Lightning Protection of Fuel Systems Transport Category Airplanes §25.954 vs. §25.981(a)(3) Eng. Maurício Veloso mauricio.veloso@anac.gov.br +55 12 3797-2385 Summary • • • • • Background Timeline Regulations Policies References Background • Lightning Zone 1 – First Return Stroke Zone 2 – Swept Stroke Zone 3 – Unlikely Attach. (Conduction) Zone 2 Zone 3 Zone 2 Zone 1 Background • Fuel Tanks • Structures • Systems Timeline • • • • • Sep. 1962 – CAR 4b. 628 Lightning Strike Protection Dec. 1964 – 14CFR Part 25 -> §25.1015 Lightning Strike Protection Sep. 1967 – §25.954 Fuel System Lightning Protection (identified as §25.981 on NPRM) and §25.981 Fuel Tank Temperature Apr. 1970 – §25.581 Lightning Protection Apr. 1994 – §25.1316 System Lightning Protection Jul. 1996 – TWA-800 accident • Oct. 1999 – NPRM for §25.981 Fuel Tank Ignition Prevention Ago. 2000 – TWA-800 NTSB final report • • • • May 2001 – §25.981 effective (Amdt. 102) May 2009 – FAA Policy memo ANM-112-08-002 Nov. 2009 – Start Large Airplane Fuel System Lightning Protection ARC May 2011 – ARC Finish Regulations • • • • §25.954 §25.901(c) §25.1309 §25.981(a)(3) §25.954 § 25.954 Fuel system lightning protection. The fuel system must be designed and arranged to prevent the ignition of fuel vapor within the system by— (a) Direct lightning strikes to areas having a high probability of stroke attachment; (b) Swept lightning strokes to areas where swept strokes are highly probable; and (c) Corona and streamering at fuel vent outlets. [Amdt. 25–14, 32 FR 11629, Aug. 11, 1967] §25.954 • Before Amendment 25-102 to part 25, § 25.954 was the regulation applied to lightning protection of fuel tanks. • As it was normally applied, that regulation only required prevention of ignition of vapors in the tank with no consideration of: – – – – expected design failures, aging, wear, or maintenance errors for airplane structure. §25.901(c) Subpart E – Powerplant General § 25.901 Installation. ... (c) For each powerplant and auxiliary power unit installation, it must be established that no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane except that the failure of structural elements need not be considered if the probability of such failure is extremely remote. §25.1309 § 25.1309 Equipment, systems, and installations. (b) The airplane systems and associated components, considered separately and in relation to other systems, must be designed so that— (1) The occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane is extremely improbable, and … (d) Compliance with the requirements of paragraph (b) of this section must be shown by analysis, and where necessary, by appropriate ground, flight, or simulator tests. The analysis must consider— (2) The probability of multiple failures and undetected failures. §25.901 and §25.1309 • Existing composite and aluminum structural technology can generally provide the ability to withstand single faults and still prevent ignition sources in the event of lightning attachment for most areas of the design. • However, systems with potentially catastrophic failure modes typically meet requirements such as §§ 25.901 and 25.1309 through a design architecture that can withstand multiple independent failures without a catastrophic effect. • As it applies to fuel tank lightning protection for basic airplane structure, compliance with § 25.981(a)(3) would typically need a design with three highly reliable, independent, and redundant protective features to prevent ignition sources. §25.981(a)(3) • 25.981(a): “ No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapors. This must be shown by: • “(3) Demonstrating that an ignition source could not result from each single failure, from each single failure in combination with each latent failure condition not shown to be extremely remote, and from all combinations of failures not shown to be extremely improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered.” AC 25.981-1C (1) Section 25.981(a)(3) defines three failure scenarios that must be addressed in order to show compliance with the rule: (a) Each single failure, regardless of the probability of occurrence of the failure, must not cause an ignition source. (b) Each single failure, regardless of the probability of occurrence, in combination with any latent failure condition not shown to be at least extremely remote (i.e., not shown to be extremely remote or extremely improbable), must not cause an ignition source. (c) All combinations of failures not shown to be extremely improbable must not cause an ignition source. AC 25.981-1C • For compliance with §25.981(a)(3): • “fuel tank vapor should be assumed to be flammable at any time (probability of flammability = 1).” • “applicants should assume that a lightning attachment could occur at any time (probability of lightning = 1).” Fuel Tank Ignition Sources §25.981(a)(3) Lightning Protection Structure Compliance demonstrated Impractical Petition for Exemption Policy Memo Prob.Light.= PL Prob. Flamab.=PF Assess. Prob. Ignition Event Systems Compliance Practical Compliance - Prob. Lightning = 1 - Prob. Flammability = 1 - Prob. of Ignition Source comply with §25981(a)(3) Exemption Petition for Exemption Fault Tolerant Design Non Fault Tolerant Design Demonstrate F.T. Impratical Demonstrate two independent, effective, and reliable lightning protection features Demonstrate Ignition of Fuel Vapor Extremely Improbable Applicable Regulations • § 25.954 Fuel system lightning protection. • § 25.981 Fuel tank ignition prevention. • § 21.50 Instructions for continued airworthiness and manufacturer’s maintenance manuals having airworthiness limitations sections. • § 25.901 Installation. (Powerplant) • § 25.1301 Function and installation. (Equipment) • § 25.1309 Equipment, systems, and installations. • § 25.1316 System lightning protection. • § 25.1353 Electrical equipment and installations. • § 25.1529 Instructions for continued airworthiness. • Appendix H to part 25–Instructions for Continued Airworthiness Applicable Policies • • • • • • • • • • AC 25.981-1C - Fuel Tank Ignition Source Prevention Guidelines FAA Policy Memo ANM-112-08-002 - Policy on Issuance of Special Conditions and Exemptions Related to Lightning Protection of Fuel Tank Structure AC 25-8 Auxiliary Fuel System Installations AC 20-53B Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Caused by Lightning AC 20-136A Protection of Aircraft Electrical/Electronic Systems against the Indirect Effects of Lightning AC 20-155 SAE Documents to Support Aircraft Lightning Protection Certification AC 25-16 Electrical Fault and Fire Prevention and Protection AC 25-19 Certification Maintenance Requirements AC 25.981-2A Fuel Tank Flammability Reduction Means AC 25.1701-1 Certification of Electrical Wiring Interconnection Systems on Transport Category Airplanes Applicable Guidance • • • • ARP 5412A - Aircraft Lightning Environment and related test waveforms ARP 5414A - Aircraft Lightning Zoning ARP 5416 - Aircraft Lightning Test Methods ARP 4761 - Aerospace Recommended Practice, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment. Obrigado. Dúvidas e Discussão até 9:30. Eng. Maurício Veloso mauricio.veloso@anac.gov.br +55 12 3797-2385