FUEL TANK SAFETY / EWIS CONTINUATION TRAINING

Transcription

1 FUEL TANK SAFETY / EWIS CONTINUATION TRAINING Q1 & Page 1 of 14

2 CONTENTS: 1 SFAR INTRODUCTION 2 Ground Fault Interrupters & Universal Fault Interrupters 3 EWIS Introduction 4 Related Airworthiness Directives 5 Arcing in aircraft electrical systems Page 2 of 14

3 1. SFAR-88 The acronym stands for Special Federal Aviation Regulation 88. It deals with fuel system safety, to include aircraft wire maintenance, aircraft wire and electrical components (pumps, fuel quantity indicators, etc.), not only inside the tanks, but circuitry and items located outside the tank, including adjacent dry bays. By December 2004, operators must include Federal Aviation Administration (FAA)-approved provisions in their inspection and maintenance programs to assure the safety of their aircraft fuel systems. SFAR 88 requirements for continued airworthiness of fuel systems may be the single biggest maintenance change in many years, and for years to come. Airplanes & Organisations affected All turbine-powered aircraft with a capacity of 30 or more passengers or a payload capacity of 7,500 pounds or more. SFAR 88 affects manufacturers (the type certificate, or TC, holders), those companies holding supplemental type certificates (STCs) involving modifications and installations affecting fuel systems (mostly manufacturers), operators, repair stations and FAA inspectors. The number of STCs affected by SFAR 88 is more than 120. The genesis: SFAR 88 results from a tragedy, the fatal July 1996 explosion of the centre wing tank (CWT) of a TWA B747. In its investigation of the TWA Flight 800 tragedy, the National Transportation Safety Board (NTSB) ultimately determined that a short circuit caused flammable vapours in the tank to ignite. Since the TWA tragedy, improved fuel system safety has been on the NTSB s Most Wanted list of aviation safety improvements. The March 2001 CWT explosion of a Thai Airways International B737 on the tarmac at Bangkok added impetus to the effort. SFAR 88 was issued for industry comment just two months after the Bangkok accident. The package: SFAR 88 requires a massive fuel system safety review and analysis, with three outputs: (1) Regulatory changes to ensure that ignition sources in fuel systems are prevented by design, (2) Changes to existing fuel systems to eliminate potential ignition sources identified by the safety analysis, (3) Maintenance and inspection changes to ensure continued airworthiness of fuel systems. Page 3 of 14

4 A selective listing of what was changed: Fuel pumps: Ground fault interrupters (GFI) for all tanks, replacing existing pump power relays. GFIs and automatic shutoff at low fuel levels may be required. Fuel quantity indication systems (FQIS): Since 115 volt AC current could potentially short to FQIS signal wiring, barrier device protection may be required for all CWTs. Lightning protection: Improved bonding of fasteners, clamps and pipes attached to (or in) the tank structure will be necessary. FAULT CURRENT PROTECTION: K type fasteners are deemed an unreliable bond and in-tank bonding jumpers may have to be installed in some aircraft. Wire harnesses over the CWT: Insufficient clearance on some aircraft, such that wires could touch the tank surface. Engineering changes have been developed. The concept: SFAR 88 effort involves a new term, critical design configuration and control limitations, or CDCCL. TC and STC holders define CDCCLs. Under this concept, all fuel pumps become critical items, as are fuel pump wiring and fuel pump circuit protection devices. These critical items (CDCCLs) can be subject to mandatory inspection and maintenance tasks. CDCCLs involve design aspects such as wire separation, explosion proof features of a fuel pump, maintenance intervals for transient suppression devices, fuel quantity indication system (FQIS) wiring, minimum bonding jumper resistance levels, and so forth. Any maintenance actions or subsequent changes to the design must not degrade the safety level of the original design over the operational life of the airplane. STC wiring installed adjacent to original design wiring may well be categorized as safety critical under the CDCCL aegis. Page 4 of 14

5 2. Ground Fault Interrupters (GFI) Every day, the wiring harnesses within an aircraft are subject to wear and tear. This occurs from swaying during flight or changes in the harness s chemical makeup due to aging. Over time, ground faults can occur as electrical current escapes these harnesses and seeks easier paths. A humble ground fault inside a fuel tank can become a catastrophic event in a commercial aircraft. The ground fault isolation unit employs a fundamentally simple and proven technique to detect and isolate electrical faults in fuel tanks. The detection technology compares the total electrical current flowing to the load, or device consuming electrical power, with the current returning from the load. A difference between these two values indicates that the current is returning to the source through an unexpected path, such as a ground fault. Should this happen, the ground fault isolation component automatically and rapidly trips its relay, protecting the aircraft s electrical and wiring system from significant damage. When it comes to ground faults and fuel tanks, two vulnerable areas need to be protected from electrical mishaps. The first is the fuel pump s circuitry. The second is the wiring upstream from the pump. Page 5 of 14

6 UFI: Universal Fault Interrupters are fitted to the B SF & PF fleet, and are designed to protect centre tank fuel override pumps from: 1. Electrical faults (line-to-ground, line-to-line, open phases, out-of-range conditions) 2. Extended operation with uncovered inlet 3. Un-commanded operation (via control of redundant control relays) The UFI installation consists of two in-line conductive path monitoring assemblies designed to protect the B /300 centre tank fuel override pump system from dangerous electrical faults and extended pump dry-operation conditions. Control of redundant relays also allows the UFI assembly to prevent un-commanded operation of the override pump, which can result from failure of a single control relay in the closed position. The device monitors current and voltage from the AC power supply to detect anomalies in the system wiring or the override pump motor. Each UFI installation includes a Relay Adapter Module, RAM. The RAM provides DC power to its associated UFI device and also permits the UFI to control the PCR, which utilizes an 115VAC coil. As part of the installation, one UFI / RAM assembly is installed near each pump control relay (PCR). Page 6 of 14

7 Operation The UFI monitors voltage and current in each phase of the AC power to detect electrical faults and diagnose the operational status of the fuel override pump system. Upon activation of the override pump switch, the RAM converts the 115V AC control signal to 28 VDC and supplies it to the UFI. The UFI completes a comprehensive power-on self-test (POST) to verify internal integrity. It then sequentially closes both the input and control relays, while verifying the proper operation of each in both the open and closed state. Improper operation of either relay will cause the UFI to unlatch both relays and declare a terminal stop condition (TSC). Non-volatile memory records average historical pump operating parameters as well as instantaneous fault data to assist in both troubleshooting and preventative maintenance. The data port on the rear of the UFI is used to communicate with the device to download stored information to a personal computer. LED indicators on the UFI illuminate to indicate unit status and also fault information, including detected fault type and the phase(s) in which the fault was detected. A reset switch is located on the face of UFI near the LED indicators. Depressing the reset switch is the only way to return the boost pump circuit to operational status from a terminal stop condition. A terminal stop condition (TSC) exists when the UFI device detects a qualified electrical fault, terminal internal system error or failure of either the input or control relay. The UFI removes power from both of the relay coils, generates a log entry and illuminates the LED indicators as appropriate. The corresponding override pump will remain off-line and the UFI will not respond to the pump power switch or cycling of aircraft power. Power can only be restored to the fuel override pump after the reset switch located on the UFI is physically activated by maintenance personnel. Uncovered Pump Inlet Protection The UFI is programmed to recognize the electrical signature that the override pump generates when the pump inlet comes uncovered. This feature is designed to assist the crew in preventing the fuel pumps from operating for extended periods of time while the pump inlet is uncovered. It is intended as a backup to the crew response to Low Pressure indication, which is to remove power to the corresponding pump via the pump power switch. If the electronic signature indicating an uncovered inlet persists uninterrupted for fifteen (15) seconds, a non-terminal stop condition (NSC) is generated. This condition can be cleared from the flight deck by cycling the respective pump power switch, thereby ensuring that all usable fuel remains available to the flight crew. If power is cycled but the pump is unable to prime within the fifteen (15) second delay period, an NSC is generated again. The UFI does not limit the allowable number of consecutive non-terminal stop conditions. Please reference B757 Manual Supplement AMM TDG Universal Fault Interrupter. Page 7 of 14

8 3. EWIS Electrical Wiring Interconnect System Simply described EWIS is the term used for the basic maintenance requirements of aircraft wiring and electrical systems, with respect to the maintenance and associated working practices, general care, inspection standards, safety, housekeeping and repair of all electrical items (including wiring) on an aircraft The actual term EWIS has been derived from documentation issued by EASA in order to address aircraft general Wiring Standards. EWIS covers the Maintenance of A/C wiring and electrical components Its Associated practices for wiring maintenance General care of wiring on and around A/C Maintenance Inspection standards General wiring safety General A/C and wiring housekeeping Repair Techniques General Wiring Standards Aircraft Improvements to reduce known problems Page 8 of 14

9 4. Related Airworthiness Directives EASA AD US Airworthiness Directives can be viewed at ATA 28 Manufacturer(s): Applicability: Installing Teflon sleeving under the clamps of certain wire bundles routed along the fuel tank boundary structure, and cap sealing certain penetrating fasteners of the main and centre fuel tanks. Boeing Boeing Company Model , -200LR, -300, and -300ER series airplanes Reason: This AD requires certain inspections for certain airplanes, corrective actions if necessary, and installation of Teflon sleeves under certain wire bundle clamps. This AD was prompted by a report indicating that additional airplanes are affected by the identified unsafe condition The NPRM proposed to continue to require installing Teflon sleeving under the clamps of certain wire bundles routed along the fuel tank boundary structure, and cap sealing certain penetrating fasteners of the main and centre fuel tanks. Page 9 of 14

10 EASA AD US Airworthiness Directives can be viewed at ATA 28 Manufacturer(s): Applicability: Reason: Fuel tank access door bonding Boeing We are adopting a new airworthiness directive (AD) for all The Boeing Company Model , -400, and -500 series airplane. This AD was prompted by a manufacturer's review that showed that the fuel tank access door at a certain wing buttock line did not have an engineered ground path with the mating wing structure. This AD requires replacing the fuel tank access door, doing a check of the electrical bond, doing related investigative and corrective actions if necessary, and revising the maintenance or inspection program by incorporating an airworthiness limitation (AWL). Page 10 of 14

11 5. Arcing in Aircraft Electrical Systems Arcs or electrical ignition are typically caused by loose connections, broken or shorted wires in a power distribution system. In aircraft wiring, vibration, moisture, temperature extremes, improper maintenance and repair all contribute to wiring failure. This occasionally leads to arcing and may ignite combustible materials. Page 11 of 14

12 Precondition to Arcing ALT Fuel Tank Safety / EWIS Continuation Training. For arcing to occur, it is necessary that some portion of the circuit wiring be exposed. This article will focus on wiring and not failure at connection points. There are a number of mechanisms that can create the preconditions for an arcing event to occur: Age related degradation of the wire insulation Degraded/aged wire insulation may result in radial cracks to the conductor. Overheated Circuit Overheated circuits (or wire bundles) can melt the insulation and expose the conductor. Fluid Exposure Some wire insulations degrade very quickly when exposed to certain fluids. Error in manufacturing The finished wire product may have breaches in the insulation. Damage during installation or maintenance Working with wiring harnesses can result in damage to the insulation Abrasion A bundle that is not properly secured can sway and rub against structures or components. There are other mechanisms that lead to wire insulation damage, but they are typically subsets of the mechanisms listed above. The Arc Begins Once the power wire has been damaged to a point where the conductor is exposed and there is a low resistance path to a different potential, arcing can begin. This different potential can be a grounded object (such as a component, structure, or a ground wire) or another power wire on a different phase. Page 12 of 14

13 Electrical Arcing Once the arcing starts, the destruction of insulation and conductor immediately begins. These materials are often released into the immediate atmosphere and become part of the arc plume. The arc plume is a hot ionized gas that provides a low resistance path for the electrical arcing. Furthermore, this plume expands out from the arcing event and can damage nearby objects. Electrical Arc Parameters There are only a few parameters that directly affect the electrical arc and its progression. These include: Distance from the power source This affects the fault current and energy available for arcing. Wire type Some insulations have a propensity to limit the arc damage, but none can fully eliminate the damage from an arcing event. Circuit protection Depending on the type and rating, the circuit protection determines the arc duration. Number of power/ground wires in bundle The initial arcing event can result in damage to other wires in the bundle and bring those wires into the arcing event. Arc Termination Conditions After the arc starts, there are only a few mechanisms that can halt the arcing event. The first one is the activation (tripping) of the circuit breaker. Depending on the type of the circuit breaker and the fault current, this might trip quickly or take several seconds before it opens. The other mechanism for ending an active arcing event is increasing the separation between the two conductors (or conductor and ground). The separation distance necessary to halt an arcing event is dependent on the voltage and the duration of arcing event. Page 13 of 14

14 Parameters Affecting Damage ALT Fuel Tank Safety / EWIS Continuation Training. Aside from the arcing event, it is necessary to consider the parameters that affect the damage level. These include: Target materials The structure or component material can impact the duration of the arc as well as the extent of the damage. Tube pressurization Different pressure levels can impact heat transfer and subsequent damage to pressurized tubes. Contamination Dirt, debris, and fluids can impact how much damage is done. These can either ignite and cause additional damage or limit the impact. Separation distance and segregation materials The physical separation distance impacts how much energy or direct arcing can impact the object. Furthermore, segregation materials (such as wire harnesses sleeves) also impact the damage level. Possible Effects of Arcing While this is the last part of the electrical arcing event, it is probably the most important one to consider. After all, if the wire arcs and has no negative impact on a system, it does not matter. But more often than not, an arcing wire will cause physical and/or functional damage. A functional damage can lead to un-commanded activation of devices or systems by transferring energy to other circuits or can result in loss of system functionality. A physical damage can mean damage to structure, to other wires in a bundle, or even damage and breach of hydraulic/fuel lines. The level of severity varies depending on the type of damage and can only be assessed through a full risk assessment of the wiring system. This risk assessment must combine the consequence of failure with the probability of failure Page 14 of 14