PANEL SUMMARY: Fuel Tank Design Philosophy and Certification

---

On the first day of the public hearing, evidence had been presented indicating that the destruction of TWA 800 resulted from an explosion in the center wing fuel tank of the Boeing 747. The Fuel Tank Design Philosophy and Certification Panel, leading off the second day, explored the safeguards designed to prevent such explosions. Witnesses included representatives of: the Boeing Commercial Airplane Group, manufacturer of the accident aircraft; the Federal Aviation Administration (FAA), which certificates all U.S. commercial aircraft; Boeing’s Douglas Products Division, formerly a unit of the separate McDonnell Douglas Corp.; the United States Air Force (USAF); and Honeywell Inc., which produced the 747’s fuel measuring system.

Center Wing Fuel Tank (36K)

Daniel Cheney, Manager at the FAA’s Seattle office, said the certification philosophy long in use concerning fuel tanks is based on the assumption that the air space in a fuel tank is always a flammable environment. Therefore, that space must be protected from threats that could trigger a fire or explosion. Such threats can be external, such as a lightning strike, or internal, such as a spark or excess heat.

Ivor Thomas, Boeing Chief Engineer of Fuel Systems and Auxiliary Power Units, testified that his company builds aircraft with that principle in mind. For example, the fuel tank contents must not be allowed to heat to the point that they "auto-ignite," and Boeing’s design is intended to keep the temperature at least 50 degrees F. below that point. The design also aims to prevent introduction of anything with sufficient electrical energy to cause ignition through a spark.

An example of the latter, according to Thomas, is the explosion-proof chamber for the impeller in the fuel pump. If an explosion does occur, the chamber is supposed to contain it. The pump is also designed so that flames cannot propagate down tubes associated with it.

Ron Hinderberger, Engineering Director at Douglas, testified that even though Douglas was separate from Boeing until recently, management of the two have found great similarity in their design philosophies. "If you assume the vapors are flammable at all times," he observed, "then you must preclude ignition at all times."

Chairman James Hall of the NTSB asked Thomas whether Boeing has given any consideration to designing out or at least reducing the flammability of the vapors, rather than just attempting to design out ignition sources. Thomas replied that one reason for continued adherence to the current philosophy is that aircraft from one manufacturer can go into service throughout the world and in the process encounter fuels of varying properties.

Responding to a question from Dr. Merritt Birky, NTSB National Resource Specialist, about whether Boeing has considered the use of less volatile fuels, Thomas pointed to several concerns associated with such fuels. One is a possible higher freezing point, leading to the risk of fuel freezing on long flights. Another is increased viscosity, which could make engines harder to restart in flight. Betty Rodriguez, fuel system technical specialist with the USAF, added that these fuels have been used in military applications, and some problems have been reported with ground starts and operation of the auxiliary power units.

Chairman Hall and Dr. Bernard Loeb, Director of the NTSB’s Office of Aviation Safety, inquired about industry and FAA reaction following the TWA accident and also an earlier accident in which a fuel tank exploded on a Philippine Air Lines (PAL) Boeing 737. The ignition source in that case was never identified. Thomas said Boeing looked for potential sources, but ultimately ended the effort without instituting any design changes in the 737. Cheney said FAA is reviewing the inquiry into the PAL case in light of the subsequent TWA accident.

Thomas said that in the past, it was a given that the tank contents are flammable and that the job of engineers is to eliminate any ignition source. But, now, he added, Boeing is developing computer models to analyze temperatures in the fuel tanks, trying to find ways to reduce flammability.

Air Conditioning Pack #3 (22K)

In association with its participation in the TWA 800 investigation, Thomas said Boeing is considering measures such as cooling of the air conditioning pack bay. Air conditioning units, known as packs, give off heat, and on the 747 they are located just below the center wing fuel tank. Another measure under review, according to Thomas, is ullage sweeping. Ullage is the space in a fuel tank not occupied by fuel. Ullage sweeping could involve flushing the space with air to purge fumes.

Since the current design philosophy depends on identifying possible ignition sources, Hall and Loeb inquired if Boeing and FAA have a way of determining what all the possibilities are. Hall asked Thomas to provide a list. Thomas did cite examples, such as float switches.

Robert Swaim, NTSB Aircraft Systems Investigator, demonstrated with an illustration that the Lockheed L-1011 and the McDonnell Douglas DC-9 and DC-10 – unlike the 747 – have air conditioning packs away from the center wing fuel tank. Hinderberger of Douglas said fuel tank safety was not a consideration in this arrangement.

Lou Taylor, Honeywell Principle Engineer, described the Fuel Quantity Indication System (FQIS), calling it "a fancy name for a fuel gauge." Components of this system are found in the fuel tank, the cockpit and the aircraft’s electrical equipment bay.

Chairman Hall asked Taylor how many ignition sources can be associated with this system. "None," he replied. But when asked by Loeb to elaborate, he added that there are none as long as no other failures occur. When asked if there are potential sources, Taylor replied that "We don’t know yet. We’re checking."

Taylor stressed that the FQIS is a very low-energy system. He observed that far more amperage can be found in a small flashlight.

Jerome Hulm, Manager of Electrical Systems at Boeing, said that since the TWA explosion, his firm has issued three 747 service bulletins – advisories to airlines flying the aircraft -- to inspect fuel tanks, fuel gauges, bonding straps and other fittings.

This is to be done at each airplane’s next scheduled heavy maintenance or within two years, whichever comes first. He added that Boeing was considering a bulletin revision to include an inspection of the insulation of the gauges inside the tanks that measure fuel levels.

He said the possible revision would be based on information obtained from the 52 aircraft already inspected, of the worldwide fleet of 970 Boeing 747s.

Cheney said that since the explosion, the FAA has issued one airworthiness directive – an order to airlines – for center fuel tank inspections and was considering an order broadening the directive.

Asked how long it might take for the FAA to implement a broader airworthiness directive, Cheney said that while some in the past have taken a year or two, the agency could act quickly, and in some cases has grounded aircraft.