Horizontal

FLIGHT TWA-800

NATGEO AIR CRASH INVESTIGATION

In search of answers to the question of ignition, the NTSB conducted an investigation into the state of electrical wiring in operational B747s and similar models from other manufacturers to see if a spark could occur in the central fuel tank.

The findings from this investigation were discouraging. Between May of 1997 and July 1998, the NTSB examined 43 existing jets, of which many were old, reaching ages up to 271/2 years old. Findings includes sharp metal shavings both on and between wires in bundles, and three quarter inch coatings of lint on wires, what NTSB described as syrup: a sticky combination of spilled beverages, leaking water and lavatory fluids, dust and other materials that build up over the years of service.
The presence of sharp metal shavings, which can be attributed to drilling, can strip insulation away from the wires. As a result, the core conducting wires become exposed and enhance the likelihood of a spark. Exposed wires that are coated with syrup or metallic drill shavings can be dangerous because either substances such as these could function as a base point for an electrical arc, which could ignite the contents of a fuel tank. The NTSB, working in conjunction with the contracted electro-mechanical Design Company, conducted simulations with these conditions to see if it was possible to create an electrical arc. In one rare case, when two bare wires were bundled close each other, as arc was created [NTSBc, 1999]

TGL

Critical Design Configuration Control Limitations (CDCCL) / SFAR88 Management and Control
BACKGROUND: After the accident of B747-131 flight TWA 800 involving Fuel Tank System explosions, NTSB (National Transportation & Safety Board) carried out investigations to find out the reason of the accident. Based on investigation findings, FAA issued Special Federal Aviation Regulation 88 (SFAR 88) advising aircraft manufacturers to carry out a design review of fuel tank system to avoid entry of any ignition source into the fuel tanks in compliance of FAR 25-901 & 25.981 (a) and (b). A similar regulation has been recommended by JAA to National Aviation Authorities (NAA) using JAR 25.901 and 25.1309. INTRODUCTION: Fuel Airworthiness Limitations (FAL) are items/systems, the failure of which may lead to an unsafe condition as defined in SFAR 88. This unsafe condition may lead to an unacceptable probability of ignition risk if specific tasks and / or maintenance practices are not performed in accordance with manufacturers requirements. Critical Design Configuration Control Limitations (CDCCL) is a limitation requirement and provides instructions to preserve a critical ignition source prevention feature of the fuel tank system to prevent occurrence of unsafe condition which may be caused by maintenance actions, repairs, modifications etc on aircraft systems and/or components.

A critical ignition source prevention feature may exist in the fuel system and its related installation or in systems that, if a failure condition were to develop, could interact with the fuel system in such a way that an unsafe condition would develop in the fuel system without this limitation. Based on SFAR88 guidelines, Boeing airplanes latest MPD revision, section-9, defines Airworthiness Limitation (AWL) tasks and CDCCL. Each AWL item which may potentially affect any of the CDCCL as defined in SFAR88 has also been identified as a CDCCL task with details of other maintenance activities having an indirect effect on the CDCCL. In addition, Boeing has developed significant inspections and modifications to improve ignition prevention feature. Nitrogen Inerting system is one of the systems developed by Boeing for in-service and production aircraft to prevent/minimize ignition risk in the fuel tanks. Airbus and ATR have also developed modifications and inspection tasks to comply EASA requirements. Airbus emphasis is to prevent ignition risk by reducing the possibility of electrical energy entering the fuel tanks. Airbus and ATR have published Airworthiness Limitations Items (ALI) part-5, A310 Fuel Airworthiness Limitations (FAL) ref: 95A.1930/05 issue-II or later and ATR42-500 Time Limits in compliance of abovementioned requirements. A310 and ATR42 FAL comprises of two basic sections; Section-1; Maintenance / inspection tasks / Time Limits, and Section-2; Critical Design Configuration Control Limitations (CDCCL).

CDCCL - Management and Control: Operators are required to amend their internal documentation to reflect the procedures developed for the management and control of each CDCCL for their fleet of aircraft. Airbus and ATR are revising AMM relevant pages to add a warning note regarding the existence of a CDCCL. In addition, aircraft component manufacturers have been advised to add a CDCCL warning note in the next revisions of applicable CMM. Boeing has reflected all the detailed CDCCL tasks in latest MPD section-9, Airworthiness Limitation (AWL) and CDCCL. It is reiterated that applicable AMM and CMM instructions must be followed before performing any maintenance action on the aircraft and/or equipment. PIAs ACTION: Following areas have been identified as a point of concern for management and control of CDCCL; i- Familiarization of maintenance personnel by issuance of Technical notices, bulletins, advisories etc. ii- Maintenance /inspection tasks control. iii- Service literature ( AD, SB, SIL etc.) assessment & control for each of the CDCCL. iv- Scheduled / Un-scheduled repair schemes control. v- Conducting a Continuous Recurrent Training program to enhance awareness of maintenance / overhaul shop personnel. vi- Inventory Control for incoming fuel system components.

i- Issuance of Technical Notices, Bulletins, advisories. Technical notices have been issued for general information of all maintenance personnel/certifying staff highlighting the existence of CDCCL. Human Factor Bulletin has also been issued to address CDCCL requirement. Revised and new technical notices and Bulletins will be issued to update the information on the subject. Action By: DCE(AV/AS)AWM, DCE(Quality Audit) Part-145. ii- Maintenance /inspection tasks control. The maintenance and inspection tasks are further classified as, Scheduled tasks and Unscheduled tasks. a- Scheduled Tasks Control Latest Airbus A310, ATR42-500 and Boeing Maintenance Planning Document (MPD) comply SFAR88/EASA ADs maintenance / inspection tasks and CDCCL requirements. In addition, MPDs of these aircraft have been scrutinized (& will be scrutinized on a continuous basis in future) to sort out the tasks having an impact on the CDCCL. These tasks have been (and will be) marked as CDCCL TASK in PIA mainframe system (PAMMIS) which is used to generate work packages. Action By: DCE(AV/AS)AWM, DCE(SD&D)AWM

b- Un Scheduled Tasks Control Inspections/ tasks introduced through Locally generated task cards as per requirements of an AD, inspection SB, or any other local operational /maintenance requirement also requires assessment whether it affects the CDCCL or not. Action By: DCE(AV/AS)AWM, DCE(SD&D)AWM, iii- Service literature assessment & control for CDCCL AD/SB evaluation checklist has been revised (Appendix-A) to add a check that the service literature under evaluation potentially affects CDCCL or Not. Based on this assessment, a data base will be updated to have a record of all the ADs, SBs, Engineering Change Orders (ECO) which have an effect any of the CDCCL requirements. This database will be arranged as per ATA100 specifications in a separate binder/register as well as in soft form spread sheet. Concerned Deputy Chief Engineer will arrange for updating this register/ spread sheet. Special consideration will be given to ADs/SBs affecting the CDCCL both during evaluation and validation on the aircraft and/or equipment. Action By: DCE(AV/AS)DE, DCE(Production) Concerned section. iv- Scheduled / Un scheduled repair schemes control Structural repair(s) may be required on an aircraft during scheduled and/or unscheduled maintenance. Any scheduled /un scheduled locally prepared repair scheme will be examined for effect on any of the CDCCL item(s). Relevant reporting forms / documents will have a check/note for the same. Action By: DCE(AS)AWM, DCE(SRS), DCE(AS) LM/BM, DCE(SD&D)AWM

v- Conducting a Continuous Recurrent Training program Marking a note CDCCL TASK on selected maintenance tasks/inspections will not be a total solution for CDCCL control. There are (and may be) tasks having an indirect effect on the CDCCL and which can only be realized during validation on the aircraft and/or equipment. Therefore, it is of prime importance to enhance awareness level of maintenance personnel /certifying staff so that the CDCCL/ fuel safety design criteria is not compromised. Recurrent Training programs have been developed to enhance awareness of maintenance / overhaul shop personnel. These training sessions will be conducted on a regular basis. Action By: DCE(AV/AS)DE, DCE(HR & Automation), DCE(Quality Audit) Part-145 Vi- Inventory Control for incoming fuel system components Fuel system components which are maintained in PIA overhaul shops are required to be maintained as per the accomplishment instructions provided in the applicable CMM. Fuel system components which are sent abroad for repair or incoming new components from the vendors or suppliers must have a certification /text for CDCCL compliance in addition to applicable ADs compliance statement. Action By: DCE(RP), DCE(ES&CA), DCE(Plng) AVOH, DGM(Logistics) Stores

RECOMMENDATIONS:
Following is recommended to satisfy CDCCL requirements; All maintenance personnel involved in the maintenance of aircraft systems and/or components should comply with the fuel system design criteria as outlined in applicable CDCCL, while working either on the fuel system or any other system/ component. Care should be taken while entering a fuel tank for maintenance that all necessary precautions have been taken care off, electrical bonding of the fuel tank system/components is not damaged, electrical wiring segregation and the distance between the fuel quantity probes and structure is maintained. There is always a probability that work performed on any aircraft system/component may affect fuel system design limitations and it is the responsibility of the certifying staff to ensure that these design limitations outlined in the CDCCL are not compromised. Persons working on fuel system components in overhaul shops should also consult respective CMM to ensure compliance of CDCCL. Regular recurrent training on CDCCL issues should be conducted in all work areas including Base maintenance, Line maintenance and overhaul shops. It is reiterated that applicable AMM and CMM instructions must be followed before performing any maintenance action on the aircraft and/or equipment. This is for information and strict compliance of all concerned.

APPENDIX-A 1- A310 Fuel Airworthiness Limitations SECTION 2 CRITICAL DESIGN CONFIGURATION CONTROL LIMITATIONS (Ref # 95A.1930/05 Issue-II Section 2) 1- Air gap between a fuel quantity indicating probes and the aircraft structure. Critical to prevent spark generation during lightning strike conditions and must not be compromised The gap stated in the relevant maintenance procedure in the AMM must be achieved during installation of a fuel quantity probe. AMM 28-42-31 pb 401 28-42-32 pb 401, 28-42-33 pb 401 2- Separation of fuel quantity and level indicating system wiring from other wiring. To prevent cross coupling of high voltage transients and thereby keep unsafe ignition energies from inside the tank it is required that operators obey the wire routing and separation standards given in the Electrical Standard Practices Manual (ESPM). ESPM 20-10-00, 20-33-20, 20-33-21, 20-33-22

3- Direct bonding on items of equipment inside a fuel tank. Direct bonding is critical to prevent spark generation during component failure and lightning strike conditions and must not be compromised Direct bonding in fuel tanks must be carried out during component installation to the appropriate bonding method and standard stated within the installation procedure in the AMM.

4- A310- Safety critical features of fuel pumps These features must be maintained throughout the full life of the fuel pump to avoid the possibility of generation of an ignition source by overheating or sparks caused by arcing, friction etc. Repair and overhaul of fuel pumps must be carried out in accordance with the equipment manufacturers maintenance instructions or other maintenance instructions acceptable to the certifying authority. CMM 28 09 01, 28 24 11. 2- ATR42-500 CRITICAL DESIGN CONFIGURATION CONTROL LIST (CDCCL) 1. INTRODUCTION
This section refers to the CDCCL (Critical Design Configuration Control List) applicable to the fuel tank. It has been built to comply with the applicable Fuel Tank Safety Regulation. The aim of the CDCCL is to provide instructions to retain the critical ignition source prevention features during configuration change that may be caused by alterations, repairs, or maintenance actions. The following components or features have been identified as part of the fuel tank ignition source prevention features.

2. SELECTED ITEMS 4.2.1. FUEL PUMP The fuel pump is a key element of the fuel system. Extensive testing demonstrated the compliance of the fuel pump with requirements of the Fuel Tank Safety Regulations. Any deviation to the pump approved configuration can lead to questioning of the test results and therefore can potentially introduce an unsafe condition. CMM reference: Pump: CMM 28-21-71 from Goodrich Actuation Systems

4.2.2. BONDING LEADS Bonding of pipes within the fuel tanks is part of the design protections against electrostatic discharge and lightning strike. More than one (1) bonding lead missing, damaged or loosened on each pipe inside the fuel tanks can introduce an unsafe condition. Bonding Leads reference: N/A 4.2.3. FQI HARNESSES AND PROBES Probes and harnesses have been tested and qualified in accordance with the Fuel Tank Safety Regulations. Any deviation from the actual design can potentially introduce an unsafe condition. Therefore these equipments must be submitted to approval before any modification. CMM references: Fuel Quantity Indicating Probes: CMM 28-42-72 from Intertechnique Fuel Quantity Indicating Harnesses: CMM 28-42-71 from Intertechnique 4.2.4. IN TANK HARNESS ROUTING Methodology and guidelines for securing in-tank fuel harnesses as prescribed within the applicable Job Instruction Cards (JIC) of ATR Aircraft Maintenance Manual (AMM), prevents the provisional length of the harness, necessary to allow removal of the probe, to be in contact with the aircraft structure and potential chafing on the wing structure. Deviation from the instructions related to these tasks could potentially introduce an unsafe condition by allowing harness chafing within the fuel tanks. AMM JIC references: 28-42-72 RAI 10000: Removal and Installation of Fuel Quantity Probe. 28-42-72 RAI 10010: Removal and Installation Harness. 28-25-73 RAI 10000: Removal and Installation of High Level Sensor.

4.2.5. WING ACCESS DOORS : The wing access doors are part of the external wing skin and participate to the electrical discharge upon a lightning strike. In order to maintain the conductivity, the methodology and guidelines for opening and closure of the wing access doors as prescribed within the applicable Job Instruction Cards (JIC) of ATR Aircraft Maintenance Manual (AMM) shall be strictly followed. Special attention shall be paid for the cleaning and preparation of the contact surfaces and the use of the relevant sealants. Furthermore a conductivity test shall be performed after the related access panel closure. Any deviation from the actual design can potentially introduce an unsafe condition AMM JIC references: 57-00-00 OAC 10000: Opening and closure of wing bow access doors 05-51-16 CHK-10010: Check of wing access doors conductivity. Ref # ATR42-500 TIME LIMITS REV.5 Dated: January 23, 2004.

 BOEING - AIRWORTHINESS LIMITATIONS/CERTIFICATION

MAINTENANCE REQUIREMENTS FUEL SYSTEMS AIRWORTHINESS LIMITATIONS
This section of the Airworthiness Limitations contains an FAA approved program of scheduled inspections for operators to incorporate into their maintenance program for this type design to meet the new standards and assumptions introduced by 25.981 and Special Federal Aviation Regulation SFAR No. 88. SFAR 88 - Fuel Tank System Fault Tolerance Evaluation Requirements and Title 14 Code of Federal Regulations 25.981 - Fuel Tank Ignition Prevention require maintenance instructions, and control limitations for certain fuel tank critical design configurations. Paragraph 2(a) of SFAR 88 and Paragraph (b) of the new standard introduced by 25.981 requires certain design approval holders of Type Certificates (TCs) and Supplemental Type Certificates (STCs) of large transport airplanes to conduct a safety review of the fuel tank systems. The purpose of the safety review is to identify design features that may result in development of ignition sources in the fuel tank systems. Fuel System Airworthiness Limitation Items (AWLs) are mandatory maintenance actions required to ensure that unsafe conditions identified by the SFAR 88 safety review do not occur or are not introduced into the fuel tank system as a result of configuration changes, repairs, alterations, or deficiencies in the maintenance program throughout the operational life of the airplane. An AWL may be: an Airworthiness Limitation Instruction (ALI) or a Critical Design Configuration Control Limitation (CDCCL).

CDCCLs are a means of identifying certain design configuration features intended to preclude a fuel tank ignition source for the operational life of the airplane. CDCCLs are mandatory and cannot be changed or deleted without the approval of the FAA office that is responsible for the airplane model Type Certificate, or applicable regulatory agency. A critical fuel tank ignition source prevention feature may exist in the fuel system and its related installation or in systems that, if a failure condition were to develop, could interact with the fuel system in such a way that an unsafe condition would develop without this limitation. Strict adherence to configuration, methods, techniques, and practices as prescribed is required to

ensure compliance with the CDCCL. Any use of parts, methods, techniques or practices not contained in the applicable CDCCL must be approved by the FAA office that is responsible for the airplane model Type Certificate, or applicable regulatory agency. ALIs identify inspection tasks related to fuel tank ignition source prevention which must be done to maintain the design level of safety for the operational life of the airplane. These ALIs are mandatory and cannot be changed or deleted without the approval of the FAA office that is responsible for the airplane model Type Certificate, or applicable regulatory agency. Strict adherence to methods, techniques and practices as prescribed is required to ensure the ALI is complied with. Any use of methods, techniques or practices not contained in these ALIs must be approved by the FAA office that is responsible for the airplane model Type Certificate, or applicable regulatory agency.