b Safety margins. The final rule completely ignores safety factors, as well as safety margins widely accepted in the world.

For example, the FAA considers the fuel tank to be explosive only after the fuel vapor concentration exceeds 100% of the Lower Flammability Limit (LFL), as opposed to 25% of the LFL adopted by the consensus standards (as adopted by the National Fire Protection Association, or NFPA)..

The FAA also assumes the ullage is explosive when the fuel temperature exceeds the instantaneous flash point, although the consensus standards require a 30˚ F safety margin between the fuel temperature and the flash point.

The FAA assumed that if the ullage had an oxygen content restricted to 12% that the tank would be effectively inerted. Traditionally, an oxygen content of 9% has been used, but this figure is based on high velocity fragments from anti-aircraft fire penetrating the fuel tanks of military aircraft. By allowing an oxygen content of 12%, a less capable inerting system is needed. The FAA has determined that an inerting system capable of reducing the oxygen content of the ullage to less than 12% is not necessary and is “impractical for commercial airplanes,” as a significantly more capable FRM would be needed.

As Erdem Ural, an expert with Massachusetts-based Loss Prevention Science and Technologies, Inc., outlined in a February 2008 presentation to the American Institute of Chemical Engineers, “If the oxygen concentration is not continually monitored [which it is not in the present FAA concept], the [inerting] system has to be operated below 60% of the worst credible LOC [Limiting Oxygen Concentration].”

In brief, the FAA has stripped away cushions to field a minimal system that does not meet generally accepted margins of safety.

b Is inerting working? One of the problems here is that the oxygen content of the ullage is not measured. Rather, the flow of nitrogen enriched air is measured, but this does not assure that the oxygen content in the tank is below the desired level. Of interest also, the rule says a built-in test can be used to verify operation, but a direct cockpit readout of FRM functioning or of ullage oxygen concentration is not mandated. The FAA says, “It would be inappropriate for the rule to mandate specific design features.”

Based on this obtuse approach, the flight crew is not required to have a readout in the cockpit of inerting system (mal)functioning or of the oxygen content of the ullage (apparently, it would alarm the crews if O₂ concentration exceeds 12% during descent).

b Monte-Carlo method. The entire rationale for inerting, and to only 12% oxygen concentration, is based on a Monte-Carlo analysis, which basically takes variables (such as flight time and fuel type) and runs hundreds of simulated airplane “flights” to estimate the risk of an explosion. One of the input variables is the 12% oxygen concentration. As such, the Monte-Carlo method is not based on real-time measurements of an inerting system’s effectiveness in a real airplane. The European Aviation Safety Agency (EASA), the regulatory equivalent of the FAA, argued in 2005 that the Monte-Carlo method might be useful for research purposes “but [it] has some inherent limitations as a certification tool.”

The hazardous conditions for fuel tanks can be quantified deterministically, so the use of Monte-Carlo seems like a way to rationalize a lower safety standard. At any moment in flight, it is straightforward to determine whether the ullage is explosive or not. Therefore, there is no reason to introduce statistical uncertainty other than to deliberately confuse the issue.

It is imperative that all concerned (industry stakeholders and the flying public) scrutinize the Monte-Carlo input parameters in the final rule. For example, the outside air temperature for landing will be 85.1˚ F or less for 97.7% of all flights considered in the FAA’s Monte-Carlo methodology. Is this realistic in summertime?

Not stated is that air conditioning packs located immediately underneath the center wing tank are frequently operated on the ground. This heat from the air conditioners must be added to that of the ambient air to show what the effects are going to be in the ullage. Of note, TWA 800 had its packs running well before takeoff to keep passengers comfortable in the plane while a security problem of matching bags to passengers was resolved.

It is noteworthy that the Monte-Carlo methodology is only used for fuel tank safety and has not been used to assess the hazards associated with other systems failures (such as the cascading effects of electrical arcing). For all other systems, the likelihood of failure must be demonstrated to be “Extremely Improbable,” which is generally understood to mean one failure in a billion flight hours. Perhaps because inerting is not defined as an essential safety system, but as an adjunct safety enhancement, it does not have to meet the one-in-a-billion standard.

One of the ways of keeping the cost down was to install just one inerting system, allow for Minimum Equipment List (MEL) relief (which allows the airplane to fly up to 10 days with the lone inerting system inoperative), and to permit a lack of appropriate system performance monitoring. It is apparent that the current design of the inerting system does not meet performance standards expressed in Sec. 25.1309 of the Federal Aviation Regulations (see box immediately below).

The FAA indicates that 3 accidents occurred 233 times out of 1,000 Monte-Carlo simulation trials, but this seems an awkward expression of risk. It is not nearly as straightforward as saying one out of so many planes has flammable ullage (see box at end of article).

Given the lack of safety margins and the optimistic parameters used in the Monte-Carlo simulations, there is a false estimate of risk with the limited inerting system proposed by the FAA.

b No redesign of tanks or adjacent equipment required. The FAA found design practices that aggravate the hazard posed by flammable ullage, yet it did not require regulatory changes that would prohibit these practices in future aircraft designs. Examples include:

• Locating air conditioning equipment below the center wing tank.
• Locating fuel gauging systems with capacitance measuring probes inside the fuel tank.
• Co-routing fuel measuring wires with high-energy wiring to other airplane systems that have sufficient energy to cause an ignition source inside fuel tanks.
• Locating high-energy electrical fuel pumps within the fuel tank.

Transport Canada and the UK Air Safety Group suggested a prohibition against placing heat sources within or near fuel tanks, but the FAA demurred, saying, “Specifically prohibiting this practice may not be the most efficient and effective way to address this problem.”

That may be so, but poor design practices need to be prohibited, especially when they’re proven deadly.

b Cost benefit. The FAA determined that the dollar value of the lives and airplanes saved by the rule is less than the cost of installing FRM or IMM, which is to say a negative cost-benefit. This declaration is not made explicitly, but must be gleaned from benefit and cost figures presented on pages 64 and 65 of the final rule. That portion of the aviation industry opposed to inerting can be expected to seize upon the negative cost-benefit and oppose the rule as not worth the effort.

The FAA figures on 1.5 accidents from fuel tank explosions, and preventing these catastrophes saves about $657 million in lives and airplanes. The cost, in 2007 dollars, of implementing the rule is estimated at $1.012 billion.

However, the FAA is assuming only 156 fatalities from an in-flight explosion (142 dead) and from an on-the-ground accident (an average of 14 dead). On page 70 of the rule, it is evident that the FAA applied only a fraction of the in-flight and on-the-ground casualties: an average of 49 fatalities. TWA 800 alone involved 230 fatalities.

The difference in the total statistical value of lives is considerable:

49 lives @ $5.5 million each =   $   270 million

230 lives @ $5.5 million each = $1,265 million

And the FAA says there is only a 26% probability that the final rule’s benefits will be greater than its costs:

“If a single in-flight catastrophic accident with 190 occupants (a 233 seat airplane) were to be prevented by 2012, the present value of the benefits will be greater than the present value of the costs.”

In other words, a one-in-four chance of loss of a single wide body aircraft cranks up the value of the lives and equipment destroyed by a fuel tank explosion. Presto, a positive cost-benefit results.

One gets the impression that cost-benefit calculations are rather like Monte-Carlo simulations: the answers depend on the inputs, and the costs of installing FRM or IMM are going to be hugely variable (type of system, where installed on the airplane, how integrated with other systems, serviceability, ground support required, etc.).

Not mentioned in the FAA’s turgid and weak discussion of cost-benefit is this tidbit buried in the files from the ARAC deliberations: inerting is expected to cost about 25 cents per ticket. When safety programs are couched in terms of added price per ticket – rather than total industry costs – a whole different perspective results. Inerting, it seems, costs less than what the airlines are now charging passengers for earphones or soda pops. Based on this method of calculating cost, the price per ticket of inerting could be doubled, even quadrupled, and it would still be a bargain.

One more thing needs to be mentioned: the FAA is only talking about inerting the heated center wing tanks, when in fact there may be a looming imperative to provide inert gas for another reason. The aviation industry must replace Halon fire suppressing chemical with a more environmentally friendly means of extinguishing fires on aircraft. Halon currently is used for suppressing engine fires and for suppressing cargo hold conflagrations. For both applications, a combination of water mist and inerting is foreseen. Thus, the inert gas produced by FRM can be routed to the fuel tanks, to be sure, but it also can be piped to cargo holds in the event of a fire. The multiple benefits of an inerting system for fuel tank, engine, cargo hold and other dry bay fire suppressing tasks is not figured into the cost benefit equation. Yet it is a certainty that Halon must be replaced, and nitrogen enriched air promises to be a substitute (in combination with a water mist system – which alone would also provide a measure of fire protection in the cabin, which presently is only protected by a handful of portable Halon extinguishers)..

It must be said also that downgrading SFAR-88 effectiveness at reducing ignition sources from 75% to 50% is wholly arbitrary and may not go far enough (given the additional 16 ADs issued after the SFAR-88 corrective actions were mandated). If SFAR-88 were only, say, 25% effective at reducing ignition sources, the costs of implementing the rule is less than the benefit.

Given that electrical components are still allowed in fuel tanks, one hesitates to overstate the effectiveness of SFAR-88.

What’s not said in all this is that eliminating ignition sources is just half of the solution, and airplanes are supposed to be designed so that a single-point failure is not catastrophic. Hence, given that an electrical spark in a fuel tank is a single-point failure, FRM or IMM was needed all along. If such technology, which has been readily available for years, had been installed, 346 people killed in fuel tank explosions since 1989 would have lived, and the airplanes would not have been destroyed. There was a false economy in not installing either FRM or IMM. There was a false economy in placing heat-generating equipment adjacent to fuel tanks. There was a false economy in placing electrical components inside fuel tanks. Correcting these grievous deficiencies is going to be expensive – but then again, the philosophy has always been that hard accident experience was a required precursor to change.

The September 2007 fire in a China Airlines B737 at Naha, Okinawa, is just the latest involving an unheated wing tank (see box below). If the FAA were serious about preventing all fuel tank fires, there is a logical next step: apply to unheated fuel tanks the same protections afforded by this rule to heated center fuel tanks.

And a third action is needed: the O₂ concentration in fuel tanks needs to be measured and a readout provided in the cockpit. This measure would tell flight crews positively whether or not the inerting system was working, and it would allow them to gauge the risk if it were not. To be sure, a measure of oxygen concentration would probably change the description of inerting from a “nice to have” safety adjunct to a safety essential system, with all that implies: dual inerting, should one system be inoperative.

Air safety is built on the notions of cushion and redundancy. The 12% oxygen concentration allowed may not have adequate cushion, and a single inerting system may not feature adequate reliability.

Lastly, the standards by which airplanes are designed are due for review. Some aircraft, like the MD-11, are designed such that air conditioning packs are not located next to fuel tanks. That practice, among others, needs to be incorporated into design regulations.

One would like to think this final rule is the proverbial “camel’s nose under the tent” and further changes will be coming in the near future,

Comments on this final rule are due 20 January 2009.