Click for next page ( 20


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 19
Type Certification and Rule Making As stated in the introduction, the processes by which the FAA seeks to assure the inherent safety or airwor- thiness of aircraft are type certification and rule making. Type certification, handled primarily in an FAA regional office, involves assuring that the manufac- turer's new design for a particular type of aircraft complies with the statute and all applicable rules and standards. Rule making, conducted at the agency's head- quarters in Washington, D.C., involves establishing the regulations and technical standards that must be met by the manufacturers and airlines in the course of design- ing, producing, operating, and maintaining the aircraft. Within each regional office, the group that reviews and approves each new aircraft design is the Type Certi- fication Board. Usually chaired by the director of the office's engineering and manufacturing section, the "Type Board" is composed of the senior managers for various technical specialties. The board functions as a manage- ment or steering group for all certification projects within the region and acts as a reviewer and arbiter of major technical issues. It provides a point for appeal by the applicants and serves as an overall advisory group to its chairman, who issues the Type Certificate. The day-to-day interactions with the applicant are handled by an assigned project manager, supported by staff members of a project engineering team. A typical certification project for a new type of airplane involves a process of interaction and iteration 19

OCR for page 19
IMPROVING AIRCRAFT SAFETY/20 between the FAA regional office and the manufacturer over a number of years. It begins when the FAA receives an application from the manufacturer for type and production certificates. The process is characterized by a progression of design and testing activities conducted by the applicant and reviews for compliance by the FAA project team, punctuated by a small number of meetings --perhaps four to six--of the Type Board at critical decision-making points. Once the FAA project team has familiarized itself with the application, the board holds a preliminary meeting, attended by the FAA team and its applicant counterparts, to make an initial evaluation and to identify the pertinent design certification cri- teria, including the regulations, standards, and criteria that the applicant must meet, and the means by which the applicant must demonstrate compliance. An interim meeting is held two to three years after the initial meeting to review the general progress and to settle any additional requirements. In the meantime, the applicant may undertake steps that rely on informal, interim decisions concerning Special Conditions that may be imposed. It does this because manufacturers are com- mitted far in advance to aircraft delivery dates. Not to do so would run the risk of delaying the project to await the final approval. The penultimate milestone is a preflight meeting of the Type Board at which, in addition to reviewing the overall progress of the project and identifying items that remain to be resolved, the board issues a Type Inspection Authorization. This document authorizes the FAA pilots to begin test flights to determine if the work has been accomplished. At the final meeting, in confirmation that all requirements have been met, the Type Certificate is issued. FAA Personnel and Organization Rule making and type certification call for engineers and scientists--airworthiness professionals--of high technical competence. The organizational and technical qualities that are desirable for rule-making personnel are similar to those required for making the critical governmental judgments in applying the rules and stan- dards to the certification process for a new type design.

OCR for page 19
21/Type Certification and Rule Making The assurance of acceptable airworthiness rules and standards must proceed from a knowledgeable FAA staff of sufficient capability and depth to provide leadership and, when necessary, to challenge the industry. Simi- larly, the type certification system presumes a high level of quality on the part of the government certifi- cation staff in assessing the work of the manufacturer in designing a new aircraft. While much smaller in numbers than the manufacturer's staff, the FAA staff must be capable of holding the company to appropriate standards of design and proof, of going beyond the let- ter of the standard to provide interpretation and to ask the right questions, and, with the aid of company- employed Designated Engineering Representatives, of painstakingly checking the company's work to assure compliance. The attributes of technical expertise, assertive judgment and independent initiative within the FAA are critical to its success. Although there are many moti- vated and dedicated members of the FAA's airworthiness engineering staffs, based on its discussions with FAA and industry engineers involved in certification and other processes, the committee found a greater technical competence and state of the art currency on the part of personnel in the aircraft industry than in the FAA. In particular, the committee found that this situation existed with respect to type certification. While this difference cannot reasonably be expected to be otherwise at the detailed design level, in order for the FAA to be effective in making significant judgments, there is a need for more qualified, critical, and analytical oversight by the senior FAA staff than is presently exercised. The present quality of aircraft designs is satisfac- tory largely because of the proficiency of the companies and the designee system. Although FAA staff members have raised apt and constructive questions, their contribution stems largely from the process itself. Systematic educa- tion and briefing by company engineers of the FAA staff provide a useful checklist against which the applicant can gain increased assurance that it has not overlooked important matters. While this role is by no means a trivial contribution to the design and ultimate airwor- thiness of the aircraft, it is not a sufficient one.

OCR for page 19
IMPROVING AI RCRAFT SAFETY/2 2 At one time, the FAA staff included senior recognized experts and authoritative sources in the field of aero- nautics. One of the earliest books on aircraft flutter, for instance, was written by FAA employees Scanlan and Rosenbaum.' The agency's ability to perform its air- worthiness mission credibly, and to command the respect . . . . . . . . aviation community, depends on its regaining such recognizable expertise. The present situation with regard to the quality of FAA personnel can be traced in part to the current organizational structure which, as described below, does not foster an environment that attracts the best people. It is also a function of the history of the aviation industry. When aviation was a newer field of endeavor, opportunities were greater and challenges broader. As aircraft become more complex, those who oversee them become specialists in particular areas. Many government engineers and inspectors grew with the industry and de- veloped seasoned judgment from involvement in a variety of new designs and a rapidly growing enterprise. As these people now begin to retire and are succeeded by another generation, the newer FAA staff expect to enjoy fewer fundamental challenges and opportunities for inno- vation than were experienced by their predecessors. Although aviation continues to present many challenges, this problem is endemic to the FAA's present age and that of many other established regulatory agencies. A factor contributing to the lack of initiative by FAA staff, both engineers and inspectors, is their ex- pressed concern that if they attempt to go beyond the precise letter of the regulation in overseeing the industry they will not be supported by their supervisors or by the Washington headquarters staff. Yet in making judgments about the safety of aircraft, some interpreta- tion is necessary. The current FAA organizational structure, which allocates type certification activities for the various categories of aircraft among several regional offices, results in a superficial level of technical oversight. The structure accounts, in part at least, for frag- menting the work of engineering specialists among many different functions, inconsistent interpretations of regulations from one regional office to another, and a lack of communication among personnel in the regional and headquarters offices on matters of common interest

OCR for page 19
23/Type Certification and Rule Making and experience. It also contributes to the agency's evident difficulty in attracting a sufficiently capable corps of engineering experts and specialists. In the Western and Northwest Regional Offices, where certification of new domestic transport aircraft is con- centrated, the work assignments of the engineering staffs are not limited to the certification of new aircraft types. The amount of time devoted to other functions varies according to specialties and the phase of design and test work in which the transport manufacturer is engaged. The two regions reported that their personnel devote, on the average, 60 to 75 percent of their time to such "other" related activities as the certification of modifications to existing jet transports, to business jets, and, perhaps primarily, to the review of service difficulty reports, service bulletins, and other kinds of in-service surveillance and remedial action. The regional engineers are also occupied by a variety of administrative tasks. Accordingly, they are stretched beyond their capacities of both expertise and time by bulges in the workload caused by new type certification, supplemental type certification, or special assignments. Problems due in part to the regional structure are demonstrated also by inconsistencies in the application of standards between the Western and Northwest Regional Offices. For example, while one region proposes to apply to one manufacturer, retroactively, the amendment to the rules relating to "accelerate-stop distances," (the min- imum allowable runway lengths for an airplane to accel- erate and stop safely, depending on its gross weight, speed, prevailing weather and runway conditions) the other office chose not to do so with other manufacturers during approximately the same period.* An example of inadequate exchange of knowledge between regions is the fact that nine months after the Chicago accident, as this committee was informed, the engineering staff of the Northwest Regional Office had *According to FAA personnel, Boeing, in the Northwest Region, is resisting the accelerate-stop rule because it claims that the 757 therefore will be at some competitive disadvantage when compared to the DC-9-80. Douglas, in the Western Region, is resisting the same rule because it claims that the DC-9-80 will be at a competitive disadvantage to the 737.

OCR for page 19
IMPROVI NG A I RCRAFT SAFETY/ 2 4 received no formal briefings on the relevant technical issues by representatives of the companies, by the Western Region's type certification team for the DC-10, or by the investigators of the accident. The committee observed an especially important problem of the FAA's attenuated organizational structure: the pool of engineering talent is so shallow that many senior positions have remained vacant for several months. The Western Regional Office, whose airworthiness juris- diction extends to Douglas, Lockheed, and a number of airlines, which is in the process of certificating the DC-9-80 and has just finished the certification of the L-1011-500, provides the most dramatic example. The office has operated for nearly a year with many vacant positions, including those of regional director, deputy director, and chief engineer would serve Certification Board. engineer. If on board, the chief as chairman of the regional Type addition to organizational structure, the committee identified a number of other factors that may contribute to the FAA's present inadequate level of technical currency and competence: Inadequate and ambiguous direction, supervision, . . and support ot stats, resulting in confusion about priorities, reluctance to assert govern- mental prerogatives, and low morale. Cumbersome Civil Service and personnnel regula- tions and artificial career barriers that have, for instance, blocked adequate advancement and recognition of nonsupervisory technical specialists. Difficulties in attracting and hiring new grad- uate and experienced engineers, particularly in the Los Angeles region where living costs are unusually high. Lack of a stimulating atmosphere and peer asso- ciation, which is essential for a-thriving technical organization. Lack of resources and incentives for continuing education of technical personnel as well as a systemwide failure to provide adequate oppor- tunities for essential training in new areas of aviation technology. Competition in the allocating of new positions from operational components of the agency, such as air traffic control. .

OCR for page 19
25/Type Certification and Rule Making While the functions of rule making and type certifi- cation are similar and call for equivalent expertise and judgment, they are not congruent with the function of day-to-day reviews to assure compliance with established standards. Rule making and type certification require personnel of high technical competence, able to address the right questions about new technological features, including those for which guidelines have yet to be established. No less vital, but decidedly different, are the technical audit and surveillance functions which require personnel generally familiar with the state of the art and with production and maintenance techniques and procedures, rather than with evolving technologies. The administrator has recognized and taken steps recently to deal with some of these concerns. In October 1979 he announced the intention to recruit a number of "national resource specialists" in such technical dis- ciplines as aeroelasticity, advanced materials, special manufacturing processes, and airline maintenance tech- niques.8 In April 1980, he advised our committee that he was exploring the merits of selecting either the Western or Northwest Regional Office as a "lead region" to coordinate type certification activities for transport aircraft. The "lead region" concept is already being employed for such other aspects of FAA certification responsibility as engines and helicopters. The committee's recommendation goes even further. In the committee's view, the availability of outstand- ingly qualified airworthiness specialists is the sine qua non of the FAA's airworthiness activities, and spe- cialists of high calibre are not being attracted to the current organization. The committee, therefore, re~om- mends that the FAA establish a oentraZ engineering organization, staffed with teohnioaZ personnel of the highest competence, responsible for type oertifioation- ond portioipation in rule making. Located in an appropriate environment, possibly adjacent to a government center of aeronautical research and under the leadership of a-recognized authority in aeronautical engineering, the proposed central engineer- ing organization would be charged, ultimately, with the following tasks: (i) the accomplishment of rule making in relation to airworthiness matters, including the interpretation of existing regulations and the identifi- cation of related research needs; (ii) the reponsibility

OCR for page 19
IMPROVING AIRCRAFT SAFETY/2 6 for the key governmental decisions affecting design phi- losophy and criteria involved in the type certification of new aircraft and Supplemental Type Certificates, thus assuming the functions of the Type Certification Boards but not replacing the regional offices' project teams that work, on a day-to-day basis, with the applicants and the designees; and (iii) other related matters call- ing for combining specialized and expert technical knowledge with experienced judgment. Members of the centralized organization would thus be available as needed to all FAA offices throughout the country, and would have the advantages of the mutual reinforcement and common experiences gained from working on many of the same types of problems as they arise from rule making and certification activities. By regular and frequent participation in design reviews and similar functions, the team members would be continuously in- formed about new technologies and other innovations. They would be required to maintain a high level of tech- nical skill. By continuous interaction with several companies and associations, these airworthiness spec- ialists would be able to function as an inter-industry forum. While taking care to safeguard proprietary information, the specialists could work as a team to transfer from one type certification experience to another the safety principles learned. Once it is fully organized, the central organization should comprise one-half to three-quarters of the FAA's present complement of 318 aerospace engineers and 50 flight test pilots, and take responsibility for most of the airworthiness engineering functions related to rule making and aircraft design. A comparatively small num- ber of engineers would remain in the regional offices for day-to-day operations, to provide sign-offs and spot- checks of the work of the type certificate applicants, and to continue to oversee the remaining important regional activities involving the certification and surveillance of production, maintenance, continuing air- worthiness, and responses to service difficulties. These functions are best served from regional offices close to the production and maintenance facilities. The functions and location of the present staff would be changed under the proposed plan, though no significant increase in the number of positions is expected.

OCR for page 19
27/Type Certification and Rule Making This reorganization cannot be accomplished all at once. Initially, a cadre of 20 to 30 specialists should be put in place to undertake the rule-making functions and to assume the more limited responsibilities of the Type Certification Boards. A five-to-seven-year transition period would probably be required to reach the ultimate goals of the proposed reorganization. An improved and centralized engineering organization is, in the committee's judgment, a prerequisite to up- grading the quality of the FAA staff. The agency needs to devise a means for attracting more experienced spe- cialists than it presently has--a difficulty the commit- tee recognizes is neither unique to the FAA nor easily remedied in any government agency. Even working within the constraints of the Civil Service System, however, the FAA should be able to find the relatively small number of experienced specialists required in private industry, other federal agencies, and universities. Certainly, the FAA would have to pursue a vigorous recruiting campaign to attract the engineers and scien- tists best suited to the central engineering organiza- tion; and the challenges and rewards of such an organi- zation would have to be made sufficiently attractive to induce experienced professionals to make career changes to become airworthiness professionals for the FAA. The possibility of building and nurturing a technical organization of high competence and esprit de corps by centralizing technical functions has ample precedent in The early National Advisory Committee for government. Aeronautics (NACA) and the Department of Defense's weapons systems programs (e.g., the nuclear-powered submarine, the SAGE network, and the ballistic missile program) all stimulated the enthusiasm of the engineering and scientific communities and attracted highly qualified experts into government service to manage and implement the efforts. Less visible examples of continuing acti- vities that also attract highly motivated and capable people include the Air Force's Materials Laboratory, its Arnold Engineering Development Center, and NASA's numerous specialized programs in aerodynamics, materials and structures, avionics, propulsion, aircraft operating problems, and flight tests carried out at a number of facilities throughout the country. These programs confirm the committee's judgment that some of the United States' best engineering talent can

OCR for page 19
IMPROVING AIRCRAFT SAFETY/28 and should be attracted into the FAA's airworthiness organization. To do that, the organization needs: Recognition that aviation safety provides an important and challenging assignment. Outstanding professional leadership that will attract good engineers seeking positions under experts in their respective fields. Substantive responsibility and influence over project elements. Association with colleagues of high qualifica- tions to provide a stimulating internal atmos- phere. Opportunities for career advancement that reward merit and expertise as well as supervisory responsibilities. A stimulating environment that provides oppor- tunities for associations with nearby universi- ties and research establishments. Opportunities for further study and professional growth. With regard to the last point, it is important to note that, while individuals with a science or technology orientation need to be exposed frequently to the state of the art and emerging technological possibilities, it is not necessary or desirable for the FAA itself to manage such recurrent educational programs. There are litany people oucs~ae One ~ AA who can teach new technolo- gies as well as those who want to learn about them. It is presumed that such programs could be arranged to meet the needs of the FAA and of others at the same time. Organized and structured continuing education is not the only means by which the technological currency of FAA personnel can be maintained. For example, the FAA might consider a rotation or exchange program for its personnel to spend Perhaps a year or more attached to either public or private, in the United States or abroad, at such places as NASA, Air Force laboratories, research establishments, manufac- turers, and universities. . an ~ _ ~ ~ _ ~ ~ a_ ~ _ _ . . ~ ~ ~ % ~1 other organizations, on the resources devoted An indispensable part of such a program is a suffi- ciency of travel and other funds to support it. To skimp _~ to building and maintaining a requisite level of FAA staff competence places the sys- tem's efficient operation in jeopardy over the long run and threatens the agency's mandate to provide "the highest degree of safety" in flight.

OCR for page 19
29/Type Certification and Rule Making The collection of the FAA's engineering talent into a single, coordinated unit should resolve many of the problems of the current regional office structure, in- cluding too close alliance with any one manufacturer, and should result in a well-trained and technically qual- ified staff that can provide improved interaction with the manufacturers and their Designated Engineering Rep- resentatives (DER). It should also eliminate many inconsistencies in interpretation and application of regulations. It is the committee's view that this revised organi- zational structure for airworthiness engineering, coupled with a recommendation to improve the type certification process (described later in the report) will result in a significant improvement in the quality of airworthiness certification and the overall effectiveness of the FAA. Designated Engineering Representatives About 370 FAA engineers are occupied with the certi- fication of aircraft of all types. Half of these are in the two regions with responsibility for Boeing, Douglas, and Lockheed. The FAA regional project engineering and flight test team certificating a new transport consists of 20 to 30 professionals, most of whom also perform other duties. By contrast with the number of FAA engineers, Boeing estimates it will concentrate about 4,000 engineers on its new 767 transport at the peak of its design effort. As a measure of the volume of work to be performed and reviewed, Lockheed has reckoned that, in the course of certificating a new wide-body aircraft, it would submit approximately 300,000 engineering drawings and changes, 2,000 engineering reports, and 200 vendor reports. In addition, it would subject the airplane to about 80 major ground tests and 1,600 flight test hours. Throughout this period, it would send some 1,500 letters to the FAA.9 FAA engineers cannot review each of the thousands of drawings, calculations, reports, and tests; yet the agency must be certain that the design for a new airplane meets all the regulatory requirements. The certifica- tion process thus depends not only on a review of high

OCR for page 19
IMPROVING AIRCRAFT SAFETY/3 8 What is lacking is initiative--a systematic means for determining where new rules are needed, the ranking of priorities, and the development of the necessary technical bases, where absent, for rule making. In light of these findings, the committee recommends that the FAA take more initiative in identifying the need for new razes and in establishing objectives, priorities, peons, and sokeduZes for rule making and that it sponsor onnuaZ ruZe-making review conferences to support this activity. To provide the means for problem identification, the FAA should reinstate annual government-industry airwor- thiness reviews. Such reviews were convened by the Civil Aeronautics Board before rule-making functions were transferred to the FAA in 1959, and were eminently suc- ce~sful. Under that system, for example, the rules necessary for certificating the initial fleet of jet aircraft were developed in a timely manner, enabling the United States to assume quickly a leading position in commercial jet aviation. The FAA attempted to revive this activity in 1974 with its all-embracing Airworthiness Review, the first in a planned biennial series. However, the bulk and comprehensive nature of the review, and the failure to limit its agenda, swamped the capability of the FAA to deal with the many recommendations. As a result, many of the recommendations still await action. Examples include: or life limits on, Type Certificates;14 changes in accelerate and stop distances;15 concern over regula- tions dealing with failure analysis and numerical prob- abilities;16 and such "key design elements" as "com- partment fire protection, emergency exits, seats and shoulder harnesses".17 Discussions with former FAA officials, and with in- dustry personnel who participated in past reviews, have convinced the committee that this process is a good one, provided that the review is well organized, the agenda is planned in advance, and the FAA follows through in a , _ , the desirability of requiring revalidation of, ~, businesslike way. The same procedures should be used for identifying the need for new standards, for discus- sing their significance, and for determining the state of the art necessary to write the rule. The process for planning and setting priorities, once the need for a new or updated rule has been iden- tified, should be managed and carried out by the FAA

OCR for page 19
39/Type Certification and Rule Making staff. Probably it was at this stage that the 1974 Air- worthiness Review failed. From discussions at the re- view, from additional industry and public comments, and from its own knowledge, FAA management and technical staff should be able to determine a priority ranking for its rule-making activity. From such a ranking, it should be an easy matter to develop a plan and schedule for rule making--in effect, a calendar--in considerable detail for the following year, and in lesser detail for the succeeding five years. The calendar should take into account the available re- sources, the need to obtain or develop the underlying technology base, and the administrative process of writ- ing, reviewing, and publishing the rule itself. The calendar should also leave sufficient room, on a planned basis, for reactive rule making--the requirement quickly to a failure, an accident, or an unanticipated technological need. Generally, by the time a technology is advanced to the point where it can be considered for incorporation into an aircraft, the research and development necessary to complete a rule should be capable of being scheduled. In other words, the research generally is not of such an advanced nature that its outcome is completely unknown or its impact unforeseeable. The research and development in support of FAA rule- making activity can be carried out for the most part by other government agencies (e.g., NASA and the Air Force), by universities, and by private industry. The committee has reviewed the existing relationship between the FAA and NASA, and has found that, while the mechanisms for coordination have been established, they are not being used effectively. Given NASA's statutory responsibility for aeronau- tical research,18, the FAA should request that agency to strengthen those research programs that lay the basi for future rule making. A formal interagency agreement between NASA and FAA could be established through which FAA submits requirements to NASA in accordance with FAA developed priorities and plans. NASA could perform the necessary research and development on a predetermined time scale. Such formal agreements should not take the place of the many ongoing technical meetings and discus- sions, but rather should reflect the outcome of these discussions in a way that the FAA can incorporate in its planning process. to react

OCR for page 19
IMPROVING AIRCRAFT SAFETY/4 0 NASA is not the only possible source for research to meet the FAA's rule-making needs. The Air Force, for example, has done a great deal of research directly ap- plicable to airworthiness matters. If other public or private resources can assist the FAA with its research needs, the FAA should enlist their aid. The recommended central engineering organization would play a significant role in this and all other aspects of the rule-making process. If this organization were to be located in proximity to an existing research center, the coordination required for technology devel- opment might be greatly facilitated. The administrative process for rule making, as recently modified by the FAA with its project team con- cept, appears to be improving--although it is still too early to tell just how much. As an additional task, the FAA should develop a systematic approach to updating the entire body of Federal Aviation Regulations. While scheduled rule making and annual conferences can be expected to address new standards reflecting advancements in knowledge and new design practices, the systematic up- dating of the regulations should result in revising or deleting rules and criteria that have become obsolete. Even if a small fraction of the regulations--perhaps 10 percent--were redone each year, such action would fulfill within a decade the need that has been evident for at least the same period. This task being never finished, the FAA should perpetuate both the annual review and updating of the regulations. Flight After Failure--A Specific Rule While the purpose of this study has been to evaluate the procedures by which the FAA and industry together assure airworthiness, the committee has been mindful throughout its deliberations of the fact that the acid test of a process lies in the substance it produces, not in its organizational elegance. The substance of rule- making and type certification procedures is thus properly measured by the technical adequacy of the adopted stan- dards or regulations and the quality of the judgments and decisions reached in applying the standards to the design of a new aircraft.

OCR for page 19
41/Type Certification and Rule Making It is in the nature of every complex technological system that all possible risks--even mechanical ones-- cannot be anticipated and prevented by the design. Most safety standards have evolved from the experience of previous errors and accidents. Airplanes built in ac- cordance with current standards are therefore designed essentially to avoid the kinds of problems that have occurred in the past and to tolerate operational abuses deemed likely to occur. The high safety performance of the modern jet transport provides assurance that the current standards, which address the risks we now recog- nize, are sound. The designer seeks to anticipate and defend against likely malfunctions and hazards that could defeat the component being designed. However, many of the fatal accidents that have occurred with airplanes manufactured by companies visited by the committee have involved rare and improbable combinations of mishaps, aspects of which were outside the "design environment" of the components in question, such as maintenance-induced damage, unde- fined weather hazards, and damage sustained outside the operating regimes. To comply with current FAA require- ments, the designer of a new aircraft may establish that structural components that are critical to safety comply with the rules by either of two kinds of analyses. One involves the concept of "safe-life," which means that a structural component or assembly must be designed to retain its strength and integrity throughout its useful life. Landing gears, propeller blades, and engine fan blades are examples of safe-life parts. Whenever appropriate, structures may also be designed to satisfy the concept of "fail-safe." Here, safety is assured through the provision of redundancy. This means that the designer must show, through a variety of analyses of possible failure modes, that if the fail- safe part is crippled, another redundant or backup part is available to do its job sufficiently, at least to permit a safe landing. For instance, a typical fuselage Panel is designed with doubler strips that stop cracks while the additional members of the panel pick up the loads until the cracks can be detected and repaired, usually at the next scheduled maintenance. - trom progresslnq

OCR for page 19
IMPROVING AIRCRAFT SAFETY/4 2 FAA procedures do not normally require the designer to take into account, by analyses, the hazard to one component from the failure of some other component that was designed to meet safe-life or fail-safe standards. This has not been required because to do so would appear to involve a contradiction of the definition of these two structural design bases: why take into account a failure that cannot occur? These procedures, however, fail to take into account an important consideration: structures designed not to fail when subjected to conditions within the design environment sometimes do fail, usually as a result of hazardous conditions outside the design environment. Examples of such hazardous conditions might include maintenance-induced damage, hard impact by ground ser- vicing equipment, cargo-induced damage, or perhaps even faulty quality control during manufacturing. The simple fact is that during the long life of many fleets of air- craft, with millions of operations, one cannot guarantee that such damage will not occur. When one goes beyond matters of structure design to consider similar design approaches to aircraft systems, the problems can be compounded. Critical control sys- tems, for instance, are designed so that the probability of failing can be demonstrated to be "extremely remote." The convention normally applied to this definition is a calculation showing that the probability of failure is one-in-one-billion (10-9) flights. However, critical control systems also have failed from causes outside the system design environment. The failure of a safe-life or fail-safe structure that surrounds such systems is currently not required to be considered within the sys- tem~s design environment. Thus it is not taken into account when analysing possible modes of systems failure. The accident in Chicago* involved presumably incon- ceivable combinations of events: the one-in-a-billion failure of critical control systems caused by the im- probable failure of a fail-safe component. That fail- ure, in turn, resulted from maintenance-induced damage not considered within the design environment of either the structural or systems components. In the committee's judgment aircraft design prin- ciples should take into account the potential of struc- tural damage caused by conditions outside the design *See Appendix B.

OCR for page 19
43/Type Certification and Rule Making environment, and should seek to prevent catastrophic effects resulting from such damage. Specifically, the oo~ni~ttee re~orr~nends that the FAA develop a rule requir- ~ng assurance Chat an aircraft is designed to Continue to fly after st~ot~raZ failure, unless that failure itself prevents the aircraft from flying. There are obviously some kinds of failure--a wing torn off in a mid-air collision--that, by themselves, prevent the aircraft from continuing to fly. In the Chicago accident, however, a primary failure led to a series of secondary failures of flight control systems which, by making it impossible for the pilot to recover, were the actual cause of the accident. It is this kind of situation that justifies the need to go one step be- yond the design assurances now required. The recommendation would require that formal design consideration be given systematically and routinely to the consequences of the possible failure of critical structure and systems, even though these can be shown by analysis to meet design standards presumed to preclude failure. Structural elements or systems that could be rendered critical to continuing flight, because of the initial failure of a primary structure, must be designed to avoid or minimize being crippled or damaged by such initial failures. While the principle underlying this proposed rule has not been generally applied, there are examples of its application to specific cases, developed in response to accidents that have occurred. One is the decompres- sion venting of wide-body aircraft. The designer takes into account unanticipated structural damage resulting, for instance, from the inadvertent opening of a cargo door or from a mid-air collision, which could cause floor failure, and a secondary problem, such as the possible interference with control cables. A second example is the requirement that design consideration be given to the trajectories of disintegrating engine parts, even though such parts are designed to safe-life criteria. The committee believes, moreover, that, with the acceptance of this recommendation, the FAA should examine currently certificated type designs to determine if they substantially and reasonably comply with the rule that would result from this recommendation. In cases where they do not, it should consider issuing appropriate Airworthiness Directives to accomplish changes that can

OCR for page 19
IMPROVING AIRCRAFT SAFETY/4 4 reasonably be made or to permit exemptions for any special circumstances that may exist. The Issue of Public Access The special issue just cited is one example of a rule-related problem that is often first identified in the course of type certification decisions. Other rule- making issues also arise during the certification process in the regional office. Several of these, including cockpit design, the interpretation of cabin safety, and the methods for determining crew complement, affect in a direct way other parties as well as the manufacturers and airlines with which the regional offices customarily deal. Some could later affect other manufacturers, such as the proposed retroactive imposition of an amendment to the regulations dealing with accelerate-stop distances. The committee has heard many proposals for "openness" in the certification process, especially with respect to the issues raised in this study. We find that much of the debate on the subject of openness involves a con- fusion between the right of the public to be heard in setting new standards (which is a formal rule-making function in which the public clearly has the right to participate) and the desire of the public to appear be- fore, or even become voting members of, the Type Certi- fication Board. The board is a decision-making body only of FAA employees, in whose ultimate decisions the public should not participate. FAA practices may inad- vertently have added to the confusion in that certain rule-making decisions--Special Conditions, exemptions, or the retroactive application of amendments to the regulations--are usually made in the course of type cer- tification without providing the normal period for notice and comment characteristic of formal rule making. The committee recognizes that, in the course of reaching formal decisions in these respects, there is a vital element of negotiation that is best accomplished by the parties most concerned--i.e., the FAA and the applicant manufacturer. Moreover, there are instances in which proprietary information is justifiably held in confidence. Even so, the committee recognizes the right

OCR for page 19
45/Type Certification and Rule Making of the public to be heard in rule-making decisions, es- pecially in the case of parties who are both knowledge- able and interested in the consequences of such deci- sions. Therefore, the committee recommends that the FAA publish, as a notice in the Federal Register, the avaiZ- abiZity of the FAA-approved preliminary regulatory and certification bases for new aircraft type design, With subsequent puLZioation of Changes thereto, to permit time by review and comment by the pubZio and response from the FAA. In making this recommendation, we seek to accommodate two equally important objectives: (i) consistent with the Administrative Procedures Act, the public should be given notice of rule-making decisions that are being contemplated, and the FAA should receive and take into account all pertinent information or recommendations prior to making its final decision; and (ii) consistent with the statute, any manufacturer may apply to the FAA and hold confidential any information provided to the FAA that would adversely affect the company's interest, as long as the information "is not required in the interest of the public.''l9 In practice, we are recommending that the regional offices, through their respective Type Certification Boards, increase the observance of rule-making formali- ties with respect to their special rule-making decisions --just as they now do in issuing Airworthiness Direc- tives when time permits in nonemergency cases. The com- mittee envisions the situation where, subsequent to providing notice concerning the regulatory and certifi- cation bases, the Type Certification Board would invite all interested parties to make formal submissions for review at one of its early meetings. Thereafter, within a reasonable specified period of, say, 30 to 60 days, the board, on behalf of the FAA, would be required to make a formal, written, and public response to the issues raised, addressing their merits and providing available supporting data.* *The relationship of the public to the activities of the Type Certification Board is also being reviewed in the Congress. At least one bill relating to the matter, S. 11433 (95th Congress, 1st Session), is being con- sidered in the Senate Committee on Commerce, Science, and Transportation. A companion bill, H.R. 4679, also has been introduced in the House of Representatives.

OCR for page 19
IMPROVING AI RCRAFT SAFETY/4 6 The procedure contemplated should in no way restrict the type board or design certification project engineers from also seeking additional technical advice and counsel from such appropriate sources as other government agencies and individual specialists and consultants, paid or volunteer, from industrial and academic set- tings.

OCR for page 19

OCR for page 19