Mr. Chairman and Members of the Subcommittee: We appreciate the opportunity to discuss the Federal Aviation Administration‘s (FAA) oversight of passenger aircraft maintenance, an important safety issue. While attention has focused in the last several months on improving the security of air travel after the September 11thattacks, this hearing is evidence of the importance of keeping a similar focus on safety. Before September 11th, this past year was shaping up to be among the safest in U.S. aviation history. Until the terrorist attacks, we had not had a fatal accident involving a commercial aircraft. Since that time, American Airlines Flight 587 crashed in Queens, New York. The National Transportation Safety Board is determining the cause of that accident. The United States operates one of the safest and most complex aviation systems in the world. The responsibility for maintaining this high level of safety is shared among FAA, the air carriers, and aircraft manufacturers. In this regard, it is important to note that FAA and the aviation industry rely on a series of overlapping controls to ensure that aircraft are maintained safely. The Nation‘s safety record is impressive, but accidents have pointed to questions about whether or not FAA‘s oversight of air carriers is operating as it should. At the outset, two such accidents are important to touch on–ValuJet Flight 592 and Alaska Airlines Flight 261. The May 1996 ValuJet accident had a significant impact on the way FAA does business. The breakdowns in ValuJet‘s safety systems and in FAA‘s oversight prompted an in-depth internal review of FAA‘s inspection program. The recommendations from this 90-day safety review proved to be the catalyst for the development of FAA‘s Air Transportation Oversight System (ATOS). The January 2000 Alaska Airlines crash and subsequent findings on Alaska Airlines‘ maintenance programs once again focused attention on FAA‘s oversight. Early reports indicated the crash may have been caused by an aircraft maintenance problem. FAA again embarked on special safety reviews to determine why Alaska Airlines and FAA inspectors had not identified the problems in the carrier‘s maintenance programs. Today I would like to discuss three points: • Fully implementing ATOS processes and better training inspectors. These issues are important because ATOS is a systems approach designed to identify and correct high risk safety problems. -------------------------------------------------------------------------------- Page 3 • Ensuring air carriers monitor their own maintenance systems. This is important because these systems represent the first line of defense for the safe operation of aircraft. • Correcting common threads that limit the effectiveness of FAA‘s oversight programs. As far back as 1987, our office and the General Accounting Office (GAO) have found persistent problems in the collection and use of safety data, inspector training, and correcting identified safety problems. FAA‘s own internal reviews have identified the same problems. FAA Must Move ATOS to Full ImplementationMore than 3 years ago, in October 1998, FAA introduced ATOS at 10 major air carriers. ATOS is designed to use data to identify trends and spot problems before they result in incidents or accidents. ATOS should help FAA inspectors focus their efforts on the causes of and solutions to the most significant safety deficiencies. Moving to ATOS is also important because FAA does not have enough inspectors to physically inspect every aircraft. ATOS is conceptually sound. However, ATOS is still not reaching its full potential at the original 10 major carriers and has not been expanded to the remaining passenger carriers. I will briefly discuss two of the reasons. Ø First, FAA implemented the system prematurely, without all the key elements. While we recognize that any safety inspection system continually evolves, key ATOS components–most importantly the process for collecting and analyzing safety data–were not fully developed when the system was deployed at 10 carriers in 1998. According to the contractor that helped FAA develop ATOS, FAA‘s compressed implementation schedule is one of the primary factors that hindered FAA‘s ability to successfully implement ATOS. The contractor‘s representative told us that when ATOS was introduced, FAA had only developed procedures for planning, conducting and reporting inspections, but not for analyzing the results. To work effectively, ATOS relies heavily on analysis of data about air carriers‘ operations. However, FAA is still working to provide inspectors with the kind of tools (or checklists) they need to collect and report good quality inspection data. For example, the inspector has to answer —yes“ or —no“ to broad, general questions, such as —Did all observed maintenance records comply with procedures for the aircraft airworthiness requirements?“ Yet, —maintenance records“ may refer to airframe, engine, or avionics-related maintenance. 2 -------------------------------------------------------------------------------- Page 4 Without specifying which kind of maintenance, the answer has limited value for targeting inspections. Over 50 percent of the inspectors we interviewed told us they did not understand ATOS inspection checklist questions they were required to use in evaluating air carrier systems. For example, one question inspectors have to answer under ATOS is: —Does the individual understand the interfaces attribute associated with the Aircraft Airworthiness Requirements process?“FAA has agreed that the checklists need to be redone, but this work will not be completed until September 2003. Ø Second, the inspectors were not adequately prepared for the shift from the inspection system in use for over 30 years to the new ATOS approach. As a result, inspectors did not widely accept the new system. Inspectors expressed concerns that there were not enough —hands-on“ inspections of aircraft or facilities in ATOS. Also, FAA did not adequately train inspectors. While all ATOS inspectors had some initial ATOS training, 71 percent of the inspectors we interviewed considered the training inadequate. Inspectors advised us that when the initial ATOS training was provided in 1998, the inspection checklists and the ATOS computer system were not finished. Therefore, the classes could only familiarize inspectors with ATOS concepts, with no practical hands-on training. Further, less than 20 percent of inspectors we interviewed told us they had been given needed training on system safety concepts, risk analysis, or auditing–skills inspectors need to successfully accomplish ATOS inspections. FAA began developing a training course on systems safety in October 2000 and began training inspectors in October 2001. However, all inspectors will not be trained until September 2002. Air Carriers Need to Better Monitor Their Own Maintenance SystemsIn December 2001, we reported on FAA‘s oversight of aircraft maintenance–more specifically, whether FAA ensured air carriers properly monitored their maintenance programs. Air carriers are responsible for the safe operation of their aircraft and for continually evaluating their own maintenance operations. FAA inspectors cannot inspect every aircraft. Therefore, it is important that FAA inspectors verify that air carriers have systems in place to identify maintenance procedures that could lead to poorly maintained aircraft. Also, air carriers can use these systems to collect and analyze data to identify trends the air carrier needs to address, such as repetitive failures of a particular 3 -------------------------------------------------------------------------------- Page 5 type of aircraft engine. In the current environment, where air travel demand is down, and corresponding revenues have sharply decreased, these internal maintenance monitoring systems can serve an important function for air carriers. If used properly, air carriers‘ internal monitoring systems can better focus the carriers‘ maintenance resources. Even though FAA has had a long-standing requirement for carriers to monitor their own maintenance, the agency has placed limited emphasis on this area when doing oversight. FAA inspectors conducted reviews of air carriers‘ ongoing aircraft maintenance, but did not routinely assess how well the systems were working. In some cases, inspectors counted attendance at carriers‘ monthly maintenance meetings as inspections. Further, during FAA‘s April 2000 special inspection, FAA determined that one carrier‘s internal system to monitor the quality of its maintenance work was ineffective. The FAA special review found that critical safety weaknesses, such as deferring repairs beyond set time limits, were going undetected. Our work showed that until FAA‘s special review, FAA had not performed an inspection of the carrier‘s internal safety system in 2 years. When inspections were performed of carriers‘ maintenance oversight systems, FAA did not ensure the problems were corrected. For example, another air carrier was not analyzing critical aircraft data for trends. FAA inspectors identified this problem in 1996, 1998, and again in FAA‘s special review in September 2000. Both our report and FAA‘s review showed that FAA inspectors needed to provide better surveillance of air carriers‘ internal maintenance oversight systems. Also, FAA inspectors needed better training on how to evaluate these systems. In addition, we found that inspectors needed to better document their inspections so they could perform trend analysis on the inspection results and ensure that identified deficiencies are corrected. FAA agreed to implement the recommendations we made in these areas. FAA Must Correct Persistent Problems in Its Oversight Process In reviewing reports prepared as far back as 1987 by our office and the General Accounting Office (GAO), we found three common threads limiting FAA‘s ability to improve its oversight. These problems center on collection and use of safety data, inspector training, and follow-up on previously identified safety problems. In these reports, recommendations were made to address the problems and FAA promised to take corrective action. Yet, a recent FAA study, issued in March 2002, shows problems persist. For example, this study, which was a combined industry and FAA review of certification, operations and maintenance processes concluded that FAA‘s data 4 -------------------------------------------------------------------------------- Page 6 analysis efforts had been hampered by a lack of quality data, in part stemming from an inability to compare and combine data from existing databases. Despite the fact that FAA has devoted an inordinate amount of resources to improving its collection and use of data, FAA has been unable to correct long-standing problems in this area. These problems severely hinder FAA‘s ability to use data for analysis, conclusions, and identifying accident precursors; effectively steer its inspections to the areas where they are needed most; and follow up to ensure identified deficiencies have been corrected.To its credit, within the last year, FAA has taken steps to address problems in ATOS and has made progress in generally improving its oversight of air carriers. FAA recently put a new management team in place that seems committed to improving ATOS and correcting past program problems and delays. FAA has agreed to implement recommendations we made in both our ATOS and aircraft maintenance reports. To make material progress on these long-standing concerns, the key now is follow-through on a number of steps. • First, FAA needs to strengthen its process for collecting and analyzing inspection results. • Second, FAA must improve training for inspectors in the concepts and skills needed to effectively carry out safety inspections. • Third, FAA must develop a system to effectively follow up on deficiencies identified during air carrier inspections. 5 -------------------------------------------------------------------------------- Page 7 Background Figure 1. Scope of FAA Oversight Approximately 3,300 FAA safety inspectors provide oversight to: Ø 139 commercial air carriers Ø 5,200 repair stations Ø 637,000 active pilots Ø 273,000 aircraft mechanics Ø 7,600 commercial aircraft Ø 11,000 charter aircraft Ø 220,000 general aviation aircraft Ø 700 aviation training facilitiesThe safety of U.S. air passengers is the joint responsibility of the air carriers and FAA. The 139 commercial air carriers in the United States have developed unique and complex systems to provide safe and efficient operations. As shown in Figure 1, oversight of these systems is only one part of the wide range of responsibilities FAA inspectors have in ensuring that safety standards are maintained. FAA and the aviation industry rely on a series of overlapping controls to ensure aircraft maintenance is performed properly. The margin of safety is built on a system of redundancies–just as there are redundant systems on an aircraft, there are multiple systems of safety oversight. Air carriers are responsible for the safe operation of their aircraft and for maintaining a system that constantly monitors the quality of the maintenance work done on their aircraft. FAA‘s oversight is a secondary but important control that ensures that air carriers have programs in place and are using them to make sure aircraft maintenance is performed according to approved procedures. 6 -------------------------------------------------------------------------------- Page 8 As far back as 1987, our office and GAO have reported numerous shortcomings in FAA‘s safety oversight system. Persistent among these shortcomings were inadequate data collection and analysis, lack of inspector training, and failure to ensure correction of problems that are identified. FAA‘s own internal reviews have identified the same problems. In response to GAO reports, FAA began developing its Safety Performance Analysis System (SPAS), a computer system designed to analyze information about air carriers from existing safety databases, and alert inspectors to pending safety trends. For example, SPAS was expected to identify specific types of aircraft that experienced problems, such as fuel leaks, at rates higher than what was normal for aircraft of the same type. Unfortunately, development of the SPAS system was a lengthy process, taking 6 years to complete. In 1996, ValuJet Flight 592 crashed into the Florida Everglades raising concerns about FAA‘s oversight and prompting a 90-day internal FAA review of its oversight process. The recommendations from this review led to FAA‘s decision to develop a new inspection system called ATOS, which was introduced in October 1998. 7 -------------------------------------------------------------------------------- Page 9 FAA Must Move ATOS to Full Implementation ATOS, as developed by FAA and Sandia National Laboratories, is designed to use data to identify trends before they become safety problems, and to help FAA inspectors target their inspection efforts. Under ATOS, inspectors must focus more on inspecting air carrier systems rather than individual aircraft. This was a major cultural change for FAA inspectors, who were accustomed to using hands-on inspections to find safety problems–a —kick the tires“ approach to inspecting as well as randomly selecting the aircraft or area to be inspected. ATOS is conceptually sound because it is data-driven, targets inspector resources to the highest risk areas, and results in comprehensive systemic solutions to safety problems. However, 3 years after it was introduced, ATOS is still not operating as intended at the original 10 air carriers and has not been expanded to the remaining 129 passenger air carriers. Even though four FAA reviews and a GAO audit disclosed problems with ATOS in 1999 and early 2000, we found that many of the same problems still exist. A number of reasons for this were summarized in our report issued Monday and are highlighted below. 8 -------------------------------------------------------------------------------- Page 10 FAA Implemented the System Prematurely Without All the Key Processes. While we recognize that inspection systems can continually be improved, ATOS was initiated prematurely with fundamental components missing. FAA is still working to fully develop procedures to analyze safety data and to ensure identified deficiencies are corrected (the Implementation component). Sandia National Laboratories officials–who helped FAA develop ATOS–told us that FAA‘s compressed implementation schedule is one of the primary factors that hindered FAA‘s ability to successfully implement ATOS. In addition, according to Sandia Laboratories officials, when ATOS was introduced, policies, processes, and procedures were developed primarily for the air carrier surveillance segment of ATOS–the portion related to planning, conducting, and reporting inspections. However, the analysis component did not exist. Today, FAA maintains that ATOS was fully functional when it was introduced, and that it is fully implemented at the 10 ATOS carriers; however, we disagree. We found that FAA has developed general procedures for each ATOS component, 9 -------------------------------------------------------------------------------- Page 11 but the system is far from fully functional. Primarily, FAA continues to have problems with collecting and analyzing quality data–the foundation upon which ATOS is built. FAA officials told us they plan to finish developing the final two ATOS components by April 30, 2002, at which time, FAA will begin field testing. FAA is still working to provide inspectors with the tools they need to collect and report good quality inspection data. The inspection questions that were first developed for inspectors to use in evaluating air carriers‘ maintenance and operations were confusing to inspectors. Over 50 percent of the inspectors we interviewed told us they did not understand the questions. For example, one question inspectors have to answer under ATOS is: —Does the individual understand the interfaces attribute associated with the Aircraft Airworthiness Requirements process?“Further, they said that the questions are too broad to generate useful information. For example, one question on an ATOS inspection checklist is —Did all observed maintenance records comply with procedures for the Aircraft Airworthiness Requirements?“ Given the numerous maintenance records and airworthiness requirements for engines, landing gear, rudders, etc., this question is not specific enough to allow useful trend analysis of inspectors‘ responses. 10 -------------------------------------------------------------------------------- Page 12 FAA has agreed the questions need to be redone and has begun work in this area. However, FAA is still determining what critical information will be required from inspectors to provide meaningful analysis of air carrier operations. Once this is determined, FAA will then begin work on developing new questions for the 95 areas of an air carrier‘s operation that inspectors review under ATOS. FAA expects to complete this effort by September 2003. Also, not all data from ATOS inspections are being captured in the ATOS database. For example, during an inspection of an air carrier‘s maintenance facility, inspectors at one ATOS field office observed two separate DC-10 aircraft where bolts that go through the bottom of the wing and into the fuel tank were loose, creating the potential for fuel leakage. However, the inspectors told us they could not enter the inspection results in the ATOS database because the inspectors had not been tasked to inspect the aircraft. As a result, this critical information was not available for trend analysis to determine if a fleet-wide problem existed. FAA has recently overcome one hurdle by integrating the ATOS database with SPAS on January 30, 2002. SPAS has always been considered a critical system that FAA needed for analyzing safety data from different safety and inspection databases, such as the Program Tracking and Reporting System that contains data collected under the traditional inspections. FAA designated SPAS to be the 11 -------------------------------------------------------------------------------- Page 13 system to analyze ATOS inspection data as well. However, there had been a delay in resolving design inconsistencies that prevented SPAS from reading ATOS data. Existence of an integrated ATOS/SPAS analysis system should facilitate future efforts to analyze important safety data. Inspectors Were Not Adequately Prepared for the New ATOS Approach. ATOS is a major shift in FAA‘s oversight approach. For over 30 years, inspectors concentrated on finding problems by inspecting aircraft instead of primarily relying on analysis of data and reviews of air carriers‘ systems. Inspectors were not adequately prepared for this shift because inspectors did not receive adequate training. Further complicating the switchover, qualified inspectors were not located where they were most needed. While all ATOS inspectors had some initial ATOS training, 71 percent of theinspectors we interviewed considered the training inadequate. In addition, FAA has been developing a training course on system safety since October 2000 and finally began training inspectors in October 2001. However, all inspectors will not be trained until September 2002. 12 -------------------------------------------------------------------------------- Page 14 Figure 3. Lead Inspectors Consider ATOS Data Inadequate to Retarget Inspection ResourcesInadequate83%Adequate13%Non-responsive4%This lack of training for the inspector workforce has adversely affected the quality and usefulness of data collected from ATOS inspectors. Continuous analysis of ATOS data should permit inspectors to retarget, or change, their inspection plans when negative safety trends are identified. Although FAA inspectors have periodically retargetedinspections, 83 percent of the lead inspectors we interviewed said the ATOS data are not adequate to help with these retargeting efforts, as shown in Figure 3. Also, of the lead inspectors we interviewed, 68 percent told us that inspectors were not assigned to locations where they were most needed. While we recognize the difficulty FAA faces in accomplishing this task, inspectors expressed this as a major concern with ATOS. Also, FAA did not always assign inspectors with the necessary experience and background to ATOS offices. For example, an inspector assigned to one ATOS office responsible for monitoring a major air carrier did not have experience with jet aircraft. FAA Needs to Establish Strong National Oversight and Accountability to Ensure Consistent Field Implementation of ATOS. FAA lacked a strong 13 -------------------------------------------------------------------------------- Page 15 national oversight strategy to ensure ATOS was consistently and properly implemented. Although FAA appointed an ATOS program manager, this manager did not have line authority. Instead, this office merely provided administrative guidance and support for field offices. The lack of strong national oversight of ATOS implementation caused confusion among the inspector workforce and managers as to who was really managing ATOS. Without strong national oversight, inspectors were essentially left on their own to implement ATOS. As a result, ATOS has been put into practice inconsistently across FAA field offices. For example, one field office has taken a different approach to ATOS by conducting some ATOS inspections jointly with the air carrier‘s internal audit staff. While this joint approach has potential merit, FAA needs to resolve issues related to possible loss of inspector independence and lack of written agency policy and procedures to sanction this approach. Air Carriers Need to Better Monitor Their Own Maintenance Systems As part of the overlapping controls within the aviation system, air carriers are responsible for continually evaluating their own maintenance operations to determine where to focus their maintenance resources. In the current environment, where demand for air travel is down, and corresponding revenues 14 -------------------------------------------------------------------------------- Page 16 have sharply decreased, these internal maintenance monitoring systems are important to air carriers for two purposes. First, internal evaluation systems identify procedures being used by maintenance technicians that could lead to poorly maintained aircraft. Second, the systems should continually collect and analyze data to determine trends that the air carrier needs to address, such as repetitive failures of a particular type of aircraft engine. As part of its oversight, FAA should monitor these air carriers‘ systems for evaluating their maintenance operations. In December 2001, we issued a report that summarized the adequacy of FAA‘s oversight in this area. Even though FAA has had a long-standing requirement (since 1964) that provides it with a way to hold carriers accountable for monitoring their own maintenance, FAA placed limited emphasis on evaluating air carrier internal systems for monitoring maintenance. FAA‘s oversight of carriers‘ internal maintenance programs needs to be improved. We found that while FAA inspectors conducted reviews of air carriers‘ ongoing aircraft maintenance, reviews of the carriers‘ internal maintenance oversight systems were not routinely conducted or were not conducted in a comprehensive manner. For example, some inspections consisted only of inspectors‘ attendance at carriers‘ maintenance meetings. Additionally, inspectors were not provided 15 -------------------------------------------------------------------------------- Page 17 adequate training on how to evaluate the effectiveness of the air carriers‘ internal maintenance monitoring systems, hampering the inspectors‘ ability to conduct thorough evaluations. FAA inspectors also maintained little documentation on inspections, precluding effective trend analysis of findings. Finally, when inspections of the internal oversight systems were performed and deficiencies were identified, FAA did not ensure the problems were corrected in a timely manner. FAA Inspectors Had Not Received Adequate Training on How to Evaluate Carriers‘ Internal Maintenance Oversight Systems or Documented Their Inspection Results to Allow for Trend Analysis and Targeting Inspections.Inspectors were not provided training on how to evaluate the effectiveness of carriers‘ internal maintenance oversight systems. Current inspector training primarily focuses on how to approve a carrier‘s system, not how to test the implementation of the system to determine whether it is functioning effectively. We also found that FAA inspectors did not record sufficient information about inspection results from air carriers‘ maintenance monitoring system reviews to permit trend analysis. For example, inspection documentation primarily showed the results of inspections as —yes,“ —no,“ or —satisfactory“ answers in FAA‘s inspection databases. When the results were unsatisfactory, inspectors were 16 -------------------------------------------------------------------------------- Page 18 required to record comments, but there was no requirement to document what corrective action was taken. FAA Must Ensure Identified Deficiencies Are Corrected. When inspections were performed and deficiencies identified, FAA did not ensure the problems were corrected in a timely manner. For example, at one air carrier, significant deficiencies were identified in the internal system to monitor aircraft maintenance as far back as 1996; however, these deficiencies were still not corrected when FAA performed a special inspection at this carrier in September 2000. At another carrier, inspectors identified maintenance deficiencies in July 1998 that were substantial enough for FAA to take enforcement action against the carrier. Despite this action, many of these problems were not corrected and were identified again when an independent FAA team conducted an inspection at the carrier in July 2000. FAA‘s National Program Review Identified Weaknesses in Carriers‘ Internal Maintenance Monitoring Systems. At the same time we were performing our review, FAA was conducting its own series of special inspections known as the National Program Review. The Review was initiated after serious shortcomings were found in Alaska Airlines‘ maintenance programs following the crash of Alaska Airlines Flight 261. FAA found problems to some degree in the internal 17 -------------------------------------------------------------------------------- Page 19 maintenance monitoring systems at all nine air carriers reviewed, and in at least three cases these problems were significant. For example, FAA found that one carrier allowed insufficient time for maintenance technicians to perform maintenance functions. Both our report and FAA‘s own review showed that FAA inspectors needed to provide better surveillance of air carriers‘ internal maintenance oversight systems. Figure 4. Aircraft Inspection Results at One Air Carrier Problem Found Aircraft 1: No. 2 Engine Thrust Reverser Inoperative. Aircraft 2: No. 1 Engine Blade Nicked; Flap Rubbing Engine Pylon. Aircraft 3: No. 1 Engine Shows Evidence of Metal Shavings in Tailpipe. Aircraft 4: Right Engine Oil Leak; Left Aileron Trim Tab Deteriorating. Aircraft 5: Hydraulic Leaks at: Flap Actuator Motor, Landing Gear Module, and Nose Landing Gear Actuator. Aircraft 6: No Problems Identified. This was particularly evident when FAA inspected in-service aircraft during its special reviews of air carriers. As shown in Figure 4, maintenance problems were found on five of the six aircraft inspected at one air carrier. As a result of FAA‘s special inspection, FAA concluded the carrier‘s maintenance programs and internal inspection systems were deficient. These problems should have been detected by the carrier‘s own internal evaluations of its maintenance operations. In turn, FAA‘s oversight of the carrier should have identified systemic shortcomings in the carrier‘s internal system that permitted the deficiencies to occur. 18 -------------------------------------------------------------------------------- Page 20 FAA agreed to enhance its oversight of air carriers‘ internal maintenance monitoring systems and indicated that corrective actions are underway. FAA agreed to require inspectors to better document inspection results, expedite the development of training for inspectors who oversee air carriers‘ internal maintenance monitoring systems, and develop a follow-up system to monitor inspection findings. FAA Must Correct Persistent Problems in Its Oversight Process From our past audit work, as well as the work performed by the GAO and FAA‘s own internal reviews, the following three overarching themes require management‘s continued attention if FAA‘s oversight function is to be improved: • collecting and using safety data to identify problems and focus inspections on the areas of highest risk, • training of inspectors, and • establishing systems to follow up on safety problems that have been identified. 19 -------------------------------------------------------------------------------- Page 21 As far back as 1987, the OIG and GAO have reported on numerous shortcomings in FAA‘s safety oversight system. While inspection programs can always be improved upon, we found some of the same fundamental issues that were identified more than 15 years ago still exist today. Both OI
An average of one time every day there is a safety-related accident, incident , or threat reported in the U.S., with the majority of incidents going unreported.
The press usually covers only major accidents that result in total and absolute fatalities.
The table below is a list of small plane crashes that occured during recent months in 2008. This is just a small list of hundreds of crashes that occur yearly.
Legal Disclaimers
All attorney listings are a paid attorney advertisement, and do not in any way constitute a referral or endorsement by an approved or authorized lawyer referral service. The information provided on Aviation Attorneys.com is not intended to
be legal advice, but merely conveys general information related
to legal issues commonly encountered. Your access to and use of this website
is subject to additional Terms and Conditions.
Regional Resources