Fuel Tanks, Venting and Inerting

An aircraft's fuel tanks carry what is often the largest single item of its load, and on a transport aircraft they are not containers at all but parts of the wing structure sealed to hold fuel. They must do more than store it. The fuel has to stay near the pump inlets in every attitude, it needs room to expand as it warms, and the space above it must breathe so that the tank is neither crushed in a descent nor burst in a climb.

The tanks also contain the one thing an aircraft designer most wants to keep from burning: a mixture of fuel vapour and air. The explosion of a nearly empty centre tank on TWA Flight 800 in 1996 showed that preventing ignition sources was not enough on its own, and it led to the inerting systems now fitted to many airliners. This article covers the tanks and their venting and inerting; the pumps and valves that deliver the fuel are in fuel feed, boost pumps and crossfeed.

Types of fuel tank

Three types of tank are used:

An integral fuel tank uses the aircraft's own structure as its walls. The wing box formed by the spars, ribs and skins, the centre section torsion box and sometimes the horizontal stabiliser are sealed during manufacture, with fuel-resistant sealant at every joint, rivet and fastener, and the space inside becomes the tank (see airframe structure and construction). It uses the available volume fully and adds little weight, because the structure is needed anyway. Its drawback is repair: a leaking integral tank has to be drained, opened and resealed.

A rigid fuel tank is a sealed metal container mounted in the wing or fuselage, or on the wingtip as a tip tank. It is simple, but it adds weight and needs its own supporting structure; it is the usual choice on light aircraft. A flexible fuel tank, or bladder, is a bag of rubberised fabric fitted into a cavity in the structure, which carries the loads. Flexible tanks are more common on military aircraft, where self-sealing versions resist battle damage.

Designers also keep tanks away from threats. The Embraer E190 E1 has a dry bay, holding no fuel, in each wing near the engine pylon, so that an engine rotor burst cannot rupture the tank.

Wing, centre and trim tanks

Transport aircraft carry most of their fuel in the wings. The Boeing 737 NG has three tanks: main tanks 1 and 2, integral with the wings, and a centre tank lying between the wing roots in the fuselage area and extending into the wing. Their usable capacities at a density of 0.8029 kg/l are 3,915 kg in each main tank and 13,066 kg in the centre tank. The A320 divides each wing into an inner and an outer tank:

The centre tank sits in the wing box where it passes through the fuselage, so its fuel does nothing to relieve the bending of the wings. It is therefore used first, while the fuel furthest outboard is kept longest to relieve wing bending and help damp flutter (see fuel mass and fuel loading).

Some types add tanks elsewhere. Additional centre tanks occupy part of the cargo hold of some A320 family aircraft. A tail trim tank in the horizontal stabiliser of the A330, A340, A380 and MD-11 receives fuel in the cruise to move the centre of gravity aft and reduce trim drag. The A321XLR carries a rear centre tank of 12,900 litres in the lower fuselage behind the main landing gear bay, an integral tank that shares some of its boundaries with the fuselage skin. Because a tank so close to the cabin raised new questions of crashworthiness, fire and explosion, EASA certified it under special conditions.

View full schematic

Baffles and collector tanks

Fuel in a large tank is a heavy liquid free to move. In manoeuvres, acceleration, deceleration and sideslip it would surge from end to end, loading the structure and uncovering the pump inlets. Fuel tank baffles, perforated walls inside the tank, damp this movement. Some large aircraft fit baffle check valves in them, which let fuel flow inboard but not outboard, so that it stays where it is wanted.

The pumps themselves are often housed in a collector tank, also called a feeder box or collector bay: a small compartment within the main tank that is kept full so that the pumps stay submerged whatever the aircraft's attitude. Some designs also let a pump be changed without draining the whole tank. The collector bay only works if it is kept full. On the Embraer E190 E1, three scavenge pumps in each wing tank, driven by motive flow, keep it full; if they fail, the bay levels out with the rest of the tank, the FUEL LO LEVEL warning may appear with less than 2,800 kg, and the engine may flame out at pitch attitudes beyond ±15°, in uncoordinated manoeuvres or under negative g.

Expansion space

Fuel expands as it warms. A tank filled to the brim in the cool of the night would overflow through its vents as the morning sun heated it, wasting fuel and spilling it where people work. Certification rules therefore require an expansion space in each tank: CS 25.969 sets it at not less than 2 % of the tank capacity for large aeroplanes. A "full" tank is thus about 98 % full.

On the A320, fuel loaded to maximum capacity can expand by 2 %, corresponding to a temperature rise of about 20 °C, without spilling. The refuelling system respects the space automatically: a high-level sensor closes each tank's refuel valve when the tank is full (see refuelling systems and fuel jettison). The expansion space is also why topping up the tanks after the last flight, a sound way of limiting condensation, needs care on a warming day.

Tank venting and surge tanks

As fuel is used, air must replace it; as the aircraft climbs or descends, the air above the fuel must follow the outside pressure. The fuel tank vent system does both, keeping the pressure in the tank close to ambient. Without it the tank would be crushed by the rising outside pressure in a descent, or burst by its own internal pressure in a climb.

In a light aeroplane each tank is vented through its filler cap or through a small tube under the wing. A blocked fuel tank vent, whether by ice, insects or a wrongly fitted cap, lets the pressure in the tank fall below ambient as fuel is drawn off. The flow to the engine falls away and the engine may stop with fuel still on board, and in a severe case the tank skin is drawn inwards. The vents are therefore checked on every walk-round.

Transport aircraft have a vent system of pipes, vent valves and a vent surge tank at the tip of each wing, outboard of the outermost fuel tank. The tanks breathe through it, and it catches any fuel that overflows into the vent lines, such as fuel pushed out by thermal expansion, and returns it to the main tanks. Some vent systems use ram air to pressurise the tanks slightly in flight, which helps the fuel flow and reduces boiling at altitude. The vents also matter in a fire: CS 25.975(a)(7) requires the vent system to prevent a tank explosion for at least 2 minutes 30 seconds when a fuel-fed fire burns on the ground outside.

Overpressure relief

The vent system cannot cope with every failure. If a refuel valve fails to close when a tank is full during pressure refuelling, or a vent becomes blocked, the pressure in a tank can rise far enough to damage its structure. A fuel tank overpressure relief valve, a spring-loaded valve set to a given pressure difference, then opens, discharging to the atmosphere directly or through the vent system, and closes again once the pressure has fallen. The A320 has such protectors in each vent, in each inner and outer tank, and between the centre tank and the left inner tank.

Fuel tank inerting

Above the fuel in every tank is the ullage, the space not occupied by liquid. It holds fuel vapour mixed with air, and whether it can burn depends on the mixture: too lean or too rich, and it will not. A nearly empty tank that is warm, on the ground on a hot day, in the climb, or next to a heat source, spends more of its time with a flammable ullage.

On 17 July 1996 TWA Flight 800, a Boeing 747-131, broke up off Long Island, New York, after its centre wing tank exploded. The NTSB concluded that the ignition source could not be determined with certainty, the most likely being a short circuit outside the tank that let excessive voltage into it through wiring of the fuel quantity indication system. It named two contributing factors: the design and certification concept that fuel tank explosions could be prevented solely by precluding ignition sources, and the design and certification of the 747 with heat sources beneath the tank, the air conditioning packs, and no means of reducing the heat they transferred into it or of making its vapour non-flammable.

Two lines of defence followed, both in CS 25.981 and its FAA equivalent. The first is ignition prevention: design reviews of existing types after the FAA's SFAR 88, and a requirement that no operation, failure or malfunction of aircraft systems may heat the inside of a tank beyond a safe margin below the lowest expected auto-ignition temperature of the fuel. The second is flammability reduction, assessed by a Monte Carlo analysis of the time a tank is flammable across the fleet. An unheated wing tank is typically flammable for about 3 % of the time, and the special conditions for inerting systems adopt that figure as their target.

The usual means is inerting: introducing a non-combustible gas into the ullage to displace enough oxygen that the vapour cannot burn. Aircraft make nitrogen-enriched air (NEA) on board, in a nitrogen generation system (NGS), also called a flammability reduction system or, on the Embraer E190-E2, an on-board inert gas generation system (OBIGGS). The A320 family's special condition for such a system defines the tank as inert when its average oxygen concentration is 12 % or less from sea level to 10,000 ft, rising linearly to 14.5 % at 40,000 ft, and requires the system to bring the fleet average flammability exposure of the tank down to 3 % or less, including on warm days on the ground and in the climb. Ignition sources must still be minimised, access panels are placarded because the tank may contain a hazardous atmosphere, and the oxygen-enriched air left over by the process must not create a hazard.

On the Boeing 737 the NGS converts bleed air into NEA and delivers it to the centre tank. It starts automatically after take-off, runs through climb, cruise, descent and landing and for a short time during taxi, and stops after a set time or when bleed pressure is no longer available. It needs no crew action and has no flight deck indication; an operability indicator sits in the main wheel well. Because the tanks are protected primarily by precluding ignition sources, the aircraft may be dispatched with the NGS inoperative under the MEL. Ignition prevention is also why the 737's limitations prohibit running a centre tank pump dry: besides damaging the pump, it is a fuel tank flammability hazard.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.