Business & GA, Commercial

Safety: Ignorance is Bliss

By David Evans | August 1, 2006
Send Feedback

Pilots have ample indications in the cockpit of engine functioning, but they won’t have comparable information concerning the operation of their fuel tank inerting system.

The Federal Aviation Administration (FAA) has proposed that fuel tanks with heat sources under them, such as air conditioning packs, be equipped with a means of eliminating the explosive vapors by pumping the tanks full of nitrogen-enriched air. By this means of inerting, the vapors will not explode in the event that an ignition source is present in the tank, such as arcing from electrical wires or rubbing of the impeller to a fuel pump. In other words, even if an ignition source occurs, the vapors in the fuel tank will have too little oxygen to sustain an explosion.

Legacy of Disaster

Recall that in July 1996 TWA Flight 800, an old B747, blew up after takeoff from New York’s John F. Kennedy airport. The National Transportation Safety Board (NTSB) determined that most probably a surge of electricity from electrical arcing found its way into the center wing tank via the fuel quantity indication system and set off the explosive vapors. The tank was empty, save for about 50 gallons of fuel, and the airplane had sat on the tarmac for at least two hours before departure. With the heat from air conditioning packs located under the tank, the leftover fuel largely vaporized, and the tank vapors were in explosive condition when the aircraft climbed out and the arcing occurred.

The arcing, if you will, was the match that caused the explosion, destroying the airplane and killing all 230 aboard. As a result of the TWA 800 tragedy, the NTSB recommended that explosive vapors be eliminated. The recommendation was given added impetus when the center tank of a Thai Airways B737 exploded at Bangkok in 2001. The blast occurred on the ground in this case, and the fuel pumps were operating at the time. As in the case of TWA 800, the weather was hot and the air conditioning packs were running.

As a result of these and other fuel tank explosions, the FAA has proposed equipping transport category aircraft with inerting systems. There are certain caveats: they must be installed on all aircraft carrying 30 or more passengers (which lets cargo airplanes off the hook), and the inerting systems need only be installed to protect tanks with heat sources under them. In effect, the center wing fuel tanks are considered more vulnerable than wing tanks, which can exploit the cooling effect of the slipstream. The concept is to use inerting to make the center wing fuel tanks equivalent in safety to the wing tanks.

The FAA proposal is controversial, as it adds a system to the airplane, which entails expense and installation. The consensus in the industry, from the many comments submitted to the FAA, is that retrofitting this system on hundreds of older aircraft is not cost-effective.

Working Reliably?

FAA has yet to decide whether or not to insist that inerting systems, called flammability reduction means, or FRM, be installed. If they are, the question is whether they will work reliably. A 10-day minimum equipment list (MEL) has been suggested; that is, if the system isn’t working, the airplane can be operated for up to 10 days until the inerting system is repaired.

How to determine if the inerting system is working? FAA says, "We intend that maintenance personnel or the flightcrew have access to any indications that must be accessed at intervals established by the FRM design approval holder when demonstrating reliability requirements for the FRM."

Basically, the FRM would be checked once daily with, say, a red or green indicator light accessed in the bay where the inerting system is located. The light would be green if nitrogen-enriched air was being generated by the system. There are a number of problems with this approach: (1) the check is only daily, before the first flight and therefore is not real time, (2) notice of subsequent failure is not provided in the cockpit, and (3) the system only indicates that nitrogen-enriched air is being generated by the FRM, not whether it’s enough. The point of measurement is not in the fuel tank, yet the whole idea is to drive the oxygen content in the tank to a point where there is too little to support an explosion.

Implied Inerting

The comment in the docket from Shaw Aero Devices is instructive (the company was instrumental in developing trial inerting systems for Boeing and Airbus aircraft). The company believes failure monitoring of system operation is inadequate. "Although it is relatively straightforward to determine when an inerting system … is inoperative, it is less straightforward to determine that a fuel tank is actually non-flammable," the company maintains.

"The main reason for our concern is that the approach described above, where the NEA [nitrogen-enriched air] is analyzed, does not actually determine the oxygen percentage in the ullage [the space between the fuel level and the top of the tank] itself. It merely `implies’ that if the system is operating properly … the fuel tank should be inert," the company maintains.

Moreover, monitoring oxygen concentration, if done only at the point of NEA discharge, would not account for breaks in downstream ducting, or minor leaks that could significantly degrade system effectiveness (that is, not enough nitrogen is getting to the tank to inert it).

"We would suggest that unless the ullage space is directly monitored and samples are taken at regular intervals during aircraft operation, the system effectiveness … cannot be truly proven on a fleet-wide basis," the company quite rightly maintains.

Why isn’t oxygen content in the tank being monitored continuously, and displayed in the cockpit? Two "explanations" come to mind. First, depending on the efficiency of the inerting generators, and especially if they are degraded, the tank may not be inert even though the system is, quote, functioning as designed. Secondly, if it isn’t providing enough nitrogen, and that’s apparent in the cockpit, then the 10-day MEL, determined by a once-a-day check, isn’t adequate, and maybe two inerting systems would be needed to account for single-system failure. No one, it seems, is willing to address that possibility, so nitrogen at the point of production will be measured, and only once per day.

Air crews are to be compelled to accept that the system is inerting the tanks, when in fact they may be explosive. As the saying goes, ignorance is bliss.

Receive the latest avionics news right to your inbox