Airworthiness Directives; Boeing Model 727 Series Airplanes Modified in Accordance With Supplemental Type Certificate SA1767SO or SA1768SO

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 39

[Docket No. 97-NM-232-AD]

RIN 2120-AA64

Airworthiness Directives; Boeing Model 727 Series Airplanes

Modified in Accordance With Supplemental Type Certificate SA1767SO or

SA1768SO

AGENCY: Federal Aviation Administration, DOT.

ACTION: Notice of proposed rulemaking (NPRM).

-----------------------------------------------------------------------

SUMMARY: This document proposes the adoption of a new airworthiness

directive (AD) that is applicable to certain Boeing Model 727 series

airplanes that have been converted from a passenger to a cargo-carrying

(``freighter'') configuration. This proposal would require, among other

actions, installation of a fail-safe hinge, redesigned main deck cargo

door warning and power control systems, and 9g cargo barrier. This

proposal is prompted by the FAA's determination that the main deck

cargo door hinge is not fail-safe; that certain main deck cargo door

control systems do not provide an adequate level of safety; and that

the main deck cargo barrier is not structurally adequate during an

emergency landing. The actions specified by the proposed AD are

intended to prevent structural failure of the main deck cargo door

hinge or failure of the cargo door system, which could result in the

loss or opening of the cargo door while the airplane is in flight,

rapid decompression, and structural damage to the airplane; and to

prevent failure of the main deck cargo barrier during an emergency

landing, which could injure occupants.

DATES: Comments must be received by December 27, 1999.

ADDRESSES: Submit comments in triplicate to the Federal Aviation

Administration (FAA), Transport Airplane Directorate, ANM-114,

Attention: Rules Docket No. 97-NM-232-AD, 1601 Lind Avenue, SW.,

Renton, Washington 98055-4056. Comments may be inspected at this

location by appointment only between the hours of 9 a.m. and 3 p.m.,

Monday through Friday, except Federal holidays.

FOR FURTHER INFORMATION CONTACT: Paul Sconyers, Associate Manager,

Airframe and Propulsion Branch, ACE-117A, FAA, Small Airplane

Directorate, Atlanta Aircraft Certification Office, One Crown Center,

1895 Phoenix Boulevard, Suite 450, Atlanta, Georgia 30349; telephone

(770) 703-6076; fax (770) 703-6097.

SUPPLEMENTARY INFORMATION:

Comments Invited

Interested persons are invited to participate in the making of the

proposed rule by submitting such written data, views, or arguments as

they may desire. Communications shall identify the Rules Docket number

and be submitted in triplicate to the address specified above. All

communications received on or before the closing date for comments,

specified above, will be considered before taking action on the

proposed rule. The proposals contained in this notice may be changed in

light of the comments received.

Comments are specifically invited on the overall regulatory,

economic, environmental, and energy aspects of the proposed rule. All

comments submitted will be available, both before and after the closing

date for comments, in the Rules Docket for examination by interested

persons. A report summarizing each FAA-public contact concerned with

the substance of this proposal will be filed in the Rules Docket.

Commenters wishing the FAA to acknowledge receipt of their comments

submitted in response to this notice must submit a self-addressed,

stamped postcard on which the following statement is made: ``Comments

to Docket Number 97-NM-232-AD.'' The postcard will be date stamped and

returned to the commenter.

Availability of NPRMs

Any person may obtain a copy of this NPRM by submitting a request

to the FAA, Transport Airplane Directorate, ANM-114, Attention: Rules

Docket No. 97-NM-232-AD, 1601 Lind Avenue, SW., Renton, Washington

98055-4056.

Discussion

Supplemental Type Certificate (STC) SA1767SO (held by FedEx)

specifies a design for a main deck cargo door, associated cargo door

cutout, and door systems. STC SA1768SO (held by FedEx) specifies a

design for a Class ``E'' cargo interior with a cargo restraint barrier

net. As discussed in notice of proposed rulemaking (NPRM), Rules

[[Page 61555]]

Docket No. 97-NM-09-AD [the final rule, AD 98-26-18, amendment 39-

10961, was published in the Federal Register on January 12, 1999 (64 FR

1994)], which is applicable to certain Boeing Model 727 series

airplanes that have been converted from a passenger to a cargo-carrying

(``freighter'') configuration, the FAA has conducted a design review of

Boeing Model 727 series airplanes modified in accordance with STC's

SA1767SO and SA1768SO and has identified several potential unsafe

conditions. [Results of this design review are contained in ``FAA

Freighter Conversion STC Review, Report Number 2, dated October 16-18,

1996,'' hereinafter referred to as ``the Design Review Report,'' which

is included in the Rules Docket for this NPRM.] This NPRM proposes

corrective action for three of those potential unsafe conditions that

relate to the following three areas: main deck cargo door hinge, main

deck cargo door systems, and main deck cargo barrier.

Main Deck Cargo Door Hinge

In order to avoid catastrophic structural failure, it has been a

typical industry approach to design outward opening cargo doors and

their attaching structure to be fail-safe (i.e., designed so that if a

single structural element fails, other structural elements are able to

carry resulting loads). Another potential design approach is safe-life,

where the critical structure is shown by analyses and/or tests to be

capable of withstanding the repeated loads of variable magnitude

expected in service for a specific service life. Safe-life is usually

not used on critical structure because it is difficult to account for

manufacturing or in-service accidental damage. For this reason, plus

the fact that none of the STC holders have provided data in support of

this approach, the safe-life approach will not be discussed further

regarding the design and construction of the main deck cargo door

hinge.

Structural elements such as the main deck cargo door hinge are

subject to severe in-service operating conditions that could result in

corrosion, binding, or seizure of the hinge. These conditions, in

addition to the normal operational loads, can lead to early and

unpredictable fatigue cracking. If a main deck cargo door hinge is not

a fail-safe design, a fatigue crack could initiate and propagate

longitudinally undetected, which could lead to a complete hinge

failure. A possible consequence of this undetected failure is the

opening of the main deck cargo door while the airplane is in flight.

Service experience indicates that the opening of a cargo door while the

airplane is in flight can be extremely hazardous in a variety of ways

including possible loss of flight control, severe structural damage, or

rapid decompression, any of which, could lead to loss of the airplane.

The design of the main deck cargo door hinge must be in compliance

with Civil Air Regulations (CAR) part 4b, including CAR part 4b.270,

which requires, in part, that catastrophic failure or excessive

structural deformation, which could adversely affect the flight

characteristics of the airplane, is not probable after fatigue failure

or obvious partial failure of a single principal structural element.

One common feature of a fail-safe hinge design is a division of the

hinge into multiple segments such that, following failure of any one

segment, the remaining segments would support the redistributed load.

The main deck cargo door installed in accordance with STC SA1767SO

is supported by latches along the bottom of the door and one continuous

hinge along the top. This single-piece hinge is considered a critical

structural element for this STC. A crack that initiates and propagates

longitudinally along the hinge line of the continuous hinge will

eventually result in failure of the entire hinge, because there is no

segmenting of the hinge to interrupt the crack propagation and support

the redistributed loads. Failure of the entire hinge can result in the

opening of the main deck cargo door while the airplane is in flight.

As discussed in the Design Review Report, an inspection of one

Boeing Model 727 series airplane modified in accordance with STC's

SA1767SO and SA1768SO revealed a number of fasteners with both short

edge margins and short spacing in the cargo door cutout external

doublers. Some edge margins were as small as one fastener diameter.

Fasteners that are placed too close to the edge of a structural member

or spaced too close to an adjacent fastener can result in inadequate

joint strength and stress concentrations, which may result in fatigue

cracking of the skin. If such defects were to exist in the structure of

the door or the fuselage to which the main deck cargo door hinge is

attached, the attachment of the hinge could fail, and consequently

cause the door to open while the airplane is in flight.

Since unsafe conditions have been identified that are likely to

exist or develop on other products of this same type design, this

proposed AD would require, within 250 flight cycles after the effective

date of the AD, a one-time detailed visual inspection of the external

surface of the main deck cargo door hinge (both fuselage and door side

hinge elements) to detect cracks, and repair, if necessary.

Accomplishment of this inspection will ensure that the subject

airplanes are not in immediate risk of hinge failure.

In addition, the proposed AD would require a detailed visual

inspection of the mating surfaces of both the hinge and the door skin

and external fuselage doubler underlying the hinge to detect cracks or

other discrepancies (e.g., double or closely drilled holes, corrosion,

chips, scratches, or gouges). The proposed AD also would require

installation of a main deck cargo door hinge that complies with the

applicable requirements of CAR part 4b, including fail-safe

requirements. Accomplishment of this detailed visual inspection will

ensure the integrity of the door and fuselage structure to which the

hinge is attached. The proposed compliance time for this inspection and

installation is within 36 months or 4,000 flight cycles after the

effective date of this AD, whichever occurs first. The compliance time

is based on the FAA's assessment of the reasonable amount of time to

redesign, manufacture, and install a fail-safe hinge. This time is in

consideration of the 18-month time period estimated by the Boeing 727

industry working group, which includes operators, affected STC holders,

and engineering organizations, to develop FAA-approved redesigns. These

actions would be required to be accomplished in accordance with a

method approved by the FAA.

Main Deck Cargo Door Systems

In early 1989, two transport airplane accidents were attributed to

cargo doors coming open during flight. The first accident involved a

Boeing 747 series airplane in which the cargo door separated from the

airplane, and damaged the fuselage structure, engines, and passenger

cabin. The second accident involved a McDonnell Douglas DC-9 series

airplane in which the cargo door opened but did not separate from its

hinge. The open door disturbed the airflow over the empennage, which

resulted in loss of flight control and consequent loss of the airplane.

Although cargo doors have opened occasionally without mishap during

takeoff, these two accidents serve to highlight the extreme potential

dangers associated with the opening of a cargo door while the airplane

is in flight.

As a result of these cargo door opening accidents, the Air

Transport Association (ATA) of America formed a task force, including

representatives of the FAA, to review the design,

[[Page 61556]]

manufacture, maintenance, and operation of airplanes fitted with

outward opening cargo doors, and to make recommendations to prevent

inadvertent cargo door openings while the airplane is in flight. A

design working group was tasked with reviewing 14 CFR part 25.783 [and

its accompanying Advisory Circular (AC) 25.783-1, dated December 10,

1986] with the intent of clarifying its contents and recommending

revisions to enhance future cargo door designs. This design group also

was tasked with providing specific recommendations regarding design

criteria to be applied to existing outward opening cargo doors to

ensure that inadvertent openings would not occur in the current

transport category fleet of airplanes.

The ATA task force made its recommendations in the ``ATA Cargo Door

Task Force Final Report,'' dated May 15, 1991 (hereinafter referred to

as ``the ATA Final Report''). On March 20, 1992, the FAA issued a

memorandum to the Director-Airworthiness and Technical Standards of ATA

(hereinafter referred to as ``the FAA Memorandum''), acknowledging

ATA's recommendations and providing additional guidance for purposes of

assessing the continuing airworthiness of existing designs of outward

opening doors. The FAA Memorandum was not intended to upgrade the

certification basis of the various airplanes, but rather to identify

criteria to evaluate potential unsafe conditions demonstrated on in-

service airplanes. Appendix 1 of this AD contains the specific

paragraphs from the FAA Memorandum that set forth the criteria to which

the outward opening doors should be shown to comply.

Applying the applicable requirements of CAR part 4b and design

criteria provided by the FAA Memorandum, the FAA has reviewed the

original type design of major transport airplanes, including Boeing 727

airplanes equipped with outward opening doors, for any design

deficiency or service difficulty. Based on that review, the FAA

identified unsafe conditions and issued, among others, the following

AD's:

For certain McDonnell Douglas Model DC-9 series airplanes:

AD 89-11-02, amendment 39-6216 (54 FR 21416, May 18, 1989);

For all Boeing Model 747 series airplanes: AD 90-09-06,

amendment 39-6581 (55 FR 15217, April 23, 1990);

For certain McDonnell Douglas Model DC-8 series airplanes:

AD 93-20-02, amendment 39-8709 (58 FR 471545, October 18, 1993);

For certain Boeing Model 747-100 and -200 series

airplanes: AD 96-01-51, amendment 39-9492 (61 FR 1703, January 23,

1996); and

For certain Boeing Model 727-100 and -200 series

airplanes: AD 96-16-08, amendment 39-9708 (61 FR 41733, August 12,

1996).

Using the criteria specified in the ATA Final Report and the FAA

Memorandum as evaluation guides, the FAA conducted an engineering

design review and inspection of an airplane modified in accordance with

STC's SA1767SO and SA1768SO held by FedEx. The FAA identified a number

of unsafe conditions with the main deck cargo door systems of these

STC's. The FAA design review team determined that the design data of

these STC's did not include a safety analysis of the main deck cargo

door systems.

As specified in the criteria contained in Appendix 1 of this AD,

for powered lock systems on the main deck cargo door, it must be shown

by safety analysis that inadvertent opening of the door after it is

fully closed, latch, and locked is extremely improbable. However, the

FAA is aware of two events in which the main deck cargo door opened

during flight. These events occurred on FedEx passenger/freighter

conversion STC's in October 1996, and March 1995. These events are

referenced in the Design Review Report.

For airplanes modified in accordance with STC's SA1767SO or

SA1768SO, the FAA considers the following four specific design

deficiencies of the main deck cargo door systems to be unsafe:

1. Indication System

The main deck cargo door indication system for STC's SA1767SO and

SA1768SO uses a warning light at the door operator's control panel and

a light at the flight engineer's panel. Both of these lights indicate

the status of the cargo door latch and lock positions, but do not

indicate either the door open or closed status. All three conditions

(i.e., door closed, latched, and locked) must be monitored directly so

that the door indication system cannot display either ``latched''

before the door is closed or ``locked'' before the door is latched. If

a sequencing error caused the door to latch and lock without being

fully closed, the subject indication system, as designed, would not

alert the door operator or the flight engineer of this condition. As a

result, the airplane could be dispatched with the main deck cargo door

unsecured, which could lead to the cargo door opening while the

airplane is in flight and possible loss of the airplane.

The light on the flight engineer's panel is labeled ``MAIN CARGO''

and is displayed in red since it indicates an event that requires

immediate pilot action. However, if the flight engineer is temporarily

away from his station, a door unsafe warning indication could be missed

by the pilots. In addition, the flight engineer could miss such an

indication by not scanning the panel. As a result, the pilots and

flight engineer could be unaware of, or misinterpret, an unsafe

condition and could fail to respond in the correct manner. Therefore,

an indicator light must be located in front of and in plain view of

both pilots since one of the pilot's stations is always occupied during

flight operations.

The main deck cargo door indication system of STC's SA1767SO and

SA1768SO does not have a level of reliability that is considered

adequate for safe operation. Many components are exposed to the

environment during cargo loading operations and may be contaminated by

precipitation, dirt, and grease, or damaged by foreign objects or cargo

loading equipment. As a result, wires, switches, and relays can fail,

jam, or short circuit and cause a loss of indication or a false

indication to the door operator and flight crew. The design logic of

the indication system (i.e., lights which extinguish when the door is

locked) will, in the event of a single point failure that would

extinguish the light, result in an erroneous ``safe'' indication

regardless of actual door status.

The design of STC's SA1767SO and SA1768S0 has a ``Press-to-Test''

red warning light on the control panel of the main deck cargo door

located near the L-1 door. The design of the monitoring system of the

main deck cargo door does not include separate lights to provide the

door operator with door close, latch, and lock status. The electrical

wiring design of the close, latch, and lock sensors of the door

monitoring system are wired in parallel instead of in series. In

parallel, two sensors could be sensing ``unsafe'' and the third sensor

could be sensing ``safe.'' If this situation were to occur, the sensors

would not illuminate the red warning light on the door control panel or

at the flight engineer's panel. Therefore, the ``Press-to-Test''

feature is adequate to check the light bulb functionality, but is not

adequate to check the cargo door closed, latched, and locked functions

and status without annunciator lights for those three functions.

2. Means to Visually Inspect the Locking Mechanism

The single view port of the main deck cargo door installed in

accordance with STC SA1767SO is intended to allow the flight crew to

conduct a visual

[[Page 61557]]

inspection of the door locking mechanism. This view port is used in

conjunction with the door warning system and should provide a suitable

``back-up'' in the event that the main deck cargo door warning system

malfunctions.

The door locking mechanism is an assembly comprised of multiple

lock pins (one for each of the door latches) connected by linkages to a

common lock shaft. Although an indicator flag attached to the lock

shaft can be seen through the view port when the shaft is in the

``locked'' position, a failure between the shaft and the pins could go

undetected, because this flag is attached to the lock shaft and not the

actual lock pins. If such a failure goes undetected, the airplane may

be dispatched with the main deck cargo door warning system inoperative

and the door not fully closed, latched, and locked, which could lead to

a main deck cargo door opening while the airplane is in flight and

possible loss of the airplane. Therefore, the FAA finds that the

subject view port is not a suitable back-up when the cargo door warning

system malfunctions.

As discussed in the ATA Final Report and the FAA Memorandum, there

must be a means of directly inspecting each lock or, at a minimum, the

locks at each end of the lock shaft of certain designs, such that a

failure condition in the lock shaft would be detectable.

3. Means to Prevent Pressurization to an Unsafe Level

Boeing 727-200 airplanes modified in accordance with STC SA1767SO

are configured to utilize the existing fuselage pressurization outflow

valve for the purpose of preventing pressurization of the airplane to

an unsafe level in the event that the main deck cargo door is not

closed, latched, and locked. The FAA design review of these modified

Boeing 727-200 airplanes (documented in the Design Review Report)

identified single point failures in the door control/outflow valve

interface that could result in the valve not sensing and responding to

an unsafe door condition. In addition, the FAA found no data to

substantiate that the outflow valve location and size could prevent

pressurization to an unsafe level.

With the current design, it is possible that the outflow valve may

not perform its intended function when utilized for the purpose of

preventing pressurization of the airplane in the event of an unsecured

door. This condition could result in cabin pressurization forcing an

unsecured door open while the airplane is in flight and possible loss

of the airplane.

Boeing 727-100 airplanes modified in accordance with the subject

STC's have no means of preventing pressurization in the event that the

main deck cargo door is not closed, latched, and locked, and therefore,

have a higher risk of a cargo door opening while the airplane is in

flight and possible loss of the airplane.

4. Powered Lock Systems

The main deck cargo door control system for STC SA1767SO that

utilizes electrical interlock switches is designed to remove door

control power (electrical and hydraulic) prior to flight and to prevent

inadvertent door openings. The occurrence of an in-flight door opening

event on airplanes modified in accordance with STC SA1767SO, as

identified in the Design Review Report, indicates the likelihood that

there may be latent and/or single point failures that can restore or

continue to allow power to the door controls and cause inadvertent door

openings. The failure modes may be found in the electrical portion of

the door control panel, which, in turn, activates the door control

hydraulics. The potential for the occurrence of these failure

conditions is increased by the harsh operating environment of freighter

airplanes. Door system components are routinely exposed to

precipitation, dirt, grease, and foreign object intrusion, all of which

increase the likelihood of damage. As a result, wires, switches, and

relays have a greater potential to fail or short circuit in such a way

as to allow the cargo door to be powered open without an operator's

command and regardless of electrical interlock positions.

A systems safety analysis would normally evaluate and resolve the

potential for these types of unsafe conditions. However, the design

data for STC SA1767SO do not include a systems safety analysis to

specifically identify these failure modes and do not show that an

inadvertent opening is extremely improbable. The need for a system

safety analysis is identified in the ATA Final Report and the FAA

Memorandum.

Since unsafe conditions have been identified that are likely to

exist or develop on other products of this same type design, this

proposed AD would require, within 60 days after the effective date,

revising the Limitations Section of the FAA-approved Airplane Flight

Manual (AFM) Supplement to provide the flight crew with procedures for

ensuring that all power is removed from the main deck cargo door prior

to dispatch of the airplane, and that the main deck cargo door is

closed, latched, and locked prior to dispatch of the airplane; and

installing any associated placards.

In addition, the proposed AD would require, within 36 months after

the effective date of the AD, incorporation of redesigned main deck

cargo door systems (e.g., warning/monitoring, power control, view

ports, and means to prevent pressurization to an unsafe level if the

main deck cargo door is not closed, latched, and locked), including any

associated procedures and placards that comply with the applicable

requirements of CAR part 4b and design criteria of the ATA Final Report

and the FAA Memorandum. Design data provided in support of the door

systems redesign should include a Systems Safety Analysis and

Instructions for Continued Airworthiness that are acceptable to the

FAA. Accomplishment of the incorporation of redesigned main deck cargo

door systems will prevent rapid decompression and/or structural damage

to the airplane as a result of loss or opening of the cargo door while

the airplane is in flight. The compliance time is based on the FAA's

assessment of the reasonable amount of time to incorporate redesigned

main deck cargo door systems. This time is in consideration of the 18-

month time period estimated by the Boeing 727 industry working group,

which includes operators, affected STC holders, and engineering

organizations, to develop FAA-approved redesigns.

These actions would be required to be accomplished in accordance

with a method approved by the FAA.

Cargo Restraint Barrier

In order to ensure the safety of occupants during emergency landing

conditions, the FAA first established in 1934, a set of inertia load

factors used to design the structure for restraining items of mass in

the fuselage. Because the airplane landing speeds have increased over

the years as the fleet has transitioned from propeller to jet design,

inertia load factors were changed as specified in CAR part 4b.260.

Experience has shown that an airplane designed to this regulation has a

reasonable probability of protecting its occupants from serious injury

in an emergency landing. The 727 passenger airplane was designed to

these criteria which specified an ultimate inertia load requirement of

9g in the forward direction. These criteria were applied to the seats

and structure restraining the occupants, including the flight crew, as

well as other items of mass in the fuselage.

When the 727 passenger airplane is converted to carry cargo on the

main

[[Page 61558]]

deck, a cargo barrier is required, since most cargo containers and the

container-to-floor attaching devices are not designed to withstand

emergency landing loads. In fact, the FAA estimates that the container-

to-floor attaching devices will only support approximately 1.5g's to

3g's in the forward direction. Without a 9g cargo barrier, it is

probable that the loads associated with an emergency landing would

cause the cargo to be unrestrained and impact the occupants of the

airplane, which could result in serious injury or death.

The structural inadequacy of the cargo barrier was evident to the

FAA during its review in October 1997 of a Boeing 727 modified in

accordance with STC SA1767SO. The observations revealed that the design

of the net restraint barrier floor attachment and circumferential

supporting structure does not provide adequate strength to withstand

the 9g forward inertia load generated by the main deck cargo mass, nor

does it provide a load path to effectively transfer the loads from the

restraint barrier to the fuselage structure of the airplane. These

observations are supported by data contained in ``ER 2785, Structural

Substantiation of the 50k 9g Bulkhead Restraint System in Support of

STC SA1543SO PN 53-1292-401 for the 9g Bulkhead 53-1980-300 Assembly

with Upper Attachment Structure, Lower Attachment Structure, Floor

Shear Web Structure, Seat Track Splice Fittings, Seat Tracks, and Seat

Track Splices,'' dated September 29, 1996, by M. F. Daniel. Although

this report was specific to STC SA1543SO, the FAA has determined that

the data are applicable to airplane modified in accordance with STC

ST00015AT because the design principles for attachment of the barriers

in both STC's are the same. The report reveals that structural

deficiencies were found in the net attach plates and floor attachment

structure of the cargo barrier. The data show large negative margins of

safety, which indicate that the inertia load capability of the cargo

barrier is closer to 2g than the required 9g in the forward direction.

From these analyses, it is evident that the cargo restraint barrier

would not be capable of preventing serious injury to the occupants

during an emergency landing event with the full allowable cargo load.

Since unsafe conditions have been identified that are likely to

exist or develop on other products of this same type design, this

proposed AD would require installation of a main deck cargo barrier

that complies with the applicable requirements of CAR part 4b.

Accomplishment of the installation will prevent serious injury to the

occupants in the event of an emergency landing. The proposed compliance

time for the installation is within 36 months or 4,000 flight cycles

after the effective date of the AD, whichever occurs first. This

compliance time is based on the FAA's assessment of the reasonable

amount of time to redesign, manufacture, and install the cargo barrier.

This time is in consideration of the 18-month time period estimated by

the Boeing 727 industry working group, which includes operators,

affected STC holders, and engineering organizations, to develop and get

FAA-approved redesigns.

Regulatory Evaluation Summary

The regulations proposed herein would not have substantial direct

effects on the States, on the relationship between the national

government and the States, or on the distribution of power and

responsibilities among the various levels of government. Therefore, in

accordance with Executive Order 12612, it is determined that this

proposal would not have sufficient federalism implications to warrant

the preparation of a Federalism Assessment.

This analysis examines the cost of a proposed AD that would require

the installation of a fail-safe hinge, redesigned main deck cargo door

warning and power control systems, and a 9g cargo barrier on Boeing

Model 727 series airplanes that have been modified in accordance with

STC's held by FedEx. As discussed above, the FAA has determined that

the main deck cargo door hinge is not fail-safe, that certain main deck

cargo door control systems do not provide an adequate level of safety,

and that the main deck cargo barrier is not structurally adequate

during a minor crash landing.

Approximately 117 U.S.-registered Boeing Model 727 series airplanes

operated by FedEx would be affected by the proposed AD. The following

discussion addresses, in sequence, the actions in this proposed

rulemaking and the estimated cost associated with each of these

actions. An analysis of the cost is also available in Rules Docket No.

97-NM-232-AD.

1. Main Deck Cargo Door Hinge

Since unsafe conditions have been identified that are likely to

exist or develop on other modified Boeing Model 727 series airplanes,

paragraph (a) of the proposed AD would require, within 250 flight

cycles after the effective date of this AD, a one-time detailed visual

inspection to detect cracks of the external surface of the main deck

cargo door hinge. FedEx estimates that this inspection would take 14

work hours. At a mechanic's burdened labor rate of $60 per work hour,

the cost per airplane would be $840, or $98,280 for FedEx's fleet of

117 affected Boeing Model 727 series airplanes.

Paragraph (b)(1) of the proposed AD would require, within 36 months

or 4,000 cycles after the effective date of this AD, a detailed visual

inspection of the mating surfaces of both the hinge and the door skin

and external fuselage doubler underlying the hinge. The FAA estimates

that compliance with this inspection would take 200 hours at an

estimated cost of $12,000 per airplane, or $1.4 million for the

affected fleet.

Paragraph (b)(2) of the proposed AD would require installation of a

fail-safe door hinge. The compliance time for this installation would

also be 36 months or 4,000 cycles after the effective date of this AD.

The estimated cost to design and certificate such a hinge is $45,000.

FedEx estimates that parts for a fail-safe door hinge would cost

$2,600, while installation would cost $11,520 per airplane for 192

hours of labor. Parts and labor for 117 affected airplanes would be

$1.7 million.

Paragraph (c) of the proposed AD would require that, if any cracks

or discrepancies are detected during the inspections required by

paragraph (a) or (b)(1) of the proposed AD, repairs must be made prior

to further flight. The cost of these repairs is not attributable to

this proposed AD.

For purposes of this analysis, the FAA assumes an effective date of

July 1, 2000. The cost to comply with proposed paragraphs (a) through

(c) over the 36-month compliance period is $3.2 million, or $2.8

million discounted to present value. The FAA assumes that the

installation of the main deck cargo door hinge [paragraph (b)(1)] would

be accomplished at the same time as the detailed visual inspection of

fastener holes [paragraph (b)(2)]. The FAA also assumes that FedEx

would perform these two activities uniformly throughout the 36-month

period. Finally, the certification cost for the main deck cargo door

hinge would be incurred within the first 6 months after the effective

date of this AD.

2. Main Deck Cargo Door Systems

Paragraph (d) of the proposed AD would require, within 60 days

after the effective date, revising the Limitations Section of the FAA-

approved AFM Supplement to provide the flight crew with procedures for

ensuring that all power is removed from the main deck cargo door prior

to dispatch of the airplane, and that the main deck cargo door is

closed, latched, and locked prior

[[Page 61559]]

to dispatch of the airplane. In addition, paragraph (d) of the proposed

AD would require the installation of any associated placards.

FedEx assumes that an external inspection of the flushness of the

cargo door, combined with an ``enhanced B-check'' would be an

acceptable means to the FAA to ensure that the cargo door is secured

prior to dispatch. Based on this assumption, FedEx estimates, before a

redesigned door system is installed [see proposed paragraph (f) below],

that it would take a mechanic 30 minutes to inspect for flushness of

the main deck cargo door prior to dispatch. FedEx also estimates that

there are 62 flights per day among the 117 affected airplanes and that

these airplanes fly 260 days per year. The estimated cost per

inspection would be $30, or $4,133 per airplane per year until the door

system is changed. In addition, FedEx estimates that the setup costs

for the daily inspection (i.e., procedure materials for the cadre of

mechanics to perform the inspection and training requirements) would be

$50,000.

B-checks on FedEx Boeing Model 727 series airplanes occur

approximately twice a year. FedEx estimates the incremental cost for

maintenance during this ``enhanced B-check'' is $11,700 per year until

the door system is changed.

Paragraph (e) of the proposed AD would require, within 36 months

after the effective date of this AD, incorporation of a redesigned main

deck cargo door system. FedEx estimates that the development and

certification of the system would cost $212,000. Modification parts

would cost $110,000 per airplane and labor costs would be $34,560 per

airplane. FedEx also estimates that 40 percent of the fleet would be

modified during a scheduled maintenance visit. The remainder of the

fleet would be out-of-service for an additional 4 days. Based on a

lease rate of $6,100 per day, FedEx estimates that the cost of down

time for the fleet would be $1.7 million over the 36-month period.

Based on FedEx's assumption that a combination of an external

inspection of cargo door flushness prior to dispatch and an

``enhanced'' B-check every 6 months, the total cost would be $3.2

million over 36 months. These activities would occur until

incorporation of a redesigned door system. Again, the FAA assumes that

the accomplishment of this incorporation would occur uniformly over the

36-month period.

The estimated cost for redesigned door systems for the fleet of 117

affected airplanes would be $18.8 million, including $212,000 for

design and certification costs and $1.7 million for additional down

time. The total cost to comply with proposed requirements for the main

deck cargo door system is $22.0 million, or $19.1 million, discounted

to present value.

3. Main Deck Cargo Barrier

Paragraph (f) of the proposed AD would require, within 36 months or

4,000 flight cycles after the effective date of this AD, installation

of a main deck cargo barrier that complies with the applicable

requirements of CAR part 4b. FedEx estimates that development and

certification of a 9g barrier would cost $94,500, while parts would

cost $30,000 and labor would cost $23,040 per airplane.

The FAA assumes that FedEx would install 9g barriers in their

affected fleet uniformly over the 36-month compliance period. The total

non-discounted cost would be $6.3 million, or $5.4 million discounted

to present value.

4. Alternative Methods of Compliance (AMOC) and Special Flight Permits

Paragraph (g) of the proposed AD would allow an AMOC or adjustment

of compliance time that provides an acceptable level of safety if

approved by the Manager of the Atlanta ACO. The FAA is unable to

determine the cost of an AMOC, but assumes it would be less than the

cost of complying with the proposed provisions in paragraphs (a)

through (f) of the proposed AD.

Paragraph (h) of the proposed AD would allow special flight permits

in accordance with the regulations to operate an affected airplane to a

location where the requirements of the proposed AD could be

accomplished.

5. Total Cost of the Proposed AD

The FAA estimates that the total compliance cost of the proposed AD

would be $31.6 million, or $27.3 million discounted to present value.

The Regulatory Flexibility Act (RFA) of 1980 establishes ``as a

principle of regulatory issuance that agencies shall endeavor,

consistent with the objective of the rule and of applicable statutes,

to fit regulatory and informational requirements to the scale of the

business, organizations, and governmental jurisdictions subject to

regulation. To achieve that principle, the RFA requires agencies to

solicit and consider flexible regulatory proposals and to explain the

rationale for their actions. The RFA covers a wide range of small

entities, including small businesses, not-for-profit organizations, and

small governmental jurisdictions.

Agencies must perform a review to determine whether a proposed or

final rule will have a significant economic impact on a substantial

number of small entities. If the determination is that it will, the

Agency must prepare a regulatory flexibility analysis as described in

the RFA. However, if an agency determines that a proposed or final rule

is not expected to have a significant economic impact on a substantial

number of small entities, section 605(b) of the RFA provides that the

head of the agency may so certify and a regulatory flexibility analysis

is not required. The certification must include a statement providing

the factual basis for this determination, and the reasoning should be

clear.

Only one operator, FedEx, is affected by this proposed AD. FedEx is

not a small entity. Pursuant to the Regulatory Flexibility Act, 5 U.S.

C. 605(b), the FAA certifies that this proposed AD would not have a

significant economic impact on a substantial number of small entities.

Title II of the Unfunded Mandates Reform Act of 1995 (the Act),

enacted as Pub. L. 104-4 on March 22, 1995, requires each Federal

agency, to the extent permitted by law, to prepare a written assessment

of the effects of any Federal mandate in a proposed or final agency

rule that may result in the expenditure by State, local, and tribal

governments, in the aggregate, or by the private sector, of $100

million or more (adjusted annually for inflation) in any one year.

Section 204(a) of the Act, 2 U.S.C. 1534(a), requires the Federal

agency to develop an effective process to permit timely input by

elected officers (or their designees) of State, local, and tribal

governments on a proposed ``significant intergovernmental mandate.'' A

``significant intergovernmental mandate'' under the Act is any

provision in a Federal agency regulation that would impose an

enforceable duty upon State, local, and tribal governments, in the

aggregate, of $100 million (adjusted annually for inflation) in any one

year. Section 203 of the Act, 2 U.S.C. 1533, which supplements section

204(a), provides that before establishing any regulatory requirements

that might significantly or uniquely affect small governments, the

agency shall have developed a plan that, among other things, provides

for notice to potentially affected small governments, if any, and for a

meaningful and timely opportunity to provide input in the development

of regulatory proposals.

This proposed AD does not contain any Federal intergovernmental or

private sector mandate. Therefore, the requirements of Title II of the

Unfunded

[[Page 61560]]

Mandates Reform Act of 1995 do not apply.

List of Subjects in 14 CFR Part 39

Air transportation, Aircraft, Aviation safety, Safety.

The Proposed Amendment

Accordingly, pursuant to the authority delegated to me by the

Administrator, the Federal Aviation Administration proposes to amend

part 39 of the Federal Aviation Regulations (14 CFR part 39) as

follows:

PART 39--AIRWORTHINESS DIRECTIVES

1. The authority citation for part 39 continues to read as follows:

Authority: 49 U.S.C. 106(g), 40113, 44701.

Sec. 39.13 [Amended]

2. Section 39.13 is amended by adding the following new

airworthiness directive:

Boeing: Docket 97-NM-232-AD.

Applicability: Model 727 series airplanes that have been

converted from a passenger to a cargo-carrying (``freighter'')

configuration in accordance with Supplemental Type Certificate (STC)

SA1767SO or SA1768SO; certificated in any category.

Note 1: This AD applies to each airplane identified in the

preceding applicability provision, regardless of whether it has been

otherwise modified, altered, or repaired in the area subject to the

requirements of this AD. For airplanes that have been modified,

altered, or repaired so that the performance of the requirements of

this AD is affected, the owner/operator must request approval for an

alternative method of compliance in accordance with paragraph (g) of

this AD. The request should include an assessment of the effect of

the modification, alteration, or repair on the unsafe condition

addressed by this AD; and, if the unsafe condition has not been

eliminated, the request should include specific proposed actions to

address it.

Compliance: Required as indicated, unless accomplished

previously.

To prevent structural failure of the main deck cargo door hinge

or failure of the cargo door system, which could result in the loss

or opening of the cargo door while the airplane is in flight, rapid

decompression, and structural damage to the airplane; and to prevent

failure of the main deck cargo barrier during an emergency landing,

which could injure occupants; accomplish the following:

Actions Addressing the Main Deck Cargo Door Hinge

(a) Within 250 flight cycles after the effective date of this

AD, perform a detailed visual inspection of the external surface of

the main deck cargo door hinge (both fuselage and door side hinge

elements) to detect cracks.

Note 2: For the purposes of this AD, a detailed visual

inspection is defined as: ``An intensive visual examination of a

specific structural area, system, installation, or assembly to

detect damage, failure, or irregularity. Available lighting is

normally supplemented with a direct source of good lighting at

intensity deemed appropriate by the inspector. Inspection aids such

as mirror, magnifying lenses, etc., may be used. Surface cleaning

and elaborate access procedures may be required.''

(b) Within 36 months or 4,000 flight cycles after the effective

date of this AD, whichever occurs first, accomplish paragraphs

(b)(1) and (b)(2) of this AD.

(1) Perform a detailed visual inspection of the mating surfaces

of both the hinge and the door skin and external fuselage doubler

underlying the hinge to detect cracks or other discrepancies (e.g.,

double or closely drilled holes, corrosion, chips, scratches, or

gouges). The detailed visual inspection shall be accomplished in

accordance with a method approved by the Manager, Atlanta Aircraft

Certification Office (ACO), FAA, Small Airplane Directorate. The

requirements of this paragraph may be accomplished prior to or

concurrently with the requirements of paragraph (b)(2) of this AD.

(2) Install a main deck cargo door hinge that complies with the

applicable requirements of Civil Air Regulations (CAR) part 4b,

including fail-safe requirements, in accordance with a method

approved by the Manager, Atlanta ACO.

(c) If any crack or discrepancy is detected during the detailed

visual inspection required by either paragraph (a) or (b)(1) of this

AD, prior to further flight, repair in accordance with a method

approved by the Manager, Atlanta ACO.

Actions Addressing the Main Deck Cargo Door Systems

(d) Within 60 days after the effective date of this AD, revise

the Limitations Section of the FAA-approved Airplane Flight Manual

(AFM) Supplement by inserting therein the procedures specified in

paragraphs (d)(1) and (d)(2) of this AD, and install any associated

placards. The AFM revision procedures and installation of any

associated placards shall be accomplished in accordance with a

method approved by the Manager, Atlanta ACO.

(1) Procedures to ensure that all power is removed from the main

deck cargo door prior to dispatch of the airplane. And

(2) Procedures to ensure that the main deck cargo door is

closed, latched, and locked prior to dispatch of the airplane.

(e) Within 36 months after the effective date of this AD,

incorporate redesigned main deck cargo door systems (e.g., warning/

monitoring, power control, view ports, and means to prevent

pressurization to an unsafe level if the main deck cargo door is not

closed, latched, and locked), including any associated procedures

and placards, that comply with the applicable requirements of CAR

part 4b and criteria specified in Appendix 1 of this AD; in

accordance with a method approved by the Manager, Atlanta ACO.

Note 3: The design data submitted for approval should include a

Systems Safety Analysis and Instructions for Continued Airworthiness

that are acceptable to the Manager, Atlanta ACO.

Actions Addressing the Main Deck Cargo Barrier

(f) Within 36 months or 4,000 flight cycles after the effective

date of this AD, whichever occurs first, install a main deck cargo

barrier that complies with the applicable requirements of CAR part

4.b, in accordance with a method approved by the Manager, Atlanta

ACO.

Note 4: The maximum main deck total payload that can be carried

is limited to the lesser of the approved cargo barrier weight limit,

weight permitted by the approved maximum zero fuel weight, weight

permitted by the approved main deck position weights, weight

permitted by the approved main deck running load or distributed load

limitations, or approved cumulative zone or fuselage monocoque

structural loading limitations (including lower hold cargo).

Alternative Methods of Compliance

(g) An alternative method of compliance or adjustment of the

compliance time contained in this proposal that provides an

acceptable level of safety may be used if approved by the Manager,

Atlanta ACO. Operators shall submit their requests through an

appropriate FAA Principal Maintenance Inspector, who may add

comments and then send it to the Manager, Atlanta ACO.

Note 5: Information concerning the existence of approved

alternative methods of compliance with this AD, if any, may be

obtained from the Atlanta ACO.

Special Flight Permit

(h) Special flight permits may be issued in accordance with

sections 21.197 and 21.199 of the Federal Aviation Regulations (14

CFR 21.197 and 21.199) to operate the airplane to a location where

the requirements of this AD can be accomplished.

Appendix 1

Excerpt from an FAA Memorandum to the Director-Airworthiness and

Technical Standards of ATA, dated March 20, 1992

``(1) Indication System:

(a) The indication system must monitor the closed, latched, and

locked positions, directly.

(b) The indicator should be amber unless it concerns an outward

opening door whose opening during takeoff could present an immediate

hazard to the airplane. In that case the indicator must be red and

located in plain view in front of the pilots. An aural warning is

also advisable. A display on the master caution/warning system is

also acceptable as an indicator. For the purpose of complying with

this paragraph, an immediate hazard is defined as significant

reduction in controllability, structural damage, or impact with

other structures, engines, or controls.

(c) Loss of indication or a false indication of a closed,

latched, and locked condition must be improbable.

(d) A warning indication must be provided at the door operators

station that monitors the door latched and locked conditions

directly, unless the operator has a visual indication that the door

is fully closed and locked. For example, a vent door that monitors

the door locks and can be seen from

[[Page 61561]]

the operators station would meet this requirement.

(2) Means to Visually Inspect the Locking Mechanism:

There must be a visual means of directly inspecting the locks.

Where all locks are tied to a common lock shaft, a means of

inspecting the locks at each end may be sufficient to meet this

requirement provided no failure condition in the lock shaft would go

undetected when viewing the end locks. Viewing latches may be used

as an alternate to viewing locks on some installations where there

are other compensating features.

(3) Means to Prevent Pressurization:

All doors must have provisions to prevent initiation of

pressurization of the airplane to an unsafe level, if the door is

not fully closed, latched and locked.

(4) Lock Strength:

Locks must be designed to withstand the maximum output power of

the actuators and maximum expected manual operating forces treated

as a limit load. Under these conditions, the door must remain

closed, latched and locked.

(5) Power Availability:

All power to the door must be removed in flight and it must not

be possible for the flight crew to restore power to the door while

in flight.

(6) Powered Lock Systems:

For doors that have powered lock systems, it must be shown by

safety analysis that inadvertent opening of the door after it is

fully closed, latched and locked, is extremely improbable.''

Issued in Renton, Washington, on November 4, 1999.

D.L. Riggin,

Acting Manager, Transport Airplane Directorate, Aircraft Certification

Service.

[FR Doc. 99-29473 Filed 11-10-99; 8:45 am]

BILLING CODE 4910-13-U