AC 25.954-1

U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Transport Airplane Fuel System Lightning Protection Date: 09/24/18 Initiated By: AIR-670 AC No: 25.954-1

This advisory circular (AC) provides guidance for showing compliance with the airworthiness regulations for transport category airplanes regarding lightning protection of fuel tanks and systems. These lightning protection requirements apply to normal conditions and possible failures of fuel tank structure and systems that could lead to fuel tank explosions. This AC also provides guidance for developing critical design configuration control limitations (CDCCLs) and Airworthiness Limitations required to be included in the Instructions for Continued Airworthiness (ICA) related to lightning protection features of the airplane fuel system.

If you have suggestions for improving this AC, you may use the Advisory Circular Feedback form at the end of this AC.

Dr. Michael C. Romanowski Director, Policy and Innovation Division Aircraft Certification Service

Contents Paragraph Page ii

1 Purpose1

2 Applicability1

3 Background2

4 Approach to Compliance2

4.1 Summary2

4.2 Compliance Tasks2

4.3 Identify the Design Features and Elements of the Fuel System that Require Lightning

Assessment3

4.4 Determine the Lightning Strike Zones3

4.5 Establish the Airplane Lightning Environment4

4.6 Develop a Lightning Protection Approach and Design Lightning Protection Features ...4

4.7 Identify Potential Failures of the Design and Protection Features5

4.8 Identify Potential Ignition Sources Associated with the Design Features and Potential

Failures5

4.9 Perform a Safety Assessment to Determine Fault Tolerance and Non-Fault Tolerance ..7

5 Provide Reliable Fault-Tolerant Protection for Lightning Ignition Sources9

5.1 Provide Fault-Tolerant Lightning Protection9

5.2 Demonstrate Effective Fault-Tolerance9

5.3 Demonstrate Protection Reliability10

5.4 Demonstrate Compliance with the “Extremely Improbable” Requirement11

6 Assess Non-Fault-Tolerant Protection for Lightning Ignition Sources12

6.1 Overview12

6.2 Qualitative Assessment of Non-Fault-Tolerant Conditions13

6.3 Quantitative Assessment of Non-Fault-Tolerant Conditions18

6.4 Evaluating Non-Fault-Tolerance for Systems19

7 Establish Airworthiness Limitations19

7.1 Critical Design Configuration Control Limitations19

7.2 Mandatory Replacement Times, Inspection Intervals, and Related Inspection and Test

Procedures22

Appendix A. Related DocumentsA-1

A.1 FAA RegulationsA-1

Contents (continued) Paragraph Page iii

A.2 European Aviation Safety Agency (EASA) RegulationsA-1

A.3 Advisory CircularsA-1

A.4 ReportsA-2

A.5 A4A DocumentsA-2

A.6 European Organization for Civil Aviation Equipment (EUROCAE) DocumentsA-2

A.7 RTCA DocumentsA-2

A.8 SAE International DocumentsA-3

Appendix B. DefinitionsB-1

B.1 Attachment PointB-1

B.2 Continued Safe Flight and LandingB-1

B.3 Critical Design Configuration Control Limitations (CDCCLs)B-1

B.4 Critical Lightning StrikeB-1

B.5 EscapesB-1

B.6 Extremely Improbable Failure ConditionB-1

B.7 Fault-Tolerant DesignB-2

B.8 Fuel SystemsB-2

B.9 Fuel Tank StructureB-2

B.10 Fuel Tank SystemsB-2

B.11 Intrinsically SafeB-2

B.12 Lightning FlashB-2

B.13 Lightning StrikeB-2

B.14 Lightning Strike ZonesB-2

B.15 Lightning Stroke (Return Stroke)B-3

B.16 PracticalityB-3

B.17 Reliable DesignB-3

B.18 Reliable Fault ToleranceB-3

B.19 RemoteB-3

B.20 SystemsB-3

Appendix C. Section 6 ExamplesC-1

C.1 Examples for Paragraph 6.1.2.1 of this ACC-1

Contents (continued) Paragraph Page iv

C.2 Examples for Paragraph 6.1.2.2 of this ACC-1

C.3 Examples for Paragraph 6.1.2.3 of this ACC-1

C.4 Example for Paragraph 6.2.5.3 of this ACC-2

Figures Number Page

Figure 1. Assessing the Combined Risk of All Non-Fault-Tolerant Failures16

1 1 PURPOSE.

1.1 This AC provides guidance for showing compliance with title 14, Code of Federal Regulations (14 CFR) 25.954, Fuel system lightning protection, at amendment 25-146.

It includes guidance on tasks to be accomplished to comply with § 25.954 for lightning protection of the airplane fuel system. These tasks may be accomplished in a different order than listed below, and some tasks may require iterations.

1.2 This AC also provides guidance, in the form of a method of compliance, appropriate for airplane fuel systems with reliable fault-tolerant lightning protection for ignition sources, including details on compliance for fault-tolerant lightning protection. Any non-fault-tolerant lightning protection in an airplane fuel system will, in order to comply with the method of compliance set for in this AC, need a thorough assessment for the likelihood of failures, lightning strikes and attachment locations, and fuel tank flammability to show compliance with the regulations. Guidance on compliance for non-fault-tolerant lightning protection are provided in this AC.

1.3 The following appendices appear at the end of this AC:

 Appendix A, Related Documents.

 Appendix B, Definitions.

 Appendix C, Section 6 Examples.

2 APPLICABILITY.

2.1 This AC applies to all applicants for new type certificates or changes to existing type certificates when the certification basis requires the applicant to address the lightning certification requirements of § 25.954, at amendment 25-146.

2.2 The guidance in this AC is for airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) transport airplane type certification engineers and the Administrator’s designees.

2.3 The material in this AC is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes acceptable means, but not the only means, for showing compliance with the applicable regulations. The FAA will consider other means of showing compliance that an applicant may elect to present. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. If, however, we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation or design changes as a basis for finding compliance.

2.4 The material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes in, or permit deviations from, existing regulatory requirements.

3 BACKGROUND.

The FAA adopted amendment 25-146, issued on September 6, 2018 (83 FR 47548, September 20, 2018), modifying the fuel systems lightning safety provisions of §

25.954. This amendment also changed § 25.981, Fuel tank explosion prevention, by excepting fuel systems lightning protection. The revised § 25.954, at amendment 25 146, includes requirements to—  Ensure catastrophic fuel vapor ignition is extremely improbable;

 Develop CDCCLs, inspections, test procedures, and mandatory replacement times for lightning protection design features; and  Include the CDCCLs, inspections, test procedures, and mandatory replacement times in the Airworthiness Limitation section of the ICA.

4 APPROACH TO COMPLIANCE.

4.1 Summary.

The method in this AC divides the design features for fuel system lightning protection into three categories: intrinsically safe, fault tolerant, and non-fault tolerant. It also provides guidance on developing material for the Airworthiness Limitations section of the ICA.

4.1.1 Guidance for incorporating intrinsically safe design features into the fuel tank system is provided in paragraph 4.9.4.1 of this AC.

4.1.2 Section 5 of this AC provides guidance on compliance with § 25.954(b) for fault-tolerant lightning protection designs.

4.1.3 Section 6 of this AC provides guidance on compliance with § 25.954(b) for non-fault-tolerant lightning protection designs.

4.1.4 Section 7 of this AC provides guidance on developing CDCCLs and other tasks that must be placed in the Airworthiness Limitation Section of the ICA.

4.2 Compliance Tasks.

The applicant should accomplish the following tasks to comply with § 25.954 lightning protection requirements for the airplane fuel system. These tasks may be accomplished in a different order than listed below, and some tasks may require iterations. Further information is provided in the paragraph referenced at the end of each task.

 Identify the design features and elements of the fuel system that require lightning assessment (paragraph 4.3).

3  Determine the lightning strike zones (paragraph 4.4).

 Establish the airplane lightning environment (paragraph 4.5).

 Develop a lightning protection approach and design lightning protection features (paragraph 4.6).

 Identify potential failures of the design and protection features (paragraph 4.7).

 Identify potential ignition sources associated with the design features and potential failures (paragraph 4.8).

 Perform a safety assessment to determine fault tolerance and non-fault tolerance (paragraph 4.9).

 Provide reliable fault-tolerant protection for lightning ignition sources (paragraph 5).

 Assess non-fault-tolerant protection for lightning ignition sources (paragraph 6).

 Establish airworthiness limitations (paragraph 7).

4.3 Identify the Design Features and Elements of the Fuel System that Require Lightning Assessment.

To comply with § 25.954(b), the applicant should identify the fuel system design features and elements for the fuel tank structure, system components, and equipment that require lightning assessment to show that ignition of fuel vapor within the systems due to lightning and its effects is prevented. The design features and elements may be categorized into design groups that share characteristics that have similar lightning protection performance. The applicant should provide a detailed description of the fuel system, including:

 Structural members and fasteners exposed to direct and swept lightning attachment;

 Structural joints and fasteners exposed to conducted-lightning current resulting from lightning attachment;

 Access doors, vents, drain valves, fuel filler ports, and other parts and components of the fuel system exposed to direct lightning attachment or conducted lightning currents; and  Electrical, mechanical, hydraulic, and fuel plumbing system installations within the fuel tank or connected to the fuel tanks exposed to direct lightning attachment or conducted lightning current.

4.4 Determine the Lightning Strike Zones.

Lightning strike zones define locations on the airplane where lightning is likely to attach and structures that will conduct lightning current between lightning attachment points. The applicant should determine lightning strike zones for the airplane configuration, since the zones will be dependent upon the airplane geometry and operational factors. Lightning strike zones often vary from one airplane type to another.

4 SAE1 ARP5414A2, Aircraft Lightning Zones, provides guidance on determining lightning strike zones for the airplane, area of direct lightning strikes, areas of swept lightning strokes, and areas of conducted electrical transients. When determining the probability of lightning attachment to certain regions of the airplane, applicants should use data from similar airplane configurations to substantiate any assumed strike attachment rate for the region.

4.5 Establish the Airplane Lightning Environment.

Fuel tank structure, system components, and equipment that are located in lightning zones 1 and 2 should be designed for lightning direct-attachment waveforms. SAE ARP5412B3, Aircraft Lightning Environment and Related Test Waveforms, provides guidance on acceptable lightning current and voltage waveforms for lightning zones 1 and 2. Fuel tank structure, system components, and equipment that are exposed to conducted currents should be assessed to determine the appropriate lightning current and voltage waveforms and amplitudes, using the conducted current waveforms for zone 3 in SAE ARP5412. The applicant may use analyses or tests to assess the conducted currents and voltages for the structure, system components, and equipment.

Margins should account for uncertainty of the analysis or test. Simple analyses of the lightning currents and voltages should incorporate larger margins than lightning currents and voltages that were calculated using detailed computational models that have been validated by tests.

4.6 Develop a Lightning Protection Approach and Design Lightning Protection Features.

The applicant should develop the lightning protection approach and design lightning protection features required to provide effective lightning protection for all the fuel system design features and elements identified in paragraph 4.3 of this AC. See paragraphs 5.2 and 6.1.2 for further guidance for demonstration of effective protection.

The lightning protection features can include specific installation requirements, such as hole-size tolerance for fasteners or surface cleaning for sealant application. Other lightning protection features can include specific protection components, such as metal mesh incorporated into the outer surface of composite structures. The design should provide reliable lightning protection that prevents lightning–related ignition sources if a potential failure occurs in the lightning protection features. When possible, the design should place fuel system components—such as fuel tank vents, drain valves, jettison tubes, filler ports, and access doors—in lightning attachment zone 3, so they are less likely to be exposed to direct lightning attachment.

1 Formerly known as the Society of Automotive Engineers.

2 SAE ARP5414 is referenced in AC 20-155A, Industry Documents to Support Aircraft Lightning Protection Certification.

3 SAE ARP5412B is referenced in AC 20-155A.

4.7 Identify Potential Failures of the Design and Protection Features.

4.7.1 The applicant should identify potential failures, due to causes that include manufacturing escapes4, operational deterioration5, and accidental damage6, that may lead to the loss or degradation of lightning protection. Identify design elements that could degrade the effectiveness of lightning protection through analysis or test. Identify failures through detailed review of manufacturing processes, material properties, structural design, systems design, and reliability and maintainability processes. Use available manufacturing discrepancy reports, in-service failure reports, and developmental tests to identify potential failures. Account for failures such as structural cracking, corroded or failed electrical bonding features, and mis-installed electrical bonding features that occur during manufacturing or maintenance.

4.7.2 The severity or types of failures should be defined and can be based on service history, where appropriate, and laboratory test data. Failure severity should be consistent with or bounded by assumptions made for structural and systems certification analyses.

Severity or types of failures due to manufacturing escapes should be based on manufacturing discrepancy reports, such as rejection tags, manufacturing process escape assessments, and assessments of process improvements.

4.7.3 Manufacturing variability and environmental conditions should be considered in conjunction with failures. Combining worst-case conditions for all manufacturing variabilities and environmental conditions is overly conservative and not necessary.

Failures due to operating or environmental conditions outside of those required for certification need not be considered. Combinations of failures where one failure also causes a second failure to occur should be considered as a single failure condition

(i.e., a common cause or cascading failure).

4.8 Identify Potential Ignition Sources Associated with the Design Features and Potential Failures.

4.8.1 Fuel system fasteners, structure, equipment, and components that are exposed to direct lightning attachment in lightning zones 1 and 2 should be assessed using the lightning

4 Manufacturing escapes for fuel tank structure include fastener selection issues (incorrect fastener size, type, finish, or coating), fastener assembly issues (misalignment, incorrect torque, hole size or quality, missing or extra washers), and installation issues (inadequate or improperly adhered sealant, missing cap seals, incorrectly installed electrical bonds). Manufacturing escapes for fuel system components and equipment include design configuration issues (incorrect fasteners, wrong or missing clamps or brackets, inadequate or improperly adhered sealant, missing or incorrect finishes), bonding issues (missing or improperly installed electrical bond or wiring shield), and clearance issues (insufficient tube or wiring clearance to adjacent systems or structure).

5 Structural failures due to operational deterioration during intended operation include broken or cracked elements (fasteners or washers), corrosion, degradation of applied materials (sealants, fastener head coating, edge glow protection, or bonded joints), and fatigue issues (loose fasteners or structural cracks). System failures due to operational deterioration include failures of support features (loss of fasteners, brackets, or clamps that support tubes, EWIS or components) and degradation of electrical bonds, wire insulation or shielding due to corrosio n, aging, or wear.

6 Structure or system failures due to accidental damage include impact from foreign object debris (FOD) or inadvertent damage incurred during alterations, repairs, or inspections.

6 waveforms identified in paragraph 4.5 of this AC. Fuel system fasteners, structure, equipment, and components should also be assessed for conducted lightning currents. If the airplane uses novel or unusual materials, structure, or configurations, the applicant should evaluate fuel system fasteners, structure, equipment, and components on the outside surface of the airplane located in lightning zone 3 using the nominal zone 3 direct lightning attachment waveforms defined in SAE ARP5412. Use of materials for fuel tank structure that are not highly conductive is considered unusual. Lightning attachment in zone 3 is defined as unlikely in SAE ARP5414, so the evaluation need not consider failures in combination with such an attachment but should demonstrate no catastrophic effect will occur when no failures are present.

4.8.2 The following paragraphs list ignition source types and examples of how ignition sources might occur:

4.8.2.1 Voltage sparks are the result of electrical breakdown of a dielectric between two separated conductors. Voltage sparking might occur, for example, between the fastener and its hole or through an insulation layer between the base of a nut and a conductive surface. A voltage spark could occur between a fuel tube and adjacent structure if the separation is insufficient or the bonding to minimize the voltage potential has failed. If this spark is exposed to fuel vapor, an ignition may result. Laboratory tests have shown that the minimum ignition energy in a voltage spark required to ignite hydrocarbon fuel vapor is 200 microjoules.7

4.8.2.2 Thermal sparks are the result of burning particles emitted by rapid melting and vaporization of conductive materials carrying current through a point contact. Thermal sparks can occur when there is a small contact area between a fastener and the hole material, or between a fastener collar and the underlying structure. Thermal sparks can occur at a point contact between a fuel tube and adjacent structure if the contact point conducts high current. When sealant or caps are used to contain sparks, failures could result in the internal pressures from the heat of thermal sparks that force hot particles past the sealant or cap resulting in sparks in the fuel vapor area.

4.8.2.3 Analyses and tests indicate a small piece of steel wool will ignite a flammable mixture when a transient current of approximately 100 milliamperes (mA) peak is applied to the steel wool.8

7 The 200-microjoule level comes from various sources. The most quoted is from Lewis and von Elbe’s book, Combustion, Flames and Explosions of Gases (Florida: Academic Press, Inc., 1987; (orig. publ. 1938)). It has a set of curves for minimum ignition energy for the various hydrocarbon compounds in jet fuel, and they all have similar minimum ignition energy levels of greater than 200 microjoules.

8 This data was from testing performed by the FAA Technical Center, Report DOT/FAA/AR-TN05/37, Intrinsically Safe Current Limit Study for Aircraft Fuel Tank Electronics. Applicants may conduct testing to substantiate alternate values.

4.8.2.4 Edge glow includes voltage or thermal sparks that occur at the edges of carbon fiber composite material when lightning current and voltage cause breakdown of resin between fibers. Failures of protection features to prevent edge glow should be identified.

4.8.2.5 Fuel vapor ignition due to lightning near fuel vent outlets can result in flame propagation into the fuel system. When lightning attaches near fuel vent outlets, ignition of fuel vapors results in a high-speed pressure wave that can travel through the flame arrestor without sufficient time for the flame arrestor to quench the flame front. The vent outlets should be located outside the lightning direct-attachment zones of the airplane. If the vent outlets are located in lightning direct-attachment zones, flame arrestors have been used to prevent lightning-ignited fuel vapors from propagating into the fuel system. Specific lightning tests and unique design features are typically needed to demonstrate the lightningprotection effectiveness for these installations9.

4.9 Perform a Safety Assessment to Determine Fault Tolerance and Non-Fault Tolerance.

4.9.1 The applicant should perform a safety assessment to determine if the fuel system design provides acceptable fuel system lightning protection based on the design features and potential ignition sources due to failures of the design features identified in the previous steps. The applicant may perform the safety assessment on groups of fuel system design elements and lightning protection features with similar physical and electrical characteristics. For non-fault-tolerant features, an assessment must show, per § 25.954(c), that the sum of the probability of failures from potential ignition sources in combination with the probability of a critical lightning strike and the fuel tank being flammable does not exceed extremely improbable. The applicant should provide its rationale for assigning design elements and lightning protection into groups.

4.9.2 The safety assessment should address all fuel system design elements identified in paragraph 4.3 of this AC, the lightning environment at the locations for those elements identified in paragraphs 4.4 and 4.5 of this AC, and the failures identified in paragraph 4.7 of this AC. The applicant should also use the safety assessment to identify where analyses or tests are necessary to demonstrate prevention of fuel systems ignition sources.

4.9.3 The applicant should use a rigorous and structured safety assessment approach. The structured safety assessment and associated fault-tolerance assessment and test reports should be part of the substantiating data. Failure modes and effects analyses are acceptable structured safety assessment tools, particularly for non-fault tolerant lightning protection features. All failure modes and effects analyses (FMEAs) and fault tree analyses (FTAs) should be included and thoroughly annotated.10 The applicant

9 Lightning effects are not addressed in the fuel tank vent fire protection requirements of § 25.975(a)(7) at amendment 25-143 and the associated AC.

10 The FMEA and FTA techniques are described in SAE ARP4761.

8 should substantiate and document all assumptions used in performing the safety assessment.

4.9.4 The safety assessment should divide all the lightning protection features of the fuel system into the following three categories:

4.9.4.1 Intrinsically Safe Lightning Protection.

Some fuel system design elements provide effective lightning protection with no foreseeable failure modes that would render them ineffective.

These design elements have no failures or combinations of failures that can result in an ignition source. This can be due to reliable design or to a very low lightning voltage or current in that specific location. The applicant should identify any intrinsically safe fuel system design elements. An example of an intrinsically safe design element would be highly conductive fuel tank skins with sufficient thickness to ensure that lightning attachment to the skin will not result in hot-spot or melt-through ignition sources in the tank. Another example would be a structural element designed with sufficient margin that fatigue cracking is not foreseeable. A third example could be fasteners or joints located in the fuel tank structure where the lightning current density is so low that an ignition source will not result even when failure conditions are present.

4.9.4.2 Fault-Tolerant Lightning Protection.

Fuel system design elements that are not intrinsically safe and require design features to provide lightning protection should be designed so that a failure associated with these elements or features will not result in an ignition source. Reliable fault-tolerant lightning ignition source prevention, in combination with fuel tank flammability control required by § 25.981 and the statistics of lightning strikes to airplanes, is acceptable for showing compliance with § 25.954(c). Detailed guidance for showing compliance for reliable fault-tolerant lightning protection is provided in section 5 of this AC.

4.9.4.3 Non-Fault-Tolerant Lightning Protection.

Applicants have found it is impractical to provide fault-tolerant features or indication of failures for some failures that occur in airplane structure.

Certain fuel system design elements and lightning protection features could have conditions where a single failure of these elements or features results in an ignition source when combined with a critical lightning strike.

These fuel system design elements, lightning protection features, and failures require detailed and thorough safety assessment to determine if the fuel system design complies with § 25.954(b). It is likely the airplane fuel system design and lightning protection can have only a very small number of these non-fault-tolerant lightning protection conditions and still show the risk of a catastrophic event is extremely improbable to comply with