ED Decision 2013/010/R
(a) Each fuel system must be constructed and arranged to ensure a flow of fuel at a rate and pressure established for proper engine functioning under each likely operating condition, including any manoeuvre for which certification is requested and during which the engine is permitted to be in operation.
(b) Each fuel system must be arranged so that any air which is introduced into the system will not result in –
(1) Reserved.
(2) Flameout.
(c) Each fuel system must be capable of sustained operation throughout its flow and pressure range with fuel initially saturated with water at 26.7°C (80°F) and having 0.20 cm3 of free water per litre (0.75 cm3 per US gallon) added and cooled to the most critical condition for icing likely to be encountered in operation.
[Amdt 25/12]
[Amdt 25/13]
CS 25.952 Fuel system analysis and test
ED Decision 2003/2/RM
(a) Proper fuel system functioning under all probable operating conditions must be shown by analysis and those tests found necessary by the Agency. Tests, if required, must be made using the aeroplane fuel system or a test article that reproduces the operating characteristics of the portion of the fuel system to be tested.
(b) The likely failure of any heat exchanger using fuel as one of its fluids may not result in a hazardous condition.
CS 25.953 Fuel system independence
ED Decision 2003/2/RM
Each fuel system must meet the requirements of CS 25.903(b) by –
(a) Allowing the supply of fuel to each engine through a system independent of each part of the system supplying fuel to any other engine; or
(b) Any other acceptable method.
CS 25.954 Fuel system lightning protection
ED Decision 2020/024/R
(See AMC 25.954)
(a) For the purposes of this paragraph—
(1) A critical lightning strike is a lightning strike that attaches to the aeroplane in a location that, when combined with the failure of any design feature or structure, could create an ignition source.
(2) A fuel system includes any component within either the fuel tank structure or the fuel tank systems, and any aeroplane structure or system components that penetrate, connect to, or are located within a fuel tank.
(b) The design and installation of a fuel system must prevent catastrophic fuel vapour ignition due to lightning and its effects, including:
(1) Direct lightning strikes to areas having a high probability of stroke attachment;
(2) Swept lightning strokes to areas where swept strokes are highly probable; and
(3) Lightning-induced or conducted electrical transients.
(c) To comply with subparagraph (b) of this paragraph, catastrophic fuel vapour ignition must be extremely improbable, taking into account the flammability, critical lightning strikes, and failures within the fuel system.
(d) To protect design features that prevent catastrophic fuel vapour ignition caused by lightning, the type design must include critical design configuration control limitations (CDCCLs) identifying those features and providing information to protect them. To ensure the continued effectiveness of those design features, the type design must also include inspection and test procedures, intervals between repetitive inspections and tests, and mandatory replacement times for those design features used in demonstrating compliance with subparagraph (b) of this paragraph. The applicant must include the information required by this subparagraph in the Airworthiness Limitations Section of the Instructions for Continued Airworthiness required by CS 25.1529.
[Amdt 25/18]
AMC 25.954 Fuel system lightning protection
ED Decision 2020/024/R
TABLE OF CONTENT
1 PURPOSE
2 APPROACH TO COMPLIANCE
2.1 Summary
2.2 Compliance tasks
2.3 Identify the design features and elements of the fuel system that require lightning assessment
2.4 Determine the lightning strike zones
2.5 Establish the aeroplane lightning environment
2.6 Develop a lightning protection approach and design lightning protection features
2.7 Identify potential failures of the design and protection features
2.8 Identify potential ignition sources associated with the design features and potential failures
2.9 Perform a safety assessment to determine fault tolerance and non-fault tolerance
3 PROVIDE RELIABLE FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES
3.1 Provide fault-tolerant lightning protection
3.2 Demonstrate effective fault-tolerance
3.3 Demonstrate protection reliability
3.4 Demonstrate compliance with the ‘extremely improbable’ requirement
4 ASSESS NON-FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES
4.1 Overview
4.2 Qualitative assessment of non-fault-tolerant conditions
4.3 Quantitative assessment of non-fault-tolerant conditions
4.4 Evaluating non-fault-tolerance for systems
5 ESTABLISH AIRWORTHINESS LIMITATIONS
Appendix A. Definitions
Appendix B. Section 4 examples
1 PURPOSE
This AMC describes the tasks that should be accomplished to show compliance with CS 25.954 for lightning protection of the aeroplane fuel system. These tasks may be accomplished in a different order than that listed below, and some tasks may require iterations.
This AMC also provides a method of compliance appropriate for reliable fault‑tolerant and non‑fault‑tolerant protection for lightning ignition sources. Any non-fault-tolerant lightning protection in an aeroplane fuel system will, in order to comply with the method of compliance set forth in this AMC, need a thorough assessment for the likelihood of failures, lightning strikes and attachment locations, and fuel tank flammability.
2 APPROACH TO COMPLIANCE
2.1 Summary
The method in this AMC divides the design features for fuel system lightning protection into three categories: intrinsically safe, fault tolerant, and non-fault tolerant. It also describes how applicants should develop material for the Airworthiness Limitations Section of the ICA.
2.1.1 Guidance for incorporating intrinsically safe design features into the fuel tank system is provided in paragraph 2.9.4.1.
2.1.2 Section 3 provides guidance on compliance with CS 25.954(b) for fault-tolerant lightning protection designs.
2.1.3 Section 4 provides guidance on compliance with CS 25.954(b) for non‑fault‑tolerant lightning protection designs.
2.1.4 Section 5 provides guidance on developing CDCCLs and other tasks that must be placed in the Airworthiness Limitation Section of the ICA.
2.2 Compliance tasks
The applicant should accomplish the following tasks to comply with CS 25.954:
— Identify the design features and elements of the fuel system that require lightning assessment (paragraph 2.3);
— Determine the lightning strike zones (paragraph 2.4);
— Establish the aeroplane lightning environment (paragraph 2.5);
— Develop a lightning protection approach and design lightning protection features (paragraph 2.6);
— Identify the potential failures of the design and protection features (paragraph 2.7);
— Identify the potential ignition sources associated with the design features and potential failures (paragraph 2.8);
— Perform a safety assessment to determine fault tolerance and non-fault tolerance (paragraph 2.9);
— Provide reliable fault-tolerant protection for lightning ignition sources (paragraph 3);
— Assess non-fault-tolerant protection for lightning ignition sources (paragraph 4); and
— Establish the Airworthiness Limitations (paragraph 5).
2.3 Identify the design features and elements of the fuel system that require lightning assessment
To comply with CS 25.954(b), the applicant should identify the fuel system design features and elements for the fuel tank structure, system components, and equipment that require lightning assessment to show that the ignition of fuel vapour within the systems due to lightning and its effects is prevented. The design features and elements may be categorised into design groups that share characteristics that have similar lightning protection performance. The applicant should provide a detailed description of the fuel system, including:
— structural members and fasteners exposed to direct and swept lightning attachment;
— structural joints and fasteners exposed to conducted-lightning current resulting from lightning attachment;
— access doors, vents, drain valves, fuel filler ports, and other parts and components of the fuel system exposed to direct lightning attachment or conducted lightning currents; and
— electrical, mechanical, hydraulic, and fuel plumbing system installations within the fuel tank or connected to the fuel tanks exposed to direct lightning attachment or conducted lightning current.
2.4 Determine the lightning strike zones
Lightning strike zones define locations on the aeroplane where lightning is likely to attach and structures that will conduct lightning current between lightning attachment points. The applicant should determine the lightning strike zones for the aeroplane configuration, since the zones will be dependent upon the aeroplane geometry and operational factors. Lightning strike zones often vary from one aeroplane type to another.
EUROCAE document ED-91A, ‘Aircraft Lightning Zoning’, dated January 2019 and the equivalent SAE ARP5414B dated December 2018, are acceptable standards providing guidelines on determining the lightning strike zones for the aeroplane, the areas of direct lightning strikes, areas of swept lightning strokes, and areas of conducted electrical transients. When determining the probability of lightning attachment to certain regions of the aeroplane, applicants should use data from similar aeroplane configurations to substantiate any assumed strike attachment rate for the region.
2.5 Establish the aeroplane lightning environment
The fuel tank structure, system components, and equipment that are located in lightning zones 1 and 2 should be designed for lightning direct-attachment waveforms. EUROCAE document ED-84A, ‘Aircraft Lightning Environment and Related Test Waveforms’, dated July 2013, and the equivalent SAE ARP5412B dated January 2013, are acceptable standards providing guidelines on acceptable lightning current and voltage waveforms for lightning zones 1 and 2. The fuel tank structure, system components, and equipment that are exposed to conducted currents should be assessed to determine the appropriate lightning current and voltage waveforms and amplitudes, using the conducted current waveforms for zone 3 in EUROCAE ED-84A/SAE ARP5412B. The applicant may use analyses or tests to assess the conducted currents and voltages for the structure, system components, and equipment. Margins should account for any uncertainty of the analysis or test. Simple analyses of the lightning currents and voltages should incorporate larger margins than the lightning currents and voltages that were calculated using detailed computational models that have been validated by tests.
2.6 Develop a lightning protection approach and design lightning protection features
The applicant should develop the lightning protection approach and design lightning protection features required to provide effective lightning protection for all the fuel system design features and elements identified in paragraph 2.3 of this AMC. See paragraphs 3.2 and 4.1.2 for further guidelines on how to demonstrate an effective protection. The lightning protection features can include specific installation requirements, such as hole-size tolerance for fasteners or surface cleaning for sealant application. Other lightning protection features can include specific protection components, such as metal mesh incorporated into the outer surface of composite structures. The design should provide reliable lightning protection that prevents lightning–related ignition sources if a potential failure occurs in the lightning protection features. When possible, the design should place fuel system components — such as fuel tank vents, drain valves, jettison tubes, filler ports, and access doors — in lightning attachment zone 3, so they are less likely to be exposed to direct lightning attachment.
2.7 Identify potential failures of the design and protection features
2.7.1 The applicant should:
— identify the potential failures, due to causes that include manufacturing escapes*, operational deterioration**, and accidental damage***, that may lead to the loss or degradation of lightning protection;
— identify, by analysis or test, the design elements that could degrade the effectiveness of lightning protection;
— identify failures through a detailed review of manufacturing processes, material properties, structural design, systems design, and reliability and maintainability processes;
— use the available manufacturing discrepancy reports, in-service failure reports, and developmental tests to identify potential failures; and
— account for failures such as structural cracking, corroded or failed electrical bonding features, and mis-installed electrical bonding features that occur during manufacturing or maintenance.
*Manufacturing escapes for fuel tank structure include fastener selection issues (incorrect fastener sizes, types, finishes, or coatings), fastener assembly issues (misalignment, incorrect torque, hole size or quality, missing or extra washers), and installation issues (inadequate or improperly adhered sealant, missing cap seals, incorrectly installed electrical bonds). Manufacturing escapes for fuel system components and equipment include design configuration issues (incorrect fasteners, wrong or missing clamps or brackets, inadequate or improperly adhered sealant, missing or incorrect finishes), bonding issues (a missing or improperly installed electrical bond or wiring shield), and clearance issues (insufficient tube or wiring clearance to adjacent systems or structure).
**Structural failures due to operational deterioration during intended operation include broken or cracked elements (fasteners or washers), corrosion, degradation of applied materials (sealants, fastener head coating, edge glow protection, or bonded joints), and fatigue issues (loose fasteners or structural cracks). System failures due to operational deterioration include failures of support features (loss of fasteners, brackets, or clamps that support tubes, EWIS or components) and degradation of electrical bonds, wire insulation or shielding due to corrosion, ageing, or wear.
***Structure or system failures due to accidental damage include impact from foreign object debris (FOD) or inadvertent damage incurred during alterations, repairs, or inspections.
2.7.2 The severity or types of failures should be defined and can be based on service history, where appropriate, and laboratory test data. The severity of the failure should be consistent with or bounded by the assumptions made for the structural and systems certification analyses. The severity or types of failures due to manufacturing escapes should be based on manufacturing discrepancy reports, such as rejection tags, manufacturing process escape assessments, and assessments of process improvements.
2.7.3 Manufacturing variability and environmental conditions should be considered in conjunction with failures. Combining worst-case conditions for all manufacturing variabilities and environmental conditions is overly conservative and not necessary. Failures due to operating or environmental conditions other than those required for certification do not need to be considered. Combinations of failures where one failure also causes a second failure to occur should be considered as a single failure condition (i.e., a common cause or cascading failure).
2.8 Identify potential ignition sources associated with the design features and potential failures.
2.8.1 Fuel system fasteners, structures, equipment, and components that are exposed to direct lightning attachment in lightning zones 1 and 2 should be assessed using the lightning waveforms identified in paragraph 2.5 of this AMC. Fuel system fasteners, structures, equipment, and components should also be assessed for conducted lightning currents. If the aeroplane uses novel or unusual materials, structures, or configurations, the applicant should evaluate the fuel system fasteners, structures, equipment, and components on the outside surface of the aeroplane located in lightning zone 3 using the nominal zone 3 direct lightning attachment waveforms defined in EUROCAE ED‑84A/SAE ARP5412B. The use of materials that are not highly conductive for the structure of fuel tanks is considered unusual. Lightning attachment in zone 3 is defined as unlikely in EUROCAE document ED‑91A, ‘Aircraft Lightning Zoning’, dated January 2019, and the equivalent SAE ARP5414B dated December 2018, so the evaluation does not need to consider failures in combination with such an attachment, but should demonstrate that no catastrophic effect will occur when no failures are present.
2.8.2 The following paragraphs list ignition source types and examples of how ignition sources might occur:
2.8.2.1 Voltage sparks are the result of the electrical breakdown of a dielectric between two separated conductors. Voltage sparking might occur, for example, between the fastener and its hole or through an insulation layer between the base of a nut and a conductive surface. A voltage spark could occur between a fuel tube and the adjacent structure if the separation is insufficient or the bonding to minimise the voltage potential has failed. If this spark is exposed to fuel vapour, an ignition may result. Laboratory tests have shown that the minimum ignition energy in a voltage spark required to ignite hydrocarbon fuel vapour is 200 microjoules*.
*The 200-microjoule level comes from various sources. The most quoted is from Lewis and von Elbe’s book, Combustion, Flames and Explosions of Gases (Florida: Academic Press, Inc., 1987; (orig. publ. 1938)). It has a set of curves for minimum ignition energy for the various hydrocarbon compounds in jet fuel, and they all have similar minimum ignition energy levels of greater than 200 microjoules.
2.8.2.2 Thermal sparks are the result of burning particles emitted by the rapid melting and vaporisation of conductive materials carrying current through a point contact. Thermal sparks can occur when there is a small contact area between a fastener and the hole material, or between a fastener collar and the underlying structure. Thermal sparks can occur at a point contact between a fuel tube and the adjacent structure if the contact point conducts a high current. When sealant or caps are used to contain sparks, failures could result in the internal pressures from the heat of thermal sparks that force hot particles past the sealant or cap, resulting in sparks in the fuel vapour area.
2.8.2.3 Analyses and tests indicate that a small piece of steel wool will ignite a flammable mixture when a transient current of approximately 100 milliamperes (mA) peak is applied to the steel wool*.
*This data was from testing performed by the FAA Technical Center, Report DOT/FAA/AR-TN05/37, Intrinsically Safe Current Limit Study for Aircraft Fuel Tank Electronics. Applicants may conduct testing to substantiate alternate values.
2.8.2.4 Edge glow includes voltage or thermal sparks that occur at the edges of carbon-fibre composite material when lightning current and voltage cause a breakdown of the resin between fibres. Failures of the protection features to prevent edge glow should be identified.
2.8.2.5 Fuel vapour ignition due to lightning near fuel vent outlets can result in flame propagation into the fuel system. When lightning attaches near fuel vent outlets, the ignition of fuel vapour results in a high-speed pressure wave that can travel through the flame arrestor without sufficient time for the flame arrestor to quench the flame front. The vent outlets should be located outside the lightning direct-attachment zones of the aeroplane. If the vent outlets are located in lightning direct‑attachment zones, flame arrestors have been used to prevent lightning-ignited fuel vapour from propagating into the fuel system. Specific lightning tests and unique design features are typically needed to demonstrate the effectiveness of the lightning-protection for these installations. (Lightning effects are not addressed in the fuel tank vent fire protection requirements of CS 25.975(a)(7).
2.9 Perform a safety assessment to determine fault-tolerance and non-fault-tolerance
2.9.1 The applicant should perform a safety assessment to determine whether the fuel system design provides acceptable fuel system lightning protection based on the design features and potential ignition sources due to failures of the design features identified in the previous steps. The applicant may perform the safety assessment on groups of fuel system design elements and lightning protection features with similar physical and electrical characteristics. For non-fault-tolerant features, an assessment must show, per CS 25.954(c), that the sum of the probability of failures from potential ignition sources in combination with the probability of a critical lightning strike and the fuel tank being flammable does not exceed extremely improbable. The applicant should provide its rationale for assigning design elements and lightning protection into groups.
2.9.2 The safety assessment should address all the fuel system design elements identified in paragraph 2.3 of this AMC, the lightning environment at the locations for those elements identified in paragraphs 2.4 and 2.5 of this AMC, and the failures identified in paragraph 2.7 of this AMC. The applicant should also use the safety assessment to identify where analyses or tests are necessary to demonstrate the prevention of fuel system ignition sources.
2.9.3 The applicant should use a rigorous and structured safety assessment approach. The structured safety assessment and associated fault-tolerance assessment and test reports should be part of the substantiating data. Failure modes and effects analyses are acceptable structured safety assessment tools, particularly for non‑fault tolerant lightning protection features. All the failure modes and effects analyses (FMEAs) and fault tree analyses (FTAs) should be included and thoroughly annotated. The applicant should substantiate and document all the assumptions used in performing the safety assessment.
2.9.4 The safety assessment should divide all the lightning protection features of the fuel system into the following three categories:
2.9.4.1 Intrinsically safe lightning protection
Some fuel system design elements provide effective lightning protection with no foreseeable failure modes that would render them ineffective. These design elements have no failures or combinations of failures that can result in an ignition source. This can be due to reliable design or to a very low lightning voltage or current in that specific location. The applicant should identify any intrinsically safe fuel system design elements. An example of an intrinsically safe design element would be highly conductive fuel tank skins with sufficient thickness to ensure that lightning attachment to the skin will not result in hot-spot or melt-through ignition sources in the tank. Another example would be a structural element designed with sufficient margins that fatigue cracking is not foreseeable. A third example could be fasteners or joints located in the fuel tank structure where the lightning current density is so low that an ignition source will not result even when failure conditions are present.
2.9.4.2 Fault-tolerant lightning protection
Fuel system design elements that are not intrinsically safe and require design features to provide lightning protection should be designed so that a failure associated with these elements or features will not result in an ignition source. Reliable fault-tolerant prevention of lightning ignition sources, in combination with the control of fuel tank flammability required by CS 25.981 and the statistics of lightning strikes to aeroplanes, is acceptable for showing compliance with CS 25.954(c). Detailed guidance for showing compliance for reliable fault-tolerant lightning protection is provided in Section 3 of this AMC.
2.9.4.3 Non-fault-tolerant lightning protection
Experience has shown that it is impractical to provide fault-tolerant features, or indications of failures, for some failures that occur in the aeroplane structure. Certain fuel system design elements and lightning protection features could have conditions where a single failure of these elements or features results in an ignition source when combined with a critical lightning strike. These fuel system design elements, lightning protection features, and failures require detailed and thorough safety assessment to determine whether the fuel system design complies with CS 25.954(b). It is likely that the aeroplane fuel system design and lightning protection can have only a very small number of these non‑fault‑tolerant lightning protection conditions and still show that the risk of a catastrophic event is extremely improbable to comply with CS 25.954(c). Section 4 of this AMC provides more detailed guidelines for showing compliance for non-fault-tolerant lightning protection.
3 PROVIDE RELIABLE FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES
3.1 Provide fault-tolerant lightning protection
Fault-tolerant lightning protection for ignition sources on fuel tank structure and systems has been shown to be generally practical and achievable. Compliance with CS 25.954(b) for most fuel system elements (equipment, components, and structures) that are not intrinsically safe should be demonstrated by showing that the lightning protection is effective, reliable, and fault tolerant.
3.2 Demonstrate effective fault tolerance
3.2.1 The substantiation process should involve tests or analyses on the fuel system design elements and features on which faults are induced. These tests and analyses should address both lightning direct attachment to the fuel system design elements and features, and conducted lightning currents on them, as applicable. Where tests are performed, the following steps outline an approach to reduce the number of tests by grouping the design elements and features and the associated failures. In each step, the assumptions should be documented.
3.2.2 The test process can be summarised in four steps:
1. Select the test articles that will be used for assessing fault tolerance. A design review may be used to develop groups, or for classification of the fuel system design elements and features. For example, fasteners could be grouped by the types of fasteners (such as rivets, bolts, and collars). The groups could be differentiated by the materials (such as aluminium, steel, titanium, stainless steel, etc.), or by the manufacturing processes (such as interference fit holes, cap seals, insulating laminate plies, material thicknesses, etc.).
2. Assess the faults (including ageing, corrosion, wear, manufacturing escapes, and any foreseeable in-service damage) to determine the worst-case failures that could render the fault tolerance ineffective. Determination of the worst-case failures should be justified with engineering tests, previous certification tests, analyses, service experience, or published data.
3. Determine the lightning current amplitudes and waveforms in the fuel system design elements and features due to direct lightning attachment and conducted lightning currents, as applicable. The lightning environments were previously identified in the hazard assessment above.
4. Conduct tests using the current amplitudes and waveforms derived from step 3 and the faults defined in step 2 to demonstrate that the design prevents ignition sources when a fault occurs.
3.2.3 Assessment of system failure conditions generally involves first assessing the result of the failure condition. For example, the loss of a means of electrical bonding at a penetration of a fuel system tank may cause higher currents or voltages on components located within the fuel tank. The loss of a wire bundle shield or a shield termination may also cause higher voltages in the fuel systems. Assessment of these effects may involve analyses, tests, or a combination of test and analysis. Scaling based on the relative distances from the attachment locations, distances for structural conductors, lengths of system elements, etc., may all be necessary to establish the worst‑case threats.
3.2.4 Computational analyses or tests of representative tank sections may be used to determine the lightning current and voltage amplitudes and waveforms within the fuel system. The applicant should determine the currents, voltages, and associated waveforms that are expected on each feature or element of the fuel system, and use these current and voltage waveforms for tests on representative fuel system parts, panels, or assemblies. Analyses should be validated by comparisons of the analysis results with test results from fuel system configurations that are similar to the fuel system to be certified. The applicant should apply appropriate margins based on the validation results.
3.2.5 The applicant should conduct lightning tests using test articles that acceptably represent the relevant aspects of the proposed aeroplane fuel system features and elements. The test articles should incorporate the identified failures needed to demonstrate fault-tolerant lightning protection. When performing these tests, the configuration of the design and protection features and elements should address the effects of ageing, corrosion, wear, manufacturing escapes, and likely damage. The possibility of cascading failure effects on redundant features (e.g., fasteners fracturing and compromising sealant directly or over time) should also be considered as part of the assessment when determining what level of fault insertion testing is needed. Guidelines for lightning test methods are provided by EUROCAE ED-105A ‘Aircraft Lightning Test Methods’, dated July 2013, and the equivalent SAE ARP5416A dated January 2013. Lightning tests are typically needed to demonstrate that fuel tank vent flame arrestors prevent fuel ignition from propagating into the fuel system if the vent outlets are located in lightning direct‑attachment zones. The tests and analyses should be documented as part of the substantiating data.
3.3 Demonstrate protection reliability
3.3.1 The applicant should identify the protection features, and qualitatively establish their reliability, using the service experience of similar protection features or other means proposed to, and accepted by, EASA. For example, the interference fit of a fastener in a hole may be established as a reliable protection feature based on service experience that interference fit fasteners do not loosen appreciably over the life of the aeroplane. Likewise, dielectric or physical separation of systems from structures may be established as a reliable protection feature, provided that similar dielectric material or support installations have been shown in service or by tests to perform their function adequately for the life of the aeroplane. Where the reliability of a fault-tolerant feature cannot be established to typically exceed the life of the aeroplane, then the appropriate replacement time, inspection interval, and related inspection and test procedure must be included in the Airworthiness Limitations Section of the ICA to ensure the effectiveness of the protection, in accordance with CS 25.954(d). Airworthiness Limitation requirements are discussed in Section 5 of this AMC.
3.3.2 The applicant should address failures that can occur in service due to ageing and wear, and failures that can escape the manufacturing processes. For example, the anticipated escapes should include past manufacturing escapes. Any process changes that are implemented to preclude a specific type of escape may be considered if they preclude future escapes. The applicant should consider training to ensure the compliance with the manufacturing process, implement designs that preclude escapes, automate reliable and repeatable drilling and assembly, and monitor process errors.
3.4 Demonstrate compliance with the ‘extremely improbable’ requirement
3.4.1 The characteristics of lightning, the frequency of aeroplane lightning strikes, and the fuel tank flammability exposure are factors that affect the likelihood of lightning causing a catastrophic fuel vapour ignition. CS 25.981(b) limits the fuel tank fleet average flammability exposure to three per cent of the flammability exposure evaluation time, or that of a conventional unheated aluminium wing tank. The worldwide transport aeroplane lightning strike rate is of the order of once in several thousand flight hours.
3.4.2 The standard lightning waveforms in the EUROCAE/SAE standards are based on the combinations of severe lightning characteristics using a current amplitude, energy, rise time, and pulse repetition that conservatively exceed the majority of recorded values. Most aeroplane lightning strikes have significantly lower current values of amplitude, duration, energy transfer, rise time, and pulse repetition than the severe characteristics in EUROCAE ED-84A/SAE ARP5412B. This reduces the likelihood of a lightning-related ignition source even when the fuel system lightning protection effectiveness has degraded from what is demonstrated using the standard lightning waveforms in EUROCAE ED-84A/SAE ARP5412B.
3.4.3 The probability of occurrence of a lightning strike attaching to, or conducting currents through, the fuel system during flammable conditions, at a sufficiently severe level represented by the test levels of EUROCAE ED-84A/SAE ARP5412B, is remote by itself. Remote failure conditions are defined in AMC 25.1309 (Qualitative Probability Terms).
3.4.4 If shown to be effective and reliable, fault-tolerant lightning protection complies with CS 25.954(c) without further analysing the probability of the failures, taking into account the remote probability of the environmental conditions discussed above. The applicant should show that the fault‑tolerant lightning protection features are designed and installed to be effective over their life or the life of the aeroplane or with appropriate inspections and maintenance. Lightning protection features and elements that have shown their reliability in service by adequate documented service history data on previous similar designs may be incorporated into the fault-tolerant design.
4 ASSESS NON-FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES
4.1 Overview
4.1.1 Fuel system configurations and failure conditions that result in non-fault-tolerant ignition sources should be minimised and precluded where practical. If the design is identified to be non‑fault‑tolerant, the design should be re-evaluated to determine whether practical measures could be implemented to make it fault tolerant. Wherever practical, fault-tolerant design protection features and elements should be implemented and assessed. ‘Practicality’ is defined as a balance of the available means, economic viability, and proportional benefit to safety. A means to provide fault tolerance that is possible with little economic impact is practical even if an event is not anticipated to occur in the life of an aeroplane without it. If the applicant determines that the fault-tolerant prevention of ignition sources is impractical for a specific design feature or failure, the applicant should review this determination of impracticality for concurrence with EASA.
4.1.2 For design features and elements that have failures where the fault-tolerant prevention of ignition sources is impractical, the applicant should assess these non‑fault-tolerant design features and elements to demonstrate that, taken together, the likelihood of a catastrophic fuel vapour ignition resulting from a lightning strike and flammable fuel tank conditions is extremely improbable. To successfully demonstrate this, it will likely be necessary to show that the probability of occurrence of such a fault is extremely remote and limited to a very small number of design features and elements. To support the results of the assessment, maintenance considerations have to be identified in order to maintain the aeroplane in this state during the life of the aeroplane. Analysis and similarity can be used, but similarity should include the similarity of the design, similarity of the current density at the design feature, and similarity of the production and maintenance conditions. Agreement with the authorities on the use of similarity should be achieved before this approach is used. In many instances, a specific manufacturer’s limited experience may not be representative of the overall transport fleet experience.
4.1.2.1 See Appendix B, paragraph B.1 of this AMC for examples of design elements or features where providing fault-tolerant prevention of lightning ignition sources should be practical.
4.1.2.2 See Appendix B, paragraph B.2 of this AMC for examples of design features or failures where providing fault-tolerant prevention of lightning ignition sources could be impractical.
4.1.2.3 See Appendix B, paragraph B.3 of this AMC for examples of design, manufacturing, and maintenance processes that may be useful in establishing compliance.
4.1.3 Applicants should identify all the potential non-fault-tolerant design and protection features early in their design process. All practical measures to provide intrinsically safe protection and fault‑tolerant prevention of ignition sources should be incorporated, which is more easily accomplished early in the design process.
4.1.4 Applicants should establish the probabilities of the flammable conditions within the fuel system where non-fault-tolerant features are present.
4.1.5 Once the probabilities of flammable conditions and the probabilities of critical lightning strikes occurring within the fuel system are defined, an evaluation of the potential for the occurrence of a structural discrepancy within the fuel system can be performed. When the probability of lightning attachment to certain regions of the aeroplane is included in the compliance approach, applicants should use data from similar aeroplane configurations to substantiate any assumed strike attachment rate.
4.1.6 Regardless of whether it is practical to provide fault-tolerant prevention of fuel system lightning ignition sources, compliance must demonstrate that the combined risk of catastrophic fuel vapour ignition due to lightning is extremely improbable. The assessment can be a qualitative analysis, a quantitative analysis, or a combination of both. The applicant should use the method that is most appropriate for the specific design. Where the protection means are reliable, the potential failure modes are rare, and limited service data is available to accurately determine the failure rates, a qualitative assessment is most appropriate. If the failure rates are available and a numerical assessment could be reasonably accurate, a quantitative assessment may be appropriate. If the potential failures are so common that the rates are well established, it is unlikely that a non‑fault‑tolerant design could be shown to be compliant without frequent maintenance checks. Combinations of failures where one failure also causes a second failure to occur should be considered as a single failure condition (i.e., a common cause or cascading failure). Combinations of independent failure modes that are expected to occur need to be considered.
4.2 Qualitative assessment of non-fault-tolerant conditions
4.2.1 The qualitative assessment must demonstrate that fuel vapour ignition due to lightning is extremely improbable, including the contribution of non-fault-tolerant features and elements. One means of assessing the risk of a catastrophic event due to failures of non-fault-tolerant features is to demonstrate that the potential ignition sources due to the failure conditions are also remote (per the AMC 25.1309 definition) for designs where fault-tolerant protection features are impractical.
4.2.2 Remote failure condition is defined in AMC 25.1309.
4.2.3 The qualitative assessment should account for the design features to limit failures, the conditions necessary for a failure to result in an ignition source, and any means used to limit the occurrence or latency of a failure. The applicant should evaluate the design’s ability to safely conduct the lightning current densities and to prevent the lightning current flow.
4.2.4 A qualitative non-fault-tolerance assessment should show that combinations of service conditions, such as vibration, humidity, temperature changes, and maintenance activities, cannot produce an ignition source when exposed to voltages or currents resulting from lightning strikes to the aeroplane.
4.2.5 The following paragraphs (4.2.5.1 to 4.2.5.4) identify the areas that should be addressed for structural discrepancies within a fuel system.
4.2.5.1 Evaluation of non-fault tolerance should include consideration of structural discrepancies resulting from overstress, ageing, fatigue, wear, manufacturing defects, and accidental and environmental damage. Damage includes conditions that could be reasonably anticipated to occur in the life of an individual aeroplane due to operation and scheduled and unscheduled maintenance. In addition, probable manufacturing escapes in the production process should be considered as probable failures.
4.2.5.2 The determination of the potential for a non-fault-tolerant condition resulting in a lightning‑related ignition source should be based on appropriate assessments. The objective of these assessments is to demonstrate that, for the combination of all the discrepant conditions in a fuel tank vapour zone (i.e. ullage), the exposure time of the non‑fault‑tolerant feature to a lightning‑induced electrical current density of sufficient magnitude to become an ignition source will be minimised to such a degree that a catastrophic failure due to a lightning strike is not anticipated during the entire operational life of all the aeroplanes of that type. In performing the assessments to determine the potential for a non‑fault‑tolerant condition to result in a lightning-related fuel vapour ignition, the following factors should be collectively considered, addressed, and documented:
4.2.5.2.1 Analysis of the electrical current densities within the fuel tank structure considering its material properties and configuration;
4.2.5.2.2 Analysis and test data necessary to support the likelihood of occurrence of a critical lightning strike at a particular location on the aeroplane where a discrepancy exists;
4.2.5.2.3 Analysis and test data necessary to support any conclusion that the electrical current density generated by a lightning strike in the specific vicinity of a structural crack or broken fastener in the fuel tank will not be of sufficient amplitude to cause sparking;
4.2.5.2.4 Analysis and test data necessary to support the likelihood of the fuel tank being flammable; and
4.2.5.2.5 Evaluation of the fuel tank structure in all areas of the fuel tank that may be susceptible to a fuel vapour condition and at electrical current densities that can result in a lightning-related ignition. This should include assessing the structure’s:
1. Susceptibility to failure (such as cracking, delamination, fastener failures, failed fastener cap seals, failed sealant, etc.);
2. Inspectability (determining whether discrepant structure could be reliably inspected such that the exposure time of the failure to a critical lightning strike will be reduced to a level that supports the safety objective);
3. Service data (reports of failed structures such as cracks, delamination, failed fasteners, failed fastener cap seals, or sealant that could become an ignition source);
4. Maintenance inspection programs (determining whether inspections will reliably detect failures and discrepancies such that their exposure times will be reduced to a level that supports the safety objective). This includes mandated inspections (e.g., the Airworthiness Limitations Section of the ICA required by Section H25.4 of Appendix H to CS-25 and CS 25.1529); and
5. Fatigue and damage-tolerance evaluation of the crack initiation/propagation rate, crack characteristics (e.g., crack width versus crack length or edge crack versus crack at or near a fastener hole), the detectable crack size, probability of detection, inspection threshold, and inspection interval.
4.2.5.3 See Appendix B of this AMC for an example of an assessment process addressing the potential for fuel tank structural cracking.
4.2.5.4 The qualitative assessment should consider any means used to ensure that the probability of a combination of faults will be remote. However, it cannot include the likelihood of lightning attaching to the aeroplane, or the flammability of the fuel tanks.
4.2.5.5 Figure 1 of this AMC provides a guide to the qualitative assessment process. Each of the activities in the qualitative assessment process, shown in Figure 1, is discussed in the paragraphs that follow.
Figure 1. Assessing the Combined Risk of All Non-Fault-Tolerant Failures
4.2.5.6 Figure 1, Item (1).
The first step is to determine whether there are design features or elements that do not provide fault‑tolerant lightning protection, as described in paragraph 2.9.4.3.
4.2.5.6.1 When a failure is considered possible, qualitatively assess with supporting test data and fleet experience to determine whether the condition is likely to occur in the life of the aeroplane fleet. This supporting data may include:
— Lightning testing relevant to specific or similar design features (see paragraph 2.3 of this AMC);
— Dielectric strength testing of insulating materials and structures such as brackets, clamp cushions, air gaps, and wire harness insulation;
— Field service reports or databases related to the non-fault-tolerant condition being assessed;
— Engineering tests to determine the durability of features, such as fatigue tests, thermal cycling tests, or corrosion tests;
— Fleet experience may also be used to estimate the likelihood of failures. The determinations should be based on conservative assumptions;
— Service experience records of manufacturing or maintenance escapes, if available; and
— Manufacturing records for defects found.
4.2.5.6.2 It may be possible to demonstrate that a design feature or element will perform similarly to a previously certificated design or design feature under foreseeable lightning threats. If applicable, provide a comparative analysis of similar design features and details on a previously certified aeroplane. The comparative analysis would include a detailed assessment of the design features and details that affect susceptibility to failure, exposure time to lightning environment, service experience, and any applicable analyses and test data.
4.2.5.7 Figure 1, Item (2).
Assess the probability of the failure condition occurring. If this failure is latent for a long time, or the failure could occur at many locations that are exposed to conducted lightning currents, the likelihood of that failure resulting in an ignition source could be significant.
4.2.5.8 Figure 1, Item (3).
Evaluate the likelihood of lightning attaching in the vicinity of non‑fault‑tolerant features and resulting in a current of sufficient amplitude to cause an ignition source at those features. Appropriate factors to consider include:
1. The possibility of lightning attachment to locations on the surface of the aeroplane near the failed non-fault-tolerant features.
2. The lightning-related ignition source threshold current for each of the failed non-fault-tolerant features. This is the lightning current amplitude that would result in an ignition source at the failed non‑fault‑tolerant feature.
3. The amplitude of the lightning current that would be necessary to produce a conducted current that would exceed the ignition source threshold.
4.2.5.8.1 Failed features within fuel systems will usually tolerate some lightning current without producing an ignition source. Above this threshold, an ignition source can occur. The lightning current amplitude, charge transfer, and action integral that result in an ignition source can be determined by tests on parts and panels that incorporate the structural features in a defined fault condition.
4.2.5.9 Figure 1, Item (4).
Consider any factors that may be used to ensure the integrity of the installations. A specified inspection interval can be proposed to detect the failure. Additional manufacturing controls may be implemented to minimise the occurrence of defects and escapes during production.
4.2.5.10 Figure 1, Item (5).
The qualitative assessment should consider all the potential non‑fault‑tolerant features and determine whether the probability of a combination of the potential for ignition sources due to failures of these features is remote. Broken fasteners and structural cracks are two failures where the applicant may find it impractical to demonstrate fault-tolerant protection. The applicant is responsible for demonstrating that ignition sources created by the combination of a non-fault-tolerant failure, a flammable environment, and a lightning strike of sufficient amplitude to result in an ignition source will be extremely improbable.
4.3 Quantitative assessment of Non-fault-tolerant conditions
4.3.1 Quantitative assessment of non-fault-tolerant features can be used. The quantitative assessment must demonstrate that fuel vapour ignition due to lightning is extremely improbable, including the contribution of non-fault-tolerant features and elements. However, to do this, there must be a reasonable amount of reliable data for the rate of failures.
4.3.2 The following four conditions should be evaluated collectively:
1. The probability of the occurrence of a flammable condition within a fuel tank in the vicinity of an ignition source due to lightning.
2. The probability of the occurrence of a lightning strike of sufficient intensity to produce an ignition source at a failed non-fault-tolerant design feature.
3. The potential for the presence of a failure of a non-fault-tolerant protection feature within a fuel system.
4. The total number of non-fault-tolerant features.
4.3.3 The same factors for a qualitative assessment should be considered for the quantitative assessment approach. The additional step is to quantify each of these factors for use in the numerical assessment. A fault tree analysis (discussed in paragraph 2.9.3 of this AMC) may be used to determine whether the combined risk of the non-fault-tolerant conditions is unlikely to result in a catastrophic event over the life of the fleet. From a numerical perspective, a probability of the order of 10‑9 per flight hour or less is the accepted standard for demonstrating that the combined risk, including all failures, is extremely improbable.
4.4 Evaluating non-fault-tolerance for systems.
Fuel, mechanical, hydraulic, and electrical components that penetrate, are located within, or are connected to the fuel tanks have typically been able to provide fault‑tolerant design capability. These components include the associated clamps, shields, supports, bonding straps, and connectors. It is therefore expected that applicants will develop fault-tolerant designs for these components.
5 ESTABLISH AIRWORTHINESS LIMITATIONS
CS-25, Appendix H, Section H25.4, Airworthiness Limitations Section, requires mandatory replacement times, inspection intervals, and related inspection and test procedures for the lightning protection features that are approved under CS 25.954. Section H25.4(a)(6) requires CDCCLs, inspections and tests, and mandatory replacement times to be located in a section of the ICA titled ‘Airworthiness Limitations.’
5.1 Critical design configuration control limitations
5.1.1 The applicant must establish CDCCLs to protect features that prevent lightning‑related ignition sources within their fuel systems. This requires the applicant to identify the lightning protection design features, as well as to prepare instructions on how to protect those features. Identification of a feature refers to listing the feature in the CDCCL. During aeroplane operations, modifications, and unrelated maintenance actions, these features can be unintentionally damaged or inappropriately repaired or altered. Instructions on protection are meant to address this safety concern. An example of a common design feature to prevent ignition sources caused by wiring is wire separation so that wires cannot chafe against one another or against structure or other components. An example of an instruction on how to protect this design feature would be ‘When performing maintenance or alterations in the vicinity of these wires, ensure that a minimum wire separation of 15.24 cm (6 inches) is maintained.’
5.1.2 CDCCLs are essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the type design of the fuel tank system. The CDCCLs should include information regarding how to prevent compromising the critical design features, or to restore them when other maintenance or alterations are being performed. The CDCCLs should be established based on evaluating the design-specific critical features that are determined from the safety analysis and determining the anticipated maintenance, alteration, or repair errors that could compromise the feature. The following list of examples of CDCCLs is intended to provide examples of lightning protection features that have been identified in certain designs, and is not intended to be inclusive of all the features that should be considered for a particular design. It is likely that the safety analysis will identify the need for additional CDCCLs.
5.1.2.1 Fuel tank structural fasteners can be potential lightning ignition sources. Specific fastener design features such as the fastener material, coating, and countersink depth are typically needed to prevent lightning ignition sources at the fasteners. Installation processes such as fastener hole clearances, fastener pull-ups, and hole angularities can be critical. The orientation of the fastener head in the fuel tank structure can be critical. The criticality of fuel tank structural fasteners may be dependent on their location, particularly those located in direct lightning attachment zones. The CDCCLs should identify these critical fastener features and refer to the structural repair manual (SRM) for approved fastener lists and approved installation processes for these fasteners.
5.1.2.2 Fuel tube electrical isolation segments can be used to limit induced lightning currents on the fuel tubes, especially on aeroplanes with carbon‑fibre composite fuel tank structures. Maintenance, alterations, or repairs of the fuel tube system should maintain the lightning current limits provided by the fuel tube isolation segments. A limitation may specify that the fuel tube isolation segments are required for lightning protection, that replacements must also meet the electrical isolation requirements of the original design, and electrical bonding straps must not bridge the isolation segments.
5.1.2.3 Fuel tank access doors have the potential for lightning-related sparking inside the tank as a result of a direct lightning strike or a conducted lightning current. The doors may incorporate specific protection features such as electrically conductive gaskets, electrically insulating seals, and multiple fasteners. The limitation may specify that the presence and integrity of the gaskets, seals and fasteners should be verified when the access doors are installed. Electrical bonding measurements may be required to verify that the electrical resistance between the access door and adjacent structure is less than a specified value.
5.1.2.4 Sealant can provide caps over fasteners or fillet seals applied where structural parts are joined within the fuel tank. Poor sealant adhesion or sealant damage could degrade the protection against lightning ignition sources. The limitation may specify that the integrity of the sealant must be verified in the areas of the fuel system where maintenance or alterations take place. Cracked, peeling, or missing sealant could indicate that the integrity of the protection is compromised.
5.1.2.5 The minimum spacing between metal fuel tubes, hydraulic tubes, and conduits and adjacent structure may be specified to prevent lightning‑related arcing. In addition, electrically insulating bushings or grommets may be installed to prevent lightning-related arcing between fuel system components and structures. The limitation may specify that the presence and integrity of the bushings or grommets must be verified in the areas of the fuel system where maintenance or alterations take place, and that the minimum clearance between fuel tubes, hydraulic tubes, or conduits and adjacent structure or components must be verified in areas where maintenance or alterations take place.
5.1.2.6 Fittings for metal hydraulic tubes, nitrogen inerting tubes, and fuel tubes may be installed through the fuel tank walls. These fittings must conduct induced-lightning currents and prevent voltage or thermal sparks within the tank between the fittings and the fuel tank structure. The limitation may require verifying that the electrical bonding resistance does not exceed a specified value if the fittings are repaired, reinstalled, or altered, and that the integrity and electrical bonding resistance of any required bonding straps must be verified as well.
5.1.2.7 Self-bonding couplings that rely on physical contact between the coupling and fuel tubes may be used to provide electrical bonding. Anodised coatings applied to the fuel tubes could degrade the electrical bonding. The coatings used on the tubes and couplings could be identified as a CDCCL to maintain acceptable electrical bonding.
5.1.2.8 Fuel quantity sensing probes and in-tank wiring may require electrical isolation from the adjacent fuel tank structure to prevent lightning-related arcing between the probes, wiring, and structure. The isolation may be provided by electrically non-conductive probe clamps, or non‑conductive caps on the ends of the probes. The wiring protection may be provided by separation from the structure. The limitation may specify that the presence and integrity of the non-conducting clamps or end caps, and the wiring separation must be verified in the areas of the fuel system where maintenance or alterations take place.
5.1.3 CDCCLs are intended to identify only the critical features of a design that must be maintained. A CDCCL has no interval, but establishes configuration limitations to protect the critical design features identified in the CDCCL. CDCCLs can also include requirements to have placards installed on the aeroplane with information about critical features. For certain equipment, critical protection may be provided by components. These critical protection features must be identified as CDCCLs and should be listed in the component maintenance manual (CMM) to provide awareness to maintenance and repair facilities.
5.1.4 Certain CDCCLs apply to elements of fuel system components. As such, the maintenance of those critical features may be covered in a CMM. When Airworthiness Limitations need to call out aspects of CMMs, it is a best practice to limit the CDCCL-controlled content to only those maintenance tasks directly impacting a CDCCL feature, rather than requiring the complete CMM to be a CDCCL.
5.2 Mandatory replacement times, inspection intervals, and related inspection and test procedures
5.2.1 To comply with CS 25.954(d), mandatory replacement times, inspection intervals, and the related inspection and test procedures must be developed for the lightning protection features identified in paragraphs 2.3 and 2.6 of this AMC. Mandatory replacement times, inspection intervals, and the related inspection and test procedures must be included in the Airworthiness Limitations Section of the ICA.
5.2.2 To ensure lightning protection is retained over the service life of the aeroplane, references to these mandatory replacement times, inspection intervals, and the related inspection and test procedures are normally included in the maintenance manuals (e.g., the AMM, SRM, SWPM) and service bulletins that provide maintenance personnel with standard practices for continued airworthiness.
5.2.3 When developing maintenance and service inspection techniques, a review of similar aeroplane designs and their service histories should be conducted to focus on the areas where past experience has shown there is a potential for affecting lightning protection features.
5.2.4 When developing procedures to remove and reinstall fuel tank access panels, applicants should include instructions to maintain or restore the lightning protection features such as sealants, fastener assemblies (structural joints), nut plates, bonded parts, insulators, conductive parts, etc.
5.2.5 The applicant should validate the intended maintenance tasks performed in the fuel tank systems and confirm that they do indeed provide protection and avoidance of damage to the lightning protection features. The applicant should ensure that the proper parts and materials are specified in the maintenance tasks.
5.2.6 The lightning design specialist should participate in the determination of the maintenance program necessary for fuel tank lightning protection.
5.2.7 Lightning protection features that are not anticipated to degrade during the life of the aeroplane, and are identified as inherently reliable, do not require mandatory maintenance for compliance with CS 25.954(d), but should be identified to EASA. The integrity of conductive primary structures is an example of such features. A claim that lightning protection features are not anticipated to degrade during the life of the aeroplane when exposed to the effects of the environment, ageing, wear, corrosion, and likely damage must be substantiated and supported by data.
5.2.8 If a protection feature could degrade over the life of the aeroplane, it must be maintained using approved inspections and procedures consistent with the requirements of CS 25.954(d).
Appendix A. Definitions
The following definitions apply to the lightning protection of fuel tanks and systems of CS 25.954 and the guidance in this AMC.
A.1 ATTACHMENT POINT.
A point where the lightning flash contacts the aeroplane.
A.2 CONTINUED SAFE FLIGHT AND LANDING.
The aeroplane can safely abort or continue a take-off, or continue controlled flight and landing, possibly using emergency procedures. The aeroplane must do this without requiring exceptional pilot skill or strength. Some aeroplane damage may occur because of the failure condition or on landing. The pilot must be able to land the aeroplane safely at a suitable airport.
A.3 CRITICAL DESIGN CONFIGURATION CONTROL LIMITATIONS (CDCCLs).
A limitation requirement to preserve a critical design feature of a fuel system that is necessary for the design to meet the performance standards of CS 25.954 (and/or CS 25.981) throughout the life of the aeroplane model. The purpose of the CDCCL is to provide instructions to retain the critical features during configuration changes that may be caused by alterations, repairs, or maintenance actions.
A.4 CRITICAL LIGHTNING STRIKE.
As defined by CS 25.954(a)(1), a critical lightning strike is a lightning strike that attaches to the aeroplane in a location that, when combined with the failure of any design feature or structure, could create an ignition source.
A.5 ESCAPES.
Production or maintenance errors that can be anticipated to occur that could render the fault tolerance, or lightning protection ineffective.
A.6 EXTREMELY IMPROBABLE FAILURE CONDITION.
Refer to the definition provided in Section 7 of AMC 25.1309 (qualitative and quantitative terms).
A.7 FAULT-TOLERANT DESIGN.
A design that precludes fuel systems ignition sources even when a fault is present.
A.8 FUEL SYSTEMS.
As defined by CS 25.954(a)(2) a fuel system includes any component within either the fuel tank structure or the fuel tank systems and any aeroplane structure or system components that penetrate, connect to, or are located within a fuel tank.
A.9 FUEL TANK STRUCTURE.
Includes structural members of the fuel tank such as aeroplane skins, access panels, joints, ribs, spars, stringers, and the associated fasteners, brackets, coatings and sealant.
A.10 FUEL TANK SYSTEMS.
Tubing, components, and wiring that penetrate, are located within, or connected to the fuel tanks.
A.11 INTRINSICALLY SAFE.
Fuel system design elements that provide effective lightning protection with no foreseeable failure modes that would render them ineffective. These design elements have no failures or combinations of failures that can result in an ignition source. This can be due to reliable design or to a very low lightning voltage or current in that specific location.
A.12 LIGHTNING FLASH.
The total lightning event. It may occur in a cloud, between clouds, or between a cloud and the ground. It can consist of one or more return strokes, plus intermediate or continuing currents.
A.13 LIGHTNING STRIKE.
Attachment of the lightning flash to the aeroplane.
A.14 LIGHTNING STRIKE ZONES.
Aeroplane surface areas and structures that are susceptible to lightning attachment, dwell times, and current conduction.
A.15 LIGHTNING STROKE (RETURN STROKE).
A lightning current surge that occurs when the lightning leader (the initial current charge) makes contact with the ground or another charge centre. A charge centre is an area of high potential of opposite charge.
A.16 PRACTICALITY.
A balance of the available means, economic viability, and proportional benefit to safety.
A.17 RELIABLE DESIGN.
A reliable design is a design that provides lightning protection features that are not anticipated to degrade during the life of the aeroplane.
A.18 RELIABLE FAULT TOLERANCE.
A fault-tolerant fuel system design is a design that precludes ignition sources in the fuel system even when a fault is present; ‘reliable’ means that the system has the ability to maintain the effectiveness of the protection features over the service life of the individual aeroplane.
A.19 REMOTE.
Refer to the definition provided in Section 7 of AMC 25.1309 (qualitative and quantitative terms).
A.20 SYSTEMS.
Systems include fuel, mechanical, hydraulic, electrical, and electrical wiring interconnection system (EWIS) components that penetrate, are located within, or connected to the fuel tanks.
Appendix B. Section 4 Examples
B.1 EXAMPLES FOR PARAGRAPH 4.1.2.1
The design elements or features for which providing fault-tolerant prevention of lightning ignition sources should be practical include the:
1. Installation of rivets and bolts in aluminium structures that are well bonded through processes that ensure the fastener/hole fit, fastener and hole quality, and installation practices;
2. Installation of bolts in composite structures that are well bonded through processes that ensure control of the fastener/hole fit, fastener and hole quality, and installation practices and with additional design features to distribute current, such as foil or mesh at the material surface; and the
3. Installation of lightning protective sealant or cap seals over fastener heads/ends located inside fuel tanks, where necessary.
B.2 EXAMPLES FOR PARAGRAPH 4.1.2.2
The design features or failures for which providing fault-tolerant prevention of lightning ignition sources could be impractical include:
1. Fatigue cracking within structural elements such as spars, skins, stringers, and ribs. Typically, material controls, manufacturing controls, established material allowables, design margins, and life‑cycle tests make the occurrence of significant cracking rare.
2. Failures of fasteners highly loaded in tension that lead to separation of the fasteners or parts of the fasteners from the hole, or gapping of the heads or nuts of the fasteners, and the consequent failure of a cap seal. Typically, manufacturing controls, design margins, and life-cycle tests make the occurrence of broken bolts rare.
3. The installation of double cap seals or structurally reinforced cap seals to retain a bolt that fails under tension, resulting in a cascading failure of the cap seals.
4. Damage that may go undetected by scheduled or directed field inspection, and manufacturing defects in composite structures.
B.3 EXAMPLES FOR PARAGRAPH 4.1.2.3
Some examples of practical design, manufacturing, and maintenance processes are listed below. Although these practices themselves are not considered to be independent features for providing fault tolerance, they are measures to minimise the likelihood of failures, or measures necessary to support the assumptions about failure modes or rates in a safety analysis.
1. A structured design review process (as described in this AMC) to ensure that all the relevant design features are reviewed to identify the critical design areas, critical processes, and associated testing and analysis requirements.
2. Engineering review of the proposed design to identify the failure modes that may occur because of manufacturing errors or escapes, maintenance errors, repairs or alterations, ageing, wear, corrosion, or likely damage.
3. Engineering review of manufacturing processes to identify the failure modes that may occur because of manufacturing errors or escapes.
4. Engineering review of service history records to identify the failure modes that may occur because of production escapes, maintenance errors, repairs or alterations, ageing, wear, corrosion, or likely damage.
5. Implementation of practical manufacturing and quality control processes to address the issues identified through the required engineering reviews.
6. For non-fault-tolerant locations, quality control processes that require inspections of critical features by a person other than the person that performed the manufacturing work.
7. Provisions in the ICA to identify cautions in maintenance documents regarding lightning protection features, as well as life limits or repetitive inspections for non-fault-tolerant features. For any penetration into the fuel tank, or any structural damage within the fuel tank, the SRM should specify the repair methods that maintain the lightning protection features.
8. Mandatory maintenance actions necessary to ensure compliance is maintained with the lightning protection requirements should be included in the Airworthiness Limitations Section of the ICA as required by Section H25.4 of Appendix H to CS-25.
B.4 EXAMPLE FOR PARAGRAPH 4.2.5.3
The following is an example of an assessment process addressing the potential for non‑fault‑tolerant fuel tank structural cracking. To assess the risk due to non-fault tolerance for structural cracks, the following should be accomplished:
B.4.1 Determine whether the structure in this zone is susceptible to fatigue cracking. If it is susceptible to fatigue cracking, determine the minimum size of crack that could be a source for arcing. This crack length should then be compared with the inspection methods used for compliance with CS 25.571 (Damage Tolerance), to determine the ability to detect and/or the probability of detecting a crack of this size.
B.4.2 If the Airworthiness Limitations required for compliance with CS 25.571 are already sufficient to ensure that the probability is remote (unlikely to occur on each aeroplane — see AMC 25.1309) that a crack will grow to a sufficient size and gap in excess of that necessary to cause sparking during a lightning event, then no lightning-related Airworthiness Limitations are required. The probability of this remote condition occurring, together with the remote probability of a critical lightning strike, make these combinations not foreseeable.
B.4.3 As part of the damage-tolerance evaluation, an analysis should be performed to determine the duration of time (in flight cycles) it will take for a crack of minimum arcing size to grow to the minimum detectable length. This crack propagation rate should then be used along with the probability of detection for the specified inspection method to determine the exposure time. That exposure time is the number of flight cycles an aeroplane may be exposed to before an ignition source due to a structural failure (crack, failed fastener, etc.) occurs.
B.4.4 If the Airworthiness Limitations necessary to support compliance with CS 25.571 cannot ensure that the likelihood of a crack in excess of the size that would cause sparking is remote, and the crack would not be readily detectable within a few flights due to fuel leaks, then this condition must be included in the risk assessment of non-fault-tolerant conditions. Further, any practical maintenance inspection should be made to minimise the exposure time. A low probability combined with a short exposure time may be necessary to demonstrate that a catastrophic ignition is extremely improbable, i.e., it is not anticipated to occur during the entire operational life of all the aeroplanes of one type.
ED Decision 2016/010/R
(See AMC 25.955)
(a) Each fuel system must provide at least 100% of the fuel flow required under each intended operating condition and manoeuvre. Compliance must be shown as follows:
(1) Fuel must be delivered to each engine at a pressure within the limits specified in the engine type certificate.
(2) The quantity of fuel in the tank may not exceed the amount established as the unusable fuel supply for that tank under the requirements of CS 25.959 plus that necessary to show compliance with this paragraph.
(3) Each main pump must be used that is necessary for each operating condition and attitude for which compliance with this paragraph is shown, and the appropriate emergency pump must be substituted for each main pump so used.
(4) If there is a fuel flowmeter, it must be blocked and the fuel must flow through the meter or its bypass. (See AMC 25.955(a)(4).)
(b) If an engine can be supplied with fuel from more than one tank, the fuel system must –
(1) Reserved.
(2) For each engine, in addition to having appropriate manual switching capability, be designed to prevent interruption of fuel flow to that engine, without attention by the flight crew, when any tank supplying fuel to that engine is depleted of usable fuel during normal operation, and any other tank, that normally supplies fuel to that engine alone, contains usable fuel.
[Amdt 25/18]
ED Decision 2003/2/RM
The word ‘blocked’ should be interpreted to mean ‘with the moving parts fixed in the position for maximum pressure drop’.
CS 25.957 Flow between interconnected tanks
ED Decision 2003/2/RM
If fuel can be pumped from one tank to another in flight, the fuel tank vents and the fuel transfer system must be designed so that no structural damage to the tanks can occur because of overfilling.
CS 25.959 Unusable fuel supply
ED Decision 2003/2/RM
The unusable fuel quantity for each fuel tank and its fuel system components must be established at not less than the quantity at which the first evidence of engine malfunction occurs under the most adverse fuel feed condition for all intended operations and flight manoeuvres involving fuel feeding from that tank. Fuel system component failures need not be considered.
CS 25.961 Fuel system hot weather operation
ED Decision 2003/2/RM
(a) The fuel system must perform satisfactorily in hot weather operation. This must be shown by showing that the fuel system from the tank outlets to each engine is pressurised, under all intended operations, so as to prevent vapour formation, or must be shown by climbing from the altitude of the airport elected by the applicant to the maximum altitude established as an operating limitation under CS 25.1527. If a climb test is elected, there may be no evidence of vapour lock or other malfunctioning during the climb test conducted under the following conditions:
(1) Reserved.
(2) For turbine engine powered aeroplanes, the engines must operate at take-off power for the time interval selected for showing the take-off flight path, and at maximum continuous power for the rest of the climb.
(3) The weight of the aeroplane must be the weight with full fuel tanks, minimum crew, and the ballast necessary to maintain the centre of gravity within allowable limits.
(4) The climb airspeed may not exceed –
(i) Reserved.
(ii) The maximum airspeed established for climbing from take-off to the maximum operating altitude.
(5) The fuel temperature must be at least 43.3°C (110°F).
(b) The test prescribed in sub-paragraph (a) of this paragraph may be performed in flight or on the ground under closely simulated flight conditions. If a flight test is performed in weather cold enough to interfere with the proper conduct of the test, the fuel tank surfaces, fuel lines, and other fuel system parts subject to cold air must be insulated to simulate, insofar as practicable, flight in hot weather.
ED Decision 2016/010/R
(See AMC 25.963)
(a) Each fuel tank must be able to withstand, without failure, the vibration, inertia, fluid and structural loads that it may be subjected to in operation. (See AMC 25.963(a).)
(b) Flexible fuel tank liners must be approved or must be shown to be suitable for the particular application.
(c) Integral fuel tanks must have facilities for interior inspection and repair.
(d) Fuel tanks must, so far as it is practicable, be designed, located and installed so that no fuel is released in or near the fuselage or near the engines in quantities sufficient to start a serious fire in otherwise survivable emergency landing conditions, and:
(1) Fuel tanks must be able to resist rupture and to retain fuel under ultimate hydrostatic design conditions in which the pressure P within the tank varies in accordance with the formula:
where:
P = fuel pressure in Pa (lb/ft2) at each point within the tank
L = a reference distance in m (ft) between the point of pressure and the tank farthest boundary in the direction of loading.
= typical fuel density in kg/m3 (slugs/ft3)
g = acceleration due to gravity in m/s2 (ft/s2)
K = 4.5 for the forward loading condition for fuel tanks outside the fuselage contour
K = 9 for the forward loading condition for fuel tanks within the fuselage contour
K = 1.5 for the aft loading condition
K = 3.0 for the inboard and outboard loading conditions for fuel tanks within the fuselage contour
K = 1.5 for the inboard and outboard loading conditions for fuel tanks outside of the fuselage contour
K = 6 for the downward loading condition
K = 3 for the upward loading condition
(2) For those (parts of) wing fuel tanks near the fuselage or near the engines, the greater of the fuel pressures resulting from subparagraphs (i) and (ii) must be used:
(i) the fuel pressures resulting from subparagraph (d)(1) above, and:
(ii) the lesser of the two following conditions:
(A) Fuel pressures resulting from the accelerations as specified in CS 25.561(b)(3) considering the fuel tank full of fuel at maximum fuel density. Fuel pressures based on the 9.0g forward acceleration may be calculated using the fuel static head equal to the streamwise local chord of the tank. For inboard and outboard conditions, an acceleration of 1.5g may be used in lieu of 3.0g as specified in CS 25.561(b)(3); and:
(B) Fuel pressures resulting from the accelerations as specified in CS 25.561(b)(3) considering a fuel volume beyond 85% of the maximum permissible volume in each tank using the static head associated with the 85% fuel level. A typical density of the appropriate fuel may be used. For inboard and outboard conditions, an acceleration of 1.5g may be used in lieu of 3.0g as specified in CS 25.561(b)(3).
(3) Fuel tank internal barriers and baffles may be considered as solid boundaries if shown to be effective in limiting fuel flow.
(4) For each fuel tank and surrounding airframe structure, the effects of crushing and scraping actions with the ground should not cause the spillage of enough fuel, or generate temperatures that would constitute a fire hazard under the conditions specified in CS 25.721(b).
(5) Fuel tank installations must be such that the tanks will not rupture as a result of an engine pylon or engine mount or landing gear, tearing away as specified in CS 25.721(a) and (c).
(See AMC 25.963(g).)
(e) Fuel tanks must comply with the following criteria in order to avoid hazardous fuel leak:
(1) Fuel tanks located in an area where experience or analysis indicates a strike is likely, must be shown by analysis supported by test, or by test to address penetration and deformation by tyre and wheel fragments, small debris from uncontained engine failure or APU failure, or other likely debris (such as runway debris).
(2) All fuel tank access covers must have the capacity to withstand the heat associated with fire at least as well as an access cover made from aluminium alloy in dimensions appropriate for the purpose for which they are to be used, except that the access covers need not be more resistant to fire than an access cover made from the base fuel tank structural material.
(See AMC 25.963(e).)
(f) For pressurised fuel tanks, a means with failsafe features must be provided to prevent the build-up of an excessive pressure difference between the inside and the outside of the tank.
(g) (Reserved)
[Amdt 25/3]
[Amdt 25/14]
[Amdt 25/18]
AMC 25.963(a) Fuel tanks: General
ED Decision 2003/2/RM
Precautions should be taken against the possibility of corrosion resulting from microbiological contamination of fuel.
AMC 25.963(d) Fuel tank strength in emergency landing conditions
ED Decision 2007/010/R
1. PURPOSE. This AMC sets forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of CS-25 related to the strength of fuel tanks in emergency landing conditions.
2. RELATED CERTIFICATION SPECIFICATIONS.
CS 25.561 “Emergency Landing Conditions – General”,
CS 25.721 “Landing Gear – General”
CS 25.994 “Fuel System Components”
CS 25J994 “Fuel System Components”
3. BACKGROUND. For many years the JAA/EASA has required fuel tanks within the fuselage contour to be designed to withstand the inertial load factors prescribed for the emergency landing conditions as specified in JAR/CS 25.561. These load factors have been developed through many years of experience and are generally considered conservative design criteria applicable to objects of mass that could injure occupants if they came loose in a minor crash landing.
a. A minor crash landing is a complex dynamic condition with combined loading. However, in order to have simple and conservative design criteria, the emergency landing forces were established as conservative static ultimate load factors acting in each direction independently.
b. Recognising that the emergency landing load factors were applicable to objects of mass that could cause injury to occupants and that the rupture of fuel tanks in the fuselage could also be a serious hazard to the occupants, § 4b.420 of the Civil Air Regulations (CAR) part 4b (the predecessor of FAR 25) extended the emergency landing load conditions to fuel tanks that are located within the fuselage contour. Even though the emergency landing load factors were originally intended for solid items of mass, they were applied to the liquid fuel mass in order to develop hydrostatic pressure loads on the fuel tank structure. The application of the inertia forces as a static load criterion (using the full static head pressure) has been considered a conservative criterion for the typical fuel tank configuration within the fuselage contour. This conservatism has been warranted considering the hazard associated with fuel spillage.
c. CS 25.963 has required that fuel tanks, both in and near the fuselage, resist rupture under survivable crash conditions. The advisory material previously associated with CS 25.963 specifies design requirements for all fuel tanks that, if ruptured, could release fuel in or near the fuselage or near the engines in quantities sufficient to start a serious fire.
d. In complying with this CS requirement for wing tanks, several different techniques have been used by manufacturers to develop the fuel tank pressure loads due to the emergency landing inertia forces. The real emergency landing is actually a dynamic transient condition during which the fuel must flow in a very short period of time to re-establish a new level surface normal to the inertial force. For many tanks such as large swept wing tanks, the effect is that the actual pressure forces are likely to be much less than that which would be calculated from a static pressure based on a steady state condition using the full geometric pressure head. Because the use of the full pressure head results in unrealistically high pressures and creates a severe design penalty for wing tanks in swept wings, some manufacturers have used the local streamwise head rather than the full head. Other manufacturers have used the full pressure head but with less than a full tank of fuel. These methods of deriving the pressures for wing tanks have been accepted as producing design pressures for wing tanks that would more closely represent actual emergency landing conditions. The service record has shown no deficiency in strength for wing fuel tanks designed using these methods.
e. FAR 25 did not contain a requirement to apply fuel inertia pressure requirements to fuel tanks outside the fuselage contour, however, the FAA (like the JAA) has published Special Conditions to accomplish this for fuel tanks located in the tail surfaces. The need for Special Conditions was justified by the fact that these tanks are located in a rearward position from which fuel spillage could directly affect a large portion of the fuselage, possibly on both sides at the same time.
4. GENERAL. CS 25.963(d) requires that fuel tanks must be designed, located, and installed so that no fuel is released in quantities sufficient to start a serious fire in otherwise survivable emergency landing conditions. The prescribed set of design conditions to be considered is as follows:
a. Fuel tank pressure loads. CS 25.963(d)(1) provides a conservative method for establishing the fuel tank ultimate emergency landing pressures. The phrase “fuel tanks outside the fuselage contour” is intended to include all fuel tanks where fuel spillage through any tank boundary would remain physically and environmentally isolated from occupied compartments by a barrier that is at least fire resistant as defined in CS-Definitions. In this regard, cargo compartments that share the same environment with occupied compartments would be treated the same as if they were occupied. The ultimate pressure criteria are different depending on whether the fuel tank under consideration is inside, or outside the fuselage contour. For the purposes of this paragraph a fuel tank should be considered inside the fuselage contour if it is inside the fuselage pressure shell. If part of the fuel tank pressure boundary also forms part of the fuselage pressure boundary then that part of the boundary should be considered as being within the fuselage contour. Figures 1 and 2 show examples of an underslung wing fuel tank and a fuel tank within a moveable tailplane, respectively, both of which would be considered as being entirely outside of the fuselage contour.
The equation for fuel tank pressure uses a factor L, based upon fuel tank geometry. Figure 3 shows examples of the way L is calculated for fuel pressures arising in the forward loading condition, while Figure 4 shows examples for fuel pressures arising in the outboard loading condition.
For Jet A(-1) fuel, a typical density of 785.0 kg/m3 (6.55 lb/US gallon) may be assumed.
Any internal barriers to free flow of fuel may be considered as a solid pressure barrier provided:
(1) It can withstand the loads due to the expected fuel pressures arising in the conditions under consideration; and
(2) The time “T” for fuel to flow from the upstream side of the barrier to fill the cell downstream of the barrier is greater than 0.5 second. “T” may be conservatively estimated as:
where:
V= the volume of air in the fuel cell downstream of the barrier assuming a full tank at 1g flight conditions. For this purpose a fuel cell should be considered as the volume enclosed by solid barriers. In lieu of a more rational analysis, 2% of the downstream fuel volume should be assumed to be trapped air;
j = the total number of orifices in baffle rib;
Cdi = the discharge coefficient for orifice i. The discharge coefficient may be conservatively assumed to be equal to 1.0 or it may be rationally based upon the orifice size and shape;
ai = the area for orifice i;
g = the acceleration due to gravity;
hi = the hydrostatic head of fuel upstream of orifice i, including all fuel volume enclosed by solid barriers;
K = the pressure design factor for the condition under consideration.
b. Near the fuselage/near the engines (Compliance with CS 25.963(d)(2).)
(1) For aircraft with wing mounted engines:
(i) The phrase “near the fuselage” is addressing those (parts of) wing fuel tanks located between the fuselage and the most inboard engine;
(ii) The phrase “near the engine” is addressing those (parts of) wing fuel tanks as defined in AMC 20-128A, figure 2, minimum distance of 10 inches (254 mm) laterally from potential ignition sources of the engine nacelle.
(2) For aircraft with fuselage mounted engines, the phrase “near the fuselage” is addressing those (parts of) wing fuel tanks located within one maximum fuselage width outside the fuselage boundaries.
c. Protection against crushing and scraping action (Compliance with CS 25.963(d)(4) and CS 25.721(b) and (c).).
Each fuel tank should be protected against the effects of crushing and scraping action (including thermal effects) of the fuel tank and surrounding airframe structure with the ground under the following minor crash landing conditions:
(i) An impact at 1.52 m/s (5 fps) vertical velocity on a paved runway at maximum landing weight, with all landing gears retracted and in any other possible combination of gear legs not extended. The unbalanced pitching and rolling moments due to the ground reactions are assumed to be reacted by inertia and by immediate pilot control action consistent with the aircraft under control until other structure strikes the ground. It should be shown that the loads generated by the primary and subsequent impacts are not of a sufficient level to rupture the tank. A reasonable attitude should be selected within the speed range from VL1 to 1.25 VL2 based upon the fuel tank arrangement.
VL1 equals to VS0 (TAS) at the appropriate landing weight and in standard sea-level conditions, and VL2 equals to VS0 (TAS) at the appropriate landing weight and altitudes in a hot day temperature of 22.8 degrees C (41 degrees F) above standard.
(ii) Sliding on the ground starting from a speed equal to VL1 up to complete stoppage, all gears retracted and with up to a 20° yaw angle and as a separate condition, sliding with any other possible combination of gear legs not extended and with a 0° yaw angle. The effects of runway profile need not be considered.
(iii) The impact and subsequent sliding phases may be treated as separate analyses or as one continuous analysis. Rational analyses that take into account the pitch response of the aircraft may be utilised, however care must be taken to assure that abrasion and heat transfer effects are not inappropriately reduced at critical ground contact locations.
(iv) For aircraft with wing mounted engines, if failure of engine mounts, or failure of the pylon or its attachments to the wing occurs during the impact or sliding phase, the subsequent effect on the integrity of the fuel tanks should be assessed. Trajectory analysis of the engine/pylon subsequent to the separation is not required.
(v) The above emergency landing conditions are specified at maximum landing weight, where the amount of fuel contained within the tanks may be sufficient to absorb the frictional energy (when the aircraft is sliding on the ground)without causing fuel ignition. When lower fuel states exist in the affected fuel tanks these conditions should also be considered in order to prevent fuel-vapour ignition.
d. Engine / Pylon separation. (Compliance with CS 25.721(c) and CS 25.963(d)(5).)
For configurations where the nacelle is likely to come into contact with the ground, failure under overload should be considered. Consideration should be given to the separation of an engine nacelle (or nacelle + pylon) under predominantly upward loads and under predominantly aft loads. The predominantly upward load and the predominantly aft load conditions should be analysed separately. It should be shown that at engine/pylon failure the fuel tank itself is not ruptured at or near the engine/pylon attachments.
e. Landing gear separation. (Compliance with CS 25.721(a) and CS 25.963(d)(5).)
Failure of the landing gear under overload should be considered, assuming the overloads to act in any reasonable combination of vertical and drag loads, in combination with side loads acting both inboard and outboard. In the absence of a more rational analysis, the side loads must be assumed to be up to 20% of the vertical load or 20% of the drag load, whichever is greater. It should be shown that at the time of separation the fuel tank itself is not ruptured at or near the landing gear attachments. The assessment of secondary impacts of the airframe with the ground following landing gear separation is not required. If the subsequent trajectory of a separated landing gear would likely puncture an adjacent fuel tank, design precautions should be taken to minimise the risk of fuel leakage.
f. Compliance with the provisions of this paragraph may be shown by analysis or tests, or both.
5. OTHER CONSIDERATIONS
a. Supporting structure. In accordance with CS 25.561(c) all large mass items that could break loose and cause direct injury to occupants must be restrained under all loads specified in CS 25.561(b). To meet this requirement, the supporting structure for fuel tanks, should be able to withstand each of the emergency landing load conditions, as far as they act in the 'cabin occupant sensitive directions', acting statically and independently at the tank centre of gravity as if it were a rigid body. Where an empennage includes a fuel tank, the empennage structure supporting the fuel tank should meet the restraint conditions applicable to large mass items in the forward direction.
Figure 1: Diagram of Fuel Tank in Underslung Wing that is Outside of the Fire Resistant Boundary
Figure 2: Diagram of Fuel Tank Within a Movable Tailplane
Figure 3 Example of Distances for Fuel Forward Acting Design Pressure Calculations
Figure 4 – Example of Distances for Fuel Outboard Acting Design Pressure Calculations
[Amdt 25/3]
AMC 25.963(e) Fuel Tank Protection
ED Decision 2013/033/R
1. PURPOSE. This AMC sets forth a means of compliance with the provisions of CS-25 dealing with the certification requirements for fuel tanks (including skin and fuel tank access covers) on large aeroplanes. Guidance information is provided for showing compliance with the impact and fire resistance requirements of CS 25.963(e).
2. BACKGROUND. Fuel tanks have failed in service due to impact with high speed objects such as failed tyre tread material and engine debris following engine failures. Failure of a fuel tank may result in hazardous fuel leak.
3. IMPACT RESISTANCE.
a. All fuel tanks must be designed to address penetration and deformation by tyre fragments, wheel fragments, small debris from uncontained engine failure or APU failure, or other likely debris (such as runway debris), unless the fuel tanks are located in an area where service experience or analysis indicates a strike is not likely. The rule does not specify rigid standards for impact resistance because of the wide range of likely debris which could impact the fuel tanks. The applicant should, however, choose to minimise penetration and deformation by analysis supported by test, or test of fuel tanks using debris of a type, size, trajectory and velocity that represents conditions anticipated in actual service for the aeroplane model involved. There should be no hazardous fuel leak after impact.
A hazardous fuel leak results if debris impact to a fuel tank surface (or resulting pressure wave) causes:
a) a running leak,
b) a dripping leak, or
c) a leak that, 15 minutes after wiping dry, results in a wetted aeroplane surface exceeding 15.2 cm (6 in) in length or diameter.
The leak should be evaluated under maximum fuel pressure (1g on ground with full fuel volume, and also considering any applicable fuel tank pressurisation).
b. The following may be used for evaluating fuel tanks for impact resistance to tyre, wheel, engine and APU debris. Furthermore, protecting the fuel tank against the threats defined in the models below would also protect against threats originating from foreign objects projected from the runway.
(i) Wheel and Tyre Debris - Fuel tanks must be protected against threats from wheel and tyre failures. Refer to AMC 25.734, which provides wheel and tyre failure threat models.
(ii) Engine Debris - The following provides the definition of a debris model to be used for protection of the fuel tanks against the threat of small engine debris (propulsion engines). It also describes how the debris model impacts a surface and a pass-fail criteria is provided.
This debris model is considered to be representative of the threat created by engine small non-rotating and rotating parts debris, including ricochets, occurring after an uncontained engine failure event. It is considered to address High Bypass Ratio and Low Bypass Ratio turbine engines.
Note: AMC 20-128A remains applicable to engine debris, other than small engine fragments, threatening fuel tanks as described here, and also remains applicable to all engine debris to other areas of the aircraft structures and systems.
A. Definition of the debris
A solid steel cube with a 9.5 mm (3/8 in) edge length.
B. Velocity of the debris
The velocity of the cube at the impact is 213.4 m/s (700 ft/s).
C. Impact areas and pass-fail criteria
Two areas are to be considered. See also Figure 1 below.
(1) ± 15-degree area
Within 15 degrees forward of the fan plane (or front engine compressor if no fan) measured from the centre of rotation to 15 degrees aft of the rearmost engine turbine plane measured from the centre of rotation, a normal impact is used (i.e. the angle between the trajectory of the debris and the surface is 90 degrees).
The impact should not create a hazardous fuel leak (see definition in paragraph 3.a of this AMC).
The leak should be evaluated under maximum fuel pressure (1g on ground with full fuel volume, and also considering any applicable fuel tank pressurisation).
(2) Area between – 15 and – 45 degrees (aft of the rearmost engine turbine plane)
Within this area, the angle of impact (see Figure 1, α and β angles) is defined by the trajectory of the debris originating from the centre of rotation of the rearmost engine turbine plane.
Similarly, as within the ± 15-degree area, the impact should not create a hazardous fuel leak.
D. Guidance material
— When showing compliance with oblique impacts, it is acceptable to consider a normal impact using a debris velocity at impact equal to the normal component of the oblique velocity vector.
— Orientation of the cube at the impact: testing and analysis should ensure that all orientations (side-on, edge-on, and corner-on) are represented.
— Impact tests should be completed in adequate number to show repeatable stable localised damage modes and damage extents for all impactor orientations (side-on, edge-on, and corner-on).
Note: α and β angles are examples of possible angles between the fuel tank skin and the debris trajectory at the impact.
Figure 1 — Cube impact angles
Figure 2 — Example of the ± 15-degree threat area representation
Note: The threat area between – 15 and – 45 degrees is not represented.
(iii) APU Debris — For small APU debris, the small fragment model as defined in AMC 20-128A applies. The impact should not create a hazardous fuel leak (as defined in paragraph 3.a above).
Note: AMC 20-128A remains applicable to APU debris, other than small APU fragments, threatening fuel tanks as described here, and also remains applicable to all APU debris to other areas of the aircraft structures and systems.
4. RESISTANCE TO FIRE
Fuel tank access covers meet the requirements of CS 25.963(e)(2) if they are fabricated from solid aluminium or titanium alloys, or steel. They also meet the above requirement if one of the following criteria is met.
a. The covers can withstand the test of AC 20-135, “Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria”, issued 2/9/90, or ISO 2685-1992(E), “Aircraft Environment conditions and test procedures for airborne equipment - Resistance to fire in designated fire zones”, for a period of time at least as great as an equivalent aluminium alloy in dimensions appropriate for the purpose for which they are used.
b. The covers can withstand the test of AC 20-135, Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria, issued 2/9/90, or ISO 2685-1992(E), Aircraft - Environment conditions and test procedures for airborne equipment - Resistance to fire in designated fire zones, for a period of time at least as great as the minimum thickness of the surrounding wing structure.
c. The covers can withstand the test of AC 20-135, Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria, issued 2/9/90, or ISO 2685-1992(E), Aircraft - Environment conditions and test procedures for airborne equipment - Resistance to fire in designated fire zones, for a period of 5 minutes. The test cover should be installed in a test fixture representative of actual installation in the aeroplane. Credit may be allowed for fuel as a heat sink if covers will be protected by fuel during all likely conditions. The maximum amount of fuel that should be allowed during this test is the amount associated with reserve fuel. Also, the static fuel pressure head should be accounted for during the burn test. There should be no burn-through or distortion that would lead to fuel leakage at the end of the tests; although damage to the cover and seal is permissible.
[Amdt 25/3]
[Amdt 25/14]
ED Decision 2003/2/RM
(a) It must be shown by tests that the fuel tanks, as mounted in the aeroplane can withstand, without failure or leakage, the more critical of the pressures resulting from the conditions specified in sub-paragraphs (a)(1) and (2) of this paragraph. In addition it must be shown by either analysis or tests, (see AMC 25.965(a)) that tank surfaces subjected to more critical pressures resulting from the conditions of sub-paragraphs (a)(3) and (4) of this paragraph, are able to withstand the following pressures:
(1) An internal pressure of 24 kPa (3·5 psi).
(2) 125% of the maximum air pressure developed in the tank from ram effect.
(3) Fluid pressures developed during maximum limit accelerations, and deflections, of the aeroplane with a full tank.
(4) Fluid pressures developed during the most adverse combination of aeroplane roll and fuel load.
(b) Each metallic tank with large unsupported or unstiffened flat surfaces, whose failure or deformation could cause fuel leakage, must be able to withstand the following test, or its equivalent, without leakage or excessive deformation of the tank walls:
(1) Each complete tank assembly and its supports must be vibration tested while mounted to simulate the actual installation.
(2) Except as specified in sub-paragraph (b)(4) of this paragraph, the tank assembly must be vibrated for 25 hours at an amplitude of not less than 0.8 mm (1/32 of an inch) (unless another amplitude is substantiated) while two-thirds filled with water or other suitable test fluid.
(3) The test frequency of vibration must be as follows:
(i) If no frequency of vibration resulting from any rpm within the normal operating range of engine speeds is critical, the test frequency of vibration must be 2 000 cycles per minute.
(ii) If only one frequency of vibration resulting from any rpm within the normal operating range of engine speeds is critical, that frequency of vibration must be the test frequency.
(iii) If more than one frequency of vibration resulting from any rpm within the normal operating range of engine speeds is critical, the most critical of these frequencies must be the test frequency.
(4) Under sub-paragraph (b)(3)(ii) and (iii) of this paragraph, the time of test must be adjusted to accomplish the same number of vibration cycles that would be accomplished in 25 hours at the frequency specified in sub-paragraph (b)(3)(i) of this paragraph.
(5) During the test, the tank assembly must be rocked at the rate of 16 to 20 complete cycles per minute, through an angle of 15° on both sides of the horizontal (30° total), about the most critical axis, for 25 hours. If motion about more than one axis is likely to be critical, the tank must be rocked about each critical axis for 12·5 hours.
(c) Except where satisfactory operating experience with a similar tank in a similar installation is shown, non-metallic tanks must withstand the test specified in sub-paragraph (b)(5) of this paragraph, with fuel at a temperature of 43.3°C (110°F). During this test, a representative specimen of the tank must be installed in a supporting structure simulating the installation in the aeroplane.
(d) For pressurised fuel tanks, it must be shown by analysis or tests that the fuel tanks can withstand the maximum pressure likely to occur on the ground or in flight.
ED Decision 2003/2/RM
The analysis or tests should be performed on each complete tank in the configuration ready and capable of flight. Each complete tank means any tank fully equipped which is isolated from other tanks by tank walls or which may be isolated by valves under some flight configurations.
CS 25.967 Fuel tank installations
ED Decision 2016/010/R
(See AMC 25.967)
(a) Each fuel tank must be supported so that tank loads (resulting from the weight of the fuel in the tanks) are not concentrated on unsupported tank surfaces. In addition –
(1) There must be pads, if necessary, to prevent chafing between the tank and its supports;
(2) Padding must be non-absorbent or treated to prevent the absorption of fluids;
(3) If a flexible tank liner is used, it must be supported so that it is not required to withstand fluid loads (see AMC 25.967(a)(3)); and
(4) Each interior surface of the tank compartment must be smooth and free of projections that could cause wear of the liner unless –
(i) Provisions are made for protection of the liner at these points; or
(ii) That construction of the liner itself provides that protection.
(b) Spaces adjacent to tank surfaces must be ventilated to avoid fume accumulation due to minor leakage. If the tank is in a sealed compartment, ventilation may be limited to drain holes large enough to prevent excessive pressure resulting from altitude changes.
(c) The location of each tank must meet the requirements of CS 25.1185(a).
(d) No engine nacelle skin immediately behind a major air outlet from the engine compartment may act as the wall of an integral tank.
(e) Each fuel tank must be isolated from personnel compartments by a fumeproof and fuelproof enclosure.
[Amdt 25/18]
AMC 25.967(a)(3) Fuel tank installation
ED Decision 2003/2/RM
The installation of a flexible tank and its venting, according to CS 25.975(a)(3) should be such that the tank liner will not be deformed in such a way as to significantly affect the fuel quantity indication.
CS 25.969 Fuel tank expansion space
ED Decision 2003/2/RM
Each fuel tank must have an expansion space of not less than 2% of the tank capacity. It must be impossible to fill the expansion space inadvertently with the aeroplane in the normal ground attitude. For pressure fuelling systems, compliance with this paragraph may be shown with the means provided to comply with CS 25.979(b).
ED Decision 2003/2/RM
(a) Each fuel tank must have a sump with an effective capacity, in the normal ground attitude, of not less than the greater of 0·10% of the tank capacity or one-quarter of a litre unless operating limitations are established to ensure that the accumulation of water in service will not exceed the sump capacity.
(b) Each fuel tank must allow drainage of any hazardous quantity of water from any part of the tank to its sump with the aeroplane in the ground attitude.
(c) Each fuel tank sump must have an accessible drain that –
(1) Allows complete drainage of the sump on the ground;
(2) Discharges clear of each part of the aeroplane; and
(3) Has manual or automatic means for positive locking in the closed position.
CS 25.973 Fuel tank filler connection
ED Decision 2003/2/RM
Each fuel tank filler connection must prevent the entrance of fuel into any part of the aeroplane other than the tank itself. In addition –
(a) Reserved
(b) Each recessed filler connection that can retain any appreciable quantity of fuel must have a drain that discharges clear of each part of the aeroplane;
(c) Each filler cap must provide a fuel-tight seal; and
(d) Each fuel filling point must have a provision for electrically bonding the aeroplane to ground fuelling equipment.
ED Decision 2018/005/R
(a) Fuel tank vents. Each fuel tank must be vented from the top part of the expansion space so that venting is effective under any normal flight condition. In addition –
(1) Each vent must be arranged to avoid stoppage by dirt or ice formation;
(2) The vent arrangement must prevent siphoning of fuel during normal operation;
(3) The venting capacity and vent pressure levels must maintain acceptable differences of pressure between the interior and exterior of the tank, during –
(i) Normal flight operation;
(ii) Maximum rate of ascent and descent; and
(iii) Refuelling and defuelling (where applicable);
(4) Airspaces of tanks with interconnected outlets must be interconnected;
(5) There may be no point in any vent line where moisture can accumulate with the aeroplane in the ground attitude or the level flight attitude, unless drainage is provided;
(6) No vent or drainage provision may end at any point:
(i) Where the discharge of fuel from the vent outlet would constitute a fire hazard; or
(ii) From which fumes could enter personnel compartments; and
(7) Each fuel tank vent system must prevent explosions, for a minimum of 2 minutes and 30 seconds, caused by the propagation of flames from outside the tank through the fuel tank vents into the fuel tank vapour spaces when any fuel tank vent is continuously exposed to flames. (See AMC 25.975(a)(7))
[Amdt 25/21]
AMC 25.975(a)(7) Fuel tank vent fire protection
ED Decision 2018/005/R
1. Purpose
This AMC provides guidance and acceptable means of compliance with CS 25.975(a)(7) and the related specifications for the prevention of fuel tank explosions caused by the ignition of vapours outside fuel tank vents.
2. References
2.1. Related certification specifications:
— CS 25.863 Flammable fluid fire protection
— CS 25.867 Fire protection: other components
— CS 25.901 Installation (paragraphs (b)(2) and (c))
— CS 25.954 Fuel system lightning protection
— CS 25.963 Fuel tanks: general (paragraphs (d) and (e)(2))
— CS 25.981 Fuel tank ignition prevention.
2.2. Technical publications
— Hill, Richard and George R. Johnson, Investigation of Aircraft Fuel Tank Explosions and Nitrogen Inerting Requirements During Ground Fires, FAA Technical Report No. FAA-RD-75-119. Washington, D.C.: U.S. Department of Transportation, 1975
— FAA Technical Report ADS-18, National Technical Information Service (NTIS), Lightning Protection Measures for Aircraft Fuel Systems. Springfield, VA: U.S. Department of Commerce, 1964
— Military Standard, Environmental Engineering Considerations and Laboratory Test Methods, MIL‑STD-810G w/Change1, Method 511.6 Procedure II. Philadelphia, PA: U.S. Department of Defense, 2014
— RTCA, Inc., Environmental Conditions and Test Procedures for Airborne Equipment, RTCA/DO‑160G. Washington DC: RTCA, Inc., 2010
— Coordinating Research Council, Inc., Handbook of Aviation Fuel Properties. Atlanta, GA: CRC, Inc., 2004
— Kuchta, Joseph M., Summary of Ignition Properties of Jet Fuels and Other Aircraft Combustible Fluids, Technical Report AFAPL-TR-75-70. Springfield, VA: U.S. Department of Commerce, 1975
3. Definitions
— Autogenous Ignition (Auto-Ignition) Temperature (AIT). The minimum temperature at which an optimised flammable vapour and air mixture will spontaneously ignite when heated to a uniform temperature in a normal atmosphere without an external source of ignition, such as a flame or spark.
— Flammability Limit. The highest and lowest concentration of fuel-in-air-by-volume per cent that will sustain combustion. A fuel-to-air mixture below the lower limit is too lean to burn, while a mixture above the upper limit is too rich to burn. The flammability limit varies with altitude and temperature and is typically presented on a temperature-versus-altitude plot.
— Flash Point. The minimum temperature at which a flammable liquid will produce flammable vapour at sea level ambient pressure.
— Flame Holding. The ability of a flame arrestor to halt the propagation of a flame front through a passage.
— Ignition Source. A source of sufficient energy to initiate combustion of a fuel-air mixture. Hot surfaces that can exceed the auto-ignition temperature of the flammable vapour under consideration are considered to be ignition sources. Electrical arcs, electrical sparks, and friction sparks are also considered to be ignition sources if sufficient energy is released to initiate combustion.
— Stoichiometric Ratio. The ratio of fuel to air corresponding to the condition in which the available amounts of fuel and oxygen completely react with each other, thereby resulting in combustion products that contain neither fuel nor oxygen.
4. Acceptable means of compliance
Acceptable means of compliance with CS 25.975(a)(7) include:
— flame arrestors in the fuel tank vents that prevent flame propagation into the fuel tank
(see paragraph 5 of this AMC);
— fuel tank inerting systems that exceed the basic requirements of CS 25.981 and prevent fuel tank explosions* (see paragraph 7.1 of this AMC);
— fuel tank pressurisation systems or features of the system that result in a closed vent system and that are effective in preventing a fuel tank explosion during all operating conditions (e.g. taxiing, take-off, landing, refuelling, etc.) and post-crash fire conditions (see paragraph 7.2 of this AMC); and
— fuel tank or vent system fire suppression systems that prevent a fuel tank explosion with a fire present at the fuel tank vent outlet for the required 2 minutes and 30 seconds (see paragraph 7.3 of this AMC).
* Fuel tank inerting systems that meet CS 25.981 would not necessarily be adequate for demonstrating compliance with CS 25.975 because CS 25.981 does not require the fuel tank ullage to be fully inert at all times. If inerting is used as the means of compliance with CS 25.975, the inerting system must be effective in preventing flame that is present at the vent outlet from propagating to the fuel tank. The applicant should show this during normal operating conditions, all foreseeable ground fire conditions (e.g. from refuelling, refuelling overflow, etc.), and post-crash ground fire conditions.
5. Flame arrestors
5.1. This paragraph describes the use of flame arrestors as a means of meeting the 2-minute and 30-second time requirements defined in CS 25.975(a)(7). The guidance is based on evaluating the flame arrestor performance during critical case conditions anticipated to occur when fire is adjacent to the fuel tank vent outlet. The flame arrestor should meet the performance described in this AMC during post‑crash ground fires or other fire scenarios such as those resulting from fuel leakage due to fuel tank damage or fuel spilled during refuelling mishaps.
5.2. Flame arrestors that meet the standards defined in this AMC may not be effective in preventing the propagation of fires that may occur following lightning strikes near the fuel tank vent outlet. The ignition of fuel vapours near the vent outlet caused by lightning results in a high-speed pressure wave that can travel through the flame arrestor without sufficient time for the heat transfer necessary for the flame arrestor to quench the flame front. Instead, fuel tank vent lightning protection may be addressed as discussed in AMC 25.954 ‘Fuel System Lightning Protection’, which is based on locating vents outside the lightning strike zones of the aeroplane. While aeroplane manufacturers have used flame arrestors to address lightning protection in several instances, they needed dedicated testing that addressed the unique design features to demonstrate the effectiveness of the installation. The guidance in this AMC is intended to address compliance with CS 25.975(a)(7) and is not intended to be used as guidance for showing compliance with the lightning protection requirements in CS 25.954.
5.3. The installation of flame arrestors in the aeroplane fuel vent system will affect the performance of the fuel tank vent system. The applicant should account for factors such as the introduction of a flow restriction and the associated increase in the pressure drop during refuelling system failure conditions, as well as the impact of environmental conditions such as icing and lightning, when requesting approval of the fuel tank installation. Means of compliance for these considerations are not addressed in this AMC. General fuel system guidance is provided in AMC 25.963 and AMC 25.981.
5.4. Previous results from flame arrestor performance tests indicated that the critical condition for evaluating the effectiveness of the flame arrestor occurs when the flame front contacts the surface of the flame arrestor, which results in heating of the flame arrestor. As the flame arrestor is heated, the ability of the flame arrestor to absorb energy may be reduced, resulting in its inability to quench the flame. Once this occurs, the flame will then pass through the flame arrestor, resulting in flashback. It is important to realise that flashback through heated flame arrestor channels, which normally quench flames, should not be confused with auto-ignition or hot surface ignition. Flashback will occur when the rate of heat loss to the channel wall is insufficient to quench the flame. In this case, the wall acts as an inadequate heat sink and not as an ignition source. The flame retains sufficient heat energy to pass to the upstream side of the flame arrestor.
5.5. Flame propagation past the flame arrestor may also occur due to the ignition of flammable vapours by hot surfaces. The time it takes for the assembly surfaces on the internal side of the flame arrestor, including the line and housing, to be heated to a temperature higher than the AIT of the flammable vapour mixture could be the limiting factor in establishing the effectiveness of the flame arrestor assembly. The ignition of combustible mixtures by hot surfaces (auto-ignition) involves different phenomena from the phenomena involved in flashback as discussed in paragraph 5.4 of this AMC. For auto-ignition to occur, a portion of the combustible gas must dwell near a hot surface long enough for the amount of chemical heat produced to become greater than the heat dissipated to the surroundings. The maximum dwell time (commonly termed the ‘ignition lag’) is a function of the heat transfer characteristics of the gas and the heat source, as well as the kinetics of the combustion process. For this reason, the surface area and the shape of the hot surface, and the flow field around the heat source, are critical factors in determining whether ignition will occur.
5.6. The test conditions defined in this AMC are intended to evaluate the effectiveness of flame arrestors during two conditions. The first condition is the ignition, by an external source, of flammable vapours at the fuel tank vent outlet. The flame arrestor should be effective in stopping the initial propagation of flames. The second condition is a continuous flow of vapour exiting the fuel vent. The flame arrestor should hold the flames without passing the flames to the upstream portion of the vent system. The applicant should determine the critical test conditions following a review and analysis of the particular flame arrestor installation and its characteristics.
5.7. The conditions under which the flame arrestor should be effective include those where flammable fluid vapours are exiting the fuel tank at flow rates that vary from no flow, which typically occurs during normal ground operations, to high-flow conditions, which typically occur during refuelling or when the fuel tank is heated due to a ground fire following an accident.
5.8. The applicant should conduct an analysis to determine the pass/fail criteria for the aeroplane-specific flame arrestor installation. The analysis should include consideration of hot surface ignition when determining whether the flame arrestor assembly meets the explosion prevention requirement of 2 minutes and 30 seconds. The maximum surface temperatures of the flame arrestor installation and the flame arrestor should be established when meeting the requirement. The applicant should consider the velocity of the flammable fluid vapour on the surface of the flame arrestor and the duct sidewall upstream (tank) side of the flame arrestor. Provided that a uniform vapour velocity is present (i.e. there are no areas of stagnation), a heat source whose temperature exceeds the AITs quoted for static conditions (typically 230 °C/450 °F) will not cause ignition in the flame arrestor installation. Data in the Handbook of Aviation Fuels Properties (see Chapter 2.2 of this AMC) show the relationships between vapour velocities and AITs. Test results from developmental testing of flame arrestors installed in fuel vent lines have shown that ignition will not occur if the temperature of the centre of the flame arrestor remains below 370 °C/700 °F. However, this temperature limit may not be appropriate for other surfaces in the flame arrestor installation where a uniform flammable vapour flow is not present. The applicant should analyse the flame arrestor design to determine the critical locations and fuel vapour flow conditions that result in the highest surface temperatures, and run an adequate number of test conditions to validate the analysis.
6. Demonstrating compliance using flame arrestors
6.1. The performance of a flame arrestor is influenced by installation effects that may cause variations in critical parameters such as the speed of the flame front and the temperatures of the surfaces. The applicant should account for such installation effects in demonstrating compliance. The applicant may choose to show compliance with CS 25.975(a)(7) by testing a complete, conformed production installation of the flame arrestor (including the upstream and downstream ducting). Alternatively, the applicant may request EASA approval to use other tests and analysis of the flame arrestor and the installation as a means of compliance.
6.2. The applicant may propose to use flame arrestor elements from a supplier. The supplier may have previously qualified an element to flame propagation requirements without consideration of the design of the aeroplane into which the flame arrestor will be installed. The applicant should conduct tests to show that they have accounted for any effects of the installation, including flame front speeds and duct sidewall temperatures. The fuel types for these tests differ, and should be established as discussed in paragraph 6.3.1.3 of this AMC prior to conducting any testing.
6.3. Flame arrestor installation test.
6.3.1. Test Set-up.
Figure A-1 shows a schematic of the test set-up. The test set-up involves mounting the flame arrestor element in a tube configuration that is representative of the aeroplane installation. The speed of the flame front that travels down the fuel vent system tubing toward the flame arrestor is a critical factor in the performance of the flame arrestor in preventing flame propagation. The flame front will accelerate down the tubing, so higher velocities will occur if the flame arrestor is located farther away from the fuel tank vent outlet. Therefore, the shape and diameter of the tubing and its length from the fuel tank vent inlet to the flame arrestor should be representative of the production configuration, unless the flame arrestor element was previously found to comply in an installation in which the speed of the flame reaching the flame arrestor was higher. In addition, the orientation of the flame arrestor in the fixture is a critical parameter for the compliance demonstration. For instance, a flame arrestor installation that faces downward, so a ground fire impinges on its face, will have a shorter duration flame-holding capability than a flame arrestor that is mounted horizontally.
6.3.1.1. Test fixture features.
The applicant should consider the following features in designing the flame arrestor test fixture:
1. Orient the element to simulate the actual aeroplane installation.
2. Cut viewing sections into the pipe upstream and downstream of the flame arrestor element and cover them with transparent material to provide visual access to the element.
3. Locate igniters upstream and downstream of the element.
4. Locate thermocouples in the duct to measure the incoming flammable mixture temperature and the vapour temperatures downstream of the flame arrestor element.
5. Install thermocouples on the surface of the centre of the flame arrestor element’s upstream face and on the surface of the upstream side of the duct.
6. Incorporate a pressure-relief feature in the upstream portion of the system to relieve explosive pressures when ignition of the upstream flammable fluid vapour occurs.
7. Mix air that is at a temperature higher than the boiling point of the fuel being used (see paragraph 6.3.1.3 of this AMC) with fuel, and introduce it at the inlet of the tube.
8. Vary fuel–air ratios by adjusting the respective fuel-vapour and air-supply rates.
6.3.1.2. Test equipment.
The test equipment should include:
1. The test article, including the flame arrestor and the downstream section of the vent system assembly that meets production specifications.
2. A section of ducting that is representative of the production flame arrestor installation.
3. A means of generating a supply of fuel vapour at preselected fuel-to-vapour air ratios and various flow rates.
4. A window for observing upstream and downstream conditions during the test. This should allow to determine the location of the flame front relative to the flame arrestor.
5. A means to measure temperatures on the upstream duct surfaces and the flame arrestor.
6. A means to measure fuel vapour mixture temperatures both upstream and downstream of the flame arrestor.
7. A means to relieve explosive pressure upstream of the flame arrestor.
8. Ignition sources for igniting the explosive mixture upstream and downstream of the flame arrestor.
6.3.1.3. Fuel type.
6.3.1.3.1. The applicant should establish the critical fuel type for the test based on a review of the approved fuels for the aeroplane model. The applicant should use fuels in the test that have representative characteristics of the critical fuel approved for use in the aeroplane. The use of hexane as a representative fuel for kerosene fuels such as Jet A and TS-1 has been found to be acceptable. Hexane (C6H14) is readily available and easily manipulated in the gaseous state, so it is typically a fuel of choice. The AIT for hexane of 223°C/433°F closely simulates that of Jet A kerosene fuel, which has an AIT of 224°C/ 435°F, and JP-4 which has an AIT of 229°C/445°F.
Note: The applicant should not use fuels with higher AITs than these, such as propane, for the flame arrestor element test because ignition on the back side of the flame arrestor would not be adequately evaluated.
6.3.1.3.2. Table A-1 summarises the properties of hexane and provides an example of the method for calculating the stoichiometric relationship of hexane needed for the test.
6.3.1.3.3. The applicant may use propane for testing of a flame arrestor installation if the AIT is not a critical parameter for the test. For example, testing of a simulated production flame arrestor installation to validate that temperatures of portions of the installation within the fuel tank remain below the maximum permitted fuel tank surface temperature (typically 200 °C/400 °F) would be acceptable, provided that the applicant or supplier has previously shown that the flame arrestor element meets the flame-holding requirements.
6.3.1.3.4. Table A-3 summarises the properties of propane as provided in FAA Technical Report ADS‑18, Lightning Protection Measures for Aircraft Fuel Systems (see Chapter 2.2 of this AMC), and provides an example of the method for calculating the stoichiometric ratio of propane.
6.3.1.4. Thermocouples.
The applicant should use bare junction 1/16- to 1/8-inch metal-sheathed, ceramic-packed, chromel‑alumel thermocouples with nominal 22 to 30 AWG (American wire gage) size conductors or equivalent. The applicant should not use air-aspirated, shielded thermocouples. Experience has shown that 1/16-inch thermocouples may provide more accurate calibration than 1/8-inch thermocouples; the 1/16-inch thermocouples are therefore recommended.
6.3.1.5. Test specimen.
The test specimen should be a production component that conforms to the type design intended for certification.
6.3.2. Test conditions.
Two types of tests are typically needed to demonstrate compliance: one for flame propagation prevention in a static vent vapour flow condition, and one for flame holding in a continuous vapour flow condition. These conditions provide a conservative demonstration of fuel tank vent fire protection capability with respect to delaying flame front propagation through the fuel vent flame arrestor installation during ground fire conditions.
6.3.2.1. Flame propagation test (static).
This test demonstrates the element’s flame-arresting performance in a static condition at the critical fuel mixture condition of 1.15 ± 0.05 stoichiometric. This mixture is based on FAA-sponsored tests done by Atlantic Research, documented in the Lightning Protection Measures for Aircraft Fuel Systems report. The report shows curves of the flame arrestor equilibrium temperature for various air–flow ratios as a function of the per cent stoichiometric fuel–air ratio (see Figure A-2 in this AMC). These curves maximise at about 1.10 to 1.20 stoichiometric. The curves indicate that higher temperatures occur at lower flow rates.
6.3.2.1.1. Establish the mixed flow.
Close the fuel and air valves. Ignite the mixture downstream of the element. Verify that flames did not propagate through the flame arrestor by observing it through the viewing window. Verify that the upstream mixture is combustible by energising the upstream igniter and observing the ignition of the upstream mixture. The applicant should repeat this test a minimum of 5 times at this mixture, as is done with explosion proof testing.
6.3.2.1.2. Flame front velocity.
The velocity of the flame front as it reaches the flame arrestor can significantly influence the effectiveness of the flame arrestor in preventing flame propagation. The flame front velocity increases as the flame travels down a vent line containing flammable vapours. The velocity of the flame front is installation-dependent and influenced by the length and diameter of the vent line, and by flow losses between the ignition source and the flame arrestor. The test configuration should include consideration of these critical features. If an applicant proposes to use a previously approved flame arrestor element in a new installation with a different length or diameter of the vent line than previously tested, the applicant should account for these installation differences in the compliance demonstration. The applicant may need to conduct a separate test to demonstrate that the flame arrestor is effective in the installed configuration.
6.3.2.2. Flame-holding test.
The purpose of this test is to show that a flame present at the fuel tank vent outlet, when a continuous flow of flammable vapour is exiting the vent, will not propagate into the fuel tank. The test conditions for this test are based on test results documented in the Lightning Protection Measures for Aircraft Fuel Systems report that resulted in the highest flame arrestor temperature. Run this test at a 1.15 stoichiometric fuel–air ratio. The flammable vapour flow rate that achieves a velocity of 0.75 to 1.0 feet per second (ft/s) across the flame arrestor is the range where flame arrestor failure occurred in the shortest time during development testing.
Adjust the flow to achieve a velocity of 0.75 ft/s (+ 0.25, – 0 ft/s) across the flame arrestor and ignite it downstream of the flame arrestor.
Determine and establish the location of the flame front by viewing it through the viewing window.
Determine the position of the flame front and adjust the vapour flow rate such that the flame front contacts the downstream flame arrestor face, resulting in the greatest rate of heating of the flame arrestor surface.
Take care to maintain the flammable vapour flow rate at a constant value throughout the test so as to maintain the correct fuel‑to-air ratio.
6.3.2.2.1. Flame arrestor element maximum surface temperatures.
Monitor the temperature at the upstream centre of the flame arrestor during the flame-holding test; it is required to stay below 370 °C/700 °F for the first 2 minutes and 30 seconds after the ignition. Data from developmental testing show that the temperature of the centre of the upstream flame arrestor face at which failure (i.e. propagation of the flame) occurred was typically above 370 °C/700 °F, which is well above the AIT of JP‑4 fuel vapour of 229 °C/445 °F, as established during no-flow conditions. The upstream flame arrestor temperature can go well above the AIT without causing upstream ignition because of the high local velocity of the vapour. For this reason, hexane, with an AIT of 223 °C/433 °F, should be used for the test of the flame arrestor element.
6.3.2.2.2. Flame arrestor installation and vent system maximum surface temperatures.
The compliance demonstration must show that flames present at the vent outlet do not propagate into the fuel tank during the first 2 minutes and 30 seconds after ignition. If the flame arrestor installation or any vent system components that are exposed to the flame are installed in locations where the ignition of flammable vapours could result in the propagation of the fire into the fuel tank, the applicant must show that ignition of the fuel vapours does not occur. This may require the installation of additional surface temperature instrumentation as part of the compliance demonstration test. The applicant should establish temperature limits for any components of the vent or flame arrestor assembly that are located in spaces where flammable vapours may be present, based on the location of the components in relation to the fuel tank. AMC 25.981 provides guidance for establishing a maximum allowable surface temperature within the fuel tank (the tank walls, baffles, or any components) that provides a safe margin, under all normal or failure conditions, that is at least 30 °C/50 °F below the lowest expected AIT of the approved fuels. The AIT of fuels will vary because of a variety of factors (e.g. ambient pressure, dwell time, fuel type, etc.). The AIT accepted by EASA without further substantiation for kerosene fuels, such as Jet A, under static sea level conditions, is 232 °C/450 °F. This results in a maximum allowable surface temperature of 200 °C/400 °F for an affected surface of a fuel tank component. Higher surface temperature limits in flammable fluid leakage zones may be allowed in certain cases where the applicant can substantiate that the higher temperature limits are acceptable. The applicant should monitor and record surface temperatures for any components where the analysis-established limits were required, and should show that the surface temperatures remain below the established limits.
6.3.3. Pass/fail criteria.
6.3.3.1. The flame arrestor installation should meet the following performance criteria, as described in paragraph 6.3.2 of this AMC:
It should pass the static propagation test;
It should have a minimum flame-holding time of 2 minutes and 30 seconds;
Installation-dependent maximum surface temperature limits should be established for any flame arrestor and vent system components located in fuel tanks or flammable fluid leakage zones that are determined to be potential sources that could propagate the flame from the external vent to the fuel tank.
6.3.3.2. After completing the flame arrestor tests noted above, the applicant should carefully examine the integrity of the structure of the flame arrestor. Suppliers have constructed flame arrestors from one flat and one corrugated stainless steel sheet that are rolled up and placed into a flanged casing. This construction produces a series of small passages. Structural integrity of the coiled sheet metal is maintained by either rods that cross at the front and rear faces of the coil or by brazing or welding of the coiled sheet metal at various points around the surface. Flame arrestors have failed the test when the flame passed across the flame arrestor because structural integrity was lost during the test due to failures of welds or brazed joints. Damage to components of the flame arrestor assembly is acceptable if the flame arrestor installation prevents flame propagation during the test, and the maintenance requirements specify that the flame arrestor must be repaired or replaced following an event where the flame arrestor was exposed to flame.
6.3.4. Related qualification and installation considerations.
This paragraph does not contain an all-inclusive list of applicable qualification considerations. The tests should show that each component performs its intended function within the environment where it is installed. The applicant should establish design-specific qualification requirements in addition to the items listed in this paragraph.
6.3.4.1. Vibration.
Test the flame arrestor in a vibration environment representative of the installation.
6.3.4.2. Icing.
Installation of a flame arrestor will probably introduce a point in the vent system where icing is likely. The applicant should account for this effect in the vent system design by either installing pressure‑relief provisions that protect the tank from excessive pressure differentials, or by showing that icing or clogging of the flame arrestor with ice is not possible.
6.3.4.3. Fuel tank bottom pressures.
In many cases, applicants have established the size of fuel tank vent systems, and the associated fuel tank refuelling rates, based on the bottom pressure of the fuel tank after failure of the refuelling system shut-off system and the resulting fuel overflow of the tank through the vent system. However, installation of a flame arrestor or modifications to the vent system may result in increased tank bottom pressures. Therefore, if an applicant adds a flame arrestor to a fuel vent, or modifies an existing flame arrestor, the applicant should evaluate the effects of these changes on the tank bottom pressure, and adjust the refuelling rates to maintain the fuel tank bottom pressures within the limits that were established by the fuel tank structural analysis.
6.3.4.4. Lightning.
The applicant must show that the fuel tank vent system installation complies with CS 25.954. AMC 25.954 provides guidance in meeting those requirements. FAA Technical Report ADS-18 (see paragraph 2.2 of this AMC) provides factors that the applicant should consider when developing features to protect fuel tank vents from lightning.
7. Demonstrating compliance using fuel tank inerting, fuel tank pressurisation, and fire suppression systems
7.1. Fuel tank inerting.
An applicant’s use of fuel tank inerting systems to show compliance with CS 25.975(a)(7) requires them to demonstrate that the design prevents fuel tank explosions during all operating conditions (e.g. taxiing, take-off, landing, refuelling, etc.) and post-crash fire scenarios. To comply with CS 25.981, inerting systems are not required to inert the fuel tanks during all operating conditions. Therefore, if an applicant proposes an inerting system as the means of compliance with CS 25.975(a)(7), the system would need to have additional capability to prevent fuel tank explosions during all operating conditions. For example, inerting systems found compliant with CS 25.981typically allow the fuel tanks to become flammable during refuelling operations, and when the inerting system is inoperative. The applicant would need to address these conditions in order to ensure that the system continues to meet the requirements of CS 25.975(a)(7).
7.2. Fuel tank pressurisation systems.
Fuel tank pressurisation systems or features of the system that result in a ‘closed’ vent system may become inoperative during an accident or the subsequent post-crash fire scenario. If the applicant proposes fuel tank inerting or pressurisation as the means of compliance with CS 25.975(a)(7), the applicant must show that these means are effective in preventing a fuel tank explosion during all operating conditions (e.g. taxiing, take-off, landing, refuelling, etc.) and post-crash fire conditions.
7.3. Fire suppression systems.
Fuel tank or vent system fire suppression systems are typically activated by a light sensor, and they discharge a fire-suppressant agent that is only effective for a short time. Demonstrating compliance using this technology would require the applicant to show its effectiveness in preventing a fuel tank explosion with a fire present at the fuel tank vent outlet for a minimum of 2 minutes and 30 seconds.
[Amdt 25/21]
Appendix A – Example of Calculation for Fuel-to-Air Ratio
ED Decision 2018/005/R
Table A-1. Combustion Properties of Hexane
|
Property |
Value |
|
Heat of combustion, BTU/lb. |
19 200 |
|
Molecular weight |
86.17 |
|
Limits of inflammability in air (% by volume) per cent: Lower Upper |
1.2 7.4 |
|
Flash point |
– 22 °C/– 7 °F |
|
Boiling point |
69 °C/156 °F |
|
Auto-ignition temperature (AIT) |
223 °C/433 °F |
|
Vapour pressure at 21 °C/70 °F (Pa/psia) |
17 237/2.5 |
Note: The equation for the combustion of hexane and oxygen is written as:
2 C6 H14 + 19 O2 = 14 H2O + 12 CO2
For every 2 moles of hexane consumed, 19 moles of oxygen are required for complete combustion with no residual oxygen. Thus, 172.34 g of hexane require 19 × 32.00 = 608 g of oxygen or 2 627.48 g of air, which is 23.14 per cent by weight oxygen. Hence, the ratio of the weight of air to the weight of hexane required for stoichiometric burning (i.e. complete combustion of hexane with no excess oxygen) is 15.24.
A 1.15 fraction of stoichiometric mixture of air and hexane has an air-to-fuel weight ratio of:
Table A-2. Fuel-to-Air Mixtures for Flame Arrestor Tests
|
Condition |
JP-4 Per cent by Volume |
JP-4 Fuel-Air Mass Ratio |
Hexane Per cent by Volume |
Hexane Fuel-Air Mass Ratio |
|
Lean limit |
0.90 |
0.035 |
1.3 |
0.04 |
|
Between lean limit and stoichiometric |
1.10 |
0.045 |
1.7 |
0.05 |
|
Stoichiometric |
1.58 |
0.065 |
2.2 |
0.0658 |
|
1.15 Stoichiometric |
1.82 |
0.074 |
2.5 |
0.07567 |
|
Between stoichiometric and rich limit |
3.0 |
0.15 |
6.3 |
0.2 |
|
Rich limit |
6.16 |
0.23 |
8.0 |
0.26 |
Table A-3. Combustion Properties of Propane
|
Property |
Value |
|
Heat of combustion (298 °K), kcal/g-mole |
530.6 |
|
Flammability limits in air (% by volume), per cent: Lower Upper |
2.2 9.5 |
|
Flame temperature (stoichiometric in air, STP) |
1 925 °C/3 497 °F |
|
Quenching diameter,* cm/in |
0.28/0.11 |
|
Minimum spark ignition energy,* millijoules |
0.027 |
|
Critical velocity gradient for flashback,* sec-1 |
600 |
|
Laminar flame speed,* cm-sec |
40 |
*Applicable to 1.1 stoichiometric propane-to-air at standard temperature and pressure (STP).
Note: The equation for the combustion of propane and oxygen is written as:
C3H8+ 5 O2 = 4 H2O + 3 CO2
For every mole of propane consumed, 5 moles of oxygen are required for complete combustion with no residual oxygen. Thus, 44.09 g of propane require 5 × 32.00 = 160 g of oxygen or 691.44 g of air, which is 23.14 per cent by weight oxygen. Hence, the weight of air to weight of propane required for stoichiometric burning (i.e. complete combustion of propane with no excess oxygen) is 15.7.
A 1.15 fraction of stoichiometric mixture of air and propane has an air-to-fuel weight ratio of:
Figure A-1. Fuel Tank Vent Flame Arrestor Test Schematic
Figure A-2. Flame Arrestor Surface Temperature at Various Flow Rates and Stoichiometric Mixture Ratios*
* FAA Technical Report ADS-18, Lightning Protection Measures for Aircraft Fuel Systems (see paragraph 2.2 of this AMC).
[Amdt 25/21]
ED Decision 2003/2/RM
(a) There must be a fuel strainer for the fuel tank outlet or for the booster pump. This strainer must –
(1) Reserved.
(2) Prevent the passage of any object that could restrict fuel flow or damage any fuel system component.
(b) Reserved.
(c) The clear area of each fuel tank outlet strainer must be at least five times the area of the outlet line.
(d) The diameter of each strainer must be at least that of the fuel tank outlet.
(e) Each finger strainer must be accessible for inspection and cleaning.
CS 25.979 Pressure fuelling system
ED Decision 2016/010/R
(See AMC 25.979)
For pressure fuelling systems, the following apply:
(a) Each pressure fuelling system fuel manifold connection must have means to prevent the escape of hazardous quantities of fuel from the system if the fuel entry valve fails.
(b) An automatic shut-off means must be provided to prevent the quantity of fuel in each tank from exceeding the maximum quantity approved for that tank. This means must –
(1) Allow checking for proper shut-off operation before each fuelling of the tank; and
(2) Provide indication, at each fuelling station, of failure of the shut-off means to stop the fuel flow at the maximum quantity approved for that tank.
(c) A means must be provided to prevent damage to the fuel system in the event of failure of the automatic shut-off means prescribed in sub-paragraph (b) of this paragraph.
(d) The aeroplane pressure fuelling system (not including fuel tanks and fuel tank vents) must withstand an ultimate load that is 2·0 times the load arising from the maximum pressures, including surge, that is likely to occur during fuelling. The maximum surge pressure must be established with any combination of tank valves being either intentionally or inadvertently closed. (See AMC 25.979(d).)
(e) The aeroplane defuelling system (not including fuel tanks and fuel tank vents) must withstand an ultimate load that is 2·0 times the load arising from the maximum permissible defuelling pressure (positive or negative) at the aeroplane fuelling connection.
[Amdt 25/18]
AMC 25.979(d) Pressure fuelling systems
ED Decision 2003/2/RM
1 Pressure fuelling systems, fuel tanks and the means preventing excessive fuel pressures, should be designed to withstand normal maximum fuelling pressure of not less than 345 kN/m2 (50 psi) at the coupling to the aeroplane.
2 Pressure fuelling systems should be so arranged that the fuel entry point is at or near the bottom of the tank so as to reduce the level of electrostatic charge in the tank during fuelling.
CS 25.981 Fuel tank explosion prevention
ED Decision 2020/024/R
(a) No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapours. This must be shown by:
(1) Determining the highest temperature allowing a safe margin below the lowest expected auto-ignition temperature of the fuel in the fuel tanks.
(2) Demonstrating that no temperature at each place inside each fuel tank where fuel ignition is possible will exceed the temperature determined under sub-paragraph (a)(1) of this paragraph. This must be verified under all probable operating, failure, and malfunction conditions of each component whose operation, failure, or malfunction could increase the temperature inside the tank.
(3) Except for the ignition sources due to lightning addressed by CS 25.954, demonstrating that an ignition source could not result from each single failure, from each single failure in combination with each latent failure condition not shown to be extremely remote, and from all combinations of failures not shown to be extremely improbable, taking into account the effects of manufacturing variability, ageing, wear, corrosion, and likely damage.
(b) Fuel tank flammability
(1) To the extent practicable, design precautions must be taken to prevent the likelihood of flammable vapours within the fuel tanks by limiting heat and energy transfer (See AMC 25.981(b)(1)).
(2) Except as provided in sub-paragraph (4) of this paragraph, no fuel tank Fleet Average Flammability Exposure level may exceed the greater of:
(i) three percent, or
(ii) the exposure achieved in a fuel tank within the wing of the aeroplane model being evaluated. If the wing is not a conventional unheated aluminium wing, the analysis must be based on an assumed Equivalent Conventional Unheated Aluminium Wing (see AMC 25.981(b)(2)).
The Fleet Average Flammability Exposure is determined in accordance with appendix N of CS-25.
(3) Any active Flammability Reduction means introduced to allow compliance with sub-paragraph (2) must meet appendix M of CS-25.
(4) Sub-Paragraph (2) does not apply to a fuel tank if following an ignition of fuel vapours within that fuel tank the aeroplane remains capable of continued safe flight and landing.
(c) Reserved.
(d) To protect design features that prevent catastrophic ignition sources within the fuel tank or fuel tank system according to subparagraph (a) of this paragraph, and to prevent increasing the flammability exposure of the tanks above that permitted in subparagraph (b) of this paragraph, the type design must include critical design configuration control limitations (CDCCLs) identifying those features and providing instructions on how to protect them. To ensure the continued effectiveness of those features, and prevent degradation of the performance and reliability of any means provided according to subparagraphs (a) or (b) of this paragraph, the type design must also include the necessary inspection and test procedures, intervals between repetitive inspections and tests, and mandatory replacement times for those features. The applicant must include information required by this subparagraph in the Airworthiness Limitations Section of the Instructions for Continued Airworthiness required by CS 25.1529. The type design must also include visible means of identifying the critical features of the design in areas of the aeroplane where foreseeable maintenance actions, repairs, or alterations may compromise the CDCCLs.
[Amdt 25/1]
[Amdt 25/6]
[Amdt 25/9]
[Amdt 25/18]
AMC 25.981(a) Fuel Tank Ignition Source Prevention
ED Decision 2020/024/R
TABLE OF CONTENT
1 PURPOSE
2 SYSTEM SAFETY ASSESSMENT (SSA)
3 FUEL VAPOUR IGNITION SOURCES
3.1 Overview
3.2 Electrical sparks and electrical arcs
3.3 Filament heating current limit
3.4 Friction sparks
3.5 Maximum allowable surface temperatures
3.6 Fuel system electrostatics
4 DESIGN CONSIDERATIONS
4.1 Fibre optics
4.2 Fuel pump electrical power supply
4.3 Location of the pump inlet
4.4 Wiring
5 SAFETY ANALYSIS
5.1 Ignition source failure analysis
5.2 Qualitative safety assessment
5.3 Assumptions and considerations for fuel tank system analysis
6 COMPONENT FAILURE MODE CONSIDERATIONS
6.1 Component qualification review
6.2 Maximum component temperature for qualification of fuel system components
6.3 Possible failure modes for determination of maximum component temperatures
7 AIRWORTHINESS LIMITATIONS FOR THE FUEL TANK SYSTEM
Appendix A. Certification of Arc Fault Circuit Breakers (AFCBs) or Ground Fault Interrupters (GFIs)
Appendix B. Related Documents
Appendix C. Definitions
1 PURPOSE
This AMC describes how to show compliance with CS 25.981, which provides the certification requirements for the prevention of ignition sources, other than lightning, within the fuel tanks of transport category aeroplanes. This AMC includes guidelines for the prevention of failure conditions created from ignition sources other than lightning. It describes a means of compliance, using circuit‑protective devices such as an arc-fault circuit-breaker (AFCB) or ground fault interrupter (GFI), to provide fail-safe features that have been accepted as showing compliance with CS 25.981. This AMC does not apply to the flammability requirements in CS 25.981(b).
2 SYSTEM SAFETY ASSESSMENT (SSA)
2.1 Before conducting an SSA of the fuel system, each applicant should assemble and review the relevant lessons learned from the overall transport fleet history, as well as from its previous products and suppliers and any other available sources to assist in identifying any unforeseen failures, wear, or other conditions that could result in an ignition source. The sources of information include aeroplane service records, flight logs, inspection records, and component supplier service and sales records.
2.2 Safety assessments of previously certified fuel systems may require additional considerations. For these safety assessments, component sales records may assist in identifying whether component failures and replacements are occurring. In addition, in some cases, changes to components have been introduced following the original type design certification without consideration of the possible effects of the changes on the system’s compliance with the requirements to prevent ignition sources. For example, certain components within fuel pumps (e.g., thrust washers) have been changed to improve the life of the pumps, which defeated the original fail-safe features of the pumps. Therefore, the results of reviewing this service history information, and a review of any changes to components from the original type design, should be documented as part of the safety analysis of the fuel tank system.
2.3 The following lists summarise the design features, malfunctions, failures, and maintenance/operational-related actions that have been identified through service experience as resulting in degradation of the safety features of aeroplane fuel tank systems. These lists are provided as guidance and are not inclusive of all the failures that need to be considered in the failure assessment. They may assist in evaluating possible failure modes during the evaluation of a fuel tank installation.
2.3.1 Pumps
1. The ingestion of pump inlet components (e.g., inducers, fasteners) into the pump impeller, releasing debris into the fuel tank.
2. Pump inlet case degradation, allowing the pump inlet check valve to contact the impeller.
3. A failure of one phase of the stator winding during operation of the fuel pump motor, together with a subsequent failure of a second phase of the motor windings, resulting in arcing through the fuel pump housing.
4. Arcing due to the exposure of electrical connections within a pump housing that has been designed with inadequate clearance to the pump cover.
5. The omission of cooling port tubes between the pump assembly and the pump motor assembly during a pump overhaul.
6. Extended dry running of fuel pumps in empty fuel tanks (e.g. caused by a failure of the fuel pump relay in the on position).
7. The use of steel impellers that may produce friction sparks if debris enters the pump.
8. Debris lodged inside pumps.
9. Pump power supply connectors that have been damaged, worn, or corroded, resulting in arcing within the connector that damages the hermetic seal, causing fuel leakage.
10. Electrical connections within the pump housing that have been designed with inadequate clearance or insulation from the metallic pump housing, resulting in arcing.
11. Thermal switches ageing over time, resulting in a higher trip temperature.
12. Flame arrestors falling out of their respective mountings.
13. Internal wires coming in contact with the pump rotating group, energising the rotor, and arcing at the impeller/adapter interface.
14. Poor bonding across component interfaces.
15. Insufficient arc-fault or ground-fault current protection capability.
16. Poor bonding of components to the structure.
17. Loads transferred from the aeroplane fuel-feed plumbing into the pump housing, resulting in a failure of the housing mounts and a subsequent failure of the pump case, which defeated the explosion‑proof capabilities of the pump.
18. A premature failure of the fuel pump thrust bearings, allowing steel rotating parts to contact the steel pump side plate.
19. Erosion of the fuel pump housing, causing a loss of the fuel pump explosion‑proof capability and exposure of the fuel pump wiring to the fuel tank.
2.3.2 Wiring to fuel pumps
1. Wear of Teflon or other insulating sleeving and wiring insulation on wires in metallic conduits located inside fuel tanks, allowing arcing from the wire through the conduits into fuel tank ullages.
2. Damage to the insulation on wiring routed adjacent to the fuel tank exterior surfaces, resulting in arcing to the metallic fuel tank surface.
2.3.3 Fuel pump connectors
1. Electrical arcing at connections within electrical connectors due to bent pins, wear, manufacturing variability (e.g. tolerances), or corrosion.
2. Fuel leakage and a subsequent fuel fire outside the fuel tank caused by corrosion or wear of electrical connectors to the pump motor, leading to electrical arcing through the connector housing (the connector was located outside the fuel tank).
3. Selection of improper insulating materials in the connector design, resulting in degradation of the material because of contact with the fuel that is used to cool and lubricate the pump motor.
2.3.4 Fuel quantity indicating system (FQIS) wiring
1. Degradation of wire insulation material (cracking).
2. Conductive or semi-conductive (silver, copper, or cadmium) deposits on electrical connectors inside fuel tanks.
3. Inadequate wire separation between FQIS wiring and structure, or between other wiring, resulting in contact that causes chafing of the wiring.
4. Unshielded FQIS wires routed in wire bundles together with high-voltage wires, creating the possibility of short-circuit failures on the FQIS wires in excess of the intrinsically safe levels.
5. FQIS wiring that does not adhere to the aeroplane manufacturer’s standard wiring practices (i.e., wires bent back along themselves with a bend radius less than the one defined in the aeroplane manufacturer’s standard wiring practices, multiple splices lying next to one another, etc.).
2.3.5 FQIS probe installation
1. Conductive or semi-conductive corrosion (copper or silver sulphur deposits) causing a reduced breakdown voltage in FQIS wiring.
2. Damage to FQIS wire insulation resulting in a reduced breakdown voltage because of wire clamping features at the electrical connections on fuel quantity probes.
3. Contamination in the fuel tanks creating an arc path for low levels of electrical energy between the FQIS probe walls (steel wool, lock wire, nuts, rivets, bolts, and mechanical impact damage to probes).
2.3.6 Valve actuators
A failure of one solenoid in a dual solenoid actuated valve, resulting in overheating of one solenoid to a temperature above the auto-ignition temperature.
2.3.7 Float switch systems
1. Conduits containing float switch wiring failures due to the freezing of water that entered the conduit, allowing fuel leakage into the conduit and along the aeroplane front spar, resulting in an engine tailpipe fire.
2. Float switch wire chaffing being observed, which might have provided a potential for a subsequent electrical short to the conduit.
3. A float switch sealing failure that allowed fuel/water to egress into the switch, compromising switch operation in an explosive environment.
2.3.8 Fuel tubes, vent tubes, conduits, and hydraulic lines.
1. Poorly conducting pipe couplings that may become electrical arc sources when exposed to electric currents.
2. Insufficient clearances between tubes and the surrounding structure.
3. Intermittent electrical bonding in flexible couplers.
4. Bonded couplers unable to conduct the expected power fault currents without arcing.
2.3.9 Electrical generator power feeder cables
1. Arcing of electrical power feeder cables to a pressurised fuel line, resulting in a fire adjacent to the fuel tank.
2. Arcing of electrical power feeder cables to an aluminium conduit, resulting in molten metal dropping onto a pressurised fuel line and consequently causing leakage of pressurised fuel.
2.3.10 Bonding straps
1. Corrosion of bonding strap wires, resulting in a failure to provide the required current paths.
2. Inappropriately attached connections (loose or improperly grounded attachment points).
3. Worn static bonds on fuel system plumbing connections inside the fuel tank, due to mechanical wear of the plumbing due to wing movement and corrosion.
4. Corrosion of the bonding surfaces near fuel tank access panels that could diminish the effectiveness of the bonding features.
5. Ageing of self-bonding fuel system plumbing connections, resulting in higher resistance bonding.
6. Missing bonds.
7. Loose or intermittent contacts between bond straps and other conductive components.
2.3.11 Pneumatic system failures
Leakage of hot air from ducting located near fuel tanks due to a duct failure, resulting in undetected heating of the tank surfaces to a temperature above the auto-ignition temperature.
2.3.12 Electrostatic Charge
1. The use of a non-conductive type of reticulated polyurethane foam in only a portion of the fuel tank system, which allowed electrostatic charge build-up and arcing in the unprotected portion of the system.
2. Spraying fuel through refuelling nozzles located in the upper portion of the tank.
3 FUEL VAPOUR IGNITION SOURCES
3.1 Overview
There are four primary phenomena that can result in the ignition of fuel vapour within aeroplane fuel tanks:
— Electrical sparks and arcs,
— Filament heating,
— Friction sparks, and
— Auto-ignition or hot surface ignition.
3.1.1 The conditions required to ignite fuel vapour from these ignition sources vary with the pressures and temperatures within the fuel tank, and can be affected by sloshing or spraying of fuel in the tank. Due to the difficulty in predicting fuel tank flammability and eliminating flammable vapour from the fuel tank, it should be assumed that a flammable fuel/air mixture may exist in aeroplane fuel tanks, and it is required that no ignition sources be present.
3.1.2 Any components located in or adjacent to a fuel tank must be designed and installed in such a manner that, during both normal and anticipated failure conditions, ignition of flammable fluid vapour will not occur. Compliance with this requirement is typically shown by a combination of component testing and analysis. Testing of components to meet the appropriate level of explosion‑proof requirements should be carried out for various single failures, and combinations of failures, to show that arcing, sparking, auto-ignition, hot surface ignition, or flame propagation from the component will not occur. The testing of components may be accomplished using several military standards and component qualification tests. For example, Method 511.6, Procedures I and II, of Military Standard MIL‑STD-810H ‘Environmental Engineering Considerations and Laboratory Tests’ dated January 2019 defines one method that can be used for showing that a component is explosion proof as defined in Appendix C of this AMC. Section 9 of EUROCAE ED-14G Change 1, dated January 2015, ‘Environmental Conditions and Test Procedures for Airborne Equipment’, and the equivalent RTCA, Inc., Document No DO-160G dated December 2010, can also be used for showing that airborne equipment is explosion proof.
3.2 Electrical sparks and electrical arcs
3.2.1 Laboratory testing has shown that the minimum ignition energy in an electrical spark required to ignite hydrocarbon fuel vapour is 200 microjoules*. Therefore, for electrical or electronic systems that introduce electrical energy into fuel tanks, such as FQISs, the energy of any electrical arcs or sparks that are created in any fuel tank should be less than 200 microjoules during either normal operation or operation with failures.
* The 200-microjoule level comes from various sources. The most quoted is from Lewis and von Elbe’s book, Combustion, Flames and Explosions of Gases (Florida: Academic Press, Inc., 1987; (orig. publ. 1938)). It has a set of curves for minimum ignition energy for the various hydrocarbon compounds in jet fuel, and they all have similar minimum ignition energy levels of greater than 200 microjoules.
Note: Standards that allow 320 microjoules are not acceptable for showing intrinsic safety. (‘Intrinsically safe’ is defined in Appendix C, paragraph C.19, of this AMC).
3.2.2 To ensure that the design has adequate reliability and acceptable maintenance intervals, a safety factor should be applied to this value when establishing a design limit. Fuel tank systems should be designed to limit the allowable energy level to the lowest practical level. Systems with a maximum energy of 20 microjoules are considered technologically feasible. Normal system operations at minimum ignition energies of up to 50 microjoules would be acceptable. Under failure conditions, the system should have an ignition energy of less than 200 microjoules.
3.3 Filament heating current limit
Analyses and testing indicate that a small piece of steel wool will ignite a flammable mixture when a current of approximately 100 milliamperes (mA) root mean square (RMS) is applied to the steel wool. Therefore, for electrical or electronic systems that introduce electrical energy into fuel tanks, such as FQIS, the electrical current introduced into any fuel tank should be limited. Because there is considerable uncertainty associated with the level of current necessary to produce an ignition source from filament heating, a safety factor should be applied to this value when establishing a design limit. A maximum steady-state current of 25 mA RMS is considered an intrinsically safe design limit for electronic and electrical systems that introduce electrical energy into fuel tanks. For failure conditions, the system should limit the current to 50 mA RMS, and induced transients to 125 mA peak current.
3.4 Friction sparks
Pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, lockwire, roll pins, cotter pins, drill chips, manufacturing debris, and so forth may be drawn into fuel pumps and contact the impeller, resulting in the possibility of metallic deposits on the rotating and stationary components within the pump. This condition has resulted in the creation of friction sparks, and this should be an assumed failure condition when conducting the SSA. Fail-safe features as described in paragraph 5.2.19.2.2 of this AMC have been used to mitigate this hazard.
3.5 Maximum allowable surface temperatures
CS 25.981(a)(1) and (2) requires applicants to:
(1) Determine the highest temperature allowing a safe margin below the lowest expected auto-ignition temperature of the fuel in the fuel tanks.
(2) Demonstrate that no temperature at each place inside each fuel tank where fuel ignition is possible will exceed the temperature determined under subparagraph (a)(1) of this paragraph. This must be verified under all probable operating, failure, and malfunction conditions of each component whose operation, failure, or malfunction could increase the temperature inside the tank.
3.5.1 Auto-ignition temperatures of fuels
Fuels approved for use on transport category aeroplanes have differing auto‑ignition temperatures. The auto-ignition temperature of JP-4 (wide-cut jet fuel) is approximately 242 °C (468 °F) at one atmosphere of pressure. Under the same atmospheric conditions, the auto-ignition temperature of JET A (kerosene) is approximately 224 °C (435 °F) to 232 °C (450 °F), and of gasoline (i.e. petrol) is approximately 427 °C (800 °F). The auto-ignition temperature of these fuels varies inversely with the ambient pressure. Also, as stated in ASTM E659, Standard Test Method for Autoignition Temperature of Chemicals, ‘the autoignition temperature by a given method does not necessarily represent the minimum temperature at which a given material will self-ignite in air. The volume of the vessel used is particularly important since lower autoignition temperatures will be achieved in larger vessels.’ In view of this, the factors affecting the pressure in the fuel tank should be taken into consideration when determining compliance with CS 25.981.
3.5.2 Maximum surface temperature
A surface whose temperature reaches a value 27.8 °C (50 °F) below the auto‑ignition temperature of the fuel air mixture is accepted without further substantiation as providing a safe margin below the lowest auto-ignition temperature of the fuel. A temperature of 204 °C (400 °F) is accepted as the maximum surface temperature inside fuel tanks for kerosene type fuels without further substantiation. Higher maximum surface temperatures may be accepted, provided that it is substantiated that the higher surface temperature will not become an ignition source in the installation. (Maximum surface temperature considerations for areas outside the fuel tank are discussed in paragraph 5.3.6.3 of this AMC.)
3.5.3 Transient higher surface temperature
The conditions (ambient pressure, dwell time, fuel type, etc.) within fuel tanks are such that a higher value may be used as a transient surface temperature limit. For example, a maximum allowable fuel tank surface temperature of 204 °C (400 °F), with a transient excursion that reduces the safe margin below 232 °C (450 °F) (i.e., the lowest expected auto-ignition temperature) for a maximum of two minutes, can be used for kerosene type fuels. The excursion above 204 °C (400 °F) occurs only during failure conditions such as a failure of the engine pneumatic system to regulate the temperature, or a duct rupture. Utilising elevated temperatures has been based on specific design features, such as an overtemperature shutoff of the pneumatic system so that the temperature cannot reach or exceed the accepted auto-ignition temperature of 232 °C (450 °F) for kerosene type fuels. Applicants should submit comprehensive test data and an analytical rationale substantiating any transient excursion in order to show that they are maintaining a safe margin below the lowest expected auto-ignition temperature of the fuel.
3.6 Fuel system electrostatics
3.6.1 Electrostatic charges are generated in liquid hydrocarbons when they are in motion with respect to another surface such as fuelling hoses, filters, nozzles, fuel tank structure, and aeroplane plumbing. The documents referenced in Appendix B, paragraphs B.3 and B.5 of this AMC, provide information on this subject. For example, during aeroplane refuelling, jet fuel is loaded either from a tanker truck or from an airport hydrant system. Flowing fuel can generate an electrical charge, especially through fuel filtration. The accumulation of charge in the fuel is a function of many factors. If the fuel conductivity is low, the relaxation time for dissipation of the electrical charge is long. Additionally, if the conductivity of the aeroplane structure is low, as it is commonly in composite wings, the relaxation time of the fuel bulk charge to structure may be longer than it would be for a traditional metallic wing structure. Some composite structures have a lower conductivity than traditional metallic structures. A comparison can be made of the conductivity of the fuel with the conductivity of the aeroplane structure. Jet fuel typically has significantly lower conductivity than composite structures, meaning that the conductivity of the jet fuel dominates the charge relaxation rate and consequently results in similar charge relaxation rates between the different types of aeroplane structures. Regardless, the fuel will accumulate an electrical charge inside an aeroplane fuel tank. This electrical charge may produce a high potential on the fuel surface, and an electrical discharge to the structure. This is particularly a concern if large unbonded objects are located inside an aeroplane fuel tank. Smaller components may also become charged, and the applicant should address this in the safety assessment. If the vapour space fuel/air mixture is in the flammable range, ignition of the mixture is possible, resulting in a fuel tank explosion and fire.
3.6.2 Charge accumulation is influenced by many factors. Without an electrical conductivity improver (also referred to as a dissipator/dissipater, static dissipater additive, electrical conductivity additive, or conductivity improver additive), typical Jet A fuel has a low electrical conductivity. An electrical conductivity improver will increase the charging rate of fuel, but at the same time greatly improve the conductivity of the fuel to rapidly dissipate the developed charge. Contaminants, considered as ionic impurities, enhance the charging tendency of the specific fuel. Fuels from different parts of the world and from different refineries will therefore have different charging tendencies based on the types of contaminants present.
3.6.3 Water contamination, however, increases the charging tendency of the fuel without a corresponding increase in conductivity. Water interacts with the additives or the naturally occurring contaminants in the fuel to provide this pro‑static effect.
When refuelling, care should be taken to not disturb the interface between the fuel remaining in the tank and the possible layer of water below it. Disruption of this interface up into the tank ullage/vapour space may lead to an electrical discharge capable of igniting a mixture of flammable fuel vapour and air.
3.6.4 Methods for minimising the magnitude of the developed charge have been developed, and are in place on transport category aeroplanes, including the following methods:
3.6.4.1 The refuel plumbing is sized and includes an orifice to maintain maximum flow rates in accordance with the electrostatic guidelines established by the National Fire Protection Association (NFPA) (NFA 77) and the ASTM (D4865).
3.6.4.2 Guidelines have been published (e.g. by ASTM) to limit flow velocities to 6 to 7 metres per second while the discharge port is covered with fuel. These guidelines also indicate that the flow velocity should be held to less than 1 metre per second until the discharge port is covered with fuel. These guidelines were developed with gasoline (i.e. petrol) in mind and are, therefore, conservative when applied to the kerosene type fuels used in commercial aviation. The design guidelines for commercial aircraft in SAE AIR1662 limit velocities to 6 to 9 metres per second in fuel plumbing and 3 metres per second at the exit nozzle. Limiting the flow velocity may be achieved by incorporating multiple refuelling discharge ports, lowering the flow velocity through the use of piccolo tubes that distribute the fuel at low velocities in the tank, and locating them at or near the bottom of the tank. Location of the refuelling discharge at the bottom of the tank minimises fuel spray — a contributor to static charge development — and provides for the ports to be covered by fuel reserves in main tanks and in the early stages of fuel flow as the refuel rate varies from 1 metre per second up to the full flow of 6 to 7 metres per second in normally emptied tanks.
Note: It may not be practical to develop a dual flow rate refuelling system, so one way to address these guidelines may be to limit the refuelling velocities to less than 1 metre per second through the use of multiple discharge points and piccolo tubes.
3.6.5 Methods of relaxing the charge have also been developed. Bonding straps are used on fuel components and plumbing lines to allow the charge to dissipate to the tank structure. During refuelling, the aeroplane is bonded to the refuelling vehicle with a separate bonding wire to provide an electrical path back to the fuel filter, which is the principal electrostatic charge generator. An electrical conductivity improver may also be used to increase fuel conductivity to quickly dissipate the developed charge. However, EASA does not require this type of additive, unless it is specified as part of the type design approval. Any limitations on the use of an electrical conductivity improver would need to meet the requirements of CS 25.1521, Powerplant limitations, and CS 25.1557, Miscellaneous markings and placards.
3.6.6 Applications of the above methods, and adherence to industry practices and guidelines on electrostatics, should be identified for each aeroplane model. Airline operations and practices regarding aeroplane refuelling should also be evaluated to verify that the procedures necessary for the safe operation of the specific aeroplane model are in place and followed. Restrictions, if any, on refuel rates, fuel properties, and the requirement for fuel additives should be identified as CDCCLs.
3.6.7 Polyurethane reticulated foam used for ignition suppression within fuel tanks and other non‑conducting objects may accumulate and retain charge. These items may have to be treated with antistatic additives to prevent charge accumulation.
4 DESIGN CONSIDERATIONS
The number of components and systems inside aeroplane fuel tanks whose failure could result in an ignition source within the fuel tank should be minimised. The following design practices are accepted by EASA for minimising ignition sources:
4.1 Fibre optics
Wiring entering the tank for such purposes as temperature monitoring and fuel quantity indication should be minimised. The use of alternate technology, such as fibre optics, may provide a means of reducing or eliminating electrically powered components from inside the fuel tanks.
4.2 Fuel pump electrical power supply
4.2.1 Fuel pump power wiring
If practical, fuel pumps should be located such that the electrical power for the pumps is routed outside the fuel tanks in such a manner that failures in the electrical power supply cannot create a hot spot inside the tank, or arc into the fuel tank. While the routing of the fuel pump power supply outside the fuel tank, and away from the fuel tank walls, may eliminate the potential for arcing directly into the fuel tank or heating of tank surfaces, the failure analysis should consider the need for electrical circuit-protective devices. If the power supply cannot be routed outside the tank, additional design features should be considered as discussed in paragraph 4.3.2 below.
Note: The applicant should consider, in the design of the pump wiring system and when showing compliance, the electromagnetic effects and electrical transients that may damage the wiring or pump.
4.2.2 Fuel pump electrical connectors
4.2.2.1 Arcing at the pump electrical connector has resulted in uncontrolled fuel leakage, an ignition source, and an uncontrolled fire outside the fuel tank. This can create a fuel tank ignition source due to the external fire heating the fuel tank surfaces. Fuel pumps should include features to isolate the electrical connector from the portion of the fuel pump where fuel is located. Applicants should show that the arcing that occurs in these designs cannot cause a cascading failure from arcing in the electrical connection, resulting in a fuel leak and a fire. One approach includes the incorporation of a dry area between the electrical connector and the fuel pump. Another approach includes extending the fuel pump power wire so the electrical connector is well away from the fuel pump. This approach has included a drip loop on the wire to prevent any fuel leaking onto the wire from being present at the electrical connector.
4.2.2.2 Alternatively, or in addition to isolating electrical connectors from the fuel, limiting the electrical energy passing into the fuel tank can prevent an ignition source from occurring. The design of traditional fuel pumps has resulted in the need to install AFCB or GFI protection features to limit the energy release during an arcing event to prevent an ignition source from occurring.
4.3 Location of the pump inlet
Debris that may enter a fuel pump inlet can cause sparks inside the fuel tank. One means to address this ignition source has been to locate the pumps such that the pump inlet remains covered with fuel whenever the pump is operating within the aeroplane operating envelope. Another means has been to prevent the propagation of any ignition from the pump into the fuel tank by using flame arrestor technology. (The performance of the flame arrestor should be validated by test to verify its effectiveness at stopping a flame front.) Any protective means, including those shown in paragraphs 4.3.1 and 4.3.2 below, should be demonstrated to be effective under the pitch, roll attitude, and negative G conditions anticipated to occur in service.
4.3.1 Main feed tanks
The installation of baffles in the tank structure, and the use of collector tanks that are continually filled with fuel using ejector pumps, are methods that have proven successful in keeping the pump inlets and pump housings submerged in fuel.
4.3.2 Auxiliary tanks
For auxiliary tanks that use motor-driven fuel pumps and that are routinely emptied, the accepted design practices include shutting off the motor-driven pumps before uncovering the fuel pump inlet, and the installation of a flame arrestor in the scavenge pump inlet line, or scavenging the remaining fuel with ejector pumps. (Note that the installation of features such as a flame arrestor in the fuel system would need to meet the fuel system performance requirements in CS 25.951, Fuel System: General.)
4.4 Wiring
The following paragraphs on wiring represent acceptable approaches for dealing with the wiring used in and near fuel tanks. For specific requirements and further guidance, the applicant should review the wiring installation and design requirements in the electrical wiring interconnect systems (EWIS) rules of CS-25 Subpart H and the associated AMC.
4.4.1 Intrinsically safe wiring
All the wiring that is intended to conduct intrinsically safe levels of electrical power into or through the fuel tanks should incorporate protective features that prevent an exceedance of the intrinsically safe levels discussed in paragraphs 3.2 and 3.3 of this AMC. This wiring should also be protected from the transients induced by high intensity radiated fields (HIRF). The following protective features could be used to support that objective:
— Separation and shielding of the fuel tank wires from other aeroplane wiring and circuits,
— Shielding against HIRF and other electromagnetic effects, and
— The installation of transient-suppression devices to preclude unwanted electrical energy from entering the tank.
4.4.2 Higher energy wiring
This includes all wiring that is not intrinsically safe.
4.4.2.1 Wiring should not be routed through metallic conduits inside the fuel tank or adjacent to fuel tank surfaces such that damage, inappropriate maintenance, or other failure/wear conditions could result in arcing to the conduit or metallic tank surface and the consequent development of an ignition source in the fuel tank. If metallic or other conductive conduit materials are used, a single failure of electrical arcing of the wiring to the conduit, adjacent tank surfaces, or structure should be assumed to occur. In addition, circuit-protective features or other features should be incorporated to preclude the development of an ignition source in the fuel tank. The methods that may be used to address this foreseeable failure condition include the use of circuit-protective features such as dual conduits, thick‑walled conduits, and/or fast-acting AFCB or GFI circuit breakers. Providing multiple layers of sleeving alone would not be considered acceptable, since wear could defeat the multiple layer protection.
4.4.2.2 Where electric wires are routed through metallic conduits installed in a fuel tank, high surface temperatures or arcing through the conduit walls can be created by short circuits. All the wiring conducting levels of power that exceed intrinsically safe levels (e.g., the fuel pump power supply) into or through a fuel tank should be evaluated assuming arcing to adjacent surfaces, such as metallic conduits or wing surfaces, unless fail-safe protective features are provided. A critical electrical wiring condition might be one in which the insulation is worn, cracked, broken, or of low dielectric strength, allowing intermittent or constant arcing to occur without consuming enough power to cause the circuit protection device, such as a thermal mechanical circuit breaker, to open. Inspection of wiring from in‑service aeroplanes has shown that greater than expected wear may occur on sleeving and wiring insulation due to movement of the wire within the conduit. Roughness of the conduit material and variations in vibration levels for each installation may significantly increase wear. In addition, inspections have shown that some protective sleeving has been missing or improperly installed, or the wrong sleeving material has been used, resulting in damage to the insulation. For these reasons, the use of protective sleeving on wiring would not, by itself, be adequate for showing compliance. The design should be tolerant to these types of foreseeable failure or maintenance errors.
4.4.3Wire separation
The wiring designs used on transport category aeroplanes vary significantly between manufacturers and models; therefore, it is not possible to define a specific, universal separation distance, or the characteristics of physical barriers between wire bundles, to protect critical wiring from damage. The separation requirements for the wiring and other components of EWIS are contained in CS 25.1707, System separation: EWIS. AMC 25.1707 contains guidance on determining an adequate separation distance between EWIS and between EWIS and aeroplane systems and structures. Even if CS 25.1707 is not in the type certification basis of the aeroplane being modified, the guidelines contained in AMC 25.1707 should be applied, along with the guidelines contained in this AMC, when determining the adequate separation distance. Intrinsically safe wiring for fuel tanks needs to be protected from induced currents caused by power system switching transients, or electromagnetic interference due to close proximity to other aeroplane wiring. In addition, damage to wire insulation can result in unwanted electrical energy being transmitted into the fuel tank, if the damaged wire can come into contact with the conductor of another wire that is not intrinsically safe. Of particular concern is the possibility of a wire bundle fire that exposes and breaks wires that are not intrinsically safe, and also damages the insulation of intrinsically safe wiring that is in close physical proximity. The broken wires may still be energised and could contact conductors of the damaged intrinsically safe wire. If physical separation is used to protect intrinsically safe fuel system wiring from other wiring, or to protect fuel tank walls from high-power wiring, the applicant must establish the minimum physical separation. The applicant should conduct an analysis to verify that currents and energies greater than those specified in paragraphs 3.2 and 3.3 of this AMC will not be applied to intrinsically safe wiring, considering the factors listed below. The following factors are based on the guidance contained in paragraphs 3. and 4. of AMC 25.1707:
4.4.3.1 The electrical characteristics, power, and criticality of the signals in the wire bundle and adjacent wire bundles;
4.4.3.2 The installation design features including the number, type, fire resistance, and location of the support devices along the wire path of the intrinsically safe wire and adjacent higher power wires;
4.4.3.3 The maximum amount of slack wire resulting from wire bundle build tolerances and other wire bundle manufacturing variations;
4.4.3.4 The probable variations in the installation of the intrinsically safe fuel system wiring and adjacent wiring, including the position or omission of wire support devices and the amount of slack wire that is possible;
4.4.3.5 The expected operating environment, including the amount of deflection or relative movement that can occur and the effect of a failure of a wire support device, or a broken wire, or other methods used to maintain physical separation;
4.4.3.6 The effects of wire bundle fires;
4.4.3.7 Maintenance practices, as defined by the aeroplane manufacturer’s standard wiring practices manual, and the ICA required by CS 25.1529, CS 25.1729; and
4.4.3.8 Localised separation.
Note: Some areas of an aeroplane may have localised areas where maintaining a general physical separation distance is not feasible. This is especially true in smaller transport category aeroplanes or in areas where wiring spans the wing-to-body join of larger transport aeroplanes. In those areas that limit the separation distance, additional means of ensuring physical separation and protection of the wiring may be necessary. Testing and/or analysis used to show that the reduced separation distance is acceptable should be conservative and consider the worst possible failure condition not shown to be extremely improbable. The applicant should substantiate that the means to achieve the reduced separation provides the necessary level of protection for wire-related failures and electromagnetic effects.
4.4.4 Inspection
Means should be provided to allow for the visual inspection of the wiring, physical barriers, and other physical means of protection. Non-destructive inspection aids may be used where it is impracticable to provide for direct visual inspection, if it is shown that the inspection is effective and the inspection procedures are specified in the maintenance manual required by CS 25.1529 and CS 25.1729.
4.4.5 Identification
Means must also be provided to make EWIS wires readily identifiable and visible to maintenance, repair, or alteration personnel. The method of identification must remain legible throughout the aeroplane’s operational life. The complete regulatory requirements for EWIS identification are contained in CS 25.1711, Component identification: EWIS.
4.4.6 Circuit breakers
Service experience has indicated that thermal mechanical circuit breakers installed in fuel pump circuits have not been shown, on some aeroplane designs, to preclude arcing of electrical wiring through metallic barriers into the fuel tank, barriers such as conduits, fuel pump housings, electrical connectors, or the tank wall. Evidence suggests that arcing from the wiring to metallic surfaces may not result in a hard short, which would trip the circuit breaker, and may result in intermittent low‑level arcing that gradually arcs through the metallic barrier into the fuel tank. For these failure conditions, circuit-protective devices such as AFCBs or GFIs may be used to provide the fail-safe features necessary to show compliance. Appendix A of this AMC provides guidance for the certification of an AFCB or GFI.
4.4.7 The use of non-metallic conduits
If a non-metallic conduit is used, its compatibility with fuel should be shown. The non-metallic conduit should be evaluated for the effects of ageing due to heat, corrosion at the connecting fittings, electrostatic charge build-up, and resistance to heat damage from internal shorts of the wires routed within the conduit.
4.4.8 Wire splices
Splices in fuel system wiring have been allowed as a standard repair procedure. The acceptability of splices will be based upon the system design and fail-safe features. The safety assessment may show that splices in fuel tank system wiring, such as fuel quantity indicating wiring within the fuel tank and fuel pump windings, are prohibited. This would be defined as a CDCCL.
4.4.9 The use of silver in fuel tanks
Silver can combine with sulphur or water and form silver-sulphide or oxide deposits between exposed conductors (terminal block connections, etc.). The silver‑sulphide deposits reduce the resistance between the conductors and can ignite fuel vapour when exposed to very low levels of electrical energy. If the use of silver in electrical components and wiring in the tank is determined to be critical, it should be defined as a CDCCL. The energy levels that have been shown to ignite fuel vapour during laboratory tests approach the levels normally used on FQIS wires and probes (e.g. FAA Report No. DOT/FAA/AR-03/61, Silver-Sulphur Deposits on Fuel Quantity Indication System and Attendant Wiring). This issue should be carefully addressed.
4.4.10 The use of steel wool
Steel wool has been used as a cleaning tool to remove corrosion and to clean parts inside fuel tanks. Steel wool creates small conductive filaments that can cause ignition sources in a fuel tank if the steel wool makes a connection between two conductors in fuel tank quantity gauging system components. For this reason, applicants should not allow the use of steel wool inside fuel tanks, and should recommend using other abrasives. (However, as stated in paragraph 5.3.4.1 in this AMC, the applicant should assume the presence of conductive debris, such as steel wool, when performing the fuel tank ignition prevention analysis.)
5 SAFETY ANALYSIS
5.1 Ignition source failure analysis
Compliance with CS 25.981 requires each applicant to develop a failure analysis for the fuel tank installation to substantiate that ignition sources will not be present in the fuel tanks. The requirements of CS 25.981 are in addition to the more general propulsion failure analysis requirements of CS 25.901 and CS 25.1309 that have been applied to propulsion installations.
5.1.1 CS 25.981(a)(3) defines three failure scenarios that must be addressed in order to show compliance with the rule:
5.1.1.1 No single failure, regardless of the probability of occurrence of the failure, may cause an ignition source.
5.1.1.2 No single failure, regardless of the probability of occurrence, in combination with any latent failure condition not shown to be at least extremely remote (i.e., not shown to be extremely remote or extremely improbable), may cause an ignition source.
5.1.1.3 No combinations of failures that are not shown to be extremely improbable may cause an ignition source. That is, each combination of failures that can create an ignition source must be separately shown to be extremely improbable.
5.1.2 SAE ARP4761, ‘Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment’ dated December 1996, describes methods for completing an SSA. An assessment may range from a simple report, which offers descriptive details associated with a failure condition, interprets test results, compares two similar systems, or offers other qualitative information, to a detailed failure analysis that may include estimated numerical probabilities. The depth and scope of an acceptable SSA depend on the following:
5.1.3.1 The complexity and criticality of the functions performed by the system under consideration,
5.1.3.2 The severity of the related failure conditions,
5.1.3.3 The uniqueness of the design and the extent of the relevant service experience,
5.1.3.4 The number and complexity of the identified causal failure scenarios, and
5.1.3.5 The detectability of contributing failures.
Note: CS 25.981 and CS 25.901 are intended to address system failures or conditions that may result in the presence of an ignition source in the fuel tanks. These specifications are not intended to address the failures or conditions that could lead to the ignition of fuel vapour, which are addressed by other specifications, such as:
— Uncontained engine debris,
— External engine fires following an engine separation,
— Damage resulting from explosive materials such as bombs,
— Post-crash fire heating of tank surfaces,
— Propagation of fire through the aeroplane vent system into the fuel tanks, or
— A fire originating within the engine that burns through the engine case.
5.2 Qualitative safety assessment
5.2.1 Typical aeroplane fuel tank systems have a limited number of possible ignition sources. Figure 1 below shows some causes of ignition sources and methods that may be used to meet the fail-safe requirements. The level of analysis required to show that ignition sources will not develop will depend on the specific design features of the fuel tank system being evaluated. Detailed quantitative analysis should not be necessary if a qualitative safety assessment shows that the features incorporated into the fuel tank system design protect against the development of ignition sources within the fuel tank system. For example, if intrinsically safe FQIS wiring entering the fuel tanks and the associated line replacement unit (LRU) were shown to have protective features such as separation (including circuit separation in the LRU) and shielding and/or transient suppression/energy limiting devices, the portion of the compliance demonstration for the associated wiring would likely be limited to showing the effectiveness of the features and defining any long-term maintenance requirements, including the mandatory replacement times, inspection intervals, related inspection procedures, or CDCCLs so that the protective features are not degraded.
Figure 1. Examples of Fuel Tank Ignition Source Considerations
5.2.2 In the case of the installation of a flame arrestor in the inlet line to a fuel pump, the compliance demonstration for the fuel pump may be limited to showing that the arrestor was effective at precluding propagation of the flame from the pump back down the inlet line into the tank, and showing that any anticipated failures or events could not violate the explosion-proof features of the pump assembly. A CDCCL may be necessary to maintain the flame arrestor design feature. If the flame arrestor cannot be shown to be effective for the life of the installation, an Airworthiness Limitation limiting the life of the flame arrestor would be necessary. In addition, revalidation of the fuel system with other regulations (e.g. icing and reduced flow due to contamination) would be required if modifications were incorporated into the fuel feed system. The SSA criteria, process, analysis methods, validation, and documentation should be consistent with the guidance material provided in SAE ARP4761, using the unique guidance specific to the fuel tank system as defined in this AMC.
5.3 Assumptions and considerations for fuel tank system analysis
The applicant should conduct the fuel tank system analysis based on the following assumptions:
5.3.1 Fuel tank flammability
The analysis should assume that the environment inside the fuel tank is always flammable. The conditions required to ignite fuel vapour from ignition sources vary with the pressures and temperatures within the fuel tank and can be affected by sloshing or spraying of fuel in the tank. Due to the difficulty in predicting fuel tank flammability, it should be assumed that a flammable fuel/air mixture exists in aeroplane fuel tanks and it is required that no ignition sources be present. The SSA should be prepared considering all the in-flight, ground, service, and maintenance conditions for the aeroplane, assuming that an explosive fuel/air mixture is present in the vapour space of fuel tanks and vent systems at all times, unless the fuel tank has features that mitigate the effects of tank ignition (e.g. polyurethane foam).
5.3.2 Failure condition classification
Unless design features are incorporated that mitigate the hazards resulting from a fuel tank ignition event (e.g. polyurethane foam, an adequate structural margin), the SSA should assume that the presence of an ignition source is a catastrophic failure condition.
5.3.3 Latent failures
5.3.3.1 In order to eliminate any ambiguity as to the restrictions on latent failures, CS 25.981(a)(3) explicitly requires that any anticipated latent failure condition must not leave the aeroplane one failure away from a catastrophic fuel tank ignition. In addition to this limitation on latency, CS 25.1309(c) limits the latent failure conditions to those that do not create an ‘unsafe system operating condition.’ Consequently, if a latent failure condition is not extremely remote (i.e., it is anticipated to occur) and it creates an ‘unsafe system operating condition,’ then flight crew alerting must be provided to ‘enable them to take appropriate corrective action.’ Notwithstanding these restrictions on latency, there are practical limitations on the available means of compliance. For example, detecting a failure condition requires a finite period of time, and there are not always ‘appropriate corrective actions’ that can be taken during the flight. Consequently, for the purpose of complying with CS 25.981(a)(3), the period of latency for any anticipated significant latent failure condition should be minimised and not allowed to exceed one flight cycle. For the purpose of complying with CS 25.1309(c), whenever the aeroplane is operating one failure away from a catastrophic fuel tank ignition, this should be considered an ‘unsafe system operating condition,’ recognising that sometimes the only appropriate corrective action when problem detection is available is to continue to the destination but not to initiate another flight without making appropriate repairs.
5.3.3.2 Another practical limitation on the available means of compliance is the technological feasibility of providing inherent failure detection within the design for all significant failures. Sometimes periodic inspection is the only practicable means of reliably detecting a failure condition. Consequently, when such inspections are identified within the analysis as the means of detection, the inspection method and frequency must be sufficient to conclude that the probability of occurrence of the significant latent failure condition is extremely remote.
5.3.3.3 Any mandatory replacement time, inspection interval, related inspection procedure, and all the CDCCLs identified as required to prevent development of ignition sources within the fuel tank system for CS 25.981(a) must be identified in the Airworthiness Limitations Section of the ICA as fuel system Airworthiness Limitations. The Airworthiness Limitations Section should include the following:
5.3.3.3.1 A designation of the maintenance actions and alterations that must be inspected (critical inspections), including at least those that could result in a failure, malfunction, or defect endangering the safe operation of the aircraft, if not performed properly or if improper parts or materials are used.
Note: A validation inspection should be conducted to reaffirm all or a portion of the initial inspection requirements for those critical inspections that, if not performed properly or if improper parts or materials are used, could result in a failure, malfunction, or defect endangering the safe operation of the aeroplane. For those air carriers that use a mechanic for the initial inspection, an inspector should be used to conduct the validation inspection. For those air carriers that use an inspector for the initial inspection, another qualified inspector should be used to conduct the validation inspection.
5.3.3.3.2 The procedures, standards, and limits necessary for critical inspections and acceptance or rejection of the items required to be inspected, and for periodic inspections and calibration of precision tools, measuring devices, and test equipment.
5.3.4 Failure conditions
In accordance with CS 25.981(a)(3), the analysis must consider the effects of manufacturing variability, ageing, wear, corrosion, and likely damage. For the purpose of compliance with CS 5.981, ‘extremely remote’ failure conditions and ‘extremely improbable’ failure conditions are defined in AMC 25.1309. Likely damage is damage that, using engineering judgment or past experience, would lead one to conclude that an occurrence is foreseeable. Examples of likely damage are:
— a wire bundle located where a mechanic could use it as a handhold;
— an instrument located where, if someone dropped a wrench, damage would result; or
— a fuel probe located where a mechanic could use it as a step in the tank.
5.3.4.1 The analysis should be conducted considering the deficiencies and anomalies listed in paragraph 2.3 of this AMC, the failure modes identified by the review of service information (including review of supplier service data), and any other failure modes identified by the functional hazard assessment of the fuel tank system. For example, the applicant should assume the presence of conductive debris such as lockwire, steel wool, nuts, bolts, rivets, etc. CS 25.981 requires that the effects of manufacturing variability, ageing, wear, corrosion, and likely damage must be considered when showing compliance, which is needed to show compliance with CS 25.901(c). Credit for fail-safe features must be substantiated.
5.3.4.2 The level of manufacturing variability, ageing, wear, corrosion, and likely damage that must be considered should be determined based upon an evaluation of the detectability of degraded or out‑of‑specification configurations, and established and documented within the analysis. In‑service and production functional tests, component acceptance tests, and maintenance checks may be used to substantiate the degree to which these states must be considered. For example, inspection of fuel tank system bonding on production aeroplanes has shown that some bonds were inadequate. Functional testing of all bonding was incorporated to address this deficiency. In some cases (e.g. component bonding or ground paths), a degraded state will not be detectable without periodic functional tests of the feature. For these features, inspection/test intervals should be established based on previous service experience of equipment installed in the same environment. If previous experience on similar or identical components is not available, conservative initial inspection/test intervals should be established until design maturity can be assured.
5.3.5 External environment
The severity of the external environmental conditions that should be considered when showing compliance with CS 25.981 is that of the conditions established by the certification specifications.
5.3.6 External sources of tank auto-ignition
The possibility of fuel tank ignition due to surface-ignition sources created by external tank heating should be considered. This includes heating of the tank due to the operation or failure of systems outside the tank within both the pressurised and unpressurised areas of the aeroplane, such as overloaded electric motors or transformers, failures in the pneumatic system, and/or ducting that could cause localised heating of tank surfaces. In addition, the possibility of localised heating due to external fires should be considered.
5.3.6.1 CS 25.967(e) requires that, ‘Each fuel tank must be isolated from personnel compartments by a fumeproof and fuelproof enclosure.’
5.3.6.1.1 Leakage of fuel or vapour into spaces adjacent to the fuel tank, where a secondary fuelproof and fumeproof barrier is not provided, has typically been assumed for areas such as:
— The wing leading edges (including any adjacent compartment such as the strut) and trailing edges,
— Fairings located below the fuel tanks,
— Fuel pump enclosures, and
— Unpressurised areas of the fuselage surrounding fuel tanks located in the empennage.
5.3.6.1.2 Components located in these areas have been required to meet the explosion-proof requirements. These components or systems should be included in the analysis. Examples of such equipment include, but are not limited to, environmental control system (ECS) air conditioning packs, motors, power assisted valves, fuel pumps, hydraulic pumps/motors, certain flight control actuators, ECS controls, and wiring and valves.
5.3.6.2 A safety review of the flammable fluid leakage zones adjacent to fuel tanks should be conducted to determine whether the design complies with the requirements of CS 25.863(a) and CS 25.981. In general, the fire protection philosophy for any area considered a flammable fluid leakage zone is to assume that flammable vapour may be present in the zone and to minimise the probability of ignition of the vapour (CS 25.863(a)). This has typically been accomplished by using combinations of the following design considerations:
— Grounding and bonding of electrical equipment,
— Qualification of electrical equipment as explosion proof,
— Sealing of electrical connectors,
— Proper support, protection, and separation of wiring,
— Drainage provisions in the leakage zone,
— Ventilation of the leakage zone in flight and of areas around the auxiliary tanks, and
— Immediate maintenance action to correct leaks in these areas.
5.3.6.3 Surface temperatures in areas adjacent to fuel tanks
While EASA (and previously the JAA (Joint Aviation Authorities)) has accepted the use of maximum acceptable surface temperatures 27.8 °C (50 °F) below the applicable auto-ignition temperature of the fuel-air mixture (i.e. a surface temperature of 204 °C (400° F) for fuel tanks filled with kerosene), some higher temperatures have been accepted in certain cases if adequately substantiated by the applicant. Some manufacturers have substantiated that the conditions (ambient pressure, dwell time, fuel type, etc.) within certain flammable fluid leakage zones are such that a higher value may be used.
For example, maximum allowable pneumatic bleed duct surface temperatures of 232°C (450°F), with a transient excursion up to 260°C (500°F) for a maximum of two minutes, have been approved. The excursion above 232°C (450°F) occurs only during failure conditions such as an engine pneumatic high stage bleed valve failure or duct rupture. The approval of these elevated temperatures has been based on compensating design features such as a cockpit indication of over-temperature combined with associated procedures to shutoff the overheated system, insulated ducts, zone ventilation airflow which produces a lean fuel-air mixture, and an automatic over-temperature shutoff of the pneumatic system so that the temperature cannot exceed the accepted 232°C (450°F) temperature for more than two minutes. The internal tank surface temperatures resulting from the failure should not exceed the surface temperature limit for the fuel type used, as described in paragraph 3.5 of this AMC.
5.3.7 Electrical ignition sources
The applicant should perform a failure analysis of all the fuel systems and subsystems that have wiring routed into fuel tanks. Systems that should be considered include those for fuel pump power and control and indication, fuel quantity indication, fuel temperature indication, fuel level sensors, and any other wiring routed into or adjacent to fuel tanks. The analysis should consider system level failures, failures within LRUs, and the component level failures discussed below. The analysis should include the existence of latent failures and subsequent failures that may lead to an ignition source within the fuel tank. Examples include undetected failures of tank components or wiring, the undetected presence of conductive debris, damage to FQIS or level sensor probes, or corrosion, in combination with external failures such as hot shorts or electromagnetic effects. In addition, the applicant should provide a description of the protective means employed in the fuel system wiring. This should include a description of features such as separation/segregation, transient suppression devices, shielding of wiring, and methods employed to maintain configuration control of critical wiring throughout the life of the aeroplane.
5.3.8 Electrical short-circuits
5.3.8.1 One method that may provide protection of circuits that enter fuel tanks is the incorporation of a transient suppression device (TSD) in the circuit close to the point where those wires enter the fuel tanks. Consideration should also be given to protection of the wiring between the TSDs and the tank if the protection devices are not located at the tank entrance, and also to the possibility of transients being induced in the wiring between the TSDs and the electrical devices in the fuel tanks. Caution should be exercised when using a TSD to ensure that the TSD addresses both voltage and current suppression in order to limit the energy and current below the limits provided in Section 3.2 of this AMC.
5.3.8.2 Another method of protection that has been used to provide a fail-safe design with respect to electrical shorts is the separation of the wiring to electrical devices in the fuel tanks from other electrical power wires and circuits, combined with shielding between the wiring that enters the fuel tanks and any other electrical power-carrying wires in the aircraft installation. The effects of electrical short circuits, including hot shorts, on the equipment and wiring that enters the fuel tanks should be considered, particularly for the FQIS wiring, fuel level sensors, and probes. Latent failures from factors such as contamination, damage/pinching of wires during installation, or corrosion on the probes, connectors, or wiring should be considered when evaluating the effects of short circuits. The wire routing, shielding, and segregation outside the fuel tanks, including within the FQIS components (e.g., gauging units), should also be considered when evaluating the effects of short circuits. The evaluation should consider both the electrical arcing and localised heating that may result from short circuits on equipment, FQIS probes, and wiring. The evaluation of electrical short circuits should include consideration of shorts within electrical equipment, and the wiring from the equipment into the fuel tank. Prevention of fuel ignition from electrical shorts to the wiring that enters the fuel tanks may require specific wire and circuit separation and wire bundle shielding.
5.3.9 LRU design evaluation
The design review should include an evaluation of the separation and protective features incorporated into any fuel system LRU whose failure could result in high‑level electrical power (i.e., above the intrinsically safe levels) entering the fuel tank. For example, circuit board failures could cause the LRU power supply circuits for the fuel quantity gauging system to come into contact with the circuits that lead into the fuel tank, resulting in a possible ignition source. Failures that can lead to violating the separation features within the LRU can be external or internal events. External failures include overvoltage or overcurrent, high humidity, temperature, vibration, shock, and contamination. Internal failures include manufacturing defects or flaws in the conductor, substrate, or coating. To address these failures, the design should either provide isolation and physical separation between the critical circuits, such as the circuits that enter a fuel tank, or adequate protective features, such as the transient suppression devices as discussed earlier, to protect the circuits that enter the fuel tank. Any LRU that meets the design requirements identified in Underwriters Laboratories Inc., UL 913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations, is considered acceptable, provided the following issues are addressed:
— Ideally, higher power circuits within the LRU should not be located on the same circuit board or in a wire harness or electrical connector with intrinsically safe circuits or wiring;
— There should be a physical barrier between circuit boards to isolate the intrinsically safe circuits from the effects of broken components or fire within the LRU; and
— If limiting devices are installed on the same circuit board in series with the system circuitry to limit the amount of power or current transmitted to the fuel tank, there should be 7.62 cm (3 inches) between the traces, unless the manufacturer can justify a smaller separation on the basis that the effects of fire on the circuit board will not compromise the intrinsically safe circuit(s).
5.3.10 Electromagnetic effects including HIRF
See AMC 25.954 for guidelines on establishing compliance with the requirements for fuel system protection from lightning effects.
5.3.10.1 The evaluation should consider the electromagnetic effects due to HIRF, electrical transients, and RF emissions on the fuel system conductors (e.g. fuel tank plumbing, structure, fuel, equipment and wiring) within the fuel tanks, particularly for the FQIS wiring and probes. The applicant should also consider the latent failures from factors such as contamination, damage, or corrosion on the probes or wiring when evaluating the effects of electrical transients. The wire routing, shielding, and segregation of conductors (e.g., plumbing, component casings, wiring, etc.) outside the fuel tanks should also be considered when evaluating the effects of electrical transients because the generation of the transient and the coupling to conductors may occur outside the fuel tanks. The evaluation should consider both electrical sparks and arcs, and localised heating, which may result from electromagnetic effects on the fuel tank system, FQIS probes, and wiring.
5.3.10.2 The evaluation should consider latent failures of electromagnetic protection features, such as shielding termination corrosion, shield damage, and transient limiting device failures, and the applicant should establish appropriate indications or inspection intervals to prevent the existence of latent failure conditions. The failure of other system components may also affect the protection against electromagnetic effects. Consequently, the evaluation should consider the effect of any anticipated failure on the continued environmental protection.
5.3.10.3 The evaluation of electromagnetic effects should be based on the specific electromagnetic environment of a particular aeroplane model. Standardised tests, such as those in EUROCAE ED-14G Change 1 dated January 2015, ‘Environmental Conditions and Test Procedures for Airborne Equipment’, and the equivalent RTCA, Inc., Document No DO-160G dated December 2010, Sections 19 and 20, are not sufficient alone to show that the appropriate standardised test categories, procedures, and test levels of EUROCAE ED-14G/RTCA DO-160G are selected, without an evaluation of the characteristics of the specific electromagnetic environment and the induced transient levels assigned to systems installed within a particular aeroplane model. Simulation of various latent failures of fuel system components within the tanks may be needed to show the effectiveness of the transient protection. The effectiveness of these features should be verified using the appropriate test procedures and test levels of EUROCAE ED-14G/RTCA DO‑160G, determined above.
5.3.10.4 Prevention of fuel ignition due to electromagnetic effects may require specific wire segregation and separation, wire bundle shielding, or transient suppression for wires entering fuel tanks. The effectiveness of the transient protection features should be verified using the appropriate test procedures and test levels of EUROCAE ED-14G/RTCA DO-160G, determined above.
5.3.10.5 Redundancy of bond paths
A failure of bonding jumpers is generally considered a latent failure, since there is no annunciation or indication of the bonding failure. The aeroplane fleet fuel tank inspections that occurred as a result of the TWA 800 investigation (National Transportation Safety Board Aircraft Accident Report NTSB/AAR‑00/03, ‘In-flight Breakup Over the Atlantic Ocean Trans World Airlines Flight 800, Boeing 747-131, N93119, Near East Moriches, New York,’ dated July 17, 1996) showed that failures of bonding jumpers, due to damage, wear, or manufacturing errors, were not unusual. Based on this, it would be difficult to show that the probability of a failure of a single bonding jumper is extremely remote or extremely improbable. Therefore, electrical bonding jumpers or other bonding provisions would need to consider the consequences of these latent failures. This may result in designs that incorporate electrical bonding redundancy, if the failure of a single electrical bonding feature could create a fuel tank ignition source. Additionally, manufacturers would need to consider the use of appropriate maintenance to detect failed bonding jumpers. An example of such maintenance might include periodic inspections to limit latency.
5.3.10.6 Self-bonding couplers
Early generation, self-bonding, flexible fuel couplers did not have multiple bonding paths. Thus, these bonding couplers exhibited single-point failures that caused a loss of function. These self-bonding flexible couplers failed because of missing bonding springs, anodising on bonding surfaces, and incorrect installation. The safety assessment of designs incorporating multiple bonding paths must consider these failure modes, and qualification testing should show that no ignition sources are present in the full-up (non‑degraded condition) and possible degraded condition with failure modes present within the couplings. For example, failure assessments of clamshell-type, self‑bonding metallic couplings in composite fuel tanks have shown that arcing could occur if a coupling was improperly latched, or became unlatched and fell to the bottom of the fuel tank. The design of the coupling would need to address these failure modes. Improper latching could be addressed through positive latching features with tactile and visual indications that the coupling is properly latched. Redundant fail-safe features, such as redundant hinge and latching features, redundant bonding features, etc., may be needed to address other possible failure modes.
5.3.10.7 Resistance or impedance limits of aeroplane electrical bonding provisions
5.3.10.7.1 There is no specific EASA guidance on the maximum resistance or impedance of aeroplane electrical bonding provisions because electrical bonding within a fuel system should be tailored to the performance requirements of a particular aeroplane design. The electrical bonding should consider the electrical sources, electrical faults, and electrostatic charges. The electrical bonding should also consider the fuel system design of the specific aeroplane, which would include the structure material used (aluminium, carbon-fibre composites, fibreglass composites, etc.), the configuration of the fuel system (routing of fuel tubes, wires, and hydraulic tubes), and the electrical bonding concept (intentional isolation, self-bonding fittings, separate bonding jumpers, etc.). Given the large variation in design approaches and the close relationship between the design approach and the electrical bonding requirements, it is not practical for EASA to provide specific guidance on the maximum bonding resistance or impedance.
5.3.10.7.2 Some type certificate (TC) holders have performed tests on their aeroplanes to determine the specific requirements for electrical bonding. Others, in the absence of specific aeroplane test data, have chosen conservative electrical bonding approaches. The approach is a decision each TC holder should make based on the specific situation for that TC holder’s aeroplane models.
5.3.10.8 Bonding integrity checks
Past experience has shown that measurement of bond resistance is the desired method of ensuring bond path integrity. During bonding resistance measurements, the protective finish of components might be damaged in order to penetrate the insulating anodised surface layer, which may lead to subsequent corrosion damage. This concern has resulted in some TC holders defining non-intrusive inspections for electrical bonding. These inspections may include detailed visual inspections provided that the quality of the electrical bonding feature can be adequately assessed by visual cues, such as visible corrosion, breakage, tightness, or missing bonding provisions. For critical bonds, this method would not by itself be adequate. Other inspection methods include inductively coupled loop resistance measurements that eliminate the need to disconnect bonding jumpers, or to penetrate corrosion‑prevention coatings. The need for bonding inspections, the frequency of the inspections, and the determination as to whether the inspections must be an Airworthiness Limitation should be established under the fuel tank SSA.
5.3.10.9 Bond corrosion and integrity
5.3.10.9.1 Degradation of electrical bonding provisions, such as bonding jumpers, has occurred on in‑service aeroplanes. Results from aeroplane fuel tank inspections conducted on a sample of aeroplanes by manufacturers and operators showed discolouration, corrosion, and damage to bonding jumpers. It is not clear whether the discolouration indicates that corrosion that will become more severe with time, or whether it is simply a surface colour change. The applicant should define the bonding feature characteristics — such as visible corrosion, discolouration, jumper strand separation, and jumper strand breakage — that will be used to distinguish discrepant bonding provisions.
5.3.10.9.2 The level of corrosion observed on bonding features, specifically on bonding jumpers, varies greatly across aeroplane fleets. While some aeroplanes within a fleet and certain locations within the fuel tanks showed no evidence of corrosion, other aeroplanes and locations exhibited higher levels of corrosion. Inspection results indicate that the materials used in certain bonding jumpers (tin-plated copper) may be more prone to corrosion. Nickel-plated copper wire does not experience similar corrosion. Corrosion programs for aeroplane structures have long recognised the variability of corrosion within the fleet. Factors that influence the level of corrosion of bonding jumpers include the fuel type (sulphur content, etc.), the presence of water in the fuel tank, installation effects such as cracking of the tin plating when the jumper is installed, the temperature, humidity, and chemicals used for preparation of the fuel tanks prior to aeroplane storage, etc. While certain levels of corrosion or discolouration may be acceptable between inspection intervals, the showing of compliance should include substantiation that the materials used in the bonding jumpers are appropriate for use in the fuel tanks in consideration of the proposed inspection intervals. This substantiation should consider the variability in corrosive environments and the factors noted above that may exist on in‑service and stored aeroplanes in the fleet.
5.3.10.10 CS 25.981 states: ‘(a) No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapours.’ Fuel tube flexible couplings and components as small as nuts, bolts, and washers may develop sufficient charge to cause arcing due to electrostatic conditions if not properly accounted for in the design. Electrical bonding would need to be considered if these couplings are identified as ignition sources during the ignition source evaluation and assessment.
5.3.11 Friction sparks
The failure modes and effects analysis (FMEA) should include an evaluation of the effects of debris entering the fuel pumps, including any debris that could be generated internally, such as any components upstream of the pump inlet. Industry practices for fuel tank cleanliness, and design features intended to preclude debris entering the fuel pumps, have not been effective at eliminating debris. Service experience has shown that pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, sealant, lockwire, and so forth have been drawn into fuel pumps and contacted the impeller. This condition could result in the creation of friction sparks, and it should be an assumed failure condition when conducting the SSA. Fail-safe features should be incorporated into the fuel pump design to address this condition. Examples of means that may be incorporated into the fuel pump design to address this concern include:
— the installation of inlet flame arrestors,
— the use of reticulated foam,
— the use/installation of ejector fuel pumps without impellers to scavenge fuel, or
— maintaining fuel over the pump inlet throughout the aeroplane flight attitude envelope.
6 COMPONENT FAILURE MODE CONSIDERATIONS
6.1 Component qualification review
The qualification of components, such as fuel pumps, has not always accounted for unforeseen failures, wear, or inappropriate overhaul or maintenance. Failures to account for these failure modes and testing the pump using the procedures defined in Military Standard MIL-STD-810H, Method 511.6, Explosive Atmosphere, have led to some fuel pumps entering airline service having never been tested to demonstrate whether they have explosion-proof capabilities. This combined experience suggests that more needs to be done to establish the capabilities of fuel pumps and other fuel system components to operate safely in an explosive environment. Such a capability should be substantiated considering these factors in addition to the conditions noted in paragraph 3.3 of this AMC. The amount of qualification review can be significantly reduced if the fail-safe features noted earlier in this AMC are followed (e.g. not operating pumps in the vapour spaces of the tank, incorporating arc fault or ground fault protection on the electrical circuit, etc.). Therefore, an extensive evaluation of the qualification of components may be required if a qualitative assessment of the component and installation features does not eliminate the component as a potential ignition source.
6.2 Maximum component temperature for qualification of fuel system components
The maximum component temperatures may be determined experimentally. Tests should be conducted that are long enough for the component to reach the maximum temperature. All the foreseeable failures and malfunctions of the fuel tank components (including those failures and malfunctions that could be undetected by the flight crew and maintenance personnel) should be considered when determining the maximum temperatures.
6.2.1 Components mounted adjacent to the exterior surface of the fuel tank can create a high localised temperature on the inner surface of the tank. This can be investigated by laboratory tests that duplicate the installation, or by a validated heat transfer analysis using the maximum potential temperature of the component.
6.2.2 When aeroplane equipment or system components such as engine bleed air ducting or ECS are located near fuel tanks, an FMEA should be performed to determine the failures of adjacent systems or components that could cause elevated surface temperatures. The maximum internal tank temperatures that can occur during normal and failure conditions should be determined. Systems, such as over-temperature protection devices, should be evaluated to determine whether periodic health checks are necessary to ensure that latent failures do not exist.
6.3 Possible failure modes for determination of maximum component temperatures
The following list identifies some possible failure modes, but not all the conditions, that should be explored in determining the maximum temperature expected for fuel tank components:
6.3.1 Fuel pumps
6.3.1.1 Normal fuel pump operation considering the highest hot day ambient and fuel tank temperatures: in many cases, fuel pump motors are protected by a (single) three-phase thermal circuit breaker. In several instances, the resetting of circuit breakers has resulted in arcing inside the fuel tank and the development of an ignition source from an existing failure. Therefore, the fuel pump circuit should also preclude the development of an ignition source if the breaker is reset or forced in by a mechanic. Methods that may be used to address this foreseeable failure condition include the use of circuit-protective features such as non-resettable, fast-acting AFCB or GFI circuit breakers.
6.3.1.2 Two-phase operation of three-phase electrical fuel pumps: a failure of a single phase of a multiple-phase fuel pump will significantly increase the load on the remaining phases of the pump and the generation of heat in the pump. In many cases, thermal protection features within the pump have been incorporated to address this failure condition, but these means have not been effective at preventing continued operation of a pump with a failed electrical phase. Another failure condition that should be considered is the subsequent failure of a second phase of the pump and possible arcing or heat damage. In general, pumps should not be allowed to operate following a failure of a single electrical phase of the pump if such operation could result in the development of an ignition source. Automatic protective means, such as AFCBs or GFIs or other means, should be provided to shut down the pump when a single electrical phase failure occurs. Periodic inspections or maintenance of these features may be required.
6.3.1.3 Dry operation of fuel pumps, including lack of lubrication: service history has shown that flight crews and maintenance personnel have inadvertently operated fuel pumps for long periods of time without fuel in the fuel tank. Fuel pumps are typically qualified for dry run operation for periods of time based upon assumptions made about the possible duration of inadvertent operation, or the failure conditions, which could result in dry running of the pump. For example, some pumps were operated during qualification testing up to a maximum of 8 hours continuously, with total accumulated dry run operation of 24 hours. These qualification tests were accomplished in order to show that the fuel pump performance was still adequate following the dry pump operation. The tests were not conducted in an explosive environment and, hence, were not intended to qualify the pumps for such operation. In other cases, previous approvals were predicated on the assumption that the fuel pump would not be dry run operated because the pump would be turned off by the flight/ground crew following a pump low‑pressure indication. Extended dry operation of pumps may result in surface temperatures above the auto-ignition temperature of the fuel, or may expose the pump to dry run operation where debris from the fuel tank could enter the impeller and cause sparks. Manufacturers’ recommended procedures have not been shown to be adequate in preventing dry run operation. Therefore, additional fail-safe features are necessary to preclude ignition sources caused by the dry run operation of aeroplane fuel pumps. One or more of the following fail-safe means should be considered for the protection of fuel pumps:
1. Incorporating design features to keep the fuel pump inlet submerged in jet fuel to prevent dry running of the pump under all operating conditions.
2. Incorporating automatic pump shutoff features into the fuel pump or aeroplane to preclude dry run operation.
3. Other means such as the installation of flame arrestors in the fuel pump inlet to preclude flame propagation into the fuel tank.
6.3.1.4 The temperatures associated with the fuel pump following wet operation with wet mechanical components both at zero and reduced fluid flow.
6.3.1.5 The temperatures associated with moving mechanisms that are locked or seized.
6.3.1.6 The temperatures generated as a consequence of pump impeller slippage.
6.3.1.7 High temperatures or high currents due to a broken shaft. The design has to contain the broken shaft, and the pump and its control system must consider the high currents and temperatures that would follow.
6.3.1.8 Failed bearings: the effects of wear on the fuel pump features incorporated into the design to maintain explosion-proof characteristics should be evaluated. For example, the wear of bearings or failures, including spinning of any bushings, and the possible effects on quenching orifices should be evaluated. In many cases, the fuel pump explosion-proof features are not redundant, and the failure or degradation of the features is latent. If single or probable combinations of failures in the fuel pump can cause an ignition source, CS 25.981 requires the incorporation of the fail-safe features noted previously. If wear of the pump can cause the degradation of fail-safe features, appropriate inspections, overhaul, or life limiting of the pump should be included in the Airworthiness Limitations Section of the ICA, per CS 25.981(d) and Appendix H to CS-25, paragraph H25.4.
6.3.2 FQIS
6.3.2.1 FQIS wiring in the tank, with maximum voltage and current applied, considering normal and failure conditions, including the effects of high‑voltage systems outside the tank in proximity to the FQIS wires.
6.3.2.2 FQIS components in the normal and failed state with the above associated maximum voltages and fault currents applied.
6.3.3 Float switch system
Float switch system temperatures should be determined considering the maximum environment temperatures and the application of the applicable maximum voltage and fault currents.
6.3.4 Fuel system components
The temperatures of the fuel system components should also be evaluated considering the failure of the bonding straps.
6.3.5 Pneumatic system
Pneumatic system temperatures need to be evaluated for the effects of duct ruptures impinging on the external tank surface. Radiant and conducted heat transfer associated with the tank and components affecting tank wall temperatures should also be considered (see the previous discussion of spaces adjacent to fuel tanks).
6.3.6 Electrical defects and arcing
Electrical defects that generate excessive heat, and arcing at the electrical connections to the pump housing or within the connector.
6.3.7 Submerged heat exchangers
Submerged heat exchangers and supply tubing operating under conditions of maximum heat rejection to the fuel. This should include failures in any systems outside the fuel tank that could result in heat exchanger or supply tubing surface temperatures exceeding 204 °C (400 °F).
6.3.8 Failed or aged seals
6.3.8.1 Spraying of fuel in the tank from any pressurised fuel source may cause electrostatic charging of the components in the fuel tank. In addition, the use of sealant in connectors that is not compatible with the fuel may allow leakage into the connector and the possibility of a fire near the connector.
6.3.8.2 Fuel line couplings
Ageing of seals may result in hardening of the seal material and leakage and spraying of fuel within the fuel tank; therefore, fuel line coupling designs should be evaluated and a design life should be established for all seals that are shown to age and allow leakage that can cause unacceptable electrostatic charging of components.
6.3.9 Fuel pump cooling flow
Fuel used for the cooling of fuel pumps may be sprayed from the fuel pump. Fuel pump cooling flow should not be sprayed into the fuel tank vapour space for the same reason as stated in 6.3.8 for the spraying of fuel. Means should be provided to distribute the discharged cooling fuel into the fuel tank at or near the bottom of the fuel tank.
6.3.10 Explosion-proof electrical connector sealant and seals
Electrical connections to fuel pumps are typically located either inside or outside the fuel tank in areas of the aeroplane where the presence of flammable fuel vapour should be assumed because no secondary sealing of fuel is provided. Fuel leakage and corrosion at electrical connectors located outside the fuel tank has allowed the presence of both flammable vapour and electrical arcing at connectors, resulting in fires. In other applications, arcing has occurred at the pump connections inside the fuel tanks, requiring the installation of appropriately sized steel shields to prevent arcing through the connector or pump housing into the fuel tank or areas where flammable vapour could exist.
6.3.11 Arcing at the pump electrical connections
Wear, corrosion, manufacturing variability (e.g. tolerances), connector distortion and seal damage from ice, and bent pins in the connector are examples of failures that have caused high resistance or shorting and arcing in electrical connectors. Based upon historical data showing that these and other failure modes listed previously in this AMC have occurred in fuel pump connectors, arcing in the connectors is a foreseeable failure. Each of these single or cascading failure modes should be included in the FMEA. The high current loads present during pump start‑up and operation exacerbate arcing in the connector. The size and duration of the arcing event should be established based upon the fuel pump electrical circuit protection features. Arcing at the pump electrical connections, and the resultant damage to the pump connector, housing, and explosion-proof features due to intermittent, and maximum energy, arcing events should be assumed. If fuel is present on the backside of the connector, failures resulting in fuel leakage in conjunction with arcing in the connector should be assumed if the fuel leak is a latent failure or is the result of a cascading failure. The design of traditional fuel pumps has resulted in the need to install AFCB or GFI protection features to address foreseeable failures and limit the energy release during an arcing event to prevent an ignition source from occurring. The pump connector should be shown to contain any resultant arcing or fire and to maintain all surface temperatures below the auto-ignition temperature of the fuel. Component manufacturer maintenance records and qualification test results should be reviewed as part of the safety analysis process to establish that any sealants and materials in the connector are compatible with the operating environment and to determine whether a design life or periodic inspections for the pump connector are needed.
7 AIRWORTHINESS LIMITATIONS FOR THE FUEL TANK SYSTEM
7.1 CS-25 Appendix H, paragraph H25.4(a)(2) requires that each mandatory replacement time, inspection interval, related inspection procedure, and all the CDCCLs approved under CS 25.981 for the fuel tank system, be included in the Airworthiness Limitations Section of the ICA.
7.2 Critical design configuration control limitations include any information necessary to maintain those design features that were defined in the original type design as being needed to preclude the development of ignition sources. This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the original fuel tank system type design. The original design approval holder should define a method to ensure that this essential information will be evident to those that may perform and approve repairs and alterations. Visual means to alert the maintenance crew should be placed in areas of the aeroplane where inappropriate actions may degrade the integrity of the design configuration. In addition, this information should be communicated by statements in the appropriate manuals, such as wiring diagram manuals.
7.2.1 CDCCLs may include any maintenance procedure that could result in a failure, malfunction, or defect endangering the safe operation of the aeroplane, if not performed properly or if improper parts or materials are used. This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the original type design of the fuel tank system.
7.2.2 CDCCLs are intended to identify only the critical features of a design that must be maintained. CDCCLs have no intervals; they establish configuration limitations to maintain and to protect the ‘critical design features’ identified in the CDCCLs. CDCCLs can also include requirements to install placards on the aeroplane with information about the critical features. For example, certain components of a fuel pump (or all the components) may include critical features that are identified as CDCCLs. These critical features must be identified in the Airworthiness Limitations Section of the ICA and should also be identified in the component maintenance manual (CMM) as CDCCLs to provide awareness to maintenance and repair facilities.
7.2.3 Certain CDCCLs apply to elements of fuel system components. As such, maintenance of those critical features may be covered in a CMM. When Airworthiness Limitations need to call out aspects of CMMs, it is a best practice to limit the CDCCL-controlled content to only those maintenance tasks directly impacting a CDCCL feature, rather than requiring the complete CMM to be a CDCCL.
7.3 Any fuel tank system components that are determined to require periodic maintenance, inspection, or overhaul to maintain the integrity of the system or maintain protective features incorporated to preclude a catastrophic fuel tank ignition event must be defined and included in the Airworthiness Limitations Section of the ICA. An inspection Airworthiness Limitation has a specific task and interval (such as 10 years). The inspection interval should be established based on the standard practices defined in AMC 25.1309 for the evaluation of component failures. The inspection could also be required following maintenance to verify that a CDCCL feature is maintained. Examples of inspection Airworthiness Limitations include the following:
7.3.1 Ageing fuel line coupling seals/o-rings
In certain instances, the materials used in fuel line couplings may lose flexibility and harden with age. Under pressurised operation, the seal may allow fuel leakage. This will allow spraying of fuel in the tanks or other areas of the aeroplane where spraying fuel could create a fire hazard. Repetitive inspections, functional checks, or mandatory replacement intervals may be required to prevent leakage.
Note: While not related to compliance with CS 25.981, the hazards associated with the ageing of fuel coupling O-rings, resulting in air entering fuel lines during suction feed operation, should also be addressed when developing the fuel system maintenance program.
7.3.2 Wear of pump bushings, bearings, and seals
Wearing of pump bushings, bearings, and seals may significantly affect the performance of fuel pumps and degrade the features necessary to maintain the explosive-proof qualification. In most cases, these failure conditions are latent; therefore, incorporation of other fail-safe features, as discussed earlier in this AMC, should be considered. If fail-safe features, such as the installation of feeder tanks that are filled using ejector pumps, are incorporated, the functioning of those features would need to be ensured by indications or periodic functional tests. The installation of fuel level sensors in the feeder tanks would provide continuous monitoring of the function. Another means could be the installation of flow indicators in the flow line of the ejector pump that can be viewed by maintenance personnel, and a mandatory periodic inspection of this function is one example of a method of a mandatory maintenance action.
7.3.3 Fuel pump electrical power protective features
If a failure of an AFCB or GFI protective feature and/or a thermal fuse (closed) is latent and this feature is needed to maintain the fail-safe features, periodic checks would likely be needed. The inspection interval, and the need for built-in test features with indications of failures, should be established through the safety analysis process and should consider the factors described in paragraph A.3.4.3 of Appendix A to this AMC.
7.3.4 Transient suppression/energy limiting devices
If a failure of the device is latent and this feature is needed to maintain the fail-safe features, periodic checks will likely be needed.
7.3.5 Wire shield grounding
Component grounds and wires will likely require inspections and measurements to determine whether they are properly grounded.
7.3.6 Fuel tank access panel/door seals
Maintenance tasks should adequately provide procedures for inspections and checks of access panels and door seals.
7.3.7 Corrosion, wear, and damage to fuel pump connectors
Maintenance tasks should provide adequate procedures for inspecting and checking fuel pump connectors for wear, corrosion, and damage.
7.3.8 Integrity of the fuel pump electrical supply conduit
Maintenance tasks should provide adequate procedures for inspecting the integrity of the structure, sealing, drain holes, and bends of the electrical supply conduit to the fuel pump.
7.4 Maintainability of design and procedures
Maintainability, both in the design and procedures (i.e. the master minimum equipment list, aeroplane maintenance manual, etc.), should be verified by the applicant. This should include, as a minimum, verification that the system and procedures support the safety analysis assumptions and are tolerant to the anticipated human errors.
7.5 Incorporation by reference into Airworthiness Limitations
7.5.1 Where the words ‘in accordance with’ or ‘per’ are used in the Airworthiness Limitations, the procedures in the referenced document must be followed to ensure that the critical design feature is maintained. Any changes to these procedures require approval by EASA before they can be used.
7.5.2 Where the words ‘refer to’ are used in the Airworthiness Limitations, the procedures in the referenced document represent one method of complying with the Airworthiness Limitation. An accepted alternative procedure may be developed by the operator in accordance with its procedures in its maintenance program/manual. Prior approval by EASA is not required for this action.
7.6 Visible identification of CDCCLs
7.6.1 CS 25.981(d) establishes a requirement for visibly identifying the critical features of a design that are located in certain areas. The DAH should define a method of ensuring that this essential information will be communicated with statements in the appropriate manuals, such as wiring diagram manuals, so it will be evident to those who perform and approve such repairs and alterations, and it will be identified as a CDCCL.
7.6.2 An example of a CDCCL that would result in a requirement for visible means would be maintaining wire separation between the FQIS wiring and other high-power electrical circuits where the separation of the wiring was determined to be a CDCCL. Acceptable methods of providing visible means would include colour coding and labelling the wiring. For retrofits of markings onto existing wiring, the placement of identification tabs at specific intervals along the wiring would be acceptable. Standardisation within the industry of the colour coding of the wiring used for the fuel tank system would assist maintenance personnel in the functional identification of wiring. It is recommended to use pink coloured wiring as a standard for fuel tank system wiring.
Appendix A. Certification of Arc Fault Circuit Breakers (AFCBs) or Ground Fault Interrupters (GFIs)
A.1 PURPOSE
This Appendix provides guidelines for the certification of AFCB or GFI devices that have been shown to be practical means to protect the circuits of electric-motor fuel pumps and other fuel tank components that use higher than intrinsically safe electrical power (for example, motor‑operated valves).
A.2 BACKGROUND
A.2.1 Service experience has shown that failures in the power supply circuit of a fuel pump, discussed in the body of this AMC, can result in ignition sources and, therefore, must be assumed as a foreseeable failure condition. Traditional thermal circuit breakers are sized to prevent nuisance trips during fuel pump transient power demands and have not tripped when intermittent electrical arcs occurred. Intermittent arcing can erode metallic barriers such as conduits, electrical connectors, and the pump housing, resulting in a loss of the integrity of the explosion-proof features, or creating ignition sources outside in areas adjacent to the fuel tank. Addressing the failure modes discussed in this AMC has resulted in the need to provide fast-acting GFI or AFCBs in traditional fuel pump electrical circuits in order to show compliance with CS 25.981.
A.2.2 AFCBs have been used as a practical means to protect against arcing in the power circuits of fuel pump motors powered by either alternating current or direct current. SAE International has issued two aerospace standards for AFCBs, one for alternating current circuits and one for direct current circuits. (See paragraph B.3 of Appendix B of this AMC).
A.2.3 Fuel pump housings and metallic conduits are grounded to the airframe, and any arcing to the cavity wall or conduit creates a ground fault. Therefore, GFIs have been used in AC pump power circuits as a practical means to ensure that power is quickly disconnected from the fuel pump in the event of a ground fault in the pump or the associated power wiring.
A.3 CERTIFICATION GUIDELINES
One acceptable means for the applicant to show compliance with the applicable regulations is to demonstrate, through design, review, analysis, and test, that the AFCB or GFI performs as intended under any foreseeable operating conditions and addresses the following guidance:
A.3.1 Fault detection trip levels
A.3.1.1 The applicant should show that the AFCB or GFI can distinguish between actual fault events and events characteristic of the normal aeroplane pump start-up operating loads and environmental conditions. Laboratory testing and/or aeroplane ground/flight testing should be performed to show the ‘intended function’ of the AFCB or GFI. The test methods chosen should reproduce the most common types of arcing in fuel pumps that occur in an aeroplane environment due to ground or arc faults. The AFCB or GFI should be designed to prevent nuisance tripping due to normal aeroplane electrical loads and electrical bus switching, and to operate continuously with the normal and abnormal aeroplane electrical bus switching characteristics associated with the master minimum equipment list dispatch relief configurations.
A.3.1.2 Installation of the AFCB or GFI should not result in an appreciable increase in the loss of the fuel pump function. A reliability requirement of the order of 100 000 hours mean time between failures may be satisfactory, but the applicant should show that a failure of the AFCB or GFI does not result in an appreciable increase in the occurrence of failures that result in the loss of fuel pump function.
A.3.1.3 Sufficient laboratory testing and aeroplane testing should be conducted to show the AFCB or GFI nuisance trip performance, including tests for lightning, HIRF, and electromagnetic compatibility. In addition, sufficient laboratory testing should be conducted to show that the AFCB or GFI trips before arcing in the fuel pump can lead to the ignition of fuel vapour in the fuel tank.
A.3.1.4 A means should be provided to latch the AFCB or GFI in a state that removes power from the fuel pump motor in the event that a ground fault has been detected, until the AFCB or GFI is reset. A trip of a single AFCB or GFI should not be reset until the reason for the trip has been determined and repaired, or until it has been determined that no ground fault exists. Intermittent arcing can cause tripping of circuit protection devices resulting from failures that are difficult to isolate during maintenance actions. Single trip events may be attributed to a nuisance fault. However, maintenance instructions should include notes that state that repeated tripping of devices indicates that an intermittent fault exists, and the circuit should not be energised until the fault is isolated and repaired.
A.3.2 Software
Inadvertent operation of multiple AFCB or GFI devices has the potential to affect the continued operation of more than one engine, a condition that EASA considers to be hazardous. The software used by the AFCB or GFI devices should be developed and verified in accordance with the latest version of AMC 20-115.
A.3.3 Airborne electronic hardware
Application-specific integrated and complex circuits used by the AFCB or GFI devices should be developed and tested in accordance with the latest version of AMC 20-152.
A.3.4 System safety assessment
A.3.4.1 AFCB or GFI devices may be installed in circuits that perform essential or critical functions, and/or their performance could impact the safety of flight. The applicant should perform an installation SSA in accordance with CS 25.901(c), 25.981(a) and (d), and 25.1309. The SSA should include a functional hazard assessment to determine the effects of failures of the AFCB or GFI devices on the safety of the aeroplane and to verify that the design limits the probability of undesirable failure conditions to acceptable levels. In addition, the applicant should address the potential for possible common cause trips due to hardware/software errors and common cause trips due to environmental conditions such as HIRF (CS 25.1317), lightning (CS 25.954 and 25.1316), and electromagnetic interference (CS 25.1301, and 25.1353(a)).
A.3.4.2 A failure to provide fuel pump power due to the unintended activation of multiple AFCB or GFI devices has the potential to affect the continued operation of more than one engine. A circuit‑protective device failure, cascading failure, or common cause failure that affects multiple engines would be non-compliant with CS 25.903(b) if it prevents the continued operation of the remaining engines, or requires immediate crew action to prevent a multiple engine power loss.
A.3.4.3 A failure of an AFCB or GFI device to detect an arc or ground fault condition in a fuel pump circuit can contribute to a catastrophic failure condition. Assuming that the loss of the explosion-proof features of the pump (examples discussed in paragraph A.2.1) or arcing at the electrical connector could result from a single failure, EASA considers the undetected failure of an AFCB or GFI alone, which prevents its detection of or response to an arc or ground fault, to be a hazardous failure condition. The probability of a loss of arc or ground fault protection should either be shown to be extremely remote (if latent, consistent with the requirement of CS 25.981(a)(3)) or annunciated to the flight crew prior to flight. If failures of the AFCB or GFI can contribute to hazardous or catastrophic failure conditions, the safety assessment should analyse the common cause failures or design errors that could result in these conditions and verify that appropriate protection to prevent them is provided. Due to the nature of AFCB and GFI devices, special attention should be given to protection from lightning, EMI, and HIRF.
A.3.4.4 As discussed in Section A.3.7 below, means should be provided for the flight crew to reset the AFCB or GFI in the event that more than one fuel pump AFCB or GFI trips simultaneously in flight.
A.3.4.5 Further, the applicant should show by design, analysis, and fault insertion testing, if applicable, the validity of failure analysis assumptions, and show that the probability of the failure of AFCB or GFI to detect the existence of a ground or arc fault condition and remove power from a pump is extremely remote (10-7 or less) when combined with a single failure as assumed in Section A.3.4.3. In order to show this, AFCB and GFI installations have typically required an automatic built-in test feature that verifies the AFCB or GFI is operational before applying power to the fuel pump prior to each flight (see Section 5.3.3 of this AMC).
A.3.5 Power and ground requirements
AFCBs or GFIs are active devices and they require power to function. The applicant should show that the AFCB or GFI power and ground connections are implemented such that all the aeroplane’s load margins are sufficient and that proper circuit protection or other methods are used to protect the AFCB or GFI power and ground wiring. The applicant should also show that there are no hazards to maintenance or flight crews due to possible hot shorts to electrical panels containing AFCBs or GFIs. In addition, if the installation of AFCBs or GFIs involves the direct replacement of devices on a given electrical panel, the applicant should show that there is adequate power/heat dissipation and ensure a safe touch temperature.
A.3.6 Built-in test
AFCB and GFI devices should incorporate the built-in test and annunciation features needed to meet the reliability requirements for showing compliance with CS 25.981(a)(3). For example, if a single or cascading failure in the fuel pump electrical circuit can result in an ignition source, a circuit protection feature failure rate less than extremely remote (1 x 10-7) would be required in order to comply with CS 25.981. Traditional protective devices without built-in tests and annunciations of failures have not been shown to achieve this level of reliability. Applicants should consider installing multiple protective devices in series or providing built-in tests with annunciation.
A.3.7 Troubleshooting procedures
A.3.7.1 Because AFCBs or GFIs are capable of detecting ground paths on pumps and aeroplane wiring that may not be detected by visual inspection, the applicant should define the operational and maintenance philosophies and the methodology associated with an AFCB or GFI trip that does not rely solely on visual inspections. The applicant should show how the maintenance procedures would be able to safely distinguish and diagnose an AFCB or GFI trip and a nuisance trip without causing a fuel tank explosion. Operational instructions and maintenance procedures should be provided to prevent the resetting of tripped AFCBs or GFIs until it can be assured that resetting an AFCB or GFI will not cause the occurrence of a fuel tank explosion. Human factors should be taken into account to minimise the possibility of human errors during aeroplane operation and maintenance.
A.3.7.2 If multiple boost pumps are protected with AFCB or GFI devices such that the continued operation of multiple engines could be affected, there should be a means for the flight crew to reset tripped AFCB or GFI devices in flight. A loss of fuel pump capability due to inadvertent tripping in some fuel tanks could result in a loss of the fuel reserves needed to complete an extended operations (ETOPS) flight or a safe diversion. To prevent causing an ignition source, the applicable aeroplane flight manual should contain a limitation against the reset of a single AFCB or GFI. However, in order to address common cause inadvertent tripping, procedures should be provided for resetting AFCB or GFI devices when multiple AFCBs or GFIs have tripped simultaneously in flight.
A.3.8 Hardware qualification
Environmental testing — including thermal, shock and vibration, humidity, fluid susceptibility, altitude, decompression, fungus, waterproof, salt spray, and explosion‑proof testing — should be performed in accordance with EUROCAE ED‑14G/RTCA DO-160G or equivalent standards. The applicant should define an insulation, dielectric, and electrical grounding and bonding standard acceptable to EASA for the AFCBs or GFIs. Appropriate test categories in each section of EUROCAE ED‑14G/RTCA DO-160G should be chosen based on the AFCB or GFI installation environment defined for the specific aeroplane. Particular attention should be given to the normal and abnormal power input tests outlined in Section 16 of EUROCAE ED‑14G/RTCA DO-160G. A system with AFCBs or GFIs installed must comply with CS 25.954 and CS 25.1316 for lightning protection, CS 25.1301 and CS 25.1353(a) for electromagnetic compatibility, and CS 25.1317 for HIRF.
A.3.9 Aeroplane tests
The applicant should show by ground tests, flight tests, or both that all the AFCBs or GFIs remain armed during both normal and abnormal electrical power bus and load switching as described in paragraph A.3.1.1 of this AMC, and are not adversely affected by the operation of other aeroplane systems. The aeroplane tests should also show that neither the AFCBs nor the GFIs would produce electromagnetic interference that would affect other aeroplane systems.
A.3.10 Instructions for Continued Airworthiness (ICA)
A.3.10.1 The applicant must submit the ICAs required by CS 25.1529 in order to provide the necessary procedures to service and maintain AFCB or GFI installations. As required by Appendix H to CS-25, H25.4, the Airworthiness Limitations Section of the ICA must include each mandatory replacement time, inspection interval, related inspection procedure, and all the critical design configuration control limitations (CDCCLs) approved under CS 25.981 for the AFCB or GFI installation. Inspection intervals determined from the safety analysis should be included for the detection of latent failures that would prevent the AFCBs or GFIs from tripping during a ground or arc fault event.
A.3.10.2 AFCBs or GFIs used for showing compliance with the CS 25.981 requirements for preventing ignition sources are typically CDCCLs in these installations. As required by CS 25.981(d), the applicant must provide visible means of identifying the AFCB or GFI as a CDCCL and should provide design features to minimise the inadvertent substitution of an AFCB or GFI with a non-AFCB or GFI device.
A.3.11 Aeroplane flight manual limitations
The aeroplane flight manual limitations section should address any limitations related to the intended function of the AFCBs or GFIs and any self-test features of the AFCB or GFI design.
Appendix B. Related Documents
B.1 EUROCAE Documents
— EUROCAE ED-14G Change 1 ‘Environmental Conditions and Test Procedures for Airborne Equipment’, dated January 2015.
— EUROCAE ED-79A ‘Guidelines for development of civil aircraft and systems’, dated December 2010.
— EUROCAE ED-107A ‘Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment’, dated July 2010.
B.2 RTCA Documents
— RTCA DO-160G, ‘Environmental Conditions and Test Procedures for Airborne Equipment’, 6 December 2010.
B.3 SAE International Documents
— AIR1662A, ‘Minimization of Electrostatic Hazards in Aircraft Fuel Systems’, dated August 2013.
— ARP4404C, ‘Aircraft Electrical Installations’ (guidance document for design of aerospace vehicle electrical systems).
— ARP4754A, ‘Certification Considerations for Highly Integrated or Complex Aircraft Systems’, dated December 2010.
— ARP4761, ‘Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment’, dated December 1996.
— ARP5583A, ‘Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment’, dated June 2010.
— AS50881F, ‘Wiring Aerospace Vehicle’ (procurement document used to specify aerospace wiring; replaces MIL-W-5088), dated May 2015.
— AS5692A, ‘ARC Fault Circuit Breaker (AFCB), Aircraft, Trip-Free Single Phase and Three Phase 115 VAC, 400 Hz - Constant Frequency’, dated December 2009.
— AS6019, ‘ARC Fault Circuit Breaker (AFCB), Aircraft, Trip-Free 28 VDC’, dated June 2012.
B.4 Military Specifications
MIL-STD-810H, Environmental Engineering Considerations and Laboratory Tests, dated January 2019.
B.5 Other Industry Documents
— Air Force Aero Propulsion Laboratory Technical Report AFAPL-TR-75-70, Summary of Ignition Properties of Jet Fuels and Other Aircraft Combustible Fluids, dated September 1975, http://www.dtic.mil/get-tr-doc/pdf?AD=ADA021320.
— ASTM D2155-12, Standard Test Method for Determination of Fire Resistance of Aircraft Hydraulic Fluids by Autoignition Temperature.
— ASTM D4865, Standard Guide for Generation and Dissipation of Static Electricity in Petroleum Fuel Systems, August 2009.
— ASTM E659-15, Standard Test Method for Autoignition Temperature of Chemicals, ASTM International.
— NASA Report NASA/TM-2000-210077, Some Notes on Sparks and Ignition of Fuels, dated March 2000, https://ntrs.nasa.gov/search.jsp?R=20000053468.
— National Fire Protection Association NFPA 77, Recommended Practice on Static Electricity, latest edition, http://www.nfpa.org.
— Underwriters Laboratories Inc., UL 913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations, dated 31 July 2006, https://standardscatalog.ul.com/standards/en/standard_913_8.
Appendix C. Definitions
C.1 ARC FAULT CIRCUIT BREAKER (AFCB)
A device that provides thermal circuit breaker protection, detects electrical arcing faults, and interrupts electrical power to the fault. (See paragraph B.3 of this AMC for the SAE standards for alternating current and direct current AFCBs.)
C.2 AUTO-IGNITION TEMPERATURE
The minimum temperature at which an optimised flammable vapour and air mixture will spontaneously ignite when heated to a uniform temperature in a normal atmosphere without an external source of ignition, such as a flame or spark.
C.3 AUXILIARY TANKS
Fuel tanks installed that make additional fuel available for increasing the flight range of the aeroplane. The term ‘auxiliary’ means that the tank is secondary to the aeroplane’s main fuel tanks; i.e., the functions of the main tanks are immediately available and operate without immediate supervision by the flight crew in the event of a failure or the inadvertent depletion of fuel in an auxiliary tank. Auxiliary tanks are usually intended to be emptied of usable fuel during flight and have been installed in various locations including centre wing structures, horizontal stabilisers, wings, and cargo compartments.
C.4 BARRIER
A physical partition attached to the aeroplane structure that separates one wire or group of wires from another wire or group of wires in order to prevent arcing, fire, and other physical damage between wires or groups of wires.
C.5 CRITICAL DESIGN CONFIGURATION CONTROL LIMITATIONS (CDCCLS)
Airworthiness Limitations that define those critical design features of the design that must be maintained to ensure that ignition sources will not develop within the fuel tank system.
C.6 ELECTRICAL SPARK
A spark that is initiated by a potential difference, which causes an electrical breakdown of a dielectric such as a fuel/air mixture, produced between electrodes that are initially separated, with the circuit initially carrying no current. The term ‘voltage sparks’ is sometimes used interchangeably with the term electrical sparks.
C.7 ELECTRICAL ARCS
Electrical arcs occur between electrodes that are in contact with each other and carry excessive current, which results in melting at the contact points. This may result in electric arc plasma and/or the ejection of molten or burning material. The term thermal sparks is used interchangeably with the term electrical arcs.
C.8 EXPLOSION PROOF
Components designed and constructed so they will not ignite any flammable vapour or liquid surrounding the component under any normal operating condition or any failure condition. Further information on the possible failure conditions that should be considered is specified in CS 25.981(a)(3).
C.9 FAIL-SAFE
Applicants should assume the presence of foreseeable latent (undetected) failure conditions when demonstrating that subsequent single failures will not jeopardise the safe operation of the aeroplane.
C.10 FILAMENT HEATING
The heating of a small diameter piece of conductive material when exposed to electrical current.
C.11 FLAMMABLE
Flammable, with respect to a fluid or gas, means susceptible to igniting readily or to exploding.
C.12 FLASHPOINT
The flashpoint of a flammable fluid is defined as the lowest temperature at which the application of a flame to a heated sample causes the vapour to ignite momentarily, or ‘flash.’ The test standard for jet fuel is defined in the fuel specification.
C.13 FRICTION SPARK
A heat source in the form of a spark that is created by mechanical contact, such as debris contacting a rotating fuel pump impeller.
C.14 FUEL SYSTEM AIRWORTHINESS LIMITATION
Any mandatory replacement time, inspection interval, related inspection procedure, and all the critical design CDCCLs approved under CS 25.981 for the fuel tank system identified in the Airworthiness Limitations Section of the ICA (as required by CS 25.981(d) and Section H25.4 of Appendix H to CS-25).
C.15 GROUND FAULT INTERRUPTER (GFI)
A device that provides thermal circuit breaker protection, detects an electrical power short circuit‑to‑ground condition, and interrupts electrical power to the ground fault.
C.16 HOT SHORT
Electrical energy introduced into equipment or systems as a result of unintended contact with a power source, such as bent pins in a connector or damaged insulation on adjacent wires.
C.17 IGNITION SOURCE
A source of sufficient energy to initiate combustion of a fuel/air mixture. Hot surfaces that can exceed the auto-ignition temperature of the flammable vapour under consideration are considered to be ignition sources. Electrical arcs, electrical sparks, and friction sparks are also considered ignition sources if sufficient energy is released to initiate combustion.
C.18 INSTALLATION APPRAISAL
A qualitative appraisal of the integrity and safety of the installation.
C.19 INTRINSICALLY SAFE
Any instrument, equipment, or wiring that is incapable of releasing sufficient electrical or thermal energy to cause an ignition source within the fuel tank under normal operating conditions, or the anticipated failure conditions (see CS 25.981(a)(3)) and environmental conditions.
C.20 LATENT FAILURE
Please refer to the definition provided in AMC 25.1309.
C.21 LINE REPLACEMENT UNIT (LRU)
Any components that can be replaced while the aeroplane remains in operational service. Examples of fuel system LRUs include components such as flight deck and refuelling panel fuel quantity indicators, fuel quantity system processors, and fuel system management control units.
C.22 MAXIMUM ALLOWABLE SURFACE TEMPERATURE
As defined in CS 25.981(a)(1) and (2), the surface temperature within the fuel tank (the tank walls, baffles, or any components) that provides a safe margin under all normal or failure conditions, which is at least 27.8 °C (50 °F) below the lowest expected auto-ignition temperature of the approved fuels. The auto-ignition temperatures of fuels will vary because of a variety of factors (ambient pressure, dwell time, fuel type, etc.). The value accepted by EASA without further substantiation for kerosene fuels, such as Jet A, under static sea level conditions, is 232.2 °C (450 °F). This results in a maximum allowable surface temperature of 204.4 °C (400 °F) for an affected component surface.
C.23 QUALITATIVE
Those analytical processes that assess system and aeroplane safety in an objective, non‑numerical manner.
C.24 QUANTITATIVE
Those analytical processes that apply mathematical methods to assess system and aeroplane safety.
C.25 TRANSIENT SUPPRESSION DEVICE (TSD)
A device that limits transient voltages or currents on wiring to systems such as the fuel tank quantity, fuel temperature sensors, and fuel level switches, etc., to a predetermined level.
[Amdt 25/1]
[Amdt 25/9]
[Amdt 25/26]
AMC 25.981(b)(1) Fuel tank flammability design precautions
ED Decision 2009/010/R
The intention of this requirement is to introduce design precautions, to avoid unnecessary increases in fuel tank flammability. These precautions should ensure:
(i) no large net heat sources going into the tank,
(ii) no unnecessary spraying, sloshing or creation of fuel mist,
(iii) minimization of any other energy transfer such as HIRF;
Applicants should limit the heat inputs to the maximum extent. Heat sources can be other systems, but also include environmental conditions such as solar radiation. The following design features have been found acceptable:
— heat insulation between a fuel tank and an adjacent heat source (typically ECS packs),
— forced ventilation around a fuel tank,
— fuel transfer logic leaving sufficient fuel in transfer tanks exposed to solar radiations on the ground in order to limit their effects
— heat rejecting paintings or solar energy reflecting paints to limit the heat input by solar radiation.
A critical parameter is the maximum temperature rise in any part of the tank under warm day conditions during a 4 hours ground operation. Any physical phenomenon, including environmental conditions such as solar radiation, should be taken into account. A temperature increase in the order of 20°C limit has been found acceptable for tanks not fitted with an active Flammability Reduction Means and therefore unable to meet the exposure criteria as defined in M25.1(b)(1).
Note 1: for tanks fitted with Flammability Reduction Means, applicants should limit heat and energy transfers to the maximum extent. No maximum temperature increase limit is defined; however the 20 °C limit is applicable in case of dispatch with the active Flammability Reduction Means inoperative.
Note 2: the maximum temperature increase under the conditions described above should be quantified whether or not the affected tank is fitted with a Flammability Reduction Means.
[Amdt 25/6]
AMC 25.981(b)(2) Fuel tank flammability definitions
ED Decision 2009/010/R
Equivalent Conventional Unheated Aluminium Wing is an integral tank in an unheated semi-monocoque aluminium wing of a subsonic aeroplane that is equivalent in aerodynamic performance, structural capability, fuel tank capacity and tank configuration to the designed wing.
Fleet Average Flammability Exposure is defined in Appendix N and means the percentage of time the fuel tank ullage is flammable for a fleet of an aeroplane type operating over the range of flight lengths.
[Amdt 25/6]