STATEMENT OF
PEGGY GILLIGAN,
DEPUTY ASSOCIATE ADMINISTRATOR,
OFFICE OF AVIATION SAFETY,
FEDERAL AVIATION ADMINISTRATION
BEFORE THE
COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE,
SUBCOMMITTEE ON AVIATION,
ON
THE MOST WANTED LIST OF THE NATIONAL TRANSPORTATION SAFETY BOARD,
ON JUNE 6, 2007.
Chairman Costello, Congressman Petri, Members of the Subcommittee:
I am pleased to appear before you today to discuss the state of aviation safety with a focus on the recommendations of the National Transportation Safety Board’s (NTSB) Most Wanted List. The relationship and interaction between the Federal Aviation Administration (FAA) and the NTSB is an important component in aviation safety. Our roles are different, but complimentary. Through accident investigation, the NTSB makes findings of probable cause that lead to the issuance of safety recommendations. The FAA receives the vast majority of the NTSB’s safety recommendations. In turn, the FAA takes action on the vast majority of the NTSB’s recommendations, even when the recommendation asks that we develop new technology to address the recommendations. We always value the intent of the recommendations, even if we are unable to do exactly what the Board recommends. Their recommendations represent the ideal, our consideration of those recommendations must, by law, factor in certain realities.
At the same time FAA has a proactive safety agenda that is developed independently from the NTSB. Naturally, there are overlapping issues, and in many cases, the FAA is already pursuing safety actions well before the NTSB recommendation is received. We do not wait to act until the NTSB has issued a recommendation. Just one example of this would be the inspections that were mandated on the A300 composite rudders, following the American Airlines Flight 587 accident. As the NTSB continued to uncover key information in the investigation, we were gathering fleet information of our own. In fact, many of our safety priorities over the years have not been in response to the NTSB at all. For example, Traffic Alert and Collision Avoidance Systems (TCAS); the Commercial Aviation Safety Team (CAST) Safety Enhancements that indicated the value of Terrain Awareness and Warning Systems (TAWS); and the initiatives that resulted from Enhanced Airworthiness Program for Airplane Systems (EAPAS) were all developed independent of any NTSB recommendations . The FAA has a strong sense of responsibility as the world-wide leader for aviation safety, but we do appreciate that it is the role of the NTSB to push us to attain ever more ambitious standards.
The historic safety record we are currently experiencing has been the subject of discussion before this Subcommittee many times recently. Today’s aviation safety is not attributable to luck or good fortune, but rather it is due to hard work and innovative safety initiatives. It is important that we put the safety record into the proper context in order to have a better understanding of why it has come about.
About half of all the aviation in the world takes place in the United States. It is a large, complex system with strong regulation, with 116 major carriers and more than 2,300 smaller commuter and on-demand operators. Our scheduled carriers alone operate over 32,000 flights each day. Before an aircraft even enters our system, it has gone through a rigorous approval process against design standards that are the toughest in the world, followed by a separate approval process for production and quality control.
There are many ways to measure safety, and we use different approaches as we constantly analyze risks and evaluate the benefits of safety measures. One measure is simple and straight forward. It compares the number of commercial aviation fatalities per 100 million people carried. In the early days of commercial flight, the number of fatalities reflected the newness of the venture. In 1946 we had about 1,300 fatalities for every 100 million people carried. Jumping ahead to just the last decade, by 1994-1996, the current baseline period against which we measure our progress, that number had dropped to 45.7 fatalities for every 100 million people carried. And while that record must be considered remarkable, it has been significantly improved upon. The average from 2004 to 2006 has been 4.2 fatalities for every 100 million carried.
The safety improvement in commercial aviation is an incredible accomplishment, shared by the entire aviation community and it is a story that continues to improve. Some of the major improvements that have contributed in this decline in fatalities include pressurized aircraft capable of flying above most weather, and precision guidance systems which allow safe landings in limited visibility. The jet engine, the single greatest safety improvement, provides modern aircraft with large performance margins, and levels of reliability that are orders of magnitude better than the last piston engines in airline service.
But perhaps the most telling fact that explains the reduction in fatalities is the answer to the question, “What are the major causes of airliner accidents today?” Because the answer is, “There are none.” Let me cite three specific types of accidents which, like polio and smallpox, used to take a persistent toll, and which, like polio and smallpox, have been virtually eliminated through human ingenuity and determination in finding and implementing solutions. I say virtually eliminated because I cannot say with certainty that we will never see one of these accidents again, but I can say with certainty that they will not return as persistent and recurring accident types.
Mid-Air Collisions
The last mid-air collision in which a U.S. Airliner was involved occurred 29 years ago. While the installation of Traffic Alert and Collision Avoidance Systems (TCAS) is the most often cited improvement, as with most safety improvements there was a layered approach, including implementation of virtually universal radar coverage in the U.S. National Airspace System, installation of conflict alert technology in the radar system, and effective training of controllers and pilots on the use of this technology. This success story is instructive on two points as we look for technology to improve safety in other areas including the critical runway environment. The first point is that the promise of a specific technology can only be safely realized through a methodical implementation process, which assures that safety will not be degraded by unintended consequences of implementation, for example problems like software glitches or high false warning rates. The second point is that even with superior technology, the human element remains critical. This was tragically demonstrated in the skies over Germany five years ago, as the pilot of a Russian airliner, which was equipped with a state-of-the-art TCAS system, failed to properly respond to a resolution advisory because it conflicted with an air traffic controller instruction.
Controlled Flight into Terrain (CFIT)
The last commercial airplane Controlled Flight into Terrain (CFIT) accident in the United States also occurred 29 years ago. There are many parallels between the successful interventions addressing CFIT and mid-air collisions. While the institution of ground proximity warning systems (GPWS) is cited as the single greatest safety enhancement to counter CFIT, again, a layered approach was implemented, which included wide radar coverage and minimum safe altitude warning technology. Problems of false warnings had to be addressed as GPWS technology evolved, and the crew training element remained critical. In fact, the last airliner CFIT in the United States occurred when the flight crew disabled the GPWS, after mistakenly thinking the alarm was due to a temporarily excessive descent rate. The last CFIT accident for a U.S. commercial airplane outside the United States occurred 12 years ago in the non-radar environment near Cali, Columbia. Since that accident commercial airplanes, along with all turbine-powered aircraft with six or more passenger seats, are required to be equipped with enhanced GPWS, which uses terrain mapping technology to provide earlier and more effective warnings.
Windshear
Again, while the on-board warning system is a key improvement, progress has been made on other important safety enhancements, such as ground-based windshear detection systems, prediction and detection of severe weather, displays of this key information to pilots, and in the critically important area of pilot training. Modern realistic simulators that mimic the flight environment have provided situational training for pilots to recognize and either avoid or safely escape from severe windshear encounters. Based on this unmatched record of continuous improvement, the aviation community faces the critical safety issues we are discussing today with confidence and with the unabated determination to further improve.
It is within this context that I would like to touch upon several of the safety areas on the NTSB’s Most Wanted List and what FAA has done in those areas, both in response to NTSB recommendations and on our own initiative.
Fuel Tank Explosions
In the aftermath of the TWA 800 tragedy, all aviation safety experts were focused on how to prevent center fuel tank explosions. The accident fundamentally altered the assumptions held not only by the FAA and NTSB, but by the entire aviation community. Preventing another such accident required us to look at different safety options, including how to eliminate ignition sources and how to reduce the flammability of the fuel tank. In the 11 years that have passed since the accident, the FAA has been extremely effective in increasing the safety of fuel tanks. We have issued more than 100 Airworthiness Directives (ADs) and a Special Federal Aviation Regulation (SFAR) to reduce or eliminate ignition sources. The ADs addressed a broad range of issues, including fuel pump manufacturing discrepancies, wear of fuel system wiring, shielding of fuel system components, and overheating solenoids. The SFAR, issued in May 2001, changed the way airplanes are designed, operated and maintained. By the end of 2002, the required manufacturer design reviews resulted in the identification of more than 200 previously unknown ignition sources. As new ignition sources were identified, the FAA issued additional ADs to address them. But the sheer volume of ignition sources confirmed that reducing fuel tank flammability was the necessary and complementary strategy to improve fuel tank safety.
Beginning in 1998, the FAA charged the Aviation Rulemaking Advisory Committee (ARAC) to evaluate options for reducing the flammable vapors in fuel tanks. The first of two ARAC groups determined that on-board inerting was too costly and impractical. In 2001, the second ARAC working group determined that a ground based inerting concept presented a new set of safety and operational issues at airports. The ARAC group acknowledged that, at that time, on-board inerting options (most of which were used by the military in conditions very dissimilar to commercial aviation) were too complex, heavy, unreliable, and costly.
What became clear was that the solution to this pressing problem required entirely new approach and FAA set about finding that solution. FAA scientists and engineers challenged the assumptions that existed at that time and ultimately developed the first prototype inerting system for commercial airplanes. The purpose of an inerting system is to replace the oxygen in the fuel tank with an inert gas, such as nitrogen, in order to prevent the ignition of fuel vapor. This means that even if all ignition points have not been identified and dealt with, there is nothing that the ignition source can ignite, thus averting a catastrophic event. On military aircraft, engine exhaust was typically used to produce the inert gas, but the technologies available could not meet the safety standards required by the FAA and were designed to operate only a few hours per day or per week compared to the average 14 hours per day flown by a commercial airplane.
More recently, nitrogen has been used to render the fuel tank inert. Various techniques were considered for separating nitrogen from air for use in inerting. In May 2002, the FAA unveiled a prototype on-board inerting system. We believe our prototype is the simplest and most reliable technology now known. Finally, the FAA prototype is substantially lighter and smaller than the systems the military uses. This combination amounted to an important breakthrough.
To remove the likelihood of explosion from unidentified ignition sources, the FAA expects to finalize a rule to require airplane operators to reduce the flammability levels of fuel tank vapors. We believe fuel tank inerting is the best solution for meeting the standards outlined in the agency’s proposal.
The FAA is extremely proud of our work in this area. A tragic aircraft accident resulted in the NTSB making safety recommendations for which there was no existing technology at the time. Utilizing all resources available to us, we kept working the problem from all possible angles. We challenged assumptions and created new solutions. This is an example of the aviation community working at its best, combining ingenuity and resources to make flying safer.
Voice and Flight Data Recorders
The FAA views data recorders as important tools for the accident investigation, consequently, we are extremely sensitive to NTSB requests for improvements in this area. The information provided by Digital Flight Data Recorders (DFDRs) and Cockpit Voice Recorders (CVRs) is often the cornerstone in determining the probable cause of an accident or incident. Therefore, the FAA has had a generally positive reaction to NTSB recommendations for improvements to data recorders, including those for additional parameters to collect more information. We are in the process of three rulemaking projects that will address a number of the NTSB recommendations on data recorders. However, as much as FAA understands the priority NTSB places on data recorder recommendations, the fact is that there are no major accidents for which a probable cause determination has not been concluded. The value of data recorders is realized only after an accident when the information has been collected and analyzed; they do not prevent accidents in and of themselves. As accident rate attests, we must be extremely prudent with regard to how we proceed to improve aviation safety.
The first of these rulemaking projects is an NPRM that proposed a series of improvements to Cockpit Voice Recorders and Flight Data Recorders. Some of the proposed improvements are longer recording times, independent power sources for each box, and emergency power sources to keep the boxes running when the aircraft’s main power source is disrupted.
The second rulemaking activity is an NPRM, published in November 2006, to specifically address flight data recorder (FDR) data filtering issues. This proposed rule clarifies the FAA’s intent to ensure the accurate recording of flight data under all operating conditions. This clarification will ensure that the NTSB has the most accurate data readily available to conduct investigations in a timely manner.
The third rulemaking project began in November 1999 when the FAA proposed the addition of flight recorder equipment to monitor the Boeing 737 rudder system after several rudder system anomalies had been identified. The FAA made several safety improvements to the B737 rudder system, and subsequently mandated a redesign of the rudders system. In September 2006, the FAA published a supplemental notice of proposed rulemaking to assess the need for recording additional B737 rudder parameters.
The improvements required by these three rulemaking efforts will achieve the right balance between enhancing accident investigation and wisely investing our safety resources.
Icing
This is another area where the Board has recommended that the FAA design the solution, test the effectiveness of the solution, and then mandate the solution. As meteorologists will attest, simply understanding some of these icing phenomena is difficult and complex. And then determining how to address these phenomena to assure safe aircraft operations takes time. That’s why we have taken a multi-pronged approach to the icing issue by taking immediate safety actions, as well as performing longer-term research to improve our understanding of icing phenomena.
One of our most effective tools to address safety issues is the airworthiness directive (AD). We have issued over 100 ADs to address multiple threats from icing on over 50 different aircraft models. These ADs cover safety issues ranging from crew operating procedures in the icing environment to direct design changes. These ADs have had the effect of significantly reducing the icing risk to the overall fleet.
Following the issuance of ADs, the FAA conducts general rulemaking intended to institutionally prevent the same icing risk for future airplane designs that were averted by implementing ADs on specific models. FAA is presently in the process of two rulemaking efforts on icing. The first, which we anticipate publishing as a final rule, requires designers to demonstrate specific airplane performance handling qualities for flights in icing conditions. The second rulemaking is an NPRM, published on April 26, 2007, entitled Activation of Ice Protection, which would introduce requirements to ensure timely activation of ice protection systems (IPS). The proposed rule would require installation of an ice detector or activation of the IPS based on visible moisture and temperature..
The recommendation that we have not yet been able to address in rulemaking is related to a phenomenon known as supercooled large droplet (SLD) icing conditions. This phenomenon has been a challenge because conditions that result in SLD are difficult to forecast and detect. It is also not easy to reproduce in a test environment. So, to first forecast and characterize SLD, then reproduce it, and finally evaluate its affect on aircraft operations has required extensive research. Our research has engaged leading experts from academia, industry, and the government. Due to the technical complexity, our activities continue today. We are committed to identifying the right solution for long term design and operational requirements for the SLD threat. In addition, we have issued numerous ADs that direct the crews of certain airplane designs to monitor and detect early signs of the onset of SLD conditions and to exit the area immediately. These ADs serve as an effective interim measure until such time we complete our research on SLD and complete the necessary rulemaking.
Runway Incursions
Reducing the risk of runway incursions is one of the FAA’s top priorities. The agency has been aggressively addressing the issue and has made progress reducing the most serious incidents, particularly those involving commercial aircraft. The number of serious runway incursions – called Category A and B – has dropped by more than 40 percent since fiscal year 2001. In 2006 there was only one serious incursion for every 2 million take-offs and landings.
The FAA has implemented important new technologies to allow tower controllers to see everything that takes place around them. One of these is the Airport Movement Area Safety System (AMASS). AMASS tracks ground movements and provides an alert so controllers can notify the crew if evasive action is required. The FAA has installed AMASS at the nation’s top 34 airports. ASDE-X, or Airport Surface Detection Equipment, Model X, is an even more sophisticated surface detection technology. While AMASS is radar-based, meaning signals might bounce off rain and fog, ASDE-X integrates data from a variety of sources, including surface movement radars located on air traffic control towers or remote towers, multi-lateration sensors, and aircraft transponders, to give controllers a more reliable view of airport operations, especially during bad weather.
By fusing the data from these sources, ASDE-X is able to determine the position and identification of aircraft and transponder-equipped vehicles on the airport movement area, as well as aircraft flying within five miles of the airport. Controllers in the tower see this information presented as a color display of aircraft and vehicle positions overlaid on a map of the airport’s runways, taxiways and approach corridors. The FAA is in the process of enhancing ASDE-X with visual and audio alarms that will alert controllers to potential collisions.
The first ASDE-X was activated for operational use and testing at General Mitchell International Airport in Milwaukee, Wisconsin, in June 2003. In addition to Milwaukee, ASDE-X is now operational at T.F. Green Airport in Providence, RI; Orlando International Airport in Orlando, FL; Hobby Airport in Houston, TX; Lambert-St. Louis International in St. Louis, MO; Seattle-Tacoma International in Seattle, WA; Bradley International in Hartford, CT; and Hartsfield-Jackson International Airport in Atlanta, GA. ASDE-X is scheduled to be deployed at all 35 OEP airports.
The FAA is also testing new technologies that will alert pilots to potential runway incursions. One of these, called Runway Status Lights, is just what is sounds like – an advanced series of runway lights, not unlike traffic lights, that tell pilots whether or not runways are clear. The operational evaluation of the runway entrance lights using ASDE-X surface surveillance was completed in June 2005 at Dallas/Ft. Worth International Airport, and the system showed promising initial results. An enhanced lighting configuration is being installed on a second runway at DFW this year. The evaluation of Runway Status Lights with AMASS began last year at San Diego’s Lindbergh Field. Other new technologies include an experimental system called the Final Approach Runway Occupancy Signal (FAROS), which is being tested at the Long Beach/Daugherty Field Airport in California. FAROS is designed to prevent accidents on airport runways by activating a flashing light visible to landing pilots to warn them that the runway is occupied and hazardous.
Fatigue
Flight and Duty time rules have been in existence since the 1950s, and the 121 domestic and 135 scheduled rules were updated in 1985. The rules on pilot flight time and rest have evolved along with advances in commercial air travel. The FAA is confident that, overall, the airline industry complies with the FAA’s current rules. In the intervening time, much research has been done on fatigue, which has resulted in a better understanding of complex fatigue-related issues. The research tells us that this issue does not easily lend itself to a set of prescriptive rules. While the existing prescriptive rules have served us well, they do not allow for the flexibility needed to address the various flight regimes that exist.
Understanding the limits of a strictly prescriptive regulatory regime, we worked to alleviate fatigue through other means. Fatigue countermeasures were first developed by NASA, and include providing in-flight rest, as well as training crew members on the use of proper diet, exercising, and even caffeine to manage fatigue. Fatigue countermeasures are covered during Crew Resource Management (CRM) initial training and during CRM recurrent training.
It is also critical to understand the role that personal responsibility plays in fatigue and why prescriptive rules can only provide a framework for safety. Crew members, mechanics, air traffic controllers, everyone involved in the safety of flight must make a personal commitment to report for work well rested and ready to perform their duties. No regulatory scheme can instill that sense of personal commitment and professionalism.
One thing we know, aviation operations will always challenge us in the area of flight time and rest. Aircraft design allows for longer and longer flight times. Recently, FAA issued approval to Delta Airlines for flights in excess of 16 hours from New York JFK to Mumbai, India. This approval was our first implementation of a fatigue risk management approach. Delta proposed – and we analyzed and approved – a detailed plan to assure the crew is rested before the flight begins, is provided appropriate rest throughout the flight, and have sufficient rest before conducting the return flight.
The procedure specifically addresses the impact to circadian rhythm, including the recognized affect of circadian law which occurs at specific times in the daily cycle. This is an example of where we need to move in the future – away from prescriptive rules and into fatigue risk management.
Conclusion
In conclusion, Mr. Chairman, let me restate that the FAA’s first priority has always been, and will always be, safety. As I said at the outset, we very much appreciate the unique relationship FAA has with the NTSB and we consider them a vital partner in advancing the safety of our Nation’s skies. The interaction between the FAA and the NTSB is certainly a factor in the unparalleled safety record we have achieved in recent years. NTSB has the responsibility to push us and the industry by identifying everything that could be done. The FAA has the responsibility to determine the actions that will provide the greatest safety benefit. We believe we have achieved the proper balance and are, understandably, proud of the safety record we are currently enjoying. We will continue to strive to implement NTSB’s recommendations as quickly as prudence, technology and science will allow.
This concludes my statement, and I would be happy to answer any questions the Committee may have.