Large Airplane Fuel System 

Lightning Protection 

Rulemaking Recommendations 

May 2011 

Federal Aviation Administration 

Large Airplane Fuel System 

Lightning Protection 

Aviation Rulemaking Committee 
ii 

Cover photo courtesy of University of Florida International Center for Lightning 

Research and Testing 
LIGHTNING ARC FINAL REPORT PAGE iii 

TABLE OF CONTENTS

TABLE OF CONTENTS............................................................................................................. iii

TABLE OF CONTENTS..............................................................................................................iv

FOREWORD..................................................................................................................................1

EXECUTIVE SUMMARY............................................................................................................2

1.0 INTRODUCTION ...............................................................................................................5

1.1 Lightning ARC Tasks..........................................................................................................7

1.2 Task Group Organization...................................................................................................8

2.0 BACKGROUND..................................................................................................................9

2.1 Lightning Effects on Airplanes...........................................................................................9

2.2 Lightning-Related Accidents..............................................................................................9

2.3 Fuel Systems Lightning Protection Regulations, Policy and Advisory Material.........10

3.0 TASK EVALUATION ......................................................................................................13

3.1 Task 1..................................................................................................................................13

3.1.1 Evaluation of the Issue...............................................................................................13

3.1.2 Findings.......................................................................................................................14

3.2 Task 2..................................................................................................................................15

3.2.1 Evaluation of the Issue...............................................................................................15

3.2.2 Findings.......................................................................................................................22

3.3 Tasks 3, 4 and 5..................................................................................................................23

3.3.1 Evaluation of the Issue...............................................................................................24

3.3.2 Findings.......................................................................................................................42

3.4 Task 6..................................................................................................................................44

3.4.1 Evaluation of the Issue...............................................................................................44

3.4.2 Findings.......................................................................................................................48

3.5 Task 7..................................................................................................................................50

3.5.1 Evaluation of the Issue...............................................................................................50

3.5.2 Findings.......................................................................................................................56

3.6 Task 8..................................................................................................................................58

3.6.1 Evaluation of the Issue...............................................................................................58

3.6.2 Findings.......................................................................................................................60

3.7 Task 9..................................................................................................................................62

3.7.1 Evaluation of the Issue...............................................................................................62

3.7.2 Findings.......................................................................................................................64

4.0 DISCUSSION OF FINDINGS..........................................................................................65

5.0 RECOMMENDATIONS ..................................................................................................69

6.0 REFERENCES ..................................................................................................................73 
LIGHTNING ARC FINAL REPORT PAGE iv 

 TABLE OF CONTENTS - CONTINUED

LIGHTNING ARC MEMBERSHIP .................................................................Appendix A 

LIGHTNING ARC CHARTER......................................................................... Appendix B 

ACRONYMS AND ABBREVIATIONS.......................................................... Appendix C 

STRUCTURES WORKING GROUP REPORT...............................................Appendix D 

CRACKS AND FASTENER CURRENT DISTRIBUTION STUDY.............. Appendix E 
LIGHTNING ARC FINAL REPORT PAGE 1 

FOREWORD 

All proposals and discussions contained in this Final Report have been reviewed and 

unanimously accepted by the members of the Large Airplane Fuel System Lightning 

Protection Aviation Rulemaking Committee (Lightning ARC) as accurate and 

comprehensive representation of the committee deliberations that occurred from August 

2009, to May 2011. 
LIGHTNING ARC FINAL REPORT PAGE 2 

EXECUTIVE SUMMARY 

The Federal Aviation Administration (FAA) chartered the Large Airplane Fuel System 

Lightning Aviation Rulemaking Committee (Lightning ARC) to re-examine Title 14, 

Code of Federal Regulations (14CFR) sections 25.954 and 25.981 to address the 

impracticality of complying with § 25.981 at Amendments 25-102[5] and 25-125[6] for 

fuel tank lightning protection. 

The Lightning ARC included industry members that are the leading aircraft lightning 

protection design experts in the world, along with the leading regulatory experts working 

in the lightning area. The Lightning ARC charter identified nine committee tasks. To 

complete those tasks, the Lightning ARC held ten face-to-face meetings, one fullcommittee web-based meeting, and over 30 international teleconferences. In between 

meetings, detailed technical evaluations were developed by Lightning ARC members to 

complete the Lightning ARC Charter tasks and prepare this report. In addition, a 

subcommittee made up of airplane manufacturer structural experts was established by the 

Lightning ARC to address structure-specific issues, such as the occurrence of cracks and 

fastener failures. The Lightning ARC also commissioned a specific study of lightning 

current distribution at structural cracks and fasteners, including the evaluation of 

lightning-related sparks at these cracks and fasteners. The results of the special studies 

are presented in appendices. The Lightning ARC findings and recommendations are 

included in this report. 

Lightning ARC recommendations based upon its findings are: 

1. Prevention of fuel vapor ignition due to lightning should be the objective of the 

regulations, achieved through both flammability control and ignition source 

prevention. Existing Part 25 regulations provide adequate flammability 

requirements. Thus, lightning-specific requirements should focus on ignition 

source prevention. 

2. Both structure and systems should be addressed in the same fuel system lightning 

protection rule with the same requirements. 

3. A prescriptive approach requiring single fault tolerant designs should be 

mandatory. If fault tolerance is impractical, a qualitative assessment, such as the 

Lightning Hazard Assessment recommended in SAE ARP5577[12], should be 

conducted to ensure that the combination of non-fault-tolerant failures resulting in 

an ignition source is remote. 

4. Manufacturing variability, aging, wear, corrosion and likely damage should be 

addressed by design, manufacturing processes and/or by instructions for 

continued airworthiness (ICA). 

5. Caution information for critical lightning protection features should be 

incorporated into instructions for continued airworthiness to minimize accidental 

or likely damage to these features during performance of maintenance, alteration 

or repairs. 
LIGHTNING ARC FINAL REPORT PAGE 3 

6. Inspections and procedures required for non-fault-tolerant designs should be 

included in the Airworthiness Limitations section of the instructions for continued 

airworthiness, whereas fault tolerant designs should utilize tasks developed by the 

MRB or a sampling program where appropriate. 

7. Changes should be made to Air Transport Association (ATA) Maintenance 

Steering Group (MSG) document MSG-3[20] to support instructions for continued 

airworthiness for fuel tank lightning protection. Addition of a new section 

specific to fuel tank lightning protection is recommended. 

8. No requirement for lower flammability should be included in the lightning 

regulations. 

9. New guidance material should be developed and existing guidance material 

should be revised to ensure a consistent approach to fuel system lightning 

protection is applied across industry. 

Proposed Rulemaking 

The Lightning ARC recommends §§ 25.954, 25.981 and Appendix H be revised to read 

as follows: 

§ 25.954 Fuel system lightning protection. 

(a) The fuel system must be designed and installed to prevent catastrophic fuel 

vapor ignition due to lightning. 

(b) The fuel system lightning protection design must be fault-tolerant for failures 

that result in lightning-related ignition sources. 

(c) Fault tolerance is not required for any specific design feature if: 

(1) providing fault tolerance is shown to be impractical for that feature, 

and 

(2) the failures that lead to lightning-related ignition sources from that 

feature and all other non-fault-tolerant features, when combined, are 

shown to be remote. 

(d) Inspections or other procedures must be established as required by Sec. 

25.1529 to prevent development of lightning-related ignition sources within the 

fuel tank system pursuant to paragraphs (b)(c) of this section. Caution 

information for critical lightning protection features shall be incorporated into 

instructions for continued airworthiness required by Sec. 25.1529 to minimize 

accidental or likely damage to these features during performance of maintenance, 

alteration or repairs. Required inspections and procedures for non-fault-tolerant 

features in paragraph (c) of this section must be included in the Airworthiness 

Limitations section of the instructions for continued airworthiness required by 

Sec. 25.1529. 
LIGHTNING ARC FINAL REPORT PAGE 4 

§ 25.981 Fuel Tank Ignition Prevention 

(a) No ignition source may be present at each point in the fuel tank or fuel tank 

system where catastrophic failure could occur due to ignition of fuel or vapors. 

This must be shown by: 

(3) Except for ignition sources due to lightning subject to Sec. 25.954, 

demonstrating that an ignition source could not result from each single 

failure, from each single failure in combination with each latent failure 

condition not shown to be extremely remote, and from all combinations of 

failures not shown to be extremely improbable. The effects of 

manufacturing variability, aging, wear, corrosion, and likely damage must 

be considered. 

§ H25.x Fuel System Lightning Protection Instructions for Continued 

Airworthiness 

(a) The applicant must prepare Instructions for Continued Airworthiness (ICA) 

applicable to fuel system lightning protection including the following: 

(1) Mandatory maintenance or inspections necessary to preclude the 

development of unsafe conditions due to non-fault tolerant lightning 

protection features shall be identified as Airworthiness Limitations and 

approved by the Administrator. 

(2) Sampling programs, maintenance and/or inspections for fault tolerant 

lightning protection features, included in the manufacturer’s recommended 

airplane maintenance program and acceptable to the Administrator. 

(3) Caution information which identifies the lightning protection features 

of the fuel system design, to minimize the potential for inadvertent 

damage or disruption of lightning protection features, included in the 

applicable airplane maintenance documents and acceptable to the 

Administrator. 

The Lightning ARC also recommends that the preamble for the rule should clarify that 

fuel system lightning protection be excluded from rules of general applicability such as 

§§ 25.901 and 25.1309. 

Required interpretation and intent for the § 25.954 rule is provided in the 

Recommendations section of this report. 
LIGHTNING ARC FINAL REPORT PAGE 5 

1.0 INTRODUCTION

Prior to Amendment 25-102[5] to Title 14, Code of Federal Regulations (14CFR) section 

25.981, the lightning protection requirements for fuel tanks were contained in § 25.954 of 

that same Title. Section 25.954 applied to system components as well as airplane 

structure. That regulation required prevention of ignition of vapors in the fuel tank, but it 

did not take into account anticipated design failures due to manufacturing variability, 

aging, wear, corrosion and likely damage. 

In May 2001 FAA issued Amendment 25-102[5]. This amendment added specific 

ignition prevention requirements and a new flammability minimization requirement to 

§ 25.981. The amendment contained specific ignition prevention requirements in 

§ 25.981(a)(3) that included consideration of factors that might cause ignition sources in 

fuel tanks. The factors requiring consideration included manufacturing variability, aging, 

wear, corrosion and likely damage, as well as evaluation of single failures and 

combinations of failures, including latent failures. These requirements applied to fuel 

tank systems and fuel tank structure. 

Systems with potentially catastrophic failure modes would typically meet the 

requirements of § 25.981(a)(3) when they provided at least triple-redundancy in their 

protective features, or dual-redundancy with continuous system monitoring to reduce the 

latency period. Dual-redundant designs could only comply with § 25.981(a)(3) when 

combined with either regular inspections at very short intervals or with a monitoring 

device to verify the functionality of the protective features. Inspection of the various 

design features might be difficult or impossible if the feature is covered by airframe 

structure. 

To prevent all sources of ignition in a fuel tank, the design had to be fail-safe so that a 

hidden or latent failure when combined with another failure would not cause an ignition 

source. An acceptable design must provide a third protective design feature. Applicants 

have argued that adding a third independent lightning protection feature or providing 

sufficient monitoring to detect latent failures in a dual-redundant protection feature are 

both impractical for certain areas of airplane wing structure, such as airplane skins, joints, 

ribs, spars, stringers, and associated fasteners, brackets, and coatings. Incorporating three 

independent protection features to control structural ignition is not technically possible 

for some designs or is too expensive to produce and maintain using currently available 

technology. 

It is impractical to continuously monitor or inspect the protection features. These 

protection features are typically integral to the fuel tank structure or inside the fuel tanks. 

Inspection of design features inside fuel tanks requires access to the fuel tanks, which is 

usually only scheduled once or twice during the life of the airplane. Increasing the 

frequency of internal fuel tank inspections could increase the possibility of damaging the 

lightning protection features during the inspection process. Because of these issues, FAA 

developed policy related to exemptions and special conditions for § 25.981(a)(3). 
LIGHTNING ARC FINAL REPORT PAGE 6 

FAA decided it is appropriate to re-examine §§ 25.954 and 25.981 to address these and 

other issues that have surfaced during application of the requirements of Amendment 25-

102[5] to fuel tank lightning protection design. The FAA’s intent is to establish a 

balanced approach to ensure that airplane designs provide an acceptable level of safety, 

while allowing manufacturers to use economically viable design, manufacture, and 

operation. The new standards should require the applicant to develop structural 

component designs that are as free of ignition sources as practical. In addition, the 

applicant must consider fuel vapor flammability in developing a design with an 

acceptable level of safety. 

FAA chartered the Aviation Rulemaking Committee (Lightning ARC) with members that 

include airplane lightning protection design specialists and aviation airworthiness 

authorities that represent diverse viewpoints. FAA participation and support came from 

all affected lines-of-business. The Lightning ARC was directed to set up specialized 

work groups, where necessary, that include at least one Lightning ARC member plus 

invited subject matter experts from industry and government. 

The Lightning ARC sponsor was the FAA Transport Airplane Directorate Manager. 

The names of Lightning ARC members, observers and contributors are listed in 

Appendix A. 
LIGHTNING ARC FINAL REPORT PAGE 7 

1.1 Lightning ARC Tasks 

The Lightning ARC charter (Appendix B) included the following tasks: 

1. Determining whether the approach to fuel tank safety related to lightning 

protection should be focused on fuel vapor ignition, ignition sources, or a 

combination of both. 

2. Determining whether the lightning protection regulation changes should apply to 

the complete fuel system, or just to the fuel tank structure. 

3. Determining what type of safety assessment approach should be used (e.g.; SAE 

Document ARP5577[12] or § 25.1309). Define content and procedures of the 

safety assessment. 

4. Determining whether a probabilistic approach, prescriptive pass/fail criteria, or a 

combination of both using qualitative analysis, should be applied to structure or 

the complete fuel system lightning protection. If a probabilistic approach is used, 

determine if flammability exposure should be considered. Determine how single 

failures should be addressed. Determine what types of single failures are 

impractical to preclude. Finally, determine what probabilistic distribution of 

lightning amplitudes would be acceptable as an industry standard. 

5. Establishing which components and installations must be addressed and which 

failure modes (including possibility of cascading failures) should be considered. 

Determine if all foreseeable, likely, or a specific set of failures should be 

addressed in determining adequate structural lightning protection. If a 

probabilistic approach is used, determine the criteria that should apply for the 

standard. Identify acceptable data to support the safety analysis (e.g., supporting 

failure rates). 

6. Determining a means to address manufacturing variability, age, wear, corrosion, 

and likely damage to lightning protection features. 

7. Determining criteria associated with instructions for continued airworthiness and 

any needed modifications to processes defined in Revision 3 to the Maintenance 

Steering Group (MSG-3) document. 

8. Considering the effect of reducing the flammability below the criteria of 

§ 25.981(b), Amendment 25-125, in adjusting the other tasks listed above. 

9. Identifying compliance guidance that might be required to facilitate showing 

compliance with the recommendations above. 
LIGHTNING ARC FINAL REPORT PAGE 8 

1.2 Task Group Organization 

In order to accomplish the tasking defined in its Charter, the Lightning ARC was divided 

into major task groups, with each group organized around similar subject matter tasks. 

The Task Groups are the following: 

TASK GROUP 1: 

Andy Plumer, Co-Chair 

Rod Graham, Co-Chair 

Regulatory Scope for Fuel System Lightning Protection. Task Group 1 

addressed tasks 1, 2, 8 and 9 from the Lightning ARC Charter. This task group 

was primarily focused on the overall general application and intent of the current 

rule and how it might be revised to accomplish the overall safety of the airplane 

fuel system without driving complexity to the point where the requirements for 

the design become impractical. In addition, the Task Group was assigned the 

work of defining the compliance guidance that needs to be developed or revised 

to support the revision to the regulatory requirements. 

TASK GROUP 2: 

Dale Winter, Co-Chair 

Dave Walen, Co-Chair 

Safety Assessment for the Fuel System Lightning Protection. Task Group 2 

addressed tasks 3, 4, and 5 from the Lightning ARC Charter. This Task Group 

was primarily focused on the overall approach to safety assessment and 

application of the compliance requirements in terms of either a probabilistic or a 

prescriptive approach. 

TASK GROUP 3: 

Peter Bootsma, Co-Chair 

Helio Librantz, Co-Chair 

Manufacturing and Continued Airworthiness Considerations. Task Group 3 

addressed tasks 6 and 7 from the Lightning ARC Charter. This Task Group was 

primarily focused on the overall approach of how to address manufacturing, aging 

and continued airworthiness in regard to the protection used for fuel system and 

structure with respect to the lightning threat. 

The Task Groups gathered background information, reviewed relevant history and 

developed sections for a first draft of the Lightning ARC Report. Once that was 

accomplished, all further report development, review, and approval were accomplished 

by the entire Lightning ARC. 
LIGHTNING ARC FINAL REPORT PAGE 9 

2.0 BACKGROUND 

2.1 Lightning Effects on Airplanes 

Lightning strikes to airplanes occur regularly; on an order of once per year for a 

commercial transport, particularly to airplanes operating in instrument meteorological 

conditions. When lightning strikes an airplane, high transient current is conducted in the 

airplane structure. The transient current can melt, burn, and deform airplane parts and 

structure where the lightning attaches to the airplane. The high lightning current is also 

conducted through airplane structure between the lightning attachment points on the 

airplane. The conducted lightning transient current can also induce voltage and current 

on airplane wiring, tubes and control mechanisms. Melting, burning, arcing, or sparking 

due to conducted lightning current or voltage can result in fuel vapor ignition if they 

occur in a flammable environment. 

Methods for preventing ignition sources due to lightning strikes are mature and are based 

on years of research into natural lightning characteristics and effects upon airplane 

structures and systems. The results have been documented in a wide body of literature 

and formalized into standards such as SAE documents ARP5412[16], ARP5414[21] and 

ARP5416[22]. Use of these standards has been accepted by FAA through Advisory 

Circulars AC 20-53B[3] and AC 20-155[23]. Much of the supporting research has been 

published by the International Conference on Lightning and Static Electricity (ICOLSE), 

National Aeronautics and Space Administration (NASA), the European Organization on 

Commercial Aircraft Equipment (EUROCAE), and in other industry forums. A high 

degree of communication among airplane lightning specialists worldwide assures that 

designers and certification authorities are continually informed of advances in lightning 

protection technology and application of this technology to new designs. 

2.2 Lightning-Related Accidents

On June 26, 1959, a Lockheed L-1649A Constellation was struck by lightning and 

experienced explosions in two of its fuel tanks, resulting in a crash. This airplane was 

fueled with aviation gasoline. Prior to the time of this accident there had been research 

conducted into the possible effects of lightning on airplane fuel tanks but the scope of this 

had been limited to integral fuel tank skin melt-through and hot-spot formation. 

Fuel vapor ignition due to lightning was the probable cause for the Boeing 707 accident 

that occurred near Elkton, Maryland on December 8, 1963.[1] At the time of its 

certification, the 707 was not required to demonstrate effective lightning protection for 

fuel systems. Following the 707 accident, substantial research was performed to 

determine the factors that could result in lightning-related fuel ignition. However, most 

of this research focused on lightning burn-through for metal fuel tank structure, and 

lightning-related fuel vapor ignition for fuel vents. 

On December 23, 1971, a Lockheed L-188A Electra suffered a lightning strike which led 

to a fire and separation of the right wing. Since the L-188A was certified by FAA in 

1958 the type did not benefit from the additional attention given to airplane fuel tanks 
LIGHTNING ARC FINAL REPORT PAGE 10 

after 14CFR 25.954 was published in 1967. The fuel type on board could not be 

determined by the Lightning ARC. 

On May 9, 1976, a Boeing 747 crashed following a lightning strike to the airplane.[2] The 

investigation for this accident presented evidence that fuel vapor ignition could have been 

caused by lightning-induced sparking at a motor-driven fuel valve. 

In three of the four accidents noted above, investigations found that the airplane fuel 

tanks contained either aviation gasoline or a mixture of Jet A kerosene-type fuels and 

higher volatility Jet B/JP-4 fuels. The fuel type involved in the 1971 Electra accident was 

not identified. The investigations for the other three accidents determined that the fuel 

mixtures would be flammable at the temperatures and altitudes that the airplanes were 

flying in at the time of the lightning strikes. During the 1980s the use of Jet B/JP-4 fuels 

began to decline, becoming nearly obsolete in the 1990s. 

Since the last lightning-related airplane fuel tank explosion, the understanding of 

lightning effects on airplane fuel tanks and systems has increased significantly, and no 

further events have occurred even though the number of flight hours since the 1976 

accident (approximately 1-billion flight hours) is more than eight times that which 

preceded that event (less than 120 million flight hours). 

2.3 Fuel Systems Lightning Protection Regulations, Policy and 

Advisory Material 

Following the Boeing 707 Elkton[1] accident, FAA adopted new fuel system lightning 

protection regulations. These regulations were implemented for transport category 

airplanes in § 25.954, Fuel system lightning protection. 

§ 25.954 states: 

The fuel system must be designed and arranged to prevent the ignition of 

fuel vapor within the system by – 

(a) Direct lightning strikes to areas having a high probability of 

stroke attachment; 

(b) Swept lightning strokes to areas where swept strokes are highly 

probable; and 

(c) Corona and streamering at fuel vent outlets. 

This regulation explicitly requires lightning protection regardless of the likelihood that 

lightning would strike the airplane. This regulation is prescriptive in requiring effective 

protection, and there is no acknowledgement that the lightning protection features could 

fail or become ineffective. There is no requirement for fault-tolerant fuel system 

lightning protection or for any evaluation of probabilities of failures related to the 

lightning protection. 

Following the 1976 Madrid Boeing 747[2] accident, further guidance for airplane fuel 

system lightning protection was developed. Specifically, FAA revised Advisory Circular 

AC 20-53, Protection of Airplane Fuel Systems Against Fuel Vapor Ignition Due to 
LIGHTNING ARC FINAL REPORT PAGE 11 

Lightning,

[3] along with its corresponding User’s Manual[4]. The Advisory Circular has 

been revised twice since its original issue. These documents added emphasis for 

lightning protection of fuel system components such as fuel tubes, fuel quantity systems, 

and fuel filler caps. 

There have been no transport airplane accidents related to fuel vapor ignition caused by 

lightning since 1976. Transport airplanes designed and certified today meet § 25.954, 

following the guidance in AC 20-53[3]. 

On July 17, 1996, a Boeing 747 operating as TWA Flight 800 was involved in an inflight breakup after takeoff. The ensuing investigation determined that the center wing 

fuel tank exploded due to an unknown ignition source. Following the Flight 800 

accident, FAA adopted Amendment 25-102[5] which revised § 25.981, Fuel tank ignition 

prevention. This amendment incorporated § 25.981(a)(3) requiring that the fuel tank 

ignition source prevention design must address failures within the fuel system. 

§ 25.981(a)(3) states: 

“(a) No ignition source may be present at each point in the fuel tank or 

fuel tank system where catastrophic failure could occur due to ignition of 

fuel or vapors. This must be shown by: ... (3) Demonstrating that an 

ignition source could not result from each single failure, from each single 

failure in combination with each latent failure condition not shown to be 

extremely remote, and from all combinations of failures not shown to be 

extremely improbable. The effects of manufacturing variability, aging, 

wear, corrosion, and likely damage must be considered.” 

While lightning was not listed as a probable cause of the Flight 800 accident, potential 

ignition sources due to lightning must be considered as part of compliance with this 

regulation, as lightning was mentioned in the rulemaking preamble and the associated 

Advisory Circular AC 25.981-1C[27]. This regulation effectively requires lightning 

protection that is fault tolerant to two independent failure conditions. This is because 

failures of lightning protection features could remain latent for a long time between 

inspections. Typically these latent failure conditions could not be shown to be extremely 

remote. 

When Amendment 25-102[5] was adopted, FAA did not consider it practical to set 

specific limits for fuel tank flammability. The amendment adopted regulation 

§ 25.981(c) that required minimizing the flammability of airplane fuel tanks. This 

regulation did not specifically require fuel tank inerting, nor did the regulation state 

specific fuel tank flammability limits. When amendment 25-102[5] was adopted, FAA 

stated in the preamble: 

“The FAA does not concur that mandating fuel tank inerting technology 

has been shown to be feasible at this time. This was discussed in detail in 

the preamble to the notice. We are continuing to evaluate further safety 

improvements, and are conducting research and development to 
LIGHTNING ARC FINAL REPORT PAGE 12 

investigate the feasibility of incorporating nitrogen inerting on both inservice and new type design airplanes. As noted previously in this 

preamble, we tasked the ARAC on July 14, 2000 (65 FR 43800), to 

evaluate both on-board and ground-based fuel tank inerting systems. If 

further improvement is found to be practicable, we may consider initiating 

further rulemaking to address such improvements.” 

However, following the implementation of Amendment 25-102[5], active fuel tank 

flammability reduction systems were developed and installed that could practically limit 

fuel tank flammability. Subsequently, FAA adopted Amendment 25-125[6], which set 

specific limits for fuel tank flammability. This Amendment modified § 25.981(b) to set 

specific limits for fuel tank flammability, expressed in terms of the fleet average 

flammability exposure. 

Following the adoption of Amendment 25-102[5], several applicants found that it was 

impractical to achieve dual fault tolerance for fuel tank structure lightning protection.[7] [8] 

[9] [24] [25] [26] FAA agreed with the applicants that applying § 25.981(a)(3) for fuel tank 

structure may be impractical. As a result, FAA issued a policy memorandum to 

standardize the process for granting exemptions and issuing special conditions for fuel 

tank structure lightning protection. FAA Policy Memorandum ANM-112-08-002[10]

defined requirements that would be applied through special conditions or exemptions. 

These requirements included both prescriptive requirements and requirements based on 

likelihood of occurrence. 
LIGHTNING ARC FINAL REPORT PAGE 13 

3.0 TASK EVALUATION 

3.1 Task 1 

Determine whether the approach to fuel tank safety related to lightning protection 

should be focused on fuel vapor ignition, ignition sources, or a combination of both. 

3.1.1 Evaluation of the Issue 

The Lightning ARC considered several options during its evaluation of the top level 

requirement for fuel tank lightning protection. After some discussion, it was realized that 

the three options listed in the Charter for Task 1 (fuel vapor ignition, ignition sources, or 

a combination of both) are actually two options because fuel vapor ignition is already the 

combination of ignition sources and flammability. 

The options we considered were: 

Option 1: Retaining the current ignition-source-only focused philosophy of 14 CFR 

25.981(a), or; 

Option 2: Focusing on the prevention of fuel tank vapor ignition as has been the 

§ 25.954 requirement which takes into consideration both ignition source 

prevention and fuel tank ullage flammability. 

Consideration of further reduction in fuel tank flammability beyond the present 

requirements of § 25.981 Amendment 25-125[6] will be discussed in Task 8. 

Ignition Source Prevention 

The prevention of all potential ignition sources in fuel tanks due to lightning is an ideal 

requirement and the goal of all lightning protection designs. Airplane manufacturers 

have demonstrated, and FAA has concurred, that in certain areas of the fuel tank it is 

impractical to provide a design that can demonstrate compliance to § 25.981(a)(3), let 

alone eliminate all ignition source possibilities, especially when considering the potential 

for latent failures and human error. 

From the FAA Policy Memorandum ANM-112-08-002[10] Page 6: 

”...the FAA has now determined that application of § 25.981(a)(3) to fuel 

tank structural lightning protection can be impractical for certain areas of 

structural design, and is therefore inappropriate for design features where 

the applicant shows compliance is impractical.” 

In practice, the presence of a potential ignition source alone does not directly result in a 

fuel tank explosion, as a flammable environment must also be present. Therefore, 

complete elimination of potential ignition sources is not necessary to ensure a safe 

design. 
LIGHTNING ARC FINAL REPORT PAGE 14 

Fuel Vapor Ignition Prevention (combination of ignition and flammability protection) 

Preventing fuel vapor ignition has been the over-arching requirement in § 25.954 for over 

forty years. The § 25.954 requirements and event history are provided in Section 2 of 

this report. The designs certified to § 25.954 requirements have demonstrated 

outstanding safety. A contributor to the safety record is the almost complete elimination 

of the use of high-flammability wide-cut fuels. 

Fuel vapor ignition prevention can be achieved by limiting or eliminating flammability 

exposure, or eliminating ignition sources. As noted above, eliminating absolutely all 

ignition sources is impractical. Similarly, eliminating all flammability exposure with 

current fuels and technology is also impractical. An effective approach would use 

practical means to limit both the likelihood of ignition sources and flammability to 

prevent fuel vapor ignition. A combination of flammability and ignition control was used 

in FAA Policy Memorandum ANM-112-08-002[10] and the FAA charter for this 

Lightning ARC states that the “applicant must consider fuel vapor flammability in 

developing a design with an acceptable level of safety.” 

Fuel tank flammability exposure was studied by the 1998 Fuel Tank Harmonization 

Working Group following the TWA Flight 800 accident. The resulting Aviation 

Rulemaking Advisory Committee (ARAC) report recommended limiting flammability 

exposure to levels that typically occur in unheated wing tanks fueled with Jet A type 

fuels. FAA incorporated that recommendation via Amendments 25-102[5] and 25-125[6], 

which now prescriptively limit flammability exposure to less than 3%, or equivalent to a 

conventional, unheated, aluminum wing tank, and provide specific means for assessing 

flammability exposure. Other protection means to address flammability, such as those 

allowed in § 25.981(c) to mitigate the effects of vapor ignition, are also considered 

sufficient for limiting flammability to prevent fuel vapor ignition. 

3.1.2 Findings 

The Lightning ARC found that the top requirement should be to prevent fuel vapor 

ignition and that this could be achieved by an effective combination of flammability 

reduction and ignition source prevention. Given that § 25.981(b) amendment 25-125[6]

already directly controls the flammability aspects, the Lightning ARC found that 

establishing requirements for fuel tank lightning protection could address ignition sources 

only while still considering the top event as fuel vapor ignition. The Lightning ARC 

found that this combination of protection means can provide an acceptable level of fuel 

tank lightning protection, and assure that no lightning-related fuel vapor ignition would 

be expected to occur. 
LIGHTNING ARC FINAL REPORT PAGE 15 

3.2 Task 2 

Determine whether the lightning protection regulation changes should apply to the 

complete fuel system, or just to the fuel tank structure. 

Note: The term fuel system is often used to refer to all of the airplane features 

related to fuel storage (i.e. tank structure), fuel plumbing, fuel related mechanical 

components (e.g. pumps and valves) and electrical wiring associated with fuel, 

such as wiring to components, and the fuel quantity indication system (FQIS). In 

the context of this section and many places elsewhere in the document, the word 

systems (often highlighted in Italic font), refers to the non-structural part of the 

fuel system, such as plumbing, components, FQIS, and electrical wiring. 

3.2.1 Evaluation of the Issue 

3.2.1.1 Background

The Lightning ARC reviewed the background material discussed in Section 2 that is 

relevant to consideration of any revisions to existing regulations and policy applicable to 

lightning protection of fuel tank structures and systems. 

The Policy Memorandum ANM-112-08-002[10] applies only to tank structure, not 

systems. In the comments to the draft Policy Memorandum, industry recommended the 

Policy also apply to fuel systems lightning protection. FAA did not incorporate this 

recommendation, partly based upon the concern that maintenance to systems presented a 

significant additional risk. Further, FAA stated that applicants had shown compliance of 

fuel systems lightning protection to § 25.981(a)(3), thus demonstrating that compliance 

was practical. In response to the industry comment, FAA stated: 

“In developing the proposed policy, the FAA determined that relief from 

the requirement of § 25.981(a)(3) was warranted for areas where it was 

shown to be impractical to meet that regulation, and where it could be 

shown that an acceptable level of safety would be provided by meeting a 

different standard. The FAA agrees that, from an electrical bonding 

standpoint, there is not a clear line between structural elements and 

systems elements, and many of the same design challenges exist for both 

structural bonding and the bonding of systems elements. The extension of 

the proposed relief to systems elements and systems supporting structure 

was carefully considered. One of the significant factors that led the FAA 

to arrive at the proposed scope for the alternative standard was the 

expected level of maintenance (disassembly and reassembly) for these 

design areas. Disassembly and reassembly of electrical bonding elements 

is considered to present a significant additional risk that a bond will be 

compromised during the life of an airplane, which generally does not exist 

for structure that is intended to be permanent.” 

The Lightning ARC reviewed the technical aspects of lightning interactions with fuel 

tank structure and fuel systems, and the techniques that are available for protection. The 

Lightning ARC found that similar protection techniques are used for systems and tank 
LIGHTNING ARC FINAL REPORT PAGE 16 

structures. The lightning protection design techniques include electrical bonding, 

insulation and isolation, arc containment, and current diversion. 

The Lightning ARC reviewed the history of activities related to systems lightning 

protection compliance to § 25.981, the majority of which are projects from our Lightning 

ARC members companies. There are few projects that have demonstrated lightning 

protection compliance of fuel tank systems with § 25.981(a)(3) using the rigorous 

systems-level assessment that the current FAA interpretation of § 25.981(a)(3) requires. 

While some designs have achieved compliance, or anticipate agreement on compliance in 

the near term, many of the features incorporated to achieve dual fault tolerance add 

complexity and are not needed to provide a safe design in which events would be 

extremely improbable. The Lightning ARC questions the benefit of introducing the 

complexities needed to demonstrate dual fault tolerance for lightning threats relative to 

overall fuel tank safety. 

3.2.1.2 Options 

In our evaluation of whether the lightning protection regulation changes should apply to 

the complete fuel system, or just to the fuel tank structure, two options were considered. 

Option 1: Changes should address the tank structure alone. 

Option 2: Changes should address the tank structure and the fuel systems. 

During our consideration of these options the following relevant factors, each discussed 

beneath a bold headline, became evident: 

The lightning environment and effects are similar for both systems and structures. 

Lightning currents that enter internal system components and structural elements are 

driven by the same mechanisms. These include: 

 Direct lightning attachment to structure or system components located in areas of 

likely attachment. 

 Lightning currents conducted into exterior and interior structural elements such as 

tank skins, stiffeners, spars, ribs, fuel pipes and system components. 

 Transient voltages and currents induced into structure, plumbing and electrical 

wiring within the fuel tanks for equipment such as fuel probes, fuel pumps, and 

fuel valves.

When an airplane is struck by lightning it becomes part of the lightning current path. The 

lightning current typically attaches at one location on the airplane, such as a wing tip, and 

flows through the structure to an attachment location on another extremity of the airplane. 

If one of the initial lightning channel attachment locations is at a forward extremity such 

as the nose or an engine nacelle, the airplane flies through the lightning channel which reattaches to other locations aft of the initial attachment location. Lightning doesn’t 
LIGHTNING ARC FINAL REPORT PAGE 17 

differentiate between systems and structures; it only sees conductive paths, loops, 

resistances and installations. 

For more information on the interaction of aircraft and lightning, including fuel tanks and 

systems, see Section 3 of SAE ARP5416[22] or the handbook Lightning Protection of 

Aircraft [11]. 

Lightning protection means for mechanical systems and structure are similar.

Airplane lightning protection is achieved by understanding the behavior of lightning 

currents throughout the airplane, and addressing each of the effects of these currents with 

robust protection designs. For fuel tank structures and systems, protection design begins 

with making the airframe as inherently safe as possible by selecting appropriate materials 

and assembly methods, and adding dedicated protection features where necessary. These 

protection features include electrical bonding to enable safe conduction of current, 

isolation of hazardous current paths, and provision of barriers between potential ignition 

sources and fuel vapors. The same approaches used for lightning protection of a fuel 

pump installation are used for preventing ignition sources at fuel tank skin, rib and spar 

joints. Designs are based on industry standards that define the airplane lightning 

environments, and adequacy of protection is verified by a combination of analysis and 

tests done in accordance to industry standards. These standards are referenced by FAA 

advisory circulars and are under constant review by SAE Committee AE-2 and 

EUROCAE Working Group 31 with participation by FAA and other airworthiness 

authorities. 

When a system component is expected to be removed for inspection or replacement, the 

design features have to ensure that the protection effectiveness is preserved in the 

replaced component. To effectively achieve this, the design must be simple to remove 

and reinstall as well as be tolerant to installation errors. 

Failure modes of lightning protection for systems and structure are similar. 

Because the lightning protection methods and many of the features for systems and 

structure that implement the lightning protection are similar, the failure modes which 

could lead to potential ignition sources will also be similar. Failures can result from 

aging, wear, corrosion, manufacturing defects, and maintenance errors. Such failures and 

the lightning current densities or voltage potential differences sufficient to produce 

ignition sources may appear in both systems and structures. 

Analysis and test tools that are utilized to quantify lightning effects and verify 

designs are similar. 

The tools used to determine the magnitudes of lightning currents in fuel tank structural 

elements are fundamentally the same as those tools used to determine the lightning 

voltages and currents in systems and installations. The physics are the same whether the 

objective is managing current in internal tank structural elements or voltage induced in 

FQIS wiring. Commonly used tools such as finite difference time domain codes have 

been employed to compute fuel tank fastener and structural element currents, as well as 

voltages appearing across insulated fuel pipe sections and between fuel probes and 
LIGHTNING ARC FINAL REPORT PAGE 18 

adjacent tank structure. Also, the same lightning test equipment and standards that are 

used to look for ignition sources within fuel tank structural components are used for 

testing fuel system installations. The standard for these tests is SAE ARP5416[22], which 

defines similar methods for both structural and system ignition source evaluations. 

Lightning laboratories and their engineers and technicians perform lightning tests on both 

systems and structures. 

The ability to provide additional layers of protection for systems is not a justification 

for requiring their implementation. 

The additional layers may have no commensurate safety benefit, yet their complexity can 

lead to additional failure modes. In the disposition of comments to the Policy 

Memorandum ANM-112-08-002[10], FAA stated that applicants had shown compliance of 

fuel systems lightning protection to § 25.981(a)(3), thus demonstrating that compliance 

was practical. The Lightning ARC reviewed this position and concluded that the ability 

to implement more complex designs does not mean it is practical from the perspective of 

achieving a commensurate benefit. In fact, a more complex design will usually have 

additional failure modes or increased risk of errors that can reduce overall safety, rather 

than enhance safety. A different requirement for systems than for structure, based solely 

on the availability of technology to implement additional layers of protection, is not 

appropriate justification for a different standard. 

One example of a more complex, but potentially less safe system installations is where 

three parallel stand-off clamps are used to provide dual fault-tolerant insulated support 

for a fuel pipe. While achieving a requirement for three independent, effective and 

reliable supports for the fuel pipe, the probability of insulation failure due to breakage, 

contamination or material defect has been increased by a factor of three. It may be better 

to consider one or two mechanically robust clamps with plenty of insulation instead of 

three smaller clamps. 

Fuel pipe isolators may be used to prevent lightning currents from flowing in the pipes 

and couplings. One such isolator with sufficient capability is better than two or three 

such isolators in series which might be utilized to meet a dual fault tolerant requirement 

but provide no more lightning protection than a single isolator. There may also be 

common-cause failures that could defeat all of the isolators such that dual fault tolerance 

is not really achieved by adding additional isolators. The additional components may 

even introduce new ignition source risks For example, if bond straps used to ground the 

resulting intermediate conductive pipe couplings become loose or are omitted during 

maintenance, a potential ignition source due to static discharges might result. Further, 

additional plumbing joints within a fuel system increase the potential for fuel leaks which 

can lead to engine fuel feed problems. 

In another example, multiple parallel bond straps may be installed across a pipe coupling 

to achieve a dual-redundant electrical bonding path. Additional bond straps increase the 

possibilities of strap and associated clamp failures, which, depending upon the design, 

might lead to arcing during a lightning strike. Parallel bond straps can create unwanted 

induced current loops, resulting in the straps and clamps becoming potential ignition 
LIGHTNING ARC FINAL REPORT PAGE 19 

sources, themselves requiring dual fault tolerant designs. There is also the possibility of 

multiple bond straps making inadvertent contact with each other, resulting in an electrical 

arc source. While the design intent would have been to ensure that an original threat is 

precluded, additional potential failure modes leading to potential ignition sources are 

introduced. A robust design that achieves the desired level of safety without these 

additional complexities is superior. 

The addition of designs with multiple layers of protection in small spaces may result in 

less robust individual designs. Examples are small volume spaces such as fuel collector 

or sump tanks where there are many components in close proximity to each other. The 

need to fit additional features in a tight space may introduce unexpected hazards. This is 

especially true for smaller Part 25 airplanes, such as business jets, but is true for areas in 

large transport airplanes as well. 

Multiple redundant features increase the potential for installation and inspection 

errors, both in the factory and during maintenance. 

A significant factor in the omission of systems from Policy Memorandum ANM-112-08-

002[10] was the distinction between those components or elements which are expected to 

remain in place for the life of the airplane versus those which are expected to be removed 

and reinstalled. Although maintenance activity can increase the likelihood that a 

disturbed lightning protection feature is rendered ineffective, the risk of ineffective 

lightning protection can be greater with multiple redundant lightning features on 

removable components because all features must be disconnected and reconnected in 

order to replace the component. An example is a fuel pipe that is electrically bonded 

using multiple redundant bond straps in order to comply with the requirement. This 

means that the installer and inspector would have up to three separate opportunities for 

making a mistake, resulting in multiple potential installation configurations which are 

incorrect and less safe for every one correct combination. This situation is not the result 

of an inadequate design, but the inevitable consequence of additional redundancy in the 

context of a common mode factor such as lightning, which affects every protection 

feature simultaneously. 

In contrast, a single robust lightning protection feature has only one opportunity for 

improper installation, and the probability of a mistake can be readily reduced by proper 

maintenance and inspection procedures. This approach results in equivalent effective 

lightning protection while dramatically reducing the potential for erroneous installations. 

The existing regulation § 25.954 and associated AC 20-53B[3] address both 

structural and systems lightning protection with common requirements and 

guidance. 

Section 25.954, Fuel System Lightning Protection, has been used to demonstrate 

compliance for both systems and structural lightning protection since 1967. The history 

of lightning protection for airplanes certified to these requirements has been excellent 

(one event noted in Section 2). While the 1967 wording for the subparts to the rule do 

not emphasize systems, the associated advisory material AC 20-53B[3] includes the need 
LIGHTNING ARC FINAL REPORT PAGE 20 

to assess lightning effects on both systems and structure. For example, AC 20-53B[3]

states the following regarding systems: 

“2. SCOPE

b. We address ignition hazards caused by direct effects on main and 

auxiliary fuel tanks, fuel tank components and plumbing, and the 

indirect effects (upset or damage) on analog or digital electronic and 

electrical systems that could lead to ignition hazards on wires or 

equipment such as fuel quantity probes located in a fuel tank cavity 

containing fuel vapor.” 

“5. LIGHTNING EFFECTS ON FUEL SYSTEMS 

c. All or some of the lightning current may be conducted through fuel 

tanks or fuel system components. It is important to determine where 

the current flows through the aircraft to allow for adequate design 

measures to protect the fuel system.” 

“6. FUEL SYSTEM LIGHTNING PROTECTION 

b. When designing the fuel system lightning protection, consider the 

following factors: 

(6) Lightning currents flowing in the internal components of the 

fuel system (such as fuel and vent lines, conduits, or internal 

structural parts) may produce electrical sparks and ignite 

flammable vapors. 

(7) Lightning currents flowing in the airframe produce voltage 

differences between adjacent parts or structure. The lightning 

electromagnetic fields can induce transient voltage and current in 

the electrical wiring and components of the fuel system.” 

Using the same design standard for both structure and systems is more likely to 

ensure all elements are considered. 

If both systems and structure are considered together beginning with the initial design on 

through lightning effects assessment, protection design and verification there will be less 

likelihood that some potential ignition sources are overlooked. A coordinated approach 

to structure and systems avoids the possibility of conflicting protection designs, such as 

isolation and electrical bonding at a system/structure interface. 

Addressing structure and systems avoids the need to establish an artificial 

boundary. 

Questions about differentiating which design features comprise part of the system and 

which comprise the tank structure would continue if an artificial boundary is utilized. An 

example is a permanent vent stringer installation with associated removable plumbing for 

climb ports, which combines a structural function (wing strength) with a system function 

(venting). The demonstration of compliance is unnecessarily complex because of 

different requirements. Avoiding the artificial boundary would provide a clear and 

simplified compliance path that avoids duplication or omissions. 
LIGHTNING ARC FINAL REPORT PAGE 21 

Another example of the problem with different requirements for system and structure can 

be shown with a pump installation. The FAA Policy Memorandum ANM-112-08-002[10] 

accepts that certain pump housings are installed for the life of the airplane, and, hence, 

considered part of the structure. However, one portion of the lightning protection may be 

pump wire shielding via a shield that grounds the wiring connector shell to the pump 

housing. Clearly the wiring connector is removable and thus would be categorized as 

systems, but does this mean the housing is now a part of systems because the housing is a 

part of the system ground? To keep systems and structure separate, a design might tend to 

use a separate pigtail wire for the shield. This is a less effective shield termination design 

than one using the connector backshell for shield grounding, resulting in a less robust 

design than might be necessary to keep the pump housing from being considered a part of 

systems. 

Fuel Quantity Indicating Systems (FQIS) 

In the discussions about whether systems and structures should have a common set of 

requirements, FQIS was a major topic of systems discussion. The Lightning ARC review 

determined that, unlike the lightning protection certified under the existing § 25.954 

requirement which did not require fault tolerance for either structures and systems, 

redundant protection from power-induced ignition sources affecting FQIS has been the 

design standard for decades. FQIS are designed to be intrinsically safe by assuring that 

system power is limited to less than that required for ignition in both normal operating 

and failure conditions. In addition, physical probe separation from structure within the 

fuel tank made this system dual fault tolerant for internal system electrical power faults. 

But many early FQIS designs did not include even fault tolerant designs for lightning 

protection. Basic lightning protection was provided by probe gaps and separation from 

structure, with no wire bundle electromagnetic shielding. Hundreds of millions of safe 

operating hours have been achieved with these designs. The adoption of § 25.981 

Amendment 25-102[5], which requires the assumption of latent failure conditions being 

present unless extremely remote, as well as considerations of other faults such as external 

electrical shorts, has generally led to a need for FQIS changes to achieve compliance for 

both electrical power faults and lightning. The question is whether this FQIS systems

precedent justifies that a difference in systems and structures requirements is necessary 

for lightning protection. 

The Lightning ARC found that the same justifications for a common requirement for 

system and structure also apply to FQIS. All of the factors noted above apply to the 

FQIS, the other fuel systems, and fuel tank structure. There is no need for different 

lightning protection requirements for fuel systems, including FQIS, and fuel tank 

structure. Applying a revised standard for lightning protection to FQIS will not negate 

the need to provide dual fault tolerant protection necessary to achieve compliance to 

§ 25.981(a)(3) for non-lightning threats. The other aspects of the fuel system safety 

assessment for FQIS will still be subject to the requirements of § 25.981(a)(3). 
LIGHTNING ARC FINAL REPORT PAGE 22 

3.2.2 Findings 

The Lightning ARC determined that changes in the regulations should address both fuel 

tanks structure and systems with a common standard. 

The findings are based upon the following summary of Section 3.2.1.2: 

 The lightning environment, interaction mechanisms and effects assessment 

methods are the same for structures and systems. 

 It is difficult, subjective and unnecessary to create an artificial delineation 

between systems and structure with respect to lightning protection. 

 Historic lightning protection requirements in § 25.954 and guidance material have 

utilized a common standard for structure and systems. 

 The availability of means to implement additional layers of protection for systems

is not justification for a different requirement than structure. The additional 

design complexity that would result from additional layers of protection will have 

no commensurate safety benefit and may introduce unforeseen negative safety 

consequences, including design, installation and maintenance errors. 
LIGHTNING ARC FINAL REPORT PAGE 23 

3.3 Tasks 3, 4 and 5 

Evaluation of Safety Assessment Approaches 

Tasks 3, 4, and 5 in the Lightning ARC Charter require evaluation of fuel tank lightning 

protection safety assessment approaches and the kinds of failures or other conditions that 

must be part of the assessment. The task statements are listed below. 

Task 3 - Determine what type of safety assessment approach should be used (e.g.; 

SAE Document ARP5577[12] or § 25.1309). Define content and procedures of the 

safety assessment. 

Task 4 - Determine whether a probabilistic approach, prescriptive pass/fail criteria, 

or a combination of both using qualitative analysis, should be applied to structure 

or the complete fuel system lightning protection. If a probabilistic approach is used, 

determine if flammability exposure should be considered. Determine how single 

failures should be addressed. Determine what types of single failures are 

impractical to preclude. Finally, determine what probabilistic distribution of 

lightning amplitudes would be acceptable as an industry standard. 

Task 5 - Establish which components and installations must be addressed and which 

failure modes (including possibility of cascading failures) should be considered. 

Determine if all foreseeable, likely, or a specific set of failures should be addressed 

in determining adequate structural lightning protection. If a probabilistic approach 

is used, determine the criteria that should apply for the standard. Identify 

acceptable data to support the safety analysis (e.g., supporting failure rates). 

These three tasks are interrelated, so are discussed together in this section. The 

fundamental question to address as part of Tasks 3, 4 and 5 is the method of safety 

assessment that should be applied to fuel system lightning protection. Two basic safety 

assessment approaches have been identified for consideration as part of Task 3 – a hazard 

assessment, similar to that described in ARP5577[12], and a risk assessment, similar to 

that described in AC 25.1309-1A[13]. 

The focus of a hazard assessment is to ensure that the protection design can effectively 

mitigate the hazards that may result when the airplane is struck by lightning. Since 

lightning protection is not the primary focus of the basic airplane design, this assessment 

technique works well for identifying where specific lightning protection features must be 

added to the basic design to mitigate potential lightning hazards. This hazard assessment 

would typically be done early in the design phase to ensure that adequate lightning 

protection is incorporated. Tests or analysis are then typically conducted to confirm that 

the required lightning protection is effective in eliminating the hazards. 

On the other hand, the focus of a risk assessment is to evaluate the design functionality, 

including effects of potential failure conditions, and show that the residual risk of an 

undesirable event is mitigated to an acceptable risk level. For example, where there is 

potential for a catastrophic effect, the likelihood of that event must be shown to be 

extremely improbable. This risk assessment approach has been used for evaluating 
LIGHTNING ARC FINAL REPORT PAGE 24 

complex systems architectures, which are part of the basic design of the airplane, to 

ensure that functionality is maintained to appropriate levels when component failures 

occur. 

3.3.1 Evaluation of the Issue 

The existing regulations that apply to fuel system lightning protection, § 25.954 and 

§ 25.981(a), currently drive different approaches for assuring adequate lightning 

protection design. The requirements of § 25.954 have driven the fuel system lightning 

design for the vast majority of Part 25 airplanes flying today. For § 25.954, the focus is 

strictly on demonstrating effectiveness of the lightning protection design - it does not 

require consideration of failure conditions that may compromise that effectiveness. This 

approach has resulted in an outstanding safety record in the fact that there has been no 

lightning-caused ignition of fuel tank vapors since 1976, as noted in Section 2. The 

Amendment 25-102[5] requirements of § 25.981(a) have only been in place since 2001, 

with very limited certification activity, so the industry experience is mostly associated 

with implementing the requirements in the design and demonstrating compliance. These 

requirements drive a rigorous assessment of failure conditions and combinations of 

failure conditions, but have been found to result in designs that are, at best, complex and 

challenging and, at worst, impractical to implement. FAA has acknowledged the 

impracticality of complying with this rule for fuel tank structural lightning protection in 

the FAA Policy Memorandum ANM-112-08-002[10]. As requested in the Lightning ARC 

charter, these rules will be re-examined in conjunction with addressing the system safety 

assessment tasks with a focus on achieving a balanced approach between an acceptable 

level of safety and economic viability in design, manufacture and operation. 

Airplane Fuel System Lightning Hazard Considerations 

The rulemaking projects that resulted in Amendments 25-102[5] and 25-125[6] were 

intended to prevent catastrophic fuel vapor ignition. For lightning to cause catastrophic 

fuel vapor ignition, the following conditions must exist: 

1. Lightning must strike the airplane; and 

2. The fuel tank ullage (air space in fuel tank) must be flammable; and 

3. The lightning amplitude and energy must exceed the severe definition used for the 

airplane protection design; or 

4. The lightning protection must have failed. 

These conditions must exist when considering lightning-related fuel vapor ignition for 

both fuel tank structure or fuel systems. 

First: Lightning strikes to airplanes are common in an airplane fleet, but not frequent for 

any single airplane. Certain atmospheric conditions lead to higher likelihood of airplane 

lightning strikes. For example, airplane lightning strikes are most common when the 

airplane is operating in clouds with precipitation and the atmospheric temperature is near 

freezing. Airplanes fly through these conditions frequently, but lightning strikes occur on 

only a small number of airplanes in these conditions. 
LIGHTNING ARC FINAL REPORT PAGE 25 

Second: Fuel tank ullage in transport airplanes operating with typical fuel types (Jet A or 

similar) is not often flammable. Amendment 25-102[5] added regulations to minimize 

fuel flammability, and the subsequent Amendment 25-125[6] added quantitative fuel tank 

flammability requirements for new transport airplane designs. The requirements in 

Amendment 25-125[6] set limits to the percentage of time that the airplane fuel tanks can 

contain flammable vapors, based on the flammability performance of conventional 

unheated aluminum wing fuel tanks. These flammability requirements significantly 

reduce the likelihood of fuel vapor ignition, independent of the lightning protection 

elements. 

The lightning-related accidents on the Boeing 707 and 747 described in Section 2 had 

fuel tanks that contained highly volatile JP-4 type fuels. High-volatility fuels such as JP4 are not generally available and are not allowed on most transport category airplanes 

certified since the early 1990s. High-volatility fuels are unlikely to be approved for use 

for airplanes that must demonstrate compliance to Amendment 25-125[6]. FAA is 

currently pursuing Airplane Flight Manual (AFM) limitations to preclude use of highvolatility fuel types unless no other fuel is available. 

The likelihood of lightning strikes to an airplane is independent from and unlikely to 

coincide with flammable fuel tanks operating with Jet A type fuels. Fuel tank 

flammability is dependent on the temperature of the fuel. Fuel tanks that are exposed to 

warm days (air temperature of greater than 80°F at takeoff) have higher likelihood of 

having a flammable ullage. However, lightning strikes to airplanes occur when the 

outside air temperature or atmospheric temperature is near freezing. While airplane 

lightning strikes occur at a range of temperatures around freezing, there is no correlation 

between airplane lightning strikes and higher atmospheric temperatures. Figure 3.3-1 

was developed from a review of a set of pilot reported lightning strike reports and 

illustrates this point. Figure 3.3-2 uses the same pilot reports but makes a comparison to 

the ground temperature at the airport nearest to where the lightning strike was reported, 

which shows the independence of lightning strikes relative to warm days on the ground. 

Review of other published data[14] [15] also supports this conclusion. 
LIGHTNING ARC FINAL REPORT PAGE 26 

Figure 3.3-1 Static Air Temperature at Time of Airplane Lightning Strike

Figure 3.3-2 Air Temperature at Closest Airport at Time of Airplane Lightning Strike
LIGHTNING ARC FINAL REPORT PAGE 27 

Third: The characteristics of lightning vary widely from one lightning flash to another, 

so that the range of lightning energy, current amplitude, duration, number of current 

pulses, and timing of the pulses vary widely. However, these characteristics are 

independent of the airplane that is struck by lightning. When lightning strikes an 

airplane, the airplane does not change the characteristics of lightning. 

Because of the widely-varying characteristics of lightning and the difficulty and 

complexity associated with measuring actual lightning characteristics, it is impractical for 

individual airplane lightning protection engineers to develop their own definition of 

lightning characteristics. Industry, regulatory, and military aircraft lightning specialists 

collaborated to consider the variability associated with lightning and airplane lightning 

strikes. The specialists, meeting in working groups such as the SAE AE-2 Lightning 

Committee, defined lightning environments that could be used to demonstrate effective 

airplane lightning protection. [15] 

The aircraft lightning protection specialists, both from industry and governments, agreed 

to define specific, severe airplane lightning environments. The defined lightning 

environment reflects relatively rare conditions for peak current amplitude, energy, and 

flash duration. While the likelihood of the severe airplane lightning environment is not 

specifically defined, the lightning standards consider it to represent on the order of the 

highest one percentile lightning flash characteristics. 

These three factors – widely-varying characteristics of lightning, frequency of airplane 

lightning strikes, and fuel tank flammability exposure – are all independent and are not 

directly related to the airplane fuel tank structure and fuel system design. But all three 

contribute to the overall lightning-related fuel system safety record for modern transport 

airplanes; which under previous design requirements did not incorporate fault-tolerant 

fuel tank lightning protection. 

Fuel System Lightning Protection Design Elements 

Fuel system lightning protection design must address the airplane fuel tank structure and 

all equipment, wiring, components and parts that are exposed to fuel or fuel vapor under 

normal conditions. The structure and equipment include the fuel tank skins, spars and 

ribs, hydraulic lines which are routed inside tanks, fuel system lines, fuel pumps, fuel 

valves, fuel quantity indicating parts and systems, in-tank wiring, fuel temperature 

probes, fuel caps, and vents. The lightning protection design must also address fuel lines 

which may contain fuel vapor and are installed outside the fuel tank. Areas of the 

airplane that may be exposed to fuel or flammable vapor due to leaks or other failures are 

not considered part of the fuel system, since fuel vapor would be present in such areas 

only following a failure of the fuel boundary sealing. Examples are areas adjacent to fuel 

tanks, space between walls of twin-wall pipes, and equipment adjacent to the tanks. 

Protection for flammable leakage zones is addressed by § 25.863. 

Fuel tank structure and systems lightning protection design elements include structural 

materials, fasteners, skin thickness, primer, paint, sealant coatings, electrical bonding 

straps, fuel and hydraulic tube fittings, wire bundle shields, transient suppression devices, 
LIGHTNING ARC FINAL REPORT PAGE 28 

etc. Many of these lightning protection design elements serve also as system or structural 

elements, and lightning protection is not their sole function. 

This situation where the lightning protection design elements serve as system or 

structural elements leads to designs that are generally reliable. Environmental 

qualification and structural integrity tests typically determine if the protection design 

elements are reliable over the expected operating conditions for the airplane. If reliable 

lightning protection designs are implemented for fuel tank structure and systems, then 

these designs should achieve the intent of ensuring that failure of lightning protection 

elements will occur infrequently during the operational life of each airplane. 

Lightning Protection Element Failures 

The Lightning ARC reviewed prior data on fuel tank failures to assess the in-service 

reliability of lightning protection features. Those reviews are summarized below. 

The first set of data reviewed were 220 airworthiness directives (AD) related to airplane 

fuel tank ignition sources issued following Special Federal Aviation Regulation (SFAR) 

88 assessments. This review found there were no cases where structural fasteners or 

sealant were the cause of the AD. Therefore, those failure conditions were either not 

found or were not determined to be a lightning hazard if any were present. 

A second set of data reviewed was the Aircraft Fuel System Safety Program (AFSSP) 

report[17]. This report, which documented the results of a voluntary industry inspection 

program, gathered information about the overall integrity of the fuel system design and 

maintenance of the in-service airplane fleet. Over 100,000 labor-hours were expended 

performing airplane fuel system inspections of the world fleet. Inspections were 

completed on 990 airplanes operated by 160 air carriers in diverse operating 

environments on six continents. 

Various criteria for inspections were used but all included elements for inspecting tank 

structure, sealant, components and transport elements. Overall, the fuel tanks inspected 

were generally found to be in good to excellent condition unless subject to initial 

manufacturing error or subsequent modification or damage. There were a few isolated 

reports of sealant missing or separating from structure and some isolated foreign object 

debris, but these were classified as insignificant in the report. Beyond this, the majority 

of findings related to degradation were associated with chafed wiring, missing or broken 

bonding jumpers, component electrical bond resistance above installation specification 

maximum value requirements and access doors with minor corrosion or seal issues. The 

few areas that were thought to potentially affect airworthiness out of these inspections 

were addressed as they were found or through follow-on actions. 

Failure modes that have been considered for lightning protection under § 25.981(a) and 

the related exemptions include those that may reasonably be expected to occur as a result 

of intended operational and environmental conditions or those that may be expected to 

occur as a result of a manufacturing quality escape. Possible cascading effects from any 

failure mode have also been considered in addition to the direct consequences of the 
LIGHTNING ARC FINAL REPORT PAGE 29 

failure. Assessments considering these failure modes have shown lightning protection 

features to be reliable. 

Structural Failures Study 

A team of structural specialists from transport category airplane manufacturers and FAA 

were asked by the Lightning ARC to evaluate the potential for structural failures that 

could degrade the fuel tank lightning protection. The specialists considered the current 

Part 25 structural design regulations, the airplane structural design methods and 

processes, and in-service fuel tank structure failures to assess the risks related to 

structural failures that could degrade the fuel tank lightning protection. Of particular 

interest was also understanding the risks involved with increasing use of composite 

structures, where limited service experience exists. 

The airplane structural specialists reported that structural integrity for transport airplanes 

is established by complying with discrete requirements. The design of safe structures is 

based on approaches such as fail-safe, primary/secondary path, and safe-life designs. In 

all these cases, a reliance on a robust design and inspection program is part of the 

compliance demonstration. Probabilistic failure analysis is not used. This is due in part 

to the difficulty in assessing the variability in design, manufacturing methods, and 

operational environment which, in the structural specialists’ opinion, makes a 

probabilistic approach unreliable and unsuited for structural failure evaluation. This 

approach has led to successful airframe designs in transport airplanes, including the 

prevention of fuel vapor ignition due to lightning. Instead of analyzing the probability of 

failure, the current structure design regulations and airplane manufacturer design 

guidelines minimize the occurrence of structural failures. 

Robust fuel tank structure that results from these design approaches and guidelines will 

retain its functionality, structural integrity and dimensional stability throughout the 

airplane service life. This will be the case regardless of whether the basic airframe 

materials are primarily aluminum, composite or some other material. The robust fuel 

tank structure will also help to ensure that lightning protection features inherent within 

the fuel tank structure will be reliable. A given design can be engineered to provide 

significant safeguards against identified sources of potential structural degradation. 

The structural specialists noted that compliance with existing structural regulations 

results in robust fuel tank design, where structural failures have been minimized. This is 

supported by in-service reports of structural failures from airplane operators. 

There are continuing improvements in structural design processes and analyses, material 

selection and processing, manufacturing, and inspection methods. This results in a more 

robust fuel tank structure with respect to cracks, broken fasteners, corrosion and wear for 

airplanes designed and certified today compared to existing airplane designs. Although 

manufacturing escapes and engineering errors still occur, the test and inspection methods 

are effective at detecting these early in the airplane life cycle. Composite structures are 

less likely to have structural cracks than aluminum structure, which is one of the driving 

forces behind the expanded use of composite structures in new designs. 
LIGHTNING ARC FINAL REPORT PAGE 30 

The existing prescriptive approach for the evaluation of structure is appropriate because it 

mitigates the chance of structural failure and incorporates analysis and material 

improvements as they evolve. 

The structural specialists’ findings stressed that it is not appropriate to use probabilistic 

analysis methods to demonstrate that a structural failure that could cause an ignition 

source is extremely remote. Probabilistic analysis methods are inconsistent with 

structural design methods, and the large scale of testing to provide numerical data to 

support the probabilistic analysis adds no value to the evaluation of structure. 

Another factor that reduces the risk associated with structural failures are mandated 

inspections. The continued airworthiness instructions as required by 14 CFR Part 25 

result in detecting degradation to maintain the integrity of the airplane structures. The 

structural airworthiness limitations and routine inspection tasks detect occurrence of 

cracks prior to reaching a length critical to affecting structural integrity. The interval for 

each inspection task takes into account the possibility of not detecting the deficiencies in 

the initial inspections. The inspection intervals are developed in order to ensure that if a 

crack occurs, it would not reach a critical length even if not detected during initial 

inspections. 

A fatigue test program representing multiple lives of the airplane with a representative 

flight mission is performed as an integral part of the basic type certification. This fatigue 

test program investigates the behavior of the structures and detects structural degradation 

in advance of similar service experience. The rigor imposed by the industry and the 

authorities ensure that once a critical structural failure is found in a fatigue test, design 

solutions are introduced for production airplanes as well as development of repairs for the 

in-service airplane regardless of whether such a failure is found in service. Interim 

measures such as routine inspections are imposed until the terminating design action is 

implemented. 

The structural specialists concluded that existing structural regulations drive processes, 

tests and analyses that will ensure a high level of robustness is inherent in the design, 

which should also minimize risk of failures that affect lightning protection. This 

conclusion applies whether or not the structure is primarily made from metal or 

composite materials. More detail is provided in the structural specialists report in 

Appendix D. 

Service Reports for Structural Failures 

Certification applicants that have addressed compliance with § 25.981(a), special 

conditions, or exemptions related to fuel tank structure lightning protection have 

identified specific failure conditions where fault tolerance may not be practical. Two 

conditions identified are: 1) cracked or broken fuel tank structure, where the crack could 

be a potential ignition source if subjected to lightning, and 2) broken structural fasteners, 

where the broken fastener could possibly compromise or defeat remaining lightning 

protection features such as sealant. 
LIGHTNING ARC FINAL REPORT PAGE 31 

To better understand these failure conditions, the Lightning ARC requested information 

from the airplane manufacturers represented on the Lightning ARC to determine how 

frequently these conditions occur on the existing airplane fleet. The structural specialists 

validated this information. 

Each airplane manufacturer represented on the committee provided data to the Lightning 

ARC. The information collected represents the reported structural cracking conditions 

associated with fuel tanks of both small and large transport class airplanes. A summary 

of the data is provided in Table 3.3-3. As shown, some structural cracks do occur in the 

fuel tanks. However, fuel tank cracks are only a subset of cracks associated with wings 

overall – many cracks associated with the wing are associated with leading and trailing 

edges. These cracks have generally been attributed to design or manufacturing errors, 

non-conformity of parts, accidental damage, or deterioration due to unexpected 

environmental or operational conditions. 
LIGHTNING ARC FINAL REPORT PAGE 32 

Table 3.3-3 Airplane Manufacturer Report Structural Cracks 

Model Flight Hours

Accumulated 

Flight Cycles Fleet Size

Structural 

Cracks - 

Wing Fuel 

Tanks

Structural 

Cracks - 

Non-Wing 

Fuel Tanks

Unique 

Conditions*

Potential 

Lightning 

Ignition 

Source**

1 32,000,000 16,000,000 821 174 3 23 3

2 90,000,000 50,000,000 4485 56 - 15 2

3 31,000,000 6,000,000 1118 443 5 19 1

4 488,578 419,639 362 1 - 1 1

5 4,930,941 4,794,160 1336 4 - 4 0

6 6,329,989 4,752,138 745 1 - 1 0

7 2,494,180 1,935,291 325 1 - 1 1

8 40,129,904 6,286,294 694 14 34 11 0

9 24,401,623 5,126,324 882 29 - 8 0

10 53,300,000 28,200,000 3200 4 - 3 0

11 48,000,000 19,200,000 1000 7 - 1 0

12 55,100,000 15,800,000 993 16 - 5 0

13 9,298,510 10,688,040 332 17 - 8 7

14 17,208,716 14,466,369 877 0 0 0 0

15 1,933,168 1,305,371 347 4 - 4 0

16 2,653,894 1,965,027 308 0 - 0 0

17 15,000,000 12,000,000 2000 14 4 - 0

18 3,441,253 1,710,666 486 5 - 1 -

19 944,469 411,469 192 14 - - -

20 433,767 162,665 272 2 - - -

21 2,309,333 2,548,418 327 5 - 1 0

22 19,542,309 23,727,972 672 115 - 1 1

23 757,764 - 359 0 - 0 0

*Unique Conditions - this column distinguishes between the total number of reported cracks in fuel tank 

structure and the number of causes of the cracks. For instance, if there was a service bulletin for a specific 

design condition that was sent out, there may have been many reports of cracks at that location but the root 

cause of all of those cracks was the same. 

**Potential Lightning Ignition Source – this column assesses the locations of the cracks relative to possible 

exposure to high enough lightning current that an ignition source may be possible 

Section 121.703(a)(15), Service Difficulty Reports, requires that the certificate holder 

report “Cracks, permanent deformation, or corrosion of airplane structures, if more than 

the maximum acceptable to the manufacturer or the FAA”. The number of unique 

cracking conditions, meaning all common cause events that were found across multiple 

airplanes within a given model (such as may have been subject to a specific service 

bulletin) have been combined to represent just one condition, to provide a sense of the 

number of failure conditions that have resulted in the cracks. 

Data was also requested from airplane manufacturers regarding the in-service failure 

experience of fasteners or rivets. Fewer reports were received on cracked or broken 

fasteners, so the data was not tabulated. It appears that broken or cracked fasteners are 

less likely than cracked structure. The reports showed a small number of isolated events 

and a few common cause events associated with particular parts types that were 

subsequently corrected or eliminated. In each case, these reported failures were less 

frequent with less exposure than for the cracked structure. 
LIGHTNING ARC FINAL REPORT PAGE 33 

The in-service reports on fuel tank structural cracks and broken bolts are relatively rare, 

which is an indication of the robustness of airplane wing structure. The absence of fuel 

ignition due to lightning for these airplanes indicates that structural cracks and broken 

bolts are not significant lightning strike ignition sources. 

The data in Table 3.3-3 is primarily from airplanes with aluminum fuel tank structure, 

although it includes a small number of transport airplane models with fuel tanks built 

using carbon fiber composite structure. In addition, the airplane manufacturers that have 

experience with primary structure built from carbon fiber composite materials were asked 

to provide their experience relative to cracks or similar failure conditions, even if the 

composite materials were not used for fuel tank structure. No reports of structural cracks 

in composite structures were found. The airplane manufacturers also reported that 

laboratory testing of composite materials with small cracks incorporated showed no 

propensity for the cracks to grow. The structural specialists also reported that cracks in 

composites were not expected as the design approach taken for composites is typically to 

keep operating strains below levels where cyclic damage will lead to deterioration over 

the life of the airplane. Some airplane fatigue testing has demonstrated this has been 

effective over multiple airplane lifetimes. Also, composites are not prone to failures due 

to corrosion effects from environmental exposure. 

Lightning Risks Associated with Structural Cracks and Broken Bolts 

As noted above, structural cracks and broken bolts are mitigated by structural design 

methods and analysis. This results in robust structure that minimizes failures that will 

occur. Mandatory inspections are defined to look for cracks that also aid in minimizing 

their exposure should they occur. In service data indicates that cracks and broken bolts 

are relatively rare in fuel tanks, as noted in Table 3.3-3. However, despite the structural 

methods employed that lead to robust structure, cracks and broken bolts still can occur. 

As shown from service experience, their occurrence has not resulted in an ignition of 

flammable fuel vapors when the airplane is struck by lightning, even after over one 

billion flight hours of potential exposure. 

Still, the Lightning ARC reviewed these failure conditions and resulting implications 

when lightning strikes an affected airplane to understand the risk they may pose. For 

instance, small cracks originating at fastener holes will be covered by fastener hardware 

(such as collars) or sealant, which protects the fuel vapor from exposure to an ignition 

source if it were to result. For larger cracks or those cracks initiated away from fasteners, 

lightning analysis and tests were conducted to assess the risk of an ignition source 

resulting from lightning. This assessment is described in Appendix E. 

The lightning tests indicate that high current densities (on the order of 100,000 A/m) are 

needed before representative structural cracks will arc or spark. These current densities 

would only be expected at or very near attachment points on skins. For conducted 

currents in aluminum structure, these current densities are much greater than what would 

be found internal to the tank (maximum values on the order of 10,000 A/m away from a 

direct attachment). 
LIGHTNING ARC FINAL REPORT PAGE 34 

Similar to cracks, broken bolts would also not immediately result in an ignition source 

hazard in an aluminum fuel tank. Where significant lightning currents are expected, 

sealant could be applied that would provide a level of fault tolerance to prevent ignition 

sources from these failures. However, in some cases, such as for highly-torqued bolts, 

the sealant could be compromised by the energy released due to the bolt fracturing. In 

those cases, tests indicate that it may require 1,000s to 10,000s of amperes to result in an 

ignition source, depending upon the fastener installation. For locations internal to 

aluminum fuel tanks, these current levels will not occur through fasteners. So again it is 

expected that the fasteners most at risk would be skin fasteners exposed to lightning 

attachment, although there may be some tank penetrating fastener locations where a 

conducted current threat may be sufficient to result in an ignition source if the sealant is 

compromised and a large enough amplitude and energy is present in the lightning strike. 

Even then, the latent exposure of these installations will be limited as broken bolts in 

these locations that compromise the sealant will also compromise the integrity of the fuel 

tank and allow fuel to leak, which would likely be found within a few flights. 

Given the service experience and the data assessment, the risk of cracks or broken bolts 

resulting in an ignition source due to lightning is very small in conventional aluminum 

fuel tanks. The Lightning ARC does not see this as significant enough to warrant 

changes to structural design practices in an attempt to prevent cracks altogether, which 

would likely only further reduce but not eliminate the risk. Nor does the Lightning ARC 

recommend modifying inspection programs to find smaller cracks sooner as the increased 

risk of damage caused during inspections would likely offset the risk caused by these 

cracks. The most relevant data to support the Lightning ARC position that the risk is 

very small is the service experience, where these conditions are known to have been 

present with no lightning caused fuel vapor ignitions resulting from them. In addition, 

when they are present, lightning test and analysis indicates that very few installations 

would be at risk of seeing enough lightning current even under severe lightning 

conditions to be a hazard. 

Composite Fuel Tank Design Considerations 

The majority of transport category airplane fuel tanks are constructed primarily of 

aluminum. Therefore, the in-service experience that could be utilized within the 

Lightning ARC tasks is primarily based upon airplane design with aluminum structure. 

However, there are transport category airplanes with carbon fiber composite fuel tanks 

that were certified to lightning protection requirements of § 25.954. Given this 

experience coupled with the increasing use of carbon fiber composite materials in new 

airplane fuel tank construction means the implications of lightning protection design 

associated with the use of these composite materials must also be considered. 

There are transport category airplane models in service with carbon fiber fuel tanks. No 

specific safety issues were identified related to composites fuel tank construction 

following the SFAR 88 fuel tank safety assessments. There is substantial experience with 

carbon fiber primary structures in general. As noted in Appendix D, general service 

experience has shown increased robustness to certain failure modes associated with 

aluminum that are relevant to lightning protection, such as corrosion and fatigue 
LIGHTNING ARC FINAL REPORT PAGE 35 

cracking. In addition, the design and analysis methods used by structures are also 

expected to result in robust structure for new designs as the use of composites expands to 

even more structural applications. 

The civil airplanes with composite fuel tank structure along with military airplane have 

served to identify lightning protection issues associated with composite fuel tanks. Some 

of these issues are addressed in guidance such as the handbook Lightning Protection of 

Aircraft [11]. However, past design efforts have focused on effectiveness of the protection 

and have not typically addressed implications of failures or manufacturing variability as 

is now required by FAA Policy Memorandum ANM-112-08-002[10] for Part 25 

applications. 

There are also a few Part 25 projects in work at the time of this Lightning ARC activity 

that incorporate composite fuel tanks, but none have been certified for lightning 

protection based upon the FAA Policy Memorandum ANM-112-08-002[10] at the time of 

this report. The details of these designs are not publicly available, and sensitivity of the 

associated intellectual property has limited the Lightning ARC’s ability to engage in 

detailed discussions regarding specific failures or effects of manufacturing variability. 

However, some general points can be made to identify potential implications of 

composite fuel tanks relative to Lightning ARC recommendations. 

Use of carbon fiber composite structures in fuel tank design introduces some different 

lightning protection design considerations than conventional aluminum designs. This is 

driven by some of the basic characteristics of typical carbon fiber composites noted 

below. 

1. Composite materials used for transport airplane fuel tanks at this time are 

fabricated as laminates. The laminate displays anisotropic current flow locally 

along the direction of the fibers at the ply level and also has intermittent contact 

between fibers within a ply or between plies. This inhibits the ability for current 

to flow well at faying surface interfaces or through the thickness of the laminate. 

Where there are cut edges of composite, a phenomena that been referred to as 

edge sparking or edge glow in industry literature can occur. 

2. The effective quasi-isotropic conductivity of the carbon fiber composite laminate 

is typically on the order of 1000 times less than aluminum which results in 

increased current locally in joints and overall in joints internal to the fuel tank. 

Addition of meshes or foils in the skins can help to reduce the current that flows 

into the joints or internal tank, but do not produce conductivity comparable to 

aluminum. 

3. The resins used in the laminate are dielectric and typically designed to cure at 

relatively low temperatures compared to the local heating that can be created by 

lightning currents. When the material is subjected to those lightning currents 

(particularly at interfaces or joints), it can either pyrolize (vaporize) the resin over 

a small volume or at least cause the resin to soften or flow locally at interfaces 

due to rapid heating of the fibers and/or other conductive materials that carry the 

lightning current in that area. For interfaces where there is some resin or other 
LIGHTNING ARC FINAL REPORT PAGE 36 

dielectric between conductive elements, voltages driven by the lightning currents 

are enough to potentially break down locally through those dielectric interfaces 

with current flow resulting from that breakdown. 

Lightning protection design concepts are somewhat independent of the tank material, but 

the materials introduce different methods for implementing those concepts with different 

levels of effectiveness. 

Aluminum fuel tank skins are inherently very conductive and allow only relatively small 

currents to flow internal to the tank. As noted above, the material conductivity difference 

between aluminum and composites typically requires that composite designs add features 

like metal foils or meshes to partially compensate for this difference. These add-on 

features cannot provide the laminate with an equivalent effective conductivity 

comparable to aluminum skins because they are only very thin conductive layers. This 

results in higher current in many joints and associated fasteners, both at skin interfaces 

and internal tank joints. The higher current places more of a burden on other design 

features in order to achieve effective lightning protection. 

Widespread use of fasteners to assemble structure remains normal practice today, even 

with composite tanks. Achieving interference fit of those fasteners can be a contributor 

to lightning protection. It is relatively easy to implement interference fit fasteners in 

aluminum structures and is desirable in order to efficiently conduct lightning currents 

through joint interfaces. However, it is a challenge to do this in composite structures 

because the insertion force of the metallic fastener as it transitions through a hole smaller 

than the fastener diameter can result in delamination of the composite structure at the 

hole interface. A similar challenge exists regarding removal of those fasteners for rework 

or repair. Most composite designs therefore have used fasteners installed in clearance 

holes to avoid the issues with interference fit installations. This results in more heating 

and associated sparking/pitting in that interface, which places more burden on other 

features in the design. The use of sleeves, bushings or grommets to enable interference 

fit can minimize the risk of delamination during installation and improve the electrical 

interface with the composite material. However, these also introduce additional 

interfaces in the joint which can increase the variability of the lightning current path 

through the joint and add more potential sources of sparking. They also complicate the 

manufacturing installation process which can affect the robustness of that process. 

The mix of electrically conductive and insulating elements in the composite laminates 

limit the ability to get high quality electrical bonds through faying surface interfaces as 

can be done with aluminum interfaces. They also can add variability to electrical 

connection in the interfaces due to presence of dielectric material from the resin. 

Electrical bonding of composites is typically achieved through fastened interfaces 

because of this, but those suffer from the fastener interface issues noted above. Some 

processes have been developed to sand off resin to expose the carbon fibers for achieving 

faying surface bonds but this approach can introduce other variability, such as 

consistency in the fiber exposure due to sanding as well as introducing the potential for 
LIGHTNING ARC FINAL REPORT PAGE 37 

damaging the fibers or compromising their protection against local environmental 

conditions such as moisture intrusion or contamination. 

Achieving electrical bonding through rework or repair also has challenges as adhesives or 

resins used in typical field applications (both factory and airline operations) can result in 

relatively thick dielectric interfaces between the repair material and the parent laminate. 

An alternate approach to electrical bonding taken sometimes with composites is to 

introduce intentional insulating materials at certain interfaces to positively prevent 

current flow at those interfaces and direct it elsewhere. These can be effective in some 

applications but must be able to withstand voltages that might be present at those 

interfaces during lightning conditions as well being reliant on the other design aspects to 

adequately handle the higher current densities that result. Care must also be taken to 

ensure that electrostatic sensitivities are not introduced by use of insulators in the tank. 

One design feature that is comparable between aluminum and composite installations is 

the application of sealants to contain sparking. However, because of the other factors 

noted above, the sealant may be required to handle higher pressure stresses as part of a 

composite design as compared to an aluminum design so the relative effectiveness may 

be less in some cases. 

Existing industry lightning protection standards and practices were reviewed to assess the 

implications to composite fuel tanks. Given the conductivity differences to aluminum 

there has been a lot of analytical modeling development work done across industry to 

provide better understanding of lightning current distributions through structure and 

systems for composite structures. This development is especially significant for fuel tank 

lightning protection design because of the higher internal tank currents coupled with 

some of the design issues noted above, which require a higher resolution in understanding 

what levels of conducted currents may be present in joints throughout the fuel tank from 

various lightning attachment locations. 

The design issues noted previously coupled with assessment of failures and 

manufacturing variability associated with candidate designs has resulted in designs that 

have been difficult to make fault tolerant under some conditions. In most cases for those 

conditions where fault tolerance could not be achieved, these designs have relied upon 

use of sealant to ensure effective protection. Continuing technology development as well 

as a better understanding of the physical effects and the interrelationships between 

environment, in-tolerance variability and failure conditions that can result in lightning 

caused ignition sources should enable eliminating these kinds of non-fault tolerant 

conditions as time goes on. Certifying a composite fuel tank to criteria such as required 

by the FAA Policy Memorandum ANM-112-08-002[10], may result in non-fault tolerant 

design conditions without practical means to make them fault tolerant. The current FAA 

policy has provisions for addressing these designs via numerical probability analysis but, 

as is noted elsewhere in this section, there are a number of issues with applying this 

approach to lightning protection design of fuel tanks and it is even more difficult in this 

case given the limited experience with composite fuel tank designs. 
LIGHTNING ARC FINAL REPORT PAGE 38 

In summary, there is limited experience with designing lightning protection for composite 

airplane fuel tank structure, particularly since the publication of Amendment 25-102[5]

introduced the concept of failure assessment and manufacturing variability considerations 

for lightning protection certification. Technical challenges introduced with composite 

material fuel tank design drive the need for additional features beyond conventional 

aluminum designs. Composite tank design experience suggests there is increased 

variability relative to assessing lightning protection performance, and there are challenges 

achieving fault tolerant designs under some conditions. Technology development and 

general maturity of the knowledge base is expected to eliminate the non-fault tolerant 

conditions over time but it is not always practical to do that today. In most cases these 

non-fault tolerant conditions are reliant on sealants to ensure effective lightning ignition 

source protection. While the current policy accounts for this via a requirement to 

demonstrate that a catastrophic fuel vapor ignition of a tank is extremely improbable, it is 

not practical to acquire the data needed to perform the required probabilistic analysis. 

The Lightning ARC has estimated that the current challenges with composite tanks are 

likely short term. While it may require more design effort and testing to demonstrate that 

the lightning protection features are effective for composite designs, the Lightning ARC 

has not identified any need for a difference in requirements for composite designs. 

Numerical Analysis Considerations 

Quantitative analyses have traditionally been used as a tool where complex systems are 

evaluated. For example, if the loss of a function is classified to be catastrophic, normally 

three independent and reliable systems would be required to meet the top level criteria of 

no catastrophic effect in one billion flight hours. The three channels would be checked 

prior to each flight and if one of the channels could fail in a latent manner, an AFM 

procedure or a routine certification maintenance requirement would be imposed. The 

probability of failure of one system is typically on the order of once in ten thousand flight 

hours during the life of the airplane. There is no requirement to improve the typical 

reliability of one system/channel. 

Structures evaluations on the other hand have traditionally relied upon implementing failsafe, safe-life, and damage-tolerance concepts, supported by routine inspection tasks. 

The structural specialists who assisted the Lightning ARC indicated that a numerical 

probability analysis approach is inappropriate for structures due to the difficulty in 

assessing the variability in design, manufacturing methods, and operational environment 

which makes a probabilistic approach not viable. This is documented in Appendix D. 

Some issues with conducting numerical probability assessments relative to lightning 

protection are summarized below. 

Fuel system lightning protection design elements do not have defined lifetimes or wearout characteristics that are typically associated with moving mechanical systems or with 

electronic components. Therefore the lightning protection design element reliability 

cannot be evaluated using the safety assessment techniques and handbook values 

normally applied to electrical and electronic systems, or moving mechanical systems. 
LIGHTNING ARC FINAL REPORT PAGE 39 

Lightning protection for airplane fuel tanks and systems involves specific characteristics 

of a number of parts and components, such as structural fasteners, wing skins and 

underlying structure, bonded structural interfaces, fuel tubes, bonding jumpers and access 

panels. For each class of part or component, there are many variations in their 

characteristics that could affect the lightning protection performance. For example, 

structural fasteners have a wide range of shank diameter, length, material and coating, 

any of which could affect the lightning protection performance. Therefore, the lightning 

protection must consider a large number of detailed characteristics of these parts. 

Typically these parts are designed to last the life of the airplane, but generally there is no 

numerical value for the mean time to failure for these features. Any protection approach 

that relies on a numerical safety assessment will require failure rate data for hundreds of 

parts with a wide range of characteristics. 

System safety assessments have traditionally been based on military handbook data to 

provide base failure rates for components. However, no such data source exists for 

structural components. Structural certification has generally been based on the concept 

of demonstrating strength and fatigue margins based on airplane life and mechanical 

stress levels. Probabilistic failure rates have never been considered for this type of 

component. 

Similarly, there is no data for rates of occurrence of undetected manufacturing escapes or 

maintenance errors. The data that is available related to detected escapes or errors is not 

meaningful in this context. 

There are also relatively few fuel system lightning protection design concepts even 

though there are many potential detailed features that implement these concepts. The 

relatively limited experience using numerical safety analysis for lightning protection as 

driven by § 25.981(a) or the FAA Policy Memorandum ANM-112-08-002[10] has shown 

that the primary value of these assessments was achieved when identifying potential 

protection element failure scenarios. The numerical safety analysis results typically do 

not change the fundamental lightning protection design approach. 

The fuel system lightning protection cannot be effectively analyzed using the traditional 

system safety assessment tools. In most cases, the functions of the fuel systems are not 

related to lightning protection. For example, the function of fuel pumps and tubes is to 

provide fuel to the engines, so failure of the fuel pumps and associated plumbing could 

result in loss of engine thrust. The lightning protection for these fuel pumps and 

plumbing is not directly related to the function of providing fuel to the engines, and is 

typically not addressed as part of the fuel system safety assessment. 

The redundancy approaches typically used for electrical and electronic systems, or 

moving mechanical systems are not effective for lightning protection either, particularly 

fuel tank lightning protection. For many lightning protection features such as structural 

fasteners, redundancy of the fasteners does not provide redundant lightning protection. 

For other lightning protection elements, the lightning protection is not improved by 

adding more of the same element. For example, adding another layer of fuel sealant over 
LIGHTNING ARC FINAL REPORT PAGE 40 

existing sealant does not provide lightning protection redundancy for that feature, 

because degradation of the adhesion between the sealant and structure may compromise 

all layers of sealant. Another example is the addition of multiple bonding straps to an 

installation where common failures, such as corrosion, could degrade or disable all of 

them. Finally, adding redundant add-on features such as multiple bonding straps can also 

lead to a greater chance of exposure to damage or improper reinstallation during routine 

maintenance, increasing the risk of possible ignition sources. The history of lightning 

protection design has shown that the simplest design implementations are typically the 

best. 

These characteristics of lightning protection make evaluation using numerical safety 

assessment techniques normally applied to electrical, electronic or mechanical systems 

inappropriate. Instead, the lightning protection effectiveness has generally been 

evaluated using standardized lightning tests, some following exposure to other 

environmental conditions such as temperature and humidity. The use of standardized 

lightning tests in combination with standardized environmental tests provides prescriptive 

lightning protection compliance demonstrations. 

The approach of defining specific, severe airplane lightning environments result in 

airplane lightning protection engineers focusing on the specific lightning protection 

features that would be incorporated into the airplane design. With this approach the 

airplane designers and the regulatory authorities emphasize the airplane lightning 

protection design adequacy based on specific lightning environment definitions, rather 

than focusing on the statistics and probabilities associated with the lightning 

environment. 

Safety Assessment Considerations 

As noted previously, the widely-varying characteristics of lightning, frequency of 

airplane lightning strikes, and fuel tank flammability exposure are all important factors 

relative to the likelihood of lightning causing a catastrophic fuel vapor ignition. They are 

all independent factors not directly related to the airplane fuel tank structure and fuel 

system design. Any qualitative or quantitative safety analysis would use similar factors 

for lightning characteristics, airplane lightning strikes rates, and fuel tank flammability 

exposure. Because these factors significantly reduce the risk of fuel vapor ignition, their 

contribution to safety should be considered and factored into defining acceptable criteria 

for the lightning protection design. The only factor that significantly changes the 

likelihood of lightning-related fuel ignition sources is the specific airplane lightning 

protection design, so that could be the focus of a practical design safety assessment. 

The contribution to catastrophic fuel vapor ignition by the factors that are independent of 

the airplane fuel system design can be considered numerically. The worldwide transport 

airplane lightning strike rate is on the order of once in several thousand flight hours.[18] 

The fuel system flammability exposure is controlled by transport airplane regulation. 

Section 25.981(b) limits the fleet average flammability exposure to three percent of the 

flammability exposure evaluation time, or that of a conventional unheated aluminum 

wing tank. Using at least 3000 flight hours between lightning strikes to each airplane, 
LIGHTNING ARC FINAL REPORT PAGE 41 

and less than three percent flammability exposure, any lightning strike to an airplane 

during a flammable condition is expected less than once in 100,000 flight hours. These 

two factors are not dependent on the fuel system lightning protection design. Using the 

terminology from the draft Advisory Circular 25.1309-1X Arsenal version, these 

conditions would be considered remote, or unlikely to occur to each airplane during its 

total life.[19] 

Lightning protection ineffectiveness results in a threshold where lightning of a certain 

amplitude and energy will result in an ignition source. Lightning strikes have wide range 

of amplitude and energy distributions, with most strike amplitudes significantly lower 

than the lightning environment specified for evaluating fuel system lightning protection. 

Since the amplitude and energy of lightning is statistically variable, the lightning strike to 

the fuel tank structure or system feature with ineffective lightning protection must exceed 

the ignition source threshold for that feature at the location where the ineffective 

lightning protection exists. 

The result is that, if a quantitative safety assessment for fuel tank structure and systems 

lightning protection is used, it only needs to address the probability of ineffective 

lightning protection features experiencing a lightning strike amplitude or energy that 

exceeds its ignition source threshold at its location, not the probability of flammability 

and airplane lightning strike rates. An acceptable level of safety is to show that 

catastrophic fuel vapor ignition is extremely improbable, typically expressed numerically 

as a probability of less than once in a billion flight hours. If the probability of an airplane 

lightning strike in combination with flammable fuel vapors is expected to be less than 

once in 100,000 flight hours, then the residual risk related to ineffective lightning 

protection in combination with a lightning strike that exceeds the ignition source 

threshold needs to be less than once in 10,000 flight hours. Using the terminology from 

the draft Advisory Circular 25.1309-1X Arsenal version, a probability per flight hour that 

is less than one in 10,000 flight hours is considered probable, or anticipated to occur one 

or more times during the entire operational life of each airplane. 

As noted earlier, lightning protection designs have been shown to be generally reliable. 

If reliable lightning protection designs are implemented for fuel tank structure and 

systems, then these designs should achieve the intent of ensuring that failure of lightning 

protection elements will occur infrequently during the operational life of each airplane. 

Airplane designs that comply with § 25.954 have prevented lightning-related fuel ignition 

when the airplanes operate with lower-volatility Jet-A type fuels, even though § 25.954 

does not require fault tolerance for the lightning protection. 

If fuel tank and fuel system lightning protection features and elements are reliable, then 

implementing fault-tolerance for these features and elements will effectively minimize 

the residual risk so that lightning-related catastrophic fuel vapor ignition is extremely 

improbable. The approach of fault-tolerant fuel tank and fuel system lightning protection 

is consistent with other transport airplane regulations and the FAA Policy Memorandum 

ANM-112-08-002[10]. 
LIGHTNING ARC FINAL REPORT PAGE 42 

3.3.2 Findings 

In reviewing the data presented above and in response to the specific tasks statements of 

Task 3, 4, and 5 in the Lightning ARC Charter, the Lightning ARC recommends the 

following: 

 A reliable single fault tolerant fuel system lightning protection design should be 

applied as a prescriptive requirement. 

o Failures leading to ineffective lightning protection do not result in a 

catastrophic fuel vapor ignition unless they are combined with the remote 

event of a lightning strike of enough amplitude or energy to result in an 

ignition source and fuel vapors in the tank are flammable. This alone makes a 

catastrophic fuel vapor ignition unlikely with a lightning protection design 

that has reliable features. A reliable single fault tolerant design will ensure 

that such an event will not happen. 

 A qualitative hazard assessment approach similar to that described in ARP5577[12] 

should be used for conducting the fuel system lightning safety assessment. 

 The safety assessment should include the following content and procedures: 

o Identify the elements of the fuel systems lightning protection 

o Identify each failure condition that potentially affects lightning protection, 

including cascading effects caused by the root failure. 

o Assess and substantiate the effectiveness, robustness and independence of the 

lightning protection relative to the expected lightning threat at each design 

location, with and without failure conditions. 

 A probabilistic safety analysis should not be applied to fuel system lightning 

protection because the significant contributors to the top level event are 

independent of the fuel system design. In addition, failure data relevant to 

lightning protection to support a meaningful probability analysis is not readily 

available or easily obtained. 

 Specific single failures (structural cracks or broken fasteners) leading to 

ineffective lightning protection have been determined to be rare and impractical to 

preclude for new type design. These failures are effectively mitigated by 

structures regulations, design processes, and mandated inspections. Even when 

they do occur, they may only result in an ignition source in aluminum fuel tanks if 

lightning attaches immediately in their vicinity. Because the combination of the 

crack or broken fastener with a lightning attachment in the immediate vicinity is 

remote, the residual risk of catastrophic fuel vapor ignition is negligible and they 

can, therefore, be excluded from the safety assessment for aluminum fuel tanks. 

o While the Lightning ARC focused on the above specific non-fault tolerant 

modes identified in past designs, if an applicant identifies other improbable 

single failures that are impractical to preclude, it would be reasonable for the 

applicant to demonstrate via the same qualitative assessment process, that 

these represent a negligible risk. 
LIGHTNING ARC FINAL REPORT PAGE 43 

 Because a probabilistic safety analysis is not recommended, there is no need to 

provide a probabilistic distribution of lightning amplitudes. The use of 

standardized specific and severe airplane lightning environments as defined in 

ARP5412[16] is consistent with other lightning regulations and focuses the design 

emphasis on the effectiveness of the lightning protection rather than on the 

variability of the lightning environment. 

 Composite fuel tanks typically require more features and result in greater 

variability in lightning protection performance than aluminum fuel tank designs. 

Given the maturity of these composite tank designs and associated technologies, 

applicants working new certification projects have found it difficult to provide 

fault tolerant designs under some conditions. Expectations are that over time and 

with continued technology development and maturity of industry knowledge 

related to variability and failures of lightning protection in composite designs, 

fault tolerant designs will become practical for all conditions. Therefore, the 

Lightning ARC finds that these composite design challenges today should not 

influence the other safety assessment recommendations. 

 Requirements for single fault tolerant lightning protection should be applied to all 

components and installations in the fuel tank structure and systems, with the 

exception of the specific single failures identified above. Failure modes, 

including cascading failures and those attributable to manufacturing errors, should 

be considered in the safety assessment with the exception of the specific structural 

failures regarding cracked structure or broken fasteners in aluminum fuel tanks 

identified above. The failure modes to include would be those that may 

reasonably be expected to occur as a result of intended operational and 

environmental conditions or those that may be expected to occur as a result of a 

manufacturing quality escape. 
LIGHTNING ARC FINAL REPORT PAGE 44 

3.4 Task 6 

Determine a means to address manufacturing variability, age, wear, corrosion and 

likely damage to lightning protection features. 

3.4.1 Evaluation of the Issue 

This section of the Lightning ARC report addresses the effects of manufacturing 

variability, aging, wear, corrosion and likely damage. While the term “age” is listed in 

the Task, the term “aging” is used in § 25.981(a). The ARC believes the intent was to 

evaluate “aging”, although little difference between the evaluation of the two terms was 

identified. 

Review of Existing Regulations 

Prior to Amendment 25-102[5] to § 25.981, the lightning protection requirements for fuel 

tank structures and systems were contained in § 25.954. This regulation required 

prevention of vapor ignition in the fuel tank, but the regulation did not contain wording 

requiring the airplane manufacturer to address manufacturing variability, aging, wear, 

corrosion and likely damage. Advisory Circular AC 20-53A[29] did not provide any 

specific guidance material with respect to manufacturing variability, aging, wear, 

corrosion and likely damage. Advisory Circular AC 20-53B[3] introduced section (8) 

entitled “Maintaining Fuel System Lightning Protection” and states in (8c): “Where 

possible, do not use devices susceptible to corrosion, fretting, flexing cycles, or other life 

limiting design features. However, when using those types of devices, you must publish 

their replacement cycles in your instructions for continued airworthiness manual”. 

Section 25.981(a)(3) specifically requires the airplane manufacturer to address these 

issues within the regulation by stating “the effects of manufacturing variability, aging, 

wear, corrosion and likely damage must be considered...”. Sections 25.981(b) 

Amendment 25-102[5], 25.981(d) Amendment 25-125[6] and SFAR 88 also introduced the 

use of Critical Design Configuration Control Limitations (CDCCL) as a means of 

managing and controlling the configuration of ignition protection features. The CDCCL 

notation is designed to preserve the integrity of ignition protection features during 

configuration change that may be caused by design changes, alterations, repairs or 

maintenance activity (likely damage). 

The 2006 advisory material for § 25.954 briefly addresses aging, wear, and corrosion as 

part of continuing airworthiness while § 25.981 requires the airplane manufacturer to 

address these areas as well as manufacturing variability and likely damage within the 

regulation.

Review of Service History Pertaining to Manufacturing Variability, Aging, Wear, 

Corrosion and Likely Damage 

In order to identify a means to address the effects of manufacturing variability, aging, 

wear, corrosion and likely damage it is appropriate to review the service history of the 

world aviation fleet. The most comprehensive source of information is provided in the 

AFSSP report[17] previously described in section 3.3.1. Overall, the fuel systems 

inspected were generally found to be in good to excellent condition unless subject to 
LIGHTNING ARC FINAL REPORT PAGE 45 

initial manufacturing error (a subset of manufacturing variability) or subsequent 

modification or damage (likely damage). There were no findings to suggest that the 

world aviation fleet exhibited systemic problems associated with aging, wear and 

corrosion. 

Options 

The Lightning ARC considered the following options for determining a means to address 

manufacturing variability, aging, wear, corrosion and likely damage of lightning 

protection features. 

Option 1: Address manufacturing variability, aging, wear, corrosion and likely 

damage during the design and certification of lightning protection features. 

Option 2: Address manufacturing variability, aging, wear, corrosion and likely 

damage with reliable manufacturing, quality and process controls. 

Option 3: Address manufacturing variability, aging, wear, corrosion and likely 

damage using instructions for continued airworthiness (ICA). 

Option 4: Address manufacturing variability, aging, wear, corrosion and likely 

damage by providing maintenance personnel with information that will minimize 

accidental or likely damage to lightning protection features during performance of 

maintenance, alterations and repairs. 

Aging, Wear and Corrosion 

As discussed in section 3.3, the objective is to design reliable lightning protection 

features that are not expected to degrade when exposed to the anticipated effects of aging, 

wear and corrosion. A reliable design can reduce the need for maintenance inspections 

required to verify the protection design, which, in turn, reduces the possibility of likely 

damage or disabling of lightning protection features that may occur during operations and 

scheduled and unscheduled maintenance activity. 

The effects of aging, wear and corrosion can be addressed during the design/certification 

phases with lightning protection features that promote a design that is reliable. As 

outlined in the AFSSP report[17], the fuel tank systems inspected were generally found to 

be in good to excellent condition. There were no findings to suggest that the world 

aviation fleet exhibited systemic problems associated with aging, wear and corrosion. A 

reliable lightning protection design can be achieved by utilizing designs with a good 

service history, supplemented by lightning and environmental testing, where applicable. 

The objective is to design reliable lightning protection features that are not expected to 

fail when exposed to the anticipated effects of aging, wear and corrosion. However, there 

may be cases where it is not practical to implement a lightning protection design that is 

completely immune to the anticipated effects of aging, wear and corrosion. In such 

cases, the instructions for continued airworthiness can be used to identify the appropriate 
LIGHTNING ARC FINAL REPORT PAGE 46 

maintenance tasks and intervals to verify, restore or replace the lightning protection 

features. 

The Lightning ARC reviewed the Options listed above and determined that an optimum 

means to address aging, wear and corrosion of lightning protection features may be a 

combination of Options 1 and 3 where the objective is to design reliable lightning 

protection features that are not expected to fail when exposed to the anticipated effects of 

aging, wear and corrosion. In cases where lightning protection features may degrade, the 

airplane manufacturer could identify appropriate inspection tasks and intervals in the 

instructions for continued airworthiness to maintain the integrity of the lightning 

protection features. 

Likely Damage 

Likely damage refers to damage that may occur to lightning protection features during 

operations and scheduled or unscheduled maintenance activity of the fuel tank structures 

and systems. 

Likely damage was identified as a significant finding within the Aircraft Fuel System 

Safety Program (AFSSP) [17], and usually occurs during maintenance activity. One means 

to address likely damage is to provide maintenance personnel with awareness of the fuel 

tank lightning protection features which can help prevent likely damage and accidental 

removal or disabling of lightning protection features during maintenance activity. 

Sections 25.981(b) Amendment 25-102[5] and 25.981(d) Amendment 25-125[6], use 

Critical Design Configuration Control Limitations (CDCCL) as a means of managing and 

controlling the configuration of ignition protection features and require that CDCCL 

information be included in the Airworthiness Limitations section of the instructions for 

continued airworthiness as required by § 25.1529. Incorporating the CDCCL information 

into the Airworthiness Limitation section may not be the most effective approach to 

minimize likely damage. The Lightning ARC determined that these instructions would 

be more effective if they are published in the maintenance documents that are directly 

used by the maintenance personnel during operations and scheduled or unscheduled 

maintenance activity. 

As an alternative to using the CDCCL designation, the applicant could incorporate 

applicable Caution information (notes) associated with critical lightning ignition source 

prevention features directly into the maintenance documentation including the Airplane 

Maintenance Manual (AMM), the Structural Repair Manual (SRM) and manuals that 

provide maintenance personnel with standard practices such as standard wiring practices. 

The Lightning ARC determined that Caution information for critical lightning protection 

features could be incorporated into instructions for continued airworthiness required by 

§ 25.1529. This is a similar approach to Part 25 Appendix H25.5 (a)(1)(vi) which 

requires the applicant to provide protection and Caution information that will minimize 

contamination and accidental damage for Electrical Wire Interconnection System 

(EWIS). 
LIGHTNING ARC FINAL REPORT PAGE 47 

Incorporating Caution information into the maintenance requirements and incorporating 

this information into the appropriate maintenance documentation can provide 

maintenance personnel with an awareness of the fuel tank lightning protection features 

which can help prevent likely damage and accidental removal or disabling of lightning 

protection features. For example, during scheduled or unscheduled maintenance within 

the fuel tank, in addition to identifying the lightning protection features, maintenance 

personnel could be advised to perform a final inspection prior to closing the fuel tank to 

ensure the lightning protection features have not been disturbed. In cases where a 

lightning protection feature has been the subject of the maintenance activity, maintenance 

personnel could be advised to verify that the lightning protection feature has been 

restored and verified by the appropriate procedure. 

Another means to address likely damage is to carry out an engineering evaluation of 

lightning protection features for susceptibility to likely damage during the airplane 

design/certification phase. The evaluation can include a review of manufacturing 

records, quality records and operational history of similar designs that include production 

and maintenance induced errors (likely damage). 

Manufacturing Variability 

As outlined below, manufacturing variability as currently interpreted by the FAA for 

§ 25.981(a) includes both manufacturing tolerances as well as manufacturing errors. 

 Manufacturing Tolerances that are expected to occur during normal 

manufacturing and allowed per the manufacturing and quality control processes 

 Manufacturing Errors which can be further subdivided into manufacturing errors 

or non-conformances that are detected and dispositioned during the airplane build 

process and manufacturing escapes which leave the factory undetected 

Manufacturing tolerances associated with the fabrication of lightning protection features 

are expected to occur during the normal manufacturing and quality control processes. 

These tolerances may have an impact on the effectiveness of the lightning protection 

design. Manufacturing tolerances can be addressed during the design of lightning 

protection features and substantiation of the design tolerances can be carried out during 

the lightning protection verification program. Examples of manufacturing tolerances 

include the tolerances associated with the fastener installation in fuel tank structure, the 

tolerances associated with sealant used as a spark barrier or the maximum allowable pipe 

alignment angle when evaluating a pipe-to-pipe electrical bonding path. 

Manufacturing Errors including Non-conformances and Escapes. Manufacturing nonconformances are manufacturing errors that are detected during the manufacturing or 

inspection process when it is determined that the production build does not conform to 

the engineering definition. There may be cases when a manufacturing error involves a 

fuel tank lightning protection feature. Manufacturing errors are anticipated to occur 

during the manufacturing/production build of the airplane. Non-conformance(s) 

associated with fuel tank structures and systems should be brought to the attention of the 

fuel tank lightning protection design authority and dispositioned to restore the fault 

tolerant lightning protection design intent. 
LIGHTNING ARC FINAL REPORT PAGE 48 

Manufacturing escapes define a condition where an error has occurred during the 

manufacturing process such that the production build of the airplane does not conform to 

the engineering definition. Furthermore, the manufacturing error is not detected and the 

airplane leaves the factory and enters service. Manufacturing escapes are anticipated to 

occur during the manufacturing/production build of the airplane. There may be cases 

when a manufacturing escape involves a fuel tank lightning protection feature. 

Manufacturing errors can be mitigated by reliable manufacturing operations, processes 

and inspections. In some cases, manufacturing processes can be selected which are 

reliable and repeatable, such as many automated processes. In cases where 

manufacturing operations rely on human skill factors, proper training and reliable 

production processes can minimize or preclude manufacturing errors. It may also be 

possible to review manufacturing and in-service records of similar designs to determine if 

such escapes have occurred and incorporate production line inspections for areas where 

records indicate a potential for errors/escapes. 

Manufacturing errors can be minimized or precluded during the design and certification 

of lightning protection features. Implementing a design where the lightning protection 

feature is not just an “add on” feature but is part of the functionality of the fuel system 

means that a manufacturing error involving a lightning protection feature would also 

manifest itself as a failure during the fuel system functional test procedure. 

Finally, designs may be able to mitigate manufacturing errors by the use of additional 

protection features to compensate for a compromise in lightning protection performance. 

This would be the objective of a fault tolerant design where the additional feature protects 

against the failure caused by the manufacturing error. An example would be the 

application of sealant over the collar or nut of a fastener installation. 

3.4.2 Findings 

The Lightning ARC has evaluated the means to address the effects of manufacturing 

variability, aging, wear, corrosion and likely damage to lightning protection features. 

The findings are summarized below: 

 The Lightning ARC found that addressing the effects of aging, wear and 

corrosion as both a design consideration and continuing airworthiness 

consideration will ensure a reliable design as supported by the findings of the 

AFSSP report[17]. 

 The Lightning ARC found that the optimum means to address likely damage 

would be a combination of addressing the susceptibility of lightning protection 

features to likely damage during the design/certification phase and publishing 

Caution information in the appropriate maintenance documentation to help 

prevent likely damage and accidental removal or disabling of lightning protection 

features. 
LIGHTNING ARC FINAL REPORT PAGE 49 

 The Lightning ARC found that the optimum means to address manufacturing 

tolerances associated with lightning protection features is addressing 

manufacturing tolerances during the design and certification phase. 

 The Lightning ARC found that an optimum means to address manufacturing 

errors is a combination of manufacturing, quality and process controls to 

minimize manufacturing errors, plus use of fault tolerant design features to 

mitigate the impact of manufacturing escapes. 
LIGHTNING ARC FINAL REPORT PAGE 50 

3.5 Task 7 

Determining criteria associated with instructions for continued airworthiness and 

any needed modifications to processes defined in Revision 3 to the Maintenance 

Steering Group (MSG-3)[20] document. 

3.5.1 Evaluation of the Issue 

This section of the Lightning ARC report proposes criteria associated with the 

instructions for continued airworthiness (ICA) and provides a review of ATA MSG-3[20] 

for developing and documenting the instructions for continued airworthiness. 

Review of Existing Regulations 

Prior to Amendment 25-102[5] of § 25.981, the lightning protection requirements for fuel 

tank structures and systems were contained in § 25.954. This regulation required 

prevention of fuel vapor ignition in the fuel tank, but the regulation did not specifically 

address ICA. The applicable regulation for continued airworthiness is contained in 

§ 25.1529 and Appendix H. Although § 25.1529 and Appendix H are applicable to all 

Part 25 regulations, including § 25.954, § 25.1529 did not specifically address continued 

airworthiness as related to fuel tank lightning protection. Advisory Circular AC 20-

53B[3] introduced section (8) entitled “Maintaining Fuel System Lightning Protection” 

which briefly discusses the need to monitor and maintain lightning protection features. 

The introduction of § 25.981 at Amendment 25-102[5] and subsequently Amendment 25-

125[6] specifically required the applicant to address continued airworthiness by stating in 

the regulation “...inspections or other procedures must be established as necessary to 

prevent development of ignition sources within the fuel tank system”. 

Sections 25.981(b) Amendment 25-102[5], 25.981(d) Amendment 25-125[6] and SFAR 88 

also introduced the use of CDCCL as a means of managing and controlling the 

configuration of lightning protection features. These regulations also mandated 

CDCCLs, inspections and procedures by stating “...these CDCCL, inspections and 

procedures must be included in the Airworthiness Limitation section of the Instructions 

for Continued Airworthiness required by § 25.1529.” 

Options 

The Lightning ARC considered the following options for determining criteria associated 

with instructions for continued airworthiness. 

Option 1: Retain the approach § 25.981 at Amendments 25-102[5] and 25-125[6]which 

requires the applicant to address continued airworthiness and also mandated that 

maintenance inspections, deemed “as necessary”, in the Airworthiness Limitation 

section of the Instructions for Continued Airworthiness. 

Option 2: Adopt a more definitive approach to continued airworthiness, where the 

maintenance inspections are determined by specific criteria as defined within the 

regulations. 
LIGHTNING ARC FINAL REPORT PAGE 51 

Industry experience indicates the thoroughness of continued airworthiness instructions 

for fuel tank lightning protection has varied from applicant to applicant. This may be due 

in part to the limited information regarding fuel tank lightning protection ICA in the 

regulatory language and guidance material of §§ 25.954 and 25.1529. Providing a more 

definitive approach to continued airworthiness within the proposed fuel tank lightning 

protection regulation can help ensure ICA are addressed by the applicant. 

However, the Lightning ARC is concerned with the § 25.981 regulatory language which 

states, ”...inspections or other procedures must be established, as necessary, to prevent 

development of ignition sources within the fuel tank systems. These CDCCL, inspections 

and procedures must be included in the Airworthiness Limitation section of the 

Instructions for Continued Airworthiness required by § 25.1529.” The interpretation of 

the regulatory language and specifically the phrase “as necessary” has resulted in some 

confusion as to what inspections and procedures are deemed necessary and as a result 

what inspections must be incorporated into the Airworthiness Limitation section of the 

ICA. 

Section 3.3 discusses that most lightning protection features are considered reliable and 

thus not expected to degrade when exposed to the anticipated effects of aging, wear and 

corrosion. A reliable design can reduce the need for maintenance inspections required to 

verify the protection design which in turn reduces the possibility of likely damage or 

disabling of lightning protection features that may occur during operations and scheduled 

or unscheduled maintenance activity. A review of the data regarding the overall integrity 

of fuel tank design and maintenance, including the AFSSP report[17] indicates that the fuel 

systems inspected were generally found to be in good to excellent condition unless 

subject to subsequent modification or damage (likely damage). Since likely damage was 

considered a significant finding within the AFSSP report[17], and usually occurs during 

operations and scheduled and unscheduled maintenance activity, the Lightning ARC 

determined that it would be beneficial to adopt a continued airworthiness approach which 

can minimize the frequency of fuel tank maintenance activity and consequently reduce 

the risk of accidental or likely damage. In addition, if a fault tolerant design is 

implemented fuel tank entries can be minimized. 

The Lightning ARC developed a definitive approach (see Figure 1) for determining 

criteria associated with instructions for continued airworthiness, as suggested by Option 

2. This approach proposes inspections and procedures for non-fault tolerant features be 

included in the Airworthiness Limitations section and procedures for fault tolerant 

designs may utilize sampling programs or the MRB process (via a modified MSG-3[20]) 

to derive the maintenance tasks. A more definitive approach will avoid the confusion 

associated with the “as necessary” terminology of § 25.981 and, together with a reliable 

fault tolerant design, will minimize the need for fuel tank entries. 
LIGHTNING ARC FINAL REPORT PAGE 52 

FIGURE I 

Instructions for Continued 

Airworthiness 

I 

1 ~ Fault Tolerant Non-Fault 

Dt:sign Tolerant Design 

1 

Lightning protection features considered Airworthiness Lmlitation Section of 

Maintenance Document reliable and not anticipated 10 degrade Inspection tasks and intervals to maintain when exposed to the effects of aging, wear, 

cOlTosion and likely damage 

thc mtcgrity of lightnmg protcction 

features. 

I 

• • I YES I I NO I 

MmnteIHmec Rev iew BOllrd 

Report 

May utilize MSG-3* as one 

means to derive Illspcetions 

and intervals to nl.'lintain the 

* The Lightning ARC recommends changes illlegrity of lightning 

protection fearures. be made to MSG-3 

OPTION 1 

Sampling Program 

Carry out a sampling program 

to verily the mtegrity of 

lightning protection features. 

OPTION 2 

Maintenance Review Board 

Report 

May utilize MSG-3* as one 

means to derive inspections 

and intelvals 10 verify the 

integrit y of lightning 

protection features. 
LIGHTNING ARC FINAL REPORT PAGE 53 

The Lightning ARC has also reviewed the wording in § 25.981 at Amendments 25-102[5]

and 25-125[6] ,”...visible means to identify critical features of the design must be placed 

in areas of the airplane where maintenance actions, repairs, or alterations may 

compromise the critical design configuration limitations (e.g. color-coding of wire to 

identify separation limitation). These visible means must also be identified as CDCCL.” 

Fuel tank lightning protection may utilize several approaches including fastener 

type/installation, sealant used as a spark/arc barrier, sealant used to prevent corrosion of 

lightning protection features, electrically bonded interfaces to safely conduct the 

lightning current, electrically insulating interfaces to prevent voltage breakdown/current 

conduction, adequate clearances between fuel systems and structure as well as cable 

shielding. The present wording in 25.981 regarding “visible means” can be widely 

interpreted. One possible interpretation would require the applicant to place visible 

means, such as placards, in areas of the fuel tank to identify all the fasteners, sealant 

applications, conductive and insulating components that may be used in the fuel tank to 

prevent ignition sources. In addition, the placards themselves would then be defined as a 

CDCCL item requiring mandatory inspections to ensure their integrity. The Lightning 

ARC reviewed and discussed the application of visible means to identify fuel system 

lightning protection features, but found no options that were considered practical or 

beneficial. 

Review of ATA MSG-3[20] as a Means of Developing and Documenting the 

Instructions for Continued Airworthiness. 

Part of Task 7 is to identify any recommended changes to the ATA MSG-3[20] logic 

process should this process be used to derive maintenance tasks and intervals associated 

with fuel tank lightning protection features. 

As outlined in the previous sections, the Lightning ARC proposes a definitive approach 

that utilizes sampling programs, Airworthiness Limitations and the Maintenance Review 

Board (MRB) process for documenting the instructions for continued airworthiness. 

In general, developing the instructions for continued airworthiness can be derived using a 

number of approaches including the following: 

 Tasks that are derived by engineering specialists during the certification process 

such as CMRs and Structural Airworthiness Limitations. This process can also be 

used to derive tasks for fuel tank lightning protection features. 

 Tasks that are developed within the Maintenance Review Board process using the 

structured approach of ATA MSG-3[20]. 

The Maintenance Review Board report contains ICA that are developed through the 

logic-based analysis process provided in ATA MSG-3[20], Operator/Manufacturer 

Scheduled Maintenance Development, prepared by the Air Transport Association. The 

latest version of the document is MSG-3 Revision 2009.1[20]. The tasks and intervals are 

developed by coordinating the efforts of specialists from the airplane Operators, Airplane 

Manufacturer and Regulatory Authorities. The airplane manufacturer utilizes the 
LIGHTNING ARC FINAL REPORT PAGE 54 

guidelines from the ATA MSG-3[20] document and produces a Policy and Procedures 

Handbook (PPH) outlining the processes and any assumptions made by the airplane 

manufacturer to derive the scheduled maintenance program. 

The working portions of the ATA MSG-3[20] document are contained in the following 

four sections. A brief overview of each section is provided below, as well as the 

suitability of each section to derive instructions for continued airworthiness as related to 

fuel tank lightning protection features. 

 Section 2-3: Systems /Powerplant Analysis Procedure

This section identifies Maintenance Significant Items (MSI) based on 

consequences of failure, evaluates functional failure to determine failure effect 

category (safety, economic or operational) and takes into consideration the failure 

cause to derive maintenance tasks. This section presently contains a note (section 

2.3.1) added in 2005 regarding fuel tank systems safety as related to ignition 

sources, including lightning. 

The ARC determined that this section may be used to derive maintenance tasks 

and intervals. However, section 2-3 would require changes to ensure the analysis 

in this section can be applied effectively. A number of potential shortcomings are 

summarized below. 

The existing note contained in section 2-3-4 regarding “fault tolerant systems” is 

inconsistent with a fault tolerant design requirement and requires review by MSG-3[20]

specialists. Confusion can exist when applying the logic questions contained in MSG3[20] section 2-3 as outlined below: 

 The terms “Function”, “Functional Failure” and “Failure Effect” may require 

clarification as they apply to a fault tolerant design subject to a lightning event. 

 There may be ambiguity when asking and understanding the logic questions such 

as the Level 1 Question 3: “Does the combination of a hidden functional failure 

and one additional failure of a system related or back up function have an 

adverse effect on operating safety?” At the present time, it is not clear how to 

respond to this question for a fault tolerant design in the event of a lightning 

strike. 

 It is not clear that the analysis process within this section can derive a 

maintenance task to restore the fault tolerant design where one lightning 

protection feature has failed. 

 It is not clear that the analysis process within this section can derive the tasks 

required to verify the integrity of lightning protection features of a fault tolerant 

design where the protection features are not anticipated to fail. 

The note added to section 2-3-1 logic analysis in 2005 refers to “lightning protection of 

the fuel tank system” and references the one example of: “the electrical bonding 

subsystem.” This information is very limited and does not provide an adequate 
LIGHTNING ARC FINAL REPORT PAGE 55 

description of fuel tank lightning protection features especially if both fuel tank structures 

and systems lightning protection is adopted. 

 Section 2-4: Airplane Structural Analysis Procedure

This section identifies Structural Significant Items (SSI) based on their 

contribution to carrying flight, ground, pressure and control loads. Structural 

components are evaluated for susceptibility to Accidental Damage (AD), 

Environmental Damage (ED) and Fatigue Damage (FD) when deriving the 

maintenance tasks. There is presently no reference to fuel tank lightning 

protection features. 

The Lightning ARC did not identify any means to use this section for evaluation 

of fuel tank lightning protection features. 

 Section 2-5: Zonal Analysis Procedure

The airplane is divided internally and externally into zones. Structures and 

systems located within each zone are evaluated for likelihood to AD and ED. 

Standard zonal analysis derives tasks where only general visual inspections (GVI) 

are adequate to check for security and general condition. Enhanced zonal analysis 

(EZAP) applied to areas which contain wiring and have potential for combustible 

material being present. 

The Lightning ARC determined that this section could be used to derive GVI of 

fuel tank lightning protection features provided the required task meets the criteria 

to become a GVI and provided the GVI is an adequate task to check for security 

and general condition. For example, this section may be appropriate to specify a 

GVI for structural conditions that may have lightning implications. In addition, 

the EZAP applied to areas which contain wiring may be appropriate to derive 

tasks and inspections for wiring located within the fuel tank. 

 Section 2-6: Lightning/High Intensity Radiated Fields (HIRF) Analysis Procedure

This section identifies lightning/HIRF protection systems and components such as 

wire shielding, pigtail terminations, backshells, bonding straps, raceways, metallic 

meshes, conductive gaskets, and conductive coatings. Protection components are 

evaluated for likelihood to AD and ED and asks the question,” Will the failure 

condition due to the expected degradation in combination with a Lightning/HIRF 

event prevent the continued safe flight and landing of the aircraft?” There is 

presently no specific reference or examples associated with fuel tank lightning 

protection features. 

The ARC determined that this section could be used to derive maintenance tasks 

and intervals since the basis of the analysis in this section evaluates the 

components for susceptibility to AD and ED. However, section 2-6 would require 

significant changes since there is presently no specific reference or examples 

associated with fuel tank lightning protection features. In addition, the analysis 
LIGHTNING ARC FINAL REPORT PAGE 56 

process would have to be revised for a fault tolerant lightning protection design 

requirement. 

3.5.2 Findings 

The Lightning ARC identified a number of findings during the assessment of criteria 

associated with continued airworthiness which could improve and promote a consistent 

approach to ICA for fuel tank lightning protection. 

 Adopt a definitive approach to continued airworthiness where inspections and 

procedures for non-fault tolerant features would be included in the Airworthiness 

Limitations section of the instructions for continued airworthiness required by 

Sec. 25.1529, and inspections and procedures for fault tolerant designs may utilize 

sampling programs or task developed through the MRB process. 

 The use of visible means for identifying lightning protection features is 

impractical. 

The ARC identified a number of findings related to potential modifications to ATA 

MSG-3[20]. Revisions could be incorporated into Section 2-3, Section 2-6 or into a new 

Section 2-X dedicated to fuel tank lightning protection. Any specific modifications to the 

MSG-3[20] document would require specialists in the MSG-3[20] logic process along with 

the support of fuel tank lightning protection specialists. 

 The existing note contained in ATA MSG-3[20] Section 2-3-4, 

Systems/Powerplant Analysis Procedure, regarding “fault tolerant systems”

discourages the use of this analysis process where fault tolerant designs are 

required for certification. If this section were to be used, this information would 

require revision for fuel tank lightning protection as a result of fault tolerant 

design being implemented. 

 The note added to ATA MSG-3[20] section 2-3-1, Systems/Powerplant Analysis 

Procedure, in 2005 refers to “lightning protection of the fuel tank system” and 

references the one example of, “...the electrical bonding subsystem.” This 

information would require revision to identify additional examples for both fuel 

tank structures and systems lightning protection, or deletion if a new section 2-x 

were to be used. 

 ATA MSG-3[20] section 2-3, Systems/Powerplant Analysis Procedure, would 

require revision if used to develop ICA for a fault tolerant fuel tank lightning 

protection design, to provide additional information and examples on the most 

appropriate method of using the analysis in this section. This includes 

information and clarification regarding “Function”, “Functional Failure” and 

“Failure Effect”; as well as information and clarification to ensure the MSG-3[20]

user understands the logic questions such as the Level 1 Question 3. 
LIGHTNING ARC FINAL REPORT PAGE 57 

 ATA MSG-3[20] section 2-6, Lightning/High Intensity Radiated Fields Analysis 

Procedure, would require significant revision to include fuel tank lightning 

protection features supported with examples and a dedicated process flowchart 

and to ensure appropriate tasks can be derived for a fault tolerant lightning 

protection design. 

 A new ATA MSG-3[20] section 2-x, Fuel Systems Lightning Protection, could be 

prepared to develop ICA for fuel tank lightning protection features supported with 

examples and a dedicated process flowchart and to ensure appropriate tasks can 

be derived for a fault tolerant lightning protection design. This approach is 

preferred by the Lightning ARC as extensive rewording to the other sections 

would likely cause difficulty for other uses. 
LIGHTNING ARC FINAL REPORT PAGE 58 

3.6 Task 8 

Consider the effect of reducing the flammability below the criteria of § 25.981(b), 

Amendment 25-125, in adjusting the other tasks listed above. 

3.6.1 Evaluation of the Issue 

With the release of the Fuel Tank Flammability Reduction Rule at Amendment 25-125[6], 

two distinct levels of flammability criteria have been established: those pursuant to the 

standard set in § 25.981(b) & (b)(1), as defined by Appendix N to Part 25, and those 

pursuant to the higher standard set in § 25.981(b)(2), as defined in Appendix M to Part 

25. It is these new flammability reduction standards that FAA Policy Memorandum 

ANM-112-08-002[10] uses as a basis for allowing alternate requirements for the ignition 

prevention standards of § 25.981(a)(3) applied to fuel tank lightning protection. 

In considering the effect of reducing the flammability below the Amendment 25-125[6]

criteria, the impact on each of the previous Lightning ARC tasks was examined. 

Effects of Further Flammability Reduction 

1. Impact to Task 1 

Task 1 was to determine whether the approach to fuel tank safety related to 

lightning protection should be focused on fuel vapor ignition, ignition sources, or 

a combination of both. Prior to the 2001 Amendment 25-102[5] revision to 

§ 25.981, fuel tank ignition protection was based solely upon ignition source 

prevention. In the preamble to the Fuel Tank Flammability Reduction Rule, as 

well as in FAA Policy Memorandum ANM-112-08-002[10], FAA stated the 

following: 

“Predicting the effectiveness of ignition prevention actions is challenging, 

since many ignition sources are the result of human error, which cannot 

be precisely predicted or quantitatively evaluated. Despite extensive 

efforts by the FAA and industry to prevent ignition sources, we continue to 

learn of new ignition sources. Some of these ignition sources are 

attributable to failures on the part of engineering organizations to identify 

potential ignition sources and provide design changes to prevent them. 

Others are attributable to actions by production, maintenance, and other 

operational personnel, who inadvertently compromise wiring and 

equipment producing ignition sources. Regardless of the causes, we 

believe that ignition prevention actions, while necessary, are insufficient 

to eliminate ignition sources.” 

The same inherent limitations found in the design, production, maintenance, and 

operation of a protection means based solely upon ignition source prevention, 

would exist for a design based solely on a Flammability Reduction Means (FRM). 

Just as it is not practical to eliminate all potential ignition sources, it is not 

practical to eliminate all possible failure conditions which could contribute to 

flammability exposure. The overall efficacy of the FRM is dependent not only 
LIGHTNING ARC FINAL REPORT PAGE 59 

upon its own performance, but also its reliability and the reliability of the systems 

supporting the FRM, such as electrical power, and pressurized air systems. A 

design based entirely on precluding flammability would require a flight critical 

means of flammability control. Achieving flight critical availability requires 

levels of redundancy which render the system impractical. A top level 

requirement based upon a balance of both flammability reduction and ignition 

source prevention is the practical solution, as found in Task 1. 

2. Impact to Task 2

Task 2 was to determine whether the lightning protection regulation changes 

should apply to the complete fuel system or just to the fuel tank structure. The 

ARC did not identify any potential impact that additional flammability reduction 

would have on whether the same lightning protection regulation changes should 

apply to the complete fuel system (systems and structure), or just the fuel tank 

structure. 

3. Impact to Tasks 3, 4, & 5

Tasks 3, 4 and 5 were to: 

Task 3 was to determine what type of safety assessment approach should be 

used. 

Task 4 was to determine whether a probabilistic approach, prescriptive 

pass/fail criteria, or a combination of both using qualitative analysis, should 

be applied to structure or the complete fuel system lightning protection. If a 

probabilistic approach is used, determine if flammability exposure should be 

considered. Determine how single failures should be addressed. 

Task 5 was to establish which components and installations must be addressed 

and which failure modes (including possibility of cascading failures) should 

be considered. 

The reduction of fuel tank flammability beyond the established criteria could 

impact the determination of the appropriate fuel tank lightning protection safety 

assessment method. Flammability exposure would need to be considered in the 

analysis if credit for additional reduction were sought by an applicant. If such a 

reduction were practically established, this could potentially affect the finding of 

Task 3, 4 and 5 regarding the requirement to demonstrate fault tolerance. 

To achieve an equivalent level of enhanced lightning protection, replacing the 

recommended requirement to demonstrate fault tolerance would have to be 

justified by an equivalent increase in the prevention of flammability. As 

discussed in Tasks 3, 4 and 5, a robust means of providing fault tolerance would 

mean the probability of a failure being present would be rare (e.g. less than 1 in 

1000). Therefore, an equivalent decrease in the flammability exposure would 

mean the capability of the FRM would have to increase by multiple orders of 

magnitude. This would require not only lower flammability levels from the 
LIGHTNING ARC FINAL REPORT PAGE 60 

performance of the FRM design, but also an increased criticality of the operation 

of the FRM throughout the lifetime of the airplane. The availability of the FRM 

is dependent upon both the reliability of the FRM components, and the significant 

number of systems and subsystems which support or affect the FRM operation. 

Based upon technology available today, a far more capable FRM is not feasible. 

Although the ARC did not do extensive studies of FRM which was outside the 

scope of the committee, the experts familiar with FRM know of no system 

currently available which they believe could demonstrate this level of 

flammability prevention. 

4. Impact to Task 6 & 7

Task 6 was to determine a means to address manufacturing variability, aging, 

wear, corrosion and likely damage to lightning protection features. 

The Lightning ARC reviewed Task 6 and found that further reduction of 

flammability exposure would not alter the means to address manufacturing 

variability, aging, wear, corrosion, or likely damage to the lightning protection 

designs. 

Task 7 was to determine criteria associated with instructions for continued 

airworthiness and any needed modifications to processes defined in Revision 3 to 

the Maintenance Steering Group (MSG-3)[20] document. 

The Lightning ARC reviewed the finding of Task 7, and did not find that the 

recommended criteria associated with determination of whether inspections were 

needed (and the associated maintenance intervals if required) would be based 

upon an assessment including the flammability exposure levels. The only impact 

the ARC identified that further flammability reduction might have on Tasks 6 and 

7, would be if the recommendation for providing fault tolerance was replaced 

entirely by lower flammability exposure requirements. Given that this was not 

found to be practical above, the ARC found no impact on Tasks 6 and 7 if 

flammability exposure were reduced below Amendment 25-125[6]. 

3.6.2 Findings 

The Lightning ARC found that further reduction in flammability exposure beyond that of 

§ 25.981(b) Amendment 25-125[6] would not affect the findings of Task 1. A balance of 

both flammability reduction and ignition source prevention is the practical solution. 

Absolute prevention of flammability exposure is not feasible with current technology, nor 

recommended as an only means of protection. 

The Lightning ARC found that flammability exposure had no impact on Task 2 regarding 

whether regulation changes should apply to the complete fuel system (systems and 

structure), or just the fuel tank structure. 
LIGHTNING ARC FINAL REPORT PAGE 61 

The Lightning ARC found that a further reduction in flammability exposure might affect 

the safety assessment approach used (numerical assessment vs. prescriptive 

requirements). However, for a further reduction in flammability exposure to allow a 

reduction in the recommended ignition source prevention means (i.e. replacing the Task 

3, 4 and 5 recommendation for demonstrating fault tolerance), a far more capable FRM 

would have to be available. This level of flammability prevention is not available today, 

nor does it appear to be practical in the near term. Accommodating different levels of 

ignition source prevention based upon different levels of flammability exposure would 

result in multiple tiers of compliance criteria and increased complexity in the regulation. 

Therefore, the Lightning ARC found that the regulation changes should not include 

different ignition source requirements based upon the potential for further reduction in 

flammability exposure beyond 25.981 Amendment 25-125[6]. Based upon this finding, 

no impact to Tasks 3, 4 or 5 were identified. 

Regarding any impact of Task 6 and 7, the Lightning ARC found that further reduction of 

flammability exposure would not alter the means to address manufacturing variability, 

aging, wear, corrosion, or likely damage to the lightning protection designs, nor the 

criteria or processes associated with the determination of whether inspections were 

needed. 
LIGHTNING ARC FINAL REPORT PAGE 62 

3.7 Task 9 

Identify compliance guidance that might be required to facilitate showing 

compliance with the recommendations above. 

3.7.1 Evaluation of the Issue 

The evaluation of potential changes to compliance material is based on the following 

summarized findings /recommendations of Tasks 1 through 8: 

 Prevention of fuel vapor ignition due to lightning strikes should be the 

overarching requirement of the future rulemaking. 

 Fuel systems as well as tank structures should be addressed by the same rule. 

 A prescriptive approach of fault tolerant protection designs should be adopted (for 

both systems and structures), coupled with existing flammability requirements. 

The guidance material presently provided in AC 25.981-1C[27] and AC 20-53B[3] will 

need to be updated. Specific findings related to updating of the advisory circulars and 

other guidance materials are provided in the following paragraphs. The ARC also found 

many updates to these ACs are needed even if no changes to the regulations were 

implemented, to reflect the current regulation interpretations and the 2009 FAA Policy 

Memorandum ANM-112-08-002[10].

Updated guidance material should address the following topics: 

 Means to evaluate the fuel tanks and system designs. This would include 

guidance for identifying possible failure modes and evaluating practical fault 

tolerant features by test. Also guidance should be provided on evaluation of fault 

tolerance for conducted currents in all areas, whereas fault tolerant protection for 

direct attachment would only need to be demonstrated for Zone 1 and 2 areas. 

Guidance material will need to be provided so that this process can be 

consistently applied. 

 Means to identify and assess the potential for ignition sources within fuel tanks 

and systems attributable to failures either by engineering design errors or potential 

design changes after initial release. The lightning-related potential ignition source 

design features described in Section 7 of AC 25.981-1C[27] should be deleted from 

AC 25.981-1C[27] and brought into a revised AC 20-53. Additionally, the 

discussion of lightning related arcs and sparks in Section 8b of AC 25.981-1C[27]

should be deleted from that AC and brought into a revised AC 20-53. 

 Means to identify and assess manufacturing variability, aging, wear, corrosion or 

likely damage, including actions by production, maintenance, and other 

operational personnel which could inadvertently compromise wiring, equipment 

and other means used to provide fuel tank lightning protection. 

 Means to identify and assess the adequacy of potential non fault tolerant designs. 
LIGHTNING ARC FINAL REPORT PAGE 63 

 Address both conventional aluminum and composite fuel tank structures. 

 Address inspection and maintenance procedures for lightning protection features. 

FAA AC 20-53B - Protection of Airplane Fuel Systems Against Fuel Vapor Ignition 

Caused by Lightning

AC 20-53B[3] provides a reasonable format to address the above listed topics. It presently 

advises applicants to define requirements for maintaining and monitoring the “dedicated 

lightning protection devices or techniques” to ensure their integrity remains intact, and 

the dispatch requirements when a protective device has degraded. But it does not address 

other potential fault conditions in the tank structure or systems. Guidance on how to 

identify and treat potential fault conditions also needs to be provided in a revision of this 

AC. The steps to showing compliance in AC 20-53B[3] would need to be revised to 

address any changes that are made to the regulations. 

AC 25.981-1C[27] - Fuel Tank Ignition Source Prevention Guidelines 

AC25.981-1C[27] presently describes potential ignition sources due to lightning strikes. 

Any of this material that is specifically related to lightning should be brought into a 

revised AC 20-53 as noted more specifically above. The lightning protection design 

guidance presently contained in Section 9 of AC 25.981-1C[27] should be relocated to new 

documents containing additional design guidance as noted below.

Additional Guidance Material on Fault Tolerance

The ARC found that additional guidance regarding designing for fault tolerance of tank 

structures and systems, identifications of potential failure conditions and dealing with 

non-fault tolerant designs, may be helpful but beyond the scope of a revised advisory 

circular. It is recommended that FAA request the SAE AE-2 and EUROCAE WG31 

Lightning Committees to develop this guidance. Lightning protection guidance already 

within Section 9 of AC 25.981-1C[27] can be included in the new guidance documents. 

The additional guidance should address: 

 Examples of the potential failures which need to be considered, especially failures 

in non-fault tolerant features. 

 Guidance on identifying other failure modes not listed in the examples. 

 Checklist for reviewing designs and ensuring compensating features to provide 

fault tolerance are provided. 

 Mitigation for protection features which cannot be practically designed to be fault 

tolerant. 

 How multiple protection features can support fault tolerance with consideration of 

cascading types of failure modes. 
LIGHTNING ARC FINAL REPORT PAGE 64 

Testing Guidance

Existing lightning test methods in SAE ARP5416[22] are adequate for assessing lightning 

protection performance, but do not describe details on how to determine fault tolerance, 

or ignition source thresholds. Additional guidance on test methods for fuel tank lightning 

protection should address: 

 Details for how to select and configure tests using the present standard test 

methods to show that an ignition source will not occur at lightning conducted or 

induced current levels within the tank or system. 

 Definition of test samples in order to include combinations of failure modes / 

tolerance limits. 

Maintenance and Inspection 

Specific changes have been proposed for ATA MSG-3[20] to determine maintenance tasks 

and intervals. Recommendations are presented in detail in Section 3.5.2. 

3.7.2 Findings 

The ARC has identified a need for revision of AC 20-53B[3] and AC 25-981-1C[27]. 

The ARC found that AC 20-53B[3] provides a reasonable baseline for incorporating the 

recommendations of the ARC, including the identification of potential ignition source 

threats, demonstration of fault tolerance of protection means, and the evaluation of both 

systems and structures under a common set of requirements. 

Revisions to AC 25.981-1C[27] would be needed primarily to remove references regarding 

compliance for lightning protection under § 25.981. 

We recommend development of Users Manuals [by SAE AE-2 & Fuel Specialists] which 

will provide the detailed guidance on how to identify failure modes, address fault 

tolerance, and on testing approaches. This Users Manual may incorporate applicable 

portions of the recent AE-2 guidance regarding the FAA Policy Memorandum ANM112-08-002[10] and the current AC 20-53A Users Manual. 

Additional guidance material to be used with industry documents SAE ARP5416[22] and 

EUROCAE ED-105 to provide details on test approaches to assess fault tolerance and to 

determine ignition source thresholds. 

Revisions to ATA MSG-3[20] to include maintenance tasks & inspections for fuel tank 

lightning protection features. 
LIGHTNING ARC FINAL REPORT PAGE 65 

4.0 DISCUSSION OF FINDINGS 

This section examines the findings of the chartered tasks, how they relate to each other 

and how in combination they form the overall recommendations of the Lightning ARC. 

In the background section of the ARC charter, FAA identified the primary problem with 

the current application of the rule, as the inability of the designer to meet the goal of a 

fail-safe design. The term fail-safe was interpreted as being the prevention of all ignition 

sources within the fuel tank. Industry found this to be problematic in at least three areas: 

1. Providing a third layer of protection to mitigate latent failure conditions is 

impractical. 

2. It is impractical to continuously monitor lightning protection features to identify 

failures. 

3. There is limited capability to inspect and detect failures to minimize the time that 

the failures are latent. 

As a result of these issues and others, FAA established the Lightning ARC with the goal 

of achieving a balanced approach for fuel tank lightning protection to prevent 

catastrophic fuel vapor ignition. Both FAA and industry understand that the elimination 

of all ignition sources is impossible. Therefore, the ARC was tasked to develop an 

acceptable level of safety that would allow manufactures to develop designs that are as 

free of ignition sources as practical, while using current technology in designs which are 

economically viable in terms of design, manufacture and operation. In addition, FAA 

tasked the Lightning ARC to consider fuel vapor flammability in developing a design to 

achieve an acceptable level of safety. 

FAA assigned the Lightning ARC nine separate tasks. Though separate, each of the tasks 

are interrelated to the prevention of a catastrophic fuel vapor ignition resulting from the 

airplane being struck by lightning. The Lightning ARC studied the tasks, both 

individually and collectively, and developed recommendations through Lightning ARC 

consensus. 

In § 25.981(a)(3), the applicant must prevent ignition sources, assuming that the fuel tank 

ullage is always flammable. The applicant must also limit fuel tank flammability, 

because of the concern that ignition sources could still occur. The requirements of 

§ 25.981(a) result in a need to provide dual fault tolerant structural lightning ignition 

sources protection, which has proven to be impractical. The ARC found that while 

providing dual fault tolerant ignition source prevention is not possible, by addressing the 

top level event, that is, fuel vapor ignition, an acceptable level of safety can be achieved. 

The Lightning ARC found that tank flammability is independent of the lightning 

protection. The Lightning ARC reviewed the flammability standard established by 

§ 25.981(b), and concluded that it adequately limits this aspect of a potential fuel tank 

lightning-related fuel vapor ignition. These existing flammability limits can be 

considered when developing a practical approach for fuel tank lightning protection 
LIGHTNING ARC FINAL REPORT PAGE 66 

regulations that prevent fuel vapor ignition by focusing on potential ignition sources due 

to lightning. 

The Lightning ARC charter stated the goal of producing a design “as free of ignition 

sources as possible”. The ARC determined that a prescriptive fault-tolerant approach for 

fuel system lightning protection is practical and economically viable using current 

technology. The prescriptive fault-tolerant approach, when coupled with a lightning 

hazard assessment, as opposed to a probabilistic risk assessment approach, emphasizes 

effective and reliable lightning protection. At the same time, the prescriptive faulttolerant approach uses techniques that have been proven through an outstanding history 

and safety record for transport airplane lightning protection. The prescriptive faulttolerant approach using a hazard assessment allows for the most effective and economical 

method of addressing potential failures due to manufacturing variability, aging, wear, 

corrosion and likely damage. 

The probabilistic risk assessment approach imposed by the current rule and the FAA 

Policy Memorandum ANM-112-08-002[10] was also fully examined. However, the data 

required to make a probabilistic risk assessment is not available for structural failures and 

the Lightning ARC does not see a path forward that would make reliable failure rate data 

available. This point was made and rejected during the comment period for the policy, 

though the final policy still did not provide any method or guidance on how this data 

would be gathered. To further the evaluation of this issue, the Lightning ARC convened 

a group of structural specialists who determined that a probabilistic risk assessment 

approach for structural failures is not practical and that there are too many variables in 

structural designs to make that approach practical. The Lightning ARC concurs and does 

not recommend the use of a probabilistic risk assessment approach. 

FAA required the probabilistic risk assessment in the policy to deal with situations where 

fault tolerance can not be achieved, such as structural cracks and broken bolts which 

could also damage a fault tolerant layer of sealant. This has proven to be one of the most 

significant issues of the current rule and FAA Policy Memorandum ANM-112-08-002[10]. 

The Lightning ARC concluded, supported by the structural sub-group report, that nonfault tolerant designs associated with structural cracks and broken bolts within aluminum 

fuel tanks do not represent a significant risk and do not justify the economic burden 

and/or technical complexity required to further reduce their improbability. 

Based upon the review of all available history, data and experience of both the structural 

and the lightning specialists, the Lightning ARC found that these threats are adequately 

mitigated through design, process controls and manufacturing techniques necessary to 

comply with existing structural regulations. The data also showed that even if a rare nonfault tolerant failure occurs, the failures are not in and of themselves a single failure 

leading to a catastrophic event. These failures must exist in combination with the 

independent factors of lightning attachment to the airplane, attachment near the non-fault 

tolerant condition, a lightning current of sufficient amplitude and flammable conditions 
LIGHTNING ARC FINAL REPORT PAGE 67 

The Lightning ARC believes this is also true in regard to composite fuel tanks. However, 

it is generally understood that composite fuel tanks will typically require more features 

and result in greater variability in lightning protection performance than aluminum fuel 

tank designs. Currently, the maturity of the technology associated with composite tank 

designs have resulted in some difficultly in providing fault tolerant designs under some 

conditions. However, it is the opinion of the Lightning ARC that with continued 

technology development and maturity of industry knowledge related to variability and 

failures of lightning protection in composite designs, fault tolerant designs will become 

practical for all conditions. Therefore the Lightning ARC finds that these composite 

design challenges today should not influence the other safety assessment 

recommendations. 

The Lightning ARC also studied the differences between structural lightning protection 

and systems lightning protection. The Lightning ARC found the lightning environment, 

means of assessment and means of protection did not support a need for different 

lightning requirement for systems. The Lightning ARC found that an acceptable level of 

safety can be achieved in both structures and systems lightning protection by a robust 

fault tolerant design when considering fuel tank flammability and the likelihood of 

lightning attachment. The Lightning ARC concluded the availability of means to 

implement additional layers of protection for systems is not justification for more 

stringent requirements compared to fuel tank structure. The additional design complexity 

that would result from additional layers of protection will have no commensurate safety 

benefit and may introduce unforeseen negative safety consequences. The Lightning ARC 

concluded the revised regulations should address both fuel tanks structure and systems

with the same requirements. 

The Lightning ARC concluded that the practical way to address the effects of 

manufacturing variability, aging, wear, corrosion and likely damage of lightning 

protection features is an approach that utilizes reliable design practices, manufacturing, 

quality and process controls along with instructions for continued airworthiness (ICA). 

Since likely damage was considered a significant finding within the AFSSP[17] and 

usually occurs during maintenance activity, the Lightning ARC concluded that Caution 

information associated with critical lightning ignition source prevention features should 

be incorporated directly into the maintenance documentation used by maintenance 

personnel including the AMM, the SRM and manuals that provide maintenance personnel 

with standard practices such as standard wiring practices. The requirement for Caution 

should be used in lieu of CDCCLs as prescribed in § 25.981. The Lightning ARC 

determined that Caution information for critical lightning protection features should be 

incorporated into instructions for continued airworthiness required by § 25.1529. These 

Cautions should include information that will minimize likely and accidental damage to 

critical lightning ignition source prevention features, during performance of maintenance, 

alteration, or repairs. 

The Lightning ARC concluded that the wording in § 25.981 (d) regarding “visible 

means” to identify critical features of the design is not considered practical for lightning 
LIGHTNING ARC FINAL REPORT PAGE 68 

protection features due to the multitude of protection features including fasteners, sealant 

as well as insulating and conducting interfaces. 

The Lightning ARC determined that a more definitive approach to continued 

airworthiness is warranted where inspections and procedures for non-fault tolerant 

features should be included in the Airworthiness Limitations section of the instructions 

for continued airworthiness required by § 25.1529. Inspections and procedures for fault 

tolerant designs may utilize sampling programs or the MRB process. A modified MSG3[20] process may be one means to derive the maintenance tasks. A more definitive 

approach will avoid the confusion associated with the “as necessary” terminology of 

§ 25.981 and together with a reliable, fault tolerant design will minimize the need for fuel 

tank entries. 

The Lightning ARC determined that the ATA MSG-3[20] process can be successful in 

developing instructions for continued airworthiness of fuel tank lightning protection. As 

outlined in the findings, changes to MSG-3[20] would be required. Revisions could be 

incorporated into Section 2-3, Section 2-6 or into a new Section 2-X dedicated to fuel 

tank lightning protection. 

The ARC concluded that additional flammability reduction is not warranted. While there 

might be a slight numerical benefit to further reduction of flammability beyond the 

established criteria, there is no practical means with current technology to provide a 

flammability reduction of sufficient magnitude to justify a reduction in ignition source 

prevention requirements. The ARC found that a design as free of ignition sources as 

practical can be achieved with a prescriptive fault tolerant design. When combined with 

the current flammability requirements, a significant benefit from further flammability 

reduction could only be achieved if it were sufficient to justify a design which would be 

completely non-fault tolerant for ignition sources. Since no practical means exist for this 

significant of a reduction in flammability, the ARC concluded that it is inappropriate to 

propose adding complexity to the rule to provide for multiple levels of ignition source 

requirements. Proposed fault tolerant ignition source requirements combined with the 

existing flammability criteria will provide the desired overall level of fuel tank safety. 

Finally, the ARC looked at the guidance that is currently available to the lightning 

specialist in regard to the current rule as well as guidance that will needed based on the 

ARC recommendations. As discussed in the findings, the guidance for fuel tank and 

system lightning protection is currently inadequate and will require update, regardless of 

what FAA chooses to implement from the ARC findings and recommendations. 
LIGHTNING ARC FINAL REPORT PAGE 69 

5.0 RECOMMENDATIONS 

The Lightning ARC Recommends: 

1. Prevention of fuel vapor ignition due to lightning should be the objective of the 

regulations, achieved through both flammability control and ignition source 

prevention. Existing Part 25 regulations provide adequate flammability 

requirements. Thus, lightning-specific requirements should focus on ignition 

source prevention. 

2. Both structure and systems should be addressed in the same fuel system lightning 

protection rule with the same requirements. 

3. A prescriptive approach requiring single fault tolerant designs should be 

mandatory. If fault tolerance is impractical, a qualitative assessment, such as the 

Lightning Hazard Assessment recommended in SAE ARP5577[12], should be 

conducted to ensure that the combination of non-fault-tolerant failures resulting in 

an ignition source is remote. 

4. Manufacturing variability, aging, wear, corrosion and likely damage should be 

addressed by design, manufacturing processes and/or by instructions for 

continued airworthiness (ICA). 

5. Caution information for critical lightning protection features should be 

incorporated into instructions for continued airworthiness to minimize accidental 

or likely damage to these features during performance of maintenance, alteration 

or repairs. 

6. Inspections and procedures required for non-fault-tolerant designs should be 

included in the Airworthiness Limitations section of the instructions for continued 

airworthiness, whereas fault tolerant designs should utilize tasks developed by the 

MRB or a sampling program where appropriate. 

7. Changes should be made to Air Transport Association (ATA) Maintenance 

Steering Group (MSG) document MSG-3[20] to support instructions for continued 

airworthiness for fuel tank lightning protection. Addition of a new section 

specific to fuel tank lightning protection is recommended. 

8. No requirement for lower flammability should be included in the lightning 

regulations. 

9. New guidance material should be developed and existing guidance material 

should be revised to ensure a consistent approach to fuel system lightning 

protection is applied across industry. 
LIGHTNING ARC FINAL REPORT PAGE 70 

Proposed Rulemaking: 

The Lightning ARC recommends §§ 25.954, 25.981and Appendix H be revised to read as 

follows: 

§ 25.954 Fuel system lightning protection. 

(a) The fuel system must be designed and installed to prevent catastrophic fuel 

vapor ignition due to lightning. 

(b) The fuel system lightning protection design must be fault-tolerant for failures 

that result in lightning-related ignition sources. 

(c) Fault tolerance is not required for any specific design feature if: 

(1) providing fault tolerance is shown to be impractical for that feature, 

and 

(2) the failures that lead to lightning-related ignition sources from that 

feature and all other non-fault-tolerant features, when combined, are 

shown to be remote. 

(d) Inspections or other procedures must be established as required by Sec. 

25.1529 to prevent development of lightning-related ignition sources within the 

fuel tank system pursuant to paragraphs (b)(c) of this section. Caution 

information for critical lightning protection features shall be incorporated into 

instructions for continued airworthiness required by Sec. 25.1529 to minimize 

accidental or likely damage to these features during performance of maintenance, 

alteration or repairs. Required inspections and procedures for non-fault-tolerant 

features in paragraph (c) of this section must be included in the Airworthiness 

Limitations section of the instructions for continued airworthiness required by 

Sec. 25.1529. 

§ 25.981 Fuel Tank Ignition Prevention 

(a) No ignition source may be present at each point in the fuel tank or fuel tank 

system where catastrophic failure could occur due to ignition of fuel or vapors. 

This must be shown by: 

(3) Except for ignition sources due to lightning subject to Sec. 25.954, 

demonstrating that an ignition source could not result from each single 

failure, from each single failure in combination with each latent failure 

condition not shown to be extremely remote, and from all combinations of 

failures not shown to be extremely improbable. The effects of 

manufacturing variability, aging, wear, corrosion, and likely damage must 

be considered. 
LIGHTNING ARC FINAL REPORT PAGE 71 

§ H25.x Fuel System Lightning Protection Instructions for Continued 

Airworthiness 

(a) The applicant must prepare Instructions for Continued Airworthiness (ICA) 

applicable to fuel system lightning protection including the following: 

(1) Mandatory maintenance or inspections necessary to preclude the 

development of unsafe conditions due to non-fault tolerant lightning 

protection features shall be identified as Airworthiness Limitations and 

approved by the Administrator. 

(2) Sampling programs, maintenance and/or inspections for fault tolerant 

lightning protection features, included in the manufacturer’s recommended 

airplane maintenance program and acceptable to the Administrator. 

(3) Caution information which identifies the lightning protection features 

of the fuel system design, to minimize the potential for inadvertent 

damage or disruption of lightning protection features, included in the 

applicable airplane maintenance documents and acceptable to the 

Administrator. 

In addition to the above rulemaking language, the Lightning ARC also recommends that 

the preamble of the rulemaking should clarify that fuel system lightning protection be 

excluded from rules of general applicability such as §§ 25.901 and 25.1309. 

Guidance that is Required to Accompany the Proposed § 25.954 Revision: 

The same fuel tank lightning protection requirements apply to both fuel tanks structure 

and systems. 

As defined in AC 25.1309 Arsenal version paragraph 5.B.2, Qualitative Probability 

Terms, “remote failure conditions are those unlikely to occur to each airplane during its 

total life, but which may occur several times when considering the total operational life 

of a number of airplanes of the type.” 

Structural cracks or broken fasteners that are due to overstress, fatigue or manufacturing 

escapes, while potentially probable for an airplane, are remote failures when considering 

lightning-related ignitions sources for airplanes that meet the Part 25 regulations for 

structural integrity, fatigue, and damage-tolerance. This is because lightning must attach 

in the specific vicinity of the structural crack or broken fastener and/or be of sufficient 

amplitude to cause sparking. 

Determining the combined probability of remote non-fault tolerant conditions is intended 

to be supported by qualitative assessment utilizing knowledgeable engineering judgment 

and not intended to be a quantitative analysis. The qualitative assessment should 

consider the likelihood of the failures, the likelihood of other conditions necessary for the 

failure to result in an ignition source and any means utilized to ensure the combination of 

conditions will be unlikely. The assessment cannot include the likelihood of lightning 

attaching to the airplane or the flammability of the fuel tanks. It can include the 
LIGHTNING ARC FINAL REPORT PAGE 72 

likelihood of lightning current densities that would lead to an ignition source for that 

particular structural failure. 

The intent is to provide fault tolerance wherever practical, where practical is defined as a 

balance of available means and economic viability. A means to provide fault tolerance 

that is possible with little economic impact, is practical even if the conditions would be 

remote without them. However, if the means would have a significant economic impact 

on production, operational or maintenance costs, it is not necessary utilize these if it can 

be determined that the ignition source conditions would be remote. 

Evaluation of fault tolerance should include consideration failures due to aging, wear, 

corrosion and likely damage. Likely damage includes conditions that could be 

reasonably anticipated to occur in the life an individual airplane due to operation, 

scheduled and unscheduled maintenance. In addition, probable escapes in the production 

design process should be considered as probable failures. Probable failures must be 

assessed to show the combination of potentially related ignition sources is remote. 

Effectiveness of designs to provide fault tolerance to failures should be demonstrated 

utilizing industry testing practices in SAE ARP5416[22] and should be evaluated in 

combination with expected design variability (e.g. drawing tolerances). It should not be 

necessary to assume that all tolerances will be at worst case concurrently (that is, stacking 

of tolerances is not required). Drawing and process limits are considered part of the basic 

design and conditions within those limits are not failure conditions. 

Critical lightning protection features are those that are required to achieve a compliant 

design. Cautions should be developed for those critical lightning protection features that 

might not be obvious as lightning protection, to avoid inadvertent modification or 

damage during maintenance. Examples of these features will need to be described in the 

guidance material. 
LIGHTNING ARC FINAL REPORT PAGE 73 

6.0 REFERENCES 

[1] Pan American World Airways, Inc. Boeing 707-121, N709PA, near Elkton, Maryland, 

December 8, 1963, US Civil Aeronautics Board Aircraft Accident Report, No. 1-0015, 

March 3, 1965 ........................................................................................................... 9, 10 

[2] Wing Failure of Boeing 747-131, Near Madrid, Spain, May 9, 1976, US National 

Transportation Safety Board Special Investigation Report, NTSB-AAR-78-12, October 

6, 1978..................................................................................................................... 10, 25 

 [3] FAA Advisory Circular 20-53B, Protection of Aircraft Fuel Systems Against Fuel 

Vapor Ignition Caused By Lightning, June 5, 2006............ 11, 19, 20, 44, 50, 62, 63, 64 

[4] User’s Manual for AC-20-53A Protection of Airplane Fuel Vapor Ignition Due to 

Lightning, US Federal Aviation Administration, DOT/FAA/CT-83/3, October 1984. 11 

[5] Federal Register, Docket No. FAA–1999–6411; Transport Airplane Fuel Tank System 

Design Review, Flammability Reduction, and Maintenance and Inspection 

Requirements, Vol. 66, No. 88, May 7, 2001 .. 2, 5, 6, 11, 12, 14, 21, 24, 25, 38, 44, 46, 

50, 53, 58 

[6] Federal Register, Docket No. FAA–2005–22997, Reduction of Fuel Tank 

Flammability in Transport Category Airplanes, Vol. 73, No. 140, July 21, 2008.... 2, 7, 

12, 13, 14, 24, 25, 44, 46, 50, 53, 58, 60, 61 

[7] Exemption No. 9148, Regulatory Docket No. FAA-2007-27562, In the matter of the 

petition of Dassault Aviation for an exemption from §25.981(a)(3) at Amendment 25-

102 of Title 14, Code of Federal Regulations, April 20, 2007 ..................................... 12 

[8] Exemption No. 8761, Regulatory Docket No. FAA-2006-25156, In the matter of the 

petition of Raytheon Aircraft Company for a two year time limited exemption from 

§25.981, Amendment 25-102, of Title 14, Code of Federal Regulations, August 7, 2006

....................................................................................................................................... 12 

[9] Federal Register, Docket No. NM415; Notice No. 25–414–11–SC, Special 

Conditions: Boeing Model 787–8 Airplane; Lightning Protection of Fuel Tank 

Structure To Prevent Fuel Tank Vapor Ignition, Vol. 75, No. 225, November 23, 2010

....................................................................................................................................... 12 

[10] FAA Policy Memorandum ANM-112-08-002, Policy on Issuance of Special 

Conditions and Exemptions Related to Lightning Protection of Fuel Tank Structure, 

May 26, 2009 ...................... 12, 13, 14, 15, 18, 19, 21, 24, 35, 37, 39, 41, 58, 62, 64, 66 

[11] Fisher, Perala, Plumer........................................................................................... 17, 35 

[12] SAE ARP5577, Aircraft Lightning Direct Effects Certification, September 2002. 2, 7, 

23, 42, 69 

[13] FAA Advisory Circular AC 25.1309-1A, System Design and Analysis, 21 June 1988

....................................................................................................................................... 23 
LIGHTNING ARC FINAL REPORT PAGE 74 

[14] Lightning Ground Strikes, In-ServiceStrikes to Aircraft and Induced Pulse Threat 

Databases M.R. Vile and C.C.R Jones. FULMEN Deliverable D2.2 1997............... 25 

[15] Aircraft Lightning Interactions in Japan Murooka, Y. Japan-US Seminar on 

Lightning: Fundamental Aspects of Physics of Lightning Discharges, 1991............... 25 

[16] SAE ARP5412A, Aircraft Lightning Environment and Related Test Waveforms, 

February 2005 ............................................................................................... 9, 43, 10, 12 

[17] Aircraft Fuel System Safety Program Report, August, 2000, published by an industry 

group that included airplane manufacturers, airlines, industry organizations and 

regulatory authorities ................................................................ 28, 44, 45, 46, 48, 51, 67 

[18] J. A. Plumer and B. L. Perry, An Analysis of Lightning Strikes in Airline Operation in 

the USA and Europe, Proceedings of the 1975 Conference of Lightning and Static 

Electricity, December 1975 .......................................................................................... 40 

[19] Draft AC 25.1309-1X, System Design and Analysis, Arsenal draft dated June 2002

 41 

[21] SAE ARP55414, Aircraft Lightning Zoning, February 2005....................................... 9 

[22] SAE ARP5416, Aircraft Lightning Test Methods, March 2005........... 9, 17, 18, 64, 72 

[23] SAE Documents to Support Aircraft Lightning Protection Certification..................... 9 

[24] Exemption No. 10174, Regulatory Docket No. FAA-2009-1058, In the matter of the 

petition of The Boeing Company for an exemption from §25.981(a)(3) at Amendment 

25-102 of Title 14, Code of Federal Regulations, December 14, 2010........................ 12 

[25] Exemption No. 10175, Regulatory Docket No. FAA-2010-0287, In the matter of the 

petition of Bombardier Aerospace for an exemption from §25.981(a)(3) of Title 14, 

Code of Federal Regulations, December 14, 2010....................................................... 12 

[26] Exemption No. 10138, Regulatory Docket No. FAA-2009-1206, In the matter of the 

petition of Embraer for an exemption from §25.981(a)(3) at Amendment 25-102 of 

Title 14, Code of Federal Regulations, September 21, 2010........................................ 12 

[27] FAA Advisory Circular 25.981-1C, Fuel Tank Ignition Source Prevention 

Guidelines, September 19, 2008 ................................................................. 11, 62, 63, 64 

[28] ICOLSE 2003; Further Work on Lightning Ignition Hazards from Intermittent 

contacts in Aluminium Fuel Tanks. Haigh, I03-53-FUL-1.......................................... 43 

[29] FAA Advisory Circular 20-53A, Protection of Airplane Fuel Systems Against Fuel 

Vapor Ignition Due to Lightning, April 12, 1985 ......................................................... 44 
 LIGHTNING ARC FINAL REPORT APPENDIX A - PAGE 1 

APPENDIX A 

LIGHTNING ARC MEMBERSHIP 
 LIGHTNING ARC FINAL REPORT APPENDIX A - PAGE 2 

LIGHTNING ARC MEMBERSHIP 

Greg Dunn, FAA Chairman.................................. Federal Aviation Administration 

Massoud Sadeghi, FAA Chairman ....................... Federal Aviation Administration 

Billy Martin, Industry Chairman.................................................................... Cessna 

Peter Bootsma ........................................................................................ Bombardier 

Patrick Carver ..........................................................................................Gulfstream 

Howard Jordan, Document Editor ..............................................Hawker Beechcraft 

Rod Graham...................................................................................................Boeing 

Stephen Haigh..............................................................................................Cobham 

Helio Librantz ..............................................................................................Embraer 

M. Scott Montgomery, Lightning ARC Secretary......................................... Cessna 

Jean Patrick Moreau.....................................................................................Dassault 

Alan Pout ........................................................................................................Airbus 

Andy Plumer ............................................................... Lightning Technologies, Inc. 

Jack Schroeder ............................................................Lightning Diversion Systems 

Dave Walen........................................................... Federal Aviation Administration 

Dale Winter....................................................................................................Boeing 

Observers 

Yehia Elghawaby..........................................................................Transport Canada 

Patrick Mattei......................................................European Aviation Safety Agency 

Contributors 

Mike Dostert ......................................................... Federal Aviation Administration 

Johnny Hodges.........................................................................................Gulfstream 

Howard Simpson.............................................................................................Airbus 

Hideo Yamakoshi......................................................... Mitsubishi Heavy Industries 

Structures Sub-Committee 

Patrick Carver, Sub-Committee Co-Chairman ......................Gulfstream Aerospace 

Rick Jensen, Sub-Committee Co-Chairman .................................................. Cessna 

Steve Penn......................................................................................................Boeing 

Jeff Blank.......................................................................................................Boeing 

Jay Shoji.........................................................................................................Boeing 

Ian Won................................................................. Federal Aviation Administration 

Greg Schneider...................................................... Federal Aviation Administration 

Maurizio Molinari.........................................................................Transport Canada 

Rupert Wheeler ..............................................................................................Boeing 
 LIGHTNING ARC FINAL REPORT APPENDIX B - PAGE 1

APPENDIX B 

LIGHTNING ARC CHARTER 
 LIGHTNING ARC FINAL REPORT APPENDIX B - PAGE 2

U.S. DEPARTMENT OF TRANSPORTATION 

FEDERAL AVIATION ADMINISTRATION 

ARC Charter 

Effective Date: 

XXlXXl09 

SUBJ: Large Airplane Fuel System Lightning Protection Aviation Rulemaking Committee 

1. Purpose of this Charter. This charter creates the Aviation Rulemaking Committee (ARC) for 

Fuel System Lightning Protection according to the authority of the Administmtor of the Federal 

Aviation Administmtion (FAA) underseetion 106(p)(5) ofTitic 49 of the United States Code (49 

U.S.c. l06(p)(5)) . This charter also outlines the conunittee's organization, resJXmsibilities, and tasks. 

2. Audience. This charter applies to members of the I,arge Airplane Fuel System Lightning 

Protection ARC, including aviation industry organizations and employees within the Orficc of the 

Associate Administrator for Aviation Safety. The audience for this charter also includes 

employees of the Office of Chief Counsel and the Office of Aviation Policy and Plans. 

3. Where to Find this Charter. You can find this charter on the FAA website at 

http:/h,vw\v.faa.!lov/ahout/committeeslrulema]";ing! 

4. Background. Prior to Amendment 25-\ 02 to Title 14, Code of Fedeml Regulations 

(14 CFR) 25.981 , the lightning protection requirements for fuel tanks were contained in § 25.954. 

Section 25.954 applied to system components as well as airplane structure. That regulation required 

prevention of ignition of vapors in the fuel tank, but it did not take into account anticipated design 

failures, age, wear, or maintenance errors. 

a. In May 2001 the FAA issued Amendment 25-1 02. This amendment added specific ignition 

prevention requirements and a new flammability minimi:/.ation requirement to § 25.981. The 

amendment contained specific ignition prevention requirements in § 25.981(aX3) that included 

cOIL<;iderdtion of factors such as age, wear, and maintenance errors, as well as the existence of single 

tailures, combinations of failures, and latent failures, that might cause ignition sourccs in fuel tanks. 

TIlese requirclllt:nl'i applied to fud tank systems in addition to structural components offuet tanks. 

b. Systems with potentially catastrophic failure modes would typically meet the requirements of 

§ 25.981 (a)(3) by providing at least triple-redundancy in their protective features with periodic 

inspections, or dual-redundancy with continuous system monitoring, to reduce the latency period. 

Dual-redundant designs could only comply with § 25.981 (a)(3) when combined with either regular 

inspections at very short intervals or a monitoring device, to verify the functionality of the protective 

features. lnspe<.1ion of the various design features might be difficult or impossible if the leatLrre is 

covered by airframe structure. 

c. To prevent all sources of ignition in a fuel tank, the design had to be "fail-safe," meaning that 

hidden (latent) component failures should not cause an ignition source when combined with another 

failure. An acceptable design must provide a third protective design feature. As it applies to fuel tank 

lightning protection for ccrtain airfrdlne structures (airplane skins, joints, ribs, spars. stringers, and 

associated fasteners, brackets, and coatings), applicants have argued that both adding a third 

Inilialed By: ANM-III 
 LIGHTNING ARC FINAL REPORT APPENDIX B - PAGE 3

XXlXX/09 

independent protective feature and providing sufficient monitoring to detcct latent failures in a dualprotective feature are impmctical fix certain areas of airplane wing structure. Incorporating three 

independent hardware protective features to control structural ignition sources might become too 

expensive to produce and maintain using currently available technology. 

d. Confirming the continued efiectiveness of these design features is diflicult due to the 

impracticality of providing continuous monitoring of the features and the limited capability of 

inspecting the features. These desib'l1 features are typically integral to the fuel tank structure or 

internal to the fuel tanks. Inspection of design features inside fuel tanks requires access to the fuel 

tanks, which is usually only scheduled once or twice during the life of the airplane. Increa<;ing the 

frequency of internal fuel tank inspections could also increase the possibility of damaging the 

lightning protection features during the inspection proccss. Because of these issues. we issued two 

exemptions that were found to be in the public interest and are developing a special condition for 

another applicant with a composite fuel tank. 

e. We now believe it is appropriate to re-examine §§ 25.954 and 25.981 to address these and other 

issues that have surfaced during application of the requirements of Amendment 25-1 02 to the design 

of lightning protection offue! tanks. We wish to establish a balanced approach to ensure that airplane 

designs provide an acceptablc level of safety, while allowing manufacturers to use designs that are 

economically viable in tenns of design, manufacture, and operation. Rcgarding structural 

components, the new standards should require the applicant to develop a design a<; free of ignition 

sources as practical. In addition, the applicant must consider fuel vapor flanunability in developing a 

design with an acceptable level of safety. 

f. We issued policy number ANM- 112-08-002, "Issuance ofSpeeial Conditions and 

Exemptions Related to Lightning Protection of Fuel Tank Structure," on May 26, 2009, as a 

temporary means to address the above issues. This policy memo will remain in effect until 

rulemaking to address the practicality issues with § 25.98 I (a)(3) is completed. 

5. Organization and Administration of the Fuel System Lightning Protection ARC. We will set 

up a committee of members of the aviation community, including airplane lightning protection design 

specialists representing diverse viewpoints. FAA participation and support will come from all 

affected lines-of-business. Where necessary, the committee may set up specialized work groups that 

inelude at least one committee member and invited subject matter experts. 

a. The committee sJXJnsor is the Manager, Transport Airplane Directorate, who: 

(1 ) Appoints members or organizations to the committee, at his sole discretion; 

(2) Receives all committee recommendations and reports; 

(3) Selects industry and FAA co-chairpersons for the committee; and 

(4) Provides administrative support for the committee, through the Aircraft Certification 

Service. 

b. The co-chairpersons will: 

2 
 LIGHTNING ARC FINAL REPORT APPENDIX B - PAGE 4

XXlXXI09 

(1) Determine (with other committee members) when a meeting is required (a quorum is 

desirable at committee meetings, but not required); 

(2) Arrange notification to all members of the time and place of each meeting; 

(3) Draft an agenda for each meeting and conduct the meeting; 

(4) Keep meeting minutes; and 

(5) Provide status uJXIates to the Manager, Transport Airplane Directorate, at 6 months and 12 

months [rom the effective date of this charter. 

6. Committee Membership. The committee will consist of aboU120 members, representing airplane 

manufacturers, fuel tank lightning protection specialists, FAA and other aviation industry participants. 

Members will be selected based on their familiarity with fuel tank lightning protection, analysis and 

regulatory compliance. Membership will be balanced in viewpoints, interests. and knowledge of the 

committee's objectives and scope. Committee membership is limited to promote discussion. Active 

participation and commitment by members is essential for achieving the committee's objectives. 

Attendance is essential for continued membership on the conunittee. The committee may invite 

additional participants as subject matter experts to support specialized work groups. 

7. Public Participation. Persons or organizations outside the conunittee who want to attend a 

meeting must get approval in advance of the meeting from a committee co-chairperson or designated 

federal representative. 

8. Committee Procedures and Tasks. 

a. The committee advises and provides written recommendations to the Manager, Transport 

Airplane Directorate, ANM-l 00. 

b. Committee tasks include, but are not limited to, the following; 

(1 ) Detennining whether the approach to fuel tank safety related to lightning protection 

should be focused on fuel vapor ignition, ignition sources, or a combination of both. 

(2) Determining whether the lightning protection regulation changes should apply to the 

complete fuel system, or just to the fuel tank structure. 

(3) Determining what type of safety assessment approach should be used (e.g.; SAE 

Document ARP5577 or § 25.1309). Define content and procedures of the safety Hssessmcnt 

(4) Detennining whether a probabilistic approach, prescriptive pass/fail criteria, or a 

combination of both using qualitative analysis, should be applied to structure or the complete fuel 

system lightning protection. If a probabilistic approach is used, detennine if flammability exposure 

should be considered. Determine how single failures should be addressed. Detenninc what types of 

single failures are impractical to preclude. Finally, dctennine what probabilistic distribution of 

lightning amplitudes would be acceptable as an industry standard. 

3 
 LIGHTNING ARC FINAL REPORT APPENDIX B - PAGE 5

XXfXX109 

(5) Establishing which components and installations must be addressed and which failure 

modes (including possibility of cascading failures) should be considered. Determine if all foreseeable, 

likely, or a specific set of failures should be addressed in determining adequate structural lightning 

protection. If a probabilistic approach is used, determine the criteria that should apply for the 

standard. Identify acceptable data to support the safety analysis (e.g., supporting failure rates). 

(6) Determining a means to address manufacturing variability, age, wear, corrosion, and 

likely damage to lightning protection features. 

(7) Determining criteria associated with instructions for continued airworthiness and any 

needed modifications to processes defmed in Revision 3 to the Maintenance Steering Group (MSG-3) 

document. 

(8) Considering the effect of reducing the flammability below the criteria of § 25.981 (b), 

Amendment 25-125, in adj usting the other tasks listed above. 

(9) IdentifYing compliance guidance that might be required to facilitate showing compliance 

with the recommendations above. 

C. The committee may propose additional ta"ks as necessary to the Manager, Trdl1sport Airplane 

Directorate, for approval. 

d. The ARC will submlt a final report detailing recommendations within 15 months from the 

effective date of this charter. The Manager, Transport Airplane Directomte, may extend this deadline 

for up to 6 months if it is in the interest of the FAA to do so. 

9. Cost and Compensation. The estimated cost to the Federal Government of the Fuel System 

Lightning Protection ARC is $60,000, annually. All travel costs for government employees will be the 

responsibility of the government employee's organization. Non-government representatives serve 

without government compensation and bear all costs of their committcc participation. 

10. Availability of Records. Under the Freedom of Information Act, 5 U.S.c. 522. rccords, reports, 

agendas, working papers, and other documents made avrulable to, prepared for, or prepared by the 

committee will be available for public inspection and copying at the FAA, Transport Airplane 

Directorate, 1601 Lind A venue SW., Renton. W A 98057-3356. Fees will be charged for information 

furnished to the public according to the fcc schedule in 49 CFR part 7. 

11. Committee Term. This committee becomes an entity on the effective date of this charter. The 

committee will remain in existence for a term of 15 months unless it'> term is ended sooner or 

extended by the Administrator. 

4 
 LIGHTNING ARC FINAL REPORT APPENDIX B - PAGE 6

XXlXXI09 

12. Distribution. This charter is distributed to the Officc of the Associate Administrator for Aviation 

Safety, the Office of the Chief Counsel, the Office of Aviation Policy and Plans, and the Office of 

Rulcmaking. 

(I.. Q; 6.M" .. " 

nistrator 

5 
 LIGHTNING ARC FINAL REPORT APPENDIX C - PAGE 1

APPENDIX C 

ACRONYMS AND ABBREVIATIONS 
 LIGHTNING ARC FINAL REPORT APPENDIX C - PAGE 2

ACRONYMS AND ABBREVIATIONS 

§..................................Section 

AC..............................Advisory Circular 

ACO ...........................Aircraft Certification Office 

AD..............................Accidental Damage 

AD..............................Airworthiness Directive 

AFM...........................Airplane Flight Manual 

AFSSP........................Aircraft Fuel System Safety Program 

AMM..........................Airplane Maintenance Manual 

ARAC ........................Aviation Rulemaking Advisory Committee 

ARC ...........................Aviation Rulemaking Committee 

ATA ...........................Air Transport Association 

CDCCL ......................Critical Design Configuration Control Limitations 

CFR............................Code of Federal Regulations 

CMR...........................Certification Maintenance Requirements 

DER............................Designated Engineering Representative 

ED ..............................Environmental Damage 

EUROCAE.................European Organization on Commercial Aircraft Equipment 

EWIS..........................Electrical Wire Interconnect System 

FAA............................Federal Aviation Administration 

FD ..............................Fatigue Damage 

FDT............................Fatigue and Damage Tolerance 

FRM ...........................Flammability Reduction Means 

FQIS...........................Fuel Quantity Indicating System 

GVI ............................General Visual Inspection 

HIRF ..........................High Intensity Radiated Fields 

ICA.............................Instructions for Continued Airworthiness 

ICOLSE......................International Conference on Lightning and Static Electricity 

MRB...........................Maintenance Review Board 

MSG...........................Maintenance Steering Group 

MSI ............................Maintenance Significant Item 

NASA.........................National Aeronautics and Space Administration 

OEM...........................Original Equipment Manufacturer 

QA..............................Quality Assurance 

SAE............................SAE International 

Sec..............................Section (as used within an FAA regulation) 

SFAR..........................Special Federal Aviation Regulation 

SRM ...........................Structural Repair Manual 

SSI..............................Structural Significant Item 

RTCA.........................RTCA, Inc. 
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 1

APPENDIX D 

STRUCTURAL WORKING GROUP 

RECOMMENDATIONS FOR 14CFR 25.981 
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 2

Table of Contents 

1.0 INTRODUCTION............................................................................................................... 3

2.0 APPLICATION OF STATISTICAL METHODS TO STRUCTURES ........................ 4

3.0 MITIGATION OF POSSBILE IGNITION SOURCES BY MINIMIZATION OF 

STRUCTURAL FAILURES......................................................................................................... 6

3.1 STRUTURAL REGUALTIONS AND CRITERIA......................................................... 6

3.2 ANALYSIS METHODS..................................................................................................... 8

3.3 DESIGN PROCESS............................................................................................................ 9

3.4 MANUFACTURING AND QUALITY PROCESSES .................................................. 10

3.5 SUMMARY OF MITIGATION OF IGNITION SOURCES ....................................... 11

4.0 SERVICE HISTORY ....................................................................................................... 11

5.0 COMPOSITE STRUTURE ............................................................................................. 12

6.0 SUMMARY AND CONCLUSIONS ............................................................................... 12
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 3

1.0 INTRODUCTION 

The Large Airplane Fuel Systems Lightning Protection Aviation Rulemaking Committee 

(ARC) commissioned a working group comprising airplane manufacturers and regulatory 

authority structural specialists to assist with their effort to revise 14 CFR 25.981. The 

members of this group have written this report in support of that effort. The members of 

this working group are listed in Appendix A. Current interpretation of § 25.981 has 

resulted in the application of statistical analysis for structural “single failure” conditions 

to both systems and structures. The rule in question states in part: 

“25.981(a)(3) Demonstrating that an ignition source could not result from 

each single failure, from each single failure in combination with each 

latent failure condition not shown to be extremely remote, and from all 

combinations for failures not shown to be extremely improbable.”

The structural working group determined that § 25.981 should be revised or have 

guidance material written to state that requirements for statistical analysis of ignition 

sources due to lightning are not applicable to structures. Structural lightning 

requirements are defined according to § 25.954, Fuel system lightning protection. 

Statistical analysis is not appropriate for structural failures and potential threats because 

there is no reliable data to support it. Structural failures have been shown by test and 

service history to be minimized in existing structural designs. This is a direct result of 

compliance to existing structural regulations and criteria, application of standard 

structural analysis methods, and use of reliable manufacturing methods. The Lightning 

ARC has determined the most likely structural single failures that are considered to 

potentially cause an ignition source are cracked structure or a failed fastener, so this 

report will address these in more detail, but the arguments and conclusions in this report 

are applicable to all types of structural failures. 

This report will provide detailed explanations of the structural working group position 

that statistical methods are not appropriate for structural failures; that threats have been 

minimized in current designs; that service history supports these conclusions; and how 

composite structure can be related to these conclusions. 

FAA structural specialists Ian Won and Greg Schneider reviewed an early draft of this 

report and provided the comments presented in this section. In their review they agreed 

with the position that even though cracks, broken bolts and other failures can occur 

within structure, probability analysis is not an appropriate tool for the analysis of these 

failures, should not apply to structures and any attempt to do so is flawed due to the lack 

of data. The FAA structural specialists did question other aspects of the report, such as 

the usage of process control, testing, regulations etc. as a means to mitigate the threat 

from structural failures. This review led to revisions to the report that are reflected in this 

final version. 
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 4

2.0 APPLICATION OF STATISTICAL METHODS TO 

STRUCTURES 

The wording of § 25.981 is typical of other systems rules that use probability analysis for 

compliance. Structural integrity, however, is established by complying with prescribed 

requirements. This is due to the difficulty in assessing the variability in design, 

manufacturing methods, and operational environment which makes a probabilistic 

approach not viable. 

When analyzing a structural failure, the number of failure modes and the variation in 

methods to predict the failure are enormous. As an example, following are some factors, 

for a detail such as a stringer, that affect failure predictions: 

 Multiple possibilities of failure modes (tension, crippling, buckling, bondline 

failure, fasteners, etc.) 

 Conservatism in fatigue and design loads 

 Variation in airplane utilization (Fatigue Spectrum) 

 Selection of design values (A-basis vs. B-basis, etc.) 

 Fidelity of stress methods (coarse vs. fine grid FEM, test based data, etc.) 

 Thickness tolerance variations 

 Variation of stress levels within the part 

Each of these items has a tolerance that is covered by things such as B-basis allowables 

and an ultimate factor of safety of 1.5. The variability for crack initiation is even more 

random than the static failure and requires testing three to five times the normal cycles in 

a lifetime. All airplane manufacturers develop a fatigue spectrum based on historical 

fleet data and the predicted operating environment for the airplane. This is used in 

fatigue testing and analysis to make sure the airplane will be safe over its lifetime. While 

there are several factors to make sure the airplane is safe even if the owner operates his 

airplane differently, this is another variation that makes prediction of when or where a 

failure would occur very difficult. The variation in each of these factors, and the 

interaction with each other, would require a huge test matrix to develop failure 

predictions. It is extremely difficult to quantitatively predict some aspects of the 

structural performance; therefore a statistically based approach is not viable. 

The structural requirements all work to make sure analysis is done at the lowest strength 

values and tested to 150% of max limit load statically and with a scatter factor or three to 

five on fatigue test cycles. This yields a robust design that minimizes the possibility of 

failures that might become ignition sources if sufficient current was present. This 

approach has led to successful airframe designs in commercial transport airplanes, 

including considering prevention of fuel tank ignition. Therefore, it is the conclusion of 

the structural working group that not only is probability failure analysis not viable, it is 

also not necessary. 
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 5
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 6

3.0 MITIGATION OF POSSBILE IGNITION SOURCES 

BY MINIMIZATION OF STRUCTURAL FAILURES 

Although it is not practical to completely eliminate structural failures, potential threats 

due to structural failures have been minimized in existing structural designs. This section 

will show how minimization of failures is a result of compliance to existing structural 

regulations and criteria, application of standard structural analysis methods, and use of 

reliable manufacturing methods. Advancements in these areas will also be discussed, 

showing how safe designs have become even safer over time. Although most of these 

factors do not directly address lightning protection, they do affect the inherent robustness 

and minimize failures of the structure lightning protection. Service history shows that the 

existing approach to fuel tank structure lightning protection is safe. The difficulties in 

applying probabilistic analysis to structure shows that numerical analysis is not 

appropriate and the inherent robustness of fuel tank structure makes numerical analysis 

unnecessary. 

3.1 STRUTURAL REGUALTIONS AND CRITERIA 

Meeting prescribed structural regulations has led to airframe designs that have minimized 

structural failures that could pose an ignition threat. Discussion on some of the more 

significant regulations follows: 

§ 25.303 Factor of Safety. - A 1.5 ultimate factor must be applied to limit loads. Limit 

load may be thought of as the highest load expected to be experienced by any one 

airplane or structural component in a fleet of airplanes during the fleet’s life. Typical 

operational loads are less than 50% of limit for fuel tank type structure. 

§ 25.305 Strength and Deformation – Structure must support limit loads without 

detrimental deformation and not interfere with a safe operation. It must also hold 

ultimate load for three seconds. This limit load requirement will ensure that fastener 

holes and other details will not yield and cause an ignition source gap. 

§ 25.307 Proof of Structure – Structure must be tested, or analyzed using reliable 

methods. Single load path configurations have additional requirements to ensure a robust 

structure. 

§ 25.571 Damage Tolerance and Fatigue evaluation of structure. - The structure is shown 

to be able to carry limit loads with failed parts or large cracks in the parts. Damage 

tolerance analysis and testing must be done to show that if damage does cause a crack, 

the crack will grow slowly and can be found during inspections. Also, widespread 

fatigue damage must be assessed using full scale test evidence. This paragraph also 

requires the wing structure (including fuel tank) be robust enough to withstand a four 

pound bird strike and continue safe flight and landing. The bird strike provision may 

drive component sizing and therefore results in a more robust structure than would 

otherwise be required. 
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 7

§ 25.581 Lightning Protection – The airplane must be protected against catastrophic 

failure effects from lightning. This drives minimum gauge requirements to prevent 

unacceptable penetration and proper conduction paths for the lightning. 

§ 25.601 General – The design must not have design features that experience has shown 

to be hazardous or unreliable. Field history at the airplane manufacturers shows that 

failed fasteners and cracks that would result in a potential ignition source have been 

minimized (Reference manufacturer data in Table 3.3-1 in the ARC report). 

§ 25.603 Materials – Material suitability and durability properties must be established 

based on tests and take into account temperature and environment. This insures material 

used for fabrication is consistent in its properties for each unit produced for that model. 

§ 25.605 Fabrication Methods – Fabrication must be done to approved processes that 

produce consistent structure. New methods have to be proven by test. This will ensure 

each structure will meet the strength/durability requirements. 

§ 25.609 Protection of Structure - Structure must be protected against weathering, 

corrosion, and abrasion. This will ensure the structure will remain sound throughout its 

life and minimize failures. 

§ 25.611 Accessibility – The structure must be accessible for inspections. 

§ 25.613 Material Strength Properties and Material Design Values – Material strength 

properties must be based on test data that has a statistical basis. This will minimize the 

possibility of structural failures due to material variability. 

The following paragraphs all describe when special factors must be used. These all help 

minimize the possibility of structural failures due to special materials, manufacturing or 

design features. 

§ 25.619 Special Factors 

§ 25.621 Casting Factors 

§ 25.623 Bearing Factor 

§ 25.625 Fitting Factors 

§ 25.954 Fuel System Lightning Protection – This lightning requirement is included in 

the structural analysis to verify the minimum skin thickness for the structural strength 

requirements will not show any penetration by melting or burn through when the fuel 

tank skin is exposed to a lightning strike.

§ 25.963 Fuel Tanks General – The fuel tank must withstand without failure the 

vibration, inertial, fuel and structural loads it is subject to during operation. The structure 

will be robust to prevent leaks. 
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 8

Many of the above regulations have been amended over time. Compliance with later 

amendments to the regulations will tend to increase the structural robustness. For 

instance, the damage tolerance aspects of § 25.571 were not introduced until 1978. 

Although damage tolerance requirements have been retroactively applied to older 

designs, the stress levels in those designs could not be modified to achieve more practical 

inspection programs, as has been done on newer designs as described in Section 3.2. 

Amendment 25-96 introduces requirements to address widespread fatigue damage, which 

will help further ensure that the occurrence of small cracks is minimized in the fleet. 

3.2 ANALYSIS METHODS 

Ongoing progress in analysis methodology has contributed to minimizing structural 

failures in newer designs. 

Rapid progress in computing speed and analysis software such as finite element analysis 

has enabled the structural engineer to do an improved detailed analysis to comply with 

strength requirements of § 25.305. The number of load conditions that can be reasonably 

considered has greatly increased, improving the ability to identify which ones are critical. 

Detailed finite element analysis has allowed for enhanced structural optimization by 

identifying non-critical material for removal. This allows designers to place material 

where it is most beneficial, which can simultaneously lead to lighter yet more capable 

parts. These methods also allow analysts to better identify stress concentrations, which 

may not be possible with other methods. 

Fatigue analysis methods are heavily dependent on test data and in some cases, in-service 

experience. These methods are therefore constantly being improved over time. Every 

new airplane development program requires fatigue tests ranging from small coupons all 

the way up to a full scale test of a complete airframe. The results of major airframe 

fatigue tests show that failures are less frequent than they were in the airplane models that 

preceded it, demonstrating that fatigue analysis methods have improved over time. Inservice data from the fleet shows that structural failures are less common in more recent 

airplane designs when compared to older designs (for similar periods of operation). 

Damage tolerance analysis as required by § 25.571 must show that if a crack occurs, it 

will not become critical before it is detected. This is done to cover random 

manufacturing or material flaws that could initiate a crack. Possible leaks from cracked 

fuel tank structure offer additional means of detection between inspections. All detected 

cracks in primary structure are immediately repaired so exposure time is minimized. 

Damage tolerance is an aspect of structural certification that has been required on newer 

airplane designs and which sets them apart from older generations of airplanes. In order 

to have a practical inspection program the design stress levels must be kept low enough 

to ensure the inspection frequency is not too burdensome to the operators. This in turn 

reduces the probability of cracks initiating. Developing a practical inspection program 

contributes to low stress levels in another way, since ideally critical crack lengths should 

be large enough to be found by visual inspections. To keep the growth of a crack slow 

the stress levels must be low, thus mitigating the chance of a crack initiating. 
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 9

Furthermore, structural analysis methods are the only practical means of establishing a 

structural inspection program. The alternative would be to use ignition source criteria to 

determine an inspection program, which requires a crack size threshold be determined. It 

would likely require a large amount of testing for each possible structural configuration 

to do this. Assuming that it is even possible to establish the crack size threshold for 

which it becomes an ignition source, the results would have to be compared to the 

structural inspection program assumptions, such as critical crack size and probability of 

detection. This comparison may likely lead to more frequent and burdensome inspection 

requirements. Because of the complexity of testing requirements, and possible negative 

effects on inspection intervals and methods, implementing an inspection program for 

cracks based on a lightning threat is not practical, nor, as this report describes in detail, is 

it necessary. 

These advancements in analysis methods contribute to minimizing structural failures and 

thus the potential for an ignition source due to lightning. 

3.3 DESIGN PROCESS 

The design process to produce safe and robust airplane structure that complies with 

current regulations also leads to a design that offers lightning protection. 

In the design process, the fasteners, materials, and corrosion protection/finish schemes 

used to design the wing are chosen with the function, loads and design criteria in mind by 

the Design, Materials and Stress/Fatigue & Damage Tolerance (FDT) engineers. 

Material selection for fasteners and other components reflect advancements in corrosion 

resistant technologies to reduce potential damage occurrence in-service. Older airplanes 

may have used materials such as 7075-T6. This has been replaced in newer airplanes 

with 2324, 7050 or 7475 alloys which have higher fracture toughness and improved stress 

corrosion cracking properties. 

All specifications and standards used for hardware, materials and processes (fasteners 

installation, sealing, etc.) are approved by FAA Designated Engineering Representative 

(DER) or FAA Aircraft Certification Office (ACO), or industry approved and used 

specifications. These are the documents to which the airplane is designed, manufactured, 

tested and inspected. 

Prior to approval, the part/installation design is analyzed by the Stress/FDT Engineering 

Group to verify the fasteners, material selections, and design features will meet the static 

and fatigue load requirements. The design is approved by the Design, Material and 

Process, Manufacturing, Quality, Stress/FDT Engineers and the DER. 

To verify the assembled wing will be able to handle the loads identified by Stress/FDT 

Engineering, two complete airframes are assembled, one for static testing, and the other 

for damage tolerance and durability testing. The static test airframe is tested to 1.5 times 

limit load per § 25.305. The fatigue test airframe is tested to multiple lives to satisfy the 

requirements of § 25.571. 
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 10

Structural cracking, fractured fasteners and other defects that show up during the testing 

are subject to component redesign and/or having the fastener evaluated and replaced with 

an improved fastener. The post test inspections also include detailed teardowns of certain 

areas which could reveal small cracks in addition to larger, more easily detectable ones. 

This verification process is done in order to ensure the components and fasteners last the 

life of the airplane. If any airplanes have been delivered prior to completion the fatigue 

testing and a crack is found during the inspection, a service bulletin will be issued to 

rework the part(s) and fix the problem. 

These aspects of the design process contribute to minimizing structural failures and thus 

the potential for an ignition source due to lightning. 

3.4 MANUFACTURING AND QUALITY PROCESSES 

Manufacturing techniques, inspection methods, and quality control processes contribute 

to less variation and defects in the final product. There have been many advancements in 

these areas which have led to enhanced product quality. These have not completely 

eliminated all defects but certainly reduce the likelihood of occurrence, which reduces the 

potential for an ignition source due to lightning. 

Trends to increase automation in airplane manufacturing have resulted in more robust 

designs by increasing consistency and reducing defects. For example, an airplane 

manufacturer may implement a fully robotized process to install aluminum index head 

rivets. The numerically controlled machine locates and drills the hole, inserts and 

squeezes the rivet, and then shaves the head flush. During the squeezing of the rivet, the 

shank expands outward with a force great enough to not only fill the hole in the 

aluminum structure but also expand the hole. This ensures a tight, leak free, bonded fit. 

Automated processes may not be suitable for all locations but many fasteners have 

inherent features which ensure proper manual installation. For Hi-Lok® type fasteners, 

the driving portion of the collar shears off at the required torque level, ensuring the collar 

is properly locked in place without being over tightened. For lock bolts, the collar 

swaging tool reacts against the tail of the bolt, which is designed to break when the 

appropriate swaging force has been applied. This ensures proper repeatable installation 

of the collar. Manual hole drilling is aided by drill templates (to properly locate 

fasteners) and drill guides (to ensure proper angularity). 

Material variation has been reduced as raw material suppliers transition to computer 

controlled processes and more accurate sensors. Variation from unit to unit at the 

airplane manufacturer has also been reduced due to improvement in manufacturing 

processes. Computer controlled machining, forming, trimming, drilling and fastener 

installation have all worked to reduce variation in the process. 

Quality Assurance (QA) processes ensure that both automated and manual manufacturing 

operations produce a final product with minimal defects. 
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 11

Robotized manufacturing processes ensure the quality and repeatability of fastener 

installations, and are Quality Assurance verified on a scheduled basis. The machines 

carrying out the installations undergo a rigorous qualification process before being used 

to produce production parts. 

Manually installed fasteners either possess inherent features (such as Hi-Lok® and lock 

bolt collars mentioned previously) or have robust quality measures in place to ensure 

proper installation. Nuts are installed by a qualified mechanic using a calibrated torque 

tool. Quality Assurance personnel can directly witness nut installation or verify the 

torque tool setting afterwards. Nuts are also inspected for gaps to verify proper 

installation. 

After assembly, the fuel tanks are leak checked with air and/or a test fluid, which offers 

another opportunity to detect defects before an airplane is delivered. 

3.5 SUMMARY OF MITIGATION OF IGNITION SOURCES 

Compliance with existing structural regulations and standard design processes has 

produced designs with inherent protection against ignition due to lightning. Current 

manufacturing and quality assurance processes also contribute to this inherent robustness. 

Evolution in all these areas has helped to further minimize the occurrence of structural 

failures. It is therefore the conclusion of the structural work groups that probability 

failure analysis for structural failure conditions is not necessary. This conclusion is 

validated by service history, as explained in the following section. 

4.0 SERVICE HISTORY 

Service history has shown that existing structural lightning protection designs are 

inherently robust. No airplane has been lost due to a fuel tank ignition due to a lightning 

strike since 1976. The inherent robustness is due to the minimization of structural 

failures as has been described in this report. The data in Appendix Table 3.3-1 of the 

Lightning ARC report is based on operator reports to airplane manufacturers with regard 

to structural cracks found in service. The data includes the effects of manufacturing 

flaws and maintenance. 

The data supports the general conclusion that cracks in fuel tank structure, while not 

completely eliminated, have been minimized. However, it is not appropriate to attempt to 

use this data to quantify the rate of structural cracking due to the reasons presented in this 

report and because newer designs are expected to perform even better due to 

incorporation of continuous improvements as outlined in Section 3.0. 

The in-service data shows a distinction between overall reports of cracking in the fuel 

tank and instances of a single cracked component on multiple airplanes due to specific 

condition that was addressed by a Service Bulletin. In some cases the cracks are detected 

when they are very small, however because of the large sample size and the fact that 

small cracks eventually grow into larger more easily inspected cracks, the data in Table 

3.3-1 of the Lightning ARC report is representative of cracking in the fleet. 
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 12

5.0 COMPOSITE STRUTURE 

While it is true there is less service experience with composite fuel tanks than for metal 

fuel tanks, in general the data shows that composites are less likely to experience 

cracking in service. Composites have to meet the same regulations as metallic tanks with 

respect to static strength, but instead of designing for a slow inspectable damage growth 

like metal structure, composites generally take a “no detrimental damage growth” 

approach to damage tolerance and in doing so, operating strains are kept below levels 

where cyclic damage will lead to deterioration over the life of the airplane. They are 

designed for no detrimental deformation at limit just like metal structure and since they 

do not yield like metals they usually have no detrimental deformation at ultimate also. 

Composites can experience delaminations under impact or direct lightning strike which is 

not typical in aluminum structure but again the structure is designed so these 

delaminations do not have detrimental growth or they are visible and repaired. In 

addition, composites are much less susceptible to corrosion compared to metallic 

structure. 

A review of over 15 years worth of service data for the Boeing 777 horizontal and 

vertical stabilizers revealed that there have been no reports of cracks or fastener failures 

in any of that structure, which although it is not a fuel tank, is representative of composite 

wing/stabilizer fuel tank construction. 

Testing of the 777 horizontal and vertical stabilizers as well as 787 wing pre-production 

test articles for three lifetimes was conducted as part of the airplane design effort. 

Results of the 777 and 787 testing showed no indication of cracking or delamination in 

the composite primary structure. Additionally the 777 and the 787 composite structure 

test programs were extensive, comprising thousands of element and hundreds of 

subcomponent level tests. These tests included cold, room temperature and hot/wet 

conditions with intentionally inflicted damage at operating stress levels in order to ensure 

that undetectable damage to composite structure does not grow under operational loads to 

the size necessary to initiate a fuel leak. 

Based on the service history and design considerations discussed above, the data shows 

that composite designs are inherently more robust compared to metallic designs with 

regard to cracking or damage growth, when designed to meet the same regulatory 

requirements. 

6.0 SUMMARY AND CONCLUSIONS 

1. Structural lightning strike criteria for fuel tank ignition are covered by § 25.954 

and therefore structural requirements should be removed from § 25.981. 

Compliance with existing structural regulations results in robust fuel tank design, 

where structural failures, including failures such as bolt fractures and cracking, 

have been minimized. This is supported by field data of structural failures from 

airplane operators. 

2. There have been continuing improvements in the design processes and analyses, 

material selection and processing, manufacturing and inspection methods over the 
 LIGHTNING ARC FINAL REPORT APPENDIX D - PAGE 13

ones used for airplanes designed in the past to support the structural rules. This 

results in a more robust fuel tank with respect to cracks, broken fasteners, 

corrosion and wear.

3. It is not appropriate to attempt to show that a structural failure that could cause an 

ignition source is extremely remote. Probability analysis methods are inconsistent 

with structural design methodology and due to the large scale of testing required, 

would add no significant value to the evaluation of structure. 

4. The structural working group’s findings of the rarity of cracks, broken bolts, etc. 

from the review of the airplane manufacturer data indicates the robustness of 

airplane manufacturers wing structure, and its ability to comply with existing 

regulations, and are typical of what would be expected. Additionally, given that 

there is no history of ignition in these airplane models, the data indicates that 

structural failures, including failures such as bolt fractures and cracking, are not 

an issue for lightning strike. 

5. It is not practical or necessary to attempt to develop an inspection program to 

detect cracks before they become a potential ignition source. 

6. The review of composite structures service and test data shows it is less likely to 

develop structural cracking than aluminum structure. Composite designs must 

meet the same structural requirements as metallic designs, which results in an 

equivalent robustness and is expected to result in equivalent lightning ignition 

service experience. 

7. Maintaining the current prescriptive approach for the evaluation of structure is 

correct because it mitigates the chance of structural failure and allows for the 

incorporation of analysis and material improvements as they evolve. 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 1

APPENDIX E 

EVALUATION OF SPARK OR ARC GENERATION BY 

LIGHTNING CURRENT AT STRUCTURAL CRACKS AND 

CRACKED BOLTS 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 2

TABLE OF CONTENTS 

1.0 INTRODUCTION............................................................................................................... 3

2.0 STUDY ON LIGHTNING ENVIRONMENT REQUIRED TO CAUSE AN IGNITION AT A 

CRACK........................................................................................................................................... 3

2.1 Test Results of Ignition Source Generation Due to Conduction Current through Aluminum 

Plates with Cracks...................................................................................................................... 4

2.1.1 Outline of the Test ....................................................................................................... 4

2.1.2 Test Specimen (Case 1: Crack from Edge)................................................................ 5

2.1.3 Test Specimen (Case 2: Cracks from Center Hole).................................................. 5

2.1.4 Test Waveforms of Conduction Current................................................................... 6

2.1.5 Test Facility and Setup................................................................................................ 6

2.1.6 Test Results .................................................................................................................. 8

2.1.7 Summary of Test Results ............................................................................................ 9

2.2 Numerical Analyses of Current Distribution of Tests and Discussion on the Mechanism and 

Threshold of Ignition Generation........................................................................................... 10

2.3.1 Calculation Model of Wing Section.......................................................................... 15

2.3.2 Calculated Cases of Current Density Distributions of the Unit Cell..................... 17

2.3.3 Findings of the Calculated Current Density Distributions within a Conventional Al Wing 

Fuel Tank Structure Model................................................................................................. 34

2.4 The Origin of Skin Effect ................................................................................................. 34

2.5 Investigative Lightning Test of Cracked Structure and Fastener Hardware.............. 38

2.5.1 Test Configuration..................................................................................................... 38

2.5.2 Test Results ................................................................................................................ 40

2.6 Investigation of Voltages across Cracks in Aluminum Panels...................................... 41

3.0 Conclusions........................................................................................................................ 44
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 3

 1.0 INTRODUCTION 

Members of the Lightning ARC conducted some tests and analyses to learn about the possibility 

of cracks in fuel tank structural elements and fastener installations becoming ignition sources due 

to lightning currents. 

The tests included conduction of simulated lightning currents through fuel tank structural 

materials and fastener installations with cracks introduced in them. Most of these tests were 

conducted at ranges of amplitudes to determine ignition source thresholds. 

The analyses included finite difference time domain computations of lightning current 

distributions on the interior surfaces of fuel tanks and within interior tank elements such as ribs, 

spars and shear ties. These computations were conducted for the more common conducted 

currents throughout lightning Zone 3 when a wing tip is struck by lightning as well as for direct 

strikes to fasteners located in lightning Zones 1A and 2A on wing tank surfaces, which are less 

common. The Zone 3 conduction – only computations are called CASE A. A combination of 

direct strike and conduction is described in CASE B and the direct strike computations are called 

CASE C. 

Computations were also made of current densities throughout some of the structural element test 

coupons so that the local current densities in the vicinity of the introduced cracks could be 

known. The current flow analysis results are presented in Section 2.3. 

The tank structure computations showed that, for all-metal tanks, the lightning current densities 

at the interior surfaces of fuel tank skins and other tank boundaries are much lower than the 

current densities in the exterior surfaces of these same elements. This is due to the long times 

required for electric currents to diffuse through the thicknesses of metal conductors. This 

phenomenon is commonly known as skin effect. A general discussion of skin effect is presented 

in Section 2.4 of this Appendix. 

Additional test data on spark thresholds of other failure conditions in fasteners and shear tie 

installations is contained in Section 2.5 and an assessment of the origin of “sparks” in structural 

elements is presented in Section 2.6. 

A discussion about the likelihoods of the ignition sources actually occurring within an all-metal 

fuel tank, based upon the data presented in Section 2, is presented in Section 3 of this appendix. 

2.0 STUDY ON LIGHTNING ENVIRONMENT REQUIRED TO 

CAUSE AN IGNITION AT A CRACK 

To study the lightning environment to cause an ignition (item c) in Section 1, the following items 

are discussed in this section. 

1. Test results of ignition source generation, 

2. Numerical analyses of the tests and discussion on the mechanism and the threshold of the 

ignition generation, and 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 4

3. Examples of calculated current density distribution within a model of a typical metal fuel 

tank section. 

In the discussions that follow, the ignition source is termed generally a spark which is commonly 

considered to result from ionization of air due to voltage, as compared with an arc that is 

commonly considered to result from current flow across conductors in contact. Sections 2.2 and 

2.6 provide discussions of whether it is actually a spark or an arc that has occurred at the tested 

cracks. 

2.1 Test Results of Ignition Source Generation Due to Conduction Current 

through Aluminum Plates with Cracks 

2.1.1 Outline of the Test 

 Current conduction tests to aluminum plates with a slit or an actual crack perpendicular to 

the current flow are conducted. Test parameters are as follows: 

 Position of a slit/crack 

 Width (gap) of slit/cracks 

 Current waveform and amplitude 

Figure 2.1 - Schematic of Current Conduction Test through 

Aluminum Plates with Cracks 

Crack Al (7075) 

Thickness: 1/8” 

No Surface Paint/Primer 

18.7” 

6.3” 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 5

2.1.2 Test Specimen (Case 1: Crack from Edge) 

 Test specimen of case 1 is as follows. They have cracks from the edges of the plates. 

Figure 2.2 - Crack (Slits) Fabricated by Electrical Discharge Machining 

-Simulating Cracks with Some Gap 

Figure 2.3 - Fatigue Crack actually Fabricated by Tension Test Apparatus 

(Crack has No Width and the Surfaces may be Touching Each Other) 

2.1.3 Test Specimen (Case 2: Cracks from Center Hole) 

The test specimen of case 1 is shown in Figure 2.4. They have cracks at the center of the plates. 

This case has two types of cracks, including one with machined air gap and one with no air gap 

due to fatigue cracks originating from the machined crack, as shown in Figure 2.4. 

1.8” 

Crack (Slit) Width: 4, 20, 40 mil 

Fatigue crack

1.8” 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 6

Figure 2.4 – Crack Fabricated by Machining Simulating Cracks with Some Gap and Fatigue 

Crack actually Fabricated by Tension Test Apparatus; Crack has No Width and Surfaces May 

Touch Each Other 

2.1.4 Test Waveforms of Conduction Current 

Test waveforms are described in Table 2.1. 

Table 2.1 - Test Waveforms of Conduction Current 

 Waveform Peak Current Notes 

1 Comp. B 6 kA 

A lightning intermediate current with a high DC 

content and therefore more likely to divide among 

structural elements according to element resistances 

and less sensitive to skin effect. Component B 

external environment peak amplitude is about 4 kA 

per SAE ARP5412A. Component B is therefore an 

appropriate current for representation of currents that 

have diffused to internal tank skin surfaces and other 

internal structural elements where cracks of interest 

as possible ignition source might be present. 

2 Comp. D/2 50 kA 

3 Comp. A 20-100 kA 

-Relatively high conduction current assuming 

proximity lightning attachment. 

-Comp. D/2 was tried because maximum conduction 

current assuming proximity lightning attachment at 

zone 2A of upper skin may be about a half of comp. 

D. 

2.1.5 Test Facility and Setup 

Crack (slits) Fabricated by Electrical Discharge Machining - 

Simulating Cracks with Some Gap 

1.8” 

Crack (Slit) Width: 4, 20, 40 Mil 

Electrical Discharge 

Machining Slits

Fatigue Cracks

0.6”

1.8”
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 7

 Test facility and setup used for the test is shown in Figures 2.5 and 2.6. 

Figure 2.5 - Photo of High Current Lightning Test Lab 

Figure 2.6 - Schematic of the Test Setup 

Capability: Generate Standard Lightning Waveforms 

Defined in SAE ARP 5412A 

Component A & D 

Generator 

Comp. B 

Generator 

Comp. C 

Generator 

Test 

Space 

Light-Tight

Chamber 

Camera

Test 

Specimen 

Comp. A/D 

Generator

Comp. B 

Generator 

Comp. C*/C 

Generator 

Current 

Transformer

Oscilloscope 

Oscilloscope 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 8

2.1.6 Test Results 

Test results are shown in Figure 2.7. 

 (1) Fatigue Crack from the Edge 

 (2) Cracks from Center Hole 

Figure 2.7 - Test Results 

The specimens containing slits cut by a saw were also tested but there were no sparks observed 

in those specimens. No further discussion of the open slits is presented in this appendix. 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 9

Table 2.2 - Current Waveforms and Examples of Sparks 

2.1.7 Summary of Test Results 

 From the above test results, the followings can be concluded. 

1. No spark was observed with cracks (slits) with some air gap. 

Sparks were observed only with actual fatigue cracks (with no gap) whose surfaces are 

rough and may be touching each other. 

2. No spark was observed when the current density at the edge crack was 6.0e4 A/m 

resulting from 6 kA of Component B through the 6 inch (150 mm) wide aluminum panel. 

Sparks were observed at the edge crack with higher currents of 20 kA and 50 kA 

through the 6 inch wide panel. For the center crack, there was only one case of a very 

faint spark when 50 kA was conducted through the 6 inch wide panel. 

3. Edge cracks are more likely to generate sparks then are cracks existing away from 

edges since the lightning current densities are highest at the edges of structural 

elements. 

Table 0.2

Pictures

Comp. D/2 

50 kA 

7.1 x 104

 A2s 

Comp. A/10 

20 kA 

1.9 x 104

 A2s 

Comp. D/2 

50 kA 

7.1 x 104

 A2s 

Specimen Waveforms

Cracks 

from 

Center 

Hole 

(Fatigue 

Crack) 

Crack from 

Edge 

(Fatigue 

Crack) 

 

Faint Spark 

- Spark was Very Small 

(Faint) 

- Could be less than 200 μJ 

- Spark at Center of Fatigue 

Crack

100μs/div 

100μs/div 

100μs/div -50 kA 

-50 kA 

-20 kA 

1ms/div 

6 kA 

Ref. Comp. B, 6 kA, 10 C

 (No Spark Observed) 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 10

2.2 Numerical Analyses of Current Distribution of Tests and Discussion on 

the Mechanism and Threshold of Ignition Generation 

To understand the behavior of the ignition source, electro-magnetic field analyses for the 

aluminum plates with slits were performed. Figures 2.8a shows the current density distribution 

of the Al plate and electric field within the slit for the case of slit at the edge with Component A 

waveform of 200 kA defined for analysis in ARP5412[16]. Slit width was 2 mm which is the size 

of the cells in the model. As can be seen, the current is concentrated to the edge. The overall 

distribution in the panel did not seem to be influenced by the existence of the slit and the intense 

current flow along the edge detours around the slit. Concentrations of current near the panel 

edges are due to the high frequency content of the Component A waveform. 

Figure 2.8a - Current Density Distribution of Al Plate and Electric Field within Slit for Case of 

Slit at Edge; t = 0.09 μs . At,0.09 μs the Current is Changing Most Rapidly and Voltage at 

Crack is Highest 

Figure 2.8b shows the maximum current density around the crack at 6 microseconds when the 

conducted current is highest. 

Zoom in Around the Crack 

Electric Field within the Crack 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 11

Ele. Surf. Cur. Dens.

(A/m)

1.26E+05

1.50E+05

2.12E+05

2.99E+05

4.22E+05

5.97E+05

8.43E+05

1.19E+06

1.68E+06

2.37E+06

3.35E+06

4.74E+06

6.69E+06

9.45E+06

1.34E+07

2.24E+07

1.26E+05

1.50E+05

2.12E+05

2.99E+05

4.22E+05

5.97E+05

8.43E+05

1.19E+06

1.68E+06

2.37E+06

3.35E+06

4.74E+06

6.69E+06

9.45E+06

1.34E+07

2.24E+07

Current Density Around the Crack

Electric Field within the Crack

Fig 2.8b - Current Density Distribution of Al Plate and Electric Field within Slit for Case of Slit 

at Edge; t = 6 μs When Current Densities are Highest. 

Injected current is 200 kA 

From these results, the following two possibilities for the spark generation at the fatigue cracks 

(with no gap) can be anticipated. 

 Electric sparks (also known as voltage sparks) within small irregular gaps of fatigue 

cracks 

 Electric arcs (also known as thermal sparks) between two rough and touching surfaces of 

the cracks 

To estimate the possibility of the voltage sparks, the potential difference between two corners of 

the slit at the edge was calculated and the result was 440 V. This potential difference is constant 

with width variation since it is due to d/dt caused by detouring current around the crack. 440 V 

is the maximum value for 200 kA Component A. Since this value is almost the same as the 

minimum value of the Paschen curve of 360 V, full threat lightning current would have to flow 

through an aluminum plate just several inches wide to cause a voltage spark. Therefore, the 

cause of the crack ignition source in the tests as well as any potential ignition source at a crack 

with the real lightning to the airplane situation should not be due to a voltage spark. 

Figure 2.9 shows the calculated current density distribution and the electric field within the slit at 

the center of the panel When the Component A waveform at 200 kA (peak) was beginning to 

flow into the panel at 0.09 us. As can be seen, the current density around the crack is small 

compared to the crack at the edge. If the slit is the actual crack, there should be many contact 

points and therefore the current density around the crack should be much less than the density 

around the edge crack. Therefore, the arc or spark probability in Case 2 (center crack) should be 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 12

much smaller than that in Case 1 (edge crack). If the voltage spark may occur, the potential 

difference is one order smaller in Case 2. Also, the spark energy in Case 2 should be quite 

smaller than in Case 1 because the energy should be proportional to the square of the current 

density. 

Figure 2.9 - Current Density Distribution of Al Plate and Electric Field within Slit for Case of 

Slit at Center of Plate; t = 0.09 μs (Normalized Distribution at t = 6.0 μs is ~equal); At this 

Time, Current is Changing Most Rapidly and Voltage at Crack is Highest. 

To evaluate the current density at the crack when a spark occurred, current density distributions 

of the Al plate used for the crack spark tests presented above were recalculated. Previously, the 

waveform used to calculate the distribution was an ideal Comp. A as described in SAE 

ARP5412A[16]. However, the actual test current varied somewhat from the ideal definition so the 

actual test waveform was curve fit and used this time. This is because the current distribution is 

influenced by the input waveform (especially by the current rise and decay times). Figure 2.10 

shows the actual injected current waveform and Figure 2.11 shows the resulting current 

distribution throughout the tested panel. The current density threshold not to cause an ignition 

source is estimated to be more than 6.0e4 A/m. Note that in the figures that follow in this 

appendix the notation for current density, for example, 6.0e4 and 6E4, are used interchangeably 

and mean the same value. 

Zoom in Around the Crack 

Electric Field within the Crack 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 13

Figure 2.10 - Injection Current Fitting

Figure 2.11 - Calculated Current Distribution of the Test Panel

Figure 2.8b shows that the current density necessary to produce an arc at the fatigue crack at the 

edge is 1.75e5 when 20 kA was conducted through the cracked panel. 

Bulk current at Edge 1,2: 40 mm in 

width. Density 2.5e4 A/m 

Bulk current at Center: 80 mm in 

width. Density 1.1e4 A/m 

Current density threshold not to 

cause an ignition source is 

estimated to be more than 

6.0e4 A/m since none of the tests 

with Comp. B produced a spark.

~4.0e5 A/m 

6.0e4 A/m 

at Location 

of Edge 

Crack

0

500

1000

1500

2000

2500

0 50 100 150 200 250 300 350 400

Time (μ s)

Bulk Current (A)

端部1

中央

端部2

E

180

Comp B 6 kA 

Current Injection 

Edge 1 

Center Edge 2 

~1.0e4 A/m 

-2000

0

2000

4000

6000

8000

10000

-200 -100 0 100 200 300 400 500 600 700 800 900 1000

時間[μ s]

電流[A] 

Comp.B (6kA) 電流[A]

I0[exp(-α t)-exp(-β t)]

I0=6855.84 

α=0.0006178 

β=0 0186984

Time (μs) 

Cur

rent 

(A) 180 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 14

Figure 2.11 shows that the current density that will not cause an arc at this crack is 6e4 A/m. 

Therefore it may be concluded that the arc threshold for this fatigue crack is somewhere between 

6e4 and 1.7e5 A/m. 

The current density that caused the faint spark at the center of the panel is believed to correspond 

to a current density similar to that at the center of the Al plate in Fig. 2.8b which is 6.2E5 A/m x 

(50 kA/200 kA) = 1.5e5 A/m (150,000 A/m) when 50 kA Component A was conducted through 

the panel as shown in Table 2-2. This is because the crack surfaces must be closed (and therefore 

touching each other at multiple locations) to cause an arc, so the current must flow through those 

multiple touching locations and the current density at the crack must be almost the same as the 

Fig. 2.8b. Although the current density in Fig 2.9 around the slit is higher than that of non-slit 

location, with a maximum of 5.2e5 A/m x (50 kA/200 kA) = 1.3e5 A/m (130,000 A/m) for 50 

kA conduction, even at the time of 0.09 μs at the ends of this slit, this is because the model 

assumes no conduction current flow across the slit width. This is not the case when the slit is 

closed. On the other hand, if the crack is open like the model of Fig. 2.9, there will be no 

touching location and no arc will be generated. 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 15

2.3 Examples of Calculated Current Density Distribution within a Typical Metal Fuel Tank 

Model 

To assess if the current density at the crack exceeds an ignition threshold, current densities in the 

areas where the cracks might occur are required. Here, we present typical examples of 

calculated current density distributions within a conventional aluminum wing fuel tank structure 

model. Table 2.3 shows the summary of these calculations, which are presented in the following 

subparagraphs. 

Table 2.3 - Calculation Conditions (Attachment Scenario, Test Current Value, etc) and 

Calculated Maximum Current Density 

CASE Attachment 

Scenario 

Input 

Amplitude and 

Waveform for 

Calculation 

(kA) 

Maximum 

Calculated 

Internal 

Current 

Density 

(A/m) 

Corresponding 

Full Threat 

Amplitude 

(kA) 

Corresponding 

Maximum Internal 

Current Density for the 

Full Threat Strike2 

(A/m) 

CASE A 

Tip Strike Zone 3 

Conduction 

Component A at 

200 kA 

(Most Likely 

Attachment Case) 

200 20 200 20 

CASE B 

Conduction and 

Direct Strike in 

Zone 2A 

Component A1 at 3 

kA 

3 890 100 (Comp D) 2.9e4 

CASE C 

Direct Strike in 

Zone 2A 

Component D at 

100 kA 

100 1.5e3 100 1.5e3 

 Note 1: Component A was applied instead of Component D in this analysis since measurements of current 

densities within a generic wing section for validation of the analysis had been made with Component A (See Section 

2.3.1) 

 Note 2. Note that the corresponding maximum internal current density for the full threat strike in CASE B is 

extrapolated from a calculation at 3 kA since this was the amplitude of a Component A test current applied to the 

wing tank structure model for validation of the EMA3D numerical simulation method. The extrapolation factor was 

33.

2.3.1 Calculation Model of Wing Section 

EMA3D was used to calculate the current distribution of a partial cutout generic wing section 

(called Unit Cell) of a conventional aluminum main wing structure, including typical structure 

elements such as: 

 Skins (with skin splices) and spars. The aluminum skins on this model are 

4 mm thick. 

 Ribs and stringers (one realistic rib and two fake ribs (as access doors for the Unit Cell)) 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 16

 Leading and trailing edges 

 A 7.5 mm air gap (slits) along a skin splice is intentionally included to obtain the worst 

case (strong) electromagnetic field penetration into the internal wing box through 

potential small apertures along the splices due to surface finishes and fay seals. 

A geometric model of the Unit Cell for the calculations as well as comparison tests is shown in 

Figure 2.12 and Figure 2.13. The Unit Cell simulates two bays of a typical aluminum main wing 

section with three ribs (one realistic rib and two fake ribs act as access doors for the Unit Cell), 

leading/trailing edges and front/rear spars. The shape is simplified using plain surfaces instead 

of round shapes because such shape differences do not essentially affect the current distribution. 

Figure 2.12 - Partial Cutout Wing Section (“Unit Cell”) for Test 

Rib 8

Rib 7 

Rib 9 

Leading Edge 

(LE) 

Trailing Edge 

(TE) 

Skins

INBD 

0.6 m

0.6 m 

0.35 m

Ports for Measurement 

Signal Cables 

2.4 m

FW

Skin 

Splice

Access Doors 

(Fake of Rib 7) 

All Components are 

Aluminum 

Current Injection 

Tabs for Skin
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 17

Figure 2.13 - Partial Cutout Wing Section (“Unit Cell”) for Test - Top Surface Removed 

2.3.2 Calculated Cases of Current Density Distributions of the Unit Cell 

Details of the calculation results are summarized in Table 2.3 and are as follows. 

CASE A: Tip Strike (most likely lightning attachment case) Zone 3 Conduction Component A 

at 200 kA 

This case represents a most frequent lightning strike scenario of tip strike and Zone 3 conduction 

through the main wing to the wing root with a 200 kA peak current. Top view of the calculated 

result at 6 μs which is Component A peak is shown in Figure 2.14. In the case of the Unit Cell 

test, return foil was needed. Thus, the calculation model also includes the return foil. The return 

foil is shown in Figure 2.14 but omitted from most of the succeeding figures. The current is 

injected and ejected through six braided wires, respectively, as shown in the figure. The 

maximum current density of 2.4e6 A/m was due to the thin wire current input at return foil and 

therefore fictitious for anywhere on a real wing. External current tends to concentrate at edges, 

especially at LE/TE edges and its density is up to ~7e4 A/m. The current density on the skin 

surface was ~2e4 A/m. 

Stringers 

Front

Spar 

Skin Splice Joint Stringer 

Rear 

Spar 

INBD 

FWD 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 18

Figure 2.14 - Top View of Unit Cell Calculated Current Distribution of CASE A 

Figures 2.15 to 2.20 show internal current at 6 μs. Note that the contour range is three orders 

smaller than Figure 2.14. Internal current is extremely small compared to the external current, 

several tens of A/m at the maximum. The reason that the internal currents are much smaller than 

the external currents is due to skin effect wherein a current of short time duration often does not 

have time to fully penetrate to the interior of a conductor. Skin effect is described more generally 

in Section 2.4. 

2.4e4 A/m 

The Max 

Current Density 

is Due to Thin 

Wire Current 

Input at Return 

Foil and 

Fictitious for 

Anywhere on a 

Real Wing. Conduction 

7e4 A/m 

2.4e6 A/m

LE 

Return Foil Needed in Test Setup 

(Does Not Exist in Real Wing) 

Time = 6 μs

Conduction 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 19

The highest current density calculated at any surface inside the unit cell is 20 A/m at rib shear 

ties shown in Figure 2.16.

Figure 2.15 - Top View of Unit Cell Calculated Current Distribution of CASE A with Top Skin 

Removed to Show Internal Currents 

Figure 2.16 - Center Rib Section of Unit Cell Model in CASE A 

Internal Surfaces on Stringers Time = 6 μs ~5.0 A/m

High Current Density Around 

these Regions are Due to the 

Penetration through the 

Access Door Seams 

Conduction 

Conduction 

Front 

Spar 

Rear 

Spar 

Stringer Joint 

for Skin 

Rib 

Time = 6 μs 

~3.5 A/m ~20 A/m <0.3 A/m

Internal Surfaces (Rib and Stringers)

Rib 

Rear Spar Front Spar 

INBD 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 20

Figure 2.17 - Close-up View at the Center of the Skin Splice in CASE A 

Close-up 

View 

Skin Splice Joint

Dry Side 

Fay Bonding 

Skin 1 

Relatively high current density of this surface should be neglected because this 

surface is within aluminum bulk and not exposed to any space. Density value is 

an average of each cell and reflects mainly the large current on top of the cell. 

20 mm Air Gap to 

Simulate 

Insufficient Contact 

Conduction 

Time = 6μs 

7.5mm 

Physical Structure of Skin Splice 

Skin 2

This 

Splice (7.5mm Air Gap) 

Wet Side 

Insulation Film 

(Simulating 

Insufficient Contact) 

Conduction 

Js=5.5 A/m 

at Upper Surface Of 

Skin Splice Joint 

Stringer Flange Skin Splice Joint 

Stringer Flange 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 21

Figure 2.18 - Close-up View of the Center of the Skin Splice (Bottom View) in CASE A; 

Interior Surface Current Distribution at Center of Model is Due to Higher Densities at Edges 

near Access Doors 

Figure 2.19 - Tank Side of the Spar in CASE A (Looking from Inside) 

Wet Side

Dry Side 

Conduction Splice 

Conduction 

Skin Splice 

Joint Stringer Flange 

Time = 6μs 

Js=9.0 A/m at Bottom 

Surface of Skin Splice 

Joint Stringer Flange 

Edge 

High Current Density in these 

Regions is Due to Current 

Concentration Near Hinges at 

Access Doors for Unit Cell 

Instruments at Ends of Tested Unit 

Cell and Fictitious on a Real Wing 

Dry Side

Js=13.8 A/m @ Center of 

Upper Surface of Spar 

Flange 

Js=0.79 A/m@ Center 

of Lower Surface of 

Spar Flange

Js ~1.0 A/m

Wet Side

Time = 6μs 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 22

Figure 2.20 - 

Tank Side 

of the Spar 

in CASE 

A 

(Close-up View) 

CASE B: Conduction and Direct Strike in Zone 2A, Component A at 3 kA 

3 kA, Component A was used in this case because that is the current applied in a comparison test 

of the same Unit Cell that was modeled. To get full scale currents at 100 kA for Zone 2A, 

Component D direct strike, the calculated values should be multiplied by 33. To get those at 200 

kA for Zone 3 conduction Component A, the calculated values should be multiplied by 67. The 

results are presented this way in the summary of Table 2.3. 

Figure 2.21 shows a close-up view of strike points and Figure 2.22 shows a waveform of the 

injection current used in the calculations. Figure 2.23 through Figure 2.30 show calculated 

current distributions with Component A, 3 kA peak injection. Extrapolated values to represent 

full threat Component D injected at a fastener are shown on Figures 2.29 and 2.30. 

With the extrapolated full threat current of 100 kA injected at a fastener (Figure 2.30), the 

interior current value of 3e4 A/m at the maximum is quite small compared with the exterior 

current value on the order of 1e6 A/m at the stroke current injection location. This is due to the 

skin effect which forces most of the current to flow directly into the exterior surfaces of the 

aluminum skin and spar panels. 

Also this is the highest density calculated anywhere within the aluminum Unit Cell. However 

this is below the arc threshold of between 6.0e4 and 1.7e5 A/m reported in Section 2.2. 

Js=13.8 A/m @ Center of 

Upper Surface of Spar 

Flange 

Js=0.79 A/m @ Center 

of Lower Surface of 

Spar Flange

Time = 6μs 

Dry Side 

Wet Side
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 23

Figure 2.21 - Current Injection Configurations for CASE B, Conduction/Direct Comp A 

3 kA Peak 

Figure 2.22 - Close-up View of Strike Point 2 to 5; Strike Point 1 is a 

Conduction Case of Figure 2.21 

Strike Point 3

Resistive lines

No Line

Strike Point 2

Resistive lines

Resistive lines

Strike Point 5

Fastener Resistance

Superimposed lines (material parameters given top priority) 

Strike Point 5'

Fastener Resistance

TE LE 

X 

Y

To Strike point 4

No Lines No Lines

2, 3 5

5’ 

Fastener edge injection Fastener direct injection Splice edge injection Splice edge injection

Splice Fasteners Calc. mesh

Strike Points 

2, 3 & 5 

Enlarged on 

Next Figure 

Current Injection Wire 4 

L

T 7

8

9

Return Foil Needed in Test Setup 

(Does not Exist in Real Wing) 

Conduction Cases: 1 

(through 6 Injection 

Wires) 

Current Injection Wire 2, 3, 5, 5'
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 24

Figure 2.23 - Component A 3 kA Injection Current Time History for the Calculation 

Figure 2.24 - Calculated Current Distribution at 6 μs on Exterior Surfaces for Conduction 

Component A, 3 kA Peak, CASE B 

CIC1-A 

~4E4 A/m

Time = 6μs 

~ 2e3 A/m 

~4e3 A/m

Conduction 1

Conduction 

~1e3 A/m 

Multiply by 67 to get Full 

Scale Currents @ 200 kA 

Conduction 

LE

TE
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 25

Figure 2.25 - Calculated Current Distribution at 6 μs on Exterior Surfaces for Direct Strike 

Component A, 3 kA Peak, CASE B 

Figure 2.26 - Rib and Spar Bulk Currents of Conduction Strike Point 1 (see Figure 2.21) Comp 

A 3 kA Peak, CASE B 

CIC2-A

~6.8E4 A/m

~1500 A/m 

3 kA

Strike Point 

Time = 6μs Strike Point 2

Multiply by 33 to get Full 

Scale Currents @ 100 kA 

LE

TE

CIC1-A

3B7 Rib Bulk Current

3B9 Rib Post to Spar Flange Bulk Current

Conduction 1 

Time (μs)

Multiply by 67 to get full 

Scale Currents @ 200 kA of 

Zone 3 Conduction Comp A. 

A

m

p

er

e

s 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 26

Figure 2.27 - Locations of Stringer Rib Fastener Currents for Direct Strike Point 2, Comp A 3 

kA Peak, CASE B 

Figure 2.28 - Stringer/Rib Fastener Currents for Fastener Edge Direct Strike, 

Comp A 3 kA Peak, CASE B 

3B6 3B5 3B4

Measurement Points

3B4 3B5 3B6

TE LE 

3B6 3B4 3B45

Strike Point 

(Direct Strike 2) 

Fastener Edge Direct Strike 2: See Next Page for Time History

Small Currents when Compared to 

those of the Skin Fasteners 

CIC2-A

Multiply by 33 to get full 

Scale Currents @ 100 kA 

Time (μs)

A

m

p

er

e

s 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 27

Figure 2.29 - Surface Current Densities on Rib 8, Fastener Edge Direct Strike, 

Comp A 3 kA Peak at 6 μs, CASE B 

Figure 2.30 - Surface Current Densities on Rib 8, Fastener Edge Direct Strike, 

Comp A 3 kA Peak at 50 μs, CASE B 

3.16E-01 

4.47E-01 

8.91E-01 

1.78E+00 

3.55E+00 

7.08E+00 

1.41E+01 

2.82E+01 

5.62E+01 

1.12E+02 

2.24E+02 

4.47E+02 

8.91E+02 

1.78E+03 

3.55E+03 

2.90E+04 

(~7.6E3 

A/

6sAt

View from Rib 7 

CIC2-A 

~2.9E4 A/m 

~ 230 A/m 

~30 A/m ~3 A/m 

Strike Point

Multiply by 33 to get Full Scale 

Currents @ 100 kA 

TE LE 

(~7.6E3 A/m 

@100 kA) 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 28

Table 2.4 shows total rib and spar internal surface currents due to a direct 3 kA Component A 

current injected to a fastener at the joint stringer below a rib. The table also shows currents due 

to 1 A of Component B current injected at the same location. Extrapolation factors applicable to 

each injected current are presented in Table 2.4. 

Table 2.4 - Calculation Results of Internal Bulk Spar and Rib Currents 

Conduction/Direct Comp A 3 kA Peak, DC Current 

CASE C: Direct Strike in Zone 2A Component D at 100 kA 

Figure 2.31 through Figure 2.39 show calculated current distributions of the Unit Cell on exterior 

and interior surfaces, with a direct strike at a fastener edge close to a skin splice in Zone 2A with 

Component D of 100 kA peak at 4 μs. Maximum interior current density is 1.5e3 A/m whereas 

exterior densities reach 1.2e6 A/m at the strike point and 7.5e4 A/m at the edges of LE/TEs. 

This result is also included in the summary of Table 2.3. 

Bulk 

Current 

Probe 

Position 

Injection Current 

Component A (3 kA) {Peak Values} DC Current (1A) {Final Values}

1 2 3 4 5 5’ 1 2 3 4 5 5’

3B7 0.4 -29 -38 -20 -40 40 0.5 -12 -24 -13 -25 26

3B9 0.1 -17 -20 -10 -21 21 0.1 -8 -13 - -13 16

Units: 

Amperes 

(Multiply by 33 to get Full Scale 

Currents @ 100 kA for Zone 2A)

Milli-Amperes 

(Multiply by 4000 to get Full scale 

Component B Results)

Strike Points 

 (Direct Strike 2, 3, 5, 5’) 

1: Conduction: See Figure 2.26 for Time History 

TE LE

Rib Spar

3B7: Rib Bulk Current 3B9: Rib Post to Spar Flange 

Bulk Current 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 29

Figure 2.31 - Current Distribution at 4 μs on Exterior Surfaces, Direct Strike in Zone 2A 

Component D at 100 kA, CASE C; Test Current Return Conductors are Shown 

Figure 2.32 - Current Distribution on Interior Surfaces - Top Skin Removed, CASE C 

1.2e6 A/m 

7.5e4 A/m 

Return Foil Needed in Test Setup 

(Does Not Exist in Real Wing) 

The Highest Current 

Density Due to the Direct 

Attachment with Comp D 

LE 

TE 

Strike Point

~ 20 A/m 

2.0e5 A/m 

Rib Surface 

Time = 4 μs 

High Current Density around this Region 

Due to the Current Concentrations at the 

Unit Cell Access Door Hinges and Injection 

Current Leads 

Front 

Spar 

Rear 

Spar 

Stringer Joint 

for Skin 

Strikepoint

INBD 

Current
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 30

Figure 2.33 - Current Distribution on Interior Surfaces - 

Close-up View of Rib and Stringers without Skins, CASE C 

Figure 2.34 - Close-up View of the Center of the Skin Splice, CASE C. 

Most of Rib 

< 30 A/m 

Edge of Rib and 

Stringers 

Fuel Tank Rib Front Spar Rear Spar 

Time = 4 μs 

INBD 

High Current Density of 

Fake Rib (Access Door) is 

Due to Test Current 

Concentrations at the 

Return Current Leads and 

Fictitious on a Real Wing Strike 

Time = 4 μs 

Fay Bonding 

7.5mm

Physical Structure of Skin Splice 

Skin Splice Joint Stringer

Skin 2 Skin 1 

This Surface

Dry Side 7.5 mm Air gap 

Closeup 

view 

Splice 

Skin Splice Joint Stringer Flange 

Js=1.5e3 A/m 

at Upper Surface of Skin Splice 

Joint Stringer Flange Wet Side 

20 mm Air Gap to 

Simulate Insufficient 

Contact 

Insulation Film 

(Simulating Insufficient 

Contact) 

Strike Point 

Strike Point
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 31

The current density of 1.5e3 is at the upper edge of the skin splice in Figure 2.34. This is the 

highest current density calculated anywhere within the aluminum Unit Cell in CASE C. This is 

below the arc threshold of between 6e4 and 1.7e5 A/m reported in Section 2.2. 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 32

Figure 2.35 - Close-up View of the Center of the Skin Splice (Bottom View) CASE C 

Figure 2.36 - Time Histories of Current Densities at Skin Splice Joint 

Stringer Flange Edges, CASE C 

Splice 

Js < 42.5 A/m at Bottom Surface of Skin 

Splice Joint Stringer Flange Edge 

Strike Point 

Wet Side 

Dry Side

Skin Splice Joint 

Stringer Flange 

Time = 4 μs 

0.00E+00

2.00E+02

4.00E+02

6.00E+02

8.00E+02

1.00E+03

1.20E+03

1.40E+03

1.60E+03

1.80E+03

0.0E+00 2.0E- 06 4.0E- 06 6.0E- 06 8.0E- 06 1.0E- 05

Time (s)

Ele. Surf. Current density (A/ m)

0.00E+00

5.00E+00

1.00E+01

1.50E+01

2.00E+01

2.50E+01

3.00E+01

3.50E+01

4.00E+01

4.50E+01

5.00E+01

0.0E+00 2.0E- 06 4.0E- 06 6.0E- 06 8.0E- 06 1.0E- 05

Time (s)

Ele. Surf. Current density (A/ m)

A. Upper Surface B. Lower Surface 

B. Lower Surface 

A. Upper Surface 

Skin Splice Joint Stringer Edge 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 33

Wet Side

Js=1.24 A/m @ Center of Lower 

Surface of Spar Flange 

Time = 4 μs 

Js=9.0 A/m @ Center of Upper 

Surface of Spar Flange 

Figure 2.37 - Current Distribution of Tank Side of the Spar, CASE C 

Figure 2.38 - Current Distribution of Tank Side of the Spar - Close-up View, CASE C 

Dry Side 

Rib ~7 A/m

Time = 4 μs

Js=9.0 A/m @ Center of Upper 

Surface Of Spar Flange 

Js=1.24 A/m @ Center of Lower 

Surface Of Spar Flange 

High Current Density in these Regions is 

Due to Current Concentration near 

Hinges at Access Doors for Unit Cell 

Instruments at Ends of Tested Unit Cell 

and Fictitious on a Real Wing 

Wet Side

Dry Side
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 34

Figure 2.39 - Time Histories of Current Densities at Upper and 

Lower Surfaces of Spar Flange, CASE C 

2.3.3 Findings of the Calculated Current Density Distributions within a 

Conventional Al Wing Fuel Tank Structure Model 

Findings of the calculated current distribution are as follows: 

 Current density of internal structure of the partial wing model (Unit Cell) was several 

orders of magnitude smaller than external current density due to skin effect which is very 

strong in an aluminum tank. 

 Calculated maximum internal current densities of the Unit Cell were 2.9e4 A/m at a rib 

edge and 1.5e3 A/m at the edge of a skin splice when 100 kA was injected to a nearby 

fastener along the rib or skin splice. These maximum values exist only in the immediate 

vicinity of direct strike location. 

 Other internal current densities were much lower, at several tens of A/m, especially for 

the much more likely conduction case when the strike occurs at a wing tip and current is 

conducted through the wing to an exit location at another place on the airplane. 

2.4 The Origin of Skin Effect 

When voltage is applied to a conductor, the initial current is confined to the conductor’s surface. 

This current is accompanied by a magnetic field. The relationship between the voltage and the 

magnetic field is given by Faraday’s law which states that: 

0.00E+00

1.00E+00

2.00E+00

3.00E+00

4.00E+00

5.00E+00

6.00E+00

7.00E+00

8.00E+00

9.00E+00

1.00E+01

0.0E+00 2.0E- 06 4.0E- 06 6.0E- 06 8.0E- 06 1.0E- 05

Time (s)

Ele. Surf. Current density (A/ m)

A. Upper surface 

B. Lower surface 

B. Lower Surface 

A. Upper Surface 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 35

The magnitude of the voltage induced in a circuit by a changing magnetic 

field equals the negative of the time rate of change of the magnetic flux 

through the area enclosed by the circuit. 

Similarly, Lenz’s Law states that the magnetically induced voltages drive conductor currents 

whose own magnetic fields tend to cancel the field initially inducing the voltage. Therefore, 

when an electric current begins to penetrate the volume of a conductor, it is opposed by surface 

eddy currents that establish magnetic fields equal and opposite to those associated with the 

penetrating current. These eddy currents act to cancel currents within the body of a conductor 

and increase the current at the surface of the conductor. In a perfect conductor (with no 

resistance), this process would occur with perfect efficiency, so that current could never 

penetrate the conductor but would always flow on the conductor’s surface. In real conductors, 

resistive losses will diminish the eddy currents and some current will eventually penetrate further 

into the thickness of the conductor. 

The confinement of electric currents close to the surfaces of conductors by this mechanism is 

known as the skin effect. At a given instant in time (or at a given frequency) the skin depth, is 

defined as the depth below the surface of a conductor at which the current density falls below 1/e

of its value at the surface, where e is the natural logarithm. 

The situation described above is illustrated in Figure 2.40 which shows a cylinder exposed to an 

initial flow of current. The current density, J, along the internal surface AB of the cylinder will 

be completely different from the current density along the exterior surface CD. This is because 

the phenomenon of skin effect delays the buildup of current on the inner surface. Only as the 

eddy currents decay, will the magnetic field penetrate the wall of the cylinder. This process 

takes 10’s or hundreds of microseconds, depending on the material and thickness of the wall. 

The higher the conductivity of the wall material, the longer the time needed for current to appear 

on the inner surface. The process of current penetration into the wall of a conductive object is 

called diffusion. 

The process of decay of the eddy currents and gradual penetration of current throughout the body 

of a conductor is known as diffusion. The process of diffusion is described below. 

Characteristic Diffusion Response

The diffusion response is the buildup of current on the inner surface of a conductor after current 

has been injected into the exterior surface. A typical response to a square wave input current is 

shown in Figure 2.41. 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 36

Figure 2.40 - Illustration of Skin Effect in a Metal Cylinder 

C D

I --+t'J:t-IC 

B 

(a) 

i; 

'" Z 

w 

a 

.... . , z 

w 

" " OJ 

u 

ro 

(b) 

EXTERNAL MAGNETIC FIELD LINE 

INTERNAL MAGNETIC FiElD LINE 

CIRCULATING CURRENT 

( •• t \ 

" ./ ...... .1 

MAGNETIC FiElD LINE PRODUCED BY 

THE CIRCULATING CURRENT 

DIRECTION OF PROPAGATION OF THE 

INTERNAL MAGNETIC FiElD 

. ~'i ei = Jp 

~ 

• A 

~ 

<> 10\ 1;\ -,' '-" ''''' '0 

..) 

'I '2 '3 tfinal 

r; ro r· , ro r; ro r; 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 37

Figure 2.41 - Diffusion-Type Response of Current on Interior Surface to Square-Wave Current 

Injected at the Exterior Surface (Time Units are Diffusion Time Constants) 

The response curve of Figure 2.41 is called a diffusion-type response and is characteristic of 

many types of situations involving the transmission of energy through a medium. An example 

would be the transfer of heat into a block of material if a heat flux were suddenly applied to one 

face of the block. 

Waveshape: Two important observations might be made about the shape of the response curve 

shown on Figure 2.41. The first is that the response initially changes only slowly and thus has a 

zero first derivative, unlike a simple exponential response, which has a finite first derivative. 

The second is that the response approaches its final value much more slowly than does a simple 

exponential response. In three time constants the response has reached 90% of its final value, 

but the rise to the 99% point takes nearly 20 time constants. 

Influence of Material: The penetration time constant is directly proportional to the 

permeability of the material, inversely proportional to the resistivity of the material and directly 

proportional to the square of the material’s thickness. The relative permeability of structural 

materials used in airplane is always very nearly unity, but thickness and resistivity can vary over 

wide ranges. 

Typical diffusion time constants for aluminum are about 40 μs per millimeter of skin thickness. 

This means that it would require 120 μs for a square wave current entering the exterior surface of 

an aluminum box to diffuse to the same current density throughout the aluminum skin. Thus a 

lightning stroke current reaching peak in 6 μs and decaying to 50 % in 69 μs can not reach 

equilibrium throughout the skin thickness. The current density on the interior of the skin reaches 

only a small percentage of that on the exterior surface, as shown by the analyses of Section 2.3. 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 38

Because of this, the skin voltage potentials available to drive currents into internal structural 

elements such as stringers and ribs are very small and so the currents in those elements are small. 

2.5 Investigative Lightning Test of Cracked Structure and Fastener 

Hardware 

2.5.1 Test Configuration 

Tests were conducted on aluminum shear ties fastened with groups of four fasteners to aluminum 

panels representing fuel tank skins. Test currents were conducted from the skin panel to the 

shear tie, as shown in Figure 2.42. Test article variants included: 

 Al panel and Al shear tie 

 CFRP panel and Al shear tie 

 Interference and clearance fit fastener installations 

Figure 2.42 - General Test Arrangement for Fastener-Related Failure Conditions; 

Test Current was Conducted from Skin Panel to Shear Tie 

Figure 2.43 shows examples of failure conditions included on the shear tie specimens. 

Conducted Lightning 

Current Path 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 39

Cracked Collar 

Missing Collar 

Crack at Hole Edge in Shear Tie 

Crack in Shear Tie 

Figure 2.43 - Examples of Failure Conditions at Shear Tie Fasteners 

The matrix of specimens tested is shown in Table 2.5. The test results are listed in Table 2.6. 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 40

Table 2.5 – Fastened Joints and Failure Conditions 

Fractured Bolt 

Cracked Collar 

Fully Cracked Shear Tie 

Crack at Hole Edge in ST 

Al Panel/Interference Fit 

Cracks with Fay Surface Bond 

Fractured Bolt 

Al Panel/Clearance Fit 

Cracked Collar 

Fractured Bolt 

CFRP Panel/Interference Fit Fully Racked Shear Tie 

Crack at Hole Edge in ST 

CFRP Panel/Clearance Fit Fractured Bolt 

2.5.2 Test Results 

Table 2.6 - Test Results for Shear Tie Fasteners with Failure Conditions 

Test Specimen Tested Failure Condition 

Range of Conducted 

Test Currents that 

Produced Sparks 

Fractured Bolt ~20 – 40 kA 

Cracked Collar ~15 – 20 kA 

Fully Cracked Shear Tie ~70 – 80 kA 

Crack at Hole Edge in Shear Tie ~85 kA 

Al Panel/Interference Fit 

Cracks with Fay Surface Bond 100 kA 

Fractured Bolt ~20 kA 

Al Panel/Clearance Fit 

Cracked Collar ~5kA 

Fractured Bolt ~50 - 60 kA 

CFRP Panel/Interference Fit Fully Racked Shear Tie ~60 – 70 kA 

Crack at Hole Edge in Shear Tie ~25 - 30 kA 

CFRP Panel/Clearance Fit Fractured Bolt ~2 – 10 kA 

Discussion about rib shear ties and fasteners with crack failure conditions: 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 41

•

400mm 

d 

70mm 

 Cracks in aluminum fuel tank structures that comprise a complete enclosure such as a 

wing box are not likely to produce arcs or sparks due to lightning currents. 

 Fully cracked shear ties and cracks at holes may spark under high shear tie current 

conditions of 50 kA – an unrealistic condition for an all-aluminum tank. 

 Cracked fasteners or nuts sparked at the lowest test current applied (5 kA). 

 Expect wide variability of test results for these kinds of tests. Therefore certification test 

levels should be set higher than expected actual shear tie currents by a margin of at least 

2.1. 

 The range of computed shear tie currents due to direct strikes to one of the shear tie 

fasteners in Section 2.3 is in the hundreds of amperes and therefore not expected to reach 

the lowest spark threshold of Table 2.7 for a cracked collar in aluminum structure, 

clearance fit (5 kA). 

2.6 Investigation of Voltages across Cracks in Aluminum Panels 

These tests were carried out in support of understanding whether the sparks observed in cracked 

panels described in Section 2.3 are actually sparks (also known as voltage sparks) or arcs (also 

known as thermal sparks). The objects of this discussion are cracks in stringers in aluminum fuel 

tanks. 

The intent of the tests was to determine the voltage that might be expected to appear across a 

crack in a fuel tank stringer when the stringer carries lightning currents. This was achieved by 

measuring the voltage drop across a hacksaw slot cut in an aluminum strip. 

The results of the tests are then related to: 

1. The expected threat currents on aluminum stringers inside aluminum fuel tanks to 

determine expected voltages stressing the crack. 

2. The consequences of the expected voltages in relation to those voltages necessary to 

create an arc (~300 V), and to sustain an arc on aluminum (14 V). 

Test Set-up and Results: The aluminum strips were 70 mm wide, with narrow slots cut in with 

a hacksaw to depths of 20 mm and 40 mm. The voltage was measured within 2 mm of the slot 

end, an extra wire was installed as a background measurement. The strips and general test 

arrangement are shown in Figures 2.44 and 2.45. 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 42

Figure 2.44 - Aluminum Strip Test Specimen and General Test Arrangement 

Figure 2.45 - Example Slot Voltage (Red Trace), Background Voltage (Blue Trace) and Injected 

Current (Black Trace) 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 43

0

50

100

150

200

250

300

Slot: 40mm Deep -

Plates: 70mm

Seperation

Slot: 20mm Deep -

Plates: 70mm

Seperation

Slot: 40mm Deep -

Plates: 2mm

Seperation

Slot: 20mm Deep -

Plates: 2mm

Seperation

Voltage difference across the slot [mV]

Test Set-up: Injected current was typically 170 A with a time to peak of 10 μs and a peak rate 

of rise of approximately 50 A/μs. For each slot depth sample, two configurations of return path 

were tested; one with a 2 mm separation of the strip from the return plate to simulate a crack in 

that part of a stringer parallel and close to the wing skin; one with the return strip 70 mm away to 

simulate a crack away from the skin. Results of the four test configurations are summarized in 

Figure 2.46. In all cases, the voltage given is the peak waveform 2 (WF2) voltage value. 

Figure 2.46 - Summary of Results (Peak Waveform 2 Voltage) for the 

4 Different Test Configurations 

Discussion of Crack Voltage Test Results: Tests reported in 2003 recorded measured currents on 

components inside aluminum fuel tanks. [28] In these tests the waveshapes inside the aluminum 

tanks were very slow, typically 100 us to peak. The highest measured value was 920 A, for the 

case of a Component A attachment over a stringer, in which stringer to fuel pipe current (via a 

bond strap) was measured at 920 A. Other currents were similarly slow, but much lower. It is 

possible to imagine stringer currents locally of greater than this, but having a similar slow 

waveshape that would not produce higher voltages at cracks. 

If there were to be a 5 kA current of 100 μs peak, this would result in a di/dt of only ~150 A/μs. 

Extrapolating from our test results on the slots, this would generate a voltage of ~750 mV across 

a 40 mm crack in a 70 mm wide stringer. 

Bearing in mind that >300 V is needed to form a spark or >14 V to maintain an arc once formed, 

there appears to be no risk of an arc initiated by a voltage spark at a crack. 

Other tests have shown that metallic stringers in composite would be subject to much higher 

currents, with relatively fast rise times, and the so cracks would present a significant hazard. 

Whether cracked metallic stringers are a potential structural fault in composite skinned tanks is 

being addressed separately in the Lightning ARC report. 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 44

3.0 Conclusions 

The tests reported in Section 2.1 of this Appendix have shown that no sparks occurred when 

the local current density where a fatigue crack exists at the edge of a panel was 6.0e4 A/m 

(60,000 A/m) (Fig. 2.11). This current density at the edge of a panel is available when 6,000 A 

of lightning current are conducted through a single structural panel that is 6 inches wide (Fig. 

2.7) 

The local current density necessary to produce an arc at the fatigue crack is 1.75e5 (175,000 

A/M) when 20 kA was conducted through the 6 inch wide structural element with a fatigue crack 

that has grown from an edge of this panel (Fig 2.7).

From these crack test results it is concluded that the ignition source threshold of fatigue cracks 

originating at the edge of a fuel tank structural element exposed to fuel vapor is somewhere 

between 60,000 A/m and 175,000 A/m (this is equivalent to between 6,000 A and 20,000 A 

through a 6 inch wide structural panel). No currents of this large magnitude have been measured 

on structural elements within an aluminum fuel tank. 

For cracks originating at a hole away from the edge of a structural element, there was only one 

case of a very faint spark. This spark is believed to correspond to a current density similar to that 

at the center of the Al plate in Fig. 2.8b which is 6.2E5 A/m x (50 kA/200 kA) = 1.5e5 A/m 

(150,000 A/m) when 50 kA Component A was conducted through the 6 inch wide panel. The 

current density to cause an arc at a fatigue crack at the edge or at the center of a panel is 

therefore about the same. With identical total currents in a panel, it is more likely that an arc 

would appear at an edge crack than at a crack away from an edge because the local current 

density is higher at an edge than at the center of a panel. 

Current Density Analysis reported in Section 2.3 of this Appendix showed that, for all-metal 

tanks, the lightning current densities at the interior surfaces of fuel tank skins and other tank 

boundaries are much lower than the current densities in the exterior surfaces of these same 

elements. This is due to the long times required for electric currents to diffuse through the 

thicknesses of metal conductors. This phenomenon is commonly known as skin effect. 

Calculated maximum internal current densities of a wing section “Unit Cell” were 2.9e4 A/m 

(29,000 A/m) (Figure 2.30) and 1.5e3 (1,500 A/m) (Fig. 2.34) at 100 kA peak. These maximum 

values appeared at the edge of a rib and the upper surface of the skin splice joint stringer flange, 

respectively. These current densities exist only in the immediate vicinity (i.e. within one fastener 

spacing or at a rib directly beneath and fastened to the struck fastener) of a fastener that has been 

directly struck in Zone 2A. They are significantly lower than the currents that produced arcs at 

the crack tests of Section 2.1. 

Other internal current densities within the tank were much lower, such as several tens of A/m, 

especially for the much more likely ‘wing tip strike’ cases, where the lightning current is 

conducted through a wing, between a struck wing tip and an exit location elsewhere on the 

airplane. 
 LIGHTNING ARC FINAL REPORT APPENDIX E - PAGE 45

The aluminum wing section whose internal current density computations are reported in this 

Appendix is typical in size of an average wing box chord and depth, and of the wing tip area of a 

large transport airplane. 

Lightning Tests of Cracked Structure and Fastener Hardware Reported in Section 2.5 of this 

appendix showed that in most situations 10’s of kiloamperes of lightning currents were required 

to produce ignition sources at failure conditions in broken bolts, collars and shear ties. The data 

is summarized in the table below. These currents are higher than the currents computed for these 

elements within the wing 

Test Results for Shear Tie Fasteners with Failure Conditions (Table 2.6) 

Test Specimen Tested Failure Condition 

Range of Conducted 

Test Currents that 

Produced Sparks 

Fractured Bolt ~20 – 40 kA 

Cracked Collar ~15 – 20 kA 

Fully Cracked Shear Tie ~70 – 80 kA 

Crack at Hole Edge in Shear Tie ~85 kA 

Al Panel/Interference Fit 

Cracks with Fay Surface Bond 100 kA 

Fractured Bolt ~20 kA 

Al Panel/Clearance Fit 

Cracked Collar ~5kA 

Fractured Bolt ~50 - 60 kA 

CFRP Panel/Interference Fit Fully Racked Shear Tie ~60 – 70 kA 

Crack at Hole Edge in Shear Tie ~25 - 30 kA 

CFRP Panel/Clearance Fit Fractured Bolt ~2 – 10 kA 

The large difference between ignition source thresholds determined by test and the computed 

actual current densities in a typical aluminum tank structure indicates that lightning is not likely 

to produce ignition sources at fatigue cracks, broken bolts, or collars within a metal fuel tank. 

The tests of fastener installations in CFRP panels indicate that lower currents may produce 

ignition sources. This is because a higher percentage of currents entering external fasteners flow 

through these fasteners to the interior structural elements.