No Fire in the Hole

Author’s Note: AMT magazine has chronicled change in our aviation industry. This is the latest in a series of articles that was first published in February 2000 with “No Fire in the Hole” and again in July 2001 with “No Fire in the Hole — Revisited, New regulations affecting aircraft fuel tanks.” There was an electronic update in October 2003 titled “No Fire in the Hole, New developments on aircraft fuel tanks.” The current article “No Fire in the Hole — More than a Decade of Change Later” shows an evolution of regulatory response and technological change both deliberate and slow. It tells the story of a maturing technology over 13 years through innovation to meet a specific aviation concern for safety and security for potentially hazardous environments like fuel tanks, cargo compartments, and confined areas of an aircraft. Technology has matured so that the percentage of oxygen in the air above the fuel is measured and nitrogen is controlled and directed only as needed to keep the ullage inerted or for fire suppression in inaccessible areas. This increases the safety margin so that no internal ignition source can cause ignition and external threats are decreased from shoulder fire missiles or high power sniper rifles.

The Trans World Airlines (TWA) 800 accident was the start of an extensive review by the FAA and the industry that has focused on three areas of concern: preventing ignition from any source within the tank, fuel flammability, and fuel tank inerting. During the NTSB hearing, those of us in the room in Baltimore, that heard the technical testimony about the in-flight explosion of the center fuel tank and observed the families of those lost, were deeply moved and we hoped that a loss like this would never happen again.

Fuel tank and cargo compartment protection
The military has had OBIGGS (on board inerting gas generating systems) on its transport aircraft and some fighters for some time. These generators are referred to as PACKS. The overriding need for safety and security trumps the concerns about fuel usage to support high bleed air usage to provide air that is separated into usable nitrogen that floods all the fuel tanks.

In order to get an OBIGGS that has in tank monitoring for control and distribution of the inerting gas on a commercial transport aircraft these are just some of the hurdles: STCs (supplemental type certificates), PMAs (parts manufacturing authority), environmental testing (RTCA/DO-160 Series {MIL Standard 810F}), environmental test methods for airborne equipment, RTCA/DO-178, guidance for the orderly development of software for airborne digital computer-based equipment and systems, and ground and flight testing plans of all system components.

For commercial aircraft the early goal was to have a system weighing about 800 pounds that would provide enough nitrogen to support the inerting of the center fuel tank of the Boeing 747.

With a lot of industry input the FAA developed a lighter weight system of less than 400 pounds for the center fuel tank application, but again it flooded the tank with nitrogen which because of its constant generation of nitrogen, reduced its effective life on the aircraft.

The change over time is that we now have the ability to measure accurately the percentage of oxygen in the tank ullage and control the output of the nitrogen generating packs and distribution of nitrogen to the fuel tanks only as needed to inert all tanks and wing vent boxes. Also, we can now use nitrogen to supplement existing fire suppression systems like Halon or replace part of an existing system, like the second Halon bottle, in cargo compartments by routing nitrogen to the cargo compartment as needed according to the feedback from probes in the ceiling of the cargo compartment. One possible change might use inerting with nitrogen or CO2 with a water mist from a 5- to 6-gallon source. The water wets the flammable material and takes away some heat while the inerting puts out the fire and keeps it out. This may be the Halon replacement because it is easy to clean up and does not cause excessive corrosion or toxicity.

The control is accomplished through the logic of the software in the system computers. The programmable read only memories (PROMs) software ensures that safety margins are maintained in the fuel tanks and backs up existing smoke detector systems in cargo compartments. By limiting nitrogen production as needed, instead of flooding the tanks, we reduce maintenance and extend the life of the nitrogen generating packs and the amount of bleed air flow required thus saving fuel. System logic for control and distribution sends nitrogen to the area of the airplane, including inaccessible structure, only where it is needed.

It took five years of research to develop a coating for the in-tank probe that would stay in the hazardous fuel environment (Jet A and JP-8) for 5,000 hours or three years to coincide with the heavy “C” check schedule of many aircraft. In order to meet this goal the probe must perform without degradation for 60 calendar months in tests of both submission to fuel vapors and immersed in fuel.

It has taken many years of extensive testing to establish a flammability minimum. Oxygen content in the air above the tank of 13 percent offers some protection in limited circumstances. 12 percent is safe with no margin of error. At 11.5 percent some tests still have ignition. In some military applications 11.5 percent oxygen content gave a 25 percent safety margin. To be full inerted to prevent ignition from an internal tank source of ignition or an external source such as a missile or rifle round, the military suggests 9 percent which is the recommendation of the Mine Safety Authority.

Further testing has shown that the most dangerous times in the flight profile are during climb and descent. Along with generating nitrogen for center tanks that are subjected to heat sources from the air conditioning system, additional packs might generate nitrogen only for climbs and decent. System logic would control these packs by accessing the conditions at long range cruise at altitude while monitoring cooling of the fuel because of low ambient temperatures and lower pressure. Over time there has been a lot of testing of how rapidly heat is dissipated to the outer aluminum wing structure based on the fuel capacity of a tank. One of the early ARAC working group opinions regarding aluminum aircraft was that the center tank was flammable 35 percent of the time. While the wing tanks are flammable 7 percent of the time.

One example of change over the last decade is the production of composite aircraft with composite wing structure. Recent testing has shown that composite wing structure provides much less heat dissipation and that the composite structure holds heat longer. Inerting of a composite wing may have to be done for a greater portion of the flight profile. These findings may affect the ETOPS (Extended-range Twin-engine Operational Performance Standards) time range for composite wing aircraft and thus inerting may be an operational factor to be considered.

I talked about Special Federal Aviation Regulation (SFAR-88) in AMT back October of 2003. Industry implementation of this regulation, in the years since, has revealed numerous short comings in design as related to lightning strikes, wiring failures, and flame arresters on fuel probes. There is an ever present possibility of lightning strikes igniting fuel vapors.

Composites don’t prevent lightning strikes.

In either aluminum or composite wing structures, the fiber optic probes in the tank have to be intrinsically safe. The probe bodies are of corrosion-resistant stainless steel completely grounded to the structure. The fiber optics does not conduct any electricity, only light. No physical sample is required that must be disposed of. The oxygen sensing, temperature, and pressure are taken at a single point on the probe with several redundant probes in each tank. Instantaneous sensing takes place when light is sent out and returned through the fiber optics to the computers that continuously perform trend analysis.

Flammability characteristics
The flammability characteristics of the various fuels approved for use in transport airplanes result in the presence of flammable vapors in the ullage, vapor space of fuel tanks at various times during the operation of the aircraft. Vapors from Jet A fuel (the typical commercial turbojet engine fuel) at temperatures below approximately 100 F are too lean to be flammable at sea level and at temperatures below minus 45 F. After thorough cold soaking at 35,000 feet altitude it takes a high energy source to ignite fuel vapors. However, when jet fuel is 120 F and above fuel vapors are highly flammable, or when a higher percentage of oxygen is present it takes a much lower energy source to cause ignition.

Some events that could produce sufficient electrical energy to create an arc include:

  • Lightning,
  • Electrostatic charging,
  • Electromagnetic interference (EMI), or
  • Failures in airplane systems or wiring that introduce high-power electrical energy into the fuel tank system.

Possible ignition sources that have been considered include:

  • Electrical arcs,
  • Friction sparks caused by mechanical contact between certain rotating components in the fuel tank, such as a steel fuel pump impeller rubbing on the pump inlet check valve, and
  • Auto ignition of fuel vapors may be caused by failure of components within the fuel tank, or external components or systems that cause components or tank surfaces to reach a high enough temperature to ignite the fuel vapors in the fuel tank. (The auto ignition temperature is the temperature at which the fuel/air mixture will spontaneously ignite due to heat in the absence of an ignition source.)

The regulatory authorities and aviation industry have always presumed that a flammable fuel air mixture exists in the fuel tanks at all times and have adopted the philosophy that the best way to ensure airplane fuel tank safety is to preclude ignition sources within fuel tanks. This philosophy has been based on the application of fail-safe design requirements to the airplane fuel tank system to preclude ignition sources from being present in fuel tanks when component failures, malfunctions, or lightning encounters occur.

Another source of information on fuel tank protection is the FAA — Fire Safety Section: System Fire Group. You can find information on fuel flammability and inerting, either completed, or ongoing, and planned research by going to for the latest reports from FAA/industry conferences and meetings.
Regulatory actions

The FAA issued Special Federal Aviation Regulation No. 88, with the final rule in 2008, to minimize the potential for failures that could cause ignition sources in fuel tanks on new and existing airplanes. The SFAR required airplane operators and manufacturers to change how airplane fuel tanks are designed, maintained, and operated. There are mandated requirements to minimize flammability in new airplanes. SFAR 88 was applicable to 6,971 turbine-powered, transport category airplanes that have 30 or more seats manufactured by 12 manufacturers.

New airplanes require that manufacturers further minimize the possibility of ignition sources in the fuel tanks in new designs. This means that transport category airplanes developed in the future will have to address potential failures in the fuel tank system that could result in a possible ignition source. Furthermore, fuel tank safety must be developed and supported by the manufacturer for the operators’ maintenance and inspection programs that identify safety-critical maintenance actions. Also, the rule requires manufacturers to reduce the time fuel tanks operate with flammable vapors in the tank by designing fuel tank systems that consider adjacent heat sources. This can be done by one of two ways: either minimizing the development of flammable vapors or by developing another means, such as on-board fuel tank inerting to prevent catastrophic damage in the unlikely event that ignition might occur.

Manufacturers had 18 months to conduct the safety review and to develop maintenance and inspection programs as required by the SFAR. Likewise, operators had 36 months from the effective date to incorporate an FAA-approved maintenance and inspection program into their operating procedures.

To date the FAA has issued or proposed about 40 airworthiness directives (ADs) on fuel tank safety. Many of these ADs are a result of lessons learned from the TWA 800 accident investigation and subsequent analysis. Adverse service experience has also shown that if specific maintenance procedures are not carried out on certain airplane fuel systems, then there may be a degradation of the design features intended to preclude ignition of vapors within the tank (i.e. bonding, grounding, and shielding). This means that technicians will be performing mandatory fuel system maintenance that is required by the limitations section of the Instructions for Continued Airworthiness for each airplane model.

For existing airplanes, FAR No. 88 requires manufacturers to conduct a one-time design review of the fuel tank system for each transport airplane model in the current fleet to ensure that failures could not create ignition sources within the fuel tank. Also, manufacturers must then design specific programs for the maintenance and inspection of the tanks to ensure the continued safety of tank systems. There are also operational changes for existing airplanes, like not running the fuel boost pumps on the B-737 when a tank is empty. As expected, additional ADs resulted from feedback from the new information received from the design review of existing aircraft.

Technological changes in aviation
As we follow the regulatory and technological change and progress, we see it is slow and deliberate. Aviation is a world unto its own. An example is from the venture capital world of finance. A venture capital investor looks for a new technology or idea and expects to put in money and that the idea will mature in no more than five years. They expect to at least triple their investment return and get out in order to reinvest with another new start-up. Aviation innovation may take more than a decade before it gets on a large number of aircraft. Safety, security, reliability, and affordability must be the end result of the regulatory and technological changes over time. Keep ‘em Flying.

Fred Workley is president of Workley Aircraft and Maintenance Inc., which is headquartered in Alexandria, VA. Workley wrote Eye on Washington and Maintenance Matters for AMT from 1996 to 2005.

More Than A Decade of Regulatory and Technological Change

July 1996: Trans World Airlines (TWA) 800 accident.

December 1997: National Transportation Safety Board hearings TWA-Flight 800.

March 19, 2001: FAA required all transport aircraft to have smoke detector systems in Class ‘C’ and ‘D’ cargo compartments.

1998: Aviation Rulemaking Advisory Committee (ARAC) Fuel Tank Harmonization Working Group (FTHWG), Final Report, Recommendations for inerting of fuel tanks received significant attention.

2000: “Proof of Concept” tests at FAA facility in Atlantic City.

April 18, 2001: Advisory Circular (AC) “Fuel Tank Ignition Source Prevention Guidelines,” AC 25.981-1C, revised 9/19/08. Provides guidance for demonstrating compliance with the certification requirements for prevention of ignition sources within fuel tanks of transport airplanes.

April 18, 2001: AC “Fuel Tank Flammability Minimization,” AC 25.981-2A, revised 9/19/08. Pertains to minimizing the formation or mitigation of hazards from flammable fuel air mixtures within fuel tanks. AC has a section on fuel tank inerting using inert gas, like nitrogen, to keep the oxygen level in the tank ullage below a combustible level to prevent fuel tank flammability.

May 7, 2001, effective date June 6, 2001: Special Federal Aviation Regulation No. 88.

July 2001: Fuel tank inerting recommendations available from the FAA.

December 2002: Probe Patents issued.

May 2003: Small Business Innovation Research (SBIR) grants to develop fuel-resistant coating and time delay technique.

October 2003: Inerting System Patent issued.

June 2004: SBIR grants to improve fuel resistant coating and phase delay technique.

2004: Environmental tests to RTCA/DO-160C successful, ground and flight tests of fiber optic oxygen sensing with RTD temperature and remote pressure transducer.

July 21, 2008: Final rule U.S. DOT/Reduction of Fuel Tank Flammability in Transport Category Aircraft.

2008: Breakthrough with fiber optic oxygen sensing and fiber optic temperature sensing in one fuel tank probe with advances in phase shift technique.

April 2008: Report of ongoing research on “Composite and Aluminum Wing Tank Flammability Comparison Testing” of next generation aircraft.

July 2009: Successful environmental tests to RTCA/DO-160E for probes, fiber optic cables including burn and acoustics with operating electronics.

2009: Fiber optic oxygen, fiber optic temperature, and fiber optic pressure under development in one probe with significant progress in frequency domain fluorescence using time gated “phase-lock” detection and new testing profiles simulating different stages of flight. Test plans include absorption of ambient temperature and air conditioning system heat on the ground into fuselage and wing structure thus affecting climb and increased oxygen during descent and holding at 10,000 feet using calibrated nitrogen gases and different fuel loads.