Subject: FUEL TANK IGNITION
SOURCE PREVENTION GUIDELINES Date: 9/19/08 Initiated By: ANM-112
AC No: 25.981-1C
1. Purpose. This advisory circular (AC) provides guidance for dem onstrating compliance with the certification requirements for prevention of ignition sources within the fuel tanks of transport category airplanes. This guidance is applicable to transport category airplanes for which a new, amended, or supplemental type certificate is requested.
2. Applicability.
a. The guidance provided in this document is directed to airplane manufacturers, m odifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) transport airplane type certification engineers, and their designees.
b. This material is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes acceptable m eans, but not the only means, for demonstrating compliance with the applicable regulations. The FAA will consider other methods of demonstrating compliance that an applicant may elect to present. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. On the other hand, if we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation or design changes as a basis for finding compliance.
c. This material does not change, create any additional, authorize changes in, or permit deviations from , regulatory requirements.
3. Cancellation. Advisory Circular 25.981-1B, Fuel Tank Ignition Source Prevention Guidelines, dated April 18, 2001, is cancelled.
4. Related Documents. The following related documents are provided for information purposes and are not necessarily directly referenced in this AC.
a. Federal Aviation Regulations. Sections that prescribe requirements for the design, substantiation, and certification relating to prevention of ignition sources within the fuel tanks of transport category airplanes include:
§ 21.50 Instructions for continued airworthiness and manufacturer’s maintenance manuals having airworthiness limitations sections.
§ 25.729(f) Protection of equipment in wheel wells.
§ 25.863 Flammable fluid fire protection.
§ 25.901 Installation. (Powerplant) § 25.954 Fuel system lightning protection.
§ 25.973 Fuel tank filler connection.
§ 25.981 Fuel tank ignition prevention.
§ 25.1301 Function and installation. (Equipment) § 25.1309 Equipment, systems, and installations.
§ 25.1316 System lightning protection.
§ 25.1353 Electrical equipment and installations.
§ 25.1529 Instructions for continued airworthiness.
Appendix H to part 25–Instructions for Continued Airworthiness
b. Advisory Circulars (AC). You can obtain any of the ACs listed below either electronically from the internet at http://www.airweb.faa.gov/rgl/. or from the U.S.
Department of Transportation, Subsequent Distribution Office, M-30, Ardmore East Business Center, 3341 Q 75th Avenue, Landover, MD 20785.
(1) AC 25-8 Auxiliary Fuel System Installations
(2) AC 20-53B Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Caused by Lightning
(3) AC 20-136A Protection of Aircraft Electrical/Electronic Systems against the Indirect Effects of Lightning
(4) AC 25-16 Electrical Fault and Fire Prevention and Protection
(5) AC 25-19 Certification Maintenance Requirements
(6) AC 25.981-2A Fuel Tank Flammability Reduction Means
(7) AC 25.1701-1 Certification of Electrical Wiring Interconnection Systems on Transport Category Airplanes
c. Society of Automotive Engineers (SAE) Documents. You can obtain the following documents from the Society of Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale, Pennsylvania, 15096.
(1) APR 4754, Aerospace Recommended Practice, Certification Considerations For Highly Integrated or Complex Aircraft Systems.
(2) ARP 4761, Aerospace Recommended Practice, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.
(3) ARP 4404, Aerospace Recommended Practice, Aircraft Electrical Systems (guidance document for design of aerospace vehicle electrical systems).
(4) AIR 1662, Minimization of Electrostatic Hazards in Aircraft Fuel Systems.
(5) ARP 5412A, Aircraft Lightning Environment and related test waveforms.
(6) ARP 5414A, Aircraft Lightning Zoning.
(7) SAE AS50881, Aerospace Vehicle Wiring (procurement document used to specify aerospace wiring, replaces MIL-W-5088).
(8) ARP 5583, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment.
d. Military Specifications. You can get a copy of these documents from the Department of Defense, Document Automation and Production Service, Building 4/D, 700 Robbins Avenue, Philadelphia, WA 19111-5094, or on the internet at http://assist.daps.dla.mil/online/start/.
(1) MIL-E-5272A, Environmental Testing of Aeronautical & Associated Equipment (Explosion Proof Equipment Qualification Tests).
(2) MIL-STD-810E, Method 511.3, Explosive Atmosphere, dated September 1, 1993.
e. Other.
(1) RTCA Document DO-160F, Environmental Conditions and Test Procedures for Airborne Equipment.
(2) Underwriters Laboratories Inc., UL 913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations.
(3) FAA Transport Airplane Directorate Designee Newsletter, Edition 15, February 1993. Article, Electrical Wiring used in Commercial Transport Airplanes.
(4) FAA Document DOT/FAA/AR-98/26, Review of the Flammability Hazard of Jet A Fuel Vapor in Civil Transport Aircraft Fuel Tanks, June 1998. An electronic copy of this report is available on the Internet at http://www.fire.tc.faa.gov.
(5) Kuchta, Joseph M., Summary of Ignition Properties of Jet Fuels and Other Aircraft Combustible Fluids, Air Force Aero Propulsion Laboratory Technical Report AFAPL-TR-75-70, U.S. Bureau of Mines PMSRC, 1975.
(6) K. E. Crouch, “Aircraft Fuel System Lightning Protection Design and Qualification Test Procedures Development,” FAA report DOT/FAA/CT-94/74, September 1994.
(7) F. A. Fisher, J. A. Plumer, and R. A. Perala, “Aircraft Lightning Protection Handbook,” FAA report DOT/FAA/CT-89/22, September 1989.
(8) American Society of Testing and Materials, ASTM D 4865, “Standard Guide for Generation and Dissipation of Static Electricity in Petroleum Fuel Systems.”
A copy of this standard can be ordered electronically on the Internet at http://www.ASTM.org.
(9) National Fire Protection Association, NFPA 77, Recommended Practice on Static Electricity, 1993 Edition A copy of this publication can be ordered electronically on the Internet at http://www.NFPA.org.
(10) F. A. Fisher, “Some Notes on Sparks and Ignition of Fuels,” NASA report NASA/TM-2000-210077, March 2000.
(11) EUROCAE ED 107, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment.
5. Definitions.
a. Auto-ignition Temperature. The minimum temperature at which an optimized flammable vapor and air mixture will spontaneously ignite when heated to a uniform temperature in a normal atmosphere without an external source of ignition, such as a flame or spark.
b. Auxiliary Tanks. Fuel tanks installed which make additional fuel available for increasing the flight range of that airplane. The term “auxiliary” means that the tank is secondary to the airplane’s main fuel tanks; i.e., the functions of the main tanks are immediately available and operate without immediate supervision by the flightcrew in the event of failure or inadvertent depletion of fuel in an auxiliary tank. Auxiliary tanks are usually intended to be emptied of usable fuel during flight and have been installed in various locations including center wing structure, horizontal stabilizers, wings, and cargo compartments.
c. Barrier. A physical partition attached to airplane structure that separates one wire or group of wires from another wire or group of wires in order to prevent arcing, fire and other physical damage between wires or groups of wires.
d. Critical Design Configuration Control Limitations. Limitations that define those parameters of the design that must be maintained to ensure that ignition sources will not develop within the fuel tank.
e. Electrical Sparks. A spark that is initiated by a potential difference which causes an electrical breakdown of a dielectric, such as a fuel/air mixture, produced between electrodes which are initially separated, with the circuit initially carrying no current. The term voltage sparks is sometimes used interchangeably with the term electrical sparks.
f. Electrical Arcs. Electrical arcs occur between electrodes which are in contact with each other and carry excessive current which results in melting at the contact points. This may result in electric arc plasma and/or ejection of molten or burning material. The term thermal sparks is used interchangeably with the term electrical arcs.
g. Explosion Proof. Components designed and constructed so they will not ignite flammable vapors or liquids surrounding the component under any normal operating condition and any failure condition. Further information on possible failure conditions that should be considered is specified in § 25.981(a)(3).
h. Flammable. Flammable, with respect to a fluid or gas, means susceptible to igniting readily or to exploding (14 CFR part 1, Definitions). Further information on flammable fluids used in airplanes may be found in the documents identified in paragraph 4e of this AC.
i. Flash Point. The flash point of a flammable fluid is defined as the lowest temperature at which the application of a flame to a heated sample causes the vapor to ignite momentarily, or “flash.” The test standard for jet fuel is defined in the fuel specification.
j. Friction Spark. A heat source in the form of a spark that is created by mechanical contact, such as debris contacting a rotating fuel pump impeller.
k. Hot Short. Electrical energy introduced into equipment or systems as a result of unintended contact with a power source, such as bent pins in a connector or damaged insulation on adjacent wires.
l. Ignition Source. A source of sufficient energy to ignite combustion of a fuel/air mixture. Surfaces that can exceed the auto-ignition temperature of the flammable vapor under consideration are considered to be ignition sources. Electrical arcs, electrical sparks and friction sparks are also considered ignition sources if sufficient energy is released to initiate combustion.
m. Installation Appraisal. A qualitative appraisal of the integrity and safety of the installation.
n. Intrinsically Safe. Any instrument, equipment, or wiring that is incapable of releasing sufficient electrical or thermal energy under normal operating conditions, anticipated failure conditions (see § 25.981(a)(3)), and environmental conditions which could cause an ignition source within the fuel tank.
o. Latent Failure. A failure whose presence may not be readily apparent to the flightcrew or maintenance personnel. A significant latent failure is one that would, in combination with one or more specific failures or events, result in a hazardous or catastrophic failure condition.
p. Maximum Allowable Surface Temperatures. A surface temperature within the fuel tank (the tank walls, baffles, or any components) that provides a safe margin under all normal or failure conditions, which is at least 50 °F (10 °C) below the lowest expected auto-ignition temperature of the approved fuels. The auto-ignition temperature of fuels will vary because of a variety of factors (ambient pressure, dwell time, fuel type, etc.). The value accepted by the FAA without further substantiation for kerosene fuels, such as Jet A, under static sea level conditions, is 450 °F (232.2 °C). This results in a maximum allowable surface temperature of 400 °F (204.4 °C) for an affected component surface.
q. Qualitative. Those analytical processes that assess system and airplane safety in an objective, non-numerical manner.
r. Quantitative. Those analytical processes that apply mathematical methods to assess system and airplane safety.
s. Transient Suppression Device (TSD). A device that limits transient voltages or currents on wiring to systems such as the fuel tank quantity, fuel temperature sensors, and fuel level switches, etc., to a predetermined level.
t. Ground Fault Interrupter (GFI). A device that detects an electrical power short circuit-to-ground condition and interrupts electrical power to the ground fault.
u. Fuel System Limitation (FSL). Any inspection that is identified in the limitations section of the instructions for continued airworthiness as required to assure integrity of items identified as critical design configuration control limitations.
v. Line Replacement Unit (LRU). Any components that can be replaced while the airplane remains in operational service. Examples of fuel system LRUs include components such as cockpit and refueling panel fuel quantity indicators, fuel quantity system processors, and fuel system management control units.
6. Background.
a. Regulatory History.
(1) The regulatory standards of part 25 require that ignition sources not be present or develop in the fuel tanks of transport airplanes. Amendment 25-11, effective May 5, 1967, introduced § 25.981, Fuel tank temperature. This requirement was prompted by a need for protection of airplane fuel tanks from possible ignition sources because of advances in electrical system sealing. These advances made it possible to place electrical system components, such as pumps and fuel gauging elements, as well as the wiring to these components, in immersed locations within fuel tanks. Additionally, fuel tank walls were subject to local “hot spots” by the proximity of airplane equipment and compressor bleed air ducts that carry air at high temperatures.
(2) The need for a regulation was further demonstrated by the possibility that the surface temperature of the fuel tank internal wall, or the fuel system components within the fuel tank, could exceed the auto-ignition temperature. Section 25.981, as originally adopted, focused on preventing ignition of fuel vapors in the fuel tanks from hot surfaces. It required that the applicant determine the highest temperature allowable in fuel tanks that provided a safe margin below the lowest expected auto-ignition temperature of the fuel approved for use in the fuel tanks. In addition, this regulation established a requirement that no temperature at any place inside any fuel tank where fuel ignition is possible may then exceed that maximum allowable temperature.
(3) Other sections of part 25 require that ignition from lightning be prevented (§ 25.954), as well as ignition from failures in the fuel system (§ 25.901). Applicants have been required by § 25.901 to complete a safety assessment of the fuel system and show that “no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane....” However, service history has shown that ignition sources have developed in airplane fuel tanks due to unforeseen failure modes or factors that were not considered at the time of original certification of the airplane, including arcs, sparks, or hot surfaces within the fuel tanks.
b. Advisory Circular 25.981-1A, Guidelines for Substantiating Compliance with the Fuel Tank Temperature Requirements, issued in 1972, provided guidance that included failure modes that used to be considered when determining compliance with the fuel tank temperature requirements defined in § 25.981. This regulation originally focused on preventing ignition of fuel vapors in the fuel tanks from hot surfaces. The AC also stated the accepted practice of establishing a minimum 50 °F temperature margin below the lowest auto-ignition temperature of the approved fuels.
c. Amendment 25-102, issued on April 18, 2001, renamed § 25.981 as Fuel tank ignition prevention. That amendment also added new requirements to address causes of ignition sources within fuel tanks, and minimization of the development of flammable vapors in the fuel tanks or mitigation of the effects of an ignition of vapors in the tanks. The new 7
ignition source prevention standard requires a safety assessment of the fuel tank system that includes:
• consideration of single failures,
• probable combinations of failures,
• development of long-term instructions for continued airworthiness, including Critical Design Configuration Control Limitations (CDCCL), and
• maintainability of the airplane fuel tank system.
d. Special Federal Aviation Regulations (SFAR) No. 88, promulgated by Amendment 21-78, also issued on April 18, 2001, requires a one-time reassessment of the fuel tank systems of many in-service transport airplanes per the ignition source prevention requirements of §§ 25.901 and 25.981, Amendment 25-102.
e. Amendment 25-125, issued July 9, 2008, amended § 25.981 to add specific requirements for the fuel tank flammability. The requirements for CDCCL were expanded to include flammability reduction means and ignition mitigation.
7. Objective.
a. The objective of this AC is to provide guidelines that address the prevention of possible sources of ignition in airplane fuel tanks. Analytical evaluation of the fuel tank system, including consideration of lessons learned from the transport airplane service history, provides insight into design features that should be carefully considered when determining compliance with the regulations that are intended to prevent ignition sources within fuel tanks. Prior to conducting a fuel system safety assessment, each applicant should assemble and review relevant lessons learned from the overall transport fleet history, as described in this AC, as well as their previous products, their suppliers, and any other available sources, to assist in identifying any unforeseen failures, wear, or other conditions that could result in an ignition source. Sources of information include airplane service records, flight logs, inspection records, and component supplier service and sales records. Guidance relating to the flammability requirements adopted in amended § 25.981 is provided separately in AC 25.981-2A.
b. Safety assessments of previously certificated fuel systems may require additional considerations. For these safety assessments, component sales records may assist in identifying if component failures and replacement are occurring. In addition, in some cases changes to components have been introduced following original type design certification without consideration of the possible effects of the changes on the system’s compliance with the requirements to prevent ignition sources. For example, certain components within fuel pumps have been changed to improve pump life, which defeated the original fail-safe features of the pumps. Therefore, results of reviewing this service history information, and a review of any changes to components from the original type design, should be documented as part of the safety analysis of the fuel tank system.
c. The following list summarizes fuel tank system design features, malfunctions, failures, and maintenance/operational related actions that have been identified through service experience as resulting in a degradation of the safety features of airplane fuel tank systems. This list is provided as guidance and not inclusive of all failures that need to be considered in the failure assessment. They may assist in evaluating possible failure modes during evaluation of the fuel tank installation.
Pumps.
• Ingestion of pump inlet components (e.g., inducers, fasteners) into the pump impeller releasing debris into the fuel tank.
• Pump inlet case degradation, allowing the pump inlet check valve to contact the impeller.
• Failure of one phase of the stator winding during operation of the fuel pump motor together with subsequent failure of a second phase of the motor windings, resulting in arcing through the fuel pump housing.
• Arcing due to the exposure of electrical connections within the pump housing that have been designed with inadequate clearance to the pump cover.
• Omission of cooling port tubes between the pump assembly and the pump motor assembly during pump overhaul.
• Extended dry running of fuel pumps in empty fuel tanks, which was contrary to the manufacturer’s recommended procedures.
• Use of steel impellers that may produce friction sparks if debris enters the pump.
• Debris lodged inside pumps.
• Pump power supply connectors have corroded resulting in fuel leakage and electrical arcing.
• Electrical connections within the pump housing have been designed with inadequate clearance or insulation from the metallic pump housing, resulting in arcing.
• Thermal switches aging over time resulting in a higher trip temperature.
• Flame arrestors falling out of their respective mounting.
• Internal wires coming in contact with the pump rotating group, energizing the rotor and arcing at the impeller/adapter interface.
• Poor bonding across component interfaces.
• Insufficient ground fault current protection capability.
• Poor bonding of components to structure.
• Loads from the airplane fuel feed plumbing transferred into the pump housing resulting in failure of the housing mounts and subsequent failure of the pump case, which defeated the explosion proof capabilities of the pump.
• Premature failure of fuel pump thrust bearings allowing steel rotating parts to contact the steel pump side plate.
Wiring to Fuel Pumps.
• Wear of Teflon sleeving and wiring insulation on wires in metallic conduits located inside fuel tanks, allowing arcing from wire through the conduits into fuel tank ullages.
• Damage to insulation on wiring routed adjacent to the fuel tank exterior surfaces that resulted in arcing to the metallic fuel tank surface.
Fuel Pump Connectors.
• Electrical arcing at connections within electrical connectors due to bent pins or corrosion.
• Fuel leakage and subsequent fuel fire outside of the fuel tank caused by corrosion of electrical connectors inside the pump motor which led to electrical arcing through the connector housing (connector was located outside the fuel tank).
• Selection of improper insulating materials in connector design resulting in degrading of the material because of contact with fuel that is used to cool and lubricate the pump motor.
Fuel Quantity Indicating System (FQIS) Wiring.
• Degradation of wire insulation (cracking).
• Conductive or semi-conductive (silver, copper or cadmium) deposits at electrical connectors inside fuel tanks.
• Inadequate wire separation between FQIS wiring and structure or other wiring, causing chafing of the wiring.
• Unshielded FQIS wires routed in wire bundles together with high voltage wires, creating the possibility of short circuit failures or induced current on the FQIS wires in excess of intrinsically safe levels.
• FQIS wiring that does not adhere to aircraft manufacturer’s standard wiring practices (i.e., wires bent back along themselves with bend radius less than defined in the aircraft manufacturer’s standard wiring practices, multiple splices lying next to one another, etc.).
FQIS Probes.
• Conductive or semi-conductive corrosion (copper or silver sulfur deposits) causing reduced breakdown voltage in FQIS wiring.
• Damage to FQIS wire insulation resulting in reduced breakdown voltage as a result of wire clamping features at electrical connections on fuel quantity probes.
• Contamination in the fuel tanks creating an arc path for low levels of electrical energy between FQIS probe walls (steel wool, lock wire, nuts, rivets, bolts, and mechanical impact damage to probes).
Valve Actuators.
• Failure of one solenoid in a dual solenoid actuated valve resulting in overheating of one solenoid above the auto-ignition temperature.
Float Switch Systems.
• Conduits containing float switch wiring failing due to freezing of water that entered the conduit, allowing fuel leakage into the conduit and along the airplane front spar resulting in an engine tailpipe fire.
• Float switch wire chaffing observed which might have provided potential for subsequent electrical short to the conduit.
• Float switch sealing failure has allowed fuel/water to egress into the switch, compromising switch operation in an explosive environment.
Fuel Tubes, Vent Tubes, Conduits, Hydraulic Lines.
• Poorly conducting pipe couplings that may become electrical arc sources when exposed to electric currents, including lightning currents.
• Insufficient clearances between tubes and surrounding structure.
• Intermittent electrical bonding in flexible couplers.
• Bonded couplers unable to conduct expected lightning or power fault currents without arcing.
Electrical Generator Power Feeder Cables.
• Arcing of electrical power feeder cables to a pressurized fuel line resulting in fire adjacent to the fuel tank.
• Arcing of electrical power feeder cables to aluminum conduit resulting in molten metal dropping onto a pressurized fuel line causing leakage.
Bonding Straps.
• Corrosion of bonding strap wires resulting in failure to provide required current paths.
• Inappropriately attached connections (loose or improperly grounded attachment points).
• Static bonds on fuel system plumbing connections inside the fuel tank worn due to mechanical wear of the plumbing from wing movement, and corrosion.
• Corrosion of bonding surfaces near fuel tank access panels that could diminish the effectiveness of bonding features.
• Aging of self-bonding fuel system plumbing connections resulting in higher resistance bonding.
• Missing bonds.
• Loose or intermittent contacts between bond straps and other conductive components.
Pneumatic System Failures .
• Leakage of air from ducting located near fuel tanks due to duct failure resulting in undetected heating of tank surfaces above the auto-ignition temperature.
Electrostatic Charge.
• Use of a non-conductive type of reticulated polyurethane foam in only a portion of a fuel tank system that allowed electrostatic charge build-up and arcing in the unprotected portion of the system.
• Spraying of fuel through refueling nozzles located at the upper portion of the tank.
8. Fuel Vapor Ignition Sources.
a. There are four primary phenomena that can result in ignition of fuel vapors from within airplane fuel tanks:
• electrical arcs and sparks.
• filament heating,
• friction sparks, and
• hot surface ignition or auto-ignition.
(1) The conditions required to ignite fuel vapors from these ignition sources vary with pressures and temperatures within the fuel tank and can be affected by sloshing or spraying of fuel in the tank. Due to the difficulty in predicting fuel tank flammability and eliminating flammable vapors from the fuel tank, the regulatory authorities have always assumed that a flammable fuel air mixture may exist in airplane fuel tanks and have required that no ignition sources be present.
(2) Any components located in or adjacent to a fuel tank must be designed and installed in such a manner that, during both normal and anticipated failure conditions, ignition of flammable fluid vapors will not occur. Compliance with this requirement is typically shown by a combination of component testing and analysis. Testing of components to meet the appropriate level of explosion-proof requirements may be carried out for various single failures, and combinations of failures, to show that arcing, sparking, auto-ignition, hot surface ignition, or flame propagation from the component will not occur. Testing of components has been accomplished using several military standards and component qualification tests. For example, military standard MIL-STD-810, Method 511, Procedure I and II, defines one method that has been accepted for demonstrating that a component is explosion proof. Section 9 of RTCA Document DO-160F has also been accepted for demonstrating that airborne equipment is explosion proof.