Maintenance and Certification
When many of us think of ageing airplanes, images come to mind of proudly displayed vintage warbirds and other enduring examples of aviation's first century of flight. However, perhaps less obvious is the world of transport and commuter category airplanes that each day transport passengers and cargo to diverse destinations around the globe. Yes, even the stylishly painted and freshly washed passenger jets transporting us for business, pleasure and to holiday destinations could be considered in the same breath as those vintage warbirds.
For those following the progress of the Federal Aviation Administration (FAA) rulemaking activities, collectively known as the Aging Airplane Program, launched following the Aloha Airlines Boeing 737-200 accident of 1988, the subject of ageing airplanes will be hardly new. In many respects, the term "ageing airplane" itself is getting long in the tooth. What is new is the approach now being taken to address design and maintenance issues associated with ageing structures, wiring and fuel tank safety.
Recent regulatory activity by the FAA, the European Aviation Safety Agency (EASA), the Brazilian Agência Nacional de Aviação Civil (ANAC) and Transport Canada Civil Aviation (TCCA), has brought to bear a focus on enhancing the safety of the current and expected future fleet of ageing airplanes. The current rulemaking initiatives recognize that many airplanes are still in service beyond their design life goal. The design life goal is a"life expectancy" in flight cycles or hours that is generally established early in the development of a new airplane and based on economic analysis, past experience with other models, and in some cases, fatigue testing. In addition, numerous accidents have raised awareness of safety issues associated with the design and maintenance of ageing airplane structures and systems.
New requirements will focus on re-evaluations of existing designs against new airworthiness standards, revising maintenance and inspection programs, and imposing flight operations requirements that would prohibit the operation of airplanes that do not incorporate required modifications and/or changes to their maintenance programs.
While the Aloha Airlines accident was not the first ageing airplane fatal accident, it was the one that brought the issue to public attention. The Boeing 737-200 was a highcycle aircraft that suffered a partial in-flight disintegration in which an 18-ft crown section of the fuselage was torn apart in flight. The accident investigation revealed the presence of small cracks at multiple rivet locations in a disbonded lap joint, which were sufficient in size and density to cause the accident. This phenomenon is referred to as widespread fatigue damage (WFD).
April 28, 1988: Aloha Airlines flight 243, Boeing 737-200 near Maui, Hawaii, fuselage upper crown skin and structure separated in flight.
Historically, we may look back to 1977 for what could be argued as the first ageing-airplane related accident; a Dan-Air Services Boeing 707-321C that crashed on final approach in Lusaka, Zambia. The airplane, engaged in a non-scheduled international cargo flight, happened to be the first aircraft off the 707-300C series convertible passenger/freighter production line. On approach, the airplane pitched rapidly nose down, dived vertically into the ground from a height of about 800 ft, and caught fire. The accident was determined to be caused by a loss of pitch control following the in-flight separation of the right-hand horizontal stabilizer and elevator as a result of a combination of metal fatigue and inadequate fail-safe design in the rear spar structure. Shortcomings in design assessment, certification, and inspection procedures were contributory factors. A post-accident survey of the 707-300 fleet worldwide revealed a total of 38 aircraft with fatigue cracks present in the stabilizer rear spar top chord.
A Dan-Air Services Boeing 707-300C, similar to the aircraft that crashed near Lusaka, Zambia, on May 14, 1977.
Our own Canadian experience involved a Douglas DC-3C wing separation near Pickle Lake, Ont., in 1987. Two other pilots flying in the vicinity at the time described the final moments of the aircraft flight as having been in an inverted attitude descent with the left wing folded upwards. The Canadian Aviation Safety Board (CASB Report No. 87- C70022) determined that the left wing failed under normal flight loads as a result of a fatigue crack in the centre section of the lower wing skin. It was also found that anomalies in the radiographs previously taken during mandatory non-destructive testing inspections were not correctly interpreted. As a result, Transport Canada conducted the Study of Non-Destructive Testing in Canadian Civil Aviation, which was completed in January 1988. The study identified a number of shortcomings, and recommended that ondestructive testing (NDT) personnel certification standards (CGSB, MIL-STD-410, ATA 105) be recognized as airworthiness standards, and that NDT work be done under an approved maintenance organization (AMO). Canadian Aviation Regulations (CARs) 571 and 573 were amended to include these requirements. In 1996, TCCA published CAR 511.34-Supplemental Structural Integrity Items to require, for all principle structural elements, the development of any change or procedure necessary to preclude the loss of the airplane or a significant reduction in the overall structural strength of its airframe.
Subsequent to the 1988 accident, the FAA greatly expanded its structural integrity inspection program and formed the Airworthiness Assurance Working Group (AAWG) with five focus areas to examine structural issues related to widespread fatigue damage and corrosion (www.faa.gov/regulations_policies/rulemaking/committees/arac/issue_areas/tae/aa/):
- Service Bulletin Review
- Supplemental Inspections
- Maintenance Programs
- Corrosion Prevention and Control Programs
- Repair Assessment Programs.
Whereas the accidents to date were raising awareness to ageing structural issues, it was not yet realized that aircraft systems ageing-related failures could be just as catastrophic. That all changed on July 17, 1996, when Trans World Airlines (TWA) flight 800, a 25-year old Boeing model 747-131, was involved in an in-flight break-up after takeoff from John F. Kennedy International Airport in New York, resulting in 230 fatalities. The accident investigation conducted by the National Transportation Safety Board (NTSB/AAR-00/03) indicated that the centre wing fuel tank (CWT) exploded due to an unknown ignition source. However, of the ignition sources evaluated by the investigation, the most likely cause was a short circuit outside of the CWT that allowed excessive voltage to enter it through electrical wiring associated with the fuel quantity indication system.
July 17, 1996: Trans World Airlines flight 800, a Boeing 747-131, in-flight break-up over the Atlantic Ocean, near East Moriches, N.Y., 230 fatalities.
This accident prompted the NTSB, the FAA and industry to examine the underlying safety issues surrounding fuel tank explosions, the adequacy of the existing regulations, the service history of airplanes certificated to these regulations, and existing fuel tank system maintenance practices. The NTSB/FAA accident investigation included:
- Review of fuel tank system design features of Boeing 747 and certain other models; and
- Inspection of in-service and retired airplanes.
The TWA flight 800 accident investigation was still in progress when, on September 2, 1998, Swissair (SR) flight 111, a McDonnell Douglas MD-11, experienced an in-flight fire approximately 53 min after departure from New York, that would ultimately lead to the aircraft colliding with water near Peggy's Cove, N.S., and would result in 229 fatalities. The accident investigation, conducted by the Transportation Safety Board of Canada (TSB AIR Report No. A98H0003), identified the cockpit attic and forward cabin drop-ceiling areas as being the primary fire-damaged area, and that the most prevalent potential ignition source was electrical energy.
It should be noted that the SR flight 111 occurrence aircraft was manufactured in 1991, and therefore, should not be considered an aged airplane. In addition, a historical review conducted by the FAA of fuel tank explosions prior to the TWA flight 800 accident revealed that ageing was not the only contributing factor in the development of potential ignition sources. In particular, in May 1990, the centre wing tank of a Boeing 737-300 exploded during push back from a terminal gate prior to flight, as the result of an unknown electrical ignition source; the aircraft was less than a year old. Hence, the development of such failures may be related to both the design and maintenance of the airplane systems.
Photos courtesy of FAA SFAR 88 Workshop, June 2001:
Potential ignition sources discovered by fleet inspection.
1. Frayed fuel pump wire; 2. Main tank over pressure;
3. Arc through conduit; 4. Arc through pump housing.
In January 1999, the FAA chartered the Aging Transport Systems Rulemaking Advisory Committee (ATSRAC). Whereas the AAWG's focus had been on structural integrity and the effects of structural corrosion and fatigue, ATSRAC (www.mitrecaasd.org/atsrac/) was tasked to "propose such revisions to the Federal Aviation Regulations (FARS) and associated guidance material as may be appropriate to ensure that non-structural systems in transport airplanes are designed, maintained, and modified in a manner that ensures their continuing operational safety throughout the service life of the airplanes."
In parallel, the Aerospace Industries Association (AIA)/Air Transport Association of America (ATA) conducted an aircraft fuel system safety investigation. The team inspected multiple in-service airplanes, and this industry program gathered significant information about the overall integrity of the design and maintenance of these aircraft. Well over 100 000 labour-hours were reportedly expended performing inspections of the world fleet. As of June 1, 2000, inspections had been completed on 990 airplanes, with a further 30 airplanes to be completed shortly thereafter, operated by 160 air carriers in diverse operating environments on six continents.
On April 21, 2001, after 18 months of deliberation, including 3 months of public consultation (including inputs from Transport Canada and other civil aviation authorities [CAA]), the FAA issued the Final Rule of Special Federal Aviation Regulation (SFAR) No. 88. This new rule promulgated improved design standards for transport category (large) airplanes, developed with the knowledge gained following the tragedy of TWA flight 800. SFAR No. 88 included a comprehensive requirement for manufacturers, owners and operators to conduct a one-time fleet-wide re-evaluation of all large airplanes of the jet age, with respect to their fuel system designs and maintenance practices, against the revised and improved safety standards. TCCA, the Joint Aviation Authorities (JAA), and other CAAs supported this important safety initiative. Manufacturers conducted extensive design reviews, and their findings were reviewed by the airworthiness authorities to verify compliance with the new requirements and to mandate corrective actions where necessary (www.fire.tc.faa.gov/systems/fueltank/intro.stm).
Through their participation in the AAWG, ATSRAC and/or the FAA's Transport Airplane and Engines Issue Group (TAEIG), EASA, TCCA and ANAC (then called Centro Técnico Aeroespacial [CTA]) have monitored and/or participated in the development of proposals for the Aging Airplane Program rulemaking initiatives.
The Aging Airplane Program initiatives consist of multidisciplinary regulatory activities including:
(1) Transport Airplane Fuel Tank System Design Review, Flammability Reduction and Maintenance and Inspection Requirements; Final Rule (issued April 19, 2001) and the Fuel Tank Safety Compliance Extension; Final Rule (issued July 21, 2004);
(2) Enhanced Airworthiness Program for Airplane Systems / Fuel Tank Safety; Notice of Proposed Rulemaking (NPRM) (issued September 22, 2005);
(3) Aging Airplane Safety; Final Rule (issued January 25, 2005);
(4) Aging Aircraft Program: Widespread Fatigue Damage; NPRM (issued April 11, 2006); and
(5) Damage Tolerance Data for Repairs and Alterations; NPRM (issued April 13, 2006)
Other related FAA regulatory initiatives include:
(6) Repair Assessment of Pressurized Fuselages; Final Rule (issued April 19, 2000); and
(7) The new approach for requirements for design approval holders (part of Aging Airplane Program Update, issued on July 21, 2004).
TCCA has recently initiated Canadian-specific rulemaking activities and has invoked a Canadian Aviation Regulation Advisory Council (CARAC) Working Group on Ageing Aeroplane Rulemaking and Harmonization Initiatives (AARHI), covering the structural and non-structural subjects. The Working Group is a joint undertaking of government and the aviation community, representing an overall aviation viewpoint. The Working Group will disposition into the Canadian regulatory framework the findings of both AAWG and ATSRAC. At the same time, the Working Group will seek to maximize compatibility with other regulatory authorities. (For more information on CARAC, please see www.tc.gc.ca/eng/civilaviation/regserv/affairs-carac-menu-755.htm)
EASA has also initiated regulatory activities that will strive to be harmonized with the FAA by creating the European Ageing Systems Coordination Group (EASCG). EASA has separately examined the ageing structures issues, but is anticipated to convene a Working Group this year to disposition those issues with input from the European industry.
Following presentation of the CARAC AARHI Working Group recommendations, TCCA will seek to publish new regulations and standards that will parallel those of the FAA's Aging Airplane Program. It is anticipated that the TCCA rulemaking will include new design approval holder (DAH) requirements, specifically for type certificate (TC) and supplemental type certificate (STC) holders, to supply data and documents in support of operator compliance with related flight operations rules. In some cases, repair design certificate (RDC) and limited STC (LSTC) holders may also be affected. The DAH requirements would reference technical standards, and include consideration for compliance planning applicable to existing DAHs and applicants for new and amended design approvals, to ensure that an acceptable level of safety is maintained for the affected airplanes.
TCCA, EASA, ANAC and the FAA have agreed to work together on the ageing airplane initiatives in an effort to foster a common understanding of the respective rulemaking activities, to provide for coordinated implementation, and to coordinate the eventual compliance findings between the appropriate CAAs, where possible using procedures developed under the bilateral agreements.
What is a bilateral agreement on airworthiness?
A bilateral agreement on airworthiness is an administrative arrangement that has the objective of promoting aviation safety by strengthening technical cooperation and mutual acceptance of tasks related to the airworthiness of aeronautical products.
For the purpose of this article, we will simply use the term "agreement" whenever we want to refer to a bilateral agreement on airworthiness.
Why do we enter into an agreement?
The Canadian Aeronautics Act has the purpose of providing for safe, efficient and environmentallyresponsible aeronautical activities, by means that include ensuring that Canada can meet its international obligations relating to aeronautical activities.
Paragraph 4.2 (1)(j) of the Aeronautics Act prescribes that the Minister (to be considered the Minister of Transport for the purpose of this article) may enter into administrative arrangements with the aeronautics authorities of other governments or with organizations acting on behalf of other governments, in Canada or abroad, with respect to any matter relating to aeronautics.
Before entry into Canada, aeronautical products designed in a foreign state require approval to ensure Canadian airworthiness design standards are fully satisfied, regardless of whether the product received prior certification by a foreign airworthiness authority. Conversely, the certification of aeronautical products that are designed in Canada must be validated by foreign airworthiness authorities upon exportation from Canada. This review, at times, may be very lengthy and require a lot of resources from the civil aviation authority (CAA) from both the exporting and importing States.
In summary, the presence of an agreement on airworthiness or certification of aeronautical products is not only very cost-beneficial for Canadian organizations exporting aeronautical products to other foreign States, but it also promotes a significant exchange of technical cooperation among States.
Characteristics of an agreement
An agreement can be entered between:
- Canada and another government under a Treaty (legally binding); or
- The Minister of Transport or Transport Canada Civil Aviation (TCCA) and their counterpart office, as an administrative or technical cooperation arrangement (not legally binding). Examples of this kind of agreement are: Technical Arrangements and Memoranda of Understanding, among others.
An agreement can only relate to civil aviation safety issues (not commerce or trade issues), and it should be within the current scope and authority of the Canadian regulations.
Foreign Affairs Canada (FAC) has primary responsibility in legally-binding agreements. For other agreements, the Minister of Transport or TCCA can engage directly.
An agreement cannot relieve the Minister of Transport of their statutory responsibilities, which, under the Aeronautics Act and the Canadian Aviation Regulations (CARs), cannot be transferred.
Steps to an agreement
The following steps are required in order for Canada to enter into an agreement with another State or organization:
1) There must be a mutual desire to strengthen and formalize technical cooperation in promoting safety, which would increase efficiency in matters relating to safety, and reduce economic burden due to redundant airworthiness reviews (technical inspections, evaluations, testing).
2) Areas of cooperation must be defined:
- Technical assistance to bilateral partner in their approval and certification activities;
- Harmonization of standards and processes;
- Facilitation of the exchange of civil aeronautical products and services;
- Mutual recognition and reciprocal acceptance of approval and certificates;
- Other areas, as mutually agreed.
3) Each State's legislation and regulatory system must be assessed and deemed to be equivalent. The civil aviation regulatory framework shown below, is used when assessing equivalency.
4) Competence and capability of a bilateral partner must be assessed as to their ability to achieve results similar to those obtained by TCCA.
5) Compliance with the Chicago Convention must be assessed.
6) Effectiveness of oversight and enforcement programs must be assessed.
7) Once confidence is established with steps 1 to 6, negotiations and a draft agreement may proceed.
The conclusion of an agreement is reached in the following manner:
- For Treaties-Signatures by both governments (States).
- For non-Treaty (not legally binding)- Signatures by Minister of Transport of Canada and bilateral partner equivalent. (The signature of the Minister commits Transport Canada, and not the Canadian Government.)
In terms of the time required to conclude an agreement, it may take up to 3 years for a legally-binding agreement (due to the lengthy review process and legal nature), and 3 months to 2 years for an agreement that is not legally binding (depending on the complexity and scope of the agreement).
Status of agreements on airworthiness
Please refer to the following Web site for information on agreements on airworthiness that have been signed by TCCA or the Government of Canada (in the case of a legally-binding agreement): http://www.tc.gc.ca/eng/civilaviation/standards/int-menu-3668.htm.
For further questions or clarifications, please contact the author at firstname.lastname@example.org.