[House Hearing, 113 Congress]
[From the U.S. Government Publishing Office]





             LESSONS LEARNED FROM THE BOEING 787 INCIDENTS

=======================================================================

                                (113-24)

                                HEARING

                               BEFORE THE

                            SUBCOMMITTEE ON
                                AVIATION

                                 OF THE

                              COMMITTEE ON
                   TRANSPORTATION AND INFRASTRUCTURE
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED THIRTEENTH CONGRESS

                             FIRST SESSION

                               __________

                             JUNE 12, 2013

                               __________

                       Printed for the use of the
             Committee on Transportation and Infrastructure





[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]





         Available online at: http://www.gpo.gov/fdsys/browse/
        committee.action?chamber=house&committee=transportation

                                _____

                  U.S. GOVERNMENT PRINTING OFFICE

81-427 PDF                WASHINGTON : 2013
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop IDCC, Washington, DC 
20402-0001






             COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE

                  BILL SHUSTER, Pennsylvania, Chairman
DON YOUNG, Alaska                    NICK J. RAHALL, II, West Virginia
THOMAS E. PETRI, Wisconsin           PETER A. DeFAZIO, Oregon
HOWARD COBLE, North Carolina         ELEANOR HOLMES NORTON, District of 
JOHN J. DUNCAN, Jr., Tennessee,          Columbia
  Vice Chair                         JERROLD NADLER, New York
JOHN L. MICA, Florida                CORRINE BROWN, Florida
FRANK A. LoBIONDO, New Jersey        EDDIE BERNICE JOHNSON, Texas
GARY G. MILLER, California           ELIJAH E. CUMMINGS, Maryland
SAM GRAVES, Missouri                 RICK LARSEN, Washington
SHELLEY MOORE CAPITO, West Virginia  MICHAEL E. CAPUANO, Massachusetts
CANDICE S. MILLER, Michigan          TIMOTHY H. BISHOP, New York
DUNCAN HUNTER, California            MICHAEL H. MICHAUD, Maine
ERIC A. ``RICK'' CRAWFORD, Arkansas  GRACE F. NAPOLITANO, California
LOU BARLETTA, Pennsylvania           DANIEL LIPINSKI, Illinois
BLAKE FARENTHOLD, Texas              TIMOTHY J. WALZ, Minnesota
LARRY BUCSHON, Indiana               STEVE COHEN, Tennessee
BOB GIBBS, Ohio                      ALBIO SIRES, New Jersey
PATRICK MEEHAN, Pennsylvania         DONNA F. EDWARDS, Maryland
RICHARD L. HANNA, New York           JOHN GARAMENDI, California
DANIEL WEBSTER, Florida              ANDRE CARSON, Indiana
STEVE SOUTHERLAND, II, Florida       JANICE HAHN, California
JEFF DENHAM, California              RICHARD M. NOLAN, Minnesota
REID J. RIBBLE, Wisconsin            ANN KIRKPATRICK, Arizona
THOMAS MASSIE, Kentucky              DINA TITUS, Nevada
STEVE DAINES, Montana                SEAN PATRICK MALONEY, New York
TOM RICE, South Carolina             ELIZABETH H. ESTY, Connecticut
MARKWAYNE MULLIN, Oklahoma           LOIS FRANKEL, Florida
ROGER WILLIAMS, Texas                CHERI BUSTOS, Illinois
TREY RADEL, Florida
MARK MEADOWS, North Carolina
SCOTT PERRY, Pennsylvania
RODNEY DAVIS, Illinois
MARK SANFORD, South Carolina
                                ------                                

                        Subcommittee on Aviation

                FRANK A. LoBIONDO, New Jersey, Chairman
THOMAS E. PETRI, Wisconsin           RICK LARSEN, Washington
HOWARD COBLE, North Carolina         PETER A. DeFAZIO, Oregon
JOHN J. DUNCAN, Jr., Tennessee       ELEANOR HOLMES NORTON, District of 
SAM GRAVES, Missouri                     Columbia
BLAKE FARENTHOLD, Texas              EDDIE BERNICE JOHNSON, Texas
LARRY BUCSHON, Indiana               MICHAEL E. CAPUANO, Massachusetts
PATRICK MEEHAN, Pennsylvania         DANIEL LIPINSKI, Illinois
DANIEL WEBSTER, Florida              STEVE COHEN, Tennessee
JEFF DENHAM, California              ANDRE CARSON, Indiana
REID J. RIBBLE, Wisconsin            RICHARD M. NOLAN, Minnesota
THOMAS MASSIE, Kentucky              DINA TITUS, Nevada
STEVE DAINES, Montana                SEAN PATRICK MALONEY, New York
ROGER WILLIAMS, Texas                CHERI BUSTOS, Illinois
TREY RADEL, Florida                  CORRINE BROWN, Florida
MARK MEADOWS, North Carolina         NICK J. RAHALL, II, West Virginia
RODNEY DAVIS, Illinois, Vice Chair     (Ex Officio)
BILL SHUSTER, Pennsylvania (Ex 
    Officio)













                                CONTENTS

                                                                   Page

Summary of Subject Matter........................................    iv

                               TESTIMONY
                                Panel 1

Margaret M. Gilligan, Associate Administrator for Aviation 
  Safety, Federal Aviation Administration........................     4

                                Panel 2

Mike Sinnett, Vice President and Chief Project Engineer for the 
  787 Program, The Boeing Company................................    20

 PREPARED STATEMENTS AND ANSWERS TO QUESTIONS FOR THE RECORD SUBMITTED 
                              BY WITNESSES

Margaret M. Gilligan:

    Prepared statement...........................................    27
    Answers to questions from Hon. Rick Larsen, a Representative 
      in Congress from the State of Washington...................    38
Mike Sinnett, prepared statement.................................    47


[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]



 
             LESSONS LEARNED FROM THE BOEING 787 INCIDENTS

                              ----------                              


                        WEDNESDAY, JUNE 12, 2013

                  House of Representatives,
                          Subcommittee on Aviation,
            Committee on Transportation and Infrastructure,
                                                    Washington, DC.
    The subcommittee met, pursuant to notice, at 10:00 a.m. in 
Room 2167, Rayburn House Office Building, Hon. Frank A. 
LoBiondo (Chairman of the subcommittee) presiding.
    Mr. LoBiondo. Good morning. The hearing will come to order. 
Thank you all for being here. The top priority of the Aviation 
Subcommittee, as well as me, personally, is the safety of the 
flying public. Therefore, the subcommittee has closely 
monitored the actions of the FAA, the NTSB, and Boeing, in 
response to the battery incidents that took place earlier this 
year. We have called this hearing to learn more about the FAA 
and Boeing's actions to get aircraft back to safe operation.
    As we all know, in January there were two separate 
incidents involving a lithium ion battery on Boeing 787 
aircraft, one on the ground in Boston and the second in the air 
over Japan. After ordering a review of all Boeing 787 critical 
systems, the Federal Aviation Administration issued an 
emergency airworthiness directive that temporarily halted the 
operations of 787s.
    In the 5 months since the incidents, the FAA and Boeing 
have worked to develop a comprehensive solution to the battery 
issues, and have safely returned the 787 aircraft to service. 
As a key part of this process, the FAA and Boeing have taken a 
hard look at the certification of the 787. This review has 
focused on what worked, given that the safety of the aircraft 
itself was not compromised in either incident, and what needs 
or needed to be improved or adjusted.
    Although the NTSB investigation is ongoing, and the board 
has not identified the exact cause of the battery failure, 
Boeing has been able to narrow the possible causes of this 
short circuit to four or five basic things that they think were 
the cause. Based on that information, Boeing developed a 
comprehensive solution that addresses all of these possible 
causes. The solution presented to the FAA addresses issues at 
the battery cell, battery, and aircraft levels. In the end, a 
new battery design underwent over 200,000 engineering hours, 
and were then subject to a rigorous testing and FAA approval 
process.
    Once again, the committee has been closely monitoring the 
actions taken by the FAA and Boeing. Initially there was great 
concern about the possible implications of these incidents. In 
the last 5 months, we have made every effort to ensure that the 
FAA and Boeing are working together to develop a comprehensive 
solution.
    Therefore, the subcommittee has met several times with 
representatives of both the FAA and Boeing, and received high-
level briefings on the incidents and the comprehensive 
solution. Chairman Shuster, Ranking Member Rahall, Ranking 
Member Larsen and I received briefings by Boeing's CEO during 
the early stages of the investigation. The subcommittee has 
remained informed about the actions being taken by Boeing and 
the FAA at every step of the process.
    Moving forward, this subcommittee will continue to monitor 
the FAA certification process and the 787. To assist in this 
effort today we will hear from the FAA and Boeing on lessons 
learned as a result of the 787 battery incidents, and the 
comprehensive certification review. This hearing is not about 
attempting to lay blame on anyone. Instead, today we will take 
a constructive look at what has been learned from these 
incidents.
    It is important to remind ourselves that the United States 
aviation system is the safest in the world. This is due to the 
dedication and commitment of all stakeholders who, in 
situations like this, work together to ensure safety of the 
flying public. I would like to thank both the FAA and Boeing 
for their participation today, and look forward to their 
testimony.
    I would like to ask unanimous consent that all Members have 
5 legislative days to revise and extend their remarks and 
include extraneous material for the record.
    [No response.]
    Mr. LoBiondo. Without exception, so ordered. I would now 
like to yield to Mr. Larsen for any statement you may make.
    Mr. Larsen. Thank you, Mr. Chairman, for calling today's 
hearing to review lessons learned from the Boeing 787 
incidents.
    Mr. Chairman, I believe we should start this hearing by 
acknowledging that we are in an incredibly safe period for U.S. 
commercial aviation. We haven't had a fatal commercial 
passenger accident in the U.S. since 2009, and we owe a great 
deal of credit for that to dedicated safety professionals at 
agencies like the FAA and the NTSB.
    Additionally, The Boeing Company has been a world leader in 
the airplane business for almost a century. It has maintained 
its leadership by making safety a priority. The Boeing 787 
pushed the technological envelope. The certification itself was 
an 8-year process. The lithium ion batteries, like many of the 
aircraft's design features, are new and a constantly evolving 
technology, not specifically covered by existing FAA 
regulations.
    We know the FAA worked with Boeing to develop special 
conditions that would ensure the safety of this new technology, 
and the process for developing these special conditions was 
collaborative, rigorous, and transparent. These conditions took 
over a year to develop, and were published in the Federal 
Register for public comment.
    Nevertheless, we had two serious safety incidents involving 
Boeing 787 lithium ion technology in roughly a week's time. 
These incidents caused the FAA and other international 
regulators to ground the 787 for more than 3 months. The 
grounding raised legitimate questions for the flying public 
about whether the certification process with the 787 worked as 
well as it should have.
    In response to these two incidents, Boeing devoted more 
than 200,000 engineering hours to understand the cause of these 
incidents and develop technical solutions to prevent or 
mitigate any further incidents. And, likewise, the FAA stepped 
up its own involvement in the testing and analysis activities 
required to certify the new battery design. As a result, the 
787 modifications certified by the FAA have been completed, and 
all the airplanes are now back in service.
    Mr. Chairman, we both agree that safety is always this 
subcommittee's highest priority. With the 787 flying safely 
again, now is the appropriate time for the subcommittee to 
review these incidents and glean lessons learned that could 
further improve aviation safety.
    In April, the Government Accountability Office raised 
concerns before the Senate Commerce Committee that the ``FAA 
staff have not been able to keep pace with industry changes 
and, thus, may struggle to understand the aircraft or equipment 
they are tasked with certificating.'' The NTSB's independent 
investigation of the January 7 Japan Airlines incident is 
exploring this key issue, and that should be completed later 
this year. The FAA is conducting its own review of the 787 
certification process.
    Looking forward, Congress must ensure that the FAA is 
adequately staffed, the agency is positioned to understand and 
to challenge assumptions put forward by manufacturers regarding 
new technologies. I hope to hear from the FAA and from Boeing 
today about how the special conditions for the 787 were 
developed, and whether they were strict enough. I would also 
want to investigate whether the resources required for 
recertification of the 787 were enough.
    In February I expressed concern that this subcommittee--at 
our subcommittee's FAA reauthorization hearing that 
sequestration could negatively affect FAA certification 
activities. I would like to hear from Ms. Gilligan whether she 
believes that sequestration, budget cuts, and hiring freezes 
are impairing the FAA's ability to attract and retain technical 
competencies required to certify new technologies.
    Also, I would like to hear about the FAA's efforts to 
retain independent technical expertise from outside the agency 
when necessary to assist in the certification of new 
technologies.
    Lastly, I hope that we will have time to investigate the 
lessons learned from this process, and how the FAA will certify 
aircraft with lithium ion batteries in the future.
    Thank you, Mr. Chairman, and I look forward to hearing from 
our witnesses.
    Mr. LoBiondo. Thank you, Mr. Larsen. I would now like to 
turn to the chairman of the full committee, Mr. Shuster.
    Mr. Shuster. Thank you, and thank you, Chairman LoBiondo 
and Ranking Member Larsen, for holding this hearing today. I 
appreciate the fact that our witnesses from the FAA and Boeing 
are here to testify before us. And as Chairman LoBiondo said, 
this is a constructive hearing, something we can learn from.
    When we look at the United States and the transportation 
system, the airline system, aviation system safely transports 
over 730 million passengers a year, 70,000 flights a day. So it 
is the safest aviation system in the world, and that is due to 
the work and the efforts of the FAA, the airlines, the 
manufacturers, the controllers, other operators and 
stakeholders who make it a safe system to operate in.
    And this committee remained in close contact with the FAA 
and Boeing after the incidents occurred, and through final 
approval. The committee's oversight activities--it was apparent 
that, throughout the process, that everybody was working 
towards a solution, and it did that. We greatly appreciate the 
Department of Transportation, Secretary LaHood and Deputy 
Secretary Porcari, Administrator Huerta, for personally meeting 
with me and others on the committee.
    And when new aircraft with novel use of technology can 
experience issues, it is important that we address those issues 
early on in the process to make sure that we have safe 
aircraft. And this situation we were able to address. It does 
not mean they are unsafe. In fact, I believe they are safe 
today.
    The incidents--the FAA and Boeing's responses to the 
incidents, we are going to remain looking at these, again, 
learning from the process, because I believe there are valuable 
lessons to be learned from this. And I look forward to hearing 
again today from our witnesses. And again, we will continue 
this oversight and we will continue to closely monitor the FAA 
certification program. And, as the 787 resumes normal 
operations, we will look again closely at what is going on, and 
what is transpiring.
    And, as I said, throughout this process I think everybody 
worked diligently, worked together to get the 787 back up in 
the air. That is positive for the U.S. economy, it is positive 
for the airlines, and the aviation industry in America.
    So, again, I would like to thank the chairman and the 
ranking member for holding this hearing today, and yield back.
    Mr. LoBiondo. OK, thank you, Mr. Shuster. Now we will turn 
to our first witness today, FAA Associate Administrator for 
Aviation Safety, Peggy Gilligan. Ms. Gilligan, you are 
recognized.

TESTIMONY OF MARGARET M. GILLIGAN, ASSOCIATE ADMINISTRATOR FOR 
        AVIATION SAFETY, FEDERAL AVIATION ADMINISTRATION

    Ms. Gilligan. Thank you. Chairman LoBiondo, Congressman 
Larsen, and members of the subcommittee, thank you for the 
opportunity to appear before you today to discuss the 
certification of the Boeing 787. One of FAA's central roles is 
to certify aircraft and components that are used in civil 
aviation operations. We have been doing this for more than 50 
years. Right from the start, aviation products have often 
stretched the technological boundaries.
    Over the decades, we have enhanced our process and 
regulations. For example, for large aircraft like the 787, we 
have changed our regulations more than 130 times to keep pace 
with new ways of doing business and new technologies. For more 
than five decades, the FAA has compiled a proven track record 
of safely introducing new technology and new aircraft.
    As we continue to certify new aircraft, I want to make one 
thing very clear. We take that responsibility very seriously. 
To certify the 787, the FAA assembled a team of FAA----
    Mr. LoBiondo. Excuse me. Could you pull the mic a little 
closer, please?
    Ms. Gilligan. Sure. Is that better?
    Mr. LoBiondo. Just pull it a little closer to you. Yes, 
that is good.
    Ms. Gilligan. OK.
    Mr. LoBiondo. Thanks.
    Ms. Gilligan. To certify the 787, the FAA assembled a team 
of FAA engineers, inspectors, test pilots, and scientists, as 
well as experts from industry, think tanks, trade 
organizations, and other civil aviation authorities, in 
addition to all the expertise at Boeing. The certification of 
this aircraft took more than 8 years, hundreds of hours of FAA 
engineering review, and 900 hours of flight testing time.
    A key tenet of the certification process is to plan for the 
unexpected, and this was the case in the 787. We required the 
manufacturer to design systems to meet certain performance 
standards. Then we required them to assume a failure, and to 
design the aircraft so that it could be safely landed if a 
failure were to occur. Many layers of safety are built in to 
the meticulous processes and the thorough design.
    For the battery, for example, we established nine specific 
requirements to protect against a battery failure, and to 
protect the aircraft if a battery should fail. One layer may 
fail, just as it did in the in-flight 787 battery incident. But 
the multiple safeguards built in, and the procedures pilots are 
trained to follow, enabled the pilots to safely land the 
aircraft. This is how the system works.
    Immediately after the 787 in-flight incident, the FAA 
issued an order that suspended flight to ensure that we had the 
time to consider the right solutions without compromising 
passenger safety. Our safety team worked thousands of hours 
alongside Boeing. And, as a result of the battery system 
review, Boeing made several changes. They redesigned the 
internal battery components to minimize a short circuit within 
the battery. They insulated the battery cells to prevent 
propagation from one cell to another. They added a robust 
battery containment and venting system to prevent a problem in 
the battery from spreading to the aircraft. Finally, the 
company improved the quality assurance process at the battery 
manufacturer, to ensure that the batteries meet our rigorous 
design standards.
    We have concluded our review of the redesign, and we have 
approved its operation. The aircraft is once again flying 
passengers safely around the world, and Boeing has resumed 
delivery of new 787s. We are confident that the new design will 
protect the safety of the aircraft and its passengers.
    The FAA is continuing to review the critical systems of the 
787, including its design, manufacture, and assembly. We began 
this broad review, which includes the FAA certification 
processes, in January, after the first incident. We expect to 
complete it this summer. Both these actions, first addressing 
the immediate safety concern, and then doing an indepth review 
of the product and the processes, are a standard way that we 
approach our safety mission.
    Some have asked whether the FAA has the expertise needed to 
oversee the 787's cutting-edge technology. Not only does the 
FAA employ a staff highly experienced in aviation, but we have 
access to experts across the country and around the world. We 
establish rigorous safety standards, and make sure 
manufacturers demonstrate that the standards have been met. Our 
safety record shows just how successful we have been.
    What the 787 battery experience has shown is that neither 
the industry nor the FAA is perfect. But it also shows, as I 
noted earlier, that as aircraft are designed and built, we plan 
for the unexpected, and we make appropriate data-driven 
decisions to manage risk to protect the safety of the flying 
public.
    As we have learned with the 787 certification, the way to 
enhance safety is to keep lines of communication open between 
industry and Government, in order to foster the ability and 
willingness to share information about the challenges that we 
all face. These solutions show the FAA and its industry 
partners continue to create an atmosphere where people work 
together, all in the pursuit of maintaining the highest levels 
of safety. That is why we are all here.
    The FAA will never lose sight of the respective roles. But 
there is always a seat at the table for the bright minds from 
industry to help inform the best way to navigate the complex 
technological issues we encounter. It would be shortsighted to 
overlook anyone's valuable expertise.
    Mr. Chairman, I am proud of the safety record we have 
achieved, and I am confident we have the best people in the 
right places to meet our challenges ahead.
    That concludes my testimony, and I will be happy to answer 
any questions you may have.
    Mr. LoBiondo. Thank you very much. A couple of questions 
that I have. During the two battery incidents, was the safety 
of the aircraft or the flying public ever in danger?
    Ms. Gilligan. The first incident, as you are aware, 
occurred on the ground after the flight had been completed. All 
the passengers and crew had left the aircraft, and the aircraft 
was being cleaned. So, in that particular incident, there was 
no risk to anyone during the operation.
    In the second incident, which did occur in flight, so far 
we believe that after the battery event itself, the remainder 
of the system operated in accordance with the standards. That 
is, it contained the event within the battery. We still do not 
have the root cause analysis completed by the NTSB, so that we 
do need to wait and see what the final results of that 
investigation are, to see if there was any additional risk that 
we haven't identified yet.
    Mr. LoBiondo. Do you believe the FAA certification 
processes in place were sufficient to address and remedy the 
concerns raised by these incidents? Or should we relook at that 
somehow?
    Ms. Gilligan. We believe that the certification process is 
really quite robust. I think the safety of the system indicates 
that the products that FAA and others around the world have 
certified do provide an appropriate level of safety.
    Having said that, we always are looking to improve the 
processes. We have learned some lessons from what we have seen 
already with these two events. We will learn more lessons from 
the NTSB review, as well as our own indepth review. All of that 
information will be rolled back into the certification process 
to improve upon a very sound, robust basis.
    Mr. LoBiondo. Understanding that we don't have the NTSB 
final report, what do you think the lessons learned from these 
two incidents are up to this point? And what is the FAA doing 
in response to lessons learned?
    Ms. Gilligan. I think we have seen a couple of important 
lessons. The first is that we now have a much more robust 
process for testing lithium ion batteries, if they are used in 
aviation. The certification standards and the testing that 
Boeing demonstrated in the redesign will become the standard 
the FAA and other authorities around the world will use when we 
evaluate the level of safety provided by a lithium ion battery 
used in an aircraft. So that is a very important lesson, and 
that is already in place.
    I think, in addition, we have seen some areas where we can 
improve our process. One thing we realized is that some of 
these new technologies are not just used in aviation. There can 
be a community of experts who know something about the 
technology, but have nothing to do with aviation. We want to be 
able to reach that community. In this case, Boeing brought 
together a number of experts on lithium batteries, and we 
learned a great deal from them.
    So, what we need to do is broaden how we reach out for 
comments on our standards and expert review, to make sure that, 
if there is a community of experts outside of aviation, we know 
how to reach them.
    We are also looking at some of the process improvements 
internally that address new technologies. We are thinking that 
it probably makes sense to have people who are not involved in 
that particular certification to periodically review our work 
and the manufacturer's work to make sure the FAA folks involved 
in the certification aren't overlooking something, or that we 
haven't missed an assumption, or that we haven't asked a 
critical question.
    So, those are the kinds of process improvements that we are 
already seeing would add value to our certification process.
    Mr. LoBiondo. Thank you. Mr. Larsen?
    Mr. Larsen. Thank you, Mr. Chairman. Ms. Gilligan--was this 
last month--we had Mr. Huerta in front of us, and he said that 
FAA had announced a review of the certification process related 
to the 787, and that review is ongoing, and so on. 
Specifically, you have outlined some lessons learned, but can 
you give us a timeline on when that review of the certification 
process will be done?
    Ms. Gilligan. Sure.
    Mr. Larsen. Can you, as well, focus--help us understand 
what the focus is of this particular certification review?
    Ms. Gilligan. Sure, I will be glad to. After the first 
incident that occurred in Boston, the Administrator and 
Secretary, along with Boeing executives, announced that we were 
going to undertake this indepth review. With the second 
incident, and then the airworthiness directive, we lost a 
little time doing the indepth review because a lot of the same 
folks needed to be included in the ongoing initiatives. So we 
actually kicked the indepth review off in early February, and 
the group has been working pretty much full-time since then, 
with an eye toward completing their review in the summer.
    So, what that team did, was go beyond information on the 
battery to look at all of the operational data that we had from 
the aircraft since its introduction into service. We wanted to 
see if there was any trend, any set of incidents that needed to 
be looked at more thoroughly. We have identified a couple of 
areas and are doing what we call deeper dives into those areas 
to see what it shows us. From that, we expect to make some 
findings and recommendations on process improvements and 
perhaps other actions that we or Boeing or both will need to 
implement.
    Mr. Larsen. I think we will--well, at least I will look 
forward to seeing the results of that review and getting 
briefed on those. Since you are in that process, I won't go 
into too much detail with you right now.
    But a question about--that arise out of this incident isn't 
a new question, but I wanted to give you an opportunity to 
address it. It has to do with this term people--some folks have 
used in the media called self-certification, that this is one 
of the dangers of self-certification. Can you help us 
understand why FAA would argue that this is not self-
certification?
    And let me give you a--self-certification would be Company 
A goes and does what it does, and comes back to you, and you 
check the boxes.
    Ms. Gilligan. Right.
    Mr. Larsen. Versus FAA does everything and then hands it to 
the company and says--you know, to Company A, and says, ``Do 
this.''
    So, those are the goal posts--I am sorry, the bookends; I 
got my analogies wrong. Those are the bookends. How do you 
characterize the certification process?
    Ms. Gilligan. We would agree that the term ``self-
certification'' is a misnomer, because Boeing doesn't certify 
anything. The Boeing Company, as the manufacturer, is 
responsible for demonstrating that their product meets all the 
standards that we have set. They have to have data and 
information and analysis that shows that they have met those 
standards. Then the FAA, or someone who works on our behalf----
    Mr. Larsen. And, I am sorry, this would apply to someone 
who makes a vortex generator this big and someone who makes an 
engine for an airplane, as well.
    Ms. Gilligan. Yes.
    Mr. Larsen. This applies to anybody looking to build a part 
for an airplane here in the U.S.
    Ms. Gilligan. Right. The certification process is 
fundamentally the same.
    Mr. Larsen. Right.
    Ms. Gilligan. There are some small parts that are treated 
very differently, but you are right, the major systems or parts 
of aircraft go through the certification process.
    It might be easiest if I can describe it through an 
analogy. We see it like taking a test. FAA is the one who sets 
the criteria for passing the test. We tell the student, the 
applicant, in this case the manufacturer, what it takes for 
them to pass the test. They have to take the test and pass it. 
Then we, or people on our behalf, grade the test and determine 
if they passed. That is really how it works.
    The FAA and our designees, who we appoint based on the 
authorization provided by Congress for the Administrator to 
appoint people to act on his behalf, are the ones who make the 
determination that the standards have been met.
    Mr. Larsen. Let's----
    Ms. Gilligan. Does that help?
    Mr. Larsen. Let's beat this dead horse a little bit, the 
analogy about the tests in school, because on page 5 of your 
testimony you discuss the lithium battery literature. So part 
of what you did, then, was to review the available lithium 
battery literature, include a consideration of the hazards of 
other battery technologies such as nickel cadmium and, 
presumably, lead acid batteries, as well. But the end result is 
that then you created a test for these special conditions, but 
the test itself perhaps was bad.
    Ms. Gilligan. We haven't seen the data that says that the 
standard that we set was bad. In fact, if you compare the 
special condition to the regulation that was on the books for 
batteries, you will see that we made it much more robust. 
Lithium batteries provide higher energy at lighter weight.
    Mr. Larsen. Sure.
    Ms. Gilligan. That is why manufacturers wanted to use them. 
But because of that higher energy, they also pose a different 
kind of risk than other batteries. That is why the standards we 
had in place didn't fully address the risks that lithium ion 
batteries could introduce, and that is why we added additional 
requirements. We even made some of the original requirements 
more robust, for the purpose of the manufacturers showing that 
the lithium battery was sufficiently safe for this application.
    Mr. Larsen. The conditions state that lithium ion batteries 
are significantly more susceptible to internal failures that 
can result in self-sustained increases in temperature and 
pressure than their lead acid counterparts. Did those hazards 
cited in the special condition trigger a heightened level of 
FAA involvement in the certification or compliance activities 
for the battery, based on that risk analysis?
    And can you explain any additional actions FAA took?
    Ms. Gilligan. We set the new standard, in consultation with 
the manufacturer and the industry. We put that standard out for 
comment. We received some comments, again, from people in the 
aviation industry. This, again, is where I think we saw a 
lesson learned. We need to make sure that that kind of special 
condition also went to experts on lithium ion batteries, who 
might have been able to help us understand better how to 
improve it. So that is something we will look at changing in 
the future.
    Then it was for Boeing, in accordance with the 
certification plan that we approved, to do tests and analysis 
to show that they had met all the requirements of the special 
condition. We had designees on our behalf who made the finding 
that Boeing had shown that they met those standards.
    Mr. Larsen. What is a designee on your behalf? Is that an 
FAA employee?
    Ms. Gilligan. No. Again, under our statute, we have been 
authorized for many years to have the Administrator appoint 
individuals or organizations to perform some functions on our 
behalf. We have a program at FAA where our engineers, in this 
case, oversee the performance of the individual who is 
designated, or the organization who we have given a designation 
to, to make sure that they are properly performing their 
functions, that they are making the same findings the FAA 
engineer would have made, if they had done it themselves.
    It is a way that we can leverage our resources, because 
there are a large number of approvals that are required in a 
manufacturing program and in our operational environment, as 
well. A cadre of FAA employees would be extremely large, 
probably unmanageably large. So we leverage our engineering 
expertise through the designation of individuals and 
organizations to act on behalf of the Administrator, in 
accordance with the FAA Authorization Act.
    Mr. Larsen. The designee program has been around since 
1938?
    Ms. Gilligan. The designee program has been around since 
the late 1930s. I think it was a very elegant solution that the 
Congress came to, realizing that there would be a number of 
these repetitive approvals that we would need, so that the 
public saw that aviation was safe, but there would never really 
be a Federal cadre of employees who would be sufficient to 
carry that out.
    So, we have been able to leverage FAA resources by 
appointing individuals to act on our behalf. It is considered 
quite an honor to be an FAA designee. It is taken quite 
seriously. We continue to oversee that those individuals, or 
the organization that holds that approval, to ensure they are 
performing properly. We have the ability to withdraw the 
designation if they are not. So we manage it in that way.
    Mr. Larsen. I have further questions, but I will take a 
second round. Thank you.
    Mr. LoBiondo. Mr. Meadows?
    Mr. Meadows. Thank you, Mr. Chairman, and thank you, Ms. 
Gilligan, for being here and, obviously, being well-informed on 
the process. And I just compliment you on that.
    It is my understanding that when the NTSB gets involved in 
investigation, that all the parties with the investigation are 
severely limited in their ability to respond or communicate, 
either to the public or the media. And they are even 
restricted, at times, in their communication between the 
parties. For example, between the FAA and Boeing, or between 
Boeing and Japan Airlines. And these communications first have 
to go through the NTSB for clearance.
    Specifically, are there any reforms that you could see that 
the FAA or the NTSB could make that would allow this process to 
work more effectively, in terms of investigating incidences, 
while still allowing them to respond to the public and to each 
other?
    Ms. Gilligan. Well, sir, I think the party system, which 
the NTSB uses, does allow for all of the interested 
organizations that are involved to have a forum to make sure 
that they are sharing information about the particular event or 
incident or accident.
    In this day and age, with the instant demand by media and 
others for immediate information, it is sometimes difficult to 
make sure that things that are unique to the accident or 
incident being investigated don't get into the public domain 
before the organization responsible for that investigation has 
an opportunity to consider how it should be presented.
    I do think, in all the cases that I am aware of, we are 
able to work out the needed exchange of information so that the 
NTSB is confident that they are controlling the information 
about the accident itself. While, meanwhile, as you point out, 
we and manufacturers and others, we have other safety 
information that we need to share to make sure----
    Mr. Meadows. But--excuse me--you hit two key points, 
though. You keep referring to accidents, and this wasn't an 
accident. It was an incident. And there is a big difference 
there, because--I think of this as a compliment to the FAA and 
to Boeing and to a number of the situations, because it wasn't 
an accident, it was something that got identified as an issue.
    And I guess, you know, when we had previous testimony with 
the FAA, it is--the Administrator said, ``Well, Boeing is 
taking responsibility, but we know that there was a number of 
other issues that weren't specifically related just to Boeing, 
and yet that information never got out.'' So, you know, it is 
not an accident, it is an incident.
    So are there any reforms that you would recommend to the 
process right now?
    Ms. Gilligan. I think we have a very good working 
relationship with the National Transportation Safety Board. If 
we are ever in need of safety information, and there is any 
question as to whether or not we can receive it, those 
questions are very quickly cleared up. I know we have also 
worked with the NTSB and Boeing and others involved in these 
investigations to make----
    Mr. Meadows. So there are no reforms that you would 
recommend.
    Ms. Gilligan. I don't know of one, offhand, sir.
    Mr. Meadows. OK.
    Ms. Gilligan. I honestly don't.
    Mr. Meadows. Well, then, let me ask you a different 
question, then. When they get involved, when the NTSB gets 
involved, how does that affect your ability to investigate, or 
does it change at all? If they are involved or if they are not 
involved, does your process change at all?
    Ms. Gilligan. There are two parallel tracks. We support the 
NTSB. In fact, many of our technical experts provide their 
technical expertise to the NTSB. As you know----
    Mr. Meadows. Right.
    Ms. Gilligan [continuing]. NTSB is a small organization. 
They certainly don't have depth of expertise in all of the 
areas of aviation. So we provide technical expertise, as do 
other parties, to those events, those investigations.
    Mr. Meadows. So does it limit your ability to investigate 
at all?
    Ms. Gilligan. No. On a parallel track, we have other 
independent responsibilities, because of our authorization----
    Mr. Meadows. Right.
    Ms. Gilligan [continuing]. To make sure that we are 
understanding if there are any immediate safety-of-flight 
issues, or things that go beyond what may be the probable cause 
of that accident. We very much try to separate that out, and we 
do our review to see if there are safety improvements we need 
to make while they do their investigation.
    Mr. Meadows. OK. My time is running out. So let me ask you. 
If you had legislation coming from this committee that said 
that we would allow for a little bit more public disclosure on 
incidences, and maybe keep that limited--public domain on 
accidents, is that something that the FAA could support, if you 
had legislation coming from this body?
    Ms. Gilligan. We----
    Mr. Meadows. Is that something you would welcome?
    Ms. Gilligan. We certainly could follow whatever direction 
along those lines that might come through legislation. I 
think----
    Mr. Meadows. But would you welcome that?
    Ms. Gilligan. Sir, we would really have to see what the 
language is. But I understand your point. I do think that 
incident review needs to be an open exchange of information by 
all of the safety professionals, so that we can be sure we are 
going to prevent something that could be prevented. We 
understand what happened. And anything that would support that, 
we could support.
    Mr. Meadows. I yield back. Thank you, Mr. Chairman.
    Mr. LoBiondo. Thank you. Mr. Williams.
    Mr. Williams. Yes. I want to say thank you for being here, 
Ms. Gilligan, we appreciate it.
    First of all, I am going to ask you an important question. 
Would you feel comfortable flying on a Boeing 787?
    Ms. Gilligan. Yes, sir.
    Mr. Williams. OK. Are you doing anything to change the 
skill set of your workforce in aircraft certification to move 
to a more risk-based system approach to safety oversight?
    Ms. Gilligan. Yes, sir, we are. We do see that the level of 
safety in the system now is at an all-time high. The only way 
we are going to continue to build on that is to make sure that 
we have, and are analyzing, what is occurring; that we are 
finding things before they cause catastrophic failure, and we 
are able to fix it. So we are moving toward that kind of 
approach. We identify risks, identify what we can do to 
mitigate, manage, or eliminate those risks, and oversee that 
implementation to make sure the mitigation has been effective.
    That will add to the skill set of our workforce, but on the 
certification side we will always need, obviously, aerospace 
engineers and other kinds of engineering expertise. We are 
looking for a cadre of folks who have that engineering 
expertise, and also the ability to do data analysis to really 
inform how they make their engineering decisions.
    Mr. Williams. One other question, which you basically 
touched on just a second ago. But, simply put, do you believe 
that Congress needs to take additional actions as a result of 
this--of the battery incidents? Do we need to get more 
involved?
    Ms. Gilligan. No, sir. I believe, as both the chairman and 
Congressman Larsen pointed out, we believe that this is a 
demonstration of the system really working well. The reality is 
these are complex pieces of equipment, and things will go 
wrong. But we need to make sure the airplane can land safely, 
and that is what we did.
    Mr. Williams. Less Government is the best Government. Thank 
you for being here.
    Ms. Gilligan. Thank you, sir.
    Mr. Williams. I yield back.
    Mr. LoBiondo. Mr. Larsen?
    Mr. Larsen. Ms. Gilligan, could you compare the level of 
involvement in the certification activities associated with the 
redesign of the battery with the certification of the original 
design, and explain what, if any, actions, as well as direct 
involvement, the FAA took?
    Ms. Gilligan. Sure. I think it is important to realize that 
after the second event, the in-flight event, we determined that 
we had an unsafe condition. That always drives a higher level 
of FAA involvement. So we worked very closely with Boeing for 
thousands of hours to understand what were the risks. Boeing 
did a very indepth analysis, brought together a team of experts 
on lithium ion batteries to understand, since we didn't know 
the root cause of the two events, we needed to understand what 
was the group of things that might have resulted in either one 
of those events occurring.
    So, Boeing identified those areas. That led to what design 
changes needed to be made to address those risks, and the 
evaluation and testing to demonstrate that those designs would 
be effective. We were with them pretty much every step of the 
way.
    There was a list of about 20 tests that needed to be 
performed. We, FAA employees, witnessed most of those tests on 
this redesign. Because, again, we were dealing with an unsafe 
condition, and we really needed to get to the root of that to 
be able to solve the problem.
    Mr. Larsen. So then--so you have characterized how the FAA 
was involved. Can you characterize the--I don't know, the 
amount of time directly involved?
    Ms. Gilligan. We have some hour counts, and I hesitate to 
use them. So we have estimated about 7,000 hours. But it is 
important to understand for the work on the airworthiness 
directive----
    Mr. Larsen. Right.
    Ms. Gilligan [continuing]. We also collect a lot of our 
overhead kinds of time. A lot of our executives and senior 
managers were involved in the work on the AD. Their time is 
included in that number. In a standard certification, the 
manager time isn't always accounted for in the same way. But 
with that exception, we spent thousands of hours working with 
Boeing.
    Mr. Larsen. What does this--what does the certification 
process--FAA's involvement in the certification process of the 
redesign tell you about your future involvement in the 
certification of the use of lithium ion batteries in--you know, 
in the next airplane, whoever makes it?
    Ms. Gilligan. Well, again, we will use the same kind of 
enhanced testing and analysis, because we have seen how that 
can really show what will happen to the battery, and whether or 
not the design really meets our standards.
    Whether or not we would delegate, or ask our designees to 
make the findings of compliance will very much depend on the 
expertise of the applicant, the expertise of the designated 
organization or the individuals in that company. It is always 
kind of a case-by-case determination. But I think we will 
continue to keep our eye on applications for the use of lithium 
batteries to be sure that the testing and the standards are as 
robust as they need to be.
    Mr. Larsen. Have you changed the literature review, 
literally? It might sound like a snarky question. But if the 
first lit review of lithium ion batteries did not indicate to 
you, or--as the FAA, of a testing regimen that would result in 
the similar incident that we saw with JAL or ANA, has the body 
of literature changed?
    Ms. Gilligan. Well, again, I think, from the expert panel 
that Boeing put together, we did learn that, in the intervening 
years, more has been learned about lithium ion batteries and 
their risks and how to test for those.
    I do think it is important to note, and I am sure that Mr. 
Sinnett will, in the next panel, that in order for Boeing to 
reproduce the events that occurred in the two incidents----
    Mr. Larsen. Right.
    Ms. Gilligan [continuing]. It was an extremely difficult 
test. It really pushed the battery much, much further than 
anybody realized it would need to be pushed, if that is the 
right way to describe----
    Mr. Larsen. Sure, I understand.
    Ms. Gilligan [continuing]. In order to replicate what 
occurred in the two incident batteries.
    So, I do think we have a very robust set of tests now that 
we are confident reflect the best knowledge on lithium ion 
batteries today, and we will continue to evaluate that testing. 
We have the RTCA right now, a standards organization that helps 
us set standards----
    Mr. Larsen. Yes.
    Ms. Gilligan [continuing]. Working on testing standards for 
small and medium-sized lithium batteries. We will task them to 
go back and continue to review the application of large lithium 
ion batteries, to make sure, if there are changes in that 
literature, that we are on top of it and we are able to 
incorporate changes if we need to.
    Mr. Larsen. Didn't the RTCA's standards for testing lithium 
ion batteries change in the 2008 timeframe?
    Ms. Gilligan. That was the first time they issued standards 
on our behalf. You know----
    Mr. Larsen. Yes. Were the----
    Ms. Gilligan [continuing]. They provided standards----
    Mr. Larsen. Were those standards different than what was--
the--were they different than what the lithium ion batteries 
were then being tested under?
    Ms. Gilligan. They were different than how Boeing 
demonstrated compliance with our original set of standards, 
because they had a standard that would have allowed for the 
battery to be recharged. In the Boeing design, Boeing had 
determined that they would not permit the battery to be 
recharged. So that was not a standard that needed to apply.
    There may have been other differences, but I don't think we 
considered them substantial.
    Mr. Larsen. Yes. And who participated in the RTCA panel to 
look at that?
    Ms. Gilligan. Oh, RTCA is a way that we bring together a 
large number of experts.
    Mr. Larsen. Right.
    Ms. Gilligan. It was quite a large panel, as I recall. We 
have got the list of people and organizations, but they were--
--
    Mr. Larsen. Were you--was the FAA involved?
    Ms. Gilligan. Oh, yes.
    Mr. Larsen. Directly in that?
    Ms. Gilligan. Yes. RTCA takes these assignments from FAA. 
We ask----
    Mr. Larsen. Well, I know they take the assignments from 
you.
    Ms. Gilligan. Oh.
    Mr. Larsen. But was----
    Ms. Gilligan. But yes, yes.
    Mr. Larsen. The FAA's folks were there?
    Ms. Gilligan. Yes, we had somewhere between 5 and 10 
participants in the course of the development of the standards, 
both to help inform the other experts about how FAA uses 
standards as well as to make sure we had a group of people who 
really understood the standard when we received it.
    Mr. Larsen. So, then, was the lithium ion battery standard 
that came out in 2008 from RTCA, their recommendations from 
RTCA, were those incorporated in testing and retesting lithium 
ion batteries for use in large airplanes?
    Ms. Gilligan. The standards really provide a manufacturer 
with a method of how to go about showing compliance to the 
performance standards that we set.
    Mr. Larsen. Right.
    Ms. Gilligan. So, we did not require anyone who already had 
an approved lithium battery application to go back and retest 
using the RTCA methodologies.
    Mr. Larsen. And why not?
    Ms. Gilligan. Well, we had developed the special conditions 
in accordance with our counterparts in Europe. Airbus A380 was 
using some small lithium batteries. So we had already all 
agreed on what that standard was. Boeing had, at that time, 
provided sufficient data to demonstrate compliance with those 
standards. So, there was no----
    Mr. Larsen. With the new standard?
    Ms. Gilligan. No, with the standards that we applied. In 
aircraft design it is very difficult to go back and cause 
existing products to be retested in accordance with some new 
standard or new information that we may get, unless something 
in the new information suggests that there is an unsafe 
condition in the old, existing product.
    Mr. Larsen. And, if I may, and you are arguing that there 
was nothing in the newer standards that indicated there was 
something unsafe in the----
    Ms. Gilligan. That is correct.
    Mr. Larsen [continuing]. In the existing standard?
    Ms. Gilligan. That is correct.
    Mr. Larsen. Yes. Thank you.
    Mr. LoBiondo. Mr. Radel?
    Mr. Radel. Thank you, Mr. Chair. Appreciate it. Thank you 
so much for your time. I had two questions. The first--sorry, I 
had to step out for a second--apparently, the first was already 
covered. It is in reference to the organization designation 
authorization. And I hope that we can work together really to 
make sure that this permitting process of these regulations 
that at times are incredibly burdensome for the industry, that 
we can work together to make them more efficient, streamline 
them. Because at the end of the day, a lot of these costs for 
the entire industry, they have to get passed along to us, who 
want to buy plane tickets.
    The other thing I just wanted to touch upon was budgeting. 
We know how sequestration has been difficult, to say the least, 
for the FAA, especially when it come to prioritizing. I would 
ask you what guidance can our committee here give the FAA in 
the future for future reauthorizations to better facilitate 
prioritization of funding, as our Republican House continues to 
enact cost savings on behalf of our American taxpayer?
    Second part, what specific spending latitude will ensure 
that the FAA continues to meet its duties of oversight and 
efficiency for airplane manufacturers?
    Ms. Gilligan. Well, if I could start with the second one 
first----
    Mr. Radel. Sure.
    Ms. Gilligan. Excuse me. First, I think we are very 
appreciative of the work that Congress did to allow the 
Administrator the flexibility to move some funding within our 
different accounts at the FAA, so that we could avoid furloughs 
this year. I think the idea of losing 10 percent of everyone's 
work time would have had a tremendously negative impact on some 
of the certification projects that we have underway.
    At the same time, we still are looking to save over $380 
million at the FAA. And that, obviously, will have its impact 
as well. Right now we are in a hard hiring freeze, for example. 
We see pockets where people have left, resigned, retired, 
whatever, and it is having a harder impact in some small 
offices.
    As to how to help us set our priorities, I do think the 
last reauthorization was very helpful. It provided a number of 
opportunities for us to work with our industry to review our 
certification processes, to try to find what it is that causes 
it to be burdensome, or to determine where there may be 
inconsistent outcomes among different offices. That will 
provide us a real opportunity to work with industry to try to 
improve those areas.
    Hopefully you will see some results from that review, and 
that might well inform additional authorizations that would be 
useful, going forward.
    Mr. Radel. All right. Again, thank you so much for your 
time. I yield my time.
    Mr. LoBiondo. Ms. Johnson.
    Ms. Johnson. Thank you very much. Let me apologize for 
being a little late; had to go to another committee. And I hope 
you haven't answered these questions. But what I would like to 
know is what key lessons have you learned with regard to this 
January Japanese Airlines incident. And will you summarize the 
process that FAA uses to create special conditions for new 
technologies? And why are special conditions necessary?
    Ms. Gilligan. Sure. If I may, I will start with the second 
one first. The special conditions is a tool that we have to 
allow the introduction of new technologies, most of which 
enhance safety, before we have had an opportunity to go through 
an extended rulemaking process. So, special conditions and, in 
this particular case, the special conditions related to lithium 
ion batteries built off standards that we had always had in 
place for traditional batteries. The special condition 
specifically identified the higher risks that are posed by 
lithium ion batteries, and provided for a more robust 
demonstration of protection from those risks.
    Special conditions are really a way of building off what we 
know to allow the introduction of new technology carefully, 
making sure that we set a little bit more robust standard for 
something that is new, or novel, before we just allow it into 
the aviation system.
    As to lessons learned, I had mentioned before we are still 
waiting for the NTSB's final investigation report on probable 
cause, and we think that will help inform some lessons. FAA and 
Boeing are also doing an indepth review of the certification 
process, and we expect to learn lessons from that, as well.
    But there are some things that we have seen already. I 
think the first and most important is that we have identified a 
more robust testing regime to be used for testing lithium ion 
batteries. Boeing used that in the redesign, and that will be 
the regime that FAA will use, going forward. So I think that is 
an important lesson. We have already raised the safety bar that 
much.
    In addition, we have identified that with new technologies 
there often times are experts who are not involved in aviation, 
but are experts in that technology. We need to find a way to 
make sure we are reaching that community of experts to help us 
make sure that when we introduce new technologies, we 
understand everything that can be known at the time.
    So, those, I think, are a couple of lessons learned. There 
are also those kinds of process improvements, where we need to 
enhance communication between the manufacturer and all of the 
sub-tier providers that they buy parts from. FAA needs to be 
monitoring that more closely, as well. So there are several 
process improvements that we are going to pursue, as well.
    Ms. Johnson. Thank you. In your written testimony you 
discuss the use of aviation experts outside the agency to 
resolve technical problems, noting certification of aviation 
products and systems is not limited to the participation of a 
single certifying entity and manufacturer. Please explain what 
steps, if any, the FAA takes to bring this independent, outside 
technical expertise to bear on the challenges associated with 
the certifying of the lithium batteries for the use of Boeing 
787.
    Ms. Gilligan. Yes, ma'am. As we were just talking, there is 
an organization called RTCA, which is a standards-setting 
organization that FAA uses, along with SAE, another similar 
organization. Through those groups, we pull together experts on 
the technology. So, again, at the RTCA we had a wide-ranging 
panel of experts with aviation experience, with lithium battery 
experience, to help us build the standards and the description 
for how a manufacturer would demonstrate that the lithium ion 
battery was safe.
    We do have a lot of mechanisms in place that let us reach 
experts around the world on the particular technologies that we 
are trying to address.
    Ms. Johnson. Thank you very much. Thank you, Mr. Chairman.
    Mr. LoBiondo. Mr. Davis.
    Mr. Davis. Thank you, Mr. Chairman, and thank you, Ms. 
Gilligan, for being here today. I apologize for coming in late. 
That seems to be the nature of our business, they double-book 
things.
    But I know you mentioned you had some responses to 
organization designation authorization. I would just like to 
ask you quickly a couple questions to have you expand on that. 
With fewer resources on the horizon for FAA across all offices, 
how will you further utilize ODA and that delegation to meet 
the growing certification workload for new products at both 
Boeing and throughout the American aerospace industrial base?
    Ms. Gilligan. Thank you, sir. As we discussed a little bit 
before, FAA has, for many, many years leveraged our internal 
resources by using either individuals or, now, organizations to 
whom we delegate authority to act on our behalf. It is a key 
way that we are meeting the safety requirements for certifying 
products. We see that expanding over time.
    The ODA is a relatively new authorization. We are learning, 
as the industry applicants are learning, as we go. But I expect 
that we will see ODA, if not mushroom, certainly grow 
substantially. It is a way that we can leverage our resources 
and assure the safety of the product at the same time.
    Mr. Davis. OK, thank you. Now, Boeing. Right now are you 
overseeing all of the--are you overseeing the entirety for 
inspections that would normally fall under an ODA----
    Ms. Gilligan. Oh, no.
    Mr. Davis [continuing]. Or their employees?
    Ms. Gilligan. Oh, no, no. The Boeing Company has an ODA. It 
is quite a robust ODA. We work very closely with them. We 
continue to provide oversight of the ODA. We need to assure 
that they are performing their authorizations on our behalf 
appropriately. I think, as we see in this hearing, there is 
always a balance between how much we delegate and how much 
involvement the FAA has. It is a delicate balance that we watch 
closely. Mostly, what we want to assure is that those who are 
operating or acting on behalf of the Administrator, do so in 
the same way an FAA engineer would have operated. We see that 
that is very much the case at the Boeing ODA.
    Mr. Davis. OK. So Boeing is still completing some delegated 
tasks that they have normally completed, and you are just doing 
your oversight?
    Ms. Gilligan. That is right. We provide oversight of the 
ODA.
    Mr. Davis. All right. I yield back the balance of my time. 
Thank you for your time today.
    Ms. Gilligan. Thank you.
    Mr. LoBiondo. Mr. Duncan?
    Mr. Duncan. Well, thank you, Mr. Chairman. Like the others, 
I had another hearing that started at 9:30 before this one. 
But--so I don't know if this has been covered, or not.
    But the next witness is going to testify that Boeing put 
this--these--this 787 electrical system under an astounding 
amount of testing, 5,000 hours of component testing, 25,000 
hours of laboratory testing, 10,000 hours at the airplane 
level, simulation of 100--equivalent to 132,000 flights. In the 
FAA study of this, have you been able to determine why, after 
all this testing, did this problem not show up before? Is it 
just a fluke, or----
    Ms. Gilligan. Mr. Duncan, again, we haven't seen the root 
cause analysis or the probable cause determination for the two 
individual incidents from the NTSB. We agree with Boeing that, 
with all the testing that was done for the original 
certification, we did not see these types of events manifest 
themselves. We also know that when we introduce new products, 
after all of the engineering work that has been done, we often 
see something in operation that either we did not anticipate 
during certification, or where we see one of the assumptions 
that we built off of was just not accurate.
    So, it is not uncommon for us to learn from the new product 
after it is introduced and to make improvements. That is what 
happened here. We had two events, we went back and analyzed 
them. Boeing redesigned the system, we were able to approve 
that redesign. The system and the aircraft are safer for it.
    Mr. Duncan. And I assume it is just a coincidence that both 
of these carriers happen to be Japanese carriers, as I 
understand. But is there something that these carriers require, 
or that the Japanese Government requires, that is different 
from what went into the other 787s?
    Ms. Gilligan. No, sir, not that I am aware of. Right now, 
we really are looking at the aircraft, the design manufacture 
and assembly of the aircraft, to see if there is anything that 
we may have overlooked that might have contributed to these two 
events, and, if so, we will address those based on whatever the 
data shows.
    Mr. Duncan. The FAA requires manufacturers to assume or 
prepare for problems occurring, and this--and have a plan for 
mitigation to take care of these types of situations. And 
apparently, you didn't find that this plane was at risk at any 
time, and no one was injured. So, from that standpoint, the 
system worked. Would that be a correct statement?
    Ms. Gilligan. Yes, sir. Until we see what the probable 
cause was, it does appear that, although we had the failure 
within the battery at the cell level, that the rest of the 
design, which met our standards, did contain that event, thus 
the aircraft was not at risk and was able to safely land.
    You are right, that is very much a tenet of our 
certification process, to design so there won't be a failure, 
then assume there is a failure and design so that the airplane 
can safely land. In that regard, after the event occurred, it 
appears everything worked as it was intended to work. But 
again, we will need to see what the NTSB results show.
    Mr. Duncan. All right. Thank you very much.
    Mr. LoBiondo. OK, Ms. Gilligan, we thank you very much, 
appreciate it, and we will move on to the second panel. Mike?
    Ms. Gilligan. Thank you, sir.
    Mr. LoBiondo. OK. Our second witness today is Mike Sinnett, 
Boeing's chief engineer for the 787 program. Mr. Sinnett, you 
are recognized for a statement.

  TESTIMONY OF MIKE SINNETT, VICE PRESIDENT AND CHIEF PROJECT 
        ENGINEER FOR THE 787 PROGRAM, THE BOEING COMPANY

    Mr. Sinnett. Chairman LoBiondo, Ranking Member Larsen, 
members of the committee, my name is Mike Sinnett, and I am the 
vice president and chief project engineer for the Boeing 787 
program. It is my pleasure to appear before you today, and I 
want you to know that Boeing is committed to supporting your 
work in any way that we can.
    Mr. Chairman, Boeing's highest priority is the safety of 
the passengers and crews who fly on our airplanes. Every Boeing 
airplane incorporates the broad, deep, and ever-increasing 
knowledge we have gained from nearly 100 years of designing and 
building airplanes. Our design approach is data-driven, with 
risk carefully assessed and managed. Our designs feature 
multiple layers of protection and redundancy of critical 
systems, so that no single component failure or combination of 
failures, even extremely remote, can endanger an airplane.
    Mr. Chairman, flying is as safe as it is because industry 
and Government work together day in and day out. The 787 
illustrates that commitment to cooperation. The design process 
started with a review of everything the industry and its 
regulators have learned about designing, building, and 
operating safe airplanes. I can attest to the team's strong 
focus on safety, and to the strength of the certification 
process, which was more rigorous for the 787 than it was for 
any of our previous airplane programs.
    When our airplanes enter service, we continuously monitor 
their performance, analyze the data we collect, share safety-
related findings with customers and regulatory authorities, and 
work with all parties to incorporate lessons learned into the 
active fleet and its new production and designs. The result is 
an exceptional, safe, and reliable airplane.
    Over its first 15 months of service, the 787 achieved a 
schedule reliability rate of 98.2 percent. That is better than 
the 777, which had been considered the best in its class up to 
that point. At the end of that 15-month period, we experienced 
two battery failures. And as we explained at recent NTSB 
hearings, both incidents, while serious, demonstrated the 
effectiveness of our design philosophy. The airplane's 
redundant safety features worked. They prevented the incidents 
from jeopardizing the passengers and crews.
    With that said, the work done following the two incidents 
revealed ways we could improve the battery system even further. 
Boeing devoted more than 200,000 engineering hours to develop a 
comprehensive solution, and worked closely with the FAA to test 
and certify these improvements. Through changes to the design 
of the battery, the manufacturing process, and the addition of 
a steel enclosure, we added protections that reduced the 
likelihood of a failure, and further ensured that, should a 
failure occur, there will be no significant impact to the 
airplane.
    Mr. Chairman, I would like to turn to certification, 
because I know that is a subject of great interest today. All 
of our airplanes are certified by the FAA, which is recognized 
globally as the gold standard. A key component of every 
airplane certification is the process for delegation of 
authority. Delegated authority furthers the top priority of 
industry and Government, which is safety. The ability to 
delegate authority through team tasks enables FAA specialists 
to focus on the highest-priority issues.
    Organizations that demonstrate strict accountability to 
certification requirements may receive what is called 
organization designation authority, or ODA. It is a privilege 
that is hard to obtain, and it carries serious 
responsibilities. Notably, the FAA remains firmly in control, 
and ODA holders are governed by stringent requirements that 
include an FAA-approved process for selecting and training 
individuals to perform these delegated tasks. I can assure you 
that the members of the Boeing ODA are held to a very high 
standard, and are backed fully with the support of The Boeing 
Company.
    As mentioned, the certification process for the 787 was the 
most rigorous in Boeing's history. It took 8 years and involved 
three times more conformed tests than the 777 certification 
program, three times more data submittals, twice as many 
airplane ground tests, and three times more integration tests.
    In closing, I would like to reiterate that certification is 
not the end of Boeing's involvement in the safety of delivered 
airplanes. We collect and analyze enormous amounts of 
operational data. And when we spot a safety issue, we address 
the issue so that safety is maintained. This ongoing commitment 
to safety and the collaboration we find across aviation, 
coupled with our in-service monitoring and data-driven risk 
management approach to designing new airplanes, are key reasons 
that flying is the world's safest way to travel. Flying today 
is 70 times safer than driving. And in recent years there have 
been zero deaths from airline accidents here in the United 
States. None of this is happenstance.
    Mr. Chairman, this concludes my remarks, and I will be 
happy to answer any questions. Thank you.
    Mr. LoBiondo. Thank you. Could you tell us what you believe 
the lessons learned were from these two incidents? And what, if 
anything, you are doing in response to them? I mean other than 
the fixes, which I know are, you know, being put in place.
    Mr. Sinnett. I think the first thing that I think of is 
that, because of these incidents and the work that followed, 
Boeing and the team that we worked with advanced the state of 
the art for understanding and testing lithium ion batteries. 
The test protocol that we had gone through up to this point had 
reflected the previous state of the art of the industry. And we 
worked, following these incidents, to push the state of the art 
so that we could cause a battery to fail in a similar way as it 
failed on the airplane. So this was one of the areas.
    I think we also learned a significant amount about how to 
improve the processes in the manufacture and quality control of 
batteries, of lithium ion batteries.
    And lastly, and I think most importantly, these incidents 
validated our design philosophy, which is that no single fault 
can put an airplane at risk, and no combination of faults, even 
extremely remote, can put the airplane at risk. And again, 
these incidents validated--revalidated that design philosophy.
    Mr. LoBiondo. Some have suggested in the aftermath of the 
two incidents that somehow the FAA certification process was in 
some way lacking. How would you respond to that?
    Mr. Sinnett. I would disagree. I believe that the 
certification process for the battery and for the airplane was 
extremely robust. The process takes into account the risks of a 
component failing, and the process takes into account the 
resulting impact on the airplane. And, as Ms. Gilligan pointed 
out, while the incidents occurred and the battery did fail, the 
failure itself was contained at the battery level and did not 
put the airplane at risk. And the certification approach 
ensures that that is the outcome.
    In a machine as complex as an airplane, there can be 
components that fail. We take those failures very seriously, 
and we work to address them. An accident can be the cause of 
multiple links in a chain that fail. And any time we have an 
incident which can be considered the break of the first link in 
that chain, we take it seriously. The incident was referred to 
as potentially impacting safety, and that is because the first 
level of the--of redundancy was compromised, and that is the 
first link in the safety chain. And so we take it very 
seriously.
    Mr. LoBiondo. OK, thank you. Mr. Larsen?
    Mr. Larsen. Thank you, Mr. Chairman. Mr. Sinnett, back to 
that first question I asked Ms. Gilligan about self-
certification. If you could imagine, again, the book-ends 
being--where people call it self-certifying, where they give 
the company--``Just go do something and come back and tell us 
what you did and we will check the box,'' versus the FAA 
crawling all over it every day, in control, and then says, 
``Here, take it and do this.'' How would you characterize the 
certification process, if those were, in fact, the book-ends?
    Mr. Sinnett. I would say that it was somewhere in the 
middle. The way the delegation works, the FAA looks at the 
tasks at hand, and it considers which tasks are safety-related, 
and it retains those safety-related tasks. In areas where the 
tasks are more relatively mundane, typical of what you do day 
in and day out in the cert process, they may delegate those 
tasks to the delegated organization.
    In the case of the battery, the initial battery 
certification, the FAA retained the items that were inherently 
safety related. For example, the FAA retained approval of the 
certification plan. They also retained approval of the safety 
assessment following all the testing of the battery. Those were 
the two items that were most important in establishing the 
safety of the battery system, and in assuring that, as we--as 
the applicant, Boeing, showed compliance, that the FAA was able 
to find compliance to the safety-related aspects.
    The other things that they delegated, things like tests to 
set up conformity, witnessing of certain environmental tests, 
those aren't necessarily germane to the safety of the overall 
system and the overall design. Really, the keys to the kingdom 
there are the certification plan itself, how we propose to show 
compliance to all the rules, and then the safety assessment, 
which ties all of the analysis and the results to the end 
safety product.
    Mr. Larsen. OK. Can you talk about the--what you called the 
new state of the art in testing? The old state of the art, if 
you will, we have discussed and NTSB discussed this nail 
penetration of a battery. And perhaps--I think we know now that 
it probably wasn't the--should not have been a standard. Can 
you talk about what was the old state of the art and what you 
think the new state of the art on testing of lithium ion 
batteries are for this size of a----
    Mr. Sinnett. Sure.
    Mr. Larsen. You know----
    Mr. Sinnett. Sure. In the past, the failure modes 
associated with large lithium ion battery cells were--there 
were really two types of failure modes. One was a severe 
failure resulting from an overcharged condition, where the cell 
contains more energy than it was ever designed to contain, 
because of a failure of the charging system, or a failure of 
the charging procedures. That type of failure has led to open 
flame resulting outside of the battery cell, and has been an 
area of great concern, from a safety perspective, which is why 
the charging system comes under such scrutiny, and is so 
carefully designed. In the NTSB factual report, they have set 
aside any concern about overcharging as being one of the 
potential failure modes of this battery.
    The only other failure modes that we are aware of are 
failure modes that result from short circuits inside the 
battery due to a number of different causes. Regardless of the 
cause, when those short circuits occurred, the net result at a 
cell level was simply the use of the--there is a burst disk on 
the side of the cell that opens when the cell pressure and 
temperature rises to allow the cell to safely vent.
    In all other cases, for a battery failure, for a cell 
failure, the only thing that has resulted is that disk opening 
and the battery venting the electrolyte, which looks like smoke 
to you or I, but it is venting electrolyte with no flame.
    These particular cells had undergone more than 2 million 
hours of operation on the airplane without a failure, and had 
undergone millions of hours of operation in another industry, 
also without a failure.
    The test state of the art at that time was a nail 
penetration test. And when that nail penetration test was 
performed, it replicated every known failure mode of the cell, 
with the exception of overcharge. And so, while the cells would 
short circuit, their temperature and pressure would increase, 
they would vent this electrolyte, which, again, looks like 
smoke. But in no cases were there ever flame, and in no cases 
was there ever propagation to another cell inside a battery. 
For that reason it was considered state of the art through, 
again, millions and millions of hours of operation.
    On the JAL airplane and on the ANA airplane, what we saw 
was some type of internal short circuit, but we don't know yet 
what the root cause was, because that is still under 
investigation. But the net result was a more energetic release 
of energy from the cell than we had seen, either through the 
nail penetration testing, or from any of the previous testing.
    And so, to replicate that, we had to put a significant 
amount of energy into the cell without overcharging. The only 
way that we knew how to do that was to wrap a cell with a 
heating element, and put on the order of 300 kilojoules of 
energy into the battery in the form of heat to heat up the cell 
so that it would burst its disk and vent the electrolyte. What 
we found in that process was that it was energetic enough that 
it released enough heat to cause other cells in the same 
battery to vent, as well.
    And so, when I think of the state of the art, we have 
advanced that state of the art to the point where now we can 
replicate a cell failure with sufficient energy to cause that 
venting to propagate to subsequent cells in the battery, and 
that is where the current state of the art is today.
    Mr. Larsen. Mr. Chairman, could I continue?
    Just to--for my edification, 300 kilojoules sounds like a 
lot. Can you just explain--I am sure everyone else here knows 
what a kilojoule is. Could you just explain what a kilojoule 
is? I don't' know what it is, so----
    Mr. Sinnett. It is--a good way to think about it is--the 
cell of the battery, that is about 30 percent more energy than 
that cell contains when it is fully charged. So you can think 
about overcharging a cell by about 30 percent. That is the 
amount of energy that we are talking about.
    Mr. Larsen. Oh, OK. I will have a second round.
    Mr. LoBiondo. Ms. Johnson? Questions?
    Ms. Johnson. [No response.]
    Mr. LoBiondo. No? Back to you.
    Mr. Larsen. Sure, great, thanks. So, with the new state of 
the art, would you argue, then--would you argue that that will 
be the state of the art? Is that going to get in the literature 
for the next lit review, and this is how you are supposed to be 
doing it because we know better now?
    Mr. Sinnett. I would imagine that for the immediate near 
term it would be, until somebody thinks up a better way to do 
it.
    One of the ways we might not like it is that it is 
overconservative at this point. We add a lot of energy to the 
battery to make it do what it does. And you never want to be 
overconservative, you kind of want to hit the sweet spot. But 
for right now, being overconservative is better than being----
    Mr. Larsen. And by overconservative, you mean you are 
really stressing the battery beyond what anyone would ever 
think it would be doing.
    Mr. Sinnett. That is correct.
    Mr. Larsen. Yes. So it ends up not being a realistic 
situation?
    Mr. Sinnett. It encompasses all realistic situations and 
then some. And it gave us great confidence with the battery 
enclosure that we have designed to go around the battery.
    In fact, in our certification testing on the airplane, with 
the airplane operating and the engines running, we wrapped that 
same heater element around a cell inside the battery in the 
newly designed enclosure, and we put that same amount of heat 
into that battery cell and caused the battery to fail on the 
airplane, while the airplane was operating, pilot is on board, 
engines running, in a conformed certification test, and 
demonstrated that, even while that single cell failed, the 
battery continued to operate for the next hour, and the 
airplane continued to operate normally throughout the entire 
event.
    Mr. Larsen. Are you involved with the ODA process?
    Mr. Sinnett. I am involved as the applicant. And inside 
Boeing we kind of have a firewall between the delegated 
organization and the applicant, which is the designer, the 
builder, the requester of the certificate. I am the designer 
and builder.
    Mr. Larsen. OK. You are getting at the crux of my question. 
Because if Boeing is an ODA or has an ODA designation, we have 
FAA working with the ODA within an organization, but that 
organization also then is designing, building the equipment, in 
this case an airplane. How do you keep those separate? Because, 
you know, the watcher is watching the ODA. The ODA is supposed 
to be watching the maker. But if the ODA and the maker are 
under one roof, then how do we--how would we look at that and 
say, ``Well, we need to have more separation''?
    Mr. Sinnett. It is a--to a large degree, it is a process-
based separation that is rooted in our culture. For example, 
while we are a designated organization today, we have always 
had designed representatives of the FAA performing aspects of 
the showing of compliance.
    Now, since I started in Boeing commercial airplanes 23 
years ago, it has been my history that I was taught from the 
very beginning that when a Boeing engineer is acting on behalf 
of the FAA, they are completely independent, and they have--
they cannot come under any undue management pressure to do 
something that is against what they would term as best, from an 
FAA perspective. And that is deeply rooted in our culture. One 
of the quickest ways to see disciplinary action as a manager is 
to provide any undue influence over a designated representative 
of the FAA. And it is in our absolute culture to make sure that 
they are independent from that perspective.
    We believe that for a couple of reasons. One, it is one of 
the primary legs in the safety stool. It--our whole industry 
relies on that. Second, we also understand that, without that, 
the certification process itself would take much longer than it 
does today, and the net product would probably not be as good 
as it is today, because we wouldn't have the expertise of the 
individuals who know as much as they do about the individual 
systems.
    Mr. Larsen. Presumably, the FAA could pull an ODA status, 
as well, if there were any problems.
    Mr. Sinnett. That is right. The FAA can pull that privilege 
from us at any time, if we are not performing it appropriately. 
And, likewise, the FAA can take an individual who is performing 
as a delegated representative and remove that individual, as 
well.
    Mr. Larsen. Yes. I will explore that a little more with the 
FAA, I think.
    I have got one last question, and it has to do with all 
those airplanes sitting on the tarmac in Paine Field. And I 
know you are moving to get those delivered, and very happy 
about that. But it goes to the changes, now that you have the--
you have signed off on the new change of the new system with 
the box and the vent. And then, incorporating that now into the 
production process and moving those planes out, is that--does 
that need to be separately certified, as well?
    Mr. Sinnett. That change----
    Mr. Larsen. The process of changing them out, putting the 
new boxes in.
    Mr. Sinnett. Yes. There were two separate certifications. 
One was really related to the basic type design of the 
airplane----
    Mr. Larsen. Right.
    Mr. Sinnett [continuing]. Changing to incorporate it. And 
the other was a certification of the service bulletin that is 
performed by the airlines to make that modification. Boeing 
teams did that modification work for the airlines, but that was 
under the service bulletin that had been approved by the FAA.
    Mr. Larsen. Any involvement in developing that 
certification for the process includes management engineers and 
machinists on the line, making sure everybody is working off 
the same page?
    Mr. Sinnett. That is correct.
    Mr. Larsen. Yes.
    Mr. Sinnett. Right.
    Mr. Larsen. That is it. Thanks.
    Mr. LoBiondo. OK. Mr. Sinnett, we thank you very much, and 
the subcommittee stands adjourned.
    Mr. Sinnett. Thank you.
    [Whereupon, at 11:22 a.m., the subcommittee was adjourned.]
