The FAA is unwilling to certify the Boeing 777X. The regulatory agency has informed Boeing that it won’t give Boeing Type Inspection Authorization (TIA) for the 777-9 unless the airframer provides evidence that it has conclusively solved a number of software and hardware issues. The FAA had signaled this in a letter to Boeing on May 13, The Seattle Times and Reuters have reported on June 27.
Since January 25, 2020, Boeing is busy testing and preparing certification of its biggest type, the 777-9. According to the order book, the 777X has a backlog of 309 orders, but Boeing reported last February that it has revised the program accounting quantity from 350 to 191 aircraft that are expected to be actually sold. In January, CEO David Calhoun confirmed during the 2020-results webcast that following consultation with regulators, Boeing was to redesign the firmware and hardware of the Actuator Control Electronics (ACE). This system translates analog control inputs into digital signals to the surface control systems and is provided by Japanese company Nabtesco.
Most worries over Common Core System
The May 13-letter disclosed by The Seattle Times and Reuters today and seen by Airinsight reveals more issues with the 777X. The most critical is the Common Core System (CCS), referred to by the FAA as a “very complex and critical avionics system (…) that provides a set of computing, networking, and input/output resources to support the computing and system interface needs for multiple airplane systems. The CCS also provides the means for hosted functions of all criticalities of safely to share the same physical resources.” The letter identifies 56 different hosted functions by the system, which on the 777X is of a completely different design from the 777-300ER.
In letters dated April 12 and May 7, Boeing’s Organization Designation Authorization Lead Administrator Tom Galantowicsz asked the FAA approval for the 777X entering phase 1 of Type Inspection Authorization despite acknowledging that software of the CCS was still incomplete, as was data for the Design Assurance Review (DAR).
In the May 13-reply, the FAA says it “considers that the aircraft is not yet ready for TIA, even if it is a phased TIA of limited scope with small number of Certification Flight Test Plans proposed. The technical data required for the type certification has not reached a point where it appears the aircraft type design is mature and can be expected to meet the applicable regulations.” Only the first phase of DAR has been completed, but phases 2 and 3 have yet to follow. Without this, the FAA has difficulty determining if the CCS is mature enough. The FAA adds that Boeing and the agency have been discussing TIA criteria for nine months and that DAR dates have continuously slipped.
No evidence that the 777-9 meets safety assessment
Nor has Boeing been able to provide evidence that the 777-9 meets the Preliminary Safety Assessment, which means that Boeing doesn’t meet its own TIA criteria. There is insufficient and inadequate data available to file the Certification Flight Test Plans for this phase of TIA. An assessment of CCS concluded that “data is not yet mature enough to show compliance, lists many open problems against safety documentation, assessments, and requirements”, especially as the GE Aviation system will have a few software updates soon that will address previous shortfalls. It also notes that the analysis included incorrect use of data from the Boeing 787.
The letter by FAA’s Ian Won says that the software update will also fix a serious issue that happened to the second of four 777-9 test aircraft (N779XX) on December 8, 2020. Without disclosing further details, the aircraft experienced an un-commanded pitch event in which it either pitched up or down. The FAA says it has “yet to see how Boeing fully implements all the corrective actions identified by the root cause investigation, including system requirement and tracing, robust verification process, supplier communication, systems integration validation, and verification, and airplane level verification to ensure the ‘maturity’ and safety/airworthiness of the aircraft.”
“We also expecting Boeing to complete comprehensive validation, verification reviews, and document the process improvements and lessons learned identified by the root cause investigation, and implement a robust process so similar escape will not happen in the future and this is not a systemic issue.”
The letter to Boeing also reveals that the update of the Actuator Control Electronics that Calhoun mentioned in January is still not complete. The FAA says that it is Europe’s EASA that hasn’t agreed “on a way forward with the 777-9” while the FAA is worried that a redesign might introduce new, inadvertent failures.
Certification not before late 2023
With the FAA unwilling to certify the 777X, the 777-9 will realistically receive its amended type certificate not until mid or late 2023 at the earliest. While this is in line with what David Calhoun has said in January, it is evident from the FAA letter that even this date is subject to confirmation. First deliveries are likely to be pushed into early 2024, which is four years behind the program schedule.
The letter also confirms the position of Emirates, whose President and CEO Sir Tim Clark has been saying in numerous interviews recently that he has no visibility on the 777X program status and deliveries to his airline. “This could be 2023, 2024, or even 2025”, Clark said in one interview. Qatar Airways’ Akbar Al Baker, on the contrary, said recently that he has been given specific information on his delivery position.
How Boeing has responded to the May 13 letter isn’t known. The airframer told The Seattle Times that it remains fully focused on safety as our highest priority.”
From an aircraft safety engineer:
The CCS also provides the means for hosted functions of all criticalities of safely to share the same physical resources.” The letter identifies 56 different hosted functions by the system,
This not an acceptable solution as the lowest DAL (Development Assurance level) will be assumed and thus safety critical functions cannot be independent from non-safety critical, in addition it is unlikely to be deterministic by design and being novel is subject to multiple uncertainties. Why make it complex?
Development of the 777X will cost a lot of money to Boeing and they will have to sell many airplanes to recover those costs. But the way things have been going so far production of this model might end before it ever becomes profitable. Even if they were able to fix all its problems it will never be a state of the art aircraft anyway. And on top of that it might actually be too big for the market, not only today but for a long time to come, because smaller and more efficient aircraft like the 787 increase frequency. For all those reasons I anticipate that the history of the 777X programme will be written in red ink, no matter how long it last. Boeing is broken.