STATEMENT OF
NICHOLAS A. SABATINI,
ASSOCIATE ADMINISTRATOR FOR SAFETY,
AND
JOHN J. HICKEY,
DIRECTOR OF THE AIRCRAFT CERTIFICATION SERVICE,
ON
“FAA AIRCRAFT CERTIFICATION: ALLEGED REGULATORY LAPSES IN THE CERTIFICATION AND MANUFACTURE OF THE ECLIPSE EA-500,”
BEFORE THE
HOUSE COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE,
SUBCOMMITTEE ON AVIATION,
SEPTEMBER 17, 2008.
Chairman Costello, Congressman Petri, Members of the Subcommittee:
I appear before you today to discuss the procedures, policies and decisions leading to the certification of the Eclipse EA-500 (Eclipse aircraft), a very light jet (VLJ) that received Federal Aviation Administration (FAA) certification on September 30, 2006. There have been numerous assertions by heretofore unnamed sources that the certification of this aircraft was rushed, achieved despite it not meeting appropriate standards, and accomplished due to extreme pressure placed on the FAA employees responsible for certification. While I am prepared to discuss the details of the Eclipse certification, I must state unequivocally at the outset what goes without saying: that FAA professionals would never and, in this case, did not, certify an aircraft that they knew to be unsafe or one that did not meet standards. I am unaware of any FAA safety professional who would choose to put the safety of the flying public at risk by certifying an unsafe product for introduction to the NAS. Signing his or her name to the certification of an aircraft or component only if it meets detailed technical standards is fundamental to the continued safety of the national airspace system (NAS).
Because of the growing interest and alleged skepticism about the airworthiness of the Eclipse aircraft, I assembled a team of experts to review data compiled in connection with the certification of the aircraft, a Special Certification Review team (SCR). I felt it was important to have the SCR headed by a highly respected individual whose personal and professional integrity are above question. That’s why I was so pleased when Jerry Mack, a former Boeing executive who has extensive certification experience from the manufacturer’s perspective, agreed to head the team. The charter of the SCR directed them to conduct an independent analysis and evaluation of the aspects of the type certification of the Eclipse aircraft that we understood were the subject of concern. All of them are highly respected professionals with technical expertise in different areas critical to type certification.
The job of the review team was not an easy one but everyone pulled together and dedicated themselves, traveling around the country to meet with the key people and review the voluminous documents involved. Last Friday, the SCR announced its findings. The team’s bottom line was critical: FAA’s certification of the Eclipse aircraft was appropriate because it did meet the required standards. In addition, the team did not find any unsafe condition needing immediate attention. This is good news--that, in the opinion of some of the best technical experts in this country, the Eclipse aircraft meets the required standards and was, therefore, legally entitled to receive certification. Their report will be available to the Committee for your review.
But also important to me and my team was learning of the deficiencies the SCR identified with regard to communication within the certification team and with regard to the documentation of decisions. I take seriously the criticism that the teams we assigned to this project did not communicate well with one another or with Eclipse. We fully accept the SCR’s criticisms of the process and agree that changes need to be made. I believe that if our type certification team had documented its various concerns in issue papers, as required, and had followed that process to resolution, all FAA staff involved in the project would have better understood and accepted the certification approach that was used in this project. I assure you that we will take every opportunity to improve communication at all levels of our organization and to ensure that our staff are accountable and follow national processes to appropriately document certification decisions.
The Certification Process: An Overview
One of the challenges of this hearing is that the FAA’s aircraft certification process is highly complex and technical. It is an extremely dynamic process, which means that no two certifications are identical. Fundamental to any certification is to have FAA staff and the Applicant working closely together to establish general timelines and expectations, and to identify deliverables. The specifics of how the project should proceed are detailed in two planning documents, the Partnership for Safety Plan (PSP) and the Project Specific Certification Plan (PSCP). In these documents, the FAA and the Applicant agree to operating practices for a certification project. Each phase of the project is built on early mutual awareness of key certification issues, commitment to planning and managing the project, early identification and resolution of issues, and other elements to achieve the vision of the project. All phases of the project are designed to contribute to improving safety and assisting with the mitigation of cost and project risk. It’s an extremely interactive process with both FAA staff and the Applicant agreeing to specific goals and responsibilities.
During type certification the FAA determines whether the design of the aircraft meets all the applicable regulatory requirements. At this stage, the approval is of the type design, not subsequently produced aircraft (approval of which is authorized under a production certificate, described below). FAA regulations specify the safety requirements, but the Applicant is free to propose the method they will use to demonstrate compliance. In the type certification process, it is the normal and preferred method for an Applicant to propose methods of compliance and then document such methods in their certification plans. Most frequently, the Applicant will use the methods of compliance published in FAA general guidance material, because they are known to be acceptable and the results are more predictable. However, it is important to understand that while the regulatory requirements are mandatory, the specific methods of compliance are not.
It is also important to understand that the law requires the Applicant to achieve defined, minimum standards. If those standards are met, the Applicant is legally entitled to a type certificate.[1] Do not mistake the term “minimum standards” for “minimal standards.” It is unworkable to require anything other than the “minimum standards” prescribed in the regulations in order for the Applicant to know exactly what it has to demonstrate. Moreover, the FAA is required by law to establish clear regulations for these applicants to follow,[2] and is likewise obligated not to act arbitrarily or capriciously.[3] For an FAA professional to require something other than what is outlined in the regulations is not only inappropriate, it is illegal.
Once an Applicant receives its type certificate, it has six months to obtain a production certificate or an approved production inspection system. The production certificate is issued when the Applicant demonstrates that it can reliably reproduce aircraft that meet the approved type design.[4] Obtaining a production certificate is extremely challenging for a new company entering the industry because they must establish the physical and procedural infrastructure to develop the capability to consistently reproduce aircraft that conforms to the type certificate. Until a production certificate is issued, the FAA must inspect each aircraft the Applicant produces as it is being built in order for us to ensure that the aircraft meets the approved type design. This is why we require that the Applicant obtain the production certificate within six months of the type certificate. FAA cannot indefinitely dedicate resources to inspect every aspect of every aircraft built by the Applicant.
In addition, an FAA Flight Standardization Board (FSB), composed of FAA pilots and other experts in flight operations, usually begins work near the end of the Type Certificate activities and is required to address any unique aspects of a new airplane. It determines operational suitability of the aircraft and its systems, requirements for flight crew training aids, type rating requirements for pilots, and any unique or special training requirements. These are determined through flight tests, meetings with the Applicant, review of documents, etc. Setting these standards and demanding that the Applicant meets them are regulatory obligations of the FAA.[5] The FSB also determines emergency evacuation capability, the resolution of flight standards issues, and other tasks as appropriate. The Board’s membership includes operations inspectors from FAA district field offices or representatives from the FAA headquarters as appropriate, a board chairperson from the FAA’s Airplane Evaluation Group (AEG), and an alternate chairperson. While the FSB evaluation is not part of the certification process of the physical aircraft, it is an essential part of the evaluation of the aircraft because it determines how the aircraft may be operated.
We cannot stress enough that this brief description of FAA’s certification of an Applicant’s product is an extreme oversimplification of the complexity and pressures associated with the process. In turning to the specifics of the Eclipse certification, more of those complexities and pressures will become apparent. While the Eclipse certification process was fairly typical in terms of encountering those complexities and pressures, it was unusual in some other respects. The Eclipse certification process involved an Applicant that had never before attempted to obtain FAA certification of its product. The process also involved an FAA field office that—though very competent in certifying aircraft products—had never before been responsible for a high profile, highly anticipated product. This situation resulted in FAA headquarters carefully monitoring both the type and production certification of the Eclipse aircraft.
During the process, some differences of opinion or questions of regulatory policy that arose during the Eclipse certification were raised to FAA headquarters level for resolution. In this instance, I believe raising the conflicts or questions to headquarters was the appropriate and right thing to do. This Committee has been justifiably critical of the FAA when headquarters failed to step in when problematic issues arose in the FAA regional and district offices. This is a case where headquarters management properly intervened to support and guide our field staff in working through problems that arose.
Type Certification Issues
Some of the problems that were a focus of concern during the type certification process involved the aircraft flaps, stall warnings, screens blanking, and most significantly, how and whether the avionics should have been approved. As I briefly review each of these issues and why I believed they were properly addressed, I would ask that you focus on the standard that had to be met and remember that if the standard was met, the law requires FAA to issue the certificate.
For an aircraft to fly safely, it is important that the flaps on the wings operate properly. Consequently, there is a certification requirement that the aircraft have a system to prevent the flaps from moving to an unsafe, asymmetrical position. This problem was recorded only once during certification. However, test pilots did cite a more frequent problem of receiving flap failure messages. Most flap failure messages were caused by system errors. The problem identified by the test pilots was mitigated by improving the flight manual procedures to assure operational safety. The problem experienced by the pilots was not the result of the certification standard not being met.
A second area of concern involved what were viewed as too frequent stall warnings experienced by FAA pilots. The dialogue on this issue has often been referred to as “false stall warnings,” which is very misleading. The certification requirement is that the warning system activate as the aircraft approaches the stall speed. During testing, the stall warning system activated appropriately. There were no “false warnings.” What was ultimately determined was that the maneuvering speeds and abnormal flap landing approach speeds that the manufacturer provided to the FAA pilots in the flight training manual and the airplane flight manual, respectively, were slower than they should have been. Consequently, operating at those speeds meant the FAA pilots were flying closer to the stall speed than they should have been, thus resulting in a more frequent activation of the warning system than pilots expected. The pilots assumed the stall warning system was activating inappropriately and referred to the activation as false warnings. The fact was that the system worked properly, but some of the speeds the pilots relied on were inaccurate and, ultimately, changed by the manufacturer. Again, the certification standard, that the stall warning system notify the pilot that he or she was approaching stall speed, was met. The training manual and flight manual speeds were changed before the first airplane was ever delivered to a customer.
The next area we reviewed was blanking of the screens of the Electronic Flight Information System (EFIS). The EFIS provides many required controls and displays for the pilot. It consists of two Primary Flight Displays, a Multifunction Display, an Autopilot Control Panel, a Center Switch Panel, and a keyboard. There were a total of three screens on the control panel. Although there were times when a screen blanked out, the bottom line is that never more than one screen blanked out at any given time. The required standard is that one display of information, essential for continued safe flight, be available to the crew. In the case of Eclipse, the pilot always had the requisite information available to continue safe flight. Consequently, the required standard was met.
Finally, and perhaps most importantly, were the allegations that a portion of the aircraft’s avionics system was certified to less than the applicable standards. I say that this is perhaps the most significant area of concern during the certification process because it is this issue that ultimately resulted in the Director of the Aircraft Certification Service, John Hickey, getting involved in the type certification.
Fundamental to understanding this matter is to understand how the FAA certifies avionics. The manufacturer of any avionics component can apply to the FAA for a Technical Standard Order Authorization (TSOA). A TSOA allows a component manufacturer to certify its product for a broader use—i.e. to enable it to sell its product to a range of aircraft manufacturers, not just to Eclipse who was applying for the type certificate in this case. A TSOA is not required to obtain a type certificate. In this case, Avidyne, the avionics manufacturer received its TSOA after Eclipse received its type certification. When an airplane is certified and contains components without TSOAs, the aircraft manufacturer becomes responsible for the component, both in the design and in the production.
During the Eclipse certification, as the negotiated target date for the issuance of Eclipse’s type certification came closer, it became clear that Avidyne, the manufacturer of the avionics system, would not qualify for a TSOA by the target date. In order not to delay the timely issuance of the type certificate, Avidyne and Eclipse decided to have the avionics certified as part of Eclipse’s type certification, while Avidyne continued its separate, parallel work on getting its TSOA. The FAA could certify that the Avidyne product met standards on the Eclipse aircraft, without making the determination that it met requirements for a TSOA. This certification approach is common for components of an aircraft.
Because of the change in approach, a disagreement arose between Eclipse personnel and our staff in our Aircraft Certification Office (ACO). Specifically, the issue centered around a dispute as to what actions were necessary to achieve compliance with the standards. To receive TSOA approval for certain types of software-driven avionics such as the one Avidyne was developing, an applicant is explicitly required to demonstrate satisfactory completion of the industry standard, referred to as “DO-178B. However, to receive a type certificate, there is no explicit requirement to meet DO-178B. In fact, the regulation governing this lists multiple ways to meet the requirements.[6] Consequently, Eclipse submitted a plan to meet the type certification requirements through a combination of ground tests, flight tests, laboratory tests, and other activities.
It was the belief of the ACO staff that Eclipse needed to complete DO-178B testing anyway in order to achieve the type certification, and informed Eclipse of that requirement. Eclipse officials notified FAA headquarters officials that they considered the ACO’s requirement to meet DO-178B to be incorrect when seeking a type certification. Rather, Eclipse argued, the type certification standards allowed for its proposed plan for compliance.
John Hickey was concerned that FAA policies and procedures were not being followed and traveled to Albuquerque, accompanied by the headquarters officials tasked with ensuring the development and implementation of national certification policy. John and these headquarters staff met with the FAA certification team to discuss whether the appropriate standards were being required, given the request that the component be evaluated only as part of the Eclipse type certification.
I support John’s decision to elevate this matter by bringing in the headquarters certification policy staff. As I mentioned, this was a situation where there was an FAA field office that had not previously been responsible for the certification of a high profile, complex project and an Applicant that had never been through the certification process. The change in Eclipse’s compliance strategy came relatively late in the program and left little time for the FAA to develop a response strategy. It was entirely appropriate that headquarters evaluate the differences of opinion about how the matter should proceed. In the end, John left it to the headquarters policy officials to determine whether the Eclipse proposal that Avidyne’s product had already met the requisite standards for type certification, was appropriate. They ultimately agreed with the Eclipse position.
I realize that this decision created resentment and raised questions for some people. No one likes to be second guessed or overruled. I know that. It takes a strong manager to intervene in a process when he knows his input will be unpopular. But making difficult decisions that are the right decisions is what leadership is all about.
As a final comment on the issuance of the type certificate, much has been made of the fact that the certificate was signed on a Saturday. I want to reiterate the complexity and pressure involved in the certification process. High profile projects always involve a strong and dedicated push at the end to meet the negotiated deadline, if possible. The pressure is always to reach a decision. It is never to reach a particular outcome. The deadline is always negotiated for a reason. The Applicant needs to know whether it can be certified by that date—in this case, September 30, 2006--for its own business reasons. The FAA has agreed to provide the resources necessary to assist the Applicant and do the necessary evaluations by the target date. It is a shared goal. If FAA agreed to a date that fell on a Saturday, then it was because the office believed the goal could be met by that date. Certification on that date, regardless of the day of the week, should not receive undue attention.
Production Certificate Issues
Turning to the production certificate, Eclipse had six months from receiving its type certificate, or until the end of March 2007, to obtain its production certificate or an approved production inspection system. Until it received a production certificate, Eclipse could only produce airplanes with very close FAA supervision of its production system and of the inspection and airworthiness certification of each airplane produced. Once again, the deadline created pressure for those individuals working on this stage of the process.
Eclipse faced some challenges during this phase. The first Eclipse airplane was delivered to a customer at the end of December 2006. Subsequently, Eclipse fell behind in its delivery schedule and was unable to deliver airplanes to customers as promised. This may have been attributable to a number of factors, including that the company suffered from frequent changes in key personnel and an overall lack of awareness of aircraft production best practices. The company was frustrated that its production schedule was in disarray and believed FAA was part of the problem. FAA employees were frustrated at Eclipse’s inability to consistently reproduce a product that met the approved design standard, thus requiring continued heightened FAA supervision of the production process.
All the while, the March 30th deadline for production certification loomed large. The increasing pressures on both sides resulted in a degradation of the personal and professional relationships necessary to achieve success and led to a number of unprofessional encounters that once more came to the attention of headquarters and John Hickey. There were allegations by Eclipse that the standards being applied were inappropriate and allegations by FAA staff that the regulations were not being followed.
With this backdrop, in early March, John established an independent team to oversee completion of the production certificate and, in the interim, the airworthiness certification of individual airplanes. The team was made up of highly respected FAA professionals from across the country and led by Ron Wojnar, who is a senior advisor in the Flight Standards Service. The independent team found that some FAA policy and procedures for airworthiness and production certification were not being followed, and that there was no effective FAA management plan in place to provide a roadmap for the parties to understand how to achieve a production certificate in the requisite time.
Consequently, the first action directed by the team was to jointly develop and implement a revised, more detailed PSCP, one of the planning documents I described earlier. This management tool defines the roles, responsibilities and expectations for both the FAA and the Applicant in order to meet the desired milestones and ensure compliance with regulations and policies. It does not change any regulatory requirements. It just provides specific steps for how to meet those requirements taking into consideration FAA’s past experience with the Applicant and our knowledge of best practices. In this instance, it amplified a less detailed plan that had previously been developed.
As a result of the PSCP and weekly meetings or telephone conferences to hold everyone accountable for meeting the PSCP goals, the production certificate was issued on April 26, 2007. (The FAA granted Eclipse an extension of the six-month deadline for issuing the production certificate on March 29, 2007, as permitted by the regulation.[7]) A total of 11 Eclipse aircraft had been delivered prior to the issuance of the production certificate, with the FAA inspecting and certifying each individual airplane.
During the production certification process, two FAA professionals were removed from the production certification team, at the direction of the FAA Manager of the local Manufacturing Inspection Office. Their removal was endorsed by Ron Wojnar, the head of the independent team. The management officials concluded that these FAA professionals were frustrated with their interaction with their Eclipse counterparts. Understandably, their frustration may have led to a lack of objectivity—a factor that FAA management appropriately considered.
Once again, a headquarters action resulted in some local FAA officials being challenged about the way they had conducted the production certification process. Once again, it is understandable that those individuals, whose judgments and decisions were questioned, would be offended. And, once again, our leadership and the difficult decisions we’ve made have been challenged as inappropriately deferential to the Applicant. But the fact is that we sent in the best and the brightest to ensure the most appropriate outcome based on the legal requirements. That additional review by FAA should be commended and not condemned. The attention and interest of FAA headquarters staff should not be viewed as inappropriate. It should be viewed as a government doing its job to make the system safer and working to introduce ever safer products into the NAS.
Flight Standardization Board Issues
As the production certificate team was performing its duties, FAA’s Flight Standards Service began its review with the FSB. The FSB team is required to evaluate the manufacturer’s training programs, aircraft manuals, checklists, aircraft system performance, and equipment functionality to determine the aircraft’s suitability, training and flight checking requirements, and crew configuration for operation in accordance with FAA regulations. Because of the aircraft’s design and performance, the FSB was also required to determine the pilot type rating for the aircraft. Eclipse requested that the aircraft be certified for Single Pilot Instrument Flight Rules (SIFR) operations, and the FSB evaluated the aircraft in accordance with these standards.
For a new airplane requiring a type rating under FAA regulations,[8] the FSB uses the broad guidance specified in FAA Advisory Circular 120-53, for a type rating determination and to evaluate the manufacturer’s training program for a new aircraft. Additionally, FSB pilots/safety inspectors are required to complete the training program and operate the airplane to the standards required by the Airline Transport Pilot/Type Rating Practical Test Standards, and in accordance with the Airplane Flight Manual normal, abnormal, and emergency procedures and operating limitations. When it becomes difficult for the majority of FSB pilots to complete the manufacturer’s training program and be able to operate the airplane at the required standards, an aircraft’s training program could be deficient, its operational workload could be too high for the average pilot, or it could be a combination of both. If the FSB determines that the workload is too high, it will not issue a type rating for a single pilot.
The FSB met at the Applicant’s headquarters on September 23, 2006 and adjourned on October 6, 2006 without issuing a type rating for the operation of the aircraft. During this evaluation period or “Phase I,” the FSB found numerous problems with the aircraft, including screen blanking of the flight displays, nuisance stall warnings, flap failures, unavailable autopilot functions necessary for SIFR operations, etc. Because these issues led to an extremely high cockpit workload during IFR operations, it would have necessitated two pilots to fly the aircraft. At that time, the FSB was unable to issue a single pilot type rating for this aircraft as requested by the Applicant, and made recommendations to Eclipse that the problems be resolved before presenting the aircraft for another FSB review. The FSB process worked – our team evaluated the product according to our standards, and when the product could not meet those standards, the FSB refused to issue the type rating.
The FSB reconvened on December 6, 2006 (“Phase II”), after Eclipse indicated that the Phase I problems had been addressed. While many of the 15 original issues had been resolved, some were still outstanding. Additionally, the FSB found three other issues that needed resolution before a type rating could be issued. The FSB adjourned on December 14, 2006. Once again, the standards were not compromised, our rules were followed, and the process worked.
Finally, the FSB reconvened for a third evaluation (“Phase III”) in January 2007. The FSB found that most of the previous outstanding issues had been resolved, but identified four issues with the aircraft, some of which had previously occurred. Once again, the team required the Applicant to take corrective measures in order to bring the aircraft in compliance with the standards for a SIFR operations type rating. Eclipse did resolve all the problems during Phase III, and the FSB issued the SIFR operations type rating on January 26, 2007.
During and after every phase of the FSB’s evaluations, all the problems that came to light were briefed fully to Eclipse staff and management for them to address and resolve. A number of them were resolved while the FSB was present; others were resolved during the time between the phases. Management in both the Aircraft Certification Service and the Flight Standards Service were also info
In short, the FSB process worked exactly as it should have. The Applicant presented their aircraft to the FSB for evaluation and a type rating determination. The FSB tested the aircraft and found it lacking in certain respects. The team required that the Applicant resolve the problems before proceeding further, and the Applicant did. While it was an undoubtedly frustrating process on both sides, all the issues were in fact resolved, and the FSB, in accordance with the law and FAA policy, issued the appropriate SIFR type rating.
Conclusion
The certification of Eclipse was a challenging project. It is impossible to convey in a single overview the complexities and thousands and thousands of decisions that went into the aircraft’s certification. I know that this Committee understands the process is demanding one. Tough decisions were made and people were pushed to work hard. Could certain things have been done differently? Absolutely, but that would be the case with any lengthy, complicated process that receives this level of investigation and scrutiny after the fact.
Our bottom line is that FAA has a vested safety interest in the certification of new aircraft. Each new generation of aircraft tends to be safer than the ones that preceded them. Our regulatory standards continue to raise the safety bar as new technologies are introduced. For this reason, FAA wants new airplane programs to succeed. But by succeed, I mean we want to help manufacturers meet all the regulatory requirements for their product. But helping them succeed never means giving them a pass on regulatory safety requirements so they can meet delivery schedules.
A good government is a government that is dedicated to its mission, accountable to the public and responsive to the needs of its citizens. I understand and appreciate that this Committee wants to ensure that responsiveness does not result in less than vigilant regulatory oversight. I am keenly aware of your concerns because they are my concerns as well. As always, you have my commitment to holding my organization and the industry we regulate to the highest aviation safety standards in the world.
Mr. Chairman, this concludes my statement. I will be happy to answer your questions at this time.
