Fuel Tank Safety

Oka Karsono - INACA

1
Fuel Tank Safety

2
Fuel Tank Safety

3
Fuel Tank Safety

4
Fuel Tank Safety

5
Fuel Tank Safety

6
Fuel Tank Safety

7
 Fuel Tank Safety

 On 8th December 1963, a Pan Am B707-100 was struck by

lightning on the left wing while holding at 5,000 feet over Elkton,
Maryland. The left wing exploded resulting in an In-flight
breakup killing all 81 onboard. The aircraft was fueled with
mixture of Jet A and JP-4 Fuels.

 On 9th May 1976, an Imperial Iranian Air Force B747, flight

ULF48, was struck by lightning on the left wing near Madrid,
Spain while descending to 5,000 feet. The left wing exploded
resulting in an In-flight breakup killing all 17 onboard. The
aircraft was fueled with JP-4 Fuel.

8
 Fuel Tank Safety

Portion of Fuselage of Pan Am Flight #214

in cornfield near Elkton, MD
9
Fuel Tank Safety

10
 Fuel Tank Safety
Reason of SFAR 88 & FTS Program

11
 Fuel Tank Safety
Reason of SFAR 88 & FTS Program

12
 Fuel Tank Safety
Reason of SFAR 88 & FTS Program

13
 Fuel Tank Safety
Reason of SFAR 88 & FTS Program

14
 Fuel Tank Safety

 On 3rd March 2001, a Thai Airways B737-400 airplane caught

fire and burned while parked at a bay at the Don Muang
International Airport, Bangkok, Thailand. NTSB has determined
that the center tank exploded shortly after the main fuel tanks of
the airplane were refueled. It appears that the center tank fuel
pumps were operating dry (no fuel was passing through the
pumps) at the time of explosion.

 The accident is similar to the 1990 center tank explosion that

occurred on a Philippine Airlines B737-300 at Ninoy Aquino
International Airport in Manila while preparing for take-off. The
center tank fuel pumps were operating dry at the time of that
explosion.

15
 Fuel Tank Safety

 Extended dry center tank fuel pumps operation, which had

occurred prior to both accidents, can result in overheating and
excessive wear of the pump bearings and consequent contact
between rotating and non-rotating parts of the pumps. Both
overheating of the bearings and contact between rotating and
non-rotating parts have the potential to create an ignition source
in the form of Hot Surface Ignition or Sparks. In addition, during
dry operation of the pumps, ignition of vapor in the fuel pump
can create a flame front that can reach the fuel tank and cause a
fuel tank explosion.

16
Fuel Tank Safety

17
 Fuel Tank Safety

 The accident occurred in Bangalore, India while the

Malaysian-registered cargo plane, a Transmile Airlines B727 was
waiting to be towed for a returned flight to Subang, Malaysia on
4th May 2006.
 The evidence indicates that an explosion in the left wing fuel
tank destroyed the structural integrity of the wing.
 Investigators found evidence of damaged wiring and electrical
arcing within the left wing fuel tank in an aluminum conduit tube
that carried 115V AC electrical power to the fuel pump.
 Wire arcing within the conduit routed through the fuel tank
was previously recognized as a potential ignition source, and the
accident airplane had been modified in accordance with an FAA
AD.
18
 Fuel Tank Safety

 The accident occurred in Bangalore, India while the

Malaysian-registered cargo plane, a Transmile Airlines B727 was
waiting to be towed for a returned flight to Subang, Malaysia on
4th May 2006.
 The evidence indicates that an explosion in the left wing fuel
tank destroyed the structural integrity of the wing.
 Investigators found evidence of damaged wiring and electrical
arcing within the left wing fuel tank in an aluminum conduit tube
that carried 115V AC electrical power to the fuel pump.
 Wire arcing within the conduit routed through the fuel tank
was previously recognized as a potential ignition source, and the
accident airplane had been modified in accordance with an FAA
AD.
19
 Fuel Tank Safety

 Airworthiness Directives (AD) required removal of the wires

from the conduit, inspection, and re-installation of the wires or
replacements into the conduit after insertion into a protective
plastic sleeve. This, however, did not prove to be sufficient to
prevent the Bangalore accident.
 This accident illustrates that Ignition Sources continue to
exist and that fuel tank explosions continue to occur in both wing
and center tanks despite the corrective efforts of government
regulators and industry. The NTSB continues to believe the best
protection against fuel tank explosions is to eliminate the
Flammable conditions inside the fuel tanks through design
changes such as Nitrogen-Inerting Systems. (NTSB Safety
Recommendation A-96-174)
20
Fuel Tank Safety

21
Fuel Tank Safety

22
Fuel Tank Safety

23
Fuel Tank Safety

24
 Fuel Tank Safety

 On 20th August 2007, a China Airlines Next Generation B737-

800 aircraft caught fire on arrival at the gate area of Naha
Airport. Initial report was of a fuel leak that lead to the fire
although no sign of fuel leakage observed by ground crew during
taxiing to the gate. Investigators revealed that a bolt, which had
come loose from the Slat track, had punctured the right wing fuel
tank, creating a hole 2-3 centimeters in diameter.
 Following the incident, the Taiwan Civil Aeronautics
Administration grounded all 14 remaining Boeing 737-800s of
China Airlines, Mandarin Airlines and the Republic of China Air
Force for inspection of the fuel systems. No anomalies were
found and all aircraft returned to service.

25
 Fuel Tank Safety

 On 17th July 1996, Trans World Airlines Flight 800 departed

New York’s John F. Kennedy International Airport en route to
Paris, France. The aircraft was a Boeing 747-100 and had
accumulated 93,303 flight-hours prior to this flight. It was
climbing through 13,760 feet when,14 minutes into the flight, it
exploded and fell into the Atlantic Ocean approximately 9 miles
off Long Island. All passengers & crew on board were killed.

26
Fuel Tank Safety

27
Fuel Tank Safety

28
Fuel Tank Safety

29
Fuel Tank Safety

30
 Fuel Tank Safety

 The NTSB suggested that the

most likely source was a
combination of a Latent fault
and a Short Circuit.

 The high energy, when

combined with the latent fault
caused an Electric Arc.

31
Fuel Tank Safety

32
Fuel Tank Safety

33
Fuel Tank Safety

34
 Fuel Tank Safety

 In flight breakup due

to Explosive Failure in
Fuselage
 212 Passengers and 18
Crew died
 Initial Investigation
focuses on Terrorism
 6 Months pass before
Terrorism – or External
Explosion discounted
 Fuel Tank Explosion –
Induced by System
Failures – 9 Months
into Investigation
35
Fuel Tank Safety

36
 Fuel Tank Safety
Reason of SFAR 88 & FTS Program

37
 Fuel Tank Safety
Reason of SFAR 88 & FTS Program

1990 - B737-300 Manila,

Philippines

1996 - B747, TWA

Flight 800, JFK NY

2001 - B737-400 Bangkok,

Thailand
38
 Fuel Tank Safety

ACCIDENT FINDINGS

WHAT CAUSED THE CRASH OF TWA 800?

• The NTSB (National Transportation Safety

Board) considered TWA 800 the most extensive
and encompassing accident investigation ever
undertaken by the safety board
• The NTSB determined that the possible caused
of the TWA 800 accident was an explosion of the
Center Wing Fuel Tank resulting from ignition of
the flammable fuel/air mixture in the tank
39
 Fuel Tank Safety
• The ignition sources evaluated by the
investigator, the most likely was short circuit
outside of the CWT that allowed excessive
voltage to enter through electrical wiring
associated by the fuel quantity indication system

The Ignition Source

• After scrutinizing all of the recovered wreckage,
which accounts for over 95% of the plane, they
found nothing to support any plausible theory of
ignition. However, concerning ignition sources,
electrical arcing and autoignition are two source
theories that were tested by the NTSB
40
 Fuel Tank Safety
Electrical Arcing

• In search of answer to the question, the NTSB

conducted an investigation into the state of
electrical wiring in operational Boeing 747s
and similar model from other manufacturers
to see if a spark could occur in the central
fuel tank
• The findings from this investigation were
discouraging. Finding include: sharp metal
shaving both on and between wire bundles
and three quarter inch coating of lint of wires,
what NTSB describe as syrup
41
 Fuel Tank Safety
• The presence of sharp metal shaving, can strip
insulation away from wire, the wire becomes
exposed and enhance the likelihood of spark
• Exposed wires that coated with syrup or metallic
drill shavings can be dangerous because either
substance can act as a conductor, consequently
could function as a base point for an electric arc,
which could ignite the contents of a fuel tank

Autoignition
• Another possible source of ignition is from the
terminals of the FQIS wires in the central fuel
tank on which copper sulfide can build up
42
 Fuel Tank Safety

• This phenomenon has been observed in

aging electrical systems, and is a result of the
natural deterioration of wiring
• The build up can become sources of localized
heat. This can cause a threat because of
autoignition
• If the localized heat source is hot enough, the
fuel around it may reach a temperature at
which it will automatically ignite

43
 Fuel Tank Safety

• Another theory involves the scavenger pump

and faulty check valve. If the scavenger pump
was operating and its check valve was too
tight, resulting in concentration of vapor
around the check valve
• The vapor have a lower auto ignition than the
liquid and the pump is a significant source of
energy that should become hot enough to
cause auto ignition of fuel vapor

44
 Fuel Tank Safety

Drill Shavings, Swarf and Contamination on Wire Bundles

45
 Fuel Tank Safety

Metal Shavings on Power Wire

46
 Fuel Tank Safety

Arc to Lower Wing Skin

Arc Through Pump Housing

Arc Through Conduit Fuel Pump Internal Damage/Overheat

47
 Fuel Tank Safety

• Wires improperly tied, riding on Hydraulic lines

48
 Fuel Tank Safety

• Heat Discoloration

49
 Fuel Tank Safety

• Bend Radii problem – Less than 3 times the Diameter

50
 Fuel Tank Safety

SFAR 88
Background:
• Due to reports of airplane incidents, NTSB made
several recommendations to the FAA to examine
manufacturers’ design and maintenance practices, and
make changes to eliminate potential ignition hazards in
transport category aircraft fuel tanks.

• In response the FAA issued SFAR 88: required that all

type certificate holder for large aircraft certified since 1
Jan 1958 conduct a safety review of the fuel tank system
to ensure that there will be no ignition source present
which could cause catastrophic failure, event with a
variety of system failures.
51
 Fuel Tank Safety

SFAR 88
Background (cont’d):
• It also required that procedures be developed to
prevent the development of ignition sources during the
life of the aircraft.

•The FAA and EASA have indicated that operators must

train their maintenance and engineering personnel
regarding the changes brought about by SFAR88

52
Fuel Tank Safety

53
 Fuel Tank Safety

The Main Concern of SFAR 88

(a) Conduct a safety review of the airplane fuel tank system
to determine that the design meets the requirements of
Secs. 25.901 and 25.981(a) and (b) of this chapter
(FAR14CFR25). If the current design does not meet
these requirements, develop all design changes to the
fuel tank system that are necessary to meet these
requirements.

(b) Develop all maintenance and inspection instructions

necessary to maintain the design features required to
preclude the existence or development of an ignition
source within the fuel tank system of the airplane.

54
 Fuel Tank Safety

SFAR 88

SFAR 88 design review resulted in several changes to:

•Design
•Operation
•Maintenance

Service Bulletin (SBs) are being released to modify

some systems and to alter several component of the
fuel system in order to reduce the possibility of
introducing an ignition source into the fuel tank

55
 Fuel Tank Safety

SFAR 88
SFAR 88 rule required manufacturers to enhance airplane
maintenance programs to maintain design features that are
necessary to prevent an ignition source in the fuel tank.

The result of this effort was the incorporation of several

Airworthiness Limitations (AWLs) for Boeing, and Fuel
Airworthiness Limitations (FALs) for Airbus into maintenance
program documents.

These AWL’s/FALs are divided into two categories:

1. Critical Design Configuration Control Limitation (CDCCL) for

Boeing and Airbus.
2. Airworthiness Limitation Inspections (ALIs) for Boeing or
Maintenance/Inspection Task (ALIs) for Airbus.

56
 Fuel Tank Safety

SFAR 88

•CDCCL (Critical Design Configuration Control Limitation) for

Boeing and Airbus : Critical fuel system design features which
must be maintain in order to minimize the creation of a fuel tank
ignition source. CDCCLs are identified in the AMMs, CMMs. (Some
examples of CDCCL: bonding and grounding of fuel system
component, and the routing of fuel system wiring.)

•ALIs (Airworthiness Limitation Inspections) only for Boeing:

Repetitive inspections which are required to help ensure that
components which are subject to degradation or damage do not
deteriorate to the point where they may fail and create an ignition
source in the fuel tank. ( Some examples of ALI: verification of
fault current bonds, and inspection of wiring insulation and
clamping.)

57
 Fuel Tank Safety

JAA/EASA
• A similar regulation ( JAA INTERIM POLICY
25/12) has been recommended by JAA to the
European NAA in JAA letter 3 February 2003.
• The review was requested to be mandated by
European NAA using JAR 25.901 & 25.1309
• In August 2005 the EASA published a policy
statement on the process for developing
instruction for maintenance and inspection of
Fuel Tank System ignition source prevention.

58
 Fuel Tank Safety

JAA/EASA
• The EASA Airworthiness Directive mandate
the Fuel Airworthiness Limitations (ALIs and
CDCCL) for the type of aircraft that resulted
from design review

• Enhanced Airworthiness Program : The FAA

and EASA have indicated that operators must
train their maintenance and engineering
personnel regarding the changes brought by
SFAR 88 (EASA ED Decision No.2007/002/R)
59
 Fuel Tank Safety

✈ JAA TGL 47 - INT/POL/25/12-1

 Introduction:
• In recent years the aviation industry has
experienced a number of accidents involving
fuel tank explosion.
• These experiences suggest that on some
aircraft types, the fuel tank system installation
does not provide as high a level of protection
against explosion as had been expected
60
 Fuel Tank Safety

✈ JAA TGL 47 - INT/POL/25/12-1

 Applicability:
• The JAA interim policy applies to all turbine
powered Large Transport Aeroplanes certified
after 1 January 1958 with type certificated
passenger capacity of 30 seats or more, or
payload of 3402 kg or more.

61
 Fuel Tank Safety

✈ JAA TGL 47 - INT/POL/25/12-1

 Ignition Sources:
• Electrical Arcs & Sparks - Wiring and
component failures, lightning, HIRF/EMI,
static
• Friction Sparks - Metallic surface rubbing -
debris in pump impeller or interference
between impeller and case
• Hot Surface Ignition / Autoignition
62
 Fuel Tank Safety

✈ March 2007 - EASA Agency Decisions

2007/01R, 2007/02R and 2007/03R issued
on Fuel System Safety

 Part 145 Organizations - Component &

Airplane level
 Part M Airworthiness Management
Organization
 Part 66 Licensing

All Decisions related to Aircraft Fuel

System Safety & CDCCL 63
 Fuel Tank Safety

Systemic Change Needed

64
Fuel Tank Safety

65
Fuel Tank Safety

66
Fuel Tank Safety

67
Fuel Tank Safety

68
 Fuel Tank Safety

FLAMMABILITY REDUCTION

✈ The NTSB recommended that Fuel Tank

Flammability was the Primary causal effect
- trying to make tanks Ignition Proof was
(probably) unachievable in the in-service
condition.
✈ Given that fact, then unless the tanks
were Flammability Reduced then the
likelihood was that there will be another
incident.
69
 Fuel Tank Safety

It takes three things to start a Fire - Oxygen, Heat & Fuel

Eliminating any one, and there would be no Fire or Explosion.

The Fuel and Oxygen in the air must be mixed in the right
proportion and have the right temperature from the heat
source in order to trigger a Fire or Explosion...

Oxygen Ignition
Flammability Ignition Source
Reduction Elimination

Fuel Vapor
70
Heated Tanks
 Fuel Tank Safety

Ignition Prevention Alone

(Not Balance Approach)
Attempting to “plug” all the holes in one layer exceed what is
realistically possible.
For over 40 years, we have been trying to
prevent tank explosions by plugging all the
holes in this layer, which is nearly impossible!

HAZARD

Ignition Prevention Layer

Holes due to;
-Design Issues
-Aging Systems Flammability Layer
-Improper Maintenance, (High Flam. Tank Shown)
Rework, Modifications etc Hole due to; ACCIDENT !
-Unknown unknowns -High Exposure to Flammable
Vapors

71
 Fuel Tank Safety

Balanced Approach with

Flammability Reduction
Flammability Reduction significantly reduces hole size in
flammability layer, virtually eliminating future accidents.

SFAR 88
Flammability Reduction /
HAZARD Low Flammability

Ignition Prevention
Layer
- Some holes eliminated
(e.g. design changes to
preclude single failures)
- Other holes reduced in
size (human factors/
maintenance issues,
unknowns, etc.)
Flammability Layer
-Reducing flammability
exposure significantly
reduces holes
(flammability reduction)
-Small holes remain due
to system performance, ACCIDENT
dispatch relief, system PREVENTED !
reliability, etc. 72
 Fuel Tank Safety

Flammability Reduction is now part of Fuel

System Safety

73
 Fuel Tank Safety

FLAMMABILITY REDUCTION SYSTEM (FRS)

AVOIDANCE OF THE EXPLOSION HAZARD BY

NITROGEN INERTING
• Beside the avoidance of igniting source, the explosion
hazards can be prevented by nitrogen enrichment of
the tank, called FRS (Flammability Reduction Systems)
• The pressurized air in the system is forced through the
membrane fibers and allows fast gases to escape
through the membrane wall and the nitrogen rich
stream to pass through
• By this possibility the level of the fuel center tank can
be adjusted from high flammability to low flammability
74
 Fuel Tank Safety

FLAMMABILITY REDUCTION SYSTEM (FRS)

AVOIDANCE OF THE EXPLOSION HAZARD BY

NITROGEN INERTING

• B737 delivered from February 2007 have been

equipped with the system
• For aircraft already delivered and still
operation, refitting will be carried out at given
time

75
 Fuel Tank Safety

✈ Air Separation Module separates out:

 Oxygen - O2

 Water - H2O

 Carbon Dioxide - CO2

 Remaining Air (4N2O2) rich in Nitrogen,

depleted in Oxygen
76
 Fuel Tank Safety

Air Separation Module

77
 Fuel Tank Safety

Boeing test system on B747 Aircraft

78
 Fuel Tank Safety

Airbus test using A320

79
Fuel Tank Safety

80
 Inerting
Fuel Tank Safety
Studies FRS
FAA FRS Implementation
Started
Demonstrator

FLAMMABILITY REDUCTION

1996 2007 TODAY

IGNITION ELIMINATION

PAL
FLYING TODAY IS
TWA
737 800 THAI FAR SAFER THAN
737 IT WAS 10 YEARS
SFAR 88 AGO
Rule

FUEL TANK SAFETY HISTORY 81

Fuel Tank Safety

82