Lightning Fuel Systems 25.981

Table of contents:

1. Indirect effects of Lightning
2. Direct Effects of Lightning
3. Lightning Fuel Systems

3.1 Introduction
3.2 Regulatory and Program Planning/Reporting
3.3 Characterization of the EM Performance of Individual Structures and Systems
3.4 Establishment of Failure Modes
3.5 Determination of the Electromagnetic Environment during All Scenarios
3.6 Coupon Testing
3.7 Experience in Fuel Tank 25.981

Full 25.981 compliance for electromagnetic effects compliance is a large, multi-year program for any aircraft certification effort. The tasks are further complicated by the use of composites as the fuel tank structural material. In the recent past, there was a great deal of change and regulatory clarification into what was actually required of airworthiness applications. Fortunately, the regulatory environment has solidified into a set of standard processes.

Our team is a pioneer in composite fuel tank lightning verification. Further, our team has participated with remarkable success in the many visible and recent 25.981 fuel tank lightning certification programs.

The large effort of a 25.981 compliance program for lightning and electrostatic effects may be further divided into five major tasks:

• Regulatory and Program Planning/Reporting
• Characterization of the EM Performance of Individual Structures and Systems
• Establishment of Failure Modes
• Determination of the Electromagnetic Environment during All Scenarios
• Coupon Testing

The main electromagnetic environments of 25.981 are lightning, electrostatic discharge and power fault. EMA^® has historical and recent success in supporting all aspects of these programs for major transport aircraft systems. This work has been widely publicized and is visible in technical publications.

3.1: Introduction

The effort required for 25.981 compliance is best introduced by a quotes from electromagnetic effects engineers leading a project in a recent major 25.981 certification efforts.

Aircraft compliance with 14 CFR 25.981(a)(3) requires consideration of failure modes for both systems and structure design such that lightning direct effects testing is conducted on representative sub-assemblies that contain the failures. Definition of the threat levels can be supported by simulation and analysis, through a well-defined process of verification and validation that follows an increasing level of complexity. . . Generally, simulation tools provide more extensive means to rationalize threat level predictions than by using development testing alone, but also more extensive means to evaluate specific design features.

-David Lalonde, Bombardier Aerospace (CS100)[1]

3.2: Regulatory and Program Planning/Reporting

Because of the size and complexity of the 25.981, careful planning is a necessity. Further, ensuring that the regulations, which are not always straightforward, are fully understood across the organization will require education and collaboration.

Our team’s effort on this task is divided into several steps described in the following subtasks.

3.2.1:Program Regulatory Planning

Enunciation and description of compliance program steps for permanent structures

The 25.981 program regulatory approach is complex with many high level decisions that must be made early in the program. Previously, many manufacturers had to decide whether to pursue an exemption or special condition. Recently ANM-112-08-002[2] formalized this process. The requirements and program approach implied by the current regulatory environment will be specified and described.

Next, a choice must be made concerning organizing the program based on the failure modes or identification of two independent layers of protection against each potential ignition threat. This best choice in this area depends on the presence of novel design features and the service and manufacturing history that allows for collection of aging and manufacturing escape statistics and descriptions. EMA^® can assist in deciding the approach and will describe the program effort implied by the choice.

3.2.2: Bonding Paradigm Definition

This determination leads directly to a selection of the protection methodology for tank systems. Typically, one selects between bonding, in which low impedance connections are established for all systems, and isolation, in which specially-designed isolation is engineered into the system to prevent harmful currents from flowing on systems. EMA^® can help select the protection methodology for systems and provide guidance on how to implement its prescriptions on the design.

3.2.3: Planning for Special Items

Overview of a path to compliance for portions of aircraft wing design that are typically deemed impractical to protect via two layers of protection

For items that are typically impractical to protect with the same approach for structures and systems such as those in the preceding sections, the regulations offer an opportunity to demonstrate that ignition probability is extremely remote, as compared to 1E-9 failures per flight hour. The steps to demonstrate this regulatory approach are extensive and are typically only applied to a small number of items. EMA^® can give the methodology and steps in order to achieve regulatory acceptance as well as assist in identifying components that are potentially impractical to protect otherwise.

3.2.4:Program Presentation and MOC

Provide statement of method of compliance and steps to perform for each effort needed to achieve 25.981 certification for each component classification and outline a format for management and presentation of the program effort

The preceding sections described individual approaches to compliance that are applied to separate components of the aircraft. In this task, EMA^® can assist in classifying all system components according to which of the above approaches to compliance is applicable. Next, we can write certification plans and method of compliance matrices for each grouping that describes at a high level the specific tasks that will need to be undertaken. Finally, EMA^® can generate a reporting matrix that may be used for certification planning, a dashboard of progress and presentation to the airworthiness authorities.

3.2.5: Project Management

Describe a project timeline with the effort required in each step and the prerequisites and outputs required at each step

EMA^® can create a Gantt chart with links to the effort needed in each program step in a mutually-agreed upon project management software. Each step will be linked with prerequisites and deliverables that will allow for changes in the timeline or other changes to be modeled.

3.2.6: Airworthiness Authority Coordination

Support for meetings with airworthiness authorities

EMA^® experience has shown that early and transparent communication with the airworthiness authorities is essential to prevent misunderstandings and delays later in the program. EMA^®‘s team can support preparation and planning for such meetings as well as attend the discussions.

3.3: Characterization of the EM Performance of Individual Structures and Systems

3.3.1: System survey

The first step in this task is to identify the fuel system design features and associated lightning protection features. EMA^® can:

• Detail each structural category or fastener type exposed to lightning direct attachment
• Detail each category of structural joint or fastener type exposed to conducted lightning currents
• Detail each system installation exposed to lightning direct attachment or conducted current
• Detail each structural category, joint/fastener and system installation exposed to conducted fault currents
• Detail each structural category, joint and system installation exposed to static discharge
• Classify each according to lightning, power fault or static discharge performance

 The design features and lightning protection features will be grouped, bounded and categorized as much as possible to reduce the matrix size, which will limit cost during later program phases.

3.3.2: Lightning Ignition source identification

The next step is critical and time consuming. EMA^® can guide and support a research program to identify all ignition sources present in a fuel tank. The benefit is that it allows one to tailor the protection mechanism to the specific ignition cause and installation location. This program is typically a combination of a simulation and a testing program.

The test or simulation cases consist of a representation of the design features described above. The goal of the tests and simulations is to determine the ignition mechanisms present in each feature. Next, the program attempts to determine the current and voltage threshold that will initiate one of the possible ignition mechanisms. This understanding is aided by the impedance parameter determination in next sub-task. The failure modes should also be considered in this step as well.

The testing should be conducted in a calibrated, ignitable atmosphere with the appropriate photography equipment to capture any ignition events. The typical ignition events are listed below:

• Voltage Spark
• Thermal Arc
• Edge Glow
• Outgassing

EMA^® can assist in classifying the conditions that lead to ignition, the type of ignition event, and the current/voltage threshold for its onset for the identified features and failure modes defined in the previous task.

Illustration of the typical ignition event types [5]

Illustration of photographic evidence of an ignition even in a calibrated, ignitable atmosphere

3.3.3: Electrostatic Ignition Source Identification

The physical mechanism for fuel ignition is very different for electrostatic effects and lightning. For lightning, the possible ignition sources are arcing from high current on structures and sparking from excessive voltage/edge glow from composites. For electrostatic discharge, the problem occurs during refuel or from fuel sloshing inside the tank. Triboelectrification results in an unbalance of charge or charge accumulation on different parts of the tank. A spark could occur that would ignite fuel vapors.

EMA^® can assist in identifying materials and components inside the tank/fuel system that could lead to charge accumulation. EMA^® can measure the properties of surfaces and estimate the threat of charging. We can assess the conductivity of materials to determine the ability for charge to bleed off.

3.3.4: Power Fault Source Identification

Another required concern for fuel ignition is a power system fault current. This can lead to a thermal arc in the same manner as lightning current. EMA^® can help identify the return path for currents in or near the fuel system and establish the components and system installations affected by power fault effects.

3.3.5: Safety Assessment

Perform safety assessment to determine fault tolerance

The next task is to determine if the design is capable of providing fault tolerant fuel systems electromagnetic effects protection. This requires going systematically through all design feature groupings from a previous task.

“Fault tolerant means the design can withstand a lightning encounter free of ignition sources for each failure condition”[3]

Designs can be fault tolerant without incorporating multiple protection features, such as:

• Fuel tank structural skins whose material and thickness are sufficient to ensure ignition sources cannot be present on the tank side opposite a lightning attachment.
• A field fastener or joint where the current density from a likely lightning attachment location is so low that an ignition source will not result even when a failure condition is present.

For locations that do not meet these criteria, a case must be developed that relies on evaluation of each feature grouping with initially assumed faults in place.

This task relies heavily on the ignition source identification task and will also require additional testing and simulation to validate the design. Some of this design analysis effort can also be used for the final validation simulation.

3.3.6: Input Parameters

Input Parameter Measurement and Validation

This task involves measurement and validation of the material properties and impedance of structural materials, joints and interfaces. There are two motivations for this effort:

1. Ignition source identification – The effort in the preceding two tasks is made more facile if the impedances and current flow distribution is known across the range of current densities and attachment locations that are required.
2. Support determination of the internal electromagnetic environment – Following tasks require a validated simulation of the full system. This cannot be accomplished accurately without a program to measure the material properties of the items and characterize the impedance at the interface of materials. This is often accompanied by a validation task using simulation and testing of representative aircraft interface assemblies.

The material properties of carbon fiber are not straightforward to obtain. The conductivity tensor of composite materials is anisotropic. EMA^® has developed techniques to accurately measure these values. We require unidirectional panels in which the carbon fiber layers are all aligned in the same direction. By injecting current uniformly into all layers in the same direction, we can determine the conductivity tensor of each layer. For quasi-isotropic or more complex arrangements, EMA^® can combine the individual layer properties in the correct way to obtain the overall conductivity tensor for all possible panel layup configurations. The testing validates the process by measuring quasi-isotropic panels to confirm that the combination of the layers results in the expected value.

Next, EMA^® measures the interface between fasteners and carbon fiber panels, between skin panels and ribs, between ribs and spars and between spars and skin panels. The inclusion of expanded copper foil (ECF) should be included where appropriate. This testing should occur at high and low current injection amplitudes.

Finally, EMA^® performs more detailed verification testing of combinations of fasteners and panels. The testing is followed by simulation. The composite conductivity and fastener impedance parameters from the previous steps are inputs to this model. If the current distributed in the panels (via B-dot sensors) and the fasteners (via current probes) has a high correlation between simulation and testing, then parameter measurements are accepted and a validated, self-consistent model exists for presentation to airworthiness authorities.

An example of one such test is described in the figure below on the left panel. Current is injected into fasteners on one side of the panel. Current is returned from fasteners in the center and other side of the panel. The current is monitored at the injection and the return fastener probes. B-dot field probes in the surface are indicative of the surface current density. The experimental apparatus is shown on the right panel of the figure.

The final result is the impedances of all interfaces as necessary for validated simulation in the full aircraft and test box models. An example of a coupon test simulation to extract impedance parameters is shown in the figure below.

Example simulation results validating the measured impedance and material parameters of a rib and composite coupon

3.4: Establishment of Failure Modes

Failure mode identification is a large task that requires coordination from many disciplines. EMA^® can be involved in establishing the program, but other groups within the organization must be involved.

3.4.1: Failure mode identification

Failure mode identification requires a rigorous process to find all nonconformities that can arise in manufacturing or service. This program will be organized to include experts in:

• Electromagnetic Environment Effects and Hazards
• Structural Design
• Systems Design
• Materials and Processes
• Manufacturing
• Quality
• Customer Support

These groups should coordinate and meet regularly to systematically assess and list all potential failure modes. There are several data sources that are typically accessed:

• Manufacturing process data assessment
• Service history records
• Developmental test data

All faults of the design should be analyzed. The faults can include:

• Manufacturing Quality Escapes
• Operational Deterioration
• Accidental Damage

An example of common faults analyzed are shown in the figure below.

Common manufacturing faults considered in 25.981 programs.

EMA^® can list the common failure modes considered as well as coordinate with disparate groups to consolidate their effort. However, EMA^® may require significant and coordinated input from the groups listed above.

3.4.2: Identify Special Items

Single Failure modes

In some areas of the design, it is impractical to have to independent protection mechanisms. The standards allow for the airworthiness requirements to be met by showing that the combined probability is extremely remote. There are only a few components to which this approach is typically applied. EMA^® can assist with part selection for this process as well as the effort in showing compliance by this method. Part of the process is shown in the tree in the figure below.

Part of flow chart tree for meeting airworthiness requirements for single-failure mode articles [6]

3.5: Determination of the Electromagnetic Environment during All Scenarios

This process is a rigorous testing and simulation task that allows for the determination of the electromagnetic environment at all aircraft locations affected by the 25.981 effort. Testing allows the simulation to be validated, establish margin, and illuminate any refinements in the modeling effort required. Simulation reveals the engineering test levels required in the following tasks for a wide range of attachments and probe locations that would be prohibitive or impossible to obtain by testing alone.

3.5.1: In-flight Simulation

The end product of this effort is to create a simulation model (validated in the following subtasks) that will include the proper attachment and detachment locations and hundreds of voltage/current probes necessary to set all coupon test levels needed in the following tasks. Simulation multiplies the number of current probes and gives results early in the program to begin testing. The modeling sets the appropriate and not overly conservative pass/fail criteria for the sparking threshold testing.

3.5.2: Test Box Validation

This task includes high-level lightning testing and simulation of a representative wing test box for validation. The high level will help show how well the simulation can handle any nonlinearities in impedance.

The box is constructed out of three to five ribs, but is square and does not include the curvature of the real wing, as shown in the figure below. Otherwise, the construction, materials and interfaces are representative of the actual wing. Again, the simulation and test are compared to validate the modeling approach and provide the internal environment. In this case, the test level should be at the full certification threat level. This validates that any nonlinearities in impedance characterization have been properly determined and that the modeling approach captures them correctly.

Example of a representative wing test box for the high level verification testing. [2]

3.5.3: Full Wing Validation

The full EM environment at all locations on and inside the wing tank is needed for 25.981 certification to set the coupon test levels. The currents, structural voltages and wire voltages are measured and simulated. This testing can occur on a full aircraft or a full wing. The wing should be conformed and include all systems and structures. A small number of panels may be removed to facilitate the testing. The results are compared in order to determine the margin and evaluate the successful understanding of the internal EM environment. The currents injected tend to be low or moderate and are not at the full certification level. An example of a successful correlation assessment for the Bombardier CSeries is shown in the figure below.

One example of a correlation assessment of test to simulation for currents of the CSeries aircraft.

This task requires a CAD-derived model of the wing and the material properties described in the previous task. A picture of the model of a recent test of the CSeries aircraft is shown in the figure below. Note that Bombardier elected to test on a full-aircraft rather than a full wing.

Model of a full-aircraft with a return conductor system for the simulation. The cockpit and empennage have been omitted as they are unnecessary in this wing simulation.

Model of a full-aircraft with a return conductor system for the simulation. The cockpit and empennage have been omitted as they are unnecessary in this wing simulation. [1]

3.5.4: Electrostatic Analysis

Establish Electrostatic Electromagnetic Environment

The electromagnetic environment for static charging is determined by analyzing in 3D across all affected structures in the tank the possible charging sources which are reduced over time by the static dissipation of charge.  The source is determined by measuring the rate of charging from triboelectrification from all sources identified in previous task, and is performed in the coupon testing tasks in the next section of this document. The dissipation is determined the conductivity of materials on all structures while considering the 3D geometry. Analysis can be used to combine the material properties, sources, and a geometric model of the tank to confirm that voltages do not exceed the threshold, based on the regulatory energy limit and the capacitance at each location.

3.5.5: Power Fault Analysis

The same 3D computational electromagnetic (EMA3D^®) model of the in-flight aircraft is also used to verify the current and current density in all structures as affected by power fault. The maximum fault current of system installations is the main additional input to this task. The results will set the fault current levels for coupon testing.

3.6: Coupon Testing

3.6.1: Lightning Coupon Testing

This task includes a great number (many hundreds) of fastener strikes and conducted current testing in ignitable atmosphere of representative aircraft structures and interfaces.

The internal EM environment determined from the full wing and text box validations are used as a source for coupon testing of representative specimens in the aircraft. The specimens should contain items with and without the identified faults as well as any ignition protection features present in the region the coupon represents. The testing occurs in a dark chamber with an ignitable atmosphere to determine if the 200 microjoule threshold for arcing has been exceeded. An example of a couple is shown in the figure below. This testing should be conformed and witnessed by the airworthiness authority or its designee.

Failure modes are incorporated in the test objects, to see if the failure modes can be tolerated free of ignition sources. The presence of two independent and effective features of protection must be demonstrated to meet the fault tolerant requirement. Testing occurs with one feature of protection artificially disabled (to reflect the failure mode), and then with the other protection feature disabled. Ignition source free performance must be demonstrated in both cases to substantiate fault tolerance. If it is not possible to design a test with one feature of protection artificially disabled, then detailed analysis will be needed. Test across the range of bounding or worst case aging effects and manufacturing faults.

EMA^® can provide the following:

• Support in building a suitable generator on-site
• Support in contracting with an existing test lab with an appropriate generator
• Test design, test plan authorship, test witnessing and test reporting

3.6.2: Static Coupon Testing

Static effects testing involves measuring charging from jet fuel flow across a tank inner panel coupon as well as charging of fuel conveyance tubing. Further characterization of coupon resistivity is determined by careful measurements of representative coupons that bound the worst case of each type inside the tank.

3.6.3: Power Fault Coupon Testing

The testing for power fault is similar to the lightning coupon testing. The waveform is instead a nearly constant current. The coupons and levels are those identified in the analysis task in the previous section.

3.7: Experience in Fuel Tank 25.981

• SAAB Gripen
• Bombardier CSeries
• Mitsubishi Regional Jet

[1] D. Lalonde, J. Kitaygorsky, W. B. S. Tse, J. Kohler and C. Weber, “COMPUTATIONAL ELECTROMAGNETIC MODELING AND EXPERIMENTAL VALIDATION OF FUEL TANK LIGHTNING CURRENTS FOR A TRANSPORT CATEGORY AIRCRAFT,” 2015 International Conference on Lightning and Static Electricity (Toulouse, France), 2015.

[2] Federal Aviation Administration, “ANM-112-08-002, Policy on Issuance of Special Conditions and Exemptions Related to Lightning Protection of Fuel Tank Structure.,” 2009.

[3] SAE/Eurocae, “Policy Guidance for Lightning Protection of Fuel Tank Structure and Systems,” 2014.

[4] A. Pout, “LIGHTNING PROTECTION OF FUEL TANKS – A350 CERTIFICATION APPROACH,” 2015 International Conference on Lightning and Static Electricity (Toulouse, France).

[5] SAE/Eurocae, “Policy Guidance for Lightning Protection of Fuel Tank Structure and Systems,” 2014.