Subject: PROTECTION OF AIRCRAFT
ELECTRICAL / ELECTRONIC
SYSTEMS AGAINST THE INDIRECT
EFFECTS OF LIGHTNING Date: 12/21/06 Initiated by: AIR-100 AC No: 20-136A Change:
1. PURPOSE.
a. This advisory circular (AC) is for aircraft manufacturers, modifiers, and foreign regulatory authorities. In it, we at the Federal Aviation Administration (FAA) recommend how you can protect aircraft electrical and electronic systems from the effects of lightning. This AC describes a means, but not the only means, for you to show compliance with the applicable sections of Title 14 of the Code of Federal Regulations (14 CFR) parts 23, 25, 27, 29 and 33 as they pertain to the type or supplemental type certification of your aircraft.
b. This AC is not mandatory and does not constitute a regulation. However, if you use the means described in this AC, you must follow it in its entirety.
2. CANCELLATION. AC 20-136, Protection of Aircraft Electrical / Electronic Systems Against the Indirect Effects of Lightning, dated March 5, 1990, is cancelled.
3. EQUIPMENT HAZARDS COVERED IN THIS AC.
a. This AC addresses hazards posed by the indirect effects of lightning to electrical and electronic systems and their associated wiring that are installed on aircraft.
b. The guidance material in this document applies to the certification of aircraft and their installed electrical and electronic systems.
c. This AC does not address direct effects such as burning, eroding, and blasting of aircraft structure that lightning would have on an aircraft or its equipment, nor does this AC address fuel ignition hazards. For information on fuel ignition hazards, see AC 20-53, Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Caused By Lightning. Also, this AC does not address lightning zoning methods, lightning environment definition or lightning test methods, nor methods and techniques for coverings (fairing, skin, and cowl). Those types of coverings should normally be designed to prevent direct attachment of a lightning strike to the underlying system components. However, if direct attachment to a system component can occur, you will need to
assess both the direct and indirect effects. For information on lightning zoning methods and lightning environment definition see AC 20-155, SAE Documents to Support Aircraft Lightning Protection Certification. For information on lightning test methods see ARP 5416, Aircraft Lightning Test Methods. See appendix 2 of this AC for definitions of lightning strike and other terms in this AC.
d. Aircraft electrical and electronic systems or components are sometimes directly exposed to lightning current conducted from the aircraft exterior, such as when lightning strikes an antenna and current flows through its coaxial cable to the equipment connected to the other end of the coaxial cable. Identify those possibilities and eliminate them by modifying the design or addressing them in the certification plan. In this AC, we do not discuss these instances further.
4. STEPS FOR SHOWING COMPLIANCE. The following seven steps describe how you may satisfy the certification requirements for your aircraft’s electrical and electronic systems, by demonstrating they are safe from the indirect effects of lightning:
• Identify the systems to be assessed
• Determine the lightning strike zones for the aircraft
• Establish the airframe lightning current paths for the zones
• Determine the aircraft internal lightning transient environment
• Establish transient control levels (TCL) and equipment transient design levels (ETDL)
• Verify compliance
• Take corrective measures, if needed
a. Identify the Systems to be Assessed.
(1) General. The aircraft systems that require lightning assessment must be identified.
The process used for identifying these systems should be similar to the process for showing compliance with §§ 23.1309, 25.1309, 27.1309, and 29.1309, as applicable. These sections address any system failure that may cause or contribute to an effect on the safety of flight of an aircraft. The effects of a lightning strike, therefore, should be assessed in a manner that allows for the determination of the degree to which the aircraft and/or its systems safety may be influenced. The operation of the aircraft systems should be assessed separately and in combination with, or in relation to, other systems. This assessment should cover—
(a) All normal aircraft operating modes, stages of flight, and operating conditions;
(b) All failure conditions and their subsequent effect on aircraft operations and the flightcrew; and Page 2
(c) Any corrective actions required.
(2) Safety Assessment. A safety assessment related to lightning should be performed to establish and classify the equipment or system failure condition. Figure 1 provides the failure condition classification and corresponding system lightning certification level based on the applicable failure condition definition. The failure condition classifications and terms used in this AC are similar to those used in AC 23.1309-1C and AC 25.1309-1A, as applicable. Based on the failure condition classification established by the safety assessment, the systems should be assigned appropriate lightning certification levels, as shown in figure 1. Further guidance on performing the safety assessment can be found in AC 23.1309-1C, AC 25.1309-1A, AC 27-1, AC 29-2, SAE ARP 4754, and SAE ARP 4761.
Figure 1. Lightning Failure Conditions and Certification Levels
FAILURE CONDITION DEFINITION FAILURE
CONDITION SYSTEM
LIGHTNING
CERTIFICATION LEVEL Failure conditions that prevent continued safe flight and landing. For Part 23, the definition is: “failure conditions that are expected to result in multiple fatalities of the occupants, or incapacitation or fatal injury to a flight crewmember normally with the loss of the airplane.”
Catastrophic
A Failure conditions that reduce the aircraft’s or the crew’s ability to cope with adverse operating conditions that would:
• Greatly reduce safety margins or functional abilities;
• Cause physical distress or larger workload that could prevent flight crew members from performing their tasks accurately or completely; or
• Seriously injure a few occupants.
Hazardous/ Severe-Major
B Failure conditions that reduce the aircraft’s or the crew’s ability to cope with adverse operating conditions that would, for example:
• Significantly reduce safety margins or functional abilities;
• Significantly increase crew workload or decrease crew efficiency; or
• Cause discomfort to occupants, possibly including injuries.
Major
C Page 3
(3) Failure Conditions. The safety assessment may show that some systems have different failure conditions in different phases of flight; therefore, different lightning requirements may have to be applied to the system for different phases of flight. For example, an automatic flight control system may have a catastrophic failure condition for autoland, while automatic flight control system operations in cruise may have a hazardous failure condition.
Redundancy alone cannot protect against the indirect effects of lightning because the electromagnetic fields and structural IR voltages can interact, at the same time, with all electrical wiring aboard an aircraft. You should consider the effects of multiple system failures due to a lightning strike when you perform your safety analysis.
b. Determine the Lightning Strike Zones for the Aircraft. Lightning zoning is a functional step in demonstrating the aircraft is adequately protected from both direct and indirect effects of lightning. The purpose of lightning zoning is to determine those areas of the aircraft likely to experience lightning channel attachment and those structures that may conduct lightning current between lightning attachment points. You must determine the lightning attachment zones for your aircraft configuration, since the zones will be dependent on the aircraft’s geometry, materials, and operational factors. Because of this, lightning attachment zones often vary from one aircraft type to another.
NOTE: AC 20-155, SAE Documents to Support Aircraft Lightning Protection Certification, references guidance that you can use in determining the lightning attachment zones for your aircraft.
c. Establish the Airframe Lightning Current Paths for the Zones. Zones 1 and 2 define where lightning is likely to attach and, as a result, the entrance and exit points for current flow through the aircraft. By definition, Zone 3 areas carry lightning current flow between direct (or swept stroke) attachment points. Therefore, we accept design and analysis using Zone 3 current levels as the external environment. The external lightning environment is:
• Caused by the lightning flash interacting with the exterior of the aircraft.
• Represented by combined waveforms of the lightning current components at the aircraft surface.
NOTE: AC 20-155 also references guidance that you can use in determining the lightning waveforms and their applications.
d. Determine the Aircraft Internal Lightning Transient Environment.
(1) The aircraft internal lightning environment consists of the transient electromagnetic fields and structural IR voltages produced by lightning current flowing through the aircraft.
Structural IR voltage is the portion of the induced voltage resulting from the product of the distributed lightning current (I) and the resistance (R) of the aircraft skin or structure. The electromagnetic fields and structural IR voltages produce voltages and currents on interconnecting wiring, which appear at equipment interface circuits. Electromagnetic fields in the aircraft may penetrate equipment enclosures and compromise system operation.
(2) Determine the lightning-induced voltage and current transient waveforms and the actual transient levels (ATL) that can appear at the electrical and electronic equipment interface circuits for each system identified in paragraph 4a. You may determine the lightning-induced transients in terms of the wire bundle current, or the open circuit voltage and the short circuit current appearing at system wiring and equipment interface circuits. The actual transient voltage and current are dependent on the loop impedances of the system and its interconnecting wiring.
e. Establish Transient Control Levels (TCL) and Equipment Transient Design Levels (ETDL).
(1) Specify the ETDL for your electrical and electronic equipment. The ETDL sets a qualification test level for this equipment. The ETDLs represent the amplitudes and waveforms of voltage or current that the equipment must withstand and remain operational. If you test the equipment to transient levels that are higher than the ETDLs, the equipment may be damaged or upset so that it no longer performs its intended function. Design your electrical and electronic equipment lightning protection to meet the specified EDTLs.
(2) Specify the TCLs so they are equal to or greater than the maximum expected ATL.
The TCL amplitudes and waveform represent target design limits for the internal lightning transient voltage and current expected to be induced on system wiring. Design your aircraft lightning protection to meet the specified TCLs.
Figure 2. Relationships Among Transient Levels Margin Transient Control Level (TCL) Actual Transient Level (ATL) Equipment Transient Design Levels (ETDL) Equipment Upset or Damage Aircraft System Wiring Electrical and Electronic Systems and Equipment
(3) The difference between ETDL and ATL is the margin. Figure 2 above shows the relationship among the ATL, TCL, and ETDL. You should evaluate the aircraft, interconnecting Page 5
wiring, and equipment protection to determine the most effective combination of TCLs and ETDLs that will provide acceptable margin. Appropriate margins to account for uncertainties in the verification techniques may be required as discussed in paragraph 6i of this AC.
f. Verify Compliance.
(1) Show that the ETDLs exceed the ATLs by the margin established in your certification plan.
(2) Verification may be accomplished by tests, by analysis, or by demonstrating similarity with previously certified aircraft and systems. The certification process for Level A systems is discussed in paragraph 6. The certification process for Level B and C systems is discussed in paragraph 7.
(3) Submit your certification plan early in the program to the cognizant aircraft certification office (ACO) for their review. Experience shows, particularly with aircraft using new technology or those that have complex systems, that early agreement on the certification plan benefits both the applicant and the cognizant ACO. The plan should define acceptable ways to resolve critical issues during the certification process. Analysis and test results during the certification process may warrant modifications in the design or verification methods. When significant changes are necessary, update the certification plan accordingly. The plan may include the items listed in figure 3:
Figure 3. Items to Include in a Lightning Certification Plan
ITEM DISCUSSION Description of systems Describe systems’ installation, including unusual or unique features; the system failure condition classifications; the operational aspects; lightning attachment zones; lightning environment; preliminary estimate of ETDLs and TCLs; and acceptable margins between ETDLs and ATLs.
Description of compliance method Describe how to verify compliance. Typically, your verification method includes similarity, analytical procedures, and tests. If using analytical procedures, describe how to verify them. For more information, see paragraph 6d of this AC.
Acceptance criteria Determine the pass/fail criteria for each system by analyzing how safe the system is. During this safety analysis, assess the aircraft in its various operational states; account for the failure and disruption modes caused by the indirect effects of lightning.
Test plans Plan each test you include as part of your certification process. As an applicant, you can decide if your test plans are separate documents or part of the compliance plan. Your test plans should state the test sequence.
g. Take Corrective Measures. When tests and analyses show that the system did not meet the pass/fail criteria, review the aircraft, installation or system design, and improve protection against lightning.
5. EFFECTS OF INDUCED TRANSIENTS. Lightning induces voltage and current transients on equipment circuits. Equipment circuit impedances and configurations will determine whether induced transients are primarily voltage or current. These transient voltages and currents can degrade system performance permanently or temporarily. The two primary types of degradation are:
a. Component Damage. This is a permanent condition in which transients alter the electrical characteristics of a circuit. Examples of devices that may be susceptible to component damage include:
• Active electronic devices, especially high frequency transistors, integrated circuits, microwave diodes, and power supply components;
• Passive electrical and electronic components, especially those of very low power or voltage rating;
• Electro-explosive devices, such as squibs and detonators;
• Electromechanical devices, such as indicators, actuators, relays, and motors; and
• Insulating materials (for example, insulating materials in printed circuit boards and connectors) and electrical connections that can burn or melt.
b. System Functional Upset.
(1) Functional upset is mainly a system problem caused by electrical transients. It may permanently or momentarily upset a signal, circuit, or a system component. This can adversely affect system performance enough to compromise flight safety. A functional upset is a change in digital or analog state that may or may not require manual reset. In general, functional upset depends on circuit design and operating voltages, signal characteristics and timing, and system and software configuration.
(2) Systems or devices that may be susceptible to functional upset include:
• Computers and data/signal processing systems;
• Electronic engine and flight controls; and
• Power generating and distribution systems.
6. LEVEL A SYSTEM LIGHTNING CERTIFICATION.
a. Identify Level A Systems.
(1) Identify your Level A systems as described in paragraph 4a.
(2) Figure 4 below illustrates a process that you can use to show that your Level A system complies with 14 CFR requirements.
(3) Define the detailed system performance pass/fail criteria. You should get ACO concurrence on this criteria before you start testing or analyzing your Level A system.
(4) You must identify specific equipment, components, sensors, power systems and wiring associated with each Level A system. You will use this when you perform the ETDL verification discussed in paragraphs 6g and 6h.
Figure 4. Typical Compliance Process for Level A Systems
b. Establish TCLs and ETDLs. ETDLs are established from an evaluation of TCLs in a particular aircraft structure and installation design. In general, the ETDLs for equipment in a complex system will not be the same for all wire bundles connecting it to other equipment in the system. You may use existing aircraft data from tests and analyses to establish TCLs and ETDLs.
c. Determine ATLs Using Aircraft Tests. You may use aircraft tests to determine the ATLs. See SAE ARP 5415, User’s Manual for Certification of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning, and ARP 5416, Aircraft Lightning Test Methods, for guidance on how to test aircraft to determine the ATLs.
d. Determine ATLs Using Analysis. You may use aircraft analysis to determine the ATLs. See SAE ARP 5415 for guidance on how to analyze aircraft to determine the ATLs.
Analysis techniques are available that calculate lightning transients using analytical models of all or parts of the aircraft including the internal structure and wires. Acceptance of the analysis method you choose depends on the accuracy of the method. You should confirm your analysis method accuracy using experimental data, and gain agreement with your analysis approach from the cognizant ACO.
e. Determine ATLs Using Similarity.
(1) You may use similarity to determine the ATLs. You may do this when there are:
• Only minor differences between the previously certified aircraft and system installation, and the aircraft and system installation to be certified; and
• There is no unresolved in-service history of problems related to lightning strikes to the previously certified aircraft.
(2) If you are unsure how the differences will affect the aircraft ATLs, perform more tests and analyses to resolve the open issues.
(3) To use similarity, you must assess the aircraft, wiring, and system installation differences that can adversely affect the system susceptibility. When assessing a new installation, consider differences that affect the internal lightning environment of the aircraft and its effects on the system. The assessment should cover:
• Aircraft type, equipment locations, airframe construction, structural materials, and apertures that could affect attenuation of the external lightning environment;
• System wiring size, length, and routing, wire types (whether parallel or twisted wires), connectors, wire shields, and shield terminations;
• Lightning protection devices such as transient suppressors and lightning arrestors;
• Grounding and bonding.
(4) You cannot use similarity for a new aircraft design with new systems.
f. Determine ETDLs Using RTCA/DO-160 Section 22 Guidance (Level A Displays Only).
(1) This approach is only applicable to Level A display systems. Level A displays involve functions for which the pilot will be within the loop through pilot/system information exchange. The reason that this approach should not be used for other Level A systems, such as control systems, is because failures and malfunctions of those systems can more directly and abruptly contribute to a catastrophic failure event than display system failures and malfunctions;
therefore, other Level A systems require a more rigorous lightning transient compliance verification program.
(2) Level A display systems typically include, in addition to the display(s); symbol generators or data concentrator devices, various sensors inputs (for example, attitude, airdata, and heading information), interconnection wiring, and associated control panels.
(3) You must use the information in figure 5 to evaluate your aircraft and system installation features to select an appropriate ETDL for your system. You must provide the cognizant ACO with a description of your aircraft and system installation features and compare these to the information in figure 5 to substantiate the ETDL selected for your aircraft and Level A display system installation.
(4) This approach offers a means of selecting the ETDLs for your Level A display system without determining specific aircraft ATLs through test or analysis. RTCA/DO-160E, Section 22, Tables 22-2 and 22-3, provides levels that may be selected as ETDLs.
Figure 5. Equipment Transient Design Levels - Level A Displays
RTCA/DO- 160
SECTION 22 LEVEL
DISPLAY SYSTEM INSTALLATION LOCATION
Level 5 Use this level when the equipment under consideration, its associated wire bundles, or other components connected by wiring to the equipment is in aircraft areas exposed to very severe lightning transients. We at the FAA define these areas as:
• Areas with composite materials whose shielding is not very effective;
• Areas where there is no guarantee of structural bonding; and
• Other open areas where there is little shielding.
You can also use this level to cover a broad range of installations.
You may need higher ETDLs when there are high current density regions on mixed conductivity structures (such as wing tips, engine nacelle fin, and so on) because the system wiring may divert some of the lightning current. If you are the system designer, apply measures to reduce the need for higher ETDLs.
Level 4 Use this level when the equipment under consideration, its associated wire bundles, or other components connected by wiring to the equipment, is in aircraft areas exposed to severe lightning transients. We define these areas as outside the fuselage (such as wings, fairings, wheel wells, pylons, control surfaces, and so on).
Level 3 Use this level when the equipment under consideration, its associated wire bundles, and other components connected by wiring to the equipment is entirely in aircraft areas with moderate lightning transients. We define these areas as the inside metal aircraft structure or composite aircraft structure whose shielding without improvements is as effective as metal aircraft structure.
Examples of such areas are avionics bays not enclosed by bulkheads, cockpit areas, and locations with large apertures (that is, doors without electromagnetic interference (EMI) gaskets, windows, access panels, and so on).
Current-carrying conductors in these areas (such as hydraulic tubing, control cables, wire bundles, metal wire trays, and so on) are not necessarily electrically grounded at bulkheads. When few wires exit the areas, either use a higher level (that is, Level 4 or 5) for these wires or offer more protection for these wires.
Level 2 Use this level when the equipment under consideration, its associated wire bundles, and other components connected by wiring to the equipment is entirely in partially protected areas. We define these areas as the inside of a metallic or composite aircraft structure whose shielding is as effective as metal aircraft structure, if you take measures to reduce the lightning coupling to wires.
Wire bundles in these areas pass through bulkheads, and have shields that end at the bulkhead connector. When a few wires exit these areas, use either a higher level (that is, Level 3 or 4) or provide more protection for these wires. Install wire bundles close to the ground plane, to take advantage of other inherent shielding from metallic structures. Current-carrying conductors (such as hydraulic tubing, control cables, metal wire trays, and so on) are electrically grounded at all bulkheads.
Level 1 Use this level when the equipment under consideration, its associated wire bundles, and other components connected by wiring to the equipment is entirely in well-protected aircraft areas. We define these areas as electromagnetically enclosed.