Simulations Can Document Effectiveness of Inerting

A unique method of assessing fuel tank safety may in fact be the most suitable approach. The Federal Aviation Administration (FAA) recently published for industry comment a notice of proposed rulemaking and an associated advisory circular calling for inerting of heated center wing tanks to prevent another explosion of the type that destroyed TWA flight 800, a B747, in 1996.

The FAA counts a total of 17 in-air and on-the-ground fuel tank explosions since the dawn of the jet age, and it predicts that nine more over the next 50 years are a virtual certainty if nothing is done. Four of these explosions, the FAA surmises, can or will be prevented by the effort now under way under the so-called SFAR 88 program to identify and mitigate likely ignition sources. However, the FAA recognizes that this effort will not be entirely successful, and that some means must be found so that an errant spark or flame inside the tank will not cause an explosion. A means of doing that is by inerting, or displacing a substantial amount of the oxygen in the tank with inert nitrogen-enriched air. The FAA is proposing to do this for all passenger airliners with heated center wing tanks (e.g., those in which nearby equipment, such as air conditioning packs, generate heat that finds its way into the tank). This heat, in combination with other factors, can lead to the formation of flammable vapors.

In demonstrating the efficacy of inerting, the FAA uses the so-called Monte Carlo method, in which variables affecting tank flammability are input into a computer model, and the model is run many times for a fleet of aircraft. The average tank flammability is thus assessed. By this means, the FAA concludes that inerting is effective.

Of interest, the Monte Carlo method was not used to assess safety of anti-icing systems or of electrical system resistance to arcing. The reason may lie in the difference between a closed system (such as tank flammability, communications reliability, ballistics, etc.) and an open system (such as icing, corrosion, fatigue cracking, tire wear induced failure, the likelihood of wake turbulence, and so forth). In a closed system, one is able to control, define or specify all the variables, whereas in an open system there are some variables that are environmentally immeasurable, beyond control, unpredictable, or develop exponentially (structural load-bearing cracking, or fire spread due to ventilation, to name two).

For example, in ballistics, one could say that the winds at various levels, and rifled barrel wear and temperature (due to rate of fire) are factors beyond control. However, the variables can be bounded by the range of random scatter, and the outer limits are related to statistically derived extremes of wind-shear, barrel wear, propellant choice, friction in the barrel, and so forth. The results can be encapsulated in a reliable enough aim-point.

Similarly, communications range and reliability may be delineated by spectrum, line of sight (i.e., height), radiated power, receiver sensitivity and tuned antennas – all very definitive factors. Even ionospheric conditions and sun spot activity for refractive bounce and signal scatter are predictive. Thus, communications are a closed case for range reliability predictions, and lend themselves to Monte Carlo analysis.

On the medical front, Monte Carlo will give one a reasonable predictability of developing a carcinoma as a function of lifestyle, environment, diet and whether or not one smokes. However, the results don’t apply to an individual, but to a wide cross-section of the population exhibiting similar behaviors (hence the fleet-wide application of Monte Carlo in assessing the risk of a fuel tank explosion).

However, in tread failure due to tire wear, an out-of-control variable might be a preponderant operation off contaminated runways, or an airline’s retread policy, which would be beyond any resolution by a Monte Carlo approach.

Likewise, a complex system such as an engine might not be analyzable by Monte Carlo for incidence of failure because it is subject to so many wild-card contingencies. Here are a few:

• Wear.
• Time between overhauls.
• Operating hours and cycle times (long haul/short haul).
• Fuel sulfidation.
• Pilot operating techniques.
• The presence or absence of Full Authority Digital Engine Control (FADEC).
• The applicability or not of extended range twin engine operations (ETOPS) standards.
• Balanced field reduced power takeoffs.

The factors vary too much, and the utility of the Monte Carlo method for analyzing the risk thresholds becomes very degraded. It would be computationally reckless to rely upon any such derivation.

This is not the case with fuel tank flammability, because the number of controllable or bounded variables allow the risk to be narrowly defined. By choosing oxygen content of the tank air, the FAA is able to talk convincingly of the plateau of risk as a more or less direct function of nitrogen enriched air. The relationship remains credible throughout the operational envelope – even though one can range fairly widely across other factors influencing flammability (pressure and temperature mainly influencing fuel flash points). In other words, the nitrogen enriched air parameter is a useful threshold when the controllable and assessed risks of a fuel tank explosion are considered.

The FAA assumes that its proposed inerting system will eliminate all but one of the nine predicted fuel tank explosions. This one event is a statistical result of the Monte Carlo simulations. If such an explosion were to occur, even after the effort to install inerting, killing another 230 or so (the TWA Flight 800 toll), the public may well ask why the FAA found the risk of one in nine acceptable. The agency’s answer may well be that the cost of doing more was prohibitive. Allowing that one wild card permitted the control factors to be freed up, such as relaxing the purity of the nitrogen enriched air from 10 percent oxygen to 12 percent, which proved far more cost-effective. Whether the FAA’s credibility can be sustained in the face of such a calamity remains to be seen.