# AC 25.954-1: Transport Airplane Fuel System Lightning Protection - Type: Advisory circular (guidance, not mandatory unless a rule or AD requires it) - Status: Current - Approved: September 24, 2018 - Last reviewed: September 27, 2018 - Family: AC 25.954-1 - 14 CFR parts: 25 - 14 CFR sections: [25.954](https://www.ecfr.gov/current/title-14/section-25.954) - Pages: 37 - PDF: https://openairdocs.org/files/sha256/3c/ec/3cecdc26b416672ef4af33e6099be3df4b7df6c39c3b7b01428eee850ed9004d - FAA DRS: https://drs.faa.gov/browse/excelExternalWindow/6B79E9BB4023AE36862583150058C583.0001 - DRS record last changed: October 23, 2026 - Page: https://openairdocs.org/ac/25.954-1 ## Versions - [AC 25.954-1](https://openairdocs.org/ac/25.954-1) (Current), approved Sep 24, 2018, 37 pages ## Text Each page's text from the PDF; open the PDF at a page with #page=N. ### Page 1 U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Transport Airplane Fuel System Lightning Protection Date: 09/24/18 Initiated By: AIR-670 AC No: 25.954-1 This advisory circular (AC) provides guidance for showing compliance with the airworthiness regulations for transport category airplanes regarding lightning protection of fuel tanks and systems. These lightning protection requirements apply to normal conditions and possible failures of fuel tank structure and systems that could lead to fuel tank explosions. This AC also provides guidance for developing critical design configuration control limitations (CDCCLs) and Airworthiness Limitations required to be included in the Instructions for Continued Airworthiness (ICA) related to lightning protection features of the airplane fuel system. If you have suggestions for improving this AC, you may use the Advisory Circular Feedback form at the end of this AC. Dr. Michael C. Romanowski Director, Policy and Innovation Division Aircraft Certification Service ### Page 2 Contents Paragraph Page ii 1 Purpose … 1 2 Applicability … 1 3 Background … 2 4 Approach to Compliance … 2 4.1 Summary … 2 4.2 Compliance Tasks … 2 4.3 Identify the Design Features and Elements of the Fuel System that Require Lightning Assessment … 3 4.4 Determine the Lightning Strike Zones … 3 4.5 Establish the Airplane Lightning Environment … 4 4.6 Develop a Lightning Protection Approach and Design Lightning Protection Features ...4 4.7 Identify Potential Failures of the Design and Protection Features … 5 4.8 Identify Potential Ignition Sources Associated with the Design Features and Potential Failures … 5 4.9 Perform a Safety Assessment to Determine Fault Tolerance and Non-Fault Tolerance ..7 5 Provide Reliable Fault-Tolerant Protection for Lightning Ignition Sources … 9 5.1 Provide Fault-Tolerant Lightning Protection … 9 5.2 Demonstrate Effective Fault-Tolerance … 9 5.3 Demonstrate Protection Reliability … 10 5.4 Demonstrate Compliance with the “Extremely Improbable” Requirement … 11 6 Assess Non-Fault-Tolerant Protection for Lightning Ignition Sources … 12 6.1 Overview … 12 6.2 Qualitative Assessment of Non-Fault-Tolerant Conditions … 13 6.3 Quantitative Assessment of Non-Fault-Tolerant Conditions … 18 6.4 Evaluating Non-Fault-Tolerance for Systems … 19 7 Establish Airworthiness Limitations … 19 7.1 Critical Design Configuration Control Limitations … 19 7.2 Mandatory Replacement Times, Inspection Intervals, and Related Inspection and Test Procedures … 22 Appendix A. Related Documents … A-1 A.1 FAA Regulations … A-1 ### Page 3 Contents (continued) Paragraph Page iii A.2 European Aviation Safety Agency (EASA) Regulations … A-1 A.3 Advisory Circulars … A-1 A.4 Reports … A-2 A.5 A4A Documents … A-2 A.6 European Organization for Civil Aviation Equipment (EUROCAE) Documents … A-2 A.7 RTCA Documents … A-2 A.8 SAE International Documents … A-3 Appendix B. Definitions … B-1 B.1 Attachment Point … B-1 B.2 Continued Safe Flight and Landing … B-1 B.3 Critical Design Configuration Control Limitations (CDCCLs) … B-1 B.4 Critical Lightning Strike … B-1 B.5 Escapes … B-1 B.6 Extremely Improbable Failure Condition … B-1 B.7 Fault-Tolerant Design … B-2 B.8 Fuel Systems … B-2 B.9 Fuel Tank Structure … B-2 B.10 Fuel Tank Systems … B-2 B.11 Intrinsically Safe … B-2 B.12 Lightning Flash … B-2 B.13 Lightning Strike … B-2 B.14 Lightning Strike Zones … B-2 B.15 Lightning Stroke (Return Stroke) … B-3 B.16 Practicality … B-3 B.17 Reliable Design … B-3 B.18 Reliable Fault Tolerance … B-3 B.19 Remote … B-3 B.20 Systems … B-3 Appendix C. Section 6 Examples … C-1 C.1 Examples for Paragraph 6.1.2.1 of this AC … C-1 ### Page 4 Contents (continued) Paragraph Page iv C.2 Examples for Paragraph 6.1.2.2 of this AC … C-1 C.3 Examples for Paragraph 6.1.2.3 of this AC … C-1 C.4 Example for Paragraph 6.2.5.3 of this AC … C-2 Figures Number Page Figure 1. Assessing the Combined Risk of All Non-Fault-Tolerant Failures … 16 ### Page 5 **1 1 PURPOSE.** 1.1 This AC provides guidance for showing compliance with title 14, Code of Federal Regulations (14 CFR) 25.954, Fuel system lightning protection, at amendment 25-146. It includes guidance on tasks to be accomplished to comply with § 25.954 for lightning protection of the airplane fuel system. These tasks may be accomplished in a different order than listed below, and some tasks may require iterations. 1.2 This AC also provides guidance, in the form of a method of compliance, appropriate for airplane fuel systems with reliable fault-tolerant lightning protection for ignition sources, including details on compliance for fault-tolerant lightning protection. Any non-fault-tolerant lightning protection in an airplane fuel system will, in order to comply with the method of compliance set for in this AC, need a thorough assessment for the likelihood of failures, lightning strikes and attachment locations, and fuel tank flammability to show compliance with the regulations. Guidance on compliance for non-fault-tolerant lightning protection are provided in this AC. 1.3 The following appendices appear at the end of this AC:  Appendix A, Related Documents.  Appendix B, Definitions.  Appendix C, Section 6 Examples. **2 APPLICABILITY.** 2.1 This AC applies to all applicants for new type certificates or changes to existing type certificates when the certification basis requires the applicant to address the lightning certification requirements of § 25.954, at amendment 25-146. 2.2 The guidance in this AC is for airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) transport airplane type certification engineers and the Administrator’s designees. 2.3 The material in this AC is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes acceptable means, but not the only means, for showing compliance with the applicable regulations. The FAA will consider other means of showing compliance that an applicant may elect to present. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. If, however, we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation or design changes as a basis for finding compliance. ### Page 6 2.4 The material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes in, or permit deviations from, existing regulatory requirements. **3 BACKGROUND.** The FAA adopted amendment 25-146, issued on September 6, 2018 (83 FR 47548, September 20, 2018), modifying the fuel systems lightning safety provisions of § 25.954. This amendment also changed § 25.981, Fuel tank explosion prevention, by excepting fuel systems lightning protection. The revised § 25.954, at amendment 25 146, includes requirements to—  Ensure catastrophic fuel vapor ignition is extremely improbable;  Develop CDCCLs, inspections, test procedures, and mandatory replacement times for lightning protection design features; and  Include the CDCCLs, inspections, test procedures, and mandatory replacement times in the Airworthiness Limitation section of the ICA. **4 APPROACH TO COMPLIANCE.** 4.1 Summary. The method in this AC divides the design features for fuel system lightning protection into three categories: intrinsically safe, fault tolerant, and non-fault tolerant. It also provides guidance on developing material for the Airworthiness Limitations section of the ICA. 4.1.1 Guidance for incorporating intrinsically safe design features into the fuel tank system is provided in paragraph 4.9.4.1 of this AC. 4.1.2 Section 5 of this AC provides guidance on compliance with § 25.954(b) for fault-tolerant lightning protection designs. 4.1.3 Section 6 of this AC provides guidance on compliance with § 25.954(b) for non-fault-tolerant lightning protection designs. 4.1.4 Section 7 of this AC provides guidance on developing CDCCLs and other tasks that must be placed in the Airworthiness Limitation Section of the ICA. 4.2 Compliance Tasks. The applicant should accomplish the following tasks to comply with § 25.954 lightning protection requirements for the airplane fuel system. These tasks may be accomplished in a different order than listed below, and some tasks may require iterations. Further information is provided in the paragraph referenced at the end of each task.  Identify the design features and elements of the fuel system that require lightning assessment (paragraph 4.3). ### Page 7 3  Determine the lightning strike zones (paragraph 4.4).  Establish the airplane lightning environment (paragraph 4.5).  Develop a lightning protection approach and design lightning protection features (paragraph 4.6).  Identify potential failures of the design and protection features (paragraph 4.7).  Identify potential ignition sources associated with the design features and potential failures (paragraph 4.8).  Perform a safety assessment to determine fault tolerance and non-fault tolerance (paragraph 4.9).  Provide reliable fault-tolerant protection for lightning ignition sources (paragraph 5).  Assess non-fault-tolerant protection for lightning ignition sources (paragraph 6).  Establish airworthiness limitations (paragraph 7). 4.3 Identify the Design Features and Elements of the Fuel System that Require Lightning Assessment. To comply with § 25.954(b), the applicant should identify the fuel system design features and elements for the fuel tank structure, system components, and equipment that require lightning assessment to show that ignition of fuel vapor within the systems due to lightning and its effects is prevented. The design features and elements may be categorized into design groups that share characteristics that have similar lightning protection performance. The applicant should provide a detailed description of the fuel system, including:  Structural members and fasteners exposed to direct and swept lightning attachment;  Structural joints and fasteners exposed to conducted-lightning current resulting from lightning attachment;  Access doors, vents, drain valves, fuel filler ports, and other parts and components of the fuel system exposed to direct lightning attachment or conducted lightning currents; and  Electrical, mechanical, hydraulic, and fuel plumbing system installations within the fuel tank or connected to the fuel tanks exposed to direct lightning attachment or conducted lightning current. 4.4 Determine the Lightning Strike Zones. Lightning strike zones define locations on the airplane where lightning is likely to attach and structures that will conduct lightning current between lightning attachment points. The applicant should determine lightning strike zones for the airplane configuration, since the zones will be dependent upon the airplane geometry and operational factors. Lightning strike zones often vary from one airplane type to another. ### Page 8 4 SAE1 ARP5414A2, Aircraft Lightning Zones, provides guidance on determining lightning strike zones for the airplane, area of direct lightning strikes, areas of swept lightning strokes, and areas of conducted electrical transients. When determining the probability of lightning attachment to certain regions of the airplane, applicants should use data from similar airplane configurations to substantiate any assumed strike attachment rate for the region. 4.5 Establish the Airplane Lightning Environment. Fuel tank structure, system components, and equipment that are located in lightning zones 1 and 2 should be designed for lightning direct-attachment waveforms. SAE ARP5412B3, Aircraft Lightning Environment and Related Test Waveforms, provides guidance on acceptable lightning current and voltage waveforms for lightning zones 1 and 2. Fuel tank structure, system components, and equipment that are exposed to conducted currents should be assessed to determine the appropriate lightning current and voltage waveforms and amplitudes, using the conducted current waveforms for zone 3 in SAE ARP5412. The applicant may use analyses or tests to assess the conducted currents and voltages for the structure, system components, and equipment. Margins should account for uncertainty of the analysis or test. Simple analyses of the lightning currents and voltages should incorporate larger margins than lightning currents and voltages that were calculated using detailed computational models that have been validated by tests. 4.6 Develop a Lightning Protection Approach and Design Lightning Protection Features. The applicant should develop the lightning protection approach and design lightning protection features required to provide effective lightning protection for all the fuel system design features and elements identified in paragraph 4.3 of this AC. See paragraphs 5.2 and 6.1.2 for further guidance for demonstration of effective protection. The lightning protection features can include specific installation requirements, such as hole-size tolerance for fasteners or surface cleaning for sealant application. Other lightning protection features can include specific protection components, such as metal mesh incorporated into the outer surface of composite structures. The design should provide reliable lightning protection that prevents lightning–related ignition sources if a potential failure occurs in the lightning protection features. When possible, the design should place fuel system components—such as fuel tank vents, drain valves, jettison tubes, filler ports, and access doors—in lightning attachment zone 3, so they are less likely to be exposed to direct lightning attachment. 1 Formerly known as the Society of Automotive Engineers. 2 SAE ARP5414 is referenced in AC 20-155A, Industry Documents to Support Aircraft Lightning Protection Certification. 3 SAE ARP5412B is referenced in AC 20-155A. ### Page 9 4.7 Identify Potential Failures of the Design and Protection Features. 4.7.1 The applicant should identify potential failures, due to causes that include manufacturing escapes4, operational deterioration5, and accidental damage6, that may lead to the loss or degradation of lightning protection. Identify design elements that could degrade the effectiveness of lightning protection through analysis or test. Identify failures through detailed review of manufacturing processes, material properties, structural design, systems design, and reliability and maintainability processes. Use available manufacturing discrepancy reports, in-service failure reports, and developmental tests to identify potential failures. Account for failures such as structural cracking, corroded or failed electrical bonding features, and mis-installed electrical bonding features that occur during manufacturing or maintenance. 4.7.2 The severity or types of failures should be defined and can be based on service history, where appropriate, and laboratory test data. Failure severity should be consistent with or bounded by assumptions made for structural and systems certification analyses. Severity or types of failures due to manufacturing escapes should be based on manufacturing discrepancy reports, such as rejection tags, manufacturing process escape assessments, and assessments of process improvements. 4.7.3 Manufacturing variability and environmental conditions should be considered in conjunction with failures. Combining worst-case conditions for all manufacturing variabilities and environmental conditions is overly conservative and not necessary. Failures due to operating or environmental conditions outside of those required for certification need not be considered. Combinations of failures where one failure also causes a second failure to occur should be considered as a single failure condition (i.e., a common cause or cascading failure). 4.8 Identify Potential Ignition Sources Associated with the Design Features and Potential Failures. 4.8.1 Fuel system fasteners, structure, equipment, and components that are exposed to direct lightning attachment in lightning zones 1 and 2 should be assessed using the lightning 4 Manufacturing escapes for fuel tank structure include fastener selection issues (incorrect fastener size, type, finish, or coating), fastener assembly issues (misalignment, incorrect torque, hole size or quality, missing or extra washers), and installation issues (inadequate or improperly adhered sealant, missing cap seals, incorrectly installed electrical bonds). Manufacturing escapes for fuel system components and equipment include design configuration issues (incorrect fasteners, wrong or missing clamps or brackets, inadequate or improperly adhered sealant, missing or incorrect finishes), bonding issues (missing or improperly installed electrical bond or wiring shield), and clearance issues (insufficient tube or wiring clearance to adjacent systems or structure). 5 Structural failures due to operational deterioration during intended operation include broken or cracked elements (fasteners or washers), corrosion, degradation of applied materials (sealants, fastener head coating, edge glow protection, or bonded joints), and fatigue issues (loose fasteners or structural cracks). System failures due to operational deterioration include failures of support features (loss of fasteners, brackets, or clamps that support tubes, EWIS or components) and degradation of electrical bonds, wire insulation or shielding due to corrosio n, aging, or wear. 6 Structure or system failures due to accidental damage include impact from foreign object debris (FOD) or inadvertent damage incurred during alterations, repairs, or inspections. ### Page 10 6 waveforms identified in paragraph 4.5 of this AC. Fuel system fasteners, structure, equipment, and components should also be assessed for conducted lightning currents. If the airplane uses novel or unusual materials, structure, or configurations, the applicant should evaluate fuel system fasteners, structure, equipment, and components on the outside surface of the airplane located in lightning zone 3 using the nominal zone 3 direct lightning attachment waveforms defined in SAE ARP5412. Use of materials for fuel tank structure that are not highly conductive is considered unusual. Lightning attachment in zone 3 is defined as unlikely in SAE ARP5414, so the evaluation need not consider failures in combination with such an attachment but should demonstrate no catastrophic effect will occur when no failures are present. 4.8.2 The following paragraphs list ignition source types and examples of how ignition sources might occur: 4.8.2.1 Voltage sparks are the result of electrical breakdown of a dielectric between two separated conductors. Voltage sparking might occur, for example, between the fastener and its hole or through an insulation layer between the base of a nut and a conductive surface. A voltage spark could occur between a fuel tube and adjacent structure if the separation is insufficient or the bonding to minimize the voltage potential has failed. If this spark is exposed to fuel vapor, an ignition may result. Laboratory tests have shown that the minimum ignition energy in a voltage spark required to ignite hydrocarbon fuel vapor is 200 microjoules.7 4.8.2.2 Thermal sparks are the result of burning particles emitted by rapid melting and vaporization of conductive materials carrying current through a point contact. Thermal sparks can occur when there is a small contact area between a fastener and the hole material, or between a fastener collar and the underlying structure. Thermal sparks can occur at a point contact between a fuel tube and adjacent structure if the contact point conducts high current. When sealant or caps are used to contain sparks, failures could result in the internal pressures from the heat of thermal sparks that force hot particles past the sealant or cap resulting in sparks in the fuel vapor area. 4.8.2.3 Analyses and tests indicate a small piece of steel wool will ignite a flammable mixture when a transient current of approximately 100 milliamperes (mA) peak is applied to the steel wool.8 7 The 200-microjoule level comes from various sources. The most quoted is from Lewis and von Elbe’s book, Combustion, Flames and Explosions of Gases (Florida: Academic Press, Inc., 1987; (orig. publ. 1938)). It has a set of curves for minimum ignition energy for the various hydrocarbon compounds in jet fuel, and they all have similar minimum ignition energy levels of greater than 200 microjoules. 8 This data was from testing performed by the FAA Technical Center, Report DOT/FAA/AR-TN05/37, Intrinsically Safe Current Limit Study for Aircraft Fuel Tank Electronics. Applicants may conduct testing to substantiate alternate values. ### Page 11 4.8.2.4 Edge glow includes voltage or thermal sparks that occur at the edges of carbon fiber composite material when lightning current and voltage cause breakdown of resin between fibers. Failures of protection features to prevent edge glow should be identified. 4.8.2.5 Fuel vapor ignition due to lightning near fuel vent outlets can result in flame propagation into the fuel system. When lightning attaches near fuel vent outlets, ignition of fuel vapors results in a high-speed pressure wave that can travel through the flame arrestor without sufficient time for the flame arrestor to quench the flame front. The vent outlets should be located outside the lightning direct-attachment zones of the airplane. If the vent outlets are located in lightning direct-attachment zones, flame arrestors have been used to prevent lightning-ignited fuel vapors from propagating into the fuel system. Specific lightning tests and unique design features are typically needed to demonstrate the lightningprotection effectiveness for these installations9. 4.9 Perform a Safety Assessment to Determine Fault Tolerance and Non-Fault Tolerance. 4.9.1 The applicant should perform a safety assessment to determine if the fuel system design provides acceptable fuel system lightning protection based on the design features and potential ignition sources due to failures of the design features identified in the previous steps. The applicant may perform the safety assessment on groups of fuel system design elements and lightning protection features with similar physical and electrical characteristics. For non-fault-tolerant features, an assessment must show, per § 25.954(c), that the sum of the probability of failures from potential ignition sources in combination with the probability of a critical lightning strike and the fuel tank being flammable does not exceed extremely improbable. The applicant should provide its rationale for assigning design elements and lightning protection into groups. 4.9.2 The safety assessment should address all fuel system design elements identified in paragraph 4.3 of this AC, the lightning environment at the locations for those elements identified in paragraphs 4.4 and 4.5 of this AC, and the failures identified in paragraph 4.7 of this AC. The applicant should also use the safety assessment to identify where analyses or tests are necessary to demonstrate prevention of fuel systems ignition sources. 4.9.3 The applicant should use a rigorous and structured safety assessment approach. The structured safety assessment and associated fault-tolerance assessment and test reports should be part of the substantiating data. Failure modes and effects analyses are acceptable structured safety assessment tools, particularly for non-fault tolerant lightning protection features. All failure modes and effects analyses (FMEAs) and fault tree analyses (FTAs) should be included and thoroughly annotated.10 The applicant 9 Lightning effects are not addressed in the fuel tank vent fire protection requirements of § 25.975(a)(7) at amendment 25-143 and the associated AC. 10 The FMEA and FTA techniques are described in SAE ARP4761. ### Page 12 8 should substantiate and document all assumptions used in performing the safety assessment. 4.9.4 The safety assessment should divide all the lightning protection features of the fuel system into the following three categories: 4.9.4.1 Intrinsically Safe Lightning Protection. Some fuel system design elements provide effective lightning protection with no foreseeable failure modes that would render them ineffective. These design elements have no failures or combinations of failures that can result in an ignition source. This can be due to reliable design or to a very low lightning voltage or current in that specific location. The applicant should identify any intrinsically safe fuel system design elements. An example of an intrinsically safe design element would be highly conductive fuel tank skins with sufficient thickness to ensure that lightning attachment to the skin will not result in hot-spot or melt-through ignition sources in the tank. Another example would be a structural element designed with sufficient margin that fatigue cracking is not foreseeable. A third example could be fasteners or joints located in the fuel tank structure where the lightning current density is so low that an ignition source will not result even when failure conditions are present. 4.9.4.2 Fault-Tolerant Lightning Protection. Fuel system design elements that are not intrinsically safe and require design features to provide lightning protection should be designed so that a failure associated with these elements or features will not result in an ignition source. Reliable fault-tolerant lightning ignition source prevention, in combination with fuel tank flammability control required by § 25.981 and the statistics of lightning strikes to airplanes, is acceptable for showing compliance with § 25.954(c). Detailed guidance for showing compliance for reliable fault-tolerant lightning protection is provided in section 5 of this AC. 4.9.4.3 Non-Fault-Tolerant Lightning Protection. Applicants have found it is impractical to provide fault-tolerant features or indication of failures for some failures that occur in airplane structure. Certain fuel system design elements and lightning protection features could have conditions where a single failure of these elements or features results in an ignition source when combined with a critical lightning strike. These fuel system design elements, lightning protection features, and failures require detailed and thorough safety assessment to determine if the fuel system design complies with § 25.954(b). It is likely the airplane fuel system design and lightning protection can have only a very small number of these non-fault-tolerant lightning protection conditions and still show the risk of a catastrophic event is extremely improbable to comply with ### Page 13 9 § 25.954(c). Section 6 of this AC provides more detailed guidance for showing compliance for non-fault-tolerant lightning protection. **5 PROVIDE RELIABLE FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES.** 5.1 Provide Fault-Tolerant Lightning Protection. Fault-tolerant lightning protection for ignition sources on fuel tank structure and systems has been shown to be generally practical and achievable. Compliance with § 25.954(b) for most fuel system elements (equipment, components, and structure) that are not intrinsically safe should be demonstrated by showing that the lightning protection is effective, reliable, and fault-tolerant. 5.2 Demonstrate Effective Fault-Tolerance. 5.2.1 The substantiation process should involve tests or analyses on fuel system design elements and features on which faults are induced. These tests and analyses should address both lightning direct attachment to the fuel system design elements and features and conducted lightning currents on them, as applicable. Where tests are performed, the following steps outline an approach to reduce the number of tests by grouping the design elements and features and associated failures. In each step, the assumptions should be documented. 5.2.2 The test process can be summarized in four steps: 1. Select the test articles that will be used for assessing fault tolerance. A design review may be used to develop groups or classification of fuel system design elements and features. For example, fasteners could be grouped by types of fasteners (such as rivets, bolts, and collars). The groups could be differentiated by materials (such as aluminum, steel, titanium, stainless steel, etc.), or by manufacturing processes (such as interference fit holes, cap seals, insulating laminate plies, material thickness, etc.). 2. Assess faults (including aging, corrosion, wear, manufacturing escapes, and any foreseeable in-service damage) to determine the worst-case failures that could render the fault tolerance ineffective. Determination of worst-case failures should be justified with engineering tests, previous certification tests, analyses, service experience, or published data. 3. Determine the lightning current amplitudes and waveforms in the fuel system design elements and features due to direct lightning attachment and conducted lightning currents, as applicable. The lightning environments were previously identified in the hazard assessment above. 4. Conduct tests using the current amplitudes and waveforms derived from step 3 and the faults defined in step 2 to demonstrate that the design prevents ignition sources when a fault occurs. ### Page 14 5.2.3 Assessment of systems failure conditions generally involves first assessing the result of the failure condition. For example, the loss of a means of electrical bonding at a systems tank penetration may cause higher current or voltage on components located within the fuel tank. The loss of a wire bundle shield or shield termination may also cause higher voltage in the fuel systems. Assessment of these effects may involve analyses, tests, or a combination of test and analysis. Scaling based on relative distances from attachment locations, distances for structural conductors, lengths of systems elements, etc., may all be necessary to establish the worst case threats. 5.2.4 Computational analyses or tests of representative tank sections may be used to determine lightning current and voltage amplitudes and waveforms within the fuel system. The applicant should determine the currents, voltages, and associated waveforms that are expected on each feature or element of the fuel system. Use these current and voltage waveforms for tests on representative fuel system parts, panels, or assemblies. Analyses should be validated by comparisons of analysis results with test results from fuel system configurations that are similar to the fuel system to be certified. The applicant should apply appropriate margins based on the validation results. 5.2.5 The applicant should conduct lightning tests using test articles that acceptably represent relevant aspects of the proposed airplane fuel system features and elements. The test articles should incorporate the identified failures needed to demonstrate fault-tolerant lightning protection. When performing these tests, the configuration of the design and protection features and elements should address the effects of aging, corrosion, wear, manufacturing escapes, and likely damage. The possibility of cascading failure effects on redundant features (e.g., fasteners fracturing and compromising sealant directly or over time) should also be considered as part of the assessment when determining what level of fault insertion testing is needed. Guidance for lightning test methods is provided by AC 20-155A accepted industry documents (e.g., SAE ARP5416). Lightning tests are typically needed to demonstrate that fuel tank vent flame arrestors prevent fuel ignition from propagating into the fuel system if the vent outlets are located in lightning direct-attachment zones. The tests and analyses should be documented as part of the substantiating data. 5.3 Demonstrate Protection Reliability. 5.3.1 The applicant should identify the protection features, and qualitatively establish the reliability, using service experience of similar protection features or other means proposed to, and accepted by, the FAA. For example, the interference fit of a fastener in a hole may be established as a reliable protection feature based on service experience that interference fit fasteners do not loosen appreciably over the life of the airplane. Likewise, dielectric or physical separation of systems from structure may be established as a reliable protection feature provided similar dielectric material or support installations that have been shown in service or by tests to perform their function adequately for the life of the airplane. Where the reliability of a fault-tolerant feature cannot be established to typically exceed the life of the airplane, then the appropriate replacement time, inspection interval, and related inspection and test procedure must be included in the Airworthiness Limitations section of ICA to ensure the protection ### Page 15 11 effectiveness, in accordance with § 25.954(d). Airworthiness Limitation requirements are discussed in section 7 of this AC. 5.3.2 The applicant should address failures that can occur in service due to aging and wear, and failures that can escape the manufacturing processes. For example, anticipated escapes should include past manufacturing escapes. Any process changes that are implemented to preclude a specific type of escape may be considered if they preclude future escapes. The applicant should consider training to ensure manufacturing process compliance, implement designs that preclude escapes, automate reliable and repeatable drilling and assembly, and monitor process errors. 5.4 Demonstrate Compliance with the “Extremely Improbable” Requirement. 5.4.1 The characteristics of lightning, frequency of airplane lightning strikes, and fuel tank flammability exposure are factors that affect the likelihood of lightning causing a catastrophic fuel vapor ignition. Section 25.981(b) limits the fuel tank fleet average flammability exposure to three percent of the flammability exposure evaluation time, or that of a conventional unheated aluminum wing tank. The worldwide transport airplane lightning strike rate is on the order of once in several thousand flight hours. 5.4.2 Standard lightning waveforms in SAE standards (accepted as a means of compliance in AC 20-155A) are based on the combinations of severe lightning characteristics using current amplitude, energy, rise time, and pulse repetition that conservatively exceed the majority of recorded values. Most airplane lightning strikes have significantly lower current amplitude, duration, energy transfer, rise time, and pulse repetition than the severe characteristics in SAE ARP5412. This reduces the likelihood of a lightningrelated ignition source even when the fuel system lightning protection effectiveness has degraded from what is demonstrated using standard lightning waveforms in SAE ARP5412. 5.4.3 The simultaneous occurrence of a lightning strike attaching to, or conducting currents through, the fuel system during flammable conditions, at a sufficiently severe level represented by the test levels of SAE ARP5412, is remote by itself. As defined under paragraph 6.f, Probability Terms, of AC 25-19A, Certification Maintenance Requirements, dated October, 3, 2011, remote failure conditions are those “[u]nlikely to occur to each airplane during its total life but may occur several times when considering the total operational life of a number of airplanes of that type.” 5.4.4 If shown to be effective and reliable, fault-tolerant lightning protection complies with § 25.954(c) without further analyzing the probability of the failures, taking into account the remote probability of the environmental conditions discussed above. The applicant should show fault-tolerant lightning protection features are designed and installed to be effective over their life or the life of the airplane or with appropriate inspections and maintenance. Lightning protection features and elements that have shown reliability in service by adequate documented service history data on previous similar designs may be incorporated into the fault-tolerant design. ### Page 16 **12 6 ASSESS NON-FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES.** 6.1 Overview. 6.1.1 Fuel system configurations and failure conditions that result in non-fault-tolerant ignition sources should be minimized and precluded where practical. If the design is identified to be non-fault-tolerant, the design should be re-evaluated to determine whether practical measures could be implemented to make it fault-tolerant. Wherever practical, fault-tolerant design protection features and elements should be implemented and assessed. “Practicality” is defined as a balance of available means, economic viability, and proportional benefit to safety. A means to provide fault tolerance that is possible with little economic impact is practical even if an event is not anticipated to occur in the life of an airplane without it. If the applicant determines that fault-tolerant ignition source prevention is impractical for a specific design feature or failure, the applicant should review this determination of impracticality for concurrence with the FAA. 6.1.2 For design features and elements that have failures where fault-tolerant ignition source prevention is impractical, the applicant should assess these non-fault-tolerant design features and elements to demonstrate that, taken together, the likelihood of a catastrophic fuel vapor ignition resulting from a lightning strike and flammable fuel tank conditions is extremely improbable. To successfully demonstrate this, it will likely be necessary to show the occurrence of such a fault is extremely remote and limited to a very small number of design features and elements. To support the results of the assessment, maintenance considerations have to be identified in order to maintain the airplane in this state during the life of the airplane. Analysis and similarity can be used, but similarity should include similarity of the design, similarity of the current density at the design feature, and similarity of the production and maintenance conditions. Agreement with the authorities on the use of similarity should be achieved before this approach is used. In many instances a specific manufacturer’s limited experience may not be representative of overall transport fleet experience. 6.1.2.1 See paragraph C.1 of this AC for examples of design elements or features where providing fault-tolerant lightning ignition source prevention should be practical. 6.1.2.2 See paragraph C.2 of this AC for examples of design features or failures where providing fault-tolerant lightning ignition source prevention could be impractical. 6.1.2.3 See paragraph C.3 of this AC for examples of design, manufacturing, and maintenance processes that may be useful in establishing compliance. 6.1.3 Applicants should identify all potential non-fault-tolerant design and protection features early in their design process. All practical measures to provide intrinsically safe ### Page 17 13 protection and fault-tolerant ignition source prevention should be incorporated, which is more easily accomplished early in the design process. 6.1.4 Applicants should establish the probabilities of the flammable conditions within the fuel system where non-fault-tolerant features are present. 6.1.5 Once the probabilities of flammable conditions and the probabilities of critical lightning strikes occurring within the fuel system are defined, an evaluation of the potential for the occurrence of a structural discrepancy within the fuel system can be performed. When the probability of lightning attachment to certain regions of the airplane is included in the compliance approach, applicants should use data from similar airplane configurations to substantiate any assumed strike attachment rate. 6.1.6 Regardless of whether it is practical to provide fault-tolerant fuel system lightning ignition source prevention, compliance must demonstrate that the combined risk of catastrophic fuel vapor ignition due to lightning is extremely improbable. The assessment can be a qualitative analysis, a quantitative analysis, or a combination of both. The applicant should use the method that is most appropriate for the specific design. Where the protection means are reliable, the potential failure modes are rare, and limited service data is available to accurately determine failure rates, a qualitative assessment is most appropriate. If failure rates are available and a numerical assessment could be reasonably accurate, a quantitative assessment may be appropriate. If the potential failures are so common that rates are well established, it is unlikely that a nonfault-tolerant design could be shown compliant without frequent maintenance checks. Combinations of failures where one failure also causes a second failure to occur should be considered as a single failure condition (i.e., a common cause or cascading failure). Combinations of independent failure modes that are expected to occur need to be considered. 6.2 Qualitative Assessment of Non-Fault-Tolerant Conditions. 6.2.1 The qualitative assessment must demonstrate that fuel vapor ignition due to lightning is extremely improbable, including the contribution of non-fault-tolerant features and elements. One means of assessing the risk of a catastrophic event due to failures of nonfault-tolerant features is to demonstrate that potential ignition sources due to failure conditions are also remote for designs where fault-tolerant protection features are impractical. 6.2.2 Remote failure conditions, as defined in paragraph 6.f(1)(a) of AC 25-19A, are those unlikely to occur to each airplane during its total life, but may occur several times when considering the total operational life of a number of airplanes of that type. 6.2.3 The qualitative assessment should account for the design features to limit failures, the conditions necessary for a failure to result in an ignition source, and any means used to limit the occurrence or latency of a failure. The applicant should evaluate the design’s ability to safely conduct the lightning current densities and to prevent the lightning current flow. ### Page 18 6.2.4 A qualitative non-fault-tolerance assessment should show that combinations of service conditions, such as vibration, humidity, temperature change, and maintenance activity, cannot produce an ignition source when exposed to voltages or currents resulting from lightning strikes to the airplane. 6.2.5 The following paragraphs (6.2.5.1 through 6.2.5.4 of this AC) identify the areas that should be addressed for structural discrepancies within a fuel system. 6.2.5.1 Evaluation of non-fault tolerance should include consideration of structural discrepancies resulting from overstress, aging, fatigue, wear, manufacturing defects, and accidental and environmental damage. Damage includes conditions that could be reasonably anticipated to occur in the life of an individual airplane due to operation and scheduled and unscheduled maintenance. In addition, probable manufacturing escapes in the production process should be considered as probable failures. 6.2.5.2 The determination of the potential for a non-fault-tolerant condition resulting in a lightning-related ignition source should be based on appropriate assessments. The objective of these assessments is to demonstrate that, for the combination of all discrepant conditions in a fuel tank vapor zone (i.e., ullage), the exposure time of the non-fault-tolerant feature to a lightning-induced electrical current density of sufficient magnitude to become an ignition source will be minimized to such a degree that catastrophic failure due to a lightning strike is not anticipated during the entire operational life of all airplanes of that type. In performing the assessments to determine the potential for a non-faulttolerant condition to result in a lightning-related fuel vapor ignition, the following factors should be collectively considered, addressed, and documented: 6.2.5.2.1 Analysis of the electrical current densities within the fuel tank structure considering its material properties and configuration; 6.2.5.2.2 Analysis and test data necessary to support the likelihood of occurrence of a critical lightning strike at a particular location on the airplane where a discrepancy exists; 6.2.5.2.3 Analysis and test data necessary to support any conclusion that the electrical current density generated by a lightning strike in the specific vicinity of a structural crack or broken fastener in the fuel tank will not be of sufficient amplitude to cause sparking; 6.2.5.2.4 Analysis and test data necessary to support the likelihood of the fuel tank being flammable; and 6.2.5.2.5 Evaluation of fuel tank structure in all areas of the fuel tank that may be susceptible to a fuel vapor condition and at electrical current densities that ### Page 19 15 can result in a lightning-related ignition. This should include assessing the structure’s: 1. Susceptibility to failure (such as cracking, delamination, fastener failure, failed fastener cap seals, failed sealant, etc.); 2. Inspectability (determining if discrepant structure could be reliably inspected such that the exposure time of the failure to a critical lightning strike will be reduced to a level that supports the safety objective); 3. Service data (reports of failed structure such as cracks, delamination, failed fasteners, failed fastener cap seals, or sealant that could become an ignition source); 4. Maintenance inspection programs (determining if inspections will reliably detect failures and discrepancies such that their exposure time will be reduced to a level that supports the safety objective). This includes mandated inspections (e.g., Airworthiness Limitations section of the ICA required by section H25.4 of appendix H to part 25 and § 25.1529); and 5. Fatigue and damage tolerance evaluation of crack initiation/propagation rate, crack characteristics (e.g., crack width versus crack length or edge crack versus crack at or near a fastener hole), detectable crack size, probability of detection, inspection threshold, and inspection interval. 6.2.5.3 See appendix C of this AC for an example of an assessment process addressing the potential for fuel tank structural cracking. 6.2.5.4 The qualitative assessment should consider any means used to ensure the combination of faults will be remote. However, it cannot include the likelihood of lightning attaching to the airplane, or the flammability of the fuel tanks. 6.2.5.5 Figure 1 of this AC provides a guide to the qualitative assessment process. Each of the activities in the qualitative assessment process, shown in figure 1, is discussed in the paragraphs that follow. ### Page 20 16 Figure 1. Assessing the Combined Risk of All Non-Fault-Tolerant Failures Conduct non-fault-tolerant assessment (1) Determine non-fault-tolerant design features or elements (2) Determine the probability of failure for the features (3) Determine the threshold where lightning current results in ignition sources (4) Evaluate measures to prevent failures and limit latency (5) Combination of non-faulttolerant failures resulting in potential ignition sources remote? Implement corrective measures Compliance verified No Yes ### Page 21 6.2.5.6 Figure 1, Item (1). The first step is to determine whether there are design features or elements that do not provide fault-tolerant lightning protection, as described in paragraph 4.9.4.3. 6.2.5.6.1 When a failure is considered possible, qualitatively assess with supporting test data and fleet experience to determine whether the condition is likely to occur in the life of the airplane fleet. This supporting data may include:  Lightning testing relevant to specific or similar design features (see paragraph 4.3 of this AC);  Dielectric strength testing of insulating materials and structures such as brackets, clamp cushions, air gaps, and wire harness insulation;  Field service reports or databases related to the non-fault-tolerant condition being assessed;  Engineering tests to determine durability of features, such as fatigue tests, thermal cycling tests, or corrosion tests;  Fleet experience may also be used to estimate the likelihood of failures. The determinations should be based on conservative assumptions;  Service experience records of manufacturing or maintenance escapes, if available; and  Manufacturing records for defects found. 6.2.5.6.2 It may be possible to demonstrate that a design feature or element will perform similarly to a previously certificated design or design feature under foreseeable lightning threats. If applicable, provide a comparative analysis of similar design features and details on a previously certificated airplane. The comparative analysis would include a detailed assessment of the design features and details that affect susceptibility to failure, exposure time to lightning environment, service experience, and any applicable analyses and test data. 6.2.5.7 Figure 1, Item (2). Assess the probability for the failure condition to occur. If this failure is latent for a long time, or the failure could occur at many locations that are exposed to conducted lightning currents, the likelihood of that failure resulting in an ignition source could be significant. 6.2.5.8 Figure 1, Item (3). Evaluate the likelihood of lightning attaching in the vicinity of non-faulttolerant features and resulting in current of sufficient amplitude to cause an ignition source at those features. Appropriate factors to consider include: ### Page 22 1. The possibility of lightning attachment to locations on the surface of the airplane near the failed non-fault-tolerant features. 2. The lightning-related ignition source threshold current for the failed non-fault-tolerant features. This is the lightning current amplitude that would result in an ignition source at the failed non-fault-tolerant feature. 3. The amplitude of lightning current that would be necessary to produce conducted current that would exceed the ignition source threshold. 6.2.5.8.1 Failed features within fuel systems will usually tolerate some lightning current without producing an ignition source. Above this threshold an ignition source can occur. The lightning current amplitude, charge transfer, and action integral that result in an ignition source can be determined by tests on parts and panels that incorporate the structural features in a defined fault condition. 6.2.5.9 Figure 1, Item (4). Consider any factors that may be used to ensure the integrity of the installations. A specified inspection interval can be proposed to detect the failure. Additional manufacturing controls may be implemented to minimize the occurrence of defects and escapes during production. 6.2.5.10 Figure 1, Item (5). The qualitative assessment should consider all the potential non-faulttolerant features and determine if the combination of potential for ignition sources due to failures of these features is remote. Broken fasteners and structural cracks are two failures where the applicant may find it impractical to demonstrate fault-tolerant protection. The applicant is responsible for demonstrating that ignition sources created by the combination of a non-fault-tolerant failure, a flammable environment, and a lightning strike of sufficient amplitude to result in an ignition source will be extremely improbable. 6.3 Quantitative Assessment of Non-Fault-Tolerant Conditions. 6.3.1 Quantitative assessment of non-fault-tolerant features can be used. The quantitative assessment must demonstrate that fuel vapor ignition due to lightning is extremely improbable, including the contribution of non-fault-tolerant features and elements. However, to do this, there must be a reasonable amount of reliable data for the rate of failures. 6.3.2 The following four conditions should be evaluated collectively: 1. Probability of the occurrence of a flammable condition within a fuel tank in the vicinity of an ignition source due to lightning. ### Page 23 2. Probability of the occurrence of a lightning strike of sufficient intensity to produce an ignition source at a failed non-fault-tolerant design feature. 3. Potential for the presence of a failure of a non-fault-tolerant protection feature within a fuel system. 4. The total number of non-fault-tolerant features. 6.3.3 The same factors for a qualitative assessment should be considered for the quantitative assessment approach. The additional step is to quantify each of these factors for use in the numerical assessment. A fault tree analysis (discussed in paragraph 4.9.3 of this AC) may be used to determine if the combined risk of the non-fault-tolerant conditions are unlikely to result in a catastrophic event over the life of the fleet. From a numerical perspective, a probability on the order of 10-9 per flight hour or less is the accepted standard for demonstrating that the combined risk, including all failures, is extremely improbable. 6.4 Evaluating Non-Fault-Tolerance for Systems. Fuel, mechanical, hydraulic, and electrical components that penetrate, are located within, or are connected to the fuel tanks have typically been able to provide faulttolerant design capability. These components include associated clamps, shields, supports, bonding straps, and connectors. Existing airplane certification programs have demonstrated that fault-tolerant lightning ignition source prevention for the fuel system is achievable and practical except for very specific structural features and elements and associated failures. The absence of specific impracticality examples regarding fuel, mechanical, hydraulic, and electrical components places a particular burden on the applicant to demonstrate that it is impractical to provide fault-tolerant system protection for these elements and features. This means that it is unlikely the FAA would find nonfault-tolerant lightning protection features for fuel, mechanical, hydraulic, and electrical components compliant with § 25.954(b). **7 ESTABLISH AIRWORTHINESS LIMITATIONS.** Part 25, appendix H, section H25.4, Airworthiness Limitations section, requires mandatory replacement times, inspection intervals, and related inspection and test procedures for lightning protection features that are approved under § 25.954. Section H25.4(a)(5) requires CDCCLs, inspections and tests, and mandatory replacement times be located in a section of the ICA titled “Airworthiness Limitation.” 7.1 Critical Design Configuration Control Limitations. 7.1.1 The applicant must establish CDCCLs to protect features that prevent lightning-related ignition sources within the fuel systems. The preamble of the NPRM for § 25.954 explains the FAA’s reasons for requiring CDCCLs. The reasons for this requirement in the final § 25.954, at amendment 25-**, remains the same. The NPRM preamble states: This proposed new paragraph will require applicants to identify the lightning protection design features, as well as to prepare instructions on how to ### Page 24 20 protect those features. Identification of a feature refers to listing the feature in the CDCCL. The FAA has determined that during airplane operations, modifications, and unrelated maintenance actions, these features can be unintentionally damaged or inappropriately repaired or altered. Instructions on protection are meant to address this safety concern. An example of a common design feature to prevent ignition sources caused by wiring is wire separation so that wires cannot chafe against one another or to structure or other components. An example of an instruction on how to protect this design feature would be “When performing maintenance or alterations in the vicinity of these wires, ensure a minimum of 6 inch wire separation is maintained.” 7.1.2 CDCCLs are essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the type design of the fuel tank system. CDCCLs should include information regarding how to prevent compromising critical design features, or restore them when other maintenance or alterations are being performed. The CDCCLs should be established based on evaluating design specific critical features that are determined from the safety analysis and a determination of anticipated maintenance, alteration, or repair errors that could compromise the feature. The following list of examples of CDCCLs is intended to provide examples of lightning protection features that have been identified in certain designs and is not intended to be inclusive of all features that should be considered for a particular design. It is likely that the safety analysis will identify the need for additional CDCCLs. 7.1.2.1 Fuel tank structural fasteners can be potential lightning ignition sources. Specific fastener design features such as fastener material, coating, and countersink depth are typically needed to prevent lightning ignition sources at the fasteners. Installation processes such as fastener hole clearance, fastener pull-up, and hole angularity can be critical. The orientation of the fastener head in the fuel tank structure can be critical. The criticality for fuel tank structural fasteners may be dependent on their location, particularly those located in direct lightning attachment zones. The CDCCLs should identify these critical fastener features and referring to the structural repair manual (SRM) for approved fastener lists and approved installation processes for these fasteners. 7.1.2.2 Fuel tube electrical isolation segments can be used to limit induced lightning current on the fuel tubes, especially on airplanes with carbon fiber composite fuel tank structure. Maintenance, alterations, or repairs of the fuel tube system should maintain the lightning current limits provided by the fuel tube isolation segments. A limitation may specify that the fuel tube isolation segments are required for lightning protection, replacements must also meet the electrical isolation requirements of the original design, and electrical bonding straps must not bridge the isolation segments. 7.1.2.3 Fuel tank access doors have the potential for lightning-related sparking inside the tank as a result of a direct lightning strike or conducted lightning current. The doors may incorporate specific protection features ### Page 25 21 such as electrically conductive gaskets, electrically insulating seals, and multiple fasteners. The limitation may specify that the presence and integrity of the gaskets, seals and fasteners be verified when the access doors are installed. Electrical bonding measurements may be required to verify that the electrical resistance between the access door and adjacent structure is less than a specified value. 7.1.2.4 Sealant can provide caps over fasteners or fillet seals applied where structural parts are joined within the fuel tank. Poor sealant adhesion or sealant damage could degrade lightning ignition source protection. The limitation may specify that the integrity of the sealant must be verified in areas of the fuel system where maintenance or alterations take place. Cracked, peeling, or missing sealant could indicate that the protection integrity is compromised. 7.1.2.5 The minimum spacing between metal fuel tubes, hydraulic tubes, and conduits and adjacent structure may be specified to prevent lightningrelated arcing. In addition, electrically insulating bushings or grommets may be installed to prevent lightning-related arcing between fuel system components and structure. The limitation may specify that the presence and integrity of the bushings or grommets must be verified in areas of the fuel system where maintenance or alterations take place; and the minimum clearance between fuel tubes, hydraulic tubes, or conduits and adjacent structure or components must be verified in areas where maintenance or alterations take place. 7.1.2.6 Fittings for metal hydraulic tubes, nitrogen inerting tubes, and fuel tubes may be installed through the fuel tank walls. These fittings must conduct induced-lightning currents and prevent voltage or thermal sparks within the tank between the fittings and the fuel tank structure. The limitation may require verifying that the electrical bonding resistance does not exceed a specified value if the fittings are repaired, reinstalled, or altered; and the integrity and electrical bonding resistance of any required bonding straps must be verified as well. 7.1.2.7 Applicants have incorporated self-bonding couplings that rely on physical contact between the coupling and fuel tubes to provide electrical bonding. Anodized coatings applied to the fuel tubes could degrade the electrical bonding. The coatings used on the tubes and couplings could be identified as a CDCCL to maintain acceptable electrical bonding. 7.1.2.8 Fuel quantity sensing probes and in-tank wiring may require electrical isolation from adjacent fuel tank structure to prevent lightning-related arcing between the probes, wiring, and structure. The isolation may be provided by electrically non-conductive probe clamps, or non-conductive caps on the ends of the probes. The wiring protection may be provided by separation from structure. The limitation may specify that the presence ### Page 26 22 and integrity of the non-conducting clamps or end caps, and wiring separation must be verified in areas of the fuel system where maintenance or alterations take place. 7.1.3 CDCCLs are intended to identify only critical features of a design that must be maintained. A CDCCL has no interval but establishes configuration limitations to protect the critical design feature identified in the CDCCL. CDCCLs can also include requirements to have placards on the airplane with information about critical features. For certain equipment, critical protection may be provided by components. These critical protection features must be identified as CDCCLs and should be listed in the component maintenance manual (CMM) to provide awareness to maintenance and repair facilities. 7.1.4 Although not intended by the introduction of CDCCLs and other fuel system airworthiness limitations in the context of § 25.981, there are also design approval holders (DAHs) that have created certain CDCCLs that include both the critical design feature as well as the tasks associated with maintaining the CDCCLs. Typically these airworthiness limitations require adhering to a specific CMM at a specific revision level when repairing or overhauling fuel system components. In this case, operators are required to adhere to all elements of the CMM specified in the CDCCLs. Any deviations from CMMs specified in the CDCCLs, including using later revisions of those CMMs, must be approved by the responsible Aircraft Certification Service office. The FAA has been working with DAHs to ensure that new design approvals identify only those critical features of components in the CMMs as CDCCLs, instead of identifying the entire CMM as CDCCLs (or other types of airworthiness limitations). 7.2 Mandatory Replacement Times, Inspection Intervals, and Related Inspection and Test Procedures. 7.2.1 To comply with § 25.954(d), mandatory replacement times, inspection intervals, and related inspection and test procedures must be developed for the lightning protection features identified in paragraphs 4.3 and 4.6 of this AC. Mandatory replacement times, inspection intervals, and related inspection and test procedures must be included in the Airworthiness Limitations section of the ICA. 7.2.2 To ensure lightning protection is retained over the service life of the airplane, references to these mandatory replacement times, inspection intervals, and related inspection and test procedures are normally included in the maintenance manuals (e.g., AMM, SRM, SWPM) and service bulletins that provide maintenance personnel with standard practices for continued airworthiness. 7.2.3 When developing maintenance and service inspection techniques, a review of similar airplane designs and their service history should be conducted to focus on areas where past experience has shown there is a potential for affecting lightning protection features. 7.2.4 When developing procedures to remove and reinstall fuel tank access panels, include instructions to maintain or restore the lightning protection features such as sealant, ### Page 27 23 fastener assembly (structural joints), nut plates, bonded parts, insulators, conductive parts, etc. 7.2.5 The applicant should validate the intended maintenance tasks performed in the fuel tank systems and confirm they indeed provide protection and avoidance of damage to the lightning protection features. The applicant should ensure that proper parts and materials are specified in the maintenance tasks. 7.2.6 The lightning design specialist should participate in the determination of the maintenance program necessary for fuel tank lightning protection. 7.2.7 Lightning protection features that are not anticipated to degrade during the life of the airplane and are identified as inherently reliable, do not require mandatory maintenance for compliance with § 25.954(d), but should be identified to the FAA. Integrity of conductive primary structures is an example of such features. A claim that lightning protection features are not anticipated to degrade during the life of the airplane when exposed to the effects of the environment, aging, wear, corrosion, and likely damage must be substantiated and supported by data. 7.2.8 If the protection feature could degrade over the life of the airplane, it must be maintained using approved inspections and procedures consistent with the requirements of § 25.954(d). ### Page 28 Appendix A A-1 Appendix A. Related Documents A.1 FAA REGULATIONS. The following 14 CFR part 25 regulations are referenced in this AC. You can download the full text of these regulations at the U.S. Government Printing Office e-CFR website. Or you can order a paper copy by sending a request to the U.S. Superintendent of Documents, U.S. Government Printing Office, Washington, D.C. 20402-0001; by calling telephone number (202) 512-1800; or by sending a request by fax to (202) 512-2250.  Section 25.571, Damage-tolerance and fatigue evaluation of structure.  Section 25.954, Fuel system lightning protection.  Section 25.981, Fuel tank ignition prevention.  Section 25.975, Fuel tank vents and carburetor vapor vents.  Section 25.1529, Instructions for Continued Airworthiness.  Section 25.1729, Instructions for Continued Airworthiness: EWIS. **A.2 EUROPEAN AVIATION SAFETY AGENCY (EASA) REGULATIONS.** Certification Specifications and Acceptable Means of Compliance for Large Aeroplanes, CS-25. You can get copies of CS-25 from the European Aviation Safety Agency, Postfach 10 12 53, D-50452 Köln, Germany; telephone +49 221 8999 000; fax: +49 221 8999 099; website: http://www.easa.europa.eu/. **A.3 ADVISORY CIRCULARS.** The following FAA ACs are related to the guidance in this AC. The latest version of each AC at the time of publication of this AC is identified below. If any AC is revised after publication of this AC, you should refer to the latest version for guidance, which can be downloaded from the Internet at http://www.faa.gov/regulations_policies/advisory_circulars/.  AC 20-53C, Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Caused by Lightning, dated September 24, 2018  AC 20-155A, Industry Documents to Support Aircraft Lightning Protection Certification, dated July 16, 2013.  AC 21-16G, RTCA Document DO-160 Versions D, E, F, and G, “Environmental Conditions and Test Procedures for Airborne Equipment”, dated June 22, 2011.  AC 25-19A, Certification Maintenance Requirements, dated October, 3, 2011.  AC 25.1309-1A, System Design and Analysis, dated June 21, 1988.  AC 121-22C, Maintenance Review Boards, Maintenance Type Boards, and OEM/TCH Recommended Maintenance Procedures, dated August 27, 2012. ### Page 29 Appendix A A-2 A.4 REPORTS. The following FAA reports are referenced in this AC:  Report No. DOT/FAA/AR-05/8, Fuel Tank Flammability Assessment Method User’s Manual, dated May 2008. This report can be downloaded from the Internet at http://www.fire.tc.faa.gov/pdf/05-8.pdf.  Report No. DOT/FAA/AR-TN05/37, Intrinsically Safe Current Limit Study for Aircraft Fuel Tank Electronics, dated October 2005. This report can be downloaded from the Internet at http://www.fire.tc.faa.gov/pdf/TN05-37.pdf.  Large Airplane Fuel System Lightning Protection Aviation Rulemaking Committee (ARC) Report, Large Airplane Fuel System Lightning Protection Rulemaking Recommendations, dated May 2011. This report can be downloaded from the Internet at https://www.faa.gov/regulations_policies/rulemaking/committees/documents/media/ LAFSLPARC-8202009.pdf. **A.5 A4A DOCUMENTS.** ATA MSG-3: Operator/Manufacturer Scheduled Maintenance Development, VOLUME 1 – FIXED WING AIRCRAFT. You can order copies of this document from A4A, 1301 Pennsylvania Avenue NW, Suite 1100, Washington, DC 20004; telephone: 202-626-4062; website: http://airlines.org/. **A.6 EUROPEAN ORGANIZATION FOR CIVIL AVIATION EQUIPMENT (EUROCAE) DOCUMENTS.** You can order copies of the following documents from EUROCAE, 102 rue Etienne Dolet, 92240 Malakoff, France; telephone: +33 1 40 92 79 30; fax: +33 1 46 55 62 65; website: http://www.eurocae.net.  EUROCAE ED-14, Environmental Conditions and Test Procedures for Airborne Equipment. You should use revision E or later. This document is technically equivalent to RTCA/DO-160.  EUROCAE ED-107A, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment, July 2010. ED-107A and SAE ARP5583A are technically equivalent. **A.7 RTCA DOCUMENTS.** RTCA/DO-160E, Environmental Conditions and Test Procedures for Airborne Equipment. You should use revision E or later. You can order copies from RTCA, Inc., 1150 18th Street NW, Suite 910, Washington, DC 20036; telephone: 202-833-9339 or fax: 202-833-9434. You can also order copies online at http:/www.rtca.org. This document is technically equivalent to EUROCAE ED-14. ### Page 30 Appendix A A-3 A.8 SAE INTERNATIONAL DOCUMENTS. You can order copies of the following documents from SAE World Headquarters, 400 Commonwealth Drive, Warrendale, Pennsylvania 15096-0001; telephone: 724-776-4970; fax: 724-776-0790; website: http://www.sae.org.  SAE ARP4754A, Guidelines for Development of Civil Aircraft and Systems, December 2010.  SAE ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, December 1996.  SAE ARP5412, Aircraft Lightning Environment and Related Test Waveforms, revision B, January 2013.  SAE ARP5414, Aircraft Lightning Zones, revision A, September 2012.  SAE ARP5416A, Aircraft Lightning Test Methods, January 7, 2013.  SAE ARP5583A, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment, June 4, 2010. ### Page 31 Appendix B B-1 Appendix B. Definitions The following definitions apply to lightning protection of fuel tanks and systems of § 25.954 and the guidance in this AC. **B.1 ATTACHMENT POINT.** A point where the lightning flash contacts the airplane. **B.2 CONTINUED SAFE FLIGHT AND LANDING.** The airplane can safely abort or continue a takeoff, or continue controlled flight and landing, possibly using emergency procedures. The airplane must do this without requiring exceptional pilot skill or strength. Some airplane damage may occur because of the failure condition or on landing. The pilot must be able to land the airplane safely at a suitable airport. **B.3 CRITICAL DESIGN CONFIGURATION CONTROL LIMITATIONS (CDCCLS).** A limitation requirement to preserve a critical design feature of a fuel system that is necessary for the design to meet the performance standards of § 25.954 (and/or § 25.981) throughout the life of the airplane model. The purpose of the CDCCL is to provide instructions to retain the critical features during configuration changes that may be caused by alterations, repairs, or maintenance actions. **B.4 CRITICAL LIGHTNING STRIKE.** As defined by § 25.954(a)(1), a critical lightning strike is a lightning strike that attaches to the airplane in a location that, when combined with the failure of any design feature or structure, could create an ignition source. **B.5 ESCAPES.** Production or maintenance errors that can be anticipated to occur that could render the fault tolerance, or lightning protection ineffective. **B.6 EXTREMELY IMPROBABLE FAILURE CONDITION.** When using qualitative analysis, an extremely improbable failure condition is a failure condition that is so unlikely that it is not anticipated to occur during the entire operational life of all airplanes of one type. When using quantitative analysis, an extremely improbable failure condition is one having a probability of failure of 1 X 10-9 or less. ### Page 32 Appendix B B-2 B.7 FAULT-TOLERANT DESIGN. A design that precludes fuel systems ignition sources even when a fault is present. **B.8 FUEL SYSTEMS.** As defined by § 25.954(a)(2) a fuel system includes any component within either the fuel tank structure or the fuel tank systems and any airplane structure or system components that penetrate, connect to, or are located within a fuel tank. **B.9 FUEL TANK STRUCTURE.** Includes structural members of the fuel tank such as airplane skins, access panels, joints, ribs, spars, stringers, and associated fasteners, brackets, coatings and sealant. **B.10 FUEL TANK SYSTEMS.** Tubing, components, and wiring that are penetrating, located within, or connected to the fuel tanks. **B.11 INTRINSICALLY SAFE.** Fuel system design elements that provide effective lightning protection with no foreseeable failure modes that would render them ineffective. These design elements have no failures or combinations of failures that can result in an ignition source. This can be due to reliable design or to a very low lightning voltage or current in that specific location. **B.12 LIGHTNING FLASH.** The total lightning event. It may occur in a cloud, among clouds, or between a cloud and the ground. It can consist of one or more return strokes, plus intermediate or continuing currents. **B.13 LIGHTNING STRIKE.** Attachment of the lightning flash to the airplane. **B.14 LIGHTNING STRIKE ZONES.** Airplane surface areas and structures that are susceptible to lightning attachment, dwell time, and current conduction. See AC 20-155A, which references documents that provide additional guidance on airplane lightning zoning. ### Page 33 Appendix B B-3 B.15 LIGHTNING STROKE (RETURN STROKE). A lightning current surge that occurs when the lightning leader (the initial current charge) makes contact with the ground or another charge center. A charge center is an area of high potential of opposite charge. **B.16 PRACTICALITY.** A balance of available means, economic viability, and proportional benefit to safety. **B.17 RELIABLE DESIGN.** A reliable design is a design that provide lightning protection features that are not anticipated to degrade during the life of the airplane. **B.18 RELIABLE FAULT TOLERANCE.** A fault-tolerant fuel system design is a design that precludes ignition sources in the fuel system even when a fault is present; “reliable” means the ability to maintain the effectiveness of the protection features over the service life of the individual airplane. **B.19 REMOTE.** Those conditions that are unlikely to occur to each airplane during its total life, but which may occur several times when considering the total operational life of a number of airplanes of the type. **B.20 SYSTEMS.** Systems include fuel, mechanical, hydraulic, electrical, and electrical wiring interconnection system (EWIS) components that penetrate, are located within, or connected to the fuel tanks. ### Page 34 Appendix C C-1 Appendix C. Section 6 Examples C.1 EXAMPLES FOR PARAGRAPH 6.1.2.1 OF THIS AC. Design elements or features where providing fault-tolerant lightning ignition source prevention should be practical include: 1. Installation of rivets and bolts in aluminum structure that are well bonded through processes that ensure fastener/hole fit, fastener and hole quality, and installation practices 2. Installation of bolts in composite structure that are well bonded through processes that ensure control of fastener/hole fit, fastener and hole quality, and installation practices and with additional design features to distribute current, such as foil or mesh at the material surface. 3. Installation of lightning protective sealant or cap seals over fastener heads/ends located inside fuel tanks, where necessary. **C.2 EXAMPLES FOR PARAGRAPH 6.1.2.2 OF THIS AC.** Design features or failures where providing fault-tolerant lightning ignition source prevention could be impractical include: 1. Fatigue cracking within structural elements such as spars, skins, stringers, and ribs. Typically, material controls, manufacturing controls, established material allowables, design margins, and life-cycle tests make the occurrence of significant cracking rare. 2. Failure of fasteners highly loaded in tension that leads to separation of the fastener or part of the fastener from the hole, or gapping of the fastener head or nut, and consequent failure of a cap seal. Typically, manufacturing controls, design margins, and life-cycle tests make the occurrence of broken bolts rare. 3. Installation of double cap seals or structurally reinforced cap seals to retain a bolt that fails under tension, resulting in cascading failure of the cap seals. 4. Preventing damage that may go undetected by scheduled or directed field inspection and manufacturing defects for composite structure (category 1 damage in AC 20-107B). **C.3 EXAMPLES FOR PARAGRAPH 6.1.2.3 OF THIS AC.** Examples of practical design, manufacturing, and maintenance processes are listed below. Although these practices themselves are not considered to be independent features for providing fault tolerance, they are measures to minimize the likelihood of failures or measures necessary to support assumptions about failure modes or rates in a safety analysis. ### Page 35 Appendix C C-2 1. A structured design review process (as described in this AC) to ensure that all relevant design features are reviewed to identify critical design areas, critical processes, and associated testing and analysis requirements. 2. Engineering review of the proposed design to identify failure modes that may occur because of manufacturing errors or escapes, maintenance errors, repairs or alterations, aging, wear, corrosion, or likely damage. 3. Engineering review of manufacturing processes to identify failure modes that may occur because of manufacturing errors or escapes. 4. Engineering review of service history records to identify failure modes that may occur because of production escapes, maintenance errors, repairs or alterations, aging, wear, corrosion, or likely damage. 5. Implementation of practical manufacturing and quality control processes to address the issues identified through the required engineering reviews. 6. For non-fault-tolerant location, quality control processes that require inspection of critical features by a person other than the person that performed the manufacturing work. 7. Provisions in the ICA to identify cautions in maintenance documents regarding lightning protection features, as well as life limits or repetitive inspections for nonfault-tolerant features. For any penetration into the fuel tank, or any structural damage within the fuel tank, the SRM should specify repair methods that maintain lightning protection features. 8. Mandatory maintenance actions necessary to ensure maintained compliance with the lightning protection requirements should be included in the Airworthiness Limitations section of the ICA as required by section H25.4 of appendix H to part 25. **C.4 EXAMPLE FOR PARAGRAPH 6.2.5.3 OF THIS AC.** The following is an example of an assessment process addressing the potential for non-fault-tolerant fuel tank structural cracking. To assess the risk due to non-fault tolerance for structural cracks, the following should be accomplished: C.4.1 Determine if the structure in this zone is susceptible to fatigue cracking. If it is susceptible to fatigue cracking, determine the minimum size of crack that could be a source for arcing. This crack length should then be compared to the inspection methods used for compliance with § 25.571 (Damage Tolerance), to determine the ability and/or probability of detecting a crack of this size. C.4.2 If the Airworthiness Limitations required for compliance with § 25.571 already are sufficient to ensure that it is remote (unlikely to occur on each airplane—see AC 25-19A) that a crack will grow to sufficient size and gap in excess of that necessary to cause sparking during a lightning event, then no lightning-related Airworthiness Limitations are required. The probability of this remote condition occurring, together ### Page 36 Appendix C C-3 with the remote probability of a critical lightning strike, make these combinations not foreseeable. C.4.3 As part of the damage tolerance evaluation, an analysis should be performed to determine the duration of time (in flight cycles) it will take for a crack of minimum arcing size to grow to the minimum detectable length. This crack propagation rate should then be used along with the probability of detection for the specified inspection method to determine the exposure time. That is, the number of flight cycles an airplane may be exposed to before an ignition source due to a structural failure (crack, failed fastener, etc.) occurs. C.4.4 If the Airworthiness Limitations necessary to support compliance with § 25.571 cannot ensure the likelihood of a crack in excess of that would cause sparking is remote, and the crack would not be readily detectable within a few flights due to fuel leaks, then this condition must be included in the risk assessment of non-fault-tolerant conditions. Further, any practical maintenance inspection should be made to minimize the exposure time. A low probability combined with low exposure time may be necessary to demonstrate that catastrophic ignition is extremely improbable, i.e., it is not anticipated to occur during the entire operational life of all airplanes of one type. ### Page 37 Appendix D D-1 Appendix D. Advisory Circular Feedback If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to 9-AWA-AVS- AIR-DMO@faa.gov or (2) faxing it to (202) 267-1813. Subject: AC 25.954-1, Transport Airplane Fuel System Lightning Protection Please check all appropriate line items: ☐ An error (procedural or typographical) has been noted in paragraph _______ on page _______. ☐ Recommend paragraph _______ on page _______ be changed as follows: ☐ In a future change to this AC, please cover the following subject: (Briefly describe what you want added.) ☐ Other comments: ☐ I would like to discuss the above. Please contact me. I would like to discuss the above. Please contact me. Submitted by: __________________________________ Date: __________________ Telephone Number: __________________ Email Address: _________________________ --- OpenAirDocs.org is an independent research project of [Contrail Labs](https://contraillabs.com/). It is not affiliated with the FAA or the NTSB. Source documents are U.S. government works in the public domain.