WASHINGTON — After two battery malfunctions aboard 787s, 100 days aground and one giant black eye, Boeing and the Federal Aviation Administration have learned this: They failed to anticipate possible troubles, however unlikely.
That was the testimony Wednesday from the Dreamliner's chief project engineer and a top FAA safety official during a House hearing into whether Boeing's faulty lithium-ion battery design might have been flagged before it was certified to fly.
The two witnesses also insisted the current FAA certification process that largely outsources direct oversight to outside designees — including Boeing employees — is fundamentally sound.
Echoing Boeing's earlier public admission, 787 chief Mike Sinnett told the House aviation subcommittee the jetmaker relied on what in retrospect were outdated tests to simulate ways the cutting-edge batteries could malfunction.
Two back-to-back 787 incidents in January involving different Japanese airlines, including a battery fire at the gate at Boston's Logan Airport, led to the grounding of the Dreamliner barely a year after its first delivery.
Asked by subcommittee chair Rep. Frank LoBiondo, R-N.J., what Boeing learned from the incidents, Sinnett said they reinforced the company's design philosophy that "no single fault can put an airplane at risk, and no combination of risks, even extremely remote, can put the airplane at risk."
Rep. Rick Larsen of Everett, the subcommittee's ranking Democrat, repeatedly pressed Sinnett and Peggy Gilligan, the FAA's associate administrator for aviation safety, on whether the agency's eight-year certification review for the new Dreamliner was independent or rigorous enough to ensure technological safety.
Since the 1930s, the FAA has relied on outside designees to help certify aircraft. But the agency expanded that approach in 2005 by granting Boeing and other companies in-house authority to vouch that design, production and repairs conform to regulatory standards.
Larsen said critics view that as akin to self-certification.
Gilligan, however, rejected that label as a "misnomer." Instead, she likened the certification process to taking a test, with the FAA setting the criteria for passing and Boeing responsible for demonstrating it met those criteria.
When the FAA approved the 787's battery in 2007, the use of large lithium-ion batteries on aircraft was considered a novel technology. That prompted the agency to impose nine conditions to reduce the battery's potential hazards as a condition for certification.
"You created a test with these special conditions but perhaps the test itself was bad," said Larsen, whose district includes Boeing's wide-body plant in Everett.
Sinnett said the battery test protocol Boeing used was state of the art at the time -- piercing one of the battery's eight cells with a nail. It triggered a short circuit but did not result in what later occurred in Boston: the battery's flammable electrolytes burning and causing a cascade of overheating called thermal runaway.
Sinnett made a similar acknowledgement in April before the National Transportation Safety Board, which is investigating the causes of the battery problems.
Since then, Boeing proposed and the FAA approved a triple-layer protection system for the battery. The fix is intended to reduce the odds of a battery failure, prevent a cell failure from spreading and protect the rest of the plane's electronics bay by enclosing the battery in a steel box that vents to the outside.
Gilligan said redesign tests "really pushed the battery much, much farther than anybody realized it needed to be pushed."
The more stringent tests, she and Sinnett said, will become the new standard for lithium-ion batteries. The FAA is conducting a comprehensive review of the 787's certification, design and manufacturing processes, to be released this summer.