Tom McSweeny and Aviation Safety

Aircraft Age? Let’s talk about its mortality.

The only true chronometer of airframe life remaining (versus the simplistic concept of "age") is an aircraft’s fatigue spectrum as measured by its fatigue index (or FI). This is calculated from the measurements made by an installed fatigue meter’s counters. It is a function of both "usage" (i.e. flight hours) and the type of flying it has done. A military aircraft’s FI accumulation rate can be very variable (eg ground attack GR1 Tornado versus an Air Defence Tornado ADV) because of the altitude, IAS, operating weight and g spectrum. A long haul airliner will have a very different FI calculation than a commuter plane of the same type because the latter will accrue more landings per flight hour and will operate at a generally lower all up weight. The only true measure of "condition" is the inspection report that results from a tear-down overhaul. However, the geriatric "aging" of an aircraft is a totally different ball of wax. It is a compendium of FI, flight hours, years since manufacture and TLC. The "years since manufacture" is pertinent to components (like energy carrying wiring and data cabling) that are not lifed but which are only replaced after failure (i.e. following fault-finding), iaw AD’s, "on condition" inspection directives and following NDI (non-destructive inspection). FI can reasonably predict such things as main-spar cracking but corrosion rates and sites are a function of the aircraft’s operating environment and exposure duration. For instance Air Nauru and Aloha would suffer a much higher rate of salt-water corrosion and engine sulfidation damage than (say) a US midwestern commuter operator flying the same airframe. Now, if halfway through its service life, an Aloha 737 airframe was purchased by Air Midwest that operator would be wise to have his acquisition surveyed carefully before he completed the sale. Corrosion damage to airframes and their wiring is accelerated rapidly by warm, moist, salt-laden climes. This is where FAA would have to factor in an aircraft's owner-history (and his geography) as well as all the other factors before they could rationally "life" a particular aircraft model. Some components, such as wiring, undercarriage, pumps and windscreens, definitely have a finite life. Some can be reconditioned – some cannot. You cannot remove a loom and bench-test it like you can do to avionics boxes, CRT’s and instrumentation. Inspection of wiring is a misnomer because it cannot be effectively inspected in situ. The bits you can’t see (i.e. where harnesses turn corners and disappear through conduits, ducts and bulkheads) are precisely the points where fraying, cracking and shorting out can occur. A resistance check will not disclose that the insulation is about to (or has) given out along its length somewhere. What you are left with is the end-game solution of re-wiring the airframe and counting it as a necessary operating cost – or chucking the whole aircraft at a declared end-of-useful-life point as determined and decreed by a competent operating authority. Unfortunately that point is presently likely to be short of the point of nil economic return where an operator would voluntarily retire an aircraft due to escalating maintenance costs. What we are arguing here is that the FAA has proven that it does not have the will to make those necessary flight safety decisions. Their public claim that "much of that airplane including the wiring will be replaced over a period" is patently false. There is a dishonest inference there that wiring is being replaced as some sort of ongoing program of rejuvenation. No such program exists. The greater lie of "maintenance can indeed replace the whole aircraft over a period of years" is not even misleading, it’s nonsensical. A figure of 99% is just totally out of touch with reality. Even if you counted "remove, repair/refurbish and replace" items it would not approach 25% based on weight, bulk, volume, parts register or rivet-count. The fall-back on the specious reassurance that the "paper-work will be OK" is the refuge of a bureaucratic scoundrel and really gets down to the fundamentals of what the FAA is all about – dotting i’s and crossing t’s. Introduction of vintage or antique aircraft into the discussion is a total misnomer because most of them are kept in mothballs outside of Oshkosh. They are not workhorses nor do they carry thousands of fare-paying passengers.

I can recall about twenty years ago doing a visit to the Naval Air Rework Facility at the NARF at NAS Alameda. I was very impressed at the thoroughness of their tear-down overhaul on P3 Orions. As a P3 pilot I knew very well that salt-water corrosion was a paramount engineering consideration for both airframe and engines. When I asked the Senior Engineer Airframe Rework about "what they found, was it always what they expected?" I assumed that they would always find the same levels of corrosion in the same nooks and crannies on similarly lifed birds. That was not the case at all and it was as simple a matter as some Naval Air station’s having better designed, more effective rinse-rack’s (or bird-baths) or some Sqn’s pilots taking the time to go divert through some rain during deployment to out-stations without rinse-racks. Without tear-down inspection no-one can assure quality. The whole concept of QA or quality assurance is about visual inspection (borescoping), functional testing and NDI (xray, ultrasound, dye penetrant etc) and then signing off components (and then the whole) as being as guaranteed as technology can be that failure is neither imminent nor will be problematical. Technology is actually allowed to fail but true maint QA is ensuring that, as a logical sequitur to design and build standard, it must fail safe. I was a Hawker de Hav’s maint test-pilot at their Perth WA facility for years and I learnt a lot there, the hard way, about the true QA credo.

That brings us down to the wire as they say. With wiring that has a proven aging problem (like Kapton) we are no longer in the realm of safety and there can be no QA (i.e. when it fails it just does not fail safe). Anyone who says there can be wiring QA is a rogue and a scoundrel with a hidden agenda. The evidence is mounting that many accidents have been caused (and many more narrowly averted) by such a low-tech flaw as an insulation that can’t cut the mustard for the design life of the aircraft. When the very next wiring-related inflight fire brings down a passenger-laden jet the FAA will have blood upon its hands – simply because there is enough evidence now upon which to act. The barn-door closing exercise of making "inspections" mandatory is about as valid as preventive dentristry telling people to keep an eye out for holes in their teeth.

OK, so the solution stems from the above premise. Who gets stung the most from the heavy duty litigation following on from an aircrash, in particular one where wrongful death is easily proved due to revelations about known wiring type (not installation) defects? Why, the manufacturer of course. Under the new compensation regime we are talking cumulative multi-billion dollar damages and the insurance companies just won’t stand for it. They’ll hike carrier’s and manufacturer’s hull and passenger liability premiums to the point where it does make economic sense to go for genuine QA. And just how do we then do that? It will cost more on the average airline ticket but the FAA will just have to decree a strip-down date for each aircraft according to a formula that takes into account its operating spectrum, flight hours and numbers of landings. At that time the aircraft, for re-certification, will have to be flown back to the manufacturer’s base and overhauled; re-lifed if you wish. Call it an integrity check – because the travelling public will like that term. A new warranty will be issued freely within the cost and all mods and AD’s will be checked as having been properly implemented. Why can’t that be done at an operator’s home maintenance base? In some cases (eg Qantas) they can obviously be licenced to conduct integrity checks. In others, the operators lacking the expertise will obviously have to ship in a Boeing team to supervise for a few weeks – whatever’s cheaper. We’re only talking about twice in the life of an airframe – say at the 2/3rds and 7/8ths point of the decreed FAA lifing (in hourly terms that equates to 89K and 119K hrs of a lifed 135k life-time). It should not be the same as the merchant marine with their rusting cargo hulks forever plying their unregulated trade under flags of convenience, but there’s presently not a lot of difference. Here we’re talking about, in most cases, National Flag carriers transporting paying passengers. Where that’s not the case perhaps it would be reasonable for cargo-haulier’s airframes to meet a lower level of compliance. What just will not do is a persistently fraudulent stance by an FAA that is in denial. There is a mounting problem with geriatric jets and it is the wiring aspect that is of paramount concern.

If you want to see an "aftermath" from a pilot’s viewpoint I suggest you now read my harrowing account of what probably did occur - and what might otherwise have been, in the case of Swissair Flight 111.

Emotive? Perhaps. On the Money? Almost for sure.

Comment (by JS): I’m not a visionary but when it comes to applying my imagination to what happened in the Swissair accident I have no trouble conjuring up two entirely separate theories:- of what did transpire - and what might have been (in different circumstances). In the first instance I see the innocent low-key beginning of the happenstance, the advice to ATC and cabin crew, the follow-up R/T, the descent checklist and then its rapid escalation through donning of masks and goggles and serious checklisting. Then come the profoundly disturbing staccato images – an atmosphere of great urgency (anxiety, concern but no fear), awareness of the deteriorating environment and restricted peripheral vision, unexpected autopilot disconnect, frustration about having to wait until over-water before commencing the dump, denser smoke, upgrading the emergency, deploying the ADG, fuel starvation flame-out of number two tail engine with many resulting warnings and cautions, sudden cockpit darkness, CRT's blank out, floodlight reflections, misting goggles, instrument power failures and an alarming realization that your partial panel attitude-flying instrument scan and control inputs are very haphazard -even chaotic, eyes streaming with tears, the annoying ceaseless audio of uncancelled system alerts and warblers, intercom and R/T mistakes and confusion, ATC distractions, EICAS announcements, unanswered cabin staff queries, a pervasive and growing feeling of consummate helplessness, breathing and vision difficulties; a Flight Attendant invades the cockpit, evidently distraught - then disappears, total uncertainty as to where the checklist is at. Then, as a vaguely discerned finale ..... seeing the collapse of the other pilot with no-one to help, a feeling of immense solitude, the agony of hot molten plastic dripping from above, difficulty in concentrating, total loss of attitude and altitude awareness and eventually, on the threshold of unconsciousness, the sensation and increased noise levels as the aircraft is accelerating under g and entering its terminal unusual attitude - but peaceably, a final ethereal dissociation from recovery (as a task) because of the mental detachment that stems from the asphyxiating ingestion of toxic smoke. A last poignantly dutiful but pointless pull on the control column as the MD11 tightens into its final graveyard spiral into the waters off the cove. Declaration of a final Mayday and any thought of external succour is totally irrelevant to such a scenario. No apologies for graphic depictions, you’ve got to see the word-picture distinctions I’ll now try to make.

In my second apparition I see a three man crew undergoing the same initial conspiracy of circumstance. In this scene the smoke detector alerts them and the captain declares: "activate the smoke checklist". After the (memory recall items), immediate action preliminaries of full-face masks, ATC and cabin staff alerting, the next step is dependent upon captain’s discretion. However, as with the Swissair instance, visible confirmatory smoke and fumes are evident and this is where the outcomes based approach makes the difference: the Captain orders "select the Flight Essential Bus, you have control". "Deploy the EVAS" (i.e. the inflated plastic aid to instrument vision). They feel a thump as the ADG slips down and locks into place in the slipstream and a charging light illuminates on the CIWS. The first officer is now responsible for ATC comms and flying the aircraft – nothing else, so he begins a gradual descent as per his edicts to ATC. He’s declared a Pan, he’s squawking emergency and he automatically has priority, so ATC must divert other traffic and clear levels below him. It’s called "take control of your destiny", it’s not an apologetic approach. It's no longer the polite "request" - it's "require". The aircraft is now on its "virgin" bus, previously isolated from the normal electrical system and presumably having 100% integrity because of that. The captain and the flight engineer commence the challenge/reply portion of the checklist actions. It is evident that despite his killing the normal electrics, the smoke build-up is continuing, that there is a self-sustaining conflagration behind one of the overhead panels. He orders: "Call Mayday, Hold 230 knots, commence fuel dumping to 50 kilo and inert the flight deck". The FE pulls a lanyard on the bulkhead-mounted nitrogen canister and grabs the foam extinguisher from its bracket. The FE, in anticipation, has already (per the checklist) shut off both EDC’s so that there is no inflow to the cockpit but he doesn’t open the outflow valve – so there is only a gradual depressurization. The flight deck door is already closed so, for their purposes, the cockpit is hermetically sealed and the flame-retardant nitrogen-rich atmosphere dampens the fire. In the absence of oxygen, and with no stoking electrics, no materials fire can take hold. The FE then sprays the adhesively congealing and sealing foam spray onto the overhead panel and the smoke emanations cease. It is now up to the captain. After a pause, he considers the danger is past and orders: "Depressurize and vent smoke, continue with the smoke elimination checklist". Flight is continued, masks off, to their divert field in their significantly reduced (but not crippled) configuration. They have no weather radar, airframe or engine anti-ice but at the lower altitudes they’re not likely to need it. Flight instruments, hydraulics, avionics and comms are sufficient for recovery. There is no point in further tempting fate and trouble-shooting as the Nitrogen and foam operation was a one-shot affair. A two-man band working fate or a three-man consortium with a game-plan? Given the alarming scope and urgency of the task, vive le difference.

It is possible with today’s technology to change the outcome of the in-fuselage fire-in-the-air challenge. To date it’s been a mish-mash apathetic and disorganized approach to resolving an unidentified issue. I’m advocating both a CRM and multi-disciplinary, technical, take-charge/outcomes-based methodology. I readily concede that there are more forms of inflight fire than one confined to the cockpit or electrically initiated. However, if the cargo despatchers and security are doing their jobs we are probably talking about the worst case scenario here. Cabin fires outside the cockpit ( or wing events for that matter) make it more important that there is a third man with the technical know-how to go aft, look into it and keep the captain properly informed.

However there’s a lot of inertia out there. Many CEO’s just have their fingers crossed that the Swissair report will be couched in terms that enables it to be dismissed (like Valujet, TWA800, Silkair….) as just another "one off".... but casualty figures will probably mount as jets get older and electrics continue to be the silent servant but also tragically, sometimes, the swift unseen suffocating savage.

If you feel that there is something missing from this argument (or have something to add) please feel free to comment at my web-site. There is a precursor there to the above (which discusses a saner way to approach the handling of inflight electrical fires).