Fuel Tank Safety Training

Fuel Tank Safety Phase 1

Students Training Material

Revision 161209 Page 1 of 20

1 Introduction

This training session will provide Phase1 Fuel Tank Safety training information (previously
known as Level 1 – Familiarisation Training).

Fuel System Safety can potentially effect wide-ranging implementation of:

• Inspection and Maintenance Programmes
• Implementation of Airworthiness Directives and Service Bulletins
• Quality Management and documentation
• Certification Maintenance Requirements
• Life limited parts
• Airworthiness Limitations
• Flight Manual limits
• MMELs (Master Minimum Equipment Lists)
• Occurrence Reporting etc.

2 Training Objectives

• Be familiar with basic elements of fuel tank safety issues

• Be able to give a simple description of the historical background & elements requiring
a safety consideration, using common words & showing examples of non-conformities
• Be able to use typical terms e.g. EASA TGL 47

EASA Phase 1 Requirements – applicability:

• Personnel of competent authorities responsible for oversight of organisations

• The quality manager and quality personnel of Part M organisations
• The group of persons that represent the maintenance management structure of the [Part 145]
organisation, the quality manager and the staff required to quality monitor the organisation
Appendix IV to 2009 AMC 145.A.30 (e) and Appendix XII to 2009 AMC M.A.706 (f) state:
[Awareness] Training should be carried out before the person starts to work without supervision,
but not later than 6 months after joining the organisation.

Completion of the previously termed ‘Level 1 Familiarisation’ training complies with the training
requirements for Phase 1. The UK CAA set a deadline for completion of the previously termed ‘Level
1’ training within their remit as the end of March 2008.

Phase 1 Training does not require a two yearly Continuation Training input. It is acceptable that
Phase 1 training may be delivered by a Training Bulletin, other self study or informative session.
Signature of the reader is required to ensure that the person has passed the training.

3 Phase 1 Course Contents

• A short background showing examples of Fuel Tank Safety (FTS) accidents or

incidents
• The description of concept of fuel tank safety and Critical Design Configuration
Control Limitations (CDCCL)
• Some examples of manufacturers documents showing CDCCL items
• Typical examples of FTS defects

Revision 161209 Page 2 of 20

 • Some examples of Type Certificate (TC) holders repair data
• Some examples of maintenance instructions for inspection.

4 Phase 2 (Detailed) Training Objectives - the scope of Phase 2

training is provided here for reference purposes only.

1. Know the history and the theoretical & practical elements of the subject; have an
overview of FAA Special Federal Aviation Regulations (SFAR) 88 and JAA Temporary
Guidance Leaflet TGL 47;
2. Be able to give a detailed description of the concept of fuel tank Airworthiness
Limitations Items (ALI), Critical Design Configuration Control Limitations (CDCCL), and
use theoretical fundamentals and specific examples;
3. Have the capacity to combine & apply the separate elements of knowledge in a logical &
comprehensive manner;
4. Have detailed information on how the above items affect the aircraft;
5. Be able to identify the components or parts or the aircraft subject to FTS from the
manufacturer’s documentation;
6. Plan the action or apply a Service Bulletin and an Airworthiness Directive.

Compliance to Phase 2 training is within 12 months of joining the organisation or at the latest by 31st
December 2010 for required personnel.

A multi-choice examination with a 75% pass mark is required to validate the Phase 2 training.

See EASA AMCs referenced in ED 2009/006/R and 2009/007/R for further details and guidelines.

Training is required for the following personnel:

Part M subpart G staff involved with management and the continuing maintenance of Airworthiness
eg. Staff managing and enacting CDCCLs, SB assessment, work planning and maintenance
programme management. - Refer to AMC in EASA ED 2009/006/R for further details and course
content

Part 145 staff required to plan, perform, supervise, inspect and certify the maintenance of aircraft &
fuel system components. - Refer to AMC in EASA ED 2009/007/R for details, training content and
further guidance on training materials.

This nominates an extensive group of operational staff within an organisation.

Phase 2 Training requires two yearly continuation training.

The following slides summarise significant fuel accident events since the mid 1990’s

Revision 161209 Page 3 of 20

5 TWA Flight 800 – 17th July 1996

A short circuit outside of the centre wing tank allowed excessive voltage to enter the tank
through Fuel Quantity Indication System (FQIS) wiring.

The TWA 800 accident, alongside other historically unexplained fuel tank explosions, then
commenced the drive to the latest change in fuel safety working practices adopted by the FAA and
EASA.

6 Remains of the TWA Flight

17th July 1996, a B747-100, Registration N-93119, departed JFK at 20.19 hrs local time for Paris. 11
minutes into the flight at 13,700ft near Long Island NY, a fuel explosion occurred.

All 230 on board were killed.

Problems were found in the Fuel Quantity Indication System and ground handling actions.
‘Contributing factors to the accident were the design and certification concept that fuel tank
explosions could be prevented solely by precluding all ignition sources and the design and
certification of the Boeing 747 with heat sources located beneath the CWT (Centre Wing Tank) with
no means to reduce heat transferred into the CWT or to render the fuel vapour in the tank non-
flammable’.

Estimated temperature in empty CWT with ground running before take-off was 49°C.

Many basic design and certification assumptions about installed fuel tank systems had to be
substantially revised.

Revision 161209 Page 4 of 20

Initial action on Fuel System Safety was commenced by the FAA which then initiated a JAA interim
policy -JAA INT/POL/25/12 - on 1st October 2000.

7 EI-BZG 737-300 Manila 11th May 1990

• Fuel Vapour Explosion from empty CWT on ground.

• Damaged/chaffed wiring from float switches.
• Conditioning packs running.
• High ambient temperature.

Ambient air temperatures were high, at least 35°C, was recorded. The air conditioning packs located
beneath the centre wing fuel tank which had been running on the ground before pushback for
approximately 30 to 45 minutes.
The centre wing fuel tank, which had not been filled for 2 days, probably contained fuel vapours.
Shortly after pushback a powerful explosion in the centre fuel tank pushed the cabin floor violently
upwards. 8 out of the 114 passengers died.
The airline had fitted logo lights after delivery which involved additional wires to be passed through
vapour seals in the fuel tanks.

The NTSB issued four safety recommendations, urging immediate inspection or testing of fuel boost
pumps, float switch wiring from float switches to the refuelling panel for chaffed or damaged insulation
material on Boeing 737-300,-400 and -500 series aircraft.

Source: Investigation Report B737-300 / PR143, 11 May 1990; NTSB safety recommendations A-90-
100/103

8 March 2001 – Thai Airways

737

• Centre tanks pumps left running on

ground when dry
• Electrical fault in centre tank

Revision 161209 Page 5 of 20

Centre Tank exploded. The aircraft was being prepared for a departure to Chiang Mai. 149
passengers were waiting to board. The fire erupted into the cabin, killing one cabin crew member and
injuring 6 others. The fire was put out by RFFS in 60 minutes. The aircraft was destroyed.

Common Features of Significant Accidents

The above accidents had several common features:
• Air conditioning packs running during ground operations
• CWT empty and high outside air temperatures experienced
• CWT pumps running at time of explosions
• Exact origin of ignition not positively identified

9 China Airlines 737-800

20th August 2007

• On taxi and arrival onto stand,

slats were retracted.
• Loose slat fairing bolt pierced 1”
hole in slat can causing fuel leak.
• Fuel tank explosion & ignition
source uncertain.

A further Recent Fuel Accident:

Okinawa, Japan 20th August 2007.

Following retraction of the slats after landing and taxy to stand, a loose bolt of the main slat track
downstop assembly punctured the wing slat can which resulted in a fuel leak. The hole was about
0.8-1.2 inches in diameter. An ignition occurred of unknown origin and a fire progressively destroyed
the aircraft. Passenger Human Factors during this evacuation from the aircraft also became an issue.

The FAA subsequently issued an Emergency AD requiring a detailed inspection and test on of each
main slat track downstop assembly on to all Boeing 737 - 600 to 900ER Series aircraft.

10 The Fire Triangle - Causes of a Fuel Explosion

Aim: “Prevent fuel system

Air
accidents through ignition
Contains Oxygen
source elimination and
flammability reduction”

Fuel substances that Heat – enough to make fuel

will burn ignite & burn

By removing one element of a’ Fire Triangle’ the risk of explosive is eliminated.

Revision 161209 Page 6 of 20

FAA research re-evaluated the data between high temperatures to high flammability and
subsequently that unsafe ignition source energy was much lower than had been previously evaluated.

Ignition Sources
There are three primary occurrences that can result in ignition of fuel vapours in aeroplane fuel tanks.
• The first is electrical arcs - electrical component and wiring failures, direct and indirect effects of
lightning, HIRF (High Intensity Radiated Fields)/ EMI, and static discharges
• The second is friction sparks resulting from mechanical contact of rotating equipment in the fuel
tank - typically this may result from debris contacting a fuel pump impeller or an impeller contacting
the pump casing
• The third is hot surface ignition or auto ignition - defined as hot surfaces which come within 30C of
the autogenous temperature of the fuel air mixture for the fluid as ignition sources. Surface
temperatures not exceeding 200°C have been accepted against current fuel types

11 Actions Commenced

• In 2000, FAA & Aircraft Industry Formed a Task Force to Investigate Fuel Tank
Explosions
• In 2001, Special Federal Air Regulation (SFAR) 88 issued with 18 Month Compliance
• Created Several FAA FAR 25 Amendments.

There are two complementary approaches to dealing with a risk of fire/explosion:

1. Ignition source elimination - requiring rigorous design reviews by Type Certificate Holders and
enhanced continuing standards of maintenance practices. Adopted by industry as standard
practises following regulation
2. Flammability Reduction systems - to mitigate ignition and evolution. Work within FAA & EASA
continues to harmonise requirements to the industry. Currently driven by FAA actions

In parallel with SFAR 88, wiring problems were being investigated by the Ageing Transport Systems
Rulemaking Advisory Committee (ATSRAC) -set up by FAA. This produced rule making known as the
Enhanced Airworthiness Programme for Aircraft Systems/Fuel Systems (EAPAS)

12 EASA – Continuing Airworthiness

• In 2000 – JAA Interim Policy (INT/POL/25/12)

• In 2003 – JAA TGL 47 published
• EASA Mandates 20th March 2007 for Fuel Tank Safety Training - Level 1 & 2 &
AMCs issued
• Further mandated requirements 24th March 2009 for Phase 1 (Awareness) & Phase 2
(Detailed) in:
• AMC Part 145
• AMC Part M
• AMC Part 66

Various JAA documents were released, notably JAA INT/POL/25/12 on 1st October 2000 requiring
aircraft safety assessments ‘showing that the presence of an ignition source within the fuel system is
Extremely Improbable and does not result from a single failure’.

JAA TGL 47 provided guidance to show compliance with the Interim Policy and in order to harmonise
the approach of the JAA community and the FAA.

Revision 161209 Page 7 of 20

Considerable industry consultations through NPAs* (Notices of Proposed Amendment) and CRDs*
(Comment Response Documents) have been a continuous feature of FTS regulation.

*both are used in the consultation phase when introducing new legislation/rules

13 Airworthiness Limitations – AWL’s

• Items arising from a systems safety analysis that have been shown to have failure
mode(s) associated with an ‘unsafe condition’
• An unacceptable probability of ignition risk could exist if specific tasks and/or
practices are not performed IAW manufacturers’ requirements
• Located in the CMRs (Certification Maintenance Requirements in the maintenance
schedule).

In order to ensure continuing airworthiness in Fuel Tank Safety, Airworthiness Limitations are
instructions issued for inspections, modifications and other maintenance actions that are mandated to
avoid an ‘Unsafe Condition’ arising.

Also these provide information necessary to maintain design features specified in the original type
design to preclude ignition sources and are included in the critical design configuration control
limitations.

14 Airworthiness Limitations – Practice

• Airworthiness Limitations are usually presented as

• Airworthiness Limitation Items (ALIs)
OR
• CDCCLs

• These mandatory instructions can include:

• Design changes
• Maintenance instructions
• Inspection instructions
• Procedures.

Airworthiness Limitations can be of two types (ALIs and CDCCLs) and both may be activated on a
particular task.

NB: Airbus uses the terminology Fuel Airworthiness Limitation (FAL) instead of AWL.

ALIs are ‘required periodical inspection tasks’ related to fuel tank ignition source prevention which
must be completed to maintain the ‘design level of safety’ and so preventing an ‘unsafe condition’
arising for the operational life of the aircraft.

15 Implementation of CDCCL’s

Critical Design Control Configuration Limitations (CDCCLs)

• Features of System Design that require their integrity to be maintained in order to ensure that
unsafe conditions do not develop in the fuel system throughout the service life of the aircraft
• Must be retained during modification, repair or maintenance

Revision 161209 Page 8 of 20

• CDCCLs are mandatory and cannot be changed or deleted without the approval of the
Authority.

CDCCLs are used to identify certain design configuration features - potentially multiple active and
latent failures - intended to preclude a fuel tank ignition source for the operational life of the aircraft.

These translate to instructions that mandate specific practices when working in critical controlled
areas to identify ‘unsafe conditions’ and their corrective actions.

CDCCLs can be concerned with the fuel system or systems/components/assemblies that interact with
the fuel system.

For example:
• Bonding & redundant bonding paths that attach components and tank
• Separation of fuel gauge wiring from other higher energy wiring
• Wire support for high energy wiring in proximity to tanks

16 CDCCLs – Practice

• Strict adherence to configuration, methods, techniques, and practices as prescribed is

required to ensure compliance with the CDCCL
• Any use of parts, methods, techniques or practices not contained in the applicable CDCCL
must be approved by the applicable regulatory agency.

CDCCLs are identified in AMMs by the TC Holder (manufacturer) and also appear specifically in
Maintenance Planning Data and relevant Component MMs.

AMC Part 145.A.45(e) states: ‘The maintenance organisation should transcribe accurately the
maintenance data onto such work cards or worksheets or make precise reference to the particular
maintenance tasks or tasks contained in such maintenance data making reference to the CDCCL
where applicable’.

An organisation’s airworthiness management procedures need to be carefully supported by staff to

ensure these design features are protected during repair/changes.
.
For critical component release: EASA Form 1 block 13 needs to indicate Airworthiness or Release
CDCCL data references so that a user/installer can determine their applicability.

17 Engineering Practice Examples

The following slides are for illustrative purposes only and are used to outline examples in an
aircraft configuration [B767in this instance] for Phase 1 Training purpose.

Revision 161209 Page 9 of 20

18 An Airworthiness Limitation (AWL) Example

• All Airworthiness Limitation tasks should be clearly identified and provide a reference for
guidance.

Critical Design Control Configuration Limitation (CDCCL)

Airworthiness Limitation Item (ALI)

Revision 161209 Page 10 of 20

19 CDCCL’s – Example 1

• An operator replaces a fuel tank component that has a critical design feature. The lack of a
bonding strap would disable an ignition source prevention feature and thus, would contribute
to an unsafe condition.

A CDCCL example for an electrical bonding instruction is illustrated.

Human Factors Awareness

Sometimes, we only read the information that is required for us to do the task.
It is possible that a CDCCL reference could be missed by Line staff. On occasions when we don’t
understand what a set of terminology means, it may just be skimmed over with the importance and
pressures of getting the aircraft away on time.

20 CDCCL’s - Example 2

• Separation of external wires of the fuel gauging system has been determined to be a way to
keep unsafe energies out of the fuel tank. An instruction is required to comply with the
CDCCLs to ensure wiring for the fuel gauging system remains separated from other wiring.

Revision 161209 Page 11 of 20

• This ensures that (in combination with another failure) unsafe ignition energies cannot be
produced in the fuel system.

A second CDCCL example illustrating a fuel system wiring separation issue.

Revision 161209 Page 12 of 20

21 CDCCL’s - Example 3

• A CDCCL statement is inserted into both the Component Maintenance Manual and the
Aircraft Maintenance Manual
• A specific feature of the fuel tank system creates an unsafe condition in the event of
certain failures: For example if a fuel pump is repaired or overhauled, but certain critical
ignition source prevention features within the pump are not installed or are not overhauled in
accordance with the CMM.

A third example that illustrates the requirement for CDCCL statements for critical components to be
placed in Component Maintenance Manuals (CMMs) and subsequent adherence.

This affects the activities of both the component organisation and the maintenance organisation.

22 An ALI reference provides more details

Revision 161209 Page 13 of 20

The key point here is greater awareness. Illustrated here is an example of a further reference
definition that Line maintenance personnel may not historically tend to locate.

Planners and Maintenance Controllers could use these more frequently so may be more aware.

23 A CDCCL reference provides more details

An example of CDCCL reference detail

24 Information Location – Maintenance Planning Data (MPD)

Example

Revision 161209 Page 14 of 20

An example of e-Information location

Comment: When using traditional AMM layouts, be aware this safety issue is not just about items in
ATA Chapter for Fuel; but also for say Hydraulics because fluid cooler pipes for cooling can pass
through tanks. Additionally, ATA Pneumatics and Air conditioning (heat exchangers and adjacent
ducting etc) Chapter requirements could also be affected. Further investigation may also be required
at a component level.

25 Additional Information Location

Revision 161209 Page 15 of 20

An illustration of a tool to check fuel system critical SB’s within an electronically accessible AMM
(myboeingfleet.com)

26 B767 SB Examples

• SB 28A0083 Engine Fuel Feed System - Fuel Pump Inlet Protection - Auxiliary Fuel
Tank Pump Automatic Shut Off Installation
• SB 28 0087 FQIS Spar Connector Back shell Inspection, Test, and Change
• SB 28A0075 Main Tank Fuel Boost Pumps and Center Auxiliary Tank Fuel
Override/Jettison Pumps Inspection
• SB 28A0072 Engine Fuel Feed Tube, Front Spar Bulkhead Fitting Bonding Test, and/or
Bonding Rework
• SB 28A0064 Honeywell Fuel Quantity Indicating System Out-Tank Wire Bundle
Replacement
• SB 28 0054 Fuel Tanks - Fuel System Inspection - Main Tanks (51 for aux tanks)

Here are some SBs that have been incorporated on the 767 fleet [as a training example]. Similar SBs
are introduced on other aircraft types.

27 Recording of work - MOE Release to service procedure

• The maintenance records must contain:

• A reference to up-to-date and approved data used
• A detailed description of the work performed
• The part number, serial number and batch number of all parts
• A record of the dimensions or test figures where there is a requirement to ensure
that a test figure or dimension is within tolerance
• Stage duplicates as required.

28 Record your test figures

• When testing a bonding circuit you must

• Record your test figures
• Do not sign the item off as just within limits
• If a maintenance instruction is not clear, read the whole MM task.

Recording the bonding test figures.

• Record actual test figures e.g.. ‘0.0002 ohms’ and not just ‘within limits’.
• Read the whole task when working on a critical explosive area to make sure an ALI or CDCCL is
not required.

29 Example Problems Discovered

• Bonding Provisions
• Straps missing/broken/loose/frayed/corrosion points
• Damaged components
• Evidence of overheated pumps
• Evidence of wiring chafing or misrouting
• Vent systems incorrectly assembled or released

Revision 161209 Page 16 of 20

 • Swarf, debris & contamination left within tanks.

As examples these highlight the need for effective fuel tank close-up and final inspections

30 Inspections - Debris, Swarf etc.

• The presence of sharp metal shavings, which can be attributed to drilling, can strip
insulation away from wiring. As a result, the core conducting wires become exposed and
enhance the likelihood of a spark.
• Exposed wires becoming coated with sulphur ‘syrup’ or metallic drill shavings can be
dangerous because either substance can act as a conductor. Substances such as these
could function as a base point for an electrical arc, which may ignite contents of a fuel tank.

Fuel Tank Procedures

It is essential that you strictly follow prescribed procedures, in particular the use of correct static
preventative clothing and tools or materials used to perform internal tasks. Take care not to damage
any part and report any damage found inside. Insignificant damage may have a major influence on
the safety of the aircraft.

Be careful of debris in the tanks. Thorough inspections are required by certifying staff.

31 Arcing Example

An arcing event has occurred here, but it may not always be this obvious to detect due to visual
restrictions or access on some tasks. Consider how to use available lighting and inspection
techniques most effectively.

A key point here is also the Human Factors affecting vigilance on tasks that need to be managed: ‘We
just don’t see what we don’t see’ unless we can actively train ourselves to look for the unexpected.

Revision 161209 Page 17 of 20

32 Air Separation Module - Hollow Fibre Membrane Technology

N2
O2, CO2, H2O

N2
O2
CO2
H2O
Air

ASM used in gas generation industry 20+

On-going Aircraft Developments

An illustration of Air Separation Module used to isolate Nitrogen Enriched Air to inert tanks. Vapour
Flammability Reduction is achieved by the principle of ‘ullage’: a reduction in the volume of oxygen
above the fuel in the tank is diminished to a level that does not support combustion. On the ground,
oxygen ullage concentration may be around 11% from say a previous day’s flight. During climb and
cruise tank O2 concentration is quickly reduced and stays below 2%, assisted by normal atmospheric
changes. On descent the ullage progressively builds and stabilises on the ground at about 10% at
shutdown.

33 On-Going Aircraft Developments - Flammable Vapour

Reduction

• NEADS (N2 Enriched Air Distribution System)

• 2007 Flammability Reduction System certified by FAA/EASA for Boeing products

Revision 161209 Page 18 of 20

The design challenge was to produce an on-board system that was fuel and weight efficient that met
commercial, operational, engineering, regulatory and certification requirements. In 2007 Boeing
introduced production cut-ins and proposals for the retro-fitting of existing aircraft with an agreed
system.

The purpose of ATA Chapter 47 (Inert Gas System) is to detail the maintenance procedures relating
to fuel tank or related fuel tank systems when minimal fuel loads exist in the tank. It also details
additional procedures relating to design changes, inspections and maintenance of these systems.
Illustrated above is an example of a N2 purging system fitted to a737NG aircraft using bleed air.

34 Sabena Hangar Brussels - 5th May 2006

• A320 Suspected uncontrolled explosion in centre tank. Multiple damage to aircraft.

Another significant fuel accident that caused the demolition of the hangar on the night of 5th May
2006.

Four aircraft undergoing heavy maintenance (Three A320s and one C130) were destroyed. One
technician was seriously injured and four received minor injuries. The blaze took over two hours to get
under control by Brussels Airport RFFS.

The exact cause could not conclusively be identified by investigators.

Revision 161209 Page 19 of 20

35 Spread the word now!!

Revision 161209 Page 20 of 20