As a result of the ONA DC-10 accident at JFK, the NTSB held two public hearings. One of these hearings dealt specifically with the CF-6 engine the engine certification requirements, type of engine failure, etc.

After the hearings, the NTSB determined that the probable cause of this accident was, "the disintegration and subsequent fire in the No. 3 engine when it ingested a large number of sea gulls." A contributory factor to the accident according to the NTSB was, "the Federal Aviation Administration and the General Electric Company failed to consider the effects of rotor imbalance on the abradable epoxy shroud material when the engine was tested for certification."

The FAA then issued an Airworthiness Directive (AD) requiring a modification to the engine shroud. This AD also required a retrofit for the shroud on existing engines.

Among the six recommendations the NTSB issued on the CF-6 engine were that the FAA "increase the maximum number of birds in the various size categories required to be ingested into turbine engines with large inlets. These increased numbers and sizes should be consistent with the birds ingested during service experience of these engines.”

The FAA has not yet acted on the last recommendation of the NTSB. Action was withheld pending the agency's Engine Regulatory Review Program. Results of that program have not yet been made public.

Of the CF-6 episode, the House subcommittee commented:

". . . when the FAA is engaging in its critical function of certificating an engine or an aircraft, it must resolve any doubts on the side of caution. It did not do that in this instance. The CF-6 engine had drilled turbofan blades and a different anti-icing capability than previous engines. The FAA should have required simulated flight testing before certificating the engine. Moreover, when damage to the engines occurred during the icing flight tests of the aircraft, additional testing under comparable conditions should have been required of the manufacturer."

The subcommitte concluded:

"When the engine and later the aircraft (the DC-10) encountered certification difficulties, the respective manufacturers of each descended on the FAA to forestall further testing and to expedite the certification process. This can no doubt be expected, but the FAA must resist any such pressures to shortcut its procedures. There can be no accommodation when considerations of safety must be paramount.” (Emphasis added.)

ATTACHMENT 2

WET RUNWAY PERFORMANCE

Current certification standards require that aircraft be tested only on dry runways. This failure of the Federal Aviation Administration to require testing under such a common operating condition as a wet runway has been directly responsible for many accidents and incidents. There were 21 accidents in the 1967-1977 period, and there are about 30 incidents each year involving wet runways. Modern airliners weigh as much as 300 tons and are traveling at about 150 m.p.h. when they land. Clearly, whether the runway is wet or dry will have a major effect on how much distance the aircraft will need to stop safely because aircraft perform far differently on wet runways than on dry ones.

For example, many transport aircraft have spoilers-devices on the top of the wing that pop up after landing to "spoil" the lift of the wing and thereby keep the aircraft on the ground and shorten the stopping distance. These spoilers are usually deployed automatically as soon as the aircraft wheels start going around. That works well on dry runways but not so well on wet ones.

On runways with a thin layer of water on top, the aircraft wheels often skim across the top of the water and do not touch the hard surface underneath. This phenomenon is called hydroplaning. In addition to making the aircraft brakes ineffective, hydroplaning also causes the spoilers not to deploy automatically because the wheels are not turning. The pilots can deploy the spoilers manually, but that takes time. During that time, the aircraft is traveling hundreds of feet down the runway.

It must be remembered that approach and landing is one of the highest periods of crew workload. There are many manual and mental tasks to perform during touchdown. Any additional tasks, mental or manual, placed on the pilot by the failure of an automatic system can only be a detriment to safety.

The adverse impact that wet runways have on aircraft performance and therefore on safety means that wet-runway performance should be included in the certification process. ALPA has recommended that several times in the past 15 years. For example, in 1973, we told the FAA that its Flight Test Handbook, which tells manufacturers how to test their aircraft for certification, should include testing on wet runways. When the Handbook appeared, however, it contained no mention of wet-runway testing. In 1974, we recommended to the FAA's Airworthiness Review a proposed rule covering aircraft performance on wet runways. So far, we have heard nothing; the FAA has neither acted on nor rejected our proposed rule.

The distance for landing on a dry runway as determined by the FAA through testing includes an allowance for such operational variables as landing long, i.e., farther down the runway than usual, and landing faster than usual. However, the experience built up over the years by airline pilots clearly shows that this allowance is insufficient when the runway is wet.

But the FAA has not required additional testing to determine scientifically what the wet runway stopping distance should be. Instead, it has glossed over this deficiency in the certification process by adding an arbitrary 15 percent to the dry runway stopping distance to arrive at the wet runway distance.

There are two serious flaws in this procedure. First, the FAA does not define what a wet runway is. Second, the agency allows the manufacturer to demonstrate shorter landing distances than required by the 15 percent rule. Such a provision can be almost meaningless if there is no definition of a wet runway.

That is graphically illustrated by the Boeing 727. The company was able to convince the FAA that the 727 required only 7-8 percent more to stop on a wet runway instead of the agency's estimate of 15 percent, and the aircraft was allowed to use the shorter distance.

However, later tests by the FAA and the National Aeronautics and Space Administration showed that the 727 on a truly wet runway far exceeded even the 15 percent margin. In some cases, the aircraft took about twice the dryrunway distance to stop on a wet runway. The reason is that brake application just after touchdown caused the wheels to lock. That in turn induced extensive hydroplaning, which led to the excessive runway stopping distances.

The lack of wet runway standards in the certification process has resulted in pilots developing their own techniques to cope with the problem. There have been many incidents and accidents stemming from hydroplaning; that there have not been more is a tribute to the skill and experience of airline pilots, not to the FAA's certification procedures.

ATTACHMENT 3

AUTOMATIC LANDING SYSTEMS

Equipment and techniques that would enable airliners to land automatically in very bad weather have been under development since 1959. At that time, the ceiling, or the bottom of the clouds, had to be at least 300 feet above the ground and visibility along the runway had to be at least three-quarters of a mile before the aircraft could attempt a landing.

Last year, the Federal Aviation Administration certificated an automatic landing (autoland) system for the Boeing 727 that requires a decision height of only 50 feet above the ground and runway visibility of only 700 feet.

The Air Line Pilots Association believes the FAA criteria for such poor-weather landings are a safety hazard. The FAA approved these landings without adequate research and testing and without requiring certain mandatory features found in autoland systems used successfully in Europe. The members of ALPA, who have thousands of hours or airline operational experience, believe the system certificated by the FAA is unacceptable. Other technology exists that would permit safe autoland operations to the low minimums already approved by the FÁA.

In August, 1975, the FAA announced its intention to establish requirements for certification of airline landings in very bad weather for the Boeing 727 and other aircraft such as the Boeing 737 and the McDonnell Douglas DC-9 that have autoland systems installed. The new weather minimum criteria (Category IIIA) were visibility along the runway (RVR) of 700 feet, and a decision height of 50 feet. (Decision height (DH) is the height above the ground at which the pilot either must see the runway ahead or end the approach and climb.) As justification for its decision, the FAA cited the following: The French have successfully conducted such operations.

Boeing has completed all Category III requirements for the 727 autoland system.

The feasibility of conducting operations to such low weather minima was discussed at an industry meeting in August, 1973.

The FAA conducted a series of autoland approaches with a 727 in January, 1974.

Additional tests were run at the FAA's National Aviation Facilities Experimental Center (NAFEC) in April and July, 1974.

The Air Line Pilots Association formally protested the autoland certification in letters to the FAA on April 20, June 23, and September 15, 1977. The FAA certificated the system August 12, 1977, without responding satisfactorily to ALPA pleas to delay certification pending more complete testing and research.

ALPA has undertaken its own lengthy investigation of the FAA's justification. What we learned makes us question whether the FAA's autoland system will provide an adequate margin of safety.

French Operations. In citing the "European experience" for certificating failpassive autoland systems to the lowest possible limits, the FAA overlooked a number of important factors. The FAA cited specifically Air Inter, a French domestic airline, which operates to minimums of 50 feet above the runway and 150 meters (492 feet) of runway visibility.

For these operations, however, Air Inter requires:

Three-man cockpit crews, even though the aircraft may be flown with just two pilots.

Detailed crew procedures.

Specially-qualified and trained pilots.

Automatic throttles and so-called "decrab" capability.

Ability to fly a missed approach automatically.

If the automatic system for a missed approach fails, the pilot can take over and fly the aircraft manually using an independent gyroscopic attitude indicator. FAA's new criteria include none of those safeguards, which ALPA believes are essential if full safety is to be assured.

Boeing Data.-Clearly, Boeing has complied with the FAA criteria for certification of its autoland system and did collect all data specified by those criteria. The analysis of these data and the conclusions reached are largely dependent upon a few basic assumptions that we believe are open to question. The most notable of these are that:

All go-around attempts following a failure in the autoland system will be successful because the failure will leave the aircraft in a position that assures a successful go-around.

Runway visual range (RVR) of 700 feet is assumed to be adequate, according to Boeing, because that is the figure the FAA uses. The FAA says that the 700-foot distance is based on Boeing data.

Conventional cockpit instruments are adequate to monitor the autoland system during the critical phases of approach and landing.

The ground portion of the instrument landing system (ILS) is 100 percent reliable.

ALPA believes that a complete, scientific certification program is needed to answer the serious questions raised by these unstated assumptions in the Boeing data. Answers are particularly needed to questions about the safety of operating to 50-foot decision height and 700-foot runway visibility with fail-passive autoland systems.

Industry Meeting.-The transcript of the August, 1973 meeting, which had representatives from virtually every segment of the airline industry, shows there was a strong consensus that:

Fail-passive autoland systems should not be authorized for operating to minima lower than Category II unless the total system reliability for such operations would be on the order of 10-9.

Establishment of the reliability would need to be demonstrated by an adequate program of test and analysis.

This test and analysis program would necessarily consider, among other factors, the frequency of missed approach initiation at and below decision height and the risk associated with executing a missed approach at these altitudes.

Criteria for fail-passive autoland operations below Category II limits should include consideration of aircraft geometry and pilot eye height and should require independent go-around guidance.

Flight Demonstrations.-The FAA conducted 20 automatic landings at Oklahoma City. The data given to ALPA on these tests consisted of two pages: one a memo and the other a tabulation of the flights. The memo says that the RVR on the 20 flights varied from 1,000 feet to 2,200 feet. The tabulation covers only the first 14 flights and shows RVR's of 1,000 to 3,000 feet. The memo and the tabulation thus do not agree. In any event, the FAA has not tested the autoland system at the RVR of 700 feet that it proposes to allow for airline operations. Current Category II operations permit RVRS as short as 1,200 feet.

NAFEC Tests.-The script for the tests called for 49 anomalies in the ILS localizer and glide slope to be introduced during the tests. Only seven were actually introduced, and none of these involved the glide slope, which provides guidance on the proper angle of descent during approach. In none of the 44 attempted autolandings, the pilot disconnected the autoland system because he considered the aircraft sink rate, drift rate or position to be unacceptable. Thus, the pilot took over in more than 20 percent of the approaches in good weather. Clearly, the capability of the pilots to take control of the aircraft under the poor weather of Category III is important and needs to be established. ALPA has found no evidence that the FAA has done so.

It is obvious that the tests run at NAFEC and the flight demonstrations at Oklahoma City are not sufficient to declare the proposed autoland system safe for airline operations.

In the latest response to ALPA, in January of this year, the FAA said it has "serious doubts as to whether continuing this long-standing series of correspondence can serve any useful purpose since substantial amounts of time in both your organization and ours are being devoted to unproductive correspondence on this subject. No new information has been forthcoming, and much of our effort, which needs to be devoted to bona fide safety questions, is being diverted unnecessarily." Rather than go away quietly, as the FAA clearly would prefer, ALPA will continue to push for higher standards of safety in commercial aviation.

CONCLUSIONS

Due to the philosophy of its design and the manner in which it has been certificated, ALPA believes the FAA has certificated a system that is unacceptable for Category III operations by itself. We believe it is superior to the conventional Category II, single-channel autopilot in all respects. We also believe that if a suitable head-up display (HUD) were used in conjunction with this system, it would be possible to operate safely into conditions as low as Category IIIA, providing that the display made sufficient information available to the pilot to enable him to perform all the tasks such a system would require him to do.

ATTACHMENT 4

COLLISION AVOIDANCE SYSTEMS

The Federal Aviation Administration was established partly as a result of a 1956 midair collision that cost the lives of 128 passengers. One of FAA's responsibilities was to improve the air traffic control system to prevent similar tragedies. More than two decades have elapsed, and the FAA is still testing and researching in its quest for a technologically "adequate" system, while it continues to depend on the outmoded "see-and-be-seen" concept.

During the 1960's, the FAA examined various concepts of independent airborne collision avoidance systems only to abandon the idea as unworkable and incompatible with a ground-based air traffic control system. Instead, the agency decided to look at the long-range development of a ground-based concept called Intermittent Positive Control (IPC). This system relayed advisory and maneuver information from ground controllers to cockpit displays. The IPC would be designed to transmit this information to the aircraft only when necessary to avoid hazardous situations.

The National Transportation Safety Board in November, 1969, convened a public hearing to investigate the causes and prevention of midair collisions. NTSB statistics showed a critical deficiency in the Nation's air traffic control system: from 1959 to 1968, there were 223 midair collisions involving U.S. registered aircraft. Nearly half, 109, were fatal, resulting in 528 deaths. Although commercial aircraft were involved in only 6.7 percent of the accidents, the passengers of the commercial aircraft accounted for 66 percent of the fatalities.

ALPA has been calling on the FAA for many years to develop and certificate an effective CAS for airline use. We have not favored any one technology; there are several that could accomplish the mission. However, we have maintained that any CAS should be installed in the aircraft to give the pilot direct, immediate knowledge of any impending threat. The FAA, on the other hand, has favored a system that would rely on computers on the ground to detect a possible collision and transmit a warning to the aircraft. In addition to taking responsibility away from the pilot, the system proposed by the FAA would not provide any backup warning to the pilot if the ground-based equipment failed.

In the early 1970's, Congress expressed concern over the FAA's delay in solving the collision avoidance problem. This concern was sharpened by the fact that airborne collision avoidance designs that could provide some protection for commercial air carriers and other aircraft were available. In 1973, a government advisory group reached much the same conclusion. This group challenged FAA's assertion that the ground-based IPC system, though years from implementation, was the best solution.

The problem of near midair collisions intensified in the 1972-1975 period. The FAA reported a total of 1,219 air traffic control system errors-either human, equipment or procedural failures-that resulted in 105 near midair collisions.

By 1976, Congress was demanding a solution to the collision avoidance system problem, but the FAA hedged. It reported to the Senate Aviation Subcommittee that it had tested CAS designs from three avionics corporations, but that new developments made it necessary to wait until 1977 to set CAS criteria. Characteristically, the FAA failed to meet this self-set goal.

As far back as early 1972, ALPA was critical of the FAA for showing a lack of urgency in developing equipment that will enable the pilot to know when a midair collision is imminent. Early last year, the FAA told the Senate aviation subcommittee it intended to pursue an airborne system known as the beacon collision avoidance system (BCAS) and would have a national standard by June, 1977. At about the same time, ALPA called on the FAA to push development of BCAS and presented a list of minimal technical and operational criteria, including data to be displayed to the pilots.

In June of last year, ALPA pointed out the BCAS is compatible with the FAA's ground-based system known as the discrete address beacon system (DABS). Therefore, it should not be considered an interim system to be used only until DABS becomes operational. Earlier this month, the FAA indicated it will issue a draft national standard for a basic BCAS by the end of this year. Under the most recent development schedule, the first operational equipment for airplanes would be available in 1982.

This BCAS, however, cannot be used in heavy-traffic areas. It will not be mandatory to install it in airline transports; thus there is no requirement for an airline to buy it. In the meantime, the FAA says it will begin to develop a concept for a more-capable BCAS that can be used in heavy traffic areas.

However, the recent experience of airline pilots has clearly shown that the danger of midair collisions continues to grow not only at the large and busy airports but also at the more numerous smaller ones. There is a mix of airline transports flying under control from the ground and other aircraft that frequently fly without such control at the smaller airports. This mix of controlled and uncontrolled aircraft is not found at the large airports.

The airline aircraft and the uncontrolled ones come close together near the airport. It is there, during approach and landing and during takeoff and climbout, that the workload of the airline flight crew is at it's peak. Thus, the pilots have little time to spend looking out the window for other aircraft and, therefore, would benefit greatly from having an effective CAS in the cockpit.

The increasingly crowded air traffic control environment and crew workload are subjects that the FAA should be paying particular attention to as it prepares to certificate the transports of the future. The agency's attitude toward workload measurement is indicative of its inadequate foresight. The FAA still looks at workload as it was measured in the 1960's, with the emphasis on manual tasks. Many experts in this area point out that advances in computers and other avionics means that the pilot of the future will have fewer manual tasks and be more of a system monitor. Thus, the FAA will have to apply the new measuring techniques being developed to understand fully the future air transport environment and the demands it will place on the cockpit crew.