# Large Airplane Fuel System Lightning Protection Rulemaking Recommendations

May 2011

Federal Aviation Administration Large Airplane Fuel System Lightning Protection Aviation Rulemaking Committeeii Cover photo courtesy of University of Fl orida International Center for Lightning Research and Testing

### LIGHTNING ARC FINA L REPORT PAGE iii



## TABLE OF CONTENTS

TABLE OF CONTENTS............................................................................................................. iii

TABLE OF CONTENTS.............................................................................................................. iv

FOREWORD.................................................................................................................................. 1

EXECUTIVE SUMMARY............................................................................................................ 2

1.0 INTRODUCTION ............................................................................................................... 5

1.1 Lightning ARC Tasks

.......................................................................................................... 7

1.2 Task Group Organization

................................................................................................... 8

2.0 BACKGROUND.................................................................................................................. 9

2.1 Lightning Effects on Airplanes

........................................................................................... 9

2.2 Lightning-Related Accidents

.............................................................................................. 9

2.3 Fuel Systems Lightning Protection Regulations, Policy and Advisory Material

......... 10

3.0 TASK EVALUATION ...................................................................................................... 13

3.1 Task 1

.................................................................................................................................. 13

3.1.1 Evaluation of the Issue

............................................................................................... 13

3.1.2 Findings

....................................................................................................................... 14

3.2 Task 2

.................................................................................................................................. 15

3.2.1 Evaluation of the Issue

............................................................................................... 15

3.2.2 Findings

....................................................................................................................... 22

3.3 Tasks 3, 4 and 5

.................................................................................................................. 23

3.3.1 Evaluation of the Issue

............................................................................................... 24

3.3.2 Findings

....................................................................................................................... 42

3.4 Task 6

.................................................................................................................................. 44

3.4.1 Evaluation of the Issue

............................................................................................... 44

3.4.2 Findings

....................................................................................................................... 48

3.5 Task 7

.................................................................................................................................. 50

3.5.1 Evaluation of the Issue

............................................................................................... 50

3.5.2 Findings

....................................................................................................................... 56

3.6 Task 8

.................................................................................................................................. 58

3.6.1 Evaluation of the Issue

............................................................................................... 58

3.6.2 Findings

....................................................................................................................... 60

3.7 Task 9

.................................................................................................................................. 62

3.7.1 Evaluation of the Issue

............................................................................................... 62

3.7.2 Findings

....................................................................................................................... 64

4.0 DISCUSSION OF FINDINGS.......................................................................................... 65

5.0 RECOMMENDATIONS .................................................................................................. 69

6.0 REFERENCES .................................................................................................................. 73

### LIGHTNING ARC FINAL REPORT PAGE iv



## TABLE OF CONTENTS - CONTINUED

LIGHTNING ARC MEMBERSHIP .................................................................Appendix A

LIGHTNING ARC CHARTER......................................................................... Appendix B

ACRONYMS AND ABBREVIATIONS.......................................................... Appendix C

STRUCTURES WORKING GR OUP REPORT...............................................Appendix D

CRACKS AND FASTENER CURRENT DISTRIBUTION STUDY.............. Appendix E

### LIGHTNING ARC FINA L REPORT PAGE 1



## FOREWORD

All proposals and discussions contained in th is Final Report have been reviewed and unanimously accepted by the members of the Large Airplane Fuel System Lightning Protection Aviation Rulemaking Committee (Lightning ARC) as accurate and comprehensive representation of the committee deliberations that occurred from August 2009, to May 2011.

### LIGHTNING ARC FINA L REPORT PAGE 2



## EXECUTIVE SUMMARY

The Federal Aviation Administration (FAA) ch artered the Large Airplane Fuel System Lightning Aviation Rulemaking Committee (Li ghtning ARC) to re-examine Title 14, Code of Federal Regulations (14CFR ) sections 25.954 and 25.981 to address the impracticality of complying with § 25.981 at Amendments 25-102 [5] and 25-125 [6] for fuel tank lightning protection.

The Lightning ARC included industry members th at are the leading aircraft lightning protection design experts in the world, along wi th the leading regulatory experts working in the lightning area. The Lightning ARC char ter identified nine committee tasks. To complete those tasks, the Lightning ARC held ten face-to-face meetings, one fullcommittee web-based meeting, and over 30 inte rnational teleconfer ences. In between meetings, detailed technical evaluations were developed by Lightning ARC members to complete the Lightning ARC Charter tasks a nd prepare this report. In addition, a subcommittee made up of airplane manufacturer stru ctural experts was established by the Lightning ARC to address struct ure-specific issues, such as the occurrence of cracks and fastener failures. The Lightning ARC also commissioned a specific study of lightning

current distribution at struct ural cracks and fasteners, including the evaluation of lightning-related sparks at thes e cracks and fasteners. The results of the special studies are presented in appendices. The Lightni ng ARC findings and recommendations are included in this report.

Lightning ARC recommendations based upon its findings are:

1. Prevention of fuel vapor i gnition due to lightning shoul d be the objective of the regulations, achieved through both fla mmability control and ignition source prevention. Existing Part 25 regulati ons provide adequate flammability requirements. Thus, lightning-specifi c requirements should focus on ignition source prevention.

2. Both structure and systems should be addressed in the same fuel system lightning protection rule with the same requirements.

3. A prescriptive approach requiring single fault tole rant designs should be mandatory. If fault tolerance is impracti cal, a qualitative assessment, such as the Lightning Hazard Assessment recommended in SAE ARP5577 [12] , should be

conducted to ensure that the combination of non-fault-tolerant failures resulting in an ignition source is remote.

4. Manufacturing variability, ag ing, wear, corrosion and likely damage should be addressed by design, manufacturing pro cesses and/or by instructions for continued airworthiness (ICA).

5. Caution information for critical li ghtning protection features should be incorporated into instructi ons for continued airworthiness to minimize accidental or likely damage to these features duri ng performance of maintenance, alteration or repairs.

### LIGHTNING ARC FINA L REPORT PAGE 3

6. Inspections and procedures required fo r non-fault-tolerant designs should be

included in the Airworthiness Limitations se ction of the instructions for continued airworthiness, whereas fault tolerant desi gns should utilize tasks developed by the MRB or a sampling program where appropriate.

7. Changes should be made to Air Tran sport Association (ATA) Maintenance Steering Group (MSG) document MSG-3 [20] to support instructions for continued airworthiness for fuel tank lightning protection. Addition of a new section specific to fuel tank lightni ng protection is recommended.

8. No requirement for lower flammability should be included in the lightning regulations.

9. New guidance material should be deve loped and existing guidance material

should be revised to ensure a consistent approach to fuel system lightning protection is applie d across industry.

Proposed Rulemaking The Lightning ARC recommends §§ 25.954, 25.981 and Appendix H be revised to read

as follows:

§ 25.954 Fuel system lightning protection. (a) The fuel system must be designed and installed to prevent catastrophic fuel vapor ignition due to lightning. (b) The fuel system lightning protection design must be fault-tolerant for failures that result in lightning- related ignition sources. (c) Fault tolerance is not required for any specific design feature if: (1) providing fault tolerance is shown to be impractical for that feature,

and (2) the failures that lead to lightni ng-related ignition sources from that

feature and all other non -fault-tolerant features , when combined, are

shown to be remote. (d) Inspections or other procedures must be estab lished as required by Sec. 25.1529 to prevent development of lightning- related ignition sources within the fuel tank system pursuant to paragraphs (b)(c) of this section. Caution information for critical lightning protecti on features shall be incorporated into

instructions for continue d airworthiness required by Sec. 25.1529 to minimize accidental or likely damage to these feat ures during performance of maintenance, alteration or repairs. Required inspecti ons and procedures for non-fault-tolerant features in paragraph (c) of this section must be in cluded in the Airworthiness

Limitations section of the instructions for continued airworthiness required by

Sec. 25.1529.

### LIGHTNING ARC FINA L REPORT PAGE 4

§ 25.981 Fuel Tank Ignition Prevention (a) No ignition source may be present at e ach point in the fuel tank or fuel tank system where catastrophic failure could o ccur due to ignition of fuel or vapors. This must be shown by: (3) Except for ignition sources due to lightning subject to Sec. 25.954

, demonstrating that an ignition source could not result from each single failure, from each single failure in co mbination with each latent failure condition not shown to be extremely re mote, and from all combinations of

failures not shown to be extremel y improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely damage must

be considered.

§ H25.x Fuel System Lightning Prot ection Instructions for Continued

Airworthiness (a) The applicant must prepare Instruc tions for Continued Airworthiness (ICA) applicable to fuel system lightni ng protection including the following: (1) Mandatory maintenance or inspections necessary to preclude the development of unsafe conditions du e to non-fault tolerant lightning protection features shall be identifi ed as Airworthiness Limitations and approved by the Administrator. (2) Sampling programs, maintenance and/ or inspections for fault tolerant lightning protection features, included in the manufacturer’s recommended airplane maintenance program and acceptable to the Administrator. (3) Caution information which identif ies the lightning protection features of the fuel system design, to mini mize the potential for inadvertent damage or disruption of lightning pr otection features, included in the applicable airplane maintenance documents and acceptable to the

Administrator.

The Lightning ARC also recommends that the preamble for the rule should clarify that fuel system lightning protection be excluded fr om rules of general applicability such as §§ 25.901 and 25.1309.

Required interpretation and intent for the § 25.954 rule is provided in the Recommendations section of this report.

### LIGHTNING ARC FINA L REPORT PAGE 5



## 1.0 INTRODUCTION

Prior to Amendment 25-102 [5] to Title 14, Code of Federa l Regulations (14CFR) section 25.981, the lightning protection requirements for fuel tanks were contained in § 25.954 of that same Title. Section 25.954 applied to system components as well as airplane structure. That regulation required prevention of ignition of vapors in the fuel tank, but it did not take into account anticipated desi gn failures due to manuf acturing variability, aging, wear, corrosion and likely damage.

In May 2001 FAA issued Amendment 25-102 [5] . This amendment added specific ignition prevention requirements and a new flammability minimization requirement to § 25.981. The amendment contained specific ignition prevention requirements in § 25.981(a)(3) that included consideration of f actors that might cause ignition sources in fuel tanks. The factors requiring considera tion included manufacturi ng variability, aging, wear, corrosion and likely damage, as well as evaluation of single failures and combinations of failures, including latent fa ilures. These requirements applied to fuel tank systems and fuel tank structure.

Systems with potentially catastrophic fa ilure modes would typically meet the requirements of § 25.981(a)(3) when they provid ed at least triple-r edundancy in their protective features, or dual-redundancy with continuous system monitoring to reduce the latency period. Dual-redundant designs coul d only comply with § 25.981(a)(3) when combined with either regular inspections at very short intervals or with a monitoring device to verify the functionality of the protective features. Inspection of the various design features might be diffi cult or impossible if the feat ure is covered by airframe

structure.

To prevent all sources of ignition in a fuel tank, the design had to be fail-safe so that a hidden or latent failure when combined with another failure would not cause an ignition source. An acceptable design must provide a th ird protective design feature. Applicants have argued that adding a third independent lightning protection feature or providing sufficient monitoring to detect latent failu res in a dual-redundant protection feature are both impractical for certain areas of airplane wing structure, such as airplane skins, joints, ribs, spars, stringers, and associated fastener s, brackets, and coatings . Incorporating three independent protection features to control st ructural ignition is not technically possible for some designs or is too expensive to pr oduce and maintain using currently available technology.

It is impractical to continuously monitor or inspect the protection features. These protection features are typically in tegral to the fuel tank structur e or inside the fuel tanks. Inspection of design features inside fuel tank s requires access to the fuel tanks, which is usually only scheduled once or twice during the life of the airplane. Increasing the frequency of internal fuel tank inspections could increase the possibi lity of damaging the lightning protection features dur ing the inspection process. Because of these issues, FAA developed policy related to exemptions and special conditions for § 25.981(a)(3).

### LIGHTNING ARC FINA L REPORT PAGE 6

FAA decided it is appropriate to re-exa mine §§ 25.954 and 25.981 to address these and other issues that have surfaced during app lication of the require ments of Amendment 25-

102 [5] to fuel tank lightning protection design. The FAA’s intent is to establish a balanced approach to ensure that airplane designs provide an accep table level of safety, while allowing manufacturers to use econom ically viable design, manufacture, and operation. The new standards should require the applicant to develop structural component designs that are as free of ign ition sources as practical. In addition, the applicant must consider fuel vapor fla mmability in developing a design with an acceptable level of safety.

FAA chartered the Aviation Rulemaking Commi ttee (Lightning ARC) with members that include airplane lightning protection design specialists and aviation airworthiness authorities that represent di verse viewpoints. FAA par ticipation and support came from all affected lines-of-business. The Light ning ARC was directed to set up specialized work groups, where necessary, that include at least one Lightning ARC member plus invited subject matter experts from industry and government.

The Lightning ARC sponsor was the FAA Tran sport Airplane Directorate Manager.

The names of Lightning ARC members, observers and contributors are listed in Appendix A.

### LIGHTNING ARC FINA L REPORT PAGE 7



### 1.1 Lightning ARC Tasks The Lightning ARC charter (Appendix B) included the following tasks:

1. Determining whether the approach to fuel tank safety related to lightning protection should be focused on fuel va por ignition, ignition sources, or a

combination of both.

2. Determining whether the lightning protect ion regulation changes should apply to the complete fuel system, or just to the fuel tank structure.

3. Determining what type of safety assessm ent approach should be used (e.g.; SAE

Document ARP5577 [12] or § 25.1309). Define content and procedures of the safety assessment.

4. Determining whether a probabilistic appro ach, prescriptive pass/fail criteria, or a combination of both using qualitative anal ysis, should be applied to structure or the complete fuel system lightning protecti on. If a probabilistic approach is used, determine if flammability exposure should be considered. Determine how single

failures should be addressed. Determ ine what types of single failures are impractical to preclude. Finally, dete rmine what probabilis tic distribution of lightning amplitudes would be accep table as an industry standard.

5. Establishing which components and insta llations must be addressed and which failure modes (including possibility of cas cading failures) should be considered. Determine if all foreseeable, likely, or a specific set of failures should be addressed in determining adequate st ructural lightning protection. If a probabilistic approach is us ed, determine the criteria that should apply for the standard. Identify acceptable data to s upport the safety analysis (e.g., supporting failure rates).

6. Determining a means to address manufact uring variability, age, wear, corrosion, and likely damage to light ning protection features.

7. Determining criteria associated with inst ructions for continued airworthiness and any needed modifications to processes de fined in Revision 3 to the Maintenance Steering Group (MSG-3) document.

8. Considering the effect of reducing the flammability below the criteria of § 25.981(b), Amendment 25-125, in adjust ing the other tasks listed above.

9. Identifying compliance guidance that might be required to facilitate showing compliance with the recommendations above.

### LIGHTNING ARC FINA L REPORT PAGE 8



### 1.2 Task Group Organization In order to accomplish the tasking defined in its Charter, the Li ghtning ARC was divided into major task groups, with each group or ganized around similar subject matter tasks.

The Task Groups are the following:

TASK GROUP 1: Andy Plumer, Co-Chair Rod Graham, Co-Chair

Regulatory Scope for Fuel Sy stem Lightning Protection. Task Group 1 addressed tasks 1, 2, 8 and 9 from the Li ghtning ARC Charter. This task group was primarily focused on the overall general application and intent of the current rule and how it might be revised to accomp lish the overall safety of the airplane fuel system without driving complexity to the point where the requirements for the design become impractical. In a ddition, the Task Group was assigned the work of defining the compliance guidance that needs to be developed or revised to support the revision to th e regulatory requirements.

TASK GROUP 2: Dale Winter, Co-Chair Dave Walen, Co-Chair

Safety Assessment for the Fuel System Lightning Protection. Task Group 2 addressed tasks 3, 4, and 5 from the Li ghtning ARC Charter. This Task Group was primarily focused on the overall a pproach to safety assessment and application of the compliance requirements in terms of either a probabilistic or a prescriptive approach.

TASK GROUP 3: Peter Bootsma, Co-Chair Helio Librantz, Co-Chair

Manufacturing and Continued Airworthiness Considerations. Task Group 3 addressed tasks 6 and 7 from the Lightni ng ARC Charter. This Task Group was primarily focused on the overall approach of how to address manufacturing, aging and continued airworthiness in regard to the protection used for fuel system and structure with respect to the lightning threat.

The Task Groups gathered background info rmation, reviewed relevant history and developed sections for a first draft of the Lightning ARC Report. Once that was accomplished, all further report development, review, and approval were accomplished by the entire Lightning ARC.

### LIGHTNING ARC FINA L REPORT PAGE 9



## 2.0 BACKGROUND

2.1 Lightning Effects on Airplanes Lightning strikes to airplanes occur regularly; on an order of once per year for a commercial transport, particularly to airpla nes operating in inst rument meteorological conditions. When lightning stri kes an airplane, high transien t current is conducted in the airplane structure. The transient current can melt, burn, and deform airplane parts and structure where the lightning attaches to the airplane. The high light ning current is also conducted through airplane structure between the lightning attachment points on the airplane. The conducted lightni ng transient current can also induce voltage and current on airplane wiring, tubes and control mechan isms. Melting, burning, arcing, or sparking due to conducted lightning current or voltage can result in fuel vapor ignition if they

occur in a flammable environment.

Methods for preventing ignition sources due to lightning strikes are mature and are based on years of research into natural lightni ng characteristics and effects upon airplane structures and systems. The results have been documented in a wide body of literature

and formalized into standards such as SAE documents ARP5412 [16] , ARP5414 [21] and

ARP5416 [22] . Use of these standards has been accepted by FAA through Advisory

Circulars AC 20-53B [3] and AC 20-155 [23] . Much of the supporti ng research has been published by the International Conference on Li ghtning and Static Electricity (ICOLSE), National Aeronautics and Space Administrati on (NASA), the European Organization on Commercial Aircraft Equipment (EUROCAE), and in other industry forums. A high degree of communication among airplane light ning specialists worldwide assures that designers and certification authorities are con tinually informed of advances in lightning protection technology and a pplication of this technology to new designs.



### 2.2 Lightning-Related Accidents On June 26, 1959, a Lockheed L-1649A Constellation was struck by lightning and experienced explosions in two of its fuel ta nks, resulting in a cras h. This airplane was fueled with aviation gasoline. Prior to the time of this accident there had been research conducted into the possible effect s of lightning on airplane fuel tanks but the scope of this had been limited to integral fuel tank skin melt-through and hot-spot formation.

Fuel vapor ignition due to li ghtning was the probable cause for the Boeing 707 accident that occurred near Elkton, Maryland on December 8, 1963. [1] At the time of its certification, the 707 was not required to de monstrate effective lightning protection for fuel systems. Following the 707 accident, substantial research was performed to

determine the factors that could result in li ghtning-related fuel ignition. However, most of this research focused on lightning burn-th rough for metal fuel tank structure, and lightning-related fuel vapor ignition for fuel vents.

On December 23, 1971, a Lockheed L-188A Elect ra suffered a lightni ng strike which led to a fire and separation of the right wing. Since the L-188A was certified by FAA in 1958 the type did not benefit from the additiona l attention given to airplane fuel tanks

### LIGHTNING ARC FINA L REPORT PAGE 10

after 14CFR 25.954 was published in 1967. Th e fuel type on board could not be determined by the Lightning ARC.

On May 9, 1976, a Boeing 747 crashed followi ng a lightning strike to the airplane. [2] The investigation for this accident presented evidence that fuel vapor ignition could have been caused by lightning-induced sparking at a motor-driven fuel valve.

In three of the four accidents noted above, investigations fo und that the airplane fuel tanks contained either aviation gasoline or a mixture of Jet A kerosene-type fuels and higher volatility Jet B/JP-4 fuels. The fuel type involved in the 1971 Electra accident was not identified. The investigati ons for the other three accidents determined that the fuel mixtures would be flammable at the temperatures and altitudes that the airplanes were flying in at the time of the lightning strikes. During the 1980s the use of Jet B/JP-4 fuels began to decline, becoming near ly obsolete in the 1990s.

Since the last lightning-rel ated airplane fuel tank e xplosion, the understanding of lightning effects on airplane fuel tanks and systems has increased significantly, and no

further events have occurre d even though the number of flight hours since the 1976 accident (approximately 1-billion flight hour s) is more than eight times that which preceded that event (less th an 120 million flight hours).



### 2.3 Fuel Systems Lightning Protection Regulations, Policy and Advisory Material Following the Boeing 707 Elkton [1] accident, FAA adopted new fuel system lightning protection regulations. Thes e regulations were implemen ted for transport category airplanes in § 25.954, Fuel system lightning protection

.

§ 25.954 states: The fuel system must be designed an d arranged to prevent the ignition of fuel vapor within the system by – (a) Direct lightning strikes to ar eas having a high probability of stroke attachment; (b) Swept lightning strokes to area s where swept strokes are highly probable; and (c) Corona and streamering at fuel vent outlets.

This regulation explicitly requires lightni ng protection regardless of the likelihood that lightning would strike the airpla ne. This regulation is prescr iptive in requiring effective protection, and there is no acknowledgement th at the lightning protection features could

fail or become ineffective. There is no re quirement for fault-tolerant fuel system lightning protection or for any evaluation of probabilities of failures related to the lightning protection.

Following the 1976 Madrid Boeing 747 [2] accident, further guidance for airplane fuel system lightning protection was developed. Sp ecifically, FAA revised Advisory Circular AC 20-53, Protection of Airplane Fuel Systems Against Fuel Vapor Ignition Due to

### LIGHTNING ARC FINA L REPORT PAGE 11

Lightning

, [3] along with its corresponding User’s Manual [4] . The Advisory Circular has been revised twice since its original i ssue. These documents added emphasis for lightning protection of fuel system components su ch as fuel tubes, fuel quantity systems, and fuel filler caps.

There have been no transport airplane accident s related to fuel va por ignition caused by lightning since 1976. Transport airplanes designed and certified today meet § 25.954, following the guidance in AC 20-53 [3]

.

On July 17, 1996, a Boeing 747 operating as TW A Flight 800 was involved in an inflight breakup after takeoff. The ensuing investigation determined that the center wing fuel tank exploded due to an unknown ign ition source. Following the Flight 800 accident, FAA adopted Amendment 25-102 [5] which revised § 25.981, Fuel tank ignition prevention . This amendment incorporated § 25. 981(a)(3) requiring that the fuel tank ignition source prevention design must addre ss failures within the fuel system.

§ 25.981(a)(3) states: “(a) No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapors. This must be s hown by: ... (3) Demonstrating that an ignition source could not result from ea ch single failure, from each single failure in combination with each late nt failure condition not shown to be extremely remote, and from all combina tions of failures not shown to be extremely improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered.”

While lightning was not listed as a probable cause of the Flight 800 accident, potential ignition sources due to lightning must be cons idered as part of compliance with this regulation, as lightning was mentioned in th e rulemaking preamble and the associated Advisory Circular AC 25.981-1C [27] . This regulation effec tively requires lightning protection that is fault tolera nt to two independent failure conditions. This is because failures of lightning protection features coul d remain latent for a long time between inspections. Typically these la tent failure conditions could not be shown to be extremely

remote.

When Amendment 25-102 [5] was adopted, FAA did not consider it practical to set specific limits for fuel tank flammabilit y. The amendment adopted regulation § 25.981(c) that required minimizi ng the flammability of airplane fuel tanks. This regulation did not specifically require fuel tank inerting, nor did the regulation state specific fuel tank flammability limits. When amendment 25-102 [5] was adopted, FAA stated in the preamble:

“The FAA does not concur that manda ting fuel tank in erting technology has been shown to be feasible at this time. This was discussed in detail in the preamble to the notice. We are continuing to evaluate further safety improvements, and are conducting research and development to

### LIGHTNING ARC FINA L REPORT PAGE 12

investigate the feasibility of incorp orating nitrogen inerting on both inservice and new type design airplanes. As noted previously in this preamble, we tasked the ARAC on July 14, 2000 (65 FR 43800), to evaluate both on-board and ground-based fuel tank inerting systems. If further improvement is found to be prac ticable, we may c onsider initiating further rulemaking to addr ess such improvements.”

However, following the implementation of Amendment 25-102 [5] , active fuel tank flammability reduction systems were developed and installed that could practically limit fuel tank flammability. Subsequently, FAA adopted Amendment 25-125 [6] , which set specific limits for fuel tank flammability. This Amendment modified § 25.981(b) to set specific limits for fuel tank flammability, expressed in terms of the fleet average flammability exposure.

Following the adoption of Amendment 25-102 [5] , several applicants found that it was impractical to achieve dual fault toleran ce for fuel tank structure lightning protection. [7] [8]

[9] [24] [25] [26] FAA agreed with the applicants th at applying § 25.981(a)(3) for fuel tank structure may be impractical. As a re sult, FAA issued a policy memorandum to standardize the process for granting exempti ons and issuing special conditions for fuel tank structure lightning protection. FAA Policy Memorandum ANM-112-08-002 [10]
defined requirements that would be applied through special conditions or exemptions. These requirements included both prescriptiv e requirements and requirements based on

likelihood of occurrence.

### LIGHTNING ARC FINA L REPORT PAGE 13



## 3.0 TASK EVALUATION

3.1 Task 1 Determine whether the approach to fuel tank safety related to lightning protection should be focused on fuel vapor ignition, ignition sources, or a combination of both.



### 3.1.1 Evaluation of the Issue The Lightning ARC considered several options during its evaluation of the top level requirement for fuel tank lightning protection. After some discussion, it was realized that the three options listed in the Charter for Task 1 (fuel vapor ignition, ignition sources, or a combination of both) are actu ally two options because fuel vapor ignition is already the combination of ignition sources and flammability.

The options we considered were:

Option 1: Retaining the current igniti on-source-only focused philosophy of 14 CFR 25.981(a), or;

Option 2: Focusing on the prevention of fu el tank vapor ignition as has been the § 25.954 requirement which takes into consideration both ignition source prevention and fuel tank ullage flammability.

Consideration of further reduction in fuel tank flammability beyond the present requirements of § 25.981 Amendment 25-125 [6] will be discussed in Task 8.

Ignition Source Prevention The prevention of all potential ignition sources in fuel tanks due to lightning is an ideal requirement and the goal of all lightning pr otection designs. Airplane manufacturers have demonstrated, and FAA has concurred, that in certain areas of the fuel tank it is impractical to provide a design that can de monstrate compliance to § 25.981(a)(3), let alone eliminate all ignition source possibilities, especially when considering the potential

for latent failures and human error.

From the FAA Policy Memorandum ANM-112-08-002 [10] Page 6:

”...the FAA has now determined that application of § 25.981(a)(3) to fuel tank structural lightning protection c an be impractical for certain areas of structural design, and is therefore in appropriate for design features where the applicant shows compli ance is impractical.”

In practice, the presence of a potential ignition source alone does not directly result in a fuel tank explosion, as a fla mmable environment must also be present. Therefore, complete elimination of potential ignition so urces is not necessary to ensure a safe design.

### LIGHTNING ARC FINA L REPORT PAGE 14

Fuel Vapor Ignition Prevention (combination of ignition and flammability protection) Preventing fuel vapor ignition has been th e over-arching requirem ent in § 25.954 for over forty years. The § 25.954 requirements and ev ent history are provide d in Section 2 of this report. The designs certified to § 25.954 requirements have demonstrated outstanding safety. A contributo r to the safety record is the almost complete elimination of the use of high-flammability wide-cut fuels.

Fuel vapor ignition prevention can be achieved by limiting or eliminating flammability exposure, or eliminating ignition sources. As noted above, eliminating absolutely all ignition sources is impractical. Similarly, eliminating all flammability exposure with current fuels and technology is also impractical. An e ffective approach would use practical means to limit both the likelihood of ignition sources and flammability to prevent fuel vapor ignition. A combination of flammability and ignition control was used in FAA Policy Memorandum ANM-112-08-002 [10] and the FAA charter for this Lightning ARC states that the “ applicant must consider fuel vapor flammability in developing a design with an acceptable level of safety .”

Fuel tank flammability exposure was st udied by the 1998 Fuel Tank Harmonization Working Group following the TWA Flight 800 accident. The resulting Aviation Rulemaking Advisory Committee (ARAC) report recommended limiting flammability exposure to levels that typically occur in unheated wing tanks fueled with Jet A type fuels. FAA incorporated that recommendation via Amendments 25-102 [5] and 25-125 [6]

, which now prescriptively limit flammability exposure to less than 3%, or equivalent to a conventional, unheated, aluminum wing tank, and provide specific means for assessing flammability exposure. Other protection mean s to address flammability, such as those allowed in § 25.981(c) to mitigate the effect s of vapor ignition, are also considered sufficient for limiting flammability to prevent fuel vapor ignition.



### 3.1.2 Findings The Lightning ARC found that the top require ment should be to prevent fuel vapor ignition and that this could be achieved by an effective combination of flammability reduction and ignition source prevention. Given that § 25.981(b) amendment 25-125 [6]
already directly controls the flammability aspects, the Lightning ARC found that establishing requirements for fuel tank light ning protection could a ddress ignition sources only while still considering the top event as fuel vapor ignition. The Lightning ARC found that this combination of protection m eans can provide an acceptable level of fuel tank lightning protection, and assure that no lightning-relate d fuel vapor ignition would be expected to occur.

### LIGHTNING ARC FINA L REPORT PAGE 15



### 3.2 Task 2 Determine whether the lightning protection regulation changes should apply to the complete fuel system, or just to the fuel tank structure.

Note: The term fuel system is often used to refer to all of the airplane features related to fuel storage (i.e. tank structur e), fuel plumbing, fuel related mechanical components (e.g. pumps and valves) and elec trical wiring associated with fuel, such as wiring to components, and the fuel quantity indication system (FQIS). In the context of this section and many places elsewhere in the document, the word

systems (often highlighted in Italic font), re fers to the non-structural part of the fuel system, such as plumbing, components, FQIS, and electrical wiring.



### 3.2.1 Evaluation of the Issue 3.2.1.1 Background The Lightning ARC reviewed the background mate rial discussed in Section 2 that is

relevant to consideration of any revisions to existing regula tions and policy applicable to lightning protection of fu el tank structures and systems

.

The Policy Memorandum ANM-112-08-002 [10] applies only to tank structure, not

systems

. In the comments to the draft Polic y Memorandum, industry recommended the Policy also apply to fuel systems lightning protection. FAA did not incorporate this recommendation, partly based upon the concern that maintenance to systems presented a significant additional risk. Further, FAA stated that applicants had shown compliance of

fuel systems lightning protection to § 25.981(a)(3), thus demonstrating that compliance was practical. In response to the industry comment, FAA stated:

“ In developing the proposed policy, th e FAA determined that relief from the requirement of § 25 .981(a)(3) was warranted for areas where it was shown to be impractical to meet th at regulation, and where it could be shown that an acceptable level of safe ty would be provided by meeting a different standard. The FAA agrees that, from an electrical bonding standpoint, there is not a clear line between structural elements and systems elements, and many of the same design challenges exist for both structural bonding and the bonding of sy stems elements. The extension of the proposed relief to systems elem ents and systems supporting structure was carefully considered. One of th e significant factors that led the FAA to arrive at the proposed scope for the alternative standard was the expected level of maintenance (disas sembly and reassembly) for these design areas. Disassembly and reassemb ly of electrical bonding elements is considered to present a significant additional risk that a bond will be compromised during the life of an airp lane, which generally does not exist for structure that is intended to be permanent .”

The Lightning ARC reviewed the technical aspe cts of lightning interactions with fuel

tank structure and fuel systems , and the techniques that are available for protection. The Lightning ARC found that similar pr otection techniques are used for systems and tank

### LIGHTNING ARC FINA L REPORT PAGE 16

structures. The lightning protection design techniques include electr ical bonding, insulation and isolation, arc containment, and current diversion.

The Lightning ARC reviewed the hi story of activiti es related to systems lightning protection compliance to § 25.981, the majority of which are projects from our Lightning ARC members companies. There are few pr ojects that have de monstrated lightning protection compliance of fuel tank systems with § 25.981(a)(3) using the rigorous systems-level assessment that the current FAA interpretation of § 25.981(a)(3) requires. While some designs have achieved compliance, or anticipate agreement on compliance in the near term, many of the features incorpor ated to achieve dual fault tolerance add complexity and are not needed to provide a safe design in which events would be extremely improbable. The Lightning ARC que stions the benefit of introducing the complexities needed to demonstrate dual fau lt tolerance for lightning threats relative to overall fuel tank safety.



### 3.2.1.2 Options In our evaluation of whether the lightning pr otection regulation cha nges should apply to the complete fuel system, or just to the fuel tank structure, two op tions were considered.

Option 1: Changes should addr ess the tank structure alone.

Option 2: Changes should addres s the tank structure and the fuel systems

.

During our consideration of these options the following relevant fact ors, each discussed beneath a bold headline, became evident:

The lightning environment and effects are similar for both systems and structures. Lightning currents that enter internal system components and struct ural elements are driven by the same mechanisms. These include:

 Direct lightning attachment to structure or system com ponents located in areas of likely attachment.

 Lightning currents conducted into exterior a nd interior structural elements such as tank skins, stiffeners, spars, ribs, fuel pipes and system components.

 Transient voltages and curre nts induced into structur e, plumbing and electrical wiring within the fuel tanks for equipmen t such as fuel probes, fuel pumps, and

fuel valves

.

When an airplane is struck by lightning it beco mes part of the lightning current path. The lightning current typically attach es at one location on the airp lane, such as a wing tip, and flows through the structure to an attachment lo cation on another extremity of the airplane. If one of the initial lightning channel attachment locations is at a forward extremity such as the nose or an engine nacelle, the airpla ne flies through the lightning channel which reattaches to other locations aft of the initi al attachment location. Lightning doesn’t

### LIGHTNING ARC FINA L REPORT PAGE 17

differentiate between systems and structures; it only sees conductive paths, loops,

resistances and installations.

For more information on the interaction of ai rcraft and lightning, including fuel tanks and systems, see Section 3 of SAE ARP5416 [22] or the handbook Lightning Protection of Aircraft [11]

.

Lightning protection means for mechanic al systems and structure are similar. Airplane lightning protection is achieved by understanding the behavior of lightning currents throughout the airplane, a nd addressing each of the effe cts of these currents with robust protection designs. Fo r fuel tank structures and systems , protection design begins with making the airframe as inherently safe as possible by selecting appropriate materials and assembly methods, and adding dedicated pr otection features where necessary. These protection features include electrical bonding to enable safe conduction of current, isolation of hazardous current paths, and pr ovision of barriers between potential ignition sources and fuel vapors. The same approach es used for lightning protection of a fuel pump installation are used for preventing igniti on sources at fuel tank skin, rib and spar joints. Designs are based on industry sta ndards that define th e airplane lightning environments, and adequacy of protection is verified by a combination of analysis and tests done in accordance to industry standards. These standards are referenced by FAA advisory circulars and are under consta nt review by SAE Committee AE-2 and EUROCAE Working Group 31 with particip ation by FAA and other airworthiness

authorities.

When a system component is expected to be removed for inspection or replacement, the design features have to ensure that the pr otection effectiveness is preserved in the replaced component. To effectively achieve this, the design must be simple to remove

and reinstall as well as be tolerant to installation errors.

Failure modes of lightning protection for systems and structure are similar. Because the lightning protection met hods and many of the features for systems and structure that implement the lightning prot ection are similar, the failure modes which could lead to potential igniti on sources will also be simila r. Failures can result from aging, wear, corrosion, manufactur ing defects, and maintenance errors. Such failures and the lightning current densities or voltag e potential differences sufficient to produce ignition sources may appear in both systems and structures.

Analysis and test tools that are utilized to quantify lightning effects and verify designs are similar. The tools used to determine the magnitudes of lightning currents in fuel tank structural elements are fundamentally the same as t hose tools used to determine the lightning voltages and currents in systems and installations. The physic s are the same whether the objective is managing current in internal tank structural elem ents or voltage induced in FQIS wiring. Commonly used tools such as finite difference time domain codes have been employed to compute fuel tank fastener and structural element currents, as well as voltages appearing across insu lated fuel pipe sections and between fuel probes and

### LIGHTNING ARC FINA L REPORT PAGE 18

adjacent tank structure. Also, the same li ghtning test equipment and standards that are used to look for ignition sources within fu el tank structural components are used for testing fuel system installations. The standard for these tests is SAE ARP5416 [22] , which defines similar methods for both structural and system ignition source evaluations. Lightning laboratories and thei r engineers and technicians perform lightning tests on both

systems and structures.

The ability to provide additional layers of protection for systems is not a justification for requiring their implementation. The additional layers may have no commensurat e safety benefit, yet their complexity can

lead to additional failure m odes. In the disposition of comments to the Policy

Memorandum ANM-112-08-002 [10] , FAA stated that applicants had shown compliance of

fuel systems lightning protection to § 25.981(a)(3), thus demonstrating that compliance was practical. The Lightning ARC reviewed th is position and concluded that the ability to implement more complex designs does not m ean it is practical from the perspective of achieving a commensurate benefit. In fact, a more complex design will usually have

additional failure modes or increased risk of errors that can reduce overall safety, rather than enhance safety. A different requirement for systems than for structure, based solely on the availability of technology to implemen t additional layers of protection, is not appropriate justification for a different standard.

One example of a more comple x, but potentially less safe system installations is where three parallel stand-off clamps are used to provide dual fault-tolerant insulated support for a fuel pipe. While achieving a require ment for three independent, effective and reliable supports for the fuel pipe, the probabi lity of insulation failure due to breakage, contamination or material defect has been increased by a factor of thr ee. It may be better to consider one or two mechanically robust cl amps with plenty of insulation instead of three smaller clamps.

Fuel pipe isolators may be used to prevent lightning currents from flowing in the pipes and couplings. One such isolator with suffi cient capability is bette r than two or three such isolators in series which might be utili zed to meet a dual fault tolerant requirement but provide no more lightning protection than a single isolator. There may also be

common-cause failures that could defeat all of the isolators such that dual fault tolerance is not really achieved by adding additional isolators. The additional components may even introduce new ignition source risks Fo r example, if bond straps used to ground the resulting intermediate conductive pipe coup lings become loose or are omitted during maintenance, a potential ignition source due to static discharges might result. Further, additional plumbing joints within a fuel system increase the potential for fuel leaks which can lead to engine fuel feed problems.

In another example, multiple parallel bond st raps may be installed across a pipe coupling to achieve a dual-redundant electrical bonding path. Additional bond straps increase the possibilities of strap and associated clam p failures, which, depending upon the design, might lead to arcing during a lightning stri ke. Parallel bond straps can create unwanted induced current loops, resulting in the stra ps and clamps becoming potential ignition

### LIGHTNING ARC FINA L REPORT PAGE 19

sources, themselves requiring dual fault tolerant designs. There is al so the possibility of multiple bond straps making inadvertent contact with each other, resulting in an electrical arc source. While the design inte nt would have been to ensure that an original threat is precluded, additional potential failure modes leading to potential ignition sources are introduced. A robust design that achieves th e desired level of safety without these additional complexities is superior.

The addition of designs with multiple layers of protection in small spaces may result in less robust individual designs. Examples are small volume spaces such as fuel collector or sump tanks where there are many components in close proximity to each other. The need to fit additional features in a tight space may introduce unexpected hazards. This is especially true for smaller Part 25 airplanes, su ch as business jets, but is true for areas in large transport airplanes as well.

Multiple redundant features increase the potential for installa tion and inspection errors, both in the factory and during maintenance. A significant factor in the omission of systems from Policy Memorandum ANM-112-08-

002 [10] was the distinction between those components or elements which are expected to remain in place for the life of the airplane ve rsus those which are expected to be removed and reinstalled. Although maintenance act ivity can increase the likelihood that a disturbed lightning protection feature is rendered ineffectiv e, the risk of ineffective lightning protection can be greater with multiple redundant lightning features on removable components because all features must be disconnected and reconnected in order to replace the component. An example is a fuel pipe that is electrically bonded using multiple redundant bond straps in order to comply with the requirement. This means that the installer and inspector would have up to three sepa rate opportunities for making a mistake, resulting in multiple potential installation configurations which are

incorrect and less safe for ever y one correct combination. This situation is not the result of an inadequate design, but the inevitable consequence of additional redundancy in the

context of a common mode factor such as lightning, which aff ects every protection feature simultaneously.

In contrast, a single robust lightning prot ection feature has only one opportunity for improper installation, and the pr obability of a mistake can be readily reduced by proper maintenance and inspection procedures. This approach results in equivalent effective lightning protection while dramatically reducing the potential for erroneous installations.

The existing regulation § 25.954 and associated AC 20-53B [3] address both

structural and system s lightning protection with common requirements and guidance. Section 25.954, Fuel System Lightning Protection , has been used to demonstrate compliance for both systems and structural lightning prot ection since 1967. The history of lightning protection for airp lanes certified to these requirements has been excellent (one event noted in Section 2). While the 1967 wording for the subparts to the rule do not emphasize systems , the associated advisory material AC 20-53B [3] includes the need

### LIGHTNING ARC FINA L REPORT PAGE 20

to assess lightning effects on both systems and structure. For example, AC 20-53B [3]
states the following regarding systems :

“

2. SCOPE

b. We address ignition hazards caused by direct effects on main and auxiliary fuel tanks, fuel t ank components and plumbing, and the indirect effects (upset or damage) on analog or digital electronic and electrical systems that could le ad to ignition hazards on wires or equipment such as fuel quantity prob es located in a fuel tank cavity containing fuel vapor.”

“5. LIGHTNING EFFECTS ON FUEL SYSTEMS

c. All or some of the lightning curre nt may be conducted through fuel tanks or fuel system components. It is important to determine where the current flows through the aircraft to allow for adequate design measures to protect the fuel system.”

“6. FUEL SYSTEM LI GHTNING PROTECTION

b. When designing the fuel system lightning protection, consider the following factors: (6) Lightning currents flowing in th e internal components of the fuel system (such as fuel and ven t lines, conduits, or internal structural parts) may produce el ectrical sparks and ignite flammable vapors. (7) Lightning currents flowing in the airframe produce voltage differences between adjacent parts or structure. The lightning electromagnetic fields can induce tr ansient voltage and current in the electrical wiring and compone nts of the fuel system.”

Using the same design standard for both structure and systems is more likely to

ensure all elements are considered.

If both systems and structure are considered together beginning with th e initial design on through lightning effects assessment, protecti on design and verification there will be less likelihood that some potential ignition sources are overlooke d. A coordinated approach

to structure and systems avoids the possibility of conf licting protection designs, such as isolation and electrical bonding at a system /structure interface.

Addressing structure and systems avoids the need to establish an artificial boundary. Questions about differentiating which de sign features comprise part of the system and which comprise the tank structure would continue if an artificial boundary is utilized. An example is a permanent vent stringer installa tion with associated removable plumbing for climb ports, which combines a structural func tion (wing strength) w ith a system function (venting). The demonstration of complianc e is unnecessarily complex because of different requirements. Avoiding the arti ficial boundary would provide a clear and simplified compliance path that avoids duplication or omissions.

### LIGHTNING ARC FINA L REPORT PAGE 21

Another example of the problem with different requirements for system and structure can be shown with a pump installation. The FAA Policy Memorandum ANM-112-08-002 [10]
accepts that certain pump housings are installe d for the life of the airplane, and, hence, considered part of the structure. However, one portion of the light ning protection may be pump wire shielding via a sh ield that grounds the wiring connector shell to the pump housing. Clearly the wiring connector is rem ovable and thus would be categorized as

systems , but does this mean the housing is now a part of systems because the housing is a part of the system ground? To keep systems and structure separate, a design might tend to use a separate pigtail wire for the shield. Th is is a less effective shield termination design than one using the connector backshell for shield grounding, resulting in a less robust design than might be necessary to keep the pump housing from being considered a part of

systems

.

Fuel Quantity Indicating Systems (FQIS)

In the discussions about whether systems and structures should have a common set of requirements, FQIS was a major topic of systems discussion. The Li ghtning ARC review determined that, unlike the lightning prot ection certified under the existing § 25.954 requirement which did not require fault tolerance for either structures and systems

, redundant protection from power-induced ignition sources affecting FQIS has been the design standard for decades. FQIS are design ed to be intrinsically safe by assuring that system power is limited to less than that required for ignition in both normal operating

and failure conditions. In a ddition, physical probe separati on from structure within the fuel tank made this system dual fault tolerant for internal system electrical power faults. But many early FQIS designs did not include even fault tolerant designs for lightning protection. Basic lightning pr otection was provided by prob e gaps and separation from structure, with no wire bundle electromagnetic shielding. Hundreds of millions of safe operating hours have been achieved with these designs. The adoption of § 25.981

Amendment 25-102 [5] , which requires the assumption of latent failure conditions being present unless extremely remote, as well as consid erations of other faults such as external electrical shorts, has generall y led to a need for FQIS cha nges to achieve compliance for both electrical power faults and lightning. The question is whether this FQIS systems precedent justifies that a difference in systems and structures requirements is necessary for lightning protection.

The Lightning ARC found that the same jus tifications for a common requirement for

system and structure also apply to FQIS. All of the factors noted above apply to the FQIS, the other fuel system s, and fuel tank structure. There is no need for different lightning protection requirements for fuel systems , including FQIS, and fuel tank structure. Applying a revised standard for lightning protection to FQIS will not negate the need to provide dual fault tolerant pr otection necessary to achieve compliance to § 25.981(a)(3) for non-lightning threats. The ot her aspects of the fuel system safety assessment for FQIS will still be subj ect to the requirements of § 25.981(a)(3).

### LIGHTNING ARC FINA L REPORT PAGE 22



### 3.2.2 Findings The Lightning ARC determined that changes in the regulations should address both fuel

tanks structure and systems with a common standard.

The findings are based upon the fo llowing summary of Section 3.2.1.2:

 The lightning environment, interactio n mechanisms and effects assessment

methods are the same for structures and systems

.

 It is difficult, subjective and unnecessary to create an artificial delineation

between systems and structure with resp ect to lightning protection.

 Historic lightning protecti on requirements in § 25.954 and guidance material have

utilized a common standa rd for structure and systems

.

 The availability of means to implemen t additional layers of protection for systems is not justification for a different requir ement than structure. The additional design complexity that would result from additional layers of protection will have no commensurate safety benefit and ma y introduce unforeseen negative safety consequences, including design, inst allation and maintenance errors.

### LIGHTNING ARC FINA L REPORT PAGE 23



### 3.3 Tasks 3, 4 and 5 Evaluation of Safety Assessment Approaches Tasks 3, 4, and 5 in the Lightning ARC Charter require evaluation of fuel tank lightning protection safety assessment approaches and th e kinds of failures or other conditions that must be part of the assessment. Th e task statements are listed below.

Task 3 - Determine what type of safety as sessment approach should be used (e.g.;

SAE Document ARP5577 [12] or § 25.1309). Define content and procedures of the safety assessment.

Task 4 - Determine whether a probabilistic approach, prescriptive pass/fail criteria, or a combination of both using qualitative analysis, should be applied to structure or the complete fuel system lightning prot ection. If a probabilistic approach is used, determine if flammability exposure shou ld be considered. Determine how single

failures should be addressed. Determ ine what types of single failures are impractical to preclude. Finally, determ ine what probabilistic distribution of lightning amplitudes would be accep table as an industry standard.

Task 5 - Establish which components and installations must be addressed and which failure modes (including possibility of cascading failures) should be considered. Determine if all foreseeable, likely, or a specific set of failures should be addressed in determining adequate structural lightning protection. If a probabilistic approach is used, determine the crit eria that should apply for the standard. Identify acceptable data to support the safety analysis (e.g., supporting failure rates).

These three tasks are interrelated, so are di scussed together in this section. The fundamental question to addre ss as part of Tasks 3, 4 and 5 is the method of safety assessment that should be applied to fuel sy stem lightning protection. Two basic safety assessment approaches have been identified for consideration as part of Task 3 – a hazard assessment, similar to th at described in ARP5577 [12] , and a risk assessment, similar to

that described in AC 25.1309-1A [13]

.

The focus of a hazard assessment is to ensure that the protection design can effectively mitigate the hazards that may result when th e airplane is struck by lightning. Since lightning protection is not the primary focus of the basic airplane design, this assessment technique works well for identifying where spec ific lightning protecti on features must be added to the basic design to mitigate potential lightning hazards. This hazard assessment would typically be done early in the design phase to ensure that adequate lightning protection is incorporated. Te sts or analysis are then typi cally conducted to confirm that the required lightning protection is e ffective in eliminating the hazards.

On the other hand, the focus of a risk assessm ent is to evaluate the design functionality, including effects of potential failure conditions, and show th at the residual risk of an undesirable event is mitigated to an acceptable risk level. For example, where there is potential for a catastrophic effect, the like lihood of that event must be shown to be extremely improbable. This risk assessmen t approach has been used for evaluating

### LIGHTNING ARC FINA L REPORT PAGE 24

complex systems architectures, which are part of the basic design of the airplane, to ensure that functionality is maintained to appropriate levels when component failures

occur.



### 3.3.1 Evaluation of the Issue The existing regulations that apply to fuel system lightning protection, § 25.954 and § 25.981(a), currently drive different appr oaches for assuring adequate lightning protection design. The requirements of § 25.954 have driven the fuel system lightning design for the vast majority of Part 25 ai rplanes flying today. For § 25.954, the focus is strictly on demonstrating eff ectiveness of the lightning pr otection design - it does not require consideration of failure conditions that may compromise that effectiveness. This approach has resulted in an outstanding safety record in the fact that there has been no lightning-caused ignition of fuel tank vapor s since 1976, as noted in Section 2. The

Amendment 25-102 [5] requirements of § 25.981(a) have only been in place since 2001, with very limited certificati on activity, so the industry expe rience is mostly associated with implementing the requirements in the de sign and demonstrating compliance. These requirements drive a rigorous assessment of failure conditions and combinations of failure conditions, but have been found to resu lt in designs that are, at best, complex and challenging and, at worst, impractical to implement. FAA has acknowledged the impracticality of complying with this rule fo r fuel tank structural lightning protection in the FAA Policy Memorandum ANM-112-08-002 [10] . As requested in the Lightning ARC charter, these rules will be re-examined in c onjunction with addressing the system safety assessment tasks with a focus on achieving a balanced approach between an acceptable level of safety and economic viability in design, manufacture and operation.

Airplane Fuel System Lightning Hazard Considerations The rulemaking projects that re sulted in Amendments 25-102 [5] and 25-125 [6] were intended to prevent catastrophic fuel vapor ig nition. For lightning to cause catastrophic fuel vapor ignition, the following conditions must exist:

1. Lightning must strike the airplane; and

2. The fuel tank ullage (air space in fuel tank) must be flammable; and

3. The lightning amplitude and energy must exceed the severe definition used for the airplane protection design; or

4. The lightning protecti on must have failed.

These conditions must exist when consideri ng lightning-related fu el vapor ignition for

both fuel tank structure or fuel systems

.

First: Lightning strikes to airplane s are common in an airplane fleet, but not frequent for any single airplane. Certain atmospheric condi tions lead to higher li kelihood of airplane lightning strikes. For example, airplane lightning strikes are most common when the airplane is operating in clouds with precipita tion and the atmospheric temperature is near freezing. Airplanes fly through these conditions frequently, but lightning strikes occur on only a small number of airplanes in these conditions.

### LIGHTNING ARC FINA L REPORT PAGE 25

Second: Fuel tank ullage in transport airplanes op erating with typical fu el types (Jet A or similar) is not often flammable. Amendment 25-102 [5] added regulations to minimize fuel flammability, and the subsequent Amendment 25-125 [6] added quantitative fuel tank flammability requirements for new transport airplane designs. The requirements in

Amendment 25-125 [6] set limits to the percentage of time that the airplane fuel tanks can contain flammable vapors, based on the flammability performance of conventional unheated aluminum wing fuel tanks. Thes e flammability requirements significantly reduce the likelihood of fuel vapor igniti on, independent of the lightning protection

elements.

The lightning-related accidents on the Boei ng 707 and 747 described in Section 2 had fuel tanks that contained highly volatile JP-4 ty pe fuels. High-volatility fuels such as JP4 are not generally available and are not allowed on most transport catego ry airplanes certified since the early 1990s. High-volatility fuels are unlikely to be approved for use for airplanes that must demonstrate compliance to Amendment 25-125 [6] . FAA is currently pursuing Airplane Flight Manual (AFM) limitation s to preclude use of highvolatility fuel types unless no other fuel is available.

The likelihood of lightning stri kes to an airplane is inde pendent from and unlikely to coincide with flammable fuel tanks operat ing with Jet A type fuels. Fuel tank flammability is dependent on the temperature of the fuel. Fuel tanks that are exposed to warm days (air temperature of greater than 80°F at takeoff) have higher likelihood of having a flammable ullage. However, light ning strikes to airplanes occur when the outside air temperature or atmospheric temp erature is near freezing. While airplane lightning strikes occur at a range of temper atures around freezing, there is no correlation between airplane lightning strikes and highe r atmospheric temper atures. Figure 3.3-1 was developed from a review of a set of pilot reported lightning strike reports and illustrates this point. Figure 3.3-2 uses the same pilot reports but makes a comparison to the ground temperature at the airport nearest to where the lightning strike was reported, which shows the independence of lightning stri kes relative to warm days on the ground. Review of other published data [14] [15] also supports this conclusion.

### LIGHTNING ARC FINA L REPORT PAGE 26

Figure 3.3-1 Static Air Temperature at Time of Airplane Lightning Strike

Figure 3.3-2 Air Temperature at Closest Airport at Time of Airplane Lightning Strike

### LIGHTNING ARC FINA L REPORT PAGE 27

Third: The characteristics of lightning vary wide ly from one lightning flash to another, so that the range of lightning energy, curre nt amplitude, duration, number of current pulses, and timing of the pulses vary wide ly. However, these characteristics are independent of the airplane that is stru ck by lightning. When lightning strikes an airplane, the airplane do es not change the characteristics of lightning.

Because of the widely-varying characteri stics of lightning and the difficulty and complexity associated with measuring actual lightning characteristics, it is impractical for individual airplane lightning protection engineers to deve lop their own definition of lightning characteristics. Industry, regulator y, and military aircraft lightning specialists collaborated to consider the variability asso ciated with lightning a nd airplane lightning strikes. The specialists, meeting in work ing groups such as the SAE AE-2 Lightning Committee, defined lightning environments that could be used to demonstrate effective airplane lightning protection. [15]

The aircraft lightning protecti on specialists, both from industry and governments, agreed to define specific, severe airplane ligh tning environments. The defined lightning

environment reflects relativel y rare conditions for peak current amplitude, energy, and

flash duration. While the like lihood of the severe airplane lightning environment is not specifically defined, the lightni ng standards consider it to represent on the order of the highest one percentile lightni ng flash characteristics.

These three factors – widely-v arying characteristics of lig htning, frequency of airplane lightning strikes, and fuel tank flammability exposure – ar e all independent and are not directly related to the airpla ne fuel tank structure and fuel system design. But all three contribute to the overall lightning -related fuel system safety record for modern transport airplanes; which under previous design require ments did not incorporate fault-tolerant fuel tank lightning protection.

Fuel System Lightning Protection Design Elements Fuel system lightning protection design must address the airpla ne fuel tank structure and all equipment, wiring, components and parts that are exposed to fuel or fuel vapor under normal conditions. The structure and equipmen t include the fuel tank skins, spars and ribs, hydraulic lines which are routed inside tanks, fuel system lines, fuel pumps, fuel valves, fuel quantity indica ting parts and systems, in-t ank wiring, fuel temperature probes, fuel caps, and vents. The lightning protection design must al so address fuel lines which may contain fuel vapor and are insta lled outside the fuel tank. Areas of the airplane that may be exposed to fuel or flam mable vapor due to leaks or other failures are not considered part of the fuel system, since fuel vapor would be present in such areas only following a failure of the fuel boundary seal ing. Examples are areas adjacent to fuel tanks, space between walls of twin-wall pipes, and equipment adjacent to the tanks. Protection for flammable leakag e zones is addressed by § 25.863.

Fuel tank structure and systems lightning prot ection design elements include structural materials, fasteners, skin thickness, prim er, paint, sealant co atings, electrical bonding straps, fuel and hydraulic tube fittings, wire bundle shields, transient suppression devices,

### LIGHTNING ARC FINA L REPORT PAGE 28

etc. Many of these lightning protection design el ements serve also as system or structural elements, and lightning protecti on is not their sole function.

This situation where the li ghtning protection design elements serve as system or structural elements leads to designs that are generally reliable. Environmental qualification and structural integrity tests typically determine if the protection design elements are reliable over the expected opera ting conditions for the ai rplane. If reliable lightning protection designs are implemented fo r fuel tank structure and systems, then these designs should achieve the intent of ensuring that fa ilure of lightning protection elements will occur infrequently duri ng the operational life of each airplane.

Lightning Protection Element Failures The Lightning ARC reviewed prior data on fuel tank failures to assess the in-service reliability of lightning protection features . Those reviews are summarized below.

The first set of data reviewed were 220 airworthiness directiv es (AD) related to airplane fuel tank ignition sources issued following Special Federal Aviation Regulation (SFAR)

88 assessments. This review found there were no cases where structural fasteners or

sealant were the cause of the AD. Therefor e, those failure conditions were either not found or were not determined to be a lightning hazard if any were present.

A second set of data reviewed was the Airc raft Fuel System Safety Program (AFSSP)
report [17] . This report, which documented the re sults of a voluntary industry inspection program, gathered information about the overall integrity of the fuel system design and maintenance of the in-service airplane fleet. Over 100,000 labor-hours were expended performing airplane fuel system inspections of the world fleet. Inspections were completed on 990 airplanes operated by 160 air carriers in diverse operating

environments on six continents.

Various criteria for inspections were used but all included elements for inspecting tank structure, sealant, components and transport el ements. Overall, the fuel tanks inspected were generally found to be in good to excel lent condition unless subject to initial manufacturing error or subsequent modificati on or damage. There were a few isolated reports of sealant missing or separating from structure and some is olated foreign object debris, but these were classifi ed as insignificant in the repor t. Beyond this, the majority of findings related to degradation were asso ciated with chafed wiring, missing or broken bonding jumpers, component electrical bond re sistance above insta llation specification maximum value requirements and access doors with minor corrosion or seal issues. The few areas that were thought to potentially a ffect airworthiness out of these inspections were addressed as they were found or through follow-on actions.

Failure modes that have been considered for lightning protec tion under § 25.981(a) and the related exemptions include those that may reasonably be expected to occur as a result of intended operational and environmental cond itions or those that may be expected to

occur as a result of a manufact uring quality escape. Possibl e cascading effects from any

failure mode have also been considered in addition to the direct consequences of the

### LIGHTNING ARC FINA L REPORT PAGE 29

failure. Assessments considering these fa ilure modes have show n lightning protection

features to be reliable.

Structural Failures Study A team of structural specialists from tran sport category airplane manufacturers and FAA were asked by the Lightning ARC to evaluate the potential for structural failures that could degrade the fuel tank lightning protecti on. The specialists considered the current Part 25 structural design re gulations, the airplane stru ctural design methods and processes, and in-service fuel tank structur e failures to assess the risks related to

structural failures th at could degrade the fu el tank lightning protection. Of particular interest was also understanding the risks i nvolved with increasing use of composite structures, where limited service experience exists.

The airplane structural specialis ts reported that structural in tegrity for transport airplanes is established by complying with discrete requ irements. The design of safe structures is based on approaches such as fail-safe, primar y/secondary path, and sa fe-life designs. In all these cases, a reliance on a robust desi gn and inspection program is part of the compliance demonstration. Probabilistic failure an alysis is not used. This is due in part to the difficulty in assessing the variab ility in design, manufacturing methods, and operational environment which, in the st ructural specialists’ opinion, makes a probabilistic approach unreliab le and unsuited for structural failure evaluation. This approach has led to successful airframe de signs in transport airplanes, including the prevention of fuel vapor igniti on due to lightning. Instead of analyzing the probability of failure, the current structure design regulat ions and airplane manufacturer design guidelines minimize the occurrence of structural failures.

Robust fuel tank structure that results from these design approaches and guidelines will retain its functionality, stru ctural integrity and dimensi onal stability throughout the airplane service life. This will be the case regardless of whether the basic airframe materials are primarily aluminum, composite or some other material. The robust fuel tank structure will also help to ensure that lightning protection features inherent within

the fuel tank structure will be reliable. A given design can be e ngineered to provide significant safeguards against identified s ources of potential structural degradation.

The structural specialists noted that comp liance with existing st ructural regulations results in robust fuel tank design, where struct ural failures have been minimized. This is supported by in-service repor ts of structural failures from airplane operators.

There are continuing improvement s in structural design proce sses and analyses, material selection and processing, manuf acturing, and inspection methods. This results in a more robust fuel tank structure with respect to crack s, broken fasteners, corrosion and wear for airplanes designed and certified today compar ed to existing airplane designs. Although manufacturing escapes and engine ering errors still occur, th e test and inspection methods are effective at detecting these early in the ai rplane life cycle. Composite structures are less likely to have structural cracks than aluminum structure, which is one of the driving forces behind the expanded use of co mposite structures in new designs.

### LIGHTNING ARC FINA L REPORT PAGE 30

The existing prescriptive approach for the ev aluation of structure is appropriate because it mitigates the chance of structural failure and incorporates analysis and material improvements as they evolve.

The structural specialists’ findings stressed th at it is not appropri ate to use probabilistic analysis methods to demonstrate that a stru ctural failure that c ould cause an ignition source is extremely remote. Probabilistic analysis methods are inconsistent with structural design methods, and the large scale of testing to provide numerical data to support the probabilistic analysis adds no value to the evaluation of structure.

Another factor that reduces the risk associ ated with structural failures are mandated inspections. The continued airworthiness instructions as required by 14 CFR Part 25 result in detecting degradation to maintain th e integrity of the airp lane structures. The

structural airworthiness limitations and r outine inspection tasks detect occurrence of cracks prior to reaching a length cr itical to affecting structural integrity. The interval for each inspection task takes into account the possibility of not detecting the deficiencies in the initial inspections. The inspection intervals are developed in order to ensure that if a crack occurs, it would not reac h a critical length even if not detected during initial inspections.

A fatigue test program representing multiple liv es of the airplane with a representative flight mission is performed as an integral part of the basic type certification. This fatigue test program investigates the behavior of the structures and detects structural degradation in advance of similar service experience. The rigor imposed by the industry and the

authorities ensure that once a critical structur al failure is found in a fatigue test, design solutions are introduced for production airplane s as well as development of repairs for the in-service airplane regardless of whether such a failure is found in service. Interim measures such as routine inspections are imposed until the terminating design action is implemented.

The structural specialists conc luded that existing structural regulations drive processes, tests and analyses that will ensure a high le vel of robustness is inherent in the design,

which should also minimize risk of failure s that affect lightni ng protection. This conclusion applies whether or not the stru cture is primarily made from metal or composite materials. More detail is provi ded in the structural specialists report in Appendix D.

Service Reports for Structural Failures Certification applicants that have ad dressed compliance with § 25.981(a), special conditions, or exemptions related to fuel tank structure lightning protection have identified specific failure c onditions where fault tolerance may not be practical. Two conditions identified are: 1) cr acked or broken fuel tank stru cture, where the crack could be a potential ignition so urce if subjected to lightning, and 2) broken structur al fasteners, where the broken fastener could possibly co mpromise or defeat remaining lightning protection features such as sealant.

### LIGHTNING ARC FINA L REPORT PAGE 31

To better understand these failure conditions , the Lightning ARC requested information from the airplane manufacturers represente d on the Lightning ARC to determine how frequently these conditions occur on the existing airplane fleet. The st ructural specialists

validated this information.

Each airplane manufacturer represented on the committee provided data to the Lightning ARC. The information collected represents the reported structur al cracking conditions

associated with fuel tanks of both small and large transport class airplanes. A summary of the data is provided in Table 3.3-3. As shown, some structural cracks do occur in the fuel tanks. However, fuel ta nk cracks are only a subset of cr acks associated with wings overall – many cracks associated with the wi ng are associated with leading and trailing edges. These cracks have generally been at tributed to design or manufacturing errors, non-conformity of parts, accidental dama ge, or deterioration due to unexpected environmental or operational conditions.

### LIGHTNING ARC FINA L REPORT PAGE 32

Table 3.3-3 Airplane Manufacturer Report Structural Cracks

Model Flight Hours Accumulated Flight Cycles Fleet Size Structural

Cracks - Wing Fuel

Tanks Structural

Cracks - Non-Wing

Fuel Tanks Unique

Conditions* Potential Lightning Ignition

Source**

1 32,000,000 16,000,000 821 174 3 23 3
2 90,000,000 50,000,000 4485 56

- 15 2
3 31,000,000 6,000,000 1118 443 5 19 1
4 488,578 419,639 362 1

- 1 1
5 4,930,941 4,794,160 1336 4

- 4 0
6 6,329,989 4,752,138 745 1

- 1 0
7 2,494,180 1,935,291 325 1

- 1 1
8 40,129,904 6,286,294 694 14 34 11 0
9 24,401,623 5,126,324 882 29

- 8 0
10 53,300,000 28,200,000 3200 4

- 3 0
11 48,000,000 19,200,000 1000 7

- 1 0
12 55,100,000 15,800,000 993 16

- 5 0
13 9,298,510 10,688,040 332 17

- 8 7
14 17,208,716 14,466,369 877 0 0 0 0
15 1,933,168 1,305,371 347 4

- 4 0
16 2,653,894 1,965,027 308 0

- 0 0
17 15,000,000 12,000,000 2000 14 4

- 0
18 3,441,253 1,710,666 486 5

- 1

- 19 944,469 411,469 192 14

- - - 20 433,767 162,665 272 2

- - - 21 2,309,333 2,548,418 327 5

- 1 0
22 19,542,309 23,727,972 672 115 - 1 1
23 757,764 - 359 0

- 0 0 *Unique Conditions - this column distinguishes between the total number of reported cracks in fuel tank

structure and the number of causes of the cracks. For instance, if there was a service bulletin for a specific design condition that was sent out, there may have been many reports of cracks at that location but the root

cause of all of those cracks was the same. **Potential Lightning Ignition Source – this column asse sses the locations of the cracks relative to possible exposure to high enough lightning current that an ignition source may be possible

Section 121.703(a)(15), Service Difficulty Reports , requires that th e certificate holder report “ Cracks, permanent deformation, or corrosi on of airplane structures, if more than the maximum acceptable to the manufacturer or the FAA ”. The number of unique cracking conditions, meaning al l common cause events that were found across multiple airplanes within a given model (such as may have been subject to a specific service bulletin) have been combined to represent ju st one condition, to provide a sense of the

number of failure conditions that have resulted in the cracks.

Data was also requested from airplane manu facturers regarding the in-service failure experience of fasteners or rivets. Fewer reports were received on cracked or broken fasteners, so the data was not tabulated. It appears that broken or cracked fasteners are less likely than cracked structure. The reports showed a small number of isolated events

and a few common cause events associated with particular parts types that were subsequently corrected or eliminated. In each case, these reported failures were less frequent with less exposure than for the cracked structure.

### LIGHTNING ARC FINA L REPORT PAGE 33

The in-service reports on fuel tank structural cracks and broken bolts are relatively rare,

which is an indication of the robustness of airplane wing stru cture. The absence of fuel ignition due to lightning for th ese airplanes indicates that structural cracks and broken bolts are not significant lightni ng strike ignition sources.

The data in Table 3.3-3 is primarily from ai rplanes with aluminum fuel tank structure, although it includes a small number of transpor t airplane models with fuel tanks built using carbon fiber composite structure. In ad dition, the airplane manufacturers that have experience with primary structure built from carbon fiber composite materials were asked to provide their experience relative to cracks or similar failure conditions, even if the composite materials were not used for fuel tank structure. No reports of structural cracks in composite structures were found. The ai rplane manufacturers also reported that laboratory testing of composite materials with small cracks inco rporated showed no propensity for the cracks to grow. The structur al specialists also reported that cracks in composites were not expected as the design appr oach taken for composites is typically to keep operating strains below levels where cyclic damage will lead to deterioration over the life of the airplane. Some airplane fa tigue testing has demonstrated this has been effective over multiple airplane lifetimes. Also, composites are not prone to failures due

to corrosion effects from environmental exposure.

Lightning Risks Associated with St ructural Cracks and Broken Bolts As noted above, structural cracks and broken bolts are mitigated by structural design methods and analysis. This results in robus t structure that minimizes failures that will occur. Mandatory inspections are defined to look for cracks that also aid in minimizing their exposure should they occur. In service data indicate s that cracks an d broken bolts are relatively rare in fuel tanks, as noted in Table 3.3-3. However, despite the structural methods employed that lead to robust structure, cracks and broken bolts still can occur. As shown from service experience, their occu rrence has not resulted in an ignition of flammable fuel vapors when the airplane is struck by lightning, even after over one billion flight hours of potential exposure.

Still, the Lightning ARC reviewed these fa ilure conditions and re sulting implications when lightning strikes an affected airplane to understand the risk they may pose. For instance, small cracks originating at fastener holes will be covered by fastener hardware (such as collars) or sealant, which protects the fuel vapor from exposure to an ignition source if it were to result. For larger cracks or those cracks initiated away from fasteners, lightning analysis and tests were conducted to assess the risk of an ignition source resulting from lightning. This asse ssment is described in Appendix E.

The lightning tests indicate that high curre nt densities (on the order of 100,000 A/m) are needed before representative structural crack s will arc or spark. These current densities would only be expected at or very near attachment points on skins. For conducted currents in aluminum structure, these current densities are much greater than what would be found internal to the tank (maximum valu es on the order of 10,000 A/m away from a direct attachment).

### LIGHTNING ARC FINA L REPORT PAGE 34

Similar to cracks, broken bolts would also not immediately result in an ignition source

hazard in an aluminum fuel tank. Where si gnificant lightning currents are expected, sealant could be applied that would provide a level of fault tolerance to prevent ignition sources from these failures. However, in so me cases, such as for highly-torqued bolts, the sealant could be compromised by the ener gy released due to th e bolt fracturing. In those cases, tests indicate that it may require 1,000s to 10,000s of amperes to result in an ignition source, depending upon the fastener installation. For locat ions internal to aluminum fuel tanks, these current levels will not occur through fastener s. So again it is expected that the fasteners most at risk would be skin fasteners exposed to lightning attachment, although there may be some tank penetrating fastener locations where a conducted current threat may be sufficient to result in an ignition source if the sealant is compromised and a large enough amplitude and en ergy is present in the lightning strike. Even then, the latent exposure of these inst allations will be limited as broken bolts in these locations that compromise the sealant w ill also compromise the integrity of the fuel tank and allow fuel to leak, which woul d likely be found within a few flights.

Given the service experience and the data assessment, the risk of cracks or broken bolts resulting in an ignition sour ce due to lightning is very sm all in conventional aluminum fuel tanks. The Lightning ARC does not se e this as significant enough to warrant changes to structural design practices in an attempt to prevent cracks altogether, which would likely only further reduce but not elim inate the risk. Nor does the Lightning ARC recommend modifying inspection programs to find smaller cracks sooner as the increased risk of damage caused during inspections w ould likely offset the risk caused by these cracks. The most relevant data to suppor t the Lightning ARC position that the risk is very small is the service e xperience, where these conditi ons are known to have been present with no lightning caused fuel vapor ig nitions resulting from them. In addition, when they are present, lightning test and anal ysis indicates that very few installations would be at risk of seeing enough light ning current even under severe lightning

conditions to be a hazard.

Composite Fuel Tank Design Considerations The majority of transport category airplane fuel tanks are constructed primarily of aluminum. Therefore, the in-service experi ence that could be utilized within the Lightning ARC tasks is primarily based upon airp lane design with aluminum structure. However, there are transport category airpla nes with carbon fiber composite fuel tanks that were certified to lightn ing protection requirements of § 25.954. Given this experience coupled with the increasing use of carbon fiber composite materials in new airplane fuel tank construction means the implications of lightning protection design associated with the use of these composite materials must also be considered.

There are transport category airp lane models in service with carbon fiber fuel tanks. No specific safety issues were identified related to composites fuel tank construction following the SFAR 88 fuel tank safety assessment s. There is substa ntial experience with carbon fiber primary structures in general. As noted in Appendix D, general service experience has shown increased robustness to certain fail ure modes associated with aluminum that are relevant to lightning protection, such as corrosion and fatigue

### LIGHTNING ARC FINA L REPORT PAGE 35

cracking. In addition, the design and analysis methods used by structures are also expected to result in robust structure for ne w designs as the use of composites expands to even more structural applications.

The civil airplanes with composite fuel tank structure along with military airplane have served to identify lightning protection issues a ssociated with composite fuel tanks. Some

of these issues are addressed in guidance such as the handbook Lightning Protection of Aircraft [11] . However, past design efforts have fo cused on effectiveness of the protection and have not typically addresse d implications of failures or manufacturing variability as is now required by FAA Policy Memorandum ANM-112-08-002 [10] for Part 25 applications.

There are also a few Part 25 projects in work at the time of this Lightning ARC activity that incorporate composite fuel tanks, but none have been certified for lightning protection based upon the FAA Policy Memorandum ANM-112-08-002 [10] at the time of this report. The details of these designs are not publicly available, and sensitivity of the associated intellectual property has limited the Lightning ARC’s ability to engage in detailed discussions regarding specific failu res or effects of manuf acturing variability. However, some general points can be made to identify potential implications of composite fuel tanks relative to Lightning ARC recommendations.

Use of carbon fiber composite structures in fuel tank design introdu ces some different lightning protection design consid erations than conventional al uminum designs. This is driven by some of the basic characteristic s of typical carbon fiber composites noted

below.

1. Composite materials used for transport ai rplane fuel tanks at this time are

fabricated as laminates. The laminate displays anisotropic current flow locally along the direction of the fibers at the pl y level and also has intermittent contact between fibers within a ply or between plies. This inhibits the ability for current to flow well at faying surface interfaces or through the thickness of the laminate. Where there are cut edges of composite, a phenomena that been referred to as edge sparking or edge glow in industry literature can occur.

2. The effective quasi-isotropic conductivity of the carbon fiber composite laminate is typically on the order of 1000 times less than aluminum which results in increased current locally in jo ints and overall in joints internal to the fuel tank.

Addition of meshes or foils in the skins can help to reduce the current that flows into the joints or internal tank, but do not produce conductivity comparable to

aluminum.

3. The resins used in the laminate are diel ectric and typically designed to cure at relatively low temperatures compared to the local heating that can be created by lightning currents. When the material is subjected to those lightning currents (particularly at interfaces or joints), it can either pyrolize (vaporize) the resin over

a small volume or at least cause the resin to soften or flow locally at interfaces due to rapid heating of the fibers and/or other conductive mate rials that carry the lightning current in that area. For interf aces where there is some resin or other

### LIGHTNING ARC FINA L REPORT PAGE 36

dielectric between conduc tive elements, voltages driv en by the lightning currents are enough to potentially break down local ly through those dielectric interfaces

with current flow result ing from that breakdown.

Lightning protection design concep ts are somewhat independent of the tank material, but

the materials introduce different methods for implementing those concepts with different

levels of effectiveness.

Aluminum fuel tank skins are inherently very conductive and allow only relatively small

currents to flow internal to the tank. As noted above, the material conductivity difference between aluminum and composites typically requ ires that composite designs add features like metal foils or meshes to partially compensate for this difference. These add-on features cannot provide th e laminate with an equiva lent effective conductivity comparable to aluminum skins because they are only very thin conductive layers. This results in higher current in many joints and a ssociated fasteners, both at skin interfaces and internal tank joints. The higher current places more of a burden on other design

features in order to achieve effective lightning protection.

Widespread use of fasteners to assemble structure remains normal practice today, even with composite tanks. Achieving interference fit of those fasteners can be a contributor to lightning protection. It is relatively easy to implement interference fit fasteners in

aluminum structures and is desirable in order to efficiently conduct lightning currents through joint interfaces. However, it is a ch allenge to do this in composite structures

because the insertion force of th e metallic fastener as it transitions through a hole smaller than the fastener diameter can result in delamination of the composite structure at the hole interface. A similar challenge exists re garding removal of those fasteners for rework or repair. Most composite designs therefore have used fasteners in stalled in clearance

holes to avoid the issues with interference fit installations. This results in more heating and associated sparking/pitting in that interface, which places more burden on other features in the design. The use of sleeves, bushings or grommets to enable interference

fit can minimize the risk of delamination du ring installation and im prove the electrical interface with the composite material. However, these also introduce additional interfaces in the joint which can increase th e variability of the lightning current path through the joint and add more potential sour ces of sparking. They also complicate the manufacturing installation pro cess which can affect the r obustness of that process.

The mix of electrically conductive and insulating elements in the composite laminates limit the ability to get high quality electr ical bonds through faying surface interfaces as

can be done with aluminum interfaces. Th ey also can add variability to electrical connection in the interfaces due to presence of dielectric material from the resin. Electrical bonding of composite s is typically achieved thr ough fastened interfaces because of this, but those suffer from the fa stener interface issues noted above. Some processes have been developed to sand off re sin to expose the carbon fibers for achieving faying surface bonds but this approach can introduce other variability, such as consistency in the fiber exposure due to sa nding as well as introduc ing the potential for

### LIGHTNING ARC FINA L REPORT PAGE 37

damaging the fibers or compromising thei r protection against local environmental

conditions such as moisture intrusion or contamination.

Achieving electrical bonding through rework or repair also has challenges as adhesives or resins used in typical field applications (bot h factory and airline operations) can result in relatively thick dielectric interf aces between the repair material and the parent laminate. An alternate approach to el ectrical bonding taken someti mes with composites is to introduce intentional insulating materials at certain interfaces to positively prevent

current flow at those interfaces and direct it elsewhere. These can be effective in some applications but must be able to withsta nd voltages that might be present at those interfaces during lightning conditions as well be ing reliant on the other design aspects to adequately handle the higher curr ent densities that result. Ca re must also be taken to

ensure that electrostatic sensitivities are not introduced by use of in sulators in the tank.

One design feature that is comparable between aluminum and composite installations is the application of sealants to contain spar king. However, because of the other factors noted above, the sealant may be required to ha ndle higher pressure stresses as part of a composite design as compared to an alumin um design so the relative effectiveness may

be less in some cases.

Existing industry lightning protec tion standards and practices we re reviewed to assess the implications to composite fuel tanks. Gi ven the conductivity differences to aluminum there has been a lot of analytical modeli ng development work done across industry to provide better understanding of lightning cu rrent distributions through structure and systems for composite structures . This development is especi ally significant for fuel tank lightning protection design because of the hi gher internal tank currents coupled with some of the design issues noted above, whic h require a higher resolution in understanding what levels of conducted currents may be pr esent in joints throughout the fuel tank from various lightning attachment locations.

The design issues noted previously c oupled with assessment of failures and manufacturing variability associ ated with candidate designs has resulted in designs that

have been difficult to make fault tolerant under some conditions. In most cases for those

conditions where fault tolerance could not be achieved, these designs have relied upon use of sealant to ensure effective protect ion. Continuing technology development as well as a better understanding of the physical effects and the interr elationships between environment, in-tolerance variability and fa ilure conditions that can result in lightning caused ignition sources should enable elimin ating these kinds of non-fault tolerant conditions as time goes on. Certifying a composite fuel tank to criteri a such as required by the FAA Policy Memorandum ANM-112-08-002 [10] , may result in non-fault tolerant design conditions withou t practical means to make them fault tolerant. The current FAA policy has provisions for addressing these design s via numerical probability analysis but, as is noted elsewhere in this section, there are a number of issues with applying this approach to lightning protection design of fuel tanks and it is even more difficult in this case given the limited experience with composite fuel tank designs.

### LIGHTNING ARC FINA L REPORT PAGE 38

In summary, there is limited experience w ith designing lightning protection for composite airplane fuel tank structure, particular ly since the publicati on of Amendment 25-102 [5]
introduced the concept of failure assessment and manufacturing variab ility considerations for lightning protection certif ication. Technical challenges introduced with composite material fuel tank design drive the need for additional features beyond conventional aluminum designs. Composite tank design experience suggests there is increased variability relative to asse ssing lightning protection performa nce, and there are challenges achieving fault tolerant designs under some conditions. Technology development and general maturity of the knowledge base is ex pected to eliminate the non-fault tolerant conditions over time but it is not always prac tical to do that today. In most cases these

non-fault tolerant conditions are reliant on sealants to ensure effective lightning ignition source protection. While the current policy accounts for this via a requirement to demonstrate that a catastrophic fuel vapor ign ition of a tank is extremely improbable, it is not practical to acquire the da ta needed to perform the requi red probabilistic analysis. The Lightning ARC has estimated that the cu rrent challenges with composite tanks are likely short term. While it may require more de sign effort and testing to demonstrate that the lightning protection featur es are effective for composite designs, the Lightning ARC has not identified any need for a differe nce in requirements for composite designs.

Numerical Analysis Considerations Quantitative analyses have traditionally been used as a tool where complex systems are evaluated. For example, if the loss of a function is classified to be catastrophic, normally three independent and reliable sy stems would be required to meet the top level criteria of no catastrophic effect in one billion flight hours. The thr ee channels would be checked prior to each flight and if one of the cha nnels could fail in a latent manner, an AFM procedure or a routine certification maintenance requirement would be imposed. The probability of failure of one system is typically on the order of once in ten thousand flight hours during the life of the airplane. Ther e is no requirement to improve the typical reliability of one system/channel.

Structures evaluations on the other hand ha ve traditionally relied upon implementing failsafe, safe-life, and damage-tolerance con cepts, supported by routin e inspection tasks. The structural specialists who assisted the Lightning ARC indicated that a numerical probability analysis approach is inappropriate for structures due to the difficulty in assessing the variability in design, manufacturing methods, and operational environment which makes a probabilistic approach not viab le. This is documented in Appendix D. Some issues with conducting numerical prob ability assessments relative to lightning protection are summarized below.

Fuel system lightning protection design elemen ts do not have defined lifetimes or wearout characteristics that are typically associat ed with moving mechanical systems or with electronic components. Therefore the light ning protection design element reliability cannot be evaluated using the safety assessment techniques and handbook values normally applied to electrical and electronic systems, or moving mechanical systems.

### LIGHTNING ARC FINA L REPORT PAGE 39

Lightning protection for airplane fuel tanks and systems involves specific characteristics of a number of parts and components, such as structural fasteners, wing skins and underlying structure, bonded structural inte rfaces, fuel tubes, bonding jumpers and access panels. For each class of part or com ponent, there are many variations in their characteristics that could affect the light ning protection performance. For example, structural fasteners have a wide range of sh ank diameter, length, material and coating, any of which could affect the lightning protec tion performance. Therefore, the lightning protection must consider a la rge number of detailed characte ristics of these parts. Typically these parts are designed to last the life of the airp lane, but generally there is no

numerical value for the mean time to failure for these features. A ny protection approach that relies on a numerical safety assessment will require failure ra te data for hundreds of parts with a wide range of characteristics.

System safety assessments have traditiona lly been based on military handbook data to provide base failure rates fo r components. However, no such data source exists for structural components. Struct ural certification has genera lly been based on the concept of demonstrating strength and fatigue marg ins based on airplane life and mechanical

stress levels. Probabilistic failure rates have never been considered for this type of
component.

Similarly, there is no data for rates of occu rrence of undetected ma nufacturing escapes or maintenance errors. The data that is available related to detected escapes or errors is not meaningful in this context.

There are also relatively few fuel system lightning protection design concepts even though there are many potential detailed featur es that implement these concepts. The relatively limited experience using numerical sa fety analysis for li ghtning protection as driven by § 25.981(a) or the FAA Policy Memorandum ANM-112-08-002 [10] has shown that the primary value of these assessment s was achieved when identifying potential protection element failure scenarios. The numer ical safety analysis results typically do not change the fundamental light ning protection design approach.

The fuel system lightning protection cannot be effectively analyzed using the traditional system safety assessment tools. In most cas es, the functions of the fuel systems are not related to lightning protection. For example, the function of fuel pumps and tubes is to provide fuel to the engines, so failure of the fuel pumps and associated plumbing could result in loss of engine thrust. The lightning protection for these fuel pumps and plumbing is not directly relate d to the function of providing fu el to the engines, and is typically not addressed as part of the fuel system safety assessment.

The redundancy approaches typically used fo r electrical and elect ronic systems, or moving mechanical systems are not effective for lightning protection either, particularly fuel tank lightning protection. For many lightning protection f eatures such as structural fasteners, redundancy of the fasteners does not provide redundant li ghtning protection. For other lightning protection elements, th e lightning protection is not improved by adding more of the same element. For exampl e, adding another layer of fuel sealant over

### LIGHTNING ARC FINA L REPORT PAGE 40

existing sealant does not provide lightning protection redundancy for that feature, because degradation of the adhesion between the sealant and structure may compromise all layers of sealant. Another example is the addition of multiple bonding straps to an installation where common failures, such as corrosion, could degrade or disable all of them. Finally, adding redundant add-on features such as multiple bonding straps can also lead to a greater chance of exposure to dama ge or improper reinstallation during routine maintenance, increasing the risk of possible ignition sources. Th e history of lightning protection design has shown that the simplest design implementations are typically the

best.

These characteristics of lightning protecti on make evaluation using numerical safety assessment techniques normally applied to el ectrical, electronic or mechanical systems inappropriate. Instead, the lightning prot ection effectiveness has generally been evaluated using standardized lightning tests, some following exposure to other environmental conditions such as temperatur e and humidity. The use of standardized lightning tests in combination with standardized environmental tests provides prescriptive lightning protection comp liance demonstrations.

The approach of defining specific, severe airplane lightning environments result in airplane lightning protecti on engineers focusing on the specific lightning protection features that would be incorporated into th e airplane design. With this approach the airplane designers and the regulatory authorities empha size the airplane lightning protection design adequacy based on specifi c lightning environment definitions, rather than focusing on the statistics and proba bilities associated with the lightning

environment.

Safety Assessment Considerations As noted previously, the widely-varying ch aracteristics of lightning, frequency of airplane lightning strikes, and fuel tank fl ammability exposure are all important factors

relative to the lik elihood of lightning causing a catastrophic fuel vapor ignition. They are all independent factors not directly related to the airplane fuel tank structure and fuel system design. Any qualitative or quantitative safety analysis would use similar factors for lightning characteristics, airplane light ning strikes rates, and fuel tank flammability exposure. Because these factors significantly reduce the risk of fuel vapor ignition, their contribution to safety should be considered and factored into defi ning acceptable criteria for the lightning protection design. The onl y factor that signi ficantly changes the likelihood of lightning-related fuel ignition sources is the specific airplane lightning protection design, so that coul d be the focus of a practical design safety assessment.

The contribution to catastrophic fuel vapor ign ition by the factors that are independent of the airplane fuel system design can be cons idered numerically. Th e worldwide transport airplane lightning strike rate is on the or der of once in severa l thousand flight hours. [18]
The fuel system flammability exposure is controlled by transport airplane regulation. Section 25.981(b) limits the fleet average flam mability exposure to three percent of the flammability exposure evaluation time, or th at of a conventional unheated aluminum wing tank. Using at least 3000 flight hours betw een lightning strikes to each airplane,

### LIGHTNING ARC FINA L REPORT PAGE 41

and less than three percent flammability expos ure, any lightning stri ke to an airplane during a flammable condition is expected le ss than once in 100,000 flight hours. These two factors are not dependent on the fuel sy stem lightning protection design. Using the terminology from the draft Advisory Ci rcular 25.1309-1X Arsenal version, these

conditions would be considered remote, or unlikely to occur to each airplane during its

total life. [19]

Lightning protection ineffectiveness results in a threshold where li ghtning of a certain amplitude and energy will result in an ignition source. Lightning strikes have wide range of amplitude and energy distri butions, with most strike am plitudes significantly lower than the lightning environment specified for evaluating fuel system lightning protection. Since the amplitude and energy of lightning is statistically vari able, the lightning strike to the fuel tank structure or system feature w ith ineffective lightning protection must exceed the ignition source threshold for that feature at the location where the ineffective lightning protection exists.

The result is that, if a quant itative safety assessment for fuel tank structure and systems lightning protection is used, it only needs to address the probability of ineffective lightning protection features experiencing a lightning strike amplit ude or energy that exceeds its ignition source threshold at its lo cation, not the probability of flammability and airplane lightning strike rates. An accep table level of safety is to show that catastrophic fuel vapor igniti on is extremely improbable, ty pically expressed numerically as a probability of less than once in a billion flight hours. If the probability of an airplane lightning strike in combination with flammabl e fuel vapors is expected to be less than once in 100,000 flight hours, th en the residual risk rela ted to ineffective lightning protection in combination with a lightning strike that exceeds the ignition source

threshold needs to be less than once in 10,000 flight hours. Using the terminology from the draft Advisory Circular 25.1309-1X Arsenal version, a probability per flight hour that is less than one in 10,000 flight hours is cons idered probable, or an ticipated to occur one or more times during the entire operational life of each airplane.

As noted earlier, lightning protection designs ha ve been shown to be generally reliable. If reliable lightning protection designs ar e implemented for fuel tank structure and systems, then these designs should achieve the intent of ensuring that failure of lightning protection elements will occur infrequently during the operational life of each airplane. Airplane designs that comply with § 25.954 ha ve prevented lightning-related fuel ignition when the airplanes operate with lower-volat ility Jet-A type fuels, even though § 25.954 does not require fault toleran ce for the lightning protection.

If fuel tank and fuel system lightning protecti on features and elements are reliable, then implementing fault-tolerance for these features and elements will effectively minimize

the residual risk so that li ghtning-related catastrophic fuel vapor ignition is extremely improbable. The approach of fault-tolerant fuel tank and fuel system lightning protection

is consistent with other tr ansport airplane regulations and the FAA Policy Memorandum

ANM-112-08-002 [10]

.

### LIGHTNING ARC FINA L REPORT PAGE 42



### 3.3.2 Findings In reviewing the data presented above and in response to the specific tasks statements of Task 3, 4, and 5 in the Lightning ARC Charter, the Lightning ARC recommends the following:

 A reliable single fault tolerant fuel syst em lightning protection design should be applied as a prescriptive requirement.

o Failures leading to ineffective lightning protection do not result in a catastrophic fuel vapor ignition unless they are combined with the remote event of a lightning strike of enough am plitude or energy to result in an ignition source and fuel vapors in the ta nk are flammable. This alone makes a catastrophic fuel vapor ignition unlikely with a lightning protection design that has reliable features. A reliable single fault tolerant design will ensure that such an event will not happen.

 A qualitative hazard assessment approach si milar to that described in ARP5577 [12]
should be used for conducting the fuel system lightning safety assessment.

 The safety assessment should include the following content and procedures:

o Identify the elements of the fuel systems lightning protection

o Identify each failure condition that po tentially affects lightning protection, including cascading effects caused by the root failure.

o Assess and substantiate the effectiveness, robustness and independence of the lightning protection relative to the expected lightning threat at each design location, with and without failure conditions.

 A probabilistic safety anal ysis should not be applied to fuel system lightning protection because the significant contri butors to the top level event are independent of the fuel system design. In addition, failure data relevant to lightning protection to support a meaningful probability analysis is not readily available or easily obtained.

 Specific single failures (structural crack s or broken fasteners) leading to ineffective lightning protection have been de termined to be rare and impractical to preclude for new type design. These fa ilures are effectively mitigated by structures regulations, desi gn processes, and mandated inspections. Even when they do occur, they may only result in an ignition source in alum inum fuel tanks if lightning attaches immediately in their vi cinity. Because the combination of the crack or broken fastener with a lightning attachment in the immediate vicinity is remote, the residual risk of catastrophic fu el vapor ignition is negligible and they can, therefore, be excluded from the sa fety assessment for aluminum fuel tanks.

o While the Lightning ARC focused on th e above specific non -fault tolerant modes identified in past designs, if an applicant identifies other improbable single failures that are imp ractical to preclude, it would be reasonable for the applicant to demonstrate via the same qualitative assessment process, that these represent a negligible risk.

### LIGHTNING ARC FINA L REPORT PAGE 43

 Because a probabilistic safety analysis is not recommended, there is no need to provide a probabilistic distribution of lightning am plitudes. The use of standardized specific and severe airplane lightning environments as defined in

ARP5412 [16] is consistent with other lightni ng regulations and focuses the design emphasis on the effectiveness of the li ghtning protection ra ther than on the variability of the lightning environment.

 Composite fuel tanks typically require more features and result in greater variability in lightning protection perform ance than aluminum fuel tank designs. Given the maturity of these composite ta nk designs and associ ated technologies, applicants working new certification proj ects have found it difficult to provide fault tolerant designs under some conditions . Expectations are that over time and with continued technology developmen t and maturity of industry knowledge related to variability and failures of lightning protection in composite designs, fault tolerant designs will become pract ical for all conditions. Therefore, the Lightning ARC finds that these compos ite design challenges today should not influence the other safety assessment recommendations.

 Requirements for single fault tolerant light ning protection should be applied to all components and installations in the fuel tank structure and systems, with the exception of the specific single failur es identified above. Failure modes, including cascading failures and those attr ibutable to manufacturing errors, should be considered in the safety assessment w ith the exception of the specific structural failures regarding cracked structure or br oken fasteners in aluminum fuel tanks identified above. The failure modes to include would be those that may reasonably be expected to occur as a result of intended operational and environmental conditions or those that may be expected to occu r as a result of a manufacturing quality escape.

### LIGHTNING ARC FINA L REPORT PAGE 44



### 3.4 Task 6

Determine a means to address manufacturi ng variability, age, wear, corrosion and likely damage to lightning protection features.



### 3.4.1 Evaluation of the Issue This section of the Lightning ARC report addresses the effects of manufacturing variability, aging, wear, corrosion and likely dama ge. While the term “age” is listed in the Task, the term “aging” is used in § 25.981(a). The ARC believes the intent was to evaluate “aging”, although little difference be tween the evaluation of the two terms was

identified.

Review of Existing Regulations

Prior to Amendment 25-102 [5] to § 25.981, the lightning protection requirements for fuel tank structures and systems were contai ned in § 25.954. This regulation required prevention of vapor ignition in the fuel ta nk, but the regulation di d not contain wording requiring the airplane manufacturer to addr ess manufacturing variability, aging, wear, corrosion and likely damage. Advisory Circular AC 20-53A [29] did not provide any specific guidance material with respect to manufacturing vari ability, aging, wear, corrosion and likely damage. Advisory Circular AC 20-53B [3] introduced section (8)

entitled “ Maintaining Fuel Syst em Lightning Protection ” and states in (8c): “ Where possible, do not use devices susceptible to co rrosion, fretting, flexing cyc les, or other life limiting design features. However, when usi ng those types of devices, you must publish their replacement cycles in your instru ctions for continued airworthiness manual ”.

Section 25.981(a)(3) specifically requires the airplane ma nufacturer to address these issues within the regulation by stating “ the effects of manufactu ring variability, aging, wear, corrosion and likely damage must be considered...” . Sections 25.981(b)

Amendment 25-102 [5] , 25.981(d) Amendment 25-125 [6] and SFAR 88 also introduced the use of Critical Design Configuration Control Limitations (CDCCL) as a means of managing and controlling the configuration of ignition protection features. The CDCCL notation is designed to preser ve the integrity of igniti on protection features during configuration change that may be caused by design changes, alterations, repairs or maintenance activity (likely damage).

The 2006 advisory material for § 25.954 briefl y addresses aging, w ear, and corrosion as part of continuing airworthiness while § 25.981 requires the airplane manufacturer to address these areas as well as manufacturing variability and likely damage within the regulation.

Review of Service History Pertaining to Manufacturing Variability, Aging, Wear, Corrosion and Likely Damage In order to identify a means to address the effects of manufacturi ng variability, aging, wear, corrosion and likely damage it is approp riate to review the service history of the world aviation fleet. The most comprehensive source of information is provided in the AFSSP report [17] previously described in secti on 3.3.1. Overall, the fuel systems inspected were generally found to be in good to excellent condition unless subject to

### LIGHTNING ARC FINA L REPORT PAGE 45

initial manufacturing error (a subs et of manufacturing variability) or subsequent modification or damage (likely damage). There were no findings to suggest that the world aviation fleet exhibited systemic pr oblems associated with aging, wear and

corrosion.

Options The Lightning ARC considered the following opt ions for determining a means to address manufacturing variability, aging, wear, corrosion and likely damage of lightning protection features.

Option 1: Address manufacturing variab ility, aging, wear, corrosion and likely damage during the design and certifica tion of lightning pr otection features.

Option 2: Address manufacturing variab ility, aging, wear, corrosion and likely damage with reliable manufacturing, quality and process controls.

Option 3: Address manufacturing variab ility, aging, wear, corrosion and likely damage using instructions for continued airworthiness (ICA).

Option 4: Address manufacturing variab ility, aging, wear, corrosion and likely damage by providing maintenance personnel with information that will minimize accidental or likely damage to lightning protection features during performance of maintenance, alterations and repairs.

Aging, Wear and Corrosion As discussed in section 3.3, the objective is to design reliable lightning protection features that are not expected to degrade when exposed to th e anticipated effects of aging, wear and corrosion. A reliable design can re duce the need for maintenance inspections required to verify the protection design, which, in turn, reduces the possibility of likely damage or disabling of lightning protection fe atures that may occur during operations and scheduled and unscheduled maintenance activity.

The effects of aging, wear and corrosion can be addressed during th e design/certification phases with lightning protection features that promote a desi gn that is reliable. As outlined in the AFSSP report [17] , the fuel tank systems inspected were generally found to be in good to excellent condition. There were no findings to suggest that the world aviation fleet exhibited systemic problems a ssociated with aging, wear and corrosion. A reliable lightning protection design can be achieved by utilizing designs with a good service history, supplemented by lightning a nd environmental testi ng, where applicable.

The objective is to design reliable lightning pr otection features that are not expected to fail when exposed to th e anticipated effects of aging, wear and corrosion. However, there may be cases where it is not pr actical to implement a lightni ng protection design that is completely immune to the anticipated effects of aging, wear and corrosion. In such cases, the instructions for cont inued airworthiness can be used to identify the appropriate

### LIGHTNING ARC FINA L REPORT PAGE 46

maintenance tasks and intervals to verif y, restore or replace the lightning protection

features.

The Lightning ARC reviewed the Options listed above and determined that an optimum means to address aging, wear and corrosion of lightning protection features may be a combination of Options 1 and 3 where the objective is to design reliable lightning protection features that are not expected to fail when exposed to the anticipated effects of aging, wear and corrosion. In cases where lig htning protection features may degrade, the airplane manufacturer could id entify appropriate inspection tasks and intervals in the

instructions for continued ai rworthiness to maintain the integrity of the lightning protection features.

Likely Damage Likely damage refers to damage that may occur to lightning protection features during operations and scheduled or unscheduled maintenance activity of the fuel tank structures and systems.

Likely damage was identified as a significan t finding within the Aircraft Fuel System Safety Program (AFSSP) [17] , and usually occurs during maintenance activity. One means to address likely damage is to provide maintenance personnel with awareness of the fuel tank lightning protection featur es which can help prevent lik ely damage and accidental removal or disabling of lightning protecti on features during maintenance activity. Sections 25.981(b) Amendment 25-102 [5] and 25.981(d) Amendment 25-125 [6] , use Critical Design Configuration Control Limitations (CDCCL) as a means of managing and controlling the configuration of ignition protectio n features and require that CDCCL

information be included in the Airworthiness Limitations section of the instructions for

continued airworthiness as required by § 25.1529. Incorporating the CDCCL information into the Airworthiness Limitation section may not be the most effective approach to minimize likely damage. The Lightning ARC de termined that these instructions would be more effective if they ar e published in the maintenance documents that are directly used by the maintenance personnel during ope rations and scheduled or unscheduled maintenance activity.

As an alternative to using the CDCCL de signation, the applican t could incorporate applicable Caution information (notes) associ ated with critical lightning ignition source prevention features directly into the maintenance documentation including the Airplane Maintenance Manual (AMM), the Structural Repair Manual (SRM) and manuals that provide maintenance personnel with standard pr actices such as standard wiring practices. The Lightning ARC determined that Caution in formation for critical lightning protection features could be incorporated into instruc tions for continued airworthiness required by § 25.1529. This is a similar approach to Part 25 Appendix H25.5 (a)(1)(vi) which requires the applicant to provide protection and Caution information that will minimize contamination and accidental damage for Electrical Wire Interconnection System (EWIS).

### LIGHTNING ARC FINA L REPORT PAGE 47

Incorporating Caution information into the mainte nance requirements and incorporating this information into the appropriate maintenance documentation can provide maintenance personnel with an awareness of the fuel tank lightning protection features which can help prevent likely damage and acc idental removal or disabling of lightning protection features. For example, during sc heduled or unscheduled maintenance within the fuel tank, in addition to identifying the lightning prot ection features, maintenance personnel could be advised to perform a final inspection prior to closing the fuel tank to ensure the lightning protection features have not been disturbed. In cases where a lightning protection feature has been the subject of the maintenance activity, maintenance personnel could be advised to verify that the lightning protection feature has been restored and verified by the appropriate procedure.

Another means to address likely damage is to carry out an engineering evaluation of lightning protection features for susceptibility to likely damage during the airplane design/certification phase. The evaluation can include a review of manufacturing records, quality records and operational histor y of similar designs that include production and maintenance induced errors (likely damage).

Manufacturing Variability As outlined below, manufacturing variability as currently interpreted by the FAA for § 25.981(a) includes both manufacturing tolera nces as well as manufacturing errors

.

 Manufacturing Tolerances that are expected to occur during normal manufacturing and allowed per the manuf acturing and quality control processes

 Manufacturing Errors which can be further subdivided into manufacturing errors or non-conformances that are detected and dispositioned during the airplane build process and manufacturing escapes which leave the factory undetected

Manufacturing tolerances associated with the fabricati on of lightning protection features are expected to occur during the normal ma nufacturing and quality control processes. These tolerances may have an impact on th e effectiveness of the lightning protection design. Manufacturing tolerances can be addressed during the design of lightning protection features and substant iation of the design tolerances can be carried out during the lightning protection veri fication program. Examples of manufacturing tolerances

include the tolerances associated with the fast ener installation in fu el tank structure, the

tolerances associated with sealant used as a spark barrier or the maximum allowable pipe alignment angle when evaluating a pipe -to-pipe electrical bonding path.

Manufacturing Errors including No n-conformances and Escapes . Manufacturing nonconformances are manufacturing errors that are detected during the manufacturing or inspection process when it is determined th at the production build does not conform to the engineering definition. There may be cases when a manufacturing error involves a fuel tank lightning protection feature. Ma nufacturing errors are anticipated to occur during the manufacturing/production build of the airplane. Non-conformance(s)

associated with fuel tank stru ctures and systems should be br ought to the attention of the fuel tank lightning protection design authority and disposi tio ned to restore the fault tolerant lightning prot ection design intent.

### LIGHTNING ARC FINA L REPORT PAGE 48

Manufacturing escapes define a condition wh ere an error has occurred during the manufacturing process such that the production build of the ai rplane does not conform to the engineering definition. Furthermore, th e manufacturing error is not detected and the airplane leaves the factory and enters servi ce. Manufacturing escapes are anticipated to occur during the manufacturing/production build of the airplane. There may be cases when a manufacturing escape involves a fu el tank lightning protection feature.

Manufacturing errors can be mitigated by reliable manufacturing operations, processes and inspections. In some cases, manufactur ing processes can be selected which are reliable and repeatable, such as many automated processes. In cases where manufacturing operations rely on human skill factors, proper training and reliable production processes can minimize or preclude manufacturing errors. It may also be possible to review manufacturi ng and in-service records of si milar designs to determine if such escapes have occurred and incorporat e production line inspections for areas where records indicate a potential for errors/escapes.

Manufacturing errors can be minimized or precluded during the de sign and certification of lightning protection featur es. Implementing a design wh ere the lightning protection feature is not just an “add on” feature but is part of the func tionality of the fuel system means that a manufacturing error involving a lightning protection feature would also manifest itself as a failure during the fuel system functional test procedure.

Finally, designs may be able to mitigate manufacturing errors by the use of additional protection features to compensate for a comp romise in lightning prot ection performance. This would be the objective of a fault tolerant design where the additi onal feature protects against the failure caused by the manufactur ing error. An example would be the application of sealant ov er the collar or nut of a fastener installation.



### 3.4.2 Findings The Lightning ARC has evaluated the means to address the eff ects of manufacturing variability, aging, wear, corro sion and likely damage to li ghtning protection features. The findings are summarized below:

 The Lightning ARC found that addressi ng the effects of aging, wear and corrosion as both a design consider ation and continuing airworthiness

consideration will ensure a reliable de sign as supported by the findings of the AFSSP report [17]

.

 The Lightning ARC found that the optim um means to address likely damage would be a combination of addressing the susceptibility of lightning protection features to likely damage during th e design/certification phase and publishing Caution information in the appropriate maintenance documentation to help prevent likely damage and accidental rem oval or disabling of lightning protection

features.

### LIGHTNING ARC FINA L REPORT PAGE 49

 The Lightning ARC found that the optim um means to address manufacturing tolerances associated with lightni ng protection featur es is addressing manufacturing tolerances during th e design and certification phase.

 The Lightning ARC found that an optim um means to address manufacturing

errors is a combination of manufact uring, quality and pro cess controls to minimize manufacturing errors, plus use of fault tolerant design features to mitigate the impact of manufacturing escapes.

### LIGHTNING ARC FINA L REPORT PAGE 50



### 3.5 Task 7 Determining criteria associated with inst ructions for continued airworthiness and any needed modifications to processes de fined in Revision 3 to the Maintenance Steering Group (MSG-3) [20] document.



### 3.5.1 Evaluation of the Issue This section of the Lightning ARC report proposes criteria associated with the

instructions for continued airworthiness (ICA) and provi des a review of ATA MSG-3 [20]
for developing and documenting the instru ctions for continue d airworthiness.

Review of Existing Regulations

Prior to Amendment 25-102 [5] of § 25.981, the lightning protection requirements for fuel tank structures and systems were contai ned in § 25.954. This regulation required prevention of fuel vapor igniti on in the fuel tank, but the re gulation did not specifically address ICA. The applicable regulation fo r continued airworthiness is contained in § 25.1529 and Appendix H. Although § 25.1529 and Appendix H are app licable to all Part 25 regulations, including § 25.954, § 25.1529 di d not specifically address continued airworthiness as related to fuel tank light ning protection. Advisory Circular AC 20-

53B [3] introduced section (8) entitled “ Maintaining Fuel System Lightning Protection ” which briefly discusses the need to monito r and maintain lightni ng protection features.

The introduction of § 25.981 at Amendment 25-102 [5] and subsequently Amendment 25-

125 [6] specifically required the applicant to ad dress continued airwor thiness by stating in the regulation “...inspections or other procedures mu st be established as necessary to prevent development of ignition sources within the fuel tank system”

.

Sections 25.981(b) Amendment 25-102 [5] , 25.981(d) Amendment 25-125 [6] and SFAR 88

also introduced the use of CDCCL as a means of managing and controlling the configuration of lightning protection features. These regulations also mandated CDCCLs, inspections and procedures by stating “...these CDCCL, inspections and procedures must be included in the Airworthin ess Limitation section of the Instructions for Continued Airworthiness required by § 25.1529.”

Options The Lightning ARC considered the following opti ons for determining criteria associated

with instructions for continued airworthiness.

Option 1: Retain the approach § 25.981 at Amendments 25-102 [5] and 25-125 [6] which requires the applicant to address continue d airworthiness and also mandated that maintenance inspections

, deemed “as necessary”, in the Airworthiness Limitation

section of the Instructions for Continued Airworthiness.

Option 2: Adopt a more definitive approach to continued airworthiness, where the maintenance inspections are determined by specific criteria as defined within the regulations.

### LIGHTNING ARC FINA L REPORT PAGE 51

Industry experience indicates the thoroughness of continued ai rworthiness instructions for fuel tank lightning protection has varied from applicant to applicant. This may be due in part to the limited information regardi ng fuel tank lightning pr otection ICA in the regulatory language and guidance materi al of §§ 25.954 and 25.1529. Providing a more definitive approach to continued airworthiness within the proposed fuel tank lightning protection regulation can help ensure ICA are addressed by the applicant.

However, the Lightning ARC is concerned with the § 25.981 regulatory language which

states, ”...inspections or other procedures must be established, as necessary , to prevent development of ignition sources within the fuel tank systems. These CDCCL, inspections and procedures must be included in the Airwor thiness Limitation section of the Instructions for Continued Ai rworthiness required by § 25.1529.” The interpretation of the regulatory language and specifically the ph rase “as necessary” has resulted in some confusion as to what inspections and proce dures are deemed necessary and as a result what inspections must be incorporated into the Airworthiness Limitation section of the

ICA.

Section 3.3 discusses that most lightning protection features are considered reliable and thus not expected to degrade when exposed to the anticipated effect s of aging, wear and corrosion. A reliable design can reduce the need for maintenance inspections required to verify the protection design which in turn reduces the possibility of likely damage or disabling of lightning protection features th at may occur during operations and scheduled or unscheduled maintenance activity. A review of the data regarding the overall integrity of fuel tank design and maintenance, including the AFSSP report [17] indicates that the fuel systems inspected were generally found to be in good to excell ent condition unless subject to subsequent modification or damage (likely damage). Since likely damage was considered a significant finding within the AFSSP report [17] , and usually occurs during operations and scheduled and unscheduled maintenance activity, the Lightning ARC

determined that it would be beneficial to adopt a continued airwor thiness approach which can minimize the frequency of fuel tank maintenance activity and consequently reduce the risk of accidental or likely damage. In addition, if a fault tolerant design is implemented fuel tank entries can be minimized.

The Lightning ARC developed a definitive ap proach (see Figure 1) for determining

criteria associated with inst ructions for continued airworth iness, as suggested by Option 2. This approach proposes inspections and proc edures for non-fault to lerant features be

included in the Airworthiness Limitations se ction and procedures for fault tolerant designs may utilize sampling programs or the MRB process (via a modified MSG-3 [20] ) to derive the maintenance tasks. A more definitive approach will avoid the confusion associated with the “as necessary” termi nology of § 25.981 and, together with a reliable fault tolerant design, will minimize the need for fuel tank entries.

### LIGHTNING ARC FINA L REPORT PAGE 52

FIGURE I

I n structio n s for C o nt i nued

Airworth i ness 

## I

1

### ~ F ault Tolerant Non -F ault

Dt: s ign Tolera n t D esig n 

# 1

Lightning protection features considered Airworthine ss Lmlit a tion Section of

Mai n tenance Docu m ent reliable and not anticipated 1 0 degrade In s p ection ta s k s a n d interval s to maintain when exposed to t h e effects of aging

, wear
, cOlTosion a n d likel y dam a ge t h c mtcgrity of li g htnmg p rotcction

features

. I 

# • • I
Y ES 

# I I NO 

# I

Mm n teIHmec R ev i ew B Oll rd Report

M a y utili ze MSG

- 3* as one

mean s to derive Ill spcet ion s
and interval s to nl.'lin t ain t h e * The Lightning ARC recommends c h ange s illleg r ity of lightning

pro t ectio n fearures. be ma d e to MSG- 3

OP TI O N 1 Samplin g P r o gram
Car r y out a s am p l in g pr og ram

to ve ril y the mtegrity of lightning protection feature s.

OPT I O N 2

Mai n tenance R eview B o a r d Report May utilize MSG- 3* a s one

mea n s to derive i n spec tion s

an d intelv a l s 10 verify the

integrit y of li g htning

pro t ectio n features.

### LIGHTNING ARC FINA L REPORT PAGE 53

The Lightning ARC has also reviewed the wording in § 25.981 at Amendments 25-102 [5]

and 25-125 [6] ,”... visible means to identify critical feat ures of the design must be placed in areas of the airplane where maintenan ce actions, repairs, or alterations may compromise the critical design configuration li mitations (e.g. color-coding of wire to identify separation limitation). These visibl e means must also be identified as CDCCL .”

Fuel tank lightning protection may utilize several approaches including fastener type/installation, sealant used as a spark/arc barrier, seal ant used to prevent corrosion of lightning protection features, electrically bonded interfaces to safely conduct the lightning current, electrically insulating interfaces to prev ent voltage breakdown/current conduction, adequate clearances between fuel systems and structure as well as cable shielding. The present wording in 25.981 re garding “visible means” can be widely interpreted. One possible inte rpretation would require the applicant to place visible means, such as placards, in areas of the fu el tank to identify all the fasteners, sealant applications, conductive and insulating component s that may be used in the fuel tank to prevent ignition sources. In addition, the placards themselves would then be defined as a CDCCL item requiring mandatory inspections to ensure their integrity. The Lightning ARC reviewed and discussed the application of visible means to identify fuel system lightning protection features, but found no optio ns that were considered practical or

beneficial.

Review of ATA MSG-3 [20] as a Means of Developing and Documenting the

Instructions for Continued Airworthiness. Part of Task 7 is to identify a ny recommended changes to the ATA MSG-3 [20] logic process should this process be used to deri ve maintenance tasks and intervals associated with fuel tank lightni ng protection features.

As outlined in the previous sections, the Li ghtning ARC proposes a definitive approach that utilizes sampling programs, Airworthin ess Limitations and the Maintenance Review Board (MRB) process for documenting the instructions for continued airworthiness.

In general, developing the instructions for c ontinued airworthiness can be derived using a number of approaches including the following:

 Tasks that are derived by engineering sp ecialists during the certification process

such as CMRs and Structural Airworthine ss Limitations. This process can also be

used to derive tasks for fuel tank lightning protection features.

 Tasks that are developed within the Main tenance Review Board process using the structured approach of ATA MSG-3 [20]

.

The Maintenance Review Board report cont ains ICA that are developed through the logic-based analysis proce ss provided in ATA MSG-3 [20]

, Operator/Manufacturer Scheduled Maintenance Development, prepared by the Air Transport Association. The

latest version of the document is MSG-3 Revision 2009.1 [20] . The tasks and intervals are developed by coordinating the efforts of specialists from the airplane Operators, Airplane Manufacturer and Regulatory Authorities. The airplane manufacturer utilizes the

### LIGHTNING ARC FINA L REPORT PAGE 54

guidelines from the ATA MSG-3 [20] document and produces a Policy and Procedures Handbook (PPH) outlining the processes and any assumptions made by the airplane

manufacturer to derive the sc heduled maintenance program.

The working portions of the ATA MSG-3 [20] document are containe d in the following

four sections. A brief overview of each se ction is provided below, as well as the suitability of each section to derive instructi ons for continued airworthiness as related to fuel tank lightning pr otection features.

 Section 2-3: Systems /Power plant Analysis Procedure

This section identifies Maintena nce Significant Items (MSI) based on consequences of failure, evaluates functi onal failure to determine failure effect category (safety, economic or operational) a nd takes into consid eration the failure

cause to derive maintenance tasks. This section presently contains a note (section 2.3.1) added in 2005 regarding fuel tank sy stems safety as related to ignition sources, including lightning.

The ARC determined that this section ma y be used to derive maintenance tasks and intervals. However, section 2-3 woul d require changes to ensure the analysis in this section can be applied effectivel y. A number of potential shortcomings are

summarized below.

The existing note contained in section 2-3-4 regarding “fault tolerant systems” is inconsistent with a fault tolerant design requirement and requir es review by MSG-3 [20]
specialists. Confusion can ex ist when applying the logic questions contained in MSG3 [20] section 2-3 as outlined below:

 The terms “Function”, “Functional Failure” and “Failure Effect” may require clarification as they apply to a fault to lerant design subject to a lightning event.

 There may be ambiguity when asking a nd understanding the logic questions such as the Level 1 Question 3: “Does the combination of a hidden functional failure and one additional failure of a system related or back up function have an adverse effect on operating safety?” At the present time, it is not clear how to respond to this question for a fault tolera nt design in the event of a lightning

strike.

 It is not clear that the analysis proc ess within this s ection can derive a

maintenance task to restore the fault tolerant design where one lightning protection feature has failed.

 It is not clear that the analysis process within this section can derive the tasks required to verify the integrity of lightning protecti on features of a fault tolerant design where the protection features are not anticipated to fail.

The note added to section 2-3-1 lo gic analysis in 2005 refers to “ lightning protection of the fuel tank system” and references the one example of: “the electrical bonding subsystem.” This information is very limite d and does not provide an adequate

### LIGHTNING ARC FINA L REPORT PAGE 55

description of fuel tank lightni ng protection features especially if both fu el tank structures and systems lightning protection is adopted.

 Section 2-4: Airplane Stru ctural Analysis Procedure

This section identifies Structural Significant Items (SSI) based on their contribution to carrying flight, ground, pre ssure and control loads. Structural components are evaluated for susceptibi lity to Accidental Damage (AD), Environmental Damage (ED) and Fati gue Damage (FD) when deriving the maintenance tasks. There is presently no reference to fuel tank lightning protection features.

The Lightning ARC did not identify any mean s to use this section for evaluation of fuel tank lightning protection features.

 Section 2-5: Zonal Analysis Procedure The airplane is divided internally and ex ternally into zones. Structures and systems located within each zone are evaluated for likelihood to AD and ED. Standard zonal analysis derives tasks wh ere only general visual inspections (GVI) are adequate to check for security and ge neral condition. Enhanced zonal analysis (EZAP) applied to areas which contain wiring and have poten tial for combustible material being present.

The Lightning ARC determined that this se ction could be used to derive GVI of fuel tank lightning protection features provided the require d task meets the criteria to become a GVI and provided the GVI is an adequate task to check for security and general condition. For example, this section may be appropr iate to specify a GVI for structural conditions that may ha ve lightning implications. In addition, the EZAP applied to areas which contain wiring may be appropriate to derive tasks and inspections for wiring located within the fuel tank.

 Section 2-6: Lightning/High Intensity Radiated Fields (HIRF) Analysis Procedure

This section identifies li ghtning/HIRF protection systems and components such as wire shielding, pigtail term inations, backshells, bonding st raps, raceways, metallic meshes, conductive gaskets, and conductiv e coatings. Protection components are

evaluated for likelihood to AD a nd ED and asks the question ,” Will the failure condition due to the expected degradation in combination with a Lightning/HIRF event prevent the continued safe flight and landing of the aircraft?” There is presently no specific reference or exampl es associated with fuel tank lightning protection features.

The ARC determined that this section coul d be used to derive maintenance tasks

and intervals since the basis of the an alysis in this section evaluates the components for susceptibility to AD and ED. However, section 2-6 would require significant changes since there is presen tly no specific reference or examples associated with fuel tank lightning protect ion features. In ad dition, the analysis

### LIGHTNING ARC FINA L REPORT PAGE 56

process would have to be revised for a fault tolerant lightning protection design requirement.



### 3.5.2 Findings The Lightning ARC identified a number of fi ndings during the assessment of criteria

associated with continued airworthiness wh ich could improve and promote a consistent approach to ICA for fuel tank lightning protection.

 Adopt a definitive approach to continue d airworthiness where inspections and procedures for non-fault tolerant features would be included in the Airworthiness

Limitations section of the instructions for continued airworthiness required by Sec. 25.1529, and inspections and procedures for fault tolerant designs may utilize sampling programs or task developed through the MRB process.

 The use of visible means for identif ying lightning protec tion features is impractical.

The ARC identified a number of findings related to potential modifications to ATA

MSG-3 [20] . Revisions could be incorporated into Section 2-3, Section 2-6 or into a new

Section 2-X dedicated to fuel tank lightning protection. Any specific modifications to the

MSG-3 [20] document would require specialists in the MSG-3 [20] logic process along with the support of fuel tank light ning protection specialists.

 The existing note contained in ATA MSG-3 [20] Section 2-3-4, Systems/Powerplant Analysis Procedure, regarding “fault tolerant systems” discourages the use of this analysis pr ocess where fault to lerant designs are required for certification. If this section were to be used, this information would require revision for fuel tank lightning pr otection as a result of fault tolerant design being implemented.

 The note added to ATA MSG-3 [20] section 2-3-1, System s/Powerplant Analysis Procedure, in 2005 refers to “ lightning protection of th e fuel tank system” and references the one example of, “...the electrical bonding subsystem.” This information would require revision to identify additional examples for both fuel tank structures and systems lightning prot ection, or deletion if a new section 2-x

were to be used.

 ATA MSG-3 [20] section 2-3, Systems/Powerplant Analysis Procedure, would require revision if used to develop ICA for a fault tolerant fuel tank lightning protection design, to provide additional information and examples on the most appropriate method of using the analys is in this secti on. This includes information and clarification regard ing “Function”, “Func tional Failure” and “Failure Effect”; as well as informati on and clarification to ensure the MSG-3 [20]
user understands the logic questions such as the Level 1 Question 3.

### LIGHTNING ARC FINA L REPORT PAGE 57

 ATA MSG-3 [20] section 2-6, Lightning/High Intens ity Radiated Fields Analysis Procedure, would require significant revision to in clude fuel tank lightning protection features supported with examples and a dedicated process flowchart and to ensure appropriate tasks can be derived for a fault tolerant lightning protection design.

 A new ATA MSG-3 [20] section 2-x, Fuel Systems Lightning Protection, could be prepared to develop ICA for fuel tank li ghtning protection featur es supported with examples and a dedicated process flowchar t and to ensure appropriate tasks can be derived for a fault tolerant lightni ng protection design. This approach is preferred by the Lightning ARC as extens ive rewording to th e other sections would likely cause difficulty for other uses.

### LIGHTNING ARC FINA L REPORT PAGE 58



### 3.6 Task 8 Consider the effect of reducing the flammability below the criteria of § 25.981(b), Amendment 25-125, in adjusting th e other tasks listed above.



### 3.6.1 Evaluation of the Issue With the release of the Fuel Tank Flammability Reduction Rule at Amendment 25-125 [6]

, two distinct levels of flammability criteria have been established: those pursuant to the standard set in § 25.981(b) & (b)(1), as defi ned by Appendix N to Part 25, and those pursuant to the higher standard set in § 25.981( b)(2), as defined in Appendix M to Part 25. It is these new flammability reduction standards that FAA Policy Memorandum

ANM-112-08-002 [10] uses as a basis for allowing altern ate requirements for the ignition prevention standards of § 25.981(a)(3) applie d to fuel tank lightning protection.

In considering the effect of reducing th e flammability below the Amendment 25-125 [6]
criteria, the impact on each of the prev ious Lightning ARC tasks was examined.

Effects of Further Flammability Reduction

1. Impact to Task 1 Task 1 was to determine whether the appr oach to fuel tank safety related to lightning protection should be focused on fuel vapor ignition, ignition sources, or

a combination of both. Prio r to the 2001 Amendment 25-102 [5] revision to § 25.981, fuel tank ignition protection wa s based solely upon ignition source prevention. In the preamble to the Fu el Tank Flammability Reduction Rule, as well as in FAA Policy Memorandum ANM-112-08-002 [10] , FAA stated the following:

“Predicting the effectiveness of igniti on prevention actions is challenging, since many ignition sour ces are the result of human error, which cannot be precisely predicted or quantitatively evaluated. Despite extensive efforts by the FAA and industry to prevent ignition sources, we continue to learn of new ignition sources. Som e of these ignition sources are attributable to failures on the part of engineering organizations to identify potential ignition sources and provide design changes to prevent them.

Others are attributable to actions by production, maintenance, and other operational personnel, who inadver tently compromise wiring and equipment producing ignition sources. Regardless of the causes, we believe that ignition prevention actions , while necessary, are insufficient to eliminate ignition sources.”

The same inherent limitations found in the design, production, maintenance, and operation of a protection means based solely upon ignition source prevention, would exist for a design base d solely on a Flammability Reduction Means (FRM). Just as it is not practical to eliminate all potential ignition sources, it is not practical to eliminate all possible failur e conditions which co uld contribute to flammability exposure. The overall effi cacy of the FRM is dependent not only

### LIGHTNING ARC FINA L REPORT PAGE 59

upon its own performance, but also its reliabi lity and the reliabili ty of the systems supporting the FRM, such as electrical pow er, and pressurized air systems. A design based entirely on precluding flam mability would require a flight critical means of flammability control. Achievi ng flight critical availability requires levels of redundancy which render th e system impractical. A top level requirement based upon a balance of both flammability reduction and ignition source prevention is the practical solution, as found in Task 1.

2. Impact to Task 2

Task 2 was to determine whether the lightning protection regulation changes should apply to the complete fuel system or just to the fuel tank structure. The ARC did not identify any potential impact that additional flammability reduction would have on whether the same lightni ng protection regulation changes should apply to the complete fuel system ( systems and structure), or just the fuel tank

structure.

3. Impact to Tasks 3, 4, & 5 Tasks 3, 4 and 5 were to: Task 3 was to determine what type of safety assessment approach should be

used.

Task 4 was to determine whether a probabilistic approach, prescriptive pass/fail criteria, or a combination of both using qualitative analysis, should be applied to structure or the complete fuel system lightni ng protection. If a probabilistic approach is us ed, determine if flammabi lity exposure should be considered. Determine how single failures should be addressed.

Task 5 was to establish which component s and installations must be addressed and which failure modes (including possi bility of cascading failures) should

be considered.

The reduction of fuel tank flammability beyond the established criteria could impact the determination of the appropri ate fuel tank lightni ng protection safety assessment method. Flammability exposure would need to be considered in the analysis if credit for additi onal reduction were sought by an applicant. If such a reduction were practically established, this could potentially a ffect the finding of Task 3, 4 and 5 regarding the requiremen t to demonstrate fault tolerance.

To achieve an equivalent level of en hanced lightning protection, replacing the recommended requirement to demonstrat e fault tolerance would have to be justified by an equivalent increase in the prevention of flammability. As discussed in Tasks 3, 4 and 5, a robust means of providing fault tolerance would mean the probability of a failure being pr esent would be rare (e.g. less than 1 in 1000). Therefore, an equivalent decr ease in the flammability exposure would mean the capability of the FRM would ha ve to increase by multiple orders of magnitude. This would require not only lower flammability levels from the

### LIGHTNING ARC FINA L REPORT PAGE 60

performance of the FRM design, but also an increased criticality of the operation of the FRM throughout the lifet ime of the airplane. The availability of the FRM is dependent upon both the reliability of the FRM components, and the significant number of systems and subsystems whic h support or affect the FRM operation.

Based upon technology available today, a far more capable FRM is not feasible. Although the ARC did not do extensive st udies of FRM which was outside the scope of the committee, the experts familiar with FRM know of no system currently available which they believe could demonstrate this level of flammability prevention.

4. Impact to Task 6 & 7

Task 6 was to determine a means to address manufacturing variability, aging, wear, corrosion and likely damage to lightning protection features.

The Lightning ARC reviewed Task 6 and found that further reduction of flammability exposure would not alter the means to address manufacturing variability, aging, wear, corrosion, or likely damage to the lightning protection designs.

Task 7 was to determine criteria associ ated with instructions for continued airworthiness and any needed modifications to processes defined in Revision 3 to the Maintenance Steering Group (MSG-3) [20] document.

The Lightning ARC reviewed the finding of Task 7, and did not find that the recommended criteria associated with determination of whether inspections were needed (and the associated maintenance intervals if required) would be based upon an assessment including the flammability exposure levels. The only impact the ARC identified that further flammability reduction might have on Tasks 6 and 7, would be if the recommendation for pr oviding fault tolerance was replaced entirely by lower flammability exposure requirements. Given that this was not found to be practical above, the ARC found no impact on Tasks 6 and 7 if flammability exposure were reduced below Amendment 25-125 [6]

.



### 3.6.2 Findings The Lightning ARC found that further reduc tion in flammability exposure beyond that of § 25.981(b) Amendment 25-125 [6] would not affect the findings of Task 1. A balance of both flammability reduction and ignition s ource prevention is the practical solution. Absolute prevention of flammability exposure is not feasible with current technology, nor recommended as an only means of protection.

The Lightning ARC found that flammability expo sure had no impact on Task 2 regarding whether regulation changes should appl y to the complete fuel system ( systems and structure), or just th e fuel tank structure.

### LIGHTNING ARC FINA L REPORT PAGE 61

The Lightning ARC found that a further reduction in flammab ility exposure might affect the safety assessment approach used (numerical assessment vs. prescriptive requirements). However, for a further redu ction in flammability exposure to allow a reduction in the recommended ignition source prevention means (i.e . replacing the Task 3, 4 and 5 recommendation for demonstrating fa ult tolerance), a far more capable FRM

would have to be available. This level of flammability prevention is not available today, nor does it appear to be pract ical in the near term. Acco mmodating different levels of ignition source prevention based upon different levels of flammability exposure would result in multiple tiers of compliance criteria and increased complexity in the regulation. Therefore, the Lightning ARC found that the regulation changes should not include different ignition source requirements based upon the potential for further reduction in flammability exposure beyond 25.981 Amendment 25-125 [6] . Based upon this finding, no impact to Tasks 3, 4 or 5 were identified.

Regarding any impact of Task 6 and 7, the Lightning ARC found that further reduction of flammability exposure would not alter the m eans to address manuf acturing variability, aging, wear, corrosion, or likely damage to the lightning protection designs, nor the criteria or processes associated with the determination of whet her inspections were

needed.

### LIGHTNING ARC FINA L REPORT PAGE 62



### 3.7 Task 9 Identify compliance guidance that migh t be required to facilitate showing compliance with the recommendations above.



### 3.7.1 Evaluation of the Issue The evaluation of potential changes to co mpliance material is based on the following summarized findings /recommendati ons of Tasks 1 through 8:

 Prevention of fuel vapor ignition due to lightning strikes should be the overarching requirement of the future rulemaking.

 Fuel systems as well as tank structures should be addressed by the same rule.

 A prescriptive approach of fault tolerant protection designs should be adopted (for

both systems and structures), coupled with existing flammability requirements.

The guidance material presently provided in AC 25.981-1C [27] and AC 20-53B [3] will need to be updated. Specific findings rela ted to updating of the a dvisory circulars and other guidance materials are provided in th e following paragraphs. The ARC also found many updates to these ACs are needed even if no changes to the regulations were implemented, to reflect the current regulat ion interpretations and the 2009 FAA Policy

Memorandum ANM-112-08-002 [10]

.

Updated guidance material should address the following topics:

 Means to evaluate the fuel tanks and system designs. This would include guidance for identifying possible failur e modes and evaluating practical fault tolerant features by test. Also guidance should be provi ded on evaluation of fault

tolerance for conducted currents in all areas , whereas fault tolerant protection for direct attachment would only need to be demonstrated for Zone 1 and 2 areas. Guidance material will need to be pr ovided so that this process can be consistently applied.

 Means to identify and assess the potential for ignition sources within fuel tanks and systems attributable to failures either by engineering design errors or potential design changes after initial release. The lightning-related potential ignition source design features described in Section 7 of AC 25.981-1C [27] should be deleted from

AC 25.981-1C [27] and brought into a revised AC 20-53. Additionally, the discussion of lightning rela ted arcs and sparks in Section 8b of AC 25.981-1C [27]

should be deleted from that AC and brought into a revised AC 20-53.

 Means to identify and assess manufacturing variability, aging, wear, corrosion or likely damage, including actions by production, maintenance, and other operational personnel which could inadve rtently compromise wiring, equipment and other means used to provide fuel tank lightning protection.

 Means to identify and assess the adequacy of potential non fault tolerant designs.

### LIGHTNING ARC FINA L REPORT PAGE 63

 Address both conventional aluminum a nd composite fuel tank structures.

 Address inspection and maintenance proce dures for lightning protection features.

FAA AC 20-53B - Protection of Airplane Fu el Systems Against Fuel Vapor Ignition Caused by Lightning

AC 20-53B [3] provides a reasonable format to address the above listed topics. It presently advises applicants to define requirements for maintaining and monitoring the “dedicated lightning protection devices or techniques” to ensure their integrity remains intact, and the dispatch requirements when a protective de vice has degraded. But it does not address other potential fault conditions in the tank structure or sy stems. Guidance on how to identify and treat potential fau lt conditions also needs to be provided in a revision of this AC. The steps to showing compliance in AC 20-53B [3] would need to be revised to address any changes that are made to the regulations.

AC 25.981-1C [27] - Fuel Tank Ignition So urce Prevention Guidelines

AC25.981-1C [27] presently describes potential igniti on sources due to lightning strikes. Any of this material that is specifically related to lightning shoul d be brought into a revised AC 20-53 as noted more specifically above. The lightning protection design guidance presently contained in Section 9 of AC 25.981-1C [27] should be relocated to new documents containing additional design guidance as noted below.

Additional Guidance Materi al on Fault Tolerance The ARC found that additional guidance regard ing designing for fault tolerance of tank structures and systems, identifications of potential failure conditions and dealing with non-fault tolerant designs, may be helpful but beyond the scope of a revised advisory

circular. It is recommen ded that FAA request the SA E AE-2 and EUROCAE WG31 Lightning Committees to develop this guidan ce. Lightning protec tion guidance already

within Section 9 of AC 25.981-1C [27] can be included in the new guidance documents. The additional guidance should address:

 Examples of the potential failures which need to be considered, especially failures

in non-fault tolerant features.

 Guidance on identifying other failure modes not listed in the examples.

 Checklist for reviewing designs and ensu ring compensating features to provide fault tolerance are provided.

 Mitigation for protection features which ca nnot be practically designed to be fault

tolerant.

 How multiple protection featur es can support fault tolerance with consideration of cascading types of failure modes.

### LIGHTNING ARC FINA L REPORT PAGE 64

Testing Guidance Existing lightning test methods in SAE ARP5416 [22] are adequate for assessing lightning protection performance, but do not describe de tails on how to determ ine fault tolerance, or ignition source thresholds. Additional guidance on test me thods for fuel tank lightning protection should address:

 Details for how to select and configure tests using the present standard test methods to show that an ignition sour ce will not occur at lightning conducted or induced current levels within the tank or system.

 Definition of test samples in order to include combinations of failure modes /

tolerance limits.

Maintenance and Inspection Specific changes have been proposed for ATA MSG-3 [20] to determine maintenance tasks

and intervals

. Recommendations are presented in detail in Section 3.5.2.



### 3.7.2 Findings

The ARC has identified a need for revision of AC 20-53B [3] and AC 25-981-1C [27]

.

The ARC found that AC 20-53B [3] provides a reasonable base line for incorporating the recommendations of the ARC, including the identification of potential ignition source threats, demonstration of fault tolerance of protection means, and the evaluation of both systems and structures under a common set of requirements.

Revisions to AC 25.981-1C [27] would be needed primarily to remove references regarding compliance for lightning protection under § 25.981.

We recommend development of Users Manuals [by SAE AE-2 & Fuel Specialists] which will provide the detailed gui dance on how to identify failure modes, address fault tolerance, and on testing appr oaches. This Users Manual may incorporate applicableportions of the recent AE-2 guidance regarding the FAA Policy Memorandum ANM112-08-002 [10] and the current AC 20-53A Users Manual.

Additional guidance material to be used with industry documents SAE ARP5416 [22] and EUROCAE ED-105 to provide deta ils on test approaches to a ssess fault tolerance and to determine ignition source thresholds.

Revisions to ATA MSG-3 [20] to include maintenance tasks & inspections for fuel tank lightning protection features.

### LIGHTNING ARC FINA L REPORT PAGE 65



## 4.0 DISCUSSION OF FINDINGS
This section examines the findings of the char tered tasks, how they relate to each other and how in combination they form the ove rall recommendations of the Lightning ARC.

In the background section of the ARC charter, FAA identified the primary problem with the current application of the rule, as the inab ility of the designer to meet the goal of a fail-safe design. The term fail-safe was interp reted as being the prev ention of all ignition

sources within the fuel tank. Industry found this to be problematic in at least three areas:

1. Providing a third layer of protection to mitigate latent failure conditions is impractical.

2. It is impractical to continuously monitor lightning protection f eatures to identify

failures.

3. There is limited capability to inspect and de tect failures to minimize the time that

the failures are latent.

As a result of these issues and others, F AA established the Lightning ARC with the goal of achieving a balanced approach for fu el tank lightning protection to prevent catastrophic fuel vapor igniti on. Both FAA and industry unde rstand that the elimination of all ignition sources is im possible. Therefore, the ARC was tasked to develop an acceptable level of safety that would allow ma nufactures to develop designs that are as free of ignition sources as practical, while using current technology in designs which are economically viable in terms of design, ma nufacture and operation. In addition, FAA tasked the Lightning ARC to consider fuel vapor flammability in developing a design to achieve an acceptable level of safety.

FAA assigned the Lightning ARC nine separate tasks. Though separate, each of the tasks are interrelated to the prevention of a catas trophic fuel vapor ign ition resulting from the airplane being struck by lightning. The Lightning A RC studied the tasks, both individually and collectively, and devel oped recommendations through Lightning ARC

consensus.

In § 25.981(a)(3), the applicant must prevent ignition sources, assuming that the fuel tank ullage is always flammable. The applicant must also limit fuel tank flammability, because of the concern that ignition sources could still occur. The requirements of § 25.981(a) result in a need to provide dual fault tolerant struct ural lightning ignition sources protection, which has proven to be impractical. The ARC found that while providing dual fault tolerant i gnition source prevention is not possible, by addressing the top level event, that is, fuel vapor ignition, an acceptable level of safe ty can be achieved.

The Lightning ARC found that tank flammability is independent of the lightning protection. The Lightning ARC reviewed th e flammability standard established by § 25.981(b), and concluded that it adequately lim its this aspect of a potential fuel tank lightning-related fuel vapor ignition. Th ese existing flammability limits can be considered when developing a practical ap proach for fuel tank lightning protection

### LIGHTNING ARC FINA L REPORT PAGE 66

regulations that prevent fuel vapor ignition by focusing on pot ential ignition sources due to lightning.

The Lightning ARC charter stated the goal of producing a design “as free of ignition sources as possible”. The ARC determined that a prescriptive fault- tolerant approach for fuel system lightning protection is practi cal and economically viable using current technology. The prescriptive fault-tolerant approach, when coupled with a lightning hazard assessment, as opposed to a probabilis tic risk assessment approach, emphasizes effective and reliable lightni ng protection. At the same time, the prescriptive faulttolerant approach uses techniques that ha ve been proven through an outstanding history and safety record for transport airplane lightning protection. The prescriptive faulttolerant approach using a hazard assessment allows for the most effective and economical method of addressing potential failures due to manufacturing variability, aging, wear, corrosion and likely damage.

The probabilistic risk assessment approach imposed by the current rule and the FAA Policy Memorandum ANM-112-08-002 [10] was also fully examined. However, the data required to make a probabilistic risk assessment is not available for st ructural failures and the Lightning ARC does not see a path forward that would make reliabl e failure rate data available. This point was made and rejected during the comment period for the policy, though the final policy still did not provide any method or guidance on how this data would be gathered. To further the evaluati on of this issue, the Lightning ARC convened a group of structural specialists who determ ined that a probabilistic risk assessment approach for structural failures is not practic al and that there are too many variables in structural designs to make th at approach practical. The Lightning ARC concurs and does not recommend the use of a probabili stic risk assessment approach.

FAA required the probabilistic risk assessment in the policy to deal with situations where fault tolerance can not be achieved, such as structural cracks and broken bolts which could also damage a fault tolerant layer of seal ant. This has proven to be one of the most significant issues of the current rule and FAA Polic y Memorandum ANM-112-08-002 [10]

. The Lightning ARC concluded, supported by th e structural sub-gr oup report, that nonfault tolerant designs associated with struct ural cracks and broken bolts within aluminum fuel tanks do not represent a significant risk and do not justify the economic burden and/or technical complexity required to further reduce their improbability.

Based upon the review of all available history, data and experience of both the structural and the lightning specialists, the Lightning A RC found that these th reats are adequately mitigated through design, process controls a nd manufacturing techniques necessary to comply with existing structural regulations. Th e data also showed thateven if a rare nonfault tolerant failure occurs, the failures ar e not in and of themselves a single failure leading to a catastrophic event. These fa ilures must exist in combination with the independent factors of lightning attachment to the airplane, attachment near the non-fault tolerant condition, a lightning current of suffi cient amplitude and flammable conditions

### LIGHTNING ARC FINA L REPORT PAGE 67

The Lightning ARC believes this is also true in regard to composite fuel tanks. However, it is generally understood that composite fuel tanks will typically re quire more features and result in greater variabil ity in lightning protection perf ormance than aluminum fuel tank designs. Currently, the maturity of the technology associated with composite tank designs have resulted in some difficultly in providing fault tolerant designs under some conditions. However, it is the opinion of the Lightning ARC that with continued technology development and maturity of indus try knowledge related to variability and failures of lightning protection in composite designs, fault tolerant designs will become practical for all conditions. Therefore th e Lightning ARC finds that these composite design challenges today s hould not influence the other safety assessment

recommendations.

The Lightning ARC also studied the differences between st ructural lightning protection

and systems lightning protection. Th e Lightning ARC found the li ghtning environment, means of assessment and means of protect ion did not support a need for different lightning requirement for systems . The Lightning ARC found that an acceptable level of safety can be achieved in both structures and systems lightning protection by a robust fault tolerant design when considering fu el tank flammability and the likelihood of lightning attachment. The Lightning ARC c oncluded the availability of means to implement additional layers of protection for systems is not justification for more stringent requirements compared to fuel tank structure. The additional design complexity that would result from additional layers of protection will have no commensurate safety benefit and may introduce unfor eseen negative safety conseq uences. The Lightning ARC concluded the revised regulations should address both fuel tanks structure and systems with the same requirements.

The Lightning ARC concluded that the prac tical way to address the effects of manufacturing variability, aging, wear, corrosion and likely damage of lightning protection features is an appr oach that utilizes reliable de sign practices, manufacturing, quality and process controls along with instru ctions for continued ai rworthiness (ICA).

Since likely damage was considered a significa nt finding within the AFSSP [17] and usually occurs during mainte nance activity, the Lightning ARC concluded that Caution information associated with critical lightni ng ignition source preven tion features should be incorporated directly into the main tenance documentation used by maintenance personnel including the AMM, the SRM and ma nuals that provide maintenance personnel with standard practices such as standard wiring practices. The requirement for Caution

should be used in lieu of CDCCLs as prescribed in § 25.981. The Lightning ARC

determined that Caution information for crit ical lightning protecti on features should be incorporated into instructions for c ontinued airworthine ss required by § 25.1529. These Cautions should include information that will minimize likely and accidental damage to critical lightning ignition source prevention f eatures, during performa nce of maintenance, alteration, or repairs.

The Lightning ARC concluded that the wo rding in § 25.981 (d) regarding “visible means” to identify critical features of the de sign is not considered practical for lightning

### LIGHTNING ARC FINA L REPORT PAGE 68

protection features due to the multitude of pr otection features including fasteners, sealant as well as insulating and conducting interfaces.

The Lightning ARC determined that a more definitive approach to continued

airworthiness is warranted where inspections and proce dures for non-fault tolerant

features should be included in the Airworth iness Limitations section of the instructions

for continued airworthiness required by § 25.1529. Inspections and procedures for faulttolerant designs may utilize sampling programs or the MRB process. A modified MSG3 [20] process may be one means to derive the maintenance tasks. A more definitive approach will avoid the confusion associat ed with the “as necessary” terminology of § 25.981 and together with a reliable, fault tole rant design will minimize the need for fuel

tank entries.

The Lightning ARC determined that the ATA MSG-3 [20] process can be successful in developing instructions for continued airworth iness of fuel tank li ghtning protection. As outlined in the findings, changes to MSG-3 [20] would be required. Revisions could be incorporated into Section 2-3, Section 2-6 or into a new Section 2-X dedicated to fuel tank lightning protection.

The ARC concluded that additional flammability reduction is not warranted. While there might be a slight numerical benefit to further reduction of flammability beyond the established criteria, there is no practical means with current technology to provide a flammability reduction of sufficient magnitude to justify a reduction in ignition source prevention requirements. The ARC found that a design as free of ignition sources as practical can be achieved with a prescriptive fault tolerant design. When combined with the current flammability requirements, a significant benefit from further flammability reduction could only be achieved if it were sufficient to ju stify a design which would be completely non-fault tolerant for ignition source s. Since no practical means exist for this significant of a reduction in flammability, the ARC concluded that it is inappropriate to propose adding complexity to the rule to pr ovide for multiple levels of ignition source requirements. Proposed fault tolerant igni tion source requirements combined with the existing flammability criteria will provide the desired overall level of fuel tank safety.

Finally, the ARC looked at the guidance that is currently available to the lightning specialist in regard to the current rule as well as guidance that will needed based on the

ARC recommendations. As discussed in th e findings, the guidance for fuel tank and system lightning protection is currently inad equate and will require update, regardless of what FAA chooses to implement from the ARC findings and recommendations.

### LIGHTNING ARC FINA L REPORT PAGE 69



## 5.0 RECOMMENDATIONS

The Lightning ARC Recommends:

1. Prevention of fuel vapor i gnition due to lightning shoul d be the objective of the regulations, achieved through both fla mmability control and ignition source prevention. Existing Part 25 regulati ons provide adequate flammability requirements. Thus, lightning-specifi c requirements should focus on ignition source prevention.

2. Both structure and systems should be addressed in the same fuel system lightning protection rule with the same requirements.

3. A prescriptive approach requiring single fault tole rant designs should be mandatory. If fault tolerance is impracti cal, a qualitative assessment, such as the Lightning Hazard Assessment recommended in SAE ARP5577 [12] , should be

conducted to ensure that the combination of non-fault-tolerant failures resulting in an ignition source is remote.

4. Manufacturing variability, ag ing, wear, corrosion and likely damage should be addressed by design, manufacturing pro cesses and/or by instructions for continued airworthiness (ICA).

5. Caution information for critical li ghtning protection features should be incorporated into instructi ons for continued airworthiness to minimize accidental or likely damage to these features duri ng performance of maintenance, alteration or repairs.

6. Inspections and procedures required fo r non-fault-tolerant designs should be

included in the Airworthiness Limitations se ction of the instructions for continued airworthiness, whereas fault tolerant desi gns should utilize tasks developed by the MRB or a sampling program where appropriate.

7. Changes should be made to Air Tran sport Association (ATA) Maintenance Steering Group (MSG) document MSG-3 [20] to support instructions for continued airworthiness for fuel tank lightning protection. Addition of a new section specific to fuel tank lightni ng protection is recommended.

8. No requirement for lower flammability should be included in the lightning regulations.

9. New guidance material should be deve loped and existing guidance material

should be revised to ensure a consistent approach to fuel system lightning protection is applie d across industry.

### LIGHTNING ARC FINA L REPORT PAGE 70

Proposed Rulemaking:

The Lightning ARC recommends §§ 25.954, 25.981and Appendix H be revised to read as

follows:

§ 25.954 Fuel system lightning protection. (a) The fuel system must be designed and installed to prevent catastrophic fuel vapor ignition due to lightning. (b) The fuel system lightning protection design must be fault-tolerant for failures that result in lightning- related ignition sources. (c) Fault tolerance is not required for any specific design feature if: (1) providing fault tolerance is shown to be impractical for that feature,

and (2) the failures that lead to lightni ng-related ignition sources from that

feature and all other non -fault-tolerant features , when combined, are

shown to be remote. (d) Inspections or other procedures must be estab lished as required by Sec. 25.1529 to prevent development of lightning- related ignition sources within the fuel tank system pursuant to paragraphs (b)(c) of this section. Caution information for critical lightning protecti on features shall be incorporated into

instructions for continue d airworthiness required by Sec. 25.1529 to minimize accidental or likely damage to these feat ures during performance of maintenance, alteration or repairs. Required inspecti ons and procedures for non-fault-tolerant features in paragraph (c) of this section must be in cluded in the Airworthiness

Limitations section of the instructions for continued airworthiness required by

Sec. 25.1529.

§ 25.981 Fuel Tank Ignition Prevention (a) No ignition source may be present at e ach point in the fuel tank or fuel tank system where catastrophic failure could o ccur due to ignition of fuel or vapors. This must be shown by: (3) Except for ignition sources due to lightning subject to Sec. 25.954

, demonstrating that an ignition source could not result from each single failure, from each single failure in co mbination with each latent failure condition not shown to be extremely re mote, and from all combinations of

failures not shown to be extrem ely improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely damage must

be considered.

### LIGHTNING ARC FINA L REPORT PAGE 71

§ H25.x Fuel System Lightning Prot ection Instructions for Continued

Airworthiness (a) The applicant must prepare Instruc tions for Continued Airworthiness (ICA) applicable to fuel system lightni ng protection including the following: (1) Mandatory maintenance or inspections necessary to preclude the development of unsafe conditions du e to non-fault tolerant lightning protection features shall be identifi ed as Airworthiness Limitations and approved by the Administrator. (2) Sampling programs, maintenance and/ or inspections for fault tolerant lightning protection features, included in the manufacturer’s recommended airplane maintenance program and acceptable to the Administrator. (3) Caution information which identif ies the lightning protection features of the fuel system design, to mini mize the potential for inadvertent damage or disruption of lightning pr otection features, included in the applicable airplane maintenance documents and acceptable to the

Administrator.

In addition to the above rulemaking language , the Lightning ARC also recommends that the preamble of the rulemaking should clarif y that fuel system lightning protection be excluded from rules of general a pplicability such as §§ 25.901 and 25.1309.

Guidance that is Required to Accompany the Proposed § 25.954 Revision: The same fuel tank lightning pr otection requirements apply to both fuel tanks structure

and systems

.

As defined in AC 25.1309 Arse nal version paragraph 5.B.2, Qualitative Probability

Terms

, “remote failure conditions ar e those unlikely to occur to each airplane during its total life, but which may occur several times when considering the total operational life of a number of airplanes of the type.”

Structural cracks or broken fasteners that ar e due to overstress, fa tigue or manufacturing escapes, while potentially probable for an airp lane, are remote failures when considering lightning-related ignitions sources for airpla nes that meet the Part 25 regulations for structural integrity, fatigue, a nd damage-tolerance. This is because lightning must attach in the specific vicinity of the structural crack or broken fastener and/ or be of sufficient amplitude to cause sparking.

Determining the combined probability of remo te non-fault tolerant c onditions is intended to be supported by qualitative assessment utilizing knowledgeable engineering judgment and not intended to be a qua ntitative analysis. The qua litative assessment should consider the likelihood of the failures, the li kelihood of other conditions necessary for the failure to result in an ignition source and any means utilized to ensure the combination of conditions will be unlikely. The assessment cannot include the likelihood of lightning attaching to the airplane or the flammability of the fuel tanks. It can include the

### LIGHTNING ARC FINA L REPORT PAGE 72

likelihood of lightning current densities that would lead to an ignition source for that particular structural failure.

The intent is to provide fault tolerance wherev er practical, where practical is defined as a

balance of available means and economic viab ility. A means to provide fault tolerance that is possible with little ec onomic impact, is practical even if the conditions would be remote without them. However, if the m eans would have a significant economic impact on production, operational or maintenance costs, it is not necessary ut ilize these if it can be determined that the ignition source conditions would be remote.

Evaluation of fault tolerance should include consideration failures due to aging, wear, corrosion and likely damage. Likely dama ge includes conditions that could be reasonably anticipated to occur in the lif e an individual airplane due to operation,

scheduled and unscheduled maintenance. In addition, probable escapes in the production design process should be considered as proba ble failures. Probable failures must be assessed to show the combination of poten tially related ignition sources is remote.

Effectiveness of designs to provide fault to lerance to failures should be demonstrated utilizing industry testing practices in SAE ARP5416 [22] and should be evaluated in combination with expected desi gn variability (e.g. dr awing tolerances). It should not be necessary to assume that all tolerances will be at worst case concurrently (that is, stacking of tolerances is not required). Drawing and process limits are considered part of the basic design and conditions within those limits are not failure conditions.

Critical lightning protection feat ures are those that are requi red to achieve a compliant design. Cautions should be de veloped for those critical light ning protection f eatures that might not be obvious as lightning protection, to avoid inadvertent modification or damage during maintenance. Examples of these features will need to be described in the guidance material.

### LIGHTNING ARC FINA L REPORT PAGE 73



## 6.0 REFERENCES

[1] Pan American World Airways, Inc. Boei ng 707-121, N709PA, near Elkton, Maryland, December 8, 1963 , US Civil Aeronautics Board Airc raft Accident Report, No. 1-0015, March 3, 1965 ........................................................................................................... 9, 10

[2] Wing Failure of Boeing 747-131, Near Madrid, Spain, May 9, 1976 , US National Transportation Safety Board Special Investigation Report, NTSB-AAR-78-12, October 6, 1978..................................................................................................................... 10, 25

[3] FAA Advisory Circular 20-53B, Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Caused By Lightning , June 5, 2006............ 11, 19, 20, 44, 50, 62, 63, 64

[4] User’s Manual for AC-20-53A Protection of Airplane Fuel Vapor Ignition Due to Lightning, US Federal Aviation Administra tion, DOT/FAA/CT-83/3, October 1984. 11

[5] Federal Register, Docket No. FAA–1999–6411; Transport Airplane Fuel Tank System Design Review, Flammability Reduc tion, and Maintenance and Inspection Requirements , Vol. 66, No. 88, May 7, 2001 .. 2, 5, 6, 11, 12, 14, 21, 24, 25, 38, 44, 46, 50, 53, 58

[6] Federal Register, Docket No. FAA–2005–22997, Reduction of Fuel Tank Flammability in Transport Category Airplanes , Vol. 73, No. 140, July 21, 2008.... 2, 7, 12, 13, 14, 24, 25, 44, 46, 50, 53, 58, 60, 61

[7] Exemption No. 9148, Regulatory Docket No. FAA-2007-27562, In the matter of the petition of Dassault Aviation for an e xemption from §25.981(a)(3 ) at Amendment 25- 102 of Title 14, Code of Federal Regulations , April 20, 2007 ..................................... 12

[8] Exemption No. 8761, Regulatory Docket No. FAA-2006-25156, In the matter of the petition of Raytheon Aircraft Company for a two year time limited exemption from §25.981, Amendment 25-102, of Title 14, Code of Federal Regulations , August 7, 2006

............................................................................................................................... ........ 12

[9] Federal Register, Docket No. NM415; Notice No. 25–414–11–SC, Special Conditions: Boeing Model 787–8 Airplane; Li ghtning Protection of Fuel Tank Structure To Prevent Fuel Tank Vapor Ignition , Vol. 75, No. 225, November 23, 2010

............................................................................................................................... ........ 12

[10] FAA Policy Memorandum ANM-112-08-002, Policy on Issuance of Special Conditions and Exemptions Related to Lightni ng Protection of Fu el Tank Structure

, May 26, 2009 ...................... 12, 13, 14, 15, 18, 19, 21, 24, 35, 37, 39, 41, 58, 62, 64, 66

[11] Fisher, Perala, Plumer........................................................................................... 17, 35

[12] SAE ARP5577, Aircraft Lightning Direct Effects Certification , September 2002. 2, 7, 23, 42, 69

[13] FAA Advisory Circ ular AC 25.1309-1A, System Design and Analysis , 21 June 1988

............................................................................................................................... ........ 23

### LIGHTNING ARC FINA L REPORT PAGE 74

[14] Lightning Ground Strikes, In-ServiceStrikes to Aircraft and Induced Pulse Threat

Databases M.R. Vile and C.C.R Jones. FULMEN Deliverable D2.2 1997............... 25

[15] Aircraft Lightning In teractions in Japan Murooka, Y. Japan-US Seminar on Lightning: Fundamental Aspects of Phys ics of Lightning Discharges, 1991............... 25

[16] SAE ARP5412A, Aircraft Lightning Environmen t and Related Test Waveforms

, February 2005 ............................................................................................... 9, 43, 10, 12

[17] Aircraft Fuel System Safety Program Report , August, 2000, published by an industry group that included airplane manufacturers , airlines, industry organizations and regulatory authorities ................................................................ 28, 44, 45, 46, 48, 51, 67

[18] J. A. Plumer and B. L. Perry, An Analysis of Lightning Stri kes in Airline Operation in the USA and Europe , Proceedings of the 1975 Confer ence of Lightning and Static Electricity, December 1975 .......................................................................................... 40

[19] Draft AC 25.1309-1X, System Design and Analysis , Arsenal draft dated June 2002

41

[21] SAE ARP55414, Aircraft Lightning Zoning , February 2005....................................... 9

[22] SAE ARP5416, Aircraft Lightning Test Methods , March 2005........... 9, 17, 18, 64, 72

[23] SAE Documents to Support Aircraft Li ghtning Protection Certification ..................... 9

[24] Exemption No. 10174, Regulatory Docket No. FAA-2009-1058, In the matter of the petition of The Boeing Company for an exemption from §25.981(a)(3) at Amendment 25-102 of Title 14, Code of Federal Regulations , December 14, 2010........................ 12

[25] Exemption No. 10175, Regulatory Docket No. FAA-2010-0287, In the matter of the petition of Bombardier Aerospace for an exemption from §25.981(a)(3) of Title 14, Code of Federal Regulations , December 14, 2010....................................................... 12

[26] Exemption No. 10138, Regulatory Docket No. FAA-2009-1206, In the matter of the petition of Embraer for an exemption from §25.981(a)(3) at Amendment 25-102 of Title 14, Code of Federal Regulations , September 21, 2010........................................ 12

[27] FAA Advisory Circular 25.981-1C, Fuel Tank Ignition Source Prevention

Guidelines , September 19, 2008 ................................................................. 11, 62, 63, 64

[28] ICOLSE 2003; Further Work on Lightning Ignition Hazards from Intermittent

contacts in Aluminium Fuel Tanks . Haigh, I03-53-FUL-1.......................................... 43

[29] FAA Advisory Ci rcular 20-53A, Protection of Airplane Fu el Systems Against Fuel Vapor Ignition Due to Lightning , April 12, 1985 ......................................................... 44

### LIGHTNING ARC FINAL REPO RT APPENDIX A - PAGE 1



## APPENDIX A

LIGHTNING ARC MEMBERSHIP

### LIGHTNING ARC FINAL REPO RT APPENDIX A - PAGE 2



## LIGHTNING ARC MEMBERSHIP

Greg Dunn, FAA Chairman.................................. Federal Aviation Administration Massoud Sadeghi, FAA Chairman ....................... Fe deral Aviation Administration Billy Martin, Industr y Chairman.................................................................... Cessna

Peter Bootsma ........................................................................................ Bombardier

Patrick Carver ..........................................................................................Gulfstream Howard Jordan, Document Editor ..............................................Hawker Beechcraft Rod Graham...................................................................................................Boeing Stephen Haigh..............................................................................................Cobham

Helio Librantz ..............................................................................................Embraer M. Scott Montgomery, Lightning ARC Secretary......................................... Cessna

Jean Patrick Moreau.....................................................................................Dassault

Alan Pout ........................................................................................................Airbus Andy Plumer ............................................................... Lightning Technologies, Inc. Jack Schroeder ............................................................Lightning Diversion Systems

Dave Walen........................................................... Federal Aviation Administration Dale Winter....................................................................................................Boeing

Observers Yehia Elghawaby..........................................................................Transport Canada Patrick Mattei......................................................European Aviation Safety Agency

Contributors

Mike Dostert ......................................................... Federal Aviation Administration Johnny Hodges.........................................................................................Gulfstream Howard Simpson.............................................................................................Airbus

Hideo Yamakoshi......................................................... Mitsub ishi Heavy Industries

Structures Sub-Committee Patrick Carver, Sub-Committee Co-C hairman ......................Gulfstream Aerospace Rick Jensen, Sub-Committee Co-Chairman .................................................. Cessna Steve Penn......................................................................................................Boeing Jeff Blank.......................................................................................................Boeing Jay Shoji.........................................................................................................Boeing

Ian Won................................................................. Federal Aviation Administration Greg Schneider...................................................... Federal Aviation Administration Maurizio Molinari.........................................................................Transport Canada Rupert Wheeler ..............................................................................................Boeing

### LIGHTNING ARC FINAL RE PORT APPENDIX B - PAGE 

### 1



## APPENDIX B

LIGHTNING ARC CHARTER

### LIGHTNING ARC FINAL RE PORT APPENDIX B - PAGE 

### 2

U.S

. DEPARTMENT OF TRANSPORTATION

FEDERAL AVIATION ADMINISTRATION

ARC Charter

Effective Date:

XXlXXl09

SUBJ: Large Airplane Fuel System Lightning Protection Aviation Rulemak in g Committee

1. Purpose of this Charter

. This charter creates the Aviation Rulemaking Committee (ARC) for

Fuel System Lig htning Protection according to the authority of the Administmtor of the Federal

Aviation Administmtion (FAA) underseetion 106(p)(5) ofTitic 49 of the U nited States Code (49

U.S.c. l 06(p)(5))

. This charter also outlines the conunittee's organization

, resJXmsibil i t ies

, and tasks

.

2. Audience

. This charter applies to members of the I,arge Airplane Fuel System Lightning

Protection ARC, including aviation industry organizations and employees within the Orficc of the

Associate Administrator for Aviation Safety

. The aud ie nce for this charter also includes employees of the Office of Chie f Counsel and the Office of Aviation Policy and Plans.

3. Where to Find this Charter. You can find this charter on the FAA website at http:/h,vw\v.faa

. !lov/ahout/com mitteesl rule ma ]";ing!

4. Background. Prior to Amendment 25-\ 02 to Tit l e 14

, Code of Fedeml Regulation s (14 CFR) 25.981

, the lightning protection requirements for fuel tanks were contained in § 25.954.

Section 25.954 app li ed to system components as well as airp l ane structure. That regulat ion required prevention of ignition of vapors in the fuel tank

, but it did not take into account anticipated design failures, age, wear, or maintenance errors.

a. In May 2001 the FAA issued Amendment 25-1 02. This amendment added specific ignition prevention requirements and a new flammabi li ty minimi:/.ation requirement to § 25.981. The

amendment contained specific ignition prevention requirements in § 25

. 981(aX3) that included cOIL<;iderdtion of factors such as age, wear, and maintenance errors
, as well as the existence of single

tailures

, combinations of failures

, and latent failures, that might cause ignition sourccs in fuel tanks.

TIlese requirc l llt:nl'i applied to fud tank systems in addition to structural components offuet tanks.

b. Systems with potent i ally catastrophic failure modes would typ i cally mee t the requirements of § 25.981 (a)(3) by providing at least triple -redun dancy in their protective features with periodic

i nspections

, or dual

- redundancy with continuous system monitoring, to reduce the latency period

. Dual

- redundant designs could only comply w ith § 25.981 (a)(3) when combined with either regular inspections at very short intervals or a monitoring device

, to verify the functionality of the protective

features. lnspe<.1ion of the various design features might be difficult or impossible if the leatLrre is

covered by airframe structure

.

c. To prevent all sources of ignition in a fuel tank, the design had to be " fail -safe," meaning that

hidden (latent) component failures should not cause an ignition source when combined with another

failure. An acceptable design must provide a third protective des i gn feature. As it applies to fuel tank lightning protection for ccrtain airfrdlne structures (airplane skins, joints, ribs

, spars. stringers, and

associated fasteners, brackets, and coatings), applicants have argued that both adding a third

Inilialed By: ANM

- III

### LIGHTNING ARC FINAL RE PORT APPENDIX B - PAGE 

### 3

XXlXX/09

independent protective feature and providing sufficient monitoring to detcct latent failures in a dualprotectiv e feature are impmctical fix certain areas of airplane wing structure. Incorporating three independent hard w are protective features to control s tructural ignition so urce s might bec o me too expensive to produce and maintain using currentl y available technology.

d. Confirming the continued efiectiveness of these design features is diflicult due to the impracticality of providing continuous monitoring of the features and the limited capability of inspecting the features. T hese desib'l1 fea t ure s are typically integral to the fuel tank struc t ure or
internal to the fuel tanks. Inspection of design features inside fuel tanks requires access to the fuel

tanks

, which is usually only scheduled once or twice during the life of the airplane. Increa<;ing the frequency of internal fuel tank inspections could also increase the possibility of damagi n g the lightning protection features during the inspection proccss. Becaus e of these issues. we i ss ued two exemptions that were found to be in the public interest and are developing a special con d ition for

another applicant with a composite fuel tank.

e. We now believe it is appropriate to re-examine §§ 25.954 and 25.981 to addres s th ese and other

issues that have surfaced during application of the requirements of Amendment 25-1 02 to the design

of lightning protection offue! tanks. We wish to establish a balanced approach to ensure that airplane designs provide an acceptablc level of safety

, while allowing manufacturers to use designs that are economically viable in tenns of design

, manufacture

, and operation. Rcgarding structu r al

components

, the new standards should require the applicant to dev e lop a design a<; free o f ignition

sources as practical. In addition

, the applicant must consider fuel vapor flanunability in developing a design with an acceptable level of safety.

f. We issued policy number ANM

- 112

- 08-002, "Issuance ofSpeeial C onditions and

E xemptions Related to Lightning Protection of Fuel Tank Structure ," on May 26

, 2009

, as a
temporary means to addr e ss th e above issues. This policy memo will remain in effect until rulemaking to address the practicalit y issues with § 25.98 I (a)(3) is completed.

5

. Org a nization and Administration of the Fuel System Lightning Protection AR C. We will set

up a committee of members of the aviation community

, including airplane lightning protection design

s pecialists representing diverse viewpoints. F AA participation and support will come from all

affected lines

- of-business. Where necessary
, the committee may set up specialized work groups that

inelude at least one committee member and invited subject matter experts.

a. The committee sJXJnsor is the Manager

, Transport Airplane Directorate

, who:

(1 ) Appoints members or organizations to the committee

, at his sole discretion;

(2) Receives all committee recommendations and reports;

(3) Selects industry and FAA co

- chairpersons for the committee ; and

(4) Provides administrative support for the committee

, through the Aircraft Certification

Service.

b. The co

- chairpersons will:

2

### LIGHTNING ARC FINAL RE PORT APPENDIX B - PAGE 

### 4

XXlXXI09

(1) Determine (with other committee members) when a meeting is required (a quorum is
desirable at committee meetings

, but not required) ;

(2) Arrange notification to all members of the time and place of each meeting;

(3) Draft an agenda for each meeting and conduct the meeting;

(4 ) Keep meeting minutes; and

(5) Provide status uJXIates to the Manager, Transport Airplane Directorate

, at 6 months and 12

months [rom the effective date of this charter

.

6

. Committee Membership

. The committee will consist of aboU120 members

, representing airplane manufacturers, fuel tank lightning protection specialists

, FAA and other avia t ion industry participants.

Members will be selected based on their familiarity with fuel tank lightning protection

, analysis and regulatory compliance. Membership will be balanced in viewpoints

, interests. and knowledge of the

committee's objectives and scope

. Committee membership is limited to promote discu s s i on

. Active participation and commitment by members is essential for achieving the committee's objectives.

Attendance is essential for continued membership on the conunittee. The committee may invite

additional participants as subject matter experts to support specialized work groups.

7. Public Participation. Persons or organizations outside the conunittee who want to attend a meeting must get approval in advance of the meeting from a committee co-chairperson or designated

federal representative.

8. Committee P rocedures and T a sks

.

a. The committee advises and provides written recommendations to the Manager

, T ransport Airplane Directorate, ANM-l 00.

b. C ommittee tasks include

, but are not limited to

, the following;

(1 ) Detennining whether the approach to fuel tank safety related to lightning protection

should be focused on fuel vapor ignition

, ignition sources
, or a combination of both.

(2) Determining whether the lightning protection regulation changes should ap p ly to the complete fuel system

, or just to the fuel tank structure.

(3) Determining what type of safety assessment approach should be used (e.g.; SAE

Document ARP5577 or § 25.1309). Define content and procedures of th e saf e ty Hssessmcnt

(4) Detennining whether a probabilistic approach

, prescriptive pass/fail criteria

, or a
combination of both using qualitative analysis

, should be applied to structure or the com p lete fuel

system lightning protection. I f a probabilistic approach is used, detennine if flammability exposure
should be considered. Determine how single failures should be addressed. Detenninc what types of single failures are impractical to preclude. Finall y , dctennine what probabilistic distribu t ion of lightning amplitudes would be acceptable as an industry standard.

3

### LIGHTNING ARC FINAL RE PORT APPENDIX B - PAGE 

### 5

XXfXX109

(5) Establishing which components and installations must be addressed and which failure

modes ( including possibility of cascading failures) should be considered. Determine if all foreseeab l e, likely, or a specific set of failures should be addressed in determining adequate structural lightning protection. If a probabilistic approach is used, determine the criteria that should apply for the

standard. Identify acceptable data to support the safety analysis (e.g., supporting failure rates).

(6) Determining a means to address manufacturing variability, age
, wear, corrosion

, and likely damage to lightning protection features.

(7) Determining cri teria associated with in struc tions for continued airworthiness and any needed modifications to processes defmed in Revision 3 to the Maintenance Steering Group (MSG

- 3)

document.

(8) Consideri ng the effect of reducing the flammability below the criteria of § 25.981 (b),

Amendment 25-125, in adj usting the other tasks listed above.

(9) IdentifYing compliance guidance that might be required to facilitate showing compliance

with the recommendations above.

C. The committee may propose additional ta"ks as necessary to the Manager

, Trdl1sport Airplane
Directorate, for approval.

d. The ARC will submlt a final report detailing recommendations within 15 months from the

effective date of this charter

. The Manager, Transport Airplane Directomte, may extend this deadline

for up to 6 months if it is in the interest of the FAA to do so.

9. Cost and Compensation. The estima ted cost to the Federa l Government of the Fuel System Lightning Protection ARC i s $60

, 000, annually. All travel costs for government employees will be the responsibility of the government employee's organization. Non

- government representatives serve without government compensation and bear all costs of their committcc participation.

10. Availability of Records. Under the Freedom of Information Act, 5 U.S

. c. 522

. rccords

, reports, agendas, working papers, and other documents made avrulable to, prepared for

, or prepared by the

committee will be available for public inspection and copying at the FAA, Transport Airplane

Directorate

, 1601 Lind A venue SW., Renton. W A 98057-3356. Fees will be charged for information

furnished to the public according to the fcc schedule in 49 CFR part 7.

11. Committee Term. This committee becomes an ent it y on the effective date of this charter

. The

committee will remain in existence for a term of 15 months unle ss i t'> term is ended sooner or extended by the Administrator.

4

### LIGHTNING ARC FINAL RE PORT APPENDIX B - PAGE 

### 6

XXlXXI09

12. Distribution

. This charter is distributed to the Officc of the Associate Administrator for Aviation Safety, the Office of t he Chief Counsel, the Office of Aviation Policy and Plans, and the Office of
Rulcmaking. 

# (I Q; 

# 6.M"

.. .. "

nistrator

5

### LIGHTNING ARC FINAL REPO RT APPENDIX C - PAGE 

### 1



## APPENDIX C

ACRONYMS AND ABBREVIATIONS

### LIGHTNING ARC FINAL REPO RT APPENDIX C - PAGE 

### 2



## ACRONYMS AND ABBREVIATIONS

§..................................Section AC..............................Advisory Circular

ACO ...........................Aircraft Certification Office AD..............................Accidental Damage

AD..............................Airworthiness Directive AFM...........................Airplane Flight Manual AFSSP........................Aircraft Fuel System Safety Program AMM..........................Airplane Maintenance Manual ARAC ........................Aviation Rulemaking Advisory Committee ARC ...........................Aviation Rulemaking Committee ATA ...........................Air Transport Association CDCCL ......................Critical Design Confi guration Control Limitations CFR............................Code of Federal Regulations CMR...........................Certification Maintenance Requirements DER............................Designated Engin eering Representative ED ..............................Environmental Damage EUROCAE.................European Organization on Commercial Aircraft Equipment

EWIS..........................Electrical Wire Interconnect System

FAA............................Federal Aviation Administration FD ..............................Fatigue Damage FDT............................Fatigue and Damage Tolerance FRM ...........................Flammability Reduction Means FQIS...........................Fuel Quantity Indicating System GVI ............................General Visual Inspection HIRF ..........................High Intensity Radiated Fields

ICA.............................Instructions for Continued Airworthiness

ICOLSE......................International Conference on Li ghtning and Static Electricity

MRB...........................Maintenance Review Board MSG...........................Maintenance Steering Group MSI ............................Maintenance Significant Item NASA.........................National Aeronautics and Space Administration OEM...........................Original Equipment Manufacturer QA..............................Quality Assurance

SAE............................SAE International Sec..............................Section (as used within an FAA regulation) SFAR..........................Special Federal Aviation Regulation SRM ...........................Structural Repair Manual SSI..............................Structural Significant Item RTCA.........................RTCA, Inc.

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 1



## APPENDIX D

STRUCTURAL WORKING GROUP

RECOMMENDATIONS FOR 14CFR 25.981

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 2

Table of Contents

1.0 INTRODUCTION............................................................................................................... 3

2.0 APPLICATION OF STATISTICAL METHODS TO STRUCTURES ........................ 4

3.0 MITIGATION OF POSSBILE IGNITION SOURCES BY MINIMIZATION OF

STRUCTURAL FAILURES......................................................................................................... 6

3.1 STRUTURAL REGUALTIONS AND CRITERIA

......................................................... 6

3.2 ANALYSIS METHODS

..................................................................................................... 8

3.3 DESIGN PROCESS

............................................................................................................ 9

3.4 MANUFACTURING AND QUALITY PROCESSES

.................................................. 10

3.5 SUMMARY OF MITIGATION OF IGNITION SOURCES

....................................... 11

4.0 SERVICE HISTORY ....................................................................................................... 11

5.0 COMPOSITE STRUTURE ............................................................................................. 12

6.0 SUMMARY AND CONCLUSIONS ............................................................................... 12

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 3



## 1.0 INTRODUCTION

The Large Airplane Fuel Systems Lightni ng Protection Aviation Rulemaking Committee (ARC) commissioned a working group comprisi ng airplane manufacturers and regulatory authority structural specialists to assist with their effort to revise 14 CFR 25.981. The members of this group have written this report in support of that effort. The members of this working group are listed in Appendix A. Current interpretation of § 25.981 has resulted in the application of statistical anal ysis for structural “sin gle failure” conditions to both systems and structures. The rule in question states in part:

“25.981(a)(3) Demonstrating that an i gnition source could not result from each single failure, from each single failure in combination with each latent failure condition not shown to be extremely remote, and from all combinations for failures not shown to be extremely improbable.”

The structural working group determined that § 25.981 should be revised or have guidance material written to state that requir ements for statistical analysis of ignition sources due to lightning are not applicable to structur es. Structural lightning requirements are defined according to § 25.954, Fuel system lightning protection

. Statistical analysis is not appropriate for st ructural failures and pot ential threats because there is no reliable data to support it. Stru ctural failures have b een shown by test and service history to be minimized in existing stru ctural designs. This is a direct result of compliance to existing structural regulations and criteria, application of standard structural analysis methods, and use of reliable manufacturing methods. The Lightning ARC has determined the most likely structural single failures that are considered to potentially cause an ignition source are cracked structure or a faile d fastener, so this report will address these in more detail, but th e arguments and conclusi ons in this report are applicable to all type s of structural failures.

This report will provide detailed explanati ons of the structural working group position that statistical methods are not appropriate for structural failures; th at threats have been minimized in current designs; that service history supports these conclusions; and how composite structure can be rela ted to these conclusions.

FAA structural specialists Ian Won and Greg Schneider reviewed an early draft of this report and provided the comments pr esented in this section. In their review they agreed with the position that even though cracks, broken bolts and other failures can occur within structure, probability analysis is not an appropriate tool for the analysis of these failures, should not apply to structures and a ny attempt to do so is flawed due to the lack of data. The FAA structural specialists did question other aspects of the report, such as the usage of process control, testing, regulati ons etc. as a means to mitigate the threat

from structural failures. This review led to revisions to the re port that are reflected in this

final version.

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 4



## 2.0 APPLICATION OF STATISTICAL METHODS TO

STRUCTURES

The wording of § 25.981 is typical of other syst ems rules that use probability analysis for compliance. Structural integrity, however, is established by complying with prescribed requirements. This is due to the difficu lty in assessing the va riability in design, manufacturing methods, and operational e nvironment which makes a probabilistic approach not viable.

When analyzing a structural failure, the number of failure modes and the variation in methods to predict the failure are enormous. As an example, following are some factors, for a detail such as a stringer, that affect failure predictions:

 Multiple possibilities of failure modes (tension, crippling, buckling, bondline failure, fasteners, etc.)

 Conservatism in fati gue and design loads

 Variation in airplane uti lization (Fatigue Spectrum)

 Selection of design values (A-basis vs. B-basis, etc.)

 Fidelity of stress methods (coarse vs. fi ne grid FEM, test based data, etc.)

 Thickness tolerance variations

 Variation of stress levels within the part

Each of these items has a tolerance that is covered by things such as B-basis allowables and an ultimate factor of safety of 1.5. The variability for crack initiation is even more random than the static failure and requires tes ting three to five times the normal cycles in a lifetime. All airplane manu facturers develop a fatigue sp ectrum based on historical fleet data and the predicted operating environm ent for the airplane. This is used in fatigue testing and analysis to make sure the airplane will be safe over its lifetime. While there are several factors to make sure the airp lane is safe even if the owner operates his airplane differently, this is another variation that makes pr ediction of when or where a failure would occur very difficult. The va riation in each of th ese factors, and the interaction with each other, would require a huge test matrix to develop failure predictions. It is extremely difficult to quantitatively predict some aspects of the structural performance; therefore a statis tically based approach is not viable.

The structural requirements all work to make sure analysis is done at the lowest strength

values and tested to 150% of ma x limit load statically and with a scatter factor or three to five on fatigue test cycles. This yields a robust design that minimizes the possibility of failures that might become ignition sources if sufficient current was present. This approach has led to successful airframe designs in commercial transport airplanes, including considering prevention of fuel tank ignition. Therefor e, it is the conclusion of the structural working group that not only is pr obability failure analys is not viable, it is also not necessary.

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 5

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 6



## 3.0 MITIGATION OF POSSB ILE IGNITION SOURCES

BY MINIMIZATION OF STRUCTURAL FAILURES

Although it is not practical to completely eliminate structur al failures, potential threats

due to structural failures have been minimized in existing structural de signs. This section

will show how minimization of failures is a result of compliance to existing structural regulations and criteria, applic ation of standard structural analysis methods, and use of reliable manufacturing methods. Advancements in these areas will also be discussed, showing how safe designs have become even safer over time. Although most of these factors do not directly address lightning protec tion, they do affect th e inherent robustness and minimize failures of the structure lightning protection. Service history shows that the existing approach to fuel tank structure light ning protection is safe. The difficulties in applying probabilistic analysis to structure shows that numerical analysis is not appropriate and the inherent robustness of fuel tank struct ure makes numerical analysis

unnecessary.



### 3.1 STRUTURAL REGUALTIONS AND CRITERIA

Meeting prescribed structural regulations has led to airframe designs that have minimized

structural failures th at could pose an ignition threat. Discussion on some of the more significant regulations follows:

§ 25.303 Factor of Safety. - A 1.5 ultimate factor must be applied to limit loads. Limit load may be thought of as the highest load expected to be experienced by any one airplane or structural component in a fleet of airplane s during the fleet’s life. Typical operational loads are less than 50% of limit for fuel tank type structure.

§ 25.305 Strength and Deformation – Struct ure must support limit loads without

detrimental deformation and not interfere w ith a safe operation. It must also hold ultimate load for three seconds. This limit load requirement will ensure that fastener holes and other details will not yield and cause an ignition source gap.

§ 25.307 Proof of Structure – Structure must be tested, or analyzed using reliable methods. Single load path configurations have additional requirements to ensure a robust

structure.

§ 25.571 Damage Tolerance and Fatigue evaluation of structure. - The structure is shown to be able to carry limit loads with failed pa rts or large cracks in the parts. Damage tolerance analysis and testing must be done to show that if damage does cause a crack, the crack will grow slowly and can be f ound during inspections. Also, widespread fatigue damage must be assessed using full s cale test evidence. This paragraph also requires the wing structure (inc luding fuel tank) be robus t enough to withstand a four pound bird strike and continue safe flight and landing. Th e bird strike provision may drive component sizing and therefore result s in a more robust structure than would otherwise be required.

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 7

§ 25.581 Lightning Protection – The airplane must be protected against catastrophic failure effects from lightning. This driv es minimum gauge requirements to prevent unacceptable penetration and proper conduction paths for the lightning.

§ 25.601 General – The design must not have de sign features that experience has shown

to be hazardous or unreliable. Field history at the airp lane manufacturers shows that

failed fasteners and cracks that would result in a potential ignition source have been minimized (Reference manufacturer data in Table 3.3-1 in the ARC report).

§ 25.603 Materials – Material suitability and du rability properties mu st be established based on tests and take into account temperatur e and environment. This insures material used for fabrication is consistent in its pr operties for each unit produced for that model.

§ 25.605 Fabrication Methods – Fabrication must be done to approved processes that produce consistent structure. New methods ha ve to be proven by test. This will ensure each structure will meet the strength/durability requirements.

§ 25.609 Protection of Structure - Structure must be protected against weathering, corrosion, and abrasion. This will ensure the structure will remain sound throughout its

life and minimize failures.

§ 25.611 Accessibility – The structure mu st be accessible for inspections.

§ 25.613 Material Strength Properties and Mate rial Design Values – Material strength properties must be based on test data that has a statistical basis. This will minimize the possibility of structural failures due to material variability.

The following paragraphs all describe when speci al factors must be used. These all help minimize the possibility of stru ctural failures due to special materials, manufacturing or design features. § 25.619 Special Factors

§ 25.621 Casting Factors

§ 25.623 Bearing Factor

§ 25.625 Fitting Factors

§ 25.954 Fuel System Lightning Protection – This lightning requirement is included in the structural analysis to verify the mini mum skin thickness for the structural strength requirements will not show any penetration by melting or burn through when the fuel tank skin is exposed to a lightning strike.

§ 25.963 Fuel Tanks General – The fuel tank must withstand without failure the vibration, inertial, fuel and stru ctural loads it is subject to during operation. The structure will be robust to prevent leaks.

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 8

Many of the above regulations have been amended over time. Compliance with later amendments to the regulations will tend to increase the structural robustness. For instance, the damage tolerance aspects of § 25.571 were not introduced until 1978. Although damage tolerance requirements have been retroactively applied to older designs, the stress levels in t hose designs could not be modifi ed to achieve more practical inspection programs, as has been done on ne wer designs as descri bed in Section 3.2. Amendment 25-96 introduces requirements to address widespread fatigue damage, which will help further ensure that the occurrence of small cracks is minimized in the fleet.



### 3.2 ANALYSIS METHODS Ongoing progress in analysis methodology has contributed to minimizing structural failures in newer designs.

Rapid progress in computing speed and analysis software such as finite element analysis has enabled the structural engineer to do an improved detailed analysis to comply with strength requirements of § 25.305. The number of load conditions that can be reasonably considered has greatly increase d, improving the ability to identify which ones are critical. Detailed finite element analysis has allo wed for enhanced structural optimization by identifying non-critical material for removal. This allows designers to place material where it is most beneficial, which can simultaneously lead to lighter yet more capable parts. These methods also allow analysts to better identify stress concentrations, which may not be possible with other methods.

Fatigue analysis methods are heavily dependent on test data and in some cases, in-service experience. These methods are therefore c onstantly being improved over time. Every new airplane development program requires fa tigue tests ranging fr om small coupons all the way up to a full scale test of a complete airframe. The results of major airframe fatigue tests show that failures are less frequent than they were in the airplane models that preceded it, demonstrating that fatigue anal ysis methods have improved over time. Inservice data from the fleet shows that struct ural failures are less common in more recent airplane designs when compared to older designs (for similar periods of operation).

Damage tolerance analysis as required by § 25.571 must show that if a crack occurs, it

will not become critical before it is de tected. This is done to cover random manufacturing or material flaws that could initiate a crack. Possible leaks from cracked

fuel tank structure offer additional means of detection between inspec tions. All detected cracks in primary structure are immediately repaired so exposure time is minimized. Damage tolerance is an aspect of structural certification that has been required on newer airplane designs and which sets them apart from older generations of airplanes. In order to have a practical inspection program the desi gn stress levels must be kept low enough to ensure the inspection freque ncy is not too burdensome to th e operators. This in turn reduces the probability of cr acks initiating. Developing a practical inspection program

contributes to low stress levels in another way, since idea lly critical crack lengths should be large enough to be found by visual inspectio ns. To keep the growth of a crack slow the stress levels must be low, thus m itigating the chance of a crack initiating.

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 9

Furthermore, structural analysis methods ar e the only practical m eans of establishing a structural inspection program. The alternativ e would be to use ignition source criteria to determine an inspection program, which requires a crack size threshold be determined. It would likely require a large amount of testi ng for each possible structural configuration to do this. Assuming that it is even possi ble to establish the cr ack size threshold for which it becomes an ignition source, the resu lts would have to be compared to the structural inspection program assumptions, such as critical crack size and probability of detection. This comparison may likely lead to more frequent and burdensome inspection requirements. Because of the complexity of testing requirements, and possible negative effects on inspection intervals and methods , implementing an inspection program for cracks based on a lightning threat is not practical , nor, as this report describes in detail, is it necessary.

These advancements in analysis methods cont ribute to minimizing st ructural failures and thus the potential for an i gnition source due to lightning.



### 3.3 DESIGN PROCESS The design process to produce safe and robus t airplane structure that complies with current regulations also leads to a design that offers lightning protection.

In the design process, the fasteners, mate rials, and corrosion protection/finish schemes used to design the wing are chosen with the function, loads and design criteria in mind by the Design, Materials and Stress/Fatigue & Damage Tolerance (FDT) engineers.

Material selection for fasteners and other components reflect advancements in corrosion resistant technologies to reduce potential damage occurrence in-service. Older airplanes may have used materials such as 7075-T6. This has been replaced in newer airplanes with 2324, 7050 or 7475 alloys which have hi gher fracture toughness and improved stress corrosion cracking properties.

All specifications and standa rds used for hardware, materi als and processes (fasteners installation, sealing, etc.) ar e approved by FAA Designated E ngineering Representative (DER) or FAA Aircraft Certification Offi ce (ACO), or industry approved and used specifications. These are the documents to wh ich the airplane is designed, manufactured, tested and inspected.

Prior to approval, the part/installation design is analyzed by the Stress/FDT Engineering Group to verify the fasteners, material selecti ons, and design features will meet the static and fatigue load requirements. The desi gn is approved by the Design, Material and Process, Manufacturing, Quality, St ress/FDT Engineers and the DER.

To verify the assembled wing will be able to handle the loads identified by Stress/FDT Engineering, two complete airframes are asse mbled, one for static testing, and the other for damage tolerance and durability testing. The static test airframe is tested to 1.5 times limit load per § 25.305. The fatigue test airframe is tested to multiple lives to satisfy the requirements of § 25.571.

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 10

Structural cracking, fractured fasteners and other defects th at show up during the testing are subject to component redesi gn and/or having the fastener evaluated and replaced with an improved fastener. The post test inspections also include detailed teardowns of certain

areas which could reveal small cracks in additio n to larger, more easily detectable ones. This verification process is done in order to ensure the components and fasteners last the life of the airplane. If any airplanes have been delivered prior to completion the fatigue testing and a crack is found during the inspecti on, a service bulletin will be issued to rework the part(s) and fix the problem.

These aspects of the design process contribute to minimizing structural failures and thus the potential for an igniti on source due to lightning.



### 3.4 MANUFACTURING AN D QUALITY PROCESSES Manufacturing techniques, insp ection methods, and quality c ontrol processes contribute to less variation and defects in the final produc t. There have been many advancements in these areas which have led to enhanced pr oduct quality. These have not completely

eliminated all defects but cer tainly reduce the lik elihood of occurrence, which reduces the potential for an igniti on source due to lightning.

Trends to increase automation in airplane manufacturing have resulted in more robust designs by increasing consistency and reduci ng defects. For example, an airplane manufacturer may implement a fully robotized process to install aluminum index head rivets. The numerically cont rolled machine locates and drills the hole, inserts and squeezes the rivet, and then shaves the head flush. During the squeezing of the rivet, the shank expands outward with a force great enough to not only fill the hole in the aluminum structure but also expand the hole. This ensures a tight, leak free, bonded fit.

Automated processes may not be suitable for all locations but many fasteners have inherent features which ensure proper manual installation. For Hi-Lok® type fasteners, the driving portion of the collar shears off at the required torque leve l, ensuring the collar is properly locked in place without being over tightened. For lo ck bolts, the collar swaging tool reacts against the tail of the bolt, which is designed to break when the appropriate swaging force has been applied. This ensures proper repeatable installation

of the collar. Manual hole drilling is aided by drill templates (to properly locate fasteners) and drill guides (t o ensure proper angularity).

Material variation has been reduced as raw material suppl iers transition to computer controlled processes and more accurate sensors. Variation from unit to unit at the airplane manufacturer has also been redu ced due to improvement in manufacturing processes. Computer controlled machin ing, forming, trimming, dr illing and fastener

installation have all worked to re duce variation in the process.

Quality Assurance (QA) processes ensure th at both automated and manual manufacturing operations produce a final product with minimal defects.

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 11

Robotized manufacturing processes ensure th e quality and repeatability of fastener installations, and are Quality Assurance verified on a scheduled basis. The machines carrying out the installations undergo a rigorou s qualification proce ss before being used to produce production parts.

Manually installed fasteners either possess inhe rent features (such as Hi-Lok® and lock bolt collars mentioned previously) or have r obust quality measures in place to ensure proper installation. Nuts are installed by a qua lified mechanic using a calibrated torque tool. Quality Assurance personnel can direc tly witness nut installation or verify the torque tool setting afterwards. Nuts are also inspected for gaps to verify proper

installation.

After assembly, the fuel tanks are leak checked with air and/or a test fluid, which offers another opportunity to detect defects before an airplane is delivered.



### 3.5 SUMMARY OF MITIGATION OF IGNITION SOURCES Compliance with existing structural regulat ions and standard design processes has produced designs with inherent protection ag ainst ignition due to lightning. Current manufacturing and quality assurance processes al so contribute to this inherent robustness. Evolution in all these areas has helped to fu rther minimize the occurr ence of structural

failures. It is therefore the conclusion of the structural work groups that probability failure analysis for structural failure cond itions is not necessary. This conclusion is validated by service history, as explained in the following section.



## 4.0 SERVICE HISTORY
Service history has shown that existing st ructural lightning pr otection designs are inherently robust. No airplane has been lost due to a fuel tank i gnition due to a lightning

strike since 1976. The inherent robustness is due to the minimization of structural failures as has been described in this report. The data in Appendi x Table 3.3-1 of the Lightning ARC report is based on operator repo rts to airplane manuf acturers with regard

to structural cracks found in service. Th e data includes the e ffects of manufacturing

flaws and maintenance.

The data supports the general conclusion that cracks in fuel tank structure, while not completely eliminated, have been minimized. However, it is not appropriate to attempt to use this data to quantify the ra te of structural cracking due to the reasons presented in this report and because newer designs are exp ected to perform ev en better due to incorporation of continuous improve ments as outlined in Section 3.0.

The in-service data shows a distinction between overall reports of cracking in the fuel tank and instances of a single cracked compone nt on multiple airplanes due to specific condition that was addressed by a Service Bulleti n. In some cases the cracks are detected when they are very small, however because of the large sample size and the fact that small cracks eventually grow into larger more easily inspected cracks, the data in Table 3.3-1 of the Lightning ARC report is repres entative of cracking in the fleet.

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 12



## 5.0 COMPOSITE STRUTURE

While it is true there is less service experience with composite fuel tanks than for metal fuel tanks, in general the data shows th at composites are less likely to experience cracking in service. Composites have to meet the same regulations as metallic tanks with respect to static strength, but instead of de signing for a slow inspectable damage growth like metal structure, composites generally take a “no detrimental damage growth” approach to damage tolerance and in doing s o, operating strains ar e kept below levels where cyclic damage will lead to deteriorati on over the life of the airplane. They are designed for no detrimental deformation at limit just like metal structure and since they do not yield like metals they usually have no detrimental deformation at ultimate also. Composites can experience delami nations under impact or direct lightning strike which is not typical in aluminum structure but ag ain the structure is designed so these delaminations do not have detrimental growth or they are visible and repaired. In addition, composites are much less suscepti ble to corrosion compared to metallic

structure.

A review of over 15 years worth of service data for the Boeing 777 horizontal and

vertical stabilizers revealed that there have been no reports of cracks or fastener failures in any of that structure, which although it is not a fuel tank, is representative of composite wing/stabilizer fuel tank construction.

Testing of the 777 horizontal and vertical st abilizers as well as 787 wing pre-production

test articles for three lifeti mes was conducted as part of th e airplane design effort. Results of the 777 and 787 testing showed no indication of cracking or delamination in the composite primary structure. Additio nally the 777 and the 787 composite structure test programs were extensive, comprisi ng thousands of element and hundreds of subcomponent level tests. These tests incl uded cold, room temperature and hot/wet conditions with intentionally inflicted damage at operating stress levels in order to ensure that undetectable damage to composite stru cture does not grow under operational loads to the size necessary to in itiate a fuel leak.

Based on the service history and design consid erations discussed above, the data shows that composite designs are i nherently more robust compared to metallic designs with regard to cracking or damage growth, wh en designed to meet the same regulatory requirements.



## 6.0 SUMMARY AND CONCLUSIONS

1. Structural lightning strike criteria for fuel tank ig nition are covered by § 25.954 and therefore structural requireme nts should be removed from § 25.981. Compliance with existing struct ural regulations results in robust fuel tank design, where structural failures, including failu res such as bolt fractures and cracking, have been minimized. This is supported by field data of stru ctural failures from airplane operators.

2. There have been continuing improvements in the design processes and analyses, material selection and processing, manuf acturing and inspection methods over the

### LIGHTNING ARC FINAL RE PORT APPENDIX D - PAGE 

### 13

ones used for airplanes designed in the past to support the structural rules. This

results in a more robust fuel tank with respect to cracks, broken fasteners,

corrosion and wear.

3. It is not appropriate to attempt to show th at a structural failure that could cause an ignition source is extremely remote. Probabi lity analysis methods are inconsistent with structural design methodology and due to the large scale of testing required, would add no significant value to th e evaluation of structure.

4. The structural working group’s findings of the rarity of cracks, broken bolts, etc. from the review of the airplane manufact urer data indicates the robustness of airplane manufacturers wing structure, a nd its ability to comply with existing regulations, and are typical of what woul d be expected. Additionally, given that there is no history of igniti on in these airplane models , the data indicates that structural failures, includ ing failures such as bolt fr actures and cracking, are not an issue for lightning strike.

5. It is not practical or nece ssary to attempt to devel op an inspection program to detect cracks before they beco me a potential ignition source.

6. The review of composite stru ctures service and test data shows it is less likely to develop structural cracking than aluminum structure. Composite designs must meet the same structural requirements as metallic designs, which results in an equivalent robustness and is expected to result in equivalent lightning ignition service experience.

7. Maintaining the current prescriptive appr oach for the evaluation of structure is correct because it mitigates the chance of structural failure and allows for the incorporation of analysis and mate rial improvements as they evolve.

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 1



## APPENDIX E

EVALUATION OF SPARK OR ARC GENERATION BY

LIGHTNING CURRENT AT STRUCTURAL CRACKS AND

CRACKED BOLTS

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 2

TABLE OF CONTENTS

1.0 INTRODUCTION............................................................................................................... 3

2.0 STUDY ON LIGHTNING ENVIRONMENT REQUIRED TO CAUSE AN IGNITION AT A

CRACK........................................................................................................................................... 3

2.1 Test Results of Ignition Source Generation Due to Conduction Current through Aluminum

Plates with Cracks

...................................................................................................................... 4

2.1.1 Outline of the Test

....................................................................................................... 4

2.1.2 Test Specimen (Case 1: Crack from Edge)

................................................................ 5

2.1.3 Test Specimen (Case 2: Cracks from Center Hole)

.................................................. 5

2.1.4 Test Waveforms of Conduction Current

................................................................... 6

2.1.5 Test Facility and Setup

................................................................................................ 6

2.1.6 Test Results

.................................................................................................................. 8

2.1.7 Summary of Test Results

............................................................................................ 9

2.2 Numerical Analyses of Current Distribution of Tests and Discussion on the Mechanism and Threshold of Ignition Generation

........................................................................................... 10

2.3.1 Calculation Model of Wing Section

.......................................................................... 15

2.3.2 Calculated Cases of Current Density Distributions of the Unit Cell

..................... 17

2.3.3 Findings of the Calculated Current Density Dist ributions within a Conventional Al Wing

Fuel Tank Structure Model

................................................................................................. 34

2.4 The Origin of Skin Effect

................................................................................................. 34

2.5 Investigative Lightning Test of Cracked Structure and Fastener Hardware

.............. 38

2.5.1 Test Configuration

..................................................................................................... 38

2.5.2 Test Results

................................................................................................................ 40

2.6 Investigation of Voltages across Cracks in Aluminum Panels

...................................... 41

3.0 Conclusions........................................................................................................................ 44

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 3



## 1.0 INTRODUCTION

Members of the Lightning ARC conducted some test s and analyses to learn about the possibility

of cracks in fuel tank structural elements and fa stener installations beco ming ignition sources due to lightning currents.

The tests included conduction of simulated lightning currents through fu el tank structural

materials and fastener installations with cracks introduced in them. Most of these tests were conducted at ranges of amplitudes to de termine ignition source thresholds.

The analyses included finite difference time domain computations of lightning current

distributions on the interior surfaces of fuel tanks and within interior tank elements such as ribs, spars and shear ties. These computations were conducted for the more common conducted currents throughout lightning Zone 3 when a wing tip is struck by lightning as well as for direct strikes to fasteners located in lightning Zone s 1A and 2A on wing tank surfaces, which are less

common. The Zone 3 conduction – only computations are called CASE A . A combination of

direct strike and conduc tion is described in CASE B and the direct strike computations are called

CASE C

.

Computations were also made of current densities throughout some of the structural element test coupons so that the local current densities in th e vicinity of the intr oduced cracks could be known. The current flow analysis re sults are presented in Section 2.3.

The tank structure computations showed that, for all-metal tanks, the ligh tning current densities

at the interior surfaces of fuel tank skins a nd other tank boundaries are much lower than the

current densities in the exterior surfaces of these same elements. This is due to the long times required for electric currents to diffuse thr ough the thicknesses of me tal conductors. This phenomenon is commonly known as skin effect. A general discussion of skin effect is presented in Section 2.4 of this Appendix.

Additional test data on spark thresholds of othe r failure conditions in fasteners and shear tie

installations is contained in Sect ion 2.5 and an assessment of the or igin of “sparks” in structural elements is presented in Section 2.6.

A discussion about the likelihoods of the ignition sources actuall y occurring within an all-metal fuel tank, based upon the data presented in Section 2, is presented in Section 3 of this appendix.



## 2.0 STUDY ON LIGHTNING EN VIRONMENT REQUIRED TO

CAUSE AN IGNITION AT A CRACK

To study the lightning environment to cause an ign ition (item c) in Secti on 1, the following items

are discussed in this section.

1. Test results of ign ition source generation,

2. Numerical analyses of the tests and discussi on on the mechanism and the threshold of the ignition generation, and

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 4

3. Examples of calculated current density distribution within a model of a typical metal fuel

tank section.

In the discussions that follow, the ignition source is termed generally a spark which is commonly

considered to result from ionization of air due to voltage, as compared with an arc that is commonly considered to result fr om current flow across conductors in contact. Sections 2.2 and 2.6 provide discussions of wh ether it is actually a spark or an arc that has occurred at the tested

cracks.



### 2.1 Test Results of Ignition Source Ge neration Due to Conduction Current through Aluminum Plates with Cracks

2.1.1 Outline of the Test

Current conduction tests to aluminum plates wi th a slit or an actual crack perpendicular to the current flow are conducted. Test parameters are as follows:

 Position of a slit/crack

 Width (gap) of slit/cracks

 Current waveform and amplitude

Figure 2.1 - Schematic of Current Conduction Test through

Aluminum Plates with Cracks Crack Al (7075)
Thickness: 1/8”
No Surface Paint/Primer 18.7” 6.3”

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 5

2.1.2 Test Specimen (Case 1: Crack from Edge)

Test specimen of case 1 is as follows. Th ey have cracks from the edges of the plates.

Figure 2.2 - Crack (Slits) Fabricated by Electrical Discharge Machining -Simulating Cracks with Some Gap

Figure 2.3 - Fatigue Crack actually Fabr icated by Tension Test Apparatus (Crack has No Width and the Surfaces may be Touching Each Other)



### 2.1.3 Test Specimen (Case 2: Cracks from Center Hole)

The test specimen of case 1 is shown in Figure 2.4. They have cracks at the center of the plates. This case has two types of cracks, including one with machined air gap and one with no air gap due to fatigue cracks originating from th e machined crack, as shown in Figure 2.4. 1.8” Crack (Slit) Width: 4, 20, 40 mil

Fatigue crack

1.8”

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 6

Figure 2.4 – Crack Fabricated by Machining Simu lating Cracks with Some Gap and Fatigue Crack actually Fabricated by Tension Test Appara tus; Crack has No Width and Surfaces May

Touch Each Other



### 2.1.4 Test Waveforms of Conduction Current

Test waveforms are described in Table 2.1.

Table 2.1 - Test Waveforms of Conduction Current

Waveform Peak Current Notes

1 Comp. B 6 kA A lightning intermediate current with a high DC content and therefore more likely to divide among

structural elements accordi ng to element resistances and less sensitive to skin effect. Component B external environment peak amplitude is about 4 kA per SAE ARP5412A. Component B is therefore an appropriate current for repr esentation of currents that

have diffused to internal tank skin surfaces and other

internal structural elements where cracks of interest as possible ignition source might be present.

2 Comp. D/2 50 kA

3 Comp. A 20-100 kA -Relatively high conduction current assuming proximity lightning attachment. -Comp. D/2 was tried because maximum conduction current assuming proximity lightning attachment at zone 2A of upper skin may be about a half of comp.

D.



### 2.1.5 Test Facility and Setup Crack (slits) Fabricated by Electrical Discharge Machining - Simulating Cracks with Some Gap 1.8” Crack (Slit) Width: 4, 20, 40 Mil

Electrical Discharge Machining Slits

Fatigue Cracks 0.6” 1.8”

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 7

Test facility and setup used for th e test is shown in Figures 2.5 and 2.6.

Figure 2.5 - Photo of High Cu rrent Lightning Test Lab

Figure 2.6 - Schematic of the Test Setup Capability: Generate Standard Lightning Waveforms

Defined in SAE ARP 5412A Component A & D
Generator Comp. B
Generator Comp. C
Generator

Test Space

Light-Tight
Chamber Camera
Test
S p ecimen Comp. A/D

Generato r

Comp. B
Generator

Comp. C*/C
Generator

Current
Transforme r

Oscilloscope Oscilloscope

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 8

2.1.6 Test Results

Test results are shown in Figure 2.7.

(1) Fatigue Crack from the Edge

(2) Cracks from Center Hole

Figure 2.7 - Test Results

The specimens containing slits cut by a saw were also tested but there were no sparks observed in those specimens. No further discussion of the open slits is pres ented in this appendix.

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 9

Table 2.2 - Current Waveforms and Examples of Sparks



### 2.1.7 Summary of Test Results

From the above test results, th e followings can be concluded.

1. No spark was observed with cracks (slits) with some air gap.

Sparks were observed only with actual fatigue cracks (with no gap) whose surfaces are rough and may be touching each other.

2. No spark was observed when the current density at the edge crack was 6.0e4 A/m resulting from 6 kA of Component B through the 6 inch (150 mm) wide aluminum panel.

Sparks were observed at the edge crack with higher currents of 20 kA and 50 kA through the 6 inch wide panel. For the cen ter crack, there was only one case of a very faint spark when 50 kA was conducted through the 6 inch wide panel.

3. Edge cracks are more likely to generate sparks then are cracks existing away from edges since the lightning current densities are highest at the e dges of structural

elements. Table 0.2 Pi ctu r es

Comp. D/2
50 kA

7.1 x 10 4 A 2 s Comp. A/10
20 kA

1.9 x 10 4 A 2 s Comp. D/2
50 kA
7.1 x 10 4 A 2 s W a v e f o rm s Spec im e n

Cracks
from
Center

Hole

(Fatigue Crack) Crack from Edge

(Fatigue Crack)

Faint Spark - Spark was Very Small (Faint) - Could be less than 200 μJ - Spark at Center of Fatigue

Crack

100μs/div 100μs/div 100μs/div -50 kA

-50 kA

-20 kA 1ms/div 6 kA Ref. Comp. B, 6 kA, 10 C (No Spark Observed)

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 10

2.2 Numerical Analyses of Current Dist ribution of Tests and Discussion on the Mechanism and Threshold of Ignition Generation

To understand the behavior of the ignition source, electro-magnetic field analyses for the aluminum plates with slits were performed. Fi gures 2.8a shows the current density distribution of the Al plate and electric field within the slit for the case of slit at the edge with Component A waveform of 200 kA defined for analysis in ARP5412 [16] . Slit width was 2 mm which is the size of the cells in the model. As can be seen, the current is concentrated to the edge. The overall distribution in the panel did not se em to be influenced by the exis tence of the slit and the intense current flow along the edge detours around the slit. Concentrations of current near the panel edges are due to the high frequency content of the Component A waveform.

Figure 2.8a - Current Density Distri bution of Al Plate and Electric Field within Slit for Case of

Slit at Edge; t = 0.09 μs . At,0.09 μs the Curre nt is Changing Most Rapidly and Voltage at Crack is Highest

Figure 2.8b shows the maximum current density around the crack at 6 microseconds when the conducted current is highest. Zoom in Around the Crack

Electric Field within the Crack

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 11

Ele. Surf. Cur. Dens. (A/m)

1.26E+05 1.50E+05 2.12E+05 2.99E+05 4.22E+05 5.97E+05 8.43E+05 1.19E+06 1.68E+06 2.37E+06 3.35E+06 4.74E+06 6.69E+06 9.45E+06 1.34E+07 2.24E+07

1.26E+05 1.50E+05 2.12E+05 2.99E+05 4.22E+05 5.97E+05 8.43E+05 1.19E+06 1.68E+06 2.37E+06 3.35E+06 4.74E+06 6.69E+06 9.45E+06 1.34E+07 2.24E+07 Current Density Around the Crack

Electric Field within the Crack

Fig 2.8b - Current Density Distribution of Al Plate a nd Electric Field within Slit for Case of Slit at Edge; t = 6 μs When Current Densities are Highest. Injected current is 200 kA

From these results, the following two possibilities for the spark ge neration at the fatigue cracks (with no gap) can be anticipated.

 Electric sparks (also known as voltage sparks ) within small irregular gaps of fatigue

cracks

 Electric arcs (also known as thermal sparks) between two rough and touching surfaces of

the cracks

To estimate the possibility of the voltage sparks , the potential difference between two corners of the slit at the edge was calculated and the result was 440 V. This potential difference is constant

with width variation since it is due to d  /dt caused by detouring current around the crack. 440 V is the maximum value for 200 kA Component A. Since this value is almost the same as the minimum value of the Paschen curve of 360 V, fu ll threat lightning current would have to flow through an aluminum plate just several inches wi de to cause a voltage spark. Therefore, the cause of the crack ignition source in the tests as well as any potential i gnition source at a crack with the real lightning to the airplane situa tion should not be due to a voltage spark.

Figure 2.9 shows the calculated current density distri bution and the electric field within the slit at the center of the panel When the Component A waveform at 200 kA (peak) was beginning to flow into the panel at 0.09 us. As can be s een, the current density ar ound the crack is small compared to the crack at the edge . If the slit is the actual crac k, there should be many contact points and therefore the current density around the crack should be much less than the density around the edge crack. Therefore, the arc or spark probability in Case 2 (center crack) should be

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 12

much smaller than that in Case 1 (edge crack). If the voltage spark ma y occur, the potential

difference is one order smaller in Case 2. Al so, the spark energy in Case 2 should be quite smaller than in Case 1 because the energy shoul d be proportional to the square of the current density.

Figure 2.9 - Current Density Distribu tion of Al Plate and Electric Field within Slit for Case of

Slit at Center of Plate; t = 0.09 μs (Normalized Distribution at t = 6.0 μs is ~equal); At this

Time, Current is Changing Most Rapidl y and Voltage at Crack is Highest.

To evaluate the current density at the crack wh en a spark occurred, current density distributions of the Al plate used for the crack spark tests pr esented above were recalculated. Previously, the

waveform used to calculate the distribution was an ideal Comp. A as described in SAE

ARP5412A [16] . However, the actual test current varied somewhat from the ideal definition so the

actual test waveform was curve fit and used this time. This is b ecause the current distribution is influenced by the input waveform (especially by the current rise and decay times). Figure 2.10 shows the actual injected current wavefo rm and Figure 2.11 shows the resulting current distribution throughout the tested pa nel. The current density thre shold not to cause an ignition

source is estimated to be more than 6.0e4 A/m. Note that in the figures that follow in this appendix the notation for current density, for ex ample, 6.0e4 and 6E4, are used interchangeably

and mean the same value. Zoom in Around the Crack

Electric Field within the Crack

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 13

Figure 2.10 - Injecti on Current Fitting

Figure 2.11 - Calculated Current Di stribution of the Test Panel

Figure 2.8b shows that the current density necessary to produce an arc at the fatigue crack at the edge is 1.75e5 when 20 kA was conducte d through the cracked panel. Bulk current at Edge 1,2: 40 mm in width. Density 2.5e4 A/m

Bulk current at Center: 80 mm in width. Density 1.1e4 A/m

Current density threshold not to cause an ignition source is
estimated to be more than
6.0e4 A/m since none of the tests
with Com p . B p roduced a s p ark. ~4.0e5 A/m

6.0e4 A/m

at Location

of Edge

Crack 0 500 1000 1500 2000 2500

0 50 100 150 200 250 300 350 400

Time (μ s )Bulk Current (A)

端部1
中央
端部2 E 180 Comp B 6 kA Current Injection

Edge 1 Edge 2 Center

~1.0e4 A/m -2000 0 2000 4000 6000 8000 10000

-200 -100 0 100 200 300 400 500 600 700 800 900 1000
時間 [μ s ]電流[A] Com p.B (6kA) 電流 [A] I0[exp(

- α t)

- exp(

- β t)]

I0=6855.84

α =0.0006178

β =0 0186984

Time (μs) Cur

rent (A) 180

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 14

Figure 2.11 shows that the current density that will not cause an arc at this crack is 6e4 A/m. Therefore it may be concluded th at the arc threshold for this fatigue crack is somewhere between

6e4 and 1.7e5 A/m.

The current density that caused th e faint spark at the center of th e panel is believed to correspond to a current density similar to that at the center of the Al plate in Fig. 2.8b which is 6.2E5 A/m x (50 kA/200 kA) = 1.5e5 A/m (150,000 A/m) when 50 kA Component A was conducted through the panel as shown in Table 2-2. This is because the crack surfaces must be closed (and therefore touching each other at multiple locations) to cause an arc, so the current must flow through those multiple touching locations and the current density at the crack must be almost the same as the Fig. 2.8b . Although the current density in Fig 2.9 around the slit is higher than that of non-slit location, with a maximum of 5.2e5 A/m x ( 50 kA/200 kA) = 1.3e5 A/m (130,000 A/m) for 50 kA conduction, even at the time of 0.09 μ s at the ends of this slit, this is because the model

assumes no conduction current flow across the slit wi dth. This is not the case when the slit is closed. On the other hand, if the crack is open like the model of Fig. 2.9 , there will be no touching location and no arc will be generated.

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 15

2.3 Examples of Calculated Current Density Di stribution within a Typical Metal Fuel Tank

Model

To assess if the current density at the crack excee ds an ignition threshold, current densities in the areas where the cracks might o ccur are required. Here, we pr esent typical examples of calculated current density distribut ions within a conven tional aluminum wing fuel tank structure model. Table 2.3 shows the summary of these ca lculations, which are pr esented in the following subparagraphs.

Table 2.3 - Calculation Conditions (Attachment Scenario, Test Current Value, etc) and Calculated Maximum Current Density

CASE Attachment

Scenario Input Amplitude and

Waveform for

Calculation (kA) Maximum

Calculated

Internal

Current Density

(A/m) Corresponding

Full Threat Amplitude (kA) Corresponding

Maximum Internal Current Density for the

Full Threat Strike 2
(A/m)

CASE A Tip Strike Zone 3

Conduction Component A at

200 kA (Most Likely Attachment Case) 200 20 200 20

CASE B Conduction and

Direct Strike in

Zone 2A Component A 1 at 3

kA 3 890 100 (Comp D) 2.9e4

CASE C Direct Strike in

Zone 2A Component D at

100 kA 100 1.5e3 100 1.5e3

Note 1: Component A was applied instead of Component D in this analysis since measurements of current densities within a generic wing section for validation of the analysis had been made with Component A (See Section 2.3.1)

Note 2. Note that the corresponding maximum internal current density for the full threat strike in CASE B is extrapolated from a calculation at 3 kA since this was the amplitude of a Component A test current applied to the wing tank structure model for validation of the EMA3D numerical simulation method. The extrapolation factor was

33.



### 2.3.1 Calculation Model of Wing Section

EMA3D was used to calculate the current distri bution of a partial cut out generic wing section (called Unit Cell) of a conventi onal aluminum main wing structur e, including typical structure

elements such as:

 Skins (with skin splices) and spars. The aluminum skins on this model are

4 mm thick.

 Ribs and stringers (one realis tic rib and two fake ribs (a s access doors for the Unit Cell))

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 16

 Leading and trailing edges

 A 7.5 mm air gap (slits) along a sk in splice is intentionally in cluded to obtain the worst case (strong) electromagnetic field penetr ation into the inte rnal wing box through potential small apertures along the splices due to surface finishes and fay seals.

A geometric model of the Unit Cell for the calcula tions as well as comparison tests is shown in Figure 2.12 and Figure 2.13. The Unit Cell simulate s two bays of a typical aluminum main wing section with three ribs (one rea listic rib and two fake ribs act as access doors for the Unit Cell), leading/trailing edges and front/rear spars. The shape is simplified using plain surfaces instead of round shapes because such shape differences do not essentially affect the current distribution.

Figure 2.12 - Partial Cutout Wing Section (“Unit Cell”) for Test

Rib 8

Rib 7 Rib 9 Leading Edge (LE)

Trailing Edge (TE) Skins

INBD 0.6 m

0.6 m

0.35 m

Ports for Measurement Signal Cables

2.4 m FW

Skin Splice

Access Doors (Fake of Rib 7) All Components are

Aluminum

Current Injection

Tabs for Skin

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 17

Figure 2.13 - Partial Cutout Wing Section (“ Unit Cell”) for Test - Top Surface Removed



### 2.3.2 Calculated Cases of Current De nsity Distributions of the Unit Cell

Details of the calculation results are summarized in Table 2.3 and are as follows.

CASE A: Tip Strike (m ost likely lightning attach ment case) Zone 3 Conduction Component A

at 200 kA

This case represents a most fre quent lightning strike scenario of tip strike and Zone 3 conduction through the main wing to the wing r oot with a 200 kA peak current. Top view of the calculated

result at 6 μ s which is Component A peak is shown in Figure 2.14. In the case of the Unit Cell test, return foil was needed. Thus , the calculation model also includes the return foil. The return foil is shown in Figure 2.14 but omitted from most of the succeeding figures. The current is injected and ejected through six braided wires, respectively, as shown in the figure. The maximum current density of 2.4e6 A/m was due to th e thin wire current in put at return foil and therefore fictitious for anywhere on a real wing. External current tends to concentrate at edges, especially at LE/TE edges and its density is up to ~7e4 A/m. The current density on the skin

surface was ~2e4 A/m. Stringers Front Spar

Skin Splice Joint Stringer

Rear Spar

INBD FWD

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 18

Figure 2.14 - Top View of Unit Cell Calcul ated Current Distribution of CASE A

Figures 2.15 to 2.20 show internal current at 6 μ s. Note that the contou r range is three orders smaller than Figure 2.14. Internal current is extremely small comp ared to the external current,

several tens of A/m at the maximum. The reason that the internal currents are much smaller than

the external currents is due to skin effect wherein a current of short time duration often does not have time to fully penetrate to the interior of a conductor. Skin effect is described more generally

in Section 2.4. 2.4e4 A/m

The Max Current Density

is Due to Thin
Wire Current Input at Return
Foil and
Fictitious for Anywhere on a Real Wing. Conduction 7e4 A/m 2.4e6 A/m

LE Return Foil Needed in Test Setup (Does Not Exist in Real Wing) Time = 6 μs

Conduction

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 19

The highest current density calculated at any su rface inside the unit cell is 20 A/m at rib shear ties shown in Figure 2.16.

Figure 2.15 - Top View of Unit Cell Calculated Current Distributi on of CASE A with Top Skin

Removed to Show Internal Currents

Figure 2.16 - Center Rib Section of Unit Cell Model in CASE A Internal Surfaces on Stringers
~5.0 A/m Time = 6 μs High Current Density Around these Regions are Due to the Penetration through the
Access Door Seams

Conduction Conduction

Front Spar

Rear Spar Stringer Joint
for Skin

Rib

Time = 6 μs

~20 A/m ~3.5 A/m < 0.3 A/m Internal Surfaces (Rib and Stringers )

Rib

Front Spar Rear Spar INBD

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 20

Figure 2.17 - Close-up View at the Cent er of the Skin Splice in CASE A Close-up

View Skin S p lice Joint

Dry Side Fay Bonding Skin 1

Relatively high current density of this surface should be neglected because this surface is within aluminum bulk and not exposed to any space. Density value is an average of each cell and reflects mainly the large current on top of the cell. 20 mm Air Gap to
Simulate
Insufficient Contact Conduction Time = 6μs 7.5mm Physical Structure of Skin Splice

Skin 2

This

Splice (7.5mm Air Gap)

Wet Side Insulation Film (Simulating Insufficient Contact)

Conduction

Js=5.5 A/m at Upper Surface Of Skin Splice Joint Stringer Flange Skin Splice Joint Stringer Flange

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 21

Figure 2.18 - Close-up View of th e Center of the Skin Splice (Bottom View) in CASE A;

Interior Surface Current Distribu tion at Center of Model is Du e to Higher Densities at Edges

near Access Doors

Figure 2.19 - Tank Side of the Spar in CASE A (Looking from Inside) Wet Side Dry Side S p lice Conduction

Conduction Skin Splice Joint Stringer Flange Time = 6μs

Js=9.0 A/m at Bottom Surface of Skin Splice Joint Stringer Flange Edge

High Current Density in these Regions is Due to Current Concentration Near Hinges at
Access Doors for Unit Cell
Instruments at Ends of Tested Unit Cell and Fictitious on a Real Wing

Dr y Side Js=13.8 A/m @ Center of Upper Surface of Spar Flange

Js=0.79 A/m @ Center
of Lower Surface of
S p ar Flan g e Js ~1.0 A/m
Wet Side Time = 6μs

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 22

Figure 2.20 -

Tank Side

of the Spar

in CASE

A

(Close-up View)

CASE B: Conduction and Direct Strike in Zone 2A, Component A at 3 kA

3 kA, Component A was used in this case because th at is the current applied in a comparison test of the same Unit Cell that was modeled. To ge t full scale currents at 100 kA for Zone 2A, Component D direct strike, the calculated valu es should be multiplied by 33. To get those at 200 kA for Zone 3 conduction Component A, the calcul ated values should be multiplied by 67. The results are presented this wa y in the summary of Table 2.3.

Figure 2.21 shows a close-up view of strike poi nts and Figure 2.22 shows a waveform of the injection current used in th e calculations. Figure 2.23 thr ough Figure 2.30 show calculated current distributions with Component A, 3 kA peak injection. Extrapolated values to represent full threat Component D injected at a fastener are shown on Figures 2.29 and 2.30.

With the extrapolated full threat current of 100 kA injected at a fa stener (Figure 2.30), the

interior current value of 3e4 A/ m at the maximum is quite small compared with the exterior

current value on the order of 1e6 A/m at the stroke current injection location. This is due to the

skin effect which forces most of the current to flow directly into the exterior surfaces of the aluminum skin and spar panels.

Also this is the highest density calculated anywhere within the aluminum Unit Cell. However

this is below the arc threshold of between 6.0e4 and 1.7e5 A/m reported in Section 2.2. Js=13.8 A/m @ Center of Upper Surface of Spar Flange

Js=0.79 A/m @ Center
of Lower Surface of Spar Flange Time = 6μs

Dry Side

Wet Side

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 23

Figure 2.21 - Current Injection Configurations for CASE B, Conduction/Direct Comp A

3 kA Peak

Figure 2.22 - Close-up View of Strike Point 2 to 5; Strike Point 1 is a Conduction Case of Figure 2.21 Strike Point 3

Resistive lines

No Line Strike Point 2

Resistive lines

Resistive lines Strike Point 5

Fastener Resistance Superimposed lines (material parameters given top priority)

Strike Point 5 '

Fastener Resistance TE LE

X

Y To Strike point 4

No Lines No Lines 2, 3 5 5’

Fastener edge injection Fastener direct injection Splice edge injection Splice edge injection Splice Fasteners Calc. mesh Strike Points 2, 3 & 5 Enlarged on Next Figure Current Injection Wire 4

L

T 7 8 9

Return Foil Needed in Test Setup (Does not Exist in Real Wing) Conduction Cases: 1 (through 6 Injection Wires) Current Injection Wire 2, 3, 5, 5 '

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 24

Figure 2.23 - Component A 3 kA Injection Cu rrent Time History for the Calculation

Figure 2.24 - Calculated Current Distribution at 6 μs on Exterior Surfaces for Conduction Component A, 3 kA Peak, CASE B CIC1-A

~4E4 A/m Time = 6μs

~ 2e3 A/m

~4e3 A/m Conduction 1

Conduction

~1e3 A/m

Multiply by 67 to get Full Scale Currents @ 200 kA Conduction

LE TE

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 25

Figure 2.25 - Calculated Current Di stribution at 6 μs on Exterior Surfaces for Direct Strike Component A, 3 kA Peak, CASE B

Figure 2.26 - Rib and Spar Bulk Currents of C onduction Strike Point 1 (see Figure 2.21) Comp A 3 kA Peak, CASE B CIC2

- A

~6.8E4 A/m

~1500 A/m 3 kA Strike Point Time = 6μs Strike Point 2

Multiply by 33 to get Full Scale Currents @ 100 kA LE TE

CIC1

- A

3B7 Rib Bulk Current

3B9 Rib Post to S p ar Flan g e Bulk Current Conduction 1

Time ( μ s ) Multiply by 67 to get full Scale Currents @ 200 kA of Zone 3 Conduction Comp A. A

m
p

er

e

s

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 26

Figure 2.27 - Locations of Stringer Rib Fastener Currents for Direct Strike Point 2, Comp A 3 kA Peak, CASE B

Figure 2.28 - Stringer/Rib Fastener Current s for Fastener Edge Direct Strike, Comp A 3 kA Peak, CASE B 3B6 3B5 3B4 Measurement Points

3B4 3B5 3B6 TE LE 3B6 3B4 3B45

Strike Point (Direct Strike 2) Fastener Ed g e Direct Strike 2: See Next Pa g e for Time Histor y

Small Currents when Compared to
those of the Skin Fasteners CIC2

- A

Multiply by 33 to get full Scale Currents @ 100 kA

Time ( μ s ) A

m
p

er

e

s

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 27

Figure 2.29 - Surface Current Densities on Ri b 8, Fastener Edge Direct Strike, Comp A 3 kA Peak at 6 μs, CASE B

Figure 2.30 - Surface Current Densities on Ri b 8, Fastener Edge Direct Strike, Comp A 3 kA Peak at 50 μs, CASE B 3.16E-01 4.47E-01 8.91E-01 1.78E+00 3.55E+00 7.08E+00 1.41E+01 2.82E+01 5.62E+01 1.12E+02 2.24E+02 4.47E+02 8.91E+02 1.78E+03 3.55E+03 2.90E+04

(~7.6E3
A/ 

### sAt  6

View from Rib 7 CIC2-A

~2.9E4 A/m ~ 230 A/m ~30 A/m ~3 A/m

Strike Point Multiply by 33 to get Full Scale Currents @ 100 kA TE LE

(~7.6E3 A/m @100 kA)

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 28

Table 2.4 shows total rib and spar internal surface currents due to a direct 3 kA Component A current injected to a fastener at the joint stringe r below a rib. The table also shows currents due to 1 A of Component B current inj ected at the same location. Extrapolation factors applicable to each injected current are presented in Table 2.4.

Table 2.4 - Calculation Resu lts of Internal Bulk Spar and Rib Currents Conduction/Direct Comp A 3 kA Peak, DC Current

CASE C: Direct Strike in Zone 2A Component D at 100 kA

Figure 2.31 through Figure 2.39 show calculated current distributions of the Unit Cell on exterior and interior surfaces, with a direct strike at a fastener edge close to a skin splice in Zone 2A with Component D of 100 kA peak at 4 μs. Maximum interior current density is 1.5e3 A/m whereas

exterior densities reach 1.2e6 A/m at the strike point and 7.5e4 A/m at the edges of LE/TEs.

This result is also included in the summary of Table 2.3. Bulk
Current

Probe

Position Injection Current

Com p onent A ( 3 kA ) { Peak Values } DC Current ( 1A ) { Final Values }

1 2 3 4 5 5 ’ 1 2 3 4 5 5 ’

3B7 0.4

- 29

- 38

- 20

- 40 40 0.5

- 12

- 24

- 13

- 2 5 26

3B9 0.1

- 17

- 20

- 10

- 21 21 0.1

- 8

- 13

- - 13 16

Units: Amperes (Multiply by 33 to get Full Scale
Currents @ 100 kA for Zone 2A ) Milli-Amperes (Multiply by 4000 to get Full scale
Com p onent B Results )

Strike Points (Direct Strike 2, 3, 5, 5’) 1: Conduction: See Figure 2.26 for Time History

TE LE

Rib S p a r 3B7: Rib Bulk Current 3B9: Rib Post to Spar Flange
Bulk Current

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 29

Figure 2.31 - Current Distribution at 4 μs on Exterior Surfaces, Direct Strike in Zone 2A Component D at 100 kA, CASE C; Test Current Return Conductors are Shown

Figure 2.32 - Current Distribution on Interi or Surfaces - Top Skin Removed, CASE C 1.2e6 A/m

7.5e4 A/m Return Foil Needed in Test Setup (Does Not Exist in Real Wing) The Highest Current Density Due to the Direct Attachment with Comp D

LE

TE Strike Point

~ 20 A/m

2.0e5 A/m Rib Surface Time = 4 μs High Current Density around this Region
Due to the Current Concentrations at the Unit Cell Access Door Hinges and Injection

Current Leads

Front Spar

Rear Spar Stringer Joint
for Skin

S t r i ke p o i n t

INBD

Current

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 30

Figure 2.33 - Current Distribution on Interior Surfaces - Close-up View of Rib and Stri ngers without Skins, CASE C

Figure 2.34 - Close-up View of the Center of the Skin Splice, CASE C. Most of Rib
< 30 A/m Edge of Rib and Stringers

Fuel Tank Rib Front Spar Rear Spar Time = 4 μ s

INBD High Current Density of Fake Rib (Access Door) is
Due to Test Current
Concentrations at the
Return Current Leads and Fictitious on a Real Wing Strike

Time = 4 μ s

Fay Bonding 7.5mm Physical Structure of Skin Splice

Skin S p lice Joint Strin g er Skin 2 Skin 1

This Surface

Dry Side 7.5 mm Air gap Closeup

view

Splice

Skin Splice Joint Stringer Flange Js=1.5e3 A/m at Upper Surface of Skin Splice Joint Stringer Flange Wet Side 20 mm Air Gap to
Simulate Insufficient
Contact Insulation Film (Simulating Insufficient Contact)

Strike Point Strike Point

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 31

The current density of 1.5e3 is at the upper edge of the skin splice in Figure 2.34. This is the highest current density calculated anywhere within the aluminum Unit Cell in CASE C. This is

below the arc threshold of between 6e 4 and 1.7e5 A/m reported in Section 2.2.

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 32

Figure 2.35 - Close-up View of the Center of the Skin Sp lice (Bottom View) CASE C

Figure 2.36 - Time Histories of Current Densities at Skin Splice Joint Stringer Flange Edges, CASE C Splice

Js < 42.5 A/m at Bottom Surface of Skin Splice Joint Stringer Flange Edge Strike Point

Wet Side Dr y Side

Skin Splice Joint Stringer Flange Time = 4 μs

0.00E+00 2.00E+02 4.00E+02 6.00E+02 8.00E+02 1.00E+03 1.20E+03 1.40E+03 1.60E+03 1.80E+03

0.0E+00 2.0E- 06 4.0E- 06 6.0E- 06 8.0E- 06 1.0E- 05

Time ( s )Ele. Surf. Current density (A/ m)

0.00E+00 5.00E+00 1.00E+01 1.50E+01 2.00E+01 2.50E+01 3.00E+01 3.50E+01 4.00E+01 4.50E+01 5.00E+01

0.0E+00 2.0E- 06 4.0E- 06 6.0E- 06 8.0E- 06 1.0E- 05

Time ( s )Ele. Surf. Current density (A/ m) A. Upper Surface B. Lower Surface

B. Lower Surface A. Upper Surface

Skin Splice Joint Stringer Edge

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 33

Wet Side Js=1.24 A/m @ Center of Lower Surface of Spar Flange Time = 4 μs Js=9.0 A/m @ Center of Upper Surface of Spar Flange Figure 2.37 - Current Distribution of Tank Side of the Spar, CASE C

Figure 2.38 - Current Distribution of Tank Side of the Spar - Close-up View, CASE C Dr y Side

Rib ~7 A/m Time = 4 μs

Js=9.0 A/m @ Center of Upper Surface Of Spar Flange

Js=1.24 A/m @ Center of Lower Surface Of Spar Flange High Current Density in these Regions is
Due to Current Concentration near Hinges at Access Doors for Unit Cell

Instruments at Ends of Tested Unit Cell and Fictitious on a Real Wing

Wet Side Dr y Side

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 34

Figure 2.39 - Time Histories of Current Densities at Upper and Lower Surfaces of Spar Flange, CASE C



### 2.3.3 Findings of the Calculated Current Density Distributions within a Conventional Al Wing Fuel Tank Structure Model

Findings of the calculated current distribution are as follows:

 Current density of internal structure of th e partial wing model (Unit Cell) was several orders of magnitude smaller than external curr ent density due to skin effect which is very strong in an aluminum tank.

 Calculated maximum internal current densitie s of the Unit Cell were 2.9e4 A/m at a rib edge and 1.5e3 A/m at the edge of a skin splice when 100 kA was injected to a nearby fastener along the rib or skin splice. Thes e maximum values exist only in the immediate vicinity of direct strike location.

 Other internal current densities were much lowe r, at several tens of A/m, especially for the much more likely conduction case when the strike occurs at a wi ng tip and current is conducted through the wing to an exit locati on at another place on the airplane.



### 2.4 The Origin of Skin Effect

When voltage is applied to a conductor, the initial current is confined to the conductor’s surface. This current is accompanied by a magnetic field. The relationship between the voltage and the magnetic field is given by Fara day’s law which states that: 0.00E+00 1.00E+00 2.00E+00 3.00E+00 4.00E+00 5.00E+00 6.00E+00 7.00E+00 8.00E+00 9.00E+00 1.00E+01

0.0E+00 2.0E- 06 4.0E- 06 6.0E- 06 8.0E- 06 1.0E- 05

Time ( s )Ele. Surf. Current density (A/ m) A. Upper surface

B. Lower surface

B. Lower Surface A. Upper Surface

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 35

The magnitude of the voltage induced in a circuit by a changing magnetic field equals the negative of the time ra te of change of the magnetic flux through the area enclosed by the circuit.

Similarly, Lenz’s Law states that the magneti cally induced voltages drive conductor currents whose own magnetic fields tend to cancel the fi eld initially inducing th e voltage. Therefore, when an electric current begins to penetrate th e volume of a conductor, it is opposed by surface eddy currents that establish magnetic fields e qual and opposite to those associated with the penetrating current. These eddy currents act to cancel current s within the body of a conductor

and increase the current at the surface of the conductor. In a perfect conductor (with no resistance), this process would occur with pe rfect efficiency, so that current could never penetrate the conductor but would always flow on the conducto r’s surface. In real conductors, resistive losses will diminish the eddy currents a nd some current will eventually penetrate further

into the thickness of the conductor.

The confinement of electric curren ts close to the surfaces of c onductors by this mechanism is

known as the skin effect

. At a given instant in time (or at a given frequency) the skin depth , is defined as the depth below the su rface of a conductor at which the current density falls below 1/ e of its value at th e surface, where e is the natural logarithm.

The situation described above is illustrated in Figure 2.40 which shows a cylinder exposed to an

initial flow of current. The cu rrent density, J, along the internal surface AB of the cylinder will be completely different from the current density along the exterior surface CD. This is because the phenomenon of skin effect delays the buildup of current on the inner surface. Only as the eddy currents decay, will the magnetic field penetr ate the wall of the cylinder. This process takes 10’s or hundreds of microseconds, depending on the material and thickness of the wall. The higher the conductivity of the wall material, th e longer the time needed for current to appear on the inner surface. The proce ss of current penetration into the wall of a conductive object is

called diffusion.

The process of decay of the eddy currents and gr adual penetration of cu rrent throughout the body

of a conductor is known as diffusion. The process of diffusion is described below.

Characteristic Diffusion Response

The diffusion response is the buildup of current on the inner surface of a conductor after current has been injected into the exteri or surface. A typical response to a square wave input current is shown in Figure 2.41.

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 36

Figure 2.40 - Illustration of Skin Effect in a Metal Cylinder C D I 

### --+t' J

:t-IC

B

(a)



## i; 

# '" Z

w 

### a



# .... . , z

w 

# " 

# " OJ u

ro

(b) EXTERNAL MAGNETIC FIELD LINE

INTERNAL MAGNETIC FiElD LINE

CIRCULATING CURRENT



# ( •• t \

" ./

...... .1 MAGNETIC FiElD LINE PRODUCED BY

THE CIRCULATING CURRENT

DIRECTION OF PROPAGATION OF THE

INTERNAL MAGNETIC FiElD



# .**~' i**  ei = Jp 

# • A**~ ~**  

## 1;\
<> 

### 10\ 

# -,' 

# '-" ''''' ' 0
..)



### 'I '2 '3 tfinal

r; ro r · 

## , ro r; ro r;

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 37

Figure 2.41 - Diffusion-Type Response of Current on Interior Surface to Square-Wave Current Injected at the Exterior Surface (Tim e Units are Diffusion Time Constants)

The response curve of Figure 2.41 is called a diffusion-type response and is characteristic of many types of situations invol ving the transmission of energy through a medium. An example

would be the transfer of heat into a block of material if a heat flux were suddenly applied to one

face of the block.

Waveshape: Two important observations might be made about the shape of the response curve shown on Figure 2.41. The first is that the response initially changes only slowly and thus has a zero first derivative, unlike a simple exponential re sponse, which has a finite first derivative. The second is that the response approaches its fi nal value much more slowly than does a simple exponential response. In three time constants th e response has reached 90% of its final value, but the rise to the 99% point ta kes nearly 20 time constants.

Influence of Material: The penetration time constant is directly proportional to the permeability of the material, inversely proportional to the resistivity of the material and directly proportional to the square of the material’s thickness. The rela tive permeability of structural materials used in airplane is always very near ly unity, but thickness and resistivity can vary over wide ranges.

Typical diffusion time constants for aluminum are about 40 μs per millimeter of skin thickness. This means that it would require 120 μs for a squa re wave current entering the exterior surface of

an aluminum box to diffuse to the same current density throughout the aluminum skin. Thus a lightning stroke current reaching peak in 6 μs and decaying to 50 % in 69 μs can not reach equilibrium throughout the skin thickness. The curre nt density on the interior of the skin reaches only a small percentage of that on the exterior surface, as shown by the analyses of Section 2.3.

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 38

Because of this, the skin voltage potentials available to drive currents into internal structural elements such as stringers and ribs are very smal l and so the currents in those elements are small.



### 2.5 Investigative Lightning Test of Cracked Structure and Fastener

Hardware

2.5.1 Test Configuration

Tests were conducted on aluminum shear ties fasten ed with groups of four fasteners to aluminum panels representing fuel tank skin s. Test currents were conduc ted from the skin panel to the shear tie, as shown in Figure 2.42. Test article vari ants included:

 Al panel and Al shear tie

 CFRP panel and Al shear tie

 Interference and clearance f it fastener installations

Figure 2.42 - General Test Arrangement fo r Fastener-Related Failure Conditions;

Test Current was Conducted from Skin Panel to Shear Tie

Figure 2.43 shows examples of failure conditi ons included on the shear tie specimens. Conducted Lightning
Current Path

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 39

Cracked Collar

Missing Collar

Crack at Hole Edge in Shear Tie

Crack in Shear Tie

Figure 2.43 - Examples of Failure C onditions at Shear Tie Fasteners

The matrix of specimens tested is shown in Table 2.5. The test results are listed in Table 2.6.

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 40

Table 2.5 – Fastened Joints and Failure Conditions

Fractured Bolt

Cracked Collar

Fully Cracked Shear Tie

Crack at Hole Edge in ST Al Panel/Interference Fit

Cracks with Fay Surface Bond

Fractured Bolt Al Panel/Clearance Fit
Cracked Collar

Fractured Bolt

Fully Racked Shear Tie CFRP Panel/Interference Fit

Crack at Hole Edge in ST

CFRP Panel/Clearance Fit Fractured Bolt



### 2.5.2 Test Results

Table 2.6 - Test Results for Shear Ti e Fasteners with Failure Conditions

Test Specimen Tested Failure Condition Range of Conducted

Test Currents that Produced Sparks

Fractured Bolt ~20 – 40 kA

Cracked Collar ~15 – 20 kA

Fully Cracked Shear Tie ~70 – 80 kA

Crack at Hole Edge in Shear Tie ~85 kA Al Panel/Interference Fit

Cracks with Fay Surface Bond 100 kA

Fractured Bolt ~20 kA
Al Panel/Clearance Fit

Cracked Collar ~5kA

Fractured Bolt ~50 - 60 kA

Fully Racked Shear Tie ~60 – 70 kA CFRP Panel/Interference Fit

Crack at Hole Edge in Shear Tie ~25 - 30 kA

CFRP Panel/Clearance Fit Fr actured Bolt ~2 – 10 kA

Discussion about rib shear ties and fa steners with crack failure conditions:

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 41

•

400mm d
70mm  Cracks in aluminum fuel tank structures that comprise a complete enclosure such as a wing box are not likely to produce arcs or sparks due to lightning currents.

 Fully cracked shear ties and cracks at hol es may spark under high shear tie current

conditions of 50 kA – an unrealistic condition for an all-aluminum tank.

 Cracked fasteners or nuts sparked at th e lowest test current applied (5 kA).

 Expect wide variability of test results for these kinds of tests. Therefore certification test levels should be set higher than expected actual shear tie curr ents by a margin of at least

2.1.

 The range of computed shear tie currents due to direct strikes to one of the shear tie

fasteners in Section 2.3 is in the hundreds of amperes and therefore not expected to reach the lowest spark threshold of Table 2.7 for a cracked collar in aluminum structure, clearance fit (5 kA).



### 2.6 Investigation of Voltages acro ss Cracks in Aluminum Panels

These tests were carried out in support of understanding whether the sparks observed in cracked panels described in Section 2.3 are actually spar ks (also known as voltage sparks) or arcs (also known as thermal sparks). The objects of this di scussion are cracks in stringers in aluminum fuel

tanks.

The intent of the tests was to determine the volta ge that might be expected to appear across a crack in a fuel tank stringer when the stringer carries lightning currents. This was achieved by measuring the voltage drop across a hack saw slot cut in an aluminum strip.

The results of the tests are then related to:

1. The expected threat currents on aluminum st ringers inside aluminum fuel tanks to determine expected voltages stressing the crack.

2. The consequences of the expected voltages in relation to those voltages necessary to create an arc (~300 V), and to sustain an arc on aluminum (14 V).

Test Set-up and Results: The aluminum strips were 70 mm wi de, with narrow slots cut in with a hacksaw to depths of 20 mm and 40 mm. The vo ltage was measured within 2 mm of the slot end, an extra wire was installed as a background measurement. The strips and general test arrangement are shown in Figures 2.44 and 2.45.

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 42

Figure 2.44 - Aluminum Strip Test Speci men and General Test Arrangement

Figure 2.45 - Example Slot Voltage (Red Trace), Background Voltage (Blue Trace) and Injected Current (Black Trace)

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 43

0 50 100 150 200 250 300

Slot: 40mm Deep -

Plates: 70mm

Seperation Slot: 20mm Deep -

Plates: 70mm

Seperation Slot: 40mm Deep -

Plates: 2mm Seperation Slot: 20mm Deep -

Plates: 2mm SeperationVoltage difference across the slot [mV] Test Set-up: Injected current was typically 170 A with a time to peak of 10 μs and a peak rate of rise of approximately 50 A/μs. For each slot depth sample, two configurations of return path were tested; one with a 2 mm separation of the stri p from the return plate to simulate a crack in that part of a stringer parallel and close to the wing skin; one w ith the return strip 70 mm away to simulate a crack away from the skin. Results of the four test configur ations are summarized in Figure 2.46. In all cases, the voltage given is the peak waveform 2 (WF2) voltage value.

Figure 2.46 - Summary of Results (P eak Waveform 2 Voltage) for the 4 Different Test Configurations

Discussion of Crack Voltage Test Results: Tests reported in 2003 recorded measured currents on components inside aluminum fuel tanks. [28 ] In these tests the wavesh apes inside the aluminum tanks were very slow, typically 100 us to peak. The highest measured value was 920 A, for the case of a Component A attachment over a stringer, in which stringer to fuel pipe current (via a bond strap) was measured at 920 A. Other currents were similarly slow, but much lower. It is possible to imagine stringer currents locally of greater than this, but having a similar slow waveshape that would not produce higher voltages at cracks.

If there were to be a 5 kA current of 100 μs pea k, this would result in a di/dt of only ~150 A/μs. Extrapolating from our test results on the slots, this would generate a voltage of ~750 mV across a 40 mm crack in a 70 mm wide stringer.

Bearing in mind that >300 V is needed to form a spark or >14 V to mainta in an arc once formed, there appears to be no risk of an arc initiated by a voltage spark at a crack.

Other tests have shown that metallic stringers in composite would be subject to much higher currents, with relatively fast rise times, and the so cracks would present a significant hazard. Whether cracked metallic stringers are a potential structural fault in comp osite skinned tanks is being addressed separately in the Lightning ARC report.

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 44



## 3.0 Conclusions

The tests reported in Section 2.1 of this Appendix have shown that no sparks occurred when the local current density where a fatigue crack exists at the edge of a panel was 6.0e4 A/m (60,000 A/m) (Fig. 2.11) . This current density at the edge of a panel is av ailable when 6,000 A of lightning current are conducte d through a single structural pa nel that is 6 inches wide (Fig. 2.7)

The local current density necessary to produ ce an arc at the fatigue crack is 1.75e5 (175,000 A/M) when 20 kA was conducted through the 6 inch wide structural element with a fatigue crack that has grown from an edge of this panel (Fig 2.7).

From these crack test results it is concluded th at the ignition source thre shold of fatigue cracks originating at the edge of a fuel tank structur al element exposed to fuel vapor is somewhere between 60,000 A/m and 175,000 A/m (this is equivalent to between 6,000 A and 20,000 A through a 6 inch wide structural pa nel). No currents of this larg e magnitude have been measured

on structural elements within an aluminum fuel tank.

For cracks originating at a hole away from the edge of a structural element, there was only one case of a very faint spark. This spark is believed to correspond to a curren t density similar to that at the center of the Al plate in Fig. 2.8b which is 6.2E5 A/m x (50 kA/200 kA) = 1.5e5 A/m (150,000 A/m) when 50 kA Component A was conduc ted through the 6 inch wide panel. The current density to cause an arc at a fatigue crack at the edge or at the center of a panel is

therefore about the same. With id entical total currents in a panel, it is more likely that an arc would appear at an edge crack than at a crack away from an edge because the local current density is higher at an edge th an at the center of a panel.

Current Density Analysis reported in Section 2.3 of this Appendix showed that, for all-metal tanks, the lightning current densities at the inte rior surfaces of fuel tank skins and other tank

boundaries are much lower than the current densiti es in the exterior su rfaces of these same elements. This is due to the long times requi red for electric currents to diffuse through the

thicknesses of metal conductors. Th is phenomenon is commonly known as skin effect.

Calculated maximum internal current densitie s of a wing section “Unit Cell” were 2.9e4 A/m (29,000 A/m) (Figure 2.30) and 1.5e3 (1,500 A/m) (Fig. 2.34) at 100 kA peak. These maximum values appeared at the edge of a rib and the upper surface of the skin splice joint stringer flange, respectively. These current densiti es exist only in the immediate vicinity (i.e. within one fastener spacing or at a rib directly beneath and fastened to the struck fastener) of a fastener that has been directly struck in Zone 2A. They are significantl y lower than the currents that produced arcs at

the crack tests of Section 2.1.

Other internal current densities within the tank were much lower, such as several tens of A/m, especially for the much more likely ‘wing tip strike’ cases, where the lightning current is conducted through a wing, between a struck wing tip and an exit location elsewhere on the airplane.

### LIGHTNING ARC FINAL REPO RT APPENDIX E - PAGE 

### 45

The aluminum wing section whose internal curren t density computations are reported in this Appendix is typical in size of an average wing box chord and depth, and of the wing tip area of a large transport airplane.

Lightning Tests of Cracked Structure and Fa stener Hardware Reported in Section 2.5 of this appendix showed that in most situ ations 10’s of kiloamperes of lightning currents were required to produce ignition sources at fail ure conditions in broken bolts, coll ars and shear ties. The data

is summarized in the table below. These currents are higher than the currents computed for these elements within the wing

Test Results for Shear Tie Fasteners with Failure Conditions (Table 2.6)

Test Specimen Tested Failure Condition Range of Conducted

Test Currents that Produced Sparks

Fractured Bolt ~20 – 40 kA

Cracked Collar ~15 – 20 kA

Fully Cracked Shear Tie ~70 – 80 kA

Crack at Hole Edge in Shear Tie ~85 kA Al Panel/Interference Fit

Cracks with Fay Surface Bond 100 kA

Fractured Bolt ~20 kA
Al Panel/Clearance Fit

Cracked Collar ~5kA

Fractured Bolt ~50 - 60 kA

Fully Racked Shear Tie ~60 – 70 kA CFRP Panel/Interference Fit

Crack at Hole Edge in Shear Tie ~25 - 30 kA

CFRP Panel/Clearance Fit Fr actured Bolt ~2 – 10 kA

The large difference between ignition source thresholds determined by te st and the computed actual current densities in a typical aluminum tank structure indicates that lightning is not likely to produce ignition sources at fati gue cracks, broken bolts, or colla rs within a metal fuel tank.

The tests of fastener installati ons in CFRP panels indicate that lower currents may produce ignition sources. This is because a higher percenta ge of currents entering external fasteners flow through these fasteners to the interior structural elements.