# B

Nov 19, 2012

AW-CRJ/12/746

Mr. Ali Bahrami Federal Aviation Administration (FAA) Manager (TAD)
New York Aircraft Certification Office, ANE-171 1600 Stewart Avenue, Suite 410 Westbury, NY 11590

Subject: CL-600-2E25 (CRJ1000) Exemption Request Against 14 CFR Part 25.981(a)(3)

Reference: 1. FAA exemption no 10175 against 14 CFR Part 25.981(a)(3) dated
Dec 17, 2010

2. TCCA Issue Paper AV-1 edition 3 (closed) dated Oct 26, 2010

3. Revised Exemption request application form against AWM 525.981(a)(3); – see attachment 1;

4. Compliance plan (including revised Project Plan schedule) for AWM 525.981(a)(3) – see attachment 2;

5. EMC TDS-698-28-BA-2028 revision A

6. Electro Magnetic Compatibility (EMC) memo CRJ900-01-66-2012-
33 dated Oct 12, 2012 – see attachment 3

7. Fuel systems memo CRJ1000/28/2010/001/EH dated Mar 29,

2010 – see attachment 4

8. Reliability, Maintainability & Safety (RMAS) memo dated Mar 29,

2010 – see attachment NCR #061-2012 dated 29 Oct 2012

9. FAA FAA Policy memo ANM-112-08-002 dated May 26, 2009

Dear Mr. Bahrami,

The purpose of this letter is to request for an extension to the compliance date for the currently published exemption 10175 (reference item 1) against FAA requirement 14 CFR Part 25.981(a)(3) subject to FAA Policy memo ANM-112-08-002 (ref item 9). It should be noted that FAA exemption 10175 allows the CL-600-2E25 aircraft to be certificated for a limited period of time without having shown compliance to FAA Policy memo ANM-112-08-002. The time period for such an allowance expires on Dec 17, A

EROSPAC E

Bombardier Inc. P.O. Box 6087, Station Centre-ville Montréal, Québec, Canada H3C 3G9 Telephone 1(514) 855-5000 Fax 1(450) 476-7361

www.bombardier.com

# 3 Attachment 1 to BA letter AW-CRJ/12/746 dated November 19, 2012



# EXEMPTION REQUEST APPLICATION FORM

Request made by : Bombardier Inc.

400 Cote-Vertu Road West
Dorval, Quebec, Canada

H4S 1Y9

Request made to: Federal Aviation Administration (FAA)

Date request made : 19 Nov 2012 via letter AW-CRJ/12/746



# Regulatory standard(s) : 14 CFR Part 25.981(a)(3) “Fuel Tank Explosion

Prevention” at amendment 25-102

1- Requirement text :

14 CFR Part 25.981(a)(3) states:

“(a) No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapours. This shall be demonstrated by: (3) Demonstrating that an ignition source could not result from each single failure, from each single failure in combination with each latent failure condition not shown to be extremely remote, and from all combinations of failures not shown to be extremely improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely damage shall be considered.”

2- Reason for exemption request:

The reason for this exemption request is to petition for a revision to the currently published exemption 10175 against FAA requirement 14 CFR Part 25.981(a)(3) as full compliance will not be demonstrated prior to Dec 17, 2012. In TCCA Issue Paper AV-1, BA had agreed that the demonstration of compliance with AWM 525.981(a)(3) (Amendment 525-12), required substantiation by dedicated tests to ensure that the structural aspects of the CL-600-2E25 fuel tank design feature two independent, effective and reliable means of lightning protection. As well, BA needs to demonstrate full compliance for the fuel system aspects. BA plans to utilize TCCA Issue Paper AV-1 as acceptable means of compliance with 14 CFR Part 25.981(a)(3) per the guidance of FAA Policy memo ANM-112-08-002.

The results of these tests were positive but did not fully conclude that all elements of the structure demonstrated compliance with this requirement. Due to some incomplete coupon testing and test coupon failures, BA needs to conduct additional testing/analysis

# 4 

# and therefore proposes a revision to the compliance plan (see attachment 2) and the compliance date as it will no longer be achieved. This new compliance plan provides the BA position as to how compliance will be fully achieved within the areas of concern. It should be noted however that significant progress has been made to date based on the testing that has been accomplished. Compliance could currently be shown for the system aspects (as documented in RBR-BA698-144) and the majority of the structural aspects. This petition is only required due to those limited areas of the fuel tank structure where full compliance cannot currently be demonstrated.

A schedule has been included as part of this compliance plan outlining the milestones towards the completion of this deliverable by Dec 17, 2015 (see attachment 3). As the areas of concern will result in design changes to the CRJ1000, this now creates a new scenario where originally it was anticipated that no design changes would be necessary. Hence, this is why the Dec 17, 2015 date is being proposed to allow us the time to facilitate this activity. A number of factors contribute to the 3 yr extension time and why any lesser time would be of high risk. Some of these risk factors include the following:

 Test campaign of the redesign may not be successful as there are aspects of the design for which it may not be possible to provide an apparent means of protection.

 Uncertainty and/or lack of confidence in the upcoming proposed redesign option may result in additional investigations for alternate design solutions (such as other suppliers, etc) which require some buffer in the schedule for potential delays.

 No testing is currently planned to support the safety analysis. If such testing is necessary (for example if the planned redesign testing fails) the timeframe to produce additional test articles, test, and prepare the safety analysis is very

short.

3- Means of Compliance

Fuel systems:

See attachment 2 for the detailed compliance plan. Fuel system elements and related components of the wing fuel tank design, full compliance has been demonstrated and documented in BA Fuel Tank System Safety – Ignition Prevention Report, RBR-BA690- 144, as part of the CL-600-2E25 type certification activities. The details of this plan are outlined in the attached BA Fuel System internal memorandum CRJ1000/28/2010/001/EH dated Mar 29, 2010 (Attachment 4).

Structure:

For the fuel tank structure-related design elements, compliance will be demonstrated as

follows:

 For certain areas of the wing fuel tank structure, the design includes at least two independent, effective and reliable means of protection such that fault tolerance is provided for each area of the design;

 For areas of the design where it is deemed impractical or where fault tolerance cannot be established, BA will present a risk analysis and/or test data where it will be shown that fuel tank vapor ignition is extremely improbable.

# 5 

# See attachment 2 for detailed compliance plan addressing the above two items. EMC memo CRJ900-01-66-2012-33 dated Oct 12, 2012 (see attachment 3), outlines the EMC plan to complete the activities required to demonstrate full compliance for design features which did not pass the previously completed testing. BA commits to complete this exercise by Dec 17, 2015, as stated in this memo and associated schedule. Note, this covers the worst case scenario where it may reveal via further analysis & testing that the result of the non-compliance requires a design change to the aircraft. Hence this

date is based on the worst case scenario.

Once all the test data are formally documented, BA will update report RAZ-BA698-017 “CL-600-2E25 Wing Tank Structural Survey in Support of Compliance with AWM 525-14 CFR 25.981(a)(3)” (at the next applicable revision), and formally submit to TCCA for review and acceptance. Recall this RAZ report provides the methodology on how structural failures modes were discovered and later classified as potential ignition sources. This next update will ensure that all test results are properly document and compliance has been ultimately demonstrated.

The RMAS memo (Attachment 4) outlines the procedures for a safety assessment of the non-fault tolerant items identified in phase 2 of this project. Some of the work required for this phase of the project is dependent upon data that will only be made available in

the commitment shown in Attachment 3.

. 4- Compensating factors (Effect on safety)

To facilitate this time-limited exemption request revision to 10175, BA is offering the following substantiation showing that the current design is safe, in order to justify allowing BA sufficient time after the current exemption deadline date (i.e. Dec 17, 2012) to complete the tasks as noted in the above attachments.

4.1 – Protection features

4.1.1- Fasteners

The CRJ1000 wing box overall design concepts are identical to those of the CRJ700/900. The upper and lower fuel tank skins are made from aluminum alloy planks with integrally machined stringers spliced together. Fasteners at splices, rib/plank and spar/plank interfaces are of the “Hi-Lite” type, which are installed interference fit. The structural integrity of these design features for the CRJ700 and CRJ900 airplane models are currently being proven during full scale fatigue testing. The CRJ700 has been cycled for full life (i.e. reaching its target of 160,000 flights) with no anomalies noted. The CRJ900 test articles have so far successfully accumulated more than 155,000 flights with a target of 160,000 flights. No issues have been reported.

Bombardier Aerospace Process Specification (BAPS) 151-029 “Installation of Hi-Lite Fasteners”, rigorously controls the installati on of the fasteners. BAPS 151-029 specifies many acceptance criteria against which the fastener installation is checked. These criteria include the specification of holes as well as installation. Some examples of these criteria are hole diameter, hole/countersink angularity, pin protrusion limits, torquing, flushness and visual inspection for cracked nuts. Any failure to meet the acceptance criteria shall be cause for rejection.

# 6 

# In addition, all fasteners that penetrate the fuel tank are installed wet as per BAPS 157- 027, to preclude leakage and corrosion.

4.1.2 - Prior testing done on the early Challenger variants

As part of the original Challenger (CL-600-1A11) certification effort, zone 2A direct lightning strike tests were carried out on four fuel tank skin splice coupons. The coupons were constructed using the same types of materials and processes as are used for production airplanes. All coupons used representative fasteners that were installed using the same pitch as on the airplane. Both faying surface seals and fillet seals were used to make the test articles production representative. The fasteners were wet
installed; however, there was no brush sealant over the fastener ends in order to facilitate hot spot detection.

The tests included strikes to both the skin and the fastener heads. No sparking or hotspots were detected. The test results are documented in BA report RAE-600-110, “CL600 Design Compliance Aircraft Lightning Protection”.

4.1.3 - Consideration of single point failure of the fastener

When considering the robustness of our fastener design and installation, BA assures continuity of the fastener throughout the aircraft life and that there is no possibility of installation or Q.A. perturbations that could result in a fastener mis-installation or failure. Furthermore, it should be noted that there has been no reported events of in-service fastener cracking, or any other scenario that could lead to arcing (since fastener continuity is maintained as supported by fatigue testing). This is in consideration of the types of fasteners used, the controlling specifications, Q.A. requirements, thickness of fastened components, size and fastener material details, interference fit provided and historical data, which demonstrates the effectiveness of our design.

4.1.4 - Sealant

Application of sealant to the fasteners is a common method of preventing fuel leaks and is also used to aid in the prevention of an ignition source in the fuel tank during a lightning strike. According to ‘Lightning Protection of Aircraft’ (Fisher, F.A., and Plumer, J.A.), “the sealant acts to contain the arcs and sparks which occur at these fasteners during a strike attachment and prevents contac t of the arc products with the fuel vapor space.”

As previously mentioned, all fasteners that penetrate the CRJ700/900/1000 fuel tanks are wet installed. An additional brushed seal (dome sealant) is applied to the interior end of the fastener. The application of this brushed sealant is rigorously controlled by BAPS 157-027 “Integral Fuel Tank Sealing”. A Quality Assurance process is in place to ensure that all the requirements from this BAPS are met.

In addition, the BAPS requires that the fuel tank sealant be leak tested per the applicable Functional Test Procedure. In order to meet the intent of the BAPS and 25.981(a)(3), a complete wing reservoir pressure leak test is performed on every aircraft during production, per FTER-IN670-281102. This test consists of pressurizing the complete main wing reservoirs to 3.5 psi, including the collector bays and center reservoir for 60 minutes, to ensure no evidence of leakage.

# 7 

# During the SFAR 88 campaign to improve fuel system safety, BA conducted inspections of CRJ fuel tanks on in-service aircraft. It was noted that even after many years of service experience, there has been no known instance of sealant deterioration.

BA has previously presented to TCCA the use of sealant as a means of containing arcs and sparks in order to avoid having an ignition source within the fuel tank. The fuel access panels are attached to the wing by screws (which are non-interference fit) that pass through a clamping ring, pass through the access panel and are held by dome anchor nuts that are attached with rivets to the access panel (see Figure 1). During zone 2A testing of the original Challenger fuel access doors, it was found that sparking

occurred at the interface of the dome anchor nuts and the rivets used to retain the dome anchor nuts. Pictures of the sparking were recorded. The test was re-done with a new panel where the countersink holes in the retaining ring were prepared with alodine and the dome anchor nuts and retaining rivets were potted with sealant. There was noevidence of sparking or arcing during the retest. This is presented in RAE-600-110 “CL600 Design Compliance Aircraft Lightning Protection”. This report also contains other examples, such as the secondary feed fuel pump where sealant was used as a means to suppress sparking at the pump retaining fasteners and anchor nuts and rivets of the pump box.

The test described above can be seen as an example of a lightning strike to a fastener in an “oversized hole”. As shown in Figure 1, the minimum clearance between the screw

and the various holes is two thousandths of an inch.

Figure 1- Fuel Access Panel Installation GASKET 600-10189-1

HOLE Ø.23-.32 CLAMP RING 600-10186-1

HOLE Ø.251-.258

CSK 100° x Ø.499 OUTER DISH 600-10050-9

HOLE Ø.310 NUT PLATE NAS1473-A4 Washer in nut plate: Ø.289 MIN

Wing Plank

MS24694-S103

Screw diameter: Ø.246-249 Access Panel Dome Anchor Nut

# 8 

# 4.2- Supplementary Exemption justification

Further to item 4.1 above, BA will demonstrate that the CRJ1000 design is safe and justifies the exemption based on: - the BA service history of Regional & Business Jet wing designs (ref BA FRACAS

tracking database) 

# , and

- 

# the low flammability exposure of the CRJ1000 wing fuel tank ( Ref: BA substantiating
report: RAP-IN670-172 Revision B-40 Addendum 37 (Design Compliance Report - Fuel System)



# 4.2.1- Service History

BA manufactures all Regional and Challenger Business Jet wings in-house. The processes regarding wing tank fasteners installation are the same for all of these aircraft. Also, there have been no reported instances of loose fasteners or sealant degradation (through FRACAS data) on these aircraft for over 30 million flying hours (for CRJ’s alone) which includes nearly two full year s of service of CRJ1000’s currently being operated by Britair and Air Nostrum. This is further supported by the high time fuel tank internal inspections performed, with Authority participation, related to the SFAR 88 activity. No missing or damaged sealant was observed during these inspections.

4.2.2 - Low Flammability Exposure

By definition, an aluminum wing with no significa nt internal or external heating source is considered of low flammability. As per the definition prescribed in FAA AC 25.981-2A, the wing design is a relatively thin design with a large surface area to volume ratio, providing good cooling characteristics (i.e. good c ooling characteristics normally result in a surface to area volume ratio greater than 1.0; the CRJ1000 ratio is 1.7). For the center tank, assessments were performed for 14 CFR Part 26 compliance based on ground and flight tests conducted on CRJ700 aircraft, which have similar cooling characteristics as the CRJ1000. It has been demonstrated that the flammability exposure is less than 7%, in accordance with the FAA Fuel Tank Flammability Assessment Model (Monte Carlo) as per Appendix N of Part 25 and FAA AC 25.981-2A.

Ref: BA substantiating report: RAP-IN670-172 Revision B-40 Addendum 37 (Design Compliance Report - Fuel System

5 - Conclusion on the Effect on Safety

Fuel tank ignition prevention is ensured through low fuel tank flammability exposure and the preclusion of ignition sources within t he tank. The prevention of ignition sources is substantiated by analysis of all potential ignition sources, using the guidance of AC25.981-1B (noting that this AC did not address the “structural lightning” aspects) and the development of airworthiness limitations , both fuel system mandatory inspections and by defining critical design configuration control limitations (CDCCLs). As added safety justification, design changes requi red to show compliance with SCA H2002-03 have been accomplished. All the resulting mandatory modifications are included as an integral part of the CRJ1000 type design. Low fuel tank flammability exposure has been demonstrated for 14 CFR Part 26.33 compliance as per FAA guidance AC 25.981-2A and Part 25 Appendix N.

# 9 

# BA considers the design of the CRJ1000 wing a safe design, with good service history and meets authority expectations for an aluminum wing design. The BA position is that granting this exemption has no impact on safety.

6 - What factors were considered in the determination of public interest?

In accordance with TCCA Issue Paper AV-1, Edition 2,”Lightning Protection for the Fuel Tank Installation”, compliance to AWM 525.981(a)(3) with respect to lightning protection will require two independent and reliable means of protection for the wing fuel tank design of the CL-600-2E25. As stated earlier in this letter, BA will utilize this Issue Paper as an acceptable means of compliance to 14 CFR Part 25.981(a)(3) taking into account the guidelines of FAA Policy memo ANM-112-08-002. However due to the unexpected problems experienced during recent testing, BA requires the extra time needed to complete the remainder of the tasks necessary to demonstrate full compliance. BA has a high level of confidence (based on overall success of original testing) that we can achieve it. Not allowing additional time beyond Dec 17, 2012 to complete our activities can result in the absence of future sales to US operators who will not be allowed to operate a CRJ under the current terms of the exemption.

This would in turn lead to a severe economical impact on BA, potentially resulting in a

reduction in the workforce since the CRJ would have less of the market share in the United States in upcoming years (which will in turn result in fewer aircraft being built). In terms of our current and future customers, they will most likely absorb the impact of these delays/ cancellations among the flying public due to their inability to provide adequate and efficient service and as a result, increase ticket prices.

Given that the testing activities has shown that the vast majority of the aircraft structure complies with 14 CFR Part 25.981(a)(3) for fault tolerance, allowing BA to demonstrate compliance to 14 CFR Part 25.981(a)(3) for the remaining areas would be reasonable when compared to the disruptions in deliv ery schedules and the potential economical impact (i.e. penalties, loss of revenue, potential workforce reductions) and the repercussions thereof (delayed entry into se rvice, customer and public dissatisfaction) that come with these delays.

Conclusion

With the commitment to perform additional testing / analysis over and above what was already done and the justification for the effect on safety and public interest, BA hereby requests that the current exemption 10175 be revised to allow for additional time for full compliance with 14 CFR Part 25.981(a)(3) up until Dec 17, 2015.

# 10 Attachment 2 to BA letter AW-CRJ/12/746 dated November 19, 2012



# Revised COMPLIANCE PLAN ADDRESSING 14 CFR Part 25.981(a)(3)

The purpose of this compliance plan is to provide details regarding BA’s approach to demonstrating compliance with the remaining activities related to compliance with 14 CFR Part 25.981(a)(3) at Amendment 25-102.

Requirement: 14 CFR Part 25.981(a)(3)

Requirement text: “(a) No ignition source may be present at each point in the fuel tank or the fuel tank system where a catastrophic failure could occur due to ignition of fuel or vapors. This must be shown by:’ (3) Demonstrating that an ignition source could not result from each single failure, from each single failure in combination with each latent failure condition not shown to be extremely remote, and from all combinations of failures not shown to be extremely improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered.

BA Disciplines Affected: Fuel Systems (primary), EMC, and Structures

Approach to Compliance

Based on the compliance methodology used to generate FAA exemption no 10175, BA’s compliance plan for 14 CFR Part 25.981(a)(3) requires a 3-phased approach. The approach as originally communicated upon appr oval of the initial FAA exemption

remains valid . This approach was summarized as follows:

PHASE 1: Identification of Failure Modes (since completed)

Structures :

An integrated Product Development Team (IPDT) was created with members from Airworthiness, Design, Quality, Manufacturing and In-Service Engineering. The intent of this team was to analyze the structural wing tank design and consider any possible defect that could occur in the manufacturing process regardless of the probability of occurrence. In addition, consideration was also made to in-service findings that were reported to BA and the repeatability of these findings as well as any potential fatigue findings gathered from two lifetimes of fatigue testing on a full-scale test article. A set of failure modes was derived from this analysis. These results have been documented in report RAZ-BA698-017 Rev --, “CL-600-2E25 Wing Tank Structural Survey in Support of Compliance with AWM 525-14 CFR 25.981(a)(3)”.

# 11 

# PHASE 2: Classification of Failure Modes (since completed)

Structures :

Each one of the agreed failure modes identified above in phase 1 were classified into one of the following categories:

i) Not a potential ignition source; ii) Possible ignition source, fault tolerant; iii) Possible ignition source, not fault tolerant.

It should be noted that this phase concentrates solely on classifying the failure modes into one of the 3 categories above. In case ii), BA has reviewed the design and noted that these failure modes are protected by two independent features that can potentially be fault tolerant. In case iii), the failure cases are protected by one design feature.

Results of the classification of these failure modes are listed in RAZ-BA698-017 Rev A, which was further amended at Rev B to incorporate comments received from TCCA.

PHASE 3: Substantiation via Test Data and Analysis (on-going)

Structures :

The failure modes that are not ignition sources [category i) above] are eliminated in this phase. The other two categories are analyzed further.

a) Fault tolerant items: BA has reviewed the list of these potentially fault tolerant items and has developed a test scenario that will prove the validity of these items as being fault tolerant. As part of phase 3, a test scenario has been submitted outlining the items which require further testing along with a schedule to conduct these tests post certification. 4 rounds of testing have since been completed but further actions remain.

See conclusion.

b) Not fault tolerant items: BA has reviewed the list of potentially non-fault tolerant items and has concluded that substantiation shall be submitted in the form of a reliability & safety assessment. BA will investigate whether there are practical design changes that could be implemented to make these items fault tolerant. If practical changes exits, BA will demonstrate compliance as outlined in a) above. If it is impractical to change the design to be fault tolerant, a safety assessment will be conducted to show that fuel tank vapor ignition is extremely improbable.

Systems:

Fuel system elements and related components of the wing fuel tank design, full compliance has been demonstrated and documented in BA Fuel Tank System Safety – Ignition Prevention Report, RBR-BA690-144, as part of the CL-600-2E25 type certification activities. The details of this plan are outlined in the attached BA Fuel System internal memorandum CRJ1000/28/2010/001/EH dated Mar 29, 2010 (Attachment 4) A schematic is shown on the next page, that outlines the 3-phased approach.

# 12 

# Summary of 3-phased approach (up to date status): 

# Systems Structure

N/A Identification of potential failure modes

Classification of failure

modes 1) Ignition source 2) Fault tolerant 3) Not fault tolerant N/A

Provide test scenarios

for fault tolerant items and safety analysis for

non-fault tolerant items Use previous data from

SFAR 88 / SCA H2002-03
to outline failure modes, design changes, inspections and probability analysis 

# Phase 1

Phase 2

Phase 3 RAZ-BA698-017 Rev - -

RAZ-BA698-017 Rev B

RAZ-BA698-017 Rev C

Fuel system Memo



# Compliance 

# Compliance

At the current time, Testing and analysis required to complete the activities of phase 3 has not yet been completed. The exemption request outlines compensating factors that demonstrate that the airplane is safe and that the time to perform the additional testing to achieve full compliance is acceptable and in the public interest.

# 13 

# Means/Method of Compliance

1) Fuel Systems (completed)

MOC = Design Review (DR), Data (D), Analysis (A)

Method of Compliance = A review of the design has shown that the CL-600-2E25 design changes do not impact the existing test data substantiation which demonstrates compliance with this requirement. This data shows that certain areas of the fuel tank design have been proven fault tolerant with a robust design, which precludes any ignition sources in that area. Regular inspections (where practical) exist as AWL items in our Maintenance Requirements Manual (MRM) can verify the functionality of these protective features.

References:

- Fuel system design compliance report RAP-IN670-172;

- Fuel system memo CRJ1000/28/2010/001/EH dated 29 March 2010.

2) EMC (MOC remains unchanged from previous exemption. MOC methodology is now being applied to remaining testing needed to be performed)

MOC = Design Review (DR), Data (D), Test (T), Analysis (A)

Method of Compliance = A review of the design will show that the CL-600-2E25 design changes do not impact the existing test data substantiation which will be used to demonstrate compliance with this requirement for “Systems” only. This data will show that certain areas of the fuel tank design have been proven fault tolerant with a robust design, which precludes any ignition sources in that area.

For structural design elements, test data will be provided for all elements of the structural design where fault tolerance has been identified. Where fault tolerance has not been identified, it will be shown via an analysis and/or test data that these areas are ones wherein fuel tank vapor igni tion is extremely improbable.

References:

- EMC design compliance report RAE-BA670-176 “Aircraft Lightning Protection Design Compliance Report, Direct Effects”;

- EMC memo CRJ900-01-66-2010-26A dated May 12, 2010.

# 14 Attachment 3 to BA letter AW-CRJ/12/746 dated November 19, 2012



# EMC memo, CRJ900-01-66-2012-33 dat ed Oct 12, 2012 (see next page)

# BT0043-02 MW97 2001-09 

# 2 1. References

1.1. AWM 525.981(a)(3)

1.2. TCCA document Fuel System Lightning Protection Certification Areas of Discussion Revised

1/27/10

1.3. TCCA Issue Paper AV-1

1.4. AWM File 5009-6-525-4; RDIMS # 6151541 V3; NCR/RCN # 080-2010 Exemption from

Paragraph 521.31(1)(d) of the Canadian Aviation Regulations only with respect to paragraph

525.981(a)(3) of the Airworthiness Manual – Fuel Tank Explosion Prevention

1.5. FAA draft document Policy Guidance for Fuel Tank Structural Lightning Protection Policy

1.6. RAZ-BA698-017 CL-600-2E25 Wing Tank Structural Survey in Support of Compliance with AWM

525 / 14 CFR 25.981(a)(3)

1.7. Memo CRJ900-01-66-2010-26A 25.981(a)(3) Structural Lightning Protection Phase 3 Plan

1.8. Memo CRJ900-01-66-2010-62A 25.981(a)(3) Structural Lightning Protection Agreement Points –

Pass Fail Criteria

1.9. Memo CRJ900-01-66-2010-63A 25.981(a)(3) Structural Lightning Protection Agreement Points –

Test Article Grouping

1.10. Memo CRJ900-01-66-2010-64A 25.981(a)(3) Structural Lightning Protection Agreement Points –

Approach for NFT Features

1.11. Memo CRJ900-01-66-2010-65A 25.981(a)(3) Structural Lightning Protection Agreement Points –

Internal Test Levels

1.12. TDS-698-28-BA-2028 Rev A Lightning Test Procedure in Support of the CL698 25.981(a)(3)

Structural Compliance Effort

2. Test Campaign Status

In accordance with ref 1.7 BA has proceeded with at test campaign in order to show compliance with

AWM 525.981(a)(3) (ref 1.1) as described in TCCA issue paper AV-1 (Ref 1.3). This has continued post

certification as permitted by the existing partial exemption (ref 1.4).

In order to define the test cases, BA and TCCA first agreed on the applicable failure modes, on which of

these were considered potential ignition sources (documented in ref 1.6), and subsequently on how the

possible test articles could be grouped to reduce the number of test cases (documented in ref 1.9).

Additionally, the pass/fail criteria were agreed (documented in ref 1.8) an d the internal test levels were

agreed (documented in ref 1.11). This ultimately re sulted in the test plan (ref 1.12) which was used to

conduct the test campaign.

Testing was conducted in three stages from 6-8 Dec 2011, from 23-27 Jan 2012, and from 7-15 Mar 2012.

Both BA and TCCA witnessed the testing during each stage. A summary of the test results is shown

below.

# BT0043-02 MW97 2001-09 

# 3 Category Defect Test type Result

Skin-Rib interface Oversized hole (1 & 2 sizes too big) Zone 2A arc attach ment to fastener Pass

Hi-lite too long (1 & 2 sizes too long) Zo ne 2A arc attachment to fastener Pass

Gap between parts Zone 2A arc attachment to fastener Pass

Correct freeze plug Zone 2A arc at tachment to fastener Pass

Loose freeze plug Zone 2A arc at tachment to fastener Pass

Rib-Spar interface Oversized ho le (1 & 2 sizes too big) In ternal conduction (WF 5) Pass

Hi-lite too long (1 & 2 sizes too long) Internal conduction (WF 5) Pass

Correct freeze plug Internal conduction (WF 5) Pass

Loose freeze plug Internal conduction (WF 5) Pass

Rib-Standoff

interface No defect Internal conduction (WF 5) Pass

Oversized hole (1 & 2 sizes too big) Internal conduction (WF 5) Pass

Rivet too long (1 & 2 sizes too long) Internal conduction (WF 5) Pass

Wing to Fuselage

Fitting No defect Zone 3 conduction Pass

Bolt too long (1 & 2 sizes too long) Zone 3 conduction Pass

Outboard fuel access

panel Missing brush sealant on dome nut Zone 3 conduction Pass

Zone 3 arc attachment to fastener Pass

Electrical bonding area degraded Zone 3 conduction Pass

Zone 3 arc attachment to fastener Pass

Zone 3 arc attachment to panel Pass

Conductive gasket missing Zone 3 conduction Pass

Zone 3 arc attachment to fastener Pass

Zone 3 arc attachment to panel Pass

Inboard fuel access

panel Missing brush sealant on dome nut Zone 2A arc attachment to fastener Pass

Electrical bonding area degraded Zone 2A arc attachment to fastener Pass

Zone 2A arc attachment to panel Pass

Conductive gasket missing Zone 2A ar c attachment to fastener Pass

Zone 2A arc attachment to panel Pass

Water drain valve Broken O-Ring Zone 2A arc attachment to valve Pass

Zone 2A arc attachment to fastener Not Pass

Electrical bonding area missing Zone 2A arc attachment to valve Not Pass

Zone 2A arc attachment to fastener Not Pass

No brush sealant Zone 2A arc attachment to valve Pass

Zone 2A arc attachment to fastener Not Pass

Spar splice No pack sealant Internal conduction (WF 5) Pass

Table 1 - Test Summary

# BT0043-02 MW97 2001-09 

# 4 As can be seen the Table 1 above, the CRJ1000 wing structure design was found to be fault tolerant in all

cases except the following:

1. Water drain valve retainer fasteners were found to not meet lightning requirements.

2. Water drain valve was found to not be fault tolera nt to the defect scenar io where the electrical

bonding area is missing.

BA therefore proposes the way forward for each of th ese cases as detailed in the following paragraphs.

Refer to enclosed Gantt chart for overall schedule

3. Way Forward for WDV Retainer Fasteners

BA has conducted a design review of the WDV retainer fasteners in order to identify possible

modifications the design such that the retainer fasteners will be compliant with the lightning regulations.

The proposed design will next be evaluated to determine all applicable failure modes of the fasteners. BA

will then review existing data to determine if it is suff icient to demonstrate fault tolerance of the modified

fastener design. If the existing data is found to be insufficient to demonstrate fault tolerance, additional

testing will be conducted to show compliance.

4. Way Forward for WDV

The way forward for the WDV is split into different sub- sections in order to maximize efficiency and cover

all contingencies. The following sections outline the plan.

4.1. Assessment of Design vs Test

BA has noted that the test case wh ere the WDV failed is extremely severe; the complete electrical bonding

surface is missing. Preliminary disc ussions with BA in-service engineer ing have indicated they have not

received any reports of corrosion be tween the wing plank and the flange s of the WDVs. Therefore, BA

will assess whether the tested case is in fact represen tative of an actual failure mode or if this case was

overly severe. A sampling program of high time aircraft will be conducted to determine the expected

extent of corrosion on the WDV electrical bonding surface. BA will document its position along with

substantiating data and presented it to TCCA for agreemen t. If it is found that th e case is not realistic, BA

will assess if additional testing is needed or if existing test data is sufficient to demonstrate fault tolerance

of the WDV. If the existing data is found to be insufficient to demonstrate fault tolerance, additional

testing will be conducted to show compliance.

4.2. Investigation of Alternate Design Options

In parallel with activity 4.1, BA will initiate a dedicated review team to investigate alternate design options

for the WDVs. This assessment will be required in th e event that BA is unable to show via the assessment

in activity 4.1 that the current WDV design is fault tole rant however it is conducted in parallel to reduce the

potential impact if it is need. Additionally, it comprises one of the BA action items from BA-TCCA

meeting 30 Apr 12.

# BT0043-02 MW97 2001-09 

# 5 The team will investigate alternate design options to determine whether a design exists that is fault tolerant

to all possible failure scenarios (including degraded electrical bonding). This will include, among other

possibilities, investigating with fuel component suppliers into existing alternate designs of the water drain

valve itself.

If a potential design change is identified that could be shown to be fault tolerant the team will evaluated the

design to determine all applicable failure modes and review existing data to determine if it is sufficient to

demonstrate fault tolerance of the modified valve design. If the existing data is found to be insufficient to

demonstrate fault tolerance, additional testing will be n ecessary to show compliance. If the design is found

to be fault tolerant, BA will assess the practicality of implementing this design.

It should be noted that this scenario caries a risk of invalidating the work done per section 3 above, since it

may result in a modified attachment scheme which does not use the same type of fasteners.

The worst case estimate is made assuming a new WDV design is required from the fuel component

supplier.

4.3. Prepare Probability Based Safety Assessment

In parallel with activity 4.1 and 4.2, BA will cond uct a probability based safety assessment of the WDV

(per agreed approach for NFT features documented in ref 1.10). This analysis will be used in the event that

BA is unable to show via the assessment in activity 4.1 that the current WDV design is fault tolerant and is

not able to find a practical, fault tole rant, alternate design in activity 4.2.

As part of the probability based safety assessment it is required to determine the sparking threshold of the

WDV in the case where the electrical bonding is degr aded. This requires additional testing to be

conducted.

5. Exemption Extension

Due to the extensive amount of work required for the way forward plan to show compliance, BA is

requesting an extension to the existing exemption for only the areas discussed in 3 and 4 above. The

extension is required since it is not feasible for BA to complete all the above activities before the expiry

date of 29 Oct 2012 of the current exemption. BA re quests that the exemption be extended per the attached

schedule which is based on the worst case estimates for completion of all above activities.

For all areas of the fuel tank structure where the testing passed, BA will prepare the documentation

required to show compliance with AWM 525.981(a)(3) as described in issue paper AV-1 prior to the expiry

date of the current exemption.ID Task NameDuration Start Finish125.981(a)(3) Exemption Extension for WDV and WDV Housing Fastener Compliance 673 days Mon 11/5/12 Wed 9/16/152Finalize Preliminary Concepts 46 days Mon 11/5/12 Mon 1/21/133 Conduct reviews of preliminary design concept to identify failure modes and prote20 days Mon 11/5/12 Fri 11/30/124 Preliminary concept frozen 1 day Mon 12/3/12 Mon 12/3/125 Complete DV engineering of agreed design concept 25 days Tue 12/4/12 Mon 1/21/136 Update RAZ-BA698-017 with design concept, failure mode, and protection feature10 days Tue 12/4/12 Mon 12/17/127 Review RAZ-BA698-017 Rev D with TCCA 5 days Tue 12/18/12 Mon 1/7/138 TCCA agreement of RAZ-BA698-017 Rev D 1 day Tue 1/8/13 Tue 1/8/139Test Article Design and Build 230 days Wed 1/9/13 Tue 12/17/1310 Prepare 'paper' test articles 15 days Wed 1/9/13 Tue 1/29/1311 Review 'paper' test articles with TCCA 10 days Wed 1/30/13 Tue 2/12/1312 Review 'paper' test articles with BAEX 10 days Wed 1/30/13 Tue 2/12/1313 Test article concept frozen 1 day Wed 2/13/13 Wed 2/13/1314 Prepare test article engineering 30 days Thu 2/14/13 Wed 3/27/1315 Order prototype parts for testing 1 day Wed 1/30/13 Wed 1/30/1316 Receive prototype parts for testing 1 day Mon 6/10/13 Mon 6/10/1317 Test article construction 120 days Tue 6/11/13 Mon 12/16/1318 Conformity inspection 1 day Tue 12/17/13 Tue 12/17/1319Test Documentation 36 days Wed 2/13/13 Wed 4/3/1320 Prepare TDS15 days Wed 2/13/13 Tue 3/5/1321 Prepare FTER 15 days Wed 3/6/13 Tue 3/26/1322 Review TDS and FTER with TCCA 5 days Wed 3/27/13 Tue 4/2/1323 TDS and FTER approved 1 day Wed 4/3/13 Wed 4/3/1324Testing80 days Wed 12/18/13 Tue 4/22/1425 Ship test articles to lab 10 days Wed 12/18/13 Tue 1/14/1426 Testing40 days Wed 1/15/14 Tue 3/11/1427 Ship test articles to BA 10 days Wed 3/12/14 Tue 3/25/1428 Receive lab test report draft 1 day Fri 4/4/14 Fri 4/4/1429 Review and revision of lab test report 10 days Mon 4/7/14 Fri 4/18/1430 Receive final lab test report 1 day Mon 4/21/14 Mon 4/21/1431 TDI of test articles at BAEX (if required) 10 days Wed 3/26/14 Tue 4/8/1432 Present results of testing and TDI to TCCA 10 days Wed 4/9/14 Tue 4/22/1433Final Documentation 78 days Mon 4/21/14 Wed 8/27/1434 Prepare top level BA test report 20 days Mon 4/21/14 Fri 5/16/1435 Internal review and revision of top level BA test report 5 days Mon 5/19/14 Fri 5/23/1436 Submission of test report to TCCA 1 day Mon 5/26/14 Mon 5/26/1437 Update RAZ-BA698-017 with test results (rev E) 10 days Tue 5/27/14 Mon 6/9/1438 Internal review and revision of RAZ-BA698-017 Rev E 5 days Tue 6/10/14 Mon 6/16/1439 Review RAZ-BA698-017 Rev E with TCCA 5 days Tue 6/17/14 Mon 6/23/1440 Submission of RAZ-BA698-017 Rev E to TCCA 1 day Tue 6/24/14 Tue 6/24/1441 Update RAE-BA670-176 with results of 25.981(a)(3) testing 20 days Wed 6/25/14 Tue 7/22/1442 Internal review and revision of RAE-BA670-176 5 days Wed 7/23/14 Tue 8/19/1443 Review of RAE-BA670-176 with TCCA 5 days Wed 8/20/14 Tue 8/26/1444 Submission of RAE-BA670-176 to TCCA 1 day Wed 8/27/14 Wed 8/27/1445Completion of design and implementation 250 days Thu 8/28/14 Wed 9/16/1546 Design125 days Thu 8/28/14 Wed 3/4/1547 Implement production and in-service (including SOC) 125 days Thu 3/5/15 Wed 9/16/1512/31/82/131/306/1012/174/34/44/215/266/248/27ONDJFMAMJJASONDJFMAMJJASONDJFMAMJJASO2Half 1, 2013Half 2, 2013Half 1, 2014Half 2, 2014Half 1, 2015Half 2, 2015TaskSplitProgressMilestoneSummaryProject SummaryExternal TasksExternal MilestoneDeadlinePage 1Project: 981_plan.mppDate: Fri 10/12/12

# 15 Attachment 4 to BA letter AW-CRJ/12/746 dated November 19, 2012



# Fuel System Memo CRJ1000/28/ 2010/001/EH dated 31 March 2010 (see next page)

# MEMO

DATE 

# 31 March 2010

SUBJECT 

# CL-600-2E25 (CRJ1000) Fuel Tank Ignition Prevention – Aircraft
Systems; AWM 525 / 14 CFR 25.981(a)

FROM 

# Endro Haryono

TO 

# Baljeet Manhas

CC 

# Alain Loranger, Geoffrey Armstrong, Fidelio Eugenio, Guy De Langis, ,
Branko Petrovic, Peter Stoyel, Francois Hopkins, Ghislain Grenier,

James Moran, Gordon A. MacMillan, Johan Kohler

REFERENCE 

# CRJ1000/28/2010/001/EH

1. References

a. RBR-BA690-144 – Fuel Tank System Safety - Ignition Prevention Report

b. Special Condition Airworthiness (SCA) H 2002-03 - Fuel Tank System Safety - Ignition

Prevention Report

c. Policy Guidance for Fuel Tank Structural Lightning Protection Policy – Final Draft

d. RAP-IN670-173 – Fuel Tank Flammability Exposure Analysis

e. FAA approval of Bombardier CRJ Flammability Analysis Report dated 6 August 2009.

f. RAZ-BA698-017 – CL600-2E25 Wing Tank Structural Survey in Support of Compliance

with AWM 525 / 14 CFR 25.981(a)(3)

2. Background

The FAA issued a policy to determine the regulatory path of fuel tank lightning protection

(Reference 1.c). It is stated that this policy is only applicable to the fuel tank structure and does

not apply to lightning protection of the system components.

This memo outlines the safety assessment that was done on the CL-600-2D24 aircraft systems

to demonstrate compliance to SCA H2002-03 (Reference 1.b), which will also be used to show

compliance to AWM 525 / 14 CFR 25.981(a) for the CL-600-2E25.

Also, as defined in the FAA guidance, the requirement for either a special condition or

petitioning for an exemption is dependent upon fuel tank flammability exposure. Hence in

addition, this memo summarizes the CRJ1000’s fuel tank flammability exposure (Reference

1.e).

# 2 3. Fuel Tank Ignition Prevention

a. Design Changes

In general, the CRJ1000 system design is similar to the CRJ700/900. A couple of design

changes in the fuel tank or adjacent of the fuel tank were introduced. None of the changes have

a negative impact to the fuel tank ignition prevention.

The following changes will be reported in the updated RBR-BA690-144 (Reference 1.a):

i. As a result of a longer wingspan, lengthening of Slat #3 and corresponding piccolo tube by

29.5” to each wing was required.

The bleed air ducting within the center fuselage for the WAI system (LH+RH) increased in

length by approximately 56” due to the center fuselage extension. A modification of fuse to

wing bleed air duct was made to accommodate the lower wing. This change does not affect

the bleed duct length in the belly fairing area.

The new bleed duct shroud was modified from the existing CRJ700/900, which is made

from a polyamide layer impregnated with steel foil instead of silicone impregnated fibber.

The inner duct material remains as CRES 321. Bleed leak detection is routed along the

bleed duct insulation vent hole and couplings.

ii. Flux Detection Unit (FDU) is not implemented for the CRJ1000.

b. Aircraft System - Safety Assessment

The detail assessment of the aircraft syst ems is documented in the report RBR-BA690-144

(Reference 1.a), and the modifications will be addressed in a new revision to the report. The

assessment includes a list of affected system components, failure modes and potential effects

to the aircraft (Refer to Appendix A).

c. Aircraft System – Lightning and Electrostatic Discharge Protection

The system components mounted on the fuel tank structure, which may potentially cause an

ignition source (spark) if improper electrical bonding or another failure case is combined with a

lightning strike or electrostatic discharge, will be addressed separately in RAZ-BA698-017.

# 3 4. Airworthiness Limitation

Airworthiness limitation(s) would be applied to ensure that possible ignition sources in the fuel

tanks are identified and precluded by design changes or maintenance actions.

a. Critical Design Configuration Control Limitation (CDCCL)

The CDCCL list will be published as a part of the Maintenance Requirement Manual (MRM).

The CDCCL provides instructions to retain the crit ical ignition source prevention feature during

configuration changes that may be caused by component substitutions, alterations, repairs or

maintenance actions. The CRJ1000 CDCCL list would be identical to the existing CRJ700/900

(Refer to the Appendix B).

b. Fuel System Limitation (FSL)

A periodic inspection would be applied against the critical component to ensure an equivalent

level of safety. The list of component, task and interval will be published in the MRM. The

CRJ1000 FSL list would be identical to the existing CRJ700/900 (Refer to the Appendix C).

5. Fuel Tank Flammability

The CRJ1000 fuel tank flammability exposure analysis was determined based on guidance

given in FAA AC 25.981-2A and Part 25 Appendix N.

According to this method, a qualitative assessment is used to determine wing fuel tank

flammability. The center fuel tank flammability exposure was analyzed using the FTFAM/Monte

Carlo Analysis methodology as per Appendix N of Part 25.

The fuel tank flammability analysis has been completed based on aircraft test results and is

documented in RAP-IN670-173 (Reference 1.d).

a. Wing Tank

As per the criteria defined in the FAA AC 25.981-2A, it is shown that the wing main fuel tanks

are categorized as conventional aluminum with no heating source. Hence it is considered as

having low flammability. Detailed assessments are presented in the BA report RAP-IN670-173

(Reference 1.d).

# 5 

# APPENDIX A

Potential Ignition Source Hazard Assessment

(RBR-BA690-144)ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS27-601 Multi-FunctionSpoilers Wiringchaffing inconduit.All Electrical arcIgnition Sourcein Fuel Tank inthe event ofconduit burnthrough, and HotSurface Ignitionsource in FuelTank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Shielded wires inmetal conduit fromfront spar to rearspar.28-20 2 Engine FeedBoost Pumpwiring chaffing inAluminumconduit.All Electrical arcIgnition Sourcein Fuel Tank inthe event ofconduit burnthrough, and HotSurface Ignitionsource in FuelTank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Wires in metalconduit from frontspar to pumpcanister.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-20 3 Engine FeedBoost Pumpfailures increasingCanistertemperature >204°C.All Hot SurfaceIgnition source inFuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Temperatureincrease fromlocked rotor due toFOD,protection bythermal fuse.Pump cartridgesubmerged.Qualified bysimilarity andanalysis.28-20 4 Engine BoostPump produceselectrical arcsfrom internalcomponentfailures or wirechaffing.All Electrical ArcIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridgesubmerged.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-20 5 Engine FeedBoost Pumpproduces frictionsparks frominternalcomponents.All Friction SparkIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridge &impeller submerged.28-20 6 Impeller tohousing contact inBoost Pump.All Friction SparksIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridge &impeller submerged.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-20 7 Ingestion of FODin Boost PumpImpeller.All Friction SparksIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridge &impeller submerged.28-20 8 FOD Ingestion orcomponentfailures causingBoost PumpMotor to stallheating windings>204°C.All Hot SurfaceIgnition source inFuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridge &impeller submerged.Qualified by test andanalysis.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-20 9 APU Fuel Pumpfailures increasingCanistertemperature >204°C.All Hot SurfaceIgnition source inFuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Temperatureincrease fromlocked rotor due toFOD, protection bythermal fuse.Pump cartridgesubmerged.Qualified bysimilarity andanalysis.28-20 10 APU Fuel Pumpproduceselectrical arcsfrom internalcomponentfailures or wirechaffing.All Electrical ArcIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridgesubmerged.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-20 11 APU Fuel BoostPump producesfriction sparksfrom internalcomponents.All Friction SparkIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridge &impeller submerged.28-20 12 Impeller tohousing contact inAPU Fuel Pump.All Friction SparksIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridge &impeller submerged.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-20 13 Ingestion of FODin APU FuelPump Impeller.All Friction SparksIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridge &impeller submerged.28-20 14 Fuel TransferSOV body heating>204°C.All Hot SurfaceIgnition source inFuel TankFAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Qualified bysimilarity andanalysis.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-20 15 Cross-Flow PumpFailuresincreasingTemperature>204°C.All Hot SurfaceIgnition Sourcein TankFAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Temperatureincrease fromlocked rotor due toFOD. Protectioncarried out bythermal Fuses.Pump Cartridgesubmerged.28-20 16 Cross-Flow Pumpproduceselectrical arcsfrom internalcomponentfailures or wiringchaffing.All Electrical ArcIgnition source infuel tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridgesubmerged.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-20 17 Cross-Flow Pumpproduces frictionsparks frominternalcomponents.All Friction SparkIgnition Sourcein fuel tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridge andimpeller submerged.28-20 18 Ingestion of FODin Cross-FlowPump Vaneelements.All Friction SparkIgnition Sourcein fuel tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridge andimpeller submerged.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-20 19 FOD ingestion ofcomponentfailures causingCross-Flow Pumpmotor to stall,heating winding>204°C.All Hot SurfaceIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.QualificationTesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Pump cartridge andimpeller submerged.28-20 20 Gravity TransferSOV motorheating >204°C.FLT Hot SurfaceIgnition source inFuel Tankthrough Fuel tankwall.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.QualificationTesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Low operatingcurrent (1.5 A).Qualified explosionproof.In order for fuel toget in the actuator,two seals must bedamaged (one in thevalve body and onein the actuator).Same actuator isused to drive theball valve of theAPU and engineSOVs. Therefore theassessment isapplied to the engineand APU SOV.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-20 21 Refuel DefuelSOV Solenoidheating >204°C.GND Hot SurfaceIgnition source inRefuel/DefuelManifoldHousing.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.QualificationTesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Low operatingcurrent (0.5 A).28-40 22 Fuel QuantityGaugingComputer failurecausing highenergy output toFuel QuantityProbes.All Hot SurfaceIgnition source inFuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-40 23 Fuel Quantitygauging wiringchaffing withpower wiringcausingcapacitance probediode heating>204°C.All Hot SurfaceIgnition source inFuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Qualificationtesting.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Fuel Qty gaugingwires are in thesame harness as thefuel temperaturesensor wires andhigh level sensorwires and aresegregated fromother aircraft wires.HLS and gaugingprobes are energizedwith 28V whiletemperature sensoris energized withlow voltage fromDCU.28-40 24 Fuel Quantitygauging wiringchaffing withpower wiringcausing electricaldischarge acrossgap.All Electrical ArcIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Fuel Qty gaugingwires are in thesame wiring harnessas the fueltemperature sensorwires and high levelsensor wires and aresegregated fromother aircraft wires.HLS and gaugingprobes are energizedwith 28V whiletemperature sensoris energized withlow voltage fromDCU.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-40 25 Fuel Quantitygauging wiringchaffing in tank.All Electrical ArcIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.28-40 26 Fuel TemperatureProbes wiringchaffing withhigh-energywiring resulting inprobe heating to>204°C.All Hot SurfaceIgnition source inFuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Fuel Qty gaugingwires are in thesame wiring harnessas the fueltemperature sensorwires and high levelsensor wires and aresegregated fromother aircraft wires.HLS and gaugingprobes are energizedwith 28V whiletemperature sensoris energized withlow voltage fromDCU.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-40 27 High LevelSensor Probeglass bead failure.All Filament HeatingIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Powered duringcentre tank to maintank transfer.28-40 28 High LevelSensor Probeglass bead heats>204°C fromwiring chaffingwith high-energywiring.All Hot SurfaceIgnition source inFuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Powered duringcentre tank to maintank transfer.Fuel Qty gaugingwires are in thesame wiring harnessas the fueltemperature sensorwires and high levelsensor wires and aresegregated fromother aircraft wires.HLS and gaugingprobes are energizedwith 28V whiletemperature sensoris energized withlow voltage fromDCU.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS28-40 29 Pressure Sensordiaphragm failureresulting inmicroswitch andwiring exposureto vapor.All Electrical ArcIgnition Sourcein Fuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.28-40 30 Scavenge EjectorDelta-P SensorSwitch heats>204°C fromwiring chaffingwith high-energywiring.GND Hot SurfaceIgnition source inFuel Tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS29-00 31 Hydraulic FluidOverheat >204°Cin hydraulic linespassing throughfuel tanks.All Hot surfaceIgnition source infuel tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Thermal Analysisand tests.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.33-40 32 Landing and TaxiLightscompartmenttemperature heatswing tank surface>204°C.GND Hot surfaceIgnition source infuel tank.FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Thermal Analysis.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.Landing and taxilights are 13 inchesin front of the frontspar. In addition,maximumtemperature of thelights is 97°C.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS36-10 33 Bleed duct leakover centre fueltank heatingcentre tanksurface>204°C.All Hot surfaceIgnition source infuel tank.FAR 25.901FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Thermal Analysis.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.There is a thermalblanket between theAnti-Ice pipes andthe top of the centretank.The CRJ1000 bleedduct configurationrunning over thecenter tank ismodified fromCRJ700/900. Theshroud is made frompolymide layerimpregnated with asteel foil instead ofsilicone impregnatedfiber.The main bleed ductis stainless steel(CRES 321). Bleedleak detection isrouted along thebleed duct insulationvent hole andcouplings.ATA ITEMNOHYPOTHETICALCOMPONENTFAILUREFLIGHTPHASEPOTENTIALEFFECT ONAIRCRAFTREQUIREMENT METHOD OFEVALUATIONASSESSMENTREPORTSECTIONREMARKS36-10 34 Anti-Ice ductoverheat heatingfront sparsurface>204°C.All Hot surfaceIgnition source infuel tank.FAR 25.901FAR 25.981FAR 25.1309Fuel Tank SystemSafety Review.Thermal analysis.RBR-BA690-144The appropriatesections of thereport will beupdated to showcompliance forCRJ1000.The updated reportwill be submittedas part of basictype certification.The CRJ1000 bleedduct connects thefuselage to the wingand passing by thefront spark ismodified fromCRJ700/900. Theshroud is made frompolymide layerimpregnated with asteel foil instead ofsilicone impregnatedfiber.The main bleed ductis stainless steel(CRES 321). Bleedleak detection isrouted along thebleed duct insulationvent hole andcouplings.Anti-Ice duct is inthe inboard leadingedge area andconnected to the slatvia the telescopicduct.

# 6 

# APPENDIX B

Critical Design Configurati on Control Limitation (CDCCL)

Maintenance Requirement Manual (MRM) CSP B-053AIRWORTHINESS LIMITATIONSTEMPORARY REVISION 2−268Date: Dec 18/08Airworthiness LimitationsPart 2 of Maintenance Requirements ManualSection 3 − Fuel System LimitationsTR 2−268Page 2 of 2Table 1 − List of Critical Design Configuration Control Limitations (CDCCL)CDCCL ITEMSCRITICAL IGNITION PREVENTION FEATUREMANUAL REFERENCEAPPLICABILITYPink striped protectivesleevesor,Production − Pink WireJacket W22 CodeChaffing of Gauging wire with power wires causing fuelprobe overheatWDM 28−40−00SB 670BA−24−011Front spar wire clippingfailure inspectionChaffing of Gauging wire with power wires causing fuelprobe overheatAMM 24−90−00−220−801SB 670BA−24−012Self−bonding couplings infuel tanks. P/ N 14J26,LC459Bonding of fuel and vent lines for lightning protectionAMM 51−80−00−760−802SB 670BA−28−014LRU Sealant inspectionPreventing arc forming in gaps due to lightningAMM 28−00−00−220−801ALL AIRCRAFTThermal Fuse assembly onHydraulic System #1 and#2Preventing Hydraulic System overheat by dumpinghydraulic fluid overboard before it reaches the Fuel Tankauto−ignition temperatureAMM 29−11−14−961−801SB 670BA−29−005CL 600 2C10, CL 600 2D15, CL 600 2D24

# 7 

# APPENDIX C

Fuel System Limitation (FSL)

Maintenance Requirement Manual (MRM) CSP B-053TASKNUMBERTASK CODE/TASK TITLE/TASK DESCRIPTIONLIMITINGINTERVALFUEL SYSTEM LIMITATIONSMODELEFFECTIVITYAMTOSSAIRWORTHINESS LIMITATIONSBCL-600-2C10, CL-600-2D15 and CL-600-2D2424-90-00-60120000 Flight HoursFUEL TANK WIRING HARNESS INSTALLATION: Detail Inspectionof the fuel tank wiring harness installation in the fuselage forcondition and security.24-90-00-220-802All24-90-00-60220000 Flight HoursFUEL TANK WIRING HARNESS INSTALLATION: Detail inspectionof the fuel tank wiring harness installation at the center tankfront spar for condition and security.24-90-00-220-801All28-00-00-60120000 Flight HoursFUEL TANK LINE REPLACEABLE UNIT SEALANT: DetailInspection of all the fuel Tank LRUs to ensure the condition andintegrity of the sealant around their mounting surfaces andattachments.28-00-00-220-801All28-11-23-60120000 Flight HoursFUEL STOWAGE SYSTEM PIPE: Functional check toensure thatthe electrical bonding values of the Fuel Stowage System PipeAssy`s is within tolerannce.28-11-23-720-801All28-11-23-60220000 Flight HoursFUEL STOWAGE SYSTEM PIPE BONDING JUMPER: Detailinspection of the Fuel Stowage System Pipe Bonding Jumpers forcondition and security.28-11-23-220-801All28-12-13-60120000 Flight HoursCLIMB VENT LOOP BOOT ASSEMBLY AND DRAINAGE TUBE:Detail inspection of the climb vent loop boot assy`s and drainagetubes for condition and security.28-12-13-220-801All29-30-00-6018000 Flight HoursHYDRAULIC SYSTEM # 3 TEMPERATURE TRANSDUCER:Operational check of the Hydraulic System # 3 TemperatureTransducer via EICAS29-36-00-710-801All29-30-00-60230000 Flight HoursHYDRAULIC SYSTEM # 3 TEMPERATURE TRANSDUCER:Discard the Hydraulic System # 3 Temperature Transducer29-36-03-961-801AllAirworthiness LimitationsPart 2 of Maintenance Requirements ManualSection 3 - Fuel System LimitationsPage 2 - 3 - 5Revision: 10Revision Date: Mar 20/2008See Effective TRTEMPORARY REVISION 2−269The contents of this Temporary Revision have been approved by the Chief, Engineering (or designate), National Aircraft Cerification Branch, TransportCanada Civil AviationDate October 10, 2008Signed Roop DhaliwalFILING INSTRUCTIONS:Insert this Temporary Revision (TR) 2−269 facing page 2−3−5 in Part 2 of the Maintenance RequirementsManual.Record the incorporation of this Temporary Revision on the yellow RECORD OF TEMPORARY REVISIONSsheet at the front of this Part.Keep this Temporary Revision until normal revision service incorporates this information into the MaintenanceRequirements Manual.DESCRIPTION:To add TASK NUMBER 29−30−00−603.TASKNUMBERMODELEFFECTIVITYAMTOSSTASK CODE/TASK TITLE/TASK DESCRIPTIONLIMITINGINTERVAL29−30−00−603ALL29−11−14−961−801HYDRAULIC SYSTEM #1 and #2 THERMAL FUSE: Discard thesystem #1 and #2 thermal fuse (Post Modsum 670T112042 or SB670BA−29−005)10000 Flight HoursCL−600−2C10, CL−600−2D15 AND CL−600−2D24AIRWORTHINESS LIMITATIONSAirworthiness LimitationsPart 2 of Maintenance Requirements ManualSection 3 − Fuel System LimitationsPage 1 of 1TR 2−269Date: Dec 18/2008CL 600 2C10, CL 600 2D15, CL 600 2D24

# 16 Attachment 5 to BA letter AW-CRJ/12/746 dated November 19, 2012



# RMAS Memo: Procedure for the Nu merical Probability Assessment of

the CRJ-1000 Fuel Tank Structural Non-Fault Tolerant Feature
Failures, dated March 29, 2010. (see next page)

# MEMO

DATE 

# March 29, 2010

SUBJECT 

# Procedure for the numerical probability assessment of the CRJ-1000

fuel tank structural Non-Fault Tolerant Feature Failures

FROM 

# Z. Klim, J-P. Dargis

TO 

# B. Manhas

CC 

# R. Heppell

Reference:

1. Policy Guidance for Fuel Tank Structural Lightning Protection Policy, 2010

2. RAZ-BA698-017, Rev.A, Wing Tank Structural Survey in Support with Compliance with AWM525 /14CFR 25.981(a) (3)



# 1. Introduction

This Memo provides BA approach to establish compliance with current regulatory standards

applicable to lightning protection of the CRJ-1000 fuel tank structure for Non-Fault Tolerant

Feature Failures by numerical probability assessment. The proposed procedure is using the

criteria defined in the FAA Policy Guidance for Fuel Tank Structural Lightning Protection Policy

(ref.1) and is aligned with the regulatory path described as petitioning for an exemption.

For areas of the design where it is found to be impractical to provide fault tolerance, the required

numerical probability assessment will be conducted to ensure a fuel vapor ignition is extremely

improbable. An extremely improbable probability is described in AC 25.981-1C as failure

conditions so unlikely that they are not anticipated to occur during the entire operational life of

all airplanes of one type. Numerically this is defined to be less than 1 x 10 -9 

# events per flight

hour. The purpose of the assessment is to substantiate that the probability of failures associated

with non-fault tolerant features that might lead to a fuel tank explosion is in extremely

improbable category.



# 2. General Approach to the Numerical Probability Assessment

The relevant non-fault tolerant structural design areas that may contribute to ignition sources

inside the fuel tank when a failure occurs will be identified. Each type of non-fault tolerant

feature failure will be assessed and the result will be summed.

Once the non-fault tolerant feature failure (NFTFF) types are identified, their failure rates will be

determined using the available data. Some additional factors might be considered when

# 2 determining failure rates including the configuration or design specific details as described in the

Policy.

The main steps of the process leading to the identification and numerical probability assessment

of the NFTFFs are described below:

1. Identify potential failure modes

2. Assess failure condition

3. Determine fault tolerance

4. Determine practicality of providing fault tolerance

The set of the potential failure modes regardless of the probability of occurrence was

established by performing a complete wing tank su rvey in pertinent areas related to fuel tank

lightning protection as defined FAA “Policy Guidance for Fuel Tank Structural Lightning

Protection”(ref.1). If the failure assessment result s in demonstrating that the design is free from

ignition sources after assessment of relevant single failure conditions, then the design is

considered to be fault tolerant. If not, then further analysis is required per numerical probability

assessment for the Non-Fault Tolerant Feature Failures. The subset of NFTFFs was defined

and the numerical probability assessment will be performed according to the guideline provided

in section 3.5 of the Policy.



# 3. Numerical Probability Assessment

The purpose of this assessment is to substantiate that it is extremely improbable that failures

associated with non-fault tolerant features will lead to a fuel tank explosion. The sample fault

tree diagram in Figure 1 provides an example of a fault logic structure that will be used for

conducting this numerical assessment. Basic ev ents are user supplied probability inputs, which

will be assessed based on the available data, tests and recommendation from the Policy. After

that, these probabilities will be multiplied together when linked by an “AND” gate or summed

together when linked by an “OR” gate. The relevant non-fault tolerant structural design areas

that may contribute to ignition sources inside the fuel tank when a failure occurs will be

identified. Each type of non-fault tolerant feature failure will be assessed and the result

summed. To be compliant, the top-level event must result in a numerical value less than 1 x 10 -9



# events per flight hour. The steps related to the probability inputs assessment and analyses are

described below.

# 3 Figure 1 – Procedure of the analysis for numerical probability assessment of the NFTFFs

Step 1 – probability of lightning attachment to aircraft per flight hour will be assessed based on

the available data and the recommendation from the Policy. According to the AC20-155 and

ARP5412A the probability of lightning attachment to aircraft vary between 1/1000 and 1/20 000.

Nominal probability is considered to be: 1/3000. Therefore the probability of 3E-4 can be used 3.11

Overall Probability of Fuel Vapor Ignition Event

3.9 Overall Spark Probability at

NFTFF1 3.10 Fleet Average Flammability Exposure (FEET)

3.7/3.9

Failure Probability of

NFTFF1

Factor for

Current Exceeding Sparking

Threshold for

NFTFF1 Probability of Vapor Ignition due

to Non-Fault

Tolerant Feature

Failure 1 (NFTFF1)

3.9

Current

Exceeds Sparking

Threshold at

NFTFF1 Probability of Vapor Ignition due

to Non-Fault

Tolerant Feature

Failure 2 (NFTFF2)

Overall Probability

of Attachment to

General Area of

NFTFF1

Probability of

Lightning

Attachment to

Aircraft Per Flight Hour Distribution

Factor for

Attachment to

General Area of

NFTFF1 Probability of Vapor Ignition due

to Non-Fault

Tolerant Feature

Failure 3 (NFTFF3) 

# Criteria: Overall Probability of
Fuel Vapor Ignition Event ≤ 1E-9

Typically 3E-4 See Table 3.9-1 See Figures 3.9-1

and 3.9-2



# 1 2 3 4 5 6

# 4 for the purpose of this analysis as recommended by the Policy. BA field data will be used also to

assess this probability.

Step 2 – distribution factor for attachment to general area of the aircraft will be obtained by

combining the probability of lightning attachment to an aircraft with a distribution of initial

lightning attachment locations on an aircraft (i.e. the percentage of lightning attachments to

initial entry and exit locations). While there can be several possible combinations of initial

lightning entry and exit locations per lightning strike event, for purpose of this analysis only one

set of initial lightning attachment locations (i.e. one “entry” and one “exit” point) will be assumed.

The distribution of initial attachment locations will be obtained from manufacturers’ data or the

generic numbers as provided in Table 3.9-1 of the Policy.

Step 3 – factor for current exceeding sparking threshold in a joint that would potentially cause

an ignition source given a failure condition will be established. While there are various lightning

current components and energy parameters that can influence ignition sources, for this

numerical probability assessment it is acceptable to simplify things by using a peak stroke

current distribution for the lightning threat exceedance curves. Acceptable peak current

distributions for Zone 1 and Zone 2 threats are provided in Figures 3.9-1 and 3.9-2 (ref.1). The

ignition source (sparking) threshold data (kA) will be determined using test objects containing

the fastened or bonded joint with the failure condition implemented. The result of this activity will

be amplitudes of direct strike or conducted lightning currents in kiloamperes (kA) that are the

maximum levels where ignition sources should not occur under specific failure conditions. This

ignition source threshold must be compared with results of analysis to determine what

conducted current levels are expected at non-fault tolerant features. The exceedance probability

results are based upon the ratio of the sparking threshold over joint current conducted by the

fastener to interior structure and scaling by a full threat stroke current factor. The exceedance

probability value will be taken from Figure 3.9-1 or Figure 3.9-2 for the respective zones.

Step 4 – failure probability of NFTFF will be determ ined using all available data from the field.

Numerical analysis methods and engineering judgment will be used to estimate these failure

rates based on conservative assumptions. For most structural lightning protection features, the

failure modes are latent which means that once failed they will be failed until repaired or until the

end of the airplane life. The NFTFF average probability of failure will be considered for latent

failure modes and normalized value per flight hour will be used in the probability calculation as

recommended by the Policy.

Step 5 – fleet average flammability exposure is defined as a percentage of the total flight time,

including from preflight through disembarking and unloading cargo, that the fuel tank is

considered flammable. According to the Policy for existing type certificated aircraft with a

passenger capacity of 30 or more or a payload capacity of 7500 pounds or more subject to the

provisions of 14 CFR Part 26, it is permissible to utilize the value of 7% as a default flammability

exposure for those applicants not otherwise required to meet the requirements of Appendix M