9 § 25.954(c). Section 6 of this AC provides more detailed guidance for showing compliance for non-fault-tolerant lightning protection.
5 PROVIDE RELIABLE FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES.
5.1 Provide Fault-Tolerant Lightning Protection.
Fault-tolerant lightning protection for ignition sources on fuel tank structure and systems has been shown to be generally practical and achievable. Compliance with § 25.954(b) for most fuel system elements (equipment, components, and structure) that are not intrinsically safe should be demonstrated by showing that the lightning protection is effective, reliable, and fault-tolerant.
5.2 Demonstrate Effective Fault-Tolerance.
5.2.1 The substantiation process should involve tests or analyses on fuel system design elements and features on which faults are induced. These tests and analyses should address both lightning direct attachment to the fuel system design elements and features and conducted lightning currents on them, as applicable. Where tests are performed, the following steps outline an approach to reduce the number of tests by grouping the design elements and features and associated failures. In each step, the assumptions should be documented.
5.2.2 The test process can be summarized in four steps:
1. Select the test articles that will be used for assessing fault tolerance. A design review may be used to develop groups or classification of fuel system design elements and features. For example, fasteners could be grouped by types of fasteners (such as rivets, bolts, and collars). The groups could be differentiated by materials (such as aluminum, steel, titanium, stainless steel, etc.), or by manufacturing processes (such as interference fit holes, cap seals, insulating laminate plies, material thickness, etc.).
2. Assess faults (including aging, corrosion, wear, manufacturing escapes, and any foreseeable in-service damage) to determine the worst-case failures that could render the fault tolerance ineffective. Determination of worst-case failures should be justified with engineering tests, previous certification tests, analyses, service experience, or published data.
3. Determine the lightning current amplitudes and waveforms in the fuel system design elements and features due to direct lightning attachment and conducted lightning currents, as applicable. The lightning environments were previously identified in the hazard assessment above.
4. Conduct tests using the current amplitudes and waveforms derived from step 3 and the faults defined in step 2 to demonstrate that the design prevents ignition sources when a fault occurs.
5.2.3 Assessment of systems failure conditions generally involves first assessing the result of the failure condition. For example, the loss of a means of electrical bonding at a systems tank penetration may cause higher current or voltage on components located within the fuel tank. The loss of a wire bundle shield or shield termination may also cause higher voltage in the fuel systems. Assessment of these effects may involve analyses, tests, or a combination of test and analysis. Scaling based on relative distances from attachment locations, distances for structural conductors, lengths of systems elements, etc., may all be necessary to establish the worst case threats.
5.2.4 Computational analyses or tests of representative tank sections may be used to determine lightning current and voltage amplitudes and waveforms within the fuel system. The applicant should determine the currents, voltages, and associated waveforms that are expected on each feature or element of the fuel system. Use these current and voltage waveforms for tests on representative fuel system parts, panels, or assemblies. Analyses should be validated by comparisons of analysis results with test results from fuel system configurations that are similar to the fuel system to be certified.
The applicant should apply appropriate margins based on the validation results.
5.2.5 The applicant should conduct lightning tests using test articles that acceptably represent relevant aspects of the proposed airplane fuel system features and elements. The test articles should incorporate the identified failures needed to demonstrate fault-tolerant lightning protection. When performing these tests, the configuration of the design and protection features and elements should address the effects of aging, corrosion, wear, manufacturing escapes, and likely damage. The possibility of cascading failure effects on redundant features (e.g., fasteners fracturing and compromising sealant directly or over time) should also be considered as part of the assessment when determining what level of fault insertion testing is needed. Guidance for lightning test methods is provided by AC 20-155A accepted industry documents (e.g., SAE ARP5416). Lightning tests are typically needed to demonstrate that fuel tank vent flame arrestors prevent fuel ignition from propagating into the fuel system if the vent outlets are located in lightning direct-attachment zones. The tests and analyses should be documented as part of the substantiating data.
5.3 Demonstrate Protection Reliability.
5.3.1 The applicant should identify the protection features, and qualitatively establish the reliability, using service experience of similar protection features or other means proposed to, and accepted by, the FAA. For example, the interference fit of a fastener in a hole may be established as a reliable protection feature based on service experience that interference fit fasteners do not loosen appreciably over the life of the airplane.
Likewise, dielectric or physical separation of systems from structure may be established as a reliable protection feature provided similar dielectric material or support installations that have been shown in service or by tests to perform their function adequately for the life of the airplane. Where the reliability of a fault-tolerant feature cannot be established to typically exceed the life of the airplane, then the appropriate replacement time, inspection interval, and related inspection and test procedure must be included in the Airworthiness Limitations section of ICA to ensure the protection
11 effectiveness, in accordance with § 25.954(d). Airworthiness Limitation requirements are discussed in section 7 of this AC.
5.3.2 The applicant should address failures that can occur in service due to aging and wear, and failures that can escape the manufacturing processes. For example, anticipated escapes should include past manufacturing escapes. Any process changes that are implemented to preclude a specific type of escape may be considered if they preclude future escapes. The applicant should consider training to ensure manufacturing process compliance, implement designs that preclude escapes, automate reliable and repeatable drilling and assembly, and monitor process errors.
5.4 Demonstrate Compliance with the “Extremely Improbable” Requirement.
5.4.1 The characteristics of lightning, frequency of airplane lightning strikes, and fuel tank flammability exposure are factors that affect the likelihood of lightning causing a catastrophic fuel vapor ignition. Section 25.981(b) limits the fuel tank fleet average flammability exposure to three percent of the flammability exposure evaluation time, or that of a conventional unheated aluminum wing tank. The worldwide transport airplane lightning strike rate is on the order of once in several thousand flight hours.
5.4.2 Standard lightning waveforms in SAE standards (accepted as a means of compliance in AC 20-155A) are based on the combinations of severe lightning characteristics using current amplitude, energy, rise time, and pulse repetition that conservatively exceed the majority of recorded values. Most airplane lightning strikes have significantly lower current amplitude, duration, energy transfer, rise time, and pulse repetition than the severe characteristics in SAE ARP5412. This reduces the likelihood of a lightningrelated ignition source even when the fuel system lightning protection effectiveness has degraded from what is demonstrated using standard lightning waveforms in SAE ARP5412.
5.4.3 The simultaneous occurrence of a lightning strike attaching to, or conducting currents through, the fuel system during flammable conditions, at a sufficiently severe level represented by the test levels of SAE ARP5412, is remote by itself. As defined under paragraph 6.f, Probability Terms, of AC 25-19A, Certification Maintenance Requirements, dated October, 3, 2011, remote failure conditions are those “[u]nlikely to occur to each airplane during its total life but may occur several times when considering the total operational life of a number of airplanes of that type.”
5.4.4 If shown to be effective and reliable, fault-tolerant lightning protection complies with § 25.954(c) without further analyzing the probability of the failures, taking into account the remote probability of the environmental conditions discussed above. The applicant should show fault-tolerant lightning protection features are designed and installed to be effective over their life or the life of the airplane or with appropriate inspections and maintenance. Lightning protection features and elements that have shown reliability in service by adequate documented service history data on previous similar designs may be incorporated into the fault-tolerant design.
12 6 ASSESS NON-FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES.
6.1 Overview.
6.1.1 Fuel system configurations and failure conditions that result in non-fault-tolerant ignition sources should be minimized and precluded where practical. If the design is identified to be non-fault-tolerant, the design should be re-evaluated to determine whether practical measures could be implemented to make it fault-tolerant. Wherever practical, fault-tolerant design protection features and elements should be implemented and assessed. “Practicality” is defined as a balance of available means, economic viability, and proportional benefit to safety. A means to provide fault tolerance that is possible with little economic impact is practical even if an event is not anticipated to occur in the life of an airplane without it. If the applicant determines that fault-tolerant ignition source prevention is impractical for a specific design feature or failure, the applicant should review this determination of impracticality for concurrence with the FAA.
6.1.2 For design features and elements that have failures where fault-tolerant ignition source prevention is impractical, the applicant should assess these non-fault-tolerant design features and elements to demonstrate that, taken together, the likelihood of a catastrophic fuel vapor ignition resulting from a lightning strike and flammable fuel tank conditions is extremely improbable. To successfully demonstrate this, it will likely be necessary to show the occurrence of such a fault is extremely remote and limited to a very small number of design features and elements. To support the results of the assessment, maintenance considerations have to be identified in order to maintain the airplane in this state during the life of the airplane. Analysis and similarity can be used, but similarity should include similarity of the design, similarity of the current density at the design feature, and similarity of the production and maintenance conditions.
Agreement with the authorities on the use of similarity should be achieved before this approach is used. In many instances a specific manufacturer’s limited experience may not be representative of overall transport fleet experience.
6.1.2.1 See paragraph C.1 of this AC for examples of design elements or features where providing fault-tolerant lightning ignition source prevention should be practical.
6.1.2.2 See paragraph C.2 of this AC for examples of design features or failures where providing fault-tolerant lightning ignition source prevention could be impractical.
6.1.2.3 See paragraph C.3 of this AC for examples of design, manufacturing, and maintenance processes that may be useful in establishing compliance.
6.1.3 Applicants should identify all potential non-fault-tolerant design and protection features early in their design process. All practical measures to provide intrinsically safe
13 protection and fault-tolerant ignition source prevention should be incorporated, which is more easily accomplished early in the design process.
6.1.4 Applicants should establish the probabilities of the flammable conditions within the fuel system where non-fault-tolerant features are present.
6.1.5 Once the probabilities of flammable conditions and the probabilities of critical lightning strikes occurring within the fuel system are defined, an evaluation of the potential for the occurrence of a structural discrepancy within the fuel system can be performed.
When the probability of lightning attachment to certain regions of the airplane is included in the compliance approach, applicants should use data from similar airplane configurations to substantiate any assumed strike attachment rate.
6.1.6 Regardless of whether it is practical to provide fault-tolerant fuel system lightning ignition source prevention, compliance must demonstrate that the combined risk of catastrophic fuel vapor ignition due to lightning is extremely improbable. The assessment can be a qualitative analysis, a quantitative analysis, or a combination of both. The applicant should use the method that is most appropriate for the specific design. Where the protection means are reliable, the potential failure modes are rare, and limited service data is available to accurately determine failure rates, a qualitative assessment is most appropriate. If failure rates are available and a numerical assessment could be reasonably accurate, a quantitative assessment may be appropriate. If the potential failures are so common that rates are well established, it is unlikely that a nonfault-tolerant design could be shown compliant without frequent maintenance checks.
Combinations of failures where one failure also causes a second failure to occur should be considered as a single failure condition (i.e., a common cause or cascading failure).
Combinations of independent failure modes that are expected to occur need to be considered.
6.2 Qualitative Assessment of Non-Fault-Tolerant Conditions.
6.2.1 The qualitative assessment must demonstrate that fuel vapor ignition due to lightning is extremely improbable, including the contribution of non-fault-tolerant features and elements. One means of assessing the risk of a catastrophic event due to failures of nonfault-tolerant features is to demonstrate that potential ignition sources due to failure conditions are also remote for designs where fault-tolerant protection features are impractical.
6.2.2 Remote failure conditions, as defined in paragraph 6.f(1)(a) of AC 25-19A, are those unlikely to occur to each airplane during its total life, but may occur several times when considering the total operational life of a number of airplanes of that type.
6.2.3 The qualitative assessment should account for the design features to limit failures, the conditions necessary for a failure to result in an ignition source, and any means used to limit the occurrence or latency of a failure. The applicant should evaluate the design’s ability to safely conduct the lightning current densities and to prevent the lightning current flow.
6.2.4 A qualitative non-fault-tolerance assessment should show that combinations of service conditions, such as vibration, humidity, temperature change, and maintenance activity, cannot produce an ignition source when exposed to voltages or currents resulting from lightning strikes to the airplane.
6.2.5 The following paragraphs (6.2.5.1 through 6.2.5.4 of this AC) identify the areas that should be addressed for structural discrepancies within a fuel system.
6.2.5.1 Evaluation of non-fault tolerance should include consideration of structural discrepancies resulting from overstress, aging, fatigue, wear, manufacturing defects, and accidental and environmental damage.
Damage includes conditions that could be reasonably anticipated to occur in the life of an individual airplane due to operation and scheduled and unscheduled maintenance. In addition, probable manufacturing escapes in the production process should be considered as probable failures.
6.2.5.2 The determination of the potential for a non-fault-tolerant condition resulting in a lightning-related ignition source should be based on appropriate assessments. The objective of these assessments is to demonstrate that, for the combination of all discrepant conditions in a fuel tank vapor zone (i.e., ullage), the exposure time of the non-fault-tolerant feature to a lightning-induced electrical current density of sufficient magnitude to become an ignition source will be minimized to such a degree that catastrophic failure due to a lightning strike is not anticipated during the entire operational life of all airplanes of that type. In performing the assessments to determine the potential for a non-faulttolerant condition to result in a lightning-related fuel vapor ignition, the following factors should be collectively considered, addressed, and documented:
6.2.5.2.1 Analysis of the electrical current densities within the fuel tank structure considering its material properties and configuration;
6.2.5.2.2 Analysis and test data necessary to support the likelihood of occurrence of a critical lightning strike at a particular location on the airplane where a discrepancy exists;
6.2.5.2.3 Analysis and test data necessary to support any conclusion that the electrical current density generated by a lightning strike in the specific vicinity of a structural crack or broken fastener in the fuel tank will not be of sufficient amplitude to cause sparking;
6.2.5.2.4 Analysis and test data necessary to support the likelihood of the fuel tank being flammable; and
6.2.5.2.5 Evaluation of fuel tank structure in all areas of the fuel tank that may be susceptible to a fuel vapor condition and at electrical current densities that
15 can result in a lightning-related ignition. This should include assessing the structure’s:
1. Susceptibility to failure (such as cracking, delamination, fastener failure, failed fastener cap seals, failed sealant, etc.);
2. Inspectability (determining if discrepant structure could be reliably inspected such that the exposure time of the failure to a critical lightning strike will be reduced to a level that supports the safety objective);
3. Service data (reports of failed structure such as cracks, delamination, failed fasteners, failed fastener cap seals, or sealant that could become an ignition source);
4. Maintenance inspection programs (determining if inspections will reliably detect failures and discrepancies such that their exposure time will be reduced to a level that supports the safety objective). This includes mandated inspections (e.g., Airworthiness Limitations section of the ICA required by section H25.4 of appendix H to part 25 and § 25.1529); and
5. Fatigue and damage tolerance evaluation of crack initiation/propagation rate, crack characteristics (e.g., crack width versus crack length or edge crack versus crack at or near a fastener hole), detectable crack size, probability of detection, inspection threshold, and inspection interval.
6.2.5.3 See appendix C of this AC for an example of an assessment process addressing the potential for fuel tank structural cracking.
6.2.5.4 The qualitative assessment should consider any means used to ensure the combination of faults will be remote. However, it cannot include the likelihood of lightning attaching to the airplane, or the flammability of the fuel tanks.
6.2.5.5 Figure 1 of this AC provides a guide to the qualitative assessment process.
Each of the activities in the qualitative assessment process, shown in figure 1, is discussed in the paragraphs that follow.
16 Figure 1. Assessing the Combined Risk of All Non-Fault-Tolerant Failures Conduct non-fault-tolerant assessment
(1) Determine non-fault-tolerant design features or elements
(2) Determine the probability of failure for the features
(3) Determine the threshold where lightning current results in ignition sources
(4) Evaluate measures to prevent failures and limit latency
(5) Combination of non-faulttolerant failures resulting in potential ignition sources remote?
Implement corrective measures Compliance verified No Yes
6.2.5.6 Figure 1, Item (1).
The first step is to determine whether there are design features or elements that do not provide fault-tolerant lightning protection, as described in paragraph 4.9.4.3.
6.2.5.6.1 When a failure is considered possible, qualitatively assess with supporting test data and fleet experience to determine whether the condition is likely to occur in the life of the airplane fleet. This supporting data may include:
Lightning testing relevant to specific or similar design features (see paragraph 4.3 of this AC);
Dielectric strength testing of insulating materials and structures such as brackets, clamp cushions, air gaps, and wire harness insulation;
Field service reports or databases related to the non-fault-tolerant condition being assessed;
Engineering tests to determine durability of features, such as fatigue tests, thermal cycling tests, or corrosion tests;
Fleet experience may also be used to estimate the likelihood of failures. The determinations should be based on conservative assumptions;
Service experience records of manufacturing or maintenance escapes, if available; and Manufacturing records for defects found.
6.2.5.6.2 It may be possible to demonstrate that a design feature or element will perform similarly to a previously certificated design or design feature under foreseeable lightning threats. If applicable, provide a comparative analysis of similar design features and details on a previously certificated airplane. The comparative analysis would include a detailed assessment of the design features and details that affect susceptibility to failure, exposure time to lightning environment, service experience, and any applicable analyses and test data.
6.2.5.7 Figure 1, Item (2).
Assess the probability for the failure condition to occur. If this failure is latent for a long time, or the failure could occur at many locations that are exposed to conducted lightning currents, the likelihood of that failure resulting in an ignition source could be significant.
6.2.5.8 Figure 1, Item (3).
Evaluate the likelihood of lightning attaching in the vicinity of non-faulttolerant features and resulting in current of sufficient amplitude to cause an ignition source at those features. Appropriate factors to consider include:
1. The possibility of lightning attachment to locations on the surface of the airplane near the failed non-fault-tolerant features.
2. The lightning-related ignition source threshold current for the failed non-fault-tolerant features. This is the lightning current amplitude that would result in an ignition source at the failed non-fault-tolerant feature.
3. The amplitude of lightning current that would be necessary to produce conducted current that would exceed the ignition source threshold.
6.2.5.8.1 Failed features within fuel systems will usually tolerate some lightning current without producing an ignition source. Above this threshold an ignition source can occur. The lightning current amplitude, charge transfer, and action integral that result in an ignition source can be determined by tests on parts and panels that incorporate the structural features in a defined fault condition.
6.2.5.9 Figure 1, Item (4).
Consider any factors that may be used to ensure the integrity of the installations. A specified inspection interval can be proposed to detect the failure. Additional manufacturing controls may be implemented to minimize the occurrence of defects and escapes during production.
6.2.5.10 Figure 1, Item (5).
The qualitative assessment should consider all the potential non-faulttolerant features and determine if the combination of potential for ignition sources due to failures of these features is remote. Broken fasteners and structural cracks are two failures where the applicant may find it impractical to demonstrate fault-tolerant protection. The applicant is responsible for demonstrating that ignition sources created by the combination of a non-fault-tolerant failure, a flammable environment, and a lightning strike of sufficient amplitude to result in an ignition source will be extremely improbable.
6.3 Quantitative Assessment of Non-Fault-Tolerant Conditions.
6.3.1 Quantitative assessment of non-fault-tolerant features can be used. The quantitative assessment must demonstrate that fuel vapor ignition due to lightning is extremely improbable, including the contribution of non-fault-tolerant features and elements.
However, to do this, there must be a reasonable amount of reliable data for the rate of failures.
6.3.2 The following four conditions should be evaluated collectively:
1. Probability of the occurrence of a flammable condition within a fuel tank in the vicinity of an ignition source due to lightning.
2. Probability of the occurrence of a lightning strike of sufficient intensity to produce an ignition source at a failed non-fault-tolerant design feature.
3. Potential for the presence of a failure of a non-fault-tolerant protection feature within a fuel system.
4. The total number of non-fault-tolerant features.
6.3.3 The same factors for a qualitative assessment should be considered for the quantitative assessment approach. The additional step is to quantify each of these factors for use in the numerical assessment. A fault tree analysis (discussed in paragraph 4.9.3 of this AC) may be used to determine if the combined risk of the non-fault-tolerant conditions are unlikely to result in a catastrophic event over the life of the fleet. From a numerical perspective, a probability on the order of 10-9 per flight hour or less is the accepted standard for demonstrating that the combined risk, including all failures, is extremely improbable.
6.4 Evaluating Non-Fault-Tolerance for Systems.
Fuel, mechanical, hydraulic, and electrical components that penetrate, are located within, or are connected to the fuel tanks have typically been able to provide faulttolerant design capability. These components include associated clamps, shields, supports, bonding straps, and connectors. Existing airplane certification programs have demonstrated that fault-tolerant lightning ignition source prevention for the fuel system is achievable and practical except for very specific structural features and elements and associated failures. The absence of specific impracticality examples regarding fuel, mechanical, hydraulic, and electrical components places a particular burden on the applicant to demonstrate that it is impractical to provide fault-tolerant system protection for these elements and features. This means that it is unlikely the FAA would find nonfault-tolerant lightning protection features for fuel, mechanical, hydraulic, and electrical components compliant with § 25.954(b).
7 ESTABLISH AIRWORTHINESS LIMITATIONS.
Part 25, appendix H, section H25.4, Airworthiness Limitations section, requires mandatory replacement times, inspection intervals, and related inspection and test procedures for lightning protection features that are approved under § 25.954.
Section H25.4(a)(5) requires CDCCLs, inspections and tests, and mandatory replacement times be located in a section of the ICA titled “Airworthiness Limitation.”
7.1 Critical Design Configuration Control Limitations.
7.1.1 The applicant must establish CDCCLs to protect features that prevent lightning-related ignition sources within the fuel systems. The preamble of the NPRM for § 25.954 explains the FAA’s reasons for requiring CDCCLs. The reasons for this requirement in the final § 25.954, at amendment 25-**, remains the same. The NPRM preamble states:
This proposed new paragraph will require applicants to identify the lightning protection design features, as well as to prepare instructions on how to
20 protect those features. Identification of a feature refers to listing the feature in the CDCCL. The FAA has determined that during airplane operations, modifications, and unrelated maintenance actions, these features can be unintentionally damaged or inappropriately repaired or altered. Instructions on protection are meant to address this safety concern. An example of a common design feature to prevent ignition sources caused by wiring is wire separation so that wires cannot chafe against one another or to structure or other components. An example of an instruction on how to protect this design feature would be “When performing maintenance or alterations in the vicinity of these wires, ensure a minimum of 6 inch wire separation is maintained.”
7.1.2 CDCCLs are essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the type design of the fuel tank system. CDCCLs should include information regarding how to prevent compromising critical design features, or restore them when other maintenance or alterations are being performed.
The CDCCLs should be established based on evaluating design specific critical features that are determined from the safety analysis and a determination of anticipated maintenance, alteration, or repair errors that could compromise the feature. The following list of examples of CDCCLs is intended to provide examples of lightning protection features that have been identified in certain designs and is not intended to be inclusive of all features that should be considered for a particular design. It is likely that the safety analysis will identify the need for additional CDCCLs.
7.1.2.1 Fuel tank structural fasteners can be potential lightning ignition sources.
Specific fastener design features such as fastener material, coating, and countersink depth are typically needed to prevent lightning ignition sources at the fasteners. Installation processes such as fastener hole clearance, fastener pull-up, and hole angularity can be critical. The orientation of the fastener head in the fuel tank structure can be critical.
The criticality for fuel tank structural fasteners may be dependent on their location, particularly those located in direct lightning attachment zones.
The CDCCLs should identify these critical fastener features and referring to the structural repair manual (SRM) for approved fastener lists and approved installation processes for these fasteners.
7.1.2.2 Fuel tube electrical isolation segments can be used to limit induced lightning current on the fuel tubes, especially on airplanes with carbon fiber composite fuel tank structure. Maintenance, alterations, or repairs of the fuel tube system should maintain the lightning current limits provided by the fuel tube isolation segments. A limitation may specify that the fuel tube isolation segments are required for lightning protection, replacements must also meet the electrical isolation requirements of the original design, and electrical bonding straps must not bridge the isolation segments.
7.1.2.3 Fuel tank access doors have the potential for lightning-related sparking inside the tank as a result of a direct lightning strike or conducted lightning current. The doors may incorporate specific protection features