b. Electrical Sparks and Electrical Arcs.
(1) Laboratory testing has shown that the minimum ignition energy in an electrical spark required to ignite hydrocarbon fuel vapor is 200 microjoules1. Therefore, for electrical or electronic systems that introduce electrical energy into fuel tanks, such as fuel quantity indicating systems, any electrical arcs or sparks that are created into any fuel tank should be less than 200 microjoules during either normal operation or operation with failures.
NOTE: In the past some components have been qualified to standards that allow 320 microjoules, but this level is not acceptable for showing intrinsic safety.
To ensure that the design has adequate reliability and acceptable maintenance intervals, a factor of safety should be applied to this value when establishing a design limit.
Fuel tank systems should be designed to limit the allowable energy level to the lowest practical level. Systems with a maximum energy of 20 microjoules are considered technologically feasible. Normal systems operations at minimum ignition energies of up to 50 microjoules would be acceptable. Under failure conditions, the system should not have an ignition energy which would exceed 200 microjoules.
(2) Electrical transients caused by environmental conditions, such as lightning strikes, with the potential to create electrical sparks and arcs in the fuel tank, should be limited so that the energy from any electrical spark or arc from the electrical transient is less than 200 microjoules. Optical detection methods and combustible vapor ignition detection methods used to show compliance for electrical transients caused by environmental conditions should detect electrical sparks and arcs with energy levels of 200 microjoules or less. Optical detection methods consist of subjecting a fuel tank to a simulated lightning strike while a specific camera/lens/film configuration is positioned near the fuel system component, system or fuel tank with the shutter open. The test is passed if no spark or arc is visible on the developed film. Combustible vapor ignition detection methods use specific combustible gas mixtures that have high ignition probability at a specific electrical energy.
Fuel system components, systems, or fuel tanks are tested in the presence of the combustible vapor. The test passes if the vapor does not ignite during the test, but does ignite using a standardized ignition energy source at the specified ignition energy. Acceptable test methods are found in SAE document ARP 5416.
c. Filament Heating Current Limit. Analyses and testing indicate a small piece of steel wool will ignite a flammable mixture when a current of approximately 100 milliamperes root-mean-square (RMS) is applied to the steel wool.2 Therefore, for electrical or electronic systems that introduce electrical energy into fuel tanks, such as fuel quantity indicating
1 The 200 microjoule level comes from various sources. The most quoted is Lewis and VonElbe, “Combustion, Flames and Explosions of Gases,” that has a set of curves for minimum ignition energy for the various hydrocarbon compounds in Jet fuel, and they all have similar minimum ignition energy levels of around 220 microjoules.
2 This data was from testing performed by the FAA Technical Center, Report number DOT/FAA/AR-TN05/37.
Applicants may conduct testing to substantiate alternate values.
systems, the electrical current introduced into any fuel tank should be limited. Because there is considerable uncertainty associated with the level of current necessary to produce an ignition source from filament heating, a factor of safety should be applied to this value when establishing a design limit. A maximum of steady-state current of 25 milliamperes RMS is considered an intrinsically safe design limit for electronic and electrical systems that introduce electrical energy into fuel tanks. For failure conditions, limit the current to 50 milliamperes RMS and for lightning induced transients to 125ma peak current.
d. Friction Sparks. Service experience has shown that pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, lockwire, roll pins, cotter pins, drill chips, and manufacturing debris, etc., have been inducted into fuel pumps and contacted the impeller resulting in the possibility of metallic deposits on rotating and stationary components within the pump. This condition has resulted in creation of friction sparks and should be an assumed failure condition when conducting the system safety assessment. Fail-safe features as described below in paragraph 10b(2) have been used to mitigate this hazard.
e. Hot Surface Ignition.
(1) Maximum Surface Temperature. Guidance provided in AC 25-8, as well as the original release of this AC, define surfaces that come within 50 degrees of the auto-ignition temperature of the fuel air mixture for the fluid as ignition sources. The FAA has historically accepted 400 °F for maximum surface temperatures for kerosene type fuels. (Maximum surface temperature considerations for areas outside the fuel tank are discussed later in this AC.) For remote failure conditions of limited duration, it is acceptable to provide substantiation of actual hot-surface ignition temperatures (note that this is different from the auto-ignition temperature of the fuel), and demonstrate a 50 °F margin below these temperatures.
(2) Flammable Fluid Properties. Fuels approved for use on transport category airplanes have differing flammability characteristics. The auto-ignition temperature of JP-4, as determined by ASTM Test Method D286, is approximately 468 °F at one atmosphere of pressure. By this method of testing, under the same atmospheric conditions the auto-ignition temperature of JET A (kerosene) is approximately 435 to 450 °F, and of gasoline, approximately 800 °F. The autoi-gnition temperature of these fuels varies inversely with the ambient pressure. In view of this, factors affecting the pressure in the fuel tank should be taken into consideration when determining compliance with § 25.981.
f. Fuel System Electrostatics. Electrostatic charges are generated in liquid hydrocarbons when they are in motion with respect to another surface such as fueling hoses, filters, nozzles, fuel tank structure and aircraft plumbing. The references in paragraphs 4c(4) and 4e(9) of this AC provide information on this subject. During airplane refueling, jet fuel is loaded either from a tanker truck or from an airport hydrant system. Flowing fuel can generate an electrical charge especially through fuel filtration. The accumulation of charge in the fuel is a function of many factors. If the fuel conductivity is low, the relaxation time for dissipation of the electrical charge is long. As a consequence, the fuel may accumulate an electrical charge inside an aircraft fuel tank. This electrical charge may produce a high 14
potential on the fuel surface and an electrical discharge to structure. This is particularly a concern when large unbonded objects are located inside an airplane fuel tank. Smaller components may also become charged and this should be addressed in the safety assessment.
If the vapor space fuel/air mixture is in the flammable range, ignition of the mixture is possible, resulting in a fuel tank explosion and fire.
(1) Charge accumulation is influenced by many factors. Without a static dissipator additive, typical Jet A fuel has a low electrical conductivity. A static dissipator additive will increase the charging rate of fuel but at the same time greatly improve the conductivity of the fuel to rapidly dissipate the developed charge. Contaminants, considered as ionic impurities, enhance the charging tendency of the specific fuel. Fuels from different parts of the world and from different refineries will therefore have different charging tendencies based on the types of contaminants present. Fuel static dissipater additives will increase the charging rate of fuel but at the same time greatly improve the conductivity of the fuel to rapidly dissipate the developed charge. Water contamination, however, increases the charging tendency of the fuel without a corresponding increase in conductivity. The water interacts with the additives or the naturally occurring contaminants in the fuel to provide this pro-static effect.
Recognizing the dangers of water contamination, the National Fire Protection Association (NFPA) also cautions that when refueling, care should be taken to not disturb the interface between the fuel remaining in the tank and the possible layer of water below it. Disruption of this interface up into the tank ullage/vapor space may lead to an electrical discharge capable of igniting a flammable fuel vapor/air mixture. Fuel tank inerting is one method of precluding this ignition source. However, for transport airplanes, this phenomenon is usually addressed by incorporating an active water removal scavenge system for the fuel tanks and periodically sumping the tanks to remove the collected water to minimize the existence of the fuel/water interface.
(2) Methods of minimizing the magnitude of the developed charge have been developed and are in place on transport airplanes including:
(a) The refuel plumbing is sized and is orificed to maintain maximum flow rates in accordance with the electrostatic guidelines established by the NFPA and the ASTM;
and
(b) Flow velocities of 6 to 7 meters per second are considered acceptable after the discharge port is covered with fuel. The guidelines also indicate that the flow velocity should be held to less than 1 meter per second until the discharge port is covered with fuel.
This criterion may be met by incorporating multiple refueling discharge ports, lowering the flow velocity through the use of piccolo tubes that distribute the fuel at low velocities in the tank, and locating them at or near the bottom of the tank. Location of the refueling discharge at the bottom of the tank minimizes fuel spray, a contributor to static charge development, and provides for the ports to be covered by fuel reserves in main tanks and in the early stages of fuel flow as the refuel rate varies from 1 meter per second up to the full flow of 6 to 7 meters per second in normally emptied tanks.
NOTE: It may not be practical to develop a dual flow rate refueling system so limiting the refueling velocities to less than one meter per second through the use of multiple discharge points and piccolo tubes may be one way to address these design guidelines.
(3) Methods of relaxing the charge have also been developed. Bonding straps are used on fuel components and plumbing lines to allow the charge to dissipate to the tank structure. During refueling, the airplane is bonded to the refueling vehicle with a separate bonding wire to provide an electrical path back to fuel filtration, which is the principal electrostatic charge generator. A static dissipator fuel additive may also be used to increase fuel conductivity, to quickly dissipate the developed charge. However, the FAA does not require this type of additive, unless it is specified as part of the type design approval. Any limitations on use of an anti static additive would need to meet the requirements of §§ 25.1521 and 25.1557.
(4) Applications of the above methods and adherence to industry practices and guidelines on electrostatics should be identified for each airplane model. Airline operation and practices regarding airplane refueling should also be evaluated to verify that the procedures necessary for safe operation of the specific airplane model are in place and followed. Restrictions, if any, on refuel rates, fuel properties, and the requirement for fuel additives should be identified as CDCCL.
(5) Polyurathane reticulated foams used for ignition suppression within fuel tanks and other nonconducting objects may accumulate and retain charge. These items may have to be treated with antistatic additives to prevent charge accumulation.
9. Design Considerations .
a. Accepted Design Practices for Minimizing Ignition Sources. The number of components and systems inside airplane fuel tanks whose failure could result in an ignition source within the fuel tank should be minimized. For example:
(1) Fiber Optics. Wiring entering the tank for such purposes as temperature monitoring and fuel quantity indication should be minimized. Use of new technology, such as fiber optics, may provide a means of reducing or eliminating electrical powered components from inside the fuel tanks.
(2) Routing of Pump Power Supply. If practical, fuel pumps should be located such that electrical power for the pumps is routed outside the fuel tanks in such a manner that failures in the electrical power supply cannot create a hot spot inside the tank or arc into the fuel tank. While routing of the fuel pump power supply outside of the fuel tank, and away from the fuel tank walls, may eliminate the potential for arcing directly into the fuel tank or heating of tank surfaces, the failure analysis should consider the need for electrical circuit protective devices. For example, arcing at the pump electrical connector has resulted in uncontrolled fuel leakage, an ignition source, and an uncontrolled fire outside of the fuel tank. This failure mode as well as any pump electrical failures, such as failure of the pump 16
internal electrical circuits, arcing of pump windings, etc., would need to be considered. If wiring is routed inside metallic conduit inside the fuel tank, redundant protection means would be required to prevent an arc of the wiring to the conduit from penetrating into the fuel tank. A practical means to achieve this is to provide sleeving of the wiring and an independent means such as a GFI or arc fault circuit breaker. Providing multiple layers of sleeving alone would not be considered acceptable since wear could defeat the multiple layer protection.
NOTE: Electromagnetic environment and lightning-induced transients that may damage the wiring or pump should be considered in the design of the pump wiring system and when showing compliance.
(3) Location of the Pump Inlet. Debris that may enter a fuel pump inlet can cause sparks inside the fuel tank. One means to address this ignition source has been to locate the pumps such that the pump inlet remains covered with fuel at any time the pump is operating within the airplane operating envelope. Another means has been preventing the propagation of any ignition from the pump into the fuel tank by use of flame arrestor technology. (The performance of the flame arrester should be validated by test to verify its effectiveness at stopping a flame front.) Any protective means including those shown below should be effective under pitch, roll attitudes, and negative G conditions anticipated to occur in service.
(a) Main Feed Tanks. Installation of baffles in tank structure and use of collector tanks that are continually filled with fuel using ejector pumps are methods that have proven successful at keeping the pump inlets and pump housings submerged in fuel.
(b) Auxiliary Tanks. For auxiliary tanks that utilize motor driven fuel pumps and that are routinely emptied, accepted design practices include shutting off the motor driven pumps prior to uncovering the fuel pump inlet and installation of a flame arrestor in the scavenge pump inlet line, or scavenging the remaining fuel with ejector pumps. (Note that installation of features such as a flame arrestor in the fuel system would need to be shown to meet fuel system performance requirements in § 25.951.)
(4) Wiring. The following paragraphs on wiring represent acceptable approaches for dealing with wiring used in and near fuel tanks. For specific requirements and further guidance, the applicant should review the wiring installation and design requirements in the new Electrical Wiring Interconnect Systems (EWIS) rules, Amendment 25-123, and associated advisory circulars.
(a) Intrinsically Safe Wiring. All wiring that is intended to conduct intrinsically safe levels of electrical power into or through the fuel tanks should incorporate protective features that prevent exceeding the intrinsically safe levels discussed in paragraphs 8b and c of this AC. This wiring should also be protected from lightning and Hight Intensity Ratiated Fields (HIRF) induced transients. The following protective features could be used to support that objective:
1 Separation and shielding of the fuel tank wires from other airplane wiring and circuits, and
2 Shielding for lightning, HIRF and other electromagnetic interference, and
3 Installation of transient suppression devices, to preclude unwanted electrical energy from entering the tank.
(b) Higher Energy Wiring. (Includes all wiring that is not intrinsically safe.)
1 Wiring should not be routed through metallic conduit inside the fuel tank or adjacent to fuel tank surfaces such that damage, inappropriate maintenance, or other failure/wear conditions could result in arcing to the conduit or metallic tank surface and development of an ignition source in the fuel tank. If metallic or other conductive conduit materials are used, the single failure of electrical arcing of the wiring to the conduit, adjacent tank surfaces, or structure should be assumed to occur. In addition, circuit protective features or other features should be incorporated to preclude development of an ignition source in the fuel tank. Methods that may be used to address this foreseeable failure condition include the use of circuit protective features such as dual conduits, thick wall conduit, and/or fast-acting ground fault interrupter (GFI) circuit breakers.
2 Where electric wires are routed through metallic conduits installed in a fuel tank, high surface temperatures or arcing though the conduit wall can be created by short circuits. All wiring conducting levels of power that exceed intrinsically safe levels
(e.g., fuel pump power supply) into or through a fuel tank should be evaluated assuming arcing to adjacent surfaces such as metallic conduits or wing surfaces, unless fail-safe protective features are provided. A critical electrical wiring condition might be one in which the insulation is worn, cracked, broken, or of low dielectric strength, allowing intermittent or constant arcing to occur without consuming enough power to cause the circuit protection device to open. Inspection of wiring from in-service airplanes has shown that greater than expected wear may occur on sleeving and wiring insulation due to movement of the wire within the conduit. Roughness of the conduit material and variations in vibration levels for each installation may significantly increase wear. In addition, inspections have shown that protective sleeving has been missing, improperly installed, or the wrong sleeving material used, resulting in damage to the insulation. For these reasons, use of protective sleeving on wiring would not by itself be adequate for showing compliance. The design should be tolerant to these types of foreseeable failure or maintenance errors.
NOTE: Advisory Circular 25-8 addresses the use of metallic conduit as an acceptable means for routing of electrical power within airplane auxiliary fuel tanks.
As indicated above, these past practices would not meet the fail-safe requirements of § 25.981 for any fuel tank, unless additional fail-safe features were incorporated.
Therefore, the more recent guidance in this AC, and rulemaking in Amendment 25- 102 supplements the guidance in AC 25-8.
(c) Wire Separation . Wiring designs used on transport airplanes vary significantly between manufacturers and models; therefore, it is not possible to define a specific universal separation distance or the characteristics of physical barriers between wire bundles to protect critical wiring from damage. Separation requirements for wiring and other components of EWIS are contained in § 25.1707, (the regulatory defintion of an EWIS is provided in § 25.1701). Advisory Circular 25.1701-1, Certification of Electrical Wiring Interconnetion Systems on Transport Category Airplanes, paragraph 5d, contains guidance on determining adequate separation distance between EWIS and between EWIS and airplane systems and structures. Even if § 25.1707 is not in the type certification basis of the airplane being modified, the guidance contained in the AC should still be applied, along with the guidance contained in this AC, when determining adequate separation distance. Intrinsically safe wiring for fuel tanks needs to be protected from induced currents caused by lightning, power system switching transients, or electromagnetic interference (EMI) due to close proximity to other airplane wiring. In addition, damage to wire insulation can result in unwanted electrical energy being transmitted into the fuel tank, if the damaged wire can come into contact with the conductor of another wire that is not intrinsically safe. Of particular concern is the possibility of a wire bundle fire that exposes and breaks wires that are not intrinsically safe and also damages the insulation of intrinsically safe wiring that is in close physical proximity. The broken wires may still be energized and could contact conductors of the damaged intrinsically safe wire. If physical separation is used to protect intrinsically safe fuel system wiring from other wiring or to protect fuel tank walls from high power wiring, the minimum physical separation must be established by the applicant. The applicant should conduct an analysis to verify that current and energies greater than those specified in paragraphs 8b and c of this AC will not be applied to intrinsically safe wiring, considering the factors listed below. The following is based on the guidance contained in paragraphs 5d(3) and (4) of AC 25.1701-1.
1 The electrical characteristics, power, and criticality of the signals in the wire bundle and adjacent wire bundles,
2 Installation design features including the number, type, fire resistance and location of support devices along the wire path of the intrinsically safe wire and adjacent higher power wires,
3 The maximum amount of slack wire resulting from wire bundle build tolerances and other wire bundle manufacturing variations,
4 Probable variations in the installation of the intrinsically safe fuel system wiring and adjacent wiring, including the position or omission of wire support devices and the amount of slack wire that is possible,
5 Expected operating environment including the amount of deflection or relative movement that can occur and the effect of a failure of a wire support device, or a broken wire, or other methods used to maintain physical separation,
6 The effects of wire bundle fires, 19
7 Maintenance practices as defined by the airplane manufacturer’s standard wiring practices manual and the ICA required by §§ 25.1529, 25.1729, 26.11(b), and 26.11(c) as applicable, and
8 Possible EMI, HIRF, or induced lightning effects.
NOTE: Some areas of an airplane may have localized areas where maintaining the minimum physical separation distance is not feasible. This is especially true in smaller transport category airplanes. In those cases, other means of ensuring equivalent minimum physical separation may be acceptable, if testing or analysis demonstrates that safe operation of the airplane is not jeopardized. The testing or analysis program should be conservative and consider the worst possible condition not shown to be extremely improbable. The applicant should substantiate to the ACO that the means to achieve the necessary separation provides the necessary level of protection for wire related failures. Electromagnetic interference (EMI) protection must also be verified.
(d) Inspection. Means should be provided to allow for the visual inspection of the wiring, physical barriers and other physical means of protection. Non-destructive inspection aids may be used where it is impracticable to provide for direct visual inspection if it is shown that the inspection is effective and the inspection procedures are specified in the maintenance manual required by §§ 25.1529, 25.1729, 26.11(b), and 26.11(c).
(e) Identification. Means must also be provided so EWIS wires are readily identified and visible to maintenance, repair, or alteration personnel. The method of identification must remain legible throughout the airplane’s operational life. The complete regulatory requirements for EWIS identification are contained in § 25.1711.
(f) Circuit Breakers. Service experience has indicated that thermal mechanical circuit breakers installed in the fuel pump circuits have not been shown to preclude arcing of electrical wiring through metallic barriers such as conduit, fuel pump housings, electrical connectors, or the tank wall into the fuel tank on some airplane designs. Evidence suggests that arcing from the wiring to metallic surfaces may not result in a hard short, which would trip the circuit breaker and may result in intermittent low level arcing that gradually arcs through the metallic barrier into the fuel tank. For these failure conditions circuit protective devices such as Arc Fault Circuit Breakers and Ground Fault Interrupters may be needed to provide fail safe features necessary to demonstrate compliance.
(g) Use of Nonmetallic Conduit. If nonmetallic conduit is used, compatibility with fuel should be demonstrated. The nonmetallic conduit should be evaluated for the effects of aging due to heat, corrosion at the connecting fittings, and resistance to heat damage from internal shorts of wires routed within the conduit.
(h) Wire Splices. Splices in fuel system wiring have been allowed as a standard repair procedure. The acceptability of splices will be based upon the system design 20
and fail-safe features. The safety assessment may show that splices in fuel tank system wiring, such as fuel quantity indicating wiring within the fuel tank and fuel pump windings, are prohibited. This would be defined as a critical design configuration control limitation.
(i) Use of Silver in Fuel Tanks. Silver can combine with sulfur or water and form silver-sulfide or oxide deposits between exposed conductors (terminal block connections, etc.). The silver-sulfide deposits reduce the resistance between conductors and can ignite fuel vapor when exposed to very low levels of electrical energy. If use of silver in electrical components and wiring in the tank is determined to be critical, it should be defined as a critical design configuration control limitation. The energy levels that have been shown to ignite fuel vapor during laboratory tests approach the levels normally used on fuel quantity indicating system wires and probes. This issue must be carefully addressed.
(j) Use of Steel Wool. Steel wool has been used as a cleaning tool to remove corrosion and clean parts inside the fuel tanks. Steel wool creates small conductive filiments that can cause ignition sources in the fuel tank if the steel wool comes in contact between conductors in fuel tank quantitiy guaging system components. For this reason design approval holders typically do not allow the use of steel wool inside fuel tanks and recommend using other abrasives.
10. Safety Analysis.
a. Ignition Source Failure Analysis. Compliance with § 25.981 requires each applicant to develop a failure analysis for the fuel tank installation to substantiate that ignition sources will not be present in the fuel tanks. The requirements of this section are in addition to the more general propulsion failure analyses requirements of §§ 25.901 and 25.1309 that have been applied to propulsion installations.
(1) Section 25.981(a)(3) defines three failure scenarios that must be addressed in order to show compliance with the rule:
(a) Each single failure, regardless of the probability of occurrence of the failure, must not cause an ignition source.
(b) Each single failure, regardless of the probability of occurrence, in combination with any latent failure condition not shown to be at least extremely remote (i.e., not shown to be extremely remote or extremely improbable), must not cause an ignition source.
(c) All combinations of failures not shown to be extremely improbable must not cause an ignition source.
(2) Compliance with § 25.981 (Amendment 25-102) requires analysis of the airplane fuel tank system using analytical methods and documentation currently used by the aviation industry in demonstrating compliance with §§ 25.901 and 25.1309 with consideration of unique requirements included in the amendment.
(3) SAE document ARP 4761, System Design and Analysis, describes methods for completing system safety assessments (SSA). An assessment may range from a simple report that offers descriptive details associated with a failure condition, interprets test results, compares two similar systems, or offers other qualitative information, to a detailed failure analysis that may include estimated numerical probabilities. The depth and scope of an acceptable SSA depend upon:
(a) The complexity and criticality of the functions performed by the system under consideration,
(b) the severity of related failure conditions,
(c) the uniqueness of the design and extent of relevant service experience,
(d) the number and complexity of the identified causal failure scenarios, and
(e) the detectability of contributing failures.
NOTE: Sections 25.981 and 25.901 are intended to address system failures that may result in the presence of an ignition source in the fuel tanks. These regulations are not intended to address failures or conditions that could lead to ignition of fuel vapors from such sources as:
• uncontained engine debris,
• external engine fires following engine separation or failure,
• damage resulting from explosive materials, such as bombs,
• post crash fire heating of tank surfaces, or
• propagation of fire through the airplane vent system into the fuel tanks.
These hazards are addressed by other regulations.
b. Qualitative Safety Assessment.
(1) Typical airplane fuel tank systems have a limited number of possible ignition sources. Figure 1 shows some causes of ignition sources and methods that may be used to meet the fail-safe requirements. The level of analysis required to show that ignition sources will not develop will depend upon the specific design features of the fuel tank system being evaluated. Detailed quantitative analysis should not be necessary if a qualitative safety assessment shows that features incorporated into the fuel tank system design protect against the development of ignition sources within the fuel tank system. For example, if intrinsically safe FQIS wiring entering the fuel tanks and the associated LRU were shown to have protective features such as separation (including circuit separation in the LRU) and shielding and/or transient suppression/energy limiting devices, the portion of the compliance demonstration for the associated wiring would be limited to demonstrating the effectiveness of the features and defining any long-term maintenance requirements or critical design configuration control limitations so that the protective features are not degraded.
(2) Another example would be installation of a flame arrestor in the inlet line to a fuel pump. The compliance demonstration for the fuel pump may be limited to showing that the arrestor was effective at precluding propagation of the flame from the pump back down the inlet line into the tank, and showing that any anticipated failures or events could not violate the explosion-proof features of the pump assembly. In addition, revalidation of the fuel system to other regulations (e.g., icing and reduced flow due to contamination) would be required if modifications were incorporated into the fuel feed system. It may also be possible to show that fuel pumps installed such that the fuel pump inlet remains covered whenever the fuel pump is operating throughout the airplane operating envelope (as discussed earlier), including anticipated low fuel operations and ground conditions, would be a satisfactory method of meeting the fail-safe requirement for the failure mode of arcing into the tank ullage (consideration of other failure modes, such as the effects of electrical arcing external to the fuel tank, at the connectors, etc, would need to be addressed). The SSA criteria, process, analysis methods, validation, and documentation should be consistent with the guidance material provided in SAE document ARP 4761, utilizing the unique guidance specific to the fuel tank system as defined in this AC.
Figure 1: Example of Fuel Tank System Fail-Safe Feature Considerations Fuel Tank Ignition Source Consideration
c. Assumptions and Considerations for Fuel Tank System Analysis. The analysis should be conducted based upon the following assumptions:
(1) Fuel Tank Flammability. The analysis should assume that the environment inside the fuel tank is always flammable. The conditions required to ignite fuel vapors from ignition sources vary with pressures and temperatures within the fuel tank and can be affected by sloshing or spraying of fuel in the tank. Due to the difficulty in predicting fuel tank flammability, the FAA has always assumed that a flammable fuel air mixture exists in airplane fuel tanks and has required that no ignition sources be present. The system safety analysis should be prepared considering all airplane in-flight, ground, service, and maintenance conditions, assuming that an explosive fuel air mixture is present in the vapor space of fuel tanks and vent systems at all times, unless the fuel tank has features that mitigate the effects of tank ignition (e.g., polyurethane foam).
(2) Failure Condition Classification. Unless design features are incorporated that mitigate the hazards resulting from a fuel tank ignition event (e.g., polyurethane foam, adequate structural margin), the SSA should assume that the presence of an ignition source is a catastrophic failure condition.
Wiring Routed Outside of Tank with Fail safe Standoffs Pump Housing Burnthrough Protected Arc/Ground Fault Circuit Protection Fault Protected Hard and Intermittent Arcing Electrical Power Flame arrestor in motor driven scavenge pump Ejector pump Scavenge Pump Inlet Covered or Protected Auxiliary Tank Pump Inlet Covered or Protected Main Feed Tank Impeller/Inlet PUMPS Separated & Shielded Fault Protected (Transient Protected) Fuel Quantity Indication Temperature Probe Fuel Level Sensor
ELECTRICAL
COMPONENTS Periodic Bond Integrity Check Redundant Bond Paths- ELECTROSTATIC or
LIGHTNING Ignition Source Present In Fuel Tank