NATCA Aircraft Certification Rep Tomaso DiPaulo Testifies on Eclipse Jet
09/17/2008
Testimony of Tomaso DiPaolo, Aircraft Certification National Representative
National Air Traffic Controllers Association
Before the House Transportation and Infrastructure Committee Subcommittee on Aviation
Wednesday, September 17, 2008
FAA Aircraft Certification: Alleged Regulatory Lapses in the Certification and Manufacture of the Eclipse EA-500 The National Air Traffic Controllers Association (NATCA) represents aviation safety professionals including the aerospace certification engineers, flight test pilots, and technical/administrative personnel in the Federal Aviation Administration’s (FAA) Aircraft Certification Division. In addition to my 20 years of service as an aerospace engineer at the FAA’s Chicago Aircraft Certification Office, I serve as the NATCA Aircraft Certification National Representative.
The FAA Aircraft Certification Division is authorized by Congress with the inherently governmental mission of ensuring that aircraft are designed, analyzed, and tested to a minimum level of safety. Once proper testing and analysis are conducted, these engineers review the results and determine whether the aircraft is in compliance with safety regulations. If all regulations have been met, the FAA gives its seal of approval by issuing a type certificate (TC). Normally aircraft have various limitations, such as weight, performance, or life limits. These limitations are to be denoted in the type certificate data sheet (TCDS), flight manual, and maintenance and overhaul manuals. Some aircraft are approved with heavily restrictive limitations. This allows the aircraft to enter the market but only to be flown in a limited capacity, giving the company time to fix the remaining concerns.
In the case of the Eclipse 500 Jet type certification project, safety, employee complaints, and undue FAA management pressure for speedy certification forced NATCA to file a grievance. All information discussed herein is produced under the protections of this hearing, applicable law, and Congressional authority. Information is presented in chronological order although some information may have been disclosed to the Union after the grievance was filed.
Creating the Partnership Safety Plan
According to the FAA’s type certificate data sheet (TCDS) for the Eclipse EA500 aircraft (referred to as a Very Light Jet), the application was dated in July of 2001, but briefings to the FAA actually began in spring of 2001. As the Very Light Jet (VLJ) represented an entirely new aircraft design, Eclipse experienced issues with design development, testing and safety. As a result, the project was not completed within the standard three years and the company applied for and was granted an extension. Although a second extension could have been granted, no such request was ever made.
Responsibility for this project was initially given to the FAA’s Chicago Aircraft Certification Office (ACO) in conjunction with both the Williams Engine Company (Williams) and the Eclipse Aviation Corporation (Eclipse). During the project, the Chicago ACO employees were required by FAA management to create a Partnership for Safety Plan (PSP) with Eclipse – a plan that outlines the goals and procedures specific to this project – and complimentary Project Specific Certification Plan (PSCP) to support the PSP goals. This PSP outlined a number of procedures, timelines and goals that fell outside of the FAA’s authorization and other federal aviation safety regulations. The need for a PSP or PSCP is only recommended by an FAA Order and is not required by law or regulation.
Some troubling aspects of the Eclipse PSP and PSCP included:
• A timeline that forecasted type certification by December 2003, highly aggressive for a new company and new aircraft design.
• The FAA committed to “optimal delegation” to the “maximum extent practicable,” handing over much of their oversight and testing responsibilities to the company itself, a dangerous decision for such a new aircraft design.
• Implications that Eclipse would have sole decision-making power over who would be the Administrative Designated Engineering Representatives (DERs). The PSP also assigned that the key representative for the Administrative DER position would be from the Williams Engine Company.
• All Eclipse data would be returned to Eclipse after TC issuance and not maintained by the FAA.
• Eclipse was allowed to appeal technical decisions to higher level FAA management and could limit when the FAA needed a safety concern document, such as a special condition or an issue paper.
• The PSCP highlighted the dependence of Eclipse’s aircraft design on aviation equipment that had been granted a Technical Standard Order (TSO). By using TSO units throughout the aircraft, it shifts costs and pressure for certification onto the TSO company (supplier). In addition, the PSCP highlighted that the Williams engine and the Eclipse aircraft were highly integrated and interdependent.
Pressure on Eclipse Engineers
In November of 2002, the Williams engine was dropped from the aircraft design. In February of 2003, the Pratt & Whitney of Canada (PWC) 610F-A engine was identified as the replacement engine. This was a major technical engineering design change and the whole propulsion and software integration system needed to be revamped. Despite the new need for additional research and design, the certification timeline did not change. Eclipse engineers and flight test pilots were then under extreme pressure to meet their business plans. For example, Eclipse personnel informed FAA engineers that they would need to do research and development for aircraft flight testing in only 7days then present the aircraft immediately to the FAA for type inspection authorization (TIA) certification flight testing.
The Eclipse DERs were being pushed to meet the company perceived minimum of the regulatory requirements and to further minimize testing in order to meet these requirements. For example, during a three-month stretch, the Company DERs were continually trying to tell the FAA engineers what the intent of complying with fuel systems regulations were despite the fact that the FAA engineers were clear in what the regulations required.
In 2003, the Eclipse project was transferred from Chicago ACO to the southwest based ASW-150/Airplane Certification Office (based in Fort Worth, Texas, referred to as “ASW”). The Chicago team had about 9 employees while the ASW-150 had about eight employees with the assistance of five more from other certification offices.
FAA’s Imposed Pay for Performance Plan
On July 10, 2005, the FAA unilaterally imposed a new pay system and work rules on multiple NATCA bargaining units including the Aircraft Certification. The new, non-negotiated pay system is called Core Compensation. One aspect of this pay system is that it replaces annual step increases with Superior Contribution Increases (SCI). These SCI increases are awarded to some individuals based on a management only assessment of their performance for the fiscal year.
This is problematic on a number of levels. First, it creates a competitive work environment since there are only a fixed number of SCI increases which is not conducive to the type of teamwork required for such high level engineering projects. Second, managers are not required to clearly justify why a particular employee was chosen or denied an SCI. This allows managers to use subjective or in some cases inappropriate criteria for rewards or punishment. In the case of Eclipse, FAA managers were able to retaliate against an employee who refused to buckle under management pressure to change their technical positions. Third, it is our understanding that top FAA management pay is tied to the accomplishment of goals within the FAA business plan, which contains a number of non-safety items. For example, the FY 2006 business plan contained the goal of certifying a Very Light Jet by the end of the Fiscal Year. As pay was tied to the accomplishment of this goal, FAA engineers in the Eclipse project came under significant pressure to certify Eclipse within this time frame, despite outstanding safety concerns and the lack of demonstrated compliance to the safety regulations.
FAA-Private Sector Cross Pollination
In the fall of 2001, it was announced that the former FAA project officer overseeing Eclipse project, Mr. Randy Griffith, had left the FAA and was now the Eclipse Aviation Airworthiness Coordinator. Mr. Griffith thus became the principal point of contact to the FAA on behalf of Eclipse. This appears to be in violation of FAA ethics standards. According to the FAA ethics training manual for 2006 a former agency employee who accepts a job may “have some limitations in communicating with his former agency on his company’s behalf” and one cannot, for a period of two years, represent his or her new employer before their former agency.”
Pressures on Project Officers
Project Officers (members of the NATCA Aircraft Certification bargaining unit) also found themselves under tremendous pressure regarding the Eclipse certification project. One example of this occurred during a technical meeting with Eclipse, the project officer, and the Chicago ACO. The meeting began with the project officer taking a firm position in regards to function and reliability testing policy. During a break, the project officer was informed that the lead manager of the Small Airplane Directorate (SAD) was on the phone, so he was brought into a private Eclipse office to take the call. After the break was over, the project officer returned to the meeting and chose to back off his technical position. The project officer later told a Chicago ACO engineer that during the telecom, the lead manager from SAD ordered him to back off his technical position in regards to function and reliability.
Additionally, project officers were forced to do their jobs without proper support and without open communication with front-line ACO engineers. One project officer was forced to juggle several projects in addition to Eclipse, and asked for assistance so that the Eclipse program could receive the attention it required. This officer was also tasked with coordinating the logistics of an Equivalent Level of Safety (ELOS) document for the Airspeed Indicating System in the Eclipse 500 Jet. An ELOS is written when, due to the unique design of a part or system in an aircraft, it is unable to comply with the letter of the safety standard but is able to comply with the intent of the standard. This project officer was not informed by FAA management of the technical opposition of the ELOS by the ACO engineers, and thus was tricked into helping create the ELOS despite outstanding safety concerns. This FAA management interference occurred many times in the Eclipse project. At the end of September of 2006, the project officer was told by his managers that “Eclipse had met their compliance goals”, but was not made aware of the still open technical objections by ACO engineers.
Lack of direct communication with the ACO engineers coupled with the high level of FAA management involvement compromises the project’s safety objectives. The standards themselves became muddled, while management coercion and lack of communication with engineers made it nearly impossible to determine if standards were being met.
Pre-Type Certificate Concerns with Eclipse – Fort Worth Aircraft Certification Office
After the project was moved to ASW-150 in Fort Worth, Texas, I started to receive many verbal complaints and concerns from employees. In the initial PSP, it was stipulated that after the project’s transfer to the southwest region, the PSP would be reviewed and renegotiated. Unfortunately, after said transfer, complaints were made to me that the hands of the engineers in Fort Worth were tied due to the initial PSP and other earlier documents that prevented these engineers from formally bringing up new safety concerns. In one case, an engineer was opposed to an ELOS which was written to address how the airspeed indicating system and pitot static system were created, but his concerns regarding the ELOS and the performance of the Eclipse 500 Jet were dismissed by FAA management. Several months after the aircraft was approved, the FAA would have to reverse itself and write an airworthiness directive (AD or safety law) due to three incidents where the pitot static system failed due to freezing condensation – exactly what the engineer and the regulations said needed to be addressed. This AD also limited the aircraft to daytime flying and mandated the use of two pilots.
Because the design of Very Light Jets (VLJs) differed so significantly from conventional jets, Federal Aviation Regulation number 23 proved ill adapted for Eclipse certification. It was brought up to me, well after the filing of the grievance, that the Small Airplane Directorate (SAD) had issued an “unofficial Part 23 Jet Certification Guide” to address the application of new safety conditions to various classes of light jets. It is my understanding that the document was not applied in total to the Eclipse 500 Jet due to the objections of the Eclipse company and due to the PSP/PSCP goals and procedural limitations.
Provisional Type Certificate and Verbal Harassment
On July 27, 2006, the FAA held a large press event at the Experimental Aircraft Association (EAA) air show in Oshkosh, WI to announce the preliminary TC approval for the Eclipse 500 Jet. According to an FAA press release there were “no major problems” complicating a future issuance of the final TC. Yet problems persisted and the engineers continued to express their technical objections that the aircraft was not meeting the safety regulations. The FAA ignored these protests and issued the preliminary TC in spite of these issues.
A few weeks after the provisional TC press event, a meeting was held at the Eclipse headquarters in Albuquerque, NM. According to reports from engineers present at that meeting, Mr. John Hickey/AIR-1, and other top level FAA DC managers were present at the meeting, although managers from the small airplane directorate were conspicuously absent. During the meeting, Mr. Hickey told the group “we are here to save this company [Eclipse]”. One engineer responded that his job was to make sure the aircraft complied with the safety regulations, and he was subsequently rebuked by Mr. Hickey in front of the other employees. Mr. Hickey then proceeded to intimidate and verbally attack each individual on the team. When I sought to address this harassment by calling Mr. Hickey in my capacity as the NATCA Representative, I was directed instead to his assistant manager, Dorenda Baker/AIR-2, who dismissed my concerns by saying that the engineers “misunderstood” Mr. Hickey and that he was only encouraging them to think outside the box.
Final Type Certificate – Outstanding Concerns
During September of 2006, I was informed by bargaining unit engineers that the Eclipse Avidyne electronics suite was still not functioning safely, had not complied with the TSO requirements, and needed further research and development. At times, one of the two screens the pilots were using would blank out for fifteen-second intervals and thus deprive the pilot of critical information. The first attempt to fix the problem was unsuccessful; rather than preventing the screens from turning blank, the changes prevented the blank screen from returning to functionality. Because of this safety concern, the engineer did not approve the related FAA document, citing that the electronics suite did not comply with regulations. Just as with the pitot static system, this engineer’s technical assessment was proven accurate. In February of 2007, Eclipse announced that they were no longer going to use the Avidyne suite due to its lack of reliability and functionality and would be retrofitting aircraft with the Avio NG. In an informal conversation with Avidyne, I was told that with more time and testing Avidyne would have been happy to address what they acknowledged were legitimate pre-type certification safety matters.
Nothing would deter the FAA from their certification goal, not even ongoing tests. I was informed that while FAA flight test pilots were in the air conducting flight tests, a group of FAA managers had met and determined that the Eclipse aircraft had met their compliance goals. The FAA flight engineers and flight test pilots were shocked to say the least.
Well after the filing of the grievance, a copy of the FAA’s final type certification board meeting minutes was provided to me for review. That meeting was held in late July of 2006 and highlighted four and a half pages of outstanding safety concerns and incomplete tests – some of which I have outlined above. Despite these outstanding concerns, there was no discussion of moving the type certification goal past the end of September of 2006 and into the next fiscal year.
On September 29, 2006, I spoke with one of the engineers and was told that they were not going to sign off and approve the TC for the Eclipse aircraft. I reaffirmed to the engineers that NATCA was behind them 100% and appreciated the good safety work they had accomplished. These engineers did not sign off on the TC approval.
According to my understanding, the next day, September 30, 2006, FAA management ordered the Eclipse project manager to come into work on a Saturday and convinced her to sign off on an Eclipse document approving of all engineering and flight test aspects of the Eclipse 500 Jet. The final TC was then signed by the Ft. Worth AWS-150 Manager, Michele Owsley. The Eclipse TC document allows the aircraft to fly with almost no limitations, despite the clearly stated non-compliance of its software systems. The FAA type certificate data sheet (TCDS) fails to establish any significant limitations or restrictions or identify any mitigation document created especially for Eclipse by FAA management. Such limitations are standard procedure when outstanding concerns persist.
The FAA management issuance of a TC without allowing the aircraft certification engineers and flight test pilots to properly complete their assigned certification/safety responsibilities is in direct violations of laws, regulations, and policies. The issuance of a TC without concurrence of all FAA engineering and flight test personnel is a significant change in proper FAA engineering procedures. In addition, this behavior contributed to significant adverse affect to the morale and performance of the engineering workforce as it degraded their professionalism by ignoring their technical decisions and dismissing the value of comprehensive testing.
NATCA Files a Grievance
On October 20, 2006, after discussions with some of the FAA engineers that worked on the Eclipse program and local NATCA representatives, NATCA decided to file a grievance against the FAA. The grievance seeks to obtain proper legal protection and representation of the employees that were involved in the project and allow the employees the option to not work any further on the Eclipse project. In addition, the grievance seeks to remedy damages caused by the FAA’s flawed pay for performance plan by prohibiting the FAA from penalizing any employee for expressing or noting safety issues during the Eclipse aircraft program. It was a concern of the Union that the imposed pay rules would allow managers to reprimand, issue negative performance evaluations or ratings, or deny employees any or the maximum performance pay increases (known as SCI ratings). Since the filing of the grievance, the Union has been approached by two employees that were given less than the maximum SCI rating due to their technical positions in the Eclipse program.
The FAA has never formally responded to the grievance although the grievance described a remedy wherein the Union and the agency could meet to bargain to restore the professionalism that is essential in the agency’s safety mission. With FAA management continuing to overturn engineer’s safety decisions and the diminishing trust between the FAA and the engineers, NATCA has stepped in to file more grievances and technical safety letters and comments on behalf of its bargaining unit employees. NATCA bargaining unit employees have also submitted evidence to Congress of further examples of FAA management maintaining dangerously close relationships with the industry, as this problem is not limited to the FAA’s relationship to the Eclipse Corporation.
Post Type Certificate Review
Many problems and near accidents have occurred with the Eclipse 500 Jet since the issuance of its final TC. A November 16, 2006, Avweb Flash article reports Eclipse grounding its Eclipse 500 Test Fleet. A memo from Eclipse to its customers states that the company chose to ground the Eclipse fleet for two weeks because of problems with the aft wing attachment bolt bushing. According to Eclipse, the aft wing attach was designed to prevent forward and aft wing flexing during hard landings. However, in the memo, the company expressed concerns over the potential for wing separation or failure on the Eclipse 500 Jet. The Eclipse memo also announced windscreen cracking problems in the patch holes where the windscreen attaches to the airframe. Cracks are reported on the outer layer, but loss of pressurization is a concern. The cracking is reported as a structural fatigue issue, which is unusual for an aircraft that is still so new, and Eclipse is requiring a 100 cycle visual inspection. In light of this, no action was taken by the FAA.
On March 2, 2007, an Eclipse advisory letter announced eight major safety and production in the areas of functional test procedures (FTP), manufacturing workforce, and production rate.3 According to the article, the bolt bushing problem has been corrected, but Eclipse is still experiencing supplier delays and quality problems, FTPs are being rewritten because of accuracy issues, safety-critical friction stir has required special engineering analysis, and DER approval, and “some components” are experiencing higher failure rates than anticipated.
Still no action was taken by the FAA.
In early June of 2008, an Eclipse 500 aircraft nearly has an accident at Midway airport in Chicago, IL. The aircraft almost crashes due to the failure of the highly integrated engine software and electronics system, which allow the pilot to control engines properly during landing. It came to NATCA’s attention that an FAA chief scientific and technical advisor was rebuked for investigating this matter and for reporting his findings that the Eclipse software system was non-compliant to the regulations.
As recently as August of 2008 another engine software incident occurred. An Eclipse 500 Jet attempting to land in Pennsylvania drove off the end of the runway. It was reported that the engines were, again, unable to be shut down. No casualties were reported, but a small child may have been injured.
As of September of 2008, the European Aviation Safety Agency (EASA), the European equivalent of the FAA, has not yet certified the Eclipse 500 Jet. One outstanding technical concern is the 30 minutes of reserve electrical/battery power after loss of engine power, which had been approved by the FAA management. Like FAA engineers and the chief scientific and technical advisor (CSTA), EASA believes that the aircraft should have 60 minutes of reserve electrical/battery power. However FAA management overruled these technical findings during the US certification process.
In anticipation of this hearing, the FAA has begun and concluded a special certification review (SCR) of the Eclipse program and a service difficulty review report. In both cases, FAA engineers with the technical expertise on light jets have not been included in the final assessment of the data developed. The SCR team of alleged specialists is being asked to determine if any pre-TC safety issues have manifested as service difficulties since the aircraft entered the market. This team, led by a former Boeing employee, is composed of managers outside of the Small Aircraft Directorate and all but one of who reportedly have no experience with small jets certification. This team does not appear to comply with the intent of the FAA’s SCR policy.
Conclusion and Recommendations
The FAA’s behavior during the certification of the Eclipse 500 Jet was inexcusable. They intimidated and coerced federal employees into ignoring safety regulations. Our safety system works because of the laws and regulations that exist to protect the flying public, but it will only continue to function if those laws and regulations are followed. The FAA must have a zero-tolerance policy with individuals that encourage non-compliance and thus put the flying public at risk. Therefore, I would like to offer the following recommendations:
1. The FAA’s business plan needs to be refocused on safety-only mission related goals. Mandating a specific timeframe for certification of an aircraft creates unnecessary pressure for speedy certification and compromises the safety and integrity of the aircraft.
2. Title 49 must be amended to allow the Union to negotiate fair and professional pay procedures that encourage and reward compliance to the safety mission of the agency.
3. Delegation must be restricted to individuals who are reviewed and approved directly by the FAA, not using a private company as a surrogate. Allowing a company to select the individuals who determine compliance creates a conflict of interest.
I would like to thank these engineers and flight test pilots who did their job by raising the questionable management tactics to the Union. I would also like to commend this committee and the Inspector General for investigating the questionable management tactics and allowing the truth to be presented in an open public forum.
|
