In February 2011, Boeing won the competition to develop the Air Force’s next generation aerial refueling tanker aircraft, the KC-46. Boeing was awarded a fixed price incentive (firm target) contract for development because KC-46 development is considered to be a relatively low-risk effort to integrate mostly mature military technologies onto an aircraft designed for commercial use. The contract is for the design, manufacture, and delivery of four test aircraft and includes options to manufacture the remaining 175 aircraft. The contract requires Boeing to deliver 18 operational aircraft by August 2017 and specifies that Boeing must correct any required deficiencies and bring development and production aircraft to the final configuration at no additional cost to the government. The contract limits the government’s financial liability and provides the contractor incentives to reduce costs in order to earn more profit. Barring any changes to KC-46 requirements by the Air Force, the contract specifies a target price of $4.4 billion and a ceiling price of $4.9 billion, at which point Boeing must assume responsibility for all additional costs. As of December 2014, Boeing and the program office estimated costs would be over the ceiling price by about $380 million and $1.4 billion, respectively. The program office estimate is higher because it includes additional costs associated with performance as well as cost and schedule risk. In all, the Air Force expects 13 production lots of aircraft to be delivered. The contract includes firm fixed price contract options for the first production lot in 2015 and the second production lot in 2016, and options with not-to-exceed firm fixed prices for production lots 3 through 13. According to program officials, Boeing plans to use a combination of development and production aircraft to meet the contractual requirement to deliver 18 aircraft by August 2017. Boeing plans to modify the 767 aircraft in two phases to produce a militarized aerial refueling tanker. In the first phase, Boeing is modifying the 767 by adding a cargo door and an advanced flight deck display borrowed from its new 787, and calling this modified version the 767-2C. The 767-2C will be built on Boeing’s existing production line. In the second phase, the 767-2C will proceed to the finishing center to become a KC-46. It will be militarized by adding aerial refueling equipment, an aerial refueling operator’s station that includes panoramic three-dimensional displays, and threat detection and avoidance systems. The aerial refueling equipment will allow for two types of refueling to be employed in the same mission—a refueling boom that is integrated with a computer assisted control system, and a permanent hose and drogue refueling system. The boom is a rigid, telescoping tube that an operator on the tanker aircraft extends and inserts into a receptacle on the Air Force fixed-wing aircraft being refueled. Air Force helicopters and all Navy and Marine Corps aircraft refuel using the “hose and drogue” system, which involves a long, flexible refueling hose stabilized by a drogue (a small windsock) at the end of the hose. See Figure 1 for a depiction of the conversion of the 767 aircraft into the KC-46 tanker with the boom deployed. The Federal Aviation Administration has previously certified Boeing’s 767 commercial passenger airplane and will certify the design for both the 767-2C and the KC-46. The Air Force is responsible for certifying the KC- 46 and its military systems. The Air Force will also verify that the KC-46 systems meet contractual requirements and that the KC-46 and various receiver aircraft are certified for refueling operations. KC-46 total program acquisition cost estimates (development, procurement, and military construction costs) have declined from $51.7 billion to $48.9 billion—$2.8 billion or about 5.4 percent—since the program started in February 2011. Most of the estimated decline in costs is due to fewer than expected engineering changes, savings from a competitively awarded aircrew training system contract, and changes in military construction assumptions. The program office projects that the KC-46 will meet all key performance goals, including providing fuel to other aircraft, by the end of development. The total cost to develop, procure, and field the KC-46 has declined by about $2.8 billion from the February 2011 baseline, a 5.4 percent decrease. The decrease is comprised of a reduction of approximately $579 million in development funding, $1.2 billion in procurement funding, and $980 million in military construction funding. Average program acquisition unit costs have declined by the same percent because quantities have remained the same. Table 1 summarizes the initial and current estimated quantities and costs for the KC-46 program. Both the development and procurement cost estimates have declined, in part, because there have not been any major engineering changes since a successful critical design review or significant technical risks that program officials believe need to be addressed moving forward. In addition, the government competitively awarded a contract for an aircrew training system at a lower price than originally projected. The current development cost estimate of approximately $6.6 billion reflects a decrease of about $579 million from the original estimate. The estimate includes $4.9 billion for the aircraft development contract and four test aircraft, $300 million for aircrew and maintenance training systems, and $1.4 billion for other government costs such as program office support, test and evaluation support, and other developmental risks related to the aircraft and training systems. The procurement cost estimate of $39 billion is about $1.2 billion less than the original estimate and will be used to procure 175 production aircraft, initial spares, and other support equipment. The military construction estimate of $3.3 billion includes the projected costs to build or modify aircraft hangars, maintenance and supply shops, and other facilities to house and support the KC-46 fleet. The estimate is $980 million less because of changes in military construction plans. For example, the program will now modify more facilities and construct fewer ones. In addition, the Air Force has decided to pay for some military construction activities out of a central account rather than using program funds. The program office projects that the KC-46 aircraft will meet all of its key performance goals, including receiving fuel from other tankers; providing fuel to about 36 receiver aircraft, according to an Air Force official’s projection; and having a certain amount of fuel to offload at various distances. According to program officials, the current assessment is based on their engineering expertise and the level of effort necessary to meet the requirements. Ultimately, these performance goals will be validated primarily through ground and flight testing. Table 2 includes a description of the program’s key performance goals. In June 2013, the Air Force Operational Test and Evaluation Center published its own independent evaluation of whether the KC-46 aircraft was on track to meet the key performance goals. The center identified a few issues, such as drogue hose instability and 3-D display anomalies that could affect Boeing’s ability to meet the tanker aerial refueling capability key performance parameter. In general though, the center agreed that the program was on track to meet all of the goals based on its interviews with subject matter experts and examination of design documents and laboratory test results. Program officials told us that the center’s next assessment is scheduled to be issued in the fall of 2015 and will be based on flight, ground, and laboratory test data. Boeing has also developed a set of technical performance measures to gauge its progress towards meeting contract specifications and three of the key performance goals, including those related to fuel offload, reliability and maintainability, and operational availability. For example, one measure related to the amount of fuel that the aircraft can carry certain distances (fuel offload versus radius) tracks operational empty weight because, in general, every pound of excess weight equates to a corresponding reduction in the amount of fuel the aircraft can carry to accomplish its primary mission. Table 3 describes the seven technical performance measures, depicts the minimum contractual specification or target for each, and identifies the current status as of December 2014. The program office is projecting that it will meet each of the technical performance measures. For example, program officials currently project that the aircraft will meet the weight target of 204,000 pounds. The program office assesses the measures on a monthly basis, relying on data from testing, models and simulations, prior tanker programs, and actual data (such as aircraft weight). Due to wiring problems, Boeing has had scheduling delays in delivering the first developmental aircraft, even though it met all of its program milestones leading up to the critical design review in July 2013. In addition to using up almost all of the 5 month schedule margin, these problems have led Boeing and the program office to delay the first flight of the first development aircraft by almost 7 months to December 2014, and by 2 months to October 2015. As the KC-46 low-rate production decisiona result of the wiring problems, Boeing only completed 3.5 hours of flight testing in 2014, compared to nearly 400 flight test hours it planned to conduct. Figure 2 illustrates the delays to key milestones since the program began in February 2011. With the program office’s approval, Boeing revised its nearly 2,400 development flight test hour plan to account for wiring-related delays and to focus on demonstrating key KC-46 aerial refueling capabilities that are required for the production decision. Under the revised schedule, Boeing will now complete roughly 22 percent of development flight testing prior to the low-rate production decision compared to its original plan of 66 percent, providing DOD with less flight test knowledge at this program milestone. In addition, only 3 test months will be on a KC-46 prior to the decision compared to the original plan of 13 months. Other development challenges, including late delivery of parts, software defects, and assumptions related to flight test cycle times pose additional risk to the flight test pace needed to demonstrate aerial refueling capabilities. These challenges could result in additional schedule delays. Boeing discovered wire separation issues while it was manufacturing the first development aircraft, which were caused by an inaccurate wiring design. After discovering this in the spring of 2014, Boeing spent six weeks conducting an audit to identify the scope of the problem and develop potential fixes. Wiring on the first development aircraft was over 90 percent complete when the audit started. Boeing officials told us that the audit found thousands of wire segments that needed to be changed. Boeing officials estimate that these changes impacted about 45 percent of the 1,700 wire bundles on the aircraft. Boeing suspended wiring installation on the remaining three development aircraft for several months while it worked through the wiring issues on the first development aircraft. Boeing officials told us that they have resolved the wire separation issues and have resumed manufacturing the second development aircraft. Due to its fixed price contract, Boeing bore the cost to fix the wiring issues, which Boeing officials estimated at approximately $40 million. As a result of these problems, Boeing did not execute the first year of the flight test program as planned, flying only 3.5 hours in calendar year 2014 compared to its plan of flying nearly 400 hours, about 1 percent. Boeing had planned to use four aircraft for flight test activities in 2014; however, it was only able to complete one flight at the end of December 2014 on one aircraft—a 767-2C. That aircraft is not scheduled to make another flight until April 2015 because Boeing has to perform additional work, such as completing ground testing and installing modified body fuel tanks. Boeing projects that the second development aircraft—a KC-46 tanker—will begin testing in June 2015. Boeing revised the development test schedule to acknowledge the wiring- related delays. In doing so, it significantly reduced testing on each aircraft prior to the October 2015 low-rate production decision than originally planned. Figure 3 depicts the decrease in the amount of flight testing prior to the low-rate production decision. Under the baseline schedule, Boeing would have completed 36 months of flight testing across the four development aircraft prior to the low-rate production decision. This would have enabled Boeing to complete about 66 percent of the nearly 2,400 development flight test hours, including aerial refueling demonstration flights that are entrance criteria for that decision, as well as some of the activities necessary to support the start of initial operational test and evaluation.Boeing plans to complete a little more than 8 months of flight testing prior to the low-rate production decision, or about 22 percent of development flight test hours. According to program officials, the vast majority of the KC-46 testing over the next several months will now be spent on demonstrating aerial refueling capabilities—a key data point necessary to hold the low-rate production decision. They also stated that the second Under the revised test schedule, development aircraft—a KC-46 tanker—will be used to support the demonstrations, and any flight test delays of that aircraft will create day for day delays in the program. Flight test delays would also increase schedule risk for later milestones, most notably to the start of operational testing. The revised plan increases concurrency between development test and production, but not significantly. The intent of developmental testing is to demonstrate the maturity of a design and to discover and fix design and performance problems before a system enters production. Our past work has shown that beginning production before demonstrating that a design is mature and that a system will work as intended increases the risk of discovering deficiencies during production that could require substantial design changes and costly modifications to systems already built. The program is also working to resolve other development challenges that pose additional schedule risk to the flight test pace needed to demonstrate aerial refueling capabilities, such as late delivery of parts, software defects, and assumptions related to flight test cycle times. These challenges could result in additional schedule delays. The following is a summary of these development challenges and any steps Boeing is taking to address them. Late delivery of parts for aircraft final assembly: Boeing’s suppliers are having difficulties delivering several key aerial refueling parts. For example, the telescope actuator, which extends and retracts the boom, needs to be redesigned in order to work properly. A redesigned telescope actuator is tentatively scheduled to be delivered in April 2015, enabling the boom that will be used to support the July/August 2015 demonstration flights to be delivered two weeks prior to its June 2015 need date. In another example, the supplier of the wing aerial refueling pod and centerline drogue system is experiencing delays in delivering these subsystems due to design and manufacturing issues with a number of parts. To stay within schedule targets, Boeing and the supplier have developed a plan to complete parts qualification testing and safety of flight testing in parallel. Program officials have said that one of the risks of this parallel approach is that discoveries during safety of flight testing could drive design changes that would then require qualification testing to be re-done. Boeing has sent engineers and other staff to help the aerial refueling suppliers overcome these challenges, and held regular management meetings to stay abreast of the latest developments. Defects in delivered software: Boeing and the program office consider the resolution of software problems as one of the program’s top risks. According to program documentation, open problem reports may have peaked in December 2014, at roughly 780 priority problem reports. Boeing fixed 170 of these problems over the past few months. As of March 2015, however, a little over 600 problem reports were still not resolved, including several hundred that must be addressed prior to the KC-46 first flight, currently planned for June 2015. Many of these problems are related to the military subsystems and either adversely affect the accomplishment of an essential operational or test capability or increase the project’s technical, cost, or schedule risk—and no workaround solution is known. Additional problems may be identified as Boeing integrates the last two software modules related to aerial refueling. Boeing expects to fully integrate these software modules in April 2015, about 10 months later than originally planned. Flight test cycle time assumptions: The program may not be able to meet the established timeframes, or cycle times for flight testing. Both Boeing and the program office regard maintaining the planned flight test rate of 65 hours per month for the 767-2C aircraft and 50 hours per month for the KC-46 aircraft’s military tests as one of the program’s greatest risks. DOD test organizations have shown that the planned military flight test rate is more aggressive than other programs have demonstrated historically. The Director of Operational Test and Evaluation also reported that the test schedule does not include sufficient time to address deficiencies discovered during tests. Despite these concerns, Boeing predicts that it can achieve the flight test rates as it has local maintenance and engineering support and control over the flight test priorities as testing is being conducted at Boeing facilities. Deviations from its proposed flight test cycle times could pose risk to the program’s ability to capture the knowledge necessary to hold the low-rate production decision in October 2015. Boeing provided an updated schedule to the program office in January 2015 that may address some of the risks we highlighted. As part of the updated test plan, the program office and Boeing also revised their approach to conducting operational test and receiver aircraft certification. The new approach re-phases some receiver aircraft certification and shifts test execution responsibility for 10 receiver aircraft from Boeing to the government. This approach may result in adding additional risk to the program should the Air Force fail to complete the testing on time. The new schedule and associated contract modifications are expected to be approved by early 2015. Program officials stated that they are reviewing the information to determine whether they need to further adjust milestone dates, including the low-rate production decision and the start of operational test. That analysis has not yet been completed. The program office and Boeing continue to collect most of the necessary manufacturing knowledge to make informed decisions as the program approaches its low-rate production decision in October 2015. However, the program is behind in some of these activities, which will make it difficult for program officials to assess the reliability of the aircraft prior to production, and could also mean less efficient production processes. Last year we began reporting on the program’s efforts to capture manufacturing knowledge that is important to make a well informed low- rate production decision. This knowledge is based on practices we identified in previous work that are used by leading commercial companies, including (1) identifying key system characteristics and critical manufacturing processes; (2) establishing a reliability growth plan and goals; (3) conducting failure modes and effects analysis; (4) conducting reliability growth testing; (5) determining whether processes are in control and capable; and (6) testing a production-representative prototype in its intended environment. Table 4 provides a description of these activities and progress the KC-46 program has made for each. Identify key system characteristics and critical manufacturing processes: Since the 767-2C will be manufactured on Boeing’s existing 767 production line, the program office and Boeing have focused their attention on identifying the key system characteristics and critical manufacturing processes for the military unique subsystems. They have identified these processes and completed two prior rounds of assessments in support of the preliminary and critical design reviews. Currently, they are assessing nine critical manufacturing processes for low-rate production, such as the assembly and installation of aerial refueling components. Six of the assessments have been completed, including the assembly and test of the wing aerial refueling pod and centerline drogue system that had been delayed over four months. As mentioned previously, the supplier has had difficulty delivering these subsystems on time due to design and manufacturing issues with a number of parts. The program did not identify any action items for two of the completed assessments. For the other four, Boeing must undertake several actions, including developing a plan on how it would qualify and deliver key parts on time, such as the telescope actuator and the refueling receptacle panel. The remaining three assessments are expected to be completed in early summer 2015. The results were not available for us to analyze during this review. Set reliability growth plan and goals: The program office has established a reliability growth curve and goal. To assess reliability growth, the program is tracking the mean time between unscheduled maintenance events due to equipment failure, which is defined as the total flight hours divided by the total number of incidents requiring unscheduled maintenance. These failures are caused by a manufacturing or design defect and require the use of Air Force resources, such as spare parts or manpower, in order to fix them. The program has set a reliability goal of 2.83 flight hours between unscheduled maintenance events and expects to be at 2 hours at the start of initial operational test and evaluation. Since the first flight dates have slipped on all four development aircraft, the program will likely have less reliability knowledge than planned prior to its low-rate production decision. Conduct failure modes and effects analysis: Boeing has completed the initial failure modes and effects analysis that covers 41 subsystems and plans to update it as flight testing is conducted. Boeing and the program office rely on this analysis to determine which subsystems on the aircraft are likely to fail, when and why they fail, and whether those subsystems’ failures might threaten the aircraft’s safety. Conduct reliability growth testing: Boeing has taken steps to improve the aircraft’s reliability, but is behind in its reliability growth efforts because of delays to the start of development flight testing. Boeing is currently testing prototypes of critical parts, uncovering failures, and incorporating design changes or manufacturing process improvements. For example, program officials told us that Boeing has initiated testing in its labs and facilities and its subcontractors’ equipment must pass specific test procedures to be considered acceptable. Boeing conducted the 767-2C first flight at the end of December 2014, which will allow the program to begin tracking the aircraft’s reliability against the growth curve (i.e., in terms of mean time between unscheduled maintenance). However, this was almost seven months later than planned. Detecting reliability problems early lessens the impact on the development and production programs. In addition, if problems are not detected until after an aircraft has been fielded, it could result in a reduction in mission readiness and higher than expected operations and sustainment costs because the aircraft have to be fixed. Determine processes in control and capable: The program has started activities to determine whether manufacturing processes are in control and capable of producing parts consistently with few defects. The program’s review of critical manufacturing processes for the military unique subsystems involves evaluating several risk areas, including whether processes are in control and capable. Program officials said that they plan on verifying that military subsystem suppliers have procedures in place to collect process control data prior to the low-rate production decision. They told us they do not plan on analyzing that data, but will rely on Boeing for process control management. Test a production-representative prototype in its intended environment: The program has not begun testing a production-representative KC-46 tanker in its intended environment. As discussed previously, the program planned to have 13 months of flight testing between two fully configured KC-46 tankers by the low-rate production decision. Due to program delays, it is likely to complete only three months of flight testing on one fully configured KC-46 tanker prior to this decision. While this increases the risk of discovering costly problems late in development, when the more complex software and advanced capabilities are tested, contract provisions specify that Boeing must correct any required deficiencies and bring development and production aircraft to the final configuration at no additional cost to the government. The next several months are critical to Boeing’s ability to demonstrate that the KC-46 can successfully perform its aerial refueling mission and that the company is ready to start producing the aircraft. Based on our analysis, Boeing is at risk of not meeting the entrance criteria needed to support the projected October 2015 low-rate production decision, and will have less knowledge about the reliability of the aircraft than originally planned. The small schedule margin that was built into the program has eroded, largely due to problems Boeing experienced while wiring the aircraft. Only one flight test has been conducted to date on a 767-2C aircraft. No flight testing has been conducted on a KC-46 tanker. The flight test pace it now hopes to achieve to support the low-rate production decision is in jeopardy because of late deliveries of key aerial refueling parts, a large number of software defects that need to be corrected, and optimistic flight test cycle assumptions. Although Boeing should bear the costs of any design or manufacturing problems that may occur, the department must be careful not to hold the low-rate production decision and award a production contract before it has adequate knowledge that the KC-46 can perform its aerial refueling mission. Given that the KC-46 program has encountered significant delays to the start of development test and the schedule moving forward remains risky, we recommend that the Secretary of Defense direct the Air Force to ensure that key aerial refueling capabilities are demonstrated prior to the low-rate production decision. The Air Force provided us with written comments on a draft of this report, which are reprinted in appendix II. The Air Force concurred with our recommendation. The KC-46 program office plans to collect all required data prior to the low-rate production decision, including the demonstration of key aerial refueling capabilities. We also incorporated technical comments from the Air Force as appropriate. We are sending copies of this report to the appropriate congressional committees; the Secretary of Defense; the Secretary of the Air Force; and the Director of the Office of Management and Budget. The report is also available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-4841 or sullivanm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. Appendix I: Status of Prior GAO Recommendations GAO report Recommendation GAO-12-366 DOD should (1) closely monitor the cost, schedule, and performance outcomes of the KC-46 program to identify positive or negative lessons learned and (2) develop metrics to track achievement of key performance parameters. Actions taken by DOD Program is in the process of compiling a list of lessons learned and has developed metrics to track the achievement of key performance parameters. GAO-13-258 DOD should (1) analyze the root causes for the rapid allocation of management reserves and (2) improve the KC-46 master schedule so that it complies with best practices. Program is monitoring the use of management reserves on a monthly basis and is in the process of updating the master schedule so that it complies with best practices, such as including all government activities. GAO-14-190 DOD should determine the likelihood and potential effect of delays on total development costs and develop mitigation plans as needed. The program completed its cost and schedule risk assessment in February 2015. Michael J. Sullivan, (202) 512-4841 or sullivanm@gao.gov. In addition to the contact named above, Cheryl Andrew, Assistant Director; Rodney Bacigalupo; Jeff Hartnett; Katheryn Hubbell; John Krump; Robert Swierczek; and Ozzy Trevino made key contributions to this report.

Summary: Aerial refueling—when aircraft refuel while airborne—allows the U.S. military to fly farther, stay airborne longer, and transport more weapons, equipment, and supplies. Yet the mainstay of the U.S. tanker forces—the KC-135 Stratotanker—is over 50 years old. It is increasingly costly to support and its age-related problems could potentially ground the fleet. As a result, the Air Force initiated the $49 billion KC-46 program to replace the aerial refueling fleet. The program plans to produce 18 tankers by 2017 and 179 aircraft in total. The National Defense Authorization Act for Fiscal Year 2012 included provisions for GAO to annually review the KC-46 program through 2017. This report addresses progress made in 2014 towards (1) achieving cost and performance goals, (2) meeting schedule targets, and (3) gathering manufacturing knowledge prior to the low-rate production decision. GAO analyzed key program documents and discussed development and production plans and results with officials from the KC-46 program office, other defense offices, and the prime contractor. The KC-46 acquisition cost estimate has declined by about 5.4 percent from $51.7 billion to $48.9 billion since February 2011 and the program is on track to meet performance goals. Most of the estimated cost decline is due to fewer than expected engineering changes and changes in military construction plans. The Air Force delayed the production decision two months, to October 2015, due to wiring problems that Boeing experienced that delayed aircraft delivery and testing. For example, Boeing completed 3.5 hours of flight testing during a single flight of the 767-2C (a precursor to the KC-46 tanker) in 2014, compared to nearly 400 flight test hours it planned to conduct. With program office approval, Boeing restructured its nearly 2,400 development flight test hour plan to focus on demonstrating key KC-46 aerial refueling capabilities required for the production decision. Significantly less testing will now be conducted prior to the decision and only three test months will be on a KC-46, compared to the original plan of 13 months. This testing is intended to demonstrate design maturity and fix design and performance problems before a system enters production. Boeing remains at risk of not being able to demonstrate the aerial refueling capabilities in time to meet the new production decision date due to late parts deliveries, software defects, and flight test cycle assumptions, which could result in additional delays. Program officials are gathering manufacturing knowledge to support a production decision, such as determining if suppliers can produce military subsystems in a production environment. However, the program office will have less knowledge about the reliability and performance of the KC-46 than planned because of reduced testing prior to the decision. While this increases the risk of discovering costly problems late in development, contract provisions specify that Boeing must correct these at no cost to the government. GAO recommends that the Air Force ensure that key aerial refueling capabilities are demonstrated prior to holding the production decision. The Air Force concurred with the recommendation.