7.1 — Safety Precautions — Aircraft and Workshop

Safety is the overriding priority in all aircraft maintenance activities. The maintenance environment contains numerous hazards — high-voltage electricity, compressed gases, flammable fluids, toxic chemicals, heavy components, and moving machinery. Every maintenance engineer must understand these hazards, know how to prevent accidents, and be able to take immediate remedial action when incidents occur. All EASA Part 66 licence categories require Level 3 (detailed knowledge) of this section.

General Safety Principles

Safe working practices are governed by a hierarchy of controls:

Why the Hierarchy Is Ordered That Way

The order in the table is not a ranking of how much protection each control gives on a good day — it is a ranking of how reliably each one keeps working on a bad day. Elimination and substitution remove the hazard from the workplace permanently and for everyone, including the apprentice who was not at the briefing and the contractor who arrives at 02:00. Engineering controls work without anyone deciding to use them: an extraction hood pulls fume away whether or not the operator remembers it is switched on, and an interlock stops a machine whether or not the guard was opened deliberately. Administrative controls — procedures, training, signs, permits — only work if a person reads them, understands them, remembers them under time pressure and chooses to follow them. Personal protective equipment sits at the bottom because it protects one person, only while it is worn, only if it was correctly selected for that specific hazard, and only if it fits and is in good condition.

There is a second reason PPE ranks last that matters more than the first: PPE fails without warning. A respirator whose cartridge is saturated goes on looking exactly like a respirator that is still filtering, and the wearer's first indication may be the smell of solvent — by which time they have already been exposed. A glove permeated by a solvent looks undamaged from the outside while the chemical is in contact with the skin underneath and is being held there. An extraction system that stops working, by contrast, is usually obvious, and an interlocked guard that fails normally fails to the safe side by stopping the machine.

In practice the tiers are combined rather than chosen between. A chromate-primer spraying task illustrates all four at once: buy the chromate-free primer where the specification allows it (elimination by substitution); spray in a booth with downdraught extraction (engineering); restrict the area, control who is in it and set a re-entry time (administrative); and put the sprayer in an air-fed hood and a coverall (PPE). Removing any one of those does not simply reduce protection a little — it moves the whole task's safety onto the tiers below it, which are the less reliable ones. That is also why "the operator was wearing a mask" is never, on its own, an adequate answer to an exposure question.

Whatever controls are applied, some residual risk always remains. The purpose of the assessment is to reduce risk to a level that is acceptable and then to make sure everyone involved knows what is left and how to react to it — not to pretend the hazard has gone.

Hazard, Risk and Risk Assessment

The two words are not interchangeable. A hazard is anything with the potential to cause harm — a 200 bar nitrogen cylinder, a drum of MEK, a 3 metre drop from a wing. Risk is the combination of how likely that harm is and how severe it would be if it happened. The nitrogen cylinder is an extremely serious hazard, but a cylinder chained upright in a ventilated store with its valve cap fitted presents a low risk; the same cylinder lying loose in the back of a van presents a high one. Controls do not change the hazard, they change the risk.

A risk assessment is a structured, recorded process with five recognisable steps: identify the hazards; decide who might be harmed and how (including people who are not doing the work — the cleaner, the visitor, the crew on the flight deck above you); evaluate the risk and decide on controls, working down the hierarchy from the top rather than reaching straight for PPE; record the significant findings and communicate them to everyone affected; and review, both periodically and whenever something changes.

Assessments come in two forms and both are needed. A generic assessment covers a repeated activity in a standard environment — wheel change, battery servicing, panel removal — and lives in the organisation's procedures. A task-specific assessment covers the job in front of you today, with its actual aircraft, its actual weather, its actual access equipment and whoever else is working nearby. On top of both sits dynamic assessment: the continuous judgement an engineer makes as conditions change, and the authority to stop when they do. Reviews are triggered by new equipment, a change of process or product, a change of location, an accident or near miss, or simply the passage of time.

The Safe System of Work

The output of an assessment is a safe system of work: the agreed sequence of steps, isolations, controls, equipment and people that makes a specific job safe. It is what turns "be careful" into something auditable. A complete one names the competent person in charge, the isolations required and who applies them, the access equipment, the PPE, the atmospheric or electrical tests to be passed before work starts, the communication arrangements, the emergency and rescue plan, and how the system is formally stood down at the end so the aircraft can be returned to service.

Two habits carry most of the practical value. The first is the pre-task brief, in which the person leading the job walks the team through the hazards, the controls and the stop conditions before anyone picks up a tool — the point being that everyone hears the same plan at the same time, including the parts that concern somebody else's task on the same aircraft. The second is the discipline that safety, of yourself and of everyone in the immediate area, ranks ahead of finding the right tool and ahead of the aircraft's departure time. That is not a slogan: an injured engineer cannot complete the task, occupies the two colleagues who go to help, and frequently creates a second casualty. Schedule pressure is a recognised precursor to maintenance error, which is precisely why the priority order has to be settled before the pressure arrives rather than during it.

Permits to Work

A permit to work is a formal written authorisation, issued by a competent person, to carry out a defined task, in a defined place, within a defined period, subject to stated precautions. It is an administrative control — the third tier of the hierarchy — and its value is that it forces the precautions to be checked and signed for before work starts rather than assumed. Its essential features are the same whatever the hazard:

• A single point of control. One issuing authority, one copy displayed at the worksite, one register. Two teams cannot each hold a permit for conflicting work on the same system.
• A defined scope and validity period. The permit expires; it does not roll over to the next shift by default, because the conditions it certified may not have.
• Cross-referenced isolations. The permit lists the isolations and lock-off points, tying it to the locks and tags physically fitted to the equipment.
• Formal hand-back. The worker signs that the job is finished or suspended and the area is safe; the issuer signs that the system has been accepted back and the isolations may be removed. An unreturned permit is treated as work still in progress.

In a maintenance organisation the three permits an engineer meets most often are hot work (any spark-, flame- or heat-producing operation near an aircraft), confined space entry (fuel tanks above all), and isolation of a hazardous energy source before work on a system. Each is dealt with in its own section of this note.

Safety Signs: Shape and Colour Carry the Meaning

European safety signs are standardised so that their meaning can be read at a distance, in poor light, and by someone who does not speak the local language: the shape and colour give the category, and the pictogram gives the detail. Text is an optional supplement, never the primary message.

Note that green carries one meaning in the scheme and red carries two, in quite different senses: green is always "safety" (escape, rescue, first aid) and red is either a prohibition or the location of fire equipment. A red sign therefore never means "danger" in this system — danger is the yellow triangle. Getting that backwards matters on the hangar floor, where the green running-man sign is the one you look for in smoke.

Personal Protective Equipment: Selecting It and Knowing Its Limits

PPE is only protective if it is matched to the specific hazard. The categories below are the ones an aircraft engineer uses daily, with the selection point that most often gets missed.

• Eye protection. Three different hazards need three different products. Impact from grinding, drilling and chiselling needs impact-rated spectacles or, better, a face shield worn over them, because a face shield alone does not seal at the sides. Chemical splash needs sealed goggles — open-sided spectacles will not stop a splash of hydraulic fluid running down the frame into the eye. Radiation from welding or from a laser needs the correct filter shade. European impact protection is graded, in increasing order of impact energy, as S, F, B and A, and the grade is marked on both the lens and the frame — both must carry the rating, since a lens that holds is useless in a frame that lets go.
• Hand protection. A glove is chosen against the specific chemical from the manufacturer's compatibility data, not from what is in the box on the bench. Every glove material has a measurable breakthrough time for each chemical, after which the chemical is passing through the intact glove; the general-purpose nitrile glove that is excellent against mineral oil is a poor choice against phosphate-ester hydraulic fluid, for which butyl rubber is the usual recommendation. Gloves are also a hazard in their own right near rotating machinery: they are the mechanism by which a hand is drawn into a drill or a lathe, so gloves come off at those machines.
• Foot protection. Safety footwear protects against three distinct things: a dropped component (toe cap), standing on a drill bit or a swarf spike (penetration-resistant midsole), and electrical contact or static (insulating, antistatic or conductive soles, which are three different specifications — conductive footwear intended to drain static is not electrical insulation and must never be relied on as such). The requirement applies on the ramp exactly as it does in the hangar.
• Body protection. Coveralls that fit and fasten, with nothing loose to catch: no ties, no lanyards, no dangling identity cards near machinery or an engine intake. Jewellery, watches and rings come off — a ring is both a conductor and, caught on a projection during a fall from a stand, the classic degloving injury.
• Respiratory protection. A disposable filtering facepiece is graded FFP1, FFP2 or FFP3 in increasing order of protection; a cartridge respirator must have the right filter class for the substance and the cartridge has a limited service life once opened. Any tight-fitting mask needs a face-fit test on the individual wearing it, and any beard growth along the sealing line defeats the seal completely — for a wearer who cannot be clean shaven the answer is a loose-fitting powered or air-fed hood, not a tighter strap. For the most hazardous work (isocyanate paint spraying, disturbing asbestos-containing material) an air-fed system is the norm rather than a filter at all.
• Hearing protection. Covered with the noise hazard later in this note; the selection point is that more attenuation is not automatically better.

All PPE has to be inspected before use, kept clean, stored where it cannot be damaged or contaminated, and replaced on condition. A pair of goggles kept in a tool drawer with the swarf is not eye protection, and a filtering facepiece stuffed in a pocket between shifts is contaminated on the inside — the side that goes against the face.

Competence, Supervision and the Authority to Stop

Part-145 requires the organisation to provide facilities and a working environment appropriate to the work being carried out, and to ensure that the environment does not impair the effectiveness of personnel — temperature, lighting, dust, contamination and noise are named as things that must be controlled, not tolerated. That is a regulatory hook the engineer can use: work that cannot be done to standard in the conditions available is work that should be stopped and rescheduled, and doing so is compliance rather than obstruction.

The same logic applies to the individual. Nobody carries out a task for which they are not trained, authorised and equipped, and every person on the job has the authority to stop it if a control is missing, a condition has changed or something simply does not look right. An organisation in which stopping the job is treated as a failure will not hear about the near misses either, and the two problems have the same root.

Electrical Safety

Electricity is one of the most dangerous hazards in aircraft maintenance. Both the aircraft's own electrical systems (typically 28 V DC and 115 V AC at 400 Hz) and workshop mains supplies (230 V AC / 50 Hz in Europe) can cause fatal electric shock.

How Electric Current Injures

It is current, not voltage, that injures. Voltage matters only because it is what drives current through the body's resistance, which is why the table below is written in milliamps. Four factors decide the outcome of a shock: how much current flows, for how long, along which path, and at what frequency.

• Path. Hand-to-hand and hand-to-opposite-foot are the dangerous paths because they take the current across the chest and through the heart. Hand-to-hand on the same side of the body, or finger-to-finger on one hand, may cause a severe local burn without reaching the heart at all. This is the reason for the old rule of keeping one hand in a pocket when working near a live circuit that cannot be isolated, and for never standing on damp concrete or a steel dock while doing it.
• Duration. The heart is only vulnerable to fibrillation during a short window in each beat, so a shock lasting less than one cardiac cycle is far less likely to trigger it than one lasting several seconds. This is exactly what a residual current device exploits: it cannot prevent the shock, it can only cut it short.
• Frequency. Mains-frequency AC at 50 or 60 Hz is close to the worst case for the heart, because the current reverses often enough to keep re-stimulating the muscle through its vulnerable window. Direct current needs a substantially higher current to fibrillate the heart, but it produces one sustained contraction rather than a buzz, and it causes deeper electrolytic and thermal tissue damage. At the aircraft's 400 Hz the current required to fibrillate the heart is higher than at 50 Hz, but the skin's impedance is lower at 400 Hz and the burn hazard is undiminished — so 115 V AC 400 Hz is treated as fully lethal and given exactly the same respect as the workshop mains.

The specific injuries follow from the mechanism. The let-go effect happens because the flexor muscles that close the hand are stronger than the extensors that open it, so a current large enough to tetanise both clamps the hand shut on the conductor and the victim cannot let go — the shock then continues for as long as the supply does. That is also why a rescuer must never simply grab the casualty. Respiratory arrest can occur without fibrillation if the current paralyses the diaphragm and intercostal muscles. Ventricular fibrillation is the usual cause of death: the heart's coordinated contraction breaks down into a useless quiver and circulation stops, and it will not restart on its own. Burns occur at the entry and exit points, where current density is highest, and along the path through the body — and the internal damage is routinely far worse than the small mark on the skin suggests.

Body Resistance: Why 230 V Kills and 28 V Usually Does Not

Almost all of the body's electrical resistance is in the outer layer of dry skin. Internally, from one hand to the other, the body is a bag of salt water measuring only a few hundred ohms. Dry, intact, callused skin can measure tens or hundreds of kilohms; skin that is damp with sweat, wet with coolant or cut measures a small fraction of that, and skin resistance also falls as the applied voltage rises because the outer layer breaks down. The practical consequence is that the same contact that gives a harmless tingle in a dry workshop in winter can be fatal in a humid hangar to someone who has been working hard.

The general rule that follows is that every supply is treated as dangerous until measured, and that the question "how many volts is it?" is never a complete risk assessment on its own: you also have to ask how much current the source can deliver, and what the resistance of the path will be.

Effects of Electric Current on the Human Body

Electrical Safety Precautions

• Isolate before work — use lockout/tagout (LOTO) procedures. Apply personal padlocks and warning tags to circuit breakers and switches.
• Verify dead — after isolation, test with a proving unit to confirm the circuit is de-energised. Test the proving unit itself before and after use.
• Static (ESD) protection — when handling electrostatic-sensitive devices, wear an approved anti-static wrist strap (which contains a 1 MΩ current-limiting resistor) connected to the aircraft/equipment structure. This is an ESD precaution, not a shock precaution — never bond yourself to structure on a circuit that may be live.
• Residual Current Devices (RCDs) — all portable power tools and workshop outlets should be RCD-protected (typically 30 mA trip).
• Capacitor discharge — capacitors in power supplies and ignition units can retain lethal charges long after power is removed. Always discharge and short-circuit before handling.
• Low-voltage working — use reduced-voltage tools (110 V centre-tapped to earth, giving 55 V to earth) where practical.
• High-voltage areas — radar systems, HF transmitters, and weather radar magnetrons produce hazardous voltages (up to 30 kV). Observe exclusion zones and interlocks.

Safe Isolation: Prove, Test, Prove

"Verify dead" is a three-part sequence, and leaving out any part of it destroys the whole thing. First prove the test instrument on a known live source or on a dedicated proving unit. Then test the isolated circuit, checking every combination of conductors — line to neutral, line to earth and neutral to earth on a single-phase supply, and every pair on a three-phase one, because a circuit can be dead between two conductors and live between two others. Then prove the instrument again, on the same known source. The final step exists because an instrument that fails between the first proving and the test would give you a comforting zero on a live circuit, and you would have no way of knowing.

The instrument itself matters. A general-purpose multimeter is the wrong tool for proving dead: it can be on the wrong range, its internal fuse can be blown, its battery can be flat, and its high input impedance can display a misleading "ghost" voltage induced from an adjacent cable — or, worse, display nothing at all when the fault is in the meter. The correct instrument is a two-pole voltage indicator with fixed leads, no range switch and a self-check, designed so that a failure shows up as a failure rather than as a zero. A non-contact voltage "pen" indicates only the presence of a field; it never proves absence, and it must not be used for this purpose.

Where work genuinely cannot be done dead — and that is a decision for an authorised person against a written justification, not one an individual makes at the panel — the controls stack up rather than substitute for one another: tools insulated and rated for the voltage present, insulating gloves and matting, screening or barriers over adjacent live parts, a defined working space, and a second competent person in attendance who knows how to isolate and how to release the casualty. Insulated tools are examined before every such use, because a nick or a crushed spot in the insulation puts the hand at conductor potential without any visible warning. The single most common failure on high-voltage work is treating one of those controls as sufficient on its own — a pair of rubber gloves is not a system of work.

The residual current device mentioned above works on a completely different principle from a fuse or a circuit breaker, and understanding the difference tells you what it will and will not do. It compares the current flowing out in the line conductor with the current returning in the neutral. In a healthy circuit they are equal; if some current is leaking to earth — for example through a person — they are not, and the device trips on that imbalance in a few tens of milliseconds. A 30 mA device therefore does not prevent the shock, it limits how long it lasts, which is precisely the duration factor discussed above. Two limitations follow directly from the principle: an RCD cannot detect a shock in which the current passes from line to neutral through the body, because that current still balances, and it offers no protection at all against contact with the DC side of a supply or a charged capacitor. Its test button is there to be used, and it tests only the tripping mechanism, not the earthing.

Reduced-voltage tooling attacks the problem from the other end. A 110 V supply fed from a transformer whose secondary winding is centre-tapped to earth puts each of the two output conductors 55 V from earth, so the worst voltage a person standing on the hangar floor can be exposed to is halved. The tool still receives its full 110 V between the conductors and works normally — the protection is in where the earth reference sits, not in the tool.

Lockout/Tagout Covers Every Energy Source, Not Just Electricity

The word "isolation" is easy to read as "switch the power off", and that reading has killed people. A maintenance task is isolated only when every source of hazardous energy that could reach the part being worked on has been positively cut off, locked and, where it is stored rather than supplied, released or restrained:

• Electrical — aircraft batteries, external ground power, the APU generator, and any local mains supply to test or servicing equipment.
• Hydraulic — pumps off is not enough; accumulators hold system pressure indefinitely after the pumps stop and must be discharged in accordance with the manual.
• Pneumatic — bleed air, shop air, and charged bottles for emergency gear extension or brakes.
• Stored mechanical energy — springs, gas struts, counterbalances, tensioned control cables and wound-up trim systems.
• Gravity — anything raised: a landing gear that could retract, a control surface or door that could fall, a jacked aircraft, a suspended engine.
• Thermal and chemical — hot brakes, hot engine and bleed components, an oxygen system still pressurised, residual fuel vapour.

The discipline that makes lockout work is that the lock is personal. Each person working on the system fits their own padlock, to a multi-hasp if several people are involved, so the isolation physically cannot be removed until the last person has finished and removed their own lock. Nobody removes another person's lock; where that becomes unavoidable it is a documented management process, not a decision taken with bolt croppers at the end of a shift. The tag that accompanies the lock carries the information the next person needs: what is isolated, why, when it was applied, and who to contact. A tag on its own, without a lock, is a warning rather than an isolation — it relies entirely on the reader choosing to obey it.

Isolating an Aircraft Electrical System

Before work begins on an aircraft electrical system the relevant circuit breakers are pulled and collared or tagged, the battery is disconnected or its master switch selected off and secured, external ground power is disconnected, and warning placards are fitted at the flight-deck controls and at the isolation points so that nobody restores power to a circuit somebody else is inside. Simply selecting the battery master off does not satisfy this: it leaves individual circuits available the moment another engineer, quite reasonably, switches it back on to test an unrelated system.

One trap is worth committing to memory. A circuit breaker is both a protective device and a convenient isolation point, but not every load is behind one that the crew can reach: most transport aircraft have a hot battery bus that is permanently connected to the battery and feeds items such as entry lighting, the clock, fire-extinguisher circuits and some fuel shut-off valves regardless of the battery master switch position. Assuming a circuit is dead because a master switch is off, without consulting the wiring diagram to establish where that circuit is actually fed from, is a well-worn route to an arc, a burn or an inadvertent system operation. Consult the diagram, isolate at the source, and then prove dead.

Aircraft Batteries

An aircraft battery combines an electrical hazard, a chemical hazard and, while charging, an explosion hazard, and the two chemistries in service are handled differently.

• Disconnection order. Remove the earth (negative) lead first and reconnect it last. With the earth lead off, a spanner that slips and touches airframe structure while on the positive terminal completes no circuit; with the earth lead still on, the same slip is a dead short across the battery.
• Hydrogen. A lead-acid battery on charge, and an overcharged nickel-cadmium battery, gas hydrogen. Hydrogen is flammable in air over an exceptionally wide range — roughly 4% to 75% by volume — needs almost no energy to ignite, and being much lighter than air it collects at the highest point of the compartment or battery room. So: ventilate, no sparks or naked flames, and switch the charger off before disconnecting the leads so the break is not made in a hydrogen-rich atmosphere while current is flowing.
• Electrolyte. Lead-acid batteries contain sulphuric acid; nickel-cadmium batteries contain potassium hydroxide, a strong alkali. Each is neutralised by a different agent, and a trace of one contaminates the other permanently, so the two types are serviced in separate areas with separate tools, separate PPE and separate spill kits. Cadmium itself is toxic and a cell should never be heated, ground or cut.
• Thermal runaway. A nickel-cadmium battery on constant-voltage charge can enter a self-reinforcing loop: rising cell temperature lowers internal resistance, which increases the charging current, which raises the temperature further. Left unchecked the battery boils, vents and can catch fire. The defences are temperature sensing, a battery-charger fault warning, and treating any battery that is hot on removal as a hazard rather than a puzzle.
• Handling. Batteries are heavy, awkward and top-heavy in their trays; they are also short-circuit sources of enormous current, so the terminals are covered whenever the battery is out of the aircraft and it is never carried by its leads.

Static Electricity and Electrostatic-Sensitive Devices

Static presents two entirely separate hazards, and confusing them leads to the wrong control being applied.

The first is an ignition hazard. A charge separated by fuel flowing through a hose, by a synthetic coverall being pulled off, or by a plastic sheet being dragged across a wing can reach many thousands of volts, and the resulting spark carries more than enough energy to ignite a fuel/air mixture or anything at all in an oxygen-enriched atmosphere. It is why static precautions belong on the list of things that matter around fuel and around oxygen systems just as much as around avionics, and the fuelling case is dealt with in detail later in this note.

The second is a damage hazard to electrostatic-sensitive devices. Modern semiconductors can be destroyed or degraded by a few hundred volts, while the threshold at which a person feels a static discharge is around three thousand volts. The whole problem is contained in those two numbers: the discharge that ruins a line-replaceable unit is one you neither feel, hear nor see. Worse, much of the damage is latent — the device passes its functional test, is fitted to the aircraft, and fails weeks later in service, at which point the cause is untraceable. The controls are therefore preventive and are followed whether or not anything seems to have gone wrong:

• Work at a designated ESD-protected bench: a dissipative mat, bonded to a common earth point, with the wrist strap, the mat and the operator all referenced to the same point so no potential difference can exist between them.
• Wear the wrist strap correctly, in contact with the skin, and test it — a strap with a broken cord or a dry contact is worse than none, because it produces confidence without protection. The series resistor it contains, of the order of one megohm, is what makes the strap safe for the wearer: it drains static in milliseconds while limiting the current that could flow if the wearer touched a live conductor.
• Transport and store sensitive items in the correct packaging. A pink or blue dissipative bag prevents charge generation but does not screen the contents from an external field; a metallised shielding bag does both. Boards are handled by their edges or their front panel, never by the connector pins or the components.
• Remember that low humidity dramatically increases charge generation and retention — a dry, heated hangar in winter is the worst case, and it is the same condition that makes handling avionics in a nylon coverall so effective at destroying them.

Stored and Residual Energy

Removing the supply does not remove the energy. Capacitors in power supplies, filters and ignition exciters can hold a lethal charge for a long time after shutdown, and the higher the voltage the longer it takes to leak away. The correct way to discharge a high-voltage capacitor is through a suitable resistive discharge stick and then to fit a shorting link, leaving it fitted while the work proceeds. Shorting the terminals directly with a screwdriver is unacceptable: the peak current welds and pits the contacts, throws molten metal at the operator's face, and can leave a capacitor that partially recovers charge afterwards.

Turbine ignition systems deserve individual mention because their exciter units store energy specifically in order to release it as a very high-energy spark, and that stored energy remains after the system is switched off. The manual states the waiting period and the discharge procedure before the unit or its lead may be disturbed, and an igniter lead is never left disconnected with the system live. Radar transmitters, HF transmitters and the high-voltage sections of older displays carry the same message: the interlocks and the exclusion zones referred to above are engineering controls, and defeating one to "just have a quick look" removes the only thing standing between the engineer and tens of kilovolts. The separate, non-electrical hazard of the radiation these transmitters emit is dealt with in the section on hazards around a live aircraft.

Gas Safety

Oxygen

Oxygen is widely used in aircraft for crew and passenger breathing systems (typically stored at 1,800–2,200 psi / 124–152 bar). It is not flammable itself but is an extremely powerful oxidiser — it dramatically accelerates combustion.

• Keep all oil, grease, and hydrocarbons away from oxygen systems — even a fingerprint of grease on a fitting can ignite in pure O₂.
• Use only oxygen-clean tools and components (cleaned with approved solvents, sealed in protective bags).
• Never use PTFE tape on oxygen fittings — use only approved thread sealants.
• Store oxygen cylinders upright, secured, away from heat sources, and separated from fuel/oil storage by at least 6.1 metres (20 feet), or by a non-combustible barrier at least 1.5 m high with a 30-minute fire rating.
• Oxygen-enriched atmospheres (above 23.5%) are extremely fire-hazardous. Ventilate work areas when oxygen systems are open.

Two mechanisms explain every one of those rules, and knowing them is the difference between remembering a list and being able to work out the right answer for a situation the list does not cover.

Enrichment changes what "non-flammable" means. Combustion rate depends on the oxygen concentration at the reaction front. Raise it above the 21% of ordinary air and three things happen together: the energy needed to start ignition falls sharply, the flame temperature rises, and the burning rate increases. Materials that will not sustain a flame in air — steel wool, many fire-resistant fabrics, some fluoropolymers, aluminium in fine form — will burn fiercely in an oxygen-rich atmosphere, and a fire that starts in one spreads at a speed that gives no time to react. This is why the enrichment threshold quoted above is treated as an alarm level and not as an interesting statistic, and why an oxygen leak in a small compartment is a fire emergency even though nothing is burning yet.

The ignition source is usually the oxygen itself. A hydrocarbon film needs something to light it, and high-pressure oxygen provides that without any external spark. When a valve is opened quickly into a dead-ended line, the gas already in the line is compressed almost instantaneously by the incoming high-pressure gas. Because the compression is too fast for the heat to escape, the temperature of that trapped gas rises dramatically — the same adiabatic heating that makes a bicycle pump warm, but compressing to 1,800 psi rather than to a few tens of psi. Add the thinnest smear of oil, grease or even a fingerprint at that point and it ignites, and once it ignites in pure oxygen the fitting itself can burn. A second, related mechanism is particle-impact ignition: a fragment of swarf or Teflon tape carried at high velocity by the gas stream strikes a bend or a seat, and the impact energy does the same job.

Those two mechanisms generate the practical rules directly. Open oxygen cylinder and system valves slowly, so that downstream pressure builds gradually and there is no shock compression. Stand clear of the regulator and gauge faces while doing it, in case a component fails. Never use oxygen as a substitute for compressed air — not to blow down a bench, not to cool yourself, and above all not to inflate a tyre or charge a strut, where it would meet grease. And never allow the system to be opened up in an atmosphere that is not being ventilated.

Oxygen Cleanliness

"Oxygen clean" is a controlled condition, not a description of how the part looks. Components and tools are degreased with an approved solvent that leaves no residue, dried, inspected, and then sealed in protective bags which are only opened at the point of installation; anything that has been out of its bag on a general workbench has to be treated as contaminated again. Lint-free cloths are used because a thread of cotton is fuel. The only lubricant permitted anywhere near the system is the specific oxygen-compatible product named in the maintenance manual, applied in the quantity the manual states and nowhere else — ordinary greases are hydrocarbons and are exactly the fuel described above.

The prohibition on PTFE thread tape has two reasons behind it. Shredded tape can migrate into the system, block a small orifice or a regulator seat, and provide the particle for an impact ignition; and the tape has no sealing function on the tapered metal-to-metal and coned fittings normally used in oxygen systems anyway, so applying it is both hazardous and pointless. Where a thread sealant is required, only the approved oxygen-service compound is used.

Residual Pressure and Charging

An oxygen cylinder is never emptied. A minimum residual charge is always retained, and the reason is that the positive internal pressure keeps the outside world out. The figure itself comes from the maintenance manual for the particular cylinder and system; around 500 psi is commonly quoted. Two things go wrong if the pressure falls below it:

• Moisture enters the cylinder. Ambient air carries water vapour, and once inside a steel or aluminium cylinder that moisture condenses and starts internal corrosion, which both weakens the pressure vessel and contaminates the gas with rust particles.
• Moisture reaches the regulator. Gas expanding through a regulator or a metering orifice cools sharply. Water that has been drawn into the system therefore freezes exactly where the passages are narrowest, and the regulator blocks — potentially at the moment the crew need the system. Contamination carried in with the moisture can jam the mechanism in the same way.

A cylinder or system found below the stated residual is therefore not simply topped up. It is treated as contaminated, and the maintenance manual's procedure for purging, drying and, where required, returning the cylinder for internal inspection applies.

Charging is done slowly for a reason that catches people out. Compressing gas into a cylinder heats it, and hot gas exerts more pressure than the same quantity of cold gas. Fill quickly and the gauge shows the target pressure while the contents are still warm; as the cylinder cools to hangar temperature the pressure falls and the cylinder turns out to be undercharged. Slow filling, or filling to a temperature-corrected figure from the chart in the manual, avoids handing the aircraft back with less oxygen on board than the paperwork says.

Nitrogen

Nitrogen is used for tyre inflation, strut charging, and as an inert gas blanket in fuel tanks (Nitrogen Inerting System — OBIGGS). It is an asphyxiant — it displaces oxygen in confined spaces without warning (it is odourless and colourless).

• Never enter a nitrogen-purged space without self-contained breathing apparatus (SCBA).
• Monitor oxygen levels in confined spaces — 19.5% is the action threshold, not the point of collapse: below it the atmosphere is classed as oxygen-deficient and must not be entered without breathing apparatus. The immediately-dangerous-to-life condition is nearer 16%, where mental effectiveness, vision and muscular coordination are already measurably impaired.
• Nitrogen cylinders are pressurised to 200–300 bar. Handle with care, secure during transport.

The reason an asphyxiant gives no warning is physiological rather than chemical. The body's urge to breathe is driven almost entirely by the carbon dioxide concentration in the blood, not by the oxygen concentration. In a nitrogen-rich atmosphere the casualty continues to exhale carbon dioxide normally, so no breathlessness, no panic and no distress is felt — the first symptoms are impaired judgement and clumsiness, which the casualty is by definition in no state to recognise. In a severely depleted atmosphere, unconsciousness can follow within a couple of breaths and it happens without any struggle. That is the whole argument for measuring the atmosphere instead of relying on how it feels, and it is why the oxygen concentration limits given above are treated as hard gates rather than guidance.

The margin between the action threshold and the point of obvious harm is deliberate: anyone who has already been affected is unlikely to make a good decision about leaving.

Why Nitrogen Is Used for Tyres, Struts and Fuel Tanks

Nitrogen is chosen for these jobs for two properties: it is dry, and it is inert.

• Tyres. A heavily braked wheel gets extremely hot. If the gas inside the tyre contains oxygen, the hot rubber liner can decompose and the resulting volatile products can ignite inside the tyre — a mechanism that has destroyed wheels and killed people on the ramp. Filling with nitrogen removes the oxygen and the reaction cannot occur, and airworthiness requirements for large aeroplanes cap the oxygen content of the inflation gas for exactly this reason. Dryness matters too: moist air condenses and freezes at altitude, and water inside a magnesium or aluminium wheel promotes corrosion. What nitrogen does not do is behave differently from air as the temperature changes — the pressure rise with temperature is essentially the same, so that is not the reason for using it.
• Oleo struts and accumulators. The gas is in direct contact with hydraulic fluid at high pressure and temperature. Oxygen would accelerate oxidation of the fluid and, in an accumulator, would sit in contact with hot oil at full system pressure. Charging a strut or accumulator with oxygen or shop air instead of nitrogen is one of the most serious errors possible on a ramp, and it is made possible only by using the wrong trolley — which is why the couplings, the trolleys and the cylinder markings are all different.
• Fuel tank inerting. The on-board inert gas generating system referred to above separates nitrogen-enriched air from bleed air and feeds it into the tank ullage, holding the oxygen concentration below the level at which the fuel/air mixture can propagate a flame. For maintenance this has a direct consequence: the ullage of an inerted tank is an asphyxiating atmosphere as well as a flammable-vapour one, and a nitrogen purge used to make a tank safe from fire has made it lethal to enter. A tank purged with nitrogen must afterwards be purged with air and re-tested before anyone goes in.

Nitrogen is also used as a service gas for pressure testing and for blanketing components in storage, and the same rule applies every time: any space that has been filled or purged with it is an oxygen-deficient space until it has been ventilated and measured.

Compressed Air and Hydraulic Gases

• Pneumatic systems operate at up to 3,000 psi (207 bar). Never direct compressed air at the body — it can cause air embolism.
• Hydraulic accumulators are charged with nitrogen — depressurise before removing.
• Bleed all pressure from lines before disconnecting fittings.

Why Compressed Air Is Not Harmless

Shop air is treated so casually that its hazards are worth stating plainly. An air jet directed at skin can force air through a pore or a small wound into the bloodstream, producing an embolism that can be fatal; directed at the ear it can rupture the eardrum; directed at clothing it can inflate and rupture the bowel. It also picks up whatever it lands on and turns it into a projectile, which is why swarf blown off a bench ends up in somebody's eye across the workshop.

• Air is never directed at any person, including yourself, and is never used to blow dust off clothing or hair — a brush or a vacuum does that job.
• Where air is used for cleaning it is reduced in pressure — workshop rules commonly cap cleaning air at about 30 psi, roughly 2 bar — and used with a nozzle designed to bleed off if it is blocked, with eye protection and with screening to protect other people.
• Couplings are fitted with safety devices that vent before the connection releases, and hoses over any distance are fitted with whip-check restraints, because a hose that comes off under pressure flails hard enough to cause serious injury.
• Line pressure is released before any fitting is broken. The energy stored in a charged line does not care that the compressor has been switched off, and a fitting released under pressure becomes a projectile while the hose behind it whips.
• Receivers and line filters are drained of condensate on schedule; water and carried-over compressor oil in the air line contaminate paint, blast media and pneumatic tools, and oil in an air line supplying anything shared with an oxygen system is a serious hazard in its own right.

Cylinder Identification: Two Schemes, One Reliable Answer

There is a good reason the rule is to read the label. Europe changed its cylinder colour code, and the two schemes disagree with each other about several common gases — so a hangar can easily hold cylinders marked to both. Under the current European standard the shoulder carries the identification and the body colour has no meaning at all; under the superseded British scheme the whole body was coloured. Both are shown below because both are still met, on older cylinders and in older examination questions.

Read across the carbon dioxide and air rows and the problem is obvious: grey means carbon dioxide under one scheme and air under the other, and black means nitrogen under one and carbon dioxide under the other. Colour narrows the field; it never settles it. What does settle it is the permanently attached label, which gives the gas name, the hazard pictograms and the composition, and the markings stamped into the cylinder shoulder, which give the specification, the working and test pressures, the tare weight, the date of the last hydrostatic test and the date the next one is due. Those stamped markings are also the reason a cylinder outside test date is quarantined rather than used.

Handling, Storage and Transport

A full cylinder is a pressure vessel with a fragile brass valve on top, and virtually every serious cylinder accident starts with that valve. If a cylinder falls and the valve shears off, the escaping gas turns the cylinder into an unguided projectile capable of going through a hangar wall.

• The valve protection cap stays fitted whenever the cylinder is not connected in service, and the cylinder is never lifted, dragged or manoeuvred by its valve, its cap or its regulator.
• Cylinders are moved on a proper trolley with the retaining chain fastened, not carried, rolled along the floor or "walked" on their base across a hangar. Where a crane must be used, it is with a purpose-made cradle or cage — never a sling round the neck and never a magnet.
• They are secured upright at all times, in use and in store, by chain or bracket at about two-thirds of their height.
• Full and empty cylinders are stored separately and labelled, so that an empty is never connected in the belief that it is a spare, and stock is rotated so that older cylinders are used first.
• Stores are outdoors or well ventilated at both high and low level, because a leak of a light gas collects at the ceiling and a leak of a heavy one collects at the floor.
• Oxidising gases are separated from fuel gases and from combustible materials as described in the oxygen storage rule above. Cylinders are kept away from heat sources and out of direct sunlight, and never in a stairwell, an escape route or an unventilated cupboard.
• Regulators are matched to the gas and the cylinder, checked for damage before fitting, and never forced onto a thread that does not accept them — the thread forms and left/right-hand conventions differ by gas precisely so that a fuel-gas regulator cannot be fitted to an oxygen cylinder.

Acetylene: The Cylinder That Is Not Simply a Bottle of Gas

Acetylene is the one common workshop gas that is dangerous on its own, without any oxidiser present. Above a modest pressure — regulations in the United States cap its use at 15 psi gauge, and other authorities set a similar low limit — free acetylene can decompose explosively into carbon and hydrogen, releasing a large amount of energy with no air involved at all. It therefore cannot be stored as a simple compressed gas.

• Construction. An acetylene cylinder is filled with a porous mass saturated with acetone, and the acetylene is dissolved in the acetone. The porous mass divides the interior into countless small cells so that a decomposition cannot propagate through the cylinder.
• Always upright. Lay a cylinder down and liquid acetone can reach the valve, so that opening it discharges acetone into the regulator and hoses and leaves the cylinder depleted. A cylinder that has been horizontal must stand upright for the period the supplier specifies before it is used.
• Never copper or silver. Acetylene reacts with copper and with silver to form metallic acetylides, which are unstable compounds detonated by shock or friction. Fittings, pipework and regulator internals in acetylene service therefore avoid copper and high-copper alloys, and silver-bearing brazing alloys are not used in the gas path. Tin, by contrast, forms no such compound and presents no equivalent hazard.
• Flashback protection. Flashback arrestors and non-return valves are fitted in both the fuel-gas and the oxygen lines, so that a flame travelling back up a hose is stopped before it reaches a cylinder.
• Leaks. Acetylene is detected by its characteristic garlic-like smell and confirmed with an approved leak-detection fluid — never with a flame. Its flammable range in air is exceptionally wide, so a leak in an enclosed space produces an ignitable mixture almost immediately.
• Fire. A cylinder that has been heated in a fire can continue to decompose internally for hours after the flames are out. The area is evacuated, the cylinder is cooled with copious water from behind protection, and it is not approached, moved or declared safe until the fire service says so.

Oils, Fuels, and Chemical Safety

Aviation Fuels

• Avgas vapour is heavier than air and can accumulate in pits, tanks, and low areas — creating explosive atmospheres.
• Jet fuel (kerosene) is less volatile but still flammable above its flash point. Fuel-soaked clothing is extremely dangerous.
• Prevent static discharge during refuelling — always bond the fuel bowser to the aircraft before connecting hoses.
• No smoking, naked flames, or spark-producing equipment within 15 metres (50 feet) of fuelling operations or fuel storage.
• Prolonged skin contact with aviation fuels causes dermatitis — use barrier cream and chemical-resistant gloves.

Flash Point, Flammable Range and Autoignition

A liquid does not burn. Its vapour burns, mixed with air in the right proportion, so three separate properties decide how a fuel behaves in a hangar and they are routinely confused with one another.

• Flash point is the lowest liquid temperature at which the fuel gives off enough vapour to form an ignitable mixture at its surface. It is a property of the liquid's volatility and it says nothing about how hot the ignition source must be.
• Flammable range is the band of vapour concentrations that will actually propagate a flame, bounded by the lower explosive limit (below it the mixture is too lean) and the upper explosive limit (above it too rich). Both ends matter: a mixture can be too rich to burn and become dangerous simply by being diluted with fresh air.
• Autoignition temperature is the surface temperature at which the vapour ignites with no spark or flame at all — a bleed duct, an exhaust, a brake unit or an unlagged hot pipe.

Put the two fuels in the table above through those definitions and their hazards turn out to be almost mirror images. Avgas, with a flash point far below any temperature the hangar will ever see, is always producing vapour; the space above the liquid in a partly filled Avgas tank is normally too rich to ignite, and the danger lies outside the tank — at the vent, in the drip tray, in the pit or bilge where the heavier-than-air vapour has collected and mixed down into its flammable range. Jet A-1, with a minimum flash point of 38 °C, is normally too lean above the liquid at ordinary temperatures, which is why kerosene feels so much safer to handle. The two ways that safety disappears are heat and mist: fuel warmed by the sun, by a bleed leak or by equipment running below the tank moves the ullage up into the flammable band, and kerosene atomised into a spray by a leaking high-pressure line, or absorbed into a rag, presents so much surface area that it ignites readily well below its flash point.

Autoignition reverses the ranking again. Kerosene has by far the higher flash point of the two, but its autoignition temperature is substantially the lower — so it is the kerosene, not the Avgas, that will ignite on contact with a hot bleed duct with no spark present. "Higher flash point" therefore does not mean "harder to ignite" in every circumstance, only in the specific circumstance of an open surface at ambient temperature.

Static, Bonding and Earthing During Fuelling

Fuel flowing along a hose, and especially fuel passing through a filter/water separator, strips electrons from the surfaces it touches and carries a charge into the receiving tank. The filter element is by a wide margin the biggest charge generator in the system. That charge accumulates on the fuel surface inside the tank, and if it reaches a high enough potential relative to the surrounding structure it will discharge as a spark — inside the one place in the aircraft where a flammable vapour is guaranteed to be present.

Three defences are used together. Bonding connects the bowser, the hose nozzle and the aircraft so that they all sit at the same potential and no spark can jump between them; it is connected before the filler cap is opened or the hose coupled, and removed last, after the cap is back on, because the moment of connection and the moment of disconnection are when a difference in potential is most likely to exist. Earthing to a ground point additionally drains charge to earth where the procedure calls for it. And a static dissipator additive blended into jet fuel raises the fuel's electrical conductivity so that charge separated in the hose relaxes back through the fuel in a fraction of a second instead of accumulating.

The remaining precautions follow the same logic: no switching of electrical equipment, no radio transmission and no mobile telephones in the fuelling zone; the exclusion distance for ignition sources given above; a fire extinguisher positioned and manned; the bowser parked so it can be driven away rather than having to reverse past the aircraft; and drip trays and a spill kit to hand. Filling through an overwing nozzle demands particular care because the operator, the nozzle and the fuel are all in the open: the nozzle's bonding clip goes to the designated point on the filler adapter before the cap comes off, and the nozzle stays in contact with the filler neck throughout.

Grade Markings, Fuel Dyes and Lead

Two different colour conventions apply to aviation fuel, and they are easily confused. The colour code in the table above is the equipment marking convention — the lettering on bowsers, hydrant couplings, filler-point placards and hose decals, which is how the correct product is identified before a nozzle goes anywhere near an aircraft. Separately, the fuel itself is dyed so a sample drawn into a jar can be recognised: Avgas 100LL is blue, Avgas 100 is green, and Jet A-1 carries no dye and appears clear to straw-coloured. A clear sample from a piston aircraft's tank is therefore a reason to stop, not a sign of clean fuel — it may be jet fuel or it may be water.

The "LL" in 100LL stands for low lead, not no lead: the fuel still contains tetraethyl lead as an anti-knock additive. Lead compounds are cumulative toxins absorbed through the skin as well as by inhalation, so Avgas is never used as a cleaning solvent or a degreaser, gloves are worn when handling it and when draining sumps, and hands are washed before eating. The same rule applies to the sludge drained from a sump or a filter bowl, which concentrates whatever the fuel was carrying.

Two further contamination hazards belong with fuel handling. Water collects in tank low points by condensation and by settling out of the fuel; besides the icing and engine-stoppage risk it enables microbiological growth at the fuel/water interface, and the resulting sludge blocks filters, holds water against the tank skin and causes serious corrosion. Sump draining, sampling and the handling of biocide treatments are therefore routine maintenance tasks, and the biocide itself is a hazardous substance requiring its own precautions.

Finally, the reason fuel-soaked clothing is singled out in the list above is worth spelling out, because it is a mechanism rather than a warning. Fabric behaves as a wick: it holds the fuel spread thinly over an enormous surface area, in intimate contact with air, at exactly the geometry that makes a candle burn steadily. A splash of kerosene on a concrete floor may not sustain a flame; the same quantity in a coverall will burn, on a person, until it is out. Contaminated clothing comes off at once and is not left to "dry off", and the skin underneath is washed — prolonged contact with fuel held against the skin by wet fabric causes chemical burns without any fire at all.

Hydraulic Fluids

Aircraft hydraulic systems commonly use:

• MIL-PRF-5606 — mineral-oil based (red). Petroleum-based, flammable.
• MIL-PRF-83282 — fire-resistant synthetic hydrocarbon base (red). A drop-in replacement for 5606 with a far higher flash point.
• Skydrol (Type IV/V) — phosphate-ester-based (purple/dark amber). Fire-resistant but highly corrosive — attacks skin, eyes, and many plastics/paints.

Three Fluid Families, and Why They Are Never Mixed

The fluids listed above fall into three chemical families, and the distinction that matters on the hangar floor is not which is "better" but that each one is matched to the seals, hoses and paint finishes of the system it serves. Mineral oil and the synthetic hydrocarbon that replaced it are compatible with nitrile seals; phosphate esters are not, and require butyl or ethylene-propylene elastomers instead. The incompatibility runs in both directions and neither direction is recoverable in service:

• Put a mineral-based fluid into a phosphate-ester system and it swells and softens every butyl seal in it.
• Put a phosphate ester into a mineral-oil system and it attacks every nitrile seal in it.

In either case the consequence is not a single leaking joint discovered next week; it is progressive failure of every seal in the system, which means a complete drain, flush and seal replacement, and it is a reportable occurrence rather than an embarrassment to be topped up quietly. The safeguards against it are dedicated servicing trolleys and cans marked for one fluid only, and reading the placard at the reservoir filler rather than relying on memory or on the colour of what is already in the sight glass.

Colour helps but does not decide. Both the mineral fluid and its fire-resistant synthetic hydrocarbon replacement are dyed red, so red tells you which family you are in but not which specification; the phosphate esters are purple. The two red fluids are close relatives — the synthetic hydrocarbon was developed specifically as a drop-in replacement with a much higher flash point, which is why a fine spray of it from a burst line will not ignite as readily. Its one significant limitation is that it is more viscous at very low temperature, which is why a further synthetic hydrocarbon specification exists for aircraft operating in extreme cold. Which fluid a given aircraft takes is stated in the maintenance manual and on the placard, and an aircraft is never converted from one to the other on the basis that they are "both red".

The material attack described in the warning above has a maintenance consequence beyond personal protection. A phosphate-ester leak that runs down inside a structure will lift paint, soften PVC wire insulation and degrade some transparent plastics, so a persistent seep above a wiring loom is a potential electrical fault in the making and is cleaned up and rectified rather than monitored. Spills are wiped up immediately with the approved absorbent and the area is cleaned according to the manual, not left to evaporate — it does not evaporate.

High-Pressure Fluid Injection Injury

Transport aircraft hydraulic systems run at 3,000 psi, and several modern types at 5,000 psi. A pinhole in a pipe, a hose or a seal at that pressure produces a jet fine enough to be almost invisible and fast enough to pass straight through skin without the person necessarily feeling more than a sting. This is one of the most under-rated injuries in aircraft maintenance, and it is dangerous precisely because it looks trivial:

• The entry wound may be a mark the size of a pinprick, with little bleeding and little immediate pain, so the casualty carries on working.
• The injected fluid tracks along the tendon sheaths and tissue planes, spreading far beyond the entry point — a finger injection can reach the palm and the forearm.
• Swelling inside the closed compartments of a finger or hand cuts off the blood supply, and the fluid itself is chemically toxic to tissue. Phosphate ester and the additive packages in modern fluids are particularly aggressive.
• Within hours the tissue begins to die. Treated late, the outcome is frequently amputation; treated early, the hand is usually saved.

The same stored energy that makes the jet dangerous makes a disconnection dangerous. A hydraulic system holds pressure long after the pumps stop, because accumulators are designed to store it — that is their purpose. So before a joint is broken the system is depressurised through the correct valve or ground connection, the accumulator is discharged to the figure the manual gives, and the reservoir is checked to establish where the fluid will go. Control surfaces, gear doors and flaps can move as a system depressurises, so the area is cleared and the appropriate ground locks and safety pins are in place before anyone starts.

Solvents and Cleaning Agents

• MEK (Methyl Ethyl Ketone) — highly flammable, CNS depressant. Use only in ventilated areas.
• Acetone — extremely flammable, rapid evaporation, drying to skin.
• Isopropyl Alcohol (IPA) — commonly used for cleaning electrical connectors. Flammable.
• Chromate compounds — used in some primers and conversion coatings. Hexavalent chromium (Cr⁶⁺) is carcinogenic. Wear respiratory protection when sanding/spraying chromate products.
• Two-part sealants and adhesives — catalysts (hardeners) are often sensitisers causing allergic reactions.

How Chemicals Get In, and the Difference Between Irritation and Sensitisation

A substance can only harm you if it reaches you, and there are only four ways in: inhalation of vapour, mist, dust or fume; absorption through intact skin or through the eyes; ingestion, almost always indirectly by eating, drinking or smoking with contaminated hands; and injection through a puncture, a cut or a high-pressure jet. Identifying the route is what selects the control: extraction and respiratory protection defeat inhalation, gloves and coveralls defeat absorption, hand-washing discipline defeats ingestion, and nothing defeats injection except keeping the body out of the line of a pressurised jet.

Effects divide into local — damage where the substance lands, such as a solvent defatting the hands or an acid burning the eye — and systemic, where the substance is carried around the body and does its damage elsewhere, as lead does to the nervous system and cadmium does to the kidneys. Systemic effects are the ones that accumulate silently over a career, and they are the reason exposure is controlled long before anybody feels unwell.

The early signs of solvent over-exposure deserve to be recognised, because they are routinely mistaken for ordinary tiredness: headache, dizziness, a feeling of mild intoxication, poor coordination and slowed reactions. An engineer in that state is not merely uncomfortable — they are a hazard on an access stand, on a live circuit and behind the wheel afterwards. Ventilation restored and fresh air taken at the first symptom, rather than at the last, is the correct response.

A distinction worth getting right is between an irritant and a sensitiser, and it is a genuine difference in kind:

• An irritant causes harm in proportion to the dose. Keep the exposure low enough and the effect is small; remove the exposure and the skin or airway generally recovers. Most solvents behave this way.
• A sensitiser provokes the immune system. The first exposures may produce no reaction at all. Once a person is sensitised, however, an exposure far below any exposure limit — a concentration that affects nobody else in the workshop — triggers dermatitis or asthma, and the sensitivity is usually permanent. The isocyanate hardeners in two-pack polyurethane paint, the amine hardeners in epoxy resin and adhesive systems, and chromate compounds are the sensitisers an aircraft engineer meets most often.

That is why the catalyst side of a two-part product is treated with more respect than the resin side, and why respiratory sensitisation is career-ending in a way that a solvent headache is not: a sensitised sprayer cannot go back into the paint shop, whatever protection is offered. Exposure limits are published as an eight-hour time-weighted average and, for fast-acting substances, as a fifteen-minute short-term limit; both assume the extraction is running and are not a licence to work up to the number.

Skin Care, Barrier Creams and Dermatitis

Occupational dermatitis is one of the commonest reportable ill-health conditions in engineering trades and its mechanism is simple. The outer layer of skin is waterproofed by a thin film of natural lipids. Solvents dissolve that film. Repeatedly degreasing the hands — and washing them in thinners, MEK or Avgas does it far more effectively than any hand cleanser — strips the lipid layer faster than the body can rebuild it, and the skin becomes dry, red, itchy and cracked. Cracked skin is then an open door: chemicals that would never pass through intact skin get in, and so do bacteria.

Three products are involved and they do three different jobs:

• Barrier or pre-work cream is applied to clean, dry skin before work begins. It makes contamination easier to remove afterwards and gives a little protection against mild irritants. It is not a glove, it does not restore anything, and it is not a substitute for the correct protective glove.
• The correct cleanser removes contamination after work. A proprietary hand cleanser, not a solvent, and warm water — grit-loaded cleaners used habitually cause their own damage.
• A restorative preparation applied afterwards replaces the natural oils that the work has removed. This is where the traditional workshop answer for resin and solvent work belongs: after cleaning off the residue, an acetone and lanolin preparation returns oil to the skin, lanolin being the fatty component that does the restoring.

Alongside the creams sit the habits: gloves selected for the chemical and changed when contaminated, no solvent-soaked rag stuffed in a pocket against the thigh, hands washed before eating and before using the lavatory, and a regular look at the hands for early redness or cracking. Dermatitis caught in its first weeks resolves; left for a year it can become chronic.

Dust, Fume and Fibre

Several of the worst exposures in a hangar are solids rather than liquids, and they are generated by the work rather than poured from a tin — which means the safety data sheet for the product as supplied may say nothing at all about them.

• Composite dust. Cutting, drilling, sanding or grinding cured carbon or glass fibre produces a fine dust of sharp fibre fragments that irritates skin, eyes and airways. Carbon dust has a second property that catches people out: it is electrically conductive, so it settles into connectors, relays and open equipment and causes tracking and intermittent faults far from where the work was done. Control it at source with local exhaust ventilation and on-tool extraction, protect adjacent equipment, wear respiratory protection of the appropriate class along with gloves, eye protection and covered skin, and clean up with a suitable vacuum — never by dry sweeping and never with a compressed-air line, both of which simply put the dust back into the air everyone is breathing.
• Uncured resins and hardeners. These are the sensitisers described above, and they are absorbed through the skin. Once fully cured the matrix is far less hazardous; partially cured swarf and dust from an incomplete cure is not.
• Asbestos. Older aircraft may contain asbestos in brake and clutch friction materials, in gaskets and packings, in thermal and acoustic insulation and around firewalls. Undisturbed it is not a risk; drilling, grinding, scraping or blowing it out with an airline releases fibres that lodge permanently in the lung and cause asbestosis, lung cancer and mesothelioma decades later. If a material is suspected of containing asbestos the work stops until it has been identified. An ordinary nuisance-dust mask offers no useful protection against asbestos fibres, and removal is a job for licensed specialists working under controlled conditions, not for the shift.
• Cadmium. Many aircraft fasteners and steel parts are cadmium plated. Cadmium fume is severely toxic to the lungs and kidneys and it is produced by any process that heats the plating — welding, brazing, flame cutting or aggressive grinding of a cadmium-plated part. The rule is simply not to apply heat to cadmium-plated components, and to treat the dust from grinding them as a hazardous substance.
• Chromates. The carcinogenic hexavalent chromium referred to above is released as dust when chromate primer is sanded and as mist when it is sprayed; both need extraction at source in addition to respiratory protection.

The control order here is the hierarchy in the first section applied to airborne contaminants: substitute the product if a safer one is approved, extract at the point of generation so the contaminant never enters the room, ventilate the room generally as a second line, and use respiratory protection last — because the mask protects only the person wearing it, while the extraction protects everybody in the bay.

Safety Data Sheets (SDS / MSDS)

Every chemical substance used in the workshop must have an SDS available. The SDS contains 16 sections covering identification, hazards, composition, first aid, fire-fighting measures, handling, exposure controls, physical properties, stability, toxicology, disposal, transport, and regulatory information. Always consult the SDS before using an unfamiliar substance.

Those sections appear in the same fixed order on every data sheet in the world, which is what makes the document usable under pressure: you do not have to read it, you have to know where to look. Identification, hazards identification and composition are sections 1 to 3; first aid is section 4 and fire-fighting measures section 5, deliberately near the front so that the two things needed in an emergency are the two you reach first. Further down, accidental release measures tell you how to deal with a spill, handling and storage gives the compatibility and segregation rules, exposure controls and personal protection names the actual glove material and filter class to use rather than "suitable PPE", physical and chemical properties gives the flash point and vapour density, stability and reactivity lists what it must not be mixed with, and disposal gives the waste route.

Two limitations are worth understanding. First, the data sheet describes the substance as supplied. It will not describe the dust produced by sanding the cured product, the fume produced by heating it, or what happens when it is mixed with the other substance already on the component — all of which are your assessment to make. Second, the data sheet is information, not a control: the legal duty is to carry out an assessment of the substance in the way your organisation uses it, and to put controls in place. A file of data sheets in the office satisfies nothing on its own.

The container label carries the same information in compressed form. The internationally harmonised hazard pictograms are red-bordered diamonds with a black symbol, and nine of them cover everything: a flame for flammable, a flame over a circle for oxidising, an exploding bomb for explosive or self-reactive, a gas cylinder for gases under pressure, a corrosion symbol for substances that attack skin, eyes or metal, a skull and crossbones for acute toxicity, an exclamation mark for harmful or irritant, a "health hazard" torso symbol for the serious long-term effects such as carcinogenicity and respiratory sensitisation, and a dead fish and tree for environmental hazard. Signal words — Danger for the more severe category, Warning for the lesser — sit alongside them.

Acids, Alkalis and Battery Electrolyte

Diluting a concentrated acid releases a surprising amount of heat. Because water has an exceptionally high specific heat capacity, adding the acid slowly to a large volume of water spreads that heat through the whole body of water and the temperature rise stays modest. Do it the other way round and the first drops of water land on concentrated acid, absorb the heat of dilution in a tiny volume, flash into steam and eject a spray of concentrated acid out of the vessel and into the face of whoever is pouring. Hence the rule and the mnemonic that goes with it: always add acid to water, slowly, with stirring, never water to acid.

It is also worth knowing that an alkali splash in the eye is generally more damaging than an acid splash of similar strength, which surprises people. An acid coagulates the surface protein it meets, and that coagulated layer partly limits how deep the acid can penetrate. An alkali saponifies the fatty components of the tissue and keeps advancing, so the injury continues to develop after the initial contact. That is the reason irrigation must be prolonged and must not be stopped as soon as the pain eases.

Read the table the right way round and it is obvious: an acid is neutralised by a mild alkali and an alkali by a mild acid. Two errors follow from getting it backwards, and both appear as examination distractors. Washing spilled acid off with water alone dilutes and spreads it without neutralising it, so the acid is still acid and is now over a wider area. Reaching for caustic soda to deal with spilled battery acid is worse still: it is a strong alkali, it attacks aluminium alloy vigorously in its own right, and the neutralisation reaction itself is violently exothermic. Nor does a coating of grease or petroleum jelly neutralise anything — it may protect a clean terminal afterwards, but it does nothing to acid already on the structure.

Because a trace of one electrolyte permanently poisons a cell of the other type, lead-acid and nickel-cadmium batteries are serviced in separate rooms, with separate tools, separate hydrometers, separate protective clothing and separate spill kits. Full-face protection, an apron and gauntlets are worn for any electrolyte handling, and an eyewash must be immediately available in the battery shop.

The same acid-and-alkali logic applies to workshop reagents. Where caustic soda has been applied to bare aluminium alloy — for example as an identification reagent — it is neutralised afterwards with a chromic anhydride (chromic acid) solution, which cancels the alkali and leaves a passivating film on the exposed metal. Simply rinsing with water leaves the alkali working on the aluminium and leaves the surface unprotected.

Storage, Spillage and Waste

Hazardous substances live in designated, clearly labelled, ventilated cabinets or stores with spill containment underneath — a bund is normally sized to hold at least 110% of the largest single container in it, so that the biggest credible leak is caught. Quantities kept in the workshop are limited to what the day's work needs, with the bulk stock in the flammable store, and the store itself is of fire-resisting construction, kept away from escape routes and marked with the appropriate warning signs.

Segregation matters as much as containment, because the hazard is often in the combination rather than in either substance alone. Oxidising agents are kept away from flammable liquids and from organic materials such as rags, paper and wood; acids are kept apart from alkalis, and both from cyanide and sulphide compounds, which liberate highly toxic gas on contact with acid; and compressed gases are stored outside the chemical store altogether. The stability and reactivity section of each data sheet names the incompatibilities, and a segregation plan for the store is drawn up from those rather than from what fits on the shelf.

When something is spilled, the order of actions matters:

• Raise the alarm and protect people first. Warn everyone nearby, evacuate the immediate area if the material is volatile or toxic, and remove ignition sources. Do not attempt a spill that is beyond the training and equipment available — call the emergency services.
• Stop the source if that can be done safely: upright the drum, close the valve, plug the leak.
• Contain it, and above all keep it out of drains, gullies and watercourses. A drain mat or a bund of absorbent placed downhill of the spill is the difference between a workshop clean-up and a pollution offence with a criminal penalty attached.
• Absorb and collect using the correct medium from the spill kit — a general absorbent for oils and fuels, and the appropriate neutralising medium for acids and alkalis.
• Dispose of the waste as hazardous waste, through a licensed route and with the transfer documentation completed. The used absorbent is now itself contaminated waste and cannot go in the general bin.
• Report and review. A spill is an occurrence: it is recorded, investigated and used to fix whatever allowed it.

Never wash a spill down a drain to "dilute" it. Solvents and fuels entering a drainage system create an explosive vapour hazard in the drains themselves as well as an environmental one, and diluting a hazardous substance does not stop it being one.

Routine waste needs the same discipline. Waste streams are segregated at source — used oils, solvents, batteries, aerosols, contaminated absorbent, composite offcuts, metal swarf — because a mixed drum is expensive to dispose of and may be illegal to move. One category deserves special mention: rags soaked in solvent, oil, or particularly in drying oils and some resins, can heat themselves. Oxidation of the oil generates heat, a crumpled heap of rags insulates that heat instead of losing it, the temperature climbs and the pile can ignite with no external source at all. Contaminated rags therefore go into a lidded metal bin, which is emptied at the end of every shift.

Fire Safety and Extinguishing Agents

A fire requires three elements (the fire triangle): fuel, oxygen, and heat (ignition source). Removing any one element extinguishes the fire. For some fires, a fourth element — the chemical chain reaction — must also be broken (the fire tetrahedron).

Fire Classes and Extinguishing Agents

How Each Agent Attacks the Fire

Every extinguishing agent works by removing one or more sides of the triangle or by breaking the chain reaction, and knowing which side an agent attacks tells you immediately where it will fail.

• Cooling removes the heat. Water is unmatched at this because of the energy it absorbs in turning to steam, and because the steam produced also displaces air above the fuel. Its weakness is everything else: it conducts electricity, it floats burning liquids and spreads them, and on hot metal it reacts.
• Smothering removes the oxygen. Foam does it by floating a blanket on a liquid surface and sealing the vapour underneath; carbon dioxide does it by displacing the air in the immediate vicinity. Both fail the moment the blanket is broken or the gas disperses, which is why a foam blanket must not be walked through and why a carbon dioxide discharge in a draught achieves very little.
• Starvation removes the fuel — shutting a valve, isolating a tank, or letting a gas fire burn out under control. For a pressurised gas fire this is not one option among several, it is the only real answer.
• Chain-breaking interferes chemically with the free radicals that propagate combustion, extinguishing the flame without necessarily cooling anything. Halons and dry powders work this way, which is why they knock a flame down so fast, and also why the fuel underneath is still hot enough to re-ignite the instant the agent clears.

Two consequences of the agent list above are worth stating plainly. Dry powder is the fastest flame knock-down available and is effective across several classes, but the residue is fine, pervasive and mildly corrosive, so a discharge inside an equipment bay or a flight deck writes off connectors and boards that the fire itself might not have touched — which is why the clean agents are preferred anywhere near avionics. And foam has to be applied gently, off a vertical surface or the back wall of a tray, so that the blanket forms and flows; directed straight into a burning liquid it simply punches through and splashes it about.

Reading the Class Table

The European classification groups fires by what is burning, and the table above follows it: ordinary combustible solids, flammable liquids, flammable gases, combustible metals and, at the end, cooking oils and fats. Cooking oils get their own class because they burn at a temperature far above the boiling point of water: applying water to a burning pan does not cool it, it flashes to steam instantly and throws burning fat across the room. A wet chemical agent works instead by reacting with the fat to form a soapy crust that seals the surface. On an aircraft the class is not academic — galley equipment and deep-fat fryers are exactly where it applies.

Electricity is treated differently, and this catches candidates out. In the European scheme it is not a class of its own, because electricity is an ignition source rather than a fuel: what is actually burning in an "electrical fire" is the cable insulation, the plastic housing or the oil in a transformer, so the fire is classified by that. What the electrical involvement changes is the agent, which must be non-conductive so the operator does not receive a shock back up the jet, and which must not leave a conductive or corrosive residue on equipment. Isolating the supply is the first action and often the decisive one: once the power is off, what remains is an ordinary fire of whatever material was ignited. Some other national schemes do label energised equipment as a separate class, which is why the letter appears in older material and in questions written outside Europe.

One nuance about carbon dioxide follows from its very limited cooling. It is rated primarily for flammable liquids and is the standard choice around live electrical equipment because it is non-conductive and leaves no residue. Directed at a surface fire in ordinary combustibles it will knock the flames down, but it cannot extinguish a deep-seated fire in wood, paper or upholstery, which will re-ignite from within — and that is why the class table above lists water, foam and dry powder against ordinary combustibles rather than carbon dioxide.

Extinguisher Identification and Colour Coding

Since the European standard was adopted, every portable extinguisher body is signal red, and the contents are identified by a coloured band or panel on the body together with the printed label. Before that, the whole body was finished in the agent's colour, and older extinguishers in that form are still encountered — and still appear in examination questions. The agent colour itself did not change; only how much of the extinguisher it covers. Alongside the colour, the label states in class letters exactly what that particular unit is approved for, and it is the label rather than the colour that is authoritative.

Halons are ozone-depleting substances, banned for general use under the Montreal Protocol and the European regulation implementing it. Civil aircraft fire protection is one of a shrinking list of "critical uses" for which they remain permitted, with separate phase-out dates set for hand-held extinguishers, lavatory systems, cargo bays and engine and APU installations — which is why an engineer still meets halon on the aircraft while it has disappeared from the hangar wall. The replacements named in the agent list above take halon's place without the ozone depletion.

The label also carries a fire rating — a number and a letter stating the size of standard test fire the unit will extinguish, which is what distinguishes two identically blue-panelled powder extinguishers of different capacities — and the operating instructions. Separately, an extinguisher carries a service label: it is inspected regularly, weighed or pressure-checked, and it is taken out of service after any discharge, however brief, because a partially discharged unit will not perform when it is next picked up.

Metal Fires: Why the Normal Rules Reverse

The reason burning magnesium behaves so violently with the ordinary agents is that at the temperature quoted in the warning above it is hot enough to strip oxygen out of compounds that are normally inert in a fire.

• With water: the magnesium takes the oxygen from the water molecule, leaving magnesium oxide and free hydrogen — and hydrogen released into a fire that hot promptly explodes. Applying water also causes violent steam explosions that scatter burning metal.
• With carbon dioxide: the same thing happens. Magnesium reduces carbon dioxide to carbon, taking the oxygen for itself, so the "inert" gas actually supplies the oxidiser. Magnesium will continue to burn in an atmosphere of pure carbon dioxide, which is precisely why carbon dioxide is listed as prohibited alongside water.

The only agents that work are dry, chemically inert powders that form a crust over the burning metal and exclude the air without reacting with it — the specialist Class D powders identified in the class table, which include graphite-based, sodium-chloride-based and ternary-chloride formulations, together with the dry limestone or chalk powders used for burning swarf in a machine shop. Older manuals also list dry asbestos wool with chalk for the same purpose, and it works on exactly the same principle of an inert dry blanket, though asbestos is no longer used in new work because of its own health hazard. Two practical points: dry sand is not a reliable substitute because it almost always holds some moisture, which supplies the water reaction above; and a Class D agent is applied gently, building a blanket over the metal rather than blasting it, because a high-velocity discharge scatters burning particles across the shop. Once covered, the metal is left to burn out under the crust rather than disturbed.

Titanium behaves the same way. Bulk titanium is difficult to ignite, but titanium swarf, with its enormous surface area, will burn fiercely and reacts with water and carbon dioxide exactly as magnesium does — which is why swarf is cleared from machines and kept in covered metal bins rather than allowed to accumulate.

Wheel, Brake and Engine Fires

These two aircraft fires call for different agents, and the reason is the fuel:

• A wheel or brake fire takes dry powder. Wheels and some brake components are magnesium and aluminium alloys, so an established fire there is a metal fire with all the chemistry above. There is a second reason to keep water and carbon dioxide away even before the metal ignites: an aircraft wheel after a heavy braking event is extremely hot, and quenching it locally causes thermal shock that can crack the wheel and turn a hot brake into an explosive wheel failure. The correct response to a merely overheated brake is to leave it alone in the designated cooling position, allow it to cool in air or with a cooling fan, and let the fusible plugs do their job — they are designed to melt and deflate the tyre in a controlled way rather than allow it to burst.
• A ground engine fire takes carbon dioxide. What is burning is fuel, oil and electrical insulation, so a clean, non-conductive smothering agent that leaves no residue in the gas path is what is wanted; water would spread burning fuel and create a shock hazard, and dry powder would contaminate the engine. Discharge is directed into the intake, the exhaust or the drains as the maintenance manual specifies, and the aircraft's own fire bottle is used if the installation allows it. Do not open the cowl doors to get at the fire: opening them admits air and can turn a contained fire into a flare-up in the operator's face.

Extinguishers Inside the Aircraft

The cabin imposes an extra requirement that no workshop extinguisher has to meet: whatever the agent does to the fire, it must not poison the people who cannot leave. Cabin extinguishers are therefore water or water/glycol units for fires in ordinary combustible materials such as seat covers, paper and furnishings, plus a halon unit — historically BCF — or its modern clean-agent replacement for everything else, halon's comparatively low toxicity at the concentrations used being the reason it survived in the cabin long after it left the hangar.

Two agents once carried in aircraft are now prohibited, and the reason in both cases is toxicity rather than fire performance. Carbon tetrachloride decomposes on hot surfaces into phosgene and other highly toxic products, so using it in an enclosed occupied space can kill the occupants faster than the fire; methyl bromide is acutely toxic in its own right. Neither may be used in a cabin, and the general principle carries across to the hangar — agent selection in any confined occupied space has to account for what the agent and its decomposition products will do to the people in there.

The lithium cells in passenger electronic devices deserve a separate note, because the class table above lists lithium among the combustible metals and that classification applies to lithium metal primary cells. In a rechargeable lithium-ion device the fire is dominated by burning electrolyte and by cell-to-cell thermal runaway propagating through the pack, so the published procedure is to knock the flames down with the available extinguisher and then to cool the device with a non-flammable liquid to stop the propagation, rather than to treat it as a metal fire. Which procedure applies is set out in the operator's manuals, and it is one of the few cases where "put water on it" is the correct answer for something that looks like a battery fire.

Using an Extinguisher

A portable extinguisher is for a fire in its earliest stage and for protecting an escape route. It is not a fire-fighting capability, and the decision to use one is made in a couple of seconds:

• Raise the alarm first, before doing anything else, so that the evacuation and the fire service response are already running whether or not your attempt works.
• Only tackle a small fire, and only with the right agent to hand. If it is larger than about the size the extinguisher is rated for, if it is producing significant smoke, or if you would have to enter the smoke to reach it, leave it.
• Keep your escape route behind you. Stand between the fire and the way out, never the other way round, and get out if the fire is not going out.
• Aim at the base of the flames, from the edge nearest you, sweeping across; on a liquid fire in a tray, work from the near edge to the far one so the blanket builds towards the fire rather than being punched into it.
• Do not hold the horn of a carbon dioxide extinguisher unless it is a frost-free type — the horn reaches the discharge temperature within a second or two.
• Ventilate afterwards if carbon dioxide has been discharged in a small or enclosed space; the agent works by displacing oxygen, and it does not distinguish between the fire's air supply and yours.
• Watch for re-ignition, particularly after a dry powder or carbon dioxide discharge, and report every use so the unit is replaced or recharged.

Fire Prevention in the Hangar

An aircraft in a hangar concentrates all three sides of the triangle in one building: tonnes of fuel, fuel-gas cylinders, solvents, paints, composite dust and packaging on the fuel side; the oxygen system and the hangar's own air on the second; and hot work, grinding sparks, electrical faults, static and smoking materials on the third. Hangar fire rules are therefore stricter than ordinary workshop rules, and all of them apply, not merely the smoking ban:

• No naked flames or unauthorised spark-producing work; smoking only in designated areas away from the building.
• Flammable liquids kept in the flammable store, with only the working quantity in the hangar, in approved containers, and returned at the end of the shift.
• Fire doors kept closed — a wedged-open fire door protects nothing, and its only function is to hold back fire and smoke for the time the escape needs.
• Escape routes, exits, fire alarm call points, extinguisher points, hydrants and hose reels kept permanently clear. "Temporarily" parking a stand or a tug across an exit is exactly the situation the rule exists to prevent, and posting somebody to watch it does not substitute for keeping it clear.
• Aircraft positioned so they can be towed out, with a towbar and tug available and the crew trained to use them, and with the aircraft's fuel state and configuration considered as part of the fire plan.
• Housekeeping treated as fire prevention: rags, packaging, composite offcuts and dust are all fuel.
• Fixed detection and suppression systems — hangar deluge or high-expansion foam — maintained and understood. An inadvertent foam discharge is itself a hazard: it fills the building in minutes, hides obstacles and open pits, and is extremely slippery.
• Everybody knowing the alarm signal, the nearest two exits and the assembly point, and a roll call being taken so that nobody is searched for who is already outside — or missed who is not.

Hot Work

Hot work — welding, brazing, soldering, grinding, cutting, heat-shrinking, anything that produces a flame, an arc, a hot surface or sparks — is one of the most common causes of industrial fires, and near an aircraft it is controlled by permit. The permit is issued by an authorised person after the precautions have been checked, and it is specific to the location and the time period:

• Combustible material is removed from the area, or where it cannot be removed it is covered with fire blankets or screened; this includes what is below the work, because sparks fall through floor gaps, cable runs and open panels and start a fire on the deck beneath while everybody is watching the torch.
• Fuel and oxygen systems are isolated and, where the work is on or near a tank, the space is gas-tested and certified free of flammable vapour before the permit is issued — and re-tested if work is suspended.
• Suitable extinguishing equipment is positioned within reach before work starts, and a fire watch is posted: a person whose only job is to watch for ignition, with an extinguisher and the means to raise the alarm.
• The fire watch continues after the work stops, for the period the permit specifies — commonly at least half an hour — because material heated by grinding or welding can smoulder unnoticed for a long time before it flames. The area is checked again before the permit is handed back.
• Aircraft transparencies, composite structure, wiring and soft furnishings near the work are protected from heat and spatter, and adjacent work is stopped or screened.

A hot-work permit cannot be self-issued by the person doing the work, for the obvious reason that the point of it is independent verification that the precautions are in place. Nor is it a marine or heavy-industry formality: it applies in an aircraft hangar with more force than almost anywhere else, because of what is parked in the middle of it.

Hazards Around a Live Aircraft

The hazards dealt with so far belong to substances and equipment. The aircraft itself is a hazard of a different kind, because it stores energy in a dozen forms and because it is surrounded by other people's work. Almost every serious ramp and hangar injury comes from the same root cause: a system did something the person nearby had assumed it could not do.

Propellers and Rotors

A propeller is treated as live at all times, by everybody, whether or not the engine has been shut down and whether or not the switches are off. Two mechanisms justify that rule rather than mere caution. A piston engine's magneto generates its own ignition and is stopped only by the switch earthing its primary lead; if that lead is broken, disconnected or its switch has failed, the magneto is still hot with the switch in the OFF position and the engine can fire when the propeller is turned by hand. And a turboprop or a helicopter rotor with residual power available, a wind gust, or a hydraulic or electrical system re-energising, can move without anyone touching it.

The practical rules are simple and absolute: never stand, walk or place equipment in the plane of rotation of a propeller or rotor; never approach a running or recently-shut-down aircraft without eye contact and a signal from the crew; treat "engine shut down" and "ground power connected" as reasons for more care rather than less. Where a propeller must be moved by hand for a maintenance task, it is done to the procedure in the manual, with the ignition confirmed dead and everyone positioned clear of the arc.

Helicopters add their own geometry. The main rotor droops when it slows and flaps in wind, so the disc can dip to head height at the edge; the tail rotor is close to invisible when turning and is the reason nobody approaches a helicopter from the rear. The standard approach is from the front or the front quarter, in the pilot's field of view, crouched, having been signalled in. On sloping ground the approach is always from the downhill side, because the disc is nearer the ground on the uphill side. Anything carried — a ladder, a panel, a length of cable — is carried horizontally, never on the shoulder.

Engine Intake and Exhaust Danger Zones

A running turbine produces two lethal zones that must be observed at all power settings, not only during high-power running:

• The intake generates enough suction at ground idle to ingest a person, and people have been killed by walking too close to an engine that was, by any casual judgement, "only ticking over". Loose items — hats, ear defenders, identity cards, rags, panels, unsecured ground equipment — go the same way and destroy the engine on the way through.
• The exhaust produces a high-velocity, high-temperature blast that remains dangerous a long way behind the aircraft and can blow over people, equipment and light aircraft, and can pick up stones and turn them into projectiles.

Both zones grow substantially with thrust, which is why the manuals give separate danger-area diagrams for ground idle and for take-off power, and why the higher-power zones are the ones respected during a ground run. Before any ground run the intake, the surrounding area and the surface upwind are checked for debris, the area is roped off or marked, communication with the flight deck is established and tested, and hearing protection is worn by everyone within the noise zone. Nobody enters a danger area on the assumption that the engineer at the controls has seen them.

Radar, HF and Other Radio-Frequency Radiation

Radio-frequency energy at the powers used by weather radar and HF transmitters is absorbed by tissue and turned into heat. The eye and the testes are the most vulnerable organs because both are poorly supplied with blood and therefore cannot carry the heat away; the recognised injuries range from a superficial warming sensation through deep tissue burns to cataract, and because the deeper heating produces no immediate pain there is no reliable warning at the time.

Three rules cover almost all of it. First, the minimum safe distance and the safe sector are given in the aircraft maintenance manual for the specific installation, and they are not a matter of judgement. Second, weather radar is not operated inside a hangar or with anyone in front of the antenna — reflections from hangar walls and from nearby aircraft can produce field strengths well above those in the open, and a scanner parked in one position concentrates the whole output into a narrow sector. Third, the transmitter is placarded off and the circuit breaker collared before any work in front of the antenna, because a built-in test or a system self-check can energise it without anybody selecting it.

Two further points belong here. Radiated energy can ignite fuel vapour and can fire electro-explosive devices, so radar and HF transmission are prohibited during refuelling and during work on any pyrotechnic or cartridge-actuated system such as a fire-bottle squib or an escape-slide inflator. And touching an HF antenna while the set is transmitting produces a deep RF burn, so the aircraft is earthed and the HF is placarded off during any work near it.

Wheels, Tyres and Brakes

An inflated aircraft tyre stores an enormous amount of energy, and the wheel that contains it is a two-piece assembly held together by tie bolts. A wheel failure releases that energy in a fraction of a second, and the debris — the wheel halves, the tie bolts and the bead flange — is thrown outwards along the axis of the axle, to either side. The recognised danger zone is therefore the region in line with the wheel axis, and the safe position for approaching or working near a wheel is fore or aft of it, in the plane of the tyre. This is the same geometry as the hot-brake rule, and for the same reason.

• Inspect the tyre and the wheel for cuts, bulges, flat spots, damaged or missing tie bolts and evidence of overheating before inflating anything. Inflating a damaged wheel is how the assembly fails.
• Inflate through an extension hose with a remote gauge, from outside the danger zone, and never exceed the rated pressure — which is a specific figure for the specific tyre and aircraft, taken from the manual, and is not "whatever it had last time".
• Deflate the tyre completely before removing a wheel from the axle and before slackening any tie bolt. Splitting a wheel that still holds pressure is one of the classic fatal maintenance accidents, and the fact that the tyre "looks flat" is not evidence that it is.
• Inflate with dry nitrogen, for the reasons given in the gas section, and never with oxygen.
• After heavy braking, leave the assembly alone. Approach only fore or aft, do not spray water or any other coolant onto a hot wheel, allow the cooling period the manual specifies or use an approved cooling fan, and remember that the fusible plugs are designed to release the tyre pressure in a controlled way rather than let the tyre explode — a deflated tyre after a hot-brake event is the system working, not a separate fault.

Stored Energy and Unexpected Movement

A parked aircraft is full of things that can move on their own or under someone else's command:

• Landing gear. Ground locks and gear pins are fitted before anyone works in or passes through a wheel well, and they are removed only by the person authorised to do so, at the point in the procedure where the manual says. The streamers on them are long and red for exactly one reason.
• Flying controls, flaps, slats, spoilers and thrust reversers. These move under hydraulic or electrical power with no warning to someone standing in the way, and they also move under their own weight when a system is depressurised. Isolation, warning placards at the controls and a check that nobody is in the path come before any system operation.
• Doors and escape slides. A door with its slide armed will fire the slide when it is opened, at a speed and force that has broken bones and thrown people off stands. Doors are disarmed before being opened for maintenance, and the arming state is checked rather than assumed.
• Accumulators, gas struts, springs and tensioned cables. These retain their energy indefinitely after the aircraft is shut down and are released only through the procedure in the manual.
• Hot and pressurised systems. Bleed ducts, engine components and brakes stay hot for a long time; oxygen and hydraulic systems stay pressurised until deliberately vented.

Every safety pin, ground lock, blanking cap and cover fitted during maintenance is an item that must be accounted for and removed before the aircraft flies, and the record of them is part of the release paperwork. A gear pin left in place after maintenance and a gear pin missing during maintenance are both serious — one grounds the aircraft, the other endangers the person under it.

Warning Notices and Tags

A red warning tag or placard fitted to an aircraft is a mandatory instruction, not advice. It signifies a hazardous condition, an inoperative system or maintenance in progress, and the aircraft or the system must not be operated until the responsible person has cleared the work and removed it. Only the authorised maintenance person who owns the work removes it — not a ramp agent who wants to reposition the aircraft, not the crew, and not the next shift because it looks finished. That, along with the physical lock in the isolation described earlier, is what stops one person's convenience becoming another person's injury. Tags are numbered or logged so that their removal can be verified before release to service.

Ground Movement, Towing and Jacking

Towing is a whole-team operation, and the injuries it produces are crushing injuries. The tow crew works to briefed roles — a person in charge, a brake rider on the flight deck where required, wing walkers with a clear view of the tips and the tail, and intercom or agreed hand signals throughout — and the aircraft stops the instant communication is lost. The towbar and head are matched to the aircraft type, the nose-gear steering is bypassed or the torque link disconnected as the manual requires, and the nose-gear turn limits are never exceeded: overturning the nose gear damages the steering mechanism and the damage is not always obvious afterwards, so an over-turn is a reportable event rather than something to drive out of.

Jacking concentrates a very large mass on three or four small points and is unforgiving of shortcuts:

• Jack only at the designated jacking points, with the correct adapters, on a level and load-bearing surface, ideally inside; outdoors there are wind limits and they are observed.
• Jacks are positioned squarely, plumb under the point, and raised together and evenly so the aircraft is never twisted or allowed to run off a jack head.
• Tail-tipping types are supported with a tail stand or ballasted before anything is removed.
• Locking collars are wound down to follow the jack as it rises, so that a hydraulic failure cannot drop the aircraft; nobody works under an aircraft supported only by hydraulic pressure.
• The centre of gravity is not changed while the aircraft is on jacks — removing an engine, defuelling, or moving a heavy component — except in the sequence and with the ballast the manual specifies.
• The area under and around the aircraft is controlled: no towing, no other movement, warning notices at the flight deck and at the jacking points, and the aircraft is left jacked only if the procedure allows and the notices are in place.

Accident Remedial Action and First Aid

• Electric shock — isolate the supply first (switch off or pull plug). Do not touch the victim while they are in contact with the live source. If breathing has stopped, begin CPR immediately.
• Chemical burns — flush affected area with copious clean water for at least 20 minutes. Remove contaminated clothing. Seek medical attention.
• Chemical splash in eyes — irrigate with clean water or eyewash for at least 15 minutes, holding eyelids open. Seek immediate medical attention.
• Fuel/solvent inhalation — move to fresh air. If unconscious, place in recovery position and call emergency services.
• Fire on a person — stop, drop, and roll. Smother with fire blanket if available. Do not use CO₂ extinguisher directly on a person (risk of cold burns and suffocation).

The Order of Actions

Every one of the responses listed above fits inside the same framework, and knowing the framework is what lets an engineer act correctly in a situation the list does not cover. It is usually remembered as D–R–A–B–C:

• Danger. Make the scene safe before you touch anybody. This is first for a hard practical reason rather than a legalistic one: the second casualty is the person who ran in to help, and two casualties are far more than twice as bad as one, because there is now nobody left to raise the alarm or to guide the ambulance in. Isolate the supply, stop the machine, ventilate the space, remove the ignition source.
• Response. Speak to the casualty and gently shake the shoulders. A casualty who answers has an airway and is breathing, which changes everything that follows.
• Airway. An unconscious casualty's airway is most often blocked by their own tongue; opening it by tilting the head and lifting the chin is the single most valuable thing an untrained bystander can do.
• Breathing. Look, listen and feel. If the casualty is not breathing normally, start resuscitation without delay and send someone else for help — the instruction to send someone else is deliberate, because leaving a non-breathing casualty to go and find a telephone yourself costs the minutes that decide the outcome.
• Circulation. Control severe bleeding with direct pressure and elevation.

An unconscious casualty who is breathing normally and has no suspected spinal injury is placed in the recovery position, which keeps the airway open and lets vomit drain rather than be inhaled. A casualty who has been in an atmosphere that could still affect them is moved into clean air first, provided that can be done without the rescuer entering it.

Electric Shock: What Makes It Different

Three features of electrical injury change the response, and all three follow from the mechanisms described earlier in this note.

• The casualty may still be part of the circuit. Because a current above the let-go threshold clamps the hand shut on the conductor, the casualty frequently cannot release it and is still energised when you arrive. Touching them makes you the next casualty at the same current. Isolate at the switch, the breaker or the plug — that is always the first choice. Only if isolation is genuinely impossible is the casualty pushed or dragged clear using a dry insulating object, by someone standing on a dry insulating surface and touching nothing else.
• High voltage is different again. At the voltages present in radar and HF installations, and in airport high-voltage distribution, current can arc to a person who never touches the conductor, and can flow through the ground around a fallen cable. Nobody approaches such a casualty until the responsible authority confirms the supply is isolated and earthed, however long that takes.
• The visible injury understates the damage. Current passing through the body burns along its whole path, and the entry and exit marks on the skin can be small while the muscle and nerve damage between them is extensive. Cardiac rhythm disturbances can also develop hours after an apparently minor shock. Anyone who has received an electric shock goes to hospital, even if they feel perfectly well, and even if the shock was "only" from the workshop supply.

Burns, Cold Burns and Special Chemical Cases

For a thermal burn, cooling is the treatment and it works far better than most people expect — cool running water for a prolonged period both limits the depth of the injury and relieves pain. Clothing that is not stuck to the skin is removed along with rings and watches before swelling starts; anything adhering is left alone. Blisters are not burst, no cream, fat or ointment is applied, and the burn is covered with a sterile non-fluffy dressing or clean cling film, which does not stick.

Cold burns need mentioning because they come from equipment nobody thinks of as dangerous. Carbon dioxide discharges at about −78 °C and will freeze skin on contact with the horn or the jet; escaping high-pressure gas cools sharply as it expands, and cryogenic liquids are colder still. A cold injury is rewarmed gently with body heat or tepid water — never rubbed, never heated directly — and treated as a burn thereafter.

Three chemical situations in this trade have a specific response that generic first aid does not cover:

• Hydrofluoric acid, present in some etchants, deoxidisers and paint strippers, is uniquely dangerous. It penetrates the skin and destroys tissue from within, the pain can be delayed for hours, and absorbed fluoride disrupts the body's calcium balance and can cause cardiac arrest from a burn covering only a small area. Where it is used, the specific calcium gluconate antidote gel must be immediately available, applied after flushing, and the casualty goes to hospital regardless of how the burn looks.
• High-pressure fluid injection is a surgical emergency dealt with under hydraulic fluids above — the point to carry here is that it presents as a trivial puncture and must never be triaged as one.
• Oxygen-saturated clothing. After a leak or a purge, clothing and hair hold a high concentration of oxygen for some time and will flare violently at any spark or flame. The casualty or the worker moves to well-ventilated fresh air, stays well away from any ignition source, and the clothing is aired thoroughly before they go anywhere near hot work, a vehicle or a smoking area.

Rescue from a Confined Space or an Oxygen-Deficient Atmosphere

This is the situation in which the instinct to help is most likely to kill the helper, so it is worth having decided in advance. A colleague who has collapsed inside a tank, a duct or a purged compartment is direct evidence that the atmosphere in there is lethal, and it will do exactly the same to anyone who follows them in. The standby person's job is to raise the alarm, to attempt recovery from outside using the retrieval line and harness that were rigged before entry, and to stop anybody else going in. Entry rescue is carried out only by trained rescuers with breathing apparatus. It is also the reason the rescue arrangements are made a condition of the entry permit, rather than something improvised once a person is already down.

First-Aid Provision

Provision is set by assessment: how many people, spread over what area and shift pattern, exposed to which hazards, and how far away the emergency services are. The practical minimum in a maintenance organisation is trained first-aiders on every shift with their names and locations posted, stocked and in-date first-aid kits, and an accident record.

Two items are worth singling out because they are effective only if their siting is right. Emergency eyewash must be immediately accessible wherever chemicals are used — the widely used standard requires it to be reachable within about ten seconds' travel from the hazard and to deliver a continuous flush for at least fifteen minutes — and every person working in the area must know where it is without looking, because a casualty with a chemical in their eyes cannot see to find it. A unit "somewhere in the building" is not compliant and, more importantly, is not useful. Sealed single-use eyewash pods serve the same purpose out on the line where plumbed-in stations do not exist. Emergency showers serve the same function for a body splash and are sited on the same reasoning. Both are tested and flushed on schedule, because a stagnant eyewash line grows contamination that will be flushed straight into an injured eye.

Finally, know the practicalities before you need them: the emergency number, the site address and gate the ambulance should use, who will meet it, and where the assembly point is. A hangar on an airfield is not a location an emergency vehicle can find unaided.

Reporting

All accidents, near-misses, and hazardous occurrences must be reported immediately to the supervisor and documented in the company's safety reporting system. In EASA-regulated environments, serious incidents must also be reported to the competent authority.

"Immediately" is doing real work in that sentence. A report made at the time captures the scene as it was, the position of the equipment, the state of the guard, the witnesses while they are still on shift and their memories before they have been discussed and reshaped. A report written up at the end of the week captures a reconstruction. Where it is safe to do so and nobody needs treatment, the area is left undisturbed for the investigation.

Near Misses Are the Cheap Lessons

A near miss is an event that could have caused injury or damage and, by chance rather than by design, did not: the spanner that fell from the stand and landed beside somebody, the panel that was found unsecured, the wrong fluid that was noticed before it went into the reservoir. It carries the same information about the failed control as an accident does, at none of the cost.

That is the whole argument for reporting them. Serious injuries are rare, so an organisation that only investigates injuries is learning from a tiny and randomly-selected sample of its problems, always after the damage. Near misses are numerous, and each one identifies a defective control before it collects on the debt. An organisation whose near-miss reporting rate rises is usually getting safer, not more dangerous — the underlying events were always happening and are now being seen.

Reporting only survives if it is easy and if it is safe. A form that takes twenty minutes, or a culture in which the reporter is asked what they did wrong, produces exactly the silence it deserves; the events continue and nobody hears about them until one of them injures somebody. Waiting for visible damage before treating something as worth reporting discards precisely the preventive value the system exists for.

Occurrence Reporting and Just Culture

Two reporting regimes run in parallel in a maintenance organisation and an engineer needs to recognise both.

• Aviation occurrence reporting. European law requires occurrences that endanger, or which if not corrected would endanger, an aircraft or its occupants to be reported through the organisation's mandatory reporting scheme and passed to the competent authority, normally within 72 hours of the reporter becoming aware of the occurrence. A Part-145 organisation is required to run an internal safety reporting scheme as part of its management system, both to feed that external reporting and to capture the hazards that never reach the threshold of an occurrence. Typical maintenance examples are an incorrect assembly found in service, a tool left in an aircraft, an incorrect fluid uplift, and damage discovered but not recorded.
• Workplace health and safety reporting. National legislation separately requires certain injuries, occupational diseases and dangerous occurrences at work to be reported to the health and safety authority. The two regimes have different thresholds and different recipients, and a single event — an engineer injured by an escape slide firing during maintenance, say — can be reportable under both. Satisfying one does not satisfy the other.

Both regimes depend on just culture, which is frequently misdescribed as a no-blame culture. It is not. A just culture undertakes that people will not be punished for actions, omissions and decisions that are commensurate with their experience and training — that is, for honest error — while making equally clear that wilful violations, gross negligence and destructive acts are not tolerated. The distinction is what makes it work: a promise of total immunity would be neither credible nor safe, and a policy of punishing error simply hides the error. The reporter's identity is protected, and reports are used to fix systems rather than to build a case against individuals.

Investigation and Corrective Action

A report that is filed and not acted on is worse than no report, because it creates a record that the hazard was known. The investigation looks for the conditions that allowed the event rather than for the person at the end of the chain: what the procedure actually said, whether the tooling was available, how the shift handover worked, whether the lighting or the access made the correct action difficult, what pressure the team was under. Those are the factors that can be changed; "be more careful" cannot.

The output is a corrective action with an owner and a date, and the loop is closed only when someone has verified that the action was taken and that it worked. The findings then have to travel — through the safety notice, the toolbox brief, the amended procedure or the revised training — because the next person to meet the same trap will be somebody who was not there. Trend analysis over many small reports is what identifies the hazard that no single event made obvious, and that is the reason the small reports are worth collecting in the first place.

Additional Workplace Hazards

Noise

Aircraft engines, APUs, pneumatic tools, and riveting guns produce noise levels well above 85 dB(A) — the threshold for mandatory hearing protection. Prolonged exposure causes permanent noise-induced hearing loss (NIHL). Wear ear defenders or ear plugs in all designated hearing protection zones.

Two features of noise damage explain why the rules look the way they do. The first is that it is painless and permanent. The sound energy destroys the outer hair cells of the cochlea, which do not regenerate; there is no soreness the next day and no recovery. The loss begins in the region around 4 kHz, which sits above most of the energy in speech but right on the consonants, so the earliest symptom is not "everything is quieter" but "I can hear people talking in the crew room, I just cannot make out what they are saying". By the time the loss is obvious in conversation, a large part of it has already happened. Ringing in the ears or muffled hearing at the end of a shift — a temporary threshold shift — is the warning that the exposure that day was too high.

The second is that the decibel scale is logarithmic, so the numbers do not behave the way intuition suggests. An increase of 3 dB doubles the sound energy reaching the ear, which means it halves the time you can safely be exposed. The damage depends on the total dose — level combined with duration — not on the peak level alone.

Action Values and What Each One Triggers

European noise legislation sets three figures, expressed as a daily or weekly personal exposure, and each one triggers a different obligation:

The last row is the one that is most often misread. The limit value is not "85 plus a bit of tolerance": it is an absolute ceiling on what actually reaches the ear, so the protection worn is part of the calculation. The peak column exists separately because impulse noise — a rivet gun, a pneumatic chisel, a cartridge tool — can injure the ear in a single event regardless of how quiet the rest of the day was, and an average measured over eight hours hides that completely.

Choosing and Wearing Hearing Protection

Hearing protection is PPE and therefore the last line, which means the first question is always whether the noise can be reduced at source or the person moved away from it — a quieter tool, damping, a screen, a longer air hose so the operator is not standing beside the compressor. What is left is then attenuated:

• More attenuation is not automatically better. Over-protection cuts the wearer off from speech, from alarms, from the sound of a reversing tug and from the change in an engine's note that tells them something is wrong — and the usual result is that the protector gets lifted off at exactly the wrong moment. The aim is to bring the level at the ear down to a comfortable working range, not to the lowest number available.
• Fit decides the real performance. The attenuation printed on the box is achieved in a laboratory. In practice, disposable foam plugs deliver a fraction of it unless they are rolled down and inserted correctly with clean hands, and ear defenders lose a great deal to spectacle side-arms, long hair, hoods and a headband stretched over a hard hat.
• Match the type to the job. Defenders are quick to put on and take off for intermittent noise and are easy to supervise, but they are hot and awkward in a confined space; plugs suit long continuous exposure and tight access; communication headsets combine protection with intercom for ground running and towing.
• Hygiene and replacement. Foam plugs are single use, reusable plugs are washed, and defender cushions harden with age and stop sealing — a set with cracked cushions is decoration.

Where the upper action value is exceeded the area is designated and signed as a hearing protection zone, and the requirement inside it is absolute rather than a matter of personal choice: hearing loss accumulates across a career, and the engineer who takes their defenders off "for a minute" to hear a colleague is taking the dose that mattered. Health surveillance — audiometry — exists to catch the early loss the individual cannot yet notice.

Working at Height

• Use approved platforms, docking systems, and scaffolding. Never stand on boxes, drums, or improvised platforms.
• Use fall-arrest harnesses when working on top of the fuselage, wings, or tail.
• Ensure platforms have guard rails, toe boards, and non-slip surfaces.

Falls are among the largest causes of serious and fatal injury in maintenance, and aircraft work presents an unusually awkward version of the problem: curved, slippery surfaces with no natural edge protection, few designated anchor points, and access equipment that has to be positioned close to expensive structure without touching it.

When does "working at height" start? The answer depends on where you are. European work-at-height law sets no minimum height: it applies to any place from which a person could fall a distance liable to cause personal injury, which includes falling into an open fuel tank or through an unguarded floor opening, and even a fall of less than a metre onto a hard hangar floor or into machinery qualifies. Other jurisdictions set a numeric trigger instead, and the figure most commonly quoted is 1.8 m, or 6 ft. Either way the requirement comes from the applicable regulation and not from the height of the aircraft, from a supervisor's opinion or from the individual's confidence — and it applies to a narrow-body wing exactly as it does to a wide-body crown.

The hierarchy of controls from the first section maps directly onto height work, and the order is worth following deliberately because the natural instinct is to start at the bottom of it and reach for a harness:

• Avoid the work at height. Can the component be removed and worked on at floor level? Can the inspection be done from a docking floor rather than from the top of the fuselage?
• Prevent the fall using a guarded working platform — the collective measure that protects everybody on it without any action on their part.
• Prevent the fall from a personal anchor using a restraint system: a lanyard adjusted so the wearer physically cannot reach the edge. Nobody falls, so no clearance and no rescue are required. Where it is workable, restraint is always better than arrest.
• Arrest the fall with a harness and energy-absorbing lanyard or an inertia reel, accepting that a fall will happen and planning for it.
• Mitigate the consequences — nets, airbags, exclusion of people from underneath.

Fall arrest carries two obligations that get overlooked. The first is clearance: the total fall distance is the free fall before the lanyard becomes taut, plus the extension of the energy absorber as it deploys, plus the height of the person below the attachment point, plus a safety margin. Added up, a two-metre lanyard needs several metres of clear space below the anchor, and an anchor at foot level roughly doubles the free fall compared with one overhead — so on a low working level a fall-arrest lanyard can let the wearer reach the floor before the system has finished doing anything at all. The second is rescue. A person hanging motionless in a harness can lose consciousness within minutes as blood pools in the legs and returns poorly to the heart, so a plan and the means to recover them quickly must exist before the work starts. "Call the fire brigade" is not a rescue plan.

Anchorage is the other half of the system and is aircraft-specific. Harnesses are attached only to the anchor points, running lines or docking structures designated for the purpose in the maintenance manual or by the equipment supplier — never to a hydraulic pipe, an antenna, a duct, a control cable or a convenient bracket, none of which is rated for the several kilonewtons an arrested fall applies, and some of which will simply come off in your hand.

Access equipment brings its own rules. Platforms and docking are positioned with the brakes applied or the wheels chocked, are not moved with people, tools or parts on them, and carry a stated safe working load that includes the equipment as well as the people. Gaps between the platform edge and the aircraft skin are closed or guarded, both to stop a person or a tool falling through and to protect the skin. Outdoor work has a wind limit, and the equipment supplier states it. Ladders and stepladders are a last resort for short-duration, light work only, used at about a 1-in-4 lean — roughly 75 degrees — secured at the top or footed, with three points of contact maintained and never used as a working platform or leaned against the aircraft skin.

Finally, working at height creates a hazard for the people underneath. Tools are tethered or kept in a closed bag, loose items come out of pockets before climbing, the area below is excluded or barriered, and anyone who has to work there wears head protection. A dropped spanner from wing height is capable of killing someone standing below, and it is also the beginning of a foreign object damage investigation.

Confined Spaces

Fuel tanks, cargo compartments, and wheel wells are confined spaces. Entry requires a permit to work, atmospheric monitoring (oxygen level, flammable gas concentration), a safety attendant outside, and rescue equipment on standby.

A confined space is not defined by being small. It is a substantially enclosed space in which a specified risk exists — oxygen deficiency or enrichment, a flammable atmosphere, a toxic atmosphere, engulfment by a liquid or a free-flowing solid, or excessive heat. A large cargo hold with an inerting system discharged into it is a confined space; a cramped avionics bay with normal ventilation and no specified risk is not. That distinction is what determines whether the permit regime applies.

Fuel tank entry is the case that combines almost every hazard in this note, and the preparation sequence has a logic that is worth learning as a sequence rather than a list:

• Defuel and drain. Remove the bulk fuel, then drain the sumps and low points. Residual fuel clinging to structure and trapped in stringer bays continues to evaporate long after the tank reads empty, so "drained" is a starting condition and not a safe one.
• Open up for through ventilation. Access panels are opened at more than one point so that air can flow across the space rather than swirl in one corner. Kerosene vapour is heavier than air and pools at the lowest point of the tank, which is where the extraction duct goes.
• Purge. Force air through the tank, or use the manual's inert-gas purge. If a nitrogen purge is used to remove the flammable atmosphere it must itself be purged out with air afterwards — a nitrogen-purged tank is safe from fire and lethal to enter, and confusing the two states is a fatal error rather than a paperwork one.
• Test the atmosphere, with a calibrated instrument, in the order oxygen, then flammable gas, then toxic contaminants — oxygen first because the readings of the other sensors depend on the oxygen concentration being normal. Test at high, middle and low level, because a heavier-than-air vapour will sit undetected at the bottom while the reading taken at the hatch is clear.
• Ventilate continuously while the space is occupied, and re-test after any break in the work, after any change in conditions, and at the intervals the permit specifies. Vapour continues to come out of sealant, out of the tank coating and out of pockets of trapped fuel for as long as anyone is in there.

The atmospheric criteria are conventional and worth memorising: oxygen between 19.5% and 23.5% by volume — the upper limit matters as much as the lower, because an enriched atmosphere makes clothing and hair flammable — and flammable vapour typically below 10% of the lower explosive limit. The 10% figure is a wide safety margin over the concentration that would actually burn, and it exists because a gas detector samples one point at one moment while the space contains gradients and pockets.

Everything taken into the space is chosen with the flammable atmosphere in mind. Lighting and tools are explosion-protected and low voltage, or air-driven; ordinary torches, mobile telephones, cameras and personal electronic devices stay outside. Clothing is cotton or approved antistatic rather than nylon, footwear is non-sparking, and jewellery and anything that can snag or be dropped comes off. Skin is protected against fuel and sealant, and where the manual requires it, breathing air is supplied from outside rather than filtered — a filter cartridge cannot make oxygen.

The human arrangements matter as much as the equipment:

• The standby attendant stays outside for the whole duration, maintains continuous communication with the person inside, controls who enters, keeps the entry log, and never leaves the position or enters the space themselves — the reason for that last rule is set out in the first-aid section above.
• An entry and exit log records who is inside at any moment, so that an evacuation or a rescue starts from a known number rather than a guess.
• The person inside wears a harness with a retrieval line where the geometry allows recovery from outside, and the rescue equipment and plan are in place before the first entry.
• Work periods are limited and rotated. Tank work is hot, cramped and disorienting; heat stress and fatigue degrade judgement in exactly the environment where judgement is needed, and dehydration builds quickly inside a wing in summer.
• The permit ties all of it together: the isolations, the gas test results and their time, the ventilation, the equipment permitted, the people, the validity period and the hand-back. Work stops when the permit expires, and it is re-tested and re-issued rather than extended by verbal agreement.

One last point that catches people out: the hazard does not end when the work does. A tank that has been open, ventilated and worked in is re-sealed with fresh sealant, which continues to give off solvent for a considerable time, and the tank is not treated as a normal enclosed volume again until the manual's cure and ventilation requirements have been met.

Foreign Object Debris (FOD)

FOD is any object or substance in the aircraft environment that could damage the aircraft or injure personnel. Tools, fasteners, safety wire, rags, and personal items must be accounted for at all times. Many organisations use tool shadow boards and FOD walks to maintain clean working areas. Lost tools require an aircraft search and documentation before the aircraft can return to service.

The three letters are used for two different things and it is worth keeping them apart: foreign object debris is the loose material, and foreign object damage is what it does. Debris is generated by the work itself far more often than it blows in from outside — rivet tails and drill swarf, lockwire offcuts, cable-tie tails, blanking caps, split pins, washers, sealant cartridge nozzles, packaging, gloves, ear plugs, pens, identity cards, torch batteries and coins out of a pocket. Outside contributions include stones, ramp fittings, catering and baggage-handling hardware, and ice shed from an aircraft.

The damage is not confined to engines, although an intake ingestion is the most expensive single outcome. Loose articles jam control runs and cable pulleys, foul flap and slat tracks, short across electrical connections and busbars, block drain paths so that water collects where it should not, cut tyres, and become high-velocity projectiles in jet blast or propeller wash. A washer dropped into an open panel and not recovered may do nothing for a year and then find its way somewhere it matters.

Tool Control

Tool control is a formal system, not tidiness, and its whole design goal is to make a missing item visible immediately rather than discovered later:

• Shadow boards and foam-cut trays show an empty outline the moment a tool is out, so a gap is obvious at a glance to anybody walking past, not just to the person who owns the box.
• Individual identification. Every tool is etched, engraved or laser-marked with the box or organisation number, so a tool found in an aircraft can be traced to a task and a person, and so that a tool from another box is not signed back into yours to fill the gap.
• Issue and return control. Tools are booked in and out, whether by a store, a tally system or a digital record, and the box is inventoried at the end of the task and at shift handover.
• Count before you close. The critical check is a tool and equipment count immediately before any panel, cowling, access door or tank is closed. Once the panel is on, finding a missing spanner means taking it off again — and that is the cheap version of the outcome.
• Special-purpose and hired-in equipment is controlled the same way. Borrowed tooling, calibrated equipment and consumable-fitted items such as torque adapters are frequently outside the normal box system, which is exactly why they get left behind.

When a tool cannot be accounted for, the response is escalation rather than an assumption that it will turn up. Work stops, the area and the aircraft are searched, the supervisor is informed, and if the item is still not found the aircraft cannot simply be signed off: the loss is recorded, the possible locations are assessed against the work carried out, and the decision on whether the aircraft can be released — and under what restrictions — is a documented one taken by the responsible person. Concealing a lost tool is a disciplinary matter precisely because the person who knows where it might be is the only person who can find it cheaply.

Consumables, Housekeeping and Checks

Tools are only part of the problem, and consumables are the part that generates the most debris:

• Drilling into a structure or over an open bay is done with a chip catcher, a vacuum attachment or a temporary catchment, and the swarf is cleared and counted out of the area rather than left to migrate.
• Lockwire offcuts and rivet tails go straight into a pocketed pouch or a bag as they are produced; a rivet tail dropped into a wing rib is effectively unrecoverable.
• Blanks, caps and protective covers are treated as controlled items, tallied like tools, and removed to a count.
• Pockets are emptied before working over an open panel, an intake or a fuel tank, and loose personal items — badges on lanyards, phones, pens, jewellery — are secured or left behind.
• The work area is cleaned as the job proceeds rather than at the end, and the bay is swept and inspected before the aircraft is moved.
• Organised FOD walks across the ramp and hangar floor, FOD bins at the exits from working areas, and magnetic sweepers for the ramp catch what individual discipline missed.

A final inspection of the intake, the exhaust, the surrounding surface and the area upwind is carried out before every engine ground run, and any panel or cowling opened during the work is confirmed closed and latched. It is worth noticing that the FOD check and the tool count are two different checks with two different purposes — one asks "is the area clear?" and the other asks "do I still have everything I brought?" — and passing one does not substitute for the other.

Manual Handling and Lifting Equipment

Musculoskeletal injury is the largest single cause of lost working days in maintenance, and unlike most of the hazards in this note it accumulates: it is the twentieth awkward lift rather than the first that does the damage. The assessment considers four things — the task (how far, how often, twisting, reaching above shoulder height or below knee height, holding away from the body), the individual (strength, height, training, pregnancy, existing injury), the load (weight, size, rigidity, grip points, whether the contents shift) and the environment (floor condition, lighting, space, temperature, working on a stand or in a tank).

The hierarchy applies here exactly as it does elsewhere, and it is routinely skipped. The first question is whether the load has to be moved by hand at all: a trolley, a hoist, a component dolly or the type-specific handling fixture called up in the maintenance manual is an engineering control and outranks any amount of lifting technique, which is only an administrative one. Where a manual lift is unavoidable, the technique is the familiar one — assess and plan the route first, feet apart, bend the knees and keep the back's natural curve, load close to the body, no twisting, lower by reversing the process — and a team lift has one person calling the moves so that everybody lifts and lowers together.

Mechanical lifting gear brings its own regime:

• Every item — sling, chain, shackle, eyebolt, hoist, crane, jack — is marked with a unique identification and its safe working load, and it is never loaded beyond it.
• It is inspected by the user before every use for cuts, broken wires, distortion, corrosion, damaged stitching and illegible markings, and it is subject to periodic thorough examination by a competent person, with a current certificate. The interval is set by the applicable national regulation or by a written scheme of examination; under the United Kingdom regulations, for example, it is at least every six months for lifting accessories and for any equipment used to lift people, and at least every twelve months for other lifting equipment.
• A load is never suspended over people and never left suspended unattended; tag lines are used to control swing rather than hands.
• The lift is planned: the weight is known rather than estimated, the centre of gravity is identified, and the attachment points are the ones the manual designates — not a convenient lug.

Machinery and Workshop Equipment

Guards and interlocks are engineering controls, which is why defeating one is treated so seriously: it does not reduce the level of protection by a step, it removes the tier of the hierarchy the machine was designed around and leaves nothing but the operator's attention. A machine with a guard removed, an interlock bridged or a trip bypassed is taken out of service and tagged, not used carefully.

• Rotating machinery. No gloves, no loose clothing, no cuffs, no ties, no lanyards, no rings or wristwatches, and long hair tied back and covered. The workpiece is clamped rather than held; swarf is cleared with a brush or hook after the machine has stopped, never with fingers and never while it is running.
• Abrasive wheels. A grinding wheel is a pressure vessel of sorts — it stores rotational energy and fails explosively. Wheels are mounted only by a person trained and authorised to do so, after checking that the wheel's maximum speed is not less than the machine's spindle speed and after a ring test for cracks; the machine is then run up to speed from behind cover before use. In service, the work rest is kept adjusted close to the wheel so that the workpiece cannot be dragged into the gap, the guard and eye shield stay in place, and eye protection is worn regardless of the shield. Grinding on the side of a straight wheel not designed for side loading is a classic cause of wheel burst.
• Portable power tools. Inspected before use, protected by a residual current device, cables routed clear of walkways and sharp edges, and disconnected from the supply — or the air line — before changing a bit, blade or disc.
• Hot processes. Grinding, cutting and drilling produce hot chips and sparks that travel a surprising distance, so the hot-work precautions described earlier apply whenever this work is done near an aircraft, and screens are used to protect people and structure nearby.

Slips, Trips and Housekeeping

Slips and trips produce more workplace injuries than any other single mechanism, and in a hangar they have the additional property of putting somebody on the floor next to whatever they were carrying, or off the edge of a stand. The causes are almost always mundane and almost always fixable at the moment they arise:

• Fluid on the floor. Hydraulic fluid, oil and de-icing fluid on a painted or sealed hangar floor produce a surface with virtually no friction, and they spread further than they look. Spills are contained and cleaned immediately, not marked with a cone and left for the next shift.
• Trailing cables and air hoses. Route services overhead where possible, along walls where not, and across walkways only in a cable ramp.
• Clutter and changes of level. Packaging, offcuts, jack pads, chocks and toolboxes left in the walking route; unmarked steps, kerbs and pit edges; open floor panels and inspection hatches, which are guarded or covered as soon as they are opened.
• Poor lighting. Task lighting is brought to the job rather than working in the shadow of the aircraft, and general lighting failures are reported instead of tolerated.
• Footwear. Non-slip soles, in good condition, are part of the control and not a substitute for the other four.

"Clean as you go" is the operative principle, and it does double duty: the same discipline that keeps the floor safe to walk on keeps loose material out of the aircraft.

Hand-Arm Vibration

Riveting hammers, air chisels, needle scalers, die grinders and impact wrenches transmit vibration into the hands, and prolonged exposure causes hand-arm vibration syndrome: permanent damage to the small blood vessels and nerves of the fingers. The early sign is blanching of the fingertips triggered by cold, accompanied by tingling and numbness; as it progresses, grip strength and fine dexterity are lost — which for an aircraft engineer is an occupational disability as well as a personal one. Like noise damage, it is cumulative, painless in its early stages and irreversible.

European vibration legislation follows the same two-threshold pattern as noise, expressed as a daily exposure averaged over eight hours: an exposure action value of 2.5 m/s², at which the employer must assess and control the risk and provide health surveillance, and an exposure limit value of 5 m/s² which must not be exceeded. Because the figure is a daily dose, a high-vibration tool used for a short time can be equivalent to a low-vibration tool used all day — which is why the control is usually a combination of choosing lower-vibration tooling, keeping tools maintained and their consumables sharp, limiting trigger time, rotating the task between people, and keeping the hands warm and dry, since cold makes the vascular symptoms markedly worse.

Working Conditions

The physical conditions of the job are a safety control in their own right, because they act on the person doing it. Heat stress builds quickly inside a wing tank, on a ramp in summer or under a hangar roof, and it degrades concentration and decision-making before the person notices they are affected; the counter-measures are rotation, rest breaks out of the heat and access to drinking water. Cold has the mirror effect, reducing dexterity and grip on a winter line station and making a vibration exposure worse at the same time. Lighting has to be adequate for the inspection standard being applied, not merely for finding the fastener — a crack that could have been found under proper light is not "not there".

Environmental limits also apply directly to the work itself. Painting, sealing, bonding and composite repair all have temperature and humidity windows specified in the manual, outside which the material will not cure or bond correctly. A task carried out outside those limits produces a defect that may not be visible on completion, so the correct response to a hangar that is too cold, too damp or too dusty is to stop and reschedule the task rather than to press on and hope — which is the same conclusion, reached from the technical side, as the one the working-environment requirement reaches from the regulatory side.