FAA to loosen fuel-tank safety rules, benefiting Boeing's 787

The Federal Aviation Administration (FAA) has quietly decided to loosen stringent fuel-tank safety regulations written after the 1996 fuel-tank explosion that destroyed flight TWA 800 off the coast of New York state.

The FAA proposes to relax the safeguards for preventing sparks inside the fuel tank during a lightning strike, standards the agency now calls "impractical" and Boeing says its soon-to-fly 787 Dreamliner cannot meet.

Instead of requiring three independent protection measures for any feature that could cause sparking, the revised policy would allow some parts to have just one safeguard.

Boeing has worked closely with the FAA to make the change in time for the 787 Dreamliner, whose airframe built of composite plastic makes lightning protection a special challenge.

But the move has stirred intense opposition inside the local FAA office from the technical specialists — most of them former Boeing engineers — responsible for certifying new airplane designs.

The national union representing about 190 Seattle-based FAA engineers this past Tuesday submitted a formal critique to the agency, calling the new policy "an unjustified step backward in safety."

In a lightning storm, the critique said, the less stringent rules could leave a commercial airliner "one failure away from catastrophe."

FAA management, contradicting its own technical staff, argues that relaxing the spark-prevention standard is balanced by new technology to reduce fuel-tank flammability that will increase safety overall.

And Boeing experts insist the 787 will be safer in a lightning storm than any jet flying today.

Jim Hall, the former National Transportation Safety Board (NTSB) chairman who oversaw the TWA 800 investigation, said he's disappointed in the FAA but not surprised.

"It appears that management has overruled the judgment of the people that have day-to-day responsibility for the safety of aircraft," Hall said.

The TWA 800 rule

The average commercial airplane is hit by lightning about twice a year, Boeing estimates. A dangerous electrical spark may occur if current passing through an airframe reaches a small gap between metal parts and jumps across the gap.

Yet because of well-developed protection systems, it's been more than 45 years since a U.S. airliner was brought down by lightning.

The rules the FAA is now reinterpreting have been in place since 2001 after the investigation into the TWA 800 fuel-tank explosion that killed all 230 people on board the 747 jumbo jet.

While investigators concluded that the likely cause of the spark that triggered that explosion was faulty wiring, they set up standards to prevent fuel-tank ignition from any source, including a lightning storm.

The rules address two distinct areas: preventing sparks in the tank and reducing the flammability of the vapor inside the tank.

Current policy dictates that airplane engineers must design three independent layers of protection in any conceivable scenario that could produce a spark.

"To this day, we have not had one manufacturer that has been able to demonstrate compliance with that rule," said Ali Bahrami, head of the FAA's Seattle office dealing with commercial-airplane certification. "We decided it's time to re-evaluate our approach."

Airbus applied for certification of its newest plane, the A380, before the regulation, so it did not have to comply.

The FAA granted exemptions in 2006 and 2007 to plane makers Dassault Aviation, of France, and Hawker Beechcraft, of Wichita, Kan., allowing them to certify their Falcon 7X and Hawker 4000 business jets with only two independent layers of protection on the wing-skin fasteners.

In a detailed briefing on the 787's protection systems, two high-level Boeing lightning experts — who spoke on condition that they not be named — said the Dreamliner cannot meet the requirement.

"Boeing spent years trying to develop triple layers of structural lightning protection for every 787 fuel-tank fastener and joint, but we were unable to identify the technical means at many locations in the wings," one said.

The FAA will accept formal comments on the policy change through Feb. 13.

The critique submitted by the FAA certification engineers' union, the National Air Traffic Controllers Association union (NATCA), acknowledges that the existing regulation is strict.

It may have to be revised in some way, said one FAA certification specialist, who, like other agency engineers interviewed for this story, asked not to be named to avoid retribution.

"A bunch of us are in agreement as to how we can do that and maintain safety," he said. "But it's not what our management is trying to do in allowing catastrophic single failures."

Potential sparks

The new FAA policy memo identifies three places where the failure of a single protection measure could produce a gap where sparking might occur, though each is a remote possibility.

The concerned FAA engineers detailed where these three vulnerabilities are on the 787:

• The aluminum shear ties that attach the wing ribs to the spars could crack.

• A wing-skin fastener could break, popping the sealant on the head.

• On fasteners inside the fuel tank, a coat of sealant covering a gap between fastener head and sleeve could deteriorate.

The two Boeing lightning experts said the company has studied each of these scenarios closely.

Indeed, Boeing lightning lab tests in 2007 revealed an unexpected amount of sparking inside the 787's wing tank as then designed, caused by gaps between fastener heads and sleeves.

In response, Boeing's engineers turned around thousands of fasteners, putting the heads on the outside instead of inside the fuel tank. Following this redesign, engineers weighed the worst-case lightning threat at every location and demonstrated that there was sufficient margin to rule out sparking.

For those fasteners that couldn't be turned around, a brush coat of sealant was added as an extra precaution, the Boeing experts said.

"The issue is totally resolved now," one of the experts said.

Likewise, the Boeing engineers said, shear-tie cracks and broken fasteners have proven not susceptible to sparking under the worst-case level of lightning current.

"The level of detailed design, test, and analysis (in the 787's wing-tank lightning protection) ... is greater than has been conducted previously in aviation," one said.

Reducing vapor

The FAA claims the less stringent anti-sparking rule is balanced by an important new safety feature of the 787: its fuel-tank inerting system.

As the level of fuel inside the wing falls during flight, the system pumps inert (nonflammable) nitrogen gas into the space created. That hugely reduces the danger of flammable vapor.

When the original 2001 rule was written, the FAA stated that it would consider relaxing the ignition-source rules in the future if there was improvement in the technology to lower flammability — "such as full-time fuel-tank inerting."

By all accounts, the 787's inerting system is very effective. But there's a catch: The FAA is not requiring that it be "full time."

If a 787's inerting system breaks down, to save the expense of grounding the plane, an airline will be free to continue to operate it for 10 days while waiting for replacement parts.

That's despite an internal recommendation from one of Boeing's own safety-engineering team leaders in November 2005 that the 787's inerting system should be required to be working before takeoff.

During those 10 days, the possibility — however remote — of potential failures in the three areas with single anti-spark features looms as unacceptably dangerous to the FAA engineers represented by NATCA.

"This inerting system, if it was full time, it would definitely be an acceptable level of safety," said a second FAA engineer who has worked on the 787's certification.

But without that assurance, he said, to fly on a Dreamliner out of a lightning-prone airport in the summer is a risk he's not prepared to take.

"I wouldn't put my family on a 787 out of Miami," said the engineer, who formerly worked for Boeing.

In contrast, Boeing's 787 lightning-team leader sees the inerting system as a bonus safety feature rather than an essential requirement. He is willing to rely on Boeing's exhaustive testing of every potential spark point in the wing.

"I wouldn't hesitate to get on the plane," he said. "I know more about the structural protection on this airplane than I do on anything else we've ever built."

FAA, Boeing too close?

Tomaso DiPaolo, NATCA's aircraft-certification national representative, charges that when FAA engineers raised their safety concerns internally management simply removed them from the team developing the new policy.

The FAA ignored its own technical people, he said, while making sure Boeing agreed with the policy change.

"It's another example of the FAA getting too close to industry," said DiPaolo. "It appears that whatever Boeing wants, Boeing gets."

A Boeing internal document reviewed by The Seattle Times shows the company had a "team to assist FAA in wording of interpretation" of the lightning rule for the 787 as far back as August 2004, just eight months after the new jet program launched.

The FAA's Bahrami insisted that the policy change has been crafted to work for all airplane manufacturers with no special treatment of Boeing.

"Boeing is only one customer," Bahrami said.

Dominic Gates: 206-464-2963 or dgates@seattletimes.com