Notices of Meeting include information about the subject matter to be examined by the committee and date, time and place of the meeting, as well as a list of any witnesses scheduled to appear. The Evidence is the edited and revised transcript of what is said before a committee. The Minutes of Proceedings are the official record of the business conducted by the committee at a sitting.
Welcome to meeting number 16 of the House of Commons Standing Committee on Transport, Infrastructure and Communities.
Today's meeting is taking place in a hybrid format, pursuant to the House order of January 25, 2021. The proceedings will be made available via the House of Commons website. So you are aware, the webcast will always show the person speaking rather than the entirety of the committee.
To ensure an orderly meeting, I would like to outline a few rules to follow. First off, members and witnesses may speak in the official language of their choice. Interpretation services are available for this meeting. You have the choice at the bottom of your screen of floor, English or French.
For members participating in person, proceed as you usually would when the whole committee is meeting in person in the committee room. Keep in mind the directives from the Board of Internal Economy regarding masking and health protocols.
Before speaking, please wait until I recognize you by name. If you are on the video conference, please click on the microphone icon to unmute. For those in the room, your microphone will be controlled as normal by the proceedings and verification officer. I remind everyone that all comments by members and witnesses should be addressed through the chair.
Finally, when you are not speaking, your mike should be on mute.
With regard to a speaking list, as always, the committee clerk and I will do the very best we can to maintain the order of speaking for all members, whether they are participating virtually or in person.
With that, pursuant to Standing Order 108(2) and the motion adopted by the committee on Tuesday, January 26, 2021, the committee is meeting today to continue its study on the aircraft certification process.
I will now welcome and introduce our witnesses for today. From the Department of Transport, we have Nicholas Robinson, director general, civil aviation; and David Turnbull, director of national aircraft certification. They are by no means rookies to this committee. This is not the first time they've sat in those seats as witnesses. All of us are very familiar with these two witnesses.
With that introduction, I am now going to turn it over to the witnesses, for five minutes each, to introduce themselves as well as give their testimony.
Mr. Robinson and Mr. Turnbull, the floor is yours.
Good evening, Mr. Chair, Ms. and Mr. Vice-Chair and committee members.
I'll be speaking on behalf of both Dave and me. Let me begin by reintroducing myself.
My name is Nicholas Robinson. As the director general of civil aviation at Transport Canada, I'm responsible for leading a team tasked with maintaining aviation safety in Canada, and that includes aircraft certification. I'm joined today, as you've mentioned, by David Turnbull, my colleague, who is the director of national aircraft certification within Transport Canada.
We're pleased to be here with you once again to continue our discussion on aircraft certification. I believe the last time we met was in November 2020.
Mr. Chair, since our last appearance Transport Canada aviation safety experts have completed their independent review of the design changes to the Boeing 737 MAX aircraft and have validated the changes after a 22-month investigation involving in excess of 16,000 hours of review by Canadian experts.
Since our last appearance, Transport Canada aviation safety experts have completed their independent review of the design changes of the Boeing 737 MAX, and have validated the changes after a 22-month investigation, involving in excess of about 16,000 hours of review by Canadian experts.
In addition, Transport Canada issued a unique airworthiness directive for the Boeing 737 MAX, which outlines the required modifications to be made to the aircraft prior to the return to service in Canadian airspace. We also issued an interim order for operators that clearly outlines and indicates Transport Canada's expectations and requirements for additional training for crew members prior to the aircraft's return to service.
As a final step, working closely with our Canadian aviation stakeholders, including the operators of the MAX and their air crew unions, on January 20, 2021, Transport Canada lifted the existing notice to airmen, referred to often as a NOTAM, which prohibited the commercial operation of the aircraft in Canadian airspace. This signalled the return to service of the aircraft in Canada.
As I have previously highlighted to this committee, Transport Canada has worked extensively with the FAA and other key certifying authorities, including the European Union Aviation Safety Agency or EASA, the National Civil Aviation Agency of Brazil or ANAC, as well as the three Canadian operators of the Boeing 737 MAX—Air Canada, WestJet and Sunwing—and their pilot unions, throughout our entire validation process of the aircraft to ensure that we addressed all factors prior to the safe return to service of this aircraft.
This is a clear demonstration of Transport Canada's commitment to keep Canadians, the travelling public and the transportation system safe and secure.
Transport Canada's certification experts, by their rigour and thoroughness, have demonstrated great leadership throughout the process, and were instrumental in guiding the aircraft design changes that we see today. Transport Canada is fully satisfied that all its safety concerns have been addressed, that the required modifications have been incorporated, that the enhanced flight crew procedures are in place and that all applicable training has been conducted for our Canadian operators to return this aircraft back into service.
While global certification authorities have worked extensively together in the review of this aircraft, the decision to certify the aircraft is one that Canada has taken independently. The differences between the FAA and Transport Canada in their procedures and training demonstrate these independent actions.
Transport Canada has issued its own airworthiness directive to include design features beyond what was required by the FAA. It has also mandated its own enhanced training associated with the 737 MAX. While there was a great deal of convergence between authorities, we did have our differences, which are identified and reflected in the documents I have outlined here today.
I would like to extend my sincere condolences, once again, to the families who have lost their loved ones in both the Lion Air tragedy as well as the Ethiopian Airlines tragedy. I cannot begin to comprehend the impact it has had on their lives and I realize that no words will make this easier, but I hope that the actions Transport Canada has taken over the last 22 months to ensure the safety and security of this aircraft may prove some small relief.
Mr. Chair, I would like to thank you for the time you have given me and my colleague to appear again before this committee, and I look forward to answering your questions.
We do have a speaking order. First on our list, from the Conservative Party, we have Ms. Kusie, followed by Mr. El-Khoury from the Liberal Party, Mr. Barsalou-Duval from the Bloc and Mr. Bachrach from the NDP.
Once again to either of our witnesses, in your opinions, what parts of the original certification process for the Boeing MAX 8 do you think were flawed to allow the aircraft to be certified despite safety concerns?
I'm asking about the original certification process, not the aircraft itself but the process.
From my perspective, the process could have been better in respect to the knowledge that the FAA had of the functionality that was introduced with the MAX. I'm primarily speaking of MCAS, the manoeuvring characteristics augmentation system. The MCAS was a system that was introduced for a specific purpose. It was added on in another flight mode to meet a similar purpose, but in doing so, some of the protection mechanisms that were originally envisaged were not included, and that was either not known or not communicated by the FAA. There seemed to have been a communication breakdown between Boeing and the FAA in that regard.
When we came along to do the validation, we investigated as part of our inquiry the existence of MCAS, but the full functionality of MCAS was not disclosed to us. Therefore, clearly there was an information breakdown in the process between Boeing and the FAA, which we ended up getting caught up in when we came to do our validation. That's the main concern.
There are other areas as well, which we'll be covering, moving forward, in respect to going back and looking at some of the certification policies, practices and processes that we feel were not followed appropriately, one of the most prominent ones being the application of what we call the “changed product rule”, which determines the nature in which a modified product is certified. There were definitely some pitfalls in there that we have to learn from, and we are going to be working with the FAA, which just introduced terms of reference to study that policy with the aim to tighten up some of the policy loopholes, you could call them, that were taken advantage of to allow, say, a less than full investigation of the changes to the product.
Then indicating, as Mr. Robinson did, that Transport Canada has its own independent process from the FAA, further to that last response, you'd say that Transport Canada has made significant changes to the certification process after having gone through this process with the recertification of the Boeing MAX.
In terms of our process, not really. I think I mentioned at the previous committee that if you're speaking of the validation process as opposed to the role of being the state of design or the prime certifier, which I assume is what you're referring to, our process is scalable in that we can increase our involvement or increase our level of scrutiny depending on the circumstances of the particular project. There's no question that our level of review of the 737 MAX since the accidents has been significantly stepped up. Obviously, when we have two tragic accidents and there is a need to investigate, that level of scrutiny goes up.
Moving forward, we've instigated some increased communication protocols with our international partners. One of the silver linings, if you could say of such a tragic series of events, is that we are communicating more frequently, and shall I say, less formally, which we found quite effective. The weekly meetings that we were having throughout the return-to-service campaign have become a habit. It has allowed us to communicate and we will be using it to communicate more informally and more frequently, moving forward, so that's a real plus.
What I'm hearing is that your approach in terms of re-evaluating the certification changed. You feel it's become more communicative, but in the bigger picture you don't feel that this certification process has changed, in general, for Transport Canada.
Not in any structural way...no. There hasn't been any specific component or aspect of our validation process that needs any significant change, but that said, clearly there are going to be other versions or derivatives of the 737 family coming up. We're already aware of those. There's no question, given the events and the history and the lessons learned, that we will be spending more resources looking at the next derivative than we normally would have. That fits into the scalability of our validation project process.
I want to let you know that I can't hear the speakers very well. I just got a message from the IT service desk flagging an issue with the Internet connection in the Wellington Building, so I hope you'll be able to hear me.
Welcome to the witnesses.
My first question is for Mr. Turnbull.
Could the technology in new airplanes become so complex as to surpass regulators' ability to evaluate it? If so, what can we do to keep that from happening?
It's a very good question, but it's not a new question. We've been dealing with this problem for a number of years. Going back 10 to 12 years ago, aircraft manufacturers started to produce aircraft with systems that were much more highly integrated. In other words, instead of having isolated systems doing their own functions, they are all talking to each other through central computers. That's one example of technological advancement. That, in itself, resulted in a significant initiative to reinvent the way we analyze aircraft system failures from what we call a “design assurance” perspective.
Those processes or methodologies have been used in recent certifications and leave me quite confident that new technologies are indeed causing the way that we analyze aircraft designs to evolve to keep up with that. I'm not concerned that technology will get away from us. There is no question, however, that anything new coming our way is cause for closer investigation and indeed learning on our part, in some cases by looking at it from the regulatory perspective. However, I remain confident that we are prepared to meet that challenge.
Going forward, what is stopping a company like Boeing from doing what it did with the 737 MAX and hiding issues from regulators? What is stopping Boeing from again deploying technology that pilots aren't familiar with?
There are two components to that question I'd like to address: one, how Canada would prevent that; and two, how our certification partners, as well, have learned to prevent that.
First I'll speak to the Canadian perspective. I can say without doubt that the approach we take with our Canadian manufactures is a much more integrated one. Our experts, the experts in the national aircraft certification group, are quite significantly involved in the certification, review and analysis, even in those components that we may delegate to our manufacturers. It is a mutually respective process, which prevents that sort of instance we saw with Boeing where information was withheld from a certification partner. From a Canadian perspective, we don't believe that sort of situation or environment would occur, given the work that we have directly with our manufacturers.
From an international perspective and the instance that we saw with Boeing, we believe that the reviews and inquiries that have been undertaken within the U.S., and the recommendations that have been put out, which the FAA has committed to implementing, will prevent a similar problem from occurring in the United States again, particularly with regard to Boeing.
A secondary set of assurances goes back to my colleague Dave's comments on what we've learned around how much we engage and the areas that we engage on in our validation process. Our validation process will be much more thorough in a number of different areas where we see there may be a chance or an opportunity that the certifying authority might not have the full information for what's being looked at.
I'll go back again to a comment, and probably a recognition, which I would ask the committee for consideration of. While among certification authorities across the world—particularly EASA, ANAC, us and the FAA—we do work together and collaborate in the certification and validation of aeronautical products, there's also a clear recognition that our systems differ in many ways.
I spoke to that in the previous question. Our engagement with our manufacturers and the way we delegate reviews are different from what the FAA has learned could be problematic, was problematic, in the case of the Boeing 737 MAX.
I would ask that the committee consider the differences between our own system and that of the FAA. I'd also refer you to the testimony you heard from our own Canadian manufacturers who are engaged in our certification systems and their approaches. I would consider that testimony as being very important, because that is a true testimony of how Canada and the national aircraft certification group work with the manufacturers to certify globally recognized, safe aeronautical products.
I hope I'll have a chance to ask my questions about the Boeing 737 MAX. It's an issue I care about deeply.
I care deeply about another issue I'd like to raise today. On Friday, everyone should have received my notice of motion. It reads as follows:
That the Committee invite the Minister of Transport to appear for one hour on the approval of the sale of Air Transat and that this meeting take place as soon as possible, but no later than February 25, 2021. That the Committee invite for the second hour of this meeting the Competition Bureau to testify on the same subject.
I am putting forward this motion because, on Thursday, as everyone knows, the transport minister approved the sale of Air Transat to Air Canada, despite the fact that the competition bureau had advised against it. The bureau's report dates back to March, yes, but the opinion still stands.
The government imposed conditions on Air Canada to allow the sale to go through, but the bureau found them inadequate. What's more, another offer was on the table, from businessman Pierre Karl Péladeau, an offer that would have kept competition intact.
In light of all that, the minister should explain why he approved the sale when the competition bureau said that it was a bad idea and that the measures were not satisfactory, not to mention the fact that Mr. Péladeau's offer was also on the table.
Hearing the minister's explanation as well as the competition bureau's perspective would be very insightful.
I have something to propose to the honourable member, Mr. Barsalou-Duval. We've discussed this, so I want to reiterate that, if he is willing to withdraw his motion, I am prepared to give him my speaking time when the Minister of Transport appears at our next meeting.
We still haven't finished our COVID-19 report, and I'm sure the Minister of Transport has a packed schedule. I think my proposal would give Mr. Barsalou-Duval enough time—more than 10 or 12 minutes—to put all of his questions to the minister.
I'd like to thank Mr. El-Khoury for his generous offer. It's very kind of him.
Of course, you'll appreciate that my preference is to have the minister appear before the committee to thoroughly address the matter. We already have two topics to discuss with him at our next meeting, his mandate letter and the whole issue of border measures and testing. I am nevertheless pragmatic, so if the committee is amenable, we can replace the transport minister with Pierre Karl Péladeau, the person who put in the competing bid. That way, the committee could examine the issue without making any demands on the minister's time.
If we decided to invite Mr. Péladeau, we would have to invite the other bidders as well. I can't quite see how having Mr. Péladeau appear as a witness would help as far as the Government of Canada is concerned, since the minister would be answering Mr. Barsalou-Duval's questions directly.
Thank you to my colleague for bringing up those little suggestions.
I come from a business background. I don't think this committee should be getting involved in business disputes between the many different airlines and businessmen. I think that, with respect to our witnesses, we need to hear them out. We don't have any studies completed, and I really want to get to the study and the report. That's very important for many people in a sector that's been heavily impacted by COVID. I get calls every day at my constituency office in terms of airlines and people who work in the airline industry or the transport industry, so I think it's important that we get to a report. There are many other things that will come up.
If our Conservative colleagues can weigh in here, I'd like to hear what they have to say.
I was talking about the relevance of inviting Mr. Péladeau. If committee members have other witnesses they would like to hear from on the subject, that's fine with me. Either way, I think it's important for the committee to give Mr. Péladeau the opportunity to be heard since he never had a chance to meet with the Minister of Transport before he approved the deal, which I find quite surprising.
I see that what I'm proposing does not have the government members' support, so we should proceed with the vote and get back to today's study.
The fact of the matter is that this is an important issue, much more than a deal negotiated between two companies. As I see it, the government's decision was politically motivated. It approved a quasi-monopoly when another offer was on the table. It seems to me that the individual behind that offer deserves to be heard by the committee. I have questions about the minister's reasons. The minister is supposed to appear Thursday, so further to Mr. El-Khoury's proposal, we could replace the minister with Mr. Péladeau, who would then have an opportunity to be heard.
Committee members will have read the letter that my colleagues and I submitted for their consideration. We have strong concerns about the way in which the minister made his decision on the Air Transat sale, especially in light of what we've heard from the competition commissioner, so we very much support the idea of inviting the minister to appear before our committee to answer our questions.
As for the proposal to add Mr. Péladeau, we have no opposition to that. I would certainly be willing to entertain that idea. However, I believe that inviting the minister should be our first priority. I certainly believe, given the impact that the sale likely has on Canadian consumers, on the flying public, that this issue is of urgent importance and I support Mr. Barsalou-Duval's motion.
I must be missing something. The minister is actually coming on Thursday, as I understand it. I would have thought that would be a perfect opportunity for Monsieur Barsalou-Duval to pose his questions to the minister, so I'm a little puzzled about the need for this motion with a date that is very specific because the minister is already attending. As I understand it, Monsieur El-Khoury is perfectly fine giving up his time for Monsieur Barsalou-Duval to spend additional time questioning the minister on his decision in relation to something that is actually a fait accompli at this point.
I personally just don't quite understand why we need this motion, Mr. Chair.
Certainly we are concerned about competition, and of course as Conservatives we always believe in the free market, but we are particularly moved today by the advance news that it looks as though the European Union will not be moving to approve this transaction, and we are concerned that it would be moot at this point.
It's one of the three necessary components for the transaction to go through. If, as we have heard, that the European Union is not going to approve it, then it would seem to us that it is not a good use of time to spend time on something that appears inevitably will not occur. Therefore, we will not be supporting this motion at this time.
What time will we be going to this evening, so all committee members and witnesses can expect how long we will be here? I'd like to verify, please. I have an adjournment speech, but that's beside the point.
No, you didn't. It's my fault. I should have mentioned it in the first part of the meeting.
My intent is to try to get through all three rounds, and I believe if we get this thing going smoothly and get going with the meeting, we should be done around 6:30, give or take a couple minutes. That's what I'm striving for.
The government claims that the Boeing 737 MAX has become the safest aircraft in the world, given all of the checks and reviews that have been done. Excuse me for being a bit confused, since the Boeing 737 MAX is equipped with MCAS, which is supposed to automatically correct any flight instability resulting from the fact that the aircraft grew so large over the years that it became unstable and no longer functioned as it should have. MCAS works in combination with a hydraulic system that operates the horizontal stabilizer.
Can you tell me which is safer: that system or the fly-by-wire system used in modern aircraft?
Mr. Chair, as to the comment that the aircraft is the safest in the world, I've never mentioned that, nor would I. It undermines the fact that the certification system is based on clear sets of regulations. We ensure that all aircraft meet those regulations and standards, so when you see an aircraft that's certified or validated by Canada, you know it's meeting that standard.
I wouldn't put one aircraft as being at a safer standard than the other. We have a clear bar that needs to be met in Canada, and that's what is met for all our aircraft. I don't know if that came from another source, but that would be our Transport Canada perspective: that all aircraft we certify or validate are safe. They've met our standards, and our standards and regulations are clear.
It was the Americans' responsibility to certify the aircraft, and they did. If, however, Canadian authorities were responsible for certifying a similar aircraft, with the same technology and functionality, would it have received certification in Canada?
Along the lines of what Mr. Robinson previously indicated, my experience working in this organization is that we would not be prone to not knowing something so fundamental about the design and functionality of the aircraft.
Would we have certified the aircraft if it was our responsibility? Eventually, yes, but I like to think we would have caught and addressed the considerations or the things that were missed with respect to the failure modes that were introduced with the use of MCAS and the way it was implemented.
Again, I can only compare it to the certification activities that we undertake as the state of design. For a case in point, at the time, the Bombardier C Series, now the Airbus A220, was a significantly more technologically advanced aircraft than the Boeing 737 MAX and was a six-year project, with 150,000 hours that we put into it. It has a very safe record. God forbid there be any accidents.
I have another question. I heard about the Challenger 300, a Bombardier plane that was certified in 2003, so over 15 years ago. Like the Boeing 737 MAX, it had a manual reversion mechanism in case of hydraulic loss. That aircraft was the subject of a concern paper, as you call it.
I would really like to know why such an aircraft would be approved in Canada in 2021 when it was the subject of a concern paper in 2003.
Thank you to both of our witnesses for being with us today to answer our questions.
My first question relates to the MCAS system. I was reading an article in The Globe and Mail last month by Brian Barsky, the engineering professor from the University of California, Berkeley. I found this quite troubling. He writes that the 737 MAX 8 “has ill-positioned engines, situated too far forward on the wings, a design that causes unstable flight.”
I imagine that for most of the flying public, reading that would cause concern because stable flight would seem to be one of the primary objectives in aircraft design.
Can either of our witnesses comment on that quote and the seemingly fundamental design flaws behind the 737 MAX 8?
I would start off by saying that there is a lot of false information in that Globe and Mail article. We actually prepared a response. Your question relates to a previous comment by Mr. Barsalou-Duval.
The aircraft does not rely on MCAS to be stable. This is a fallacy. The media has taken this and it's gone a little bit too far. Our push-back on The Globe and Mail includes an attempt to correct that fallacy, in that the MCAS system is simply a system that will increase the nose pitch-down moment on the aircraft to affect the feel that the pilot has in the control column as part of the stall identification system. The aircraft has been thoroughly tested with the speed trim system—which includes the MCAS system—completely inoperative and the flight characteristics have been found to be totally acceptable.
This is not an inherently unstable aircraft. Anything that you're reading out there that says that MCAS is there to prevent an aircraft from stalling or that it is otherwise saving the day on an “unstable aircraft” is simply untrue.
There seem to be a number of independent experts, and we've certainly heard from some at committee, who have asserted precisely that, so I suppose we get into a situation of “he said, he said”.
According to a report in The Globe and Mail, Transport Canada chose to disregard a senior Transport Canada engineering manager's recommendation that the MCAS system be removed entirely. Is this true, and if so, why was that and what considerations went into that decision?
I'll speak to this, because The Globe and Mail article mentioned that the senior person was me. I can speak to this directly.
In fact, when our expert came to us with the idea of looking at the MCAS of the aircraft, the first thing Dave and I did was to really start to explore the issue. What a great idea. What an idea that we want all of our experts to bring forward to us when we look at a validation or a certification issue. We want them to take issue with what's in front of them and explore it to the fullest. That's why to a previous question to me on whether there was any influence with regard to this validation process, I said there wasn't. Our experts were given full range to over-review the concerns that we clearly outlined to the FAA back in April of 2019 and to bring to Dave the changes that they would require, that they thought were absolutely necessary in order for Canada to be comfortable and for me to make remarks to this committee to say that we are fully satisfied that all of our safety issues have been addressed.
There again—and I'm back to my colleague's question—was another assertion in The Globe and Mail that was absolutely false.
You required several physical changes to the MAX 8 above and beyond the FAA's requirements, and that's certainly commendable. My question is why you stopped short of requiring a third angle of attack sensor. I understand that this is something that was recommended by several independent experts. It's something that's used in the Airbus A320neo.
What were the factors that went into that decision not to require a third sensor, and were there concerns expressed by Boeing related to that possible change?
The notion of a third sensor did come up. However, it is not the role of the regulator per se to impose the design solution on the applicant. This is how the certification process works. The applicant will propose a design solution, and it's the regulator's job to ascertain whether that solution meets the standard. Design changes were implemented on the 737 MAX, which were found to meet the safety standards and to mitigate the specific concerns that were discovered in the post-accident investigation, without the addition of a third source.
You are correct that other aircraft do indeed have three sources, but that is not the only way that the system can be designed. We evaluated the aircraft with the existing number of sensors and the improvements that were made, and we found them acceptable.
We're now going to move on to our second round. We're going to start with Mr. Soroka from the Conservatives for five minutes, followed by Mr. Sidhu from the Liberals for five minutes, Mr. Barsalou-Duval for two and a half minutes, and then Mr. Bachrach for two and a half minutes.
My first concern, which I've heard from a lot of people, is that this aircraft has been in service for many decades and it's had many modifications over the years, but when it came to the certification process, I'm just wondering, as are many others, if that was just a rubber stamp because it's been the safest aircraft for many decades. Is that potentially the case?
No, it wasn't a rubber stamp. I'll refer back to one of the key issues that have found us here today, which was that the company, Boeing, was withholding information from the FAA with regard to the full extent of the MCAS system. The validation approach that we took was similar to the validation approach we took on many aircraft that we reviewed from other certification authorities.
In this case, we had a manufacturer that didn't fully articulate to the certifying authority, the FAA, the full extent of MCAS.
Yes, certainly. There were a number of changes, some of which were not directly related to the accident. There were some discoveries with respect to the need to separate some wire bundles to prevent some common failures. A lot of the work was done with respect to software changes to the flight control computer, specifically with MCAS, to limit the power and the frequency in which MCAS can fire. MCAS can only fire once per flight now.
The use of the electric trim switch on the control column can actually disable MCAS, which was not the case before. Its authority in terms of the degree and the rate to which it can change the angle of the horizontal stabilizer is limited to allow the pilot to overcome that input. There are some features added that allow a comparison between the left and right AOA sensors that will prevent the propagation of errors through to the following systems.
A lot of it, in addition to those changes to the flight control computer, involved changes to the procedures to allow for improved pilot awareness—in other words, situational awareness in failure modes or failure scenarios that can still occur. One of the key findings of the accidents and our post-accident investigation was the degree to which the pilots in general were not prepared and not trained to deal with the types of failures that are deemed possible. That's a common theme.
We also discovered that the simulators that were used for training were not programmed to demonstrate the faults that actually occurred in the accidents. That has been fixed.
Then, of course, Transport Canada went above and beyond and recognized that the erroneous firing of the stick shaker, which is part of the stall warning system, is deemed to be extremely distracting and definitely a negative in respect to pilot workload. The failure case, which is still possible within the aircraft, trips off a number of what we call “cockpit effects” that the pilot has to deal with. In our judgment—and the EASA agreed with us—the ability to disable that erroneously firing stick shaker was a required improvement to reduce the pilot workload in these foreseeable failure scenarios to an acceptable level.
You brought up the training requirements. I know that the Minister of Transport has said that, in order for this plane to get certified, there had to be training. Was this specifically just on the MCAS system or were there other training requirements as well?
As I said, some of the failure modes that occurred are still possible within the aircraft. The objective here in general, as is always the case in aircraft certification—or should be the case—is to make the training commensurate with the design. In other words, if there are systems that rely on pilot intervention—in other words, the pilot is expected to intervene to correct a failure situation—it is critical that the training be customized to emphasize that reliance on the training.
That was something that was noticed and was missed in the original job.
I'll go back to my opening remarks, in that the coordination and collaboration between international authorities has been significant from the beginning of this process. The FAA are the certifying authority, but as my colleague Dave pointed out in some of the changes that were just outlined there, I would say that the other three authorities were also leaders in ensuring that those changes were made to that aircraft.
The four authorities together continuously meet and met to discuss this aircraft, to discuss the review of the aircraft and to exchange ideas of the aircraft. They met within the group of four but also bilaterally and trilaterally at times.
Now that we are committed to looking at the reviews—particularly, I would say, the joint authorities technical review that we as well as other certification authorities participated on—we're committed to working with the United States in making sure that those recommendations are implemented in a consistent manner that has harmony across the four authorities.
I wouldn't express that there were many differences. We each have a delegation system. At their very root, or the reason for their existence, they are similar. The key comes down to, in my view, the degree of oversight that is carried out by the authority. We both delegate responsibilities, but in our system and in the FAA, as it should be, the fact you've delegated authority does not preclude, or alleviate the responsibility of the regulator to understand the design. That's key to this issue.
Clearly, in the case of the 737 MAX, there were issues about the aircraft design that were not known and not understood by the FAA. That's the fundamental starting point of where this happened. As I've explained previously to an earlier question, our delegation system has traditionally evolved to a point where we consider a certification project as a partnership with our delegated applicants. We work hand-in-hand with them, and we work on this together.
The decision at the end, the individual decision of delegates to make the individual determination of compliance to all the standards the aircraft must meet, is truly given and done by them, but that decision is not made without our full knowledge and concurrence right to the end of the project.
The possibility of there being something unknown or not understood in our system, and to a great degree with many of the certifications that come from the FAA, are of that nature. Something happened with respect to the dynamic between Boeing and the FAA in that particular instance. We all know the story. It's not the way it's supposed to work.
I can speak specifically to the four certifying partners, Brazil, the Europeans, us and the FAA. The FAA has certified the aircraft, and all three other partners have validated the aircraft. This will allow other authorities, and you can imagine global authorities all over the world, to determine when they're going to approve the aircraft.
I'll also note that this aircraft was relatively new. Unlike some other aircraft, when it was grounded, there will be some authorities that won't need to allow this aircraft to return, simply because it was not flying in their airspace.
We can provide the latest information we have to the committee at a later date, but I wouldn't want to list off all the countries right now, because it's changing as individuals are completing their reviews.
I'm going to continue the line of questioning around aircraft safety. My question is for Mr. Turnbull.
The activator is a mechanism that triggers the actuator, which raises and lowers the aircraft's horizontal stabilizer. The Boeing 737 MAX is equipped with only one activator, when most aircraft with a similar capacity are equipped with at least two activators to ensure the aircraft functions properly.
Would you say it's safer to have a single-activator system or a multi-activator system, as is found in most other aircraft?
I'm not going to be able to get into the details of which aircraft have different numbers of actuators. Some of my specialists who report to me would know that. All I can say is that the compliance to the standards includes an analysis of all the failure modes. It includes a thorough look at the redundancy certain systems have. Aircraft systems can be designed with different layers of redundancy. It's dependent on the probability of failures; that determines whether they meet the requirements.
You didn't really answer my question any more than you did when I asked whether you would certify the same aircraft had it been manufactured in Canada.
I really can't understand how Canada deems acceptable aircraft that are less safe than those produced by Boeing's competitors. Is it that Canadian travellers don't deserve to fly on the safest aircraft possible?
All of this comes down to the fact that the aircraft is outdated. It's had the same system, or at least the same certification, for 50 years.
Don't you think it's a problem to have an aircraft that is constantly being grandfathered in?
With respect, Mr. Barsalou-Duval, I don't believe your assertions are quite accurate. The 737 MAX, yes, is a derivative model with a lot of history, but it has yet again been shown to meet the design, the safety standard. There are many aircraft out there flying right now that have a perfectly safe record and were certified 30, 40 or 50 years ago.
Again, the exercise with the 737 MAX was to re-evaluate the design as it was proposed by Boeing and to determine once and for all whether the design changes completely and thoroughly mitigated the concerns and the failure modes that were realized in the accidents. That job has been complete. At this point to say that it is an unsafe aircraft would not be consistent with the conclusions we've drawn that allowed it to go back into service.
I'd like to ask some questions stemming from my recent Order Paper question and the response that I received from Transport Canada.
In it, your department indicated that.... We know the Lion Air crash occurred on October 9, and that nine days following the crash, there was a telephone call between the FAA and Transport Canada in which the FAA told Transport Canada that the MCAS caused the Lion Air crash and that a software fix would be forthcoming soon. Why, with that information in hand, did Transport Canada not move to immediately ground the aircraft until there was a fix in place?
Thank you for that question. What I can say is, at that point, conversations with the FAA started right away after the aircraft accident of Lion Air, just like it would with other accidents that occurred. I'll even refer to an accident that occurred for another 737 variant model just a number of months ago. Right away, we were speaking to the FAA with regard to what they knew about the aircraft.
You were mentioning that short time frame. What I can say is that within that short time frame, and actually on November 8, Transport Canada moved forward unilaterally—we were the only civil aviation authority to do so—to change criteria for crews to ensure they were aware of the key steps to address a runaway trim stabilizer condition. That occurred on November 8, and that was the first immediate action that we undertook to start to address an issue that we saw and were aware of. We worked with our air operators and aircrews to establish that, and then we continued to speak with the FAA to fully understand the accident.
As you can imagine, during an accident there are preliminary reports, but there is a great deal of information that has to come out to understand where the accident...and what caused the accident. We were satisfied at the time that the quick, unilateral actions that Canada took, which were in place by November 8, started to address that.
Mr. Robinson and Mr. Turnbull, welcome back to the committee. I realize that you've had certainly a lot of work over the last two years. I was very glad to hear that there are no outstanding concern papers left on the MAX 8.
However, in the past, there were outstanding concern papers, in particular with respect to the MCAS. Can the witnesses describe for the committee what changes were made to the MCAS while the plane was grounded that led to the MCAS concern paper being resolved?
The concern paper that was referred to and discussed at previous committees was not specifically related to MCAS. It was our investigation of the stall characteristics of the airplane to determine the basic dependency of the aircraft on systems, such as MCAS but also other aspects that comprise the stall identification system, to determine whether the aircraft had inherent natural stall characteristics. In other words, does the aircraft require systems to intervene to protect it from stalls? At the end of that exchange, we concluded, thankfully so, that the aircraft does not.
Yes, that issue paper was open, and it was eventually closed with the result we had expected to confirm—that MCAS was not required to maintain a stable aircraft.
I believe I covered that in one of my previous answers. I'll just summarize it again.
The ability for MCAS to fire has been protected. There are more inputs required than were in existence in the previous design. The system is only allowed to fire once per flight, where in the accident situations it was firing repeatedly. The authority that the MCAS has to drive the nose down has been scaled back such that, even if it did malfunction, it is now within the pilot's full ability to recover and overcome those aerodynamic forces.
There are comparative features or cross-checks between the two AOA sensors. If they're out by a certain difference between the two of them, it will kill the input and prevent the MCAS from firing. Finally, the electric trim switch on the control column, if applied by the pilot, will immediately engage the MCAS, which in the previous situation it did not.
In a discussion by my colleague David, he mentioned one of the key things. One of the unique changes we had was the ability for crew to pull a circuit breaker to help alleviate some of the workload issues that are found within the cockpit. If we have that procedure as an option to flight crew, we have to train against it. We have to make sure that the crew are ready, they understand and they know how to move forward to address that circuit breaker pull. That's one of the crew procedures that we've put in place.
There were also some negative training elements that we found, “negative training” meaning that it prevented individuals in other failure scenarios from taking and using the systems that were available to them. We looked at the curriculum and removed particularly a negative training element with regard to the trim switch.
Those are the key procedural changes we made that were unique to Canada's approval.
There are two pieces there, and it is very important.
When Transport Canada certifies an aircraft, that's a Canadian-made product. That's a Canadian manufacturer coming to us for an initial-type certification for a product. That wasn't the case here. We were a validating authority.
From a certification component—and we've explained in a few of the responses we've had—we believe our certification approach in Canada is very sound. We have very strong oversight and a very strong relationship with our manufacturers. I don't believe that certification approach is called into question here.
From a validating authority perspective, that's what we were in with the Boeing 737 MAX. We've explained that what happened here was that there was a withholding of information with regard to the full impact of a particular system on an aircraft. In this validation approach we're speaking about now that concluded back in December of this year—to my colleague Dave's point—what we did was we turned up the level of input and the level of involvement so that we were able to fully come to an understanding that when we validated this aircraft we both could say, and Transport Canada could say, that all of our safety concerns are addressed.
We worked with the FAA and other aviation authorities to ensure that the systems that were previously mischaracterized, withheld and not explained fully, were done this time.
Mr. Turnbull or Mr. Robinson, whomever, it doesn't matter, I have just a couple of comments. First of all, thank you for being with us today. I certainly thank you for the important work you do on behalf of all of us who fly and for the challenging work you do on a regular basis.
However, I'm often left wondering, when I read the reports and the information surrounding this MAX aircraft, how a minister or a committee like this one can provide meaningful oversight on issues that are so technical in nature.
I think we first have to look at the authority that we're provided with regard to aircraft certification. It goes back to a previous question of how we manage as a certifying authority to ensure that we are up to date and able to certify, review and examine continuously evolving and continuously more complex aircraft.
From an authority to certify or validate the aircraft perspective, the authority is exactly where we need it to be. It's with our globally recognized experts. These are leaders in the field of aircraft certification who are working in Canada's national aircraft certification group. Those are the people we need to continue to bring into our national aircraft certification group, continue to recruit and continue to use to make those decisions on whether or not an aircraft meets very clear regulations and standards.
In terms of the committee's perspective, we very much welcome the review you've undertaken with regard to looking at and examining the processes attributed to validation and certification, and our engagement with international partners. We would be interested in and very much welcome your assessment of how our process is working, the testimony from our industry with regard to that process and any recommendations you might make to improve that process.
I think it is extremely important—and I do wish the committee to consider it—that the certification, validation and review of these aircraft be left with our global leaders, our experts who are found within our national aircraft certification group.
I will be the first to say that we look for experts in the field who may be working with design and manufacture when we look to recruit individuals. There are certain areas within aircraft certification where the labour market is very small and very tight. We're always encouraging and hoping to bring the best into the national aircraft certification group. As part of that, some of the individuals we bring in absolutely have previous employment within our design and manufacture organizations.
What we do have, and it's across government, is a very clear process to make sure there is no conflict of interest. If an individual is coming from Bombardier—because they're a strong Canadian manufacturer—or another one of our strong Canadian manufacturers, we will ensure that they're not in a conflict of interest in a review of an aircraft, an assessment of an aircraft or in an airworthiness case of an aircraft.
There are strong checks and balances. There are systems within national aircraft certification, within Dave's team, to make sure that there isn't a single actor who could undermine a strong aircraft certification process because they've come from a particular industry partner.
Members, we're now going to move on to our third round. I had Mr. Kram there, but he's bumped up to the round before that, so I'm assuming Mr. Shipley is going to take the floor for five minutes on behalf of the Conservatives, followed by Ms. Jaczek for the Liberals for five minutes, and then Mr. Barsalou-Duval and Mr. Bachrach for two and a half minutes each.
I'll direct this to either Mr. Turnbull or Mr. Robinson, whoever wants to take this question. These MAX 8s were, for lack of a better term, “mothballed” for almost two years. Where were these planes actually stored for that period?
A lot of them went to the desert in the U.S. southwest, which is a very special spot due to its low humidity. It's not conducive to corrosion. A lot of them are flown back to wherever they may operate.
Thank you. That's great. It leads into my second question, which was going to be about corrosion. I understand, as with any vehicle, if you store your car—even in the winter, if you have a summer car—it can be very hard on it.
Was there any concern with bringing all these planes back into service, with corrosion and with sitting? I know we're dealing with the certification and the issues they had prior, but anything that sits around for two years.... Have they all been thoroughly tested? Are they all ready to go? Quite frankly, are some of them still mothballed or are they all up and running?
Of course, some of them are probably still mothballed because of the pandemic. The demand is only growing, so obviously they are not all being put back into service at the same time. That is a gradual process, which is ongoing.
With respect to your question—it's a very good one—one of the required actions to be taken before the return to service of any particular aircraft is to follow a Boeing service bulletin—which was developed specifically to address your question—to consider the specific maintenance actions that should be undertaken on an aircraft that has been stored for such a period of time. I believe those back-to-service maintenance actions are customized, dependent upon where and how the aircraft was stored. It was definitely part of the process to make sure that was covered.
Boeing has produced several service bulletins. All the design changes that were introduced were introduced via service bulletins produced by Boeing. Those service bulletins are the vehicles to convey the information to the airlines to either install modifications or, in the context of your question, to carry out specific maintenance actions.
In addition to that, in Transport Canada's case, the oversight of the airlines themselves is conducted primarily by our national operations branch, which oversees the airlines that actually fly the 737 MAX. There are three of them. The maintenance activities prior to re-entering services would have been overseen and checked by that other part of Transport Canada that has that as their mandate.
You may not be able to answer this as fulsomely as you have the other ones, but obviously the pilots haven't been flying these planes either. With COVID also causing some problems getting pilots back in their seats, how has that worked out?
Are the pilots being retrained and recertified? How's that going?
I have a similar answer. That was probably one of the biggest challenges faced by the airlines. I know that Air Canada—or was it WestJet, I can't remember. One of them had in excess of 400 pilots who have essentially been sitting dormant. It's a very daunting task to get them back up to speed.
One of the things that we did above and beyond the bare minimum was to issue an interim order, which mandated that those pilots go through that training. It was never a concern that they would not. It was literally a belts and braces approach to make sure that every single pilot who gets cleared to go back on the aircraft has gone through the now enhanced and highly emphasized training for these pilots. That was an activity that was undertaken by the airlines even before the release of our AD. The training material was available. The airlines were up working on training their pilots even before we were ready to return the aircraft to service. Part of that training is in a simulator. Part of that training is in the actual aircraft.
That was a very significant effort that was carried out by the airlines.
Actually, this was already asked. I believe it was by Mr. Rogers. If it wasn't, I apologize.
I had it written down here, and I have to ask. I'm not a nervous flyer. Obviously, I'm not doing any flying right now, but I do like to take many vacations with family. After being on this study, next time I get on a 737 MAX, it's obviously going to be in the back of my mind. How could it not be? I was going to ask Mr. Robinson and Mr. Turnbull, even though it's been answered, do you have any hesitation ever getting on a plane, 737 MAX, with your families and flying?
I think all that we've heard this evening is really very reassuring in terms of the steps that have been taken in relation to the tragic accidents with the Boeing MAX 8. However, there is one very simple question that I think many people in the public would ask: If the fault was the MCAS system, was there any consideration of actually removing the system completely?
It was obviously introduced to solve a certain problem. You have now modified its use with all sorts of sensors and other very technical aspects, but why not just simply remove the system and return the plane to its previous condition, which was apparently flying safely?
Thank you for the question. That's a very interesting topic indeed.
A previous question touched on the voice that was heard from one of my team members, who looked very closely at that question and did quite an in-depth analysis of the pros and cons of MCAS. We had that discussion. We had that investigation. We had that conversation with the FAA.
The reality of it is that, as a validating authority, we're not in the driver's seat. We looked at the issue very closely. It was determined by the FAA, and in the end we did agree, that MCAS, strictly speaking, is required to meet strict compliance to a very specific requirement that specifies a particular control column force in a stall, in what we call a windup turn, or a banked turn, where the aircraft is experiencing some G-force. That said, that requirement in itself is quite subjective. That's where this conversation came from.
Had we been in the driver's seat, I could put 20/20 hindsight on it and say that maybe if it was Transport Canada certifying the aircraft originally, we would have not required MCAS, but I will remind you, or inform you, as the case may be, that this is a system that Boeing offered up. Based on our investigation, there was never really much of a debate that we could ascertain that went on between Boeing and FAA as to whether the system was required. Boeing offered it up to meet a specific need, to meet this column force requirement. From what we've gleaned, I guess there was never really a conversation between Boeing and FAA to really scrutinize that question as to whether MCAS was really required.
To wrap it up, in the end, I would be free to say that the length of time to fix the aircraft was related to the decision to leave MCAS on. There's no question. Had MCAS been removed...and as I explained earlier, the aircraft has been thoroughly tested by the FAA and us—and EASA, by the way—with the MCAS off, with safe flying characteristics. Nevertheless, there was this specific kind of picky requirement, if I may, that said this force had to be 50 pounds. Without MCAS, it was falling slightly short.
Technically speaking, it's required for compliance. Is it really needed for safety? Debatably, no, but again, the FAA took the design as presented from Boeing. They accepted that was to be evaluated. Again, their job is to evaluate what is presented to them. I won't say that the process to reach return to service was not simplified by MCAS being left on. A lot of the work was to fix the system, to work around some of the not desirable features, shall I say, that MCAS brought to the airplane. That's why it took so long.
Thank you for that because it does relate a little bit to Mr. El-Khoury's line of questioning in terms of complicating systems and then having to evaluate the plane as a whole.
I just want to touch on one piece. We heard some heartbreaking testimony from families who lost loved ones on the plane. I'm wondering if Transport Canada learned anything in terms of communication in these sorts of tragic events. It struck all of us, I think, that perhaps they were still searching for answers. They were still obviously grieving. I'm wondering if there's anything Transport Canada has thought about in terms of, heaven forbid, any future situations like this.
I've had the opportunity to speak with the Canadian families, individuals associated with victims who were close to Canada, on a number of occasions now. I've learned a great deal from all of them. My condolences again go out to each and every one of them. I can't imagine the impact that this has had, nor do I want to imagine it.
We've learned a great deal. When this first occurred, we treated it as an aviation safety issue that we needed to get to the bottom of. Our national aircraft certification group and our aviation safety experts wanted to get to the bottom of it. We clearly outlined to the FAA our expectations, where we were not going to go, where we wanted to go. We started working with our aviation partners, and we wanted to address this issue.
What we missed was the personal impact, the human impact, that these accidents have. That's what we will learn and will do better on in the future. I do hope that—and I take the point that was made—we don't have to act again in this sort of way, but we did already. We just passed the anniversary of PS752 and the downing of that aircraft.
The conversations that we had with the family members of ET308, the Ethiopian Airlines 302, have directly impacted how we engage with families. It's impacted how I continue—how we, as a team, continue—to engage with the Ethiopian families, but it impacted right away how we engaged, from the beginning, with the PS752 families.
The age of the aircraft and the fact that it's covered by a grandfather clause worry me, and I'll tell you why.
I have a computer with a CPU I bought in 1995. I could use that computer today, if I really wanted to, but it would be a struggle and probably not work as well as a current model. The same is more or less true of this aircraft. The basic design remains unchanged to avoid recertification, but the aircraft has become larger over the years, which makes it all the worse.
In 1967, the 737 MAX could carry 115 passengers. Today's model, the 737 MAX 8, can carry up to 200 passengers. The aircraft is now twice as heavy and 10 metres longer. Those aren't minor changes. On top of that, the aircraft is 50 years old.
When, then, will the grandfather clause cease to apply? The clause has exempted the aircraft from recertification and allowed changes to be made because the aircraft's original design still stands.
You pointed directly at what is really the number one priority in investigating the certification policies and procedures, i.e., the lessons learned that came out of the accident. That is, as I mentioned earlier in this committee hearing, the changed product rule. That set of regulations, generally known as the “changed product rule”, define a process whereby a changed product is evaluated and it is determined whether the aircraft, in its changed form, should step up to the latest design standards, or whether certain aspects of the aircraft, or certain systems or features on the aircraft, are allowed, as you referred to it, to be grandfathered or to recomply with the existing standards.
I encourage you to review your automatic recertification process, at least as far as the grandfather clause goes.
I'll conclude with this question. Actually, it's more of a request. Could you provide the committee with the concern paper I asked you about earlier? The one from 2003 regarding the Challenger 300. I'm told it's called the I-8. I would very much appreciate receiving that. It would tell us what the concerns were with the Challenger 300 and whether they were the same in the case of the 737 MAX.
If you would like to finish what you were saying in response to the previous question, go ahead.
I may need some more specifics there. In the course of certifying domestically—in this case it's a Bombardier aircraft—we may have as many as 20, 30 or 40 issue papers on any certification. I'm not particularly current on the one you're referring to.
Thank you, Mr. Chair, and thank you, again, gentlemen, for answering all of our questions.
My last question has to do with something that arose as part of the various investigations in the United States. I think committee members followed with interest the reports of the U.S. House committee on transport and later the U.S. Senate committee that looked into these matters. One of the things that really stood out to me was the reference to the use of something called “authorized representatives”. As I understand it, these are employees of Boeing. They work for the company and draw a paycheque from the Boeing company, but they're actually seconded by the FAA—by the regulator—to do the work of the federal regulator.
To me, this seems to put them in the position of being a bit of a double agent and having two masters. It doesn't seem to lend itself to having a certification system that has real integrity. When I raised this with the minister at our committee, he said that this is done all the time and in fact we use authorized representatives in Canada.
Given the shocking revelations that came out of those two reports in the United States around the “culture of concealment” and all of the things that led to MCAS being hidden from the pilots and others, is Transport Canada looking into the role of these authorized representatives? Is this something that we can improve in our validation and certification processes, so that we will have fully separate professionals who are not beholden to the companies that are having their aircraft certified?
It seems to me that this would be something that would benefit the Canadian public and help restore—or at least increase—the amount of trust that people have in these systems.
The Canadian system of delegating authority, at least in the context of our aircraft certification, goes back to 1968. It's a well-established and well-developed system. I would agree that to the outsider it may involve a suspicion of conflict of interest. The reality is that the delegation system has been promulgated and accepted, not only within Transport Canada but to these external holders, to leverage our resources to allow and give credit to those organizations that have that expertise and can make the call.
The key to the whole process working and where we can really shut the door on any concerns of conflict of interest is our oversight of those delegates in doing that work. That is the key. As I said earlier, delegating the authority does not equate to relinquishing the regulator's knowledge and understanding of what is being done and what is being carried out. Right up until the moment a delegate in the Canadian system makes a determination of compliance to a particular requirement, they have had a discussion with their counterpart in my organization to agree mutually, working as a team, as to whether that finding should be made. It is not the case, necessarily, of somebody going away—out of sight, out of mind—and making these determinations on their own.
We're well conscious of the potential for conflict of interest. We've set up a system within the companies whereby the delegates themselves can reach across the room or across the table to us as the regulator and point out where they may be in a situation where their superiors are pressuring them. They have systems and mentors within their own companies that allow them to reach out and have those conversations.
We meet at least quarterly with every major delegated organization that we interface with. These are the types of things we are talking about in terms of how to maintain and how to, shall I say, nip it in the bud, if we've heard any signals of a delegate being pressured to make a decision that went against his or her technical best judgment. That feedback loop and that transparency is very consciously and very deliberately built into our delegation system to address the very concern that you raised.
Thank you, Mr. Robinson, as well, for your testimony today.
To all members, thank you. There's no doubt this will add to the final report that the analysts will be working on.
With that, we will end this meeting. Before I do, I want to mention that it would be great if any information that has been requested of the witnesses could be passed on to the clerk. The clerk will pass it on to the members of the committee.
With that, and with no other business, the meeting is adjourned.