety campaign. We've worked with the recreational operator and those associations that represent the recreational operator: What are the risks to those operators? What are the risks to those people who go down to their local airport on a Saturday to fly their aircraft for pleasure? What do they have to keep in mind in order to keep safe?
We take very seriously the Transportation Safety Board recommendations that it puts forward after air accidents. We make sure that we try to act on them as appropriately and in as timely a way as possible to ensure, and to continue to ensure, safe Canadian aviation.
We could ask the minister if he is available on March 10. That would be the best thing to do to try to speed things up here. We set a date for the study, March 10, but have yet to call witnesses for that date. We could ask the minister to come then and we could also talk about the supplementary estimates.
Again, I took the time to carefully read the ministers' mandate letters. There are so many different aspects and important files that we would need two hours with each minister. These are things that Canadians are concerned about, whether we are talking about climate change, infrastructure or transport. I think that one hour per minister is not too much to ask. If anyone here had a question about the supplementary estimates and absolutely wanted a response, they could ask their question then. After all, the time belongs to each parliamentarian.
With all due respect to the parliamentary secretary, it is not the committee's job to manage the minister's schedule. Our colleagues around the table are not here to manage the ministers' agendas. As we keep hearing in response to our questions in the House of Commons, the committees are free and independent from the government's agenda. Here, it is up to us to decide whether it is reasonable to set aside two hours for both ministers. I sincerely think it is. Then we could ask the ministers to come back to talk about the supplementary estimates, even if that means getting Mr. Garneau to come just once to also talk about the study. That would be the best solution.
I really want us to talk about the ministerial mandate letters. I can't ask that we postpone the study of the mandate letter of the to another meeting, although I appreciate the suggestion. There are so many things we want to talk about when it comes to infrastructure that I cannot go in that direction.