Fuel Tank Safety Training
Fuel Tank Safety Phase 1
Students Training Material
Revision 161209
Page 1 of 20
1
Introduction
This training session will provide Phase1 Fuel Tank Safety training information (previously known as Level 1 – Familiarisation Training). Fuel System Safety can potentially effect wide-ranging implementation of: • Inspection and Maintenance Programmes • Implementation of Airworthiness Directives and Service Bulletins • Quality Management and documentation • Certification Maintenance Requirements • Life limited parts • Airworthiness Limitations • Flight Manual limits • MMELs (Master Minimum Equipment Lists) • Occurrence Reporting etc.
2
Training Objectives
Be familiar with basic elements of fuel tank safety issues Be able to give a simple description of the historical background & elements requiring a safety consideration, using common words & showing examples of non-conformities • Be able to use typical terms e.g. EASA TGL 47
• •
EASA Phase 1 Requirements – applicability:
• Personnel of competent authorities responsible for oversight of organisations • The quality manager and quality personnel of Part M organisations • The group of persons that represent the maintenance management structure of the [Part 145] organisation, the quality manager and the staff required to quality monitor the organisation Appendix IV to 2009 AMC 145.A.30 (e) and Appendix XII to 2009 AMC M.A.706 (f) state: [Awareness] Training should be carried out before the person starts to work without supervision, but not later than 6 months after joining the organisation. Completion of the previously termed ‘Level 1 Familiarisation’ training complies with the training requirements for Phase 1. The UK CAA set a deadline for completion of the previously termed ‘Level 1’ training within their remit as the end of March 2008. Phase 1 Training does not require a two yearly Continuation Training input. It is acceptable that Phase 1 training may be delivered by a Training Bulletin, other self study or informative session. Signature of the reader is required to ensure that the person has passed the training.
3
Phase 1 Course Contents • A short background showing examples of Fuel Tank Safety (FTS) accidents or incidents • The description of concept of fuel tank safety and Critical Design Configuration Control Limitations (CDCCL) • Some examples of manufacturers documents showing CDCCL items • Typical examples of FTS defects
Revision 161209
Page 2 of 20
• •
4
Some examples of Type Certificate (TC) holders repair data Some examples of maintenance instructions for inspection.
Phase 2 (Detailed) Training Objectives - the scope of Phase 2 training is provided here for reference purposes only.
1. Know the history and the theoretical & practical elements of the subject; have an overview of FAA Special Federal Aviation Regulations (SFAR) 88 and JAA Temporary Guidance Leaflet TGL 47; 2. Be able to give a detailed description of the concept of fuel tank Airworthiness Limitations Items (ALI), Critical Design Configuration Control Limitations (CDCCL), and use theoretical fundamentals and specific examples; 3. Have the capacity to combine & apply the separate elements of knowledge in a logical & comprehensive manner; 4. Have detailed information on how the above items affect the aircraft; 5. Be able to identify the components or parts or the aircraft subject to FTS from the manufacturer’s documentation; 6. Plan the action or apply a Service Bulletin and an Airworthiness Directive. Compliance to Phase 2 training is within 12 months of joining the organisation or at the latest by 31st December 2010 for required personnel. A multi-choice examination with a 75% pass mark is required to validate the Phase 2 training. See EASA AMCs referenced in ED 2009/006/R and 2009/007/R for further details and guidelines. Training is required for the following personnel: Part M subpart G staff involved with management and the continuing maintenance of Airworthiness eg. Staff managing and enacting CDCCLs, SB assessment, work planning and maintenance programme management. - Refer to AMC in EASA ED 2009/006/R for further details and course content Part 145 staff required to plan, perform, supervise, inspect and certify the maintenance of aircraft & fuel system components. - Refer to AMC in EASA ED 2009/007/R for details, training content and further guidance on training materials. This nominates an extensive group of operational staff within an organisation. Phase 2 Training requires two yearly continuation training.
The following slides summarise significant fuel accident events since the mid 1990’s
Revision 161209
Page 3 of 20
5
TWA Flight 800 – 17th July 1996
A short circuit outside of the centre wing tank allowed excessive voltage to enter the tank through Fuel Quantity Indication System (FQIS) wiring.
The TWA 800 accident, alongside other historically unexplained fuel tank explosions, then commenced the drive to the latest change in fuel safety working practices adopted by the FAA and EASA.
6
Remains of the TWA Flight
17th July 1996, a B747-100, Registration N-93119, departed JFK at 20.19 hrs local time for Paris. 11 minutes into the flight at 13,700ft near Long Island NY, a fuel explosion occurred. All 230 on board were killed. Problems were found in the Fuel Quantity Indication System and ground handling actions. ‘Contributing factors to the accident were the design and certification concept that fuel tank explosions could be prevented solely by precluding all ignition sources and the design and certification of the Boeing 747 with heat sources located beneath the CWT (Centre Wing Tank) with no means to reduce heat transferred into the CWT or to render the fuel vapour in the tank nonflammable’. Estimated temperature in empty CWT with ground running before take-off was 49°C. Many basic design and certification assumptions about installed fuel tank systems had to be substantially revised.
Revision 161209
Page 4 of 20
Initial action on Fuel System Safety was commenced by the FAA which then initiated a JAA interim policy -JAA INT/POL/25/12 - on 1st October 2000.
7
EI-BZG 737-300 Manila 11th May 1990
• • • •
Fuel Vapour Explosion from empty CWT on ground. Damaged/chaffed wiring from float switches. Conditioning packs running. High ambient temperature.
Ambient air temperatures were high, at least 35°C, was recorded. The air conditioning packs located beneath the centre wing fuel tank which had been running on the ground before pushback for approximately 30 to 45 minutes. The centre wing fuel tank, which had not been filled for 2 days, probably contained fuel vapours. Shortly after pushback a powerful explosion in the centre fuel tank pushed the cabin floor violently upwards. 8 out of the 114 passengers died. The airline had fitted logo lights after delivery which involved additional wires to be passed through vapour seals in the fuel tanks. The NTSB issued four safety recommendations, urging immediate inspection or testing of fuel boost pumps, float switch wiring from float switches to the refuelling panel for chaffed or damaged insulation material on Boeing 737-300,-400 and -500 series aircraft. Source: Investigation Report B737-300 / PR143, 11 May 1990; NTSB safety recommendations A-90100/103
8
March 2001 – Thai Airways 737 • Centre tanks pumps left running on ground when dry • Electrical fault in centre tank
Revision 161209
Page 5 of 20
Centre Tank exploded. The aircraft was being prepared for a departure to Chiang Mai. 149 passengers were waiting to board. The fire erupted into the cabin, killing one cabin crew member and injuring 6 others. The fire was put out by RFFS in 60 minutes. The aircraft was destroyed. Common Features of Significant Accidents The above accidents had several common features: • Air conditioning packs running during ground operations • CWT empty and high outside air temperatures experienced • CWT pumps running at time of explosions • Exact origin of ignition not positively identified
9
China Airlines 737-800 20th August 2007 • On taxi and arrival onto stand, slats were retracted. • Loose slat fairing bolt pierced 1” hole in slat can causing fuel leak. • Fuel tank explosion & ignition source uncertain.
A further Recent Fuel Accident: Okinawa, Japan 20th August 2007. Following retraction of the slats after landing and taxy to stand, a loose bolt of the main slat track downstop assembly punctured the wing slat can which resulted in a fuel leak. The hole was about 0.8-1.2 inches in diameter. An ignition occurred of unknown origin and a fire progressively destroyed the aircraft. Passenger Human Factors during this evacuation from the aircraft also became an issue. The FAA subsequently issued an Emergency AD requiring a detailed inspection and test on of each main slat track downstop assembly on to all Boeing 737 - 600 to 900ER Series aircraft.
10 The Fire Triangle - Causes of a Fuel Explosion Air Contains Oxygen
Fuel substances that will burn
Aim: “Prevent fuel system accidents through ignition source elimination and flammability reduction”
Heat – enough to make fuel ignite & burn
By removing one element of a’ Fire Triangle’ the risk of explosive is eliminated.
Revision 161209
Page 6 of 20
FAA research re-evaluated the data between high temperatures to high flammability and subsequently that unsafe ignition source energy was much lower than had been previously evaluated. Ignition Sources There are three primary occurrences that can result in ignition of fuel vapours in aeroplane fuel tanks. • The first is electrical arcs - electrical component and wiring failures, direct and indirect effects of lightning, HIRF (High Intensity Radiated Fields)/ EMI, and static discharges • The second is friction sparks resulting from mechanical contact of rotating equipment in the fuel tank - typically this may result from debris contacting a fuel pump impeller or an impeller contacting the pump casing • The third is hot surface ignition or auto ignition - defined as hot surfaces which come within 30C of the autogenous temperature of the fuel air mixture for the fluid as ignition sources. Surface temperatures not exceeding 200°C have been accepted against current fuel types
11 Actions Commenced • In 2000, FAA & Aircraft Industry Formed a Task Force to Investigate Fuel Tank Explosions • In 2001, Special Federal Air Regulation (SFAR) 88 issued with 18 Month Compliance • Created Several FAA FAR 25 Amendments. There are two complementary approaches to dealing with a risk of fire/explosion: 1. Ignition source elimination - requiring rigorous design reviews by Type Certificate Holders and enhanced continuing standards of maintenance practices. Adopted by industry as standard practises following regulation 2. Flammability Reduction systems - to mitigate ignition and evolution. Work within FAA & EASA continues to harmonise requirements to the industry. Currently driven by FAA actions In parallel with SFAR 88, wiring problems were being investigated by the Ageing Transport Systems Rulemaking Advisory Committee (ATSRAC) -set up by FAA. This produced rule making known as the Enhanced Airworthiness Programme for Aircraft Systems/Fuel Systems (EAPAS)
12 EASA – Continuing Airworthiness • In 2000 – JAA Interim Policy (INT/POL/25/12) • In 2003 – JAA TGL 47 published • EASA Mandates 20th March 2007 for Fuel Tank Safety Training - Level 1 & 2 & AMCs issued • Further mandated requirements 24th March 2009 for Phase 1 (Awareness) & Phase 2 (Detailed) in: • AMC Part 145 • AMC Part M • AMC Part 66 Various JAA documents were released, notably JAA INT/POL/25/12 on 1st October 2000 requiring aircraft safety assessments ‘showing that the presence of an ignition source within the fuel system is Extremely Improbable and does not result from a single failure’. JAA TGL 47 provided guidance to show compliance with the Interim Policy and in order to harmonise the approach of the JAA community and the FAA.
Revision 161209
Page 7 of 20
Considerable industry consultations through NPAs* (Notices of Proposed Amendment) and CRDs* (Comment Response Documents) have been a continuous feature of FTS regulation. *both are used in the consultation phase when introducing new legislation/rules
13 Airworthiness Limitations – AWL’s • Items arising from a systems safety analysis that have been shown to have failure mode(s) associated with an ‘unsafe condition’ • An unacceptable probability of ignition risk could exist if specific tasks and/or practices are not performed IAW manufacturers’ requirements • Located in the CMRs (Certification Maintenance Requirements in the maintenance schedule). In order to ensure continuing airworthiness in Fuel Tank Safety, Airworthiness Limitations are instructions issued for inspections, modifications and other maintenance actions that are mandated to avoid an ‘Unsafe Condition’ arising. Also these provide information necessary to maintain design features specified in the original type design to preclude ignition sources and are included in the critical design configuration control limitations.
14 Airworthiness Limitations – Practice •
Airworthiness Limitations are usually presented as • Airworthiness Limitation Items (ALIs) OR • CDCCLs
•
These mandatory instructions can include: • Design changes • Maintenance instructions • Inspection instructions • Procedures.
Airworthiness Limitations can be of two types (ALIs and CDCCLs) and both may be activated on a particular task. NB: Airbus uses the terminology Fuel Airworthiness Limitation (FAL) instead of AWL. ALIs are ‘required periodical inspection tasks’ related to fuel tank ignition source prevention which must be completed to maintain the ‘design level of safety’ and so preventing an ‘unsafe condition’ arising for the operational life of the aircraft.
15 Implementation of CDCCL’s Critical Design Control Configuration Limitations (CDCCLs) • •
Features of System Design that require their integrity to be maintained in order to ensure that unsafe conditions do not develop in the fuel system throughout the service life of the aircraft Must be retained during modification, repair or maintenance
Revision 161209
Page 8 of 20
•
CDCCLs are mandatory and cannot be changed or deleted without the approval of the Authority.
CDCCLs are used to identify certain design configuration features - potentially multiple active and latent failures - intended to preclude a fuel tank ignition source for the operational life of the aircraft. These translate to instructions that mandate specific practices when working in critical controlled areas to identify ‘unsafe conditions’ and their corrective actions. CDCCLs can be concerned with the fuel system or systems/components/assemblies that interact with the fuel system. For example:
• Bonding & redundant bonding paths that attach components and tank • Separation of fuel gauge wiring from other higher energy wiring • Wire support for high energy wiring in proximity to tanks 16 CDCCLs – Practice • •
Strict adherence to configuration, methods, techniques, and practices as prescribed is required to ensure compliance with the CDCCL Any use of parts, methods, techniques or practices not contained in the applicable CDCCL must be approved by the applicable regulatory agency.
CDCCLs are identified in AMMs by the TC Holder (manufacturer) and also appear specifically in Maintenance Planning Data and relevant Component MMs. AMC Part 145.A.45(e) states: ‘The maintenance organisation should transcribe accurately the maintenance data onto such work cards or worksheets or make precise reference to the particular maintenance tasks or tasks contained in such maintenance data making reference to the CDCCL where applicable’. An organisation’s airworthiness management procedures need to be carefully supported by staff to ensure these design features are protected during repair/changes. . For critical component release: EASA Form 1 block 13 needs to indicate Airworthiness or Release CDCCL data references so that a user/installer can determine their applicability.
17 Engineering Practice Examples The following slides are for illustrative purposes only and are used to outline examples in an aircraft configuration [B767in this instance] for Phase 1 Training purpose.
Revision 161209
Page 9 of 20
18 An Airworthiness Limitation (AWL) Example •
All Airworthiness Limitation tasks should be clearly identified and provide a reference for guidance.
Critical Design Control Configuration Limitation (CDCCL)
Airworthiness Limitation Item (ALI)
Revision 161209
Page 10 of 20
19 CDCCL’s – Example 1
•
An operator replaces a fuel tank component that has a critical design feature. The lack of a bonding strap would disable an ignition source prevention feature and thus, would contribute to an unsafe condition.
A CDCCL example for an electrical bonding instruction is illustrated. Human Factors Awareness Sometimes, we only read the information that is required for us to do the task. It is possible that a CDCCL reference could be missed by Line staff. On occasions when we don’t understand what a set of terminology means, it may just be skimmed over with the importance and pressures of getting the aircraft away on time.
20 CDCCL’s - Example 2
•
Separation of external wires of the fuel gauging system has been determined to be a way to keep unsafe energies out of the fuel tank. An instruction is required to comply with the CDCCLs to ensure wiring for the fuel gauging system remains separated from other wiring.
Revision 161209
Page 11 of 20
•
This ensures that (in combination with another failure) unsafe ignition energies cannot be produced in the fuel system.
A second CDCCL example illustrating a fuel system wiring separation issue.
Revision 161209
Page 12 of 20
21 CDCCL’s - Example 3
• A CDCCL statement is inserted into both the Component Maintenance Manual and the Aircraft Maintenance Manual • A specific feature of the fuel tank system creates an unsafe condition in the event of certain failures: For example if a fuel pump is repaired or overhauled, but certain critical ignition source prevention features within the pump are not installed or are not overhauled in accordance with the CMM. A third example that illustrates the requirement for CDCCL statements for critical components to be placed in Component Maintenance Manuals (CMMs) and subsequent adherence. This affects the activities of both the component organisation and the maintenance organisation.
22 An ALI reference provides more details
Revision 161209
Page 13 of 20
The key point here is greater awareness. Illustrated here is an example of a further reference definition that Line maintenance personnel may not historically tend to locate. Planners and Maintenance Controllers could use these more frequently so may be more aware.
23 A CDCCL reference provides more details
An example of CDCCL reference detail
24 Information Location – Maintenance Planning Data (MPD) Example
Revision 161209
Page 14 of 20
An example of e-Information location Comment: When using traditional AMM layouts, be aware this safety issue is not just about items in ATA Chapter for Fuel; but also for say Hydraulics because fluid cooler pipes for cooling can pass through tanks. Additionally, ATA Pneumatics and Air conditioning (heat exchangers and adjacent ducting etc) Chapter requirements could also be affected. Further investigation may also be required at a component level.
25 Additional Information Location
Revision 161209
Page 15 of 20
An illustration of a tool to check fuel system critical SB’s within an electronically accessible AMM (myboeingfleet.com)
26 B767 SB Examples • SB 28A0083 Engine Fuel Feed System - Fuel Pump Inlet Protection - Auxiliary Fuel Tank Pump Automatic Shut Off Installation • SB 28 0087 FQIS Spar Connector Back shell Inspection, Test, and Change • SB 28A0075 Main Tank Fuel Boost Pumps and Center Auxiliary Tank Fuel Override/Jettison Pumps Inspection • SB 28A0072 Engine Fuel Feed Tube, Front Spar Bulkhead Fitting Bonding Test, and/or Bonding Rework • SB 28A0064 Honeywell Fuel Quantity Indicating System Out-Tank Wire Bundle Replacement • SB 28 0054 Fuel Tanks - Fuel System Inspection - Main Tanks (51 for aux tanks) Here are some SBs that have been incorporated on the 767 fleet [as a training example]. Similar SBs are introduced on other aircraft types.
27 Recording of work - MOE Release to service procedure • The maintenance records must contain: • A reference to up-to-date and approved data used • A detailed description of the work performed • The part number, serial number and batch number of all parts • A record of the dimensions or test figures where there is a requirement to ensure that a test figure or dimension is within tolerance • Stage duplicates as required.
28 Record your test figures • • • •
When testing a bonding circuit you must Record your test figures Do not sign the item off as just within limits If a maintenance instruction is not clear, read the whole MM task.
Recording the bonding test figures. • Record actual test figures e.g.. ‘0.0002 ohms’ and not just ‘within limits’. • Read the whole task when working on a critical explosive area to make sure an ALI or CDCCL is not required.
29 Example Problems Discovered • • • • • •
Bonding Provisions Straps missing/broken/loose/frayed/corrosion points Damaged components Evidence of overheated pumps Evidence of wiring chafing or misrouting Vent systems incorrectly assembled or released
Revision 161209
Page 16 of 20
•
Swarf, debris & contamination left within tanks.
As examples these highlight the need for effective fuel tank close-up and final inspections
30 Inspections - Debris, Swarf etc.
• The presence of sharp metal shavings, which can be attributed to drilling, can strip insulation away from wiring. As a result, the core conducting wires become exposed and enhance the likelihood of a spark. • Exposed wires becoming coated with sulphur ‘syrup’ or metallic drill shavings can be dangerous because either substance can act as a conductor. Substances such as these could function as a base point for an electrical arc, which may ignite contents of a fuel tank. Fuel Tank Procedures It is essential that you strictly follow prescribed procedures, in particular the use of correct static preventative clothing and tools or materials used to perform internal tasks. Take care not to damage any part and report any damage found inside. Insignificant damage may have a major influence on the safety of the aircraft. Be careful of debris in the tanks. Thorough inspections are required by certifying staff.
31 Arcing Example
An arcing event has occurred here, but it may not always be this obvious to detect due to visual restrictions or access on some tasks. Consider how to use available lighting and inspection techniques most effectively. A key point here is also the Human Factors affecting vigilance on tasks that need to be managed: ‘We just don’t see what we don’t see’ unless we can actively train ourselves to look for the unexpected.
Revision 161209
Page 17 of 20
32 Air Separation Module - Hollow Fibre Membrane Technology
N2 O2, CO2, H2O N2
O2 CO2 H2O Air
ASM used in gas generation industry 20+ On-going Aircraft Developments An illustration of Air Separation Module used to isolate Nitrogen Enriched Air to inert tanks. Vapour Flammability Reduction is achieved by the principle of ‘ullage’: a reduction in the volume of oxygen above the fuel in the tank is diminished to a level that does not support combustion. On the ground, oxygen ullage concentration may be around 11% from say a previous day’s flight. During climb and cruise tank O2 concentration is quickly reduced and stays below 2%, assisted by normal atmospheric changes. On descent the ullage progressively builds and stabilises on the ground at about 10% at shutdown.
33 On-Going Reduction • •
Aircraft
Developments
-
Flammable
Vapour
NEADS (N2 Enriched Air Distribution System) 2007 Flammability Reduction System certified by FAA/EASA for Boeing products
Revision 161209
Page 18 of 20
The design challenge was to produce an on-board system that was fuel and weight efficient that met commercial, operational, engineering, regulatory and certification requirements. In 2007 Boeing introduced production cut-ins and proposals for the retro-fitting of existing aircraft with an agreed system. The purpose of ATA Chapter 47 (Inert Gas System) is to detail the maintenance procedures relating to fuel tank or related fuel tank systems when minimal fuel loads exist in the tank. It also details additional procedures relating to design changes, inspections and maintenance of these systems. Illustrated above is an example of a N2 purging system fitted to a737NG aircraft using bleed air.
34 Sabena Hangar Brussels - 5th May 2006 •
A320 Suspected uncontrolled explosion in centre tank. Multiple damage to aircraft.
Another significant fuel accident that caused the demolition of the hangar on the night of 5th May 2006. Four aircraft undergoing heavy maintenance (Three A320s and one C130) were destroyed. One technician was seriously injured and four received minor injuries. The blaze took over two hours to get under control by Brussels Airport RFFS. The exact cause could not conclusively be identified by investigators.
Revision 161209
Page 19 of 20
35 Spread the word now!!
Revision 161209
Page 20 of 20
