[House Hearing, 113 Congress]
[From the U.S. Government Publishing Office]
LESSONS LEARNED FROM THE BOEING 787 INCIDENTS
=======================================================================
(113-24)
HEARING
BEFORE THE
SUBCOMMITTEE ON
AVIATION
OF THE
COMMITTEE ON
TRANSPORTATION AND INFRASTRUCTURE
HOUSE OF REPRESENTATIVES
ONE HUNDRED THIRTEENTH CONGRESS
FIRST SESSION
__________
JUNE 12, 2013
__________
Printed for the use of the
Committee on Transportation and Infrastructure
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available online at: http://www.gpo.gov/fdsys/browse/
committee.action?chamber=house&committee=transportation
_____
U.S. GOVERNMENT PRINTING OFFICE
81-427 PDF WASHINGTON : 2013
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC
area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, Washington, DC
20402-0001
COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE
BILL SHUSTER, Pennsylvania, Chairman
DON YOUNG, Alaska NICK J. RAHALL, II, West Virginia
THOMAS E. PETRI, Wisconsin PETER A. DeFAZIO, Oregon
HOWARD COBLE, North Carolina ELEANOR HOLMES NORTON, District of
JOHN J. DUNCAN, Jr., Tennessee, Columbia
Vice Chair JERROLD NADLER, New York
JOHN L. MICA, Florida CORRINE BROWN, Florida
FRANK A. LoBIONDO, New Jersey EDDIE BERNICE JOHNSON, Texas
GARY G. MILLER, California ELIJAH E. CUMMINGS, Maryland
SAM GRAVES, Missouri RICK LARSEN, Washington
SHELLEY MOORE CAPITO, West Virginia MICHAEL E. CAPUANO, Massachusetts
CANDICE S. MILLER, Michigan TIMOTHY H. BISHOP, New York
DUNCAN HUNTER, California MICHAEL H. MICHAUD, Maine
ERIC A. ``RICK'' CRAWFORD, Arkansas GRACE F. NAPOLITANO, California
LOU BARLETTA, Pennsylvania DANIEL LIPINSKI, Illinois
BLAKE FARENTHOLD, Texas TIMOTHY J. WALZ, Minnesota
LARRY BUCSHON, Indiana STEVE COHEN, Tennessee
BOB GIBBS, Ohio ALBIO SIRES, New Jersey
PATRICK MEEHAN, Pennsylvania DONNA F. EDWARDS, Maryland
RICHARD L. HANNA, New York JOHN GARAMENDI, California
DANIEL WEBSTER, Florida ANDRE CARSON, Indiana
STEVE SOUTHERLAND, II, Florida JANICE HAHN, California
JEFF DENHAM, California RICHARD M. NOLAN, Minnesota
REID J. RIBBLE, Wisconsin ANN KIRKPATRICK, Arizona
THOMAS MASSIE, Kentucky DINA TITUS, Nevada
STEVE DAINES, Montana SEAN PATRICK MALONEY, New York
TOM RICE, South Carolina ELIZABETH H. ESTY, Connecticut
MARKWAYNE MULLIN, Oklahoma LOIS FRANKEL, Florida
ROGER WILLIAMS, Texas CHERI BUSTOS, Illinois
TREY RADEL, Florida
MARK MEADOWS, North Carolina
SCOTT PERRY, Pennsylvania
RODNEY DAVIS, Illinois
MARK SANFORD, South Carolina
------
Subcommittee on Aviation
FRANK A. LoBIONDO, New Jersey, Chairman
THOMAS E. PETRI, Wisconsin RICK LARSEN, Washington
HOWARD COBLE, North Carolina PETER A. DeFAZIO, Oregon
JOHN J. DUNCAN, Jr., Tennessee ELEANOR HOLMES NORTON, District of
SAM GRAVES, Missouri Columbia
BLAKE FARENTHOLD, Texas EDDIE BERNICE JOHNSON, Texas
LARRY BUCSHON, Indiana MICHAEL E. CAPUANO, Massachusetts
PATRICK MEEHAN, Pennsylvania DANIEL LIPINSKI, Illinois
DANIEL WEBSTER, Florida STEVE COHEN, Tennessee
JEFF DENHAM, California ANDRE CARSON, Indiana
REID J. RIBBLE, Wisconsin RICHARD M. NOLAN, Minnesota
THOMAS MASSIE, Kentucky DINA TITUS, Nevada
STEVE DAINES, Montana SEAN PATRICK MALONEY, New York
ROGER WILLIAMS, Texas CHERI BUSTOS, Illinois
TREY RADEL, Florida CORRINE BROWN, Florida
MARK MEADOWS, North Carolina NICK J. RAHALL, II, West Virginia
RODNEY DAVIS, Illinois, Vice Chair (Ex Officio)
BILL SHUSTER, Pennsylvania (Ex
Officio)
CONTENTS
Page
Summary of Subject Matter........................................ iv
TESTIMONY
Panel 1
Margaret M. Gilligan, Associate Administrator for Aviation
Safety, Federal Aviation Administration........................ 4
Panel 2
Mike Sinnett, Vice President and Chief Project Engineer for the
787 Program, The Boeing Company................................ 20
PREPARED STATEMENTS AND ANSWERS TO QUESTIONS FOR THE RECORD SUBMITTED
BY WITNESSES
Margaret M. Gilligan:
Prepared statement........................................... 27
Answers to questions from Hon. Rick Larsen, a Representative
in Congress from the State of Washington................... 38
Mike Sinnett, prepared statement................................. 47
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
LESSONS LEARNED FROM THE BOEING 787 INCIDENTS
----------
WEDNESDAY, JUNE 12, 2013
House of Representatives,
Subcommittee on Aviation,
Committee on Transportation and Infrastructure,
Washington, DC.
The subcommittee met, pursuant to notice, at 10:00 a.m. in
Room 2167, Rayburn House Office Building, Hon. Frank A.
LoBiondo (Chairman of the subcommittee) presiding.
Mr. LoBiondo. Good morning. The hearing will come to order.
Thank you all for being here. The top priority of the Aviation
Subcommittee, as well as me, personally, is the safety of the
flying public. Therefore, the subcommittee has closely
monitored the actions of the FAA, the NTSB, and Boeing, in
response to the battery incidents that took place earlier this
year. We have called this hearing to learn more about the FAA
and Boeing's actions to get aircraft back to safe operation.
As we all know, in January there were two separate
incidents involving a lithium ion battery on Boeing 787
aircraft, one on the ground in Boston and the second in the air
over Japan. After ordering a review of all Boeing 787 critical
systems, the Federal Aviation Administration issued an
emergency airworthiness directive that temporarily halted the
operations of 787s.
In the 5 months since the incidents, the FAA and Boeing
have worked to develop a comprehensive solution to the battery
issues, and have safely returned the 787 aircraft to service.
As a key part of this process, the FAA and Boeing have taken a
hard look at the certification of the 787. This review has
focused on what worked, given that the safety of the aircraft
itself was not compromised in either incident, and what needs
or needed to be improved or adjusted.
Although the NTSB investigation is ongoing, and the board
has not identified the exact cause of the battery failure,
Boeing has been able to narrow the possible causes of this
short circuit to four or five basic things that they think were
the cause. Based on that information, Boeing developed a
comprehensive solution that addresses all of these possible
causes. The solution presented to the FAA addresses issues at
the battery cell, battery, and aircraft levels. In the end, a
new battery design underwent over 200,000 engineering hours,
and were then subject to a rigorous testing and FAA approval
process.
Once again, the committee has been closely monitoring the
actions taken by the FAA and Boeing. Initially there was great
concern about the possible implications of these incidents. In
the last 5 months, we have made every effort to ensure that the
FAA and Boeing are working together to develop a comprehensive
solution.
Therefore, the subcommittee has met several times with
representatives of both the FAA and Boeing, and received high-
level briefings on the incidents and the comprehensive
solution. Chairman Shuster, Ranking Member Rahall, Ranking
Member Larsen and I received briefings by Boeing's CEO during
the early stages of the investigation. The subcommittee has
remained informed about the actions being taken by Boeing and
the FAA at every step of the process.
Moving forward, this subcommittee will continue to monitor
the FAA certification process and the 787. To assist in this
effort today we will hear from the FAA and Boeing on lessons
learned as a result of the 787 battery incidents, and the
comprehensive certification review. This hearing is not about
attempting to lay blame on anyone. Instead, today we will take
a constructive look at what has been learned from these
incidents.
It is important to remind ourselves that the United States
aviation system is the safest in the world. This is due to the
dedication and commitment of all stakeholders who, in
situations like this, work together to ensure safety of the
flying public. I would like to thank both the FAA and Boeing
for their participation today, and look forward to their
testimony.
I would like to ask unanimous consent that all Members have
5 legislative days to revise and extend their remarks and
include extraneous material for the record.
[No response.]
Mr. LoBiondo. Without exception, so ordered. I would now
like to yield to Mr. Larsen for any statement you may make.
Mr. Larsen. Thank you, Mr. Chairman, for calling today's
hearing to review lessons learned from the Boeing 787
incidents.
Mr. Chairman, I believe we should start this hearing by
acknowledging that we are in an incredibly safe period for U.S.
commercial aviation. We haven't had a fatal commercial
passenger accident in the U.S. since 2009, and we owe a great
deal of credit for that to dedicated safety professionals at
agencies like the FAA and the NTSB.
Additionally, The Boeing Company has been a world leader in
the airplane business for almost a century. It has maintained
its leadership by making safety a priority. The Boeing 787
pushed the technological envelope. The certification itself was
an 8-year process. The lithium ion batteries, like many of the
aircraft's design features, are new and a constantly evolving
technology, not specifically covered by existing FAA
regulations.
We know the FAA worked with Boeing to develop special
conditions that would ensure the safety of this new technology,
and the process for developing these special conditions was
collaborative, rigorous, and transparent. These conditions took
over a year to develop, and were published in the Federal
Register for public comment.
Nevertheless, we had two serious safety incidents involving
Boeing 787 lithium ion technology in roughly a week's time.
These incidents caused the FAA and other international
regulators to ground the 787 for more than 3 months. The
grounding raised legitimate questions for the flying public
about whether the certification process with the 787 worked as
well as it should have.
In response to these two incidents, Boeing devoted more
than 200,000 engineering hours to understand the cause of these
incidents and develop technical solutions to prevent or
mitigate any further incidents. And, likewise, the FAA stepped
up its own involvement in the testing and analysis activities
required to certify the new battery design. As a result, the
787 modifications certified by the FAA have been completed, and
all the airplanes are now back in service.
Mr. Chairman, we both agree that safety is always this
subcommittee's highest priority. With the 787 flying safely
again, now is the appropriate time for the subcommittee to
review these incidents and glean lessons learned that could
further improve aviation safety.
In April, the Government Accountability Office raised
concerns before the Senate Commerce Committee that the ``FAA
staff have not been able to keep pace with industry changes
and, thus, may struggle to understand the aircraft or equipment
they are tasked with certificating.'' The NTSB's independent
investigation of the January 7 Japan Airlines incident is
exploring this key issue, and that should be completed later
this year. The FAA is conducting its own review of the 787
certification process.
Looking forward, Congress must ensure that the FAA is
adequately staffed, the agency is positioned to understand and
to challenge assumptions put forward by manufacturers regarding
new technologies. I hope to hear from the FAA and from Boeing
today about how the special conditions for the 787 were
developed, and whether they were strict enough. I would also
want to investigate whether the resources required for
recertification of the 787 were enough.
In February I expressed concern that this subcommittee--at
our subcommittee's FAA reauthorization hearing that
sequestration could negatively affect FAA certification
activities. I would like to hear from Ms. Gilligan whether she
believes that sequestration, budget cuts, and hiring freezes
are impairing the FAA's ability to attract and retain technical
competencies required to certify new technologies.
Also, I would like to hear about the FAA's efforts to
retain independent technical expertise from outside the agency
when necessary to assist in the certification of new
technologies.
Lastly, I hope that we will have time to investigate the
lessons learned from this process, and how the FAA will certify
aircraft with lithium ion batteries in the future.
Thank you, Mr. Chairman, and I look forward to hearing from
our witnesses.
Mr. LoBiondo. Thank you, Mr. Larsen. I would now like to
turn to the chairman of the full committee, Mr. Shuster.
Mr. Shuster. Thank you, and thank you, Chairman LoBiondo
and Ranking Member Larsen, for holding this hearing today. I
appreciate the fact that our witnesses from the FAA and Boeing
are here to testify before us. And as Chairman LoBiondo said,
this is a constructive hearing, something we can learn from.
When we look at the United States and the transportation
system, the airline system, aviation system safely transports
over 730 million passengers a year, 70,000 flights a day. So it
is the safest aviation system in the world, and that is due to
the work and the efforts of the FAA, the airlines, the
manufacturers, the controllers, other operators and
stakeholders who make it a safe system to operate in.
And this committee remained in close contact with the FAA
and Boeing after the incidents occurred, and through final
approval. The committee's oversight activities--it was apparent
that, throughout the process, that everybody was working
towards a solution, and it did that. We greatly appreciate the
Department of Transportation, Secretary LaHood and Deputy
Secretary Porcari, Administrator Huerta, for personally meeting
with me and others on the committee.
And when new aircraft with novel use of technology can
experience issues, it is important that we address those issues
early on in the process to make sure that we have safe
aircraft. And this situation we were able to address. It does
not mean they are unsafe. In fact, I believe they are safe
today.
The incidents--the FAA and Boeing's responses to the
incidents, we are going to remain looking at these, again,
learning from the process, because I believe there are valuable
lessons to be learned from this. And I look forward to hearing
again today from our witnesses. And again, we will continue
this oversight and we will continue to closely monitor the FAA
certification program. And, as the 787 resumes normal
operations, we will look again closely at what is going on, and
what is transpiring.
And, as I said, throughout this process I think everybody
worked diligently, worked together to get the 787 back up in
the air. That is positive for the U.S. economy, it is positive
for the airlines, and the aviation industry in America.
So, again, I would like to thank the chairman and the
ranking member for holding this hearing today, and yield back.
Mr. LoBiondo. OK, thank you, Mr. Shuster. Now we will turn
to our first witness today, FAA Associate Administrator for
Aviation Safety, Peggy Gilligan. Ms. Gilligan, you are
recognized.
TESTIMONY OF MARGARET M. GILLIGAN, ASSOCIATE ADMINISTRATOR FOR
AVIATION SAFETY, FEDERAL AVIATION ADMINISTRATION
Ms. Gilligan. Thank you. Chairman LoBiondo, Congressman
Larsen, and members of the subcommittee, thank you for the
opportunity to appear before you today to discuss the
certification of the Boeing 787. One of FAA's central roles is
to certify aircraft and components that are used in civil
aviation operations. We have been doing this for more than 50
years. Right from the start, aviation products have often
stretched the technological boundaries.
Over the decades, we have enhanced our process and
regulations. For example, for large aircraft like the 787, we
have changed our regulations more than 130 times to keep pace
with new ways of doing business and new technologies. For more
than five decades, the FAA has compiled a proven track record
of safely introducing new technology and new aircraft.
As we continue to certify new aircraft, I want to make one
thing very clear. We take that responsibility very seriously.
To certify the 787, the FAA assembled a team of FAA----
Mr. LoBiondo. Excuse me. Could you pull the mic a little
closer, please?
Ms. Gilligan. Sure. Is that better?
Mr. LoBiondo. Just pull it a little closer to you. Yes,
that is good.
Ms. Gilligan. OK.
Mr. LoBiondo. Thanks.
Ms. Gilligan. To certify the 787, the FAA assembled a team
of FAA engineers, inspectors, test pilots, and scientists, as
well as experts from industry, think tanks, trade
organizations, and other civil aviation authorities, in
addition to all the expertise at Boeing. The certification of
this aircraft took more than 8 years, hundreds of hours of FAA
engineering review, and 900 hours of flight testing time.
A key tenet of the certification process is to plan for the
unexpected, and this was the case in the 787. We required the
manufacturer to design systems to meet certain performance
standards. Then we required them to assume a failure, and to
design the aircraft so that it could be safely landed if a
failure were to occur. Many layers of safety are built in to
the meticulous processes and the thorough design.
For the battery, for example, we established nine specific
requirements to protect against a battery failure, and to
protect the aircraft if a battery should fail. One layer may
fail, just as it did in the in-flight 787 battery incident. But
the multiple safeguards built in, and the procedures pilots are
trained to follow, enabled the pilots to safely land the
aircraft. This is how the system works.
Immediately after the 787 in-flight incident, the FAA
issued an order that suspended flight to ensure that we had the
time to consider the right solutions without compromising
passenger safety. Our safety team worked thousands of hours
alongside Boeing. And, as a result of the battery system
review, Boeing made several changes. They redesigned the
internal battery components to minimize a short circuit within
the battery. They insulated the battery cells to prevent
propagation from one cell to another. They added a robust
battery containment and venting system to prevent a problem in
the battery from spreading to the aircraft. Finally, the
company improved the quality assurance process at the battery
manufacturer, to ensure that the batteries meet our rigorous
design standards.
We have concluded our review of the redesign, and we have
approved its operation. The aircraft is once again flying
passengers safely around the world, and Boeing has resumed
delivery of new 787s. We are confident that the new design will
protect the safety of the aircraft and its passengers.
The FAA is continuing to review the critical systems of the
787, including its design, manufacture, and assembly. We began
this broad review, which includes the FAA certification
processes, in January, after the first incident. We expect to
complete it this summer. Both these actions, first addressing
the immediate safety concern, and then doing an indepth review
of the product and the processes, are a standard way that we
approach our safety mission.
Some have asked whether the FAA has the expertise needed to
oversee the 787's cutting-edge technology. Not only does the
FAA employ a staff highly experienced in aviation, but we have
access to experts across the country and around the world. We
establish rigorous safety standards, and make sure
manufacturers demonstrate that the standards have been met. Our
safety record shows just how successful we have been.
What the 787 battery experience has shown is that neither
the industry nor the FAA is perfect. But it also shows, as I
noted earlier, that as aircraft are designed and built, we plan
for the unexpected, and we make appropriate data-driven
decisions to manage risk to protect the safety of the flying
public.
As we have learned with the 787 certification, the way to
enhance safety is to keep lines of communication open between
industry and Government, in order to foster the ability and
willingness to share information about the challenges that we
all face. These solutions show the FAA and its industry
partners continue to create an atmosphere where people work
together, all in the pursuit of maintaining the highest levels
of safety. That is why we are all here.
The FAA will never lose sight of the respective roles. But
there is always a seat at the table for the bright minds from
industry to help inform the best way to navigate the complex
technological issues we encounter. It would be shortsighted to
overlook anyone's valuable expertise.
Mr. Chairman, I am proud of the safety record we have
achieved, and I am confident we have the best people in the
right places to meet our challenges ahead.
That concludes my testimony, and I will be happy to answer
any questions you may have.
Mr. LoBiondo. Thank you very much. A couple of questions
that I have. During the two battery incidents, was the safety
of the aircraft or the flying public ever in danger?
Ms. Gilligan. The first incident, as you are aware,
occurred on the ground after the flight had been completed. All
the passengers and crew had left the aircraft, and the aircraft
was being cleaned. So, in that particular incident, there was
no risk to anyone during the operation.
In the second incident, which did occur in flight, so far
we believe that after the battery event itself, the remainder
of the system operated in accordance with the standards. That
is, it contained the event within the battery. We still do not
have the root cause analysis completed by the NTSB, so that we
do need to wait and see what the final results of that
investigation are, to see if there was any additional risk that
we haven't identified yet.
Mr. LoBiondo. Do you believe the FAA certification
processes in place were sufficient to address and remedy the
concerns raised by these incidents? Or should we relook at that
somehow?
Ms. Gilligan. We believe that the certification process is
really quite robust. I think the safety of the system indicates
that the products that FAA and others around the world have
certified do provide an appropriate level of safety.
Having said that, we always are looking to improve the
processes. We have learned some lessons from what we have seen
already with these two events. We will learn more lessons from
the NTSB review, as well as our own indepth review. All of that
information will be rolled back into the certification process
to improve upon a very sound, robust basis.
Mr. LoBiondo. Understanding that we don't have the NTSB
final report, what do you think the lessons learned from these
two incidents are up to this point? And what is the FAA doing
in response to lessons learned?
Ms. Gilligan. I think we have seen a couple of important
lessons. The first is that we now have a much more robust
process for testing lithium ion batteries, if they are used in
aviation. The certification standards and the testing that
Boeing demonstrated in the redesign will become the standard
the FAA and other authorities around the world will use when we
evaluate the level of safety provided by a lithium ion battery
used in an aircraft. So that is a very important lesson, and
that is already in place.
I think, in addition, we have seen some areas where we can
improve our process. One thing we realized is that some of
these new technologies are not just used in aviation. There can
be a community of experts who know something about the
technology, but have nothing to do with aviation. We want to be
able to reach that community. In this case, Boeing brought
together a number of experts on lithium batteries, and we
learned a great deal from them.
So, what we need to do is broaden how we reach out for
comments on our standards and expert review, to make sure that,
if there is a community of experts outside of aviation, we know
how to reach them.
We are also looking at some of the process improvements
internally that address new technologies. We are thinking that
it probably makes sense to have people who are not involved in
that particular certification to periodically review our work
and the manufacturer's work to make sure the FAA folks involved
in the certification aren't overlooking something, or that we
haven't missed an assumption, or that we haven't asked a
critical question.
So, those are the kinds of process improvements that we are
already seeing would add value to our certification process.
Mr. LoBiondo. Thank you. Mr. Larsen?
Mr. Larsen. Thank you, Mr. Chairman. Ms. Gilligan--was this
last month--we had Mr. Huerta in front of us, and he said that
FAA had announced a review of the certification process related
to the 787, and that review is ongoing, and so on.
Specifically, you have outlined some lessons learned, but can
you give us a timeline on when that review of the certification
process will be done?
Ms. Gilligan. Sure.
Mr. Larsen. Can you, as well, focus--help us understand
what the focus is of this particular certification review?
Ms. Gilligan. Sure, I will be glad to. After the first
incident that occurred in Boston, the Administrator and
Secretary, along with Boeing executives, announced that we were
going to undertake this indepth review. With the second
incident, and then the airworthiness directive, we lost a
little time doing the indepth review because a lot of the same
folks needed to be included in the ongoing initiatives. So we
actually kicked the indepth review off in early February, and
the group has been working pretty much full-time since then,
with an eye toward completing their review in the summer.
So, what that team did, was go beyond information on the
battery to look at all of the operational data that we had from
the aircraft since its introduction into service. We wanted to
see if there was any trend, any set of incidents that needed to
be looked at more thoroughly. We have identified a couple of
areas and are doing what we call deeper dives into those areas
to see what it shows us. From that, we expect to make some
findings and recommendations on process improvements and
perhaps other actions that we or Boeing or both will need to
implement.
Mr. Larsen. I think we will--well, at least I will look
forward to seeing the results of that review and getting
briefed on those. Since you are in that process, I won't go
into too much detail with you right now.
But a question about--that arise out of this incident isn't
a new question, but I wanted to give you an opportunity to
address it. It has to do with this term people--some folks have
used in the media called self-certification, that this is one
of the dangers of self-certification. Can you help us
understand why FAA would argue that this is not self-
certification?
And let me give you a--self-certification would be Company
A goes and does what it does, and comes back to you, and you
check the boxes.
Ms. Gilligan. Right.
Mr. Larsen. Versus FAA does everything and then hands it to
the company and says--you know, to Company A, and says, ``Do
this.''
So, those are the goal posts--I am sorry, the bookends; I
got my analogies wrong. Those are the bookends. How do you
characterize the certification process?
Ms. Gilligan. We would agree that the term ``self-
certification'' is a misnomer, because Boeing doesn't certify
anything. The Boeing Company, as the manufacturer, is
responsible for demonstrating that their product meets all the
standards that we have set. They have to have data and
information and analysis that shows that they have met those
standards. Then the FAA, or someone who works on our behalf----
Mr. Larsen. And, I am sorry, this would apply to someone
who makes a vortex generator this big and someone who makes an
engine for an airplane, as well.
Ms. Gilligan. Yes.
Mr. Larsen. This applies to anybody looking to build a part
for an airplane here in the U.S.
Ms. Gilligan. Right. The certification process is
fundamentally the same.
Mr. Larsen. Right.
Ms. Gilligan. There are some small parts that are treated
very differently, but you are right, the major systems or parts
of aircraft go through the certification process.
It might be easiest if I can describe it through an
analogy. We see it like taking a test. FAA is the one who sets
the criteria for passing the test. We tell the student, the
applicant, in this case the manufacturer, what it takes for
them to pass the test. They have to take the test and pass it.
Then we, or people on our behalf, grade the test and determine
if they passed. That is really how it works.
The FAA and our designees, who we appoint based on the
authorization provided by Congress for the Administrator to
appoint people to act on his behalf, are the ones who make the
determination that the standards have been met.
Mr. Larsen. Let's----
Ms. Gilligan. Does that help?
Mr. Larsen. Let's beat this dead horse a little bit, the
analogy about the tests in school, because on page 5 of your
testimony you discuss the lithium battery literature. So part
of what you did, then, was to review the available lithium
battery literature, include a consideration of the hazards of
other battery technologies such as nickel cadmium and,
presumably, lead acid batteries, as well. But the end result is
that then you created a test for these special conditions, but
the test itself perhaps was bad.
Ms. Gilligan. We haven't seen the data that says that the
standard that we set was bad. In fact, if you compare the
special condition to the regulation that was on the books for
batteries, you will see that we made it much more robust.
Lithium batteries provide higher energy at lighter weight.
Mr. Larsen. Sure.
Ms. Gilligan. That is why manufacturers wanted to use them.
But because of that higher energy, they also pose a different
kind of risk than other batteries. That is why the standards we
had in place didn't fully address the risks that lithium ion
batteries could introduce, and that is why we added additional
requirements. We even made some of the original requirements
more robust, for the purpose of the manufacturers showing that
the lithium battery was sufficiently safe for this application.
Mr. Larsen. The conditions state that lithium ion batteries
are significantly more susceptible to internal failures that
can result in self-sustained increases in temperature and
pressure than their lead acid counterparts. Did those hazards
cited in the special condition trigger a heightened level of
FAA involvement in the certification or compliance activities
for the battery, based on that risk analysis?
And can you explain any additional actions FAA took?
Ms. Gilligan. We set the new standard, in consultation with
the manufacturer and the industry. We put that standard out for
comment. We received some comments, again, from people in the
aviation industry. This, again, is where I think we saw a
lesson learned. We need to make sure that that kind of special
condition also went to experts on lithium ion batteries, who
might have been able to help us understand better how to
improve it. So that is something we will look at changing in
the future.
Then it was for Boeing, in accordance with the
certification plan that we approved, to do tests and analysis
to show that they had met all the requirements of the special
condition. We had designees on our behalf who made the finding
that Boeing had shown that they met those standards.
Mr. Larsen. What is a designee on your behalf? Is that an
FAA employee?
Ms. Gilligan. No. Again, under our statute, we have been
authorized for many years to have the Administrator appoint
individuals or organizations to perform some functions on our
behalf. We have a program at FAA where our engineers, in this
case, oversee the performance of the individual who is
designated, or the organization who we have given a designation
to, to make sure that they are properly performing their
functions, that they are making the same findings the FAA
engineer would have made, if they had done it themselves.
It is a way that we can leverage our resources, because
there are a large number of approvals that are required in a
manufacturing program and in our operational environment, as
well. A cadre of FAA employees would be extremely large,
probably unmanageably large. So we leverage our engineering
expertise through the designation of individuals and
organizations to act on behalf of the Administrator, in
accordance with the FAA Authorization Act.
Mr. Larsen. The designee program has been around since
1938?
Ms. Gilligan. The designee program has been around since
the late 1930s. I think it was a very elegant solution that the
Congress came to, realizing that there would be a number of
these repetitive approvals that we would need, so that the
public saw that aviation was safe, but there would never really
be a Federal cadre of employees who would be sufficient to
carry that out.
So, we have been able to leverage FAA resources by
appointing individuals to act on our behalf. It is considered
quite an honor to be an FAA designee. It is taken quite
seriously. We continue to oversee that those individuals, or
the organization that holds that approval, to ensure they are
performing properly. We have the ability to withdraw the
designation if they are not. So we manage it in that way.
Mr. Larsen. I have further questions, but I will take a
second round. Thank you.
Mr. LoBiondo. Mr. Meadows?
Mr. Meadows. Thank you, Mr. Chairman, and thank you, Ms.
Gilligan, for being here and, obviously, being well-informed on
the process. And I just compliment you on that.
It is my understanding that when the NTSB gets involved in
investigation, that all the parties with the investigation are
severely limited in their ability to respond or communicate,
either to the public or the media. And they are even
restricted, at times, in their communication between the
parties. For example, between the FAA and Boeing, or between
Boeing and Japan Airlines. And these communications first have
to go through the NTSB for clearance.
Specifically, are there any reforms that you could see that
the FAA or the NTSB could make that would allow this process to
work more effectively, in terms of investigating incidences,
while still allowing them to respond to the public and to each
other?
Ms. Gilligan. Well, sir, I think the party system, which
the NTSB uses, does allow for all of the interested
organizations that are involved to have a forum to make sure
that they are sharing information about the particular event or
incident or accident.
In this day and age, with the instant demand by media and
others for immediate information, it is sometimes difficult to
make sure that things that are unique to the accident or
incident being investigated don't get into the public domain
before the organization responsible for that investigation has
an opportunity to consider how it should be presented.
I do think, in all the cases that I am aware of, we are
able to work out the needed exchange of information so that the
NTSB is confident that they are controlling the information
about the accident itself. While, meanwhile, as you point out,
we and manufacturers and others, we have other safety
information that we need to share to make sure----
Mr. Meadows. But--excuse me--you hit two key points,
though. You keep referring to accidents, and this wasn't an
accident. It was an incident. And there is a big difference
there, because--I think of this as a compliment to the FAA and
to Boeing and to a number of the situations, because it wasn't
an accident, it was something that got identified as an issue.
And I guess, you know, when we had previous testimony with
the FAA, it is--the Administrator said, ``Well, Boeing is
taking responsibility, but we know that there was a number of
other issues that weren't specifically related just to Boeing,
and yet that information never got out.'' So, you know, it is
not an accident, it is an incident.
So are there any reforms that you would recommend to the
process right now?
Ms. Gilligan. I think we have a very good working
relationship with the National Transportation Safety Board. If
we are ever in need of safety information, and there is any
question as to whether or not we can receive it, those
questions are very quickly cleared up. I know we have also
worked with the NTSB and Boeing and others involved in these
investigations to make----
Mr. Meadows. So there are no reforms that you would
recommend.
Ms. Gilligan. I don't know of one, offhand, sir.
Mr. Meadows. OK.
Ms. Gilligan. I honestly don't.
Mr. Meadows. Well, then, let me ask you a different
question, then. When they get involved, when the NTSB gets
involved, how does that affect your ability to investigate, or
does it change at all? If they are involved or if they are not
involved, does your process change at all?
Ms. Gilligan. There are two parallel tracks. We support the
NTSB. In fact, many of our technical experts provide their
technical expertise to the NTSB. As you know----
Mr. Meadows. Right.
Ms. Gilligan [continuing]. NTSB is a small organization.
They certainly don't have depth of expertise in all of the
areas of aviation. So we provide technical expertise, as do
other parties, to those events, those investigations.
Mr. Meadows. So does it limit your ability to investigate
at all?
Ms. Gilligan. No. On a parallel track, we have other
independent responsibilities, because of our authorization----
Mr. Meadows. Right.
Ms. Gilligan [continuing]. To make sure that we are
understanding if there are any immediate safety-of-flight
issues, or things that go beyond what may be the probable cause
of that accident. We very much try to separate that out, and we
do our review to see if there are safety improvements we need
to make while they do their investigation.
Mr. Meadows. OK. My time is running out. So let me ask you.
If you had legislation coming from this committee that said
that we would allow for a little bit more public disclosure on
incidences, and maybe keep that limited--public domain on
accidents, is that something that the FAA could support, if you
had legislation coming from this body?
Ms. Gilligan. We----
Mr. Meadows. Is that something you would welcome?
Ms. Gilligan. We certainly could follow whatever direction
along those lines that might come through legislation. I
think----
Mr. Meadows. But would you welcome that?
Ms. Gilligan. Sir, we would really have to see what the
language is. But I understand your point. I do think that
incident review needs to be an open exchange of information by
all of the safety professionals, so that we can be sure we are
going to prevent something that could be prevented. We
understand what happened. And anything that would support that,
we could support.
Mr. Meadows. I yield back. Thank you, Mr. Chairman.
Mr. LoBiondo. Thank you. Mr. Williams.
Mr. Williams. Yes. I want to say thank you for being here,
Ms. Gilligan, we appreciate it.
First of all, I am going to ask you an important question.
Would you feel comfortable flying on a Boeing 787?
Ms. Gilligan. Yes, sir.
Mr. Williams. OK. Are you doing anything to change the
skill set of your workforce in aircraft certification to move
to a more risk-based system approach to safety oversight?
Ms. Gilligan. Yes, sir, we are. We do see that the level of
safety in the system now is at an all-time high. The only way
we are going to continue to build on that is to make sure that
we have, and are analyzing, what is occurring; that we are
finding things before they cause catastrophic failure, and we
are able to fix it. So we are moving toward that kind of
approach. We identify risks, identify what we can do to
mitigate, manage, or eliminate those risks, and oversee that
implementation to make sure the mitigation has been effective.
That will add to the skill set of our workforce, but on the
certification side we will always need, obviously, aerospace
engineers and other kinds of engineering expertise. We are
looking for a cadre of folks who have that engineering
expertise, and also the ability to do data analysis to really
inform how they make their engineering decisions.
Mr. Williams. One other question, which you basically
touched on just a second ago. But, simply put, do you believe
that Congress needs to take additional actions as a result of
this--of the battery incidents? Do we need to get more
involved?
Ms. Gilligan. No, sir. I believe, as both the chairman and
Congressman Larsen pointed out, we believe that this is a
demonstration of the system really working well. The reality is
these are complex pieces of equipment, and things will go
wrong. But we need to make sure the airplane can land safely,
and that is what we did.
Mr. Williams. Less Government is the best Government. Thank
you for being here.
Ms. Gilligan. Thank you, sir.
Mr. Williams. I yield back.
Mr. LoBiondo. Mr. Larsen?
Mr. Larsen. Ms. Gilligan, could you compare the level of
involvement in the certification activities associated with the
redesign of the battery with the certification of the original
design, and explain what, if any, actions, as well as direct
involvement, the FAA took?
Ms. Gilligan. Sure. I think it is important to realize that
after the second event, the in-flight event, we determined that
we had an unsafe condition. That always drives a higher level
of FAA involvement. So we worked very closely with Boeing for
thousands of hours to understand what were the risks. Boeing
did a very indepth analysis, brought together a team of experts
on lithium ion batteries to understand, since we didn't know
the root cause of the two events, we needed to understand what
was the group of things that might have resulted in either one
of those events occurring.
So, Boeing identified those areas. That led to what design
changes needed to be made to address those risks, and the
evaluation and testing to demonstrate that those designs would
be effective. We were with them pretty much every step of the
way.
There was a list of about 20 tests that needed to be
performed. We, FAA employees, witnessed most of those tests on
this redesign. Because, again, we were dealing with an unsafe
condition, and we really needed to get to the root of that to
be able to solve the problem.
Mr. Larsen. So then--so you have characterized how the FAA
was involved. Can you characterize the--I don't know, the
amount of time directly involved?
Ms. Gilligan. We have some hour counts, and I hesitate to
use them. So we have estimated about 7,000 hours. But it is
important to understand for the work on the airworthiness
directive----
Mr. Larsen. Right.
Ms. Gilligan [continuing]. We also collect a lot of our
overhead kinds of time. A lot of our executives and senior
managers were involved in the work on the AD. Their time is
included in that number. In a standard certification, the
manager time isn't always accounted for in the same way. But
with that exception, we spent thousands of hours working with
Boeing.
Mr. Larsen. What does this--what does the certification
process--FAA's involvement in the certification process of the
redesign tell you about your future involvement in the
certification of the use of lithium ion batteries in--you know,
in the next airplane, whoever makes it?
Ms. Gilligan. Well, again, we will use the same kind of
enhanced testing and analysis, because we have seen how that
can really show what will happen to the battery, and whether or
not the design really meets our standards.
Whether or not we would delegate, or ask our designees to
make the findings of compliance will very much depend on the
expertise of the applicant, the expertise of the designated
organization or the individuals in that company. It is always
kind of a case-by-case determination. But I think we will
continue to keep our eye on applications for the use of lithium
batteries to be sure that the testing and the standards are as
robust as they need to be.
Mr. Larsen. Have you changed the literature review,
literally? It might sound like a snarky question. But if the
first lit review of lithium ion batteries did not indicate to
you, or--as the FAA, of a testing regimen that would result in
the similar incident that we saw with JAL or ANA, has the body
of literature changed?
Ms. Gilligan. Well, again, I think, from the expert panel
that Boeing put together, we did learn that, in the intervening
years, more has been learned about lithium ion batteries and
their risks and how to test for those.
I do think it is important to note, and I am sure that Mr.
Sinnett will, in the next panel, that in order for Boeing to
reproduce the events that occurred in the two incidents----
Mr. Larsen. Right.
Ms. Gilligan [continuing]. It was an extremely difficult
test. It really pushed the battery much, much further than
anybody realized it would need to be pushed, if that is the
right way to describe----
Mr. Larsen. Sure, I understand.
Ms. Gilligan [continuing]. In order to replicate what
occurred in the two incident batteries.
So, I do think we have a very robust set of tests now that
we are confident reflect the best knowledge on lithium ion
batteries today, and we will continue to evaluate that testing.
We have the RTCA right now, a standards organization that helps
us set standards----
Mr. Larsen. Yes.
Ms. Gilligan [continuing]. Working on testing standards for
small and medium-sized lithium batteries. We will task them to
go back and continue to review the application of large lithium
ion batteries, to make sure, if there are changes in that
literature, that we are on top of it and we are able to
incorporate changes if we need to.
Mr. Larsen. Didn't the RTCA's standards for testing lithium
ion batteries change in the 2008 timeframe?
Ms. Gilligan. That was the first time they issued standards
on our behalf. You know----
Mr. Larsen. Yes. Were the----
Ms. Gilligan [continuing]. They provided standards----
Mr. Larsen. Were those standards different than what was--
the--were they different than what the lithium ion batteries
were then being tested under?
Ms. Gilligan. They were different than how Boeing
demonstrated compliance with our original set of standards,
because they had a standard that would have allowed for the
battery to be recharged. In the Boeing design, Boeing had
determined that they would not permit the battery to be
recharged. So that was not a standard that needed to apply.
There may have been other differences, but I don't think we
considered them substantial.
Mr. Larsen. Yes. And who participated in the RTCA panel to
look at that?
Ms. Gilligan. Oh, RTCA is a way that we bring together a
large number of experts.
Mr. Larsen. Right.
Ms. Gilligan. It was quite a large panel, as I recall. We
have got the list of people and organizations, but they were--
--
Mr. Larsen. Were you--was the FAA involved?
Ms. Gilligan. Oh, yes.
Mr. Larsen. Directly in that?
Ms. Gilligan. Yes. RTCA takes these assignments from FAA.
We ask----
Mr. Larsen. Well, I know they take the assignments from
you.
Ms. Gilligan. Oh.
Mr. Larsen. But was----
Ms. Gilligan. But yes, yes.
Mr. Larsen. The FAA's folks were there?
Ms. Gilligan. Yes, we had somewhere between 5 and 10
participants in the course of the development of the standards,
both to help inform the other experts about how FAA uses
standards as well as to make sure we had a group of people who
really understood the standard when we received it.
Mr. Larsen. So, then, was the lithium ion battery standard
that came out in 2008 from RTCA, their recommendations from
RTCA, were those incorporated in testing and retesting lithium
ion batteries for use in large airplanes?
Ms. Gilligan. The standards really provide a manufacturer
with a method of how to go about showing compliance to the
performance standards that we set.
Mr. Larsen. Right.
Ms. Gilligan. So, we did not require anyone who already had
an approved lithium battery application to go back and retest
using the RTCA methodologies.
Mr. Larsen. And why not?
Ms. Gilligan. Well, we had developed the special conditions
in accordance with our counterparts in Europe. Airbus A380 was
using some small lithium batteries. So we had already all
agreed on what that standard was. Boeing had, at that time,
provided sufficient data to demonstrate compliance with those
standards. So, there was no----
Mr. Larsen. With the new standard?
Ms. Gilligan. No, with the standards that we applied. In
aircraft design it is very difficult to go back and cause
existing products to be retested in accordance with some new
standard or new information that we may get, unless something
in the new information suggests that there is an unsafe
condition in the old, existing product.
Mr. Larsen. And, if I may, and you are arguing that there
was nothing in the newer standards that indicated there was
something unsafe in the----
Ms. Gilligan. That is correct.
Mr. Larsen [continuing]. In the existing standard?
Ms. Gilligan. That is correct.
Mr. Larsen. Yes. Thank you.
Mr. LoBiondo. Mr. Radel?
Mr. Radel. Thank you, Mr. Chair. Appreciate it. Thank you
so much for your time. I had two questions. The first--sorry, I
had to step out for a second--apparently, the first was already
covered. It is in reference to the organization designation
authorization. And I hope that we can work together really to
make sure that this permitting process of these regulations
that at times are incredibly burdensome for the industry, that
we can work together to make them more efficient, streamline
them. Because at the end of the day, a lot of these costs for
the entire industry, they have to get passed along to us, who
want to buy plane tickets.
The other thing I just wanted to touch upon was budgeting.
We know how sequestration has been difficult, to say the least,
for the FAA, especially when it come to prioritizing. I would
ask you what guidance can our committee here give the FAA in
the future for future reauthorizations to better facilitate
prioritization of funding, as our Republican House continues to
enact cost savings on behalf of our American taxpayer?
Second part, what specific spending latitude will ensure
that the FAA continues to meet its duties of oversight and
efficiency for airplane manufacturers?
Ms. Gilligan. Well, if I could start with the second one
first----
Mr. Radel. Sure.
Ms. Gilligan. Excuse me. First, I think we are very
appreciative of the work that Congress did to allow the
Administrator the flexibility to move some funding within our
different accounts at the FAA, so that we could avoid furloughs
this year. I think the idea of losing 10 percent of everyone's
work time would have had a tremendously negative impact on some
of the certification projects that we have underway.
At the same time, we still are looking to save over $380
million at the FAA. And that, obviously, will have its impact
as well. Right now we are in a hard hiring freeze, for example.
We see pockets where people have left, resigned, retired,
whatever, and it is having a harder impact in some small
offices.
As to how to help us set our priorities, I do think the
last reauthorization was very helpful. It provided a number of
opportunities for us to work with our industry to review our
certification processes, to try to find what it is that causes
it to be burdensome, or to determine where there may be
inconsistent outcomes among different offices. That will
provide us a real opportunity to work with industry to try to
improve those areas.
Hopefully you will see some results from that review, and
that might well inform additional authorizations that would be
useful, going forward.
Mr. Radel. All right. Again, thank you so much for your
time. I yield my time.
Mr. LoBiondo. Ms. Johnson.
Ms. Johnson. Thank you very much. Let me apologize for
being a little late; had to go to another committee. And I hope
you haven't answered these questions. But what I would like to
know is what key lessons have you learned with regard to this
January Japanese Airlines incident. And will you summarize the
process that FAA uses to create special conditions for new
technologies? And why are special conditions necessary?
Ms. Gilligan. Sure. If I may, I will start with the second
one first. The special conditions is a tool that we have to
allow the introduction of new technologies, most of which
enhance safety, before we have had an opportunity to go through
an extended rulemaking process. So, special conditions and, in
this particular case, the special conditions related to lithium
ion batteries built off standards that we had always had in
place for traditional batteries. The special condition
specifically identified the higher risks that are posed by
lithium ion batteries, and provided for a more robust
demonstration of protection from those risks.
Special conditions are really a way of building off what we
know to allow the introduction of new technology carefully,
making sure that we set a little bit more robust standard for
something that is new, or novel, before we just allow it into
the aviation system.
As to lessons learned, I had mentioned before we are still
waiting for the NTSB's final investigation report on probable
cause, and we think that will help inform some lessons. FAA and
Boeing are also doing an indepth review of the certification
process, and we expect to learn lessons from that, as well.
But there are some things that we have seen already. I
think the first and most important is that we have identified a
more robust testing regime to be used for testing lithium ion
batteries. Boeing used that in the redesign, and that will be
the regime that FAA will use, going forward. So I think that is
an important lesson. We have already raised the safety bar that
much.
In addition, we have identified that with new technologies
there often times are experts who are not involved in aviation,
but are experts in that technology. We need to find a way to
make sure we are reaching that community of experts to help us
make sure that when we introduce new technologies, we
understand everything that can be known at the time.
So, those, I think, are a couple of lessons learned. There
are also those kinds of process improvements, where we need to
enhance communication between the manufacturer and all of the
sub-tier providers that they buy parts from. FAA needs to be
monitoring that more closely, as well. So there are several
process improvements that we are going to pursue, as well.
Ms. Johnson. Thank you. In your written testimony you
discuss the use of aviation experts outside the agency to
resolve technical problems, noting certification of aviation
products and systems is not limited to the participation of a
single certifying entity and manufacturer. Please explain what
steps, if any, the FAA takes to bring this independent, outside
technical expertise to bear on the challenges associated with
the certifying of the lithium batteries for the use of Boeing
787.
Ms. Gilligan. Yes, ma'am. As we were just talking, there is
an organization called RTCA, which is a standards-setting
organization that FAA uses, along with SAE, another similar
organization. Through those groups, we pull together experts on
the technology. So, again, at the RTCA we had a wide-ranging
panel of experts with aviation experience, with lithium battery
experience, to help us build the standards and the description
for how a manufacturer would demonstrate that the lithium ion
battery was safe.
We do have a lot of mechanisms in place that let us reach
experts around the world on the particular technologies that we
are trying to address.
Ms. Johnson. Thank you very much. Thank you, Mr. Chairman.
Mr. LoBiondo. Mr. Davis.
Mr. Davis. Thank you, Mr. Chairman, and thank you, Ms.
Gilligan, for being here today. I apologize for coming in late.
That seems to be the nature of our business, they double-book
things.
But I know you mentioned you had some responses to
organization designation authorization. I would just like to
ask you quickly a couple questions to have you expand on that.
With fewer resources on the horizon for FAA across all offices,
how will you further utilize ODA and that delegation to meet
the growing certification workload for new products at both
Boeing and throughout the American aerospace industrial base?
Ms. Gilligan. Thank you, sir. As we discussed a little bit
before, FAA has, for many, many years leveraged our internal
resources by using either individuals or, now, organizations to
whom we delegate authority to act on our behalf. It is a key
way that we are meeting the safety requirements for certifying
products. We see that expanding over time.
The ODA is a relatively new authorization. We are learning,
as the industry applicants are learning, as we go. But I expect
that we will see ODA, if not mushroom, certainly grow
substantially. It is a way that we can leverage our resources
and assure the safety of the product at the same time.
Mr. Davis. OK, thank you. Now, Boeing. Right now are you
overseeing all of the--are you overseeing the entirety for
inspections that would normally fall under an ODA----
Ms. Gilligan. Oh, no.
Mr. Davis [continuing]. Or their employees?
Ms. Gilligan. Oh, no, no. The Boeing Company has an ODA. It
is quite a robust ODA. We work very closely with them. We
continue to provide oversight of the ODA. We need to assure
that they are performing their authorizations on our behalf
appropriately. I think, as we see in this hearing, there is
always a balance between how much we delegate and how much
involvement the FAA has. It is a delicate balance that we watch
closely. Mostly, what we want to assure is that those who are
operating or acting on behalf of the Administrator, do so in
the same way an FAA engineer would have operated. We see that
that is very much the case at the Boeing ODA.
Mr. Davis. OK. So Boeing is still completing some delegated
tasks that they have normally completed, and you are just doing
your oversight?
Ms. Gilligan. That is right. We provide oversight of the
ODA.
Mr. Davis. All right. I yield back the balance of my time.
Thank you for your time today.
Ms. Gilligan. Thank you.
Mr. LoBiondo. Mr. Duncan?
Mr. Duncan. Well, thank you, Mr. Chairman. Like the others,
I had another hearing that started at 9:30 before this one.
But--so I don't know if this has been covered, or not.
But the next witness is going to testify that Boeing put
this--these--this 787 electrical system under an astounding
amount of testing, 5,000 hours of component testing, 25,000
hours of laboratory testing, 10,000 hours at the airplane
level, simulation of 100--equivalent to 132,000 flights. In the
FAA study of this, have you been able to determine why, after
all this testing, did this problem not show up before? Is it
just a fluke, or----
Ms. Gilligan. Mr. Duncan, again, we haven't seen the root
cause analysis or the probable cause determination for the two
individual incidents from the NTSB. We agree with Boeing that,
with all the testing that was done for the original
certification, we did not see these types of events manifest
themselves. We also know that when we introduce new products,
after all of the engineering work that has been done, we often
see something in operation that either we did not anticipate
during certification, or where we see one of the assumptions
that we built off of was just not accurate.
So, it is not uncommon for us to learn from the new product
after it is introduced and to make improvements. That is what
happened here. We had two events, we went back and analyzed
them. Boeing redesigned the system, we were able to approve
that redesign. The system and the aircraft are safer for it.
Mr. Duncan. And I assume it is just a coincidence that both
of these carriers happen to be Japanese carriers, as I
understand. But is there something that these carriers require,
or that the Japanese Government requires, that is different
from what went into the other 787s?
Ms. Gilligan. No, sir, not that I am aware of. Right now,
we really are looking at the aircraft, the design manufacture
and assembly of the aircraft, to see if there is anything that
we may have overlooked that might have contributed to these two
events, and, if so, we will address those based on whatever the
data shows.
Mr. Duncan. The FAA requires manufacturers to assume or
prepare for problems occurring, and this--and have a plan for
mitigation to take care of these types of situations. And
apparently, you didn't find that this plane was at risk at any
time, and no one was injured. So, from that standpoint, the
system worked. Would that be a correct statement?
Ms. Gilligan. Yes, sir. Until we see what the probable
cause was, it does appear that, although we had the failure
within the battery at the cell level, that the rest of the
design, which met our standards, did contain that event, thus
the aircraft was not at risk and was able to safely land.
You are right, that is very much a tenet of our
certification process, to design so there won't be a failure,
then assume there is a failure and design so that the airplane
can safely land. In that regard, after the event occurred, it
appears everything worked as it was intended to work. But
again, we will need to see what the NTSB results show.
Mr. Duncan. All right. Thank you very much.
Mr. LoBiondo. OK, Ms. Gilligan, we thank you very much,
appreciate it, and we will move on to the second panel. Mike?
Ms. Gilligan. Thank you, sir.
Mr. LoBiondo. OK. Our second witness today is Mike Sinnett,
Boeing's chief engineer for the 787 program. Mr. Sinnett, you
are recognized for a statement.
TESTIMONY OF MIKE SINNETT, VICE PRESIDENT AND CHIEF PROJECT
ENGINEER FOR THE 787 PROGRAM, THE BOEING COMPANY
Mr. Sinnett. Chairman LoBiondo, Ranking Member Larsen,
members of the committee, my name is Mike Sinnett, and I am the
vice president and chief project engineer for the Boeing 787
program. It is my pleasure to appear before you today, and I
want you to know that Boeing is committed to supporting your
work in any way that we can.
Mr. Chairman, Boeing's highest priority is the safety of
the passengers and crews who fly on our airplanes. Every Boeing
airplane incorporates the broad, deep, and ever-increasing
knowledge we have gained from nearly 100 years of designing and
building airplanes. Our design approach is data-driven, with
risk carefully assessed and managed. Our designs feature
multiple layers of protection and redundancy of critical
systems, so that no single component failure or combination of
failures, even extremely remote, can endanger an airplane.
Mr. Chairman, flying is as safe as it is because industry
and Government work together day in and day out. The 787
illustrates that commitment to cooperation. The design process
started with a review of everything the industry and its
regulators have learned about designing, building, and
operating safe airplanes. I can attest to the team's strong
focus on safety, and to the strength of the certification
process, which was more rigorous for the 787 than it was for
any of our previous airplane programs.
When our airplanes enter service, we continuously monitor
their performance, analyze the data we collect, share safety-
related findings with customers and regulatory authorities, and
work with all parties to incorporate lessons learned into the
active fleet and its new production and designs. The result is
an exceptional, safe, and reliable airplane.
Over its first 15 months of service, the 787 achieved a
schedule reliability rate of 98.2 percent. That is better than
the 777, which had been considered the best in its class up to
that point. At the end of that 15-month period, we experienced
two battery failures. And as we explained at recent NTSB
hearings, both incidents, while serious, demonstrated the
effectiveness of our design philosophy. The airplane's
redundant safety features worked. They prevented the incidents
from jeopardizing the passengers and crews.
With that said, the work done following the two incidents
revealed ways we could improve the battery system even further.
Boeing devoted more than 200,000 engineering hours to develop a
comprehensive solution, and worked closely with the FAA to test
and certify these improvements. Through changes to the design
of the battery, the manufacturing process, and the addition of
a steel enclosure, we added protections that reduced the
likelihood of a failure, and further ensured that, should a
failure occur, there will be no significant impact to the
airplane.
Mr. Chairman, I would like to turn to certification,
because I know that is a subject of great interest today. All
of our airplanes are certified by the FAA, which is recognized
globally as the gold standard. A key component of every
airplane certification is the process for delegation of
authority. Delegated authority furthers the top priority of
industry and Government, which is safety. The ability to
delegate authority through team tasks enables FAA specialists
to focus on the highest-priority issues.
Organizations that demonstrate strict accountability to
certification requirements may receive what is called
organization designation authority, or ODA. It is a privilege
that is hard to obtain, and it carries serious
responsibilities. Notably, the FAA remains firmly in control,
and ODA holders are governed by stringent requirements that
include an FAA-approved process for selecting and training
individuals to perform these delegated tasks. I can assure you
that the members of the Boeing ODA are held to a very high
standard, and are backed fully with the support of The Boeing
Company.
As mentioned, the certification process for the 787 was the
most rigorous in Boeing's history. It took 8 years and involved
three times more conformed tests than the 777 certification
program, three times more data submittals, twice as many
airplane ground tests, and three times more integration tests.
In closing, I would like to reiterate that certification is
not the end of Boeing's involvement in the safety of delivered
airplanes. We collect and analyze enormous amounts of
operational data. And when we spot a safety issue, we address
the issue so that safety is maintained. This ongoing commitment
to safety and the collaboration we find across aviation,
coupled with our in-service monitoring and data-driven risk
management approach to designing new airplanes, are key reasons
that flying is the world's safest way to travel. Flying today
is 70 times safer than driving. And in recent years there have
been zero deaths from airline accidents here in the United
States. None of this is happenstance.
Mr. Chairman, this concludes my remarks, and I will be
happy to answer any questions. Thank you.
Mr. LoBiondo. Thank you. Could you tell us what you believe
the lessons learned were from these two incidents? And what, if
anything, you are doing in response to them? I mean other than
the fixes, which I know are, you know, being put in place.
Mr. Sinnett. I think the first thing that I think of is
that, because of these incidents and the work that followed,
Boeing and the team that we worked with advanced the state of
the art for understanding and testing lithium ion batteries.
The test protocol that we had gone through up to this point had
reflected the previous state of the art of the industry. And we
worked, following these incidents, to push the state of the art
so that we could cause a battery to fail in a similar way as it
failed on the airplane. So this was one of the areas.
I think we also learned a significant amount about how to
improve the processes in the manufacture and quality control of
batteries, of lithium ion batteries.
And lastly, and I think most importantly, these incidents
validated our design philosophy, which is that no single fault
can put an airplane at risk, and no combination of faults, even
extremely remote, can put the airplane at risk. And again,
these incidents validated--revalidated that design philosophy.
Mr. LoBiondo. Some have suggested in the aftermath of the
two incidents that somehow the FAA certification process was in
some way lacking. How would you respond to that?
Mr. Sinnett. I would disagree. I believe that the
certification process for the battery and for the airplane was
extremely robust. The process takes into account the risks of a
component failing, and the process takes into account the
resulting impact on the airplane. And, as Ms. Gilligan pointed
out, while the incidents occurred and the battery did fail, the
failure itself was contained at the battery level and did not
put the airplane at risk. And the certification approach
ensures that that is the outcome.
In a machine as complex as an airplane, there can be
components that fail. We take those failures very seriously,
and we work to address them. An accident can be the cause of
multiple links in a chain that fail. And any time we have an
incident which can be considered the break of the first link in
that chain, we take it seriously. The incident was referred to
as potentially impacting safety, and that is because the first
level of the--of redundancy was compromised, and that is the
first link in the safety chain. And so we take it very
seriously.
Mr. LoBiondo. OK, thank you. Mr. Larsen?
Mr. Larsen. Thank you, Mr. Chairman. Mr. Sinnett, back to
that first question I asked Ms. Gilligan about self-
certification. If you could imagine, again, the book-ends
being--where people call it self-certifying, where they give
the company--``Just go do something and come back and tell us
what you did and we will check the box,'' versus the FAA
crawling all over it every day, in control, and then says,
``Here, take it and do this.'' How would you characterize the
certification process, if those were, in fact, the book-ends?
Mr. Sinnett. I would say that it was somewhere in the
middle. The way the delegation works, the FAA looks at the
tasks at hand, and it considers which tasks are safety-related,
and it retains those safety-related tasks. In areas where the
tasks are more relatively mundane, typical of what you do day
in and day out in the cert process, they may delegate those
tasks to the delegated organization.
In the case of the battery, the initial battery
certification, the FAA retained the items that were inherently
safety related. For example, the FAA retained approval of the
certification plan. They also retained approval of the safety
assessment following all the testing of the battery. Those were
the two items that were most important in establishing the
safety of the battery system, and in assuring that, as we--as
the applicant, Boeing, showed compliance, that the FAA was able
to find compliance to the safety-related aspects.
The other things that they delegated, things like tests to
set up conformity, witnessing of certain environmental tests,
those aren't necessarily germane to the safety of the overall
system and the overall design. Really, the keys to the kingdom
there are the certification plan itself, how we propose to show
compliance to all the rules, and then the safety assessment,
which ties all of the analysis and the results to the end
safety product.
Mr. Larsen. OK. Can you talk about the--what you called the
new state of the art in testing? The old state of the art, if
you will, we have discussed and NTSB discussed this nail
penetration of a battery. And perhaps--I think we know now that
it probably wasn't the--should not have been a standard. Can
you talk about what was the old state of the art and what you
think the new state of the art on testing of lithium ion
batteries are for this size of a----
Mr. Sinnett. Sure.
Mr. Larsen. You know----
Mr. Sinnett. Sure. In the past, the failure modes
associated with large lithium ion battery cells were--there
were really two types of failure modes. One was a severe
failure resulting from an overcharged condition, where the cell
contains more energy than it was ever designed to contain,
because of a failure of the charging system, or a failure of
the charging procedures. That type of failure has led to open
flame resulting outside of the battery cell, and has been an
area of great concern, from a safety perspective, which is why
the charging system comes under such scrutiny, and is so
carefully designed. In the NTSB factual report, they have set
aside any concern about overcharging as being one of the
potential failure modes of this battery.
The only other failure modes that we are aware of are
failure modes that result from short circuits inside the
battery due to a number of different causes. Regardless of the
cause, when those short circuits occurred, the net result at a
cell level was simply the use of the--there is a burst disk on
the side of the cell that opens when the cell pressure and
temperature rises to allow the cell to safely vent.
In all other cases, for a battery failure, for a cell
failure, the only thing that has resulted is that disk opening
and the battery venting the electrolyte, which looks like smoke
to you or I, but it is venting electrolyte with no flame.
These particular cells had undergone more than 2 million
hours of operation on the airplane without a failure, and had
undergone millions of hours of operation in another industry,
also without a failure.
The test state of the art at that time was a nail
penetration test. And when that nail penetration test was
performed, it replicated every known failure mode of the cell,
with the exception of overcharge. And so, while the cells would
short circuit, their temperature and pressure would increase,
they would vent this electrolyte, which, again, looks like
smoke. But in no cases were there ever flame, and in no cases
was there ever propagation to another cell inside a battery.
For that reason it was considered state of the art through,
again, millions and millions of hours of operation.
On the JAL airplane and on the ANA airplane, what we saw
was some type of internal short circuit, but we don't know yet
what the root cause was, because that is still under
investigation. But the net result was a more energetic release
of energy from the cell than we had seen, either through the
nail penetration testing, or from any of the previous testing.
And so, to replicate that, we had to put a significant
amount of energy into the cell without overcharging. The only
way that we knew how to do that was to wrap a cell with a
heating element, and put on the order of 300 kilojoules of
energy into the battery in the form of heat to heat up the cell
so that it would burst its disk and vent the electrolyte. What
we found in that process was that it was energetic enough that
it released enough heat to cause other cells in the same
battery to vent, as well.
And so, when I think of the state of the art, we have
advanced that state of the art to the point where now we can
replicate a cell failure with sufficient energy to cause that
venting to propagate to subsequent cells in the battery, and
that is where the current state of the art is today.
Mr. Larsen. Mr. Chairman, could I continue?
Just to--for my edification, 300 kilojoules sounds like a
lot. Can you just explain--I am sure everyone else here knows
what a kilojoule is. Could you just explain what a kilojoule
is? I don't' know what it is, so----
Mr. Sinnett. It is--a good way to think about it is--the
cell of the battery, that is about 30 percent more energy than
that cell contains when it is fully charged. So you can think
about overcharging a cell by about 30 percent. That is the
amount of energy that we are talking about.
Mr. Larsen. Oh, OK. I will have a second round.
Mr. LoBiondo. Ms. Johnson? Questions?
Ms. Johnson. [No response.]
Mr. LoBiondo. No? Back to you.
Mr. Larsen. Sure, great, thanks. So, with the new state of
the art, would you argue, then--would you argue that that will
be the state of the art? Is that going to get in the literature
for the next lit review, and this is how you are supposed to be
doing it because we know better now?
Mr. Sinnett. I would imagine that for the immediate near
term it would be, until somebody thinks up a better way to do
it.
One of the ways we might not like it is that it is
overconservative at this point. We add a lot of energy to the
battery to make it do what it does. And you never want to be
overconservative, you kind of want to hit the sweet spot. But
for right now, being overconservative is better than being----
Mr. Larsen. And by overconservative, you mean you are
really stressing the battery beyond what anyone would ever
think it would be doing.
Mr. Sinnett. That is correct.
Mr. Larsen. Yes. So it ends up not being a realistic
situation?
Mr. Sinnett. It encompasses all realistic situations and
then some. And it gave us great confidence with the battery
enclosure that we have designed to go around the battery.
In fact, in our certification testing on the airplane, with
the airplane operating and the engines running, we wrapped that
same heater element around a cell inside the battery in the
newly designed enclosure, and we put that same amount of heat
into that battery cell and caused the battery to fail on the
airplane, while the airplane was operating, pilot is on board,
engines running, in a conformed certification test, and
demonstrated that, even while that single cell failed, the
battery continued to operate for the next hour, and the
airplane continued to operate normally throughout the entire
event.
Mr. Larsen. Are you involved with the ODA process?
Mr. Sinnett. I am involved as the applicant. And inside
Boeing we kind of have a firewall between the delegated
organization and the applicant, which is the designer, the
builder, the requester of the certificate. I am the designer
and builder.
Mr. Larsen. OK. You are getting at the crux of my question.
Because if Boeing is an ODA or has an ODA designation, we have
FAA working with the ODA within an organization, but that
organization also then is designing, building the equipment, in
this case an airplane. How do you keep those separate? Because,
you know, the watcher is watching the ODA. The ODA is supposed
to be watching the maker. But if the ODA and the maker are
under one roof, then how do we--how would we look at that and
say, ``Well, we need to have more separation''?
Mr. Sinnett. It is a--to a large degree, it is a process-
based separation that is rooted in our culture. For example,
while we are a designated organization today, we have always
had designed representatives of the FAA performing aspects of
the showing of compliance.
Now, since I started in Boeing commercial airplanes 23
years ago, it has been my history that I was taught from the
very beginning that when a Boeing engineer is acting on behalf
of the FAA, they are completely independent, and they have--
they cannot come under any undue management pressure to do
something that is against what they would term as best, from an
FAA perspective. And that is deeply rooted in our culture. One
of the quickest ways to see disciplinary action as a manager is
to provide any undue influence over a designated representative
of the FAA. And it is in our absolute culture to make sure that
they are independent from that perspective.
We believe that for a couple of reasons. One, it is one of
the primary legs in the safety stool. It--our whole industry
relies on that. Second, we also understand that, without that,
the certification process itself would take much longer than it
does today, and the net product would probably not be as good
as it is today, because we wouldn't have the expertise of the
individuals who know as much as they do about the individual
systems.
Mr. Larsen. Presumably, the FAA could pull an ODA status,
as well, if there were any problems.
Mr. Sinnett. That is right. The FAA can pull that privilege
from us at any time, if we are not performing it appropriately.
And, likewise, the FAA can take an individual who is performing
as a delegated representative and remove that individual, as
well.
Mr. Larsen. Yes. I will explore that a little more with the
FAA, I think.
I have got one last question, and it has to do with all
those airplanes sitting on the tarmac in Paine Field. And I
know you are moving to get those delivered, and very happy
about that. But it goes to the changes, now that you have the--
you have signed off on the new change of the new system with
the box and the vent. And then, incorporating that now into the
production process and moving those planes out, is that--does
that need to be separately certified, as well?
Mr. Sinnett. That change----
Mr. Larsen. The process of changing them out, putting the
new boxes in.
Mr. Sinnett. Yes. There were two separate certifications.
One was really related to the basic type design of the
airplane----
Mr. Larsen. Right.
Mr. Sinnett [continuing]. Changing to incorporate it. And
the other was a certification of the service bulletin that is
performed by the airlines to make that modification. Boeing
teams did that modification work for the airlines, but that was
under the service bulletin that had been approved by the FAA.
Mr. Larsen. Any involvement in developing that
certification for the process includes management engineers and
machinists on the line, making sure everybody is working off
the same page?
Mr. Sinnett. That is correct.
Mr. Larsen. Yes.
Mr. Sinnett. Right.
Mr. Larsen. That is it. Thanks.
Mr. LoBiondo. OK. Mr. Sinnett, we thank you very much, and
the subcommittee stands adjourned.
Mr. Sinnett. Thank you.
[Whereupon, at 11:22 a.m., the subcommittee was adjourned.]