Toward a Better Understanding and Evaluation of Ullage Deflagration Hazards

Typically, dry bay fires are a product of threat interaction with the flammable liquid fuel, while ullage events are largely controlled by conditions prior to penetration (i.e., the degree of flammability of the mixture). Likewise, dry bay fires are diffusion flames driven by mixing, while ullage explosions are driven by the speed of the chemical reaction, as the reactants are already mixed.

The need to protect aircraft fuel tanks from explosions has existed since the earliest days of aviation. Dating back to the 1920s and ‘30s, dirigible manufacturers began working to eliminate the hazard of explosive hydrogen gas used for buoyancy by replacing it with less efficient and more costly helium [1]. Later, during World War II, both British and Soviet fixed-wing aircraft began to see the introduction of fuel tank ullage inerting systems to help mitigate the risk of fuel tank fire [2]. Nonetheless, a review of air combat data from the subsequent conflicts in Southeast Asia showed that more than 50% of the aircraft losses were still the result of fires and explosions [3].

Due to the significant vulnerability concern arising specifically from jet fuel, various methods have been applied to better understand and predict the risk of fuel fires/explosions onboard aircraft. These methods include subject-matter expert (SME) opinions, comparative analysis, computer simulations, and Live Fire Test and Evaluation (LFT&E).

While the Next Generation Fire Model (NGFM) is being developed to predict the probability of dry bay fires, there are currently no verified and validated models for ballistically induced ullage explosions and overpressure (e.g., within an aircraft fuel tank/wing structure). In addition, the safety and vulnerability communities have typically taken a “worst-case” approach to ullage ignition, assuming the ullage will be at its most flammable condition and any overpressure will result in catastrophic failure. Though this approach mitigates risk and negates the need for understanding the flammability of the ullage across mission profiles, as well as eliminates the need for detailed structural analyses, it can also drive unnecessary weight, cost, and complexity into an air vehicle design—and all without necessarily reducing the vulnerability of the system. Additionally, there is no predictive ullage methodology integrated into the Computation of Vulnerable Area Tool (COVART) or the Advanced Joint Effectiveness Model (AJEM), with analyses relying on precalculated tables, much like the current approach for dry bay fire.

Understanding Ullage

For a flammable gas to burn in air, the volumetric ratio of fuel and air must be within a specific flammability range. In laboratory tests conducted with a spark or pilot flame, if the amount of fuel vapor in the fuel-air mixture is below the Lower Flammability Limit (LFL) or above the Upper Flammability Limit (UFL), the mixture will not burn with sufficient heat to ignite adjacent gases and propagate the flame throughout the volume. Meanwhile, reactions occurring within these limits will result in ullage reactions (i.e., explosions). Explosive events characterized by rapid combustion, exceeding the local speed of sound, are termed “detonations,” while slower propagation events are known as “deflagrations.” Ullage explosions are always deflagrations, producing a uniform, nonlocalized pressure rise affecting all portions of the volume uniformly. This is unlike pressures generated by detonations or phenomena, such as hydrodynamic ram (HRAM), that produce localized or focused pressure events that are highly dependent on geometry and shotline.

The fuel-air ratio (FAR) of an aircraft’s ullage is a function of its altitude (i.e., pressure), the fuel, and its temperature. These combined factors affect the vaporization of the liquid jet fuel, which itself comprises many different hydrocarbons with differing boiling points. Figure 1 illustrates some of the drivers of the ullage mixture.

Figure 1. Simplified Schematic of Forces Affecting Ullage Conditions.

Jet fuels are largely kerosene-based, and the primary current concern is with JP-8 (NATO code F-34), Jet A, and Jet A-1 (NATO code F-35). Jet A is the U.S. commercial aviation fuel, while Jet A-1 is adopted by most of the rest of the world, with the exception of some countries that follow the Russian TS-1 standard.

JP-8 was adopted to replace JP-4 (Jet-B) because it has a higher flash point requirement and was considered safer for ground operations. Similarly, JP-5 was adopted by the Navy for ship-based aviation because it has a higher minimum allowable flash point. JP-8 and the aforementioned Jet A variants all have a minimum flash point of 100 °F, though in practice, the actual measured flash points are generally much higher (≥100 °F). JP-5 has a minimum requirement of 140 °F. In contrast, TS-1 has a requirement of just 83 °F.

In 2016, as a cost-saving measure for continental U.S. (CONUS) operations, the U.S. Air Force completed conversion from JP-8 to Jet A blended with required additives (i.e., a corrosion inhibitor/lubricity enhancer, fuel system icing inhibitor, and static dissipater), designated NATO code F-24. However, when it comes to evaluating the distillate fuels for ullage deflagrations, JP-8/F-34, Jet A, and Jet A-1/F-35 are considered interchangeable, as the variations in the hydrocarbon content are not controlled. Batch-to-batch variations in hydrocarbons do not prevent meeting the fuel specifications.

The variation in vapor composition among different samples of Jet A has been demonstrated in DOT/FAA/AR-02/96 [4]. The four samples were heated to their measured “flash points” (i.e., the temperature at which the fuel produces enough vapor to ignite in air), and gas chromatography was used to analyze the vapor composition. Figure 2 shows the carbon number distribution broken out by sample with a focus on C₅–C₁₂. The legend shows the flash point of each sample. (Note that Sample #298 meets the TS-1 standard.) In addition to each fuel differing in composition in the liquid phase, as the liquids are heated, the differing boiling points of each of the hydrocarbons will drive differences in the vapor composition.

Figure 2. Hydrocarbon Analysis for Four Different Jet A Samples.

The FAR generating complete combustion is known as the stoichiometric ratio, where all oxygen and fuel are consumed in the reaction. The highest overpressure observed during an ullage event, however, will normally occur when the FAR is higher than the stoichiometric ratio (i.e., more fuel than air). As shown in Figure 3, testing conducted at the California Institute of Technology shows the effects of flammability on the ignition source strength required to ignite a propane/air mixture [5]. As can be seen, as the mixture approaches the LFL or Lean Limit, greater energy is required to ignite it, and the least energy is required when the mixture is slightly rich.

Figure 3. Minimum Ignition Energy vs. Percent Propane in Air.

Understanding and Preventing the Hazard

Generally, a deflagration under worst-case conditions can generate overpressures ranging from 6 to 10 times the absolute pressure at ignition (i.e., 88 to 147 psig at sea level conditions) [6]. For such an event occurring within an aircraft fuel tank, these pressures will result in a catastrophic structural failure and possible loss of aircraft, depending on tank location.

To mitigate the risk of ullage explosions on civilian aircraft, emphasis is first placed on preventing any ignition source capable of initiating a deflagration regardless of the ullage FAR. However, this requirement is different for military aircraft due to ballistic protection requirements. Military aircraft are often protected from ullage deflagrations using inerting or fuel tank fillers, such as reticulated foam. These systems prevent any ignition from developing into a deflagration and generating a critical overpressure.

Some of the earliest laboratory testing was conducted by Stewart and Starkman in the 1950s using JP-4, JP-4 vapor, and other aircraft fuels to determine their flammability limits as a function of pressure, fuel type, temperature, and ignition energy (sparks and incendiary ammunition) [7]. They tested both CO₂ and N₂ as inertants. The capacitor discharge spark tests were conducted at different simulated altitudes while the ballistic (U.S. 0.50-cal armor-piercing incendiary [API]) tests were all performed at sea level. The oxygen and inertants were mixed in a separate tank using Dalton’s law of partial pressures and mixed by inducing convective currents in the tank.

The purpose of the testing was to determine the lowest level oxygen that would no longer support combustion, which is known as the limiting oxygen concentration (LOC). Any test that resulted in an ignition was counted; no overpressure thresholds were used. From the spark tests, the following observations were made:

• Increasing altitude (decreasing pressure) narrowed the flammability limits, and at altitudes above 40,000 ft, there was a marked decrease in reaction strength.
• Liquid fuel in the tank increased the amount of inertant required when compared to gas-phase results. While not explored in the test series, this result could be due to the inert gases dissolving into the liquid fuel.
• At sea level, the LOC with CO₂ was ≈12.5% and just under 10% with N₂. The LOC increased in a semi-linear fashion with increasing altitude.

A later test series was performed early in the development process, prior to the Air Force adopting inerting [8]. As the N₂ requirements had been developed under static conditions, there was concern that, as observed with the flammability limits in air, there might potentially be an effect caused by the agitation of the fuel that would change the effectiveness of the proposed nitrogen inerting systems.

Tests were conducted using JP-8 in an 80-gal test vessel mounted on a slosh-vibration table. The slosh amplitude was fixed at 30°, and only one slosh rate (17.5 cycles/min) was used. A spark was used as the ignition source.

Several deflagrations were observed at 13% O₂, and no deflagrations were observed at 12%, even with sloshing. Thus, the conclusions were that sloshing did not change the maximum allowable percentage of oxygen and that 12% was generally low enough for JP-8 fuel vapors. Researchers felt confident in these results despite only testing one mode and frequency for slosh.

Figure 4 shows a final plot that the authors derived from their tests, along with 21% O₂ data from a previous test series [9].

Figure 4. Peak Reaction Pressure at Various O₂ Levels in Sloshing Tanks.

The typical military requirement is to maintain the ullage oxygen level below 9% to 9.8%, based on the pioneering research of Stewart and Starkman and the desire to have zero reaction [10].

To reduce the oxygen in aircraft tanks, the primary technology employed is usually an On-Board Inert Gas Generation System (OBIGGS). These systems use bleed air from the engine(s) to generate nitrogen-enriched air (NEA). Unlike reticulated foam, OBIGGS does not decrease the fuel capacity of the aircraft, only added weight to the aircraft. As a general rule-of-thumb for OBIGGS, for every 1% decrease in oxygen levels required, a 10% increase in OBIGGS weight is needed.

After the loss of TWA 800 due to an ullage explosion in the center wing tank, there was a revived interest in ullage protection for civilian aircraft. Previous commercial research and development had relied solely on eliminating potential ignition sources. The Federal Aviation Administration (FAA) conducted several experiments using three different electrically driven ignition sources to determine the LOC [11]. The ignition/no-ignition determination was made using either a hinged aluminum plate that moved or an aluminum foil disk that ruptured.

Out of that research, the FAA developed a civilian oxygen requirement of 12% up to 10,000 ft with a linear increase to 14.5% at 40,000 ft and extrapolating linearly above that altitude [12].

JLF Ullage Ignition Testing

The purpose of the Joint Live Fire (JLF) testing was to develop data for engineers or analysts to use in determining the actual risk of structural failure and loss of aircraft due to a ballistically induced ullage ignition, as well as the level of inerting that would suitably mitigate a threat-initiated deflagration for a particular platform or fuel tank [13]. To make these determinations, rather than rely on a spark igniter, which is less energetic and less representative of a ballistic threat, pyrotechnic igniters and APIs were instead employed. That said, a few spark tests were also included for baselining purposes to compare to existing igniter data. Additionally, rather than attempting to simulate the ullage vapor with a simple single-component, low-boiling-point hydrocarbon—such as propane, pentane, or even a blend, as some prior programs used—liquid Jet A was used to ensure more operationally applicable results, though it does introduce additional complexity into the test setup and execution.

A test method was developed to independently vary the oxygen level and amount of fuel vapor prior to each test. The oxygen level in the ullage was reduced by adding nitrogen until the oxygen measurement reached the desired level simulating the effects of OBIGGS and NEA. The amount of fuel vapor was controlled by heating or cooling liquid Jet A fuel, holding it at a predetermined temperature, and circulating the vapor to generate a well-stirred, homogeneous mixture prior to activating the ignition source.

This test series was performed by the 704 TG/OL-AC, first at Upper Test Site 3 and later at Test Site 2 at the Aerospace Vehicle Survivability Facility (AVSF) located at Wright-Patterson Air Force Base (WPAFB), OH. Testing was conducted in an iron-bird test tank that has long been used for ullage and HRAM testing. The test tank (shown in Figures 5 and 6) is a cube measuring approximately 39 inches on all sides (internally) for a total volume of approximately 34 ft³ or 256 gal. The test article construction consists of 0.5-inch-thick stainless-steel plates welded along each edge. The inside of the vessel contains no partitions or internal structure of any kind apart from mounts for instrumentation, igniters, plumbing, etc. The tank was filled to a 33% level with Jet A.

Figure 5. Dimetric Schematic of Test Tank.

Figure 6. Test Tank Installed.

The test tank was connected to a larger conditioning tank that generates Jet A vapors through precise temperature control using either a heating or cooling loop as necessary to meet the desired fuel temperature, which drove the overall system temperatures. All tests were conducted at near sea-level pressure conditions. The oxygen level was monitored with a paramagnetic oxygen sensor, and static pressure transducers measured the overpressures. A Flame Ionization Detector (FID), to measure the amount of fuel vapor, was also present but provided inconsistent results.

A total of 203 tests were conducted, comprising 65 nonballistic (4 spark and 61 pyrotechnic igniter) tests and 138 ballistic shots taken with either one of two API projectiles or a simulated warhead fragment. Both the shotline and the nonballistic ignition source height were 6 inches above the liquid level. The fuel flash point for each batch of fuel used was determined via ASTM D93. In addition to flash point tests, the fuels were also tested using ASTM D2887 protocols, simulating the distillation curve of a fuel sample. This ASTM D2887 data give additional insight into the composition and how the liquid might vaporize.

After much research, the pyrotechnic igniters selected were the EBBOS ChZ (chemical igniter) manufactured by Fr. Sobbe GmbH. One of their primary usages is in the European Standard “Determination of Explosion Characteristics of Dust Clouds,” and they are available in energy output levels rated from 100 J to 20,000 J. The 5-kJ versions were used as ignition sources in the Experimental Chamber for Evaluation of Exploding Dust (ExCEED) when the Idaho National Laboratory was studying the explosive characteristics of beryllium dust [14]. For the JLF testing, a single 10-kJ igniter was selected, as it was estimated to be the same order of magnitude as the energy released by the burning of the incendiary from a small API after a complete function.

Testing with the pyrotechnic igniters demonstrated that they were more potent than the spark, capable of igniting the ullage mixture at lower fuel temperature as well as at a lower oxygen level. With the pyrotechnic igniters, differences in deflagration overpressures were generally seen in response to a change in temperature (i.e., change in fuel vapor), as well as to changes in oxygen. In addition, as the oxygen was lowered, the flammability limits narrowed, and at around 12% O₂ the flammability limits were so narrow they were initially missed. The lowest oxygen level, which was still flammable to the pyrotechnic was 11.7%, which still generated tens of psi of overpressure. After completing the pyrotechnic testing, the data were compared with legacy API data conducted with a U.S. 0.50-cal API round [15], and statistical analysis showed that the pyrotechnic and 0.50-caliber data were not differentiable through an analysis of variance (ANOVA) statistical test.

The intent of choosing the pyrotechnic igniters was to serve as a better surrogate for ballistic threats than the spark had, while still simplifying testing. Testing with foreign API rounds of interest to ballistic vulnerability analysis was then carried out with the intent of confirming the pyrotechnic igniter results. To confirm if the API threats were more potent (e.g., requiring additional inerting as legacy testing has indicated), API threats were tested at the same temperature that represented peak flammability for the igniters. However, the two API threats showed that they had a different flammability envelope that had been mapped out with the igniters. The API projectiles had a slightly lower peak flammable temperature, likely due to the incendiary cloud liberating more vapor and changing the UFL.

In general, the API rounds generated “noisier” data than the pyrotechnic igniters with more mixed results. In addition to the differences in ignition energy, the rounds generate a damage hole that could entrain air as the round passes through, potentially influencing reduced oxygen testing. The threat will also be more dynamic as it travels through the volume distributing its energy, as opposed to a static ignition source in the middle of the volume. The API threats also did not necessarily generate deflagration overpressures that were lower under less flammable conditions, as was witnessed with the pyrotechnic igniters. In general, reduced, potentially nondamaging overpressures were not witnessed; there were either significant deflagration overpressures or no ignition.

Testing was completed in March of 2025, and the final report will be available from the Defense Technical Information Center (DTIC). Analysts and design engineers can use the measured overpressures and compare them to individual tanks on a particular platform across the operational mission profiles, as the flammability of the tanks may vary over time and failure of a given tank may not result in loss of crew or aircraft, and will be platform-specific.

About the Author

Mr. Jim Tucker currently serves as a subject-matter expert for the SURVICE Engineering Company. He has more than 30 years of specialized experience in aviation-related fire research and modeling, as well as the development, testing, and modeling of fire protection tools and methodologies. He began his career as an Air Force lieutenant at the Wright Laboratory Safety and Survivability Branch, where he worked as part of the Tri-Service Halon 1301 replacement effort. He is a current member of the Next Generation Fire Model Integrated Product Team. Mr. Tucker holds a B.S. in mechanical engineering as well as an M.S. in fire protection engineering from the Worcester Polytechnic Institute.

References

1. GlobalSecurity.org. “Airship Gases – Helium.” https://globalsecurity.org/military/world/airship-helium.htm, 2011, accessed June 2025.
2. Legg, D. “Aircraft Survivability: New Challenges for a New Global Conflict (World War II). Aircraft Survivability, http://jasp-online.org/asjournal/fall-2017/aircraft-survivability-new-challenges-for-a-new-global-conflict-world-war-ii/, fall 2017.
3. Harper, G., M. Kay, and G. Feist. “Aircraft Dry Bay Fire Protection: A Review of Available Options.” Halon Options Technical Working Conference, National Institute of Standards and Technology, pp. 25–20, 2001.
4. Woodrow, J. E. “Determination of Fuel/Air Mass Ratios for Jet Fuels at Their Flash Point Temperatures.” Center for Environmental Sciences and Engineering, 2006.
5. Shepherd, J., J. Krok, and J. Lee. “Spark Ignition Energy Measurements in Jet A. Graduate Aeronautical Laboratories, California Institute of Technology, 2000.
6. National Fire Protection Association. NFPA 68 Guide for Venting of Deflagrations. Qunicy, MA: NFPA International, 2002.
7. Stewart, P. B., and E. S. Starkman. “Inerting Conditions for Aircraft Fuel Tanks.” Wright Air Development Center, Wright-Patterson Air Force Base, OH, 1955.
8. Ott, E. E., and R. A. Lillie. “Influence of Fuel Slosh Upon the Effectiveness of Nitrogen Inerting for Aircraft Fuel Tanks.” Air Force Aero Propulsion Laboratory, Wright-Patterson Air Force Base, OH, 1970.
9. Ott, E. E. “The Effects of Fuel Slosh and Vibration on the Flammability Hazards of Hydrocarbon Turbine Fuels Within Aircraft Fuel Tanks.” Air Force Aero Propulsion Laboratory, Wright-Patterson Air Force Base, OH, 1970.
10. Anderson, C. L. “Test and Evaluation of Halon 1301 and Nitrogen Inerting Against 23mm HEI Projectiles.” Air Force Flight Dynamics Laboratory, Wright-Patterson Air Force Base, OH, 1978.
11. Summer, S. M. “Limiting Oxygen Concentration Required to Inert Jet Fuel Vapors Existing at Reduced Fuel Tank Pressures – Final Phase.” Federal Aviation Administration, 2004.
12. Federal Aviation Administration. “Appendix N to Part 25. Fuel Tank Flammability Exposure and Reliability Analysis.” Retrieved from Cornell Law School Electronic Code of Federal Regulations (e-CFR), https://www.law.cornell.edu/cfr/text/14/appendix-N_to_part_25, undated.
13. Tucker, J. “Joint Live Fire (JLF) Aircraft Systems Detailed Test Plan for Assessment of Ullage Ignition.” SURVICE Engineering Company, Dayton, OH, November 2019.
14. Humrickhouse, P. “The ExCEED Facility for Beryllium Dust Explosions.” Idaho National Laboratory, Idaho Falls, ID, 2013.
15. Clodfelter, R., and E. Ott. “Preliminary Investigation of Fuel Tank Ullage Reactions During Horizontal Gunfire.” Air Force Aero Propulsion Laboratory, Wright-Patterson Air Force Base, OH, 1972.