Introduction

An important Federal Aviation Administration (FAA) function is certifying the safety of aircraft, aircraft engines, and major aircraft components. A law enacted in December 2020, the Aircraft Certification, Safety, and Accountability Act (Division V of P.L. 116-260), required FAA to implement major changes in its policies and procedures concerning certification of transport aircraft, such as commercial passenger and cargo jets. The act includes comprehensive provisions to review and reform aircraft certification regulations and processes, with particular attention to the certification of transport category airplanes used in commercial airline service and the process to review and certify changes to those aircraft over time to incorporate new technologies.

This report provides background on aircraft certification requirements and FAA oversight, as well as details regarding reforms enacted under the Aircraft Certification, Safety, and Accountability Act.

The Basics of Aircraft Certification

Several different certifications (Figure 1) are required before new aircraft can be placed into service:

• Type certification refers to the process of reviewing engineering data and performing inspections and tests to certify that new designs comply with regulatory requirements and minimum safety standards. Type certification is the first step in bringing a new aircraft to market or incorporating new technologies into the design of existing aircraft. FAA may grant amended or supplemental type certifications to address modifications that, in its opinion, do not change the design, power, thrust, or weight of the aircraft so extensively that a substantially complete investigation to determine regulatory compliance is necessary.¹ In such cases, the designer or manufacturer generally must show that the proposed changes comply with the airworthiness requirements in effect on the date of application.² In certain circumstances, FAA's "changed product rules" permit it to waive regulatory requirements in approving a type design change so long as an equivalent level of safety can be demonstrated.
  
  When sufficient or appropriate safety standards do not exist because of novel or unusual design features of the aircraft, FAA may issue "special conditions" specifying criteria that establish an equivalent level of safety.³ Increasingly, the rapid pace of change in flight deck automation and electronic flight control systems has resulted in greater reliance on special conditions to address software design, cybersecurity concerns, and human interface and human factors design considerations.⁴
  
  Once a type certificate or an amendment to an existing type certificate is issued, it typically remains valid indefinitely. In rare cases a type certificate can be voluntarily surrendered, or it can be suspended or revoked by FAA.⁵
• Production certification permits an aircraft or component manufacturer to build deliverable aircraft. It involves reviews of facilities, manufacturing processes, quality assurance, and workplace safety to assess whether the type design can be safely and reliably reproduced.
• Airworthiness certification is required before an aircraft can begin routine operations for an airline or other operator. Unlike type certification and production certification, a separate airworthiness certification is required upon final assembly of every aircraft manufactured. Processes involve examinations, inspections, and tests to determine that the aircraft conforms to the certified type design and meets airworthiness standards.

Figure 1. Types of Aircraft Certification

Source: CRS analysis of 14 C.F.R. Subchapter C - Aircraft.

Type Certification Standards

FAA has developed a broad range of certification standards that vary depending on the size and intended use of the aircraft. In general, FAA certifies the type designs of aircraft in either transport or normal categories.

• Transport category airplanes include those designed with a maximum takeoff weight of more than 19,000 pounds or a configuration of 20 or more seats. This encompasses most aircraft that passengers would normally fly on in scheduled commercial service operations. These airplanes must be certified under the regulatory standards prescribed in 14 C.F.R. Part 25. Manufacturers may seek to certify smaller airplanes under the transport category requirements, but usually opt for certification under the normal category.
• Normal category certification involves somewhat less stringent standards. As specified in 14 C.F.R. Part 23, normal category standards vary depending on maximum seating configuration and operating speeds. Normal category airplanes may separately be certified for aerobatic maneuvers, whereas transport category airplanes are not certified for aerobatics. Revised Part 23 certification processes rely on industry design and construction standards approved by FAA. Most smaller airplanes now in use, however, were certified prior to changes that were made to Part 23 in December 2016, and are certified under normal, utility, commuter, or aerobatic categories based on the requirements that existed at the time of certification.
• Rotorcraft, such as helicopters, with maximum takeoff weights of 7,000 pounds or less or having less than 10 seats, can be certified in the normal category under 14 C.F.R. Part 27, but larger rotorcraft must be certified to transport category standards specified in 14 C.F.R. Part 29.
• Experimental airworthiness certificates are issued on a case-by-case basis, including for airplanes used specifically for research and development, marketing and sales (such as the sale of military aircraft to foreign governments), exhibition, and air racing, and for amateur-built aircraft.
• Light sport aircraft (LSA), one- or two-seat single-engine aircraft weighing less than 1,320 pounds (or 1,430 pounds for seaplanes) having a maximum rated speed of 120 knots (138 miles per hour) or less and used strictly for recreation, are certified to comply with industry consensus standards instead of standards defined in regulation.
• Powered ultralight aircraft having an empty weight less than 254 pounds and limited in speed to 55 knots (63 miles per hour) in level flight are not certified by FAA. Similarly, unpowered ultralight aircraft with an empty weight less than 155 pounds do not receive FAA certification.

Continued Airworthiness

After FAA-certified aircraft are delivered and enter operation, FAA maintains oversight responsibility to identify operational or maintenance difficulties. Under normal circumstances, safety deficiencies involving aircraft in operational use are addressed through the continued airworthiness process. This process involves FAA working with manufacturers, airlines, and other aircraft operators to identify safety deficiencies, approve fixes, and issue airworthiness directives ordering operators to address safety concerns through inspections, repairs, and/or replacements of faulty components. For electronic systems this might involve hardware replacements or software or firmware updates.

The continued airworthiness process requires international cooperation between aircraft operators, maintainers, manufacturers, and civil aviation authorities. In the United States, FAA requires aircraft operators and repair stations to submit timely service difficulty reports (SDRs) documenting any serious failures, malfunctions, or defects of an aircraft, aircraft engine, or other aircraft component.⁶ FAA maintains a centralized database of these SDRs, and investigates reported difficulties and monitors trends to identify problems that may warrant the issuance of an airworthiness directive. In this continued airworthiness process, FAA works with operators, maintainers, and manufacturers to determine suitable corrective actions to address safety deficiencies.

In addition, FAA may become aware of safety deficiencies requiring corrective actions through voluntary reporting measures⁷ and through investigative findings and safety recommendations issued based on aviation accident investigations conducted by the National Transportation Safety Board (NTSB) or by investigative bodies in other countries, as well as through FAA's own inspections and audits of aircraft operators. Once safety deficiencies are identified, it is ultimately up to FAA to determine an appropriate remedy in order to maintain operating aircraft of that type in a safe, airworthy condition, which may result in FAA issuing an airworthiness directive prescribing corrective actions that must be taken by aircraft operators.

Figure 2. The Continued Airworthiness Process

Source: CRS analysis. Notes: ASAP: Aviation Safety Action Program; VDRP: Voluntary Disclosure Reporting Program; FOQA: Flight Operational Quality Assurance.

Managing the Certification Process

Certification is primarily the responsibility of FAA's Aircraft Certification Service (AIR), which oversees product development phases, the manufacturing processes covered under production certification, and the airworthiness certification of all completed aircraft. AIR is part of FAA's Office of Aviation Safety, which also includes the Flight Standards Service (FSS). FSS primarily inspects and oversees airlines and other aircraft operators, but plays an important role in setting training standards and reviewing flight operational procedures for newly certified and modified aircraft designs. AIR shares responsibility for overseeing continued airworthiness with FSS, which regulates airline operations and pilot training.

FAA's aircraft certification workforce is augmented by FAA designees. These are employees of aircraft and aircraft component design and manufacturing organizations and consultants who carry out certain delegated functions, such as tests and inspections, on FAA's behalf.

FAA's annual budget for AIR totals about $260 million, which covers a staff of about 1,350 employed at 13 aircraft certification offices, 19 manufacturing inspection district offices, 4 manufacturing inspection satellite offices, a certificate management office, a certification program management section at FAA headquarters, and 2 international offices. FAA's largest aircraft certification office, located in Seattle, WA, and primarily dedicated to overseeing Boeing Commercial Airplanes, has a staff of about 40 employees. Overall, AIR oversees about 1,600 manufacturers. Of those, 13 have authority to conduct type certification of their own products under a program known as Organization Designation Authorization (ODA), and 19 have authority to perform production certification as of March 30, 2021.⁸ The largest U.S.-based manufacturer of aircraft and aviation products, Boeing, has delegated authority to perform type certification, production certification, and airworthiness certification.

Addressing Pilot Training in the Context of Aircraft Certification

Whereas FAA's Air Certification Service is responsible for aircraft certification, the Flight Standards Service (FSS)⁹ prescribes the standards for aircraft operations and verifies that operators, such as airlines, meet those standards. For each aircraft type design, FSS sets up an aircraft evaluation group to determine required training and operational procedures.

Flight standardization boards are the functional elements of aircraft evaluation groups that deal specifically with the training and flight operational procedures and requirements for a particular aircraft.¹⁰ This includes determinations regarding the requirement for a pilot to obtain an aircraft type rating, and minimum training recommendations and requirements for establishing initial flight crew member competency for the aircraft.

For variants of an existing aircraft type, a flight standardization board may develop Master Difference Requirements tables that outline the specific differences between various aircraft covered under the type certification as well as similar aircraft. These tables form the basis for evaluating an operator's differences training curriculum for pilots who transition from one variant of an aircraft type to another or between aircraft with similar characteristics. The tables specify the training needed to learn and understand the differences between related aircraft types. FAA operations inspectors assigned to a particular airline or operator may then use these tables, along with more detailed flight standardization board reports, as a guide for reviewing and approving an operator's flight training plan.

Human Factors Implications

Automation-related aviation accidents over the past decade have brought complex human-systems interaction to the forefront of public policy. A number of accidents have involved either failures of automated systems or pilot confusion over the operation of automated systems. Studies indicate that pilots often do not fully understand how automated systems operate, and lack awareness of the various modes and status of flight automation. Moreover, research has shown that piloting skills associated with maneuvering aircraft using manual controls decline as a consequence of flying highly automated aircraft. Additionally, some research has shown that pilots may overestimate their ability to take over and safely maneuver the aircraft in situations when automation fails, particularly given the likelihood of unanticipated distractions in the cockpit during a system failure.¹¹ These studies have raised questions about approaches to training pilots on highly automated aircraft.¹² Complicating matters further, automated systems on modern air transport airplanes are highly adaptable. As a consequence, different airlines and individual pilots use different automated features and modes to suit their particular operational needs and personal preferences.¹³ Experts continue to debate whether greater standardization of automation design, operating procedures, and training is desirable.

A January 2016 audit report released by the Department of Transportation Office of Inspector General (DOT OIG) found that while FAA had established certain requirements governing airline use of flight deck automation, it lacked a process to ensure that airline training and proficiency standards adequately addressed pilot monitoring capabilities.¹⁴ In response, Section 2102 of the FAA Extension, Safety, and Security Act of 2016 (P.L. 114-190) directed FAA to develop a process for verifying that air carrier pilot training programs incorporate automated systems monitoring and opportunities to hone manual flying skills. FAA is currently considering a rulemaking to address the design of flight crew interfaces and cockpit alerting systems.¹⁵

Delegation Authority

Delegation of various aircraft and aircraft component certification functions to qualified private entities, such as company employees, independent consultants, or technical organizations, is a long-standing FAA practice. As far back as the 1920s, federal aviation safety agencies that preceded FAA relied on private individuals to participate in examination, inspection, and testing of aircraft during the product certification process. In the 1940s, programs were established to appoint designees to perform certain product certification approvals. These included designated engineering representatives and designated manufacturing inspection representatives employed by aircraft, aircraft engine, and aircraft component manufacturers, as well as airline maintenance facilities and repair stations.

Since its creation in 1958, FAA has allowed consultants and certain employees of aircraft and aircraft component manufacturers to conduct various certification functions on its behalf. This system was restructured in the 1980s, when FAA established a program to designate Organizational Designated Airworthiness Representatives. These actions were taken under FAA's long-standing authority under 49 U.S.C. §44702(d) to delegate activities related to aircraft type certification, production certification, and airworthiness certification, including examination, testing, and inspection necessary to issue a certificate, to private individuals and entities.

FAA notes that "[w]hen acting as a representative of the Administrator, these persons or organizations are required to perform in a manner consistent with the policies, guidelines, and directives of the Administrator. When performing a delegated function, FAA designees are legally distinct from and act independent of the organizations that employ them." Under 49 U.S.C. §44702(d), FAA has the authority to rescind a delegation issued to a private person at any time for any appropriate reason. Moreover, any person affected by the action of an entity delegated certain FAA certification functions may petition FAA for reconsideration, and FAA may, at its own initiative, consider the actions of a delegated entity at any time. If FAA determines that the delegated entity's actions are unreasonable or unwarranted, it may change, modify, or reverse them.

Organization Designation Authorization

In the 1990s, FAA's Aviation Rulemaking Advisory Committee sought industry input regarding FAA's delegation of aircraft certification activities. In 1998, the committee recommended that FAA establish a program known as Organization Designation Authorization (ODA), generally authorizing companies to conduct a broad array of delegated functions on behalf of the agency.

In 2005, FAA adopted these recommendations, promulgating regulations that formally established a new program for certifying companies that design and build production aircraft and aircraft parts. Under a formal ODA framework,¹⁶ FAA delegates certification authority to various aerospace companies, including aircraft manufacturers such as Boeing; engine manufacturers such as Pratt and Whitney, General Electric, and Rolls Royce; and avionics and flight control systems suppliers such as Honeywell and Collins Aerospace.¹⁷ FAA asserts that using designees for routine, well-established certification tasks allows it to focus limited resources on safety-critical certification issues as well as new and novel technologies.¹⁸ Congress has generally supported increased utilization of FAA's delegation and designation authorities in order to engage design and manufacturing organizations and their employees more directly in the aircraft certification process, often by working as proxies for FAA and its aircraft certification inspector workforce. Nonetheless, legislative language in the 2012 FAA Modernization and Reform Act (P.L. 112-95) and the 2018 FAA reauthorization (P.L. 115-254) directed FAA to review these practices to assess their efficiency and safety implications.

Evolution of the ODA Program

Over the past 15 years, the ODA program has expanded despite concerns over the adequacy of FAA oversight. Based on recommendations from the certification process committee and mandates in P.L. 112-95, FAA adopted several initiatives to improve and expand the program.¹⁹

Following passage of P.L. 112-95, FAA chartered two aviation rulemaking committees, one to address certification processes and the other to examine regulatory consistency. Among the recommendations set forth by the Certification Process Committee was expanding delegation under ODA to include processes for certifying that aircraft meet noise and emissions standards and for approving continued airworthiness instructions. The recommendations also included initiatives to address FAA tracking of certification activities, update certification regulations, and improve consistency of regulatory interpretations.

A 2015 audit by the DOT OIG found that FAA lacked a comprehensive process for determining aircraft certification service staffing needs for effective ODA oversight and other certification activities. It urged FAA to develop minimum staffing requirements, issue guidance on the data that should be routinely monitored and analyzed by ODA oversight staff, improve audit processes and training, and widely disseminate findings of these audits to ODA oversight teams to assist in planning future oversight. It also recommended that FAA implement evaluation criteria and risk-based tools to aid ODA oversight personnel in targeting oversight activities.

In a 2015 statement, the Government Accountability Office (GAO) observed that, while industry stakeholders favored expanding the ODA program, employee unions raised concerns that FAA lacked adequate resources to implement and oversee ODA expansion.²⁰ However, two years later, in March 2017, GAO reported that FAA had carried out its ODA action plan, had launched an audit training initiative for personnel supervising ODA inspections, and had expanded delegation under ODA to authorize designees to approve instructions for continued airworthiness, emissions data, and noise certification.²¹ According to GAO, FAA, in collaboration with industry, had also developed an ODA scorecard to measure outcomes related to its ODA initiatives, including manufacturer compliance with standards set for delegated activities and FAA oversight.²²

In 2018, following oversight hearings,²³ Congress expressed general support for the ODA framework, but included extensive language in P.L. 115-254 mandating specific aircraft certification reforms. It directed FAA to establish a Safety Oversight and Certification Advisory Committee to develop policy recommendations for the certification process and for FAA oversight of certification activities, and mandated that FAA establish performance objectives and metrics. In March 2019, a few months after the law's enactment, FAA established an ODA Office within its Aviation Safety Organization to oversee the program and improve ODA practices. The act also mandated that FAA establish a Regulatory Consistency Communications Board to improve consistency in regulatory interpretations, especially those concerning aircraft certification and flight standards. The board provides a forum²⁴ for industry stakeholders to raise issues of policy or regulatory consistency to FAA anonymously and without fear of retaliation.

In its present form, the ODA framework is predicated on the broader FAA Integrated Oversight Philosophy, an approach to safety oversight activities based on risk-based strategies for allocating FAA oversight resources.²⁵ This approach relies on regulated entities, including manufacturers and airlines, adopting comprehensive safety management systems that continuously collect and analyze safety data and provide mechanisms for voluntary reporting of safety concerns. FAA, in turn, uses these data and safety reports to target its oversight based on its own risk assessments. In this regard, the ODA program bears similarities to the airline Voluntary Disclosure Reporting Program, which the agency uses to track compliance with continued airworthiness requirements and other voluntary safety reporting systems at airlines that fall under the umbrella of broader safety management system approaches.

Safety Management Systems

FAA's approach to delegating certification authority is based on a risk management method known as the safety management system (SMS). FAA defines SMS as a formal organization-wide approach to managing safety risk through structured and systematic procedures, practices, and policies intended to address and improve safety on a continuing basis.²⁶ It includes formal processes for decisionmaking regarding safety risks; safety assurance; knowledge sharing; and promoting a strong safety culture through training, education, and communication.

FAA SMS initiatives address international requirements for safety management, which apply to airlines and air traffic service providers as well as organizations responsible for the type design and manufacture of aircraft.²⁷ In 2014, FAA launched a rulemaking initiative to address a requirement of the International Civil Aviation Organization (ICAO) that design and production approval holders implement SMS. However, it has not issued a proposed rule to that end. Instead, FAA promotes voluntary compliance with an industry standard, National Aerospace Standard (NAS) 9927, Safety Management Systems and Practices for Design and Manufacturing, finding its contents to be consistent with the ICAO Annex 19 standards and FAA SMS requirements for commercial airlines.²⁸ FAA has implemented a voluntary SMS program for design and manufacturing organizations using NAS 9927 along with ICAO Annex 19 and SMS regulations for commercial airlines as guides. Manufacturers that implement voluntary SMS programs under these guidelines can obtain formal FAA recognition of their SMS program.

International Standards and Practices

Internationally, aircraft certification and airworthiness practices are to adhere to standards set by ICAO, a specialized agency of the United Nations. Specifically, ICAO Annex 8 to the Convention on International Civil Aviation lays out the type certification process that FAA and other regulators follow.²⁹ Annex 8 also describes standard procedures for establishing a certification program, forming a certification team, demonstrating compliance with the certification basis, and issuing type certificates.

It is up to the civil aviation authority for each individual nation to establish regulations and oversight of certification activities related to design and manufacturing carried out principally within that country. Countries generally accept type certificates issued by other countries under the terms of bilateral agreements on aviation safety and airworthiness, thus allowing for the import and export and global operation of aircraft.³⁰ The increasing globalization of the supply chain for aircraft components has created geographic and geopolitical challenges for this scheme and for FAA. In 2015, the DOT OIG found that much of the certification work conducted at FAA-regulated aircraft supplier facilities, about a quarter of which were located overseas, was carried out by ODA holder employees with little or no FAA oversight.³¹ FAA has stepped up oversight of priority international suppliers, but given the size of the industry, it continues to rely heavily on ODA holders and foreign regulators to verify the quality and integrity of aircraft components built overseas for installation on U.S.-certified aircraft.

While FAA oversees type certification for aircraft and aircraft components designed and assembled in the United States, other regulatory entities oversee type certification for aircraft and products assembled in other countries. Notably, the European Union Aviation Safety Agency (EASA) oversees the type certification process for aircraft and aircraft products designed in European countries. Because Boeing, based in Chicago, and Airbus, based in Toulouse, France, jointly control a large majority of worldwide sales of large commercial passenger jets, FAA and EASA fulfill important roles in certifying passenger airliners operated worldwide. FAA generally accepts EASA certification of commercial aircraft manufactured by Airbus, and, reciprocally, European countries under EASA accept FAA certification of U.S.-manufactured aircraft. While the two regulatory agencies, like the industry giants that they regulate, generally cooperate on safety matters, they sometimes hold differing views regarding safety design. Such disagreements came to the fore following the grounding of Boeing 737 Max passenger jets in 2019.

The Boeing 737 Max

The Boeing 737 received its initial type certification in December 1967.³² Over the past five decades, it has gone through a dozen amended type certifications and a number of smaller changes as new variants have been introduced to incorporate new technologies and new capabilities. The changes were all reviewed and approved by FAA, although considerable certification work over the years has been delegated to FAA designees, principally Boeing and its employees, most recently through use of the ODA program. FAA did not require any of these 737 variants to undergo a completely new type certification process.

In 2012, Boeing submitted an application initiating certification of a new variant of the Boeing 737 referred to as the Max.³³ The Max introduced larger engines, along with a number of other design changes to the aircraft structure and flight control systems. The larger engines and the placement of those engines farther forward required a reengineering of aircraft flight control systems related to pitch control.³⁴ Under the ODA program, FAA delegated a number of certification functions to Boeing, including the certification plan for the flight control computers that automatically make adjustments compensating for certain pitch-up events. The Boeing 737 Max received amended type certification in February 2017, and customer deliveries began in May 2017.

Crashes

On October 29, 2018, Lion Air flight 610, a Boeing 737 Max-8, crashed into the Java Sea shortly after takeoff from Jakarta, Indonesia, killing all 189 on board. Multiple automatic nose-down trim commands occurred during the last six to seven minutes of the accident flight, which the pilots attempted to counteract unsuccessfully by applying nose-up pitch trim commands.³⁵ At the end of the recorded flight data, the vertical stabilizer had moved to almost the full nose-down position, and the airplane was in a steep dive.

Two weeks after the Lion Air crash, FAA issued an emergency directive³⁶ ordering U.S. operators of Boeing 737 Max airplanes to adopt specific procedures to address situations that might trigger repeated nose-down trim commands by an automated flight control feature known as the Maneuvering Characteristics Augmentation System, or MCAS. In December 2018, FAA expanded the scope of the airworthiness directive, ordering the procedural change for all Boeing 737 Max airplanes worldwide.³⁷

This change did not prevent a second accident, on March 10, 2019, when Ethiopian Airlines flight 302 crashed shortly after departure from Addis Ababa, Ethiopia, killing all 157 on board. Investigation revealed several similarities to the Lion Air flight 610 crash.³⁸ Notably, immediately upon takeoff and for the short duration of the flight, a critical flight sensor connected to MCAS indicated an extremely high pitch (roughly 75 degrees nose up), whereas an alternative sensor not connected to MCAS appeared to report small pitch variations of a few degrees, consistent with a normal takeoff climb. Over the next few minutes the aircraft experienced a series of automatic aircraft nose-down trim commands. As with the Lion Air flight, aircraft flight data ceased with the pitch trim at almost a full nose-down position with the aircraft in a steep descent.

The MCAS system, as equipped on the two accident airplanes, received aircraft angle-of-attack data from only one of the airplane's two angle-of-attack sensors. These sensors are essentially sensitive wind vanes affixed to the side of the fuselage that precisely measure the relative airflow and thereby convey information about the aircraft's pitch angle relative to the airflow around it.

The MCAS was added to the Boeing 737 Max as a means to address pitch stability requirements that were affected by the larger CFM LEAP-1B engines chosen to power the new variant. According to Boeing, the system was intended to activate to automatically correct for unintended pitch-up events under certain rare combinations of engine thrust settings and airplane configurations.³⁹ However, on both Lion Air flight 610 and Ethiopian Airlines flight 302, the MCAS engaged in response to faulty data from the angle-of-attack sensor falsely indicating that the aircraft was in a nose-high attitude when, in fact, it was not, triggering repeated nose-down pitch trim commands. In such situations, if the pilots counteracted the automated nose-down commands with a nose-up pitch trim, the MCAS would reset after five seconds, then repeat the nose-down pitch command again. The system would repeat this cycle for as long as it continued to sense that the aircraft was in a nose-high attitude, even if based on errant sensor data.

Investigations of the 737 Max Certification

The circumstances of the two Boeing 737 Max crashes led authorities in several countries, including China and the European Union, to immediately ground 737 Max airplanes as the crashes and the aircraft systems involved were investigated. FAA, Boeing, and U.S. air carriers did not immediately follow suit. One day after the Ethiopian Airlines crash, FAA instead notified international civil aviation authorities that it anticipated mandatory design changes to be instituted no later than April 2019. However, on March 13, 2019, FAA issued an emergency order grounding all 737 Max aircraft. That order⁴⁰ remained in place until November 2020, when FAA approved modifications to the flight control systems and revised pilot training.

The concerns that emerged following the two crashes centered on how the Boeing 737 Max flight control systems and MCAS specifically were certified, with attention focused on the relationships between FAA and delegated entities from private industry performing certification work under the ODA program. Some journalists asserted that certification work on the 737 Max was rushed because of pressures on Boeing employees with certification responsibilities to quickly bring the airplane to market to compete with the Airbus A320 Neo, which entered service in early 2016.⁴¹

FAA quickly convened a technical advisory board to review Boeing's MCAS software update and systems safety assessment and recommend steps needed to certify Boeing's changes and return the aircraft to service, while regulators in several other countries pursued independent reviews of the Boeing 737 Max design and certification. A number of investigative reviews of the certification process, oversight of the certification process, and associated failures that led to the two crashes were conducted as well.

Joint Authorities Technical Review

In April 2019, FAA convened the multinational Joint Authorities Technical Review (JATR), chaired by former NTSB Chairman Christopher Hart, to conduct a comprehensive review of the Boeing 737 Max aircraft's automated flight control system certification. The JATR was composed of experts from FAA, the National Aeronautics and Space Administration (NASA), and representatives from air safety authorities in Europe, Canada, Australia, Brazil, China, Japan, Indonesia, Singapore, and the United Arab Emirates.⁴² The JATR published its final report and recommendations on October 11, 2019.⁴³

Regarding the certification process, the JATR recommended that regulations and guidance be changed to implement a top-down evaluation of every proposed change from an integrated perspective. It emphasized the need to implement a comprehensive systems analysis examining impacts on system interactions and dependencies, including implications for training and operational procedures for flight crew and maintenance personnel. The JATR review stressed that the level of assessment should be proportional to the impact of the proposed design change on the aircraft as a whole.

The JATR also urged reviews of the Boeing 737 Max certification with respect to systems safety analysis, assessment of airplane handling qualities, and the design and engineering of Boeing 737 Max training simulators. It stressed the importance of early FAA involvement in the type certification process and recommended regulatory changes to improve FAA awareness of proposed design changes and underlying design assumptions. It also recommended that the certification process incorporate feedback paths between the applicant and FAA regarding regulatory compliance, systems safety principles, and flight deck human factors. The JATR also recommended that FAA conduct a workforce review of its Boeing Aviation Safety Oversight Office to ensure sufficient expertise to carry out effective oversight. Moreover, it recommended a review to ensure that ODA unit members at Boeing do not face undue pressure in performing certification work and have sufficient lines of communication to FAA certification engineers without fear of punitive actions or process violations.

The JATR recommended that FAA promote safety culture pertaining to product development and certification compliance. It stressed that aircraft functions should be examined holistically, and that FAA should encourage manufacturers to assess aircraft safety and design details independently from the design functions. It noted that adoption of a safety management system (SMS) would be one way to achieve this goal.

The JATR also recommended that FAA integrate and emphasize human factors design and human-systems integration throughout the certification process. It stressed the importance of compliance with regulations pertaining to flight crew system interfaces and cockpit alerts and warnings, and recommended that FAA expand its aircraft certification human factors resources. It also recommended that FAA set formal requirements to evaluate operational impacts, systems integration, and human performance. Moreover, it recommended that FAA address the implications of flight crew response assumptions and human factors considerations of design changes in developing training requirements and operating manuals. It specifically recommended that FAA review training programs pertaining to flight crew handling of uncommanded pitch-up and pitch-down events and other aircraft mis-trim conditions.

The JATR also recommended that FAA take steps to ensure that manufacturers apply industry best practices, including requirements management practices, transparency of design assumptions, process assurance activities, and effective configuration management. It pointed to the current SAE International Recommended Practice⁴⁴ on certification of highly integrated or complex aircraft systems as appropriate guidance on industry best practices, and recommended that FAA review and amend advisory materials⁴⁵ to clearly articulate and promote the principles outlined in the SAE International guidance.

The JATR further recommended that FAA guidance be updated to emphasize the examination of cumulative impacts resulting from design changes. It also recommended that FAA conduct a study to determine the adequacy of existing policy, guidance, and assumptions related to aircraft maintenance. It also recommended that FAA review policies for analyzing safety risk and issuing interim airworthiness directives to address safety deficiencies following fatal transport category aircraft accidents. It stressed that FAA should share post-accident safety information with international partners to the maximum extent possible.

Joint Operations Evaluation Board and Flight Standardization Board

Separate from the JATR, the FAA convened a multinational Joint Operations Evaluation Board (JOEB), composed of civil aviation authorities from the United States, Canada, Brazil, and the European Union, to evaluate 737 Max pilot training requirements. The JOEB conducted extensive flight simulator reviews and made formal training recommendations that were provided to FAA's Aircraft Evaluation Group and Flight Standardization Board (FSB) for the Boeing 737 Max certification review. That work culminated in recommendations for training issued in October 2020 that included dissemination of specific information regarding the functionality of the MCAS system to pilots and formal simulator training to handle uncommanded pitch-down scenarios similar to those encountered in the two crashes.

These findings were noteworthy because there has traditionally been little international coordination in regulating pilot qualifications and training. While ICAO sets general training and licensing standards for pilots internationally, it is up to individual countries to set formal requirements for their pilots.⁴⁶ While the United States adopted more stringent requirements a decade ago mandating a minimum of 1,500 hours of total flight time for airline pilots, foreign airlines often operate with first officers who are required to meet international standards only for multi-crew commercial pilot licenses, which can be obtained with as little as 240 total flight hours. It is not unusual for entry-level first officers at foreign airlines to have only a few hundred hours of total flight experience. Moreover, FAA has limited regulatory authority over foreign airlines that fly into the United States and limited influence over aircraft-specific training requirements set by foreign countries whose airlines purchase airplanes from Boeing and other U.S. manufacturers. FAA has urged ICAO to address perceived pilot training deficiencies and recommended that ICAO update its standards and guidance to include additional training to prepare airline pilots to operate aircraft manually if automated systems fail.⁴⁷

National Transportation Safety Board Recommendations

In September 2019, NTSB issued safety recommendations to FAA and to Boeing, urging action to address design assumptions about pilot response to uncommanded flight control system events, like an MCAS activation, in the certification process based on its participation in the Boeing 737 Max crash investigations.⁴⁸ NTSB urged Boeing to ensure that assessments of the 737 Max consider the effect of all possible cockpit alerts and indications on pilot recognition and response, and address these factors in cockpit design changes as well as pilot procedures and training. It similarly urged FAA to change aircraft certification, flight operations, and training standards to ensure that cockpit warnings and indicators are appropriately designed and assessed for pilot recognition and response. NTSB also recommended that FAA develop and deploy evaluation tools, based on input from industry and human factors experts, to help inform aircraft designers and certifiers regarding pilot response to failure conditions. It also urged FAA to develop formal design standards and diagnostic tools to improve the clarity and prioritization of cockpit failure indications and alerts.

Department of Transportation Inspector General Audits

On March 19, 2019, Secretary of Transportation Elaine Chao requested that the DOT OIG compile a detailed factual history of the Boeing 737 Max type certification. The DOT OIG received similar requests from various congressional committees and Members of Congress seeking details regarding FAA's approach to certifying the Boeing 737 Max, reliance on the ODA program, and actions in response to the Boeing 737 Max crashes. The focus of the DOT OIG audit carried out in response to these requests was on FAA's process for certifying the Boeing 737 Max. The audit also examined FAA actions following the Lion Air crash in October 2018 and the subsequent Ethiopian Airlines crash in March 2019.⁴⁹

The report provides a detailed chronology of certification activities that commenced in early 2012. The audit noted, significantly, that the design of the MCAS system was changed in March 2016, shortly after the first Boeing 737 Max test flight in January 2016. Subsequently, the certification of the flight control computer, including the MCAS control logic, was delegated to Boeing in September 2016. Certification flight tests were completed in February 2017, and the FAA Flight Standardization Board (FSB) approved the transition training for the aircraft in March 2017. The amended type certificate was issued shortly thereafter, paving the way for the first delivery of the Boeing 737 Max in May 2017.

The audit found that, in August 2017, Boeing identified an issue concerning the fact that not all 737 Max aircraft were equipped with cockpit warnings that would alert pilots to a possible failure of the angle-of-attack sensor that provides data to the flight control computer, and that such a failure scenario could trigger MCAS activation of automated nose-down pitch trim in certain circumstances. Neither the Lion Air nor the Ethiopian Airlines aircraft that crashed were equipped with these indicators. The audit found that Boeing never formally notified FAA or Boeing 737 Max customers of this finding, but did include it in revised certification documents submitted in October 2017.

Following the Lion Air crash on October 29, 2018, the audit found that, within days, FAA initiated a review of the operational service history of the Boeing 737 Max. FAA issued an operational bulletin alerting operators that erroneous angle-of-attack data could trigger uncommanded nose-down trim inputs, and subsequently issued an airworthiness directive alerting operators to possible repeated nose-down trim commands that could lead to difficulty maintaining pitch control. The directive required operators to revise the Airplane Flight Manual to include procedures to counteract uncommanded nose-down movements.

The audit found that FAA's risk analysis of the Lion Air flight 610 crash, completed in late November 2018, found the expected fatality rate for the 737 Max to be 2.68 fatalities per 1 million flight hours, much higher than FAA's acceptable risk threshold for transport airplanes of 1 fatality per 10 million flight hours. Based on this risk assessment, FAA concluded that a software fix to redesign MCAS was needed. It estimated that without the software fix, there was a risk that the existing design would result in about 15 crashes over the life of the entire Boeing 737 Max fleet. Nonetheless, FAA concluded that the procedural changes mandated by the airworthiness directive would temporarily mitigate the risk, but only until July 2019.

Boeing concurred with FAA's risk assessment and agreed to develop software changes to the MCAS. In January 2019, FAA initiated an internal review of the original MCAS certification process. The DOT OIG audit found that this was the first time that FAA was presented with the full details of how MCAS worked. While the audit concluded that FAA did not identify any noncompliance with certification requirements, FAA noted deficiencies in Boeing's ability to trace related documents and clearly explain MCAS functionality and its linkages to other aircraft systems and functions.

The audit also examined FAA's internal reviews of the Boeing ODA program 737 Max certification oversight. The audit revealed that FAA had uncovered evidence of undue pressure on ODA unit members, prompting Boeing to conduct a survey of its ODA unit members in 2016. That survey found that almost 40% of respondents had encountered perceived undue pressure, and 25% had experienced perceived undue pressure beyond their direct reporting structure. The survey also identified pressures from high workloads, uncertainty about dual roles of ODA unit members, and a desire among respondents for Boeing to share information about undue pressure cases to improve learning and understanding of these issues.

The audit also noted that in 2018 and 2019, the Boeing ODA completed seven internal audits that found no nonconformities or violations of FAA regulations regarding undue pressure and found that the processes for reporting concerns were well communicated and supported. Nonetheless, a perception that there were inadequate protections from actions by leadership outside of the ODA units was noted in one of the audits, while another audit noted a lack of confidence that the process for reporting perceived undue pressure incidents would result in satisfactory conclusions and protect ODA unit members. Previously, FAA and DOT OIG identified additional concerns about the timeliness and quality of certification documents and the effectiveness of FAA certification oversight. These findings contributed to FAA's decision in November 2018 to initiate formal compliance action against Boeing, citing five specific cases of Boeing ODA unit member allegations of interference, conflicting duties, and undue pressures from beyond the ODA unit.

The DOT OIG also initiated an audit of FAA's pilot training requirements in February 2020, citing concerns regarding the adequacy of domestic and international pilot training standards for commercial passenger aircraft and the use of automation on those aircraft. Additionally, in April 2021, the DOT OIG initiated an audit of FAA's oversight of the Boeing 737 Max's return to service, including examination of the risk assessment process and of decisions regarding the grounding of the aircraft and its subsequent recertification in November 2020.

In February 2021, the DOT OIG published additional audit findings regarding FAA's certification of the Boeing 737 Max and its use of delegation authority during the certification process.⁵⁰ The audit concluded that, while FAA and Boeing followed established certification processes, deficiencies in those processes and associated guidance led to a significant misunderstanding of how the MCAS operated and the risks associated with the MCAS. The DOT OIG found that FAA certification guidance does not adequately address the integration of new technologies into existing aircraft models.

The audit report noted that FAA had not yet implemented a risk-based approach to ODA oversight. Moreover, it found that FAA staff overseeing Boeing faced continuing challenges in balancing certification reviews and ODA oversight responsibilities. It also concluded that Boeing ODA personnel lack adequate independence. It cautioned that Boeing ODA structure and processes and FAA oversight, despite reforms, may be unable to fully address concerns of undue pressure and may still be unable to effectively identify high-risk safety concerns. The DOT OIG recommended that FAA

• update changed product rules to address new technologies;
• revise criteria for defining and assessing novel or unusual design features;
• require applicants to submit failure probability analyses identifying key assumptions as part of the certification process;
• assess and update guidance regarding design assumptions about pilot actions, pilot reaction times, and failure mode testing;
• establish processes for notifying FAA personnel regarding changes to system safety assessments, including changes that occur after certification flight testing has commenced;
• implement procedures for communication and coordination between Boeing and FAA, and between aircraft certification, flight standards, and flight test groups in FAA;
• implement policies and procedures for aircraft evaluation group reviews and approvals and improve consistency of practices among aircraft evaluation groups;
• incorporate lessons learned from the Boeing 737 Max into ODA oversight, implementing a risk-based approach;
• clarify priorities, roles, and responsibilities of FAA engineers performing oversight and certification work, including details regarding the timing of oversight activities;
• conduct an assessment of ODA unit members to gauge the extent to which they participate in both design activities and FAA-delegated compliance oversight, and based on findings, revise ODA guidance;
• revise ODA requirements to ensure adequate internal controls to prevent interference with ODA unit members;
• determine whether Boeing has met requirements established under a settlement agreement with FAA on December 18, 2015, including requirements to report and meet agreed-upon performance metrics regarding safety management and regulatory compliance;⁵¹ and
• complete rulemaking to mandate safety management systems for aircraft manufacturers, including establishing compliance time frames.

Department of Transportation Special Committee Review

Separately, Secretary Chao established a special committee to review FAA's aircraft certification process in April 2019. That committee, composed of aviation and safety experts, published an official report of its findings and recommendations on January 16, 2020.⁵² The committee found that FAA's certification process was generally rigorous, robust, and overseen by personnel committed to safety, but identified several areas for improvement. It found FAA's delegation system to be an appropriate and effective tool for conducting aircraft certification, and recommended that it be continued with some revisions, specifically to ensure that ODA units be completely independent in their role as representatives of FAA in certification matters.

With respect to the Boeing 737 Max certification specifically, the committee concluded that requiring the aircraft to undergo a new type certification would not have resulted in more scrutiny of the design and would not have produced a safer airplane. It instead concluded that additional scrutiny of interactions between changed items and related systems, as well as the cumulative impacts of multiple design changes over time, including impacts on flight crew operations, should be required.

The committee recommended that FAA take steps to ensure a total system approach to safety, linking product certification to pilot training and flight operations. It also recommended that FAA encourage the integration of ODA, SMS, and safety partnership initiatives to improve the effectiveness of management and oversight of safety and certification. The committee urged that FAA and industry work collaboratively to remove undue pressure on ODA units, and that ODA unit decisionmaking be completely independent when representing the FAA on certification matters.

The committee proposed that system safety assessments be expanded to more fully consider human-system interactions and include more systematic analysis of human performance and error assessments. It recommended that FAA require human factors analyses for all safety-critical functions and failure modes associated with design changes, that tests and evaluations include multiple failure mode scenarios, and that tests be conducted using pilots who are representative of airline pilots anticipated to fly delivered aircraft. Moreover, conclusions of safety assessments pertaining to the safe operation of aircraft should be made available to end users and related flight information monitored during operational service.

The committee also recommended that FAA consider differences in operations, training, and oversight in countries where U.S.-designed and -manufactured aircraft are delivered. It recommended that FAA address minimum flight crew standards and promote advanced training and qualification programs for foreign pilots. It suggested that FAA expand its engagement with foreign entities and provide technical assistance and training to foster improved international safety standards and practices for aircraft certification, operations, and maintenance.

The committee concluded that safety could be improved through enhanced data gathering and targeted analysis to identify and mitigate risks and implement corrective actions. It recommended a single repository for aviation safety data, pointing to FAA's Aviation Safety Information Analysis and Sharing (ASIAS) as an example. It further recommended that FAA propose that ICAO take steps to improve operational data sharing internationally.

The committee identified the potential for disconnects between design certification and operational requirements due to the fact that FAA manages aircraft certification and flight standards aircraft evaluations under separate management structures with different policies, guidance, leadership, and organizational cultures. It recommended that FAA clarify the roles of the aircraft evaluation group in Flight Standards in the product certification process and the working relationship between Flight Standards and Aircraft Certification organizations within FAA. It emphasized that the aircraft evaluation group should have sufficient engagement throughout the certification process to be fully aware of design changes.

The committee also recommended that FAA reevaluate its workforce strategy for aircraft certification to adapt to industry changes and recruit certification personnel with the right range of skills to meet evolving needs.

With regard to amended type certificates, the committee recommended that FAA ensure its policies and guidance are updated to fully evaluate changes in the context of aircraft systems, human interactions with those systems, and the influences of the flight environment. Moreover, guidance should highlight potential vulnerabilities that can be introduced by changes and modifications to existing systems, noting that historical assumptions may be inappropriate or may need specific testing and validation in the context of novel design changes. Additionally, the committee recommended that FAA clarify roles and responsibilities of the type certificate applicant and FAA personnel in determining what constitutes a significant change.

The committee also recommended that FAA's Innovation Center⁵³ should prioritize changes to the certification process and regulatory framework to assist the Aircraft Certification Service in keeping up with new concepts and technologies. It specifically recommended that FAA conduct a review of management processes and update and strengthen methods, tools, and training for safety oversight of delegation programs.

It also recommended that FAA review certification regulations and procedures, focusing on applying a system safety approach to product certification and oversight of industry design organizations. It stressed that the review should examine minimum qualifications and organizational requirements for design and manufacturing organizations, including aspects related to compliance assurance and safety management systems. The committee recommended that FAA develop comprehensive plans to improve certification addressing personnel, organizational culture, processes, and change management. It noted that these implementation plans should include mechanisms to track and monitor initiatives and include metrics for measuring expected benefits. Additionally, the committee stressed that FAA must improve procedures to quickly amend and adopt orders, policies, and advisory materials, and rapidly disseminate this information to the field to implement recommendations emanating from various oversight and advisory committees and use appropriate metrics to gauge the effectiveness of such actions and whether anticipated benefits are being realized.

Department of Justice Actions

The Department of Justice launched a criminal probe of Boeing based on a broad subpoena issued by a Washington, DC, grand jury immediately following the Ethiopian Airlines crash in March 2019.⁵⁴ On January 7, 2021, Boeing entered into a deferred prosecution agreement in response to charges that it had deceived FAA about MCAS, resulting in airplane manuals and pilot-training materials lacking information about MCAS. Boeing agreed to pay a criminal penalty of $243.6 million and provide compensation of $1.77 billion to Boeing 737 Max purchasers and $500 million to establish a crash-victim beneficiaries fund.⁵⁵

Congressional Hearings and Reports

The congressional committees of jurisdiction over FAA and civil aviation safety matters held a number of hearings addressing the Boeing 737 Max and implications for aircraft certification and FAA safety oversight. These included the following:

House Transportation and Infrastructure Committee Hearings

• May 15, 2019, Subcommittee on Aviation Hearing, Status of the Boeing 737 MAX
• June 19, 2019, Subcommittee on Aviation Hearing, Status of the Boeing 737 MAX: Stakeholder Perspectives
• July 17, 2019, Subcommittee on Aviation Hearing, State of Aviation Safety
• October 30, 2019, Full Committee Hearing, The Boeing 737 Max: Examining the Design, Development, and Marketing of the Aircraft
• December 11, 2019, Full Committee Hearing, The Boeing 737 MAX: Examining the Federal Aviation Administration's Oversight of the Aircraft's Certification

Senate Commerce, Science, and Transportation Committee Hearings

• March 27, 2019, Subcommittee on Aviation and Space Hearing, The State of Airline Safety: Federal Oversight of Commercial Aviation
• October 29, 2019, Full Committee Hearing, Aviation Safety and the Future of Boeing's 737 MAX

House Transportation and Infrastructure Committee Majority Staff Report (September 2020)

In September 2020, the majority staff of the House Transportation and Infrastructure Committee issued a report on the design, development, and certification of the Boeing 737 Max.⁵⁶ That report asserted that technical design flaws, faulty assumptions regarding pilot response, management failures at Boeing, and gaps in FAA oversight contributed to the Boeing 737 Max crashes. It found that production pressures and economic motivations at Boeing, coupled with a culture of concealment and faulty design and performance assumptions, contributed to design flaws in the flight control systems. Moreover, it asserted that inherent conflicts of interest and the elevation of Boeing's influence over certification reviews and decisions contributed to an erosion of FAA's ability to provide appropriate oversight of the 737 Max certification. The report concluded that safety concerns regarding the design of the MCAS systems were either inadequately addressed or dismissed by Boeing, and that FAA's certification review was grossly insufficient.

Senate Commerce, Science, and Transportation Committee Majority Staff Report (December 2020)

In December 2020, the majority staff of the Senate Committee on Commerce, Science, and Transportation released a report focusing on aviation safety oversight, safety culture at FAA, and whistleblower concerns over how FAA responds to aviation safety concerns.⁵⁷ While the Senate committee's investigation was initially prompted by the Boeing 737 Max crashes and grounding, the scope of the report encompassed broader concerns about FAA oversight of airline flight operations and maintenance in addition to concerns regarding aircraft design and manufacturing and aircraft certification. The report detailed a number of examples of significant lapses in aviation safety that it attributed to poor oversight and failed leadership at FAA.

Significant findings included repeated failures of FAA leadership to implement adequate training for FAA flight standards personnel to address repeated findings of deficiencies, as well as specific examples of FAA retaliating against whistleblowers. The investigation found FAA's oversight of air carriers to be ineffective, and that at least one airline had exerted improper influence over FAA regulators to gain favorable treatment regarding regulatory compliance and voluntary reporting. The investigation unveiled alleged misconduct at FAA's Honolulu, HI, Flight Standards District Office, claiming that certain supervisors and senior personnel in the office had cozy relationships with commercial air tour and charter operators that resulted in favorable treatment of operators and hampered the ability of inspectors to conduct effective oversight.

The Senate Committee's staff investigation found that some members of the Flight Standardization Boards (FSBs) formed to review operational training requirements for the Boeing 737 Max as well as the Gulfstream VII airplane lacked appropriate training, and that some FAA inspectors were inappropriately qualified on these aircraft. These findings reflected broader concerns that FAA has lacked accountability with respect to developing and delivering adequate training for flight standards inspectors in general. The investigation also found that, during 737 Max recertification testing, Boeing inappropriately influenced FAA human factors simulator testing of pilot reaction times, that at least one FAA test event was improperly influenced by Boeing, and that at least one FAA pilot appeared to have been complicit in the testing. The investigation found that these shortcomings compromised FAA oversight of the Boeing 737 Max certification.

Based on its findings and observations, the committee majority staff recommended that the DOT OIG conduct a thorough review of FAA compliance philosophy, and that it fully investigate allegations of aviation whistleblower retaliation and make recommendations for disciplinary actions arising from such investigations. The report also recommended the creation of an ombudsman function within FAA to educate FAA employees about whistleblower rights and to serve as an independent resource for FAA employees to discuss their rights and remedies related to allegations of misconduct. It urged the FAA Administrator to establish formal policies for carrying out independent and objective misconduct investigations and subsequent adjudication.

Return to Flight

In November 2020, FAA issued an airworthiness directive mandating corrective action to return grounded Boeing 737 Max airplanes to revenue service by U.S. air carriers. The directive generally required owners and operators to update the airplane's automated flight control logic, including MCAS, through software updates.⁵⁸ The directive also required the installation of a cockpit warning light to alert pilots of possible angle-of-attack sensor failures. Additionally, the directive required procedural changes to facilitate pilot recognition of and responses to undesired pitch trim events and the effects of potential angle-of-attack sensor failures. Separately, the directive required modifications to reroute certain wiring connected to the horizontal stabilizer trim to address concerns regarding the adequacy of shielding that were identified during the certification review of the aircraft but were not implicated in either of the crashes.

This marked FAA's official ungrounding of the aircraft, although the return to service of specific airplanes was predicated on completion of required work and FAA-approved pilot training. U.S. airlines operating the Boeing 737 Max were able to comply with these requirements and return some aircraft to revenue operations within one to two months of FAA's publication of the directive.

Civil aviation regulators in Brazil, Canada, Europe, and the United Kingdom generally followed FAA's lead. The first Boeing 737 Max airplanes to resume revenue flights were operated by the Brazilian airline Gol on December 9, 2020, 10 days after the Brazilian National Civil Aviation Agency gave its approval to do so. Transport Canada approved the resumption of Boeing 737 Max flights in January 2021, and the European Union followed suit on January 27, 2021. While other countries, including the United Arab Emirates, where FlyDubai operates Boeing 737 Max aircraft, have also lifted grounding orders, China has resisted, indicating that it would not approve a return to service until it determines that the airplane is airworthy, pilots have been appropriately retrained, and clear conclusions are drawn from the two crashes.⁵⁹ In early July 2021, Chinese aviation officials signaled a general willingness to proceed with flight testing of the Boeing 737 Max, but conditions for validation were still reportedly being negotiated with Boeing.⁶⁰

The Aircraft Certification, Safety, and Accountability Act

On December 27, 2020, the Aircraft Certification, Safety, and Accountability Act (Division V of P.L. 116-260) was signed into law. The act mandates major changes to the aircraft certification process, the ODA program, and FAA oversight of that program. The following provides a detailed analysis of the provisions in the act. Rather than offering a section-by-section summary, this narrative synthesizes and summarizes the legislative provisions based on underlying issues and objectives. It does not provide information regarding FAA and industry actions to address the requirements of the act.

Required Safety Management Systems for Manufacturers

The act requires FAA to initiate rulemaking to require that aircraft and component manufacturers that hold both a type certificate and a production certificate implement an FAA-approved SMS that meets standards and recommended practices established by ICAO within four years of enactment.

The law specifies that, at a minimum, the SMS be consistent with and complimentary to existing SMSs, allow for operational feedback from product customers and pilots, and allow for FAA approval and routine oversight. FAA is required to conduct risk-based surveillance, inspections, audits, and continuous monitoring of type and production certificate-holder SMS programs. FAA was also directed to work closely with ICAO and civil aviation authorities in other countries to encourage and assist with adoption of SMS by foreign manufacturers.

The law specifies that the SMS regulations must provide for a confidential employee reporting system for reporting hazards, issues, concerns, occurrences, and incidents without concern for reprisal. Manufacturers are to be required to submit summary reports of employee reports received at least twice per year. Such information submitted to FAA is to be protected from public disclosure unless de-identified to protect the identity of submitters.⁶¹ The law also mandates the establishment of a code of ethics for each manufacturer applicable to all employees that formally sets safety as the organization's top priority. FAA was required to initiate manufacturer SMS rulemaking within 30 days of enactment and issue a final rule within 24 months thereafter.

Expert Panel Review

P.L. 116-260 required, within 30 days of enactment, that FAA establish an expert panel to review and make recommendations regarding the use of ODA at manufacturers of transport category airplanes. The panel is to assess the extent to which safety management processes promote or foster a safety culture consistent with ICAO guidelines.⁶² The panel is also to examine the effectiveness of measures implemented to instill a commitment to safety above all other priorities and the ODA certificate holder's ability to make reasonable and appropriate decisions regarding delegated authorities.

The 24-member expert panel is to be composed of representatives from NASA, the FAA Certification Service, the FAA Flight Standards Service, bargaining unit representatives for FAA aircraft certification service field engineers and FAA safety inspectors, labor unions representing passenger and cargo airline pilots, a labor union representing employees manufacturing transport category airplanes, a labor union representing employees engaged in designing transport category airplanes, air carrier employees with responsibilities for administering SMS programs, four distinct ODA holders, a lawyer with expertise regarding ODA holders and their interactions with FAA, and two independent experts holding degrees in aerospace engineering who each have a minimum of 20 years of relevant applied experience. Panelists are required to disclose to the FAA Administrator financial interests in businesses engaged in the design or production of transport category airplanes, engines, or major components or parts used on transport category airplanes.

The act grants the expert panel limited authorities to access ODA holder sites and records, including appropriately marked proprietary information and trade secrets protected under nondisclosure agreements, and to interview employees, so long as a majority of review panel members consider each action to be taken necessary and appropriate.

The expert panel is charged with issuing a report within 270 days of its first meeting. The panel is to submit the report to the FAA Administrator and to congressional committees of jurisdiction. Findings must be endorsed by at least 10 members of the review panel, and recommendations must be endorsed by at least 18 panelists. Dissenting views are to be included as appendixes to the report. Upon submission of the report, the review panel shall be terminated, and within five days of receiving the report, the FAA Administrator is required to post it on FAA's public Internet site.

Upon review of the expert panel's findings, FAA may limit, suspend, or terminate an ODA, and may specify corrective actions for reinstatement of such an ODA. Within six months after receipt of the panel's recommendations, FAA must publish on its website and submit to congressional committees of jurisdiction a detailed explanation for any disagreement with a recommendation, explaining why the Administrator does not believe implementation of the recommendation would improve aviation safety.

Additionally, within one year after receipt of the panel's recommendations, FAA is required to issue a report to congressional oversight committees detailing its determination of whether each transport airplane ODA holder is able to safely and reliably perform all delegated functions. If FAA finds that an ODA holder is unable to do so, FAA is to identify risk mitigations or other corrective actions and associated timelines for remediation, and report on the status of ongoing investigations and the implementation of expert panel recommendations. FAA is also to include in its report details regarding procedures for conducting focused oversight of ODA processes related to the design and production of new and derivative transport airplanes.

FAA must brief the House Transportation and Infrastructure Committee and the Senate Committee on Commerce, Science, and Transportation every 90 days through the end of FY2023 on its efforts to review ODA units, and identify challenges impeding FAA's ability to oversee ODA units. One briefing of each committee must discuss measures taken to address the integrity of FAA employees charged with overseeing aircraft certification ODA and to assure that such oversight is carried out in accordance with safety management principles and in the interest of aviation safety.

By the end of December 2021, FAA is required to submit a report to the congressional committees of jurisdiction on the status of its efforts to address relevant recommendations made by the Joint Authorities Technical Review, the NTSB, the DOT OIG, and the Safety Oversight and Certification Advisory Committee,⁶³ and potentially others identified by FAA. FAA is to provide a determination of whether it concurs in whole or in part with each recommendation, along with an implementation plan and schedule for implementing all recommendations with which it concurs. For any recommendations with which FAA does not concur, a detailed explanation as to why it does not concur must be included in the report.

Independent Study on Type Certification Reforms

Separately, the Aircraft Certification, Safety, and Accountability Act requires FAA to enter into an agreement with a federally funded research and development center to carry out an independent review and assessment of options for reforming aircraft type certification. The review is to address whether there would be an aviation safety benefit to setting a fixed length of time beyond which a type certificate may not be amended. The review is also to examine the safety benefits and costs of requiring FAA to document exemptions, exceptions, or findings of equivalent levels of safety when amended or supplemental type certificates do not comply with the latest airworthiness standards.

The review is to take into consideration the investigations, reports, and assessments regarding the Boeing 737 Max, including but not limited to the Joint Authorities Technical Review, and work performed by the NTSB, the DOT OIG, the DOT Special Committee, congressional committees, and foreign aviation authorities. The study is also to take into consideration the impacts of changes to aircraft type certification procedures required by the act.

Within 270 days after the independent review is submitted to FAA, the agency is to submit a report to the congressional committees of jurisdiction detailing its response to the findings and recommendations, along with details of what actions FAA will take in response, or the rationale for not taking action to address specific recommendations from the study.

Repeal of Aircraft Certification and Flight Standards Performance Objectives and Metrics

P.L. 116-260 repealed two significant provisions of the FAA Authorization Act of 2018 (P.L. 115-254) pertaining to performance metrics and objectives of the FAA Aircraft Certification Service and the FAA Flight Standards Service. Those provisions had directed FAA to establish performance objectives intended to streamline aircraft certification and reduce delays while increasing accountability for FAA and the aviation industry, in part by fully utilizing FAA delegation and designation authorities, as well as by fully implementing risk management principles and a systems safety approach. Under the now repealed provisions, FAA was to establish specific performance metrics to track progress toward streamlining aircraft certification and flight standards functions.

FAA Inspectors and Certification Oversight Staff

The Aircraft Certification, Safety, and Accountability Act authorizes $27 million for each fiscal year, from FY2021 through FY2023, for FDA to recruit and retain engineers, safety inspectors, human factors specialists, software and cybersecurity experts, and other technical experts, as well as chief scientific and technical advisors, for oversight of certification activities. The act also directs FAA to carry out a review of its certification workforce to determine whether the agency has the expertise and capability to assess the safety implications and oversee the adoption of new or innovative technologies, materials, and procedures used by aircraft designers and manufacturers. FAA is also to examine its Senior Technical Experts Program⁶⁴ to determine whether that program should be enhanced or expanded to bolster the work of the FAA Office of Aviation Safety, and especially the Aircraft Certification Service and the Flight Standards Service. The review is to be completed by the end of September 2021.

Within 30 days after completion of the review, the FAA Administrator is required to brief the congressional committees of jurisdiction on the results, as well as provide an analysis of FAA's ability to hire experts for the certification workforce having the requisite expertise to oversee new developments in aircraft design and manufacturing. The act also directs FAA to include in its report to congressional committees details regarding efforts to increase the number of engineers, inspectors, and other qualified technical experts to carry out oversight of ODA holders, particularly transport airplane ODA holders.

Continuing Education and Training

The act directs FAA to develop a program for recurrent training and continuing education of engineers, inspectors, and other experts employed in the FAA Aircraft Certification Service. Additionally, it directs FAA to the maximum extent practicable to provide certification personnel access to diverse professional opportunities that expand their knowledge and skills regarding systems design, flight controls, principles of aviation safety, system oversight, and certification project management. In developing its continuing education and training, FAA is directed to consult with outside experts to build a curriculum covering current and new aircraft technologies, human factors, project management, the roles and responsibilities associated with oversight of designees, and recommended practices for compliance with FAA regulations. It also instructs the agency to develop programs that will minimize the likelihood of FAA personnel developing biases toward particular designers or manufacturers. The act authorizes $10 million for each fiscal year, from FY2021 through FY2023, to implement these continuing education and training initiatives.

Employment Restrictions

The act imposes specific employment restrictions on FAA employees, prohibiting current FAA employees from supervising oversight of an aircraft design or manufacturing organization if they had been employed by that organization in the preceding one-year period. Former FAA inspectors and engineers may not work as an agent or representative of such an organization before FAA, including engaging in written and oral communications regarding particular matters, if that individual served in or supervised inspection or certification functions regarding that organization, regardless of whether the individual had responsibilities concerning such matters while employed by FAA.

The act also prohibits FAA from providing performance-based incentives or awards to employees based on meeting or exceeding schedules, quotas, or deadlines tied to aircraft certification activities.

Voluntary Safety Reporting Program

The act directs FAA to establish within one year of enactment a voluntary safety reporting program for engineers, inspectors, systems safety specialists, and other experts employed by FAA that is consistent with other similar safety reporting programs at FAA. The program is to allow such individuals a means to confidentially report instances where they have identified safety concerns during certification or oversight processes. The law specifies that FAA is to maintain a reporting culture that is voluntary, nonpunitive, and confidential, and protects against adverse employment action related to participation in the program. FAA is to develop the program in collaboration with appropriate bargaining unit representatives of the Aircraft Certification Service and the Flight Standards Service.

The act directs FAA to thoroughly review all voluntary safety reports in a timely manner to determine whether a safety issue exists and whether the aircraft certification process contributed to the safety concern. FAA is to establish a corrective action process to address identified safety issues and improve safety systems, hazard controls, risk reduction, systems certification, regulatory compliance and conformance, and FAA oversight, and to implement lessons learned.

Safety-Critical Information

The act removes FAA authority for certifying design and production certification organizations⁶⁵ and replaces it with requirements for transport category airplane type certificate holders to submit safety-critical information regarding the design to FAA. The law specifies that such safety-critical information is to include design and operational details, including functions, failure modes, and mode indications of certain automated systems like autopilots, as well as any failure conditions having a severity level of hazardous or catastrophic. These systems must pass FAA system safety assessments. Additionally, holders are required to disclose any adverse airplane handling characteristics that require software to augment the flight controls to produce compliant handling qualities to meet applicable regulations. Moreover, type certificate holders are required to disclose newly discovered information fitting these criteria for disclosure on an ongoing basis, and FAA must establish multiple milestones throughout the certification process to assess whether systems are novel or unusual and thus require additional scrutiny.

The act also directs FAA to ensure that airplane flight manuals and operating manuals contain descriptions of automated flight control systems as well as the procedures for responding to a failure or aberrant behavior of such a system. The act also specifies that FAA may not delegate airworthiness compliance determinations or system safety assessments until it completes a review and validation of underlying assumptions related to human factors.

The act establishes authority for FAA to impose civil penalties of up to $1 million per violation for a transport airplane type certificate holder that fails to disclose safety-critical information regarding the design. It authorizes FAA to revoke an airline transport pilot certification and issue a civil penalty to any individual acting on behalf of a type certificate holder that knowingly makes a false statement with respect to the disclosure of safety-critical design information.

Selection of ODA Unit Members

Beginning on January 1, 2022, each individual selected to be an ODA unit⁶⁶ member for an ODA holder must be an employee, contractor, or consultant to that ODA holder or an employee of a supplier to that ODA holder. Further, FAA must review all individuals nominated to be ODA unit members by the ODA holder, approving or rejecting them within 30 days of receiving an application.

For up to 30 days, while the application for an individual is under FAA review, the ODA holder may conditionally designate the individual to perform ODA unit member functions, provided that the ODA holder has instituted FAA-approved systems and processes to ensure the integrity and reliability of conditionally designated ODA unit members and has implemented SMS. FAA, at its discretion, may prohibit an ODA holder from making conditional designations of ODA unit members and may prohibit a conditionally assigned ODA unit member from performing authorized functions at any time and for any reason. If FAA rejects the application of an individual performing conditionally designated ODA unit functions, then all ODA functions performed by the individual during the conditional period would be required to undergo an FAA review.

ODA holders may resubmit applications for individuals who had previously been rejected as ODA unit members. This allows for reconsideration if an individual's work experience or responsibilities change. FAA must ensure that applications for previously rejected individuals demonstrate that the reasons for prior rejection have been satisfactorily resolved or mitigated.

In general, the law specifies that, to be approved as a member of an ODA unit, an individual must be technically proficient and qualified to perform the authorized functions sought, have no recent record of serious FAA enforcement action, and be of good moral character. The individual must also possess the knowledge of applicable regulations, as well as knowledge of relevant design or production principles, system safety principles, or safety risk management processes appropriate for the authorized functions sought.

Under the requirements of the act, FAA is to carry out a review to determine whether existing ODA unit members meet the minimum qualifications to continue to serve in the ODA unit. For individuals found to be unqualified, FAA will be required to specify remedial action for the individual to meet the qualification standards, or otherwise take other appropriate action, including prohibiting such an individual from performing an authorized function.

The act authorizes $3 million for each fiscal year from FY2021 through FY2023 to carry out its qualification reviews of ODA unit members.

Prohibition on Interference with ODA Units

P.L. 116-260 makes it unlawful to interfere with the duties of ODA unit members. The act expressly prohibits a supervisor working for an ODA holder that manufactures transport category airplanes from interfering with an ODA unit member performing authorized functions. Under the provision, interference refers to "blatant or egregious statements or behavior, such as harassment, beratement, or threats," but can also consist of assigning non-ODA unit duties or activities that interfere with performance of authorized ODA unit functions. The law directs FAA to continuously seek to eliminate or minimize interference by an ODA holder that affects the authorized functions carried out by ODA unit members. ODA holders must designate offices to handle and investigate reports of interference submitted by ODA unit members, and must notify FAA regarding reports of interference and the conclusion of any investigation into alleged interference.

ODA Unit Records

The Aircraft Certification, Safety, and Accountability Act requires ODA holders to maintain records, including data, applications, manuals and other information required by the holder's FAA-approved procedures manual. Additionally, ODA holders must maintain records on the names, responsibilities, qualifications, and training for all ODA unit members and example signatures for all ODA unit members who carry out FAA-delegated functions.

FAA ODA Unit Oversight and FAA Safety Advisors

The act requires FAA to perform periodic audits of each ODA unit and its procedures at least once every seven years. The ODA holder is required to maintain records of each audit and corrective actions resulting from the findings of such audits. FAA is also required to conduct regular oversight activities by inspecting ODA holder delegated functions and taking actions based on validated inspection findings.

Under the act, FAA is required to assign FAA aviation safety personnel with appropriate expertise to serve as advisors to ODA units at large transport airplane and airplane engine manufacturers. These advisors are to communicate with ODA unit members on an ongoing basis to ensure that they are knowledgeable about applicable FAA policies and acceptable means of compliance, and to monitor performance to ensure consistency with such policies. The act prohibits the ODA holder or FAA from prohibiting communication between assigned FAA staff and ODA unit members. FAA is to submit a report to the congressional committees of jurisdiction by September 30, 2022, detailing its efforts to implement these provisions.

ODA Best Practices

The Aircraft Certification, Safety, and Accountability Act requires FAA to carry out a review of best practices among a sampling of ODA holders. At a minimum, identified best practices are to address preventing and deterring undue pressure on or by an ODA unit member, or within an ODA or by an ODA holder, and maintaining independence between FAA, the ODA holder, and ODA unit members. The review panel is also directed to examine other regulated industries to gather lessons learned and assess procedures and processes that address undue pressure on employees, coziness between regulators and regulated entities, and other factors affecting the ability to maintain regulatory independence. The review panel is also to identify ways to improve communications between an ODA administrator, ODA unit members, and FAA engineers and inspectors in order to enable direct communications regarding technical concerns that arise during a certification project, without fear of reprisal to the ODA administrator or to ODA unit members. The panel is also to examine other FAA designee programs, including the assignment of FAA advisors to designees to determine what elements of these programs may help improve FAA oversight of ODA units, individual ODA unit members, and the ODA program in general.

Within 180 days of receiving the report detailing the panel's review and recommendations, the FAA Administrator is to establish a set of best practices that are generally applicable to all ODA holders and require such procedures and policies to be incorporated, as applicable, into each ODA program holder's approved procedures manual. FAA is to make public notice of the established best practices and allow for a public comment period of at least 60 days prior to establishing them as required elements of ODA programs.

Type Certification Integrated Project Teams

Under P.L. 116-260, FAA must convene an interdisciplinary integrated project team upon receipt of every application for a new type certificate for a transport category airplane received. An integrated project team will be responsible for coordinating review and providing advice and recommendations to FAA regarding the application, and it is to be available, upon request of the FAA Administrator, during the certification process. Each integrated project team is to consist of FAA employees or employees of other federal agencies, such as the Air Force, the DOT Volpe National Transportation Systems Center, or NASA, with specialized experience in engineering, systems design, human factors, and pilot training.

The integrated project team is to make written recommendations about plans, analyses, assessments, and reports required to document the certification process regarding new technologies or novel design features. These recommendations are to be retained in the certification project file, and are to consist of an initial review of design proposals, identification of new technologies and novel designs, and safety-critical design aspects. The file is also to include a determination of compliance findings, system safety assessments, and safety-critical design features, and an evaluation of FAA expertise needed to support the project. The team is to review and evaluate any requests for exceptions or exemptions from compliance with airworthiness standards; the conduct of design reviews, procedure evaluations, and training evaluations; and the applicant's final design documentation and other data to evaluate regulatory compliance. FAA is to provide a written response to each recommendation issued by a project team to be retained in the certification project file.

Within one year after enactment, and annually thereafter through FY2023, FAA is to submit a report to congressional committees of jurisdiction on the establishment of each integrated project team required under this provision, detailing the composition and role of each such team.

Appeals of Certification Decisions

The Aircraft Certification, Safety, and Accountability Act directs FAA to order a formal process through which decisions and findings regarding compliance or noncompliance with aircraft design requirements may be appealed. The order is to include processes for resolving technical issues at preestablished stages of the certification process and automatic elevation to alert FAA management when major certification milestones are not completed or resolved within an agreed-upon time. It is to spell out processes for handling elevated issues, including appeals seeking resolution of unresolved issues. The FAA Associate Administrator for Aviation Safety is to issue a written decision for each such appeal submitted. This decision may be appealed to the FAA Administrator for final review and determination. The FAA Administrator may, in turn, render a final determination or may decline to review the matter. During the appeals process, no FAA employee may engage in ex parte communication with any individual representing or acting on behalf of the certificate holder or applicant. Any FAA official made aware of ex parte communications must disclose all details of such communication in a public record released along with the written determination. Determinations under this process are not subject to judicial review. At the conclusion of each calendar year through 2025, FAA is to submit a report to congressional oversight committees summarizing each such appeal that was resolved under this process during the year.

System Safety Assessments

The Aircraft Certification, Safety, and Accountability Act requires FAA to promulgate regulations by the end of December 2022, requiring organizations seeking to amend a transport category airplane type certificate to perform a system safety assessment regarding each proposed design change that FAA considers to be significant. The assessment is to consider the effects of errors, malfunctions, and failures, and to consider realistic pilot response times to address such occurrences. Applicants are to provide FAA oversight personnel with the data and assumptions underlying each assessment and amendments to those assessments, and provide FAA with clear, traceable documentation explaining changes to aircraft type designs and system safety assessment certification. The FAA Aircraft Certification Service and the FAA Flight Standards Service will review each such system safety assessment and supporting information provided to determine whether it adequately addresses systems safety under error, malfunction, or failure conditions.

The act directs FAA to work with civil aviation authorities from other nations where aircraft are designed to maintain international harmonization of relevant regulations regarding system safety assessments. The act instructs FAA to issue guidance or advisory materials emphasizing the importance of clear documentation of technical details, failure modes, and effects of significant design changes covered under system safety assessment.

Nonconformity with Approved Type Designs

P.L. 116-260 expressly prohibits an aircraft manufacturer holding a production certificate from seeking airworthiness certification of a production aircraft that does not conform to the original type design certification. The statute establishes a civil penalty of up to $1 million for every nonconforming aircraft presented for airworthiness certification. In levying such fines, FAA is instructed to consider the nature, circumstances, extent, and gravity of the violation, including the length of time the manufacturer was aware of the nonconformity, the degree of culpability, the size of the business, and any history of prior violations.

Flight Crew Alerting

The act requires FAA to adopt NTSB recommendations regarding flight crew alerting systems by incorporating these recommendations into future certification requirements. The provision also includes sense-of-Congress language that the NTSB recommendations be applied to any system safety assessments of existing Boeing 737 Max designs.

Further, the act prohibits FAA from issuing a type certificate for a transport category airplane unless the airplane incorporates a flight crew alerting system that displays and differentiates its warnings, cautions, and advisories, and includes functions to assist flight crews in prioritizing corrective actions and responding to system failures. For transport category aircraft other than airplanes, such as helicopters, the statue requires that the type certificate applicant provide a means acceptable to FAA to assist the flight crew in prioritizing corrective actions and responding to system failures.

Pilot Training and Human Factors

The Aircraft Certification, Safety, and Accountability Act requires FAA to independently review any manufacturer proposal regarding the scope, format, or minimum training requirements for a new transport category airplane. Until FAA establishes approved training requirements, manufacturers are prohibited from making any assurances or other contractual commitments, whether written or verbal, to a potential purchaser unless a clear and conspicuous disclaimer, in a form approved by FAA, is included regarding the status of training requirements for the airplane. Moreover, in marketing the airplane, manufacturers are prohibited from offering financial incentives, such as rebates, to a potential purchaser related to the scope, format, or magnitude of pilot training.

The act also requires applicants seeking amended type certificates for transport category airplanes to demonstrate to FAA that the design of systems and instrumentation adequately accounts for realistic assumptions regarding the time required for pilots to respond to abnormal conditions. These demonstrations and underlying assumptions are to be based on test data, analysis, or other technical validation methods, and to conform with generally accepted scientific consensus among human factors experts regarding pilot response times.

Expert Safety Review

The act directs FAA to initiate an expert safety review of design and certification assumptions for transport category airplanes regarding pilot operations and training. The review is to include an examination of applicable regulations, guidance, and directives related to pilot response assumptions and human factors and human systems integration considerations, particularly those related to pilot-aircraft interfaces. It is also to include a focused examination of underlying assumptions regarding the time required for pilots to respond to abnormal conditions, including response to safety-significant failure conditions and failure scenarios that trigger multiple, and possibly conflicting, warnings and alerts. The review is to include details of human factors assumptions and relevant operational data, human factors research findings, and the recommendations of human factors experts regarding possible recommendations for modifications to existing assumptions. The review is to also examine modifications to pilot certification standards over the past four years, focusing on any possible effects on pilot competency in basic manual flying skills. It is also to take into consideration the global nature of aviation and differences in levels of pilot competency and pilot training programs worldwide.

The review is to identify a process for various aviation stakeholders, including pilots, airlines, inspectors, engineers, test pilots, and human factors experts, to provide and discuss observations, feedback, and best practices. The review also is to examine processes for ensuring that type certification reviews address the cumulative effects of new technologies and the interaction of those technologies with existing aircraft systems on pilot performance. FAA is to examine current processes to adjust system safety assessments, design requirements, and pilot procedures and training requirements when changes are made to underlying certification assumptions.

Upon completion of the review, FAA is to provide a report to the congressional committees of jurisdiction detailing the results and any recommendations for actions to address pilot response assumptions, including potential tools and methods to better integrate human factors into the aircraft certification process. The legislation directs FAA to update its regulations in response to the expert safety review. Additionally, FAA is to inform other international civil aviation authorities that certify transport category airplane type designs of the expert panel report and encourage them to reevaluate existing regulations and processes based on the findings and recommendations of the review.

Call-to-Action on Airman Certification Standards

The act instructed FAA to initiate a call-to-action safety review of pilot certification standards, including a detailed examination of FAA regulations, guidance, and directives related to pilot certification standards, revisions to those standards over the past five years, and potential effects on pilot competency in manual flying skills and the management of aircraft automation. The review is to identify a process for including flight training students, instructors, designated pilot examiners, pilots, airlines, labor organization representatives, and aviation safety experts in discussions of observations, feedback, and best practices.

Ninety days after the call-to-action safety review is completed, FAA is to submit a report to the congressional committees of jurisdiction detailing the results of the review and any recommendations for actions or best practices to ensure competency in manual flying skills and effective management of aircraft automation. FAA is to also identify what actions it will take in response to the recommendations.

International Pilot Training Standards

The act directs the Secretary of Transportation and the FAA Administrator to take on a leadership role internationally in setting global standards to improve air carrier pilot training and qualifications. The objectives are to identify common standards for monitoring and managing aircraft automation and manual flying, controlling the flightpath without automated flight systems, effectively managing automated flight systems under appropriate conditions, identifying when automated flight system usage is appropriate and when it is not, and recognizing and appropriately responding to abnormal conditions.

In exercising leadership, DOT and FAA are to consider the latest information regarding human factors, aircraft manufacturing trends related to cockpit automation, how cockpit automation improves aviation safety and how it introduces novel risks, the availability of opportunities for pilots to practice manual flying skills, the need for consistency in maintaining and enhancing manual flying skills worldwide, recommended practices in this respect from other countries, and whether a need exists for initial and recurrent training standards to improve manual flying skills and proficiency in managing automated flight systems. The Secretary or the FAA Administrator is to brief the congressional committees of jurisdiction on a regular basis on the status of efforts to address international pilot training required by the legislation.

Additionally, the act directs DOT and FAA to work with the Department of State to engage in bilateral and multilateral discussions with other nations and through ICAO to bolster international collaboration, data sharing, and harmonization of safety requirements. Toward this objective, DOT and FAA are instructed to promote continued sharing of operational safety information, prioritize better airmanship by addressing pilot training deficiencies regarding manual flying skills and overreliance on aircraft automation, encourage regulations pertaining to flight crew training requirements having safety advantages, and address other training areas FAA believes will enhance international aviation safety. Further, FAA is to seek to expand its role in providing technical assistance in support of international aviation safety by promoting and enhancing effective oversight systems, including operational safety enhancements identified through data collection and analysis. DOT and FAA are also to promote and encourage compliance with international safety standards, work to minimize cybersecurity threats and vulnerabilities throughout the aviation ecosystem, and support the sharing of safety data, risk assessments, mitigations, and best practices through established international aviation safety groups.

The act authorizes $5 million for each fiscal year from FY2021 through FY2023 to carry out these initiatives related to pilot training, and an additional $2 million for each of those fiscal years to fulfill the obligations related to bilateral and multilateral aviation safety engagement. The act authorizes FAA to provide technical assistance to other nations in connection with bilateral and multilateral agreements, including initiatives to further bolster airmanship.

The provisions regarding international pilot training standards include sense-of-Congress language finding that increased reliance on flight automation risks a degradation of manual flying skills that are essential for pilot confidence and competence. It references an ICAO working paper⁶⁷ on pilot training improvements to address automation dependency that identifies a need for new or amended international standards or guidance to mitigate the consequences of automation dependency, and expresses a sense of Congress that the recommendations of this paper should be made a priority by the ICAO Assembly and that the United States should work with ICAO and other international aviation safety groups to further bolster components of airmanship.

Pilot Operational Evaluations

The Aircraft Certification, Safety, and Accountability Act directs FAA to ensure that pilot operational evaluations of transport airplane type designs submitted for certification are carried out using pilots from air carriers that are expected to operate such airplanes. Airplane manufacturers are to satisfactorily demonstrate to FAA that airline pilots asked to participate in such evaluations have a range of levels of experience. FAA is required to implement these changes within one year of enactment.

Human Factors Education Program

The act also requires FAA to develop a human factors education program that addresses the effects of modern flight deck systems on transport airplanes, including automated systems, on human performance and approaches to better integrate human factors into aircraft design and certification. The training is intended to be integrated into the training protocols for, and routinely administered to, appropriate employees in the Flight Standards Service and the Aircraft Certification Service as well as other employees and authorized representatives determined to require such training by the FAA Administrator.

Human Factors Research

The Aircraft Certification, Safety, and Accountability Act requires FAA to develop research requirements to address the integration of human factors in the design and certification of air transport aircraft. FAA is to consult with aircraft manufacturers, operators, and pilots in developing the research program. Further, it is to identify research requirements and establish research goals relevant to advancing technology, improving design engineering and certification practices, and facilitating better understanding of human factors concepts relevant to the increased reliance on automated and complex flight deck systems and aircraft operations. The language directs FAA to include research to help develop diagnostic tools to validate pilot recognition and response assumptions and improve the clarity of failure indications. Toward these objectives, FAA is to leverage ongoing and planned research focusing on preventing future accidents involving U.S.-manufactured transport category airplanes and addressing increasingly complex aircraft systems and designs. The legislation authorizes $7.5 million annually from FY2021 through FY2023 to conduct this human factors research.

In carrying out this research program, FAA is to work with organizations with appropriate expertise, especially the existing FAA Center of Excellence for Technical Training and Human Performance and a new Center of Excellence for Automated Systems and Human Factors in Aircraft authorized by the act. This new center is intended to facilitate collaboration among academic experts, FAA, the aircraft and airline industries, and pilots. It is to establish research goals to improve technology, engineering practices, understanding of related human factors concepts, and associated education and training. The center is also directed to examine issues related to human-systems integration and pilot interfaces, including human factors considerations for aircraft design and certification, and to review safety reports to identify human factors research for further study. The provision instructs FAA to avoid duplication of work performed by other centers of excellence, but does not preclude coordination and collaboration among them. FAA is directed to ensure that the center reflects a balance of viewpoints across broad disciplines in the aviation industry and gives priority to subject-matter experts whose professional experience enables them to make objective and impartial contributions. Any individual working within the center of excellence who was formerly engaged in certification of the 737 Max MCAS system as either a Boeing or an FAA employee must disclose his or her involvement in that certification work prior to performing any work for the FAA center.

The legislation authorizes $2 million for each fiscal year, from FY2021 through FY2023, to fund the development and research of the Center for Excellence for Automated Systems and Human Factors in Aircraft.

Changed Products and Amended Type Certificates

The Aircraft Certification, Safety, and Accountability Act directs FAA to revise and improve the process of issuing amended type certificates. It requires FAA to initiate rulemaking and develop or revise related guidance and training materials by the end of December 2022. It directs FAA to ensure that proposed changes to aircraft are evaluated from an integrated aircraft system perspective. The regulations are to consider the work of the Certification Management Team and of various international harmonization efforts and assess whether establishing a fixed time beyond which a type certificate could no longer be amended would improve aviation safety. The regulations are to limit the extent to which new or revised flight control systems, structural changes, or the introduction of novel or unusual systems or components that pose hazardous or catastrophic risks can be approved under an amended type certificate.

The act also requires FAA to develop objective criteria for determining what constitutes a significant change requiring a new type certification. It directs FAA to implement mandatory reviews throughout the certification process and establish requirements for maintaining relevant records of agreements between FAA and certificate applicants regarding documentation and deliverables, including any regulatory exceptions or exemptions.

The provisions state that FAA's orders and regulatory guidance pertaining to amended type certificates should provide for

• early FAA involvement and feedback mechanisms to ensure FAA awareness of changes;
• early coordination with FAA regarding functional hazard assessment validations and preliminary system safety assessment reviews;
• presentation of new technologies, novel designs, or safety-critical features and systems to FAA initially and throughout the certification process;
• clear terms for determining when new type certificates may be required and what certification functions may be delegated;
• improvements to type certification data sheets to clearly identify compliance requirements with applicable regulations and amendments; and
• clear policies to guide applicants regarding clarity and consistency of key design and compliance information submitted for certification.

The act also directs FAA to develop training materials for establishing the certification basis for changed aircraft designs and related products.

The act also directs FAA to assume a leadership role in the creation of international policies and standards relating to the issuance of amended type certificates. In carrying out this directive, the legislation encourages FAA certification management team members to examine and address relevant recommendations issued by the NTSB, the Joint Authorities Technical Review, the DOT Office of Inspector General, the Safety Oversight and Certification Advisory Committee, and others as determined appropriate by FAA. It instructs FAA to reevaluate existing assumptions and practices pertaining to the amended type certificate process and ensure, to the greatest extent practicable, that FAA regulations regarding amended type certificates are harmonized with those of foreign countries that issue aircraft design certifications.

Whistleblower Protections

The Aircraft Certification, Safety, and Accountability Act expands aviation industry whistleblower protections to include employees of type or production certificate holders, as well as employees of contractors, subcontractors, or suppliers of those certificate holders. It prohibits employers from firing or otherwise discriminating against employees who provide information or testify regarding a violation or alleged violation of federal laws, regulations, and standards pertaining to aviation safety. The whistleblower protections, however, do not apply to employees who deliberately cause a violation.

The act renamed the FAA Aviation Safety Whistleblower Investigation Office the Office of Whistleblower Protection and Aviation Safety Investigations. It expands the office's role to receive allegations of whistleblower retaliation and to work with the FAA Office of Investigations and Professional Responsibility, the DOT OIG, and the Office of Special Counsel on investigations related to whistleblower retaliation within FAA.

A new position within the office, the Whistleblower Ombudsman, is to be filled by an individual with a background in federal labor law, government human resource management, and conflict resolution. The Whistleblower Ombudsman is to assume responsibility for educating FAA employees about the consequences of retaliation against whistleblowers and available rights and remedies of employees facing retaliation. The ombudsman is also to assist in developing training to help prevent and mitigate retaliation. The ombudsman is to serve as an independent confidential resource to discuss allegations of retaliation and available rights and remedies based on the specific circumstances of a case, and to coordinate with human resources, the Office of Whistleblower Protection and Aviation Safety Investigations, and the FAA Office of Chief Counsel, as well as the DOT OIG Whistleblower Protection Coordinator and the Office of Special Counsel as necessary.

The act directs FAA to rename the Office of Investigations the Office of Investigations and Professional Responsibility, and directs FAA to review and revise policies pertaining to investigations of misconduct by an individual in a supervisory or management position at FAA. The revisions are to ensure independent and objective investigation and accurate recording and reporting of investigative activities and findings, including proper management of case files. FAA is to ensure that interviews conducted as part of a whistleblower investigation are carried out in a manner that promotes truthful answers and accurate records, and that investigations are coordinated with the DOT OIG, the Office of Special Counsel, and the Department of Justice, as appropriate.

FAA Compliance Program Oversight

The act directs FAA to establish an executive council to oversee its compliance program used to track deviations from regulatory standards through comprehensive safety data sharing between FAA and regulated entities.⁶⁸ The steering committee is to identify, collect, analyze, and monitor data related to the compliance program across relevant FAA program offices and provide the executive council with information necessary to carry out its functions as well as recommendations pertaining to the functions, operations, and effectiveness of the compliance program.

The executive council chair is to report relevant annual findings, including trends in noncompliance, FAA deficiencies in implementing the program, and any recommendations to improve the compliance program to the FAA Administrator. The law also requires the chair to provide annual briefings through calendar year 2023 to the congressional committees of jurisdiction on the effectiveness of the compliance program and recommendations. The act expressly prohibits the FAA Administrator or the Secretary of Transportation from prohibiting the chair from performing his or her duties, including reporting to Congress. Under the terms of the provision, the executive council will be dissolved on October 1, 2023.

Transport Airplane Risk Assessment Methodology Review

The Aircraft Certification, Safety, and Accountability Act instructed FAA to enter into an agreement with the National Academies of Sciences (NAS) to examine the approach and effectiveness of the Transport Airplane Risk Assessment Methodology (TARAM) process used by FAA. NAS is to deliver a report to the congressional committees of jurisdiction assessing the TARAM analysis process and its effectiveness toward improving aviation safety, along with recommendations to improve the methodology and its effectiveness.

The act also requires FAA to provide notice to the congressional committees of jurisdiction on the findings and recommendations issued using the TARAM process following any transport airplane accident involving a loss of life or any other accident in which the FAA Administrator determines that an airworthiness directive is likely needed to correct an unsafe condition associated with the aircraft's design.

Boeing Settlement Agreement

The act also included sense-of-Congress language that FAA should pursue all available remedies to demand full payment of any deferred civil penalties if it finds that Boeing has not fully met all of its obligations included in the formal settlement agreement signed December 18, 2015.⁶⁹ The act requires FAA to brief the congressional committees of jurisdiction within 60 days of enactment, and every six months thereafter, until all obligations under the settlement agreement have been met.

National Air Grant Fellowship Program

The law creates a National Air Grant Fellowship program under the leadership of a director appointed by the FAA Administrator. Under the program, FAA is to work with institutes of higher education that offer degrees in fields related to aerospace to provide fellowships in aerospace policy to graduate students and post-graduate degree recipients. Fellows are to be placed in positions in the executive and legislative branches of the U.S. government, with priority placement to congressional committees with jurisdiction over FAA and in the offices of Members of Congress who have demonstrated interest in aerospace policy. Fellowships cannot exceed one year in duration. The act authorizes $15 million annually for FY2021 through FY2025, which may remain available until expended, to carry out the fellowship program.

Emerging Safety Trends in Aviation

The Aircraft Certification, Safety, and Accountability Act directs FAA to enter into agreement with the Transportation Research Board (TRB) to develop and issue annual reports identifying, categorizing, and analyzing emerging safety trends in air transportation. The act instructs the TRB, in consultation with the Secretary of Transportation and the FAA Administrator, to harmonize data and sources from existing reporting systems within DOT and FAA. Beginning in 2022 and extending through FY2031, the TRB is to submit biennial reports to the congressional committees of jurisdiction identifying emerging safety trends in air transportation.

The act further directs FAA to conduct an annual internal safety culture assessment each year through FY2031. FAA is to survey employees in its aviation safety organization to assess safety culture and the implementation of voluntary safety reporting programs.

Aviation Maintenance Schools and Technical Training

The Aircraft Certification, Safety, and Accountability Act requires FAA to promulgate interim final regulations governing the certification of aviation maintenance technician schools to replace existing training requirements and curricula specified in 14 C.F.R. Part 147. The law prescribes that aviation maintenance school applications are to include a description of facilities and details regarding the manner in which the school's curriculum will ensure that students acquire the knowledge and skills needed to attain an FAA mechanic certificate and associated ratings.

Additionally, aviation maintenance technician schools will be required to demonstrate the manner in which they will provide qualified instructors who hold appropriate ratings and qualifications, teach in a manner that ensures positive educational outcomes, and maintain a student-to-instructor ratio the does not exceed 25:1 for any shop class.

Under future rule revisions, schools are to ensure that the curriculum continuously aligns with FAA mechanic certification standards and assure that students are properly trained in the knowledge and skills needed to be eligible to take the appropriate tests for a mechanic certification and associated ratings. Moreover, each school is to be properly accredited as an institution of higher education, or must obtain and maintain FAA approval pertaining to administration and record-keeping. Schools must maintain a student pass rate on FAA mechanic exams of at least 70% within 60 days of graduation over the past three-year period, and are subject to periodic FAA inspections to assess regulatory compliance and adherence to FAA-approved operating specifications.

Ongoing FAA Oversight Challenges

Addressing the numerous requirements set forth in the Aircraft Certification, Safety, and Accountability Act will be a major safety focus for FAA over the next several years. Assessing the effectiveness of FAA initiatives to implement mandated changes may prove challenging. Developing appropriate safety metrics to measure the efficacy of future actions, such as the implementation of SMS at aircraft manufacturing facilities, is likely to be difficult. Moreover, FAA faces continuing challenges in recruiting, hiring, and training workers with the skills needed to effectively carry out certification activities and monitor safety compliance at aircraft design and manufacturing facilities.

A November 2020 GAO study found that FAA had examined gaps in critical competencies among its safety inspectors and engineers only on a limited basis.⁷⁰ It also found that FAA did not routinely assess its training curricula for safety inspectors and engineers. GAO recommended that FAA assess critical competencies for its inspector and engineer workforce and assess gaps in meeting these competencies on a recurring basis. It also recommended that FAA assess training curricula for its inspectors and engineers on a recurring basis to align training with core competency needs.

Another factor potentially affecting FAA involvement in certification activities and manufacturer oversight is the continuing uncertainty of federal budgets. In the past, the inability of Congress to agree on appropriations bills in a timely manner has resulted in temporary shutdowns of some government activities. While entities with delegated authority can continue certification work during a government shutdown, certification activities that depend on FAA action may be deferred, potentially delaying product development and certification.