AMC 25.954 Fuel system lightning protection

• ED Decision 2020/024/R found in: CS-25 Amdt 27 - Large Aeroplanes (Jan 2023)

AMC 25.954 Fuel system lightning protection ED Decision 2020/024/R TABLE OF CONTENT 1 PURPOSE 2 APPROACH TO COMPLIANCE 2.1 Summary 2.2 Compliance tasks 2.3 Identify the design features and elements of the fuel system that require lightning assessment 2.4 Determine the lightning strike zones 2.5 Establish the aeroplane lightning environment 2.6 Develop a lightning protection approach and design lightning protection features 2.7 Identify potential failures of the design and protection features 2.8 Identify potential ignition sources associated with the design features and potential failures 2.9 Perform a safety assessment to determine fault tolerance and non-fault tolerance 3 PROVIDE RELIABLE FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES 3.1 Provide fault-tolerant lightning protection 3.2 Demonstrate effective fault-tolerance 3.3 Demonstrate protection reliability 3.4 Demonstrate compliance with the ‘extremely improbable’ requirement 4 ASSESS NON-FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES 4.1 Overview 4.2 Qualitative assessment of non-fault-tolerant conditions 4.3 Quantitative assessment of non-fault-tolerant conditions 4.4 Evaluating non-fault-tolerance for systems 5 ESTABLISH AIRWORTHINESS LIMITATIONS Appendix A. Definitions Appendix B. Section 4 examples 1 PURPOSE This AMC describes the tasks that should be accomplished to show compliance with [CS 25.954](#_DxCrossRefBm1709821378) for lightning protection of the aeroplane fuel system. These tasks may be accomplished in a different order than that listed below, and some tasks may require iterations. This AMC also provides a method of compliance appropriate for reliable fault‑tolerant and non‑fault‑tolerant protection for lightning ignition sources. Any non-fault-tolerant lightning protection in an aeroplane fuel system will, in order to comply with the method of compliance set forth in this AMC, need a thorough assessment for the likelihood of failures, lightning strikes and attachment locations, and fuel tank flammability. 2 APPROACH TO COMPLIANCE 2.1 Summary The method in this AMC divides the design features for fuel system lightning protection into three categories: intrinsically safe, fault tolerant, and non-fault tolerant. It also describes how applicants should develop material for the Airworthiness Limitations Section of the ICA. 2.1.1 Guidance for incorporating intrinsically safe design features into the fuel tank system is provided in paragraph 2.9.4.1. 2.1.2 Section 3 provides guidance on compliance with [CS 25.954(b)](#_DxCrossRefBm1709821378) for fault-tolerant lightning protection designs. 2.1.3 Section 4 provides guidance on compliance with [CS 25.954(b)](#_DxCrossRefBm1709821378) for non‑fault‑tolerant lightning protection designs. 2.1.4 Section 5 provides guidance on developing CDCCLs and other tasks that must be placed in the Airworthiness Limitation Section of the ICA. 2.2 Compliance tasks The applicant should accomplish the following tasks to comply with [CS 25.954](#_DxCrossRefBm1709821378): — Identify the design features and elements of the fuel system that require lightning assessment (paragraph 2.3); — Determine the lightning strike zones (paragraph 2.4); — Establish the aeroplane lightning environment (paragraph 2.5); — Develop a lightning protection approach and design lightning protection features (paragraph 2.6); — Identify the potential failures of the design and protection features (paragraph 2.7); — Identify the potential ignition sources associated with the design features and potential failures (paragraph 2.8); — Perform a safety assessment to determine fault tolerance and non-fault tolerance (paragraph 2.9); — Provide reliable fault-tolerant protection for lightning ignition sources (paragraph 3); — Assess non-fault-tolerant protection for lightning ignition sources (paragraph 4); and — Establish the Airworthiness Limitations (paragraph 5). 2.3 Identify the design features and elements of the fuel system that require lightning assessment To comply with [CS 25.954(b)](#_DxCrossRefBm1709821378), the applicant should identify the fuel system design features and elements for the fuel tank structure, system components, and equipment that require lightning assessment to show that the ignition of fuel vapour within the systems due to lightning and its effects is prevented. The design features and elements may be categorised into design groups that share characteristics that have similar lightning protection performance. The applicant should provide a detailed description of the fuel system, including: — structural members and fasteners exposed to direct and swept lightning attachment; — structural joints and fasteners exposed to conducted-lightning current resulting from lightning attachment; — access doors, vents, drain valves, fuel filler ports, and other parts and components of the fuel system exposed to direct lightning attachment or conducted lightning currents; and — electrical, mechanical, hydraulic, and fuel plumbing system installations within the fuel tank or connected to the fuel tanks exposed to direct lightning attachment or conducted lightning current. 2.4 Determine the lightning strike zones Lightning strike zones define locations on the aeroplane where lightning is likely to attach and structures that will conduct lightning current between lightning attachment points. The applicant should determine the lightning strike zones for the aeroplane configuration, since the zones will be dependent upon the aeroplane geometry and operational factors. Lightning strike zones often vary from one aeroplane type to another. EUROCAE document ED-91A, ‘Aircraft Lightning Zoning’, dated January 2019 and the equivalent SAE ARP5414B dated December 2018, are acceptable standards providing guidelines on determining the lightning strike zones for the aeroplane, the areas of direct lightning strikes, areas of swept lightning strokes, and areas of conducted electrical transients. When determining the probability of lightning attachment to certain regions of the aeroplane, applicants should use data from similar aeroplane configurations to substantiate any assumed strike attachment rate for the region. 2.5 Establish the aeroplane lightning environment The fuel tank structure, system components, and equipment that are located in lightning zones 1 and 2 should be designed for lightning direct-attachment waveforms. EUROCAE document ED-84A, ‘Aircraft Lightning Environment and Related Test Waveforms’, dated July 2013, and the equivalent SAE ARP5412B dated January 2013, are acceptable standards providing guidelines on acceptable lightning current and voltage waveforms for lightning zones 1 and 2. The fuel tank structure, system components, and equipment that are exposed to conducted currents should be assessed to determine the appropriate lightning current and voltage waveforms and amplitudes, using the conducted current waveforms for zone 3 in EUROCAE ED-84A/SAE ARP5412B. The applicant may use analyses or tests to assess the conducted currents and voltages for the structure, system components, and equipment. Margins should account for any uncertainty of the analysis or test. Simple analyses of the lightning currents and voltages should incorporate larger margins than the lightning currents and voltages that were calculated using detailed computational models that have been validated by tests. 2.6 Develop a lightning protection approach and design lightning protection features The applicant should develop the lightning protection approach and design lightning protection features required to provide effective lightning protection for all the fuel system design features and elements identified in paragraph 2.3 of this AMC. See paragraphs 3.2 and 4.1.2 for further guidelines on how to demonstrate an effective protection. The lightning protection features can include specific installation requirements, such as hole-size tolerance for fasteners or surface cleaning for sealant application. Other lightning protection features can include specific protection components, such as metal mesh incorporated into the outer surface of composite structures. The design should provide reliable lightning protection that prevents lightning–related ignition sources if a potential failure occurs in the lightning protection features. When possible, the design should place fuel system components — such as fuel tank vents, drain valves, jettison tubes, filler ports, and access doors — in lightning attachment zone 3, so they are less likely to be exposed to direct lightning attachment. 2.7 Identify potential failures of the design and protection features 2.7.1 The applicant should: — identify the potential failures, due to causes that include manufacturing escapes\*, operational deterioration\*\*, and accidental damage\*\*\*, that may lead to the loss or degradation of lightning protection; — identify, by analysis or test, the design elements that could degrade the effectiveness of lightning protection; — identify failures through a detailed review of manufacturing processes, material properties, structural design, systems design, and reliability and maintainability processes; — use the available manufacturing discrepancy reports, in-service failure reports, and developmental tests to identify potential failures; and — account for failures such as structural cracking, corroded or failed electrical bonding features, and mis-installed electrical bonding features that occur during manufacturing or maintenance. \**Manufacturing escapes for fuel tank structure include fastener selection issues (incorrect fastener sizes, types, finishes, or coatings), fastener assembly issues (misalignment, incorrect torque, hole size or quality, missing or extra washers), and installation issues (inadequate or improperly adhered sealant, missing cap seals, incorrectly installed electrical bonds). Manufacturing escapes for fuel system components and equipment include design configuration issues (incorrect fasteners, wrong or missing clamps or brackets, inadequate or improperly adhered sealant, missing or incorrect finishes), bonding issues (a missing or improperly installed electrical bond or wiring shield), and clearance issues (insufficient tube or wiring clearance to adjacent systems or structure).* \*\**Structural failures due to operational deterioration during intended operation include broken or cracked elements (fasteners or washers), corrosion, degradation of applied materials (sealants, fastener head coating, edge glow protection, or bonded joints), and fatigue issues (loose fasteners or structural cracks). System failures due to operational deterioration include failures of support features (loss of fasteners, brackets, or clamps that support tubes, EWIS or components) and degradation of electrical bonds, wire insulation or shielding due to corrosion, ageing, or wear.* \*\*\**Structure or system failures due to accidental damage include impact from foreign object debris (FOD) or inadvertent damage incurred during alterations, repairs, or inspections.* 2.7.2 The severity or types of failures should be defined and can be based on service history, where appropriate, and laboratory test data. The severity of the failure should be consistent with or bounded by the assumptions made for the structural and systems certification analyses. The severity or types of failures due to manufacturing escapes should be based on manufacturing discrepancy reports, such as rejection tags, manufacturing process escape assessments, and assessments of process improvements. 2.7.3 Manufacturing variability and environmental conditions should be considered in conjunction with failures. Combining worst-case conditions for all manufacturing variabilities and environmental conditions is overly conservative and not necessary. Failures due to operating or environmental conditions other than those required for certification do not need to be considered. Combinations of failures where one failure also causes a second failure to occur should be considered as a single failure condition (i.e., a common cause or cascading failure). 2.8 Identify potential ignition sources associated with the design features and potential failures. 2.8.1 Fuel system fasteners, structures, equipment, and components that are exposed to direct lightning attachment in lightning zones 1 and 2 should be assessed using the lightning waveforms identified in paragraph 2.5 of this AMC. Fuel system fasteners, structures, equipment, and components should also be assessed for conducted lightning currents. If the aeroplane uses novel or unusual materials, structures, or configurations, the applicant should evaluate the fuel system fasteners, structures, equipment, and components on the outside surface of the aeroplane located in lightning zone 3 using the nominal zone 3 direct lightning attachment waveforms defined in EUROCAE ED‑84A/SAE ARP5412B. The use of materials that are not highly conductive for the structure of fuel tanks is considered unusual. Lightning attachment in zone 3 is defined as unlikely in EUROCAE document ED‑91A, ‘Aircraft Lightning Zoning’, dated January 2019, and the equivalent SAE ARP5414B dated December 2018, so the evaluation does not need to consider failures in combination with such an attachment, but should demonstrate that no catastrophic effect will occur when no failures are present. 2.8.2 The following paragraphs list ignition source types and examples of how ignition sources might occur: 2.8.2.1 Voltage sparks are the result of the electrical breakdown of a dielectric between two separated conductors. Voltage sparking might occur, for example, between the fastener and its hole or through an insulation layer between the base of a nut and a conductive surface. A voltage spark could occur between a fuel tube and the adjacent structure if the separation is insufficient or the bonding to minimise the voltage potential has failed. If this spark is exposed to fuel vapour, an ignition may result. Laboratory tests have shown that the minimum ignition energy in a voltage spark required to ignite hydrocarbon fuel vapour is 200 microjoules\*. \**The 200-microjoule level comes from various sources. The most quoted is from Lewis and von Elbe’s book, Combustion, Flames and Explosions of Gases (Florida: Academic Press, Inc., 1987; (orig. publ. 1938)). It has a set of curves for minimum ignition energy for the various hydrocarbon compounds in jet fuel, and they all have similar minimum ignition energy levels of greater than 200 microjoules.* 2.8.2.2 Thermal sparks are the result of burning particles emitted by the rapid melting and vaporisation of conductive materials carrying current through a point contact. Thermal sparks can occur when there is a small contact area between a fastener and the hole material, or between a fastener collar and the underlying structure. Thermal sparks can occur at a point contact between a fuel tube and the adjacent structure if the contact point conducts a high current. When sealant or caps are used to contain sparks, failures could result in the internal pressures from the heat of thermal sparks that force hot particles past the sealant or cap, resulting in sparks in the fuel vapour area. 2.8.2.3 Analyses and tests indicate that a small piece of steel wool will ignite a flammable mixture when a transient current of approximately 100 milliamperes (mA) peak is applied to the steel wool\*. \**This data was from testing performed by the FAA Technical Center, Report DOT/FAA/AR-TN05/37, Intrinsically Safe Current Limit Study for Aircraft Fuel Tank Electronics. Applicants may conduct testing to substantiate alternate values.* 2.8.2.4 Edge glow includes voltage or thermal sparks that occur at the edges of carbon-fibre composite material when lightning current and voltage cause a breakdown of the resin between fibres. Failures of the protection features to prevent edge glow should be identified. 2.8.2.5 Fuel vapour ignition due to lightning near fuel vent outlets can result in flame propagation into the fuel system. When lightning attaches near fuel vent outlets, the ignition of fuel vapour results in a high-speed pressure wave that can travel through the flame arrestor without sufficient time for the flame arrestor to quench the flame front. The vent outlets should be located outside the lightning direct-attachment zones of the aeroplane. If the vent outlets are located in lightning direct‑attachment zones, flame arrestors have been used to prevent lightning-ignited fuel vapour from propagating into the fuel system. Specific lightning tests and unique design features are typically needed to demonstrate the effectiveness of the lightning-protection for these installations. (Lightning effects are not addressed in the fuel tank vent fire protection requirements of [CS 25.975(a)(7)](#_DxCrossRefBm1709821429). 2.9 Perform a safety assessment to determine fault-tolerance and non-fault-tolerance 2.9.1 The applicant should perform a safety assessment to determine whether the fuel system design provides acceptable fuel system lightning protection based on the design features and potential ignition sources due to failures of the design features identified in the previous steps. The applicant may perform the safety assessment on groups of fuel system design elements and lightning protection features with similar physical and electrical characteristics. For non-fault-tolerant features, an assessment must show, per [CS 25.954(c)](#_DxCrossRefBm1709821378), that the sum of the probability of failures from potential ignition sources in combination with the probability of a critical lightning strike and the fuel tank being flammable does not exceed extremely improbable. The applicant should provide its rationale for assigning design elements and lightning protection into groups. 2.9.2 The safety assessment should address all the fuel system design elements identified in paragraph 2.3 of this AMC, the lightning environment at the locations for those elements identified in paragraphs 2.4 and 2.5 of this AMC, and the failures identified in paragraph 2.7 of this AMC. The applicant should also use the safety assessment to identify where analyses or tests are necessary to demonstrate the prevention of fuel system ignition sources. 2.9.3 The applicant should use a rigorous and structured safety assessment approach. The structured safety assessment and associated fault-tolerance assessment and test reports should be part of the substantiating data. Failure modes and effects analyses are acceptable structured safety assessment tools, particularly for non‑fault tolerant lightning protection features. All the failure modes and effects analyses (FMEAs) and fault tree analyses (FTAs) should be included and thoroughly annotated. The applicant should substantiate and document all the assumptions used in performing the safety assessment. 2.9.4 The safety assessment should divide all the lightning protection features of the fuel system into the following three categories: 2.9.4.1 Intrinsically safe lightning protection Some fuel system design elements provide effective lightning protection with no foreseeable failure modes that would render them ineffective. These design elements have no failures or combinations of failures that can result in an ignition source. This can be due to reliable design or to a very low lightning voltage or current in that specific location. The applicant should identify any intrinsically safe fuel system design elements. An example of an intrinsically safe design element would be highly conductive fuel tank skins with sufficient thickness to ensure that lightning attachment to the skin will not result in hot-spot or melt-through ignition sources in the tank. Another example would be a structural element designed with sufficient margins that fatigue cracking is not foreseeable. A third example could be fasteners or joints located in the fuel tank structure where the lightning current density is so low that an ignition source will not result even when failure conditions are present. 2.9.4.2 Fault-tolerant lightning protection Fuel system design elements that are not intrinsically safe and require design features to provide lightning protection should be designed so that a failure associated with these elements or features will not result in an ignition source. Reliable fault-tolerant prevention of lightning ignition sources, in combination with the control of fuel tank flammability required by [CS 25.981](#_DxCrossRefBm1709821428) and the statistics of lightning strikes to aeroplanes, is acceptable for showing compliance with [CS 25.954(c)](#_DxCrossRefBm1709821378). Detailed guidance for showing compliance for reliable fault-tolerant lightning protection is provided in Section 3 of this AMC. 2.9.4.3 Non-fault-tolerant lightning protection Experience has shown that it is impractical to provide fault-tolerant features, or indications of failures, for some failures that occur in the aeroplane structure. Certain fuel system design elements and lightning protection features could have conditions where a single failure of these elements or features results in an ignition source when combined with a critical lightning strike. These fuel system design elements, lightning protection features, and failures require detailed and thorough safety assessment to determine whether the fuel system design complies with [CS 25.954(b)](#_DxCrossRefBm1709821378). It is likely that the aeroplane fuel system design and lightning protection can have only a very small number of these non‑fault‑tolerant lightning protection conditions and still show that the risk of a catastrophic event is extremely improbable to comply with [CS 25.954(c)](#_DxCrossRefBm1709821378). Section 4 of this AMC provides more detailed guidelines for showing compliance for non-fault-tolerant lightning protection. 3 PROVIDE RELIABLE FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES 3.1 Provide fault-tolerant lightning protection Fault-tolerant lightning protection for ignition sources on fuel tank structure and systems has been shown to be generally practical and achievable. Compliance with [CS 25.954(b)](#_DxCrossRefBm1709821378) for most fuel system elements (equipment, components, and structures) that are not intrinsically safe should be demonstrated by showing that the lightning protection is effective, reliable, and fault tolerant. 3.2 Demonstrate effective fault tolerance 3.2.1 The substantiation process should involve tests or analyses on the fuel system design elements and features on which faults are induced. These tests and analyses should address both lightning direct attachment to the fuel system design elements and features, and conducted lightning currents on them, as applicable. Where tests are performed, the following steps outline an approach to reduce the number of tests by grouping the design elements and features and the associated failures. In each step, the assumptions should be documented. 3.2.2 The test process can be summarised in four steps: 1. Select the test articles that will be used for assessing fault tolerance. A design review may be used to develop groups, or for classification of the fuel system design elements and features. For example, fasteners could be grouped by the types of fasteners (such as rivets, bolts, and collars). The groups could be differentiated by the materials (such as aluminium, steel, titanium, stainless steel, etc.), or by the manufacturing processes (such as interference fit holes, cap seals, insulating laminate plies, material thicknesses, etc.). 2. Assess the faults (including ageing, corrosion, wear, manufacturing escapes, and any foreseeable in-service damage) to determine the worst-case failures that could render the fault tolerance ineffective. Determination of the worst-case failures should be justified with engineering tests, previous certification tests, analyses, service experience, or published data. 3. Determine the lightning current amplitudes and waveforms in the fuel system design elements and features due to direct lightning attachment and conducted lightning currents, as applicable. The lightning environments were previously identified in the hazard assessment above. 4. Conduct tests using the current amplitudes and waveforms derived from step 3 and the faults defined in step 2 to demonstrate that the design prevents ignition sources when a fault occurs. 3.2.3 Assessment of system failure conditions generally involves first assessing the result of the failure condition. For example, the loss of a means of electrical bonding at a penetration of a fuel system tank may cause higher currents or voltages on components located within the fuel tank. The loss of a wire bundle shield or a shield termination may also cause higher voltages in the fuel systems. Assessment of these effects may involve analyses, tests, or a combination of test and analysis. Scaling based on the relative distances from the attachment locations, distances for structural conductors, lengths of system elements, etc., may all be necessary to establish the worst‑case threats. 3.2.4 Computational analyses or tests of representative tank sections may be used to determine the lightning current and voltage amplitudes and waveforms within the fuel system. The applicant should determine the currents, voltages, and associated waveforms that are expected on each feature or element of the fuel system, and use these current and voltage waveforms for tests on representative fuel system parts, panels, or assemblies. Analyses should be validated by comparisons of the analysis results with test results from fuel system configurations that are similar to the fuel system to be certified. The applicant should apply appropriate margins based on the validation results. 3.2.5 The applicant should conduct lightning tests using test articles that acceptably represent the relevant aspects of the proposed aeroplane fuel system features and elements. The test articles should incorporate the identified failures needed to demonstrate fault-tolerant lightning protection. When performing these tests, the configuration of the design and protection features and elements should address the effects of ageing, corrosion, wear, manufacturing escapes, and likely damage. The possibility of cascading failure effects on redundant features (e.g., fasteners fracturing and compromising sealant directly or over time) should also be considered as part of the assessment when determining what level of fault insertion testing is needed. Guidelines for lightning test methods are provided by EUROCAE ED-105A ‘Aircraft Lightning Test Methods’, dated July 2013, and the equivalent SAE ARP5416A dated January 2013. Lightning tests are typically needed to demonstrate that fuel tank vent flame arrestors prevent fuel ignition from propagating into the fuel system if the vent outlets are located in lightning direct‑attachment zones. The tests and analyses should be documented as part of the substantiating data. 3.3 Demonstrate protection reliability 3.3.1 The applicant should identify the protection features, and qualitatively establish their reliability, using the service experience of similar protection features or other means proposed to, and accepted by, EASA. For example, the interference fit of a fastener in a hole may be established as a reliable protection feature based on service experience that interference fit fasteners do not loosen appreciably over the life of the aeroplane. Likewise, dielectric or physical separation of systems from structures may be established as a reliable protection feature, provided that similar dielectric material or support installations have been shown in service or by tests to perform their function adequately for the life of the aeroplane. Where the reliability of a fault-tolerant feature cannot be established to typically exceed the life of the aeroplane, then the appropriate replacement time, inspection interval, and related inspection and test procedure must be included in the Airworthiness Limitations Section of the ICA to ensure the effectiveness of the protection, in accordance with [CS 25.954(d)](#_DxCrossRefBm1709821378). Airworthiness Limitation requirements are discussed in Section 5 of this AMC. 3.3.2 The applicant should address failures that can occur in service due to ageing and wear, and failures that can escape the manufacturing processes. For example, the anticipated escapes should include past manufacturing escapes. Any process changes that are implemented to preclude a specific type of escape may be considered if they preclude future escapes. The applicant should consider training to ensure the compliance with the manufacturing process, implement designs that preclude escapes, automate reliable and repeatable drilling and assembly, and monitor process errors. 3.4 Demonstrate compliance with the ‘extremely improbable’ requirement 3.4.1 The characteristics of lightning, the frequency of aeroplane lightning strikes, and the fuel tank flammability exposure are factors that affect the likelihood of lightning causing a catastrophic fuel vapour ignition. [CS 25.981(b)](#_DxCrossRefBm1709821428) limits the fuel tank fleet average flammability exposure to three per cent of the flammability exposure evaluation time, or that of a conventional unheated aluminium wing tank. The worldwide transport aeroplane lightning strike rate is of the order of once in several thousand flight hours. 3.4.2 The standard lightning waveforms in the EUROCAE/SAE standards are based on the combinations of severe lightning characteristics using a current amplitude, energy, rise time, and pulse repetition that conservatively exceed the majority of recorded values. Most aeroplane lightning strikes have significantly lower current values of amplitude, duration, energy transfer, rise time, and pulse repetition than the severe characteristics in EUROCAE ED-84A/SAE ARP5412B. This reduces the likelihood of a lightning-related ignition source even when the fuel system lightning protection effectiveness has degraded from what is demonstrated using the standard lightning waveforms in EUROCAE ED-84A/SAE ARP5412B. 3.4.3 The probability of occurrence of a lightning strike attaching to, or conducting currents through, the fuel system during flammable conditions, at a sufficiently severe level represented by the test levels of EUROCAE ED-84A/SAE ARP5412B, is remote by itself. Remote failure conditions are defined in [AMC 25.1309](#_DxCrossRefBm1709821113) (Qualitative Probability Terms). 3.4.4 If shown to be effective and reliable, fault-tolerant lightning protection complies with [CS 25.954(c)](#_DxCrossRefBm1709821378) without further analysing the probability of the failures, taking into account the remote probability of the environmental conditions discussed above. The applicant should show that the fault‑tolerant lightning protection features are designed and installed to be effective over their life or the life of the aeroplane or with appropriate inspections and maintenance. Lightning protection features and elements that have shown their reliability in service by adequate documented service history data on previous similar designs may be incorporated into the fault-tolerant design. 4 ASSESS NON-FAULT-TOLERANT PROTECTION FOR LIGHTNING IGNITION SOURCES 4.1 Overview 4.1.1 Fuel system configurations and failure conditions that result in non-fault-tolerant ignition sources should be minimised and precluded where practical. If the design is identified to be non‑fault‑tolerant, the design should be re-evaluated to determine whether practical measures could be implemented to make it fault tolerant. Wherever practical, fault-tolerant design protection features and elements should be implemented and assessed. ‘Practicality’ is defined as a balance of the available means, economic viability, and proportional benefit to safety. A means to provide fault tolerance that is possible with little economic impact is practical even if an event is not anticipated to occur in the life of an aeroplane without it. If the applicant determines that the fault-tolerant prevention of ignition sources is impractical for a specific design feature or failure, the applicant should review this determination of impracticality for concurrence with EASA. 4.1.2 For design features and elements that have failures where the fault-tolerant prevention of ignition sources is impractical, the applicant should assess these non‑fault-tolerant design features and elements to demonstrate that, taken together, the likelihood of a catastrophic fuel vapour ignition resulting from a lightning strike and flammable fuel tank conditions is extremely improbable. To successfully demonstrate this, it will likely be necessary to show that the probability of occurrence of such a fault is extremely remote and limited to a very small number of design features and elements. To support the results of the assessment, maintenance considerations have to be identified in order to maintain the aeroplane in this state during the life of the aeroplane. Analysis and similarity can be used, but similarity should include the similarity of the design, similarity of the current density at the design feature, and similarity of the production and maintenance conditions. Agreement with the authorities on the use of similarity should be achieved before this approach is used. In many instances, a specific manufacturer’s limited experience may not be representative of the overall transport fleet experience. 4.1.2.1 See Appendix B, paragraph B.1 of this AMC for examples of design elements or features where providing fault-tolerant prevention of lightning ignition sources should be practical. 4.1.2.2 See Appendix B, paragraph B.2 of this AMC for examples of design features or failures where providing fault-tolerant prevention of lightning ignition sources could be impractical. 4.1.2.3 See Appendix B, paragraph B.3 of this AMC for examples of design, manufacturing, and maintenance processes that may be useful in establishing compliance. 4.1.3 Applicants should identify all the potential non-fault-tolerant design and protection features early in their design process. All practical measures to provide intrinsically safe protection and fault‑tolerant prevention of ignition sources should be incorporated, which is more easily accomplished early in the design process. 4.1.4 Applicants should establish the probabilities of the flammable conditions within the fuel system where non-fault-tolerant features are present. 4.1.5 Once the probabilities of flammable conditions and the probabilities of critical lightning strikes occurring within the fuel system are defined, an evaluation of the potential for the occurrence of a structural discrepancy within the fuel system can be performed. When the probability of lightning attachment to certain regions of the aeroplane is included in the compliance approach, applicants should use data from similar aeroplane configurations to substantiate any assumed strike attachment rate. 4.1.6 Regardless of whether it is practical to provide fault-tolerant prevention of fuel system lightning ignition sources, compliance must demonstrate that the combined risk of catastrophic fuel vapour ignition due to lightning is extremely improbable. The assessment can be a qualitative analysis, a quantitative analysis, or a combination of both. The applicant should use the method that is most appropriate for the specific design. Where the protection means are reliable, the potential failure modes are rare, and limited service data is available to accurately determine the failure rates, a qualitative assessment is most appropriate. If the failure rates are available and a numerical assessment could be reasonably accurate, a quantitative assessment may be appropriate. If the potential failures are so common that the rates are well established, it is unlikely that a non‑fault‑tolerant design could be shown to be compliant without frequent maintenance checks. Combinations of failures where one failure also causes a second failure to occur should be considered as a single failure condition (i.e., a common cause or cascading failure). Combinations of independent failure modes that are expected to occur need to be considered. 4.2 Qualitative assessment of non-fault-tolerant conditions 4.2.1 The qualitative assessment must demonstrate that fuel vapour ignition due to lightning is extremely improbable, including the contribution of non-fault-tolerant features and elements. One means of assessing the risk of a catastrophic event due to failures of non-fault-tolerant features is to demonstrate that the potential ignition sources due to the failure conditions are also remote (per the AMC 25.1309 definition) for designs where fault-tolerant protection features are impractical. 4.2.2 Remote failure condition is defined in [AMC 25.1309](#_DxCrossRefBm1709821113). 4.2.3 The qualitative assessment should account for the design features to limit failures, the conditions necessary for a failure to result in an ignition source, and any means used to limit the occurrence or latency of a failure. The applicant should evaluate the design’s ability to safely conduct the lightning current densities and to prevent the lightning current flow. 4.2.4 A qualitative non-fault-tolerance assessment should show that combinations of service conditions, such as vibration, humidity, temperature changes, and maintenance activities, cannot produce an ignition source when exposed to voltages or currents resulting from lightning strikes to the aeroplane. 4.2.5 The following paragraphs (4.2.5.1 to 4.2.5.4) identify the areas that should be addressed for structural discrepancies within a fuel system. 4.2.5.1 Evaluation of non-fault tolerance should include consideration of structural discrepancies resulting from overstress, ageing, fatigue, wear, manufacturing defects, and accidental and environmental damage. Damage includes conditions that could be reasonably anticipated to occur in the life of an individual aeroplane due to operation and scheduled and unscheduled maintenance. In addition, probable manufacturing escapes in the production process should be considered as probable failures. 4.2.5.2 The determination of the potential for a non-fault-tolerant condition resulting in a lightning‑related ignition source should be based on appropriate assessments. The objective of these assessments is to demonstrate that, for the combination of all the discrepant conditions in a fuel tank vapour zone (i.e. ullage), the exposure time of the non‑fault‑tolerant feature to a lightning‑induced electrical current density of sufficient magnitude to become an ignition source will be minimised to such a degree that a catastrophic failure due to a lightning strike is not anticipated during the entire operational life of all the aeroplanes of that type. In performing the assessments to determine the potential for a non‑fault‑tolerant condition to result in a lightning-related fuel vapour ignition, the following factors should be collectively considered, addressed, and documented: 4.2.5.2.1 Analysis of the electrical current densities within the fuel tank structure considering its material properties and configuration; 4.2.5.2.2 Analysis and test data necessary to support the likelihood of occurrence of a critical lightning strike at a particular location on the aeroplane where a discrepancy exists; 4.2.5.2.3 Analysis and test data necessary to support any conclusion that the electrical current density generated by a lightning strike in the specific vicinity of a structural crack or broken fastener in the fuel tank will not be of sufficient amplitude to cause sparking; 4.2.5.2.4 Analysis and test data necessary to support the likelihood of the fuel tank being flammable; and 4.2.5.2.5 Evaluation of the fuel tank structure in all areas of the fuel tank that may be susceptible to a fuel vapour condition and at electrical current densities that can result in a lightning-related ignition. This should include assessing the structure’s: 1. Susceptibility to failure (such as cracking, delamination, fastener failures, failed fastener cap seals, failed sealant, etc.); 2. Inspectability (determining whether discrepant structure could be reliably inspected such that the exposure time of the failure to a critical lightning strike will be reduced to a level that supports the safety objective); 3. Service data (reports of failed structures such as cracks, delamination, failed fasteners, failed fastener cap seals, or sealant that could become an ignition source); 4. Maintenance inspection programs (determining whether inspections will reliably detect failures and discrepancies such that their exposure times will be reduced to a level that supports the safety objective). This includes mandated inspections (e.g., the Airworthiness Limitations Section of the ICA required by [Section H25.4 of Appendix H to CS-25](#_DxCrossRefBm1709821427) and [CS 25.1529](#_DxCrossRefBm1709821031)); and 5. Fatigue and damage-tolerance evaluation of the crack initiation/propagation rate, crack characteristics (e.g., crack width versus crack length or edge crack versus crack at or near a fastener hole), the detectable crack size, probability of detection, inspection threshold, and inspection interval. 4.2.5.3 See Appendix B of this AMC for an example of an assessment process addressing the potential for fuel tank structural cracking. 4.2.5.4 The qualitative assessment should consider any means used to ensure that the probability of a combination of faults will be remote. However, it cannot include the likelihood of lightning attaching to the aeroplane, or the flammability of the fuel tanks. 4.2.5.5 Figure 1 of this AMC provides a guide to the qualitative assessment process. Each of the activities in the qualitative assessment process, shown in Figure 1, is discussed in the paragraphs that follow. Figure 1. Assessing the Combined Risk of All Non-Fault-Tolerant Failures 4.2.5.6 Figure 1, Item (1). The first step is to determine whether there are design features or elements that do not provide fault‑tolerant lightning protection, as described in paragraph 2.9.4.3. 4.2.5.6.1 When a failure is considered possible, qualitatively assess with supporting test data and fleet experience to determine whether the condition is likely to occur in the life of the aeroplane fleet. This supporting data may include: — Lightning testing relevant to specific or similar design features (see paragraph 2.3 of this AMC); — Dielectric strength testing of insulating materials and structures such as brackets, clamp cushions, air gaps, and wire harness insulation; — Field service reports or databases related to the non-fault-tolerant condition being assessed; — Engineering tests to determine the durability of features, such as fatigue tests, thermal cycling tests, or corrosion tests; — Fleet experience may also be used to estimate the likelihood of failures. The determinations should be based on conservative assumptions; — Service experience records of manufacturing or maintenance escapes, if available; and — Manufacturing records for defects found. 4.2.5.6.2 It may be possible to demonstrate that a design feature or element will perform similarly to a previously certificated design or design feature under foreseeable lightning threats. If applicable, provide a comparative analysis of similar design features and details on a previously certified aeroplane. The comparative analysis would include a detailed assessment of the design features and details that affect susceptibility to failure, exposure time to lightning environment, service experience, and any applicable analyses and test data. 4.2.5.7 Figure 1, Item (2). Assess the probability of the failure condition occurring. If this failure is latent for a long time, or the failure could occur at many locations that are exposed to conducted lightning currents, the likelihood of that failure resulting in an ignition source could be significant. 4.2.5.8 Figure 1, Item (3). Evaluate the likelihood of lightning attaching in the vicinity of non‑fault‑tolerant features and resulting in a current of sufficient amplitude to cause an ignition source at those features. Appropriate factors to consider include: 1. The possibility of lightning attachment to locations on the surface of the aeroplane near the failed non-fault-tolerant features. 2. The lightning-related ignition source threshold current for each of the failed non-fault-tolerant features. This is the lightning current amplitude that would result in an ignition source at the failed non‑fault‑tolerant feature. 3. The amplitude of the lightning current that would be necessary to produce a conducted current that would exceed the ignition source threshold. 4.2.5.8.1 Failed features within fuel systems will usually tolerate some lightning current without producing an ignition source. Above this threshold, an ignition source can occur. The lightning current amplitude, charge transfer, and action integral that result in an ignition source can be determined by tests on parts and panels that incorporate the structural features in a defined fault condition. 4.2.5.9 Figure 1, Item (4). Consider any factors that may be used to ensure the integrity of the installations. A specified inspection interval can be proposed to detect the failure. Additional manufacturing controls may be implemented to minimise the occurrence of defects and escapes during production. 4.2.5.10 Figure 1, Item (5). The qualitative assessment should consider all the potential non‑fault‑tolerant features and determine whether the probability of a combination of the potential for ignition sources due to failures of these features is remote. Broken fasteners and structural cracks are two failures where the applicant may find it impractical to demonstrate fault-tolerant protection. The applicant is responsible for demonstrating that ignition sources created by the combination of a non-fault-tolerant failure, a flammable environment, and a lightning strike of sufficient amplitude to result in an ignition source will be extremely improbable. 4.3 Quantitative assessment of Non-fault-tolerant conditions 4.3.1 Quantitative assessment of non-fault-tolerant features can be used. The quantitative assessment must demonstrate that fuel vapour ignition due to lightning is extremely improbable, including the contribution of non-fault-tolerant features and elements. However, to do this, there must be a reasonable amount of reliable data for the rate of failures. 4.3.2 The following four conditions should be evaluated collectively: 1. The probability of the occurrence of a flammable condition within a fuel tank in the vicinity of an ignition source due to lightning. 2. The probability of the occurrence of a lightning strike of sufficient intensity to produce an ignition source at a failed non-fault-tolerant design feature. 3. The potential for the presence of a failure of a non-fault-tolerant protection feature within a fuel system. 4. The total number of non-fault-tolerant features. 4.3.3 The same factors for a qualitative assessment should be considered for the quantitative assessment approach. The additional step is to quantify each of these factors for use in the numerical assessment. A fault tree analysis (discussed in paragraph 2.9.3 of this AMC) may be used to determine whether the combined risk of the non-fault-tolerant conditions is unlikely to result in a catastrophic event over the life of the fleet. From a numerical perspective, a probability of the order of 10‑9 per flight hour or less is the accepted standard for demonstrating that the combined risk, including all failures, is extremely improbable. 4.4 Evaluating non-fault-tolerance for systems. Fuel, mechanical, hydraulic, and electrical components that penetrate, are located within, or are connected to the fuel tanks have typically been able to provide fault‑tolerant design capability. These components include the associated clamps, shields, supports, bonding straps, and connectors. It is therefore expected that applicants will develop fault-tolerant designs for these components. 5 ESTABLISH AIRWORTHINESS LIMITATIONS [CS-25, Appendix H, Section H25.4, Airworthiness Limitations Section](#_DxCrossRefBm1709821427), requires mandatory replacement times, inspection intervals, and related inspection and test procedures for the lightning protection features that are approved under [CS 25.954](#_DxCrossRefBm1709821378). Section [H25.4(a)(6)](#_DxCrossRefBm1709821427) requires CDCCLs, inspections and tests, and mandatory replacement times to be located in a section of the ICA titled ‘Airworthiness Limitations.’ 5.1 Critical design configuration control limitations 5.1.1 The applicant must establish CDCCLs to protect features that prevent lightning‑related ignition sources within their fuel systems. This requires the applicant to identify the lightning protection design features, as well as to prepare instructions on how to protect those features. Identification of a feature refers to listing the feature in the CDCCL. During aeroplane operations, modifications, and unrelated maintenance actions, these features can be unintentionally damaged or inappropriately repaired or altered. Instructions on protection are meant to address this safety concern. An example of a common design feature to prevent ignition sources caused by wiring is wire separation so that wires cannot chafe against one another or against structure or other components. An example of an instruction on how to protect this design feature would be ‘When performing maintenance or alterations in the vicinity of these wires, ensure that a minimum wire separation of 15.24 cm (6 inches) is maintained.’ 5.1.2 CDCCLs are essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the type design of the fuel tank system. The CDCCLs should include information regarding how to prevent compromising the critical design features, or to restore them when other maintenance or alterations are being performed. The CDCCLs should be established based on evaluating the design-specific critical features that are determined from the safety analysis and determining the anticipated maintenance, alteration, or repair errors that could compromise the feature. The following list of examples of CDCCLs is intended to provide examples of lightning protection features that have been identified in certain designs, and is not intended to be inclusive of all the features that should be considered for a particular design. It is likely that the safety analysis will identify the need for additional CDCCLs. 5.1.2.1 Fuel tank structural fasteners can be potential lightning ignition sources. Specific fastener design features such as the fastener material, coating, and countersink depth are typically needed to prevent lightning ignition sources at the fasteners. Installation processes such as fastener hole clearances, fastener pull-ups, and hole angularities can be critical. The orientation of the fastener head in the fuel tank structure can be critical. The criticality of fuel tank structural fasteners may be dependent on their location, particularly those located in direct lightning attachment zones. The CDCCLs should identify these critical fastener features and refer to the structural repair manual (SRM) for approved fastener lists and approved installation processes for these fasteners. 5.1.2.2 Fuel tube electrical isolation segments can be used to limit induced lightning currents on the fuel tubes, especially on aeroplanes with carbon‑fibre composite fuel tank structures. Maintenance, alterations, or repairs of the fuel tube system should maintain the lightning current limits provided by the fuel tube isolation segments. A limitation may specify that the fuel tube isolation segments are required for lightning protection, that replacements must also meet the electrical isolation requirements of the original design, and electrical bonding straps must not bridge the isolation segments. 5.1.2.3 Fuel tank access doors have the potential for lightning-related sparking inside the tank as a result of a direct lightning strike or a conducted lightning current. The doors may incorporate specific protection features such as electrically conductive gaskets, electrically insulating seals, and multiple fasteners. The limitation may specify that the presence and integrity of the gaskets, seals and fasteners should be verified when the access doors are installed. Electrical bonding measurements may be required to verify that the electrical resistance between the access door and adjacent structure is less than a specified value. 5.1.2.4 Sealant can provide caps over fasteners or fillet seals applied where structural parts are joined within the fuel tank. Poor sealant adhesion or sealant damage could degrade the protection against lightning ignition sources. The limitation may specify that the integrity of the sealant must be verified in the areas of the fuel system where maintenance or alterations take place. Cracked, peeling, or missing sealant could indicate that the integrity of the protection is compromised. 5.1.2.5 The minimum spacing between metal fuel tubes, hydraulic tubes, and conduits and adjacent structure may be specified to prevent lightning‑related arcing. In addition, electrically insulating bushings or grommets may be installed to prevent lightning-related arcing between fuel system components and structures. The limitation may specify that the presence and integrity of the bushings or grommets must be verified in the areas of the fuel system where maintenance or alterations take place, and that the minimum clearance between fuel tubes, hydraulic tubes, or conduits and adjacent structure or components must be verified in areas where maintenance or alterations take place. 5.1.2.6 Fittings for metal hydraulic tubes, nitrogen inerting tubes, and fuel tubes may be installed through the fuel tank walls. These fittings must conduct induced-lightning currents and prevent voltage or thermal sparks within the tank between the fittings and the fuel tank structure. The limitation may require verifying that the electrical bonding resistance does not exceed a specified value if the fittings are repaired, reinstalled, or altered, and that the integrity and electrical bonding resistance of any required bonding straps must be verified as well. 5.1.2.7 Self-bonding couplings that rely on physical contact between the coupling and fuel tubes may be used to provide electrical bonding. Anodised coatings applied to the fuel tubes could degrade the electrical bonding. The coatings used on the tubes and couplings could be identified as a CDCCL to maintain acceptable electrical bonding. 5.1.2.8 Fuel quantity sensing probes and in-tank wiring may require electrical isolation from the adjacent fuel tank structure to prevent lightning-related arcing between the probes, wiring, and structure. The isolation may be provided by electrically non-conductive probe clamps, or non‑conductive caps on the ends of the probes. The wiring protection may be provided by separation from the structure. The limitation may specify that the presence and integrity of the non-conducting clamps or end caps, and the wiring separation must be verified in the areas of the fuel system where maintenance or alterations take place. 5.1.3 CDCCLs are intended to identify only the critical features of a design that must be maintained. A CDCCL has no interval, but establishes configuration limitations to protect the critical design features identified in the CDCCL. CDCCLs can also include requirements to have placards installed on the aeroplane with information about critical features. For certain equipment, critical protection may be provided by components. These critical protection features must be identified as CDCCLs and should be listed in the component maintenance manual (CMM) to provide awareness to maintenance and repair facilities. 5.1.4 Certain CDCCLs apply to elements of fuel system components. As such, the maintenance of those critical features may be covered in a CMM. When Airworthiness Limitations need to call out aspects of CMMs, it is a best practice to limit the CDCCL-controlled content to only those maintenance tasks directly impacting a CDCCL feature, rather than requiring the complete CMM to be a CDCCL. 5.2 Mandatory replacement times, inspection intervals, and related inspection and test procedures 5.2.1 To comply with [CS 25.954(d)](#_DxCrossRefBm1709821378), mandatory replacement times, inspection intervals, and the related inspection and test procedures must be developed for the lightning protection features identified in paragraphs 2.3 and 2.6 of this AMC. Mandatory replacement times, inspection intervals, and the related inspection and test procedures must be included in the Airworthiness Limitations Section of the ICA. 5.2.2 To ensure lightning protection is retained over the service life of the aeroplane, references to these mandatory replacement times, inspection intervals, and the related inspection and test procedures are normally included in the maintenance manuals (e.g., the AMM, SRM, SWPM) and service bulletins that provide maintenance personnel with standard practices for continued airworthiness. 5.2.3 When developing maintenance and service inspection techniques, a review of similar aeroplane designs and their service histories should be conducted to focus on the areas where past experience has shown there is a potential for affecting lightning protection features. 5.2.4 When developing procedures to remove and reinstall fuel tank access panels, applicants should include instructions to maintain or restore the lightning protection features such as sealants, fastener assemblies (structural joints), nut plates, bonded parts, insulators, conductive parts, etc. 5.2.5 The applicant should validate the intended maintenance tasks performed in the fuel tank systems and confirm that they do indeed provide protection and avoidance of damage to the lightning protection features. The applicant should ensure that the proper parts and materials are specified in the maintenance tasks. 5.2.6 The lightning design specialist should participate in the determination of the maintenance program necessary for fuel tank lightning protection. 5.2.7 Lightning protection features that are not anticipated to degrade during the life of the aeroplane, and are identified as inherently reliable, do not require mandatory maintenance for compliance with [CS 25.954(d)](#_DxCrossRefBm1709821378), but should be identified to EASA. The integrity of conductive primary structures is an example of such features. A claim that lightning protection features are not anticipated to degrade during the life of the aeroplane when exposed to the effects of the environment, ageing, wear, corrosion, and likely damage must be substantiated and supported by data. 5.2.8 If a protection feature could degrade over the life of the aeroplane, it must be maintained using approved inspections and procedures consistent with the requirements of [CS 25.954(d)](#_DxCrossRefBm1709821378). Appendix A. Definitions The following definitions apply to the lightning protection of fuel tanks and systems of [CS 25.954](#_DxCrossRefBm1709821378) and the guidance in this AMC. A.1 ATTACHMENT POINT. A point where the lightning flash contacts the aeroplane. A.2 CONTINUED SAFE FLIGHT AND LANDING. The aeroplane can safely abort or continue a take-off, or continue controlled flight and landing, possibly using emergency procedures. The aeroplane must do this without requiring exceptional pilot skill or strength. Some aeroplane damage may occur because of the failure condition or on landing. The pilot must be able to land the aeroplane safely at a suitable airport. A.3 CRITICAL DESIGN CONFIGURATION CONTROL LIMITATIONS (CDCCLs). A limitation requirement to preserve a critical design feature of a fuel system that is necessary for the design to meet the performance standards of [CS 25.954](#_DxCrossRefBm1709821378) (and/or [CS 25.981](#_DxCrossRefBm1709821428)) throughout the life of the aeroplane model. The purpose of the CDCCL is to provide instructions to retain the critical features during configuration changes that may be caused by alterations, repairs, or maintenance actions. A.4 CRITICAL LIGHTNING STRIKE. As defined by [CS 25.954(a)(1)](#_DxCrossRefBm1709821378), a critical lightning strike is a lightning strike that attaches to the aeroplane in a location that, when combined with the failure of any design feature or structure, could create an ignition source. A.5 ESCAPES. Production or maintenance errors that can be anticipated to occur that could render the fault tolerance, or lightning protection ineffective. A.6 EXTREMELY IMPROBABLE FAILURE CONDITION. Refer to the definition provided in Section 7 of [AMC 25.1309](#_DxCrossRefBm1709821113) (qualitative and quantitative terms). A.7 FAULT-TOLERANT DESIGN. A design that precludes fuel systems ignition sources even when a fault is present. A.8 FUEL SYSTEMS. As defined by [CS 25.954(a)(2)](#_DxCrossRefBm1709821378) a fuel system includes any component within either the fuel tank structure or the fuel tank systems and any aeroplane structure or system components that penetrate, connect to, or are located within a fuel tank. A.9 FUEL TANK STRUCTURE. Includes structural members of the fuel tank such as aeroplane skins, access panels, joints, ribs, spars, stringers, and the associated fasteners, brackets, coatings and sealant. A.10 FUEL TANK SYSTEMS. Tubing, components, and wiring that penetrate, are located within, or connected to the fuel tanks. A.11 INTRINSICALLY SAFE. Fuel system design elements that provide effective lightning protection with no foreseeable failure modes that would render them ineffective. These design elements have no failures or combinations of failures that can result in an ignition source. This can be due to reliable design or to a very low lightning voltage or current in that specific location. A.12 LIGHTNING FLASH. The total lightning event. It may occur in a cloud, between clouds, or between a cloud and the ground. It can consist of one or more return strokes, plus intermediate or continuing currents. A.13 LIGHTNING STRIKE. Attachment of the lightning flash to the aeroplane. A.14 LIGHTNING STRIKE ZONES. Aeroplane surface areas and structures that are susceptible to lightning attachment, dwell times, and current conduction. A.15 LIGHTNING STROKE (RETURN STROKE). A lightning current surge that occurs when the lightning leader (the initial current charge) makes contact with the ground or another charge centre. A charge centre is an area of high potential of opposite charge. A.16 PRACTICALITY. A balance of the available means, economic viability, and proportional benefit to safety. A.17 RELIABLE DESIGN. A reliable design is a design that provides lightning protection features that are not anticipated to degrade during the life of the aeroplane. A.18 RELIABLE FAULT TOLERANCE. A fault-tolerant fuel system design is a design that precludes ignition sources in the fuel system even when a fault is present; ‘reliable’ means that the system has the ability to maintain the effectiveness of the protection features over the service life of the individual aeroplane. A.19 REMOTE. Refer to the definition provided in Section 7 of [AMC 25.1309](#_DxCrossRefBm1709821113) (qualitative and quantitative terms). A.20 SYSTEMS. Systems include fuel, mechanical, hydraulic, electrical, and electrical wiring interconnection system (EWIS) components that penetrate, are located within, or connected to the fuel tanks. Appendix B. Section 4 Examples B.1 EXAMPLES FOR PARAGRAPH 4.1.2.1 The design elements or features for which providing fault-tolerant prevention of lightning ignition sources should be practical include the: 1. Installation of rivets and bolts in aluminium structures that are well bonded through processes that ensure the fastener/hole fit, fastener and hole quality, and installation practices; 2. Installation of bolts in composite structures that are well bonded through processes that ensure control of the fastener/hole fit, fastener and hole quality, and installation practices and with additional design features to distribute current, such as foil or mesh at the material surface; and the 3. Installation of lightning protective sealant or cap seals over fastener heads/ends located inside fuel tanks, where necessary. B.2 EXAMPLES FOR PARAGRAPH 4.1.2.2 The design features or failures for which providing fault-tolerant prevention of lightning ignition sources could be impractical include: 1. Fatigue cracking within structural elements such as spars, skins, stringers, and ribs. Typically, material controls, manufacturing controls, established material allowables, design margins, and life‑cycle tests make the occurrence of significant cracking rare. 2. Failures of fasteners highly loaded in tension that lead to separation of the fasteners or parts of the fasteners from the hole, or gapping of the heads or nuts of the fasteners, and the consequent failure of a cap seal. Typically, manufacturing controls, design margins, and life-cycle tests make the occurrence of broken bolts rare. 3. The installation of double cap seals or structurally reinforced cap seals to retain a bolt that fails under tension, resulting in a cascading failure of the cap seals. 4. Damage that may go undetected by scheduled or directed field inspection, and manufacturing defects in composite structures. B.3 EXAMPLES FOR PARAGRAPH 4.1.2.3 Some examples of practical design, manufacturing, and maintenance processes are listed below. Although these practices themselves are not considered to be independent features for providing fault tolerance, they are measures to minimise the likelihood of failures, or measures necessary to support the assumptions about failure modes or rates in a safety analysis. 1. A structured design review process (as described in this AMC) to ensure that all the relevant design features are reviewed to identify the critical design areas, critical processes, and associated testing and analysis requirements. 2. Engineering review of the proposed design to identify the failure modes that may occur because of manufacturing errors or escapes, maintenance errors, repairs or alterations, ageing, wear, corrosion, or likely damage. 3. Engineering review of manufacturing processes to identify the failure modes that may occur because of manufacturing errors or escapes. 4. Engineering review of service history records to identify the failure modes that may occur because of production escapes, maintenance errors, repairs or alterations, ageing, wear, corrosion, or likely damage. 5. Implementation of practical manufacturing and quality control processes to address the issues identified through the required engineering reviews. 6. For non-fault-tolerant locations, quality control processes that require inspections of critical features by a person other than the person that performed the manufacturing work. 7. Provisions in the ICA to identify cautions in maintenance documents regarding lightning protection features, as well as life limits or repetitive inspections for non-fault-tolerant features. For any penetration into the fuel tank, or any structural damage within the fuel tank, the SRM should specify the repair methods that maintain the lightning protection features. 8. Mandatory maintenance actions necessary to ensure compliance is maintained with the lightning protection requirements should be included in the Airworthiness Limitations Section of the ICA as required by [Section H25.4 of Appendix H to CS-25](#_DxCrossRefBm1709821427). B.4 EXAMPLE FOR PARAGRAPH 4.2.5.3 The following is an example of an assessment process addressing the potential for non‑fault‑tolerant fuel tank structural cracking. To assess the risk due to non-fault tolerance for structural cracks, the following should be accomplished: B.4.1 Determine whether the structure in this zone is susceptible to fatigue cracking. If it is susceptible to fatigue cracking, determine the minimum size of crack that could be a source for arcing. This crack length should then be compared with the inspection methods used for compliance with [CS 25.571](#_DxCrossRefBm1709820942) (Damage Tolerance), to determine the ability to detect and/or the probability of detecting a crack of this size. B.4.2 If the Airworthiness Limitations required for compliance with [CS 25.571](#_DxCrossRefBm1709820942) are already sufficient to ensure that the probability is remote (unlikely to occur on each aeroplane — see [AMC 25.1309](#_DxCrossRefBm1709821113)) that a crack will grow to a sufficient size and gap in excess of that necessary to cause sparking during a lightning event, then no lightning-related Airworthiness Limitations are required. The probability of this remote condition occurring, together with the remote probability of a critical lightning strike, make these combinations not foreseeable. B.4.3 As part of the damage-tolerance evaluation, an analysis should be performed to determine the duration of time (in flight cycles) it will take for a crack of minimum arcing size to grow to the minimum detectable length. This crack propagation rate should then be used along with the probability of detection for the specified inspection method to determine the exposure time. That exposure time is the number of flight cycles an aeroplane may be exposed to before an ignition source due to a structural failure (crack, failed fastener, etc.) occurs. B.4.4 If the Airworthiness Limitations necessary to support compliance with [CS 25.571](#_DxCrossRefBm1709820942) cannot ensure that the likelihood of a crack in excess of the size that would cause sparking is remote, and the crack would not be readily detectable within a few flights due to fuel leaks, then this condition must be included in the risk assessment of non-fault-tolerant conditions. Further, any practical maintenance inspection should be made to minimise the exposure time. A low probability combined with a short exposure time may be necessary to demonstrate that a catastrophic ignition is extremely improbable, i.e., it is not anticipated to occur during the entire operational life of all the aeroplanes of one type. [Amdt 25/26]