13 be assumed to occur. In addition, circuit protective features or other features should be incorporated to preclude development of an ignition source in the fuel tank. Methods that may be used to address this foreseeable failure condition include the use of circuit protective features such as dual conduits, thick wall conduit, and/or fast-acting ground fault interrupter (GFI) circuit breakers.
2 Where electric wires are routed through conduits installed in a fuel tank, high surface temperatures or arcing though the conduit wall can be created by short circuits. All wiring conducting power (e.g. fuel pump power supply, fuel level sensor, etc.) into or through a fuel tank should be evaluated assuming arcing to adjacent surfaces such as metallic conduits or wing surfaces, unless fail-safe protective features are provided. A critical electrical wiring condition might be one in which the insulation is worn, cracked, broken, or of low dielectric strength, allowing intermittent or constant arcing to occur without consuming enough power to cause the circuit protection device to open. Inspection of wiring from in-service airplanes has shown that greater than expected wear may occur on sleeving and wiring insulation due to movement of the wire within the conduit. Roughness of the conduit material and variations in vibrations levels for each installation may significantly increase wear. In addition, inspections have shown that protective sleeving has been missing, improperly installed, or the wrong sleeving material used, resulting in damage to the insulation. The design should be tolerant to these types of foreseeable failure or maintenance errors.
(c) Circuit Breakers. Service experience has indicated that circuit breakers installed in the fuel pump circuits have not been shown to preclude arcing of electrical wiring through metallic barriers such as conduit or the tank wall into the fuel tank on some airplane designs. Evidence suggests that arcing from the wiring to metallic surfaces may not result in a hard short, which would trip the circuit breaker and may result in intermittent low level arcing that gradually arcs through the metallic barrier into the fuel tank. The design and routing of electrical wiring should be carefully evaluated to assure the design is, in fact, fail-safe.
(d) Use of Metallic Conduit. Advisory Circular 25-8 addresses the use of metallic conduit as an acceptable means for routing of electrical power within airplane fuel tanks. As indicated by service experience, these past practices would not meet the fail-safe requirements of § 25.981 unless additional fail-safe features were incorporated. Therefore, the guidance in AC 25-8 will be revised.
(e) Use of Non Metallic Conduit. If nonmetallic conduit is used, compatibility with fuel should be demonstrated. Aging due to heat, corrosion at the connecting fittings, and resistance to heat damage from internal shorts of wires routed within the conduit, should be evaluated.
b. Spark Energy Limit Margins. The electrical energy that enters a fuel tank is considered intrinsically safe if it is limited to less than the spark energy and filament heating energy limits previously provided. These values should not be exceeded under the single and multiple failure conditions as defined in the regulation. This may result in the need for the actual limits used for a design to include a factor of safety applied to each of these limits. The factor of safety provides
14 additional margin to ensure that when failures and malfunctions are considered, the design has adequate reliability and ensures continued safe operation between normal inspections or overhauls. The design limit used by the applicant for the design with no failures or malfunctions present, and the design limit used for the design with consideration for failures or malfunctions, should be stated in the compliance documentation.
9. SAFETY ANALYSIS.
a. Ignition Source Failure Analysis. Compliance with § 25.981 and SFAR No. 88 require each applicant to develop a failure analysis for the fuel tank installation to substantiate that ignition sources will not be present in the fuel tanks. The requirements of this section are in addition to the more general propulsion failure analyses requirements of §§ 25.901 and 25.1309 that have been applied to propulsion installations.
(1) Section 25.981(a)(3) defines three failure scenarios that must be addressed in order to show compliance with the rule:
• Each single failure, regardless of the probability of occurrence of the failure, must not cause an ignition source.
• Each single failure, regardless of the probability of occurrence, in combination with any latent failure condition not shown to be at least extremely remote (i.e., not shown to be extremely remote or extremely improbable), must not cause an ignition source.
• All combinations of failures not shown to be extremely improbable must not cause an ignition source.
(2) Compliance with § 25.981 (Amdt. 25-102) requires analysis of the airplane fuel tank system using analytical methods and documentation currently used by the aviation industry in demonstrating compliance with §§ 25.901 and 25.1309 with consideration of unique requirements included in the amendment.
(3) Advisory Circular 25.1309, System Design and Analysis, describes methods for completing system safety assessments (SSA). An assessment may range from a simple report that offers descriptive details associated with a failure condition, interprets test results, compares two similar systems, or offers other qualitative information, to a detailed failure analysis that may include estimated numerical probabilities. The depth and scope of an acceptable SSA depend upon:
• the complexity and criticality of the functions performed by the system under consideration,
• the severity of related failure conditions,
• the uniqueness of the design and extent of relevant service experience,
• the number and complexity of the identified causal failure scenarios, and
• the detectability of contributing failures.
NOTE: Sections 25.981 and 25.901 are intended to address system failures that may result in the presence of an ignition source in the fuel tanks. These regulations are not intended to address failures or conditions that could lead to ignition of fuel vapors from such sources as:
• uncontained engine debris,
• external engine fires following engine separation or failure,
• damage resulting from explosive materials, such as bombs,
• post crash fire heating of tank surfaces, or
• propagation of fire through the airplane vent system into the fuel tanks.
These hazards are addressed by other regulations.
b. Qualitative Safety Assessment.
(1) Typical airplane fuel tank systems have a limited number of possible ignition sources. Figure 1 shows causes of ignition sources and methods that may be used to meet the fail-safe requirements. The level of analysis required to show that ignition sources will not develop will depend upon the specific design features of the fuel tank system being evaluated.
Detailed quantitative analysis should not be necessary if a qualitative safety assessment shows that features incorporated into the fuel tank system design protect against the development of ignition sources within the fuel tank system. For example, if all wiring entering the fuel tanks and their associated line replaceable units were shown to have protective features such as separation (including circuit separation in the LRU) and shielding and/or transient suppression/energy limiting devices, the portion of the compliance demonstration for the associated wiring would be limited to demonstrating the effectiveness of the features and defining any long-term maintenance requirements or critical design configuration control limitations so that the protective features are not degraded.
(2) Another example would be installation of a flame arrestor in the inlet line to a fuel pump. The compliance demonstration for the fuel pump may be limited to showing that the arrestor was effective at precluding propagation of the flame from the pump back down the inlet line into the tank, and showing that any anticipated failures or events could not violate the explosion-proof features of the pump assembly. In addition, revalidation of the fuel system to other regulations (e.g., icing and reduced flow due to contamination) would be required if modifications were incorporated to the fuel feed system. It may also be possible to show that fuel pumps installed such that the fuel pump inlet remains covered whenever the fuel pump is operating throughout the airplane operating attitude envelope, including anticipated low fuel operations and ground conditions, would be a satisfactory method of meeting the fail-safe requirement. The SSA criteria, process, analysis methods, validation, and documentation should be consistent with the guidance material provided in AC 25.1309 utilizing the unique guidance specific to the fuel tank system as defined in this AC.
16 Figure 1: Fuel Tank System Fail-Safe Feature Considerations
c. Assumptions and Considerations for Fuel Tank System Analysis. The analysis should be conducted based upon the following assumptions:
(1) Fuel Tank Flammability. The analysis should assume that the environment inside the fuel tank is always flammable. The conditions required to ignite fuel vapors from ignition sources vary with pressures and temperatures within the fuel tank and can be affected by sloshing or spraying of fuel in the tank. Due to the difficulty in predicting fuel tank flammability, the FAA has always assumed that a flammable fuel air mixture exists in airplane fuel tanks and has required that no ignition sources be present. The system safety analysis should be prepared considering all airplane in-flight, ground, service, and maintenance conditions, assuming that an explosive fuel air mixture is present in the vapor space of fuel tanks at all times, unless the fuel tank has features that mitigate the effects of tank ignition (e.g., polyurethane foam).
(2) Intrinsically Safe. Failures that create energy levels inside fuel tanks above intrinsically safe levels are considered to be an ignition source.
Fuel Tank Ignition Source Consideration Wiring Routed Outside of Tank Pump Housing Burnthrough Protected Arc/Ground Fault Circuit Protection Fault Protected Electrical Power Flame arrestor in motor driven scavenge pump Ejector pump Scavenge Pump Inlet Covered Auxiliary Tank Pump Inlet Covered Main Feed Tank Impeller/Inlet PUMPS Separated & Shielded Transient Protection Isolation Fuel Quantity Transmitter Fault Protected Fuel Quantity Indication Temperature Probe Fuel Level Sensor
ELECTRICAL
COMPONENTS Periodic Integrity Check Redundant Bond Paths- ELECTROSTATIC or
LIGHTENING Ignition Source Present In Fuel Tank
(3) Failure Condition Classification. Unless design features are incorporated that mitigate the hazards resulting from a fuel tank ignition event (e.g. polyurethane foam, adequate structural margin), the SSA should assume that the presence of an ignition source is a catastrophic failure condition.
(4) Latent Failures.
(a) In order to eliminate any ambiguity as to the restrictions on latent failures, § 25.981(a)(3) explicitly requires that any anticipated latent failure condition not leave the airplane one failure away from a catastrophic fuel tank ignition. In addition to this § 25.981(a)(3) limitation on latency, § 25.1309(c) limits latent failure conditions to those that do not create an “unsafe system operating condition.” Consequently, if a latent failure condition is not extremely remote (i.e., it is anticipated to occur) and it creates an “unsafe system operating condition,” then “warning information must be provided to alert the crew” and “to enable them to take appropriate corrective action.” These applicable regulatory restrictions on latency notwithstanding, there are practical limitations on the available means of compliance. For example, detecting a failure condition requires a finite period of time and there are not always “appropriate corrective actions” that can be taken during the flight. Consequently, for the purposes of compliance with § 25.981(a)(3), the period of latency for any anticipated significant latent failure condition should be minimized and not allowed to exceed one flight cycle. For the purposes of § 25.1309(c) compliance, any time the airplane is operating one failure away from a catastrophic fuel tank ignition should be considered an “unsafe system operating condition,” recognizing that sometimes the only “appropriate corrective action” is to continue on to your destination but not to initiate another flight without making appropriate repairs.
(b) Another practical limitation on the available means of compliance is the technological feasibility of providing inherent failure detection within the design for all significant failures. Sometimes periodic inspection is the only practicable means of reliably detecting a failure condition. Consequently, when such inspections are used as the means of detection, the inspection method and frequency must be sufficient to conclude that the occurrence of the significant latent failure condition is extremely remote. If the effectiveness of the inspection method is judged susceptible to human error, the procedure should be made a required inspection item (RII). (See 14 CFR 121.369(b) for considerations of a "required inspection item.")
(5) Failure Conditions. When showing compliance with § 25.981(a)(3), the effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered. For the purpose of compliance with § 25.981, “extremely remote” failure conditions are those not anticipated to occur to each airplane during its total life, but which may occur a few times when considering the total operational life of all airplanes of one type. This definition is consistent with that developed by the Aviation Rulemaking Advisory Committee (ARAC) for a revision to FAA AC 25.1309-1A, and that currently used by the Joint Aviation Authorities (JAA) in ACJ 25.1309. “Extremely improbable” failure conditions are those so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. This definition
18 is consistent with the definition provided in FAA AC 25.1309-1A and retained in the draft revision to AC 25.1309-1A proposed by the ARAC.
(a) The analysis should be conducted considering the deficiencies and anomalies listed in paragraph 6(g) of this AC, failure modes identified by the review of service information (including review of supplier service data), and any other failure modes identified by the functional hazard assessment of the fuel tank system. For example, the presence of conductive debris such as lockwire, steel wool, nuts, bolts, rivets etc., should be assumed. Section 25.981 specifically requires that the effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered when demonstrating compliance.
(b) The level of manufacturing variability, aging, wear, corrosion, and likely damage that must be considered should be determined based upon evaluation of the detectability of degraded or out-of-specification configurations, and established and documented within the analysis. In-service and production functional tests, component acceptance tests, and maintenance checks may be used to substantiate the degree to which these states must be considered. For example, inspection of fuel tank system bonding on production airplanes has shown that some bonds were inadequate. Functional testing of all bonding was incorporated to address this deficiency. In some cases (e.g., component bonding or ground paths), a degraded state will not be detectable without periodic functional test of the feature. For these features, inspection/test intervals should be established based on previous service experience on equipment installed in the same environment. If previous experience on similar or identical components is not available, conservative initial inspection/test intervals should be established until design maturity can be assured.
(6) External Environment. The severity of the external environmental conditions that should be considered when demonstrating compliance with § 25.981 are those established by certification regulations and special conditions (e.g., HIRF, lightning), regardless of the associated probability of exposure to any external environment. For example, the probability of lightning encounter should be assumed to be one.
(7) External Sources of Tank Auto-ignition. The possibility of fuel tank ignition due to auto-ignition sources created by external tank heating should be considered. This includes heating of the tank due to operation or failure of systems outside the tank within both the pressurized and unpressurized areas of the airplane, such as overloaded electric motors or transformers, failures in the pneumatic system and/or ducting that could cause localized heating of tank surfaces. In addition, the possibility of localized heating due to external fires must be considered. Section 25.967(e) requires that, “Each fuel tank must be isolated from personnel compartments by a fume proof and fuel proof enclosure.” Leakage of fuel or vapor into spaces adjacent to the fuel tank, where a secondary fuel and fume proof barrier is not provided, has typically been assumed for areas such as:
• the wing leading and trailing edges,
• fairings located below the fuel tanks,
• fuel pump enclosures, and
• unpressurized areas of the fuselage surrounding fuel tanks located in the empennage.
Components located in these areas have been required to meet explosion proof requirements.
These components or systems must be included in the analysis. Examples of equipment include, but are not limited to, ECS packs, motors, power assisted valves, fuel pumps, hydraulic pumps/motors, certain flight control actuators, ECS controls, and valves.
(8) Electrical Ignition Sources. The applicant should perform a failure analysis of all fuel systems and sub systems with wiring routed into fuel tanks. Systems that should be considered include fuel pump power and control and indication, fuel quantity indication, fuel temperature indication, fuel level sensors, and any other wiring routed into or adjacent to fuel tanks. The analysis should consider system level failures, failures within line replaceable units (LRU) and component level failures discussed below. The analysis should include existence of latent failures and subsequent failures that may lead to an ignition source within the fuel tank.
Examples include undetected failures of tank components or wiring, the undetected presence of conductive debris, damage to FQIS or level sensor probes, or corrosion (copper or silver sulfur), in combination with external failures such as hot shorts or induced transients (EMI and lightning). In addition, the applicant should provide a description of the protective means employed in the fuel system wiring. This should include a description of features such as separation/segregation, transient suppression devices, and shielding of wiring and methods employed to maintain configuration control of critical wiring throughout the life of the airplane.
NOTE: EMI protection is often a function of circuit and surrounding structural characteristics. Therefore care should be taken when determining the effects of exposing a system with faults present to some EMI threat, especially lightning.
(9) Electrical Short-Circuits.
(a) Incorporation of protective features that mitigate the effects of electrical shortcircuits that could occur outside the fuel tanks, such as separation of fuel tank wires and circuits from electrical power wires and circuits, combined with shielding between wiring that enters fuel tanks and any electrical power-carrying wires in the aircraft installation, has been used on certain airplane types to provide a fail-safe design with respect to electrical shorts. The effects of electrical short circuits, including hot shorts, on equipment and wiring that enters the fuel tanks should be considered, particularly for the fuel quantity indicating system wiring, fuel level sensors, and probes. Latent failures from factors such as contamination, damage/pinching of wires during installation, or corrosion on the probes, connectors, or wiring should be considered when evaluating the effects of short circuits. The wire routing, shielding, and segregation outside the fuel tanks, including within the FQIS components (e.g., gaging units), should also be considered when evaluating the effects of short circuits. The evaluation should consider both electrical arcing and localized heating that may result from short circuits on equipment, fuel quantity indicating system probes, and wiring. The evaluation of electrical short circuits should include consideration of shorts within electrical equipment, and wiring from the equipment into
20 the fuel tank. Prevention of fuel ignition from electrical shorts to wiring that enters fuel tanks may require specific wire and circuit separation and wire bundle shielding.
(b) Another method that has been proposed to provide protection of circuits that enter fuel tanks from electrical short circuits is the installation of a transient suppression device on the circuit close to the point where those wires enter fuel tanks
(10) Line Replacement Unit (LRU) Design Evaluation. Line replaceable units include any components that can be replaced while the airplane remains in operational service.
Examples of fuel system LRU’s include components such as cockpit and refueling panel fuel quantity indicators, fuel quantity system processors, and fuel system management control units.
The design review should include evaluation of the separation and/or protective features incorporated into any fuel system LRU whose failure could result in high level electrical power entering the fuel tank. Any LRU that meets the design requirements identified in reference (3), paragraph 4f, of this AC, Underwriters Laboratories Inc., UL 913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations, would provide adequate separation of the power sources within the LRU.
(11) Electromagnetic Effects, including Lightning, Electromagnetic Interference (EMI), and High-Intensity Radiated Fields (HIRF).
(a) The effects of electrical transients from lightning, EMI, or HIRF on anything conductive (e.g. fuel tank plumbing, structure, fuel, equipment and wiring) within the fuel tanks should be considered, particularly for the fuel quantity indicating system wiring and probes.
Latent failures from factors such as contamination, damage, or corrosion on the probes or wiring should be considered when evaluating the effects of electrical transients. The wire routing, shielding, and segregation of conductors (e.g. plumbing, component casings, wiring, etc.) outside the fuel tanks should also be considered when evaluating the effects of electrical transients, because the transient generation and coupling to conductors may occur outside the fuel tanks.
The evaluation should consider both electrical arcing and localized heating that may result from lightning, EMI, and HIRF transients on the fuel tank system, fuel quantity indicating system probes, and wiring.
(b) Latent failure of electromagnetic protection features, such as shielding termination corrosion, shield damage, and transient limiting device failure should be considered and appropriate indication or inspection intervals established to prevent the existence of latent failure conditions. The failure of other system components may also affect EMI protection.
Consequently, the effect of any anticipated failure on the continued environmental protection should be considered. For example, a normally high impedance electrical load that fails due to an electrical short, or a normally low impedance load that fails to an open state, can cause a significant redistribution of the lightning currents within a wire bundle; hence, the voltage induced at components within the fuel tank.
(c) The evaluation of electromagnetic effects from lightning, EMI, or HIRF should be based on the specific electromagnetic environment of a particular aircraft model.
21 Standardized tests, such as those in RTCA DO-160, Sections 19, 20, and 22, are not sufficient alone, without evaluation of the characteristics of the specific electromagnetic environment for a particular aircraft model, to show that appropriate standardized DO-160 test procedures and test levels are selected. Simulation of various latent failures of fuel system components within the tanks may be required to demonstrate the transient protection effectiveness.
(d) Prevention of fuel ignition due to electrical transients from lightning, EMI, or HIRF may require specific wire segregation and separation, wire bundle shielding, or transient suppression for wires entering fuel tanks. Effectiveness of the transient protection features should be verified using the appropriate DO-160 test procedures and test levels determined above.
(12) Friction Sparks. The failure modes and effects analysis (FMEA) should include evaluation of the effects of debris entering the fuel pumps, including any debris that could be generated internally, such as any components upstream of the pump inlet. Industry fuel tank cleanliness practices and design features intended to preclude debris entering the fuel pumps have not been effective at eliminating debris. Service experience has shown that pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, sealant, lockwire, etc. have been inducted into fuel pumps and contacted the impeller. This condition could result in creation of friction sparks and should be an assumed failure condition when conducting the system safety assessment. Fail-safe features should be incorporated into the fuel pump design to address this condition. Examples of means that may be incorporated into the fuel pump design to address this concern include:
• Installation of inlet flame arrestors,
• Use of reticulated foam,
• Use/installation of jet fuel pumps without impellers to scavenge fuel, or
• Maintaining fuel over the pump inlet throughout the airplane flight attitude envelope.
10. COMPONENT QUALIFICATION CONSIDERATIONS.
a. Component Qualification Review. Qualification of components, such as fuel pumps, using the MIL specifications has not always accounted for unforeseen failures, wear, or inappropriate overhaul or maintenance. Service experience indicates that explosion proof capabilities should be substantiated (or re-substantiated for the SFAR compliance) considering these factors in addition to those conditions noted in paragraph 6g of this AC. Therefore, an extensive evaluation of the qualification of components may be required if qualitative assessment does not limit the component as a potential ignition source.
b. Determining Maximum Component Temperature. Maximum component temperatures may be determined experimentally. Tests should be conducted long enough for the component to reach the maximum temperature. All foreseeable failures and malfunctions of the fuel tank components (including those failures and malfunctions that could be undetected by the flightcrew and maintenance personnel) should be considered when determining maximum temperatures and
22 possible development of electrical arcing or sparking in the fuel tank. The following list, although it does not include all possible failure modes, suggests some conditions that should be explored as applicable:
• Normal operation
• Single phase operation of three-phase electrical components. In many cases fuel pump motors are protected by a (single) three-phase circuit breaker. In several instances, resetting of circuit breakers has resulted in arcing inside the fuel tank and the development of an ignition source. Therefore, the fuel pump circuit should also preclude development of an ignition source if the breaker is reset or forced in by a mechanic. Features such as non-resettable breakers or fuses are design features that would meet the fail-safe requirements of § 25.901 that apply to this failure condition.
• Two-phase operation of three-phase electrical components. Failure of a single phase of a multiple-phase fuel pump may significantly increase the load on the remaining phases of the pump and generation of heat in the pump. In many cases thermal protection features within the pump have been incorporated to address this failure condition. Another failure condition that should be considered is subsequent failure of a second phase of the pump and possible arcing or heat damage. In general, pumps should not be allowed to operate following failure of a single electrical phase of the pump if such operation could result in development of an ignition source. Automatic protective means, such as arc/ground fault interrupters, should be provided to shut down the pump when a single electrical phase failure occurs. Periodic inspections or maintenance of these features may be required.
• Dry operation of mechanical components including lack of lubrication. Service history has shown that flightcrews and maintenance personnel have inadvertently operated fuel pumps for long periods of time without fuel in the fuel tank. Fuel pumps are typically qualified for dry run operation for differing periods of time. For example, some pumps were qualified with up to a maximum of 8 hours continuous, with total accumulated dry run operation of 24 hours. Indefinite operation of pumps may result in surface temperatures above the autoignition temperature. Manufacturers recommended procedures are not adequate to assure that pumps will not inadvertently be operated for long periods of time without fuel in the tank. Therefore, if indefinite operation in an empty fuel tank can result in a surface temperature that is an ignition source in the fuel tank, additional fail-safe features are necessary to preclude dry run operation of airplane fuel pumps beyond the time for which the pump was originally qualified. One or more of the following fail-safe means should be considered for protection of fuel pumps:
23 /elevenoclock Qualified for indefinite dry run operation.
/elevenoclock Incorporation of automatic pump shutoff features into the fuel pump or airplane to preclude dry run operation past the dry run qualification demonstration time.
/elevenoclock Annunciation of dry run operation of the pump and FAA approved Airplane Flight Manual procedures that require shutoff of the pump.
/elevenoclock Other means such as installation of flame arrestors to preclude flame propagation into the fuel tank.
NOTE: Annunciation of inadvertent pump operation should be in accordance with the annunciation requirements of § 25.1309. For airplanes configured with a two-crew flight deck, cautionary level annunciation would be appropriate.
• Wet operation of mechanical components with zero and reduced fluid flow
• Moving mechanisms locked or seized
• Pump impeller slippage
• Failed Bearings. The effects of wear on fuel pump features incorporated into the design to maintain explosion proof characteristics should be evaluated. For example, wear of bearings or failures, including spinning of any bushings, and possible effects on quenching orifices should be evaluated. In many cases fuel pump explosion proof features are not redundant and failure or degradation of the features is latent. If single or probable combinations of failures in the fuel pump can cause an ignition source, § 25.981 requires incorporation of fail-safe features noted previously. If wear of the pump can cause degradation of fail-safe features, appropriate inspection, overhaul or life limiting of the pump should be included in the Limitations section of the Instructions for Continued Airworthiness.
• Failed or Aged seals. Spraying of fuel in the tank from any pressurized fuel source may cause electrostatic charging of components in the fuel tank and significantly increase the range of temperature during which the fuel tank vapors are flammable. The design should not include features that result in spraying of fuel, such as fuel pump motor cooling flow return to the tank. In addition, use of sealant in connectors that is not compatible with fuel may allow leakage into the connector and the possibility of a fire near the connector.
Fuel Line Couplings. Aging of seals may result in hardening of the seal material and leakage and spaying of fuel within the fuel tank; therefore, fuel line coupling
24 designs should be evaluated and a design life should be established for all seals that are shown to age and allow leakage.
Fuel Pump Cooling Flow. Fuel used for cooling of fuel pumps may be sprayed from the fuel pump. Fuel pump cooling flow should not be sprayed into the fuel tank vapor space. Means should be provided to distribute the cooling fuel into the fuel tank at or near the bottom of the fuel tank.
Electrical Connector Sealant, Seals, and Explosion Proofness. Electrical connections to fuel pumps are typically located either inside or outside the fuel tank in areas of the airplane where the presence of flammable fuel vapors should be assumed because no secondary sealing of fuel is provided. Fuel leakage and corrosion at electrical connectors located outside the fuel tank has allowed the presence of both flammable vapors and electrical arcing at connectors, resulting in fires. In other applications, arcing has occurred at the pump connections inside the fuel tanks, requiring installation of appropriately sized steel shields to prevent arcing through the connector or pump housing into the fuel tank or areas where flammable vapor could exist.
Arcing at the pump electrical connections should be assumed with fuel present in the safety assessment. The energy release during an arcing condition may be limited by installation of arc/ground fault protection features. The pump connector should be shown to contain any resultant arcing or fire and maintain all surface temperatures below the auto-ignition temperature of the fuel. Component manufacturer maintenance records and qualification test results should be reviewed to establish that the sealant is compatible with the fuel and to determine if a design life or periodic inspections for the pump connector are needed.
• Electrical defects that generate excessive heat. Arcing at the electrical connections to the pump housing or within the connector.
• Submerged heat exchangers. Operating under conditions of maximum heat rejection to the fuel.
c. Determination of Maximum Temperature of Fuel Tank Surface.
(1) Components mounted adjacent to the exterior surface of the fuel tank can create a high localized temperature at the inner surface of the tank. This can be investigated by laboratory tests that duplicate the installation, or by a validated heat transfer analysis using the maximum potential temperature of the component.
(2) External Heat Source. When engine bleed air ducting, Environmental Control Equipment (ECS), and other airplane components or systems are located near fuel tanks, an FMEA should be made to determine failures of adjacent systems or components that could cause elevated surface temperatures. The maximum internal tank temperatures that can occur during