Transport Airplane Fuel System Lightning Protection

09/24/18 AC 25.954 - 1 Appendix A Appendix A. R elated D ocuments A.1 FAA REGULATIONS .

The following 14 CFR part 25 regulations are referenced in this AC . You can download the full text of these regulations at the U.S. Government Printing Office e - CFR website.

Or you can order a paper copy by sending a request to the U.S. Superintendent of Documents, U.S. Gover nment Printing Offi ce, Washington, D.C. 20402 - 0001; by calling telephone number (202) 512 - 1800; or b y sending a request by fax to (202) 512 - 2250.

 Section 25.571, Damage - tolerance and fatigue evaluation of structure .

 Section 25.954, Fuel system lightning pr otection .

 Section 25.981, Fuel tank ignition prevention .

 Section 25.975, Fuel tank vents and carburetor vapor vents .

 Section 25.1529, Instructions for Continued Airworthiness .

 Section 25.1 7 29, Instructions for Continued Airworthiness: EWIS .

A.2 EUROPEAN AVIATI ON SAFETY AGENCY (EA SA) REGULATIONS.

Certification Specifications and Acceptable Means of Compliance for Large Aeroplanes, CS - 25 . You can get copies of CS - 25 from the European Aviation Safety Agency, Postfach 10 12 53, D - 50452 Köln, Germany; telephone +49 221 8999 000; fax: +49 221 8999 099; website: http://www.easa.europa.eu/ .

A.3 ADVISORY CIRCULARS .

The following FAA ACs are related to the guidance in this AC. The latest version of each AC at the time of publication of this AC is identified below. If any AC is revised after publication of this AC, you should refer to the latest version for guidance, which can be downloaded from the Internet at http://www.faa.gov/regulations_policies/advisory_circulars/ .

 AC 20 - 53C , Protection of Aircraft Fuel Systems A gainst Fuel Vapor Ignition Caused b y Lightning , dated September 24, 2018  AC 20 - 155A, Industry Documents to Support Aircraft Lightning Protection Certif ication , dated July 16, 2013.

 AC 21 - 16 G , RTCA Document DO - 160 Versions D, E, F, and G, “Environmental Conditions and Test Procedures for Airborne Equipment ” , dated June 22, 2011.

 AC 25 - 19A, Certification Maintenance Requirements , dated October, 3, 2011.

 AC 25.1309 - 1A , System Design and Analysis , dated June 21, 1988.

 AC 121 - 22C , Maintenance Review Boards, Maintenance Type Boards, and OEM/TCH Recommended Maintenance Procedures , dated August 27, 2012.

A - 1

09/24/18 AC 25.954 - 1 Appendix A A.4 REPORTS.

The following FAA reports are referenced in this A C:  Report No. DOT/FAA/AR - 05/8, Fuel Tank Flammability Assessment Method User’s Manual , dated May 2008. This report can be downloaded from the Internet at http://www.fire.tc.faa.gov/pdf/05 - 8.pdf .

 Repor t No. DOT/FAA/AR - TN05/37 , Intrinsically Safe Current Limit Study for Aircraft Fuel Tank Electronics , dated October 2005. This report can be downloaded from the Internet at http://www.fire.tc.faa.gov /pdf/TN05 - 37.pdf .

 Large Airplane Fuel System Lightning Protection Aviation Rulemaking Committee (ARC) Report, Large Airplane Fuel System Lightning Protection Rulemaking Recommendations , dated May 2011. This report can be downloaded from the Internet at https://www.faa.gov/regulations_policies/rulemaking/committees/documents/media/ LAFSLPARC - 8202009.pdf .

A.5 A4A DOCUMENTS.

ATA MSG - 3: Operator/Manu facturer Scheduled Maintenance Development, VOLUME 1 – FIXED WING AIRCRAFT. You can order copies of this document from A4A , 1301 Pennsylvania Avenue NW, Sui te 1100, Washington, DC 20004; t elephone : 202 - 626 - 4062; website : http://airlines.org/ .

A.6 EUROPEAN ORGA NIZATION FOR CIVIL A VIATION EQUIPMENT (EUROCAE) DOCUMENTS.

You can order copies of the following documents from EUROCAE, 102 rue Etienne Dolet, 92240 Malakoff, France; telephone: +33 1 40 92 79 30; f ax: +33 1 46 55 62 65; website: http://www.eurocae.net .

 EUROCAE ED - 14, Environmental Conditions and Test Procedures for Airborne Equipment . You should use r evision E or later. This document is technically equivalent to RTCA/DO - 160 .

 EUROCAE ED - 107A, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment , July 2010. ED - 107A and SAE ARP55 83A are technically equivalent.

A.7 RTCA DOCUMENTS .

RTCA/DO - 160E, Environmental Conditions and Test Procedures for Airborne Equipment . You should use revision E or later. You can order copies from RTCA, Inc., 1150 18th Street NW, Suite 910, Washington, DC 20036; telephone: 202 - 833 - 9339 or fax : 202 - 833 - 9434. You can also order copies online at http:/www.rtca.org . This document is t echnically equivalent to EUROCAE ED - 14.

A - 2

09/24/18 AC 25.954 - 1 Appendix A A.8 SAE INTERNATIONAL DO CUMENTS.

You can order copies of the following documents f rom SAE World Headquarters, 400 Commonwealth Drive, Warrendale, Pennsylvania 15096 - 0001; telephone : 724 - 776 - 4970; fax : 724 - 776 - 0790; websi te: http://www.sae.org .

 SAE ARP 4754A, Guidelines for Development of Civil Aircraft and Systems , December 2010.

 SAE ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment , December 1996.

 SAE ARP5412, Aircraft Lightning Environment and Related Test Waveforms , revision B, January 2013.

 SAE ARP541 4 , Aircraft Lightning Zones , revision A , September 201 2 .

 SAE ARP5416 A , Aircraft Lightning Test Methods , January 7, 2013.

 SAE ARP5583 A , Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment , June 4, 20 10.

A - 3

09/24/18 AC 25.954 - 1 Appendix B Appendix B. Definitions T h e following definitions apply to lightning protection of fuel tanks and systems of § 25.954 and the guidance in this AC.

B.1 ATT ACHMENT P OINT .

A point where the lightning flash contacts the airplane.

B.2 CONTINUED S AFE F LIGHT AND L ANDING .

The airplane can safely abort or continue a takeoff, or continue controlled flight and landing, possibly using emergency procedures. The airplane mus t do this without requiring exceptional pilot skill or strength. Some airplane damage may occur because of the failure condition or on landing. The pilot must be able to land the airplane safely at a suitable airport.

B.3 CRITICAL D ESIGN C ONFIGURATION C ONTROL L IMITATIONS (CDCCL S ) .

A limitation requirement to preserve a critical design feature of a fuel system that is necessary for the design to meet the performance standards of § 25.954 (and/or § 25.981) throughout the life of the airplane model. The purpose of the CDCCL is to provide instructions to retain the critical features during configuration changes that may be caused by alterations, repairs, or maintenance actions.

B.4 CRITICAL LIGHTNING S TRIKE .

As defined by § 25.954(a)(1), a critical lightning strike is a lightning strike that attaches to the airplane in a location that, when combined with the failure of any design feature or structure, could create an ignition source.

B.5 ESCAPES .

Production or maintenance errors that can be anticipated to occur that could re nder the fault tolerance, or lightning protection ineffective.

B.6 EXTREMELY I MPROBABLE F AILURE C ONDITION .

When using qualitative analysis, an extremely improbable failure condition is a failure condition that is so unlikely that it is not anticipated to occur during the entire operational life of all airplanes of one type. When using quantitative analysis, an - 9 extremely improbable failure condition is one having a probability of failure of 1 X 10 or less.

B - 1

09/24/18 AC 25.954 - 1 Appendix B B.7 FAULT - T OLERANT D ESIGN .

A d esign that preclude s fuel sy stems ignition sources even when a fault is present.

B.8 FUEL S YSTEMS .

As defined by § 25.954(a)(2) a fuel system i ncludes a ny component within either the fuel tank structure or the fuel tank systems and any airplane structure or system components that penetra te , connect to , or are located within a fuel tank.

B.9 FUEL T ANK S TRUCTURE .

Includes s tructural members of the fuel tank such as airplane skins, access panels, joints, ribs, spars, stringers, and associated fasteners, brackets, coatings and sealant .

B.10 FUEL T ANK S YSTEMS .

Tubing, components, and wiring that are penetrating, located within, or connected to the fuel tanks .

B.11 INTRINSICALLY S AFE .

F uel system design elements that provide effective lightning protection with no foreseeable failure modes that would render th em ineffective . These design elements have no failures or combinations of failures that can result in an ignition source. This can be due to reliable design or to a very low lightning voltage or current in that speci fic location.

B.12 LIGHTNING F LASH .

The total lightning event. It may occur in a cloud, among clouds, or between a cloud and the ground. It can consist of one or more return strokes, plus intermediate or continuing currents.

B.13 LIGHTNING S TRIKE .

Attachment of the lightning flash to the airplane.

B.14 LIGHTNI NG S TRIKE Z ONES .

Airplane surface areas and structures that are susceptible to lightning attachment, dwell time, an d current conduction. See AC 20 - 155 A , which references documents that provide additional guidance on airplane lightning zoning.

B - 2

09/24/18 AC 25.954 - 1 Appendix B B.15 LIGHTNING S TR OKE ( R ETURN S TROKE) .

A lightning current surge that occurs when the lightning leader (the initial current charge) makes contact with the ground or another charge center. A charge center is an area of high potential of opposite charge.

B.16 PRACTICALITY .

A balan ce of available means, economic viability, and proportional benefit to safety.

B.17 RELIABLE DESIGN .

A reliable design is a design that provide li ghtning protection features that are not anticipated to degrade during the life of the airplane .

B.18 RELIABLE FAULT TOL ERANCE .

A fault - tolerant fuel system design is a design that precludes ignition sources in the fuel system even when a fault is present; “reliable” means the ability to maintain the effectiveness of the protection features over the service life of the indi vidual airplane.

B.19 REMOTE .

Those conditions that are unlikely to occur to each airplane during its total life, but which may occur several times when considering the total operational life of a number of airplanes of the type.

B.20 SYSTEMS .

Systems include fuel, mech anical, hydraulic, electrical , and electrical wiring interconnection system (EWIS) components that penetrate, are located within, or connected to the fuel tanks.

B - 3

09/24/18 AC 25.954 - 1 Appendix C Appendix C. Section 6 Examples C.1 EXAMPLES FOR PARAGRA PH 6.1.2.1 OF THIS AC.

Design elements or features where providing fault - tolerant lightning ignition source prevention sh ould be practical include : 1. Installation of rivets and bolts in aluminum structure that are well bonded through processes that ensure fastener/hole fit, faste ner and hole quality, and installation practices 2. Installation of bolts in composite structure that are well bonded through processes that ensure control of fastener/hole fit, fastener and hole quality, and installation practices and with additional design features to distribute current, such as foil or mesh at the material surface.

3. Installation of lightning protective sealant or cap seals over fastener heads/ends located inside fuel tanks , where necessary .

C.2 EXAMPLES FOR PARAGRA PH 6.1.2.2 OF THIS AC.

D esign features or failures where providing fault - tolerant lightning ignition source prevention could be impractical include : 1. Fatigue cracking within structural elements such as spars, skins, stringers, and ribs.

Typically , material c ontrols, manufacturing controls, established material allowables, design margins, and life - cycle tests make the occurrence of significant cracking rare.

2. Failure of fasteners highly loaded in tension that leads to separation of the fastener or part of the f astener from the hole, or gapping of the fastener head or nut, and consequent failure of a cap seal. Typically, manufacturing controls, design margins, and life - cycle tests make the occurrence of broken bolts rare.

3. Installation of double cap seals or struc turally reinforced cap seals to retain a bolt that fails under tension , resulting in cascading failure of the cap seals .

4. Preventing damage that may go undetected by scheduled or directed field inspection and manufacturing defects for composite structure ( c ategory 1 damage in AC 20 - 107B).

C.3 EXAMPLES FOR PARAGRA PH 6.1.2.3 OF THIS AC.

Examples of p ractical design, manufacturing, and maintenance processes are listed below . Although these practices themselves are not considered to be i ndependent features for providing fault tolerance, they are measures to minimize the likelihood of failures or measures necessary to support assumptions about failure modes or rates in a safety analysis.

C - 1

09/24/18 AC 25.954 - 1 Appendix C 1. A structured design review process (as described in this AC) to ensure that all relevant design features are reviewed to identify critical design areas, critical processes, and associated testing and analysis requirements.

2. Engineering review of the proposed design to identify failure modes that may occur be cause of manufacturing errors or escapes, maintenance errors, repairs or alterations, aging, wear, corrosion, or likely damage.

3. Engineering review of manufacturing processes to identify failure modes that may occur because of manufacturing errors or escape s.

4. Engineering review of service history records to identify failure modes that may occur because of production escapes, maintenance errors, repairs or alterations, aging, wear, corrosion, or likely damage.

5. Implementation of practical manufacturing and qua lity control processes to address the issues identified through the required engineering reviews.

6. For non - fault - tolerant location, q uality control processes that require inspection of critical features by a person other than the person that performed the m anufacturing work.

7. Provisions in the ICA to identify cautions in maintenance documents regarding lightning protection features, as well as life limits or repetitive inspections for non - fault - tolerant features. For any penetration into the fuel tank, or any structural damage within the fuel tank, the SRM should specify repair methods that maintain lightning protection features.

8. Mandatory maintenance actions necessary to ensure maintained compliance with the lightning protection requirements should be include d in the Airworthiness Limitations section of the ICA as required by section H25.4 of appendix H to part 25 .

C.4 EXAMPLE FOR P ARAGRAPH 6.2.5.3 OF THIS AC.

The following is an example of an a s sessment process address ing the potential for non - fault - tolerant fuel tank structural cracking . To assess the risk due to non - fault tolerance for structural cracks , the following should be accomplished: C.4.1 Determine if the structure in this zone is su sceptible to fatigue cracking. I f it is susceptible to fatigue cracking, determine the minimum size of crack that could be a source for arcing. This crack length should then be compared to the inspection methods used for compliance with § 25.571 (Damage Tolerance) , to determine the abili ty and/or probability of detecting a crack of this size.

C.4.2 If the Airworthiness Limitations required for compliance with § 25.571 already are sufficient to ensure that it is remote (unlikely to occur on each airplane — see AC 25 - 19A ) that a crack will grow to sufficient size and gap in excess of that necessary to caus e sparking during a lightning event, then no lightning - related Airworthiness Limitations are required. T he probability of this remote condition occurring, together C - 2

09/24/18 AC 25.954 - 1 Appendix C with the remote probability of a critical lightning strike, make these combinations not foreseeable.

C.4.3 As part of the damage tolerance evaluation, an analysis should be performed to determine the duration of time (in flight cycles) it will take for a crack of minimum arcing size to grow to the minimum detectable length. This crack propagation rate should then be used along with the probability of detection for the specified inspection method to determine the exposure time. That is, the number of flight cycles an airplane may be exposed to be fore an ignition source due to a structural failure (crack, failed fastener, etc.) occurs.

C.4.4 If the Airworthiness Limitations necessary to support compliance with § 25.571 cannot ensure the likelihood of a crack in excess of that would cause sparking is remo te , and the crack would not be readily detectable within a few flights due to fuel leaks, then this condition must be included in the risk assessment of non - fault - tolerant conditions .

Further, any practical maintenance inspection should be made to minimize the exposure time. A low probability combined with low exposure time may be necessary to demonstrate that catastrophic ignition is extremely improbable, i.e., it is not anticipated to occur during the entire operational life of all airplanes of one type.

C - 3

09/24/18 AC 25.954 - 1 Appendix D Appendix D. Advisory Circular Feedback If you find an error in this AC , have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to 9 - AW A - AVS - AIR - DMO@faa.gov or (2) faxing it to (202) 267 - 181 3.

Subject: AC 25.954 - 1 , Transport Airplane Fuel System Lightning Protection Please check all appropriate line items: ☐ An error (procedural or typographical) has been noted in paragraph _______ o n page _______.

☐ Recommend paragraph _______ on page _______ be changed as follows: ☐ In a future change to this AC, please cover the following subject: (Briefly describe what you want added.)

☐ Other comments: ☐ I would like to discuss the abo ve. Please contact me.

I would like to discuss the above. Please contact me.

Submitted by: __________________________________ Date: __________________ Telephone Number: __________________ Email Address : ________ ________ _________ D - 1