Aviation Safety: Status of FAA's Actions to Oversee the Safety of Composite Airplanes
Released: 2011-10-20T00:00:00

Letter

Background

Airplane manufacturers have been using composite materials in general aviation and military applications for decades. Prior to the mid-1980s, airplane manufacturers used composite materials in transport category airplanes in secondary structures (e.g., wing edges) and control surfaces (e.g., panels). In 1988, Airbus introduced the A320, the first airplane in production with an all-composite tail section—including the horizontal and vertical stabilizers and rudder—and, in 1995, the Boeing Company introduced the Boeing 777, also with a composite tail section. (See fig. 1.) More recently, manufacturers have extended the use of composites to airframe structures, such as the fuselage and wings. For example, in 2007, Airbus introduced the A380, which used composite materials in the wings and upper fuselage. Airplane manufacturers have increased their use of composites for a number of reasons. First, composite materials tend to have a higher strength-to-weight ratio than metals, allowing airplanes to be lighter. And because these airplanes are lighter, they offer fuel savings, which are a high priority for air carriers. In addition, the material properties of composites make them more resistant to fatigue and corrosion than metal, which leads to lower maintenance costs.

The increase in composite materials has been facilitated by private and federally funded advanced materials research. Although airplane manufacturers conduct the bulk of the aerospace research on composite materials as part of their product development activities, over the years, federal research has contributed to the state of knowledge about composite properties, and federal research centers have studied basic and advanced properties of composite materials as well as their applications. For example, the Department of Defense’s Air Force Research Laboratory has made significant contributions in materials research in developing composite aircraft such as the B-2 bomber and the F-22 fighter. The National Aeronautics and Space Administration (NASA) has conducted both fundamental research and applied composite research since the 1970s and 1980s, when it explored the basic properties of advanced composite materials and in-flight service and environmental exposure of composite components. More recently, NASA began funding research on the aging and durability of aircraft advanced structural materials including composites. FAA funds aviation safety research programs to support its certification and regulatory activities, encompassing a range of topics such as fire safety, crashworthiness, and aging airplanes. For example, it has used its fire test facilities to conduct tests of composite airplane sections to determine whether the fires will emit toxic gas that exceeds safety levels. Since 2003, FAA has collaborated with selected universities in support of its advanced materials research program. The goal of the project is to provide research and training in support of expanding composite applications, which the universities facilitate by partnering with local aviation manufacturers and suppliers.

Boeing’s 787 will be the first mostly composite large transport airplane in commercial service. The 787 is about 50 percent composite by weight (excluding the engines). (See fig. 2.) The 787 is the first large commercial transport category airplane to use composite materials for much of its fuselage and wings. As airplane manufacturers are required to do for all new airplane designs, Boeing applied to aviation regulators in the jurisdictions where the airplane will be registered to certify the airplane design. According to Boeing, the fuselage and wing structures require more extensive certification work than other structures of the airplane.

Boeing applied to FAA for certification of the Boeing 787 in March 2003 and began the certification flight test program in April 2010. Although its certification application originally called for delivering the first airplanes for service in 2008, Boeing requested that FAA extend its certification application four times because of delays caused by development processes and production challenges. As of September 2011, Boeing had about 800 orders for the 787 and plans to deliver the first 787 to Japan’s All Nippon Airways in the third quarter of 2011. In August 2011, Boeing completed all required flight testing and received type certification from FAA. The significance of type certification is explained later in this section. Boeing also is developing a derivative version of the 787-8 model—the 787-9 is a stretch version that will have more seating capacity than the original version.

Ensuring the safety of the nation’s aviation system is the shared responsibility of FAA and the aviation industry. FAA is responsible for, among other things, setting certification standards and certifying that the airplane manufacturers and parts suppliers meet FAA standards, conducting periodic inspections of manufacturing facilities to ensure continued compliance with regulations, and overseeing airplane repair facilities to ensure they follow the proper maintenance and training procedures. Airplane manufacturers are responsible for showing compliance with those regulations and building safe airplanes. Manufacturers help ensure their airplanes remain airworthy throughout their designed service life by developing airplane maintenance programs and repair manuals and providing requested on-site technical assistance. Airplane operators are responsible for maintaining and operating airplanes safely and helping maintain the airworthiness of their airplane fleets by tracking their airplanes’ service history and reporting relevant repair and accident data to FAA and the manufacturers.

A domestic airplane manufacturer must seek and FAA must issue a type certificate before a new airplane design is introduced into service. A type certificate signifies that airplanes manufactured to conform to the basic airplane and systems design will meet FAA’s airworthiness, noise, and emission standards for the safe conduct of flights. The standards form the basis for certification, modified as appropriate in accordance with special conditions, exemptions, and equivalent level of safety findings. Airplanes produced under a type-certified design are issued a standard airworthiness certificate. During the certification process, FAA engineers, designees, and test pilots review detailed plans, drawings, compliance plans, test reports, and analyses provided by the manufacturer to demonstrate the airplane’s compliance with FAA’s safety standards. (See fig. 3.) For example, the certification plan for the 787-8 contains 13 individual plans relating to structural components of the airplane, with a total of 904 deliverables from Boeing for FAA approval. During the certification process, the manufacturer must also produce a prototype (or prototypes) of the new airplane and conduct both ground and flight tests.

FAA approves newly manufactured airplanes for service by issuing an airworthiness certificate. Typically, airplanes with a type-certified design are produced under an FAA production certificate and FAA will issue a standard airworthiness certificate for each airplane manufactured. Alternatively, airplanes manufactured without a production certificate will be issued an airworthiness certificate on a case-by-case basis through inspection of each airplane to ensure that it conforms to its type design and is in condition for safe flight.

As part of the type certification process, FAA evaluates the airplane’s design for novel features and the applicability of airworthiness standards to ensure that the novel airplane features comply with applicable performance standards or safety levels. When it finds technical issues that need further investigation, FAA creates an issue paper to document issues and communications with the airplane manufacturer. In some cases, FAA may exempt the manufacturer from an airworthiness standard when the manufacturer petitions FAA for an exemption and indicates the exemption is in the public interest and will not adversely affect safety. In other cases, FAA may approve an equivalent level of safety finding. A manufacturer requests an equivalent level of safety finding from FAA when the manufacturer determines that it cannot show literal compliance with a regulatory standard or when the standard assumes a particular compliance method that is not feasible for the new airplane design, but can demonstrate that it meets the same level of safety. FAA also may determine that an existing standard is not adequate for a novel design feature, such as when a standard assumes a level of performance based on traditional materials (e.g., aluminum) and the new airplane design utilizes different materials. In such situations, FAA may create special conditions that the manufacturer must meet in order to demonstrate that the airplane meets the current safety level. Special conditions differ from an equivalent level of safety finding in three ways: FAA (as opposed to the manufacturer) originates the action based on a novel design feature, FAA determines that the regulatory standard is not adequate, and FAA generally publishes the draft special conditions for public comment. However, FAA uses the issue paper process to document its evaluation of technical issues in both situations.

FAA conducts the assessment process for all certification applicants and creates special conditions when necessary. (See fig. 4.) Prior to developing special conditions, FAA must determine that the following criteria are met: (1) The airplane has a novel or unusual design feature, (2) the airworthiness standards do not contain adequate or appropriate safety standards for this feature, and (3) the proposed special conditions establish a level of safety equivalent to that established in the regulations. Special conditions are unique to the specific certification program in which they are issued and apply to derivative airplane models—later versions of that airplane that incorporate similar novel design features.

Airplane manufacturers in the United States may apply for certification of new airplanes from foreign aviation authorities, which are responsible for ensuring that airplanes registered in their countries meet their airworthiness standards. For example, U.S. manufacturers apply to EASA for approval to allow their airplanes to fly in European airspace. This is essential for the commercial success of airplanes that are marketed globally. Boeing applied to EASA for certification of the 787 in 2003. Aviation authorities often use validation, a form of certification, to establish compliance for airplanes designed outside their countries and to issue a type certificate for these airplanes. For example, FAA officials stated that the European Union, Canada, Japan, and Brazil do type validations for U.S. aviation products. According to FAA officials, Boeing has applied for type validation of the 787 with EASA, the Japanese Civil Aviation Bureau, Transport Canada Civil Aviation, and the Chinese aviation authority. FAA uses its bilateral airworthiness agreements with other countries to determine its responsibilities during validation for U.S. aviation products sent abroad.

FAA and EASA have agreed to coordinate their certification and validation efforts while recognizing each agency’s authority to develop and enforce its own standards. In order to promote efficiency, FAA and EASA established a validation process for issuing type certificates for airplanes designed in each other’s jurisdiction. FAA is the primary certificating authority for U.S.-manufactured airplanes, and EASA is a validating authority. EASA and FAA reverse roles for airplanes manufactured in the European Union. Under the defined procedure, the primary certificating authority takes the lead role in working with the manufacturer while the validating authority remains involved. FAA and EASA also recognized the importance of effective, continual communication among themselves and the manufacturer to facilitate this process.

FAA plays a significant role in ensuring the continued safe operation of in- service airplanes. The agency accepts new airplane maintenance schedules and manuals, inspects repair stations to ensure quality assurance standards are met, and issues directives when it detects problems. As part of airplane type certification, FAA accepts the manufacturer’s airplane maintenance schedules, which become the basis upon which air carriers develop their own maintenance programs. FAA certifies and oversees repair facilities’ safety and operations. These facilities, which include independent repair stations (part 145 facilities) and airline in-house repair facilities (part 121 operators), conduct airplane repairs and maintenance in accordance with airworthiness standards and manufacturers’ requirements. As part of its oversight activities, FAA checks whether these facilities are using qualified staff as well as whether facilities are following their maintenance, repair, and training programs. Finally, FAA issues airworthiness directives—orders directing corrective action to maintain airworthiness—when it becomes aware of an unsafe condition with an airplane and determines that the condition is likely to exist or develop in other airplanes of the same design.

FAA Followed Its Special Conditions Process in Requiring That Boeing Demonstrate That the 787’s Composite Structures Meet Existing Safety Levels

FAA Established Special Conditions for Boeing to Demonstrate That the 787’s Composite Airframe Meets Existing Safety Levels

FAA applied 5 special conditions where it determined the applicable airworthiness regulations did not contain adequate or appropriate safety standards for design features related to the 787’s composite fuselage and wings. Two of the 5 special conditions are concerned with occupant survivability in a postcrash scenario, and 3 of the 5 relate to the soundness of the fuel tank structure in order to prevent fuel leakage or ignition. (See table 1.)

These 5 special conditions, which relate to novel features of the airplane’s composite fuselage and wings, represent a third of the 15 special conditions that FAA created as part of its overall certification of the 787 airplane. Initially, the special conditions are applicable to the 787-8 model. If FAA amends the type certificate for the 787 at a later date to include derivative models that incorporate similar novel design features, the special conditions would apply to the other models as well.

FAA Followed Its Processes for Developing and Monitoring Special Conditions

On the basis of our review of FAA’s documentation and discussions with FAA officials about its activities in developing the five special conditions, we found that FAA followed the special conditions process. Specifically, we found that FAA identified and evaluated technical issues and regulatory standards, determined the need for special conditions, obtained and responded to public comments, and monitored Boeing’s compliance activities. In August 2011, FAA issued the type certificate for the Boeing 787.

Identifying technical and regulatory issues: FAA evaluated technical issues related to the composite feature, identified regulatory standards that may not be adequate, consulted with technical and scientific experts, and documented Boeing’s position. FAA documented its evaluation of the airplane’s design issues and gaps in the regulatory standards. For example, FAA developed the tire debris penetration special conditions because the regulation, which was based on the assumption that the wings would be made from aluminum, specifies that only the fuel tank access panels need be resistant to debris penetration rather than the entire wing area. However, FAA’s certification staff determined that Boeing needed to demonstrate that the entire wing, and not just the fuel tank access panels, be able to withstand debris. We also found sufficient evidence that in developing each of the special conditions, FAA involved technical specialists and, in some cases, relied on research done at its technical research center. For example, FAA used the results of the technical center’s research on appropriate test methods for demonstrating the fire resistance of composite fuselage materials to help it develop its special conditions. In another case, we found that FAA also reviewed test results provided by Boeing as it evaluated the technical issues.  Determining special conditions were needed: We found that, consistent with FAA policy, FAA adequately documented the implications of the composite features on safety, why the existing airworthiness standards were not adequate, and how the special conditions would enable the 787 airplane to meet the current level of safety. For example, FAA staff noted that the current fuel tank fire resistance standards do not explicitly require that the areas contiguous to the fuel tank access panels be resistant to tire debris because the standards were based on the performance of aluminum wings. The ability of aluminum wing skins to resist penetration by debris is understood from extensive use. However, lacking an extensive service history of composite wings, FAA determined that Boeing would have to take additional steps to prove that the wing surface area contiguous to the fuel tanks meets the current safety level. We also found that FAA obtained Boeing’s position on the proposed special conditions and reviewed Boeing’s plans for demonstrating compliance. In some cases, FAA and Boeing negotiated certain aspects of the compliance approach. Before each proposed special condition was issued for public comment, the parties tentatively agreed on the compliance approach and what Boeing would deliver (e.g., test plans, test report, or analyses) to demonstrate compliance.  Public comment: We found that before finalizing each of the five special conditions, FAA solicited and considered public comments by publishing the draft special conditions in the Federal Register. FAA summarized the source and substance of each comment received and the agency’s position on the substance of the comments in the final special conditions, which are publicly available. FAA did not revise the special conditions on the basis of the comments, although it could have done so had it determined that revision was advisable. As part of our review of the public comments, we took steps to gather additional information about technical issues. For example, we contacted one of the two parties who commented on the structural lightning protection special condition to obtain technical information and discussed these issues with FAA.  Monitoring compliance: We found that FAA tracked the status of the deliverables Boeing provided in order to determine that the manufacturer complied with the special conditions and was demonstrating that it could meet safety levels. We found that FAA tracked the dates each deliverable was received and approved. For most deliverables, FAA staff, rather than a designee, was responsible for approving the deliverable, especially for more significant tests and documents. As noted above, tests were among the various forms of deliverables. Although FAA designees were the responsible officials for witnessing the certification tests, Boeing representatives invited FAA staff to observe the tests as well, and FAA staff attended many of them. Boeing tested full-scale structures, such as a portion of the wing span, the horizontal stabilizer, and the fuselage. Some of these tests were conducted to simulate how certain composite structures would perform in a crash. One such test, which FAA technical staff monitored, involved vertically dropping a section of a composite fuselage from a height and at a rate that FAA required. The test validated the analytical model used to assess the behavior of the 787 fuselage for all the design conditions required under the special conditions.

FAA Revised Its Fuel Tank Lightning Protection Requirements during the 787 Certification Process

FAA’s review of the 787 airplane design and determination of special conditions occurred as the agency was reconsidering changes it had previously made to the fuel tank lightning protection standards. In 2001, FAA amended its fuel tank ignition regulations to address the causes of a 1996 catastrophic fuel tank explosion accident. FAA’s new approach to precluding fuel tank explosions required reductions in both the probability of ignition sources occurring in the fuel tanks and the flammability of fuel tanks. Compliance with this approach required an airplane manufacturer to demonstrate its airplane design has three highly reliable, independent, and redundant protective features to prevent ignition sources or has two such design features that are continuously monitored or routinely inspected. However, by 2006, several certification applicants found it impractical to meet the revised design standards for fuel tank structure as applied to the lightning protection features. For example, applicants indicated that it was impractical to routinely inspect protective features inside the fuel tank because fuel tank inspections may occur only once or twice in the life of an airplane and more frequent inspections could result in damage to lightning protection features during the inspection process. FAA officials noted that the agency had not realized that airplane manufacturers would find it impractical to comply with the revised requirements when it developed them. However, after it had granted partial exemptions to two airplane certification applicants and was in the process of evaluating the 787 design, FAA determined that it needed to provide additional policy guidance while it studied the issue further.

In 2009, FAA issued guidance that established the circumstances under which the agency may create special conditions for fuel tank lightning protection for manufacturers of airplanes with composite fuel tanks and grant exemptions to manufacturers of airplanes with aluminum fuel tanks. It identified requirements and indicated that it will develop methods of compliance whenever it creates special conditions or grants an exemption. In each case, FAA will approve a design if it finds that the proposed design would provide an acceptable level of safety. According to the policy, new airplane designs must include technology that reduces flammability, such as a nitrogen generation system, in fuel tanks that are more flammable than typical aluminum wing fuel tanks. Prior to issuing this policy, FAA provided a draft version for public comment, which generated a large number of comments from a variety of stakeholders (e.g., airplane manufacturers, aviation manufacturing associations, and a union representing FAA engineers, among others). FAA wrote a response to each of the comments it published and incorporated changes to its policy as it deemed appropriate. Some comments were technical corrections. Others were more substantive. For example, two parties providing comments questioned whether FAA should allow airplanes to be operated when their fuel tank flammability reduction systems are inoperable, noting that these systems are one of the redundant systems necessary for preventing fuel tank fires during a lightning strike. FAA responded that the issue is not part of the structural lightning policy, but lightning policy, but noted that the decision is made by the FAA flight operations board on a case-by-case basis.

FAA Granted an Equivalent Level of Safety Finding Related to the Composite Fuselage

In addition to creating the special conditions, FAA granted Boeing an equivalent level of safety finding for the 787 related to the flame penetration properties of the fuselage. As indicated, an airplane manufacturer can request an equivalent level of safety finding when it determines that it may not be able to comply literally with the standard, but it can show that its airplane design meets the same level of safety. In this case, Boeing proposed demonstrating that the 787 composite skin and insulation configuration could meet the current level of safety developed for typical aluminum-skin and insulation configurations. Boeing proposed using a large-scale or laboratory-scale test—that is, a different test method from the small-scale test that the standard specifies for applicants to simulate the characteristics of a postcrash fire. Boeing determined that a small-scale test would not be sufficient for testing its composite fuselage fire resistance properties because the standard FAA test does not test the airplane skin, which the regulation assumes to be aluminum. FAA approved the equivalent level of safety finding subject to the condition that the results of Boeing’s large-scale (or laboratory-scale) testing show the 787 fuselage skin and structural components provide a survivable cabin environment for 5 minutes or equivalent to that of a traditional aluminum fuselage with compliant insulation. We also found that FAA documented its determination to grant Boeing an equivalent level of safety finding, providing a description of the technical issues and Boeing’s plan to demonstrate the composite fuselage would meet the current level of safety in a manner similar to how it documented the special conditions determination, although it did not obtain public comments, which are not required for an equivalent level of safety finding.

EASA Also Assessed the Use of Composite Materials in the Boeing 787

EASA’s Process Is Similar to FAA’s Special Conditions Process

EASA uses a validation process (a form of certification) to issue a type certificate indicating that U.S.-manufactured airplanes meet European airworthiness standards. As with FAA, during validation EASA develops a certification basis comprising relevant airworthiness standards and additional considerations such as special conditions to account for novel features or new uses of products. FAA and EASA officials stated that the two authorities work together to harmonize their standards and, as a result, the standards are similar in many respects, but have some differences. For example, one authority may adopt a standard before the other. As with FAA’s certification process, a key component of EASA’s type certification is determining whether current airworthiness standards are appropriate to ensure an airplane’s novel features or new product uses meet current levels of safety. EASA develops a certification review item (review item) when it identifies an airworthiness standard that may not be adequate for addressing novel features or new technology uses.

As part of its validation review, EASA identifies technical and regulatory issues that it wants to evaluate further and discuss with the manufacturer and creates what it calls action items to document these actions. According to EASA, the agency develops review items by reviewing current standards and guidance material, considering its and the manufacturer’s experience with existing technology, and determining possible ways to show relevant performance of new technology or specifying new requirements. Review items can result in special conditions, means of compliance, or equivalent safety findings that become part of an airplane’s certification basis. Review items contain a description of the technical or regulatory issues, EASA’s position, and any requirements and conditions the manufacturer must meet for certification. According to EASA officials, when EASA and the manufacturer agree to the conditions and requirements contained in the review items, EASA closes the review item.

EASA Created 11 Review Items Associated with the Boeing 787’s Composite Airframe

According to EASA, it developed 11 review items—resulting in seven special conditions and five means of compliance—to address existing EASA airworthiness standards it determined were not adequate for determining whether the 787’s composite fuselage and wings met current levels of safety. These review items focus on issues such as crashworthiness, fatigue and damage tolerance, structural integrity, fire resistance, and fuel tank protection. (See tables 2 and 3.) The purposes of the 11 review items include to enhance knowledge of and bring attention to issues related to composites, to address new or novel features of composites, to apply newly developed airworthiness standards, and to address new methods of compliance with airworthiness standards. In order to receive its type certification from EASA, Boeing must demonstrate compliance with the conditions and requirements contained in special conditions and means of compliance identified in the EASA review items.

We found that 5 of EASA’s composite-related review items resulted in special conditions that are similar to the special conditions and equivalent level of safety finding that FAA developed for the 787. (See table 2.) Specifically, four of these special conditions—fuselage crashworthiness, wing and fuel tank fire protection, fuselage in-flight fire resistance, and fuel tank protection from debris—are very similar to four of FAA’s special conditions. The postcrash fire resistance special condition is similar to FAA’s equivalent level of safety finding, but it adds a requirement that FAA did not include. EASA required that Boeing provide safety information for rescue crews in case of a fire emergency.

We found that the remaining 6 EASA review items differed from FAA’s special conditions and equivalent level of safety finding. (See table 3.) EASA created these review items to address differences between its and FAA’s airworthiness standards, regulatory language, interpretations of standards, and positions on technical issues. For example, EASA developed its review item on the structural integrity of fuel tank access covers to apply a standard that already existed for FAA. For other review items, EASA’s regulatory language differed from FAA’s (fuel tank flammability), and EASA requested information from Boeing about the composite materials’ strength and damage tolerance that FAA did not request (performance of composites on the fin deck).

The extent to which EASA relied on FAA to oversee and determine Boeing’s compliance with EASA’s composite-related review items varied. According to EASA officials, EASA requested that FAA determine compliance for a majority of the requirements (i.e., deliverables) identified in the review items and action items. EASA validated the 787’s type design in August 2011, requiring an FAA statement of compliance prior to issuing its type certificate. Three of EASA’s review items indicated that EASA requested that FAA determine whether Boeing complied with the airworthiness standards included in the review items. In one review item, EASA retained the compliance determinations. The remaining seven review items did not directly indicate which agency would determine compliance, although EASA indicated in three of the seven that it will remain involved by reviewing supporting documentation. Additionally, throughout its development of the review items, EASA reviewed documentation and test results and analysis from Boeing as well as witnessed Boeing-conducted tests.

FAA and Industry Actions May Address Key Safety-Related Concerns, but It Is Too Early to Assess the Adequacy of These Actions

Key Safety-Related Concerns Identified in Areas Related to Composite Airframe Repair and Maintenance

Through a review of relevant literature and interviews with experts, we identified and categorized key safety-related concerns into four areas, namely (1) limited information on the behavior of composite airframe structures, (2) technical concerns related to the unique properties of composite materials, (3) limited standardization of composite materials and repair techniques, and (4) level of training and awareness on composite materials. As we have previously reported, problems with repair and maintenance can affect the safety of airplane operations. None of the experts that we spoke with felt that the concerns they identified posed extraordinary safety risks or were insurmountable. Several experts reiterated that while not every risk can be known, the use of composites is not revolutionary; rather, it is a new application of technology that has a history in military and general aviation applications.

Limited information: These concerns focus on how composite airframe structures behave when damaged and as they age. These concerns are partly attributable to the limited in-service experience with composite materials used in the airframe structures of commercial airplanes and, therefore, less information is available on the behavior of these materials than on the behavior of metal. Studies that we reviewed noted that more empirical data would help better predict the behavior of damaged composite structures through more robust models or analytical methods. Reliable damage behavior predictions are important because they help form the basis for a new airplane’s design or maintenance program. An expert that we spoke with also noted that while manufacturers rely, in part, on models to predict the behavior of damaged composites, the limited amount of in-service performance data available to use as inputs to the models may create challenges for airplane designers.

Technical concerns: These concerns include challenges in detecting and characterizing damage in composite structures, as well as making adequate composite repairs. Impact damage to composite structures is unique in that it may not be visible or may be barely visible, making it more difficult for a repair technician or aviation worker to detect than damage to metallic structures. In addition, the type of nondestructive inspection techniques repair technicians could use to detect and characterize composite damage varies, in part because composites vary in their construction (e.g., sandwich composite construction and variable thicknesses of laminate construction). The ability of composite nondestructive inspection techniques to adequately detect damage depends on the composite’s construction and the type of damage (e.g., delamination, disbonding, or water infiltration). Thus, damage may not be detected sufficiently or properly if repair technicians do not use or apply the correct nondestructive inspection technique. Furthermore, no nondestructive inspection technique exists that can measure the strength of a bonded composite repair after it is completed. Making a repair is also a concern partly because composite repairs are more susceptible to human error than metal repairs since the quality (i.e., achieving the anticipated strength) of a composite repair is highly dependent on the process used.

Limited standardization: Composite materials and repair techniques are less standardized than metal materials and repairs. With limited standardization due, in part, to business proprietary practices and the relative immaturity of the application of composite materials in airframe structures, a repair technician could confuse materials or processes, which may result in improper repairs. According to one study, only about a dozen common metal alloy materials are used for traditional metal repairs, while over 60 unique materials may be used for various composite repairs. Less standardization also can have a negative economic impact for airlines and repair stations because a repair facility might have to keep a large stock of repair materials and parts in house, which creates an inventory and storage challenge. Composite materials generally need to be stored at a specific temperature, and the materials also have shelf lives (i.e., expiration dates).

Level of training and awareness: This concern focuses on whether industry workers handling composites or in contact with composites (specifically, repair technicians, designees, and airport workers) and FAA aviation safety inspectors receive sufficient training and are aware of and can appreciate the differences between metal and composite materials.

Airplane repair technicians and designees that have worked with metal materials for decades generally may not be as familiar with composite materials, whose application in airplanes is relatively recent and whose unique characteristics are associated with technical challenges. Two experts suggested that applying metal repair practices to composite structures may be inappropriate and risk the repair of the composite structures. Thus, repair technicians and designees need adequate training about composites’ unique characteristics and the associated challenges to—in the case of repair technicians—properly maintain and repair composite structures and—in the case of designees—properly review and approve composite repair designs. FAA requires that part 121 certificate holders (air carriers), their agents, and part 145 repair stations (independent repair facilities) have training programs that are adequate to ensure that personnel approving and performing composite inspections, maintenance, and repairs are informed and competent to do so. One expert expressed concern that while the training is available to technicians and designees, they may lack incentives to become trained. Four experts suggested that FAA or industry implement certification requirements for technicians that work with composite structures, similar to that of welders.

Airline and airport workers also may require greater awareness of the differences in the damage properties of composite materials and metallic materials. Ramp areas at airports are typically small, congested areas where departing and arriving aircraft are serviced by airline and airport ramp workers, including baggage, catering, and fueling personnel. As we have previously reported, a large number of people using equipment in a relatively small area, often under considerable time pressure, creates an environment in which aircraft and equipment can, among other things, be damaged. Undetected aircraft damage from ramp activities, whether to metallic or composite structures, can cause in-flight emergencies. In December 2005, for example, an Alaska Airlines MD-80 that had departed from Seattle for Burbank, California, experienced a sudden cabin depressurization. After the aircraft safely returned to Seattle, it was discovered that a ramp vehicle had punctured the aircraft fuselage, but the incident had not been reported.

FAA’s aviation safety inspectors may not have sufficient composite- related training or knowledge to identify safety risks during inspections, according to some experts with whom we spoke. As part of FAA’s oversight process, FAA aviation safety inspectors check airlines’ and repair stations’ processes and programs, including whether their facilities are following their respective maintenance, repair, and training programs. While FAA does not actually inspect or check the quality or strength of composite repairs, according to FAA officials, FAA inspectors should be knowledgeable enough about composite structure maintenance and repair so that they can identify safety problems at repair facilities. For example, one expert noted that FAA inspectors need to be able to identify whether repair technicians are using the appropriate nondestructive inspection technique or interpreting the results correctly. Three experts suggested that FAA inspectors should complete a required level of composite-related training or certification prior to inspecting facilities that handle composites. Furthermore, the demand for FAA inspectors that have sufficient knowledge in composites may increase with the growth of in-service airplanes with composite airframe structures needing composite maintenance and repair.

FAA Has Actions Intended to Address Key Safety- Related Concerns

FAA has ongoing or planned efforts that are intended to help address the areas of safety-related concerns that we identified. Because FAA regulations and oversight activities are not specific to composites, however, FAA’s actions to address these concerns are within its current roles and responsibilities. Many actions are similar to actions it takes for certifying and overseeing the continued airworthiness of any new airplane, but are adapted to address the unique characteristics of composite materials. FAA’s efforts to address these concerns include issuing new or modified guidance and policy, conducting research, developing and implementing training, and collaborating with industry stakeholders. As discussed below, each of these efforts relates to multiple safety concerns that we identified.

Guidance and policy: FAA recently has updated guidance and has proposed additional guidance related to composites, which helps address concerns related to training and awareness, technical areas, and limited information. For example, FAA updated its existing guidance on composite aircraft structure, and on quality systems for composite manufacturing. This updated guidance helps address technical concerns by providing information on composite materials to manufacturers designing and seeking certification of new airplanes. FAA is currently updating guidance on composite and bonded aircraft structures, which will be targeted toward all facilities that conduct composite repairs and alterations. This guidance helps address both training and awareness concerns and technical concerns by providing information on composite repair. FAA also has draft guidance to help entities that handle composite materials develop training or qualification programs for composite maintenance technicians. And, while the rule is not focused on composites, FAA recently issued an airplane fatigue damage rule, which helps address concerns related to limited information on how composite structures age and fatigue. The rule requires that all manufacturers take a proactive approach to managing risk related to widespread fatigue damage by requiring the demonstration of the validity of the structural maintenance program by test or service experience, in an effort to reduce FAA’s current practice of issuing airworthiness directives after an incident.

Research: FAA has past, ongoing, and planned research related to the inspection and repair of composites, as well as research on aging airplanes. FAA’s research helps address concerns about limited information on how composite airframe structures behave when damaged and as they age, technical concerns, and standardization concerns. FAA partners with universities under its Centers of Excellence program, conducts research at its Technical Center, as well as contracts with industry and academia. For example, FAA’s National Aging Aircraft Research Program, which was initiated following passage of the Aviation Safety Research Act of 1988, includes research on the maintenance and repair of airplane structures, including composite structures and how they age. Part of this research is conducted under FAA’s Centers of Excellence program. FAA’s research efforts have produced information about airplane design guidelines, which FAA then incorporates into its industry guidance discussed above. FAA’s collaboration with academia and industry also provides research on standardizing materials and processes.

Training: FAA offers a composite materials training course for its aviation safety inspectors and is developing another composites awareness course for designees, which addresses concerns related to training and awareness and technical issues. In 2009, this course replaced two previously offered composites training courses for FAA inspectors. In developing the current course, FAA utilized new terminology and industry input for the new curriculum to design the course around the inspection of new-generation composite airplanes. Also, according to an FAA official, this course focuses more on an inspector’s job functions in performing audit and surveillance activities of composite maintenance facilities, while the prior classes were not tied back to regulations or surveillance activities. Similar to other technical courses available to FAA inspectors who oversee maintenance activities, this course is available to those who need it. FAA officials explained that the course is not required for all such inspectors because only selected inspectors are assigned to facilities that perform composite repair; thus, not every inspector needs to complete the course. FAA field office managers are responsible for requesting this course for their staff and use FAA’s formal decision tree process to determine if the inspector needs the training. FAA officials reported to us that, based on FAA training request records for the past 3 years, all requests made by field office managers for inspectors to receive the composites awareness training have been fulfilled. According to FAA’s internal order on inspector training, conditions, including completion of on- the-job training, must be met for an inspector to perform tasks unsupervised. FAA officials explained that many inspectors have gained experience with composite materials before being hired by FAA, and that field office managers who keep track of inspectors’ training and skills do not assign aviation safety inspectors to tasks that they are not qualified for. According to FAA data, 73 percent of FAA inspectors assigned to repair stations that are certified to conduct composite repairs on large airplanes have completed one or more of the composites courses. (FAA was unable to tell us whether these repair stations were actively repairing composite structures.) Regarding training for airlines and repair stations, FAA officials told us that these facilities are responsible for training their own repair technicians or other aviation workers. However, FAA is currently collaborating with industry stakeholders to help develop and encourage industry stakeholders to provide composite training.

Industry collaboration: FAA also collaborates with industry stakeholders and in some cases sponsors industry workshops or working groups. FAA plays a leadership role in the Commercial Aircraft Composite Repair Committee (CACRC)—whose charter is to develop and improve maintenance, inspection, and repair of commercial airplane composite structure and components. CACRC has several specific task groups that help address safety-related concerns in several areas that we identified. For example, CACRC has a task group that focuses on composite training, as well as task groups that work on issues related to repair techniques, repair materials, and inspection. In recent years, CACRC published a document that represents the industry standard for teaching points for an awareness class on Critical Issues in Composite Maintenance and Repair. FAA’s composites awareness course for FAA inspectors discussed above used these teaching points as a foundation for its curriculum. In addition to its involvement with CACRC, FAA sponsors working groups that are composed of composite airplane manufacturers (i.e., Boeing and Airbus) and regulators (i.e., FAA and EASA) and whose charters include identification of maintenance issues. FAA also sponsors industry workshops to facilitate the sharing of information, such as technical issues related to damage tolerance or standardization of composite materials. According to FAA, these working groups and workshops help address concerns related to technical issues, standardization, and training and awareness. Furthermore, FAA’s technical center sponsors the Composite Material Handbook 17, which provides information and guidance to industry stakeholders, such as databases and educational materials for structural engineering, maintenance, and manufacturing, that helps address technical concerns and to some degree concerns about standardization.

Industry Stakeholders Play a Role in Addressing Safety-Related Concerns

Industry stakeholders—mainly manufacturers and airlines—also play a significant role in ensuring an airplane’s continued safety and have taken a range of actions that help address concerns that we identified. Because our study focused on FAA actions to address key safety-related concerns, the actions discussed here should not be considered all-inclusive. Manufacturers are responsible for designing and building airplanes that are safe and meet safety standards, and providing instructions for continued airworthiness that are accepted by FAA. Furthermore, manufacturers are generally expected by their customers (i.e., airlines) to design an airplane that is maintainable and reparable, as well as to support repair and maintenance of airplanes in service. Airlines are responsible for the safe maintenance and operation of airplanes. Actions taken by manufacturers and airlines that help address concerns include manufacturers’ direct customer service support to airlines, research and design allowances, involvement in programs to share data on in-service airplanes, training, and participation in industry groups and FAA- sponsored working groups and workshops.

Specifically, manufacturers have conducted and continue to conduct extensive research on composites as part of their product development activities. According to Boeing representatives, a significant number of tests are conducted during the design development stage to gain knowledge about the materials and the structures used and verify that they will behave as predicted. Through the design development and certification process, manufacturers incorporate safety allowances and redundancies into the airplane design, helping address concerns related to limited information and technical concerns. For example, a manufacturer may design an airplane that is strong enough to ensure that nonvisible damage that may occur to a composite fuselage would not require structural repair to maintain structural integrity and airworthiness. Also, when preparing repair instructions for a structural repair manual, a manufacturer may use its research conducted on repair techniques to set allowable limits on the size or type of a composite repair to ensure that the repair does not diminish an airplane’s strength below the acceptable airworthiness level.

Airlines, through their relationships with the manufacturers, may provide manufacturers with service information, such as selected maintenance records, that help increase an airplane’s maintainability and reparability. These relationships help address limited information and technical concerns by providing service information to the manufacturer to incorporate into maintenance and repair instructions and future airplane designs. Service information provided by airlines is also analyzed by manufacturers and incorporated into service bulletins and service letters that provide new or modified information on how to maintain and repair an airplane, which helps airlines become educated about any new technical issues. In addition, airlines may participate in a focused fleet survey program with the manufacturer, which involves an airline and manufacturer conducting more detailed evaluations of in-service airplanes. This information can be incorporated into maintenance and repair plans and help provide insights to improve future airplane designs.

We also found that to help address training and awareness concerns, manufacturers and airlines provide training on composites. For example, Boeing currently offers four courses to its Boeing 787 customers specifically related to composite structures. Boeing reported that, on the basis of enrollment so far, it anticipates that all of the airlines purchasing the 787 will send some personnel through one or more of its composites courses, which is almost twice the participation of similar courses for previous airplane programs. Major airlines may also provide in-house training to their personnel.

As discussed above, industry representatives, including manufacturers and airlines, voluntarily participate in CACRC activities and FAA- sponsored working groups and workshops to share information globally. Their participation in these groups helps address concerns in several areas that we identified. Specifically, the workgroups provide a venue to share lessons learned about repair and maintenance and for manufacturers and airlines to discuss needs and goals for standardization.

It Is Too Early to Fully Assess the Adequacy of FAA and Industry Actions

It is too early to fully assess the adequacy of FAA and industry efforts to address safety-related concerns and to build sufficient capacity to handle and oversee composite maintenance and repair, given that composite airframe structures in currently in-service airplanes are mostly limited to the secondary structures. As discussed previously, manufacturers are increasingly using composite materials in the airframe structures of transport airplanes. As more airlines add airplanes with composite airframe structures to their fleets, the demand for composite maintenance and repair will increase. To accommodate that growth, FAA will likely need to certify and oversee an increasing number of repair facilities, and more FAA personnel will likely need knowledge and training composites. It is, however, unclear at this time what the extent of the demand will be on FAA to certify additional repair stations for composites and on FAA inspectors who would oversee those stations. It is also too early to determine how well positioned FAA and its inspectors will be to meet future demands given that several FAA efforts, including in the areas of composite training and FAA guidance, are in the planning stages or are only recently under way. Similarly, the adequacy of other FAA and industry efforts—i.e., research, modeling, and stakeholder relationships, such as those between manufacturers and airlines, which depend in large part upon the collection and sharing of maintenance and repair information—can be fully evaluated only when there is greater in-service experience with composite airframe structures.

Finally, the extent to which the previously discussed FAA and industry efforts may help to ensure the continued airworthiness of composite airframe structures may also be affected by whether and when FAA addresses broader oversight weaknesses that we and others have previously identified. In recent years, both we and the DOT IG have identified weaknesses in how FAA implements its oversight processes, including the reliability, validity, and completeness of the data FAA uses to manage safety risks. We did not evaluate these processes during our review, or the steps FAA is taking or plans to take to address those weaknesses, because these concerns are not specific to the repair and maintenance of composite structures. However, the increased use of composite materials in airplanes may exacerbate some of these weaknesses—and their associated risks—if FAA does not take appropriate corrective steps. For example,  As mentioned earlier, composite damage may be less visible, and consequently more difficult to detect, than metal damage. To the extent composite damage goes undetected, and thus unreported, it would diminish the validity, completeness, and reliability of the data that FAA will be collecting and using to help proactively identify risks and take actions to mitigate those risks before they result in failure of composite structures.  Deficiencies in FAA’s oversight systems for airlines and repair stations affect FAA’s ability to ensure that these facilities have the proper tools and are following their respective maintenance programs and quality control processes. For example, the DOT IG has reported that the design of FAA’s airline surveillance system is flawed in that it allows lower-risk maintenance programs to be inspected before higher-risk programs.

Agency Comments and Third-Party Views

We provided copies of a draft of this report to DOT, NASA, EASA, and Boeing Company for their review and comment. Each organization provided technical corrections and clarifications, which we incorporated as appropriate.

As arranged with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after the date of this letter. At that time, we will send copies of this report to the appropriate congressional committees, the Secretary of Transportation, the Administrator of FAA, the Administrator of NASA, and other interested parties. In addition, this report will be made available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions or would like to discuss this work, please contact me at (202) 512-2834 or dillinghamg@gao.gov. Contact points for our offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II.

Appendix I: Objectives, Scope, and Methodology

This report addresses the Federal Aviation Administration’s (FAA) and the European Aviation Safety Agency’s (EASA) certification of airplanes using composite materials, specifically the agencies’ processes for developing special requirements to ensure that Boeing demonstrates the 787 composite fuselage and wings meet current safety levels, and FAA’s actions to address safety-related concerns associated with repairing and maintaining composite airplanes identified by literature and stakeholders. We focused on FAA’s and EASA’s actions as they relate to the certification of the Boeing 787 because it is the first large transport category airplane for commercial use with a composite airframe structure to undergo the certification process. To address these objectives, we reviewed FAA and EASA regulations, policies, and processes and Boeing certification documents for the special conditions and review items the agencies indicated were related to the 787’s composite fuselage and wings. We conducted a literature search and reviewed 39 journal articles and technical papers related to the repair and maintenance of composite airplanes. We interviewed 11 stakeholders with expertise in the area of maintenance and repair of composite materials in airplanes and representing a variety of perspectives, including manufacturers, repair stations, academic researchers, and air carriers.

Review of FAA’s Process to Develop Special Conditions for the 787 Composite Structures

To provide information about FAA’s certification and special condition processes for the 787, we interviewed FAA and Boeing officials and reviewed FAA regulations, orders, policies, and other guidance. At the time of our review, FAA had developed the certification basis for the 787 airplane, which identified the regulatory standards, special conditions, exemptions, and equivalent level of safety findings that make up the airplane’s type certification. FAA indicated that it had developed issue papers for five special conditions, one equivalent level of safety finding, and five means of compliance (two of which relate to two of the special conditions) for the standards that it determined did not contain appropriate safety requirements to ensure that the 787’s composite fuselage and wings meet the current level of safety and provided documentation of them. We focused on the special conditions and equivalent level of safety finding because we were interested in determining whether FAA followed its process for developing them and the information was publicly available. We did not conduct a comprehensive review of all of the airworthiness standards that affect the composite fuselage or wings nor did we make an assessment of whether FAA should have created special conditions for the composite features in addition to those identified by FAA.

On the basis of our analysis of FAA’s processes, we developed a flow chart of the major steps in the issue paper and special condition processes. These processes are linked because issue papers may be used to support a special condition determination, as well as an equivalent level of safety finding or means of compliance. Using this information, we created a data collection instrument that allowed us to review FAA and Boeing’s technical papers and determine to what extent FAA documented that it followed these steps. In particular, we looked for information that documented how FAA  determined there was a significant technical or regulatory issue,  determined it should develop special conditions or equivalent level of  obtained and responded to public comments, and  monitored Boeing’s compliance with special conditions.

Following our preliminary review of the documents, we interviewed FAA officials and Boeing representatives to obtain additional information and documents to more fully understand the steps FAA took to evaluate the 787 design, regulations, and Boeing’s actions to demonstrate compliance. Although we reviewed documents describing some of Boeing’s compliance activities, Boeing’s actions to demonstrate compliance with the special conditions are considered proprietary, and therefore we were not able to describe them in detail. As part of our review of the public comments to the special conditions, we identified technical issues and, in one case, contacted the source of the comments to obtain additional information.

Review of EASA Certification Review Item Process

To provide information about EASA’s validation of the 787’s airworthiness, we interviewed EASA and FAA officials involved in the certification process and reviewed relevant EASA documents. EASA identified 11 certification review items (review items) that it developed related to the Boeing 787’s primary composite features. We obtained and reviewed the EASA regulations, principles, and processes concerning validation, as well as the 11 composite-related review items. We developed analytical tools to determine the technical or regulatory issues and the requirements or conditions contained in the review items. We used the analytical tools to identify the review items’ similarities to and differences from the composite-related special conditions and equivalent safety findings that FAA developed.

Identification of Repair and Maintenance Concerns

To identify the key safety concerns associated with the repair and maintenance of composite airframe structures in transport airplanes, we interviewed 11 aviation experts and conducted a literature search and reviewed 39 documents and FAA technical reports related to the repair and maintenance of composite airframe structures in transport category airplanes. Our literature search methodology is discussed below. The 11 experts we interviewed represented a variety of perspectives, including manufacturers, repair stations, research or academia, air carriers, and aviation consultants or providers of composite training. As part of our methodology for identifying experts, we developed a list of categories that represent the range of entities with involvement in the repair and maintenance of composite airframe structures in transport category airplanes. We reviewed background information to identify potential sources of stakeholders, as well as actual names of experts. We also reviewed the interviews conducted during design to identify any sources or names of experts recommended by the interviewees. For the selection process, we developed criteria and determined that the experts would have to meet two or more of the criteria to be selected for interviewing. The criteria included  experience or knowledge about repair and maintenance of composite structures, not just design or manufacturing of composite materials/structures or accident investigations;  expertise or knowledge in advanced composite materials, including composite materials in aircraft; knowledge regarding FAA’s oversight of repair and maintenance of composite materials components or aircraft; and  affiliation or association with work or research in the areas of transport category airplanes, and not exclusively military or general aviation.

We then compiled a list of key safety concerns unique to the repair and maintenance of composite airframe structures in transport category airplanes through our review of the 39 documents and FAA technical reports and our interviews with the 11 experts. To assess the extent to which FAA actions help address these concerns, we interviewed FAA officials, including policymakers, aviation safety inspectors, scientists, and researchers about ongoing and planned activities. We also interviewed industry stakeholders, including representatives from Boeing, Airbus, and the Air Transport Association, about FAA and industry actions that help address key safety concerns. We reviewed documentation, including current and proposed FAA regulations, policies, and guidance; FAA research plans; and presentations from industry working group meetings related to the repair and maintenance of composite airframe structures or the oversight of composite repair and maintenance. We also identified safety concerns related to the repair and maintenance of transport category airplanes—though not composite-specific—through our review of our reports and prior Department of Transportation Office of Inspector General reports.

Literature Search

We targeted our literature search to eight databases. We selected the databases to contain scholarly journal articles (ProQuest, Social SciSearch), government-conducted or government-funded research reports (National Technical Information Service and the National Transportation Library Digital Repository), conference proceedings (PapersFirst), and a combination of the three above (Transportation Research Information Services, INSPEC, PASCAL). We searched the databases using a combination of specific keywords and subject headings, such as “composites,” “damage,” “maintenance,” “civil aviation,” and “aircraft industry.” Our literature search covered studies published from 2000 onward and initially yielded results with titles and abstracts for more than 1,000 documents. After a cursory review by our librarian and elimination of duplicates and irrelevant documents, those results were reduced to titles and abstracts for 659 documents.

We then identified 209 of the 659 document title and abstracts as relevant to the scope of our review. We categorized documents as relevant if the title and abstract indicated that the document discussed the continued airworthiness or the repair and maintenance of airframe structures in commercial transport category airplanes. Documents were excluded from our review if the title and abstract indicated that the document exclusively discussed a variety of irrelevant topics, including the use of composites in nonairplane applications, such as orthopedics or bicycles; composites in military applications or secondary airplane structures; airplane design and certification; or the results of experiments for a specific theoretical model, tool, or system.

Because many of the 209 relevant document abstracts covered similar topics, we selected a sample of the abstracts on which to base a request for a full document for review. To select the sample of documents, we categorized the 209 document abstracts into 10 topics: (1) behavior prediction, (2) damage characterization, (3) environmental effects, (4) maintenance, (5) nondestructive inspection/evaluation, (6) repair design, (7) repair technique or process, (8) structural health monitoring or damage detection, (9) training, and (10) other. We then selected up to 5 documents from each of the first 9 topics and all of the documents from the “other” topic based on the following criteria: documents whose abstract directly refers to concerns related to repair, maintenance, or continued airworthiness of composite airframe airplane structures; and from the remaining documents in the topic, we chose the ones with the most recent date—barring duplicative authors. Through this process, we selected a sample of 52 document abstracts from the 209 relevant document abstracts.

We requested copies of each of the 52 documents in our sample. Six of the 52 documents were unavailable to us because of copyright restrictions or the document was not in the English language. Furthermore, upon review of the remaining 46 full documents, we found that 13 were irrelevant to the scope of our review. Ultimately, we reviewed 33 full documents from our literature search to identify safety concerns associated with the repair and maintenance of composite airframe structures in transport airplanes.

In addition to these 33 documents, we reviewed 6 technical reports published by FAA’s technical center. The FAA technical center provided us with a list of 36 reports that contain aspects of composite structures. We identified 8 of the reports as relevant through review of each report abstract; 2 of the 8 relevant reports were duplicative of documents identified through our literature search described above.

Appendix II: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Paul Aussendorf (Assistant Director), Rebekah Boone, Leia Dickerson, Bert Japikse, Delwen Jones, Stan Kostyla, Gail Marnik, Jaclyn Nelson, Josh Ormond, Madhav Panwar, and Gretchen Snoey made key contributions to this report.