Hasn’t Failed Yet a Poor Method of Assuring Electrical System Safety

It is time to press the Federal Aviation Administration (FAA) to improve its certification standards.

The latest example of an emergency created by lax standards comes from a United Airlines B777 that suffered an electrically-stoked fire on taxi out 26 February 2007 at Heathrow. The UK’s Air Accidents Investigation Branch (AAIB) investigated, and its excellent 16 April report documents how an electrical failure led to a spreading fire (see Aviation Safety Journal, ‘Regulatory Lassitude Contributed to Electrical Fire’).

We’ve seen this before. In 1998, a Swissair MD-11, en route from New York to Zurich, crashed at Halifax, Canada. The cause? According to the Transportation Safety Board (TSB) of Canada, electrical arcing above the main deck ignited flammable insulation blankets. The first time the pilots knew they had a fire was when it burned through the cockpit ceiling and molten globs of plastic fell on the captain, driving him from his seat. He and 229 others aboard perished.

In its exhaustive post mortem of the crash, the TSB said, basically, if there weren’t flammable materials on an airplane, the hazard posed by in flight fire would be much less. Nil, in fact.

The FAA has ordered metalized Mylar insulation blankets, which were on the accident MD-11, removed from the fleet and replaced with a less flammable material. All well and good, but the less flammable material – plain Mylar – was on the United B777 and it burned, too.

The United pilots, knowing they had an electrical problem, prudently elected not to take off. It was not until they were informed, from sources outside the airplane, that thick, black smoke was seen pouring out of the lower fuselage, did the pilots know they had a fire. Fortunately, the fire fighters were right there, and the fire seemed to have burned itself out, after charring insulation blankets in the lower equipment pay.

Like on the Swissair jet, the United fire was started by electrical arcing, which caused molten pieces of copper wire to fall out of the equipment box, and onto the insulation blankets.

Severe electrical arcing occurred in the Right Generator Circuit Breaker (RGCB) and the Right Bus Tie Breaker (RBTB). It was not possible, from the congealed evidence, to determine where the arcing first occurred, but both the RGCB and the RBTB assemblies were damaged, almost beyond recognition.

One might ask why these two critical, interactive and fire-prone electrical components were placed in the same P200 power box. One would think they would have been separated into different power boxes.

Fire damage to the P200 power panel with cover removed, showing burnt-out RGCB and RBTB contactors (view looking forward and to the right).

Fire damage to the P200 power panel with cover removed, showing burnt-out RGCB and RBTB contactors (view looking forward and to the right).

The definition of “box” needs explanation, also. In this case, the box was open on the bottom, allowing the molten metal from arcing to drop onto the insulation blankets below. Not just a couple globs of molten metal, but rather a volcanic flow of super hot material over the course of 30 minutes or more. Manufacturer Boeing has since proposed an aluminum tray, mounted on the bottom of the P200 box to block molten metal from arcing to descent and ignite the insulation blankets. One would have thought that the definition of “box” meant enclosure on six sides, period.

As far as the insulation blankets, they were tested against a Bunsen burner flame, as well as against a cotton swab soaked in alcohol. As the AAIB noted, “The flame extinguished … as soon as the flame was removed.” There’s a huge difference, however, between a propane burner flame and 1,900º F heat of melted copper. The molten droplets, falling through the bottomless P200 box, were hot enough to ignite the insulation blankets.

If this had occurred in the air, the United B777 could well have been a repeat of the Swissair MD-11.

One wonders if electrical systems are tested with sufficient rigor when the airplane design is approved for operational service by the FAA, a process known as certification.

Consider what is done to assure structural integrity for the life of the airplane. The fuselage is pressurized repeatedly to make sure the flexing of the skin panels can be done safely through the thirty or forty year life of the aircraft. Same thing with wings; they are repeatedly bent upwards to make sure they have sufficient strength to endure such flexing for many years. Indeed, the airplane structure is fatigue tested to the point of failure.

Here’s an idea: do the same thing for high current carrying electrical systems. The basic thought here is to uncover the typical failure modes and the weak points in the assemblies and materials. Of main interest are di-electric breakdown due to thermal cycling.

Example of a contactor on a bus tie breaker with high main contact erosion after 47,000 flying hours and 14,500 flight cycles.

Example of a contactor on a bus tie breaker with high main contact erosion after 47,000 flying hours and 14,500 flight cycles.

 

Example of contact wear on an auxiliary power breaker that has completed 25,000 flying hours and 22,000 flight cycles.

Example of contact wear on an auxiliary power breaker that has completed 25,000 flying hours and 22,000 flight cycles.

Indeed, the test airplane for structure could have the electrical system installed, and the electrical testing could take place on the same accelerated schedule as is the structure. It seems far preferable to discover vulnerabilities in the electrical system well before passengers are on board. One would think a power box open on the bottom would be found in such testing to be a false weight saving. And there’s nothing like sustained dropping of molten metal to show that the propane flame of the Bunsen burner for insulation blanket testing is wholly inadequate for real world conditions. The FAA adapted this test from one used to assess the flammability of carpeting. Against the sustained drip, drip of molten metal, the carpet-based test has proven insufficiently demanding.

Moreover, it’s the interaction of components that reveals true vulnerability. This has been proven in structure, where the thickness of aluminum skin, the arrangement of ribs and stringers, and the manner in which rivet holes are bored can have an enormous affect on the design life of the fuselage. The same concept applies to electrical systems. Higher time electrical contacts clearly degrade over time, and the wear appears to do so exponentially as erosive spatter wear “sets in.” On condition (hasn’t failed YET) is a poor method for monitoring impending, potentially catastrophic electrical failure. It’s time to implement an equivalent structural integrity test for electrical systems.