Since June, Boeing Co.'s newest jumbo jet, the 777, has been logging daily flights between Washington and London. With its sophisticated new design--drawn up entirely on a computer screen--the $4 billion aircraft program is a technological and commercial triumph for the nation's largest plane manufacturer. The $4 billion Malaysia Airlines order last week that included 15 of the new planes confirmed what many in the aviation industry already knew: As the hot-selling 777 takes off, Boeing is soaring ahead of rivals.
But a four-month investigation by BUSINESS WEEK has revealed that, for more than two years, Federal Aviation Administration officials have been engaged in a highly contentious debate about a possible 777 design problem that raises serious safety issues. BUSINESS WEEK reviewed scores of internal FAA documents and held lengthy interviews with numerous midlevel engineers and safety inspectors at the agency, including several who worked directly on the 777 certification project. These sources--most of whom spoke anonymously for this article out of fear of reprisal--say that many FAA officials continue to question whether the plane has been adequately tested. "It's an issue of safety," says one FAA engine specialist, referring to concerns that the 777 could be severely destabilized if a fan blade broke. "It could lead to catastrophe."
DUAL MANDATE. Boeing executives declined to comment for this article. In a written statement, the company maintains that "no airplane in history has been tested as thoroughly as the Boeing 777." Top FAA officials in Washington also vehemently defend the plane. Thomas McSweeney, director of the FAA's aircraft-certification service, says that if he believed the plane was unsafe, he'd have stopped certification "in a heartbeat. The airplane has met every regulation that it was required to meet."
But well-placed FAA sources see the issue differently. They believe that pressure to meet Boeing's planned certification date for the plane--Apr. 19, 1995--led top-level officials at the FAA to overrule safety concerns raised by the agency's own engineers. Keenly aware that Boeing's commercialization schedule depended on meeting that deadline, these sources argue that FAA management granted the 777 an operating certificate without adequately testing for the potential design flaw. Critics say that such problems stem from the agency's dual mandate: The FAA's charter calls for it to ensure the safety of the public as well as to promote the U.S. aviation industry. "The FAA is supposed to regulate the manufacturers to ensure airline safety," complains one FAA inspector. "Washington knows how important that plane is to Boeing's entire existence."
McSweeney denies that contention. While aircraft manufacturers "try to hold to their certification dates," he maintains that the FAA did not rush to meet Boeing's schedule. But this is not the first time the FAA has faced criticism of being too close to planemakers. In a General Accounting Office report on the FAA's certification practices published last year, the agency was criticized for exercising weak oversight. Normally, the agency works closely with the manufacturer during the final stages of design of a new plane. After conducting flight tests and reviewing compliance with FAA regulations, the agency is supposed to approve new planes only when all problems have been worked out.
COZY TIE-UP. But the GAO report criticized the agency for depending extensively on manufacturers' own engineers to approve much certification testing. And Steven Calvo, the report's author, says the GAO also found that the FAA approved new planes even when kinks remained. "At the end, there are lots of things the FAA is trying to resolve, but manufacturers have sold those planes," says Calvo. "They have to make deliveries by specific dates or they face penalties. It's an economic issue."
In the case of the 777, the FAA and Boeing worked together more closely than usual: As part of its strategy for getting the 777 up and flying in record time, Boeing and the FAA agreed to a cooperative certification process from the start. Boeing kept the agency informed of the plane's design at every step, allowing problems to be worked out as they arose.
The debate over safety stems from concerns about the size and weight of the fan blades in the 777's unusually large jet engines. Because the 777 was designed with two engines, rather than the four common in previous long-haul models such as the 747, its fan blades are bigger and far heavier. In their largest configuration, for example, the 777 fan blades built by Pratt & Whitney each weigh 43 pounds--more than three times the weight of those built for the 747.
Therein lies the problem: Numerous FAA engineers and inspectors fear that if one of those giant blades were to break in flight, tremendous vibrations could occur that might severely destabilize the plane. Such breaks are not unknown: 24 other jet airliners have reported fan-blade breaks since 1990. Although no crashes have resulted, FAA safety experts fear that the greater size and weight of the 777's blades would make such a break far more destabilizing. They warn that the 777 cockpit might shake so badly that pilots could not read the flight instruments, increasing the risk of a crash. And the effect on passengers, they say, remains unclear. Indeed, continued concerns have led the FAA to consider new regulations in consultation with the aviation industry.
Despite the worries, FAA sources say Boeing appears to have done only limited testing to see how the 777 would react if a blade broke. And with no regulations on its books specifically requiring such data, the FAA appears to have backed down--days before certification--from a yearlong bid to get Boeing to do more thorough tests. "Boeing did not go beyond the bare minimum requirements," says one FAA engineer.
BIGGEST EVER. Top FAA officials vehemently deny that view. They insist their testing of the 777 was sufficient. McSweeney says the plane would bear no increased risk of destabilizing vibrations if a blade were to break. While the design of the 777 "makes the engine-imbalance issue a little more important to deal with," he maintains it does not increase the chances of pilots' losing control. Instead, he argues that vibrations would be no worse than those on a 747. And he adds that pilots would be able to maintain control simply by lowering the altitude--although FAA sources say that solution is under dispute. The three makers of engines for the 777--Pratt & Whitney, General Electric, and Rolls-Royce--also deny any problems. "We're confident this is a completely reliable and dependable aircraft-engine combination," says a Pratt & Whitney spokesman.
For now, Boeing is the only manufacturer to face such questions because the 777 engine is the largest engine ever put on a commercial aircraft. But the industry trend is moving toward bigger engines, and rivals won't escape the debate. "This is not just a Boeing problem," says Thomas Boudreau, an FAA engineer who worked closely on 777 certification.
The new 777 series is central to Boeing's effort to maintain its lead in the global market. With 350 to 400 seats, the 777 competes with the A-340 and A-330 jumbos produced by the European consortium Airbus Industrie and with the MD-11 from St. Louis' McDonnell Douglas Corp. With world demand estimated at more than 3,000 for such jumbos over the next two decades, Boeing counts on the 777 to fuel growth for years. It "will be Boeing's most important product," says Edmund S. Greenslet, publisher of Airline Monitor in Ponte-Vedra Beach, Fla. By 2000, he estimates the 777 will account for $12 billion in annual sales--40% of Boeing's projected new-aircraft revenues.
The 777 promises a bonanza for the airlines, too. Analyst William B. Whitlow Jr. of Portland (Ore.) brokerage Pacific Crest Securities estimates the two-engine plane could cut fuel costs 20% below the 747, even as it carries more cargo and passengers. That has won plenty of customers. United Airlines Inc. ordered 34 and took delivery of the first of them in May. Boeing has sold 245 of the planes to British Airways, Japan Airlines, Continental Airlines, and others. Although aware of the questions about engine imbalance, "we're pleased with the performance of the airplane and of the engine," says Gordon A. McKinzie, United's 777 program manager.
The FAA debate crystallized in November, 1993, when a 747 of Cathay Pacific Airways Ltd. blew a fan blade over the Pacific Ocean. The break produced such severe vibrations that the pilots considered ditching the plane in the sea. Although the aircraft eventually landed safely, the incident alarmed FAA engineers then reviewing the 777. In May, 1994, Darrell M. Pederson, manager of the FAA's transport-airplane directorate, ordered Boeing to prove that a similar fan-blade loss would not "jeopardize the continued safe flight and landing of the 777." Pederson was not permitted by the FAA to comment, but McSweeney now downplays such fears. The Cathay Pacific incident was made out to be "far more serious" than it was, he says.
EXCUSES, EXCUSES. Nevertheless, over the following year the FAA sent a stream of letters to Boeing asking for such proof. FAA officials complained about Boeing's lack of response: Donald E. Gonder, manager of the airframe branch of the FAA's aircraft-certification office in Seattle, wrote in one internal document that Boeing always had "one excuse or another" for not providing the data. Finally, in a letter dated Jan. 25, 1995, Donald L. Riggin, manager of the FAA's Seattle office, warned Boeing that if it wanted to win 777 certification on Apr. 19, it was "imperative" to provide answers by Jan. 31. Neither Gonder nor Riggin would comment.
Boeing's response came on Feb. 7. In a letter to Riggin, Timothy E. Hickcox, Boeing's 777 certification manager, acknowledged that Boeing was also concerned about the effects of an unbalanced engine. But he argued that Boeing had looked into the issue and considered the plane safe, although it was "without documentation" to demonstrate its claim--since it was under no "regulatory requirement" to provide it.
Under continued pressure from FAA engineers, however, Boeing partially relented. On Feb. 16, Boeing gave the agency information that it claimed showed the level of vibrations a 777 would suffer if a fan blade did break. In a letter, Hickcox argued that the expected vibrations would be "reasonable"--so minor that passengers and pilots would remain safe.
But the letter did little to mollify FAA engineers. In numerous documents, the FAA argued that Boeing had simply asserted its findings without providing data to back them up. In one briefing paper, FAA engineer Jeffrey E. Duven complained that Boeing's findings were "incomplete" and unlikely to provide "credible validation" of its claims. And in a Mar. 4, 1995, letter, the FAA warned that Boeing's analysis was "inconclusive" and that it "[does] not adequately prove that the equipment as installed in the 777 will survive" the vibration levels Boeing projected.
A month later, FAA engineers were still waiting. According to an internal memo dated Apr. 10--just nine days before certification--the FAA warned Boeing that the plane could not be approved without such data. But Boeing again dismissed the demands. "The analysis and data provided more than substantiate compliance," Boeing responded. "Therefore, there is no need for additional testing, and Boeing has no intention of doing any further testing."
"HARSH RHETORIC." McSweeney describes such discussions as common. "It's the give-and-take in the certification process that leads to the safety we have today," he says. But other FAA officials argue that such a late, heated exchange is unusual. "There's always a certain amount of disagreement," says Jack A. Sain, who retired in 1993 as the manager of the FAA's North East propeller and engine directorate, the primary unit responsible for engine certifications. "But generally, a certification doesn't degenerate into such harsh rhetoric."
In a meeting on Apr. 12, FAA engineers specified several tests Boeing still needed to do to allay its concerns: The FAA asked for a "full airplane test" in the air to show that the plane could continue to function. The FAA also asked Boeing to do a flight-deck simulation using the expected level of vibrations over an extended time period, to show that pilots would be able to read their instruments. And they asked about potential for injuries to passengers.
Finally, on Apr. 13 and 14, Boeing submitted additional documentation. In response to demands for a full plane test, McSweeney says that no live flight test was then done. Instead, Boeing submitted data culled from 1,000 previous flight tests; altogether, Boeing argued, pilots had flown an hour under heavy vibrations with no difficulties. However, the accumulated hour was made up of roughly 100 separate incidents, each lasting no more than 30 seconds.
As for a flight-deck-simulator test showing that pilots and other crew members would be able to perform, Boeing cited engineering studies that it claimed showed that the vibrations would be similar to those experienced on a 747. Boeing also submitted a report from one of its own representatives. The Boeing rep traveled to several flight simulation facilities and underwent vibration tests at levels that Boeing claimed "were representative of blade-out windmilling vibrations." After its own rep reported that he had no trouble reading, writing, or speaking during the vibrations, Boeing argued that there was no need for further testing. As for passengers, Boeing again concluded that, under the worst vibration levels it estimated, such levels "would not cause injury to passengers."
Apparently, that was enough to satisfy top FAA officials. On Apr. 18, Pederson agreed that Boeing had provided adequate data. The next day, the plane won certification on schedule.
NEW RULES? But critics within the agency say the tests Boeing submitted remained far below the standard they had demanded for more than a year--and did little to allay their fears. One FAA inspector closely involved in the 777 certification dismisses the 747 comparison as "apples to oranges." He and others also say that such tests do not recreate the vibration levels pilots would experience over a lengthy time period. "Unless you put a dummy in a seat and shake it for an extended period of time at expected levels, you haven't proved a thing," says the inspector.
McSweeney defends the decision to move ahead with the certification. "[Engine imbalance] is a fairly new issue," he says. "We're all learning all the time." Indeed, the subject has become one of the main agenda items of the Aviation Rulemaking Advisory Committee (ARAC), a quasi-official advisory group of aviation-industry and FAA officials that develops new airline regulations. The group is studying possible changes in FAA rules needed to deal with the dangers of imbalance typified by larger engines. Numerous ARAC group members acknowledge that current regulations--developed in the 1950s, when fan blades were far smaller--do not require adequate testing for large engines. "Imbalance is more of an issue than it was in the past," says Larry Hanson, manager of loads and dynamics for Gulfstream Aerospace Corp. in Savannah, Ga. "We're still reviewing what the requirements ought to be."
The FAA's McSweeney agrees there is a need for more study. "We started this debate; we wanted this debate," he says. One remedy being considered, alongside a drop in the plane's altitude: requiring explosive bolts to be installed, so that in an emergency the affected engine would be blown off the wing. Until these safety issues are more clearly resolved, that may be the best the FAA has to offer.