AMC 25.1441(b) Risk assessment related to oxygen fire hazards in gaseous oxygen systems

ED Decision 2018/005/R

1.       Purpose

This AMC provides guidance material and acceptable means of compliance for demonstrating compliance with CS 25.1441(b), which requires an oxygen system to be free from hazards in itself, in its method of operation, and in its effect upon other components.

This AMC applies to centralised, decentralised or portable oxygen systems. Those systems may be installed in an occupied compartment or in a remote inaccessible area.

2.       Related certification specifications

CS 25.869(c) Fire protection: systems — Oxygen equipment and lines

CS 25.1301 Function and installation

CS 25.1309 Equipment, systems and installations

CS 25.1441(b) Oxygen equipment and supply

CS 25.1453 Protection of oxygen equipment from rupture

3.       Installation

CS 25.869(c) specifies that oxygen system equipment and lines must:

(1)      not be located in any designated fire zone;

(2)      be protected from heat that may be generated in, or may escape from, any designated fire zone; and

(3)     be installed so that escaping oxygen cannot cause the ignition of grease, fluid, or vapour accumulations that are present in normal operation or as a result of a failure or malfunction of any system.

In addition, the following analysis and precautions should be considered.

3.1.    External ignition sources

An analysis should be performed to identify all possible external ignition sources and their mechanisms. If an ignition source exists in the vicinity of the oxygen system installation, it should be demonstrated that in normal operation or in conditions that result from a failure or malfunction of any system, the risk of ignition is minimised and that all design precautions have been taken to minimise this risk.

3.2.    Contamination

The compartments in which oxygen system components are installed should provide adequate protection against potential contamination by liquids, lubricants (grease, etc.), dust, etc.

3.3.    Ventilation

The compartments in which oxygen system components are installed should be ventilated in such a way that, if a leak occurred or oxygen was discharged directly into the compartment (not overboard) from any protective device or pressure-limiting device, the likelihood of ignition of the oxygen-enriched environment would be minimised. The applicant should substantiate that the ventilation rate of the compartment is adequate. Analytically determined ventilation rates should be validated by flight test results or their equivalent.

CS 25.1453(f) provides additional specifications related to ventilation.

This paragraph does not apply to portable oxygen systems, such as systems used to provide first-aid oxygen to passengers or supplemental oxygen for cabin crew mobility, usually stowed in overhead bins, provided that it is confirmed that the shut-off means mounted on the oxygen container is always closed when the system is stowed and not used.

3.4.    Routing

The installation of the system should be such that components and pipelines are:

—         adequately separated from electrical and fluid systems;

—         routed so as to minimise joints and sharp bends;

—         clear of moving controls and other mechanisms.

CS 25.1453(b) provides additional specifications related to oxygen pressure sources and the installation of tubing.

4.       Oxygen hazards analysis (OHA)

The applicant should demonstrate that the oxygen systems and their components are designed so that the occurrence of an uncontrolled oxygen fire at the aircraft level is extremely improbable and does not result from a single failure.

To assess the consequences of system/component failures, the applicant should conduct an oxygen hazards analysis (OHA) in either a qualitative or a quantitative manner, and include the conclusions of the OHA in the oxygen systems system safety analysis (SSA).

The applicant should provide an OHA with a detailed assessment of the potential ignition and combustion mechanisms. In the OHA, the applicant should do the following:

4.1.    Equipment failures

The applicant should use a detailed failure modes and effects analysis (FMEA) at the component level as the input for the OHA. The OHA should not include quality/production issues or human errors during assembly in.

The applicant should take into account all single failures, and any failure combinations that are not shown to be extremely improbable.

4.2.    Operating conditions

The applicant should consider the worst-case operating conditions, including any failures determined from paragraph 4.1 that are not shown to be extremely improbable.

4.3.    Components and materials

The analysis should cover all component designations and the materials of construction, including compounds and non-metallic material.

Most materials ignite at lower temperatures in an oxygen-enriched environment than in air. The applicant should therefore establish the auto ignition temperature assuming a 100 % oxygen-enriched environment, and evaluate the materials used to determine whether they are flammable under the conditions specified in paragraph 4.2.

4.4.    Ignition mechanisms

The assessment should address the identification of the possible internal ignition mechanisms. As a minimum, the following mechanisms should be assessed:

—         adiabatic compression (pneumatic impact) (see Note 1 below)

—         frictional heating

—         mechanical impact

—         particle impact

—         fresh metal exposure

—         static discharge

—         electric arc

—         chemical reaction

—         resonance.

The applicant should evaluate each ignition mechanism under the conditions specified in paragraph 4.2 to determine whether it exists in the component and in the system considered.

Note 1: in calculating the temperature elevation due to oxygen compression, the applicant should use the transient peak pressures measured under paragraph 5.2, unless other values are duly demonstrated.

4.5.    Kindling chain

The applicant should evaluate the ability of a fire to propagate and burn through a component, i.e. the kindling chain. The ignition and burning of a single component may produce sufficient heat to ignite the surrounding materials, leading to a burn-through of the component.

Therefore, if any of the ignition mechanisms assessed under paragraph 4.4 exists, the applicant should conduct an analysis to assess the kindling chain, based on the ability of the materials of construction to contain a fire.

5.       Design considerations

5.1.    High-pressure shut-off

As required by CS 25.1453(c), the applicant must keep to a minimum the parts of the system that are subjected to high-pressure oxygen, and must locate those parts so they are remote from occupied compartments to the extent that is practicable.

High-pressure shut-off valves should be designed to open and close slowly enough so as to avoid the possible risk of fire or explosion.

5.2.    Pressure-limiting devices (e.g. relief valves)

As required by CS 25.1453(e), the applicant must design the pressure-limiting devices (e.g. relief valves), which protect parts of the system from excessive pressure, so that in the event of a malfunction of the normal pressure-controlling means (e.g. a pressure reducing valve), they prevent the pressure from exceeding the applicable maximum working pressure multiplied by 1.33.

In addition, the performance of pressure-limiting devices should be tested on a complete system under the conditions specified in paragraph 4.2, but limited to failures that are not shown to be extremely improbable.

For testing purposes, oxygen can be replaced by an inert gas (e.g. nitrogen). However, the relationship between the pressure and the temperature would not be simulated by the inert gas and should be analysed separately. The transient pressure level (TPL) should be measured at various locations, and each component of the oxygen system exposed to the TPL should be demonstrated to sustain the pressure level.

The analysis detailed in paragraph 4.1 may identify single failures that affect the pressure regulation device. These failures could include poppet/shaft/diaphragm blockages or ruptures, seal leakages, etc. of a pressure reducer. If the applicant excludes any of these single failures from the TPL assessment due to

—         design considerations, such as a safety factor on the yield strength, the size of damage, etc. or

—         a low estimated probability of the failure occurring,

they should provide a detailed rationale for this in the certification documents and agree it with EASA.

CS 25.1453(d) provides additional specifications related to the protection of oxygen pressure sources (e.g. tanks or cylinders) against overpressure.

5.3.    Isolation

When the system includes multiple bottles as oxygen sources, each source should be protected from reverse flow or reverse pressure if a failure occurs on one source. Such isolation can be achieved by installing check valves or an equivalent means in an appropriate manner.

5.4.    Non-metallic hoses

Except for flexible lines from oxygen outlets to the dispensing units, or where shown to be otherwise suitable for the installation, non-metallic hoses should not be used for any oxygen line that is normally pressurised during flight.

If non-metallic hoses with anti-collapse springs are used due to installation constraints, it should be ensured that inadvertent electrical current cannot reach the spring, as this could cause the hose to melt or burn, leading to an oxygen-fed fire. As an example, correctly grounded metallic braid may be considered to prevent inadvertent electrical current from reaching the spring.

In addition, non-metallic oxygen distribution lines should not be routed where they may be subjected to elevated temperatures, electric arcing, or released flammable fluids that might result from normal operation, or from a failure or malfunction of any system.

5.5.    Grounding

All the oxygen lines and hoses should be grounded as appropriate.

5.6.    Joints

Joints should, as far as possible, be assembled dry. However, where compounds are used for sealing, they should be approved for that purpose.

5.7.    Recharging systems

Recharging systems, if installed, should be provided with means to prevent excessive rates of charging, which could result in dangerously high temperatures within the system. The recharging system should also provide protection from contamination.

Where in situ recharging facilities are provided, the compartments in which they are located should be accessible from outside the aircraft and be as remote as possible from other service points and equipment. Placards should be provided, located adjacent to the servicing point, with adequate instructions covering the precautions to be observed when the system is being charged.

[Amdt 25/21]