Significant Regulatory & Other Activity

Mon, Oct 26, 2009 — David Evans

Regulatory & Other Items

4 September 2009                     Federal Aviation Administration (FAA)FR Doc E9-21478                       Docket No. FAA-2009-0810

Subject: Notice of Proposed Rulemaking (NPRM) regarding Design Maneuvering Speed Limitation

An outgrowth of the American Airlines Flight 587 crash at New York city in November 2001, this proposal is intended to clarify that flying at or below design maneuvering speed (VA) does not allow a pilot to make multiple large control input in more than one axis at a time. In the accident, the first officer flying made numerous alternating rudder control inputs in rapid successions (e.g., rudder reversals). Even though the A300-600 was below VA, the buildup of aerodynamic loads on the rudder resulted in its snapping off the airplane, leading in close order to the fiery crash that killed all 260 aboard and 5 persons on the ground.

Rapid rudder reversals tore off the tailfin to the A300-600, leading to FAA redefinition of design maneuvering speed.

Rapid rudder reversals tore off the tailfin to the A300-600, leading to FAA redefinition of design maneuvering speed.

The NPRM says many pilots might have a general misunderstanding of the meaning of VA and the structural protection that exists below it. The proposed change to the regulations would clarify that flying at or below VA does not allow a pilot to make multiple large control inputs in one axis or single full control inputs in more than one axis at a time without endangering the airplane’s structure.

Comments on the statement are due 3 November 2009.

The FAA has, as of two weeks before the deadline, received only one comment on this NPRM. Submitted 9 September by Geoffrey Barrance, a retired avionics and safety engineer, it is a comprehensive critique of the NPRM. As such, it is quoted here in full:

1. The proposed amendment is weak:

“Should be avoided” – the primary criticism of this proposed amendment is that despite the General Discussion, in the context of the AA587 accident, and its claim to respond to NTSB recommendation A-04-60, the new wording does not address the problem facing a pilot in knowing at what speed a certain input to the airframe is safe and what type of input is likely to cause structural failure.

2. The proposed amendment is not specific:

“Rapid and large” – how is a pilot to know what those words mean? Will the FAA interpret them as requiring the AFM [Airplane Flight Manual] to provide a specific and detailed explanation of exactly what the particular airplane is capable of withstanding? Will there be an Advisory Circular associated with this changed requirement to provide interpretation and guidance as to acceptable means of compliance?

3. The proposed amendment is not retroactive:

Assume that AFM wording approved for future aircraft is able to communicate the exact conditions that the pilot may apply – if so, well and good. But the amendment is not retroactive and we are left with existing aircraft for which no such precise definition is given is or indeed practically possible.

4. The underlying handling problem that led to the AA587 accident has not been addressed.

The underlying problem which has not been addressed is that in certain circumstances a pilot is required to take firm and, if not aggressive, then immediate and positive action, yet seemingly has no way to know how much or when it is likely to break the airplane. The AA587 accident illustrates this exactly: the pilot flying reacted to a perceived potential upset with rudder inputs – a mere one-and-a-half cycles at the Dutch Roll frequency – and was rewarded with a catastrophically compromised airframe. The dilemma faced by the pilot is that there is some unspecified (or poorly specified) point where the kind of control input that he would almost routinely need to apply during landing or takeoff are no longer safe. The AA587 accident illustrates this dilemma exactly, yet it has been given little recognition.

5. AA587 is not the only accident with relevance to this proposed amendment:

Note also the example provided by the response to the 737 rudder upsets, as a result of which specific training was instigated for unusual and extreme application of controls for recovery and continued flight. The question of whether the pilot of AA587 was influenced by knowledge of the 737 accidents and/or subsequent training has not been addressed.

6. The structural and systems issues arising from the AA587 accident have not been addressed:

It is unacceptable for an airframe to fail catastrophically from a pilot input of only one-and-a-half cycles at any aerodynamic or structural mode (Todd Wissing [American Airlines pilot]: “No plane should fall apart because somebody presses a pedal too hard.”) NTSB’s recommendations letter addresses these issue, but this proposed regulation does nothing to address those issues for existing airplanes. Different kinds of modifications to CFR Part 25 are required – see recommendation A-04-56. Such amendments should include consideration of composite structure failure characteristics [the tailfin and rudder on AA587 were composite] compared with traditional (metal) structure, which was clearly an issue in the AA587 accident. A panel of industry and regulatory experts should be assembled to consider whether the CFR certification requirements for vertical stabilizer strength and structural protection from rudder deflections are adequate.

7. This action must not proceed in isolation from the other recommendations made by the NTSB:

This action responds to only one of the NTSB’s Safety Recommendations. There are seven in all – see the full letter from [then] Chairman Ellen Engleman Conners to [then] Administer Marion Blakey dated November 10th 2004.


30 September 2009                     Transport Canada/European Safety Agency (EASA)

No.CF-2009-37 (Airworthiness Directive)

Subject: Wing Anti-Ice System, Outboard Low-Heat Detection Switches on Bombardier CL-600-2B19 aircraft

Requires a number of actions to correct a situation where asymmetric ice can build up on the wings and the crew won’t be alerted to this anomaly, which can result in stall and reduced controllability of the aircraft in icing conditions. Chief among the required actions is installation of low-heat detection switches in the wing outboard leading edges not later than 1 November 2010. The changed maintenance requirement must be incorporated into operators maintenance schedules within 30 days.

The Bombardier CL-600-2B19.

The Bombardier CL-600-2B19.

The following caution is provided:

“There have been a number of cases reported in which piccolo ducts were found to have been installed in the opposite wing, resulting in the incorrect orientation of the bleed holes. During reinstallation of the piccolo ducts and leading edge assemblies after installation of the low-heat detection switches, particular attention should be paid to the correct alignment of the piccolo ducts.”

According to the AD, failure of piccolo ducts can result in “unannunciated asymmetric ice build-up” on the wing leading edge.

A comparable AD from the FAA has not yet been issued. However, the piccolo tubes have a history. The FAA issued AD 2009-06-05 on 24 March 2009 requiring within 60 months inspection and replacement of piccolo ducts:

“This directive mandates the amendment of the AFM [Aircraft Flight Manual] procedures, in addition to checking the part numbers and serial numbers of the installed wing anti-ice piccolo ducts and replacing them as necessary.

“The unsafe condition is anti-ice system air leakage with a possible adverse effect on the anti-ice air distribution patters and anti-ice capability without annunciation to the flight crew, and consequent reduced controllability of the airplane.”

The FAA AD affected 108 CL-600-2B19 aircraft in U.S. registry.

The Canadian AD was also issued by the European Aviation Safety Agency (EASA).


14 October 2006                     FAA

FR Doc E9-24652                    Docket No. NM415                     Notice No. 25-09-11-SC

Subject: Notice of Proposed Special Conditions, Boeing 787-8, Lightning Protection of Fuel Tank Structure to Prevent Fuel Tank Vapor Ignition

This is the latest special condition announced for Boeing’s new B787 all-composite aircraft. Unlike aluminum structures, the composite construction of the B787 makes it vulnerable to lightning strikes (lightning penetrates the composite structure, whereas in most cases on aluminum structure the strike is limited to the surface). As a result, lightning could penetrate the wing fuel tanks and ignite any flammable vapors therein. The result could be a fuel tank explosion of the type that destroyed TWA Flight 800 in 1996 (although that explosion was triggered by electrical arcing inside the tank).

This special condition announces that Boeing will outfit the airplane with a fuel tank nitrogen generation system (NGS) to reduce exposure to explosive vapors to a fleet average of 3%, as required by the regulations.

It appears, however, that other elements of the fuel tank design may be relaxed because of the NGS. As the document indicates:

“Based on our recognition … that a highly effective NGS for the fuel tanks makes it unnecessary to assume that the fuel tank is always flammable. As discussed previously, the assumption that the fuel tank is always flammable was part of basis for the ignition prevention requirements of Sec. 25.981(a)(3).”

The wording is subtle but significant. The FAA is saying that other components of the fuel system need not be fault tolerant (i.e., protect from errant ignition sources) because the NGS is always present to fill the void space of the tank with an inert gas such that an explosion will not occur despite the presence of an ignition source.

The special condition appears to violate former FAA Administrator Jane Garvey’s dictum regarding a “belt and suspenders” approach to fuel tank safety: not only minimizing ignition sources but, should one occur, an inerting system to prevent explosion of the fuel/air vapor.

Here is the key statement in the special condition that indicates Garvey’s “belt and suspenders” rule has been, well, suspended:

“For any non-fault tolerant features proposed in the design, Boeing must show that eliminating these features or making them fault tolerant is impractical.”

One wonders why non-fault tolerant features would be acceptable in a new design aircraft that will be in service for about the next 40 years.

These special conditions follow by more than a year the FAA’s final rule, “Reduction of Fuel Tank Flammability in Transport Category Airplanes.” That rule addressed performance requirements for NGS installed in new aircraft and retrofitted to existing aircraft.

Comments on the proposed special condition are due 30 November 2009.


23 October 2009                     European Aviation Safety Agency (EASA)


AD No. 2009-0230-E

Subject: Emergency Airworthiness Directive for Sikorsky S-92 helicopters

Applies to all Sikorsky S-92A helicopters and requires inspection within 10 flight hours and continued inspections every 10 flight hours thereafter of the main gear box (MGB). Effective date 27 October 2009.

According to this AD:

“Cracks have reportedly been found in the MGB assembly mounting feet, pad and foot ribs during regular inspections of the MGB feet and mounting bolts. In one case, the mounting foot was completely severed from the MGB. Other cases include cracks at the fore and aft mounting bold location on the right hand side mounting foot.

“This condition, if not detected and corrected, could lead to failure of the MGB attachment, possibly resulting in MGB detachment and consequent loss of control of the helicopter.

“For the reasons described above, this EASA Emergency AD requires repetitive inspections of the MGB assembly mounting feet pad and foot ribs for cracks and, if any cracks are found, the replacement of the MGB assembly with a serviceable unit. Replacement of the MGB assembly does not constitute a terminating action for the repetitive inspections.”

These inspections relate to the fatal crash 12 March 2009 of an S-92A near St. John’s, Newfoundland. The case is now under investigation by the Transportation Safety Board (TSB) of Canada. The TSB issued a communiqué 18 June 2009 indicating the MGB is a focus of the investigation, indicating:

“The investigation has revealed that, even though the Sikorsky S-92A MGB was certificated to meet requirements of Part 29 of the Federal Aviation Regulations (FAR 29) of the United States FAA, there is a perception in some areas of the aviation community that the MGB can be run in a dry states – that is, without lubricating oil – for 30 minutes. FAR 29 does not require run-dry operation of a gearbox to meet the 30-minute ‘continued safe operation’ … As a result of the fracture of the filter bowl mounting studs, resulting in the loss of a large quantity of oil, the certification guidance material is being reviewed. Additionally, the FAA and Sikorsky Aircraft are working to identify all the modes of failure that might lead to Sikorsky S-92A MGB oil loss, determining their probability of occurrence, and developing appropriate mitigation strategies.”

MGB after removal from the wreckage of the S-92A.

MGB after removal from the wreckage of the S-92A.

Oil filter housing showing one of three mounting studs broken and missing.

Oil filter housing showing one of three mounting studs broken and missing.


The S-92A was certified after Sikorsky demonstrated that the chance of complete oil loss was “extremely remote,” only to suffer a series of gearbox oil-loss incidents after the helicopter entered service. The MGB, which transmits power from the engines to the main rotor blades, is one of the most critical components in a helicopter. Pilots can recover from an engine failure, but MGB seizure is considered catastrophic.

S-92A wreckage layout and reconstruction.

S-92A wreckage layout and reconstruction.

Given the previous incidents and the fatal crash, one must ask: how many cracks must be found before immediate grounding is appropriate?

Comments are closed.

Nolan Law Group