Multiple sources within the Federal Aviation Administration, Boeing and Congress say the jetmaker may not get the largest 737 Max variant, the Max 10, through FAA certification in time to hit a crucial deadline that if missed would trigger a new tighter safety requirement — from which Boeing wants an exemption.
Missing the year-end deadline could mean having to substantially revamp the Max 10 cockpit systems, a redesign of the aging 737 flight deck that the company previously declared impractical.
While Boeing's lobbyists have not yet officially asked for congressional action, they will likely request a legislative amendment that extends the deadline past Dec. 31, according to a company insider.
That would allow the Max 10, like previous Max models, to be certified without meeting the latest safety standard that governs the design of cockpit crew alerts that warn pilots of some system malfunction during flight.
Boeing has been lobbying Congress, expressing concern about the schedule for the FAA's certification of Max 10, which is the process of clearing it as safe to fly passengers.
In the meantime, an FAA safety engineer said the agency is "pulling people from other projects to come help" on Max 10 certification and ensure the FAA isn't blamed for delaying the process.
"They are scrambling," said the FAA engineer, who asked for anonymity to protect his job.
Boeing has informed some airlines of the pending problem, including Max 10 launch customer United Airlines, which has more than 250 Max 10s on order.
If Boeing missed the deadline and was compelled to upgrade the Max 10 flight deck, its crew alerting system would operate differently from that of the Max 8 and 9 models. Assuming that can be done, it would necessitate separate pilot training for the Max 10, an expense the airlines don't want.
In an interview, U.S. Sen. Maria Cantwell, D-Wash., who chairs the Senate committee that helped draft the FAA reform law, indicated that — provided the FAA approves it — she's inclined to grant an extension for Boeing.
"If they would like more time, this is an FAA decision," Cantwell said. "If the FAA says yes, we need another six months, give them six months. If everybody was in agreement, I would change the date."
She said the FAA should complete a full system safety assessment, including weighing whether making the Max 10 cockpit different from the other Max models might increase the risk for airlines with mixed fleets.
"Safety first. We're not going to hurry. We're not going to be rushed," Cantwell said. "I need the FAA to lead. I want to hear from them that that's what they think is the safest way to go."
The FAA in an emailed statement said it cannot discuss specific details about the Max 10's certification.
"Nor will we speculate about any actions the applicant (Boeing) might take with respect to a timeline for completing the project," the FAA said.
In a statement Tuesday, Boeing said "we continue to work transparently with the FAA to provide the information they need, and we are committed to meeting their expectations to achieve 737-10 certification."
"Safety remains the driving factor in this effort," Boeing added.
Initial Max models already exempted
Thursday is the three-year anniversary of the Max crash in Ethiopia, the second of two Max crashes that killed 346 passengers and crew.
Those accidents and the failures of oversight of the Max spurred Congress to pass the Aircraft Safety and Certification Reform Act in late 2020 to reform the FAA oversight process.
That law requires any airplane certified after Dec. 31 this year to comply with the latest FAA crew alerting regulation. The 737 is the only Boeing jet that doesn't meet the standard.
Every other current Boeing airplane has what's called an Engine Indicating and Crew Alerting System, or EICAS, that complies with the FAA regulation.
This is a centralized cockpit warning system that helps the pilots differentiate, prioritize and respond to aural and visual warnings, cautions and alerts that activate during flight.
As required in the regulation, it allows pilots to suppress erroneous warnings that can cause excessive distraction.
And it designates a hierarchy of alerts depending on the seriousness of the problem, with the most urgent alerts grabbing the crew's attention through two different senses in a combination of aural, visual and tactile cues.
Boeing's EICAS system not only tells pilots what is wrong but typically instructs the pilot what to do to get out of the situation.
But because the 737's cockpit inherited many systems from the original 1960s-era design, it's difficult to update the airplane to comply with this regulation.
In 2014, Boeing convinced the FAA to relax this specific safety standard for the Max.
Boeing relied on a special FAA rule to successfully argue that full compliance with the latest federal requirements would be "impractical" for the Max and would cost too much.
Documents obtained by The Seattle Times laying out the argument Boeing made then to the FAA show that its case rested largely on the 737's long service history, which by then had accumulated more than 300 million hours in the air on mostly routine, safe flights.
Boeing separately argued that it had corrected each of the distinct crew alerting problems that may have confused the pilots in three fatal 737 crashes during the previous decade — the 2005 Helios Airways crash in Greece that killed 121 people; the 2008 Aeroflot-Nord crash in Russia, in which 88 died; and the 2009 Turkish Airlines crash in Holland with nine fatalities.
Boeing's submission to the FAA cited an estimate of the cost of full compliance for the Max at "more than $10 billion." That was enough for the FAA to agree to grant the exemption.
A deadline looms
The two initial models of the new jet family, the Max 8 and the Max 9, were certified accordingly. The new, smaller Max 7 model is currently undergoing flight tests and is expected to be certified later this year.
The Max 10 began flight tests last summer. But its certification is more complicated than the previous Max models.
After the two fatal Max crashes the European Union Aviation Safety Agency insisted that by the time this final Max plane enters service it must have an upgraded Angle of Attack sensor system that provides triple redundancy rather than the double redundancy on previous models.
The Angle of Attack is the angle between the jet's wing and the oncoming air. An incorrect measurement of this from one faulty sensor on each of the two crash flights triggered a new, poorly designed flight control system on the Max to force the planes down.
Boeing's Max 10 upgrade includes new software in the flight control computer that provides a separate calculation of the Angle of Attack using various other data readings independent of the two physical Angle of Attack sensors on the jet's fuselage.
The Boeing insider, who requested anonymity to keep his job, said there's "no way" the company will certify the Max 10 by the deadline.
"They still don't have certification on the Max 7, and it's virtually the same plane as the Max 8 and Max 9," the insider said. "Boeing is stuck. They need the law changed or the FAA to agree to an exemption for more time."
Could extending the deadline be safer?
A separate Boeing insider said that to get that change. Boeing lobbyists on Capitol Hill have been "educating congressional members and staff about potential impacts" of missing the looming deadline, including potential job losses in Washington state should the Max 10 not go forward.
The 2020 FAA reform legislation mandates that any airplane certified two years after its enactment must have a fully compliant EICAS-style, state-of-the-art crew alerting system.
That requirement was spurred by the two crash scenarios, when both crews were subjected to multiple distracting erroneous alerts that likely contributed to the pilots' loss of control.
A person who was involved in drafting the 2020 FAA reform law said that the intent was to ensure that all future airplane designs complied with the crew alerting standard but, given the FAA's original exemption, to let the Max pass.
"The expectation was that the Max 10 would be certified before the two-year deadline," said the person, who asked not to be identified to continue his work on FAA reform in Congress.
"It wouldn't require major legislation," this person said, only an amendment to the date in the law.
The FAA safety engineer said "there may be a good case for granting the extension" for the Max 10.
For one thing, he said, the Max 10's new triple-redundant Angle of Attack system means the risk of the multiple erroneous crew alerts that caused so much confusion in the crash scenarios is now much reduced.
In this respect, the Max 10 should be safer than the previous generation 737 models with their solid safety record, the engineer said.
In addition, he said, changing the Max 10 crew alerts would make the jet's cockpit instrument system different from that of the Max 8 and 9, introducing potential confusion among pilots for airlines like Alaska Airlines that have all three models on order.
A pilot might fly a Max 9 one day and a Max 10 the next. Confusion over the differing styles of alerts might create higher risk than not upgrading the system and keeping a common cockpit.
"If FAA pilots are convinced that erroneous warnings are dealt with by the Max 10 design, from a technical standpoint, I'd be content," the engineer said.
"But it should be done through a formal public process," he added, "Not by lobbying behind the scenes."
