U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

81–427 PDF 2013

LESSONS LEARNED FROM THE BOEING 787 

INCIDENTS 

(113–24) 

HEARING 

BEFORE THE

SUBCOMMITTEE ON 

AVIATION 

OF THE

COMMITTEE ON 

TRANSPORTATION AND 

INFRASTRUCTURE 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED THIRTEENTH CONGRESS 

FIRST SESSION 

JUNE 12, 2013 

Printed for the use of the 

Committee on Transportation and Infrastructure 

( 

Available online at: http://www.gpo.gov/fdsys/browse/ 

committee.action?chamber=house&committee=transportation 

(II) 

COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE 

BILL SHUSTER, Pennsylvania, Chairman 

DON YOUNG, Alaska 

THOMAS E. PETRI, Wisconsin 

HOWARD COBLE, North Carolina 

JOHN J. DUNCAN, JR., Tennessee, 

Vice Chair 

JOHN L. MICA, Florida 

FRANK A. LOBIONDO, New Jersey 

GARY G. MILLER, California 

SAM GRAVES, Missouri 

SHELLEY MOORE CAPITO, West Virginia 

CANDICE S. MILLER, Michigan 

DUNCAN HUNTER, California 

ERIC A. ‘‘RICK’’ CRAWFORD, Arkansas 

LOU BARLETTA, Pennsylvania 

BLAKE FARENTHOLD, Texas 

LARRY BUCSHON, Indiana 

BOB GIBBS, Ohio 

PATRICK MEEHAN, Pennsylvania 

RICHARD L. HANNA, New York 

DANIEL WEBSTER, Florida 

STEVE SOUTHERLAND, II, Florida 

JEFF DENHAM, California 

REID J. RIBBLE, Wisconsin 

THOMAS MASSIE, Kentucky 

STEVE DAINES, Montana 

TOM RICE, South Carolina 

MARKWAYNE MULLIN, Oklahoma 

ROGER WILLIAMS, Texas 

TREY RADEL, Florida 

MARK MEADOWS, North Carolina 

SCOTT PERRY, Pennsylvania 

RODNEY DAVIS, Illinois 

MARK SANFORD, South Carolina 

NICK J. RAHALL, II, West Virginia 

PETER A. DEFAZIO, Oregon 

ELEANOR HOLMES NORTON, District of 

Columbia 

JERROLD NADLER, New York 

CORRINE BROWN, Florida 

EDDIE BERNICE JOHNSON, Texas 

ELIJAH E. CUMMINGS, Maryland 

RICK LARSEN, Washington 

MICHAEL E. CAPUANO, Massachusetts 

TIMOTHY H. BISHOP, New York 

MICHAEL H. MICHAUD, Maine 

GRACE F. NAPOLITANO, California 

DANIEL LIPINSKI, Illinois 

TIMOTHY J. WALZ, Minnesota 

STEVE COHEN, Tennessee 

ALBIO SIRES, New Jersey 

DONNA F. EDWARDS, Maryland 

JOHN GARAMENDI, California 

ANDRE ́ CARSON, Indiana 

JANICE HAHN, California 

RICHARD M. NOLAN, Minnesota 

ANN KIRKPATRICK, Arizona 

DINA TITUS, Nevada 

SEAN PATRICK MALONEY, New York 

ELIZABETH H. ESTY, Connecticut 

LOIS FRANKEL, Florida 

CHERI BUSTOS, Illinois 

SUBCOMMITTEE ON AVIATION

FRANK A. LOBIONDO, New Jersey, Chairman 

THOMAS E. PETRI, Wisconsin 

HOWARD COBLE, North Carolina 

JOHN J. DUNCAN, JR., Tennessee 

SAM GRAVES, Missouri 

BLAKE FARENTHOLD, Texas 

LARRY BUCSHON, Indiana 

PATRICK MEEHAN, Pennsylvania 

DANIEL WEBSTER, Florida 

JEFF DENHAM, California 

REID J. RIBBLE, Wisconsin 

THOMAS MASSIE, Kentucky 

STEVE DAINES, Montana 

ROGER WILLIAMS, Texas 

TREY RADEL, Florida 

MARK MEADOWS, North Carolina 

RODNEY DAVIS, Illinois, Vice Chair 

BILL SHUSTER, Pennsylvania (Ex Officio) 

RICK LARSEN, Washington 

PETER A. DEFAZIO, Oregon 

ELEANOR HOLMES NORTON, District of 

Columbia 

EDDIE BERNICE JOHNSON, Texas 

MICHAEL E. CAPUANO, Massachusetts 

DANIEL LIPINSKI, Illinois 

STEVE COHEN, Tennessee 

ANDRE ́ CARSON, Indiana 

RICHARD M. NOLAN, Minnesota 

DINA TITUS, Nevada 

SEAN PATRICK MALONEY, New York 

CHERI BUSTOS, Illinois 

CORRINE BROWN, Florida 

NICK J. RAHALL, II, West Virginia 

(Ex Officio) 

(III) 

CONTENTS Page 

Summary of Subject Matter .................................................................................... iv 

TESTIMONY 

PANEL 1 

Margaret M. Gilligan, Associate Administrator for Aviation Safety, Federal 

Aviation Administration ...................................................................................... 4 

PANEL 2 

Mike Sinnett, Vice President and Chief Project Engineer for the 787 Program, 

The Boeing Company ........................................................................................... 20 

PREPARED STATEMENTS AND ANSWERS TO QUESTIONS FOR THE 

RECORD SUBMITTED BY WITNESSES 

Margaret M. Gilligan: 

Prepared statement .......................................................................................... 27 

Answers to questions from Hon. Rick Larsen, a Representative in Congress from the State of Washington ............................................................ 38 

Mike Sinnett, prepared statement ......................................................................... 47 

iv 


Insert offset folio 1 here 81427.001

tim &4051tr 

C!U!alrman 

('\uist .... her p, ikrbllm, S!atrflirl'<1m 

<!Inmmitttt un dlranllpurtatinn nnb 1Jnfralltrudurt 

1It.~. ]l{nullt uf iRtprtstntatiuJ!ll 

JIIuul!ington. lOO121lS15 

June 7. 2013 

SUMMARY OF SUBJECT MAITER 

TO: 

FROM: 

Members. Subcommittee on Aviation 

Staff. Subcommittee on Aviation 

Nick 41. iRa4aU. )~ 

tianking lII.mb.r 

RE: Subcommittee Hearing on "Lessons Leamed from the Boeing 787 Incidents" 

PURPOSE 

The Subcommittee on Aviation will meet on Wednesday. June 12.2013. at 10:00 a.m. in 

2167 Rayburn House Office Building to receive testimony in order to explore and discuss "lessons 

learned" as a result of the Boeing 787 battery incidents that occurred in January 2013. The 

Subcommittee will hear from the Federal Aviation Administration (FAA) and The Boeing 

Company (Boeing) on actions taken as a result of and lessons learned from the 787 battery 

incidents. 

BACKGROUND 

Snmmary of Incidents and Response 

On January 7. 2013. cleaning personnel discovered smoke while working on a Japan 

Airlines (JAL) Boeing 787 that was parked at a gate at Boston Logan International Airport. The 

aircraft had recently landed at the airport after a flight from Narita. Japan. The aircraft had been 

deplaned of passengers and crew when the cleaning crew boarded the plane and reported smelling 

smoke. When a mechanic opened the aft electronic equipment bay. he found hea:v! smoke and fire 

coming from the front of the auxiliary power unit (APU) battery! case (Figure J). He indicated that 

the fire had two distinct flames that were about three inches in length at the two connectors on the 

front of the battery case? The mecbauic was unsuccessful in extinguishing the fire. Airport 

firefighters extinguished the fire about an hour and forty minutes after iuitial notification.4 

I The auxiliary power unit battery provides power to otart 811 APU durin& around 8IId flight operations. The APU battery 

is one of two lithium iOD batteriea used on the 181. While lithium ion batteriea have baen used on pl8llea prior 10 the 

781, the 787 usea larger batterica for some main electrical functions on the aircraft. 

2 National Transportation Safety Board (NTSB) Interim F8<:tual Report, NTSB case Number: DCA131A037, pese I 

(March 1, 2013). 

'li!.ot2. 

'Ii!. at 4. 
v 


Insert offset folio 2 here 81427.002

In response to the JAL 787 battery fire at Boston Logan International Airport, the National 

Transportation Safety Board (NTSB) sent a "go-team" to investigate the incident. The lithium-ion 

battery cells involved in the fire were transported to the NTSB forensics lab in Washington, D.C., 

for further investigation. Both the FAA and Boeing are parties to the ongoing NTSB investigation. 

In the days following the JAL 787 battery incident, several other incidents were reported on 

787 aircraft in commercial service. These incidents were not related to the 787 batteries. However, 

these incidents, along with the JAL 787 battery incident, prompted the FAA on January 11,2013, to 

order a comprehensive review of the 787's critical systems, including the design, construction, and 

assembly ofthe battery components of the aircraft. 

On January 15,2013, an AU Nippon Airways 787, during a domestic flight in Japan, 

experienced a problem with its main battery (Figure 1).5 According to the carrier, the main battery 

in the forward cargo hold triggered an emergency warning to the pilot. This warning was followed 

by a second warning light in the cockpit that indicated smoke. According to passengers and crew, 

there was an odd smell in the cockpit and cabin. The pilot decided to make an emergency landing 

and evacuate all passengers and crew via inflated chutes. While there was no fire when the plane 

landed, there was discoloration and signs of leakage in the main battery. 

Following the battery incident aboard the All Nippon Airways 787, the Japan Transport 

Safety Board (JTSB) opened an investigation into the incident and both Japanese air carriers 

operating 787 aircraft (Japan Airlines and All Nippon Airways) voluntarily grounded their fleet of 

787's on January 16,2013. 

Later that same day, the FAA issued an Emergency Airworthiness Directive (AD) to address 

a potential battery fire risk in the 787, which required operators to temporarily cease operations.6 At 

the same time, the FAA announced that it would work with the manufacturer and air carriers to 

develop a corrective action plan to allow the U.S. 787 fleet to resume operations as quickly and 

safely as possible. Aviation regulatory agencies of other countries in which the 787 operated 

quickly followed suit, with temporary groundings ordered in Japan, the European Uuion, India, 

Qatar, Ethiopia, Kenya, and Chile. Boeing responded by sending teams of investigators and 

engineers to both incident sites to compile information and, in coordination with the FAA, devise a 

solution to return the 787's back to service. In April, the NTSB held a two-day investigative hearing 

in connection to its investigation of the Jaliuary 7, 2013 JAL 787 battery incident. The NTSB's final 

report should be complete by the end of the year. 

, The main battery provides power to selected electrical/electronic equipment during ground and /light operations for nonnaland failure conditions. 

• Boeing Model 787-8 FAA Emergency Airworthiness Directive, AD #: 2013-02-51, January 16, 2013. 

2 
vi 


Insert offset folio 3 here 81427.003

FIGURE 1: 

Aireraft Certifi£ation 

In exercising its discretion, the FAA has devised a system of compliance review that 

involves certification of aircraft design and manufacture. Under this certification process, the duty 

to ensure that an aircraft conforms to FAA safety regulations lies with the manufacturer and. 

operator, while the FAA retains responsibility for overseeing compliance. Thus, the manufacturer is 

required to develop the plans and specifications and perform the inspections and tests necessary to 

establish that an aircraft design comports with the regulations; the FAA then reviews the data by 

conducting a risk based review of the manumcturer's work. If the FAA fmds that a proposed new 

type of aircraft comports with minimum safety standards, it signifies its approval by issuing a type 

certificate. 

When a new design of aircraft is being proposed, such as the Boeing 787, the designer must 

ftrst apply to the FAA for a type certificate. The applicant must show that the aircraft, aircraft 

engine, or propeller concerned meets the applicable existing airworthiness reqnirements. The 

regulations also provide for the issuance of special conditions when the Administrator finds that the 

existing airworthiness standards do hot contain adequate or appropriate safety standards because of 

novel or unusual design features of the product to he type certificated. In the interest of safety, rapid 

technological advances presently heing made by the civil aircraft industry require that the FAA be 

able to issue speciai conditions to address truly novel or unusual design features that it has, as yet, 

not had an adequate opportunity to include in the airworthiness standards through the general 

rulemaking process. For example, in the Boeing 787's case, the lithium-ion battery is a newer 

technology that is not specificaliy covered by existing regulatory standards. Therefore, the FAA 

developed special conditions that ensured a comparable level of safety with the standards that were 

in place at the time of certification. In order to receive a type certificate, the applicant must conduct 

a series of tests and reviews to show that the product is compliant with existing standards and the 

special conditions. This includes lab tests, flight tests, conformity inspections, and detail- and 

airplane-level compliance findings, all of which are subject to FAA oversight. 

Along with seeking a type certificate, the applicant can simultaneously seek a production 

certificate from the FAA. A production certificate is an approval by the FAA to mannfacture 

duplicate products of the type design approved by the type certificate. Before approving a 

production certificate, the FAA will review the manufacturer's quality contrul systems against 

regulatory and policy requirements. The holder of the production certificate is responsible for the 

quality of all parts, even those that are not specifically manufactured by the production certificate 

holder. In other words, a manufacturer may not produce all the parts on their aircraft, bnt they are 

responsible for the quality of each item on the plane. 

3 
vii 


Insert offset folio 4 here 81427.004

FIGURE 2: 

Aircraft Certification Process 

Fjllil! Productt.:m CeftlficatK)l1 Bourd 

\t~~ Type Cel11hca\e 

!o.SUE' papers Safety Review Bourd 

Cert,fication Bus.ts . Ajrplan~:He\l"e! compnance findings 

Equ1V;:!lent Safety Fmd\flgs. Det<l4-feve! compliance 

Spec!'l! conddJOOs 

Source: FAA 

In order to ensure that all parts meet quality standards, the FAA also has the ability to grant 

a company Organization Designation Authorization (ODA). The ODA allows a company to set up 

an organization of airworthiness representatives (AR's) who aet on behalf of the FAA. The 

company and the FAA develop a procedures manual, which is the guiding document on the 

procedures, processes, and practices for the company. The AR's are authorized by the FAA and 

usually carryout routine certification actions. The FAA insPectors have the authority to perform any 

of these activities themselves should they wish to, or they can delegate the responsibility to the AR. 

AR's are approved by the FAA after going through a review process and are responsible for 

ensuring the manufactUrers' compliance to FAA standards. The FAA has multiple processes that 

must be met to ensure that a new aircraft meets the standards of aircraft design and manufacturing. 

Boeing does have an ODA. 

Boeing applied for a type certificate for the 787-8 airplane in March 2003. More than eight 

years later, in August 20 II, the 187-8 airplane received transport-category approval from the FAA. 

Because the 187 was utilizing new and novel lithium-ion battery technology for the main and APU 

hatteries, the FAA also issued special conditions for the 787 lithium-ion battery installation in 

October 2007.' 

On January 11, 2013, in response to the JAL 787 battery incident and to other reported 

issues, the FAA announced it was going to conduct a comprehensive review of the 787's critical 

systems, including the design, construction, and assembly of the battery components of the aircraft. 

In particular, the FAA indicated that " .•. the purpose of the review was to validate the work 

7 25.359.SC, 72 Federal Register 57842 (October II, 2007); beeame effective on November 13,2001. 

4 
viii 


Insert offset folio 5 here 81427.005

conducted durin1 the certification process and further ensure that the aircraft meets the FAA's high 

level of safety." The FAA has coordinated closely with Boeing in conducting the 787 critical 

systems and certification review and the work is ongoing. 

Return to Servke 

The January 16,2013 airworthiness directive ordered the temporary cessation of 787 

operations. The emergency AD specifically directed air carriers, before further flight, to " ... modify 

the battery system, or take other actions, in accordance with a method approved by the Manager, 

Seattle Aircraft Certification Office.,,9 The FAA indicated that it would work with the manufacturer 

and operators to develop a plan to allow 787's to resume operations as quickly and safely as 

possible. While the NTSB investigation was ongoing, the FAA and Boeing determined to move 

ahead with a comprehensive solution plan. They understood tbe sequence of events (a short circuit 

in one cell that propagated to other cells), but the actual cause of the short circuit remained 

unknown. That having been said, Boeing was able to narrow the cause of the short circuit to four or 

five potential causes. On February 17,2013, Boeing submitted a comprehensive certification and 

design plan to the FAA for its review and approval. The plan included the following ruitigation 

actions: 

• At the battery cell level: They made design changes to the battery cells to reduce the chance 

of a short circuit (Figure 3), 

• At the battery level: They proposed design changes to stop propagation from cell-to-cell 

(reduce the chance for cell-to-cell contact and the buildup of moisture) (Figure 3); and 

• At the aircraft level: They improved the battery containment components to allow the 

venting of gases outside of the plane in the event of a battery short circuit (this was intended 

to do three things; prevent gases from entering the cabin; reduce the chance of cell-to-cell 

propagation; and preclude the possibility of a fire)( Figure 3). 

• FAA Pres. Relea .. , "FAA Will Rev;ew Boeing 787 Design and Production",January 11,2013. 

9 Boeing Model 787·8 FAA Emergency Airworthiness Directive, AD #: 2013-02-51, January. t6,2013. 

5 
ix 


Insert offset folio 6 here 81427.006

FIGURE 3: 

Comprehensive Set of Solutions: Battery 

Insulation 

'mproll9dfoJ' 

r~'maIBnd 

el&<;/lics/ /$olation 

Source, Boeing 

The FAA approved the initial plan on March 12, 2013, which allowed Boeing to make 

a1temtionsto the batteries on a 787 aircraft for test flight. On March 25, 2013, the FAA authorized a 

series of test flights. After the tests proved successful, Boeing submitted a final certification plan for 

the upgraded batteries to the FAA on April 8, 2013. 

After further review by the FAA, the final plan was approved on April 19, 2013, and a 

modified AD was issued on April 26, 2013. The modified AD allowed for 787 aircraft to return to 

commercial service upon completion of the steps outlined in the certification plan. The AD and the 

updated certification plan did not affect the 787' s original type and production certificates; the 

battery update as outlined in the certification plan is not considered a major design change and 

therefore does not requITe an amended type certificate. 

Following the issuance of the AD allowing 787 aircraft to return to commercial service, 

other aviation regulatory authorities that had similar orders lifted them. Ethiopian Airlines was the 

first to return their aircraft to service on April 28, 2013. As of June 5, 2013, all 50 787's have 

received the battery modification, and have been returned to their respective operator and retorned 

to commercia! service. Delivery of the 787 has resumed as well, with all newly delivered aircraft 

containing the modified battery as prescribed by the AD. 

Lessons Learned from Boeing and FAA Reviews 

In the five months that have passed since the 787 battery incidents, the Committee on 

Transportation and Infrastructure has closely monitored all actions taken by the FAA, the NTSB, 

and Boeing. Below are some, but not all, of the lessons that have been learned so far. 

• Lithium-Ion Battery Testing: The incidents advanced the understanding of lithium-ion 

batteries and their use in airplanes. Specifically. while the initial certification testing was 

extensive and reflected state of the art practices at the time, the FAA and Boeing developed 

additional testing methods. Boeing. the FAA, and industry stakeholders bave also identified 

6 
x 


Insert offset folio 7 here 81427.007

ways to enhance the battery's design and manufacturing processes, and these enhancements 

have been incorporated intu Boeing's comprehensive battery solution. 

• Communication: While the "multi-tiered supplier" dynamic is not new to the Boeing 787, 

the FAA has determined that it needs to spend more time improving communication 

horizontally and vertically to ensure a clear traceability of all required changes down the 

supplier chain and to ensure that all instructions are clearly communicated along the chain. 

WITNESSUST 

Ms. Margaret Gilligan 

Associate Administrator for Aviation Safety 

Federal Aviation Administration 

Mr. Mike Sinnett 

Chief Engineer for the 787 Program 

Boeing 

7 
(1) 

LESSONS LEARNED FROM THE BOEING 787 

INCIDENTS 

WEDNESDAY, JUNE 12, 2013 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON AVIATION, COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE, Washington, DC. 

The subcommittee met, pursuant to notice, at 10:00 a.m. in Room 

2167, Rayburn House Office Building, Hon. Frank A. LoBiondo 

(Chairman of the subcommittee) presiding. 

Mr. LOBIONDO. Good morning. The hearing will come to order. 

Thank you all for being here. The top priority of the Aviation Subcommittee, as well as me, personally, is the safety of the flying 

public. Therefore, the subcommittee has closely monitored the actions of the FAA, the NTSB, and Boeing, in response to the battery 

incidents that took place earlier this year. We have called this 

hearing to learn more about the FAA and Boeing’s actions to get 

aircraft back to safe operation. 

As we all know, in January there were two separate incidents involving a lithium ion battery on Boeing 787 aircraft, one on the 

ground in Boston and the second in the air over Japan. After ordering a review of all Boeing 787 critical systems, the Federal Aviation 

Administration issued an emergency airworthiness directive that 

temporarily halted the operations of 787s. 

In the 5 months since the incidents, the FAA and Boeing have 

worked to develop a comprehensive solution to the battery issues, 

and have safely returned the 787 aircraft to service. As a key part 

of this process, the FAA and Boeing have taken a hard look at the 

certification of the 787. This review has focused on what worked, 

given that the safety of the aircraft itself was not compromised in 

either incident, and what needs or needed to be improved or adjusted. 

Although the NTSB investigation is ongoing, and the board has 

not identified the exact cause of the battery failure, Boeing has 

been able to narrow the possible causes of this short circuit to four 

or five basic things that they think were the cause. Based on that 

information, Boeing developed a comprehensive solution that addresses all of these possible causes. The solution presented to the 

FAA addresses issues at the battery cell, battery, and aircraft levels. In the end, a new battery design underwent over 200,000 engineering hours, and were then subject to a rigorous testing and FAA 

approval process. 

Once again, the committee has been closely monitoring the actions taken by the FAA and Boeing. Initially there was great conVerDate Aug 31 2005 12:55 Oct 17, 2013 Jkt 000000 PO 00000 Frm 00011 Fmt 6633 Sfmt 6633 P:\HEARINGS\113\AV\6-12-1~1\81427.TXT JEAN
2 

cern about the possible implications of these incidents. In the last 

5 months, we have made every effort to ensure that the FAA and 

Boeing are working together to develop a comprehensive solution. 

Therefore, the subcommittee has met several times with representatives of both the FAA and Boeing, and received high-level 

briefings on the incidents and the comprehensive solution. Chairman Shuster, Ranking Member Rahall, Ranking Member Larsen 

and I received briefings by Boeing’s CEO during the early stages 

of the investigation. The subcommittee has remained informed 

about the actions being taken by Boeing and the FAA at every step 

of the process. 

Moving forward, this subcommittee will continue to monitor the 

FAA certification process and the 787. To assist in this effort today 

we will hear from the FAA and Boeing on lessons learned as a result of the 787 battery incidents, and the comprehensive certification review. This hearing is not about attempting to lay blame 

on anyone. Instead, today we will take a constructive look at what 

has been learned from these incidents. 

It is important to remind ourselves that the United States aviation system is the safest in the world. This is due to the dedication 

and commitment of all stakeholders who, in situations like this, 

work together to ensure safety of the flying public. I would like to 

thank both the FAA and Boeing for their participation today, and 

look forward to their testimony. 

I would like to ask unanimous consent that all Members have 5 

legislative days to revise and extend their remarks and include extraneous material for the record. 

[No response.] 

Mr. LOBIONDO. Without exception, so ordered. I would now like 

to yield to Mr. Larsen for any statement you may make. 

Mr. LARSEN. Thank you, Mr. Chairman, for calling today’s hearing to review lessons learned from the Boeing 787 incidents. 

Mr. Chairman, I believe we should start this hearing by acknowledging that we are in an incredibly safe period for U.S. commercial 

aviation. We haven’t had a fatal commercial passenger accident in 

the U.S. since 2009, and we owe a great deal of credit for that to 

dedicated safety professionals at agencies like the FAA and the 

NTSB. 

Additionally, The Boeing Company has been a world leader in 

the airplane business for almost a century. It has maintained its 

leadership by making safety a priority. The Boeing 787 pushed the 

technological envelope. The certification itself was an 8-year process. The lithium ion batteries, like many of the aircraft’s design 

features, are new and a constantly evolving technology, not specifically covered by existing FAA regulations. 

We know the FAA worked with Boeing to develop special conditions that would ensure the safety of this new technology, and the 

process for developing these special conditions was collaborative, 

rigorous, and transparent. These conditions took over a year to develop, and were published in the Federal Register for public comment. 

Nevertheless, we had two serious safety incidents involving Boeing 787 lithium ion technology in roughly a week’s time. These incidents caused the FAA and other international regulators to ground 

3 

the 787 for more than 3 months. The grounding raised legitimate 

questions for the flying public about whether the certification process with the 787 worked as well as it should have. 

In response to these two incidents, Boeing devoted more than 

200,000 engineering hours to understand the cause of these incidents and develop technical solutions to prevent or mitigate any 

further incidents. And, likewise, the FAA stepped up its own involvement in the testing and analysis activities required to certify 

the new battery design. As a result, the 787 modifications certified 

by the FAA have been completed, and all the airplanes are now 

back in service. 

Mr. Chairman, we both agree that safety is always this subcommittee’s highest priority. With the 787 flying safely again, now 

is the appropriate time for the subcommittee to review these incidents and glean lessons learned that could further improve aviation safety. 

In April, the Government Accountability Office raised concerns 

before the Senate Commerce Committee that the ‘‘FAA staff have 

not been able to keep pace with industry changes and, thus, may 

struggle to understand the aircraft or equipment they are tasked 

with certificating.’’ The NTSB’s independent investigation of the 

January 7 Japan Airlines incident is exploring this key issue, and 

that should be completed later this year. The FAA is conducting its 

own review of the 787 certification process. 

Looking forward, Congress must ensure that the FAA is adequately staffed, the agency is positioned to understand and to challenge assumptions put forward by manufacturers regarding new 

technologies. I hope to hear from the FAA and from Boeing today 

about how the special conditions for the 787 were developed, and 

whether they were strict enough. I would also want to investigate 

whether the resources required for recertification of the 787 were 

enough. 

In February I expressed concern that this subcommittee—at our 

subcommittee’s FAA reauthorization hearing that sequestration 

could negatively affect FAA certification activities. I would like to 

hear from Ms. Gilligan whether she believes that sequestration, 

budget cuts, and hiring freezes are impairing the FAA’s ability to 

attract and retain technical competencies required to certify new 

technologies. 

Also, I would like to hear about the FAA’s efforts to retain independent technical expertise from outside the agency when necessary to assist in the certification of new technologies. 

Lastly, I hope that we will have time to investigate the lessons 

learned from this process, and how the FAA will certify aircraft 

with lithium ion batteries in the future. 

Thank you, Mr. Chairman, and I look forward to hearing from 

our witnesses. 

Mr. LOBIONDO. Thank you, Mr. Larsen. I would now like to turn 

to the chairman of the full committee, Mr. Shuster. 

Mr. SHUSTER. Thank you, and thank you, Chairman LoBiondo 

and Ranking Member Larsen, for holding this hearing today. I appreciate the fact that our witnesses from the FAA and Boeing are 

here to testify before us. And as Chairman LoBiondo said, this is 

a constructive hearing, something we can learn from. 

4 

When we look at the United States and the transportation system, the airline system, aviation system safely transports over 730 

million passengers a year, 70,000 flights a day. So it is the safest 

aviation system in the world, and that is due to the work and the 

efforts of the FAA, the airlines, the manufacturers, the controllers, 

other operators and stakeholders who make it a safe system to operate in. 

And this committee remained in close contact with the FAA and 

Boeing after the incidents occurred, and through final approval. 

The committee’s oversight activities—it was apparent that, 

throughout the process, that everybody was working towards a solution, and it did that. We greatly appreciate the Department of 

Transportation, Secretary LaHood and Deputy Secretary Porcari, 

Administrator Huerta, for personally meeting with me and others 

on the committee. 

And when new aircraft with novel use of technology can experience issues, it is important that we address those issues early on 

in the process to make sure that we have safe aircraft. And this 

situation we were able to address. It does not mean they are unsafe. In fact, I believe they are safe today. 

The incidents—the FAA and Boeing’s responses to the incidents, 

we are going to remain looking at these, again, learning from the 

process, because I believe there are valuable lessons to be learned 

from this. And I look forward to hearing again today from our witnesses. And again, we will continue this oversight and we will continue to closely monitor the FAA certification program. And, as the 

787 resumes normal operations, we will look again closely at what 

is going on, and what is transpiring. 

And, as I said, throughout this process I think everybody worked 

diligently, worked together to get the 787 back up in the air. That 

is positive for the U.S. economy, it is positive for the airlines, and 

the aviation industry in America. 

So, again, I would like to thank the chairman and the ranking 

member for holding this hearing today, and yield back. 

Mr. LOBIONDO. OK, thank you, Mr. Shuster. Now we will turn 

to our first witness today, FAA Associate Administrator for Aviation Safety, Peggy Gilligan. Ms. Gilligan, you are recognized. 

TESTIMONY OF MARGARET M. GILLIGAN, ASSOCIATE ADMINISTRATOR FOR AVIATION SAFETY, FEDERAL AVIATION ADMINISTRATION 

Ms. GILLIGAN. Thank you. Chairman LoBiondo, Congressman 

Larsen, and members of the subcommittee, thank you for the opportunity to appear before you today to discuss the certification of 

the Boeing 787. One of FAA’s central roles is to certify aircraft and 

components that are used in civil aviation operations. We have 

been doing this for more than 50 years. Right from the start, aviation products have often stretched the technological boundaries. 

Over the decades, we have enhanced our process and regulations. 

For example, for large aircraft like the 787, we have changed our 

regulations more than 130 times to keep pace with new ways of 

doing business and new technologies. For more than five decades, 

the FAA has compiled a proven track record of safely introducing 

new technology and new aircraft. 

5 

As we continue to certify new aircraft, I want to make one thing 

very clear. We take that responsibility very seriously. To certify the 

787, the FAA assembled a team of FAA—— 

Mr. LOBIONDO. Excuse me. Could you pull the mic a little closer, 

please? 

Ms. GILLIGAN. Sure. Is that better? 

Mr. LOBIONDO. Just pull it a little closer to you. Yes, that is 

good. 

Ms. GILLIGAN. OK. 

Mr. LOBIONDO. Thanks. 

Ms. GILLIGAN. To certify the 787, the FAA assembled a team of 

FAA engineers, inspectors, test pilots, and scientists, as well as experts from industry, think tanks, trade organizations, and other 

civil aviation authorities, in addition to all the expertise at Boeing. 

The certification of this aircraft took more than 8 years, hundreds 

of hours of FAA engineering review, and 900 hours of flight testing 

time. 

A key tenet of the certification process is to plan for the unexpected, and this was the case in the 787. We required the manufacturer to design systems to meet certain performance standards. 

Then we required them to assume a failure, and to design the aircraft so that it could be safely landed if a failure were to occur. 

Many layers of safety are built in to the meticulous processes and 

the thorough design. 

For the battery, for example, we established nine specific requirements to protect against a battery failure, and to protect the aircraft if a battery should fail. One layer may fail, just as it did in 

the in-flight 787 battery incident. But the multiple safeguards built 

in, and the procedures pilots are trained to follow, enabled the pilots to safely land the aircraft. This is how the system works. 

Immediately after the 787 in-flight incident, the FAA issued an 

order that suspended flight to ensure that we had the time to consider the right solutions without compromising passenger safety. 

Our safety team worked thousands of hours alongside Boeing. And, 

as a result of the battery system review, Boeing made several 

changes. They redesigned the internal battery components to minimize a short circuit within the battery. They insulated the battery 

cells to prevent propagation from one cell to another. They added 

a robust battery containment and venting system to prevent a 

problem in the battery from spreading to the aircraft. Finally, the 

company improved the quality assurance process at the battery 

manufacturer, to ensure that the batteries meet our rigorous design standards. 

We have concluded our review of the redesign, and we have approved its operation. The aircraft is once again flying passengers 

safely around the world, and Boeing has resumed delivery of new 

787s. We are confident that the new design will protect the safety 

of the aircraft and its passengers. 

The FAA is continuing to review the critical systems of the 787, 

including its design, manufacture, and assembly. We began this 

broad review, which includes the FAA certification processes, in 

January, after the first incident. We expect to complete it this summer. Both these actions, first addressing the immediate safety conVerDate Aug 31 2005 12:55 Oct 17, 2013 Jkt 000000 PO 00000 Frm 00015 Fmt 6633 Sfmt 6633 P:\HEARINGS\113\AV\6-12-1~1\81427.TXT JEAN
6 

cern, and then doing an indepth review of the product and the 

processes, are a standard way that we approach our safety mission. 

Some have asked whether the FAA has the expertise needed to 

oversee the 787’s cutting-edge technology. Not only does the FAA 

employ a staff highly experienced in aviation, but we have access 

to experts across the country and around the world. We establish 

rigorous safety standards, and make sure manufacturers demonstrate that the standards have been met. Our safety record 

shows just how successful we have been. 

What the 787 battery experience has shown is that neither the 

industry nor the FAA is perfect. But it also shows, as I noted earlier, that as aircraft are designed and built, we plan for the unexpected, and we make appropriate data-driven decisions to manage 

risk to protect the safety of the flying public. 

As we have learned with the 787 certification, the way to enhance safety is to keep lines of communication open between industry and Government, in order to foster the ability and willingness 

to share information about the challenges that we all face. These 

solutions show the FAA and its industry partners continue to create an atmosphere where people work together, all in the pursuit 

of maintaining the highest levels of safety. That is why we are all 

here. 

The FAA will never lose sight of the respective roles. But there 

is always a seat at the table for the bright minds from industry to 

help inform the best way to navigate the complex technological 

issues we encounter. It would be shortsighted to overlook anyone’s 

valuable expertise. 

Mr. Chairman, I am proud of the safety record we have achieved, 

and I am confident we have the best people in the right places to 

meet our challenges ahead. 

That concludes my testimony, and I will be happy to answer any 

questions you may have. 

Mr. LOBIONDO. Thank you very much. A couple of questions that 

I have. During the two battery incidents, was the safety of the aircraft or the flying public ever in danger? 

Ms. GILLIGAN. The first incident, as you are aware, occurred on 

the ground after the flight had been completed. All the passengers 

and crew had left the aircraft, and the aircraft was being cleaned. 

So, in that particular incident, there was no risk to anyone during 

the operation. 

In the second incident, which did occur in flight, so far we believe 

that after the battery event itself, the remainder of the system operated in accordance with the standards. That is, it contained the 

event within the battery. We still do not have the root cause analysis completed by the NTSB, so that we do need to wait and see 

what the final results of that investigation are, to see if there was 

any additional risk that we haven’t identified yet. 

Mr. LOBIONDO. Do you believe the FAA certification processes in 

place were sufficient to address and remedy the concerns raised by 

these incidents? Or should we relook at that somehow? 

Ms. GILLIGAN. We believe that the certification process is really 

quite robust. I think the safety of the system indicates that the 

products that FAA and others around the world have certified do 

provide an appropriate level of safety. 

7 

Having said that, we always are looking to improve the processes. We have learned some lessons from what we have seen already with these two events. We will learn more lessons from the 

NTSB review, as well as our own indepth review. All of that information will be rolled back into the certification process to improve 

upon a very sound, robust basis. 

Mr. LOBIONDO. Understanding that we don’t have the NTSB 

final report, what do you think the lessons learned from these two 

incidents are up to this point? And what is the FAA doing in response to lessons learned? 

Ms. GILLIGAN. I think we have seen a couple of important lessons. The first is that we now have a much more robust process 

for testing lithium ion batteries, if they are used in aviation. The 

certification standards and the testing that Boeing demonstrated in 

the redesign will become the standard the FAA and other authorities around the world will use when we evaluate the level of safety 

provided by a lithium ion battery used in an aircraft. So that is a 

very important lesson, and that is already in place. 

I think, in addition, we have seen some areas where we can improve our process. One thing we realized is that some of these new 

technologies are not just used in aviation. There can be a community of experts who know something about the technology, but have 

nothing to do with aviation. We want to be able to reach that community. In this case, Boeing brought together a number of experts 

on lithium batteries, and we learned a great deal from them. 

So, what we need to do is broaden how we reach out for comments on our standards and expert review, to make sure that, if 

there is a community of experts outside of aviation, we know how 

to reach them. 

We are also looking at some of the process improvements internally that address new technologies. We are thinking that it probably makes sense to have people who are not involved in that particular certification to periodically review our work and the manufacturer’s work to make sure the FAA folks involved in the certification aren’t overlooking something, or that we haven’t missed an 

assumption, or that we haven’t asked a critical question. 

So, those are the kinds of process improvements that we are already seeing would add value to our certification process. 

Mr. LOBIONDO. Thank you. Mr. Larsen? 

Mr. LARSEN. Thank you, Mr. Chairman. Ms. Gilligan—was this 

last month—we had Mr. Huerta in front of us, and he said that 

FAA had announced a review of the certification process related to 

the 787, and that review is ongoing, and so on. Specifically, you 

have outlined some lessons learned, but can you give us a timeline 

on when that review of the certification process will be done? 

Ms. GILLIGAN. Sure. 

Mr. LARSEN. Can you, as well, focus—help us understand what 

the focus is of this particular certification review? 

Ms. GILLIGAN. Sure, I will be glad to. After the first incident that 

occurred in Boston, the Administrator and Secretary, along with 

Boeing executives, announced that we were going to undertake this 

indepth review. With the second incident, and then the airworthiness directive, we lost a little time doing the indepth review because a lot of the same folks needed to be included in the ongoing 

8 

initiatives. So we actually kicked the indepth review off in early 

February, and the group has been working pretty much full-time 

since then, with an eye toward completing their review in the summer. 

So, what that team did, was go beyond information on the battery to look at all of the operational data that we had from the aircraft since its introduction into service. We wanted to see if there 

was any trend, any set of incidents that needed to be looked at 

more thoroughly. We have identified a couple of areas and are 

doing what we call deeper dives into those areas to see what it 

shows us. From that, we expect to make some findings and recommendations on process improvements and perhaps other actions 

that we or Boeing or both will need to implement. 

Mr. LARSEN. I think we will—well, at least I will look forward 

to seeing the results of that review and getting briefed on those. 

Since you are in that process, I won’t go into too much detail with 

you right now. 

But a question about—that arise out of this incident isn’t a new 

question, but I wanted to give you an opportunity to address it. It 

has to do with this term people—some folks have used in the media 

called self-certification, that this is one of the dangers of self-certification. Can you help us understand why FAA would argue that 

this is not self-certification? 

And let me give you a—self-certification would be Company A 

goes and does what it does, and comes back to you, and you check 

the boxes. 

Ms. GILLIGAN. Right. 

Mr. LARSEN. Versus FAA does everything and then hands it to 

the company and says—you know, to Company A, and says, ‘‘Do 

this.’’ 

So, those are the goal posts—I am sorry, the bookends; I got my 

analogies wrong. Those are the bookends. How do you characterize 

the certification process? 

Ms. GILLIGAN. We would agree that the term ‘‘self-certification’’ 

is a misnomer, because Boeing doesn’t certify anything. The Boeing 

Company, as the manufacturer, is responsible for demonstrating 

that their product meets all the standards that we have set. They 

have to have data and information and analysis that shows that 

they have met those standards. Then the FAA, or someone who 

works on our behalf—— 

Mr. LARSEN. And, I am sorry, this would apply to someone who 

makes a vortex generator this big and someone who makes an engine for an airplane, as well. 

Ms. GILLIGAN. Yes. 

Mr. LARSEN. This applies to anybody looking to build a part for 

an airplane here in the U.S. 

Ms. GILLIGAN. Right. The certification process is fundamentally 

the same. 

Mr. LARSEN. Right. 

Ms. GILLIGAN. There are some small parts that are treated very 

differently, but you are right, the major systems or parts of aircraft 

go through the certification process. 

It might be easiest if I can describe it through an analogy. We 

see it like taking a test. FAA is the one who sets the criteria for 

9 

passing the test. We tell the student, the applicant, in this case the 

manufacturer, what it takes for them to pass the test. They have 

to take the test and pass it. Then we, or people on our behalf, 

grade the test and determine if they passed. That is really how it 

works. 

The FAA and our designees, who we appoint based on the authorization provided by Congress for the Administrator to appoint 

people to act on his behalf, are the ones who make the determination that the standards have been met. 

Mr. LARSEN. Let’s—— 

Ms. GILLIGAN. Does that help? 

Mr. LARSEN. Let’s beat this dead horse a little bit, the analogy 

about the tests in school, because on page 5 of your testimony you 

discuss the lithium battery literature. So part of what you did, 

then, was to review the available lithium battery literature, include 

a consideration of the hazards of other battery technologies such as 

nickel cadmium and, presumably, lead acid batteries, as well. But 

the end result is that then you created a test for these special conditions, but the test itself perhaps was bad. 

Ms. GILLIGAN. We haven’t seen the data that says that the 

standard that we set was bad. In fact, if you compare the special 

condition to the regulation that was on the books for batteries, you 

will see that we made it much more robust. Lithium batteries provide higher energy at lighter weight. 

Mr. LARSEN. Sure. 

Ms. GILLIGAN. That is why manufacturers wanted to use them. 

But because of that higher energy, they also pose a different kind 

of risk than other batteries. That is why the standards we had in 

place didn’t fully address the risks that lithium ion batteries could 

introduce, and that is why we added additional requirements. We 

even made some of the original requirements more robust, for the 

purpose of the manufacturers showing that the lithium battery was 

sufficiently safe for this application. 

Mr. LARSEN. The conditions state that lithium ion batteries are 

significantly more susceptible to internal failures that can result in 

self-sustained increases in temperature and pressure than their 

lead acid counterparts. Did those hazards cited in the special condition trigger a heightened level of FAA involvement in the certification or compliance activities for the battery, based on that risk 

analysis? 

And can you explain any additional actions FAA took? 

Ms. GILLIGAN. We set the new standard, in consultation with the 

manufacturer and the industry. We put that standard out for comment. We received some comments, again, from people in the aviation industry. This, again, is where I think we saw a lesson 

learned. We need to make sure that that kind of special condition 

also went to experts on lithium ion batteries, who might have been 

able to help us understand better how to improve it. So that is 

something we will look at changing in the future. 

Then it was for Boeing, in accordance with the certification plan 

that we approved, to do tests and analysis to show that they had 

met all the requirements of the special condition. We had designees 

on our behalf who made the finding that Boeing had shown that 

they met those standards. 

10 

Mr. LARSEN. What is a designee on your behalf? Is that an FAA 

employee? 

Ms. GILLIGAN. No. Again, under our statute, we have been authorized for many years to have the Administrator appoint individuals or organizations to perform some functions on our behalf. We 

have a program at FAA where our engineers, in this case, oversee 

the performance of the individual who is designated, or the organization who we have given a designation to, to make sure that they 

are properly performing their functions, that they are making the 

same findings the FAA engineer would have made, if they had 

done it themselves. 

It is a way that we can leverage our resources, because there are 

a large number of approvals that are required in a manufacturing 

program and in our operational environment, as well. A cadre of 

FAA employees would be extremely large, probably unmanageably 

large. So we leverage our engineering expertise through the designation of individuals and organizations to act on behalf of the Administrator, in accordance with the FAA Authorization Act. 

Mr. LARSEN. The designee program has been around since 1938? 

Ms. GILLIGAN. The designee program has been around since the 

late 1930s. I think it was a very elegant solution that the Congress 

came to, realizing that there would be a number of these repetitive 

approvals that we would need, so that the public saw that aviation 

was safe, but there would never really be a Federal cadre of employees who would be sufficient to carry that out. 

So, we have been able to leverage FAA resources by appointing 

individuals to act on our behalf. It is considered quite an honor to 

be an FAA designee. It is taken quite seriously. We continue to 

oversee that those individuals, or the organization that holds that 

approval, to ensure they are performing properly. We have the ability to withdraw the designation if they are not. So we manage it 

in that way. 

Mr. LARSEN. I have further questions, but I will take a second 

round. Thank you. 

Mr. LOBIONDO. Mr. Meadows? 

Mr. MEADOWS. Thank you, Mr. Chairman, and thank you, Ms. 

Gilligan, for being here and, obviously, being well-informed on the 

process. And I just compliment you on that. 

It is my understanding that when the NTSB gets involved in investigation, that all the parties with the investigation are severely 

limited in their ability to respond or communicate, either to the 

public or the media. And they are even restricted, at times, in their 

communication between the parties. For example, between the FAA 

and Boeing, or between Boeing and Japan Airlines. And these communications first have to go through the NTSB for clearance. 

Specifically, are there any reforms that you could see that the 

FAA or the NTSB could make that would allow this process to 

work more effectively, in terms of investigating incidences, while 

still allowing them to respond to the public and to each other? 

Ms. GILLIGAN. Well, sir, I think the party system, which the 

NTSB uses, does allow for all of the interested organizations that 

are involved to have a forum to make sure that they are sharing 

information about the particular event or incident or accident. 

11 

In this day and age, with the instant demand by media and others for immediate information, it is sometimes difficult to make 

sure that things that are unique to the accident or incident being 

investigated don’t get into the public domain before the organization responsible for that investigation has an opportunity to consider how it should be presented. 

I do think, in all the cases that I am aware of, we are able to 

work out the needed exchange of information so that the NTSB is 

confident that they are controlling the information about the accident itself. While, meanwhile, as you point out, we and manufacturers and others, we have other safety information that we need 

to share to make sure—— 

Mr. MEADOWS. But—excuse me—you hit two key points, though. 

You keep referring to accidents, and this wasn’t an accident. It was 

an incident. And there is a big difference there, because—I think 

of this as a compliment to the FAA and to Boeing and to a number 

of the situations, because it wasn’t an accident, it was something 

that got identified as an issue. 

And I guess, you know, when we had previous testimony with 

the FAA, it is—the Administrator said, ‘‘Well, Boeing is taking responsibility, but we know that there was a number of other issues 

that weren’t specifically related just to Boeing, and yet that information never got out.’’ So, you know, it is not an accident, it is an 

incident. 

So are there any reforms that you would recommend to the process right now? 

Ms. GILLIGAN. I think we have a very good working relationship 

with the National Transportation Safety Board. If we are ever in 

need of safety information, and there is any question as to whether 

or not we can receive it, those questions are very quickly cleared 

up. I know we have also worked with the NTSB and Boeing and 

others involved in these investigations to make—— 

Mr. MEADOWS. So there are no reforms that you would recommend. 

Ms. GILLIGAN. I don’t know of one, offhand, sir. 

Mr. MEADOWS. OK. 

Ms. GILLIGAN. I honestly don’t. 

Mr. MEADOWS. Well, then, let me ask you a different question, 

then. When they get involved, when the NTSB gets involved, how 

does that affect your ability to investigate, or does it change at all? 

If they are involved or if they are not involved, does your process 

change at all? 

Ms. GILLIGAN. There are two parallel tracks. We support the 

NTSB. In fact, many of our technical experts provide their technical expertise to the NTSB. As you know—— 

Mr. MEADOWS. Right. 

Ms. GILLIGAN [continuing]. NTSB is a small organization. They 

certainly don’t have depth of expertise in all of the areas of aviation. So we provide technical expertise, as do other parties, to those 

events, those investigations. 

Mr. MEADOWS. So does it limit your ability to investigate at all? 

Ms. GILLIGAN. No. On a parallel track, we have other independent responsibilities, because of our authorization—— 

Mr. MEADOWS. Right. 

12 

Ms. GILLIGAN [continuing]. To make sure that we are understanding if there are any immediate safety-of-flight issues, or 

things that go beyond what may be the probable cause of that accident. We very much try to separate that out, and we do our review 

to see if there are safety improvements we need to make while they 

do their investigation. 

Mr. MEADOWS. OK. My time is running out. So let me ask you. 

If you had legislation coming from this committee that said that we 

would allow for a little bit more public disclosure on incidences, 

and maybe keep that limited—public domain on accidents, is that 

something that the FAA could support, if you had legislation coming from this body? 

Ms. GILLIGAN. We—— 

Mr. MEADOWS. Is that something you would welcome? 

Ms. GILLIGAN. We certainly could follow whatever direction along 

those lines that might come through legislation. I think—— 

Mr. MEADOWS. But would you welcome that? 

Ms. GILLIGAN. Sir, we would really have to see what the language is. But I understand your point. I do think that incident review needs to be an open exchange of information by all of the safety professionals, so that we can be sure we are going to prevent 

something that could be prevented. We understand what happened. 

And anything that would support that, we could support. 

Mr. MEADOWS. I yield back. Thank you, Mr. Chairman. 

Mr. LOBIONDO. Thank you. Mr. Williams. 

Mr. WILLIAMS. Yes. I want to say thank you for being here, Ms. 

Gilligan, we appreciate it. 

First of all, I am going to ask you an important question. Would 

you feel comfortable flying on a Boeing 787? 

Ms. GILLIGAN. Yes, sir. 

Mr. WILLIAMS. OK. Are you doing anything to change the skill 

set of your workforce in aircraft certification to move to a more 

risk-based system approach to safety oversight? 

Ms. GILLIGAN. Yes, sir, we are. We do see that the level of safety 

in the system now is at an all-time high. The only way we are 

going to continue to build on that is to make sure that we have, 

and are analyzing, what is occurring; that we are finding things before they cause catastrophic failure, and we are able to fix it. So 

we are moving toward that kind of approach. We identify risks, 

identify what we can do to mitigate, manage, or eliminate those 

risks, and oversee that implementation to make sure the mitigation 

has been effective. 

That will add to the skill set of our workforce, but on the certification side we will always need, obviously, aerospace engineers and 

other kinds of engineering expertise. We are looking for a cadre of 

folks who have that engineering expertise, and also the ability to 

do data analysis to really inform how they make their engineering 

decisions. 

Mr. WILLIAMS. One other question, which you basically touched 

on just a second ago. But, simply put, do you believe that Congress 

needs to take additional actions as a result of this—of the battery 

incidents? Do we need to get more involved? 

Ms. GILLIGAN. No, sir. I believe, as both the chairman and Congressman Larsen pointed out, we believe that this is a demonstraVerDate Aug 31 2005 12:55 Oct 17, 2013 Jkt 000000 PO 00000 Frm 00022 Fmt 6633 Sfmt 6633 P:\HEARINGS\113\AV\6-12-1~1\81427.TXT JEAN
13 

tion of the system really working well. The reality is these are complex pieces of equipment, and things will go wrong. But we need 

to make sure the airplane can land safely, and that is what we did. 

Mr. WILLIAMS. Less Government is the best Government. Thank 

you for being here. 

Ms. GILLIGAN. Thank you, sir. 

Mr. WILLIAMS. I yield back. 

Mr. LOBIONDO. Mr. Larsen? 

Mr. LARSEN. Ms. Gilligan, could you compare the level of involvement in the certification activities associated with the redesign of 

the battery with the certification of the original design, and explain 

what, if any, actions, as well as direct involvement, the FAA took? 

Ms. GILLIGAN. Sure. I think it is important to realize that after 

the second event, the in-flight event, we determined that we had 

an unsafe condition. That always drives a higher level of FAA involvement. So we worked very closely with Boeing for thousands of 

hours to understand what were the risks. Boeing did a very indepth analysis, brought together a team of experts on lithium ion 

batteries to understand, since we didn’t know the root cause of the 

two events, we needed to understand what was the group of things 

that might have resulted in either one of those events occurring. 

So, Boeing identified those areas. That led to what design 

changes needed to be made to address those risks, and the evaluation and testing to demonstrate that those designs would be effective. We were with them pretty much every step of the way. 

There was a list of about 20 tests that needed to be performed. 

We, FAA employees, witnessed most of those tests on this redesign. 

Because, again, we were dealing with an unsafe condition, and we 

really needed to get to the root of that to be able to solve the problem. 

Mr. LARSEN. So then—so you have characterized how the FAA 

was involved. Can you characterize the—I don’t know, the amount 

of time directly involved? 

Ms. GILLIGAN. We have some hour counts, and I hesitate to use 

them. So we have estimated about 7,000 hours. But it is important 

to understand for the work on the airworthiness directive—— 

Mr. LARSEN. Right. 

Ms. GILLIGAN [continuing]. We also collect a lot of our overhead 

kinds of time. A lot of our executives and senior managers were involved in the work on the AD. Their time is included in that number. In a standard certification, the manager time isn’t always accounted for in the same way. But with that exception, we spent 

thousands of hours working with Boeing. 

Mr. LARSEN. What does this—what does the certification process—FAA’s involvement in the certification process of the redesign 

tell you about your future involvement in the certification of the 

use of lithium ion batteries in—you know, in the next airplane, 

whoever makes it? 

Ms. GILLIGAN. Well, again, we will use the same kind of enhanced testing and analysis, because we have seen how that can 

really show what will happen to the battery, and whether or not 

the design really meets our standards. 

Whether or not we would delegate, or ask our designees to make 

the findings of compliance will very much depend on the expertise 

14 

of the applicant, the expertise of the designated organization or the 

individuals in that company. It is always kind of a case-by-case determination. But I think we will continue to keep our eye on applications for the use of lithium batteries to be sure that the testing 

and the standards are as robust as they need to be. 

Mr. LARSEN. Have you changed the literature review, literally? 

It might sound like a snarky question. But if the first lit review 

of lithium ion batteries did not indicate to you, or—as the FAA, of 

a testing regimen that would result in the similar incident that we 

saw with JAL or ANA, has the body of literature changed? 

Ms. GILLIGAN. Well, again, I think, from the expert panel that 

Boeing put together, we did learn that, in the intervening years, 

more has been learned about lithium ion batteries and their risks 

and how to test for those. 

I do think it is important to note, and I am sure that Mr. Sinnett 

will, in the next panel, that in order for Boeing to reproduce the 

events that occurred in the two incidents—— 

Mr. LARSEN. Right. 

Ms. GILLIGAN [continuing]. It was an extremely difficult test. It 

really pushed the battery much, much further than anybody realized it would need to be pushed, if that is the right way to describe—— 

Mr. LARSEN. Sure, I understand. 

Ms. GILLIGAN [continuing]. In order to replicate what occurred in 

the two incident batteries. 

So, I do think we have a very robust set of tests now that we 

are confident reflect the best knowledge on lithium ion batteries 

today, and we will continue to evaluate that testing. We have the 

RTCA right now, a standards organization that helps us set standards—— 

Mr. LARSEN. Yes. 

Ms. GILLIGAN [continuing]. Working on testing standards for 

small and medium-sized lithium batteries. We will task them to go 

back and continue to review the application of large lithium ion 

batteries, to make sure, if there are changes in that literature, that 

we are on top of it and we are able to incorporate changes if we 

need to. 

Mr. LARSEN. Didn’t the RTCA’s standards for testing lithium ion 

batteries change in the 2008 timeframe? 

Ms. GILLIGAN. That was the first time they issued standards on 

our behalf. You know—— 

Mr. LARSEN. Yes. Were the—— 

Ms. GILLIGAN [continuing]. They provided standards—— 

Mr. LARSEN. Were those standards different than what was— 

the—were they different than what the lithium ion batteries were 

then being tested under? 

Ms. GILLIGAN. They were different than how Boeing demonstrated compliance with our original set of standards, because 

they had a standard that would have allowed for the battery to be 

recharged. In the Boeing design, Boeing had determined that they 

would not permit the battery to be recharged. So that was not a 

standard that needed to apply. 

There may have been other differences, but I don’t think we considered them substantial. 

15 

Mr. LARSEN. Yes. And who participated in the RTCA panel to 

look at that? 

Ms. GILLIGAN. Oh, RTCA is a way that we bring together a large 

number of experts. 

Mr. LARSEN. Right. 

Ms. GILLIGAN. It was quite a large panel, as I recall. We have 

got the list of people and organizations, but they were—— 

Mr. LARSEN. Were you—was the FAA involved? 

Ms. GILLIGAN. Oh, yes. 

Mr. LARSEN. Directly in that? 

Ms. GILLIGAN. Yes. RTCA takes these assignments from FAA. 

We ask—— 

Mr. LARSEN. Well, I know they take the assignments from you. 

Ms. GILLIGAN. Oh. 

Mr. LARSEN. But was—— 

Ms. GILLIGAN. But yes, yes. 

Mr. LARSEN. The FAA’s folks were there? 

Ms. GILLIGAN. Yes, we had somewhere between 5 and 10 participants in the course of the development of the standards, both to 

help inform the other experts about how FAA uses standards as 

well as to make sure we had a group of people who really understood the standard when we received it. 

Mr. LARSEN. So, then, was the lithium ion battery standard that 

came out in 2008 from RTCA, their recommendations from RTCA, 

were those incorporated in testing and retesting lithium ion batteries for use in large airplanes? 

Ms. GILLIGAN. The standards really provide a manufacturer with 

a method of how to go about showing compliance to the performance standards that we set. 

Mr. LARSEN. Right. 

Ms. GILLIGAN. So, we did not require anyone who already had an 

approved lithium battery application to go back and retest using 

the RTCA methodologies. 

Mr. LARSEN. And why not? 

Ms. GILLIGAN. Well, we had developed the special conditions in 

accordance with our counterparts in Europe. Airbus A380 was 

using some small lithium batteries. So we had already all agreed 

on what that standard was. Boeing had, at that time, provided sufficient data to demonstrate compliance with those standards. So, 

there was no—— 

Mr. LARSEN. With the new standard? 

Ms. GILLIGAN. No, with the standards that we applied. In aircraft design it is very difficult to go back and cause existing products to be retested in accordance with some new standard or new 

information that we may get, unless something in the new information suggests that there is an unsafe condition in the old, existing 

product. 

Mr. LARSEN. And, if I may, and you are arguing that there was 

nothing in the newer standards that indicated there was something 

unsafe in the—— 

Ms. GILLIGAN. That is correct. 

Mr. LARSEN [continuing]. In the existing standard? 

Ms. GILLIGAN. That is correct. 

Mr. LARSEN. Yes. Thank you. 

16 

Mr. LOBIONDO. Mr. Radel? 

Mr. RADEL. Thank you, Mr. Chair. Appreciate it. Thank you so 

much for your time. I had two questions. The first—sorry, I had to 

step out for a second—apparently, the first was already covered. It 

is in reference to the organization designation authorization. And 

I hope that we can work together really to make sure that this permitting process of these regulations that at times are incredibly 

burdensome for the industry, that we can work together to make 

them more efficient, streamline them. Because at the end of the 

day, a lot of these costs for the entire industry, they have to get 

passed along to us, who want to buy plane tickets. 

The other thing I just wanted to touch upon was budgeting. We 

know how sequestration has been difficult, to say the least, for the 

FAA, especially when it come to prioritizing. I would ask you what 

guidance can our committee here give the FAA in the future for future reauthorizations to better facilitate prioritization of funding, 

as our Republican House continues to enact cost savings on behalf 

of our American taxpayer? 

Second part, what specific spending latitude will ensure that the 

FAA continues to meet its duties of oversight and efficiency for airplane manufacturers? 

Ms. GILLIGAN. Well, if I could start with the second one first—— 

Mr. RADEL. Sure. 

Ms. GILLIGAN. Excuse me. First, I think we are very appreciative 

of the work that Congress did to allow the Administrator the flexibility to move some funding within our different accounts at the 

FAA, so that we could avoid furloughs this year. I think the idea 

of losing 10 percent of everyone’s work time would have had a tremendously negative impact on some of the certification projects 

that we have underway. 

At the same time, we still are looking to save over $380 million 

at the FAA. And that, obviously, will have its impact as well. Right 

now we are in a hard hiring freeze, for example. We see pockets 

where people have left, resigned, retired, whatever, and it is having 

a harder impact in some small offices. 

As to how to help us set our priorities, I do think the last reauthorization was very helpful. It provided a number of opportunities 

for us to work with our industry to review our certification processes, to try to find what it is that causes it to be burdensome, or 

to determine where there may be inconsistent outcomes among different offices. That will provide us a real opportunity to work with 

industry to try to improve those areas. 

Hopefully you will see some results from that review, and that 

might well inform additional authorizations that would be useful, 

going forward. 

Mr. RADEL. All right. Again, thank you so much for your time. 

I yield my time. 

Mr. LOBIONDO. Ms. Johnson. 

Ms. JOHNSON. Thank you very much. Let me apologize for being 

a little late; had to go to another committee. And I hope you 

haven’t answered these questions. But what I would like to know 

is what key lessons have you learned with regard to this January 

Japanese Airlines incident. And will you summarize the process 

17 

that FAA uses to create special conditions for new technologies? 

And why are special conditions necessary? 

Ms. GILLIGAN. Sure. If I may, I will start with the second one 

first. The special conditions is a tool that we have to allow the introduction of new technologies, most of which enhance safety, before we have had an opportunity to go through an extended rulemaking process. So, special conditions and, in this particular case, 

the special conditions related to lithium ion batteries built off 

standards that we had always had in place for traditional batteries. 

The special condition specifically identified the higher risks that 

are posed by lithium ion batteries, and provided for a more robust 

demonstration of protection from those risks. 

Special conditions are really a way of building off what we know 

to allow the introduction of new technology carefully, making sure 

that we set a little bit more robust standard for something that is 

new, or novel, before we just allow it into the aviation system. 

As to lessons learned, I had mentioned before we are still waiting 

for the NTSB’s final investigation report on probable cause, and we 

think that will help inform some lessons. FAA and Boeing are also 

doing an indepth review of the certification process, and we expect 

to learn lessons from that, as well. 

But there are some things that we have seen already. I think the 

first and most important is that we have identified a more robust 

testing regime to be used for testing lithium ion batteries. Boeing 

used that in the redesign, and that will be the regime that FAA 

will use, going forward. So I think that is an important lesson. We 

have already raised the safety bar that much. 

In addition, we have identified that with new technologies there 

often times are experts who are not involved in aviation, but are 

experts in that technology. We need to find a way to make sure we 

are reaching that community of experts to help us make sure that 

when we introduce new technologies, we understand everything 

that can be known at the time. 

So, those, I think, are a couple of lessons learned. There are also 

those kinds of process improvements, where we need to enhance 

communication between the manufacturer and all of the sub-tier 

providers that they buy parts from. FAA needs to be monitoring 

that more closely, as well. So there are several process improvements that we are going to pursue, as well. 

Ms. JOHNSON. Thank you. In your written testimony you discuss 

the use of aviation experts outside the agency to resolve technical 

problems, noting certification of aviation products and systems is 

not limited to the participation of a single certifying entity and 

manufacturer. Please explain what steps, if any, the FAA takes to 

bring this independent, outside technical expertise to bear on the 

challenges associated with the certifying of the lithium batteries for 

the use of Boeing 787. 

Ms. GILLIGAN. Yes, ma’am. As we were just talking, there is an 

organization called RTCA, which is a standards-setting organization that FAA uses, along with SAE, another similar organization. 

Through those groups, we pull together experts on the technology. 

So, again, at the RTCA we had a wide-ranging panel of experts 

with aviation experience, with lithium battery experience, to help 

18 

us build the standards and the description for how a manufacturer 

would demonstrate that the lithium ion battery was safe. 

We do have a lot of mechanisms in place that let us reach experts around the world on the particular technologies that we are 

trying to address. 

Ms. JOHNSON. Thank you very much. Thank you, Mr. Chairman. 

Mr. LOBIONDO. Mr. Davis. 

Mr. DAVIS. Thank you, Mr. Chairman, and thank you, Ms. 

Gilligan, for being here today. I apologize for coming in late. That 

seems to be the nature of our business, they double-book things. 

But I know you mentioned you had some responses to organization designation authorization. I would just like to ask you quickly 

a couple questions to have you expand on that. With fewer resources on the horizon for FAA across all offices, how will you further utilize ODA and that delegation to meet the growing certification workload for new products at both Boeing and throughout 

the American aerospace industrial base? 

Ms. GILLIGAN. Thank you, sir. As we discussed a little bit before, 

FAA has, for many, many years leveraged our internal resources 

by using either individuals or, now, organizations to whom we delegate authority to act on our behalf. It is a key way that we are 

meeting the safety requirements for certifying products. We see 

that expanding over time. 

The ODA is a relatively new authorization. We are learning, as 

the industry applicants are learning, as we go. But I expect that 

we will see ODA, if not mushroom, certainly grow substantially. It 

is a way that we can leverage our resources and assure the safety 

of the product at the same time. 

Mr. DAVIS. OK, thank you. Now, Boeing. Right now are you overseeing all of the—are you overseeing the entirety for inspections 

that would normally fall under an ODA—— 

Ms. GILLIGAN. Oh, no. 

Mr. DAVIS [continuing]. Or their employees? 

Ms. GILLIGAN. Oh, no, no. The Boeing Company has an ODA. It 

is quite a robust ODA. We work very closely with them. We continue to provide oversight of the ODA. We need to assure that they 

are performing their authorizations on our behalf appropriately. I 

think, as we see in this hearing, there is always a balance between 

how much we delegate and how much involvement the FAA has. 

It is a delicate balance that we watch closely. Mostly, what we 

want to assure is that those who are operating or acting on behalf 

of the Administrator, do so in the same way an FAA engineer 

would have operated. We see that that is very much the case at 

the Boeing ODA. 

Mr. DAVIS. OK. So Boeing is still completing some delegated 

tasks that they have normally completed, and you are just doing 

your oversight? 

Ms. GILLIGAN. That is right. We provide oversight of the ODA. 

Mr. DAVIS. All right. I yield back the balance of my time. Thank 

you for your time today. 

Ms. GILLIGAN. Thank you. 

Mr. LOBIONDO. Mr. Duncan? 

19 

Mr. DUNCAN. Well, thank you, Mr. Chairman. Like the others, I 

had another hearing that started at 9:30 before this one. But—so 

I don’t know if this has been covered, or not. 

But the next witness is going to testify that Boeing put this— 

these—this 787 electrical system under an astounding amount of 

testing, 5,000 hours of component testing, 25,000 hours of laboratory testing, 10,000 hours at the airplane level, simulation of 100— 

equivalent to 132,000 flights. In the FAA study of this, have you 

been able to determine why, after all this testing, did this problem 

not show up before? Is it just a fluke, or—— 

Ms. GILLIGAN. Mr. Duncan, again, we haven’t seen the root cause 

analysis or the probable cause determination for the two individual 

incidents from the NTSB. We agree with Boeing that, with all the 

testing that was done for the original certification, we did not see 

these types of events manifest themselves. We also know that when 

we introduce new products, after all of the engineering work that 

has been done, we often see something in operation that either we 

did not anticipate during certification, or where we see one of the 

assumptions that we built off of was just not accurate. 

So, it is not uncommon for us to learn from the new product after 

it is introduced and to make improvements. That is what happened 

here. We had two events, we went back and analyzed them. Boeing 

redesigned the system, we were able to approve that redesign. The 

system and the aircraft are safer for it. 

Mr. DUNCAN. And I assume it is just a coincidence that both of 

these carriers happen to be Japanese carriers, as I understand. But 

is there something that these carriers require, or that the Japanese 

Government requires, that is different from what went into the 

other 787s? 

Ms. GILLIGAN. No, sir, not that I am aware of. Right now, we 

really are looking at the aircraft, the design manufacture and assembly of the aircraft, to see if there is anything that we may have 

overlooked that might have contributed to these two events, and, 

if so, we will address those based on whatever the data shows. 

Mr. DUNCAN. The FAA requires manufacturers to assume or prepare for problems occurring, and this—and have a plan for mitigation to take care of these types of situations. And apparently, you 

didn’t find that this plane was at risk at any time, and no one was 

injured. So, from that standpoint, the system worked. Would that 

be a correct statement? 

Ms. GILLIGAN. Yes, sir. Until we see what the probable cause 

was, it does appear that, although we had the failure within the 

battery at the cell level, that the rest of the design, which met our 

standards, did contain that event, thus the aircraft was not at risk 

and was able to safely land. 

You are right, that is very much a tenet of our certification process, to design so there won’t be a failure, then assume there is a 

failure and design so that the airplane can safely land. In that regard, after the event occurred, it appears everything worked as it 

was intended to work. But again, we will need to see what the 

NTSB results show. 

Mr. DUNCAN. All right. Thank you very much. 

Mr. LOBIONDO. OK, Ms. Gilligan, we thank you very much, appreciate it, and we will move on to the second panel. Mike? 

20 

Ms. GILLIGAN. Thank you, sir. 

Mr. LOBIONDO. OK. Our second witness today is Mike Sinnett, 

Boeing’s chief engineer for the 787 program. Mr. Sinnett, you are 

recognized for a statement. 

TESTIMONY OF MIKE SINNETT, VICE PRESIDENT AND CHIEF 

PROJECT ENGINEER FOR THE 787 PROGRAM, THE BOEING 

COMPANY 

Mr. SINNETT. Chairman LoBiondo, Ranking Member Larsen, 

members of the committee, my name is Mike Sinnett, and I am the 

vice president and chief project engineer for the Boeing 787 program. It is my pleasure to appear before you today, and I want you 

to know that Boeing is committed to supporting your work in any 

way that we can. 

Mr. Chairman, Boeing’s highest priority is the safety of the passengers and crews who fly on our airplanes. Every Boeing airplane 

incorporates the broad, deep, and ever-increasing knowledge we 

have gained from nearly 100 years of designing and building airplanes. Our design approach is data-driven, with risk carefully assessed and managed. Our designs feature multiple layers of protection and redundancy of critical systems, so that no single component failure or combination of failures, even extremely remote, can 

endanger an airplane. 

Mr. Chairman, flying is as safe as it is because industry and 

Government work together day in and day out. The 787 illustrates 

that commitment to cooperation. The design process started with a 

review of everything the industry and its regulators have learned 

about designing, building, and operating safe airplanes. I can attest 

to the team’s strong focus on safety, and to the strength of the certification process, which was more rigorous for the 787 than it was 

for any of our previous airplane programs. 

When our airplanes enter service, we continuously monitor their 

performance, analyze the data we collect, share safety-related findings with customers and regulatory authorities, and work with all 

parties to incorporate lessons learned into the active fleet and its 

new production and designs. The result is an exceptional, safe, and 

reliable airplane. 

Over its first 15 months of service, the 787 achieved a schedule 

reliability rate of 98.2 percent. That is better than the 777, which 

had been considered the best in its class up to that point. At the 

end of that 15-month period, we experienced two battery failures. 

And as we explained at recent NTSB hearings, both incidents, 

while serious, demonstrated the effectiveness of our design philosophy. The airplane’s redundant safety features worked. They prevented the incidents from jeopardizing the passengers and crews. 

With that said, the work done following the two incidents revealed ways we could improve the battery system even further. 

Boeing devoted more than 200,000 engineering hours to develop a 

comprehensive solution, and worked closely with the FAA to test 

and certify these improvements. Through changes to the design of 

the battery, the manufacturing process, and the addition of a steel 

enclosure, we added protections that reduced the likelihood of a 

failure, and further ensured that, should a failure occur, there will 

be no significant impact to the airplane. 

21 

Mr. Chairman, I would like to turn to certification, because I 

know that is a subject of great interest today. All of our airplanes 

are certified by the FAA, which is recognized globally as the gold 

standard. A key component of every airplane certification is the 

process for delegation of authority. Delegated authority furthers 

the top priority of industry and Government, which is safety. The 

ability to delegate authority through team tasks enables FAA specialists to focus on the highest-priority issues. 

Organizations that demonstrate strict accountability to certification requirements may receive what is called organization designation authority, or ODA. It is a privilege that is hard to obtain, 

and it carries serious responsibilities. Notably, the FAA remains 

firmly in control, and ODA holders are governed by stringent requirements that include an FAA-approved process for selecting and 

training individuals to perform these delegated tasks. I can assure 

you that the members of the Boeing ODA are held to a very high 

standard, and are backed fully with the support of The Boeing 

Company. 

As mentioned, the certification process for the 787 was the most 

rigorous in Boeing’s history. It took 8 years and involved three 

times more conformed tests than the 777 certification program, 

three times more data submittals, twice as many airplane ground 

tests, and three times more integration tests. 

In closing, I would like to reiterate that certification is not the 

end of Boeing’s involvement in the safety of delivered airplanes. We 

collect and analyze enormous amounts of operational data. And 

when we spot a safety issue, we address the issue so that safety 

is maintained. This ongoing commitment to safety and the collaboration we find across aviation, coupled with our in-service monitoring and data-driven risk management approach to designing 

new airplanes, are key reasons that flying is the world’s safest way 

to travel. Flying today is 70 times safer than driving. And in recent 

years there have been zero deaths from airline accidents here in 

the United States. None of this is happenstance. 

Mr. Chairman, this concludes my remarks, and I will be happy 

to answer any questions. Thank you. 

Mr. LOBIONDO. Thank you. Could you tell us what you believe 

the lessons learned were from these two incidents? And what, if 

anything, you are doing in response to them? I mean other than 

the fixes, which I know are, you know, being put in place. 

Mr. SINNETT. I think the first thing that I think of is that, because of these incidents and the work that followed, Boeing and the 

team that we worked with advanced the state of the art for understanding and testing lithium ion batteries. The test protocol that 

we had gone through up to this point had reflected the previous 

state of the art of the industry. And we worked, following these incidents, to push the state of the art so that we could cause a battery to fail in a similar way as it failed on the airplane. So this 

was one of the areas. 

I think we also learned a significant amount about how to improve the processes in the manufacture and quality control of batteries, of lithium ion batteries. 

And lastly, and I think most importantly, these incidents validated our design philosophy, which is that no single fault can put 

22 

an airplane at risk, and no combination of faults, even extremely 

remote, can put the airplane at risk. And again, these incidents 

validated—revalidated that design philosophy. 

Mr. LOBIONDO. Some have suggested in the aftermath of the two 

incidents that somehow the FAA certification process was in some 

way lacking. How would you respond to that? 

Mr. SINNETT. I would disagree. I believe that the certification 

process for the battery and for the airplane was extremely robust. 

The process takes into account the risks of a component failing, 

and the process takes into account the resulting impact on the airplane. And, as Ms. Gilligan pointed out, while the incidents occurred and the battery did fail, the failure itself was contained at 

the battery level and did not put the airplane at risk. And the certification approach ensures that that is the outcome. 

In a machine as complex as an airplane, there can be components that fail. We take those failures very seriously, and we work 

to address them. An accident can be the cause of multiple links in 

a chain that fail. And any time we have an incident which can be 

considered the break of the first link in that chain, we take it seriously. The incident was referred to as potentially impacting safety, 

and that is because the first level of the—of redundancy was compromised, and that is the first link in the safety chain. And so we 

take it very seriously. 

Mr. LOBIONDO. OK, thank you. Mr. Larsen? 

Mr. LARSEN. Thank you, Mr. Chairman. Mr. Sinnett, back to that 

first question I asked Ms. Gilligan about self-certification. If you 

could imagine, again, the book-ends being—where people call it 

self-certifying, where they give the company—‘‘Just go do something and come back and tell us what you did and we will check 

the box,’’ versus the FAA crawling all over it every day, in control, 

and then says, ‘‘Here, take it and do this.’’ How would you characterize the certification process, if those were, in fact, the book-ends? 

Mr. SINNETT. I would say that it was somewhere in the middle. 

The way the delegation works, the FAA looks at the tasks at hand, 

and it considers which tasks are safety-related, and it retains those 

safety-related tasks. In areas where the tasks are more relatively 

mundane, typical of what you do day in and day out in the cert 

process, they may delegate those tasks to the delegated organization. 

In the case of the battery, the initial battery certification, the 

FAA retained the items that were inherently safety related. For example, the FAA retained approval of the certification plan. They 

also retained approval of the safety assessment following all the 

testing of the battery. Those were the two items that were most important in establishing the safety of the battery system, and in assuring that, as we—as the applicant, Boeing, showed compliance, 

that the FAA was able to find compliance to the safety-related aspects. 

The other things that they delegated, things like tests to set up 

conformity, witnessing of certain environmental tests, those aren’t 

necessarily germane to the safety of the overall system and the 

overall design. Really, the keys to the kingdom there are the certification plan itself, how we propose to show compliance to all the 

23 

rules, and then the safety assessment, which ties all of the analysis 

and the results to the end safety product. 

Mr. LARSEN. OK. Can you talk about the—what you called the 

new state of the art in testing? The old state of the art, if you will, 

we have discussed and NTSB discussed this nail penetration of a 

battery. And perhaps—I think we know now that it probably 

wasn’t the—should not have been a standard. Can you talk about 

what was the old state of the art and what you think the new state 

of the art on testing of lithium ion batteries are for this size of 

a—— 

Mr. SINNETT. Sure. 

Mr. LARSEN. You know—— 

Mr. SINNETT. Sure. In the past, the failure modes associated with 

large lithium ion battery cells were—there were really two types of 

failure modes. One was a severe failure resulting from an overcharged condition, where the cell contains more energy than it was 

ever designed to contain, because of a failure of the charging system, or a failure of the charging procedures. That type of failure 

has led to open flame resulting outside of the battery cell, and has 

been an area of great concern, from a safety perspective, which is 

why the charging system comes under such scrutiny, and is so 

carefully designed. In the NTSB factual report, they have set aside 

any concern about overcharging as being one of the potential failure modes of this battery. 

The only other failure modes that we are aware of are failure 

modes that result from short circuits inside the battery due to a 

number of different causes. Regardless of the cause, when those 

short circuits occurred, the net result at a cell level was simply the 

use of the—there is a burst disk on the side of the cell that opens 

when the cell pressure and temperature rises to allow the cell to 

safely vent. 

In all other cases, for a battery failure, for a cell failure, the only 

thing that has resulted is that disk opening and the battery venting the electrolyte, which looks like smoke to you or I, but it is 

venting electrolyte with no flame. 

These particular cells had undergone more than 2 million hours 

of operation on the airplane without a failure, and had undergone 

millions of hours of operation in another industry, also without a 

failure. 

The test state of the art at that time was a nail penetration test. 

And when that nail penetration test was performed, it replicated 

every known failure mode of the cell, with the exception of overcharge. And so, while the cells would short circuit, their temperature and pressure would increase, they would vent this electrolyte, 

which, again, looks like smoke. But in no cases were there ever 

flame, and in no cases was there ever propagation to another cell 

inside a battery. For that reason it was considered state of the art 

through, again, millions and millions of hours of operation. 

On the JAL airplane and on the ANA airplane, what we saw was 

some type of internal short circuit, but we don’t know yet what the 

root cause was, because that is still under investigation. But the 

net result was a more energetic release of energy from the cell than 

we had seen, either through the nail penetration testing, or from 

any of the previous testing. 

24 

And so, to replicate that, we had to put a significant amount of 

energy into the cell without overcharging. The only way that we 

knew how to do that was to wrap a cell with a heating element, 

and put on the order of 300 kilojoules of energy into the battery 

in the form of heat to heat up the cell so that it would burst its 

disk and vent the electrolyte. What we found in that process was 

that it was energetic enough that it released enough heat to cause 

other cells in the same battery to vent, as well. 

And so, when I think of the state of the art, we have advanced 

that state of the art to the point where now we can replicate a cell 

failure with sufficient energy to cause that venting to propagate to 

subsequent cells in the battery, and that is where the current state 

of the art is today. 

Mr. LARSEN. Mr. Chairman, could I continue? 

Just to—for my edification, 300 kilojoules sounds like a lot. Can 

you just explain—I am sure everyone else here knows what a 

kilojoule is. Could you just explain what a kilojoule is? I don’t’ 

know what it is, so—— 

Mr. SINNETT. It is—a good way to think about it is—the cell of 

the battery, that is about 30 percent more energy than that cell 

contains when it is fully charged. So you can think about overcharging a cell by about 30 percent. That is the amount of energy 

that we are talking about. 

Mr. LARSEN. Oh, OK. I will have a second round. 

Mr. LOBIONDO. Ms. Johnson? Questions? 

Ms. JOHNSON. [No response.] 

Mr. LOBIONDO. No? Back to you. 

Mr. LARSEN. Sure, great, thanks. So, with the new state of the 

art, would you argue, then—would you argue that that will be the 

state of the art? Is that going to get in the literature for the next 

lit review, and this is how you are supposed to be doing it because 

we know better now? 

Mr. SINNETT. I would imagine that for the immediate near term 

it would be, until somebody thinks up a better way to do it. 

One of the ways we might not like it is that it is overconservative 

at this point. We add a lot of energy to the battery to make it do 

what it does. And you never want to be overconservative, you kind 

of want to hit the sweet spot. But for right now, being overconservative is better than being—— 

Mr. LARSEN. And by overconservative, you mean you are really 

stressing the battery beyond what anyone would ever think it 

would be doing. 

Mr. SINNETT. That is correct. 

Mr. LARSEN. Yes. So it ends up not being a realistic situation? 

Mr. SINNETT. It encompasses all realistic situations and then 

some. And it gave us great confidence with the battery enclosure 

that we have designed to go around the battery. 

In fact, in our certification testing on the airplane, with the airplane operating and the engines running, we wrapped that same 

heater element around a cell inside the battery in the newly designed enclosure, and we put that same amount of heat into that 

battery cell and caused the battery to fail on the airplane, while 

the airplane was operating, pilot is on board, engines running, in 

a conformed certification test, and demonstrated that, even while 

25 

that single cell failed, the battery continued to operate for the next 

hour, and the airplane continued to operate normally throughout 

the entire event. 

Mr. LARSEN. Are you involved with the ODA process? 

Mr. SINNETT. I am involved as the applicant. And inside Boeing 

we kind of have a firewall between the delegated organization and 

the applicant, which is the designer, the builder, the requester of 

the certificate. I am the designer and builder. 

Mr. LARSEN. OK. You are getting at the crux of my question. Because if Boeing is an ODA or has an ODA designation, we have 

FAA working with the ODA within an organization, but that organization also then is designing, building the equipment, in this case 

an airplane. How do you keep those separate? Because, you know, 

the watcher is watching the ODA. The ODA is supposed to be 

watching the maker. But if the ODA and the maker are under one 

roof, then how do we—how would we look at that and say, ‘‘Well, 

we need to have more separation’’? 

Mr. SINNETT. It is a—to a large degree, it is a process-based separation that is rooted in our culture. For example, while we are a 

designated organization today, we have always had designed representatives of the FAA performing aspects of the showing of compliance. 

Now, since I started in Boeing commercial airplanes 23 years 

ago, it has been my history that I was taught from the very beginning that when a Boeing engineer is acting on behalf of the FAA, 

they are completely independent, and they have—they cannot come 

under any undue management pressure to do something that is 

against what they would term as best, from an FAA perspective. 

And that is deeply rooted in our culture. One of the quickest ways 

to see disciplinary action as a manager is to provide any undue influence over a designated representative of the FAA. And it is in 

our absolute culture to make sure that they are independent from 

that perspective. 

We believe that for a couple of reasons. One, it is one of the primary legs in the safety stool. It—our whole industry relies on that. 

Second, we also understand that, without that, the certification 

process itself would take much longer than it does today, and the 

net product would probably not be as good as it is today, because 

we wouldn’t have the expertise of the individuals who know as 

much as they do about the individual systems. 

Mr. LARSEN. Presumably, the FAA could pull an ODA status, as 

well, if there were any problems. 

Mr. SINNETT. That is right. The FAA can pull that privilege from 

us at any time, if we are not performing it appropriately. And, likewise, the FAA can take an individual who is performing as a delegated representative and remove that individual, as well. 

Mr. LARSEN. Yes. I will explore that a little more with the FAA, 

I think. 

I have got one last question, and it has to do with all those airplanes sitting on the tarmac in Paine Field. And I know you are 

moving to get those delivered, and very happy about that. But it 

goes to the changes, now that you have the—you have signed off 

on the new change of the new system with the box and the vent. 

And then, incorporating that now into the production process and 

26 

moving those planes out, is that—does that need to be separately 

certified, as well? 

Mr. SINNETT. That change—— 

Mr. LARSEN. The process of changing them out, putting the new 

boxes in. 

Mr. SINNETT. Yes. There were two separate certifications. One 

was really related to the basic type design of the airplane—— 

Mr. LARSEN. Right. 

Mr. SINNETT [continuing]. Changing to incorporate it. And the 

other was a certification of the service bulletin that is performed 

by the airlines to make that modification. Boeing teams did that 

modification work for the airlines, but that was under the service 

bulletin that had been approved by the FAA. 

Mr. LARSEN. Any involvement in developing that certification for 

the process includes management engineers and machinists on the 

line, making sure everybody is working off the same page? 

Mr. SINNETT. That is correct. 

Mr. LARSEN. Yes. 

Mr. SINNETT. Right. 

Mr. LARSEN. That is it. Thanks. 

Mr. LOBIONDO. OK. Mr. Sinnett, we thank you very much, and 

the subcommittee stands adjourned. 

Mr. SINNETT. Thank you. 

[Whereupon, at 11:22 a.m., the subcommittee was adjourned.] 

27 


Insert offset folio 8 here 81427.008

TRANSPORTATION AND INFRASTRUCTURE, SUBCOMMITTEE ON AVIA TlON, 

STATEMENT OF MARGARET M. GILLIGAN, ASSOCIA TE ADMINISTRATOR, 

FEDERAL A VIA TION ADMINISTRATION, BEFORE THE HOUSE COMMITTEE ON THE 

CERTIFICATION OF THE BOEING 787 AIRCRAFT AND THE LESSONS LEARNED, 

JUNE 12,2013. 

Chainllan LoBiondo, Congressman Larsen, Members of the Subcommittee: 

Thank you for the opportunity to appear before you today to discuss the Federal Aviation 

Administration's (FAA) certification of the Boeing 787 airplane. There were two widely 

reported incidents earlier this year involving the malfunction of one of the Lithium-Ion batteries 

on in-service 787s that resulted in the FAA grounding the fleet and initiating a comprehensive 

safety review of the 787 critical systems, including design, manufacturing, and assembly. 

Today, after extensive design and certification work, 787s are once again part of the commercial 

fleet, flying passengers safely around the world. The comprehensive review will be completed 

this summer. 

FAA Certification Process 

The FAA certifies aircraft and components that are used in civil aviation operations. Some 

version of our certification process has been in place and served us well for over 50 years. This 

does not mean the process has remained static. Since 1964, the regulations covering certification 

processes have been under constant review. As a result, the general regulations have been 

modified over 90 times, and the rules applicable to large transport aircraft, like the 787, have 

been amended over 130 times. The regulations and our policies have evolved in order to adapt to 

an ever-changing industry that uses global partnerships to develop new, morc emcien! and safer 

aviation products and technologies. 

1 
28 


Insert offset folio 9 here 81427.009

As this committee knows, the FAA is using a risk based approach to improving aviation safety. 

The FAA focuses its efforts on those areas thaI have the highcst risk. The FAA type certification 

team members, who I will discuss in more detail below, must review the applicant's design 

descriptions and project plans, determine where their involvement will derive the most safety 

benefit, and coordinate their intentions with the applicant When a particular decision or event is 

critical to the safety oflhe product or to the determination of compliance, the FAA must be 

involved either directly or through the use of our designee system. 

The designee program was originally authorized by Congress in 1938 and is critical to the 

success and efIectiveness of the certification process. In aircraft certification, both individual 

and organizational designees support the FAA. The FAA determines the level of involvement of 

the designees and the level of FAA participation needed based on many variables. These 

variables include the designee's understanding of compliance policy; consideration of any novel 

or unusual certification areas; or where adequate standards may not be in place. 

There are some issues that will always require direct FAA involvement, including rulemakings 

required to approve special conditions and equivalent level of safety determinations. The FAA 

may choose to be involved in other project areas after considering factors such as our confidence 

in the applicant, the applicant's experience, the applicant's internal processes, and confidence in 

the designees. 

Something that is not well understood about the certification process is that it is the applicant's 

responsibility to ensure that an aircraft conforms to FAA safety regulations. It is the applicant 

who is required to develop the plans and specifications and perform the inspections and tests 

necessary to establish that an aircraft design complies with the regulations. The FAA is 

2 
29 


Insert offset folio 10 here 81427.010

responsible for determining that the applicant has shown that the design meets the standards. We 

do that through review of data and by conducting risk based evaluations of the applicant's work. 

When a new design of aircraft is being proposed, the designer must apply to the FAA for a type 

certificate. While an applicant usually works on its design before discussing it with the FAA, we 

encourage discllssions with the FAA well in advance of presenting a fonnal application. Once 

an applicant approaches us, a series of meetings are held both to familiarize FAA with the 

proposed design, and to fillniliarize the applicant with the applicable certification requirements. 

A number of tormal and infonnal meetings are held on issues ranging from technical to 

procedural. Once the application is made, issue papers are developed to provide a structured 

way of documenting the resolution of technical, regulatory, and administrative issues that are 

identified during the process. 

The applicant must show that its design meets applicable existing airworthiness requirements. 

Title 14 of the U.S. Code of Federal Regulations Part 25 comprises the safety requirements for 

transport category airplanes. The regulations also provide for the issuance of special conditions 

when the FAA finds that the existing airworthiness standards do not address new or novel design 

features. 

When the FAA proposes to apply special conditions to an airplane design, a noticc of proposed 

special conditions is published in the Federal Register and the public has an opportunity to 

comment. As is the case with other rulemakings, those comments are considered and addressed 

before the special condition is finalized. This process is intended to allow important innovation, 

while maintaining the level of safety consistent with the existing regulations. Special conditions 

3 
30 


Insert offset folio 11 here 81427.011

address the unique risks associated with a pmiicular new technology. They do not replace 

general safety requirements, they supplement them. 

Once the certification basis is established for the proposed design, the FAA and the applicant 

develop and agree to a certification plan. In order to receive a type certificate, the applicant 

must conduct a series of tests and reviews to show that the product is compliant with existing 

standards and the special conditions. This includes analysis, lab tests, flight tests, conformity 

inspections, and detail-and airplane-level compliance tlndings, all of which are subject to FAA 

oversight. If the FAA finds that a proposed new type of aircraft complies with safety standards, 

it issues a type certificate. 

:FAA Certification of the Boeing 787 

Using the framework described for obtaining a type certificate for a proposed airplane design, I 

would like to provide some information about the certification of the Boeing 787. Boeing first 

applied for a type certificate for this aircraft on March 28, 2003. The FAA formed a certification 

team comprised of certification engineers, inspectors, flight test pilots, flight test enginccrs, 

human factors specialists, technical advisors, specialists from the FAA Technical Center, and 

several of our Chief Scientists in various disciplines. The team was supplemented by experts 

from other aviation authorities, industry technical organizations such as RTCA and SAE, and 

govemment, such as the DOT's Volpe Center. As a result of regular meetings between the FAA 

and Boeing teams, FAA identified a numbcr of design features of the proposed airplane where 

the cun·ent standards did not address the new or novel features, including the lithium ion main 

and auxiliary power unit (APU) batteries. At that time, there was a general standard - an FAA 

regulation - for the design of nickel cadmium and lead acid batteries, but these standards did not 

4 
31 


Insert offset folio 12 here 81427.012

fully address the safety issues associated with lithium-ion battery systems. Therefore, the FAA 

developed a special condition to establish a comparable level of safety with the standards that 

were in place at the time of celiification. 

In order to develop the special conditions necessary to achieve the equivalent level of safety 

required for certification, we reviewed the available lithium battery literature. This also included 

consideration of the hazards of other battery technologies, such as nickel cadmium batteries. 

This review and analysis resulted in an issue paper, which led to publication in the Federal 

Register of proposed special conditions on April 30,2007. The special conditions identified 

requirements to produce a level of safely equivalent to existing requirements in place for other 

types of batteries. The special conditions became effective in November 2007 and snpplemented 

the existing part 25 requirements. 

The development and approval of the special conditions focused on two related safety concepts; 

the function the system performs, and the hazards associated with its failure. The primary 

goveming rule, part 25.1309, establishes general requirements for system safety. There is also 

an Advisory Circular that accompanies the rule that describes mcthods applicants can use to 

describe and analyze systems to demonstrate compliance. System descriptions and functional 

hazard assessments help us understand what happens to system functions when failures occur. 

With respect to the lithium ion batteries, from a functional standpoint, they were not critical 

becanse they were only intended to provide power if some of the six generators on the airplane 

failed. 

In summary, the certification of the Boeing 787 required extensive FAA involvement over an 

eight year period. A total of 150 issue papers were developed. Engineers spent thousands of 

5 
32 


Insert offset folio 13 here 81427.013

hours on the certification. There were over 900 hours of flight testing during the process. The 

certification process was detailed and thorough, but, as is the case with newly certified products, 

we often learn more about the product after it is certified and gains service experience. As we 

obtain pertinent information, identify potential risk, or learn of a system failure, we analyze it, 

we find ways to mitigate the risk, and we require operators to implement the mitigation. And 

that is what happened in the case of the 787. 

787 Incidents and the Decision to Ground the Fleet 

New products and technologies, in all industries, often have operating failures when they first go 

10 market. Aviation is no different, but the consequences of failure can be so much more 

significant, that mitigations of potential failures arc built into the certification process. On 

January 7, 2013, when a battery on the 787 operated by Japan Airlines (JAL) overheated and 

stmied a fire on an empty aircraft at Boston Logan Airport, FAA immediately investigated the 

incident. On January 11,2013, FAA announced a comprehensive review of the 787's critical 

systems, including the design, manufacture and assembly of the aircraft. The Japan transport 

ministry and the National Transportation Safety Board also opened investigations. On January 

16, an All Nippon Airways (ANA) 787 made an emergency landing at Takamatsu Airport after 

flight crew received a computer warning that there was smoke inside one of the eleetrical 

compartments. ANA said that there was an error message in the cockpit indicating a battery 

system malfunction. 

Far and away the most important fact eoncerning these incidents is that no one on board the 

aircraft was injured. Even when the battery system failed in flight, the incident did not result in 

injury to anyone on board. This is in part because the FAA certifieation process requires 

6 
33 


Insert offset folio 14 here 81427.014

manufacturers to assume that system failures will occur and to design mitigations for those 

failures to protect the aircraft so that no injury occurs to persons on board the aircraft. From a 

certification standpoint, that goal was met. 

After the second event, we gathered all the data we had. Given the limited operational 

experience we had with the airplane, the fact that the two battery events occnrred in quick 

succession, and that one of the events occurred in flight, we decided to ground the fleet. This 

would allow us to take the time necessary to develop and implement the right safety solution 

without compromising safety. 

Prior to January, the FAA had not grounded an aircraft fleet since the DC-l 0 in1979, so this is 

not an action the agency takes lightly. Unlike that previous fleet grounding, the 787 was 

grounded, despite the fact that the incidents, thankfully, did not result in death or injury to 

passengers or crew. 

The accident rate for commercial aircraft operations is at an all time low. Neither the public nor 

the FAA has the tolerance for that accident rate increasing. Failures of systems on airplanes with 

hundreds of thousands of flight hours provide us with a tremendous amount of service data we 

can use to put an operational incident into the appropriate context and determine the 

corresponding mitigation. When the number of flight hours that can be evaluated is limited, 

FAA's ability to develop an appropriate mitigation is more challenging. 

Grounding the 787 Heet gave the FAA the ability to consider necessary mitigations without 

compromising passenger safety. The fact that the incident was limited in nature helped us focus 

our analysis and agree upon a mitigation that could be implemented. 

7 
34 


Insert offset folio 15 here 81427.015

Post Grounding Review 

The comprehensive review of the Boeing 787 and the root cause analysis of the two battery 

incidents was a data driven process. Based on past accident investigations, we know tbat, while 

it is sometimes not possible to determine the actual cause of an incident, that does not prevent us 

from developing effective mitigations to prevent further malfunctions. 

Boeing, with support from industry and government battery experts, conducted a comprehensive 

review of the design of the battery systems. Based on the infonnation obtained from the review, 

the focus of mitigation efforts was on the possible causes that could result in an internal shOlt 

within the cells and the battery. The changes Boeing proposed addressed the initiation of a short, 

propagation of the malfunction from one battery cell to another, and contaimnent of the event 

should another propagation occur. FAA specialists were involved in developing the mitigation 

eiIort throughout the process. 

On April 19,2013, after Boeing completed the certification plan and demonstrated compliance 

with the standards, the FAA approved Boeing's design for modifications to the 787 battery 

system. The changes were designed to address risks at the battery cell level, the battery level, 

and the aircraft leveL A team ofF AA certification specialists observed the rigorous tests we 

required Boeing to perform. They devoted weeks to reviewing the detailed analysis of the design 

changes. 

On April 26, 2013, the FAA issued an Airworthiness Directive (AD) superseding the previously 

issued AD mandating that operators install of the main and auxiliary power (APU) unit battery 

enclosures and cnviromnental control system ducts; and replacing the main battery, APU battery, 

8 
35 


Insert offset folio 16 here 81427.016

and their respective battery chargers. This AD also requires revision of the maintenance 

program to include an airworthiness limitation reflecting a requirement to replace certain parts 

related to the battery enclosure. 

To assnre proper installation of the new design, the FAA closely monitored modifications to the 

U.S. fleet and staged teams of inspectors at modification locations. Further, as the certifying 

authority, FAA continues to provide support to other authorities around the world as they finalize 

their own acceptance procedures. 

Lessons Learned from the 787 Certification Process 

The FAA has a standard review of the process of every design we certify. Short tenu, we often 

find administrative and procedural issues that are immediately evident and can be implemented 

for the next certification. For example, with respect to the 787, while the "multi-tiered supplier" 

dynamic is not new to industry, the FAA has determined that we need to spend more lime 

overseeing communication and ensuring a clear line of accountability of all required changes 

down the supplier chain. We also look t'Or ways to improve the integrity of the process with the 

addition of independent review of the work done. 

While understanding the lessons learned as the result of a technical failure can take time becanse 

the root cause is not readily evident, thc FAA has demonstrated its ability to develop mitigations 

which ensure the safety of passengers and crew. In cases such as the flammability of the center 

fuel tank or the 737 rudder malfunctions, mitigations had to be developed that we were confident 

protected the passengers and crew without knowing the exact root cause of the particnlar 

problem. For example, it was not possible to know what caused the spark that caused the 

explosion in the center fuel tank and brought down TWA Flight 800. The safest path to 

9 
36 


Insert offset folio 17 here 81427.017

mitigation was 10 find a way to inert the center fuel tank, so that, regardless of what caused the 

spark, no harm could result. With respect to the 737 rudder system, which was the cause of two 

fatal accidents in the 1990s, operational, procedural, training and design changes were 

implemented to protect flights from potential malfunctions, 

Technical Expertise 

Finally, I would like to address the concern expressed by some that FAA's use of aviation 

experts who do not work for the FAA suggests that we do not have the requisite expertise to 

resolve technical problems as they arise, Such concerns are unfounded, The aviation industry is 

filled with intelligent, innovative people, Certification of aviation products and systems is not 

limited to the participation of a single certifying entity and a single manufacturer. It is a 

worldwide industry and any new airplane design contains parts and products made by hundreds 

of companies in dozens of countries, Certification of an airplane, in the United States or abroad, 

requires the eftorts of the best and brightest minds, FAA seeks the participation of industry 

experts who can add a level of safety or knowledge that can improve the process or the product. 

Likewise, when, as an industry, we face a problem, bringing together the best and the brightest 

minds to work on solving the problem and making industry-wide safety improvements, should be 

considered a best practice, Limiting the use of technical experts because of who they work for is 

the equivalent of imposing limitations on problem solving, That is not a limitation that FAA 

would ever support. 

Mr. Chairman, I hope this hearing helps the Committee understand the complexity of the 

certification proccss and the commitment of industry and FAA to support both the certification 

of new and innovative technologies and work to resolve problems as they arise, I am proud of 

10 
37 


Insert offset folio 18 here 81427.018

the safety record we have achieved together. I am confident we have the best people in place to 

meet the challenges ahead. 

This concludes my prepared statement. I will be happy to answer your questions at this time. 

11 
38 


Insert offset folio 19 here 81427.019

ili!l1~I}U.I ... 

<lll1ulnnan 

Cfutmmititt ou alrnusportnthm nUll Jlufrnstrurtutt 

lit.§>. )inuSt of Ittpttsl!utntiutll 

lIIiall/fingtnll. 1lI(!j; ;!n515 

June 25, 2013 

Ms. Margaret Gilligan 

Associate Administrator for Aviation Safety 

Federal Aviation Administration 

800 Independence Avenue S.W. 

Washington, D.C. 20591 

Dear Ms. Gilligan: 

Nith ill. lRal)all. 3111 

lRanklng m,mber 

I thank you for your testimony before the Subcommittee on Aviation on June 12, 2013, 

regarding Lessons Learned from the Boeing 787 Incidents. I would appreciate your written 

response to the following questions for the hearing record. 

I) Would you please briefly explain Organization Designation Authorization (ODA)? 

What types of certification activities are delegated to companies like Boeing? 

2) What are some of the requirements for a company to be granted ODA? 

3) Would you please explain how the Federal Aviation Administration (FAA) conducts 

oversight of companies that are granted ODA? 

4) In April, the FAA testified before that National Transportation Safety Board that during 

the development of certification plans and compliance activity, the FAA determines its 

level of involvement through risk-based methods. Would you please explain the factors 

that make up the FAA's risk-based analysis? 

5) I have heard from some of my constituents about their difficulties in securing ODA 

designation to allow them to conduct their own Supplemental Type Certifications. What 

is FAA doing to implement recommendations from the report on aircraft certification 

required by Section 312 of the FAA Modernization and Reform Act of20127 
39 


Insert offset folio 20 here 81427.020

Ms. Margaret Gilligan 

June 25. 20J3 

Page 2 

6) Does the 787 incident have any effect on FAA's progress in implementing efficiency 

gains in certification that Section 312 was designed to address? 

7) How many full-time employees (PTEs) does FAA have working on certification issues? 

Of these employees, what is the breakdown of those working to certify new technologies? 

I would appreciate your written responses no later than July 9, 2013. Thank you again for 

your testimony. 

Sincerely, 

~ ~Ie ::> 

RICK LARSEN 

Ranking Democratic Member 

Subcommittee on Aviation 

Committee on Transportation and Infrastructure 
40 


Insert offset folio 21 here 81427.021

Larsen QFRs 

787 Lessons Learned Hearing 

1. Would you please briefly explain Organizational Designation 

Anthorization (ODA)? What types of certification activities are 

delegated to companies like Boeing? 

ANSWER: 

Organization Designation Authorization (ODA) is an FAA issued anthorization 

for qualified individuals (two or more) within organizations involved in aircraft 

manufacturing, modification or repair or in an airline involved in aircraft repair or 

modification activities. The authorization allows the organization to do routine 

functions on behalf of the Administrator, and thereby allow FAA resources to 

focus on more critical safety matters. Boeing Commercial Airplanes holds an 

ODA authorization associated with engineering and production activities for 

current aircraft models (e.g. Boeing 777) and previously produced aircraft models 

(e.g. older Boeing 737 models). 

To become a delegated organization, the organization must demonstrate specific 

regulatory knowledge, industry experience and integrity. All FAA aircraft 

certification approvals are conducted in accordance with established regulations 

(14 CFR Part 21) and guidance. These standards do not allow a delegated 

organization to deviate from what is required for regulatory compliance. 

Additionally, delegated organi7..ations maintain regular communication with the 

FAA staff and perform that work nnder FAA oversight. 

As part of our certification processes, the FAA detemlines our level of 

involvement based on a number of risk-based factors, including the safety 

criticality of the design, the clarity of the requirements and guidance, and the 

experience/competency level of the applicant and their delegation system. 

Typical functions for an ODA, including Boeing include the following: 

a. Approve technical data that demonstrates compliance to airworthiness 

standards 

b. Conduct inspections or witness tests to demonstrate compliance with 

airworthiness standards 

c. Inspect (conform) parts and articles to confirm they match the design 

d. Issue airworthiness certificates or approvals for delivery of new aircraft to US 

and international operators 

e. Approve operational or repair infonnation for in-service 
41 


Insert offset folio 22 here 81427.022

Larsen QFRs 

787 Lessons Learned Hearing 

2. What are some of the requirements for a company to be granted 

ODA? 

ANSWER: 

The organization must have experience performing certification work and 

demonstrated its capability to successfully conduct any functions authorized 

Imder the ODA. This includes a thorough working knowledge of the regulations 

and FAA policies related to the functions authorized. Also, it must have a staff of 

individuals in its organization who meet the qualification requirements needed to 

perform any function, and it must institute an organizational model which ensures 

that the ODA staff is able to perform its functions without any influence from 

other parts of the organization. 

The organization must develop and implement an FAA-approved procedures 

manual describing how it will perform any authorized functions and administer 

the ODA, including; internal training requirements, self-audit requirements, and 

selection and approval processes for the ODA staff. 
42 


Insert offset folio 23 here 81427.023

LarsenQFRs 

787 Lessons Learned Hearing 

3. Would you please explain how the Federal Aviation 

Administration (FAA) conducts oversight of companies that are 

granted ODA? 

ANSWER: 

The FAA has an established oversight program that requires ongoing supervision 

that meets minimum annual requirements, as well as formal inspections of the 

ODA holder every 2 years. This oversight is conducted by an organization 

management tcarn (OMT) consisting ofF AA personnel skilled in all the functions 

delegated by the authorization. All OMT members are required to assess the 

performance of the ODA holder in the member's technical area. 

Oversight focuses on ODA system aspects; monitoring compliance with the 

approved procedures manual and the adequacy of those procedures. 

Oversight includes review of all FAA functions performed by the organization. 

This can be done by the witnessing of particular functions, participation during 

certification activities, and the post-review of records and data. 
43 


Insert offset folio 24 here 81427.024

Larsen QFRs 

787 Lessons Learned Hearing 

4. In April, the FAA testified before the National Transportation Safety 

Board (NTSB) that during the development of certification plans and 

compliance activity, the FAA determines its level of involvement 

through risk-based methods. Would you please explain the factors 

that make up the FAA's risk- based analysis? 

ANSWER: 

The FAA Aircraft Certification Service uses risk based methodologies to assign risk 

levels to Production Approval Holders that manufacture aviation products and 

articles. These risk levels establish the FAA's frequency and level of oversight. 

The FAA's Aircraft Certification Service uses a Risk Based Resource Targeting 

(RBRT) model to assign risk. RBRT uses input factors (known as indicators) to 

identify and categorize the risk associated with oversight of individual production 

approval holders. The organizational indicators include: Quality System, 

Supplier/Outsourcing, Organizational Stability, Relationship with the FAA, and 

Compliance History. The Technical indicators include: Complexity, Service 

Experience, Applicant/Production Approval Holder Experience, and New/Emerging 

Technology. In addition, the criticality of the product or article to be manufactnred is 

factored into the risk determination. There are a total of thirty-four specific factors 

within the organizational and technical indicators that are used at least once a year to 

assess the risk of FAA production approval holders. Upon determining the level of 

risk for each production approval holder, the FAA then determines the amount of 

oversight required. 
44 


Insert offset folio 25 here 81427.025

Larsen QFRs 

787 Lessons Learned Hearing 

5. I have heard from some of my constituents about their difficulties 

in securing ODA designation to allow them to conduct their own 

Supplemental Type Certifications. What is FAA doing to 

implement recommendations from the report on aircraft 

certification required by Section 312 of the FAA Modernization 

and Reform Act of 2012? 

ANSWER: 

As required by Section 312 of the FAA reauthori7.ation, the FAA fonnulated an 

aviation rulemaking committee (ARC) with industry stakeholders to review and, 

where applicable, modernize or refonn our certification processes. Our Report to 

Congress on that ARC was delivered on Aug 13, 2012. 

The ARC made a number of recommendations, several of which are already being 

implemented in the FAA Aircraft Certification Service. We have an 

implementation plan addressing all of the recommendations. 

One of the six recommendations from the ARC involved more effective use of 

delegation. In support of this we are identifying ways to expand delegation 

provisions and also identifYing changes to enhance the benefit of Organization 

Delegation Authorization (ODA) appointments for the FAA and industry. These 

activities are underway and will continue into 2014. 

In addition to the broader work associated with the Section 312 reauthorization, 

including the delegation system changes noted above, the FAA is also planning to 

prototype alternative ways to access the benefit of ODA appointment in smaller 

companies, such as the situation noted in your inquiry. This activity involves 

ensuring FAA oversight practices are commensurate v\lith the lower overall risks 

associated with the routine certification work these smaller organizations wish to 

do. If this concept proves to be feasible, a path for ODA appointment of smaller 

companies may be mutually beneticial to FAA and industry. These activities are 

underway now and will continue through 2014. Results from this prototype 

activity, along with the work being conducted by the Part 21 ARC, may he a basis 

for adjustments to national ODA policy. 
45 


Insert offset folio 26 here 81427.026

Larsen QFRs 

787 Lessons Learned Hearing 

6. Does the 787 incident have any effect on FAA's progress in 

implementing efficiency gains in certification that section 312 was 

designed to address? 

ANSWER: 

The FAA takes all incidents seriously. We systematically review all safety 

incidents and we look for systemic or specific causes. Once the causes are 

identified, corrective actions are taken to make improvements where necessary. 

The 787 incident will be treated in this same manner and lessons learned will 

guide appropriate changes and improvements to our certification processes and 

oversight activities. 

Section 312 also provides an opportunity for the Agency to implement changes, 

including activities related to how we measure the effectiveness (benefits) of 

certification process improvements and how they are sustained over longer 

periods oftime. Currently, these two efforts do not specifically overlap and there 

is no specific effect on our Section 312 implementation plan stemming from the 

787 events. The FAA is now implementing changes addressing recommendations 

from the Section 312 Aviation Rulemaking Committee and if findings from the 

787 incident were to affect any specific goal of the Section 312 implementation 

plan, the plan will be updated to show that change 
46 


Insert offset folio 27 here 81427.027

LarsenQFRs 

787 Lessons I"earned Hearing 

7. How many full-time employees (FTEs) does FAA have working on 

certification issues? Of these employees, what is the breakdown of 

those working to certify new technologies? 

ANSWER: 

The Aircraft Certification Service (AIR) currently has an onboard staffing level of 

1253 (out of the 1319 authorized). This includes 659 aerospace engineers, 248 

aviation safety inspectors, and 29 flight test pilots that are in direct support 

certification activities. In FY13, we estimate that AIR spent approximately 

408,000 hours on certification activities which converts to about 260 full-time 

equivalent (FTE) positions. AIR generally spends about 20% of its time in direct 

support of certification activities which includes type, production, and 

airworthiness certHication. AIR's technical employees are not assigned to only 

work certification issues. Activities in support of continued operational safety 

will normally take priority and their work is typically shifted from certification to 

continued operational safety when we are experiencing budget and staffing 

shortfalls, as we have in FYI3. With a more stable budget and staffing resonrces, 

the time dedicated to certification-related projects would increase. 

AIR does not specifically track certification work on new technologies. 

Certification work is tracked by the type of approval being sought by the 

applicants, not the content of the design. However, in addition to those 

employees working certification projects, AIR employs 21 (5 are vacant) Chief 

Scientific and Technical Advisors (CSTA). Although the CSTA's do not certify 

new technology, they are at the forefront of scientific and technological activities 

related to FAA research and development efforts. CST As are charged to 1) 

influence the research agendas of U.S. and foreign aviation industries, military, 

academia, and other research institutions, and 2) interact with and assist other 

U.S. Government agencies and foreign civil aviation authorities in technologyrelated issues. In addition, AIR employs II Facilities & Equipment positions that 

are dedicated to work associated with the implementation ofNextGen technology. 
47 


Insert offset folio 28 here 81427.028

Statement of Mike Sinnett 

Vice President and Chief Project Engineer for the 787 Program, The Boeing Company 

Before the House Transportation and Infrastructure Committee, Subcommittee on Aviation 

June 12, 2013 

Chairman LoBiondo, Ranking Member Larsen, members of the Subcommittee, my name is Mike Sinnett, 

and I am the vice president and chief project engineer for the Boeing 787 program. 

It is my pleasure to appear !:lefore you today to support your continuing efforts to improve U.S. aviation. 

I know that you take that responsibility seriously, and I want you to know that Boeing is committed to 

supporting your work in any way that we can. 

Mr. Chairman, Boeing's highest priority is the safety of the passengers and crews who fly on our 

airplanes. Every Boeing employee is committed to safety. It is part of our DNA as a company, and it is 

that unwavering commitment that has helped to make air travel the safest form of transportation. Last 

year, as many of you may know, was the safest year for commercial jet travel in history. 

Boeing has !:leen in the airplane business for nearly 100 years, and we have been designing, 

manufacturing and servicing commercial jets for more than 50 years. We have delivered more than half 

of the commercial jets in service around the world today, and with every new airplane we create, we 

build on the knowledge we have gained from that broad, deep, and ever-increasing experience. 

The approach we take to every new airplane design employs methodologies that have served us well 

throughout our history as we have worked to ensure the highest level of airplane safety. It is a datadriven approach in which risk is carefully assessed and managed. Our designs feature multiple layers of 

protection, and redundancy of critical systems, so that no single component failure, or even an 

extremely remote combination of failures, can endanger an airplane. 

The FAA has certified all of our airplane designs, indicating that they satisfy the agency's extensive safety 

requirements. It also has certified all of our production lines, indicating that we have established and 

shown that we can maintain a quality control system to ensure that each aircraft produced conforms to 

the approved design. And each aircraft that comes off of our assembly lines receives an airworthiness 

certificate indicating that it has been thoroughly checked out both on the ground and in flight and is 

ready for safe operation in commercial service. 

These certification processes are robust and recognized globally as the gold standard for airplane 

certification. They also have been continuously improved over the past 50 years. With each new 

airplane deSign, the certification process has become more rigorous. 

Importantly, this strong focus on safety by both industry and government continues long after our 

airplanes move through our factory doors -literally for as long as the airplanes remain in service. We 

continuously monitor the performance of our airplanes, carefully analyze the data we coilect, share 
48 


Insert offset folio 29 here 81427.029

safety-related findings with customers and regulatory authorities, and work with all relevant parties to 

Incorporate lessons learned into the active fleet and into new production aircraft and future designs. 

Boeing learned a great deal from the two highly-publicized events in January of this year involving 787 

lithium-ion batteries. These were significant events, which we took very seriously. We devoted more 

than 200,000 engineering hours to understanding the two events, to developing a comprehensive set of 

solutions that I will describe in a moment, and to working with the FAA to test and certify those 

improvements. We also fully supported, and will continue to fully support, the ongoing investigations 

into the two incidents that the National Transportation Safety Board and the Japan Transport Safety 

Board are leading. 

Mr. Chairman, flying is as safe as it is because airplane manufacturers, regulators, airlines, airports, air 

traffic service providers, investigators and suppliers work together on safety and have done so for 

decades. We all share a firm commitment to safety, and we work with each other literally day in and day 

out. That is why we have been able to achieve such an impressive record - and why we are able to 

continuously improve upon that record. 

The 787 and Boeing's Response to Battery Incidents 

The 787 illustrates that deep commitment. The design process started, as it does with all of our new 

airplane programs, with a comprehensive review of everything the industry and its regulators have 

learned about designing, building and operating safe airplanes. For example, as part of the 787 design 

review we evaluated every safety issue on the 777 airplane to ensure that our 787 design addressed all 

of those issues. I have worked on the 787 program from its start, and I can personally attest to the 

team's strong focus on safety throughout the design, build, and test phases of the program. I also can 

attest to the strength of the certification process, which was more rigorous for the 787 than it was for 

any of our previous airplane programs, several of which I have worked on, including the 777. 

The result of all that hard work is an exceptional, safe and reliable airplane - the first commercial jet of 

the 21" Century, with a very strong, low-maintenance composite structure, 20% better fuel efficiency 

than the models it replaces, a lower cabin altitude and bigger windows, to name just a few of its many 

innovative features. Over its initial 15 months of service, with eight airlines operating a total of SO 

airplanes, the 787 also achieved a schedule reliability rate of 98.2%. That is better than the 777 over its 

first 15 months of service, which until the 787 came along was widely recognized as the best in its class. 

But as this Committee is aware, at the end of that 15 month period we experienced two 787 battery 

failures. On January 7, a Japan Airlines 787-8 experienced an auxiliary power unit battery failure while 

parked at Boston's Logan International Airport. No passengers or crew members were aboard the 

airplane, and none of the maintenance or cleaning personnel aboard the airplane were injured. Roughly 

one week later, an All Nippon Airways 787-8 experienced a battery failure during flight from YamaguchiUbe Airport to Tokyo. The crew diverted the airplane and performed a safe landing at Takamatsu 
49 


Insert offset folio 30 here 81427.030

airport. In response to these incidents, the FAA and other regulatory agencies issued directives 

suspending 787 operations that remained in effect for more than three months. 

As mentioned a moment ago, Boeing has worked diligently with the governmental bodies charged with 

investigating those incidents - the NTSB and lTSB - as well as the FAA and other civil aviation authorities 

responsible for ensuring the safety of the 787's lithium-ion batteries. Boeing worked around the clock, 

dedicating hundreds of its best engineers and consulting with experts in lithium-ion battery technology 

from across industry and government. We appreciate the efforts of the government agencies that 

participated in that process, as well as those from our supplier-partners and other industries who 

supported our efforts to find a solution. We also are deeply grateful to our airline customers, who stood 

by us and remained confident in the promise of the 787 during a challenging period of significant service 

disruption. 

As we explained in our public testimony at the NTSB's recent hearing, the incidents - while serlousdemonstrated the effectiveness of the design philosophy that I spoke about earlier. The airplane's 

redundant safety features prevented the battery failures from putting the airplane, its passengers, and 

crew in jeopardy. With that said, the work done in the wake of the two incidents revealed ways that we 

could improve the batteries, and on March 12 we received FAA approval of a certification plan for a 

proposed comprehensive and multi-layered set of battery system improvements. 

Our solution employed three layers of protection. First, we made design changes and manufacturing 

process enhancements that reduce the likelihood of a battery failure in the first place. Second, we 

proposed additional changes within the battery to reduce the probability that a cell failure will 

propagate from cell to cell. And third, we designed a new steel enclosure that isolates the battery from 

the rest of the electronic equipment bay and which, in the unlikely event of a failure, will vent all battery 

vapors outside the airplane. Importantly, the enclosure's deSign minimizes the amount of oxygen inside 

the box, thus eliminating the possibility of a fire. 

Taken in combination, these improvements to the 787's battery system significantly reduce the 

likelihood of a battery failure and further ensure that should a failure occur there will be no significant 

impact on the airplane. After a series of rigorous certification tests, the FAA and other regulatory 

agencies gave 787 operators approval to resume commercial flights. We have high confidence in our 

solution, which enhances what was already a very safe airplane. But as mentioned earlier, we will 

continue to fully support the ongoing NTSB and JTSB investigations, and we will take into account any 

future findings those investigations may reach. 

The FAA was deeply involved in the process that culminated in the certification of our battery solution. 

After the first incident, the FAA and Boeing began evaluating all of the known facts and data through the 

Continued Operational Safety Program, or COSP, a disciplined process established in 1999 to assess inservice incidents. Using COSP, we determine whether an incident demonstrates a significant safety 

issue, and if so, we determine what immediate mitigating actions might be needed (if any) until a longer 

term, more permanent solution is found. 
50 


Insert offset folio 31 here 81427.031

After the second battery incident, the FAA and Boeing again evaluated the situation using the COSP 

process. And following the FAA Administrator's subsequent decision to suspend 787 operations, experts 

from the agency closely monitored the design work and the tests we conducted to validate the 

proposed improvements to the battery, and of course supervised the rigorous process that certified the 

new design. 

I will share more thoughts about certification in a minute because I know that is a subject of great 

interest to this Committee. But first I want to give you an update on the status of the 787 fleet. I am very 

happy to report that the 787 modifications certified by the FAA have been completed on all ofthe 50 

airplanes that had been delivered prior to the suspension of operations, and as of June 4th all 50 were 

back in revenue service. In addition, Boeing has been delivering new 787s from its factories with the 

approved modifications since May 14. A great airplane has returned to the sky, and I am confident it will 

serve our airline customers and the traveling public extremely well for decades to come. 

The High Standards for Airplane Certification and Delegated Authoritv 

That confidence is rooted not only in my own experience on the 787 program, and with the Boeing team 

and outside experts from industry and government who worked on the battery solution, but also in the 

certification process that, like our airplane designs, has continuously improved through the years. It is a 

process wherein the FAA defines the requirements that a new airplane must meet, and the 

manufacturer demonstrates through FAA-approved analyses and tests that the designs, and the 

airplanes built to those designs, meet all FAA requirements. 

A key component of every airplane certification is the FAA's process for the delegation of authority. 

Delegated authority furthers the top priority of industry and government that I mentioned at the 

beginning of my remarks - safety. The ability to delegate authority for more routine certification tasks to 

qualified individuals enables FAA speCialists to focus on the highest-priority issues. As the certification 

process has grown more robust, delegation also enables Boeing and the FAA to complete the 

certification process more efficiently and robustly. 

Delegation is nothing new. As a practice, it dates back to the late 1920s. And when Congress created the 

current FAA in 1958, it correctly surmised that if FAA officials were to analyze and review compliance 

with every single certification requirement, it would require thousands of new engineers and inspectors, 

additional facilities, and likely hundreds of millions of dollars in new annual funding. Congress 

recognized the fiscal and practical necessity of using private sector expertise to keep pace with the 

growing aviation industry, and wisely gave the FAA authority to delegate certain certification activities 

to qualified persons - in effect enabling the agency to leverage its own resources by tapping into the 

considerable expertise of the private sector. 

For reasons of both effectiveness and efficiency, delegated authority has transltioned from individual 

designations to organizational designations. Organizations that demonstrate and maintain strict 
51 


Insert offset folio 32 here 81427.032

accountability to certification requirements and processes may receive what is called Organization 

Designation Authorization, or ODA. As the name implies, ODA status allows an organization to perform 

certain certification tasks on behalf of the FAA. It is a privilege that is hard to obtain and that carries with 

it serious responsibilities. Notably, the FAA remains in control of the certification process. It retains 

authority for approval and oversight of all ODA procedures, determines which portions of any given 

certification project are delegated, and retains ultimate and sole authority to issue airplane type 

certificates. 

ODA holders are governed by stringent FAA requirements that include having an FAA-approved process 

for selecting and training individuals to perform the delegated tasks. In accordance with FAA 

procedures, the agency is notified when an individual is selected for ODA membership, and it is given an 

opportunity to participate in the evaluation of candidates and provide feedback. The FAA also retains 

the right to direct the removal of an underperforming member. 

I can tell you from personal experience that the members of the Boeing ODA are held to a very high 

standard. They are well qualified, well trained, and take their responsibilities as representatives of the 

FAA Administrator very seriously. These professionals focus intensely on one goal- to ensure full 

compliance with all FAA requirements. And they are, by design, and with the full support of the 

company, protected from pressures to cut corners or otherwise act in a manner inconsistent with FAA 

procedures and standards. Boeing has established communication channels that enable them to report 

undue pressure directly to senior management, as well as the FAA, which conducts oversight and formal 

audits. Members of the Boeing ODA also regularly check on each other through a system of peer 

reviews. 

The Robust Nature of the 787 Certification Process 

The certification process for the 787 was the most rigorous and comprehensive certification process In 

Boeing's history. Boeing applied for certification in March of 2003. It was an eight-year process, 

involving thousands of safety demonstrations, from design review to component testing to system and 

structural testing and finally to flight testing. The compliance checklist alone for the 787-8 was 3,342 

pages long. The thousands of topics on that fist included such items as takeoff speeds, performance with 

one engine inoperative, stall characteristics, emergency lighting, material strength properties, bird 

strikes, warning lights, oxygen equipment, even the shape of the knobs on cockpit controls. 

It is hard to overstate the comprehensive nature and rigor of the 787 certification process, which 

involved three times more conformed tests than the 777 certification program, three times more data 

submittals showing compliance, twice as many airplane ground tests, and three times more integration 

testing. 

Beginning with the design phase, every element of the 787 was examined and evaluated to determine 

how it performed, both separately and in conjunction with other parts and systems. It was a top to 
52 


Insert offset folio 33 here 81427.033

bottom evaluation, spanning everything from the raw materials used to make airplane parts to the 

overall performance of the airplane in flight. 

The 787's integrated electrical power system, which includes the batteries, underwent more than 5,000 

hours of component-level testing, followed by more than 25,000 hours of laboratory testing to 

demonstrate the battery's interaction with various system elements during normal operations as well as 

during simulated, abnormal failure conditions. At the airplane level, the integrated electrical system 

underwent more than 10,000 hours of testing under normal operating conditions and under simulated, 

abnormal conditions, including extreme weather, long and short flight durations, and low and high 

elevations. 

Two full-scale replicas of the 787 were created for static and fatigue testing of the airplane's structure. 

The wings and fuselage of one of the replicas were manipulated during static testing to simulate 

conditions far beyond what any airplane would ever experience in service. The second replica is 

undergoing fatigue testing that simulates the structural stress on the plane. That testing eventually will 

simulate a total of at least 132,000 flights. 

The first flight of the 787 occurred on December 15, 2009, and in April of 2010 the 787 began the FAA's 

extensive flight test program. Engineers demonstrated compliance with over 25,000 test conditions as 

part of the flight test program. 

The testing included multiple environments and scenarios. Take-offs and landings in extreme crosswinds were tested in Iceland. Cold weather starting was tested at minus 45 degrees Fahrenheit. Takeoffs and operations with a single engine and simulated generator failures were demonstrated, along 

with a multitude of other simulated system failures. High altitude take-offs were tested in La Paz, Bolivia 

at an elevation of 13,000 feet. Take-offs and operations with the airplane overweight were tested, as 

were aborted take-ofts and tail-strike take-offs. 

To obtain certification and to test the airplane's capabilities, multiple 787s logged over 1,700 flights 

during testing, flying for over 5,000 hours, Including endurance flights. They performed ultra-Iongdistance flight tests, including an indirect route from Guam to Everett, Washington, that lasted 18 hours. 

The pilots simulated system and engine failures to demonstrate that the airplane could still safely reach 

a distant airport. The 787 also set new records for both speed and distance in its weight class by flying 

from Seattle to Bangladesh-10,337 nautical miles, and around the world in under 42.5 hours. 

The FAA oversight was extensive during the flight test program and it observed and reviewed the tests 

using two methods. An FAA official was aboard for approximately 25 percent of the flight test hours. The 

tests conducted during the remaining hours were observed by Boeing personnel qualified and trained to 

act as FAA delegates during the certification process. 

One reason delegated authority and the overall certification process have worked so well is that both 

have evolved and improved in response to changing technologies and conditions in the industry. This 
53 


Insert offset folio 34 here 81427.034

evolution must continue. Boeing is grateful that this Committee recognized that fact in the FAA 

Modernization Act of 2012, which in sections 312 and 313 directed the agency to further improve its 

certification and regulatory processes. In response, a number of good recommendations have emerged 

via the Aviation Rulemaking Committee process, but they have not been fully adopted. On behalf of 

Boeing and others in the aerospace industry, I encourage the Committee to continue working with the 

FAA to ensure timely implementation of these important recommendations. The Committee has 

provided a great opportunity through the reauthorization bill to achieve progress in this area, and our 

nation's aviation industry will be strengthened by your oversight of these provisions. 

Boeing's Commitment to Continued Safe Operations 

In closing I would like to return briefly to a subject I mentioned earlier in my testimony because it is such 

an important part of the aviation safety story. Certification is not the end of Boeing's - or the FAA'sinvolvement in ensuring the safety of the airplanes delivered to our customers. I mentioned that we 

track the performance of every airplane we build for as long as it is in service. We collect and analyze 

enormous amounts of operational data, and we are not alone in that regard. Airlines, manufacturers, 

and government regulators around the world collect, share and analyze the performance of the inservice fleet, and when we spot a safety issue, or see a troublesome trend, we work together to address 

the issue or trend so that safety of flight is maintained. 

At Boeing, we established a formal, FAA-approved process 20 years ago to monitor the in-service fleet, 

identify emerging issues, make disciplined, data-driven safety decisions, and take corrective action 

where and when needed in coordination with our customers and the regulatory agencies. We called it 

the Boeing In-Service Safety Process, and in 1999 it evolved into the Continued Operational Safety 

Program that I mentioned earlier. 

Also in the 19905 we began regular, periodic reviews of safety initiatives at other aerospace companies, 

at companies in other industries, and at government agencies, both here in the United States and 

abroad. We regularly share best practices and key findings so that we can continue to advance the 

safety of flight. 

Collaborative action is essential to safe flight because, while we strive to design and build perfect 

airplanes and to anticipate all potential problems, the unexpected sometimes happens and we learn 

something new. It is vitally important, therefore, that we have the people and processes in place to 

ensure that the learning never stops, that we continue to advance our knowledge of airplanes and the 

conditions in which they operate, and that we incorporate those valuable lessons learned into the active 

fleet and future designs so that safety issues and problems do not become fatal accidents. 

Our recent experience with 787 battery failures was both a surprise and a disappointment, but it also 

was a testament to why Boeing and the industry as a whole have achieved a superb safety record. Two 

batteries on separate airplanes failed. But since the safe management of potential component-level 

failures is central to our design philosophy, no one was hurt, and the damage to the airplane in both 
54 

Æ 


Insert offset folio 35 here 81427.035

cases was limited to the batteries and areas immediately around them. From that standpoint, what 

happened in Boston and Japan in January demonstrated a central tenet of our design philosophy. 

Furthermore, what happened in the wake of those two incidents demonstrated our strong commitment 

to safety and the collaborative approach we take to ensuring safe flight. The unexpected occurred, 

talent was quickly brought to bear from both industry and government, a solution was found, tested and 

certified, modifications were implemented, and 787s are now flying again. 

The strong commitment to safety and the collaboration we find across the aviation world, coupled with 

our in-service monitoring and data-driven, risk management approach to designing new airplanes, are 

key reasons that flying is the world's safest way to travel. You no doubt have heard these statistics, but 

they are worth repeating here. It is 70 times safer to fly in a commercial jet than it is to drive a car. More 

people die every year by accidental drowning than have died over the past 30 years of commercial 

flying. In the decade from 1998 to 2008 the fatal accident rate for U.S. commercial airline operations 

dropped by more than 80 percent, and in several years recently there have been zero deaths from 

airline accidents here in the United States. 

None of this is happenstance. 

Mr. Chairman, that ends my formal remarks. I thank you for this opportunity to testify before the 

Committee, and I will be happy to answer any questions ..