Safety Recommendation A-06-037

We note that, on March 13, 2015, you issued certification policy memorandum PS ANM 25 12, “Certification of Structural Elements in Flight Control Systems,” which specifies that structural failures must be included in the system safety analysis. The issuance of the certification policy memorandum satisfies Safety Recommendation A-02-50, which is classified “Closed—Acceptable Action.”

Safety Recommendation A-06-37 consists of two parts: consideration of structural failures and consideration of human/airplane systems interactions. We have previously said that your May 3, 2013, publication of the final rule and associated advisory circular for Part 25.1302, “Installed Systems and Equipment for Use by the Flight Crew,” satisfied the second part of the recommendation. The issuance of PS ANM 25 12 satisfies the first part of Safety Recommendation A-06-37, which is classified CLOSED--ACCEPTABLE ACTION.

Although we previously expressed concern with the length of time between when the certification policy memorandum was made available for public comment and when it would be issued, we are pleased that the work has been completed.

-From Michael P. Huerta, Administrator: As indicated in previous responses to the Board regarding these recommendations, the Federal Aviation Administration (FAA) developed a policy statement (PS) to clarify that structural elements in systems are not exempt from system requirements. On March 13, 2015, we issued PS-ANM-25-12, "Certification of Structural Elements in Flight Control Systems." This PS is available at the following Web site: rgl.faa.gov. The Board previously indicated this PS would complete our actions in response to these recommendations. I believe that the FAA has effectively addressed these recommendations and consider our actions complete.

Safety Recommendation A-06-37 consists of two parts: consideration of structural failures and consideration of human/airplane systems interactions. Your May 3, 2013, publication of the final rule and associated AC for Part 25.1302, “Installed Systems and Equipment for Use by the Flight Crew” completes the actions that satisfy the second part of the recommendation. On May 11, 2010, you released for public comment a policy memorandum specifying that structural failures must be included in the system safety analysis. The draft policy, if implemented, would satisfy Safety Recommendation A-02-50, and the first part of Safety Recommendation A-06-37 addressing structural failures.

We are not aware of any controversy associated with this draft policy, nor do we believe that, unlike the issuance of new regulations and mandates, issuance of the policy memorandum would require any review beyond that of the FAA. However, in the 4 1/2 years since this draft policy was published, you have neither completed the work nor issued the policy. We point out that we issued Safety Recommendation A-06-37 more than 8 years ago and Safety Recommendation A-02-50, almost 12 years ago. Such long delays are not acceptable.

Accordingly, pending timely issuance of a policy memorandum based on the proposal published for comment on May 11, 2010, Safety Recommendations A 02 50 and A 06 37 are classified OPEN—UNACCEPTABLE RESPONSE.

-From Michael P. Huerta, Administrator: As we stated in our letter elated May 6, 2011, there are two aspects to this recommendation: 1) consideration of structural failures and 2) consideration of human airplane/system interaction failures, in the assessment of safety critical systems.

We are finalizing the policy statement on structural failures mentioned in our previous response and expect to complete it by December 31. 2013. On May 3, 2013, we published the final rule and AC for§ 25.1302, Installed Systems and Equipment for Use by the Flight Crew (78 FR 25 840). This is in addition to the two documents we previously issued regarding human airplane/system interaction failures. AC 25 1302-1 can be found at the following Web site: http://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_25.1302-1.pdf

The AC provides requirements and guidance for the design and evaluation of controls, displays, system behavior, system integrations, and error management of installed equipment intended for flight crewmember use.

I will keep the Board informed of the FAA's progress on this safety recommendation and provide a further response by August 31, 2014.

In May 2010, the FAA released for public comment a draft certification policy memorandum specifying that structural failures must be included in the required system safety analysis. The NTSB separately provided favorable comments on this proposed policy, which addresses the first part of this recommendation (consideration of structural failures in the assessment of safety-critical systems). In its current letter, the FAA also described a number of actions that it has taken to address the second part of this recommendation (consideration of human airplane/system interaction failures in the assessment of safety-critical systems).

Among these actions was the publication in February 2011 of a notice of proposed rulemaking (NPRM) to revise Part 25.1302, “Installed Systems and Equipment for Use by the Flight Crew,” to address flightcrew error. Pending release of the final version of the certification policy memorandum, and the issuance of a final rule based on the NPRM, Safety Recommendation A-06-37 is classified OPEN—ACCEPTABLE RESPONSE.

CC# 201100201: - From J. Randolph Babbitt, Administrator: There are two aspects to this recommendation, 1) consideration of structural failures and 2) consideration of human airplane/system interaction failures, in the assessment of safety critical systems. In consideration of structural failures, in 2010 we released for public comment a policy memo specifying that structural failures must be included in the system safety analysis. We are currently finalizing the policy memo based on comments received, including those from the Board.

In consideration of human airplane/system interaction failures we published:

1. Advisory Circular 25-11A, Electronic Flight Deck Displays in 2007, that provides general guidance for the design, installation, integration, and approval of electronic flight deck displays, components, and systems installed in transport category airplanes along with safety aspects and human performance. Because of the size of the AC, it is accessible on our regulatory and guidance library Web site.

2. Section 25.1322, Flightcrew Alerting (enclosure 1) and its associated AC in 2010. The final rule enhances flightcrew alerting standards by updating definitions, prioritization, color requirements, and performance for flightcrew alerting to reflect changes in technology and functionality; and

3. The notice of proposed rulemaking for § 25.1302, Installed Systems and Equipment for Use by the Flight Crew (enclosure 2) was published in February 2011 to address flightcrew error. Its associated AC was also published for comment. This rulemaking will provide requirements and guidance for the design and evaluation of controls, displays, system behavior, and system integrations as well as design guidance for error management of installed equipment intended for flight crewmember use.

This recommendation was reiterated with the issuance of A-09-113 through- 128 greensheet. This greensheet references a June 4, 2007 accident of a Cessna Citation 550, N550BP, which impacted Lake Michigan shortly after departure from General Mitchell International Airport, Milwaukee, Wisconsin (MKE).In its 2006 study of the aircraft certification process, the NTSB made two recommendations to the FAA concerning human/aircraft interaction issues in the certification of aircraft. Safety Recommendation A-06-37 asked the FAA to ?

amend the advisory materials associated with 14 CFR] 25.1309 to include consideration of structural failures and 7 human/airplane system interaction failures in the assessment of safety-critical systems.

This recommendation was reiterated with the issuance of A-09-113 through- 128 greensheet. This greensheet references a June 4, 2007 accident of a Cessna Citation 550, N550BP, which impacted Lake Michigan shortly after departure from General Mitchell International Airport, Milwaukee, Wisconsin (MKE).In its 2006 study of the aircraft certification process, the NTSB made two recommendations to the FAA concerning human/aircraft interaction issues in the certification of aircraft. Safety Recommendation A-06-37 asked the FAA to ?

amend the advisory materials associated with 14 CFR] 25.1309 to include consideration of structural failures and 7 human/airplane system interaction failures in the assessment of safety-critical systems.? Safety Recommendation A-06-38 asked the FAA to require a program for the monitoring and ongoing assessment of safety-critical systems throughout the life cycle of the airplane. Once in place, use this program to validate that the underlying assumptions made during design and type certification about safety-critical systems are consistent with operational experience, lessons learned, and new knowledge.

In response to these recommendations, the FAA indicated that it was incorporating more standardized consideration of human factors into new certification projects and planned to develop new regulations and advisory materials and a human factors design guide. Additionally, the FAA stated that it intended to formalize a process for monitoring and assessing safety critical systems throughout the life cycle of an airplane. Pending the FAA’s related actions, the NTSB classified Safety Recommendations A-06-37 and -38, ?Open Acceptable Response? On September 12, 2007.

However, although this investigation revealed that many Citation pilots were aware of some of the human factors issues associated with the Citation cockpit design (such as the potential for inadvertently pressing the wrong button when engaging the autopilot or yaw damper), the NTSB is not aware of any plans by Cessna or the FAA to change the design to address these issues. The FAA indicated to the NTSB that it was developing guidance on human factors issues in aircraft for use by its certification staff; however, the NTSB is not aware that this new guidance has been developed and distributed, nor that it would address the many issues identified in this accident.

Therefore, the NTSB concludes that the circumstances of this accident demonstrate the importance of a program for the FAA to monitor and conduct ongoing assessments of safety-critical systems throughout the life cycle of an airplane; the FAA did not perform this task adequately for the Cessna Citation. Because the numerous human factors issues identified in the accident airplane’s cockpit design may have been corrected if current human factors principles had been applied after certification, the NTSB reiterates Safety Recommendations A-06-37 and 38 and classifies both OPEN -- UNACCEPTABLE RESPONSE.

During the March 28, 2007, meeting, the FAA indicated that it is developing formal guidance on when structures- and systems-related regulatory provisions should apply. With regard to human/airplane system interaction, the FAA is incorporating more standardized consideration of human factors into new certification projects, and plans to develop new regulations and advisory material, amend existing regulations and advisory material, and develop a formalized human factors design guide.

The activities described by the FAA are responsive to this recommendation. The Safety Board emphasizes that this recommendation asks that the safety implications of a structural failure on system function be considered in the assessment of safety-critical systems. While formal guidance on when structures- and systems-related regulatory provisions should apply is valuable and needed, it remains necessary to consider the effect that a structural failure has on the functions performed by relevant safety-critical systems.

Pending development and issuance of improved guidance on when structures- or systems-related regulatory provisions should apply, inclusion of structural failures in system safety analyses, and development and issuance of improved guidance and regulations concerning human factors considerations in type certification projects, Safety Recommendation A-06-37 is classified OPEN -- ACCEPTABLE RESPONSE.

Letter Mail Controlled 8/29/2006 8:26:32 AM MC# 2060429: - From Marion C. Blakey, Administrator: 8/17/06 The FAA agrees with the intent of these safety recommendations, and we have been working on several initiatives that we feel address the issues underlying them. For example, based on the outcome of our Certification Process Study (CPS), we launched a number of initiatives, including an initiative called Key Safety Information, which is closely related to the safety critical systems”concept. Other initiatives address maintenance human factors as well as oversight of repairs, alterations, and maintenance.

In response to these recommendations, we have formed an internal team to evaluate current FAA initiatives. This team will assess the CPS initiatives, FAA’s research program, and rulemaking projects to determine relevance to the recommendations. The team will then identify any shortfalls and propose any refinements to our strategy, if necessary. We plan to complete that assessment by September 2006. We would like to meet with your staff after that time to discuss the results. A member of my staff will contact you to establish a meeting date. After those discussions, we will revise our plans for addressing the recommendations and provide you with a formal status update by January 31, 2007.

I will keep the Board informed of the FAA’s progress on these safety recommendations. Staff level meeting with FAA to discuss recommendations on aircraft certification, 3/28/07 The FAA indicated that it is developing formal guidance on when structures and systems related regulatory provisions should apply. In general, the more restrictive provision would apply in areas where the decision may not be obvious.

With regard to human/airplane system interaction, the FAA is incorporating more standardized consideration of human factors in new certification projects, and plans to develop a new regulation (25.1302) and advisory material, amend existing regulations (25.1309 and 25.1322) and advisory material, develop a formalized human factors design guide, and conduct research to affect continued improvement. However, the FAA acknowledged that this would likely remain a work in progress for the foreseeable future.