U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Fuel Tank Ignition Source Prevention Guidelines Date: 09/24/18 Initiated By: AIR-670 AC No: 25.981-1D
This advisory circular (AC) provides guidance for showing compliance with title 14, Code of Federal Regulations (14 CFR) 25.981, Fuel tank explosion prevention, which provides the certification requirements for the prevention of ignition sources, other than lightning, within the fuel tanks of transport category airplanes. AC 25.954-1, Transport Airplane Fuel System Lightning Protection, now addresses ignition sources due to lightning. The guidance in this AC is applicable to transport category airplanes for which a new, amended, or supplemental type certificate is requested.
Revisions to this AC include: (1) removing the lightning-related aspects because they are now in AC 25.954-1, developed specifically to address compliance with § 25.954, Fuel system lightning protection; and (2) describing means of compliance for prevention of failure conditions created from ignition sources, other than lightning, using circuit protective devices—such as an arc fault circuit breaker or ground fault interrupter—to provide fail-safe features.
If you have any suggestions for improving this AC, you may the Advisory Circular Feedback form at the end of this AC.
Dr. Michael C. Romanowski Director, Policy and Innovation Division Aircraft Certification Service
Contents Paragraph Page ii
1 Purpose1
2 Applicability1
3 Cancellation1
4 Background: Regulatory History2
5 Objective3
6 System Safety Assessment (SSA)3
7 Fuel Vapor Ignition Sources8
7.1 Overview8
7.2 Electrical Sparks and Electrical Arcs8
7.3 Filament Heating Current Limit9
7.4 Friction Sparks9
7.5 Maximum Allowable Surface Temperatures9
7.6 Fuel System Electrostatics11
8 Design Considerations13
8.1 Fiber Optics13
8.2 Location of the Pump Inlet14
8.3 Wiring14
9 Safety Analysis19
9.1 Ignition Source Failure Analysis19
9.2 Qualitative Safety Assessment20
9.3 Assumptions and Considerations for Fuel Tank System Analysis21
10 Component Failure mode Considerations32
10.1 Component Qualification Review32
10.2 Maximum Component Temperature for Qualification of Fuel System Components32
10.3 Possible Failure Modes for Determination of Maximum Component Temperatures33
11 Airworthiness Limitations for the Fuel Tank System37
11.4 Maintainability of Design and Procedures39
11.5 Incorporation by Reference into Airworthiness Limitations39
11.6 Visible Identification of CDCCLs40
Contents (continued) Paragraph Page iii Appendix A. Certification of Arc Fault Circuit Breaker (AFCB) or Ground Fault Interrupter
(GFI)A-1
A.1 PurposeA-1
A.2 BackgroundA-1
A.3 Certification GuidanceA-1
Appendix B. Related DocumentsB-1
B.1 RegulationsB-1
B.2 Advisory CircularsB-2
B.3 OrdersB-2
B.4 ReportsB-3
B.5 Military SpecificationsB-3
B.6 Industry Documents. ....................................................... Error! Bookmark not defined.
Appendix C. DefinitionsC-1
C.1 Arc Fault Circuit Breaker (AFCB)C-1
C.2 Autoignition TemperatureC-1
C.3 Auxiliary TanksC-1
C.4 BarrierC-1
C.5 Component Maintenance Manual (CMM) DeviationC-1
C.6 Critical Design Configuration Control Limitations (CDCCLs)C-2
C.7 Electrical SparksC-2
C.8 Electrical ArcsC-2
C.9 Explosion ProofC-2
C.10 Fail-SafeC-2
C.11 Filament HeatingC-2
C.12 FlammableC-2
C.13 Flash PointC-3
C.14 Friction SparkC-3
C.15 Fuel System Airworthiness LimitationC-3
C.16 Ground Fault Interrupter (GFI)C-3
C.17 Hot ShortC-3
Contents (continued) Paragraph Page iv
C.18 Ignition SourceC-3
C.19 Installation AppraisalC-3
C.20 Intrinsically SafeC-3
C.21 Latent FailureC-4
C.22 Line Replacement Unit (LRU)C-4
C.23 Maximum Allowable Surface TemperaturesC-4
C.24 QualitativeC-4
C.25 QuantitativeC-4
C.26 Transient Suppression Device (TSD)C-4
Figures Number Page
Figure 1. Examples of Fuel Tank Ignition Source Considerations21
1 1 PURPOSE.
This AC provides guidance for showing compliance with § 25.981, which provides the certification requirements for the prevention of ignition sources, other than lightning, within the fuel tanks of transport category airplanes. (AC 25.954-1 addresses ignition sources due to lightning.) This AC includes guidance for prevention of failure conditions created from ignition sources other than lightning. It describes a means of compliance, using circuit protective devices such as an arc fault circuit breaker (AFCB) or ground fault interrupter (GFI), to provide fail-safe features that have been accepted as showing compliance with § 25.981.
2 APPLICABILITY.
2.1 This AC applies to transport category airplanes for which a new, amended, or supplemental type certificate is requested. The guidance in this AC is for airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) transport airplane type certification engineers and the Administrator’s designees. This guidance is applicable for showing compliance with the fail-safe fuel tank system ignition prevention requirements of § 25.981, amendment 25-102 and later amendments. This guidance does not apply to the flammability requirements in § 25.981(b) and (c) (at amendments 25-125 and 25-102, respectively).
It may also be used for showing compliance with the fail-safe requirements of §§ 25.901 and 25.1309, amendments 25-40 through 25-46, for fuel tank system ignition prevention when amendment 25-102 or later is not in the certification basis.
2.2 The material in this AC neither mandatory nor regulatory in nature and does not constitute a regulation. It describes acceptable means, but not the only means, for showing compliance with the applicable regulations. The FAA will consider other means of showing compliance that an applicant may elect to present. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. If, however, we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation or design changes as a basis for finding compliance.
2.3 The material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes in, or permit deviations from, existing regulatory requirements.
3 CANCELLATION.
This AC cancels AC 25.981-1C, Fuel Tank Ignition Source Prevention Guidelines, dated September 19, 2008.
2 4 BACKGROUND: REGULATORY HISTORY.
4.1 The regulatory standards of part 25 require that ignition sources not be present or develop in the fuel tanks of transport category airplanes. Amendment 25-11, effective May 5, 1967, introduced § 25.981, Fuel tank temperature. This requirement was prompted by a need for protection of airplane fuel tanks from possible ignition sources because of advances in electrical system sealing. These advances made it possible to place electrical system components, such as pumps and fuel gauging elements, as well as the wiring to these components, in immersed locations within fuel tanks.
Additionally, fuel tank walls were subject to local “hot spots” by the proximity of airplane equipment and compressor bleed air ducts that carry air at high temperatures.
4.2 The need for a regulation was further substantiated by the possibility that the surface temperature of the fuel tank internal wall, or the fuel system components within the fuel tank, could exceed the autoignition temperature of the fuel. Section 25.981, as originally adopted, focused on preventing ignition of fuel vapors in the fuel tanks from hot surfaces. It required that the applicant determine the highest temperature allowable in fuel tanks that provided a safe margin below the lowest expected autoignition temperature of the fuel approved for use in the fuel tanks. In addition, this regulation established a requirement that no temperature at any place inside any fuel tank where fuel ignition is possible may then exceed that maximum allowable temperature.
4.3 Other sections of part 25 require that ignition from lightning be prevented (§ 25.954, Fuel system lightning protection), as well as ignition from failures in the fuel system (§ 25.901, Powerplant: Installation). Section 25.901 requires applicants to complete a safety assessment of the fuel system and show that “no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane....”
However, service history has shown that ignition sources have developed in airplane fuel tanks due to unforeseen failure modes or factors that were not considered at the time of original certification of the airplane model, including arcs, sparks, or hot surfaces within the fuel tanks.
4.4 AC 25.981-1A, Guidelines for Substantiating Compliance with the Fuel Tank Temperature Requirements, dated January 20, 1971, provided guidance that included failure modes that used to be considered when determining compliance with the fuel tank temperature requirements defined in § 25.981, amendment 25-11. This regulation originally focused on preventing ignition of fuel vapors in the fuel tanks from hot surfaces. The AC also stated the accepted practice of establishing a minimum 50 °F temperature margin below the lowest autoignition temperature of the approved fuels.
4.5 Amendment 25-102, issued on April 18, 2001, renamed § 25.981 as Fuel tank ignition prevention. That amendment also added new requirements to address causes of ignition sources within fuel tanks, and to minimize the development of flammable vapors in the fuel tanks or mitigate the effects of ignition of vapors in the tanks. The ignition source prevention standard requires a safety assessment of the fuel tank system that includes:
Consideration of single failures;
3 Probable combinations of failures;
Development of long-term instructions for continued airworthiness (ICA), including mandatory replacement time, inspection interval, related inspection procedure, and critical design configuration control limitations (CDCCLs); and Maintainability of the airplane fuel tank system.
4.6 Special Federal Aviation Regulation (SFAR) No. 88 to part 21, Fuel Tank System Fault Tolerance Evaluation Requirements, issued at amendment 21-78 on April 18, 2001, requires a one-time reassessment of the fuel tank systems of many in-service transport category airplanes according to the ignition source prevention requirements of §§ 25.901 and 25.981, at amendments 26-46 and 25-102, respectively.
4.7 Amendment 25-125, issued July 9, 2008, added specific requirements for the fuel tank flammability to § 25.981. The requirements for CDCCLs were expanded to include flammability reduction means and ignition mitigation.
4.8 Amendment 25-146, issued on September 6, 2018 (83 FR 47548, September 20, 2018), enhanced § 25.954 requirements to prevent catastrophic fuel tank failures due to the effect of lightning on the fuel tank structure and systems including fault tolerant fuel system lightning ignition source protection. This amendment removed lightning as an ignition source threat to be assessed under § 25.981 because it was often impractical to show compliance with § 25.981 for lightning in some cases. It also renamed § 25.981 from Fuel tank ignition prevention to Fuel tank explosion prevention.
5 OBJECTIVE.
The objective of this AC is to provide guidance that addresses the prevention of possible sources of ignition in airplane fuel tanks in order to comply with § 25.981, at amendment 25-146. Analytical evaluation of the fuel tank system, including consideration of lessons learned from the service history of transport category airplanes, provides insight into design features that should be carefully considered when determining compliance with the regulations that are intended to prevent ignition sources within fuel tanks.
6 SYSTEM SAFETY ASSESSMENT (SSA).
The preamble to amendment 25-102 states:
This rulemaking also adds a new paragraph (a)(3) to require that a safety analysis be performed to demonstrate that the presence of an ignition source in the fuel tank system could not result from any single failure, from any single failure in combination with any latent failure condition not shown to be extremely remote, or from any combination of failures not shown to be extremely improbable….Compliance with § 25.981 requires an analysis of the airplane fuel tank system using analytical methods and documentation
4 currently used by the aviation industry in demonstrating compliance with §§ 25.901 and 25.1309.
6.1 Before conducting an SSA of the fuel system, each applicant should assemble and review relevant lessons learned from the overall transport fleet history, as described in this AC, as well as from its previous products and suppliers and any other available sources to assist in identifying any unforeseen failures, wear, or other conditions that could result in an ignition source. Sources of information include airplane service records, flight logs, inspection records, and component supplier service and sales records. Guidance relating to the flammability requirements adopted in the amended § 25.981 is provided separately in AC 25.981-2A, Fuel Tank Flammability Reduction Means. Guidance relating to fuel system lightning protection is provided in AC 25.954-1.
6.2 Safety assessments of previously certificated fuel systems may require additional considerations. For these safety assessments, component sales records may assist in identifying if component failures and replacements are occurring. In addition, in some cases, changes to components have been introduced following original type design certification without consideration of the possible effects of the changes on the system’s compliance with the requirements to prevent ignition sources. For example, certain components within fuel pumps (e.g., thrust washer) have been changed to improve pump life, which defeated the original fail-safe features of the pumps. Therefore, results of reviewing this service history information, and a review of any changes to components from the original type design, should be documented as part of the safety analysis of the fuel tank system.
6.3 The following lists summarize design features, malfunctions, failures, and maintenance/operational-related actions that have been identified through service experience as resulting in a degradation of the safety features of airplane fuel tank systems. These lists are provided as guidance and are not inclusive of all failures that need to be considered in the failure assessment. They may assist in evaluating possible failure modes during evaluation of the fuel tank installation.
6.3.1 Pumps.
1. Ingestion of pump inlet components (e.g., inducers, fasteners) into the pump impeller, releasing debris into the fuel tank.
2. Pump inlet case degradation, allowing the pump inlet check valve to contact the impeller.
3. Failure of one phase of the stator winding during operation of the fuel pump motor together with subsequent failure of a second phase of the motor windings, resulting in arcing through the fuel pump housing.
4. Arcing due to the exposure of electrical connections within the pump housing that has been designed with inadequate clearance to the pump cover.
5. Omission of cooling port tubes between the pump assembly and the pump motor assembly during pump overhaul.
6. Extended dry running of fuel pumps in empty fuel tanks (e.g. caused by failure of the fuel pump relay in the on position).
7. Use of steel impellers that may produce friction sparks if debris enters the pump.
8. Debris lodged inside pumps.
9. Pump power supply connectors that have been damaged, worn, or corroded, resulting in arcing within the connector that damages the hermetic seal, causing fuel leakage.
10. Electrical connections within the pump housing that have been designed with inadequate clearance or insulation from the metallic pump housing, resulting in arcing.
11. Thermal switches aging over time, resulting in a higher trip temperature.
12. Flame arrestors falling out of their respective mounting.
13. Internal wires coming in contact with the pump rotating group, energizing the rotor, and arcing at the impeller/adapter interface.
14. Poor bonding across component interfaces.
15. Insufficient arc-fault or ground-fault current protection capability.
16. Poor bonding of components to structure.
17. Loads transferred from the airplane fuel-feed plumbing into the pump housing, resulting in failure of the housing mounts and subsequent failure of the pump case, which defeated the explosion-proof capabilities of the pump.
18. Premature failure of fuel pump thrust bearings allowing steel rotating parts to contact the steel pump side plate.
19. Erosion of the fuel pump housing, causing loss of the fuel pump explosion-proof capability and exposure of fuel pump wiring to the fuel tank.
6.3.2 Wiring to Fuel Pumps.
1. Wear of Teflon or other insulating sleeving and wiring insulation on wires in metallic conduits located inside fuel tanks, allowing arcing from the wire through the conduits into fuel tank ullages.
2. Damage to insulation on wiring routed adjacent to the fuel tank exterior surfaces, resulting in arcing to the metallic fuel tank surface.
6.3.3 Fuel Pump Connectors.
1. Electrical arcing at connections within electrical connectors due to bent pins, wear, manufacturing variability (e.g. tolerances), or corrosion.
2. Fuel leakage and subsequent fuel fire outside of the fuel tank caused by corrosion or wear of electrical connectors to the pump motor, leading to electrical arcing through the connector housing (connector was located outside the fuel tank).
3. Selection of improper insulating materials in connector design, resulting in degradation of the material because of contact with fuel that is used to cool and lubricate the pump motor.
6.3.4 Fuel Quantity Indicating System (FQIS) Wiring.
1. Degradation of wire insulation material (cracking).
2. Conductive or semi-conductive (silver, copper, or cadmium) deposits at electrical connectors inside fuel tanks.
3. Inadequate wire separation between FQIS wiring and structure, or between other wiring, resulting in contact that causes chafing of the wiring.
4. Unshielded FQIS wires routed in wire bundles together with high voltage wires, creating the possibility of short circuit failures on the FQIS wires in excess of intrinsically safe levels.
5. FQIS wiring that does not adhere to the airplane manufacturer’s standard wiring practices (i.e., wires bent back along themselves with bend radius less than defined in the airplane manufacturer’s standard wiring practices, multiple splices lying next to one another, etc.).
6.3.5 FQIS Probe Installation.
1. Conductive or semi-conductive corrosion (copper or silver sulfur deposits) causing reduced breakdown voltage in FQIS wiring.
2. Damage to FQIS wire insulation resulting in reduced breakdown voltage because of wire clamping features at electrical connections on fuel quantity probes.
3. Contamination in the fuel tanks creating an arc path for low levels of electrical energy between FQIS probe walls (steel wool, lock wire, nuts, rivets, bolts, and mechanical impact damage to probes).
6.3.6 Valve Actuators.
Failure of one solenoid in a dual solenoid actuated valve resulting in overheating of one solenoid above the autoignition temperature.
6.3.7 Float Switch Systems.
1. Conduits containing float switch wiring failure due to freezing of water that entered the conduit, allowing fuel leakage into the conduit and along the airplane front spar resulting in an engine tailpipe fire.
2. Float switch wire chaffing observed, which might have provided potential for subsequent electrical short to the conduit.
3. Float switch sealing failure that allowed fuel/water to egress into the switch, compromising switch operation in an explosive environment.
6.3.8 Fuel Tubes, Vent Tubes, Conduits, and Hydraulic Lines.
1. Poorly conducting pipe couplings that may become electrical arc sources when exposed to electric currents.
2. Insufficient clearances between tubes and surrounding structure.
3. Intermittent electrical bonding in flexible couplers.
4. Bonded couplers unable to conduct expected power fault currents without arcing.
6.3.9 Electrical Generator Power Feeder Cables.
1. Arcing of electrical power feeder cables to a pressurized fuel line, resulting in fire adjacent to the fuel tank.
2. Arcing of electrical power feeder cables to aluminum conduit, resulting in molten metal dropping onto a pressurized fuel line and consequently causing pressurized fuel leakage.
6.3.10 Bonding Straps.
1. Corrosion of bonding strap wires resulting in failure to provide required current paths.
2. Inappropriately attached connections (loose or improperly grounded attachment points).
3. Worn static bonds on fuel system plumbing connections inside the fuel tank, due to mechanical wear of the plumbing from wing movement and corrosion.
4. Corrosion of bonding surfaces near fuel tank access panels that could diminish the effectiveness of bonding features.
5. Aging of self-bonding fuel system plumbing connections, resulting in higher resistance bonding.
6. Missing bonds.
7. Loose or intermittent contacts between bond straps and other conductive components.
6.3.11 Pneumatic System Failures.
Leakage of hot air from ducting located near fuel tanks due to duct failure resulting in undetected heating of tank surfaces above the autoignition temperature.
6.3.12 Electrostatic Charge.
1. Use of a non-conductive type of reticulated polyurethane foam in only a portion of the fuel tank system that allowed electrostatic charge build-up and arcing in the unprotected portion of the system.
2. Spraying of fuel through refueling nozzles located at the upper portion of the tank.
8 7 FUEL VAPOR IGNITION SOURCES.
7.1 Overview.
There are four primary phenomena that can result in ignition of fuel vapors within airplane fuel tanks:
Electrical sparks and arcs, Filament heating, Friction sparks, and Autoignition or hot surface ignition.
7.1.1 The conditions required to ignite fuel vapors from these ignition sources vary with pressures and temperatures within the fuel tank and can be affected by sloshing or spraying of fuel in the tank. Due to the difficulty in predicting fuel tank flammability and eliminating flammable vapors from the fuel tank, the regulatory authorities have always assumed that a flammable fuel/air mixture may exist in airplane fuel tanks and have required that no ignition sources be present.
7.1.2 Any components located in or adjacent to a fuel tank must be designed and installed in such a manner that, during both normal and anticipated failure conditions, ignition of flammable fluid vapors will not occur. Compliance with this requirement is typically shown by a combination of component testing and analysis. Testing of components to meet the appropriate level of explosion-proof requirements should be carried out for various single failures, and combinations of failures, to show that arcing, sparking, autoignition, hot surface ignition, or flame propagation from the component will not occur. Testing of components has been accomplished using several military standards and component qualification tests. For example, Method 511.5, Procedures I and II, of Military Standard MIL-STD-810N defines one method that the FAA has accepted for showing that a component is explosion proof as defined in appendix C of this AC.
Section 9 of RTCA DO-160G has also been accepted for showing that airborne equipment is explosion proof.
7.2 Electrical Sparks and Electrical Arcs.
7.2.1 Laboratory testing has shown that the minimum ignition energy in an electrical spark required to ignite hydrocarbon fuel vapor is 200 microjoules.1 Therefore, for electrical or electronic systems that introduce electrical energy into fuel tanks, such as FQIS, any electrical arcs or sparks that are created into any fuel tank should be less than 200 microjoules during either normal operation or operation with failures.
1 The 200-microjoules level comes from various sources. The most quoted is from Lewis and Von Elbe’s book, “Combustion, Flames and Explosions of Gases” (Florida: Academic Press, Inc., 1987; (orig. publ. 1938)). It has a set of curves for minimum ignition energy for the various hydrocarbon compounds in jet fuel, and they all have similar minimum ignition energy levels of around 220 microjoules.