Portal:TWA Flight 800 investigation/Day2-2
NTSB Board Meeting on TWA 800
August 23, 2000
Day 2, part 2 of 4
part1, part3, part4
George Black: Would the deterioration of the wire, not only environmental deterioration but also an accumulation of maintenance practices that leads us to make these sorts of comments.
Bob Swaim: Well, Boeing, in their principle causes of wire degradation in their service letter, mentioned that over time, additional maintenance can induce further degradation, so it can be a contributor.
George Black: OK. Dr. Loeb, do we know what the manufacturers considered the design life of the existing aircraft's flight. For instance, a next generation 737 or Airbus 320 being produced today -- I seem to have read somewhere that the 747 was expected to last ....
Bernard Loeb: I don't really know the answer. I think the economic life of the 747 may have been 15 years, some of these are at 20 years, but they're predicated upon amortization of the cost and making it operationally economical for the carriers, I mean they've got to design an airplane that the carriers can make money with and they're not design lives in terms of how long the airplane will last or long it will remain airworthy.
George Black: Do we have any idea what they are projecting, though, for the aircraft that are coming ...
Bernard Loeb: I don't really know, Member Black, but we can certainly try to determine that.
George Black: The reason I'm saying this, the wiring on these aircraft is essentially the same, there are no new ideas ... they're still using the same sorts of wires and they're still in bundles and they will be subject to the same thing over a period of time.
Bernard Loeb: There are, of course, newer insulations, hybrid insulations available now that weren't available a number of years ago but, yes, you're essentially correct. The wiring systems are essentially the same as they were.
George Black: The accident airplane was scheduled to be retired at some point not too long after the accident, was it not? Do you know the answer to that?
Bernard Loeb: That is our understanding.
Jim Hall: OK. Let's be sure we know one way or another.
Bob Swaim: The aircraft was coming in for a check soon after ...
Jim Hall: Do we or do we not know, gentlemen, if we don't know, we don't know on that matter.
Bob Swaim: Sir, we know it was coming in for a check, but we also know that the 747 fleet was coming to the end of its life and that this airplane was coming to the end of its time. What we don't know, Mr. Chairman, is when this airplane was going to be removed from the fleet, we do know that it was in their plans to eventually eliminate these older 747s.
George Black: I know it was industry practice because there were a lot of them that Bob was able to find at Miranda and other places that had been retired permanently, they just weren't retired from the airlines so that they could do these intrusive inspections. And what I'm getting around to, here, is, was there any evidence that you found in any of the aircraft you inspected that, maybe maintenance was deferred on these airplanes when their projected retirement date was in view?
Bob Swaim: It's not something that we looked for and so is not something I can say that we saw.
Bernard Loeb: But I think we can say that all of the deferred maintenance that did exist in the ?? items and so forth were within as best as we know when we did look at those things that were within the regulatory scheme, and whether some things were being put off that would've otherwise been done that were not required to have been done, that we don't know.
George Black: One more, here. Bob, you mentioned that the transition from the DC10 to the MB10 -- I asked that question the other day when some people from Fed Ex were here, and apparently they're saying they did rewire those airplanes completely during that conversion, so apparently it can be done, there can be corporate decision made that, if you're going to keep an appliance for a certain amount of time, there's a cost-effective measure to rewire them to preclude some of these factors like hardening of insulation and things that later lead to difficulties, so I would add that to what you said, to use that as a comparison that apparently they are essentially rewiring those airplanes.
Jim Hall: Just so we're straight on the record, I called Fred Smith because that was a question and what he reported is that, in his estimation, changing over 90% of the wiring on the aircraft and that most or all of it is new avionics packages that they are putting in, which I think is similar to the 7 triple 7 avionics.
George Black: OK. Good.
Jim Hall: So it is not correct that they're doing all of it but they're probably doing in excess of 90%.
George Black: Substantial portion. Thank you.
John Goglia: It needs to be said here, that the age of the airplane, alone is not the factor here. An airplane that is maintained properly that we have good maintenance programs that get us into these problem areas and address those issues, those airplanes can last forever. Today's production of airplanes use the best materials that can be had at the time of manufacture. These airplanes last a long time. It really is a question of making sure that what happens to them after they leave the assembly line picks up on all these problem areas. And what we've identified here is some real shortcomings in the ability of industry to pick up on some of those areas. But had those areas been addressed in a proper way, we wouldn't be here talking about it.
Jim Hall: Well, with all due respect, excuse me John, I think that we've laid out here, obviously, is that the longer an aircraft is around, the more changes and modifications have to be made to it and more attention has to paid to the maintenance. And I had not seen with the FAA recommendations or in the Boeing submission that the industry, yet, is paying the type of attention it needs to pay to older aircraft. And I do know that everyone makes these statements and that's why I want Dr. Ellingstad to look at the facts.
We are the repository of the aviation statistics, we ought to answer the question whether or not we are seeing any trend in terms of the aging fleet and the number of accidents and incidents particularly as it relates to in-flight fires and other type of electrical problems. But we have a White House task force, we have the ATA and everyone else trying to address this issue, so I agree with what you're saying but I think it's extremely important to point out that most people understand that, as you get older, things degrade, because everybody has a body that they live in and knows what happens there.
So, that's just a comment, but I don't want to leave the impression that we've resolved in this issue that age is not a factor because I personally believe it may be.
George Black: Mr. Chairman, just along what you said here, there's a press release put out by the ATA on the 3- year fuel systems review a few weeks ago, and one of the first statements in the press release is that the fuel tank systems of the world fleet -- that would be all of the fleet -- are soundly designed and do not degrade over time, would you agree with that, Bob?
Bernard Loeb: Obviously, we disagree with that notion and I think it is a part of what Member Goglia was saying. I mean, if the attitude is going to be that there are no problems, everything is fine, now I think there's a difference between saying these problems reached a level of the airplanes being unsafe and should not be flying -- that is not at all what we're saying.
If we believe these airplanes right now were unsafe to fly, we would have an urgent recommendation that we would be proposing to the members of the Board and hopefully would be going on to the FAA. That's not what we're saying. However, that's not the same thing as to say that there are no problems.
There are problems, we found the problems, they need to be addressed, and if they're not addressed, and if the attitude is they don't need to be addressed, then Chairman Hall is correct; we need to do something about that because certainly as these planes age there are going to be more, but Member Goglia's point is well taken as well, and that is that they need to get on with the job and fix these problems and there's a lot of things including training, including better instructions, and including doing in some cases what they're supposed to do -- to keep these airplanes in better shape.
George Black: And this report actually they indicated they found some of the same things that Bob was finding; they felt we did not think that rose to the level of degradation. Thank you.
Jim Hall: I think Member Goglia had an additional point in regard to the study I requested that I think is important from his own experience and I think everyone knows that -- I don't know that everybody knows -- but the background of all five Board members is available on the internet and I forgot to mention that this was being broadcast at www.ntsb.gov -- supposed to do that in my opening statement -- but Member Goglia has an extensive background in the maintenance area of aviation and speaks with a great deal of personal knowledge in this area.
John Goglia: The only comment I had, and it's not unknown to anybody here on the panel, is that we don't have the data to really get in to do that. As I said earlier, I never in all the years that I worked, never filled out a service difficulty report or any other mechanism to report wiring problems.
Even if went in and something was broken, something was reported not working by a flight crew, and we went out there and found the cannon plug burned, a very common occurrence, very similar to the picture Bob had shown with the burned wire, we would replace it -- replace the cannon plugs, repair the wires, that would be the sign-off in the logbook, the recordkeeping would be correct, but that recordkeeping did not close the loop with engineering. It closed the loop for the airplane. It was not captured anywhere.
So if we go in and try to look for data to support any position on wiring, we're not going to have the data. And most of you here are engineers and you know that if you don't have the data for an engineer, you're talking to the wall, because engineering is driven by data. (laughter)
Jim Hall: Well, speaking to that point, I think one thing we can agree on is looking at the age of this audience, we need a break right now, so let's take a 15-minute break and reconvene at 11:15.
Afternoon Session
Jim Hall: We will reconvene this meeting of the NTSB. The Board is in a review of the report on the accident report of Flight 800 of TWA accident that occurred off the coast of New York in July of 1996. We are in the midst of a presentation on the wiring and maintenance issues with Mr. Swaim and it is now Member Carmody's turn for questions.
Carol Carmody: Thank you. First of all, to revisit the subject of SDR difficulty report and we were told that there was no code for reporting wiring difficulties, during the break I was stopped by someone from the ATA who told me, in fact, the ATA established, in the 1999 revision of ATA Spec 100, a new chapter to cover wiring faults -- Chapter 97 -- and this was apparently given to the FAA, so this leads to ?? now a code for reporting such difficulties with wiring, and I wanted to pass that on. I think it was news to all of us, here.
On the subject of SDR service difficulty report, I guess I'm sort of discouraged this continual difficulty with difficulty reports. I remember back in 1989 when I worked on the Senate Commerce Committee we did a study and had a hearing on this issue because it was discovered that the SDRs were not being used and they weren't effective and the data wasn't good, and I'm hearing this 11 years later and I guess I'm wondering why we're still in this situation. What is the problem with the SDRs? Are they not used? Are they not reported properly? Is the data not assimilated? Is there anything we can do to make it better? I throw that out to anyone ... Mr. Swaim, perhaps.
Bob Swaim: The Safety Board has made recommendations regarding SDRs and shortcomings in the SDR systems and I should defer to Mr. Sweedler. I became an AMP mechanic at about 21-22 years old. I don't think I ever filled a single one out. But as far as history from the Board's perspective, I defer to Mr. Sweedler.
Carol Carmody: OK. Thank you.
Barry Sweedler: The Board has made a number of recommendations dealing with the SDR system. The two that are cited in this report go back to 1993 and we made another series in 1997.
Jim Hall: What I'd like to do is ask Member Goglia to tell us what a service difficulty report is, and what the purpose of it is so that particularly the family members in the audience will know what you're talking about Mr. Sweedler.
John Goglia: Certainly. Basically, when one is working on an airplane and you uncover a problem, you encounter a problem, in certain areas you are required to fill out notice, essentially to the FAA, that you found this problem, giving what the initial problem was, what your findings were, and what your corrective action was. And those are collected, stored electronically -- I believe they do them in Oklahoma City -- and trends can be developed from those.
By not having the codes for wiring, for example, all of the work I mentioned, all of the times that there were difficulties encountered that didn't get reported, it didn't funnel up through the engineering departments for somebody to look at it. It didn't put the lightbulb on to say there may be a problem with this particular wire circuit or this component. Therefore, it never received the attention on a fleet-wide basis, and fleet-wide means all airplanes around the world. So, it didn't receive the attention it should've and could've, and the corrective action that would've solved the problems.
Everyone of us in this room are used to traveling on airplanes, going to the airport, and we're going to leave at 12 o'clock, and we're going to leave at 12 o'clock with the exception recently of air traffic delays. But we get very complacent over the reliability of the part? The service difficulty report played a significant role in developing that reliable airplane. It allowed the engineering community to focus on the things that were causing these airplanes not to leave on time -- the delays for maintenance purposes. Without that, we would still be sitting in the 1950s with airplanes that only flew three or four hours a day. It has contributed greatly to the process we have today, but it's not perfect. And we need to put back into the process a very robust reporting system so that the engineering community can get the data they need to keep the system healthy.
Carol Carmody: Well, that goes to my point, then -- I'm gathering that if nobody has filled them out that there is not a requirement, or if there is a requirement, it's not a very onerous one. Is that correct? Is there a requirement to fill out an SDR when you find something?
Bernard Loeb: The answer to that is, it depends. It depends on what you find. There're requirements to fill out certain things and some things are not required to be filled out, very minor things that are done and tweaking, and even more importantly, some things are reported more religiously than others. Some things are virtually never reported and, as Member Goglia said, are in fact some cases not codes that are sufficiently precise to be able to get that information into the database in the first place.
SDRs we have looked at for, since I've been at it, for more than 20 years, we use them in accident investigation and incident investigation to see if there's been a history or record and this has to do with general aviation as well as air carriers, and we've had problems with them throughout from time to time, although it's a very valuable database in some respects. But there are deficiencies that we've seen over the years. We've made recommendations. The FAA has come back at times and indicated that they were going to improve things and, in fact, Barry, I guess you're going to finish up and explain where you are right now?
Barry Sweedler: Right. The recommendations that we made going back to 1993, we asked the FAA to review the reporting items and establish standardized reporting formats for malfunction or defect reports and service difficulty reports and include the capability of electronic submission. The FAA has worked with the ATA and they have issued an NPRM and a supplemental NPRM and, back in 1997, we made another recommendation which asked them to modify the Safety Difficulty Reporting system so that it contains more complete and accurate information about component failures, for example, revise the various SDR forms and database to include cycles and times since last inspection.
For failed components, we asked them to relate to the operators who submit SDRs the need for complete and accurate information when they report component failures, and remind the FAA inspectors assigned to part 121 and 135 operators of their need to review the component failure reports for accuracy and completeness. Now, final rule is being crafted and the best information we have from the FAA is that there should be a final rule -- in fact, it has been ?? that it's in coordination and it should be issued late next month. So, in about a month from now, the FAA anticipates revising the system with a final rule. So, I think some progress is being made --it's taken awhile -- but hopefully it will address some of the concerns that we have had.
Carol Carmody: That does sound like progress. Thank you. Going back to the wiring issues, Mr. Swaim you mentioned there are no user-friendly manuals for wiring. I take it by that you mean there's no instruction on how to clean, how to inspect, how to proceed ... is that what you meant by user-friendly?
Bob Swaim: Well, those are two separate subjects, the instructions in the books, and just the usability of the books -- being two different subjects. By user-friendly, unless you know where it is, the experience of the Standard Wiring Practices Manual, information is very hard to find. It's also a very bulky set of manuals that you don't simply pick up and carry into an avionics compartment and work in the airplane -- it's very difficult.
Carol Carmody: Is there specific guidance on what, for example, what liquids might cause damage, like the anti-corrosive ?? or the lavatory fluid ... is there specific mention in the manual for that.
Bob Swaim: Currently, very little.
Carol Carmody: Hmmm???
Bob Swaim: Currently, very little.
Carol Carmody: Very little. So this is just something that people learn by experience or word of mouth, trial and error ... something like that?
Bob Swaim: I think Member Goglia hit it on his GVIs -- general visual inspections -- when you're doing an inspection of a compartment, you're just supposed to do a GVI, make sure it's generally clean.
Carol Carmody: I had a question in the report on page 325, the first paragraph there. It talks about a recommendation the board had made in 1990, which asked the FAA essentially to issue an AD requiring a maintenance inspection of wiring bundles or additional wiring that had been added since manufacture. And the FAA did not choose to do that and they cited the Boeing maintenance planning document. Does this mean, then, that there is no specific requirement for a particular inspection when wiring is added, that it just would be seen when an inspection is routinely made, there would not be a specific look at that?
Bob Swaim: That's essentially correct. It goes back to the GVI subject, the general visual inspection of the area.
Carol Carmody: And I notice that we closed that one with unacceptable action -- there's been no change, I guess, since that time. Thank you, that's all I have right now.
Jim Hall: Member Goglia had asked, will you explain the GVI process.
Bob Swaim: The general visual inspection is laid out on one page in this manual we've come up with, this accident investigation report. Basically, what it says is that you go into the specified area, for example the center wing tank of the seven compartments, and you inspect each of the items in there for their integrity and any type of security and degradation and cleanliness that you can find in that area.
John Goglia: Does it specify how close you should be when you look at it?
Bob Swaim: The answer in the TWA Manual is that you can clearly see it or something along that line ... its hands and mirrors, you can use inspection mirrors, flashlights, so there is a suggestion that you be close enough that you can adequately inspect backsides and visually see what is contained in the area.
John Goglia: And if you have a wire bundle as you mentioned yesterday, as thick as somebody else's wrist, not mine, you're not to break the bundle open, you just look at the outside.
Bob Swaim: Absolutely not. You only look at the outside and, as I spoke with a French family member this morning, I, as a typical past AMP have grown to accept certain things in airplanes and now in this presentation this morning, we've made some of them to light, some of us in the industry or some people in industry, have taken as for granted, conditions in the airplanes and we're starting to take a second look at that.
John Goglia: Thank you.
Jim Hall: Page 552, there's a paragraph in this report in the analysis section, to assist in addressing these problems and discussing the wiring maintenance problems and the FAA and other aging issue problems, established the Aging Transport Systems Rule-Making Advisory Committee. The Board is encouraged -- activities in which the Safety Board has been following with great interest -- the Board is encouraged that other government agencies including the Navy and Airforce have increased their research into aging aircraft systems and shared the resulting information in reports with the FAA and that the White House has formed a Wire Safety Research Inter-Agency Working Group. Although the FAA's research is scheduled to continue into future fiscal years, the charter of the ATSRMAC will expire in January 2001, unless it is extended.
In light of the short time remaining for the completion of the ASRACs work, the Safety Board is concerned that the final reporting recommendations may not fully and adequately address all of the issues identified in the aging transport non-structural systems plan. When did this committee begin its work and what is a reasonable period of time and staff's opinion for this work to be completed, and should we recommend that the work be extended since it's due to expire in less than six months?
Bob Swaim: Well, sir, the beginning of the -- stand-by please -- the aging transport systems order from the DOT is dated Jan. 19, 1999. And, as I mentioned previously, it expires in January of 2001. There had been comments as Member Black mentioned from industry that there essentially aren't any problems after they'd gone and looked at some airplanes.
Jim Hall: Is that an ATA report?
Bob Swaim: The ATA made the aging systems task force -- the answer to your question is yes.
Jim Hall: That's what I thought. And that report that we have here today, where is that report? Let's enter that report in the record. The Aircraft Fuel System Safety Program Report is prepared by the international aviation industry, it was issued on August 4, 2000 and I'd like that, unless there's objection, for that to be made part of factual documentation of this accident.
John Goglia: Mr. Chairman, I'd just like to clear something up. Member Black read a press release earlier and the person quoted in that press release has indicated, not only to me but to others, that that quote was a mis-quote; it did not clearly state what was said and, just for the record, would like to correct that.
Jim Hall: Well, he ought to ask the media to correct it as well because every time they misquote me alot and you have to chase them around and ask them to clarify or correct. They can put out another press release to correct his quote. Well, go back, Mr. Swaim ...
Bob Swaim: As far as the ASRAC, I think the long story short here is that the proposed safety recommendation is that, regardless of whatever their conclusions are, implement the aging systems plan and the seven points. We've had a number of discussions with the FAA on this issue and I think we've made our points clear to them but, however, what we're saying in this recommendation, Mr. Chairman, is what you put out in the plan -- we agree with, it's addressing the right issues and so forth and make certain, regardless of what the Rule-Making Advisory Committee comes up with, you implement what you're saying you found in the process that led to the plan and which put forth in the plan.
Jim Hall: And I think that the major concern there is the credibility of the system to produce on what they say they're going to do, because it's not the first time we will have asked for them to address this issue. As Member Hammerschmidt pointed out, this issue was discussed previously and as a result of an event that was not catastrophic in 1993, 1994, Mr. Swaim tells me and, Mr. Swaim, the public needs to know that it's very difficult with the number of major aviation accidents here to keep one person on one accident all the time. And Mr. Swaim has dedicated almost all his time for four years to this particular accident. But I think that family members and others who are observers would say, we've heard this before ... is there going to be a difference ... can you all give me any assurance that there will be a difference??
Bob Swaim: We certainly can not, but that's the reason that we are proposing the recommendation that's in the draft report.
Jim Hall: Very well. Well, I want to be sure that we follow up very closely. Mr. Sweedler, your successor, who we have not announced yet or will be selected -- you will have an interim successor and then someone who will be selected -- needs to follow up on these recommendations and particularly on these and be sure that what is being said is being done.
Barry Sweedler: Yes, Mr. Chairman.
Jim Hall: Is that all, Mr. Swaim? Continue. I got carried away.
Bob Swaim: No, sir...I think you pretty well captured it.
Jim Hall: Cause I mean, you know, I had one of the family members observe to me at the break and I've tried to put into perspective all the people that are involved in this event, whether it's the airline, the corporation, the various groups and parties, all the people -- the interested citizens who have written, these five members of this Board try to do a very good job of being sure that we read and consider everything that is presented to us.
But, on this particular issue, we had the structural failure with the Hawaiian aircraft and as a result, that changed the system in terms of aging structures. I would like to think that this event would change the system in terms of aging systems on aircraft, because I understand everything Member Goglia is saying, but I also know -- I follow very closely the aviation industry in this country -- we are extending the life of many of these aircraft well beyond what they put as their economic design life.
I think experts say that to be done safely, it has to be done carefully. And while many people may have a classic vehicle that they themselves take care of, if you have a classic airplane, the general public and those who get on it, is looking to the government regulators to do their job to ensure that the operators in the industry are properly maintaining these aircraft if our system of government is going to permit them to fly indefinitely, which is presently a decision that we have in this country.
So I think it's very, very important -- I think it's probably, in many ways, the most significant thing in terms of the airplane, that comes out of this tragedy. Do any of the other members have comments or questions for this area before Mr. Swaim concludes this. John? George? Carol? Yes. Yes, I would like to have this document added as an addendum to the report if that's all right with staff.
?: It will be put into the docket, yes.
Jim Hall: Or you want it added to the report?
?: I'd like to take that under advisement -- see if we can discuss that if that's at all possible ... simply because of the size and what that's going to do but we can talk about that afterwards.
Jim Hall: Well, you heard Member Goglia's recommendation and I would appreciate it if you would consider it and get back and let us know.
?: OK, will do so.
Jim Hall: I will definitely want it part of the docket; whether it's part of the report is a matter to be resolved.
?: It will be sir.
Jim Hall: Now Mr. Swaim, you have spent four years of your life on this subject and these are the two days that are focused on your work. Is there anything that's not been covered that you think is significant that we ought to discuss? And we'll take as much time as you think to be sure it's discussed.
Bob Swaim: Thank you, sir. For the families, I'd like to emphasize, to point out, that the Safety Board makes recommendations out of every major accident; they'll come up with some issues that seem to be crucial but, Chairman, you put your finger on it that this has been a watershed accident. A lot of the things that we have seen this morning are in the process of change. The military and the civilian wiring world are now working together to look at these things, see what the problems are, to address them.
This has been a watershed accident. It, alike Aloha, except in systems, for aging systems, for circuit protection, and for vapor protection. And the White House commission that you mentioned, the inter-agency working group is spreading this behind this aviation accident such as car generations, so thank you. And the last thing is, I'd like to recognize one of my group members who died last November. I understand his family is watching on television and Chris Hartonis?, he was very close to all of us and he was the one that really pushed the transience suppression device. He was an FAA employee who, unfortunately, passed last November.
Jim Hall: Well, I'm sure everyone joins you in sending in condolences to the family. We will now move to the issue of design and certification issues and Dr. Loeb has been previously introduced. Dr. Loeb, if you would please proceed with that presentation.
Bernard Loeb: Thank you, Mr. Chairman. As I indicated yesterday in my opening remarks, the current certification philosophy assumes that a flammable fuel air mixture exists in the fuel tanks at all times and attempts to preclude fuel tank explosions solely by eliminating all ignition sources. In fact, as you have heard during this Board meeting, a flammable mixture does exist in many airplanes for a good portion of the time -- especially in airplanes with air conditioning packs located beneath their center wing tanks.
We believe that this certification approach is flawed because we know it is not possible to reliably eliminate all ignition sources. In fact, it is not even possible to predict all ignition sources. But failure modes and effects analyses that are now used as a part of the means for demonstrating compliance with certification requirements cannot and should not be relied upon solely to demonstrate that no ignition source will exist.
There are several reasons why these analyses are not always reliable. Inadequate or incomplete databases that can produce unrealistic or flawed data, and we just some heard some discussion on that on the SDR databases. The inability to accurately predict all failure modes and the probability of the predicted failure modes. The exclusion of certain failure modes; for example, we're talking about uncontained engine failures, bombs, explosive charges, and post-crash fires. And, finally, the flawed premise that maintenance and inspection will always detect or fix failures.
Staff has concluded that the most effective approach to prevent fuel tank explosions is to address both: that is, to continue to attempt to eliminate ignition sources, but also to preclude to the maximum extent possible, flammable vapors in fuel tanks. The Safety Board's December 1996 recommendations ask the FAA, in the long term, preclude operation of transport category airplanes with explosive fuel/air mixtures in fuel tanks and, in this regard, to consider airplane design modifications such as ?? systems.
The December 1996 recommendations also ask the FAA to, in the short term, require modifications and operational procedures to reduce the potential for flammable fuel fixtures. The FAA has proposed to minimize fuel tank flammability in newly designed airplanes, but has not done so yet for the existing fleet. The FAA is also evaluating the use of directed ventilation to cool the center wing tank area, the use of ground-conditioned air instead of air conditioning packs when the airplane is on the ground, and, of course, the use of inerting systems and they're looking at both on-board and on-ground systems.
Although we recognize the benefits of fault-trees?, and failure modes and effect analyses, and I do want to emphasize that we do recognize their benefits, staff nevertheless remains concerned more generally about over reliance on these analyses and the certification process, especially in the case of failure modes that can be catastrophic. We believe that the Board's upcoming aircraft certification study should examine whether certification standards in general should require a reliable, independent means for overcoming or counteracting any potential failure that could cause catastrophic results regardless of the calculated probability of that failure. The staff and I are know prepared to address any questions the Board has about this portion of the draft report.
Jim Hall: Very well. Thank you, Dr. Loeb. Well, I'm going to defer to Member Hammerschmidtshmidt. I've got some questions I want to ask you, Dr. Loeb, and I can't put my hands on them right now and, unless the Board objects, I'll come after Member Hammerschmidtschmidt with my questions. Go ahead, John.
John Hammerschmidt: Thank you. I don't have many questions if any questions, really, in this portion of the report other than a comment. Compared to much of what we've been discussing thus far in this Board meeting where we can visualize, for example, wiring which has been contaminated on an aircraft, and the size of the fuel tank or what the wreckage looked like -- this subject, is to my view a lot more arcane....dealing with probabilities to the several decimal points.
My only question would be, I noted something interesting, in particular in this section where we make reference to what was learned from the investigations of the Space Shuttle Challenger accident and also from what was learned in the Three-Mile Island Nuclear car plant accident investigation. Could you elaborate on why we included those examples in the text of the report.
Bernard Loeb: Yes. The main reason we used those examples was to indicate the difficulty that engineers and designers face in attempting to predict, to divine, to come up in any way they can with the potential failure modes and the basis for most of that is your experience. You draw upon what you have learned throughout your experience and what the databases tell you, as well, and which is one of the other concerns.
Given that we have a variety of databases that intend information, they're not all consistent, some are better than others, some are worse than others, but they all have deficiencies and flaws. Given that that is one of the bases for being able to predict potential failure modes that the system just doesn't work very well. And the Challenger accident, the 3-Mile Island accident, the accident that involved US Air 427, the 737, and the FAA's Engineer Test and Evaluation Board that took place after the completion of the US Air 427 report -- all of these demonstrate very clearly that it is not rational to believe that we can predict all failure modes.
There will be failure modes we will not be able to predict. There're going to be surprises that we learn, unfortunately, only after, hopefully it'll be an incident not an accident but in many cases it's accidents, and accidents that take lives. So the answer to that is to recognize in advance that we can't predict all these failure modes, and do something about it, and what we're recommending in the long run that we've already recommended as a result, in fact, of the 737 of USAir 427 is redundancy.
What redundancy means is independent systems. If one fails, the other one picks up, and we're talking about a case where a failure would, in fact, have the potential to lead to a catastrophic accident. That's a long answer to your question of the Challenger, and those accidents clearly demonstrated that you can't predict all failure modes.
John Hammerschmidt: Well, long answer but a very good answer, I think. So, that's all I have, Mr. Chairman.
Jim Hall: Alright, well I apologize -- I tried to get these questions but I've got so much paper, I can't find what I've got and I'm too old to remember all the questions. Page 534, Dr. Loeb, line 4 through 13. In that discussion I gather there was not a fault-tree? analysis done to the center fuel tank on the initial certification of the airplane?
Bernard Loeb: That's correct. There was no requirement that that be done.
Jim Hall: And then the fault-tree? that was then done by Boeing, why was that done?
Bernard Loeb: We requested, as part of the investigative process, that asked them if they would do a fault-tree? process to see how they would come up with the failure modes and probabilities they would put on them.
Jim Hall: And what's the staff's opinion of that study, of that fault-tree??
Bernard Loeb: I can let Scott Warren talk about that a little bit more in detail because he is the one who was involved, let me just summarize and say that they produced a document that we had some difficulties with. We submitted the document to some experts at NASA Langley to look at and they likewise had significant difficulties with it. Boeing did indicate that the document was not done as part of a requirement by the FAA to do an FMEA or Failure Modes Effect Analysis and indicated that perhaps it would've been different under those conditions. We made it very clear to them that this was part of a federal investigation but I'll let Scott talk a little bit more what the difficulties with it were.
Scott Warren: When we got the fault-tree?, we reviewed it thoroughly and completely ourselves and determined that there were a number of items in that fault-tree? that we had concerns about, specifically the failure rates and especially the exposure times, which is the amount of time that a failure can be considered to be latent in an airplane -- in other words, not have any symptoms.
Those two items make the probability of failure, mathematically, ?. We considered both those items to have some significant difficulties. To ensure that our suspicions about the ? were correct, we did send the ? to Dr. ? at NASA Langley ??? Langley Space Flight Center, and they reviewed it thoroughly for us and collaborated our opinion ?? had a number of shortcomings -- the exposure times specifically -- and also the construction of the tree, they felt would not stand up to a peer review if it were submitted formally.
Jim Hall: Page 534, lines 18 to 19. As you know, Dr. Loeb, we asked the staff to do a safety study in March of 1999 after US Air 427 on the certification. I realize that, since that time we ended up with the EgyptAir, Alaska Air, John Kennedy and Payne Stewart accidents, among others. When do we anticipate this study to begin?
Bernard Loeb: Well, I thought you were probably going to give me an opportunity to say something that Vern Ellingstad would probably come up out of his seat. I think -- Dr. Ellingstad and I will get together right after this and try to lay out a plan for how this will be done and get it started.
Jim Hall: Now that we have this major report out of our system, I'd like to see some resources addressed to that. Page 535, line 7 to 8. You say the Safety Board is aware that service history data maintained by manufacturers do not include data from all operators. Would you please explain that? Why wouldn't Boeing have this data? Is it something that is voluntary from the operators?
Bernard Loeb: I'm going to let Bob Swaim talk about that a little bit because he likes that subject area.
Bob Swaim: Thank you. This largely comes back to our SDR talk of earlier and Scott has, Mr. Warren has a favorite phrase: "Sometimes small dogs aren't puppies" and it's kind of the same here in that some operators don't find it favorable from a management standpoint to have records publicly accessible about their problems.
Jim Hall: Is that another FAA requirement to be an operator?
Bob Swaim: Well, no. As Dr. Loeb indicated previously, some things are reportable on SDRs and some are not. And how you phrase some things can make the difference of whether they go into the system or not.
Jim Hall: But they still have to make reports to the FAA under the AD's what we're missing is their working with the manufacturer on providing operational history and problems?
Bob Swaim: It goes same to the manufacturers that sometimes the operators don't find it in their best interest to be in that data group.
Jim Hall: Well, as a passenger, do I know which operators those are?
Bob Swaim: It's hard to find even as a government entity.
?: That's a study within itself.
John Goglia: It may actually be the opposite. If we look, think back to the ValuJet accident in the Everglades, when certain members of the press did a very thorough SDR research, they reported that some airlines had far greater reports on certain issues than others. And the way the story was written, it sort of indicated or led one to believe that, because of that, this airline was less safe, in the broad sense, less safe than, maybe, others...when, in fact, it may be just as somebody was reporting at that particular airline, all of these problems ?? and believed they were going to get attention and get fixed. And other people just won't report anything. And when you look at some of the fleet operators and some of the problems we've had with the people, that have absolutely no SDR reports from the airplanes, yet when we get them after an incident, you look at the airplane and you wonder how that could be.
Jim Hall: Has staff considered a recommendation to the FAA in this area?
Bernard Loeb: Well, we have made recommendations on the SDRs and we're waiting to see what kind of improvement finally wells up out of this last one before we decide where we need to go. And I also think it's an issue that in our certification study we can look at some things in terms of databases because, as I indicated earlier, it is a lynch pin of a lot of this process, that developing our databases in order to determine the likelihood of an event occurring, you need to look at accidents/incidents, but you also need to look at things like SDRs and so forth. So those databases are a part of that process.
Jim Hall: Dr. Loeb, will you and Mr. Swaim address page 541-42, footnote 637 and I'm pleased to note that Boeing has revised its procedures to share information between military and commercial activities. Bob, you might give just a brief overview of why that is an important and significant step forward.
Bob Swaim: Some of the airplanes that are used in commercial service are also used in military service. And we found, unfortunately, in this investigation that the two sides sometimes do not talk. And that led to finding a 1980 study that Boeing had done for the airforce on their version of the 747 that found a lot of heat could enter the tanks and, so, we made that information available and, as a result of that, Boeing reportedly changed their procedure by which they can look for this information in the next accident investigation.
Jim Hall: On page 546, lines 5 to 10, the fuel tank inerting issue -- when are these tests going to be conducted and when the ARAC be established.
Bernard Loeb: We don't know when this flight test will ...
Jim Hall: You might just briefly outline the issue we're talking about.
Bernard Loeb: The issue is the work that is being done on the groundbase inerting system. There was to be some flight tests that were going to be conducted, testing out the inerting process using the groundbase system and testing it out and trying to determine a lot of things including how long you will, in fact, be inert and the conditions under which you may lose the inerting properties that you will, in fact, have oxygen coming back into the fuel tank.
These flight tests were to have taken place by now and they were scheduled for August but that has now been postponed and I don't know ... they're now indicating, possibly, October. So, we're in touch with them and we're trying to, we will be involved, we are involved and will be involved with the flight tests but we don't know exactly when that's going to happen now.
Jim Hall: But this is the testing that leads to the possible inerting that the FAA says could reduce the exposure for effective center wing tanks, fuel tanks, center wing tanks to approximately 2%.
Bernard Loeb: That is correct.
Jim Hall: And that's important work.
Bernard Loeb: That is very important work.
Jim Hall: And also the FAA states on page 546 in line 17, excuse me, line 15 to 19, according to the FAA use of ground sources on days when the temperature exceeds 60 degrees F would reduce the fleetwide flammability center wing tanks from approximately 35% to approximately 25%. The FAA stated that a Boeing service letter recommends that operators use ground sources for conditioned air when available and practical, and that it intends to encourage operators to follow this recommendation. Why would they not require them rather than just encourage them?
Bernard Loeb: Well, of course, Boeing can't do that -- the FAA would have to make the requirement and they are working to encourage -- I think that currently the UC was the availability and how this would work and I think they're still studying this issue and we're talking to them regularly and if we believe that we need to bring a recommendation to the Board's attention on this, we will do so.
Jim Hall: Very well. I apologize for taking up additional time. Member Goglia.
John Goglia: Have I been demoted? A minute ago I was Chairman Goglia.
Jim Hall: Chairman Goglia, I'm sorry, Chairman Goglia, whatever...
John Goglia: Just a couple of questions, Bernie. You mentioned about the engineering evaluation board after 427 in the context of failure modes. Did any of that research uncover failure modes that were not used in the part of the original certification of the ????
Bernard Loeb: Well, yes. Of course, during the investigation itself, we uncovered failure modes that had not been previously detected or predicted and, during the ETEB's study, they confirmed a number of things that we had already come up with as a part of our investigation of US Air 427.
They also came up with a failure mode that we had not previously considered that involved icing. In other words, in the four years we spent on 427 concluding the three prior years on 585 had not come up with this on that the ETEB came up with afterwards, demonstrates that you simply -- noone can sit down, no matter who they assemble and get together and get all of the failure modes.
And my view of this is that if we had another ETEB on the 737 we would at some time probably find something else out that we haven't learned even in this process. That's why we're suggest that you can't rely on this process solely when the failure has a potential for catastrophe.
John Goglia: OK. Now, the FAA recently published a final rule on type certification procedures to change product's rule -- derivative products. My memory doesn't, I guess I'm getting old, my memory, I don't remember that this originated from a recommendation so I guess the first part of this question goes to Barry. Did we ever make any recommendations about changed?? products and requiring them to meet current certification rules?
Barry Sweedler: I don't believe so, Member Goglia. I can check it but my recollection is that we have not.
Bernard Loeb: I think Mr. Sweedler is correct. We've looked at the issue a number of times. I don't believe we've actually made a recommendation directly on the issue.
John Goglia: OK. And I don't remember ever seeing any comments from us going to the docket for this rule change. Did we comment?
Bernard Loeb: No, no we did not.
?: This is John DeLeecy?; he's chief of our aviation engineering division.
John DeLeecy: We did notice that rule-making when it came out in the Federal Register and it caught us by surprise. It's an extremely detailed document -- you'd almost have to be lawyer to fully understand it -- but we do have it in staff review. The general impression that I had was that it was unclear to me the definition of what a changed product would be. If it truly meant that every airplane that was going to go from a dash 100 to a dash 200 was going to now have to be recertified in accordance with the current regulations, that would be fantastic. But it's not apparent, yet, in my understanding of that proposed rule-making whether it's that broadly applied.
John Goglia: But we didn't comment when it was in the MPLM stage. Was it in MPS ? or directly the rule? ??
John DeLeecy: I also don't recall when we pulled it off the Federal Register whether it was a final rule or proposed rule-making.
John Goglia: It says final rule in the...
Bernard Loeb: I think it was .... WE were unaware of it prior to this just recently coming to our attention and as John DeLeecy has indicated, we have looked at it but we're looking at it even more. It is our quick review -- it's very hard to tell exactly to what this applies. And so we're going to try to get more understanding of that.
John Goglia: I'd like to have a little more understanding about process. Who is supposed to capture these? Do we have someone who reads the Federal Register and picks these up?
John DeLeecy: Yes, I review the Federal Register every day. Our Com Center pulls it out and sends it down to us and we make a pass through and highlight any of the rule-making that might be applicable to our work. We did catch this recently as it came out as a final rule but I don't recall ever, years ago, when it might have been a proposed rule.
Bernard Loeb: The other thing is, normally, with our dialogue with the FAA, we would be aware where this was in the process and that this was happening, and we simply were totally unaware that ... so I don't even know what the genesis is.
Jim Hall: Mr. DeLeecy, could you just please find out for us and let the five Board members have the rule email or memo from you on what the process is? The answer is, obviously, we did not comment on it and it is now a final rule. I think we'd be all interested -- did we decide not to comment? Why? And what the situation was.
John Goglia: I have no further questions.
Jim Hall: Member Black.
George Black: This question to Bernie; I guess it's sort of two parts. One, is it possible that an aircraft certification is so that it renders the airplane unsafe and, if so, how is this monitored by the FAA and the manufacturer?
Bernard Loeb: Well, the FAA has a -- I'll answer the first one first. The FAA has a continuing air-worthiness program requirements levied on the air carriers and that is the basis for keeping airplanes in the air. No airplane can fly if it is not airworthy and as long as it is deemed airworthy it can fly forever. I mean, there is no time limit, there is no requirement, it must be airworthy and there is a continuing airworthiness program with each airplane that should, ostensibly, keep it in airworthy condition or it won't fly.
George Black: OK. In this particular case, we're essentially saying that an airplane should not be certified. In the future, would this theory that, by keeping energy sufficient ? ignition out of the center wing tank, that takes care of the flammability issue ... are there other issues that would be like that out there, decisions that were made years ago that might not be operative?
Bernard Loeb: Well, I would believe that the Boeing 737 rudder system is exactly one. We believe that the rudder control actuator, the main actuator, there is not a redundant system, there is a need for a redundant system. We have made those recommendations and we're hopeful we'll see changes in that. What we are concerned about, though, is that the certification process that could allow those things -- airplanes that don't have this redundancy when a failure mechanism that was not predicted could occur and lead to a catastrophic result -- then we think there needs to be this redundancy and that is the issue in this issue of certifying that we're talking about.
Jim Hall: Member Carmody?
Carol Carmody: Thank you. Yes, I'm very interested in the certification study which the Board's ?? staff is going to undertake and I'd welcome any information you can share about that. Do you have an idea of the scope -- will you be looking at certification for all large transport category aircraft or specific ...
Bernard Loeb: No, Member Carmody, I don't have any thoughts about that right now because Dr. Ellingstad and I have simply not had an opportunity to sit down and talk about this as the Chairman indicated in almost a year and a half. Since the commitment to look at this, we've simply been inundated with so many other major accidents that we were unable to get to it but we're going to look at that now and then give the Board a better idea what the scope would be.
?: Excuse me, Dr. Loeb, if I may interject here, perhaps to defend ourselves with respect to this. This is an enormously complicated issue. And necessarily the scope of the study is going to have to be sufficiently broad to contend with some of that complexity, so we're looking on the possibility of a study that is going to have to carry on for some period of time. Now one advantage that we do have, Dr. Loeb has indicated to us that he is going to defer his retirement to help us with this study. (laughter)
Carol Carmody: I realize you haven't scoped this out but would you also consider the issue of derivative certification as part of this?
?: Yes. That's clearly one of the major topics that has to be considered in this.
Carol Carmody: Well, I look forward to any future advice you may have on this subject. Thank you.
Jim Hall: Very well. Thank you. Is that all the questions Member Carmody? Do any of the other members have additional questions? Dr. Loeb, is there anything else you'd like to add on this? I think that takes us to a natural breaking point for lunch. We'll take a little more than an hour but we will put the gavel down sharply at 1:30 so we will stand in recess until 1:30.
continued on part 3