Subject: FUEL TANK IGNITION SOURCE
PREVENTION GUIDELINES Date: 4/18/01 Initiated By: ANM-112 AC No: 25.981-1B Change:
1. PURPOSE. This advisory circular provides guidance for demonstrating compliance with the certification requirements for prevention of ignition sources within the fuel tanks of transport category airplanes. This guidance is applicable to transport category airplanes for which a new, amended, or supplemental type certificate is requested.
2. APPLICABILITY.
a. The guidance provided in this document is directed to airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration transport airplane type certification engineers, and their designees.
b. This material is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. The Federal Aviation Administration will consider other methods of demonstrating compliance that an applicant may elect to present. Terms such as "shall" and "must" are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance described in this document is used.
While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations.
c. This material does not change, create any additional, authorize changes in, or permit deviations from, regulatory requirements.
3. CANCELLATION. Advisory Circular 25.981-1A, Guidelines for Substantiating Compliance with the Fuel Tank Temperature Requirements, dated January 20, 1971, is cancelled.
4. RELATED DOCUMENTS. The following related documents are provided for information purposes and are not necessarily directly referenced in this AC.
a. Federal Aviation Regulations. Sections that prescribe requirements for the design, substantiation, and certification relating to prevention of ignition sources within the fuel tanks of transport category airplanes include:
2 § 21.50 Instructions for continued airworthiness and manufacturer’s maintenance manuals having airworthiness limitations sections.
§ 25.729(f) Protection of equipment in wheel wells.
§ 25.863 Flammable fluid fire protection.
§ 25.901 Installation (Powerplant) § 25.954 Fuel system lightning protection.
§ 25.973 Fuel tank filler connection.
§ 25.981 Fuel tank ignition prevention.
§ 25.1301 Function and installation (Equipment) § 25.1309 Equipment, systems, and installations.
§ 25.1316 System lightning protection.
§ 25.1353 Electrical equipment and installations.
§ 25.1529 Instructions for continued airworthiness Appendix H Instructions for continued airworthiness
b. FAA Directives.
Notice N 8110.71 Guidance for the Certification of Aircraft Operating in High Intensity Radiated Field (HIRF) Environments.
c. Advisory Circulars (AC). You can obtain any of the advisory circulars listed below either electronically from the internet at http://www.faa.gov/avr/air/acs/achome.htm or from the U.S. Department of Transportation, Subsequent Distribution Office, SVC-121.23, Ardmore East Business Center, 3341 Q 75th Avenue, Landover, MD 20785.
AC 25-8 Auxiliary Fuel System Installations AC 20-53A Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Due to Lightning, (see also Users Manual) AC 20-136 Protection of Aircraft Electrical/Electronic Systems against the Indirect Effects of Lightning AC 25-16 Electrical Fault and Fire Prevention and Protection AC 25-19 Certification Maintenance Requirements AC 25.981-2 Fuel Tank Flammability Minimization
d. Society of Automotive Engineers (SAE) Documents. You can obtain the following documents from the Society of Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale, Pennsylvania, 15096.
(1) AIR5128, Electrical Bonding of Aircraft Fuel System Plumbing Systems, January 1997.
(2) APR4754, Aerospace Recommended Practice, Certification Considerations For Highly Integrated or Complex Aircraft Systems.
(3) ARP 4761, Aerospace Recommended Practice, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.
(4) ARP4404, Aerospace Recommended Practice, Aircraft Electrical Systems (guidance document for design of aerospace vehicle electrical systems).
e. Military Specifications.
(1) MIL-B-5087B, System Electrical Bonding.
(2) AS50881, Aerospace Vehicle Wiring (procurement document used to specify aerospace wiring, replaces MIL-W-5088).
(3) MIL-E-5272A - Environmental Testing of Aeronautical & Associated Equipment (Explosion Proof Equipment Qualification Tests).
(4) MIL-STD-810E, Method 511.3, Explosive Atmosphere, dated September 1, 1993.
f. Other.
(1) RTCA Document DO-160D, Environmental Conditions and Test Procedures for Airborne Equipment.
(2) International Electrotechnical Commission (IEC), IEC60079-11, Electrical Apparatus for Explosive Gas Atmospheres.
(3) Underwriters Laboratories Inc., UL 913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations.
(4) FAA Transport Airplane Directorate Designee Newsletter, Edition 15, February 1993. Article, Electrical Wiring used in Commercial Transport Airplanes.
(5) FAA Regulatory Support Division (AFS-500 or -600), Oklahoma City, Project 414- 76a (01603), Explosion Potential for Electrical Items in Fuel Tanks.
(6) FAA Document DOT/FAA/AR-98/26, Review of the Flammability Hazard of Jet A Fuel Vapor in Civil Transport Aircraft Fuel Tanks, June 1998.
(7) Kuchta, Joseph M., Summary of Ignition Properties of Jet Fuels and Other Aircraft Combustible Fluids, Air Force Aero Propulsion Laboratory Technical Report AFAPL-TR-75-70, U.S. Bureau of Mines PMSRC, 1975.
5. DEFINITIONS.
a. Auto-ignition temperature. The minimum temperature at which an optimized flammable vapor and air mixture will spontaneously ignite.
b. Auxiliary Tanks. Fuel tanks installed which make additional fuel available for increasing the flight range of that airplane. The term “auxiliary” means that the tank is secondary to the airplane’s main fuel tanks; i.e., the functions of the main tanks are immediately available and operate without immediate supervision by the flightcrew in the event of failure of inadvertent depletion of fuel in an auxiliary tank. Auxiliary tanks are usually intended to be emptied of usable fuel during flight and have been installed in various locations including center wing structure, horizontal stabilizers, wings and cargo compartments.
c. Critical Design Configuration Control Limitations. Limitations that define those parameters of the design that must be maintained to ensure that ignition sources will not develop within the fuel tank.
d. Electrical Arc or Spark. The transfer of electrons across a gap.
e. Explosion Proof. Components designed and constructed so they will not ignite flammable vapors or liquids surrounding the component, under any normal operating and anticipated failure condition.
f. Flammable. Flammable, with respect to a fluid or gas, means susceptible to igniting readily or to exploding (14 CFR Part 1, Definitions). Further information on flammable fluids used in airplanes may be found in the documents identified in paragraph 4f of this AC.
g. Flash point. The flash point of a flammable fluid is defined as the lowest temperature at which the application of a flame to a heated sample causes the vapor to ignite momentarily, or "flash." The test standard for jet fuel is defined in the fuel specification.
h. Friction Spark. A heat source in the form of a spark that is created by mechanical contact, such as debris contacting a rotating fuel pump impeller.
i. Hot Short. Electrical energy introduced into equipment or systems as a result of unintended contact with a power source, such as bent pins in a connector or damaged insulation on adjacent wires.
j. Ignition source. A source of sufficient energy to initiate combustion of the fluid.
Surfaces that can exceed the auto-ignition temperature of the fluid under consideration are
5 considered to be an ignition source. Electrical arcs and friction sparks are also common ignition sources.
k. Installation Appraisal. A qualitative appraisal of the integrity and safety of the installation.
l. Intrinsically Safe. Any instrument, equipment, or wiring that is incapable of releasing sufficient electrical or thermal energy under normal operating or anticipated failure conditions to cause ignition of a specific hazardous atmospheric mixture in the most easily ignited concentration.
m. Latent Failure. A failure whose presence may not be readily apparent to the flightcrew or maintenance personnel. A significant latent failure is one that would, in combination with one or more specific failures or events, result in a hazardous or catastrophic failure condition.
n. Maximum allowable surface temperatures. There is a general industry/FAA practice that a maximum allowable surface temperature that provides a safe margin under all normal or failure conditions is at least 50°F below the lowest expected auto-ignition temperature of the approved fuels. The auto-ignition temperature of fuels will vary because of a variety of factors (ambient pressure, dwell time, fuel type, etc.), but the value generally accepted without further substantiation for kerosene type fuels, such as Jet A, under static sea level conditions, is 450°F.
This results in a maximum surface temperature of approximately 400°F for an affected component or surface.
o. Qualitative. Those analytical processes that assess system and airplane safety in an objective, non-numerical manner.
p. Quantitative. Those analytical processes that apply mathematical methods to assess system and airplane safety.
q. Transient Suppression Device (TSD): A device that limits electrical signals that enter fuel tanks on fuel tank gauging system wires to intrinsically safe levels.
6. BACKGROUND.
a. Regulatory History.
(1) The regulatory standards of part 25 require that ignition sources not be present or develop in the fuel tanks of transport airplanes. Amendment 25-11, effective May 5, 1967, introduced § 25.981, Fuel tank temperature. This requirement was prompted by a need for protection of airplane fuel tanks from possible ignition sources because of advances in electrical system sealing. These advances made it possible to place electrical system components, such as pumps and fuel gauging elements, as well as the wiring to these components, in immersed locations within fuel tanks. Additionally, fuel tank walls were subject to local "hot spots" by the
6 proximity of airplane equipment and compressor bleed air ducts that carry air at high temperatures.
(2) The need for a regulation was further demonstrated by the possibility that the surface temperature of the fuel tank internal wall, or the fuel system components within the fuel tank, could exceed the auto-ignition temperature. Section 25.981, as originally adopted, focused on preventing ignition of fuel vapors in the fuel tanks from hot surfaces. In addition, it required that the applicant determine the highest temperature allowable in fuel tanks that provided a safe margin below the lowest expected auto-ignition temperature of the fuel approved for use in the fuel tanks. In addition, this regulation established a requirement that no temperature at any place inside any fuel tank where fuel ignition is possible may then exceed that maximum allowable temperature.
(3) Other sections of part 25 require that ignition from lightning be prevented (§ 25.954), as well as ignition from failures in the fuel system (§ 25.901). Applicants have been required by § 25.901 to complete a safety assessment of the fuel system and show that “no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane....” However, service history has shown that ignition sources have developed in airplane fuel tanks due to unforeseen failure modes or factors that were not considered at the time of original certification of the airplane, including arcs, sparks, or hot surfaces within the fuel tanks.
b. Advisory Circular 25.981-1A, Guidelines for Substantiating Compliance with the Fuel Tank Temperature Requirements, published in 1972, provided guidance that included failure modes that to be considered when determining compliance with the fuel tank temperature requirements defined in § 25.981. This regulation focused on preventing ignition of fuel vapors in the fuel tanks from hot surfaces. The AC also recommended a minimum 50°F temperature margin below the lowest auto-ignition temperature of the approved fuels.
c. Amendment 25-102, issued on April 18, 2001, renamed § 25.981 as Fuel Tank Ignition Prevention, and added new requirements to address causes of ignition sources within fuel tanks and minimization of the development of flammable vapors in the fuel tanks or mitigation of the effects of an ignition of vapors in the tanks. The new ignition source prevention standard requires a safety assessment of the fuel tank system that includes:
• consideration of single failures,
• probable combinations of failures,
• development of long-term instructions for continued airworthiness, and
• maintainability of the airplane fuel tank system
d. Special Federal Aviation Regulations (SFAR) No. 88, promulgated by Amendment No.
21-78, also issued on April 18, 2001, requires a one-time reassessment of the fuel tank systems of many in service transport airplanes per the ignition source prevention requirements of § 25.901 and the amended § 25.981.
e. The purpose of this AC is to provide guidelines that address precluding possible sources of ignition in airplane fuel tanks. Analytical evaluation of the fuel tank system, including consideration of lessons learned from the transport airplane service history, provide insight into design features that should be carefully considered when determining compliance with the regulations that are intended to preclude ignition sources within fuel tanks. Prior to conducting a fuel system safety assessment, each applicant should assemble and review relevant lessons learned from their previous products, their suppliers, and any other available sources, to assist in identifying any unforeseen failures, wear, or other conditions that could result in an ignition source. Sources of information include airplane service records, flight logs, inspection records, and component supplier service and sales records. Guidance relating to the flammability requirements adopted in amended § 25.981 is provided separately in AC 25.981-2, Fuel Tank Flammability Minimization.
f. Safety assessments of previously certificated fuel systems may require additional considerations. For retroactive safety assessments, component sales records may assist in identifying if component failures and replacement are occurring. In addition, in some cases changes to components have been introduced following original type design certification without consideration of the possible effects of the changes on the system’s compliance with the requirements to preclude ignition sources. For example, certain rotating components and static parts within fuel pumps have been changed to steel to improve pump life, which defeated the original fail-safe features of the pumps because steel components introduce the possibility of sparks being generated when contacted by adjacent components or debris within the pump.
Therefore, results of reviewing this service history information, and a review of any changes to components from the original type design, should be documented as part of the safety analysis of the fuel tank system.
g. The following list summarizes fuel tank system design features, malfunctions, failures, and maintenance related actions that have been identified through service experience as resulting in a degradation of the safety features of airplane fuel tank systems. They may assist in evaluating possible failure modes during evaluation of the fuel tank installation.
Pumps:
• Ingestion of pump inlet components (e.g. inducer, fasteners) into the pump impeller releasing debris into the fuel tank.
• Pump inlet case degradation, allowing the pump inlet check valve to contact the impeller.
• Failure of one phase of the stator winding during operation of the fuel pump motor together with subsequent failure of a second phase of the motor windings, resulting in arcing through the fuel pump housing.
• Arcing due to the exposure of electrical connections within the pump housing that have been designed with inadequate clearance to the pump cover.
• Omission of cooling port tubes between the pump assembly and the pump motor assembly during pump overhaul.
• Extended dry running of fuel pumps in empty fuel tanks, which was contrary to the manufacturer’s recommended procedures.
• Use of steel impellers that may produce sparks if debris enters the pump.
• Debris lodged inside pumps.
• Pump power supply connectors have corroded resulting in fuel leakage and electrical arcing.
• Electrical connections within the pump housing have been designed with inadequate clearance or insulation from the metallic pump housing resulting in arcing.
• Thermal switches aging over time resulting in a higher trip temperature.
• Flame arrestors falling out of their respective mounting.
• Internal wires coming in contact with the pump rotating group, energizing the rotor and arcing at the impeller/adapter interface.
• Poor bonding across component interfaces.
• Insufficient ground fault current protection capability.
• Poor bonding of components to structure.
• Loads from the airplane fuel feed plumbing were transferred into the pump housing resulting in failure of the housing mounts and subsequent failure of the pump case, which defeated the explosion proof capabilities of the pump.
• Premature failure of fuel pump thrust bearings allowing steel rotating parts to contact the steel pump side plate.
Wiring to fuel pumps:
• Wear of Teflon sleeving and wiring insulation on wires in metallic conduits located inside fuel tanks, allowing arcing from wire through the conduits into fuel tank ullages.
• Damage to insulation on wiring routed adjacent to the fuel tank exterior surfaces that resulted in arcing to the metallic fuel tank surface.
Fuel Pump Connectors:
• Electrical arcing at connections within electrical connectors due to bent pins or corrosion.
• Fuel leakage and subsequent fuel fire outside of the fuel tank caused by corrosion of electrical connectors inside the pump motor which lead to electrical arcing through the connector housing (connector was located outside the fuel tank).
• Selection of improper insulating materials in connector design resulting in degrading of the material because of contact with fuel that is used to cool and lubricate the pump motor.
Fuel Quantity Indicating System (FQIS) Wiring:
• Degradation of wire insulation (cracking) and corrosion (copper or silver sulfur deposits) at electrical connectors.
• Conductive or semi-conductive corrosion deposits (sulfide deposits) at electrical connectors inside fuel tanks.
• Unshielded FQIS wires routed in wire bundles together with high voltage wires, creating the possibility of short circuit failures or induced current on the FQIS wires in excess of intrinsically safe levels.
FQIS Probes:
• Conductive or semi-conductive corrosion (copper or silver sulfur deposits) causing reduced breakdown voltage in FQIS wiring.
• Damage to FQIS wire insulation resulting in reduced breakdown voltage as a result of wire clamping features at electrical connections on fuel quantity probes.
• Contamination in the fuel tanks creating an arc path for low levels of electrical energy between FQIS probe walls (steel wool, lock wire, nuts, rivets, bolts, and mechanical impact damage to probes).
Bonding Straps:
• Corrosion of bonding strap wires resulting in failure of wires.
• Inappropriately attached connections (loose or improperly grounded attachment points).
• Static bonds on fuel system plumbing connections inside the fuel tank worn due to mechanical wear of the plumbing from wing movement, and corrosion.
• Corrosion of bonding surfaces near fuel tank access panels that could diminish the effectiveness of bonding features.
• Aging of self-bonding fuel system plumbing connections resulting in higher resistance bonding.
Pneumatic System Failures:
• Leakage of air from ducting located near fuel tanks due to duct failure resulting in undetected heating of tank surfaces above the auto-ignition temperature.
Electrostatic Charge:
• Use of non-conductive reticulated polyurethane foam that holds electrostatic charge build up.
• Spraying of fuel into fuel tanks through inappropriately designed refueling nozzles
• Spraying of fuel into fuel tanks from fuel pump motor cooling flow return ports that spray fuel into the tank.
7. FUEL TANK IGNITION SOURCES.
a. There are four primary phenomena that can result in ignition of fuel vapors from within airplane fuel tanks:
• electrical arcs,
• filament heating
• friction sparks, and
• hot surface ignition or auto-ignition
(1) The conditions required to ignite fuel vapors from these ignition sources vary with pressures and temperatures within the fuel tank and can be affected by sloshing or spraying of fuel in the tank. Due to the difficulty in predicting fuel tank flammability and eliminating flammable vapors from the fuel tank, the regulatory authorities have always assumed that a flammable fuel air mixture may exist in airplane fuel tanks and have required that no ignition sources be present.
(2) Any components located in or adjacent to a fuel tank must be qualified to meet standards that assure, during both normal and anticipated failure conditions, that ignition of flammable fluid vapors will not occur. This is typically accomplished by a combination of component testing and analysis. Testing of components to meet explosion-proof requirements is carried out for various single failures, and combinations of failures, to show that arcing, sparking, auto-ignition, or flame propagation from the component will not occur. Testing of components has been accomplished using several military standards and component qualification tests. For example, military standard MIL-STD-810, Method 511, Procedure I and II, defines one method that has been accepted for demonstrating that a component is explosion proof. Section 9 of RTCA Document DO 160D has also been accepted for demonstrating that electronic equipment is explosion proof.
b. Electrical Arcs. Laboratory testing has shown that the minimum spark ignition energy required to ignite hydrocarbon fuel vapor is 200 microjoules. For electronic systems that introduce electrical energy into fuel tanks, such as fuel quantity indicating systems, the energy introduced into any fuel tank by a fully operational system should be limited to a value that assures the 200 microjoule limit is not exceeded during both normal and failure conditions with an appropriate safety margin. Electrical transients with the potential to create sparks in the fuel tank should be limited to less than 200 microjoules. (Electrical transient amplitudes less than 40 volts may be considered less than the potential required to create sparks.) In addition, to ensure that the design has adequate reliability and acceptable maintenance intervals, a factor of safety should be applied to this value when establishing a design limit. For example, a maximum of 20 microjoules is considered intrinsically safe for fuel quantity indicating systems.
c. Filament Heating Energy Limit. Analyses and testing indicate a small piece of wire from steel wool can ignite jet fuel when a current of 30 to 40 milliamperes root-mean-square (RMS) is applied to the wire. Therefore, electrical power with the potential to create a filament heating ignition source in the fuel tank should be limited to less than 30 milliamperes RMS. In
11 addition, to ensure that the design has adequate reliability and acceptable maintenance intervals, a factor of safety should be applied to this value when establishing a design limit.
d. Friction Sparks. Service experience has shown that pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, sealant, lockwire, etc. have been inducted into fuel pumps and contacted the impeller. This condition could result in creation of friction sparks and should be an assumed failure condition when conducting the system safety assessment.
e. Hot Surface Ignition.
(1) Flammable Fluid Properties. Fuels approved for use on transport category airplanes have differing flammability characteristics. The autoignition temperature of JP-4, as determined by ASTM Test Method D286, is approximately 468°F at one atmosphere of pressure. By this method of testing, under the same atmospheric conditions the autoignition temperature of JET A (kerosene) is approximately 450°F, and of gasoline, approximately 800°F. The autoignition temperature of these fuels varies inversely with the ambient pressure. In view of this, factors affecting the pressure in the fuel tank should be taken into consideration when determining compliance with § 25.981.
(2) Maximum Surface Temperature. Guidance provided in AC 25-8, Auxiliary Fuel System Installations, defines surfaces that come within 50 degrees of the auto-ignition temperature of the fuel air mixture for the fluid as ignition sources. The FAA has approved installations, which experience surface temperatures in excess of 400°F. Manufacturers have substantiated that the conditions (ambient pressure, dwell time, fuel type, etc.) within fuel tanks are such that a higher value may be used. For example, a maximum allowable fuel tank surface temperature of 400°F, with a transient excursion up to 450°F for a maximum of two minutes, has been approved. The excursion above 400°F occurs only during failure conditions such as failure of the engine pneumatic system to regulate temperature, or duct rupture. Approval of these elevated temperatures has been based on compensating design features, such as an overtemperature shutoff of the pneumatic system so that the temperature cannot exceed the accepted 450°F value.
8. DESIGN CONSIDERATIONS.
a. Accepted Design Practices for Minimizing Ignition Sources. The number of components and systems inside airplane fuel tanks whose failure could result in an ignition source within the fuel tank should be minimized. For example:
(1) Fiber Optics. Wiring entering the tank for such purposes as temperature monitoring and fuel quantity indication should be minimized. Use of new technology, such as fiber optics, may provide a means of reducing or eliminating electrical powered components from inside the fuel tanks.
(2) Routing Of Pump Power Supply. If practical, fuel pumps should be located such that electrical power for the pumps is routed outside the fuel tanks in such a manner that failures in the electrical power supply cannot create a hot spot inside the tank or arc into the fuel tank.
NOTE: Structural considerations and fuel-feed system performance may make it impractical to locate the fuel pumps such that all wiring is routed outside the fuel tank.
(3) Pump Inlet. Another design practice that should be considered is locating fuel pumps such that the pump inlet remains covered with fuel throughout the airplane operating envelope.
(a) Main Feed Tanks. Installation of baffles in tank structure and use of collector tanks that are continually filled with fuel using ejector pumps are methods that have proven successful at keeping the pump inlets and pump housings submerged in fuel.
(b) Auxiliary Tanks. For auxiliary tanks that utilize motor driven fuel pumps and the tank is routinely emptied, accepted design practices include shutting off the motor driven pumps prior to uncovering the fuel pump inlet and installation of a flame arrestor in the scavenge pump inlet line, or scavenging the remaining fuel with ejector pumps. These methods should be effective under pitch and role attitudes, and negative G conditions, anticipated to occur in service, but not when the main fuel tank quantity is deplete during fuel exhaustion conditions.
(4) Wiring.
(a) Intrinsically Safe. All wiring that is intended to conduct intrinsically safe levels (see paragraph 7b) of power into equipment located in the fuel tanks should incorporate protective features such as:
1 Separation of the fuel tank wires from higher energy carrying wires and shielding of the fuel tank wires; or 2 Installation of transient suppression devices, to preclude unwanted electrical energy from entering the tank.
These features should be provided unless it can be shown that an ignition source could not develop assuming the existence of contamination, corrosion, damage to probes, or other latent failures, including maintenance errors.
(b) Higher Energy Wiring.
1 Wiring should not be routed through metallic conduit or adjacent to fuel tank surfaces such that damage, inappropriate maintenance, or other failure/wear conditions could result in arcing to the conduit or metallic tank surface and development of an ignition source in the fuel tank. If metallic or other conductive conduit materials are used, the single failure of electrical arcing of the wiring to the conduit, adjacent tank surfaces, or structure should