RSS

Airplane Certified by FAA Despite Concerns

Mon, Sep 29, 2008 — David Evans

Articles

At a recent Aviation Subcommittee hearing into the controversial certification of the Eclipse EA-500 Very Light Jet (VLJ), the chairman, Rep. Jerry Costello (D-IL), led off with this hypothetical, “For the past few years, I have asked the question – does the Federal Aviation Administration (FAA) have adequate resources to accomplish its mission?” It may be more pertinent to ask, for whom does the FAA believe it works? For pilots and the traveling public, or the airlines and the manufacturers?

Image

“Based on the revelations that unfolded at the hearing, the FAA clearly “accommodated” the wishes of an upstart manufacturer, granting all that it asked for, when it was asked for, accepted shortcomings in design and shelved critical safety issues to be solved at a later date.As an example, according to Calvin Scovel, the Department of Transportation Inspector General (DOT/IG), the FAA accepted an “IOU” from Eclipse, to the effect that avionics software would meet the accepted industry standard at a later date – after certification.

The Eclipse EA-500 Very Light Jet (VLJ) was the first of this new class of aircraft to be certified by the FAA. Mid-level FAA officials assert their concerns were overridden in the haste to certify the airplane by 30 September 2006.

“Are IOU’s commonplace?” asked Costello.

They’re usually issued for non-safety related items, replied Scovel, who pointed out, “In this case, the IOU was granted for flight-critical software.”

Lost in this discussion was the fact that there is no regulatory definition of an “IOU,” much less any definitive dates or times by which IOUs must be resolved. The term “IOU” was bandied about as if this were some sort of semi-approved category for systems that didn’t meet certification standard, in order for the airplane design to move on and complete certification. There is no regulatory category defined as an “IOU” that allows a deficient product to be put into revenue service in the marketplace. If the issuance of an “IOU” is a “common practice” the FAA has developed, it circumvents the agency’s own regulatory certification standards.

Rep. James Oberstar (D-MN), Chairman of the Transportation & Infrastructure Committee, was closer to the gut issue, the FAA’s Customer Service Initiative. Under this program, or slogan, actually, the agency held up airlines and the manufacturers as the people the agency works for, and woe to the mid-level FAA employee who does not understand this mission.

Citing English poet Geoffrey Chaucer, Oberstar said, “If gold rusts, what of iron?” In other words, if the FAA, the supposed “gold standard” among regulatory agencies around the world, is corrupted by rust – that is, confusion about who it works for – then we are in trouble.

“In this case, the FAA remains steadfast in its assertion that no federal regulations were violated,” Oberstar said. “However, when the findings of this investigation are viewed in total, there is a disturbing suggestion that there was another ‘cozy relationship’ and reduced level of vigilance on the FAA’s part during the process of approving the type certificate and the production certificate of the Eclipse EA-500.”

The “IOUs” seem to be one means of putting the Customer Service Initiative into action on behalf of a manufacturer.

By “another cozy relationship,” Oberstar was referring to the 3 April committee hearing, where a brace of mid-level FAA employees said their safety concerns with Southwest Airlines and American Airlines were over-ruled by senior officials at FAA headquarters in Washington DC. (See Aviation Safety & Security Digest, ‘Committee Vows to Legislate Changes to Strengthen Oversight of Airlines,’ archives.)

At the 17 September hearing, the same situation played out, this time with a manufacturer instead of airlines under the microscope. There was the usual table of mid-level FAA witnesses, this time from the Ft. Worth Aircraft Certification Office (ACO) and from the San Antonio Manufacturing Inspection District Office (MIDO), testifying that the type certification was rushed and that the production certificate was issued before Eclipse could demonstrate an ability to replicate the design in mass production. Many of these individuals were still employed by the FAA, prompting Costello to warn senior agency officials that he would be on the lookout for any retribution taken on them for speaking out.

The local FAA officials were followed by a table full of senior FAA officials from Washington, who defended their actions by saying, basically, they had the big picture and the locals just weren’t thinking “outside the box” to approve the EA-500 design and its manufacturing.

The DOT/IG, Scovel, led off the hearing, with results of his investigation (still ongoing):

“What this case is about is a strikingly accommodative behavior to certify an aircraft by a date set a year before … The FAA should have developed certification standards in advance of VLJ. The FAA acknowledged that Part 23 [which apply to light airplanes] regulations were ‘not valid’ for certifying the VLJ.”

Rep. John Hall (D-NY) noted, “We’ve seen the cozy relationship too often. First, it was with the airlines and now with the manufacturers.” He pointed out that the situation over certification of the EA-500 grew so toxic that the manager of the San Antonio MIDO, Ford Lauer, purchased liability insurance for himself.

When asked about this insurance policy by Oberstar, Lauer replied: “I took out the policy because I wasn’t free to look at all aspects of the airplane for which I was responsible; so I just wasn’t comfortable.”

This is not exactly a vote of confidence that the airplane is safe for operation by average pilots – which is the FAA standard.

And while this matter wasn’t explored at the hearing, it was mentioned: managers at FAA headquarters were given bonuses for certifying the EA-500 by the end of fiscal year 2006 (which may have much to do with the unusual issuance of certification on Saturday, 30 September 2006). However, an FAA official told this publication on 24 September, “No one received a bonus tied to the Eclipse certification.” The operative word seems to be “tied,” as bonuses for superior performance were clearly paid.

On the other hand, FAA employees at the ACO and MIDO were penalized. Tomasa Dipaolo of the National Air Traffic Controllers Association, which represents them, said:

“Some engineers were penalized for keeping the safety of the Eclipse 500 a priority over the speed of certification. Several reported receiving poor performance reports based solely on the content of their technical finding. Because they found safety problems in the design of the Eclipse 500, whose correction might result in a delay to certification, they were denied bonuses.

“The problem with the Eclipse 500 is not the relatively narrow issue of a faulty aircraft; it is the far broader issue of an Agency with flawed priorities. The FAA has abandoned its safety culture and shirked its responsibility to keep the flying public safe.”

Oberstar kept coming back to the FAA’s Customer Service Initiative, the subject of much critical commentary at the 3 April hearing on airline compliance with maintenance dictums. At that hearing, it was plainly evident that the airlines, not the flying public, were the FAA’s customers.

In late July, the House passed legislation that would require modification within 90 days of the Customer Service Initiative, specifically:

  • To remove any reference to airlines or “other entities regulated by the Agency” as “customers.

  • To clarify that the only customers of the agency are “individuals traveling on aircraft, and,

  • That the FAA Administrator shall “ensure that safety is given a higher priority than preventing the dissatisfaction of an air carrier or other entity regulated by the Agency.”

This desire for change to the Customer Service Initiative was made plain at the 3 April hearing, and Oberstar pointedly asked Nicholas Sabatini, the most senior FAA official at the 17 September hearing, if the words had been changed. Simply put, the answer was no.

Oberstar sniffed that the Customer Service Initiative “may be abolished legislatively, even if the FAA strikes it.”

It should be pointed out that Eclipse exploited the Customer Service Initiative, complaining directly to FAA headquarters when it perceived it was not getting satisfaction from the local certification officials.

Dipaolo offered what may be a more effective means of assuring that the FAA hews to safety first:

“The FAA’s pay for performance system should only include goals that directly address the degree of safety and public protection maintained. Goals mandating certification deadlines encourage management to pressure their employees into hasty certification, potentially compromising the integrity and safety of the project.”

What Congress may not appreciate is the degree to which the airlines and manufacturers are accommodated in the regular conduct of the FAA’s business. Four examples will suffice to make the point:

(1) The service difficulty report (SDR) system only applies to incidents that occur while airborne – for example, an engine shutdown. The FAA proposed extending the SDR to report incidents on the ground – such as takeoff configuration problems – but this initiative was strenuously objected to by the airlines, and as a result was dropped by the FAA.

(2) Cost-benefit calculations are required for every safety initiative, but one has to ask, who benefits from these calculations? In many cases, the cost-benefit calculations are used to discourage a safety initiative. There are many ways to “game” the costs for an entire fleet of aircraft. An alternative would price a safety initiative as the cost per ticket, which is considerably less than the millions of dollars frequently served up to justify inaction.

(3) The FAA involves airlines and manufacturers in the Aviation Rulemaking Advisory Committee (ARAC) process, by which they influence and shape the rules they must then adhere to. The sick joke is that ARAC really stands for “All Rulemaking Activity Ceases.”

(4) The FAA frequently grants Special Conditions for certifying an aircraft design. These Special Conditions are frequently issued because certification standards have not kept pace with the march of technological progress. What is clear from a reading of dozens of these provisions is that they are written by the manufacturer or hew closely to what the manufacturer proposes.

Congress could hold hearings for a month on the many ways in which the FAA treats airlines and manufacturers as its customers.

In the meantime, the statements that follow on the EA-500 certification hearing demonstrate the depth of the problem at FAA headquarters and the attitude of denial that there is a problem. If FAA officials can say the EA-500 certification violated no rules, the rules themselves need to be examined.

– Statement of Rep. James Oberstar (D-MN), Chairman Committee on Transportation & Infrastructure:

“(The) Federal Aviation Administration (FAA) rushed to approve both the type (TC) and production certificates (PC) of a new aircraft, the Eclipse EA-500, despite safety concerns raised by a number of FAA certification engineers and aviation safety inspectors over the design and manufacture of the aircraft ….

Image

“There are disturbing similarities between the testimony we will hear today, and the hearing we held on April 3rd involving regulatory abuses at the FAA office charged with overseeing Southwest Airlines. Once again, we will hear how the FAA’s ‘Customer Service Initiative’ mistakenly treats those who are the subject of regulation as the ‘customer,’ and how it has the potential to create conflicts with the FAA’s one and only mandate – safety.

“The FAA’s only responsibility should be to respond in a timely fashion to an applicant’s approval documentation and to provide a ‘yes’ or ‘no’ decision on whether an aircraft is ready for safe certification.”

Rep. James Oberstar, Chairman, full Committee on Transportation & Infrastructure

“There are disturbing similarities between the testimony we will hear today, and the hearing we held on April 3rd involving regulatory abuses at the FAA office charged with overseeing Southwest Airlines. Once again, we will hear how the FAA’s ‘Customer Service Initiative’ mistakenly treats those who are the subject of regulation as the ‘customer,’ and how it has the potential to create conflicts with the FAA’s one and only mandate – safety.

“I fear that complacency may have set in at the highest levels of FAA management, reflecting a pendulum swing away from vigorous enforcement of compliance, toward an industry-favorable, cozy relationship. This time it involves a manufacturer instead of an airline ….

“With the significant risks posed by a new aircraft, powered by new technology, and produced by a new manufacturer, it seems logical to have expected the FAA to exercise much greater scrutiny than in the typical certification program with an established manufacturer such as Airbus, Boeing, Cessna, etc. Moreover, the EA-500 represented an entirely new class of aircraft, and did not easily fit into the FAA’s normal certification regime. The EA-500 has advanced avionics and turbine engine technology more characteristic of a large transport aircraft. Its only commonality with a typical general aviation aircraft is its light weight and small passenger capacity. However, the FAA chose to use certification requirements for general aviation aircraft rather than the more rigorous requirements that should be required of aircraft with a greater degree of complexity ….

“FAA actually had the audacity to put in its performance plan that the Eclipse would be certified by September 30, 2006 – a Saturday, and also the end of Fiscal Year 2006, coincidentally. How could the FAA possibly know when the aircraft would be ready for certification? ….

“It is also interesting to note that the FAA Rotorcraft Certification Directorate in Fort Worth, Texas, which was assigned primary responsibility for evaluating the EA-500, appears to have been very diligent in its attempt to adhere to established certification regulations and appears to have performed admirably. However, their decisions and recommendations were routinely overruled by higher-level FAA management, with ‘customer service’ to Eclipse looming as a strong influence ….

“(It) appears that when design deficiencies were identified that appeared to be non-compliant with FAA certification requirements, senior FAA management became personally involved, overruled lower-level engineers and inspectors, worked diligently to find ‘work-arounds,’ to find ‘alternative approval rationales and techniques,’ and to accept ‘IOUs’ for later compliance. In many ways, the certification process in this case was conducted ‘backwards’ from the clear intent and requirements of FAA certification regulations. Instead of certifying on the basis of safety alone, FAA senior management appeared to be highly motivated to find ways to explain why design deficiencies identified by FAA engineers and inspectors as ‘unsafe’ were indeed ‘flawed,’ but they were still ‘acceptable for certification’ by simply changing the approval criteria … Thus, the allegations and findings in this case are cause for concern and suggest the immediate need for a broad policy review of FAA certification practices.”

– Statement of Rep. Jerry Costello (D-IL), Chairman Subcommittee on Aviation:

“I am extremely disappointed that the FAA again lacks the ability to oversee its programs – in this case its certification programs. Unfortunately, this hearing will expose an agency that is as interested in promoting aviation and befriending manufacturers as it is in carrying out its number one responsibility of protecting safety and the flying public ….

“One of the most disturbing findings to me in the IG’s report is that instead of mandating that problems be resolved, the FAA accepted ‘IOUs’ from Eclipse to resolve the problems at a later date. In this case, an ‘IOU’ was allowed on the avionics system that ran the plane. I question the practice of using ‘IOUs’ in any instance. However, to use an ‘IOU’ on the avionics system that is used to run the EA-500 which has no stand-by instruments (also known as back-up systems) from a new manufacturer, who has no prior experience and on a system so critical to the aircraft is unbelievable!

“It gets worse – according to the FAA’s own testimony on page 10 and 11, Eclipse delivered 11 EA-500s to customers prior to the completion of the ‘IOU’ on this critical avionics system. In an exchange of letters which I will submit for the record, Eclipse was to ‘retain control of the aircraft’ until the issue was closed out. Clearly, that did not happen …

“I have said time and again safety cannot be compromised. In this case the FAA is treating manufacturers like ‘customers,’ instructing its employees to ‘build relationships with our customers’ instead of acting like regulators. For example, the FAA’s own test pilots said the EA-500 should not be certified as a single pilot plane because of in-flight concerns such as complexity of new software and a minimally effective autopilot system and FAA agreed. Eclipse filed a customer service complaint against the FAA and the agency immediately reversed course and certified the plane as single pilot. In addition, the European Aviation Safety Agency (EASA) refused to certify the EA-500 for operations for a variety of reasons, including single pilot operation concerns ….

Finally, we have seen a pattern at the FAA of an agency that is reactive – not proactive. Only after getting briefed by the IG on the Eclipse certification issues and on the IG’s recommendation did the Acting Administrator, Bobby Sturgell, convene a review team to do an audit of the certification programs. The FAA seems to be on autopilot until pushed into action by the Aviation Subcommittee, the IG or the media.

“It is not enough to have safety regulations in place. The FAA must enforce those regulations … We expect and deserve more!”

– Testimony of Calvin Scovel, Department of Transportation Inspector General (DOT/IG):

“ …. In March 2007, our office received a complaint concerning the certification process for the Eclipse EA-500. The complainant alleged that senior FAA officials prevented FAA inspectors from properly inspecting the production of the Eclipse jet by, among other things, reassigning the inspectors who had identified numerous deficiencies …

“During our ongoing investigation of the allegations, other FAA employees raised additional concerns that senior officials in FAA’s Aircraft Certification Service shortcut both the design and production certification processes. The complaints alleged that those officials may have compromised safety by (1) certifying Eclipse’s design despite knowledge of Eclipse’s failure to meet certification requirements for avionics software, stall warnings, flaps, and cockpit screens and (2) rushing approvals required for Eclipse to mass produce its jet ….

“FAA chose to certify the EA-500 and other VLJs using certification requirements for general aviation aircraft rather than the more stringent certification requirements for larger transport aircraft. However, in a post-design certification, ‘lessons learned’ internal review of the Eclipse project, FAA managers acknowledged that the general aviation certification requirements were ‘inadequate to address the advanced concepts introduced on this aircraft.’ ….

“FAA granted Eclipse a production certificate on 26 April 2007. However, a production certificate is FAA’s approval that the manufacturer has demonstrated the ability to manufacture aircraft using an FAA-approved design without further airworthiness inspections. To obtain a production certificate, manufacturers are required to undergo FAA quality control reviews and an FAA Production Certification Board review to determine if they have complied with all regulations. FAA’s quality control reviews … identified numerous deficiencies, with 42 serious deficiencies (including 4 involving software) identified as late as February 2007.

“The Production Certification Board completed its review on 26 April 2007 – the same day the production certification was granted – and identified two serious, overarching deficiency issues … Despite the impact … FAA awarded the production certification to Eclipse with 13 specific production problems.

“Additionally, before it received its production certification, Eclipse encountered numerous problems replicating its own aircraft design on the factory floor … For example, in one instance, Eclipse presented an aircraft to FAA for airworthiness certification with approximately 20 airworthiness deficiencies, even though an FAA-approved Eclipse inspector had previously inspected the aircraft for airworthiness and found no non-conformities ….

“FAA granted Eclipse Organizational Designated Airworthiness Representative (ODAR) authority to certify its own aircraft for airworthiness 4 years before Eclipse obtained a design certificate. This authority allowed Eclipse to approve and document parts as they were manufactured, with Eclipse inspectors overseeing manufacturing processes on FAA’s behalf. However, it is unclear to us why FAA determined that Eclipse met the qualifications to perform its own inspections since Eclipse was a new manufacturer with no history of manufacturing an aircraft or shepherding a design through the design certification process ….

“The Eclipse EA-500 is a technologically advanced aircraft with an integrated avionics system that controls several of the aircraft’s crucial systems and displays, sensor data processing, and subsystem monitoring. For example, this system enables the flight crew to control landing gear, cabin pressurization, lighting, trim, and electrical systems.

“This integrated system also handles key data that flows to the aircraft’s flight management system, such as global positioning (GPS) altitude, direction, and velocity data. The EA-500’s avionics system is solely computer-based; it does not have stand-by instruments to monitor flight-critical information (other VLJs like the Cessna Mustang have back-up [analogue] systems; see fig. 2 below).

Image

“During the EA-500 design certification, Eclipse applied and FAA approved alternate means of compliance for the aircraft’s avionics software. Given the EA-500’s dependence on its avionics software, we would have expected FAA to perform rigorous analysis and testing prior to design certification. We found, however, that FAA did not require this software to be approved to the accepted industry standard before certification. Instead, FAA accepted an ‘IOU’ from Eclipse, which stated that the aircraft would meet the accepted industry standard at a later date. In exchange, Eclipse agreed to maintain control of the aircraft – meaning that it would not be released to customers ….

“We also spoke with FAA inspectors …who stated that the FAA’s proposed actions of accepting an IOU from the manufacturer were so contrary to its long-established business practices that they did not meet the safety standards normally required of other applicants ….

“FAA regulations state that the electronic display indicators must be designed so that if one display fails, another display would remain available to the crew without the need for immediate action by the pilot for continued safe operation. The cockpit display is critical instrumentation for the pilot; it displays vital information such as airspeed, altitude, flap position, and rate of climb. In the case of the EA-500, the cockpit display is even more critical because there is no back-up, analogue instrumentation.

“In order to award the design certificate, FAA permitted Eclipse to fix the software ‘bug’ that caused the screen banking after the design certification was issued. However, Eclipse was not able to do so until 18 January 2007 – nearly 4 months after the design certification was awarded. While this fix appeared to address the software ‘bug,’ our analysis of SDRs [service difficulty reports] (submitted) by the largest user of the EA-500 between June 2007 and July 2008 disclosed one instance of cockpit screen blanking that occurred during the final approach for landing ….

“FAA regulations state that the main wing flaps must be designed so that the occurrence of flap failure is ‘extremely improbable.’ However, both before and after the design certificate was awarded, the aircraft had problems with flaps sticking in position. The impact of this on the aircraft is that a ‘flaps up’ landing can require up to 100 percent more landing distance. This landing length may not be available for every general aviation pilot who flies the EA-500, which is not equipped with anti-skid brakes. During testing of the aircraft in December 2006, FAA’s Flight Standardization Board recommended that it be restricted to two-pilot operations, stating:

The immediate issue that has caused the Board to reach this conclusion is the repeated flap failures that have occurred during recent flights. These failures are now approaching a frequency of one flap failure for every 10 attempts to operate the flaps. The flight control problem affects safety of flight and acceptable operational reliability.

“FAA Headquarters officials overruled the Board’s recommendation and approved it for single-pilot operations in January 2007 after receiving a customer service complaint from Eclipse. While only 1 instance of flap failure was reported through an SDR after design certification, our analysis of SDRs from the largest EA-500 user … disclosed 21 reports of other flight control part malfunctions (i.e., rudder, flaps, aileron, and elevator) ….

“FAA asserts that none of the current problems experienced by EA-500 users were identified during the design certification. However, in our opinion, there is sufficient evidence that these problems were occurring during that period and that FAA should have known about them.

“For example, in the 2 weeks preceding award of the design certification on 30 September 2006, Eclipse test-flew the aircraft for 100 hours as a pre-condition for receiving the certification. During those flights, the pilots experienced (1) at least 4 erroneous stall warnings during landing, (2) 10 instances of cockpit screen freezing or blanking, and (3) 18 cases of actual flap failure or flap-failure messages on the cockpit display. All of these are problems that users continued to report after design certification. Table 1 shows the design problems that occurred before and after FAA awarded Eclipse its design certification:

Image

“Based on the results of our investigation to date, the conclusions in FAA’s lessons-learned review, and – most importantly – the problems that continue to impact pilots, we believe that the FAA should have exercised greater diligence in certifying the EA-500 design ….”

– Testimony of David Downey, FAA (retired), former Manager, FAA’s Rotorcraft Division:

“There have been characterizations regarding professional competence and conduct that are unfair and unmerited …

“The events leading to (Eclipse EA-500) problems are numerous and somewhat complicated …

“This was a company that aspired to go from a production rate of zero to 150 in the first year (2006) and 600 their second year (2007) – unheard of in the aviation industry and unrealistic. Further, this was a company that wanted to gain its engineering approval – a.k.a. TC, its production approval, or PC, its Repair Station Certificate and have aircraft awarded their Standard Airworthiness Certificate all within 15 days. That would be similar to a student going to college for 4 years and expecting to get two BS’s and a Master’s all on the same day – possible – but highly unlikely. No amount of FAA ‘coaching’ would dissuade (Eclipse) executives and staff that this feat was not practical and overly ambitious ….

“(Eclipse) had over the previous years established a legacy of not meeting its commitments to the FAA. (Eclipse) rarely submitted a report on time, yet had the gall to drop a report on the FAA and want approval immediately ….

“On 14 September 2006, a late afternoon meeting was convened with the FAA employees involved with the (Eclipse EA-500) in an Albuquerque hotel. In attendance were the pilots, inspectors, engineers and four FAA executives. Among the executives was the Director, Aircraft Certification Service [John Hickey, a later witness at the hearing]. It was completely clear to all employees present that the current approach to the software certification on the EA-500 was not going to meet the EA-500 calendar schedule or the Service Director’s timetables. As an aside, during my Software class at the Defense Systems Program Management course, we were taught that software should be event driven not calendar driven … The field FAA experts were justifiably unconvinced of Eclipse’s ability to perform.

“In this 14 September meeting, the FAA Software Engineer, Mr. Wallace, tried to convey to the Service Director [Hickey] that the Eclipse approach would not follow the established FAA procedures and was sorely lacking in meeting the agency’s established and time-tested software certification procedures, not to mention Eclipse and their vendor never meeting a calendar date for a data submission. Mr. Wallace was summarily subjected to a verbal barrage that conveyed that he, Mr. Wallace, was not able to think ‘outside the box.’ It was at this point that I interjected myself between my staff employee and the Service Director [Hickey]. My ‘taking up’ for him resulted in my dressing down and a humiliating verbal assault in front of my subordinates and peers.

“In 35 years of public service as an Army officer and FAA employee, I have never suffered an experience as denigrating or unwarranted. It was clear to those present that Mr. Hickey was passionately making the case for thinking outside the box, however, the box must still be within the bounds of regulatory compliance and appropriate risk management. I have heard this Albuquerque meeting characterized as Mr. Hickey’s passion for meeting customer needs and thinking outside the box. I would characterize it as an assault on our professionalism and our character.”

– Testimony of Thomas Haueter, Director, Office of Aviation Safety, National Transportation Safety Board (NTSB):

“Although the Safety Board is not directly involved in aircraft certification and manufacturing processes, the Board strives to improve aviation safety through detailed accident and incident investigations and subsequent recommendation. To date, the Board has conducted five investigations involving Eclipse 500 airplanes … four events have occurred since April 2008 and the investigations are still ongoing ….

“Regarding the June 2008 incident at Chicago Midway International Airport, the flying pilot reported that, while crossing the runway threshold for a landing attempt, the airplane encountered a 10 to 15-knot windshear and developed a high sink rate, which the pilot arrested by applying power [this aircraft, per the operator’s policy, was operated by two pilots]. The airplane’s touchdown was normal, and the pilot retarded both thrust levers to idle. However, shortly afterward, the pilot found that the airplane was accelerating rapidly through 100 knots. The pilot confirmed that the thrust levers were at idle, but he noted that the engines were at maximum power and that the airplane was continuing to accelerate. Because the airplane was rapidly approaching the end of the runway and could not be slowed, the pilot decided to abort the landing.

“As the airplane was climbing out, the pilots found that the thrust lever position had no effect on the power from either engine. The flying pilot lowered the flaps and landing gear to control the airplane’s speed. However, the pilots found that to remain below 200 knots, which is the maximum operating speed for the flaps and landing gear, the airplane needed to maintain a shallow climb. The pilots declared an emergency and were cleared by the air traffic control tower to land on any runway.

“The pilots noted that the airplane’s engine indicating and crew alerting system displayed that the left and right engine full authority digital electronic controls, or FADECs, had failed. The pilots [referred to] the quick reference handbook’s emergency procedures section for engine control failure, which contained instructions for a single engine control failure but not for a dual engine control failure. The procedure advised that, when one engine control failed, its respective engine should be shut down. Thus, the pilots shut down the right engine and began to maneuver the airplane toward the runway. However, shortly afterward, they noted that the left engine was at idle and would not respond to the thrust lever commands. Fortunately, the airplane had sufficient altitude to reach the runway for a successful landing. Without the resourcefulness of the pilots, the visual meteorological conditions that prevailed at the time, and the airplane’s proximity to the airport, the successful completion of this flight would have been unlikely.

“The Eclipse 500 airplane does not have any mechanical linkage or cables between the thrust levers and the engines. Instead, the airplane’s thrust levers are connected to the engines’ FADECs by electrical wiring. Each FADEC continuously checks itself and the opposite engine’s FADEC to ensure that all of the components are working correctly. Each engine control has two separate channels: one is in control, and the other stands by to become active if a component in the active channel fails. If both channels fail, the FADEC software will continue to control its engine by reading data from the opposite engine. If both channels fail on both engines’ thrust levers, the FADEC software is programmed to ignore the thrust levers’ positions and maintain the requested thrust level at the last valid thrust lever position.

“Test have found that, when the thrust levers on the Eclipse 500 were pushed against the maximum power stops using a normal application of force – that is, a force that a pilot might normally use during flight – it was possible to cause the control system to detect an out-of-range setting that would result in an engine control failure. These faults could be cleared by cycling the electrical power to the FADECs.

“The findings of the investigation to date indicate it is likely that the pilot advanced the thrust levers up to the maximum power stops when reacting to the windshear to arrest the sudden increase in the sink rate. This action likely caused the dual channel failures in both thrust levers. Then, because of the programming logic of the FADEC software, the engines maintained the thrust level of the last valid thrust lever position. In this case, that position was at, or nearly at, maximum power, so the engines remained at that high power setting.

“During this incident, the fault in the right engine was cleared when the flight crew shut down that engine. However, because the FADEC software was programmed so that the left engine would mirror the thrust lever position of the no-fault right engine, which was positioned at idle after shutdown, the power in the left engine was reduced to idle. After the pilots shut down the right engine to attempt to regain engine control, it is likely that the left engine rolled back to idle immediately. Thus, the pilots were flying with one engine that was shut down and another engine that would not advance past idle, and they had no emergency procedures to address the situation.

“This dual channel failure of both thrust levers occurred after the airplane had accumulated only 238 hours and 192 cycles since new. The thrust levers are part of the throttle quadrant assembly. The Safety Board’s investigation found that the throttle quadrant assemblies failed in a similar manner during testing, which suggested that there might be a design or quality problem in the Eclipse 500’s throttle quadrant assembly.”

– Testimony of Nicholas Sabatini, Associate FAA Administrator for Safety (the testimony was also given by Sabatini on behalf of John Hickey, Director, FAA Aircraft Certification Service):

“While I am prepared to discuss the details of the Eclipse certification, I must state unequivocally at the outset what goes without saying: that FAA professionals would never and, in this case, did not, certify an aircraft that they knew to be unsafe or one that did not meet standards ….

“Last Friday  [12 September], the SCR [Special Certification Review Team] announced its findings. The team’s bottom line [is] critical: FAA’s certification of the Eclipse aircraft was appropriate because it did meet the required standards. In addition, the team did not find any unsafe condition needing immediate attention. This is good news – that, in the opinion of some of the best technical experts in this country, the Eclipse aircraft meets the required standards and was, therefore, legally entitled to receive certification ….

“But also important to me and my team was learning of the deficiencies the SCR identified with regard to communication within the certification team and with regard to the documentation of decisions. I take seriously the criticism that the teams we assigned to this project did not communicate well with one another or with Eclipse … I believe that if our type certification team had documented its various concerns in issue papers, as required, and had followed that process to resolution, all FAA staff involved in the project would have better understood and accepted the certification approach that was used in this project ….

“Once an Applicant receives its type certificate, it has six months to obtain a production certificate or an approved production inspection system. The production certificate is issued when the Applicant demonstrates that it can reliably reproduce aircraft that meet the approved type design. Obtaining a production certificate is extremely challenging for a new company entering the industry because they must establish the physical and procedural infrastructure to develop the capability to consistently reproduce aircraft that conform to the type certificate. Until a production certificate is issued, the FAA must inspect each aircraft the Applicant produces as it is being built in order for us to ensure that the aircraft meets the approved type design. This is why we require that the Applicant obtain the production certificate within six months of the type certificate ….

“The Eclipse certification process involved an Applicant that had never before attempted to obtain FAA certification of its product. The process also involved an FAA field office that – though very competent in certifying aircraft products – had never before been responsible for a high profile, highly anticipated product …

“[Regarding] blanking of the screens of the Electronic Flight Information System (EFIS). The EFIS provides many required controls and displays for the pilot. It consists of two Primary Flight Displays, a Multifunction Display, an Autopilot Control Panel, a Center Switch Panel, and a keyboard. There were a total of three screens on the control panel. Although there were times when a screen blanked out, the bottom line is that never more than one screen blanked out at any given time. The required standard is that one display of information, essential for continued safe flight, be available to the crew [note: ‘crew’ approved to be just one pilot by the FAA]. In the case of Eclipse, the pilot always had the requisite information available to continue safe flight [note: this may be so if the only problem is one screen momentarily blanking, but what if there is another problem at the same time, such as the throttle-quadrant dilemma mentioned by the NTSB’s Tom Haueter above]. Consequently, the required standard was met ….

“I understand and appreciate that this Committee wants to ensure that responsiveness [to the manufacturer] does not result in less than vigilant oversight. I am keenly aware of your concerns because they are my concerns as well ….”


Comments are closed.

Nolan Law Group