Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Introduction and Summary of Recommendations In creating the Federal Aviation Administration (FAA) 22 years ago, the U.S. Congress directed the agency to as- sure "the highest degree of safety" in flight.1 With respect to airworthiness, i.e., the physical integrity of the airplane, the FAA carries out its mandate in a number of ways: It establishes, at its headquarters office, technical design standards and regulations through its rule-making powers. It assures, in its regional offices, that each new type of aircraft (e.g., the Boeing 747, the McDonnell Douglas DC-10, or the Lockheed L-1011) is designed and manufactured in accordance with the rules and standards set forth in the estab- lished Federal Aviation Regulations (FARs), and is subject to a process that ultimately awards the manufacturer a design Type Certificate and a Production Certificate. It establishes, also in the regional offices, a system for reviewing the fabrication of air- planes and for issuing an Airworthiness Cer- tificate for each one. It employs a system of inspections and surveil- lance, at district offices within the regions, of the flight operations and maintenance pro- cedures of the airlines to make sure that each aircraft adheres to FAA standards of continuing airworthiness. 1
IMPROVING AIRCRAFT SAFETY/2 In addition, the FAA approves repair and overhaul stations, and licenses some mechanics who work on the equipment or who inspect the work of others. During the course of production and maintenance, it reviews and approves the processes and procedures of the manufac- turer and airline. If violations are found at any stage, the FAA has the authority to enforce its regulations through warnings, fines, or revocation of licenses and certificates. The FAA is organized into 12 regions reporting to its Washington headquarters. Its total employment is 57,490, with the largest segment of the staff assigned to air traffic control. The airworthiness function, which is the subject of this report, employs approximately 3,000 people.2 Large jet transport aircraft are produced in the United States by three companies, Boeing, Douglas, and Lockheed, 3 and operated in passenger service by some 30 U.S. air carriers. In addition, aircraft produced by two European concerns (British Aircraft Corporation and Airbus Industrie) and one Japanese company (Nihon) are also operated by U.S. carriers. Aircraft types range from the smaller twin-engine B-737 and DC-9 to the three- and four-engine wide bodies, the L-1011, DC-10, and B-747. The United States can be proud of its air transpor- tation system, with an industry at the forefront of technology and innovation that employs more than half a million people, and a favorable trade balance from air- craft exports that approached $10 billion in 1979.4 A passenger airliner takes off or lands somewhere in the United States on the average of every three seconds, around the clock, every day of the year. In 1979, 318 million passengers flew a total of 256 billion miles --some 1 million times the distance to the moon. The number of passengers carried by domestic airlines has risen 75 percent in the past decade. Out of a total of 301 million passengers, 350 people died in U.S. commercial aviation accidents last year, with a passenger fatality rate of 0.115 per 100 million passenger-miles flown; this compares to 16 deaths in 1978 and 460 in 1974, the worst year in the past decade (0.005 and 0.197 passenger fatalities per 100 million passenger-miles respectively).5 Since the introduc- tion of jet-powered commercial flight in 1958, U.S. air
3/Introduction and Summary of Recommendations carriers have been involved in 216 accidents resulting in fatalities. Only 16 of these were attributed pri- marily to failures of a jet aircraft or its equipment (see Appendix C), according to data from the National Transportation Safety Board, which is responsible for investigating and assigning "probable cause" to airplane accidents.6 The balance was attributed to the cate- gories of human error in flight and the air traffic control system. Indeed, it is these three elements that contribute to the safety of aviation: (i) the airplane itself--how it is designed, built, and maintained; (ii) the national aviation system--the airports, airways, and the control of air traffic; and (iii) the airline flight operations that deal with the control of the aircraft. Although these elements are interrelated--how the airplane is flown depends on the handling qualities of the aircraft and on the instrumentation available to the pilot--they can be and often are addressed separately. Even though the airworthiness of the machine itself, the subject of this study, accounts for a relatively small portion of all aircraft fatalities, it is evident that even a single fatal accident of, say, a wide-body transport carrying hundreds of passengers is a matter for great concern and soul-searching. In the aftermath of the American Airlines' DC-10 accident over Chicago on May 25, 1979,* in-depth accident and engineering inves- tigations were performed by the safety board and the FAA, and hearings were held by various Congressional commit- tees. The accident lent added urgency, for instance, to an ongoing study by the U.S. House of Representatives' Government Activities and Transportation Subcommittee of the Committee on Government Operations, the May 7, 1980 report of which addresses many of the same matters considered here. Aircraft safety demands a "forgiving" design that tolerant of failure, careful production that is of the highest quality, and excellent maintenance that gives painstaking attention to detail throughout the life of the airplane. The rare fatal accident that involves *When incidents or accidents are used as examples, they are referred to in the text as necessary. Further infor- mation on two accidents is found in excerpts from the official reports in Appendix B.
IMPROVING AIRCRAFT SAFETY/4 airframe or equipment is almost without exception the result of a failure of at least two, and occasionally all three, of these factors. For example, in the 1977 accident of a Dan-Air, Boeing 707 aircraft in Lusaka, Zambia,* a redundant or backup structural element in the horizontal stabilizer failed to carry the load after the primary element failed. This was clearly a design fault. Yet if more thorough inspection techniques had been used, or if knowledge of fatigue problems had been more widely shared, fatigue cracks would have been found before they grew to critical size. Individual failures of a significant nature are relatively rare and combinations of failures that lead to serious accidents are unlikely. Yet with the vast number of flight operations that take place over the period of a year, even the unlikely event can occasion- ally occur. The achievement of our air transportation safety record has its basis in the development, over the past half century, of necessary strengths on the part of both the federal government and the air transport industry. Even so, as described in the body of the report, and summarized below, the committee finds that the technical competence and up-to-date knowledge required of people in the FAA have fallen behind those in industry. As air- craft become more sophisticated, complex, costly, and numerous, and as the generation of government engineers and inspectors, who gained broad knowledge and experi- ence as the industry was developing, begins to retire, the FAA staff face fewer challenges and reduced expecta- tions, a situation characteristic of a second generation situation characteristic ot regulatory agency. Many of the committee's specific conclusions and recommendations for improving the airworthiness system flow from this central finding. - Is the excellent safety record a goon predictor or the continued safety of large transport aircraft in the future? Not necessarily. How- ever, we hope that the recommendations that follow, many of which concern the need for personnel and organiza- tional improvement, will help to make it so. A report such as this, with many recommendations, necessarily emphasizes shortcomings and opportunities for improvement. We urge the reader to bear in mind, *See Appendix B.
5/Introduction and Summary of Recommendations therefore, that we have discovered nothing in the course of this study that would lead us to conclude that the confidence gained in the airworthiness of our nation's transport aircraft is unwarranted. In this respect, the safety record speaks for itself. But, as reassuring as this record should be to passengers and purchasers of such aircraft alike, we do not counsel complacency for the decisionmakers who are responsible for continued flight safety. The airworthiness system can and should be improved. Type Certification and Rule Making The processes by which the FAA seeks to assure the inherent safety or airworthiness of aircraft are type certification and rule making. Type certification in- volves assuring that the manufacturer's new design for a particular type of aircraft complies with the statute and all applicable rules and standards. Rule making consists of establishing the regulations and technical standards that must be met by manufacturers and airlines in the course of designing, producing, operating, and maintaining the aircraft. The FAA's engineering staff needs to be strong in order to deal effectively with its counterparts in industry. The organizational and technical qualities that are desirable in rule-making personnel are similar to those required for making the critical governmental judgments in applying the rules and standards to the certification process for a new type of design. A1- though there are many motivated and dedicated members of the FAA's airworthiness engineering staff, the regional structure of the agency, and other factors have contri- buted to a lesser technical competence in the FAA, espe- cially in the offices where type certification is per- formed, than in the aircraft industry. Consequently, the level of technical oversight is becoming superficial. Moreover, this structure accounts, at least in part, for fragmenting the work of engineering specialists among many different functions, for inconsistent interpreta- tions of regulations, from one regional office to an- other, and for a lack of communication among regional office and headquarters personnel on matters of co~,~,,on interest and experience. It also contributes to the
IMPROVING AI RCRAFT SAFETY/6 agency's evident difficulty in attracting a sufficiently capable cadre of highly qualified engineering experts and specialists--a difficulty, the committee recognizes, that is neither unique in the federal government to the FAA nor easily remedied. In the committee's view, however, the availability IS of outstandingly qualified airworthiness specialists the sine qua non of the FAA's airworthiness activities. Specialists of high calibre are not likely to be at- tracted to the current organization. A centralized engi- neering organization is thus needed, led initially by a cadre of 20 to 30 senior experts, and charged ultimately with the following tasks: (i) the accomplishment of rule making in relation to airworthiness matters, including the interpretation of existing regulations and the iden- tification of related research needs; (ii) the respon- sibility for the key governmental decisions affecting the design philosophy and criteria involved in the type certification of new aircraft and supplemental type certification, thus assuming the functions of the Type Certification Boards but not replacing the regional offices' project teams that work, on a day-to-day basis, with the applicants and their "designees"; and (iii) other related tasks calling for combining specialized and expert technical knowledge and seasoned judgment. ire committee therefore recommends that the FAA estahZish a oentraZ engineering organization, staffed with teohnioaZ personnel of the highest competence, responsible for type certification and participation in rule making. [pp. 20-29]* FAA engineers cannot review each of the thousands of drawings, calculations, reports, and tests involved in the type certification process; yet the agency must be certain that each design for a new airplane meets all of the regulatory requirements. The present system thus depends not only on the quality of the FAA staff but also on the assistance rendered by aircraft company employees called Designated Engineering Representatives (DERs) who review the design and design process to make sure, on behalf of the FAA, that all aspects of the regulations are complied with. The "designees" are senior engineers *Page numbers refer to the place in the report where the recommendation is discussed.
7/Introduction and Summary of Recommendations employed by the manufacturers who possess detailed know- ledge of the design, based on a daily involvement that is not practical or for FAA personnel to achieve. Accordingly, the advantages of the designee system as an extension of the limited FAA staff are apparent. Yet the system is often criticized. The possible disad- vantage is the appearance, if not the existence, of a lack of independent objectivity--i.e., a form of conflict of interest for the designee who is in the position of serving two masters, the aircraft manufacturing firm that pays him, and the FAA to which he is expected to report problems. The committee finds, however, that potentials for conflict are checked in the following ways: (i) engineers are ethically motivated to maintain their repu- tation for technical integrity and professionalism; (ii) recognizing the stake of the manufacturer in assuring a safe, serviceable, and reliable airplane, the company's designees perform traditional engineering review tasks for the FAA that would, by and large, be performed for the company as well; (iii) the designees perform their work under the supervision of the FAA staff; and (iv) the FAA reserves to its own staff the most critical design decisions and approvals. As the system is presently organized, therefore, the committee concludes that the designee system for aug- menting the capability of the FAA to review and certify the type design is not only appropriate but indispens- able. The oorrenittee, therefore, re~orr~nends that the FAA continue to use Designated Engineering Representatives to perform the functions non delegated to them. [pp. 29-33 ] ~~ ~ Of greater concern, however, is the identification of what appears to be a trend toward placing more and more reliance on the manufacturer in the course of type certification. Toward the end of the certification pro- cedure, for instance, the designees submit large amounts of reports and calculations to their FAA counterparts for approval. While the requirement to make such submissions has value in assuring airworthiness in most cases the FAA staff performs only a cursory review of the substance of this great volume of documentation. Further, the process invites a review that focuses, however superficially, on the details, often at the expense of closely examining overall design concepts. The introduction of a more thorough and different kind of review than is now performed by the Type Certifi- cation Board is needed. Such a review should be con
IMPROVING AIRCRAFT SAFETY/8 ducted at key certification milestones or checkpoints, and by more knowledgeable, experienced, and specialized FAA staff of the kind recommended for the centralized engineering group. Special emphasis should be placed on the review, early in the process, of fundamental design concepts. Recognizing that this objective cannot be accomplished immediately, the committee concludes that, over time, the introduction of such ungraded milestone reviews would lend the high degree of technical quality in the FAA design review that is now lacking. The oom ~_ ~, _ ~ mitten thus recommends that the FAA adopt a Longer range objective to improve the type certification process through a series of milestone reviews of the design data to examine fundomentaZ Concepts and to assure oompZianoe with the fuZZ intent of safety regulations as ~eZZ as with their specific details. [pp. 31-33] While the principal guarantors of safe flight are, of necessity, the builders and the operators of the air- planes, the airworthiness system of checks and balances depends on the establishment and updating of the govern- ing safety standards for design, production, and main- tenance. The committee finds that the FAA's rule-making activity is primarily reactive to the needs of safety as determined from accidents. What is lacking most is initiative--a systematic means for anticipating needs, for identifying and ranking priorities, and for assuring the necessary technical base, where absent, for rule making. Updating of rules to eliminate obsolescent ones is also needed. 7he committee recommends that the Fig take more initiative in identifying the need for new rules and in establishing objectives, priorities, plans, and sokeduZes for rule making and that it sponsor annual ruZe-making review conferences to support this activity. [pp. 33-40] As it studied the record of aircraft accidents, as well as present design philosophies, the committee came to recognize a serious shortcoming in the current regu- lations and in how they are applied. The problem has to do with the interpretation of the regulations that per- mits a manufacturer to demonstrate in the design of an aircraft that certain failures simply cannot occur and that, once demonstrated, the consequences to other structure and systems of such an "impossible" failure need not be taken into account. in how they are applied.
9/Introduction and Summary of Recommendations This practice, however, fails to take into account an important consideration: structures designed not to fail when subjected to conditions within the design environment sometimes do fail, usually as a result of hazardous conditions _utside the design environment. Examples of such hazardous conditions might include maintenance-induced damage, hard impact by ground servicing equipment, cargo-induced damage, or perhaps even faulty quality control during manufacturing. The simple fact is that during the long life of many fleets of aircraft, with millions of operations, one cannot guarantee that such damage will not occur. In the committee's judgment aircraft design principles should take into account the potential of structural damage caused by conditions outside the design environment, and should seek to prevent catastrophic effects resulting from such damage. Of course, this theory cannot apply to the consequences of the kind of damage that by itself prevents the airplane from continuing to fly, such as a wing torn off in a mid- air collision. Specifically, the committee recommends that the FAA develop a rule requiring assuronoe that an aircraft is designed to continue to fly after struoturaZ foiZure, unless that faiZure itseZf.prevents the airoroft from flying. [pp. 40-44] In the course of certificating the design of a new aircraft, certain kinds of rule-making decisions (e.g., Special Conditions, exemptions, and the retroactive ap- plication of recent amendments to the regulations) are often made without benefit of public knowledge and com ment that are a part of normal rule making. Often, such decisions involve questions of cabin safety, crew com- plement, cockpit design, and landing and takeoff limita- tions--matters of concern to the crew and public as well as the FAA and the affected applicant. In order to pro- vide a legitimate measure of openness in this decision- making process, consistent with the need to preserve the confidentiality of proprietary information. the ~mmiLL recommends that the FAA publish, Federal Register, the avaiZabitity of the FAA-approved preZiminary reguZatory and certification bases for new aircraft type design, with subsequent puLZioation of changes thereto, to permit time Zy review and comment by the public and response from the FAA. [pp. 44-46] as a notice in the
IMPROVING AIRCRAFT SAFETY/10 Production and Maintenance While standards and design are necessary to establish the concept of a safe new airplane, it is in the produc- tion and continuing maintenance phases, which involve the labors of thousands of individuals with scores of differing skills, that the opportunities are greatest not only for assuring that aircraft are built and main- tained to established safety standards, but also for introducing (as well as avoiding) faults that could have later consequences. The means for assuring the adequacy of the production system involve various levels of company and FAA quality control surveillance. FAA inspectors review and approve the company's manufacturing procedures and quality con- trol systems, with the aid of company-employed Designated Manufacturing Inspection Representatives (DMIRs). From time to time, the agency also conducts detailed audits by quality assurance teams. While the procedures work quite well and are gener- ally well conceived, lapses in production have occurred and warn against complacency. Accordingly, the committee recommends that the FAA increase its emphasis on quality assurance in aZZ phases of the production process by increasing the frequency of Crudity Assurance Systems Analysis ond Review beam visits to atZ Production Certi- ftoate holders, and by expanding the responsibiZities of FAA inspectors and quality assurance teams to inoZude the observation of actual hardware. [pp. 50-53] Once a new aircraft leaves the manufacturer's plant for service with a carrier, the airline accepts respon- sibility for maintaining it. At the same time, the day- to-day FAA activity also shifts from the manufacturing review staff of the regional office to air-carrier in- spectors in the respective district offices, located near the principal airports of the country. The committee found wide differences in the practices of the FAA maintenance and avionics inspectors, espe- cially with respect to the extent of direct observation of the aircraft, the level of their maintenance inspec- tion activity, and their assertiveness. While the regu- lations make-them responsible for approving the carriers' maintenance programs, and changes thereto, the committee sees the system as allowing, and even encouraging, them
11/Introduction and Summary of Recommendations to view this responsibility as a passive one. Further- more, the committee finds that the detailed quality con- trol audit teams formerly employed to augment the in- spectors' ability to monitor the airlines' maintenance programs have been reduced to more infrequent visits. Because of the importance of maintenance to the continued airworthiness of the carriers' aircraft, the committee recommends that the FAA increase its surveiZ- Zanoe of air Zine maintenonoe operations, making use of a team approach for frequent ond unonnounoed inspections, and encouraging its air sorrier inspectors to give higher priority to strategioaZZy seZeoted on-site visits and hardware observations, both ranZomZy during aZZ shifts, and for specific maintenonoe procedures that they deem espeoiaZZy oritioaZ or imp or ton t. [pp. 53-58] With the exception of the flight crew, no group has a greater effect on aircraft safety than the maintenance workers at the airlines. It stands to reason that the _ skill levels of mechanics and inspectors should be of high quality and appropriate to the type and complexity of the particular aircraft on which they are working. Development over the past 30 years of the techno- logically sophisticated modern jet transport with in- creasingly complex components has led to rapid changes in the level of skills and knowledge required to maintain aircraft. The committee considers the current FAA sur- veillance and certification procedures for licensing mechanics and approving their training to be outdated and of limited effectiveness. There is no stringent standard comparable, for instance, to that for flight crews, for establishing the initial experience level or periodic upgrading requirement of the skills of mechan- ics who repair or service aircraft. Further, mechanics working on advanced avionics are not required to have special credentials. Considering these factors, the committee recommends that the FAA relies ond update the Licensing ond training certification requirements for air Zine maintenance personnel ond consider designating avionics as ~ sepo rate area for licensing, [pp. 58-60] FAA personnel must interact with their opposite numbers in the companies and airlines in a reviewing and approving (i.e., regulatory) mode, yet they must possess independence and objectivity. There is concern that too close and prolonged an association with the same com- pany's personnel poses the possibility that the requi- site characteristics of independence and objectivity
IMPROVING AIRCRAFT SAFETY/12 will be eroded. Reassignment to other companies could provide the advantage of fresh perspectives and new learning experiences. Accordingly, the committee re~om- mends thot the FAA adopt a system for reassigning its personnel on a periodic basis to deal with different manufacturers and Worriers. [pp. 60-61] While the designer participates directly in the preparation of the initial maintenance program, once the carrier begins to make modifications to it, the FAA does not require that the manufacturer holding the Type Cer- tificate be consulted before changes are made. Further, the FAA office responsible for approving such changes is not necessarily the same one that originally certificated the aircraft. It is possible, then, that some changes in the maintenance program, or modifications of the aircraft, will degrade the safety of the airplane in subtle ways that only the aircraft designer is likely to recognize. Procedures for removing and reattaching major components may have such significance, as may different aircraft jacking or towing conditions, or changes in liquids and gases used for servicing, purging or cleaning. In some cases, the manufacturer will have more detailed knowledge than the carrier of the inherent strength of the aircraft structure and its major components or their suscepti- bility to damage. A requirement that the FAA seek and obtain formal review by the manufacturer of any proposed significant modification, or variation in maintenance procedures, before the agency approves it, should in- crease the likelihood of early warnings of any dangers. With such considerations in mind, the committee recommends that the FAA assure that the monufaoturer (type oertif:oote ho idea) have continuing know Ledge of an operator Is maintenance procedures by obtaining the manufaoturer's forma Z review prior to authorizing any significant deviation from the approved maintenance program. SimiZorZy, it recommends that the FAA assure that the manufacturer be made aware of an operator's oppZioation for a ~:uppZementaZ Type Certificate by obtaining the monufacturer's format review prior to authorizing any significant deviation from the approved design. [pp. 61-64] Procedures for reporting safety-related incidents and service difficulties, and the information and indi- cation of trends that such reports provide, should be
13/Introduction and Summary of Recommendations among the principal tools of all airworthiness personnel within the FAA and the industry. The present procedures are inadequate. While the FAA now recognizes this fact and has begun a five-year effort to develop a modern, comprehensive information-gathering and data-processing system, the committee views the pace of development as too leisurely. Hence, the committee recommends that the FAA acceZerote its development of on effective informa- tion-gothering and data system. This system should inoZude assess to the oppropriate elements of the monufaoturers' and worriers' records [pp. 64-68] Information systems are no better than the informa- tion fed into them. The committee found excessive confusion in the current procedures for reporting occur- rences involving structural damage to the aircraft. The confusion extends to the matter of what to report, whether to report it at all, when to report, and to whom the report must go. The maintenance-induced damage to the aft pylon bulkhead on two DC-10 aircraft of Conti- nental Airlines prior to the American Airlines Chicago accident, which was not required to be reported, illus- trates this dilemma. To reduce this important source of confusion, the committee recommends thot the FAA require that any damage to the primary structure of an aircraft, regordZess of bow the dotage was housed, be reported. [pp. 68-70] Leadership and Advice Because the FAA regulates an industry that works at the frontiers of technology, it must be a leader in its field. It needs to be able to develop and apply new standards for rapidly changing technology. To ensure that the agency provides such technical leadership, the administration requires access to the advice of the fore- most aviation specialists in the nation. Accordingly, the committee recommends that the administrator appoint a senior advisory committee of experts from government, industry, and universities to advise on the adequacy of teahnioaZ programs and on the direction of future deveZ- opments. [pp. 73-74] As an agency of the U.S. Department of Transpor- tation, the FAA operates under the oversight of the Secretary of Transportation. Given the fact that the
IMPROVING AIRCRAFT SAFETY/14 FAA regulates a single, relatively cohesive industry, where the similarities of training and perspective of industry and agency people far outweigh their differ- ences, the secretary needs an objective group of policy advisors to review the FAA periodically and to address issues related to his oversight responsibility. The committee recommends, therefore, that the Seoretory of Transportation appoint on independent aviation safety polity boord, reporting to him ond responsible for advice on ma.ior safety ond oozing issues; for oov~nseZ on ~ ~ v . ~ oversight of the FAA; and for recommendations of candidates for the positions of administrator and deputy administrator. [pp. 74-76] The rapid turnover of senior FAA officials in recent years has resulted in several new approaches to long- standing problems with each change in administration. Particularly in organizations concerned with safety regulation and high technology, of which the FAA is both, there is a decided value in continuity for programs and policies to be tested for effectiveness. Beyond con- tinuity, the administrator and deputy administrator need to possess high technical, professional, and administra- tive competence. Accordingly, the committee recommends that the President select the administrator on, deputy administrator from a state of condidates recommended by the proposed aviation safety policy board or a simiZor group of experts and that strong consideration be given to reappointment when opproprzate. - a, · [P. 761 In the final analysis, no matter how proficient the FAA is, the safety of an aircraft depends on the people who design, produce, and maintain the machine--the air- craft manufacturers and air carriers. In any endeavor involving human beings, mistakes can be and often are made. The only known way to minimize them is through a system of checks and double checks. There are already many checks and balances present in the industry's work to design, build, and maintain air- planes. But some companies lack a separate internal safety organization, akin to an internal audit staff, to assure management on a continuing basis that the proper processes and procedures are in place, that personnel are fully trained and qualified, that adequate controls exist, and that the product is indeed as good as it is stated to be.
15/Introduction and Summary of Recommendations The Committee, therefore, recommends that each industrial firm involved in the design, production, or maintenance of oommeroiaZ transport aircraft consider having an internal aircraft safety orgonization to provide additionaZ assuronoe of airworthiness to Company management. [pp. 76-77] Concluding Remarks Although this study was conducted under a severe time limitation of six months, the committee has completed a rather detailed examination of the process of certifica- ting the design, production, and maintenance of large commercial transport aircraft. The results of this exa- mination, including many specific findings, are centered in its recommendations. While each of these is considered important, the committee considers that the following conclusions warrant special attention: The FAA needs highly competent, dynamic lead- ership, with terms of sufficient duration to provide stability and continuity. . The FAA needs an improved technical staff of greater competence, which can be attracted only if significant organizational changes are made. The FAA needs a committee, reporting to the administrator, to provide advice on the appli- cation of new technologies to the work of the FAA. The Department of Transportation needs a board reporting to the Secretary of Transpor- tation to provide advice on FAA policy matters and to recommend candidates for the positions of administrator and deputy administrator. These three conclusions deal with people and organizational matters. An entirely different kind of conclusion concerns the philosophy of aircraft design: Aircraft can be designed to be more tolerant of failure, and should be able to land safely even after some severe structural damage.
IMPROVING AIRCRAFT SAFETY/16 There is a final thought that concerns the attitudes of all those engaged in aviation and in the welfare of the flying public. The airworthiness standards in the Federal Aviation Regulations are a set of minimum standards arising from experience with aircraft operation and accidents. The regulations cannot cover everything that might have an important bearing on safety. What is prescribed is based largely on past failures and readily predictable future ones and therefore is not all that is necessary to ensure safety. Indeed, the Federal Aviation Act states first that the administrator must find that the aircraft is of proper design, construction, and performance for safe operation and then that the aircraft also meets the minimum standards. In practice, this requirement of judgment means that to improve the present system will call for an exceptional capacity to imagine unlikely problems, and thus to anticipate the need for further rules and practices, before the unpredictable accident strikes. This idea is the basis for the admonition that pervades most of the committee's recommendations to the FAA. It must take more initiative in every aspect of its work and, to do so, it must improve the expertise and quality of the technical staff and advisors upon whose judgment it relies.
