-T / T / +T | Comment(s)

Monday, May 1, 2006

Regulatory Report

All ahead stop

Another 45 days has been provided for industry comment on actions to reduce the chance of a catastrophic fuel tank explosion, extending the deadline to May 8 from March 23 [FR Doc E6-4025]. As one wag quipped, "Looks like more time is being provided for industry to figure out how to dodge the bullet." The "bullet," in this case, is an errant heat source in the fuel system that is hot enough to ignite the fuel/air vapors, either from electrical arcing or, say, from a fuel pump impeller striking its housing. The Federal Aviation Administration (FAA) has issued 83 airworthiness directive (ADs), published under the overall rubric of special federal aviation rule number 88 (SFAR 88), requiring operators and maintainers to take actions to minimize these heat sources.

By this means, the FAA hopes the risk of a fuel tank explosion is reduced some 50-75 percent; the remaining 25-50 percent of the risk (estimated at nine accidents) is to be mitigated through an on-board system to inert the fuel/air vapors by providing a flow of nitrogen enriched air to the tanks, basically rendering the fuel/air vapors too "lean" to sustain an explosion if an ignition source is present.

The FAA had planned to require inerting of only heated center wing tanks, e.g., those with a heat source under them, such as air conditioning packs (an outgrowth of the TWA Flight 800 explosion in 1996, in which the detonation occurred in the heated center wing tank of the B747, while the airplane was climbing after takeoff, as did explosions in 1990 of a Philippine Airlines B737 and a 2001 explosion on a Thai Airways B737, both of which occurred in the center wing tanks while the airplanes were on the ground). The FAA also proposed to exempt cargo aircraft.

An assessment by Sandia National Laboratories could unhinge this approach, placing a higher premium on inerting of both the heated center wing tanks and unheated wing tanks. The Sandia report, titled "Assessment of the Effectiveness of Special Federal Aviation Regulation (SFAR 88) Airworthiness Directives (ADs) in Preventing Ignition Sources," was only recently placed in the docket, hence the extension to the comment period (the report can be found at http://dmses.dot.gov/docimages/pdf95/389033_web.pdf.) The 49-page report douses cold water on the FAA's hopes that reducing ignition sources would minimize the need for inerting. Herewith, some key findings from the report:

  • "The pumps, Boeing fuel quantity indicator system (FQIS), and the Airbus FQIS and fuel level sensing system (FLSS), had high likelihood rankings for ignition risk."
  • "The Sandia evaluation ... indicated ... an order of magnitude improvement in residual risk after ADs were applied. However, even with this improvement, the residual risk of a center tank explosion was still a factor of 100-1,000 away from the 10-9 goal [one in a billion, or extremely improbable]."
  • "In terms of the relative effectiveness of individual ADs, friction sparks from fuel boost pumps were identified as the driving failure modes. Of all the ADs, only one AD addressed these failure modes and was considered highly effective. Other ADs relating to the FQIS systems are preventive and should be effective as the fleet ages. Effectiveness of the remaining ADs on the risk of a fuel tank explosion was minimal."
  • "When layers of protection sequentially and unknowingly fail from day-to-day operations, airplanes can remain in service with pre-existing failures and operate at a higher risk level."
  • "Other known incidents (e.g., degraded wires and sparks from foreign objects) were identified in various reports (SDRs, ADs, OEM references). These incidents met neither the extremely improbable nor the single flight requirement."
  • "Safety features like boost pump auto-shutoff, current fault interrupers, and transient suppression units can help prevent ignition sources in fuel tanks. However, correct response times, high reliability, fail-safe options, and positive failure detection must be incorporated, or unexpected failures could introduce other new ignition sources."
  • "Sandia estimates AD effectiveness at a factor of 10 improvement overall, which is still a factor of 100-1,000 from the 10-9 goal. At this time, Sandia cannot directly support the 75 percent reduction in future fuel tank explosions assumed ... Both Airbus and Boeing fuel system designs allowed undetected ignition-related failures on more than one flight, which violate the FAA Part 25 requirement of 10-9 risk protection. If major new designs are not technically feasible, continued multi-phased efforts to prevent fuel tank explosions are necessary to gain orders of magnitude reduction in residual risk."
  • "The review showed a drawback of the pump subsystem designs. Neither Airbus nor Boeing can completely avoid dry running. ... While the auto-shutoff system provides a layer of protection, it cannot prevent all running within vapor. One documented failure is an impeller rubbing and potentially sparking pump. This failure is a latent event. On the first flight when it occurs, the pump should be removed and installed with a new pump to restore the protection. But because it is latent, the pump will potentially operate for many more flights."
  • "The review also revealed that with hundreds of miles of wiring present on aircraft, it is not unreasonable to have one (or more) degraded in-tank wiring in an aging fleet. Wiring inspections have revealed faulted and degraded wiring ... Similarly, electrical protection devices and monitors can degrade and become faulted ... These degradations are susceptible to lightning strike, HIRF [high intensity radio frequency], and EMI [electromagnetic interference], as well as energy from an electrical short of a neighboring electrical system. If the degradations are not detected, the failures can exist for many more flights or even years."
  • "A [potential latent failure] assumes a tank access door is left open by maintenance personnel."
  • "Sandia came to realize that the raw data on safety and probability of ignition-related failure was not documented in any detail."

    In other words, no amount of maintenance is likely to eliminate the hazard of ignition sources in fuel tanks. In fact, the Sandia report demolishes the FAA's comforting blandishments. The report talks about any number of ADs still to be issued, so the hunt for ignition sources extends into perpetuity. One wonders why this independent evaluation was not published earlier, as it likely would have led to a more modest reckoning of the effects of the SFAR 88-related ADs.

    The Sandia effort probably should be taken to the next step: an independent evaluation of the FAA's inerting scheme, which relaxes the allowable oxygen content of the fuel/air vapors in the tank from 9 percent to 12 percent, foregoes inerting on descent, and envisions providing a flow of nitrogen enriched air only to heated center wing tanks. Moreover, a 10-day MEL is envisioned, so the airplane can operate without inerting for up to this long, with the various "unexpected" hazards documented in the Sandia report.

    One suspects that an independent evaluation of the inerting scheme would leave the FAA's fuel tank safety program dead in the water. Inerting of all tanks, all the time, would provide protection against a combination of faults, even with Mother Nature thrown in as the stirrer with lightning, but that would require more than the minimalist approach now being entertained.

    It should be pointed out that the National Transportation Safety Board (NTSB) has called for the elimination in all tanks of the hazard posed by flammable vapors. In other words, the NTSB never put its faith in the SFAR 88 ADs to reduce hot spots, preferring instead to eliminate the explosive fumes.

    Indeed, an NTSB letter dated March 23 and obviously submitted after the Sandia report, suggested the FAA needs to do better:

    "The fact remains that wing tanks have exploded ... the Board ... believes that the FAA should at least provide design guidance to encourage the use of available nitrogen generation technologies for all fuel tanks ... Further, the Safety Board does not believe that cargo airplanes should be omitted ...

    "Finally, the Safety Board notes that additional benefits from onboard flammability reduction systems can be realized, but that the FAA does not address any of these. Nitrogen-producing equipment can be used to provide fire protection for avionics, electrical compartments, unoccupied spaces, and cargo compartments. For example, on February 8, 2006, a DC-8 cargo airplane was on fire when it landed at Philadelphia, Pennsylvania, International Airport. The fire was quickly spreading to the cargo area, and the crew may have had only a few extra minutes in which to land the airplane. An inerting system may have suppressed or extinguished the fire, significantly improving the safety of the flight."

    To be sure, the aviation industry is in no economic shape to undertake the cost of retrofitting proper inerting. In this regard, the Sandia report on the SFAR 88 ADs might help to convince Congress of the absolute necessity of authorizing the funds necessary for inerting.

    Formation of new safety analysis effort

    On March 21 the Federal Aviation Administration announced the formation of an airplane-level safety analysis group under the auspices of the Aviation Rulemaking Advisory Committee (ARAC). The new ARAC is designed to pull together the potentially malignant "interaction of systems." The group has been specifically tasked to examine specific risk, latent risk, and the extent to which, under the minimum equipment list (MEL), an airplane can be exposed to a critical failure.

    According to the FAA's tasking document, "The report will document the approach used to establish whether a significant latent failure should be allowed to leave the airplane one failure away from a catastrophic condition." The maintenance implications relate to the MEL, and whether or not a component must be fixed to insure that the airplane is not one failure away from catastrophe. Although not specifically mentioned, the task ought to relate to the fuel system safety issue cited above. (See www.faa.gov/regulations_policies/rulemaking/recently_published/media/TAE_notice.pdf)

    A dangerous foible

    "The actions specified in this AD are intended to detect and correct improper rigging of the propeller feathering linkage. The above issue, if uncorrected, could result in degraded performance and poor handling qualities with consequent loss of control of the airplane," the FAA intones in an AD published March 23 (see http://thefederalregister.com/d.p/2006-03-22-E6-4123). A spate of recent MU-2 accidents prompted the FAA to conduct a safety evaluation of the MU-2B, and this AD is one of the outcomes. The MU-2 is a twin-turboprop with jetlike performance; one wonders how many accidents were attributable to this foible.

  • Live chat by BoldChat