Inerting and Fire Prevention

A fuel-tank explosion needs three things at once: flammable vapour, enough oxygen, and an ignition source. The A330 attacks two of the three — vapour itself can never be fully eliminated — through three lines of defence: design that removes ignition sources, a mandatory maintenance baseline (CDCCL) that keeps that design intact for the aircraft's whole life, and on equipped aircraft a Fuel Tank Inerting System (FTIS) that starves the centre tank of oxygen.

   tank explosion =  flammable vapour + enough oxygen + ignition source
                          │                  │               │
   (cannot be fully       │                  │               │
    eliminated — fuel     ▼                  ▼               ▼
    always evaporates)  venting &        FTIS inerting    ① ignition-prevention design
                        temperature      O₂ < 12 % in       ② CDCCL maintenance baseline
                        (indirect)       the centre tank       (keeps ① effective for life)

1. Ignition prevention — four design targets

"The fuel system for this aircraft includes design properties that prevent ignition of fuel in the fuel tank. These design properties prevent: ‐ sparks caused by lightning strike, electrical faults or by mechanical friction ‐ increases in fuel temperature from heat sources adjacent to the fuel tank ‐ increases in fuel vapour density caused by leaks ‐ fuel leakage on hot surfaces."

In hardware terms: bonding leads against lightning and static sparks, harness design and routing against electrical faults, the flame arrestors of the vent system against ground fire (tank venting), vent intakes positioned clear of the high-probability lightning strike zones, and skin thickness standards. The pilot never operates any of it — but it is why a fuel tank full of vapour can take a lightning strike.

2. CDCCL — the maintenance red line

"Some procedures identify a fuel system item that is in a category known as a Critical Design Configuration Control Limitation (CDCCL). This category is applicable to items that are identified as the possible source of ignition of fuel in a fuel tank. You must keep CDCCL items in a serviceable condition. It is possible that damage, wear or changes to a CDCCL item can cause a fuel tank explosion... it is a mandatory requirement that you do the instruction correctly and accurately as the procedure tells you."

[!warning]- CDCCL is a category, not a component It tags every item whose damage, wear or unauthorised modification could turn it into a tank ignition source — particular bonding leads, seals, harness routings — and makes their exact configuration a mandatory airworthiness limit. The industry built this continued-airworthiness baseline after fuel-tank explosion accidents. A pilot needs the why (these items decide whether the tank can ignite); the item list belongs to maintenance and engineering.

3. FTIS — starving the centre tank of oxygen

"The aim of this system is to reduce the flammability in the fuel tanks that have a high flammability exposure. The fuel center tank is the only one that has a high flammability exposure. Therefore, the Fuel Inerting System only needs to be installed for the center tank. All other tanks do not need Fuel Inerting System installation. To reduce the flammability in the center tank, the Fuel Inerting System produces an oxygen-depleted air that goes in the center tank to replace the ambient air."

Why only the centre tank? It sits inside the fuselage, ringed by heat sources — air-conditioning packs, hydraulics, the gear bay — and unlike the wing tanks it is not bathed in cold high-altitude air. Warmer fuel means vapour more readily inside the flammable range: high flammability exposure. The wing and trim tanks, chilled from outside, do not need inerting. (Rationale is integrative synthesis; the exposure statement is FCOM verbatim.)

The production chain:

"The system... is composed by: a Conditioned Service Air System (CSAS) and an Inert Gas Generation System (IGGS). The CSAS extracts and conditions some engine bleed air to adequate pressure and temperature. Then, the air goes through the IGGS where an Air Separation Module taps the nitrogen molecules. Therefore, an oxygen-depleted air is produced (with less than 12 % of oxygen)... The Fuel Inerting System does not require any flight crew action. It works independently as soon as the engines started and until they stop."

  engine bleed ──► CSAS ───────────► IGGS ─────────────► centre tank
  air             (conditions        (Air Separation      (oxygen-depleted air,
                   pressure/temp)     Module taps N₂)       O₂ < 12 %, replaces
                                                            the ullage air)
  Fully automatic: runs from engine start to shutdown — no crew action,
  no control switch, no normal indication.

[!warning]- FTIS is prevention, not extinguishing It does not fight a fire — it makes one impossible to start. Ambient air is 21 % oxygen; below about 12 % the vapour space cannot sustain combustion. Even if every ignition-source defence failed, a spark in an inerted ullage finds nothing to burn — the same reason a nitrogen-filled room cannot catch fire.

4. Operations, configuration, dispatch

• No crew interface whatsoever in normal operation — no switch, no indication. The only cockpit face of the system is its failure alert, FUEL INERTING SYS FAULT, which changes no fuel-handling procedure (the aircraft falls back to the baseline ignition-source defences); see FCMC and inerting faults.
• Configuration: FTIS targets the centre tank, so it is only meaningful on six-tank aircraft — and even there it is a separate yes/no option in the FCOM Aircraft Configuration Summary. Check the aircraft's effectivity; do not infer it from the tank fit.
• Dispatch: the inerting system has no item in some operators' MEL editions — relief, where applicable, follows the current MEL revision.

Self-test

[!note]- Q1. Which leg of the fire triangle does each defence attack? Ignition-prevention design and CDCCL attack the ignition source; FTIS attacks the oxygen; the vapour leg cannot be eliminated and is only managed indirectly (venting, temperature limits).

[!note]- Q2. Why does damaging a CDCCL item matter more than most defects? CDCCL items are exactly those whose damage, wear or alteration can become a tank ignition source — the AMM ties them directly to the possibility of a fuel-tank explosion, which is why their procedures are mandatory to the letter.

[!note]- Q3. Why is the centre tank the only inerted tank? It is the only tank with high flammability exposure — fuselage heat sources around it and no cold-air bath. Wing and trim tanks run cold and stay below the exposure threshold.

[!note]- Q4. What does the crew do to operate FTIS? Nothing. It runs automatically from engine start to shutdown, with no switch and no normal indication; only its failure raises an ECAM alert — and even that changes no fuel handling.

[!note]- Q5. How low does FTIS take the ullage oxygen, against what ambient value? Below 12 % oxygen, against 21 % in ambient air — under the level that sustains combustion.

Key takeaways

References

• AMM 28-18-00 Description and Operation (ignition-prevention design properties); AMM 28-00-00 §1.A (CDCCL definition and mandate).
• FCOM DSC-28-10-140 (FTIS purpose, scope, CSAS/IGGS chain, automation).
• The flammability-exposure rationale and the fire-triangle framing are integrative synthesis from the cited sources.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.