Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Type Certification and Rule Making As stated in the introduction, the processes by which the FAA seeks to assure the inherent safety or airwor- thiness of aircraft are type certification and rule making. Type certification, handled primarily in an FAA regional office, involves assuring that the manufac- turer's new design for a particular type of aircraft complies with the statute and all applicable rules and standards. Rule making, conducted at the agency's head- quarters in Washington, D.C., involves establishing the regulations and technical standards that must be met by the manufacturers and airlines in the course of design- ing, producing, operating, and maintaining the aircraft. Within each regional office, the group that reviews and approves each new aircraft design is the Type Certi- fication Board. Usually chaired by the director of the office's engineering and manufacturing section, the "Type Board" is composed of the senior managers for various technical specialties. The board functions as a manage- ment or steering group for all certification projects within the region and acts as a reviewer and arbiter of major technical issues. It provides a point for appeal by the applicants and serves as an overall advisory group to its chairman, who issues the Type Certificate. The day-to-day interactions with the applicant are handled by an assigned project manager, supported by staff members of a project engineering team. A typical certification project for a new type of airplane involves a process of interaction and iteration 19
IMPROVING AIRCRAFT SAFETY/20 between the FAA regional office and the manufacturer over a number of years. It begins when the FAA receives an application from the manufacturer for type and production certificates. The process is characterized by a progression of design and testing activities conducted by the applicant and reviews for compliance by the FAA project team, punctuated by a small number of meetings --perhaps four to six--of the Type Board at critical decision-making points. Once the FAA project team has familiarized itself with the application, the board holds a preliminary meeting, attended by the FAA team and its applicant counterparts, to make an initial evaluation and to identify the pertinent design certification cri- teria, including the regulations, standards, and criteria that the applicant must meet, and the means by which the applicant must demonstrate compliance. An interim meeting is held two to three years after the initial meeting to review the general progress and to settle any additional requirements. In the meantime, the applicant may undertake steps that rely on informal, interim decisions concerning Special Conditions that may be imposed. It does this because manufacturers are com- mitted far in advance to aircraft delivery dates. Not to do so would run the risk of delaying the project to await the final approval. The penultimate milestone is a preflight meeting of the Type Board at which, in addition to reviewing the overall progress of the project and identifying items that remain to be resolved, the board issues a Type Inspection Authorization. This document authorizes the FAA pilots to begin test flights to determine if the work has been accomplished. At the final meeting, in confirmation that all requirements have been met, the Type Certificate is issued. FAA Personnel and Organization Rule making and type certification call for engineers and scientists--airworthiness professionals--of high technical competence. The organizational and technical qualities that are desirable for rule-making personnel are similar to those required for making the critical governmental judgments in applying the rules and stan- dards to the certification process for a new type design.
21/Type Certification and Rule Making The assurance of acceptable airworthiness rules and standards must proceed from a knowledgeable FAA staff of sufficient capability and depth to provide leadership and, when necessary, to challenge the industry. Simi- larly, the type certification system presumes a high level of quality on the part of the government certifi- cation staff in assessing the work of the manufacturer in designing a new aircraft. While much smaller in numbers than the manufacturer's staff, the FAA staff must be capable of holding the company to appropriate standards of design and proof, of going beyond the let- ter of the standard to provide interpretation and to ask the right questions, and, with the aid of company- employed Designated Engineering Representatives, of painstakingly checking the company's work to assure compliance. The attributes of technical expertise, assertive judgment and independent initiative within the FAA are critical to its success. Although there are many moti- vated and dedicated members of the FAA's airworthiness engineering staffs, based on its discussions with FAA and industry engineers involved in certification and other processes, the committee found a greater technical competence and state of the art currency on the part of personnel in the aircraft industry than in the FAA. In particular, the committee found that this situation existed with respect to type certification. While this difference cannot reasonably be expected to be otherwise at the detailed design level, in order for the FAA to be effective in making significant judgments, there is a need for more qualified, critical, and analytical oversight by the senior FAA staff than is presently exercised. The present quality of aircraft designs is satisfac- tory largely because of the proficiency of the companies and the designee system. Although FAA staff members have raised apt and constructive questions, their contribution stems largely from the process itself. Systematic educa- tion and briefing by company engineers of the FAA staff provide a useful checklist against which the applicant can gain increased assurance that it has not overlooked important matters. While this role is by no means a trivial contribution to the design and ultimate airwor- thiness of the aircraft, it is not a sufficient one.
IMPROVING AI RCRAFT SAFETY/2 2 At one time, the FAA staff included senior recognized experts and authoritative sources in the field of aero- nautics. One of the earliest books on aircraft flutter, for instance, was written by FAA employees Scanlan and Rosenbaum.' The agency's ability to perform its air- worthiness mission credibly, and to command the respect . . . . . . . . aviation community, depends on its regaining such recognizable expertise. The present situation with regard to the quality of FAA personnel can be traced in part to the current organizational structure which, as described below, does not foster an environment that attracts the best people. It is also a function of the history of the aviation industry. When aviation was a newer field of endeavor, opportunities were greater and challenges broader. As aircraft become more complex, those who oversee them become specialists in particular areas. Many government engineers and inspectors grew with the industry and de- veloped seasoned judgment from involvement in a variety of new designs and a rapidly growing enterprise. As these people now begin to retire and are succeeded by another generation, the newer FAA staff expect to enjoy fewer fundamental challenges and opportunities for inno- vation than were experienced by their predecessors. Although aviation continues to present many challenges, this problem is endemic to the FAA's present age and that of many other established regulatory agencies. A factor contributing to the lack of initiative by FAA staff, both engineers and inspectors, is their ex- pressed concern that if they attempt to go beyond the precise letter of the regulation in overseeing the industry they will not be supported by their supervisors or by the Washington headquarters staff. Yet in making judgments about the safety of aircraft, some interpreta- tion is necessary. The current FAA organizational structure, which allocates type certification activities for the various categories of aircraft among several regional offices, results in a superficial level of technical oversight. The structure accounts, in part at least, for frag- menting the work of engineering specialists among many different functions, inconsistent interpretations of regulations from one regional office to another, and a lack of communication among personnel in the regional and headquarters offices on matters of common interest
23/Type Certification and Rule Making and experience. It also contributes to the agency's evident difficulty in attracting a sufficiently capable corps of engineering experts and specialists. In the Western and Northwest Regional Offices, where certification of new domestic transport aircraft is con- centrated, the work assignments of the engineering staffs are not limited to the certification of new aircraft types. The amount of time devoted to other functions varies according to specialties and the phase of design and test work in which the transport manufacturer is engaged. The two regions reported that their personnel devote, on the average, 60 to 75 percent of their time to such "other" related activities as the certification of modifications to existing jet transports, to business jets, and, perhaps primarily, to the review of service difficulty reports, service bulletins, and other kinds of in-service surveillance and remedial action. The regional engineers are also occupied by a variety of administrative tasks. Accordingly, they are stretched beyond their capacities of both expertise and time by bulges in the workload caused by new type certification, supplemental type certification, or special assignments. Problems due in part to the regional structure are demonstrated also by inconsistencies in the application of standards between the Western and Northwest Regional Offices. For example, while one region proposes to apply to one manufacturer, retroactively, the amendment to the rules relating to "accelerate-stop distances," (the min- imum allowable runway lengths for an airplane to accel- erate and stop safely, depending on its gross weight, speed, prevailing weather and runway conditions) the other office chose not to do so with other manufacturers during approximately the same period.* An example of inadequate exchange of knowledge between regions is the fact that nine months after the Chicago accident, as this committee was informed, the engineering staff of the Northwest Regional Office had *According to FAA personnel, Boeing, in the Northwest Region, is resisting the accelerate-stop rule because it claims that the 757 therefore will be at some competitive disadvantage when compared to the DC-9-80. Douglas, in the Western Region, is resisting the same rule because it claims that the DC-9-80 will be at a competitive disadvantage to the 737.
IMPROVI NG A I RCRAFT SAFETY/ 2 4 received no formal briefings on the relevant technical issues by representatives of the companies, by the Western Region's type certification team for the DC-10, or by the investigators of the accident. The committee observed an especially important problem of the FAA's attenuated organizational structure: the pool of engineering talent is so shallow that many senior positions have remained vacant for several months. The Western Regional Office, whose airworthiness juris- diction extends to Douglas, Lockheed, and a number of airlines, which is in the process of certificating the DC-9-80 and has just finished the certification of the L-1011-500, provides the most dramatic example. The office has operated for nearly a year with many vacant positions, including those of regional director, deputy director, and chief engineer would serve Certification Board. engineer. If on board, the chief as chairman of the regional Type addition to organizational structure, the committee identified a number of other factors that may contribute to the FAA's present inadequate level of technical currency and competence: · Inadequate and ambiguous direction, supervision, . . and support ot stats, resulting in confusion about priorities, reluctance to assert govern- mental prerogatives, and low morale. Cumbersome Civil Service and personnnel regula- tions and artificial career barriers that have, for instance, blocked adequate advancement and recognition of nonsupervisory technical specialists. Difficulties in attracting and hiring new grad- uate and experienced engineers, particularly in the Los Angeles region where living costs are unusually high. Lack of a stimulating atmosphere and peer asso- ciation, which is essential for a-thriving technical organization. Lack of resources and incentives for continuing education of technical personnel as well as a systemwide failure to provide adequate oppor- tunities for essential training in new areas of aviation technology. Competition in the allocating of new positions from operational components of the agency, such as air traffic control. .
25/Type Certification and Rule Making While the functions of rule making and type certifi- cation are similar and call for equivalent expertise and judgment, they are not congruent with the function of day-to-day reviews to assure compliance with established standards. Rule making and type certification require personnel of high technical competence, able to address the right questions about new technological features, including those for which guidelines have yet to be established. No less vital, but decidedly different, are the technical audit and surveillance functions which require personnel generally familiar with the state of the art and with production and maintenance techniques and procedures, rather than with evolving technologies. The administrator has recognized and taken steps recently to deal with some of these concerns. In October 1979 he announced the intention to recruit a number of "national resource specialists" in such technical dis- ciplines as aeroelasticity, advanced materials, special manufacturing processes, and airline maintenance tech- niques.8 In April 1980, he advised our committee that he was exploring the merits of selecting either the Western or Northwest Regional Office as a "lead region" to coordinate type certification activities for transport aircraft. The "lead region" concept is already being employed for such other aspects of FAA certification responsibility as engines and helicopters. The committee's recommendation goes even further. In the committee's view, the availability of outstand- ingly qualified airworthiness specialists is the sine qua non of the FAA's airworthiness activities, and spe- cialists of high calibre are not being attracted to the current organization. The committee, therefore, re~om- mends that the FAA establish a oentraZ engineering organization, staffed with teohnioaZ personnel of the highest competence, responsible for type oertifioation- ond portioipation in rule making. Located in an appropriate environment, possibly adjacent to a government center of aeronautical research and under the leadership of a-recognized authority in aeronautical engineering, the proposed central engineer- ing organization would be charged, ultimately, with the following tasks: (i) the accomplishment of rule making in relation to airworthiness matters, including the interpretation of existing regulations and the identifi- cation of related research needs; (ii) the reponsibility
IMPROVING AIRCRAFT SAFETY/2 6 for the key governmental decisions affecting design phi- losophy and criteria involved in the type certification of new aircraft and Supplemental Type Certificates, thus assuming the functions of the Type Certification Boards but not replacing the regional offices' project teams that work, on a day-to-day basis, with the applicants and the designees; and (iii) other related matters call- ing for combining specialized and expert technical knowledge with experienced judgment. Members of the centralized organization would thus be available as needed to all FAA offices throughout the country, and would have the advantages of the mutual reinforcement and common experiences gained from working on many of the same types of problems as they arise from rule making and certification activities. By regular and frequent participation in design reviews and similar functions, the team members would be continuously in- formed about new technologies and other innovations. They would be required to maintain a high level of tech- nical skill. By continuous interaction with several companies and associations, these airworthiness spec- ialists would be able to function as an inter-industry forum. While taking care to safeguard proprietary information, the specialists could work as a team to transfer from one type certification experience to another the safety principles learned. Once it is fully organized, the central organization should comprise one-half to three-quarters of the FAA's present complement of 318 aerospace engineers and 50 flight test pilots, and take responsibility for most of the airworthiness engineering functions related to rule making and aircraft design. A comparatively small num- ber of engineers would remain in the regional offices for day-to-day operations, to provide sign-offs and spot- checks of the work of the type certificate applicants, and to continue to oversee the remaining important regional activities involving the certification and surveillance of production, maintenance, continuing air- worthiness, and responses to service difficulties. These functions are best served from regional offices close to the production and maintenance facilities. The functions and location of the present staff would be changed under the proposed plan, though no significant increase in the number of positions is expected.
27/Type Certification and Rule Making This reorganization cannot be accomplished all at once. Initially, a cadre of 20 to 30 specialists should be put in place to undertake the rule-making functions and to assume the more limited responsibilities of the Type Certification Boards. A five-to-seven-year transition period would probably be required to reach the ultimate goals of the proposed reorganization. An improved and centralized engineering organization is, in the committee's judgment, a prerequisite to up- grading the quality of the FAA staff. The agency needs to devise a means for attracting more experienced spe- cialists than it presently has--a difficulty the commit- tee recognizes is neither unique to the FAA nor easily remedied in any government agency. Even working within the constraints of the Civil Service System, however, the FAA should be able to find the relatively small number of experienced specialists required in private industry, other federal agencies, and universities. Certainly, the FAA would have to pursue a vigorous recruiting campaign to attract the engineers and scien- tists best suited to the central engineering organiza- tion; and the challenges and rewards of such an organi- zation would have to be made sufficiently attractive to induce experienced professionals to make career changes to become airworthiness professionals for the FAA. The possibility of building and nurturing a technical organization of high competence and esprit de corps by centralizing technical functions has ample precedent in The early National Advisory Committee for government. Aeronautics (NACA) and the Department of Defense's weapons systems programs (e.g., the nuclear-powered submarine, the SAGE network, and the ballistic missile program) all stimulated the enthusiasm of the engineering and scientific communities and attracted highly qualified experts into government service to manage and implement the efforts. Less visible examples of continuing acti- vities that also attract highly motivated and capable people include the Air Force's Materials Laboratory, its Arnold Engineering Development Center, and NASA's numerous specialized programs in aerodynamics, materials and structures, avionics, propulsion, aircraft operating problems, and flight tests carried out at a number of facilities throughout the country. These programs confirm the committee's judgment that some of the United States' best engineering talent can
IMPROVING AIRCRAFT SAFETY/28 and should be attracted into the FAA's airworthiness organization. To do that, the organization needs: · Recognition that aviation safety provides an important and challenging assignment. Outstanding professional leadership that will attract good engineers seeking positions under experts in their respective fields. Substantive responsibility and influence over project elements. Association with colleagues of high qualifica- tions to provide a stimulating internal atmos- phere. Opportunities for career advancement that reward merit and expertise as well as supervisory responsibilities. A stimulating environment that provides oppor- tunities for associations with nearby universi- ties and research establishments. Opportunities for further study and professional growth. With regard to the last point, it is important to note that, while individuals with a science or technology orientation need to be exposed frequently to the state of the art and emerging technological possibilities, it is not necessary or desirable for the FAA itself to manage such recurrent educational programs. There are litany people oucs~ae One ~ AA who can teach new technolo- gies as well as those who want to learn about them. It is presumed that such programs could be arranged to meet the needs of the FAA and of others at the same time. Organized and structured continuing education is not the only means by which the technological currency of FAA personnel can be maintained. For example, the FAA might consider a rotation or exchange program for its personnel to spend Perhaps a year or more attached to either public or private, in the United States or abroad, at such places as NASA, Air Force laboratories, research establishments, manufac- turers, and universities. . an ~ _ ~ ~ _ ~ ~ a_ ~ _ _ . . ~ ~ ~ % ~1 other organizations, on the resources devoted An indispensable part of such a program is a suffi- ciency of travel and other funds to support it. To skimp _~ to building and maintaining a requisite level of FAA staff competence places the sys- tem's efficient operation in jeopardy over the long run and threatens the agency's mandate to provide "the highest degree of safety" in flight.
29/Type Certification and Rule Making The collection of the FAA's engineering talent into a single, coordinated unit should resolve many of the problems of the current regional office structure, in- cluding too close alliance with any one manufacturer, and should result in a well-trained and technically qual- ified staff that can provide improved interaction with the manufacturers and their Designated Engineering Rep- resentatives (DER). It should also eliminate many inconsistencies in interpretation and application of regulations. It is the committee's view that this revised organi- zational structure for airworthiness engineering, coupled with a recommendation to improve the type certification process (described later in the report) will result in a significant improvement in the quality of airworthiness certification and the overall effectiveness of the FAA. Designated Engineering Representatives About 370 FAA engineers are occupied with the certi- fication of aircraft of all types. Half of these are in the two regions with responsibility for Boeing, Douglas, and Lockheed. The FAA regional project engineering and flight test team certificating a new transport consists of 20 to 30 professionals, most of whom also perform other duties. By contrast with the number of FAA engineers, Boeing estimates it will concentrate about 4,000 engineers on its new 767 transport at the peak of its design effort. As a measure of the volume of work to be performed and reviewed, Lockheed has reckoned that, in the course of certificating a new wide-body aircraft, it would submit approximately 300,000 engineering drawings and changes, 2,000 engineering reports, and 200 vendor reports. In addition, it would subject the airplane to about 80 major ground tests and 1,600 flight test hours. Throughout this period, it would send some 1,500 letters to the FAA.9 FAA engineers cannot review each of the thousands of drawings, calculations, reports, and tests; yet the agency must be certain that the design for a new airplane meets all the regulatory requirements. The certifica- tion process thus depends not only on a review of high
IMPROVING AIRCRAFT SAFETY/30 quality by the FAA but also on the assistance rendered by employees of the aircraft manufacturers--the Desig- nated Engineering Representatives, who review the design and design process to make sure, on behalf of the agency, that all aspects of the regulations are complied with. These Designees hold key technical positions and are usually selected from the ranks of the firm's more senior engineers, typically having 15 to 20 years' expe- rience. Many hold supervisory positions as well. In general, they possess detailed knowledge of the design based on day-to-day involvement. It is not practical for FAA personnel to acquire the same familiarity with details of the drawings, analyses, and tests. Although, the committee was told, career path advancement is not affected by the designee role, the peer respect earned by virtue of the individual's appointment evidently contributes to what the committee observed as a high degree of dedication and motivation in the individual performance of designees. Indeed, among those inter- viewed, the committee detected that the job of a designee is a sought-after assignment. Designees are usually nominated by the applicant (~.e., aircraft manufacturer) but are appointed by the FAA regional director only after he is satisfied with their personal and professional qualifications and expe- rience. Once appointed, they are delegated by the FAA administrator, through the regional office, to repre- sent the FAA in helping to determine that the aircraft design complies with the relevant requirements of the regulations. In this capacity, designees are bound by the "same requirements, instructions, procedures, and interpretations as FAA employees.''l° me ~. . _ _ -l-~le use or Designees has been successful in the past primarily because each of the three segments of the air transportation systemr-government, manufacturer, and airline--seeks to achieve a high degree of safety. While designees perform much work for the FAA, the agency re- serves to itself the approval of such necessary and prudent elements in the certification process as: · The regulatory basis. · The analytical criteria to be used. · The major design philosophy affecting safety. · All fault-type safety analyses. · All test proposals. · The witnessing of all major tests. · All major flight testing.
31/Type Certification and~Rule Making · All in-service safety problems. The aircraft flight manual. The advantages of the designee system are apparent. It enables the FAA to have a substantially increased number of highly qualified technical people reviewing and checking thousands of pages of data to determine whether or not all the pertinent regulations and proce- dures have been satisfied. The possible disadvantage of the system, one that has been often asserted by some members of the public and representatives of interest groups other than the companies and the FAA itself, is the appearance, if not the existence, of a lack of inde- pendent objectivity--i.e., a conflict of interest for the designee, who is in the position of serving two masters. The committee finds, however, that potentials for conflict are checked by: (i) the ethical motivation of engineers to maintain a reputation for technical integ- rity and professionalism; (ii) the fact that, recognizing the stake of the manufacturer in assuring a safe, serv- iceable, and reliable product, the company's designees are senior engineers who perform traditional engineering review tasks for the FAA that would, by and large, be performed on behalf of the company; (iii) the organiza- tional structure by which the designees perform their work under the supervision of the FAA staff; and (iv) the arrangement that the FAA reserves to its own staff the most critical design decisions and approvals. As the system is presently organized, therefore, the committee concludes that the designee system for augment- ing the capability of the FAA to review and certificate the type design is not only appropriate but indispen- sable. The committee, therefore, recommends that the FAA continue to use Designated Engineering Representa- tives to perform the functions now delegated to them. A New Process for Type Certification The success of the certification can be attested by the record of U.S.-designed aircraft in the world market. However, the committee finds that, as the design of air- planes grows more complex, the FAA is placing greater reliance on the manufacturer. Near the end of the cer- tification procedure, for instance, the designees submit stacks of reports and calculations to the FAA staff for
IMPROVING AIRCRAFT SAFETY/32 approval. While the requirement of making such submis- sions has value in assuring airworthiness, in most cases the FAA staff performs only a cursory review of the substance of this overwhelming volume of documents. Further, the process invites a review that focuses, however superficially, on the details, often at the expense of closely examining overall design concepts. This is the case, in large part, because the FAA lacks the qualified experts to provide the proper lead- ership for the type certification process--a finding that led the committee to recommend establishment of a central engineering organization. We find that the FAA involvement in type certification, both at the project team and Type Board levels, lacks initiative, focuses on details, and gives insufficient attention to fundamental concepts at early stages. While appropriate questions are asked, and satisfactorily answered, to assure that the rules have been met, questions seldom address the appropriateness of the rule or whether a new rule would be a better approach. This situation appears to be the case more in the design stage than in the flight test stage, where FAA and company capabilities are more evenly matched. In essence, the granting of a Type Certificate indicates that the letter, but not necessarily the spirit, of the regulation has been met. What is needed are more thoroughgoing reviews of type certification made at key design milestones or check- points by more knowledgeable, experienced, and special- ized experts of the kind recommended for the centralized engineering group. Ultimately, such reviews would replace the reviews currently held by the present Type Certification Board. Recognizing that this objective cannot be accomplished immediately, the committee sug- gests a gradual replacement of day-to-day engagement with meetings of the central engineering organization at important stages to address significant matters and fun- damental questions. In time, the establishment of such milestone reviews would provide the high degree of tech- nical quality to the FAA design review that is now lacking. The committee thus recommends that the FAA adopt a Zonger-range objective to improve the type oer- tifioation process through a series of milestone reviews of the design data to examine fundomentaZ concepts and to assure oompZianoe with the fuZZ intent of safety regulations as ~eZZ as with their specific details.
33/Type Certification and Rule Making In a technological environment, the determination of design and engineering adequacy and product safety can- not be legislated in minute detail. Establishing cri- teria for such matters would be the responsibility of the proposed central team in the course of developing reviews for oversight to replace those now practiced by the Type Board, project team, and designees. For instance, the design and creation of a structural component such as a wing includes the following steps that are critical to airworthiness: (i) determination of the loads; (ii) creation of the structure to carry the loads; (iii) analyses to demonstrate adequate margins of safety for all conceivable modes of failure; and (iv) confirmation by structural tests. It should be possible for a team of experts to schedule reviews so as to pro- vide guidance on airworthiness issues at critical periods in the design process, to ask penetrating questions, to examine a small sample of data, and to be satisfied, as a consequence of placing primary emphasis on design con- cepts, that the aircraft will be airworthy. These results could be achieved without acquiring a detailed knowledge of all drawings and analyses. We expect, therefore, that the instituting of upgraded milestone reviews, with the proper team of experts from the cen- tral engineering organization, will encourage greater initiative by the FAA and provide a higher degree of technical quality to its interaction with the manufac- turer. The Need for Timely Rule Making The airworthiness system depends not only on the safety consciousness of aircraft manufacturers and air carriers but on the premise that the standards embodied in the Federal Aviation Regulations for design, produc- tion, maintenance, and operation will be set and kept as up-to-date as they reasonably can be through the rule- making process. Primarily through its headquarters staff, the FAA manages its rule-making steps in the following ways: 0 Proposals for possible rules are reviewed ini- tially by the staffs of the offices of airwor- thiness, aviation safety, and flight operations, under the associate administrator for Aviation
IMPROVING AIRCRAFT SAFETY/34 Standards, and ranked for priority attention by the office directors. Within the FAA, ideas for new rules may come from the rule-making staff, from members of the airworthiness staffs in the regional offices, from the aircraft and airline industries, and from organizations representing specialized personnel such as pilots, flight attendants, mechanics, and inspectors. Ideas also originate in a variety of formal and informal meetings and colloquia, including airworthiness conferences attended by domestic and overseas industry and government representatives. Rules also may be proposed by the Congress and by other federal agencies such as the Environmental Protection Agency and the National Transportation Safety Board. This board, an independent federal agency whose charge includes investigating and determining the probable cause of civil aircraft accidents, also may make recommendations for changes in the regulations as a result of its findings. When a matter is considered serious enough to justify a new or revised rule, headquarters project teams, typically comprising engineers from the rule-making and airworthiness offices and a regulatory attorney, are asked to develop the safety, technical, and economic justifi- cations and to draft the proposed rule. Other members of the project staff include economists and environmentalists when these considerations are called for. . . Once drafted and approved for rule making by the administrator, the proposed rule is pub- lished in the Federal Register as a Notice of Proposed Rule Making (NPRM).* The notice sets forth a stated period, ranging from 30 to 180 days, during which all interested parties may submit written comments. In cases where public interest runs high, the FAA may elect to hold open hearings.ll *In very complex matters, or where the appropriate solution is not yet clear, the preliminary device of publishing an Advance Notice of Proposed Rule Making (ANPRM) is employed.
35/Type Certification and Rule Making . . After the designated period for comments has expired, all communications on the subject, to and from the outside, cease. At this stage, the FAA deliberates and decides, in light of the comments and its own technical judgment, whether or not to issue the rule, what form it will take, and what time period is needed before it takes effect. Finally, the administrator approves the rule by publishing it in the Federal Register, together with a preamble describing how the public com- ments were handled. The adopted rule is then incorporated into the regulations. Subject to President Carter's Executive Order No. 12044,12 all "significant" rules, which means those involving high cost or stirring public controversy, must carry the approval of the Secretary of Transportation as well. Once the rule is final, an affected party not satisfied with the outcome may seek recourse in the courts. It is not uncommon that investigation of a potential rule will reveal that further research is necessary be- fore an appropriate standard can be defined. An example of such a problem is the rule concerning post-impact aircraft fire. In the early 1970s, it became apparent that the latest jet aircraft, in particular the large wide-body airplanes, were absorbing the forces of crash impacts much more effectively than their predecessors. Aircraft occupants were surviving crashes in greater numbers, only to be exposed, on occasion, to fires. Beginning in 1973, the FAA, the National Aeronautics and Space Admin- istration, the National Bureau of Standards, and many parts of the aviation industry substantially increased their research on aircraft fire. During the next three or four years, the FAA initiated three separate rule- making actions: (i) a proposed modification to the existing flammability rules for cabin interior fire- resistant materials; (ii) a Notice of Proposed Rule Making, calling for materials with reduced smoke output; and (iii) an Advance Notice of Proposed Rule Making, calling for materials with lower toxicity properties. Soon afterward, research and development revealed the inadequate understanding of fire dynamics and the
IMPROVING AIRCRAFT SAFETY/3 6 lack of standardized testing techniques for measuring flammability smoke, and toxicity. Indeed, virtually no systematic, large-scale testing had been done in these areas, and it became clear that experiments carried out in laboratories bore little resemblance to full-scale fires in airplanes. The three pending rule-making actions thus had little or no basis. Accordingly, in 1977, the FAA withdrew the proposed rules to await a better understanding of fires in aircraft. The several fire research efforts are still under way. The FAA, NASA, and the aviation industry are presently conducting large-scale tests of assembled components to determine their fire resistance levels in order to form the basis for new standards. Meanwhile, industry has, in some cases, taken advantage of the technology developed thus far by applying incremental improvements to certain cabin interior components-- e.g., fire-resistant polyimide foam insulation around air-conditioning ducts, redesign of lavatory structures to contain fires, and new phenolic-resin-based cabin sidewall panels that exhibit markedly increased resistance to fire penetration. The fact that the FAA has initiated rule-making actions without an adequate data base is an example of the agency's emphasis on the process of rule making rather than on the substance of regulatory needs. The FAA rule-making process is mainly reactive, either to the needs of safety as determined from accidents, or to new technologies as identified by manufacturers. In some instances, even this responsive mode has been lagging. A case in point involves two proposals discussed and agreed to by the FAA and the industry at a 1974 Air- worthiness Conference,13 concerning the use of continuous-gust criteria for strength and structural deformation design, and the need for a safety analysis of the probability of fuselage openings. Although the hole-size criteria have been applied by the FAA through Airworthiness Directives and Type Certification negoti- ation, and continuous-gust criteria have been used by industry, largely on a voluntary basis, the FAA has not yet incorporated into the Federal Aviation Regulations the detailed rules requiring these practices--some six years after they were first proposed. Of equal importance to its ability to respond to rule-making imperatives of a new design or an accident
37/Type Certification and Rule Making is the FAA's need to be capable of understanding how new technology could give rise to the requirement for new rules as well. This is important in order to assure that the FAA is prepared to scrutinize competently the safety implications of new design approaches, to avoid or reduce the regulatory drag on innovation and the introduction of new technology, and to promote advances in safety in areas where the industry is not leading. Examples of emerging technologies where FAA expertise lags behind industry include advanced composite struc- tures, avionics, active control systems, and the impact of new aerodynamic shapes. New standards, and the research and development to support them, in areas such as survivability and human factors, are examples of areas on which manufacturers place less priority, compared to airworthiness, reliability, and productivity. The FAA thus should be expected to exhibit a greater amount of guidance and leadership in the former areas. In order to issue and maintain clear and technically current standards, the FAA must have an excellent rule- making process, one that keeps pace with advances in technology and meets the needs of those who interpret and apply the standards. The attributes of such a pro- cess are: (i) a scientific and technical knowledge base for proposed standards; (ii) a systematic approach to identifying the need for new rules or the modification of existing ones, coupled with set priorities and schedules; (iii) a capability to react to unforeseen emergencies (arising from an accident, for example) by reordering established priorities; and (iv) efficiency in the processes of scanning the technical horizon, soliciting recommendations from affected parties, draft- ing and inviting comments on proposed regulations, and preparing the final, adopted rule. Of the above attributes, the committee finds that only the administrative processes of rule making are being actively pursued by the FAA today. Indeed, the agency has recently taken steps to improve the efficien- cy of its administrative rule-making. In the spring of 1979, it developed a rule-making project team system that holds promise for improving the scheduling and accountability of the rule-making staff. The FAA's rule- making actions also seem to work promptly in reacting to the external stimulus of a fatal accident. In other respects, however, the committee finds too much caution and passivity.
IMPROVING AIRCRAFT SAFETY/3 8 What is lacking is initiative--a systematic means for determining where new rules are needed, the ranking of priorities, and the development of the necessary technical bases, where absent, for rule making. In light of these findings, the committee recommends that the FAA take more initiative in identifying the need for new razes and in establishing objectives, priorities, peons, and sokeduZes for rule making and that it sponsor onnuaZ ruZe-making review conferences to support this activity. To provide the means for problem identification, the FAA should reinstate annual government-industry airwor- thiness reviews. Such reviews were convened by the Civil Aeronautics Board before rule-making functions were transferred to the FAA in 1959, and were eminently suc- ce~sful. Under that system, for example, the rules necessary for certificating the initial fleet of jet aircraft were developed in a timely manner, enabling the United States to assume quickly a leading position in commercial jet aviation. The FAA attempted to revive this activity in 1974 with its all-embracing Airworthiness Review, the first in a planned biennial series. However, the bulk and comprehensive nature of the review, and the failure to limit its agenda, swamped the capability of the FAA to deal with the many recommendations. As a result, many of the recommendations still await action. Examples include: or life limits on, Type Certificates;14 changes in accelerate and stop distances;15 concern over regula- tions dealing with failure analysis and numerical prob- abilities;16 and such "key design elements" as "com- partment fire protection, emergency exits, seats and shoulder harnesses".17 Discussions with former FAA officials, and with in- dustry personnel who participated in past reviews, have convinced the committee that this process is a good one, provided that the review is well organized, the agenda is planned in advance, and the FAA follows through in a , _ , the desirability of requiring revalidation of, ~, businesslike way. The same procedures should be used for identifying the need for new standards, for discus- sing their significance, and for determining the state of the art necessary to write the rule. The process for planning and setting priorities, once the need for a new or updated rule has been iden- tified, should be managed and carried out by the FAA
39/Type Certification and Rule Making staff. Probably it was at this stage that the 1974 Air- worthiness Review failed. From discussions at the re- view, from additional industry and public comments, and from its own knowledge, FAA management and technical staff should be able to determine a priority ranking for its rule-making activity. From such a ranking, it should be an easy matter to develop a plan and schedule for rule making--in effect, a calendar--in considerable detail for the following year, and in lesser detail for the succeeding five years. The calendar should take into account the available re- sources, the need to obtain or develop the underlying technology base, and the administrative process of writ- ing, reviewing, and publishing the rule itself. The calendar should also leave sufficient room, on a planned basis, for reactive rule making--the requirement quickly to a failure, an accident, or an unanticipated technological need. Generally, by the time a technology is advanced to the point where it can be considered for incorporation into an aircraft, the research and development necessary to complete a rule should be capable of being scheduled. In other words, the research generally is not of such an advanced nature that its outcome is completely unknown or its impact unforeseeable. The research and development in support of FAA rule- making activity can be carried out for the most part by other government agencies (e.g., NASA and the Air Force), by universities, and by private industry. The committee has reviewed the existing relationship between the FAA and NASA, and has found that, while the mechanisms for coordination have been established, they are not being used effectively. Given NASA's statutory responsibility for aeronau- tical research,18, the FAA should request that agency to strengthen those research programs that lay the basi for future rule making. A formal interagency agreement between NASA and FAA could be established through which FAA submits requirements to NASA in accordance with FAA developed priorities and plans. NASA could perform the necessary research and development on a predetermined time scale. Such formal agreements should not take the place of the many ongoing technical meetings and discus- sions, but rather should reflect the outcome of these discussions in a way that the FAA can incorporate in its planning process. to react
IMPROVING AIRCRAFT SAFETY/4 0 NASA is not the only possible source for research to meet the FAA's rule-making needs. The Air Force, for example, has done a great deal of research directly ap- plicable to airworthiness matters. If other public or private resources can assist the FAA with its research needs, the FAA should enlist their aid. The recommended central engineering organization would play a significant role in this and all other aspects of the rule-making process. If this organization were to be located in proximity to an existing research center, the coordination required for technology devel- opment might be greatly facilitated. The administrative process for rule making, as recently modified by the FAA with its project team con- cept, appears to be improving--although it is still too early to tell just how much. As an additional task, the FAA should develop a systematic approach to updating the entire body of Federal Aviation Regulations. While scheduled rule making and annual conferences can be expected to address new standards reflecting advancements in knowledge and new design practices, the systematic up- dating of the regulations should result in revising or deleting rules and criteria that have become obsolete. Even if a small fraction of the regulations--perhaps 10 percent--were redone each year, such action would fulfill within a decade the need that has been evident for at least the same period. This task being never finished, the FAA should perpetuate both the annual review and updating of the regulations. Flight After Failure--A Specific Rule While the purpose of this study has been to evaluate the procedures by which the FAA and industry together assure airworthiness, the committee has been mindful throughout its deliberations of the fact that the acid test of a process lies in the substance it produces, not in its organizational elegance. The substance of rule- making and type certification procedures is thus properly measured by the technical adequacy of the adopted stan- dards or regulations and the quality of the judgments and decisions reached in applying the standards to the design of a new aircraft.
41/Type Certification and Rule Making It is in the nature of every complex technological system that all possible risks--even mechanical ones-- cannot be anticipated and prevented by the design. Most safety standards have evolved from the experience of previous errors and accidents. Airplanes built in ac- cordance with current standards are therefore designed essentially to avoid the kinds of problems that have occurred in the past and to tolerate operational abuses deemed likely to occur. The high safety performance of the modern jet transport provides assurance that the current standards, which address the risks we now recog- nize, are sound. The designer seeks to anticipate and defend against likely malfunctions and hazards that could defeat the component being designed. However, many of the fatal accidents that have occurred with airplanes manufactured by companies visited by the committee have involved rare and improbable combinations of mishaps, aspects of which were outside the "design environment" of the components in question, such as maintenance-induced damage, unde- fined weather hazards, and damage sustained outside the operating regimes. To comply with current FAA require- ments, the designer of a new aircraft may establish that structural components that are critical to safety comply with the rules by either of two kinds of analyses. One involves the concept of "safe-life," which means that a structural component or assembly must be designed to retain its strength and integrity throughout its useful life. Landing gears, propeller blades, and engine fan blades are examples of safe-life parts. Whenever appropriate, structures may also be designed to satisfy the concept of "fail-safe." Here, safety is assured through the provision of redundancy. This means that the designer must show, through a variety of analyses of possible failure modes, that if the fail- safe part is crippled, another redundant or backup part is available to do its job sufficiently, at least to permit a safe landing. For instance, a typical fuselage Panel is designed with doubler strips that stop cracks while the additional members of the panel pick up the loads until the cracks can be detected and repaired, usually at the next scheduled maintenance. - trom progresslnq
IMPROVING AIRCRAFT SAFETY/4 2 FAA procedures do not normally require the designer to take into account, by analyses, the hazard to one component from the failure of some other component that was designed to meet safe-life or fail-safe standards. This has not been required because to do so would appear to involve a contradiction of the definition of these two structural design bases: why take into account a failure that cannot occur? These procedures, however, fail to take into account an important consideration: structures designed not to fail when subjected to conditions within the design environment sometimes do fail, usually as a result of hazardous conditions outside the design environment. Examples of such hazardous conditions might include maintenance-induced damage, hard impact by ground ser- vicing equipment, cargo-induced damage, or perhaps even faulty quality control during manufacturing. The simple fact is that during the long life of many fleets of air- craft, with millions of operations, one cannot guarantee that such damage will not occur. When one goes beyond matters of structure design to consider similar design approaches to aircraft systems, the problems can be compounded. Critical control sys- tems, for instance, are designed so that the probability of failing can be demonstrated to be "extremely remote." The convention normally applied to this definition is a calculation showing that the probability of failure is one-in-one-billion (10-9) flights. However, critical control systems also have failed from causes outside the system design environment. The failure of a safe-life or fail-safe structure that surrounds such systems is currently not required to be considered within the sys- tem~s design environment. Thus it is not taken into account when analysing possible modes of systems failure. The accident in Chicago* involved presumably incon- ceivable combinations of events: the one-in-a-billion failure of critical control systems caused by the im- probable failure of a fail-safe component. That fail- ure, in turn, resulted from maintenance-induced damage not considered within the design environment of either the structural or systems components. In the committee's judgment aircraft design prin- ciples should take into account the potential of struc- tural damage caused by conditions outside the design *See Appendix B.
43/Type Certification and Rule Making environment, and should seek to prevent catastrophic effects resulting from such damage. Specifically, the oo~ni~ttee re~orr~nends that the FAA develop a rule requir- ~ng assurance Chat an aircraft is designed to Continue to fly after st~ot~raZ failure, unless that failure itself prevents the aircraft from flying. There are obviously some kinds of failure--a wing torn off in a mid-air collision--that, by themselves, prevent the aircraft from continuing to fly. In the Chicago accident, however, a primary failure led to a series of secondary failures of flight control systems which, by making it impossible for the pilot to recover, were the actual cause of the accident. It is this kind of situation that justifies the need to go one step be- yond the design assurances now required. The recommendation would require that formal design consideration be given systematically and routinely to the consequences of the possible failure of critical structure and systems, even though these can be shown by analysis to meet design standards presumed to preclude failure. Structural elements or systems that could be rendered critical to continuing flight, because of the initial failure of a primary structure, must be designed to avoid or minimize being crippled or damaged by such initial failures. While the principle underlying this proposed rule has not been generally applied, there are examples of its application to specific cases, developed in response to accidents that have occurred. One is the decompres- sion venting of wide-body aircraft. The designer takes into account unanticipated structural damage resulting, for instance, from the inadvertent opening of a cargo door or from a mid-air collision, which could cause floor failure, and a secondary problem, such as the possible interference with control cables. A second example is the requirement that design consideration be given to the trajectories of disintegrating engine parts, even though such parts are designed to safe-life criteria. The committee believes, moreover, that, with the acceptance of this recommendation, the FAA should examine currently certificated type designs to determine if they substantially and reasonably comply with the rule that would result from this recommendation. In cases where they do not, it should consider issuing appropriate Airworthiness Directives to accomplish changes that can
IMPROVING AIRCRAFT SAFETY/4 4 reasonably be made or to permit exemptions for any special circumstances that may exist. The Issue of Public Access The special issue just cited is one example of a rule-related problem that is often first identified in the course of type certification decisions. Other rule- making issues also arise during the certification process in the regional office. Several of these, including cockpit design, the interpretation of cabin safety, and the methods for determining crew complement, affect in a direct way other parties as well as the manufacturers and airlines with which the regional offices customarily deal. Some could later affect other manufacturers, such as the proposed retroactive imposition of an amendment to the regulations dealing with accelerate-stop distances. The committee has heard many proposals for "openness" in the certification process, especially with respect to the issues raised in this study. We find that much of the debate on the subject of openness involves a con- fusion between the right of the public to be heard in setting new standards (which is a formal rule-making function in which the public clearly has the right to participate) and the desire of the public to appear be- fore, or even become voting members of, the Type Certi- fication Board. The board is a decision-making body only of FAA employees, in whose ultimate decisions the public should not participate. FAA practices may inad- vertently have added to the confusion in that certain rule-making decisions--Special Conditions, exemptions, or the retroactive application of amendments to the regulations--are usually made in the course of type cer- tification without providing the normal period for notice and comment characteristic of formal rule making. The committee recognizes that, in the course of reaching formal decisions in these respects, there is a vital element of negotiation that is best accomplished by the parties most concerned--i.e., the FAA and the applicant manufacturer. Moreover, there are instances in which proprietary information is justifiably held in confidence. Even so, the committee recognizes the right
45/Type Certification and Rule Making of the public to be heard in rule-making decisions, es- pecially in the case of parties who are both knowledge- able and interested in the consequences of such deci- sions. Therefore, the committee recommends that the FAA publish, as a notice in the Federal Register, the avaiZ- abiZity of the FAA-approved preliminary regulatory and certification bases for new aircraft type design, With subsequent puLZioation of Changes thereto, to permit time by review and comment by the pubZio and response from the FAA. In making this recommendation, we seek to accommodate two equally important objectives: (i) consistent with the Administrative Procedures Act, the public should be given notice of rule-making decisions that are being contemplated, and the FAA should receive and take into account all pertinent information or recommendations prior to making its final decision; and (ii) consistent with the statute, any manufacturer may apply to the FAA and hold confidential any information provided to the FAA that would adversely affect the company's interest, as long as the information "is not required in the interest of the public.''l9 In practice, we are recommending that the regional offices, through their respective Type Certification Boards, increase the observance of rule-making formali- ties with respect to their special rule-making decisions --just as they now do in issuing Airworthiness Direc- tives when time permits in nonemergency cases. The com- mittee envisions the situation where, subsequent to providing notice concerning the regulatory and certifi- cation bases, the Type Certification Board would invite all interested parties to make formal submissions for review at one of its early meetings. Thereafter, within a reasonable specified period of, say, 30 to 60 days, the board, on behalf of the FAA, would be required to make a formal, written, and public response to the issues raised, addressing their merits and providing available supporting data.* *The relationship of the public to the activities of the Type Certification Board is also being reviewed in the Congress. At least one bill relating to the matter, S. 11433 (95th Congress, 1st Session), is being con- sidered in the Senate Committee on Commerce, Science, and Transportation. A companion bill, H.R. 4679, also has been introduced in the House of Representatives.
IMPROVING AI RCRAFT SAFETY/4 6 The procedure contemplated should in no way restrict the type board or design certification project engineers from also seeking additional technical advice and counsel from such appropriate sources as other government agencies and individual specialists and consultants, paid or volunteer, from industrial and academic set- tings.
