21 such as electrically conductive gaskets, electrically insulating seals, and multiple fasteners. The limitation may specify that the presence and integrity of the gaskets, seals and fasteners be verified when the access doors are installed. Electrical bonding measurements may be required to verify that the electrical resistance between the access door and adjacent structure is less than a specified value.
7.1.2.4 Sealant can provide caps over fasteners or fillet seals applied where structural parts are joined within the fuel tank. Poor sealant adhesion or sealant damage could degrade lightning ignition source protection. The limitation may specify that the integrity of the sealant must be verified in areas of the fuel system where maintenance or alterations take place.
Cracked, peeling, or missing sealant could indicate that the protection integrity is compromised.
7.1.2.5 The minimum spacing between metal fuel tubes, hydraulic tubes, and conduits and adjacent structure may be specified to prevent lightningrelated arcing. In addition, electrically insulating bushings or grommets may be installed to prevent lightning-related arcing between fuel system components and structure. The limitation may specify that the presence and integrity of the bushings or grommets must be verified in areas of the fuel system where maintenance or alterations take place; and the minimum clearance between fuel tubes, hydraulic tubes, or conduits and adjacent structure or components must be verified in areas where maintenance or alterations take place.
7.1.2.6 Fittings for metal hydraulic tubes, nitrogen inerting tubes, and fuel tubes may be installed through the fuel tank walls. These fittings must conduct induced-lightning currents and prevent voltage or thermal sparks within the tank between the fittings and the fuel tank structure. The limitation may require verifying that the electrical bonding resistance does not exceed a specified value if the fittings are repaired, reinstalled, or altered;
and the integrity and electrical bonding resistance of any required bonding straps must be verified as well.
7.1.2.7 Applicants have incorporated self-bonding couplings that rely on physical contact between the coupling and fuel tubes to provide electrical bonding.
Anodized coatings applied to the fuel tubes could degrade the electrical bonding. The coatings used on the tubes and couplings could be identified as a CDCCL to maintain acceptable electrical bonding.
7.1.2.8 Fuel quantity sensing probes and in-tank wiring may require electrical isolation from adjacent fuel tank structure to prevent lightning-related arcing between the probes, wiring, and structure. The isolation may be provided by electrically non-conductive probe clamps, or non-conductive caps on the ends of the probes. The wiring protection may be provided by separation from structure. The limitation may specify that the presence
22 and integrity of the non-conducting clamps or end caps, and wiring separation must be verified in areas of the fuel system where maintenance or alterations take place.
7.1.3 CDCCLs are intended to identify only critical features of a design that must be maintained. A CDCCL has no interval but establishes configuration limitations to protect the critical design feature identified in the CDCCL. CDCCLs can also include requirements to have placards on the airplane with information about critical features.
For certain equipment, critical protection may be provided by components. These critical protection features must be identified as CDCCLs and should be listed in the component maintenance manual (CMM) to provide awareness to maintenance and repair facilities.
7.1.4 Although not intended by the introduction of CDCCLs and other fuel system airworthiness limitations in the context of § 25.981, there are also design approval holders (DAHs) that have created certain CDCCLs that include both the critical design feature as well as the tasks associated with maintaining the CDCCLs. Typically these airworthiness limitations require adhering to a specific CMM at a specific revision level when repairing or overhauling fuel system components. In this case, operators are required to adhere to all elements of the CMM specified in the CDCCLs. Any deviations from CMMs specified in the CDCCLs, including using later revisions of those CMMs, must be approved by the responsible Aircraft Certification Service office.
The FAA has been working with DAHs to ensure that new design approvals identify only those critical features of components in the CMMs as CDCCLs, instead of identifying the entire CMM as CDCCLs (or other types of airworthiness limitations).
7.2 Mandatory Replacement Times, Inspection Intervals, and Related Inspection and Test Procedures.
7.2.1 To comply with § 25.954(d), mandatory replacement times, inspection intervals, and related inspection and test procedures must be developed for the lightning protection features identified in paragraphs 4.3 and 4.6 of this AC. Mandatory replacement times, inspection intervals, and related inspection and test procedures must be included in the Airworthiness Limitations section of the ICA.
7.2.2 To ensure lightning protection is retained over the service life of the airplane, references to these mandatory replacement times, inspection intervals, and related inspection and test procedures are normally included in the maintenance manuals (e.g., AMM, SRM, SWPM) and service bulletins that provide maintenance personnel with standard practices for continued airworthiness.
7.2.3 When developing maintenance and service inspection techniques, a review of similar airplane designs and their service history should be conducted to focus on areas where past experience has shown there is a potential for affecting lightning protection features.
7.2.4 When developing procedures to remove and reinstall fuel tank access panels, include instructions to maintain or restore the lightning protection features such as sealant,
23 fastener assembly (structural joints), nut plates, bonded parts, insulators, conductive parts, etc.
7.2.5 The applicant should validate the intended maintenance tasks performed in the fuel tank systems and confirm they indeed provide protection and avoidance of damage to the lightning protection features. The applicant should ensure that proper parts and materials are specified in the maintenance tasks.
7.2.6 The lightning design specialist should participate in the determination of the maintenance program necessary for fuel tank lightning protection.
7.2.7 Lightning protection features that are not anticipated to degrade during the life of the airplane and are identified as inherently reliable, do not require mandatory maintenance for compliance with § 25.954(d), but should be identified to the FAA. Integrity of conductive primary structures is an example of such features. A claim that lightning protection features are not anticipated to degrade during the life of the airplane when exposed to the effects of the environment, aging, wear, corrosion, and likely damage must be substantiated and supported by data.
7.2.8 If the protection feature could degrade over the life of the airplane, it must be maintained using approved inspections and procedures consistent with the requirements of § 25.954(d).
Appendix A A-1 Appendix A. Related Documents A.1 FAA REGULATIONS.
The following 14 CFR part 25 regulations are referenced in this AC. You can download the full text of these regulations at the U.S. Government Printing Office e-CFR website.
Or you can order a paper copy by sending a request to the U.S. Superintendent of Documents, U.S. Government Printing Office, Washington, D.C. 20402-0001; by calling telephone number (202) 512-1800; or by sending a request by fax to
(202) 512-2250.
Section 25.571, Damage-tolerance and fatigue evaluation of structure.
Section 25.954, Fuel system lightning protection.
Section 25.981, Fuel tank ignition prevention.
Section 25.975, Fuel tank vents and carburetor vapor vents.
Section 25.1529, Instructions for Continued Airworthiness.
Section 25.1729, Instructions for Continued Airworthiness: EWIS.
A.2 EUROPEAN AVIATION SAFETY AGENCY (EASA) REGULATIONS.
Certification Specifications and Acceptable Means of Compliance for Large Aeroplanes, CS-25. You can get copies of CS-25 from the European Aviation Safety Agency, Postfach 10 12 53, D-50452 Köln, Germany; telephone +49 221 8999 000; fax:
+49 221 8999 099; website: http://www.easa.europa.eu/.
A.3 ADVISORY CIRCULARS.
The following FAA ACs are related to the guidance in this AC. The latest version of each AC at the time of publication of this AC is identified below. If any AC is revised after publication of this AC, you should refer to the latest version for guidance, which can be downloaded from the Internet at http://www.faa.gov/regulations_policies/advisory_circulars/.
AC 20-53C, Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Caused by Lightning, dated September 24, 2018 AC 20-155A, Industry Documents to Support Aircraft Lightning Protection Certification, dated July 16, 2013.
AC 21-16G, RTCA Document DO-160 Versions D, E, F, and G, “Environmental Conditions and Test Procedures for Airborne Equipment”, dated June 22, 2011.
AC 25-19A, Certification Maintenance Requirements, dated October, 3, 2011.
AC 25.1309-1A, System Design and Analysis, dated June 21, 1988.
AC 121-22C, Maintenance Review Boards, Maintenance Type Boards, and OEM/TCH Recommended Maintenance Procedures, dated August 27, 2012.
Appendix A A-2 A.4 REPORTS.
The following FAA reports are referenced in this AC:
Report No. DOT/FAA/AR-05/8, Fuel Tank Flammability Assessment Method User’s Manual, dated May 2008. This report can be downloaded from the Internet at http://www.fire.tc.faa.gov/pdf/05-8.pdf.
Report No. DOT/FAA/AR-TN05/37, Intrinsically Safe Current Limit Study for Aircraft Fuel Tank Electronics, dated October 2005. This report can be downloaded from the Internet at http://www.fire.tc.faa.gov/pdf/TN05-37.pdf.
Large Airplane Fuel System Lightning Protection Aviation Rulemaking Committee (ARC) Report, Large Airplane Fuel System Lightning Protection Rulemaking Recommendations, dated May 2011. This report can be downloaded from the Internet at https://www.faa.gov/regulations_policies/rulemaking/committees/documents/media/ LAFSLPARC-8202009.pdf.
A.5 A4A DOCUMENTS.
ATA MSG-3: Operator/Manufacturer Scheduled Maintenance Development, VOLUME 1 – FIXED WING AIRCRAFT. You can order copies of this document from A4A, 1301 Pennsylvania Avenue NW, Suite 1100, Washington, DC 20004;
telephone: 202-626-4062; website: http://airlines.org/.
A.6 EUROPEAN ORGANIZATION FOR CIVIL AVIATION EQUIPMENT (EUROCAE) DOCUMENTS.
You can order copies of the following documents from EUROCAE, 102 rue Etienne Dolet, 92240 Malakoff, France; telephone: +33 1 40 92 79 30; fax: +33 1 46 55 62 65;
website: http://www.eurocae.net.
EUROCAE ED-14, Environmental Conditions and Test Procedures for Airborne Equipment. You should use revision E or later. This document is technically equivalent to RTCA/DO-160.
EUROCAE ED-107A, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment, July 2010. ED-107A and SAE ARP5583A are technically equivalent.
A.7 RTCA DOCUMENTS.
RTCA/DO-160E, Environmental Conditions and Test Procedures for Airborne Equipment. You should use revision E or later. You can order copies from RTCA, Inc., 1150 18th Street NW, Suite 910, Washington, DC 20036; telephone: 202-833-9339 or fax: 202-833-9434. You can also order copies online at http:/www.rtca.org. This document is technically equivalent to EUROCAE ED-14.
Appendix A A-3 A.8 SAE INTERNATIONAL DOCUMENTS.
You can order copies of the following documents from SAE World Headquarters, 400 Commonwealth Drive, Warrendale, Pennsylvania 15096-0001;
telephone: 724-776-4970; fax: 724-776-0790; website: http://www.sae.org.
SAE ARP4754A, Guidelines for Development of Civil Aircraft and Systems, December 2010.
SAE ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, December 1996.
SAE ARP5412, Aircraft Lightning Environment and Related Test Waveforms, revision B, January 2013.
SAE ARP5414, Aircraft Lightning Zones, revision A, September 2012.
SAE ARP5416A, Aircraft Lightning Test Methods, January 7, 2013.
SAE ARP5583A, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment, June 4, 2010.
Appendix B B-1 Appendix B. Definitions The following definitions apply to lightning protection of fuel tanks and systems of § 25.954 and the guidance in this AC.
B.1 ATTACHMENT POINT.
A point where the lightning flash contacts the airplane.
B.2 CONTINUED SAFE FLIGHT AND LANDING.
The airplane can safely abort or continue a takeoff, or continue controlled flight and landing, possibly using emergency procedures. The airplane must do this without requiring exceptional pilot skill or strength. Some airplane damage may occur because of the failure condition or on landing. The pilot must be able to land the airplane safely at a suitable airport.
B.3 CRITICAL DESIGN CONFIGURATION CONTROL LIMITATIONS (CDCCLS).
A limitation requirement to preserve a critical design feature of a fuel system that is necessary for the design to meet the performance standards of § 25.954 (and/or § 25.981) throughout the life of the airplane model. The purpose of the CDCCL is to provide instructions to retain the critical features during configuration changes that may be caused by alterations, repairs, or maintenance actions.
B.4 CRITICAL LIGHTNING STRIKE.
As defined by § 25.954(a)(1), a critical lightning strike is a lightning strike that attaches to the airplane in a location that, when combined with the failure of any design feature or structure, could create an ignition source.
B.5 ESCAPES.
Production or maintenance errors that can be anticipated to occur that could render the fault tolerance, or lightning protection ineffective.
B.6 EXTREMELY IMPROBABLE FAILURE CONDITION.
When using qualitative analysis, an extremely improbable failure condition is a failure condition that is so unlikely that it is not anticipated to occur during the entire operational life of all airplanes of one type. When using quantitative analysis, an extremely improbable failure condition is one having a probability of failure of 1 X 10-9 or less.
Appendix B B-2 B.7 FAULT-TOLERANT DESIGN.
A design that precludes fuel systems ignition sources even when a fault is present.
B.8 FUEL SYSTEMS.
As defined by § 25.954(a)(2) a fuel system includes any component within either the fuel tank structure or the fuel tank systems and any airplane structure or system components that penetrate, connect to, or are located within a fuel tank.
B.9 FUEL TANK STRUCTURE.
Includes structural members of the fuel tank such as airplane skins, access panels, joints, ribs, spars, stringers, and associated fasteners, brackets, coatings and sealant.
B.10 FUEL TANK SYSTEMS.
Tubing, components, and wiring that are penetrating, located within, or connected to the fuel tanks.
B.11 INTRINSICALLY SAFE.
Fuel system design elements that provide effective lightning protection with no foreseeable failure modes that would render them ineffective. These design elements have no failures or combinations of failures that can result in an ignition source. This can be due to reliable design or to a very low lightning voltage or current in that specific location.
B.12 LIGHTNING FLASH.
The total lightning event. It may occur in a cloud, among clouds, or between a cloud and the ground. It can consist of one or more return strokes, plus intermediate or continuing currents.
B.13 LIGHTNING STRIKE.
Attachment of the lightning flash to the airplane.
B.14 LIGHTNING STRIKE ZONES.
Airplane surface areas and structures that are susceptible to lightning attachment, dwell time, and current conduction. See AC 20-155A, which references documents that provide additional guidance on airplane lightning zoning.
Appendix B B-3 B.15 LIGHTNING STROKE (RETURN STROKE).
A lightning current surge that occurs when the lightning leader (the initial current charge) makes contact with the ground or another charge center. A charge center is an area of high potential of opposite charge.
B.16 PRACTICALITY.
A balance of available means, economic viability, and proportional benefit to safety.
B.17 RELIABLE DESIGN.
A reliable design is a design that provide lightning protection features that are not anticipated to degrade during the life of the airplane.
B.18 RELIABLE FAULT TOLERANCE.
A fault-tolerant fuel system design is a design that precludes ignition sources in the fuel system even when a fault is present; “reliable” means the ability to maintain the effectiveness of the protection features over the service life of the individual airplane.
B.19 REMOTE.
Those conditions that are unlikely to occur to each airplane during its total life, but which may occur several times when considering the total operational life of a number of airplanes of the type.
B.20 SYSTEMS.
Systems include fuel, mechanical, hydraulic, electrical, and electrical wiring interconnection system (EWIS) components that penetrate, are located within, or connected to the fuel tanks.
Appendix C C-1 Appendix C. Section 6 Examples C.1 EXAMPLES FOR PARAGRAPH 6.1.2.1 OF THIS AC.
Design elements or features where providing fault-tolerant lightning ignition source prevention should be practical include:
1. Installation of rivets and bolts in aluminum structure that are well bonded through processes that ensure fastener/hole fit, fastener and hole quality, and installation practices
2. Installation of bolts in composite structure that are well bonded through processes that ensure control of fastener/hole fit, fastener and hole quality, and installation practices and with additional design features to distribute current, such as foil or mesh at the material surface.
3. Installation of lightning protective sealant or cap seals over fastener heads/ends located inside fuel tanks, where necessary.
C.2 EXAMPLES FOR PARAGRAPH 6.1.2.2 OF THIS AC.
Design features or failures where providing fault-tolerant lightning ignition source prevention could be impractical include:
1. Fatigue cracking within structural elements such as spars, skins, stringers, and ribs.
Typically, material controls, manufacturing controls, established material allowables, design margins, and life-cycle tests make the occurrence of significant cracking rare.
2. Failure of fasteners highly loaded in tension that leads to separation of the fastener or part of the fastener from the hole, or gapping of the fastener head or nut, and consequent failure of a cap seal. Typically, manufacturing controls, design margins, and life-cycle tests make the occurrence of broken bolts rare.
3. Installation of double cap seals or structurally reinforced cap seals to retain a bolt that fails under tension, resulting in cascading failure of the cap seals.
4. Preventing damage that may go undetected by scheduled or directed field inspection and manufacturing defects for composite structure (category 1 damage in AC 20-107B).
C.3 EXAMPLES FOR PARAGRAPH 6.1.2.3 OF THIS AC.
Examples of practical design, manufacturing, and maintenance processes are listed below. Although these practices themselves are not considered to be independent features for providing fault tolerance, they are measures to minimize the likelihood of failures or measures necessary to support assumptions about failure modes or rates in a safety analysis.
Appendix C C-2
1. A structured design review process (as described in this AC) to ensure that all relevant design features are reviewed to identify critical design areas, critical processes, and associated testing and analysis requirements.
2. Engineering review of the proposed design to identify failure modes that may occur because of manufacturing errors or escapes, maintenance errors, repairs or alterations, aging, wear, corrosion, or likely damage.
3. Engineering review of manufacturing processes to identify failure modes that may occur because of manufacturing errors or escapes.
4. Engineering review of service history records to identify failure modes that may occur because of production escapes, maintenance errors, repairs or alterations, aging, wear, corrosion, or likely damage.
5. Implementation of practical manufacturing and quality control processes to address the issues identified through the required engineering reviews.
6. For non-fault-tolerant location, quality control processes that require inspection of critical features by a person other than the person that performed the manufacturing work.
7. Provisions in the ICA to identify cautions in maintenance documents regarding lightning protection features, as well as life limits or repetitive inspections for nonfault-tolerant features. For any penetration into the fuel tank, or any structural damage within the fuel tank, the SRM should specify repair methods that maintain lightning protection features.
8. Mandatory maintenance actions necessary to ensure maintained compliance with the lightning protection requirements should be included in the Airworthiness Limitations section of the ICA as required by section H25.4 of appendix H to part 25.
C.4 EXAMPLE FOR PARAGRAPH 6.2.5.3 OF THIS AC.
The following is an example of an assessment process addressing the potential for non-fault-tolerant fuel tank structural cracking. To assess the risk due to non-fault tolerance for structural cracks, the following should be accomplished:
C.4.1 Determine if the structure in this zone is susceptible to fatigue cracking. If it is susceptible to fatigue cracking, determine the minimum size of crack that could be a source for arcing. This crack length should then be compared to the inspection methods used for compliance with § 25.571 (Damage Tolerance), to determine the ability and/or probability of detecting a crack of this size.
C.4.2 If the Airworthiness Limitations required for compliance with § 25.571 already are sufficient to ensure that it is remote (unlikely to occur on each airplane—see AC 25-19A) that a crack will grow to sufficient size and gap in excess of that necessary to cause sparking during a lightning event, then no lightning-related Airworthiness Limitations are required. The probability of this remote condition occurring, together
Appendix C C-3 with the remote probability of a critical lightning strike, make these combinations not foreseeable.
C.4.3 As part of the damage tolerance evaluation, an analysis should be performed to determine the duration of time (in flight cycles) it will take for a crack of minimum arcing size to grow to the minimum detectable length. This crack propagation rate should then be used along with the probability of detection for the specified inspection method to determine the exposure time. That is, the number of flight cycles an airplane may be exposed to before an ignition source due to a structural failure (crack, failed fastener, etc.) occurs.
C.4.4 If the Airworthiness Limitations necessary to support compliance with § 25.571 cannot ensure the likelihood of a crack in excess of that would cause sparking is remote, and the crack would not be readily detectable within a few flights due to fuel leaks, then this condition must be included in the risk assessment of non-fault-tolerant conditions.
Further, any practical maintenance inspection should be made to minimize the exposure time. A low probability combined with low exposure time may be necessary to demonstrate that catastrophic ignition is extremely improbable, i.e., it is not anticipated to occur during the entire operational life of all airplanes of one type.