III
PRESENTED PAPERS AIRCRAFT FUEL SYSTEM REQUIREMENTS



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings III PRESENTED PAPERS AIRCRAFT FUEL SYSTEM REQUIREMENTS

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings This page in the original is blank.

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings 9 Engine Fuel System Design Issues Matthias Eder United Technologies Pratt & Whitney ABSTRACT In order to optimize the development of improved fire safe aviation fuels, it is necessary to understand how fuel is used in the engine prior to the combustion process. This paper discusses the utilization of fuel as a hydraulic fluid, a coolant, and a component lubricant in the aircraft engine prior to combustion. General fuel system design guidelines are provided to facilitate an understanding of fuel system architecture, system design requirements, and the flammability-related testing of fuel system components. Further discussions provide an insight into the type of components and materials used and the fuel properties considered in fuel system designs to ensure safe and reliable engine performance. INTRODUCTION In the development of more fire-safe aviation fuels, consideration must be given to the entire engine fuel system to ensure that changes are not detrimental. Safe and reliable engine fuel system operation has been obtained through rigorous design and verification test processes that depend to a large extent on current fuel properties, which are both specified and inherent. The noncombustion utilization of fuel depends on these fuel properties for reliable and safe engine operation. Fuel may be used as a hydraulic ("fueldraulic") fluid, a coolant, and a lubricant. Fuel has traditionally been used for fuel valve actuation, inlet variable geometry actuation, and start bleed and cooling valve actuation. Recent military engine designs that employ thrust vectoring exhaust nozzles have expanded the use of fueldraulics to high power (100 H.P., 3500 psi) exhaust nozzle actuation. In addition, fuel from the airframe tanks has been used as a coolant for engine-mounted electronic controls and diagnostics to enhance the reliability of these controls. Fuel has also been used as a coolant on airframe subsystems and oil systems and actuation components in high temperature environments. Although fuel is generally regarded as a less than optimum lubricant, fuel lubrication plays an important role in the design and performance of fuel pumps, fuel controls, and fuel powered actuators. Wear and sliding friction can adversely affect the life and performance of these components. ENGINE FUEL SYSTEM A typical military engine fuel system is illustrated in Figure 9-1. This engine is a typical high-performance after-burning engine with a modulating exhaust nozzle with a digital electronic engine control. It is an operational engine used on modern military aircraft. Low pressure aircraft boost pumps provide dedicated fuel coolant to the electronic engine control with a return path to the aircraft tank. The fuel in the aircraft tank is the lowest temperature fuel available on the aircraft and is, therefore, used for cooling electronics. The fuel for combustion is first used to cool aircraft subsystems, such as the environmental, hydraulic, and electrical subsystems. At the engine inlet, fuel is at approximately 40 psi pressure and 200°F temperature. In newer engines, the temperature at the engine inlet can be as high as 250°F. At the engine inlet the fuel pressure is raised by a centrifugal pump to provide sufficient charging pressure for the main fuel pump, a gear pump, and the augmentor pump, which is a high speed centrifugal pump. The lubricating qualities of the fuel are an important factor in pump durability. The main fuel pump provides fuel for combustion as well as for fueldraulic actuation. The fuel for gas generator combustion is used to cool the engine lubricating oil prior to entering the gas generator combustor. The augmentor pump provides fuel for the augmentor combustor only. Fueldraulic actuation is used to control start bleeds, fan variable guide vanes, compressor variable guide vanes, and control of the exhaust nozzle. The power to drive the exhaust nozzle is provided by a pneumatic motor and ball screw actuators. More recent engines with thrust vectoring exhaust nozzles use fuel at up to 3500 psi pressure to power actuators that control the exhaust nozzle area and the direction of thrust. Fuel is also used to power and control the fuel metering function in the main fuel control and in the augmentor fuel control.

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings FIGURE 9-1 Fuel system design for military aircraft: schematic drawing of the engine hydromechanical control system. A typical modern commercial engine fuel system, the PW 4084, is depicted in Figure 9-2. The major difference between military and commercial fuel systems is that there is no afterburner on a commercial engine and, therefore, no fuel system features for controlling this function. The use of fuel as a coolant is limited to cooling engine oil. Electronics are not cooled because the environment is more benign. Fueldraulics is utilized for compressor variable geometry actuation, bleed air valve actuation, and turbine cooling valve actuation. DESIGN CONSIDERATIONS RELATED TO FLAMMABILITY Most fuel systems contain numerous fuel-to-air seals, most of which are elastomeric. Static seals are required to exhibit no external leaks over all operation conditions. Dynamic seals, such as seals on sliding actuator shafts or rotating shafts, incorporate a drain line to an overboard drain for any external leaks. In most cases, dynamic seals on sliding shafts incorporate dual shaft seals for increased reliability. Whenever possible, a minimum level of fuel flow in fuel lines and components is preferred in order to provide cooling and prevent fuel deposit formation due to high ambient temperatures. In areas where fuel flow is adjacent to extreme high temperature structures, the hot surface ignition characteristics (HSIC), rather than the minimum ignition or autoignition temperature of the fuel, is used to evaluate the potential fire hazard. The HSIC is a more realistic predictor of fire due to fuel leakage. Externally mounted fuel system lines and components are positioned so that the lowest HSIC temperature is not exceeded. Components and component assemblies are electrically bonded to the engine case to provide lightning protection and to prevent a build up of static electricity. The engine case, in turn, is bonded to the airframe. Because most fuel system components are structural pressure vessels that contain fuel at elevated temperatures and pressures, the structural strength margins of all components are designed for overpressure, low cycle fatigue life, and high cycle fatigue life. QUALIFICATION TESTING RELATED TO FLAMMABILITY In accordance with AS1055B, fuel-carrying components and lines are required to be fire resistant for five minutes when exposed to a 2000°F flame at the most adverse operating conditions. This ensures that no component will contribute to

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings FIGURE 9-2 Fuel system design for commercial aircraft: schematic drawing of PW 4084 fuel distribution system. an external fire. All electrical-current-carrying components are required to be explosion proof (per MIL-STD-810 method 511.3) to ensure that the electrical operation of the component will not ignite a combustible atmosphere surrounding the component. Checks are performed to verify electrical bonding between component assemblies and the engine case and between the engine case and the airframe. The integrity margin of structural pressure vessels is verified by proof pressure testing to 1.5 times maximum operating pressure without yielding and burst pressure testing to 2.0 times maximum operating pressure without rupture. Additional structural verification testing includes low and high cycle fatigue life tests and pressure impulse testing. FUEL SYSTEM MATERIALS Potential fuel additives or modifications to improve fuel fire safety must be compatible with the materials used in fuel systems. The following is an overview of the materials used in the listed components. Most fuel pumps are of the centrifugal, gear, and vane design (in some cases, piston pumps are used). Housings are generally made of high grade aluminum castings, such as C355, forgings, or wrought stock, such as 2219. The pumping elements are made of high strength tool steel or stainless hardenable steel; some vane pumps and piston pumps utilize tungsten carbide on wear surfaces to minimize wear. Fuel controls perform a variety of functions, from simple fuel flow metering to complex fuel flow staging and sequencing and a host of other engine controlling functions. Fuel control housings are generally made of high grade aluminum castings, such as AMS 4225 or A201, with a recent trend toward forgings or wrought stock housings made of 2219 or similar aluminum alloys. A common coating for these aluminum alloys is anodize of different thicknesses to prevent corrosion or to provide a suitable wear surface. Internal valves are mostly made of high grade stainless steel, grade 440C, or similar alloys. Many of these fuel controls contain electromechanical interface devices, such as solenoids, stepper motors, switches, electrohydraulic servovalves, and position feedback devices, such as resolvers or linear variable differential transformers. These electrical devices contain magnet wire and magnet wire insulation and various potting compounds. In many cases, these devices are immersed and operate in fuel. Fueldraulic actuator housings range from aluminum to steel to titanium with exotic coatings. Actuators also contain the same type of electromechanical interface devices as fuel controls. Small actuators are used to position and control hot air valves used to de-ice the engine inlet and to cool the turbine. Other materials used extensively are elastomeric seals and plastic seal backups. The most widely used elastomeric seal

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings materials are nitrile, fluorosilicone, and fluorocarbon in the form of O ring seals or gaskets. FUEL CHARACTERISTICS One of the most important characteristics of aviation fuel is the ability to act as a coolant for other systems and to burn the absorbed heat in the combustion process. The ability of the fuel to perform this function is governed by the specific heat of the fuel and the maximum temperature to which the fuel can be raised without incurring detrimental side effects. For JP-8 fuel, thermal stability limits the maximum temperature over long periods to 300°F and short time exposure to 325°F. Exceeding these limits greatly accelerates the thermal breakdown of the fuel and causes deposit formation in fuel system components, which can cause fuel nozzle/injector fouling and other anomalies in fuel system components. Fuel nozzles and electrohydraulic servovalves are valve assemblies that contain matched sets of valves and sleeves with diametrical clearances on the order of 0.0002 inch. A significant deposit in these tight clearances increases friction and degrades performance of the valve. There is a considerable effort under way to qualify and introduce a higher temperature fuel, JP-8+100, that would raise the maximum long time bulk temperature limit to 400°F and the short time excursion limit to 425°F. The objective of this fuel additive package is increase the fuel heat sink without increasing the propensity to form fuel deposits. Modifications to improve the fire safety of aviation fuels must be compatible with this effort. Fuel lubricating qualities are generally recognized as being less than optimum. But lubricity is an important property that affects wear characteristics of sliding contact surfaces in pumping elements, such as bearings, gears, vanes, and pistons. In the past, the use of low lubricity fuel has required the redevelopment of some pump materials. Lubricity affects the sliding friction and wear between sliding parts in fuel control mechanisms. A desirable lubricity value of fuel is equal to a ball-on-cylinder wear scar of 0.5 mm or less. This will ensure the satisfactory performance of older fuel systems that are more dependent on lubricity for fuel system performance. Other fuel characteristics that must be considered in the development of a safer fuel are specific gravity; viscosity, specific heat, vapor pressure, bulk modulus, and interaction with contaminants. Specific gravity is used as a parameter to calculate fuel flow. Older hydromechanical fuel controls are calibrated using calibrating fluid with a tightly controlled specific gravity of 0.775 to 0.765. A wide variation from this value makes fuel flow scheduling less accurate. Viscosity affects low temperature pumpability, servosystem damping, and hydrodynamic fluid film lubrication. The low temperature limit of 12 centistokes is the current limit, and a significant increase in viscosity will adversely affect fuel pumpability at the engine inlet. Excessive damping in some servosystems may also result from a significant increase in viscosity at any temperature. At the other extreme, a significant decrease in high temperature viscosity will decrease the hydrodynamic film thickness in certain pump journal bearings and will adversely affect pump durability. Specific heat affects the heat sink capacity of the fuel. Any increase in specific heat will have a positive impact. However, the important aspect of heat sink capacity is specific heat per mass, indicating the amount of heat that can be absorbed per unit mass of fuel. It is highly desirable to maximize specific heat per mass. Another characteristic of fuels that must be considered is vapor pressure. Although it is highly desirable to keep fuel vapor pressure as low as possible for fire safety reasons and for the sake of fuel system pumpability, low vapor pressure also adversely affects engine starting and altitude relight capability. The bulk modulus characteristic is generally not a fuel system design driver. Only with the emergence of high response, high power exhaust nozzle actuation systems has the importance of a high value of fuel bulk modulus become apparent. A lower bulk modulus can lower the natural frequency of a fueldraulic servosystem. The maximum bandwidth at which the servosystem can operate is then determined by the bulk modulus. Conversely, operating a servosystem designed to operate with a minimum bulk modulus with a fluid of lower bulk modulus will result in system instability. The solubility of gases, to the extent that this impacts the bulk modulus value, must also be considered in any fuel modification. How a fuel interacts with suspended contaminants is not a readily definable characteristic but should be considered. It is highly desirable to keep solid contaminants suspended in solution and to prevent coagulation and the formation of larger particles. This is especially true in fuel system branches downstream of the system filters where large contaminant particles can plug orifices and jam mechanisms. SUMMARY Reliable operation of jet engine fuel systems has been developed based on current fuel characteristics, both specified and inherent. Fuels with improved fire safety should consider keeping within the currently known range of characteristic values. Changes resulting in characteristics outside the current ranges will require a significant amount of development and verification testing to establish that there is no detrimental impact from the new fuel. Evaluations of a new fuel must not only consider compatibility with new systems, but also compatibility with current, proven fuel systems.

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings 10 Applications of Vulnerability Analysis and Test Methods to Aircraft Design Hugh Griffis Wright-Patterson Air Force Base ABSTRACT Over a period of many years, the U.S. Department of Defense has developed several ways to lower the number of aircraft lost in combat. This paper outlines a systems engineering based approach and a description of hardening concepts that can greatly reduce the vulnerability of aircraft to fires and explosions. The systems engineering design process includes modeling and testing, which can predict and demonstrate the capability of hardening design features. Known limitations in modeling and testing are highlighted. BACKGROUND This paper describes analysis concepts and vulnerability reduction features that could benefit commercial aircraft. The paper highlights some broad concepts used by the Department of Defense to reduce the vulnerability of aircraft. The systems engineering process is used to categorize threats, effects of threats, and design approaches to hardening aircraft. The categories of threat are presented in tables to clarify the interrelationships of threat effects, design concepts, and hardening options. Different threats (ballistic, nuclear, laser, chemical, biological, high power microwave, etc.) affect different portions of the aircraft hardware. This paper highlights ballistic threats, which are assumed to be the most likely threats to commercial aircraft. Effects of ballistic threats and relevant hardening features are described below. SYSTEMS ENGINEERING PROCESS Combat data shows that most combat aircraft losses can be attributed to fire and explosions. State-of-the-art vulnerability analyses of current combat aircraft confirm that fires and explosions are a significant vulnerability. Therefore, reducing overall vulnerability requires reducing vulnerability to fires and explosions. In the systems engineering process, complex technical problems are divided into basic areas, including interrelationships. In order to reduce the vulnerability of complex aircraft systems, these areas must be well defined. The critical areas involved in reducing vulnerability to fires and explosions are listed below: fire and explosion elements damage modes and effects hardening approaches modeling and testing FIRE AND EXPLOSION ELEMENTS Fires and explosions require three critical elements, an ignition source, a flammable material, and oxygen. Remove any one of the three elements, and the potential for fire and explosion is eliminated. Figure 10-1 shows the three basic elements and their interrelationship. The following sections define the critical features of each. FIGURE 10-1 Fire and explosion elements.

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings Ignition Sources Fires and explosions can start from a wide range of ignition sources. In order to harden the aircraft effectively, one must understand the causes of fires and explosions. When and how a fire or explosion starts depends on the threat-induced ignition source. Tables 10-1 and 10-2 list some common ignition sources from ballistic threats and mechanical failures. Flammable Materials: Vapors, Sprays, and Liquids Flammable materials constitute a large portion of the aircraft. Fuel tanks hold thousands of gallons of flammable material, and hydraulic and coolant systems hold tens of gallons of flammable material. A fire involving tens of gallons of flammable material can cause serious damage or even the loss of an aircraft. Normally, flammable materials and ignition sources do not occupy the same space. As a result of damage from a ballistic threat and/or mechanical failure, flammable materials, ignition sources, and oxygen may occupy the same space, such as a dry bay (a volume adjacent to a fuel tank) or ullage (the air space above the fuel in the fuel tank). A sustained dry bay fire or ullage explosion can result in loss of the aircraft. Table 10-3 shows a more complete list of equipment and the location of flammable materials. Oxygen The third critical element of fires and explosions is oxygen. Oxygen concentrations are altered by environmental factors, such as temperatures of the fuel and ullage, atmospheric pressure, and internal air flow. These environmental factors TABLE 10-1 Ignition Sources from Ballistic Threats Class of Threat Specific Threat Ignition Sources Guns/Projectiles Armor piercing incendiary Incendiary flash Penetration flash Guns/Projectiles High explosive incendiary Incendiary flash Fireball Penetration flash Missiles Contact-fuzed missile Incendiary flash Fireball Penetration flash Missiles Proximity-fuzed missile Penetration flash Incendiary flash Fireball Bombs High explosive materials Fireball TABLE 10-2 Ignition Sources from Mechanical Failures Class of Threat Specific Threat Ignition Sources Electrical Damaged wiring Sparking and arcing Electrical Static discharge Sparking and arcing Electrical Lighting Sparking and arcing Leaks Spray of flammable material Hot surface ignition Mechanical Engine part penetrates case Flame and hot air outside of engine case alter the fuel/air concentration ratio. As the oxygen concentration and environmental factors change, the probability of fire and explosion changes. Dependent upon numerous factors, the fuel/air concentration ratio may be too rich or too leanto support a fire or explosion. Most test data are based on results from ground test facilities, some of which have the capability to simulate internal and external air flow. Air flow is critical in determining whether or not there will be a fire or explosion because it changes the fuel/air concentration ratio. Holes from ballistic damage can change the internal air flow; air flow in or over the ullage can decrease the ullage temperature quickly during flight. Fuel temperature remains relatively constant because of the fuel's large thermal mass, except when heated fuel is transferred to another tank. In order to determine the probability of fire and explosion with ground tests, in-flight environmental conditions must be considered. Generally, the ullage temperature and oxygen concentration decrease as the altitude increases. According to computer models that simulate typical in-flight conditions, the probability of fire and explosion is nearly constant from sea level to 30,000 feet, but decreases at higher altitudes. DAMAGE MODES AND EFFECTS Damage modes and effects depend on the nature of the threat and on the affected component. Threat-induced damage may result in component failure. How the component fails is called the failure mode. The importance of the failure depends on the type of component (i.e., flight controls) and the type of failure mode (i.e., loss of structural capability). Equipment can be organized into three classes: nonredundant components (i.e., primary wing structure), redundant components (i.e., hydraulic flight controls), and non-critical components. Modeling of redundant components includes both cascading failures and the number of failures required to lose the function. Table 10-4 shows both nonredundant and redundant components.

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings TABLE 10-3 Location of Flammable Materials Material Equipment   Tanks Pumps Pressure Lines Return Lines Dry Bays Fuel X X X X X Hydraulic Fluid X X X X X Avionics Coolant X X X X X Factors that Alter the Probabilities of Fires and Explosions The probability of a fire or explosion depends on numerous factors. Many of these factors are conceptually similar, but differ greatly in the details. Trade-off studies using a broad range of threats and resultant ignition sources are required to obtain robust designs. Table 10-5 shows several factors that can alter the probability of fires and explosions. These factors are interrelated. The following are examples of how component details can alter the probability of fire: (1) the probability of fire from fuel pouring through a hole in a fuel tank wall is different from that of fuel spraying through a hole in a 400 psi fuel line; (2) a fire in a small dry bay with no air flow may go out, either because a large volume of fuel pours in and quenches the fire or because the fire burns up the available oxygen; (3) the probability of fire from fuel pouring through a small hole in a fuel tank wall is different from that for a dry bay being flooded, which can occur because of hydrodynamic ram (shock load transmitted through a fluid) damage induced by the impact of a fast large fragment or a high explosive projectile. TABLE 10-4 Damage Modes and Effects Effect of Threat Critical Components Failure Modes Fire Flight controls Loss of yaw, pitch, roll control Fire Crew Personnel incapacitated by toxic fumes Fire Structure Loss of structural capability Fire Electrical Loss of power to support flight controls Explosion or Blast Flight controls Loss of yaw, pitch, roll control Explosion or Blast Structure Loss of structural capability Penetration Flight controls Loss of yaw, pitch, roll control HARDENING APPROACHES An aircraft that is hit by a ballistic threat will be damaged. Aircraft can be hardened to withstand this damage by removing the vulnerability, by using less vulnerable components, by shielding the components, and by adding features that increase damage tolerance. Removing the vulnerability is the desired approach, but often this is not practical. Hardening approaches that enable aircraft to tolerate damage are generally complex. In order to design a damage-tolerant aircraft, an allowable damage criteria must be developed. For example, a damage criteria might specify that the damaged structure withstand 50 percent of the worst case flight loads. Worst case flight loads should not include safety factors or aircraft life expectation. Defining the allowable damage criteria will facilitate trade-off studies (see Figure 10-2) and minimize the cost, weight, and maintenance impacts of hardening approaches. Reducing Fires General approaches to reducing fires are as follows: filtering personnel air; filling the dry bay with lightweight material (foam); adding a system that extinguishes fires; rapidly shutting off sources of flammable material; adding fire walls; and separating flammable materials from ignition sources. These hardening approaches are applicable to several classes of dry bays and equipment. Table 10-6 present additional information regarding hardening approaches shown to reduce the vulnerability of combat aircraft to fire. Each hardening approach has positive and negative attributes. For example, foam is very effective against small fragments but does not work well for high explosive threats because the blast displaces the foam. Reducing Explosions Two classes of hardening approaches to reduce the likelihood of explosions are shown in Table 10-7. The first method

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings TABLE 10-5 Factors That Alter the Probability of Fires and Explosions   Fires   Explosions Item Factors Item Factors Dry Bay Environment Oxygen content Fuel/air ratio Distance of ignition source from liquid spray Ullage Environment Oxygen content Fuel/air ratio Explosion temperature limits Factors That Alter the Dry Bay Environment Pressure and hole size Bay size and fluid flow Clutter Air flow (internal and external) Altitude Factors That Alter the Ullage Environment Fuel and ullage temperature Shock propagation distance Fuel splashing Internal air flow (internal and venting) Altitude Ignition Sources Energy intensity, size, and length of flash Type of threat Ignition Sources Energy intensity, size, and length of flash Type of threat is intended to prevent an ullage explosion. This approach uses foam or inerts the ullage by increasing the nitrogen (reducing the oxygen) concentration to eliminate the explosion. The same hardware is required to inert an ullage space or a dry bay. The second approach increases the aircraft's capability of with standing an explosion but has huge weight and cost penalties. TEST AND MODELING CONCERNS Fire Modeling Modeling of a dry bay fire is very complex. The three methods of dry bay fire modeling are described below. FIGURE 10-2 Trade-off study approach. The computation of vulnerable area and repair time (COVART) model assesses the probability of aircraft loss for a wide range of threats. The COVART model determines the component and system probability of kill for several kill mechanisms, such as functional failure, fire kills, blast kills, and others. The fire and explosion kill methodology uses the air gap method which involves tables that are a function of fragment mass, fragment velocity, air gap distance from a striker plate, and the component being hit. The data come from predictive models and test data. The air gap tables and numerous rules are used to predict the probability of fire. The WINFIRE model is a physics/chemistry-based model that assesses the probability of a sustained fire in a dry bay

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings TABLE 10-6 Hardening Approaches to Reducing Fires Location Equipment Reason for Design Concern Hardening Approach Pilot Pilot air Smoke and fumes can overcome the crew. Oxygen mask and filtered air supply Pilot Crew station materials Smoke and fumes can overcome the crew. Nonflammable materials for cockpit and crew ensemble Flight Controls Mechanical and electrical lines Fire can damage flight controls causing loss of yaw, pitch, and roll control. Separated critical redundant equipment Flight Controls Flight computers and power supplies Fire can damage flight controls causing loss of yaw, pitch, and roll control. Separated critical redundant equipment Internal Weapons Bay Surrounding structure Sustained fire around weapons will result in high order explosion. Fire resistance/ablative material added to contain fire Critical equipment and lines removed from internal weapons bay Internal Weapons Bay Air through weapons bay Sustained fire around weapons will result in high order explosion. Weapons bay sealed to eliminate flame propagation to other dry bays Dry Bays Hot equipment Leaking flammable material on hot surfaces can start a fire. Fluid path restricted by use of double walls Dry Bays Fuel lines Removing or shutting off source of flammable material from dry bay will limit cascading fire damage. Sustained fire will damage critical equipment. Valves shut at fire walls Fuel lines routed within fuel tanks Dry Bays Hydraulic lines Removing or shutting off source of flammable material from dry bay will limit cascading fire damage. Sustained fire will damage critical equipment. In-line shut-off valve and sensor for each redundant branch Dry Bays Avionics coolant lines and modules Removing or shutting off source of flammable material from dry bay will limit cascading fire damage. Sustained fire will damage critical equipment. Reservoir sensor with pump shut-off switch Dry Bays Tank walls Sustained fire will damage critical equipment. Power packs to suppress fire Bladders to seal small holes Foams to fill the dry bay Dry Bays Dry bay fire suppression system Sustained fire will damage critical equipment. Active or passive fire suppression system Inerted dry bay air Dry Bays Engine bay fire suppression system Sustained fire will damage critical equipment. Pilot-activated shut-off of engine fuel supply and pilot-activated fire suppression system Dry Bays Engine inlet Fuel in engine inlet can cause a rapid explosion or cascading fire. Fuel removal from inlet before going into combat Bladders to seal small holes and limit fuel into engine inlet

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings TABLE 10-7 Hardening Approaches to Reducing Explosions Location Equipment Reason for Design Concern Hardening Approach Ullage Foam Ullage explosion pressure can induce structural damage that results in global structural failure. Foam to stop the explosion flame/shock front from growing and propagating across the ullage volume Ullage Inerting by advanced air-separating module-permeable membrane, molecular sieve, liquid nitrogen, or gaseous nitrogen Ullage explosion pressure can induce structural damage that results in global structural failure. Addition of nitrogen enriched air to ullage to lower (less than 12%) oxygen concentration Structure Fuel tank structure Ullage explosion pressure can induce structural damage that results in global structural failure. Structural dynamic load allowable pressure increased and provides air gap data for the COVART model. This modelassumes the flammable material spray and ignition flashshape and size, and determines responses (temperature and pressure) within a volume. Based on the physical overlap of the spray and ignition flash, the model predicts if a fire will start. With sufficient heat and oxygen, the model predicts the dry bay temperature and pressure. The WINFIRE modelaccounts for the threat initial ignition conditions. Heat transfer finite difference/finite element models are numerical/physics/chemistry-based models that determine responses (temperature and pressure) within solid elements. The user must define the threat initial ignition conditions and environmental conditions. This method of modeling is used to study localized, detailed effects. Fire Testing Fire test results are probabilistic. In general, parametric tests are required to obtain reasonable data. For example, a test series with two shots (one with a fire and one without) has a probability of fire of 0.5 with a range of ± 0.5. In cases where test results are mixed, additional shots are needed to obtain quality data. Mixed test results indicate that something is changing. Understanding the reason for the change is critical, but difficult. Defining a fire is difficult. The classical measures are temperature and pressure. Based on numerous tests, the classical methods of evaluation appear to be inadequate for many tests. Most test measurements are made along the dry bay edge, although the WINFIRE model temperature prediction is the average dry bay temperature. Hence, comparing test results and the WINFIRE model is difficult. Finite element results and test data need to be collected at various locations in a dry bay. Explosion Modeling The objective of an ullage model is to predict the ullage concentrations, peak pressure, and pressure time history over the volume of the fuel tank. Ullage environmental conditions are very complex. The fuel acts as a large heat sink because of its large thermal mass. The ullage has internal air flow which may have liquid splashing. The outer skin can either add or subtract heat from the ullage depending on aircraft velocity and altitude. Pretest predictions of ballistic explosion pressures do not correlate well with test results, although our understanding is improving. Explosion Testing Ballistic tests of JP-8 fuel have shown that bomb samplers do not adequately define the edge of the temperature explosion curves. A bomb sampler ignition source is less intense than some threats; but more intense ignition sources could expand the explosion curves. Hardware that is capable of measuring fuel tank oxygen and fuel/air ratio is very limited. Hence, it is difficult to determine the concentrations in aircraft or in test articles. This problem makes it difficult to compare model and test data. SUMMARY This paper has used a systems engineering process to break down a complex technical problem into its basic elements: flammable material; ignition source; and oxygen. The goal of this paper is to inform aircraft designers and managers of the basic elements and concepts involved in reducing an aircraft's vulnerability to fires and explosions.

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings Reducing aircraft vulnerability requires considerable activity early in the design phase. Add-on features to reduce vulnerability are generally less effective and incur higher life cycle costs than features incorporated in the design. An effective vulnerability reduction program requires a robust and comprehensive systems engineering process based on tests and analyses. Early analyses of vulnerability and numerous critical tests using components, simulators, and replicas are needed to support design decisions. Using models for making pretest predictions, then testing, correlating test results to pretest predictions, and correcting models is critical to understanding this complex problem. Unfortunately, lack of funding has hampered the development of effective models. The cost of modeling and testing may appear to be high; however, it is much lower than the cost of an ineffective design. We know that inerting ullage and dry bays would significantly reduce the vulnerability of aircraft but may be too costly.

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings This page in the original is blank.

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings 11 Aircraft Fuel System Design Issues Harendra K. Mehta and A. Thomas Peacock The Boeing Company ABSTRACT This presentation is intended to provide an understanding of design considerations for the fuel system of a typical commercial aircraft, with an emphasis on safety. Current design methods to make the fuel systems as safe as possible are a culmination of technological advances combined with information from operational experience and accident investigations. The presentation briefly addresses past efforts to improve post-crash fire safety and concludes with recommendations for future research. AIRCRAFT FUEL SYSTEM The aircraft fuel system is designed to store and deliver fuel to engines and auxiliary power units (APU) safely for a variety of flight missions, including emergency situations. The major design considerations for the system, in addition to the necessary basic performance requirements, are safety, compatibility, reliability, and maintainability. In this paper, a description of the aircraft fuel system performance, safety, and compatibility will be followed by specific considerations for safety fuels. Performance Major components of a typical commercial jet airplane fuel system are: vented tank system primarily using the wing box (mainly a structural design issue) engine fuel feed and transfer system (plumbing design using electrically driven pumps) fuel quantity measurement and indication system (capacitance or ultrasonic gauging) Fuel Tanks Fuel tanks are usually located within the wing box of the airplane. A minimum of one tank for each engine is provided. For example, on a twin engine airplane, there is one main tank on each side of the fuselage. If the airplane size and range require additional fuel capacity, then the center wing box is designed to hold fuel. On a four engine aircraft, there are two main tanks on each side of the fuselage with additional capacity provided by the center tank. The fuel system may also include reserve tanks and surge tanks and, occasionally, body tanks. The tanks are integral type sealed structures and vented to the atmosphere; there is at least one open vent port (for each tank) under all conditions. The vent system is designed not to exceed pressure limits for tanks. The tank structure mainly consists of spars, ribs, and stringers. An example of the system is shown in Figure 11-1. Engine Feed System Independent fuel feed to each engine must be provided with a capability for cross-feeding when necessary. In addition, suction feed capability must be provided to ensure fuel flow to engines when boost pumps are inoperative. Another important consideration is negative 'g' operation. A typical engine feed system consists of electrically driven pumps, fuel lines, valves, and fittings (shown in Figure 11-2). An independent fuel feed is also provided for the auxiliary power unit. The system is designed to minimize the volume of unusable fuel in the tank and incorporates means to remove accumulated water. Fuel Quantity Measurement and Indication System The fuel quantity measurement system employs either capacitance or ultrasonic gauging usually combined with density measurement to indicate the quantity to the flight crew and the wing fueling station. Each tank has 10 to 14 probes to determine the height of the fuel at locations throughout the tank using one of the above methods. Capacitance gauging may also include a compensator in each tank. The fuel height and density data are input to processors where, using the airplane wing data, they are converted into fuel mass in each tank. Accuracy and reliability of the system are important for managing the system in flight as well as for determining the weight of the aircraft at takeoff. Other means of calculating

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings FIGURE 11-1 Airplane fuel system, general arrangement. fuel quantity are fuel measuring sticks (to be used on the ground) and fuel flow meters. Fuel Jettison The fuel system is designed for pressure fueling and defueling. Some aircraft are also equipped for jettisoning fuel overboard to reduce aircraft weight in an emergency landing. Fuels Typical aircraft turbine fuels include Jet A and Jet A-1, which are commonly used throughout the world except in China, the former Soviet Union, and Eastern Europe; Jet B, which has higher vapor pressure than Jet A and is used in some countries with extremely cold weather; JP-8, which is the US and NATO military equivalent of Jet A-1; and JP-4, which is a higher vapor pressure fuel which was used in military aircraft in the past but is in limited use now. Russian fuels, designated TS-1 and RT, and a Chinese fuel, designated Jet 3 (RP-3), are also used in aircraft produced in Western countries. Safety When considering fuel management, designs are aimed at minimizing the hazards of fire and explosion. Three elements are necessary to produce a fire or explosion, flammable material, oxygen, and an ignition source. Eliminating any one of these elements reduces the risk of fire to zero. The system designer has the most control over the ignition source. Therefore, major emphasis has been placed on eliminating potential ignition sources. In areas where ignition sources cannot be completely avoided, attempts have been made to minimize inadvertent leaks of flammable fluids and to provide ventilation to prevent the accumulation of vapors. In addition, structural designs have been made crashworthy to reduce the fire risk following a crash. Thus, three major ways of making a fuel system safer are: ignition source control, flammable fluid control, and crashworthiness. Details of how these methods are employed in fuel system installations follow. Tank Installations Spaces adjacent to fuel tanks, such as the leading and trailing edges of the wing, are provided with ventilation and drainage. This prevents the accumulation of hazardous vapors or liquid fuel. Ventilation and drain outlets are located to avoid discharging flammable fluids into potentially hazardous areas. Flight tests are carried out to verify that vent areas are adequate and that there is no pressure buildup. Fuel tanks are always isolated from occupied compartments by fume-proof and fuel-proof barriers. An uncontained engine failure can damage a fuel tank, causing a fuel leak. Dry bays are provided in tank installations to avoid fuel leakage in the zone above the engine where it could create a fire hazard by dripping onto hot engine surfaces.

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings FIGURE 11-2 Engine and APU fuel feed system. Fuel Shutoff Fuel shutoff capability is provided for each engine and auxiliary power unit installation. Independent fuel shutoff valves are located outside the fire zones at the fuel tank boundary in a protected area, typically on the wing spar. When the valve is closed, it prevents fuel from being delivered to the engine or large quantities of fuel from being liberated through a broken line in case of a complete engine separation. Wiring to the valve is duplicated and separated, and two sources of actuation are provided, one by the fire handle and the other at the engine cutoff lever. The valve is commanded closed when the engine is shut down and remains attached to the tank if the line is broken. Ignition Source Control Maintaining tank-mounted equipment below the maximum allowable external-surface temperature provides a margin of safety against fuel vapor ignition in normal and failure modes. A sample of each component is tested to verify that the safe temperature limit is not exceeded. Equipment located within fuel tanks, such as electrically driven fuel pumps, must be explosion proof. This capability is demonstrated in tests in which a combustible mixture is intentionally ignited inside the component while the component is surrounded by a second explosive mixture. To be considered explosion proof, the component must retain its structural integrity without igniting the surrounding mixture. The power input to quantity measurement and indication systems is kept extremely low to prevent the risk of any malfunction causing sparks with sufficient energy to cause ignition. For the same reason, electrical equipment is bonded to the aircraft structure. To prevent the accumulation of hazardous charge on components through which there is high fuel flow, bonding is provided for static electricity dissipation. Fuel flow during fueling operations is also controlled and distributed to minimize the accumulation of electrostatic charge. Fuel lines are adequately separated from electrical wiring; as a further precaution, fuel lines are routed below the wiring runs to ensure that any fuel leakage will not contact potential ignition sources, such as wires and electrical components. Fuel Carrying Components Components and lines carrying fuel are sometimes located in or near fire zones where leaking fuel poses a potential risk. Inside the fire zones, these components and lines are made fireproof. Potential for leakage from fuel line connections and components is controlled by shrouding the possible source with a second sealed barrier. The shroud is drained overboard, and the drain exit is located where it is safe and observable so that leaks can be detected and repaired before they become hazardous. Fuel lines routed through the pressurized areas have a drainable and vented shroud that completely encloses the line. The vent line leads to a safely located drain mast. An

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings example of a shrouded fuel line and shroud drain with a flame arrester is shown in Figure 11-3. Crashworthy Designs The fuel system is designed with extreme care to maximize system protection during wheels-up landing as well as in crash situations. Fuel system components are located in areas protected by the aircraft structure and away from the ''wipe-off" zone to minimize the possibility of fuel leakage and ignition in the event of a wheels-up landing. The heavy structural members and fuselage skin absorb the energy of the landing impact and provide protection against scraping action on the ground. Break-away landing gear, break-away strut attachments, and break-away flap attachments are designed to prevent the rupture of the fuel tanks. All tanks within the fuselage contour are designed to withstand specified emergency landing loads. In aircraft equipped with auxiliary fuel tanks to extend their range, the tanks are normally contained within the fuselage lower cargo compartment and are suspended from the main fuselage floor to provide additional ground clearance. Fuel and vent lines that connect these tanks to the main fuel system incorporate drainable and vented shrouds. These lines are either designed to break away or to be sufficiently flexible to accommodate tank movement without causing fuel spillage. This flexibility is also required for lines to the auxiliary power unit, which is normally installed in the aircraft tail section. Vent System The vent system maintains inside tank pressure at near ambient pressure by allowing airflow into and out of the tanks during fuel usage and fueling. The vent outlet is located in the FIGURE 11-3 A shrouded fuel line in a pressurized compartment. lower wing surface, away from the wing tip and edges to avoid areas that are most subject to lightning strikes. The outlet is either flush or recessed to preclude corona and streamers. Figure 11-4 illustrates a typical arrangement. A flame arrester system in the vent outlet line protects the system from an external ground fire source. Lightning Protection A significant consideration of aircraft fuel system safety is lightning protection. Skin panels in the fuel tank area are sufficiently thick to preclude a lightning strike penetrating them, and structural joints are conductive to prevent internal sparking in the event of a lightning strike. Removable doors and panels located in critical vapor areas are designed to maintain electrical continuity to preclude sparking during a lightning strike. Tests are conducted to demonstrate a safe design. Compatibility In addition to performance and safety requirements, the aircraft fuel system must be evaluated for compatibility with materials to which it will probably be exposed. In other words, materials used in the system structure, plumbing components, and pumps and valves must be evaluated for compatibility with both domestic and foreign fuels, with and without common additives. Various coatings, seals, and sealants must also be compatible with fuels and additives. Material compatibility is usually established by conducting extensive testing. The fuel system must be able to handle small quantities of water, which may separate from fuel or may result from the condensation of water vapors ingested through the vent system. When the aircraft hydraulic system is cooled through a fuel heat exchanger, there is a potential for hydraulic fluid leakage into the fuel tank. Therefore, possible fuel contamination from hydraulic fluid must also be considered. Small amounts of particulate contamination must be safely handled by the system. In addition, engine hardware and materials are designed to be compatible with hot fuel and products of combustion at high temperatures. The aircraft fuel system interface must also be compatible with airport fuel systems and ground supply equipment. Considerations for Safety Fuels Performance and Uses In view of the focus of this workshop on fuels with improved fire safety, it will be helpful to review the secondary uses of fuel in an aircraft fuel system. The fuel is used as a

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings FIGURE 11-4 Typical installation of a fuel tank vent system. heat sink for excess heat from engine accessories. When fuel is being pumped, it also keeps the pump temperature under control. In many systems, ejector pumps are provided to move accumulated water from low areas of the tank to the main pump inlet. These pumps require fuel from the boost pump to operate. Fuel can be used to feed any engine from any main or center tank and, on some aircraft, can be transferred from tank to tank relatively easily; therefore, fuel can be used effectively for controlling the aircraft center of gravity. Proper fuel management also provides wing bending relief as well as airplane flutter control. In the engine, fuel also serves as a hydraulic fluid and a coolant. The many uses of the fuel mean it is handled many times. The fuel must flow through a complex fuel metering unit with narrow passages as it is delivered to the engine combustor. Recovering fuel from tanks (minimizing unusable fuel quantity) is important to aircraft range and performance. The fuel recovery efficiency is currently about 99.5 percent. The current fuels provide adequate suction feed capability (flow with minimal pressure drop), which must be maintained with fuels modified for safety. The fuel must flow at low temperatures, and there should be no significant increase in freezing point. To maintain the ranges and routes currently offered by airline operators, modified fuels must have volumetric energy content nearly equivalent to current fuels. Fuel electrostatic (charging) characteristics should be no worse than current fuels to ensure that the current safety levels are not adversely affected. The preferred conductivity range is 50 picosiemens per meter (pS/m) to 450 pS/m. In general, the fuel must meet the ASTM D-1655 specification or other acceptable specification and should not adversely affect engine starting, engine operation, or emissions. Compatibility Safety fuels must also demonstrate compatibility with existing engine and airframe fuel systems and materials (small modifications may be acceptable), current fuels and additives, existing airport fuel systems and ground supply equipment, and be capable of accepting different fuels (switch loading). Finally, the safety characteristic must remain intact after fueling the aircraft. That is, the characteristic that makes the fuel safe must not be altered by the process of fueling under pressure and high flow rates. History of Safety Fuels Some of the concepts investigated in the past to improve post-crash fire safety include gelled fuels, emulsions, and long chain polymer additives. Gelled fuels were not successful because of the large amount of unrecoverable fuel or ineffectiveness with volatile fuels (JP-4. Jet B). Antimisting kerosene (AMK) fuels were promising in many laboratory and field tests but required degrading before the fuel could be used in engines. Adding systems to convert a safety fuel back to normal fuel could decrease reliability and efficiency while

OCR for page 59
Aviation Fuels with Improved Fire Safety: A Proceedings increasing the weight and cost of the overall system. A controlled impact demonstration showed that AMK would not be effective in all post-crash situations. RECOMMENDATIONS The excellent safety record in the commercial aviation industry has been achieved by continuous emphasis on design improvements, guidelines for safe operations, and improved facilities. Fuel treatment or conditioning may further improve aircraft fire safety and would be a desirable goal for research and development if economic constraints were satisfied. In any concept that involves modifying fuels to improve safety, higher vapor pressure fuels and foreign fuels should be included. A user panel should assist in evaluating different concepts and detailed R&D activities. An early economic assessment should be done for various concepts and should include not only the fuel costs and performance penalties but also the cost of introduction. Maximum use should be made of previous experience to guide the development. A rigorous assessment of the impact of fuel modification on other aircraft components and operations should be conducted.