7 May 2001
Source: http://www.access.gpo.gov/su_docs/aces/fr-cont.html
-------------------------------------------------------------------------
[Federal Register: May 7, 2001 (Volume 66, Number 88)]
[Rules and Regulations]
[Page 23085-23131]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr07my01-15]
[[Page 23085]]
-----------------------------------------------------------------------
Part II
Department of Transportation
-----------------------------------------------------------------------
Federal Aviation Administration
-----------------------------------------------------------------------
14 CFR Part 21 et al.
Transport Airplane Fuel Tank System Design Review, Flammability
Reduction and Maintenance and Inspection Requirements; Final Rule
[[Page 23086]]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Parts 21, 25, 91, 121, 125, and 129
[Docket No. FAA-1999-6411; Amendment Nos. 21-78, 25-102, 91-266, 121-
282, 125-36, 129-30]
RIN 2120-AG62
Transport Airplane Fuel Tank System Design Review, Flammability
Reduction, and Maintenance and Inspection Requirements
AGENCY: Federal Aviation Administration (FAA), DOT.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: This rule requires design approval holders of certain turbine-
powered transport category airplanes, and of any subsequent
modifications to these airplanes, to substantiate that the design of
the fuel tank system precludes the existence of ignition sources within
the airplane fuel tanks. It also requires developing and implementing
maintenance and inspection instructions to assure the safety of the
fuel tank system. For new type designs, this rule also requires
demonstrating that ignition sources cannot be present in fuel tanks
when failure conditions are considered, identifying any safety-critical
maintenance actions, and incorporating a means either to minimize
development of flammable vapors in fuel tanks or to prevent
catastrophic damage if ignition does occur. These actions are based on
accident investigations and adverse service experience, which have
shown that unforeseen failure modes and lack of specific maintenance
procedures on certain airplane fuel tank systems may result in
degradation of design safety features intended to preclude ignition of
vapors within the fuel tank.
EFFECTIVE DATE: June 6, 2001.
FOR FURTHER INFORMATION CONTACT: Michael E. Dostert, FAA, Propulsion/
Mechanical Systems Branch, ANM-112, Transport Airplane Directorate,
Aircraft Certification Service, 1601 Lind Avenue SW., Renton,
Washington 98055-4056; telephone (425) 227-2132, facsimile (425) 227-
1320; e-mail: mike.dostert@faa.gov.
SUPPLEMENTARY INFORMATION:
Availability of Final Rules
You can get an electronic copy using the Internet by taking the
following steps:
(1) Go to the search function of the Department of Transportation's
electronic Docket Management System (DMS) Web page (http://dms.dot.gov/
search).
(2) On the search page type in the last four digits of the Docket
number shown at the beginning of this notice. Click on ``search.''
(3) On the next page, which contains the Docket summary information
for the Docket you selected, click on the final rule.
(4) To view or download the document click on either ``Scanned
Image (TIFF)'' or ``Adobe PDF.''
You can also get an electronic copy using the Internet through
FAA's web page at http://www.faa.gov/avr/arm/nprm/nprm.htm or the
Federal Register's web page at http://www.access.gpo.gov/su_docs/aces/
aces140.html.
You can also get a copy by submitting a request to the Federal
Aviation Administration, Office of Rulemaking, ARM-1, 800 Independence
Avenue SW., Washington, DC 20591, or by calling (202) 267-9680. Make
sure to identify the amendment number or docket number of this final
rule.
Small Business Regulatory Enforcement Fairness Act
The Small Business Regulatory Enforcement Fairness Act (SBREFA) of
1996 requires FAA to comply with small entity requests for information
or advice about compliance with statutes and regulations within its
jurisdiction. Therefore, any small entity that has a question regarding
this document may contact their local FAA official, or the person
listed under FOR FURTHER INFORMATION CONTACT. You can find out more
about SBREFA on the Internet at our site, http://www.gov/avr/arm/
sbrefa.htm. For more information on SBREFA, e-mail us at 9-AWA-
SBREFA@faa.gov.
Background
On October 26, 1999, the FAA issued Notice of Proposed Rulemaking
(NPRM) 99-18, which was published in the Federal Register on October
29, 1999 (64 FR 58644). That notice proposed three separate
requirements:
First, a requirement was proposed for the design approval holders
of certain transport category airplanes to conduct a safety review of
the airplane fuel tank system and to develop specific fuel tank system
maintenance and inspection instructions for any items determined to
require repetitive inspections or maintenance.
Second, a requirement was proposed to prohibit the operation of
those airplanes beyond a specified time, unless the operators of those
airplanes incorporated instructions for maintenance and inspection of
the fuel tank system into their inspection programs.
Third, for new designs, the proposal included a requirement for
minimizing the flammability of fuel tanks, a requirement concerning
detailed failure analysis to preclude the presence of ignition sources
in the fuel tanks and including mandatory fuel system maintenance in
the limitations section of the Instructions for Continued
Airworthiness.
Issues Prompting This Rulemaking Activity
On July 17, 1996, a 25-year old Boeing Model 747-100 series
airplane was involved in an inflight breakup after takeoff from Kennedy
International Airport in New York, resulting in 230 fatalities. The
accident investigation conducted by the National Transportation Safety
Board (NTSB) indicated that the center wing fuel tank exploded due to
an unknown ignition source. The NTSB issued recommendations intended
to:
Reduce heating of the fuel in the center wing fuel tanks
on the existing fleet of transport airplanes,
Reduce or eliminate operation with flammable vapors in the
fuel tanks of new type certificated airplanes, and
Reevaluate the fuel system design and maintenance
practices on the fleet of transport airplanes.
The accident investigation focused on mechanical failure as
providing the energy source that ignited the fuel vapors inside the
tank.
The NTSB announced their official findings of the TWA 800 accident
at a public meeting held August 22-23, 2000, in Washington, DC. The
NTSB determined that the probable cause of the explosion was ignition
of the flammable fuel/air mixture in the center wing fuel tank.
Although the ignition source could not be determined with certainty,
the NTSB determined that the most likely source was a short circuit
outside of the center wing tank that allowed excessive voltage to enter
the tank through electrical wiring associated with the fuel quantity
indication system (FQIS). Opening remarks at the hearing also indicated
that:
``* * * This investigation and several others have brought to light
some broader issues regarding aircraft certification. For example,
there are questions about the adequacy of the risk analyses that are
used as the basis for demonstrating compliance with many
certification requirements.''
This accident prompted the FAA to examine the underlying safety
issues surrounding fuel tank explosions, the
[[Page 23087]]
adequacy of the existing regulations, the service history of airplanes
certificated to these regulations, and existing maintenance practices
relative to the fuel tank system.
Flammability Characteristics
The flammability characteristics of the various fuels approved for
use in transport airplanes results in the presence of flammable vapors
in the vapor space of fuel tanks at various times during the operation
of the airplane. Vapors from Jet A fuel (the typical commercial
turbojet engine fuel) at temperatures below approximately 100 deg.F are
too lean to be flammable at sea level; at higher altitudes the fuel
vapors become flammable at temperatures above approximately 45 deg.F
(at 40,000 feet altitude).
However, the regulatory authorities and aviation industry have
always presumed that a flammable fuel air mixture exists in the fuel
tanks at all times and have adopted the philosophy that the best way to
ensure airplane fuel tank safety is to preclude ignition sources within
fuel tanks. This philosophy has been based on the application of fail-
safe design requirements to the airplane fuel tank system to preclude
ignition sources from being present in fuel tanks when component
failures, malfunctions, or lightning encounters occur.
Possible ignition sources that have been considered include:
Electrical arcs,
Friction sparks, and
Autoignition. (The autoignition temperature is the
temperature at which the fuel/air mixture will spontaneously ignite due
to heat in the absence of an ignition source.)
Some events that could produce sufficient electrical energy to
create an arc include:
Lightning,
Electrostatic charging,
Electromagnetic interference (EMI), or
Failures in airplane systems or wiring that introduce
high-power electrical energy into the fuel tank system.
Friction sparks may be caused by mechanical contact between certain
rotating components in the fuel tank, such as a steel fuel pump
impeller rubbing on the pump inlet check valve. Autoignition of fuel
vapors may be caused by failure of components within the fuel tank, or
external components or systems that cause components or tank surfaces
to reach a high enough temperature to ignite the fuel vapors in the
fuel tank.
Existing Regulations/Certification Methods
The current 14 CFR part 25 regulations that are intended to require
designs that preclude the presence of ignition sources within the
airplane fuel tanks are as follows:
Section 25.901 is a general requirement that applies to all
portions of the propulsion installation, which includes the airplane
fuel tank system. It requires, in part, that the propulsion and fuel
tank systems be designed to ensure fail-safe operation between normal
maintenance and inspection intervals, and that the major components be
electrically bonded to the other parts of the airplane.
Sections 25.901(c) and 25.1309 provide airplane system fail-safe
requirements. Section 25.901(c) requires that ``no single failure or
malfunction or probable combination of failures will jeopardize the
safe operation of the airplane.'' In general, the FAA's policy has been
to require applicants to assume the presence of foreseeable latent
(undetected) failure conditions when demonstrating that subsequent
single failures will not jeopardize the safe operation of the airplane.
Certain subsystem designs must also comply with Sec. 25.1309. That
section requires airplane systems and associated systems to be:
``* * * designed so that the occurrence of any failure condition
which would prevent the continued safe flight and landing of the
airplane is extremely improbable, and the occurrence of any other
failure conditions which would reduce the capability of the airplane
or the ability of the crew to cope with adverse operating conditions
is improbable.''
Compliance with Sec. 25.1309 requires an analysis, and testing
where appropriate, considering possible modes of failure, including
malfunctions and damage from external sources, the probability of
multiple failures and undetected failures, the resulting effects on the
airplane and occupants, considering the stage of flight and operating
conditions, and the crew warning cues, corrective action required, and
the capability of detecting faults.
This provision has the effect of mandating the use of ``fail-safe''
design methods, which require that the effect of failures and
combinations of failures be considered in defining a safe design.
Detailed methods of compliance with Secs. 25.1309(b), (c), and (d) are
described in Advisory Circular (AC) 25.1309-1A, ``System Design
Analysis,'' and are intended as a means to evaluate the overall risk,
on average, of an event occurring within a fleet of aircraft. The
following guidance involving failures is offered in that AC:
In any system or subsystem, a single failure of any
element or connection during any one flight must be assumed without
consideration as to its probability of failing. This single failure
must not prevent the continued safe flight and landing of the airplane.
Additional failures during any one flight following the
first single failure must also be considered when the probability of
occurrence is not shown to be extremely improbable. The probability of
these combined failures includes the probability of occurrence of the
first failure.
As described in the AC, the FAA fail-safe design concept consists
of the following design principles or techniques intended to ensure a
safe design. The use of only one of these principles is seldom
adequate. A combination of two or more design principles is usually
needed to provide a fail-safe design (i.e., to ensure that catastrophic
failure conditions are not expected to occur during the life of the
fleet of a particular airplane model).
Design integrity and quality, including life limits, to
ensure intended function and prevent failures.
Redundancy or backup systems that provide system function
after the first failure (e.g., two or more engines, two or more
hydraulic systems, dual flight controls, etc.)
Isolation of systems and components so that failure of one
element will not cause failure of the other (sometimes referred to as
system independence).
Detection of failures or failure indication.
Functional verification (the capability for testing or
checking the component's condition).
Proven reliability and integrity to ensure that multiple
component or system failures will not occur in the same flight.
Damage tolerance that limits the safety impact or effect
of the failure.
Designed failure path that controls and directs the
failure, by design, to limit the safety impact.
Flightcrew procedures following the failure designed to
assure continued safe flight by specific crew actions.
Error tolerant design that considers probable human error
in the operation, maintenance, and fabrication of the airplane.
Margins of safety that allow for undefined and
unforeseeable adverse flight conditions.
These regulations, when applied to typical airplane fuel tank
systems, are
[[Page 23088]]
intended to prevent ignition sources inside fuel tanks. The approval of
the installation of mechanical and electrical components inside the
fuel tanks was typically based on a qualitative system safety analysis
and component testing which showed that:
Mechanical components would not create sparks or high
temperature surfaces in the event of any failure; and
Electrical devices would not create arcs of sufficient
energy to ignite a fuel-air mixture in the event of a single failure or
probable combination of failures.
Section 25.901(b)(2) requires that the components of the propulsion
system be ``constructed, arranged, and installed so as to ensure their
continued safe operation between normal inspection or overhauls.''
Compliance with this regulation is typically demonstrated by
substantiating that the propulsion installation, which includes the
fuel tank system, will safely perform its intended function between
inspections and overhauls defined in the maintenance instructions.
Section 25.901(b)(4) requires electrically bonding the major
components of the propulsion system to the other parts of the airplane.
The affected major components of the propulsion system include the fuel
tank system. Compliance with this requirement for fuel tank systems has
been demonstrated by showing that all major components in the fuel tank
are electrically bonded to the airplane structure. This precludes
accumulation of electrical charge on the components and the possible
arcing in the fuel tank that could otherwise occur. In most cases,
electrical bonding is accomplished by installing jumper wires from each
major fuel tank system component to airplane structure. Advisory
Circular 25-8, ``Auxiliary Fuel Tank Installations,'' also provides
guidance for bonding of fuel tank system components and means of
precluding ignition sources within transport airplane fuel tanks.
Section 25.954 requires that the fuel tank system be designed and
arranged to prevent the ignition of fuel vapor within the system due to
the effects of lightning strikes. Compliance with this regulation is
typically shown by incorporation of design features such as minimum
fuel tank skin thickness, location of vent outlets out of likely
lightning strike areas, and bonding of fuel tank system structure and
components. Guidance for demonstrating compliance with this regulation
is provided in AC 20-53A, ``Protection of Aircraft Fuel Systems Against
Fuel Vapor Ignition Due to Lightning.''
Section 25.981 requires that the applicant determine the highest
temperature allowable in fuel tanks that provides a safe margin below
the lowest expected autoignition temperature of the fuel that is
approved for use in the fuel tanks. No temperature at any place inside
any fuel tank where fuel ignition is possible may then exceed that
maximum allowable temperature. This must be shown under all probable
operating, failure, and malfunction conditions of any component whose
operation, failure, or malfunction could increase the temperature
inside the tank. Guidance for demonstrating compliance with this
regulation has been provided in AC 25.981-1A, ``Guidelines For
Substantiating Compliance With the Fuel Tank Temperature
Requirements.'' The AC provides a listing of failure modes of fuel tank
system components that should be considered when showing that component
failures will not create a hot surface that exceeds the maximum
allowable fuel tank component or tank surface temperature for the fuel
type for which approval is being requested. Manufacturers have
demonstrated compliance with this regulation by testing and analysis of
components to show that design features, such as thermal fuses in fuel
pump motors, preclude an ignition source in the fuel tank when failures
such as a seized fuel pump rotor occur.
Airplane Maintenance Manuals and Instructions for Continued
Airworthiness
Historically, manufacturers have been required to provide
maintenance-related information for fuel tank systems in the same
manner as for other systems. Prior to 1970, most manufacturers provided
manuals containing maintenance information for large transport category
airplanes, but there were no standards prescribing minimum content,
distribution, and a timeframe in which the information must be made
available to the operator.
Section 25.1529, as amended by Amendment 25-21 in 1970, required
the applicant for a type certificate (TC) to provide airplane
maintenance manuals (AMM) to owners of the airplanes. This regulation
was amended in 1980 to require that the applicant for type
certification provide Instructions for Continued Airworthiness (ICA)
prepared in accordance with Appendix H to part 25. In developing the
ICA, the applicant is required to include certain information such as a
description of the airplane and its systems, servicing information, and
maintenance instructions, including the frequency and extent of
inspections necessary to provide for the continuing airworthiness of
the airplane (including the fuel tank system). As required by Appendix
H to part 25, the ICA must also include an FAA-approved Airworthiness
Limitations section enumerating those mandatory inspections, inspection
intervals, replacement times, and related procedures approved under
Sec. 25.571, relating to structural damage tolerance. Before this
amendment, the Airworthiness Limitations section of the ICA applied
only to airplane structure and not to the fuel tank system.
One method of establishing initial scheduled maintenance and
inspection tasks is the Maintenance Steering Group (MSG) process, which
develops a Maintenance Review Board (MRB) document for a particular
airplane model. Operators may incorporate those provisions, along with
other maintenance information contained in the ICA, into their
maintenance or inspection program.
Section 21.50 requires the holder of a design approval, including a
TC or supplemental type certificate (STC) for an airplane, aircraft
engine, or propeller for which application was made after January 28,
1981, to furnish at least one set of the complete ICA to the owner of
the product for which the application was made. The ICA for original
type certificated products must include instructions for the fuel tank
system. A design approval holder who has modified the fuel tank system
must furnish a complete set of the ICA for the modification to the
owner of the product.
Type Certificate Amendments Based on Major Change in Type Design
Over the years, design changes have been introduced into fuel tank
systems that may affect their safety. There are three ways in which
major design changes can be approved:
1. The TC holder may be granted an amendment to the type design.
2. Any person, including the TC holder, wanting to alter a product
by introducing a major change in the type design not great enough to
require a new application for a TC, may be granted an STC.
3. In some instances, a person may also make an alteration to the
type design and receive a field approval. The field approval process is
a method for obtaining approval of relatively simple modifications to
airplanes. In this process, an authorized FAA Flight Standards
Inspector can approve the alteration by use of FAA Form 337.
[[Page 23089]]
Maintenance and Inspection Program Requirements
Airplane operators are required to have extensive maintenance or
inspection programs that include provisions relating to fuel tank
systems.
Section 91.409(e), which generally applies to other than commercial
operations, requires an operator of a large turbojet multiengine
airplane or a turbopropeller-powered multiengined airplane to select
one of the following four inspection programs:
1. A continuous airworthiness inspection program that is part of a
continuous airworthiness maintenance program currently in use by a
person holding an air carrier operating certificate, or an operating
certificate issued under part 119 for operations under parts 121 or
135, and operating that make and model of airplane under those parts;
2. An approved airplane inspection program approved under
Sec. 135.419 and currently in use by a person holding an operating
certificate and operations specifications issued under part 119 for
part 135 operations;
3. A current inspection program recommended by the manufacturer; or
4. Any other inspection program established by the registered owner
or operator of that airplane and approved by the Administrator.
Section 121.367, which is applicable to those air carrier and
commercial operations covered by part 121, requires operators to have
an inspection program, as well as a program covering other maintenance,
preventative maintenance, and alterations.
Section 125.247, which is generally applicable to operation of
large airplanes, other than air carrier operations conducted under part
121, requires operators to inspect their airplanes in accordance with
an inspection program approved by the Administrator.
Section 129.14 requires a foreign air carrier and each foreign
operator of a U.S. registered airplane in common carriage, within or
outside the U.S., to maintain the airplane in accordance with an FAA-
approved program.
In general, the operators rely on the TC data sheet, MRB reports,
ICA's, the Airworthiness Limitations section of the ICA, other
manufacturers' recommendations, and their own operating experience to
develop the overall maintenance or inspection program for their
airplanes.
The intent of the rules governing the inspection and/or maintenance
program is to ensure that the inherent level of safety that was
originally designed into the system is maintained and that the airplane
is in an airworthy condition.
Historically, for fuel tank systems these required programs
include:
Operational checks (e.g., a task to determine if an item
is fulfilling its intended function);
Functional checks (e.g., a quantitative task to determine
if functions perform within specified limits);
Overhaul of certain components to restore them to a known
standard; and
General zonal visual inspections conducted concurrently
with other maintenance actions, such as structural inspections.
However, specific maintenance instructions to detect and correct
conditions that degrade fail-safe capabilities have not been deemed
necessary because it has been assumed that the original fail-safe
capabilities would not be degraded in service.
Design and Service History Review
The FAA has examined the service history of transport airplanes and
performed an analysis of the history of fuel tank explosions on these
airplanes. While there were a significant number of fuel tank fires and
explosions that occurred during the 1960's and 1970's on several
airplane types, in most cases, the fire or explosion was found to be
related to design practices, maintenance actions, or improper
modification of fuel pumps. Some of the events were apparently caused
by lightning strikes. Extensive design reviews were conducted to
identify possible ignition sources, and actions were taken that were
intended to prevent similar occurrences. However, fuel tank system-
related accidents have occurred in spite of these efforts.
On May 11, 1990, the center wing fuel tank of a Boeing Model 737-
300 exploded while the airplane was on the ground at Nimoy Aquino
International Airport, Manila, Philippines. The airplane was less than
one year old. In the accident, the fuel-air vapors in the center wing
tank exploded as the airplane was being pushed back from a terminal
gate prior to flight. The accident resulted in 8 fatalities and
injuries to an additional 30 people. Accident investigators considered
a plausible scenario in which damaged wiring located outside the fuel
tank might have created a short between 115-volt airplane system wires
and 28 volt wires to a fuel tank level switch. This, in combination
with a possible latent defect of the fuel level float switch, was
investigated as a possible source of ignition. However, a definitive
ignition source was never confirmed during the accident investigation.
This unexplained accident occurred on a newer airplane, in contrast to
the July 17, 1996, accident that occurred on an older Boeing Model 747
airplane that was approaching the end of its initial design life.
The Model 747 and 737 accidents indicate that the development of an
ignition source inside the fuel tank may be related to both the design
and maintenance of the fuel tank systems.
National Transportation Safety Board (NTSB) Recommendations
Since the July 17, 1996, accident, the FAA, NTSB, and aviation
industry have been reviewing the design features and service history of
the Boeing Model 747 and certain other transport airplane models. Based
upon its review, the NTSB has issued the following recommendations to
the FAA intended to reduce exposure to operation with flammable vapors
in fuel tanks and address possible degradation of the original type
certificated fuel tank system designs on transport airplanes.
The following recommendations relate to ``Reduced Flammability
Exposure'':
``A-96-174: Require the development of and implementation of design
or operational changes that will preclude the operation of transport-
category airplanes with explosive fuel-air mixtures in the fuel tanks:
LONG TERM DESIGN MODIFICATIONS:
(a) Significant consideration should be given to the development of
airplane design modification, such as nitrogen-inerting systems and the
addition of insulation between heat-generating equipment and fuel
tanks. Appropriate modifications should apply to newly certificated
airplanes and, where feasible, to existing airplanes.''
``A-96-175: Require the development of and implementation of design
or operational changes that will preclude the operation of transport-
category airplanes with explosive fuel-air mixtures in the fuel tanks:
NEAR TERM OPERATIONAL
(b) Pending implementation of design modifications, require
modifications in operational procedures to reduce the potential for
explosive fuel-air mixtures in the fuel tanks of transport-category
aircraft. In the B-747, consideration should be given to refueling the
center wing fuel tank (CWT) before flight whenever possible from cooler
ground fuel tanks, proper monitoring and management of the CWT fuel
temperature, and maintaining an appropriate minimum fuel quantity in
the CWT.''
[[Page 23090]]
``A-96-176: Require that the B-747 Flight Handbooks of TWA and
other operators of B-747s and other aircraft in which fuel tank
temperature cannot be determined by flightcrews be immediately revised
to reflect the increases in CWT fuel temperatures found by flight
tests, including operational procedures to reduce the potential for
exceeding CWT temperature limitations.''
``A-96-177: Require modification of the CWT of B-747 airplanes and
the fuel tanks of other airplanes that are located near heat sources to
incorporate temperature probes and cockpit fuel tank temperature
displays to permit determination of the fuel tank temperatures.''
The following recommendations relate to ``Ignition Source
Reduction'':
``A-98-36: Conduct a survey of fuel quantity indication system
probes and wires in Boeing Model 747's equipped with systems other than
Honeywell Series 1-3 probes and compensators and in other model
airplanes that are used in Title 14 Code of Federal Regulations Part
121 service to determine whether potential fuel tank ignition sources
exist that are similar to those found in the Boeing Model 747. The
survey should include removing wires from fuel probes and examining the
wires for damage. Repair or replacement procedures for any damaged
wires that are found should be developed.''
``A-98-38: Require in Boeing Model 747 airplanes, and in other
airplanes with fuel quantity indication system (FQIS) wire
installations that are co-routed with wires that may be powered, the
physical separation and electrical shielding of FQIS wires to the
maximum extent possible.''
``A-98-39: Require, in all applicable transport airplane fuel
tanks, surge protection systems to prevent electrical power surges from
entering fuel tanks through fuel quantity indication system wires.''
Service History
The FAA has reviewed service difficulty reports for the transport
airplane fleet and evaluated the certification and design practices
utilized on these previously certificated airplanes. An inspection of
fuel tanks on Boeing Model 747 airplanes also was initiated.
Representatives from the Air Transport Association (ATA), Association
of European Airlines (AEA), the Association of Asia Pacific Airlines
(AAPA), the Aerospace Industries Association of America, and the
European Association of Aerospace Industries initiated a joint effort
to inspect and evaluate the condition of the fuel tank system
installations on a representative sample of airplanes within the
transport fleet. The fuel tanks of more than 800 airplanes were
inspected. Data from inspections conducted as part of this effort and
shared with the FAA have assisted in establishing a basis for
developing corrective action for airplanes within the transport fleet.
In addition to the results from these inspections, the FAA has
received reports of anomalies on in-service airplanes that have
necessitated actions to preclude development of ignition sources in or
adjacent to airplane fuel tanks.
The following provides a summary of findings from design
evaluations, service difficulty reports, and a review of current
airplane maintenance practices.
Aging Airplane Related Phenomena
Fuel tank inspections initiated as part of the Boeing Model 747
accident investigation identified aging of fuel tank system components,
contamination, corrosion of components and sulfide deposits on
components as possible conditions that could contribute to development
of ignition sources within the fuel tanks. Results of detailed
inspection of the fuel pump wiring on several Boeing Model 747
airplanes showed debris within the fuel tanks consisting of lockwire,
rivets, and metal shavings. Debris was also found inside scavenge
pumps. Corrosion and damage to insulation on FQIS probe wiring was
found on 6 out of 8 probes removed from one in-service airplane.
In addition, inspection of airplane fuel tank system components
from out-of-service (retired) airplanes, initiated following the
accident, revealed damaged wiring and corrosion buildup of conductive
sulfide deposits on the FQIS wiring on some Boeing Model 747 airplanes.
The conductive deposits or damaged wiring may result in a location
where arcing could occur if high power electrical energy was
transmitted to the FQIS wiring from adjacent wires that power other
airplane systems.
While the effects of corrosion on fuel tank system safety have not
been fully evaluated, the FAA has initiated a research program to
better understand the effects of sulfide deposits and corrosion on the
safety of airplane fuel tank systems.
Wear or chafing of electrical power wires routed in conduits that
are located inside fuel tanks can result in arcing through the
conduits. On December 23, 1996, the FAA issued Airworthiness Directive
(AD) 96-26-06, applicable to certain Boeing Model 747 airplanes, which
required inspection of electrical wiring routed within conduits to fuel
pumps located in the wing fuel tanks and replacement of any damaged
wiring. Inspection reports indicated that many instances of wear had
occurred on Teflon sleeves installed over the wiring to protect it from
damage and possible arcing to the conduit.
Inspections of wiring to fuel pumps on Boeing Model 737 airplanes
with over 35,000 flight hours have shown significant wear to the
insulation of wires inside conduits that are located in fuel tanks. In
nine reported cases, wear resulted in arcing to the fuel pump wire
conduit on airplanes with greater than 50,000 flight hours. In one
case, wear resulted in burnthrough of the conduit into the interior of
the 737 main tank fuel cell. On May 14, 1998, the FAA issued a
telegraphic AD, T98-11-52, which required inspection of wiring to
Boeing Model 737 airplane fuel pumps routed within electrical conduits
and replacement of any damaged wiring. Results of these inspections
showed that wear of the wiring occurred in many instances, particularly
on those airplanes with high numbers of flight cycles and operating
hours.
The FAA also has received reports of corrosion on bonding jumper
wires within the fuel tanks on one in-service Airbus Model A300
airplane. The manufacturer investigating this event did not have
sufficient evidence to determine conclusively the level of damage and
corrosion found on the jumper wires. Although the airplane was in long-
term storage, it does not explain why a high number of damaged/corroded
jumper wires were found concentrated in a specific area of the wing
tanks. Further inspections of a limited number of other Airbus models
did not reveal similar extensive corrosion or damage to bonding jumper
wires. However, they did reveal evidence of the accumulation of sulfide
deposits around the outer braid of some jumper wires. Tests by the
manufacturer have shown that these deposits did not affect the bonding
function of the leads. Airbus has developed a one-time-inspection
service bulletin for all its airplanes to ascertain the extent of the
sulfide deposits and to ensure that the level of jumper wire damage
found on the one Model A300 airplane is not widespread.
On March 30, 1998, the FAA received reports of three recent
instances of electrical arcing within fuel pumps installed in fuel
tanks on Lockheed Model L-1011 airplanes. In one case, the electrical
arc had penetrated the pump and housing and entered the fuel tank.
Preliminary investigation indicates
[[Page 23091]]
that features incorporated into the fuel pump design that were intended
to preclude overheating and arc-through into the fuel tank may not have
functioned as intended due to discrepancies introduced during overhaul
of the pumps. Emergency AD 98-08-09 was issued April 3, 1998, to
specify a minimum quantity of fuel to be carried in the fuel tanks for
the purpose of covering the pumps with liquid fuel and thereby
precluding ignition of vapors within the fuel tank until such time as
terminating corrective action could be developed.
Unforeseen Fuel Tank System Failures
After an extensive review of the Boeing Model 747 design following
the July 17, 1996, accident, the FAA determined that during original
certification of the fuel tank system, the degree of tank contamination
and the significance of certain failure modes of fuel tank system
components had not been considered to the extent that more recent
service experience indicates is needed. For example, in the absence of
contamination, the FQIS had been shown to preclude creating an arc if
FQIS wiring were to come in contact with the highest level of
electrical voltage on the airplane. This was shown by demonstrating
that the voltage needed to cause an arc in the fuel probes due to an
electrical short condition was well above any voltage level available
in the airplane systems.
However, recent testing has shown that if contamination, such as
conductive debris (lock wire, nuts, bolts, steel wool, corrosion,
sulfide deposits, metal filings, etc.) is placed within gaps in the
fuel probe, the voltage needed to cause an arc is within values that
may occur due to a subsequent electrical short or induced current on
the FQIS probe wiring from electromagnetic interference caused by
adjacent wiring. These anomalies, by themselves, could not lead to an
electrical arc within the fuel tanks without the presence of an
additional failure. If any of these anomalies were combined with a
subsequent failure within the electrical system that creates an
electrical short, or if high-intensity radiated fields (HIRF) or
electrical current flow in adjacent wiring induces EMI voltage in the
FQIS wiring, sufficient energy could enter the fuel tank and cause an
ignition source within the tank.
On November 26, 1997, in Docket No. 97-NM-272-AD, the FAA proposed
a requirement for operators of Boeing Model 747-100, -200, and -300
series airplanes to install components for the suppression of
electrical transients and/or the installation of shielding and
separation of fuel quantity indicating system wiring from other
airplane system wiring. After reviewing the comments received on the
proposed requirements, the FAA issued AD 98-20-40 on September 23,
1998, that requires the installation of shielding and separation of the
electrical wiring of the fuel quantity indication system. On April 14,
1998, the FAA proposed a similar requirement for Boeing Model 737-100,
-200, -300, -400, and -500 series airplanes in Docket No. 98-NM-50-AD,
which led to the FAA issuing AD 99-03-04 on January 26, 1999. The
action required by those two airworthiness directives is intended to
preclude high levels of electrical energy from entering the airplane
fuel tank wiring due to electromagnetic interference or electrical
shorts. Several manufacturers have been granted approval for the use of
alternative methods of compliance (AMOC) with these AD's that permit
installation of transient suppressing devices in the FQIS wiring that
prevent unwanted electrical power from entering the fuel tank. All
later model Boeing Model 747 and 737 FQIS's have wire separation and
fault isolation features that may meet the intent of these AD actions.
This rulemaking will require evaluation of these later designs and the
designs of other transport airplanes.
Other examples of unanticipated failure conditions include
incidents of parts from fuel pump assemblies impacting or contacting
the rotating fuel pump impeller. The first design anomaly was
identified when two incidents of damage to fuel pumps were reported on
Boeing Model 767 airplanes. In both cases objects from a fuel pump
inlet diffuser assembly were ingested into the fuel pump, causing
damage to the pump impeller and pump housing. The damage could have
caused sparks or hot debris from the pump to enter the fuel tank. To
address this unsafe condition, the FAA issued AD 97-19-15. This AD
requires revision of the airplane flight manual to include procedures
to switch off the fuel pumps when the center tank approaches empty. The
intent of this interim action is to maintain liquid fuel over the pump
inlet so that any debris generated by a failed fuel pump will not come
in contact with fuel vapors and cause a fuel tank explosion.
The second design anomaly was reported on Boeing Model 747-400
series airplanes. The reports indicated that inlet adapters of the
override/jettison pumps of the center wing fuel tank were worn. Two of
the inlet adapters had worn down enough to cause damage to the rotating
blades of the inducer. The inlet check valves also had significant
damage. An operator reported damage to the inlet adapter so severe that
contact had occurred between the steel disk of the inlet check valve
and the steel screw that holds the inducer in place. Wear to the inlet
adapters has been attributed to contact between the inlet check valve
and the adapter. Such excessive wear of the inlet adapter can lead to
contact between the inlet check valve and inducer, which could result
in pieces of the check valve being ingested into the inducer and
damaging the inducer and impellers. Contact between the steel disk of
the inlet check valve and the steel rotating inducer screw can cause
sparks. To address this unsafe condition, the FAA issued an immediately
adopted rule, AD 98-16-19, on July 30, 1998.
Another design anomaly was reported in 1989 when a fuel tank
ignition event occurred in an auxiliary fuel tank during refueling of a
Beech Model 400 airplane. The auxiliary fuel tank had been installed
under an STC. Polyurethane foam had been installed in portions of the
tank to minimize the potential of a fuel tank explosion if uncontained
engine debris penetrated those portions of the tank. The accident
investigation indicated that electrostatic charging of the foam during
refueling resulted in ignition of fuel-air vapors in portions of the
adjacent fuel tank system that did not contain the foam. The fuel vapor
explosion caused distortion of the tank and fuel leakage from a failed
fuel line. Modifications to the design, including use of more
conductive polyurethane foam and installation of a standpipe in the
refueling system, were incorporated to prevent reoccurrence of
electrostatic charging and a resultant fuel tank ignition source.
Review of Fuel Tank System Maintenance Practices
In addition to the review of the design features and service
history of the Boeing Model 747 and other airplane models in the
transport airplane fleet, the FAA also has reviewed the current fuel
tank system maintenance practices for these airplanes.
Typical transport category airplane fuel tank systems are designed
with redundancy and fault indication features such that single
component failures do not result in any significant reduction in
safety. Therefore, fuel tank systems historically have not had any
life-limited components or specific detailed inspection requirements,
unless mandated by airworthiness directives.
[[Page 23092]]
Most of the components are ``on condition,'' meaning that some
test, check, or other inspection is performed to determine continued
serviceability, and maintenance is performed only if the inspection
identifies a condition requiring correction. Visual inspection of fuel
tank system components is by far the predominant method of inspection
for components such as boost pumps, fuel lines, couplings, wiring, etc.
Typically, these inspections are conducted concurrently with zonal
inspections or internal or external fuel tank structural inspections.
These inspections normally do not provide information regarding the
continued serviceability of components within the fuel tank system,
unless the visual inspection indicates a potential problem area. For
example, it would be difficult, if not impossible, to detect certain
degraded fuel tank system conditions, such as worn wiring routed
through conduit to fuel pumps, debris inside fuel pumps, corrosion to
bonding wire interfaces, etc., without dedicated intrusive inspections
that are much more extensive than those normally conducted.
Listing of Deficiencies
The list provided below summarizes fuel tank system design
deficiencies, malfunctions, failures, and maintenance-related actions
that have been determined through service experience to result in a
degradation of the safety features of airplane fuel tank systems. This
list was developed from service difficulty reports and incident and
accident reports. These anomalies occurred on in-service transport
category airplanes despite regulations and policies in place to
preclude the development of ignition sources within airplane fuel tank
systems.
1. Pumps:
Ingestion of the pump inducer into the pump impeller and
generation of debris into the fuel tank.
Pump inlet case degradation, allowing the pump inlet check
valve to contact the impeller.
Stator winding failures during operation of the fuel pump.
Subsequent failure of a second phase of the pump resulting in arcing
through the fuel pump housing.
Deactivation of thermal protective features incorporated
into the windings of pumps due to inappropriate wrapping of the
windings.
Omission of cooling port tubes between the pump assembly
and the pump motor assembly during fuel pump overhaul.
Extended dry running of fuel pumps in empty fuel tanks,
which was contrary to the manufacturer's recommended procedures.
Use of steel impellers that may produce sparks if debris
enters the pump.
Debris lodged inside pumps.
Arcing due to the exposure of electrical connections
within the pump housing that have been designed with inadequate
clearance to the pump cover.
Thermal switches resetting over time to a higher trip
temperature.
Flame arrestors falling out of their respective mounting.
Internal wires coming in contact with the pump rotating
group, energizing the rotor and arcing at the impeller/adapter
interface.
Poor bonding across component interfaces.
Insufficient ground fault current protection capability.
Poor bonding of components to structure.
2. Wiring to pumps in conduits located inside fuel tanks:
Wear of Teflon sleeving and wiring insulation allowing
arcing from wire through metallic conduits into fuel tanks.
3. Fuel pump connectors:
Electrical arcing at connections within electrical
connectors due to bent pins or corrosion.
Fuel leakage and subsequent fuel fire outside of the fuel
tank caused by corrosion of electrical connectors inside the pump motor
which lead to electrical arcing through the connector housing
(connector was located outside the fuel tank).
Selection of improper materials in connector design.
4. FQIS wiring:
Degradation of wire insulation (cracking), corrosion and
sulfide deposits at electrical connectors
Unshielded FQIS wires routed in wire bundles with high
voltage wires.
5. FQIS probes:
Corrosion and sulfide deposits causing reduced breakdown
voltage in FQIS wiring.
Terminal block wiring clamp (strain relief) features at
electrical connections on fuel probes causing damage to wiring
insulation.
Contamination in the fuel tanks causing a reduced arc path
between FQIS probe walls (steel wool, lock wire, nuts, rivets, bolts;
or mechanical impact damage to probes).
6. Bonding straps:
Corrosion to bonding straps.
Loose or improperly grounded attachment points.
Static bonds on fuel tank system plumbing connections
inside the fuel tank worn due to mechanical wear of the plumbing from
wing movement and corrosion.
7. Electrostatic charge:
Use of non-conductive reticulated polyurethane foam that
holds electrostatic charge buildup.
Spraying of fuel into fuel tanks through inappropriately
designed refueling nozzles or pump cooling flow return methods.
Fuel Tank Flammability
In addition to the review of potential fuel tank ignition, the FAA
has undertaken a parallel effort to address the threat of fuel tank
explosions by eliminating or significantly reducing the presence of
explosive fuel air mixtures within the fuel tanks of new type designs,
in-production, and the existing fleet of transport airplanes.
On April 3, 1997, the FAA published a notice in the Federal
Register (62 FR 16014) that requested comments concerning the 1996 NTSB
recommendations regarding reduced flammability listed earlier in this
notice. That notice provided significant discussion of service history,
background, and issues relating to reducing flammability in transport
airplane fuel tanks. Review of the comments submitted to that notice
indicated that additional information was needed before the FAA could
initiate rulemaking action to address the recommendations.
On January 23, 1998, the FAA published a notice in the Federal
Register that established and tasked an Aviation Rulemaking Advisory
Committee (ARAC) working group, the Fuel Tank Harmonization Working
Group (FTHWG), to provide additional information prior to rulemaking.
The ARAC consists of interested parties, including the public, and
provides a public process to advise the FAA concerning development of
new regulations.
Note: The FAA formally established ARAC in 1991 (56 FR 2190,
January 22, 1991), to provide advice and recommendations concerning
the full range of the FAA's safety-related rulemaking activity.
The FTHWG evaluated numerous possible means of reducing or
eliminating hazards associated with explosive vapors in fuel tanks. On
July 23, 1998, the ARAC submitted its report to the FAA. The full
report is in the docket created for this ARAC working group (Docket No.
FAA-1998-4183). This docket can be reviewed on the U.S. Department of
Transportation electronic Document Management System on the Internet at
http://dms.dot.gov. The full report is also in the docket for this
rulemaking.
[[Page 23093]]
The report provided a recommendation for the FAA to initiate
rulemaking action to amend Sec. 25.981, applicable to new type design
airplanes, to include a requirement to limit the time transport
airplane fuel tanks could operate with flammable vapors in the vapor
space of the tank. The recommended regulatory text proposed, ``Limiting
the development of flammable conditions in the fuel tanks, based on the
intended fuel types, to less than 7 percent of the expected fleet
operational time, or providing means to mitigate the effects of an
ignition of fuel vapors within the fuel tanks such that any damage
caused by an ignition will not prevent continued safe flight and
landing.'' The report discussed various options of showing compliance
with this proposal, including managing heat input to the fuel tanks,
installation of inerting systems or polyurethane fire suppressing foam,
and suppressing an explosion if one occurred, etc.
The level of flammability defined in the proposal was established
based upon comparison of the safety record of center wing fuel tanks
that, in certain airplanes, are heated by equipment located under the
tank, and unheated fuel tanks located in the wing. The FTHWG concluded
that the safety record of fuel tanks located in the wings was adequate
and that if the same level could be achieved in center wing fuel tanks,
the overall safety objective would be achieved. Results from thermal
analyses documented in the report indicate that center wing fuel tanks
that are heated by air conditioning equipment located beneath them
contain flammable vapors, on a fleet average basis, for up to 30
percent of the fleet operating time.
During the ARAC review it was also determined that certain airplane
types do not locate heat sources adjacent to the fuel tanks. These
airplanes provide significantly reduced flammability exposure, near the
5 percent value of the wing tanks. The group therefore determined that
it would be feasible to design new airplanes such that fuel tank
operation in the flammable range would be limited to near that of the
wing fuel tanks. The primary method of compliance with the requirement
proposed by the ARAC would likely be to control heat transfer into and
out of fuel tanks such that heating of the fuel would not occur. Design
features such as locating the air conditioning equipment away from the
fuel tanks, providing ventilation of the air conditioning bay to limit
heating and cool fuel tanks, and/or insulating the tanks from heat
sources, would be practical means of complying with the regulation
proposed by the ARAC.
In addition to its recommendation to revise Sec. 25.981, the ARAC
also recommended that the FAA continue to evaluate means for minimizing
the development of flammable vapors within the fuel tanks to determine
whether other alternatives, such as ground based inerting of fuel
tanks, could be shown to be cost effective.
To address the ARAC recommendations, the FAA initiated research and
development activity to determine the feasibility of requiring ground-
based inerting. The results of this activity are documented in report
No. DOT/FAA/AR-00/19, ``The Cost of Implementing Ground-Based Fuel Tank
Inerting in the Commercial Fleet.'' A copy of the report is in the
docket for this rulemaking. In addition, on July 14, 2000 (65 FR
43800), the FAA tasked the ARAC to conduct a technical evaluation of
certain fuel tank inerting methods that would reduce the flammability
of the fuel tanks on both new type designs and in-service airplanes.
The FAA is also evaluating the potential benefits of using directed
ventilation methods to reduce the flammability exposure of fuel tanks
that are located near significant heat sources.
Discussion of the Final Rule
The FAA review of the service history, design features, and
maintenance instructions of the transport airplane fleet indicates that
aging of fuel tank system components and unforeseen fuel tank system
failures and malfunctions have become a safety issue for the fleet of
turbine-powered transport category airplanes. The FAA is amending the
current regulations in four areas.
The first area of concern encompasses the possibility of the
development of ignition sources within the existing transport airplane
fleet. Many of the design practices used on airplanes in the existing
fleet are similar. Therefore, anomalies that have developed on specific
airplane models within the fleet could develop on other airplane
models. As a result, the FAA considers that a one-time safety review of
the fuel tank system for transport airplane models in the current fleet
is needed.
The second area of concern encompasses the need to require the
design of future transport category airplanes to more completely
address potential failures in the fuel tank system that could result in
an ignition source in the fuel tank system.
Third, certain airplane types are designed with heat sources
adjacent to the fuel tank, which results in heating of the fuel and a
significant increase in the formation of flammable vapors in the tank.
The FAA considers that fuel tank safety can be enhanced by reducing the
time fuel tanks operate with flammable vapors in the tank and is
therefore adopting a requirement to provide means to minimize the
development of flammable vapors in fuel tanks, or to provide means to
prevent catastrophic damage if ignition does occur.
Fourth, the FAA considers that it is necessary to impose
operational requirements so that all required maintenance or inspection
actions will be included in each operator's FAA-approved maintenance or
inspection program.
These regulatory initiatives are being codified as a Special
Federal Aviation Regulation (14 CFR part 21), amendments to the
airworthiness regulations (14 CFR part 25), and amendments to the
operating requirements (14 CFR parts 91, 121, 125, 129)
Part 21 Special Federal Aviation Regulation (SFAR)
Historically, the FAA works with the TC holders when safety issues
arise to identify solutions and actions that need to be taken. Some of
the safety issues that have been addressed by this voluntary
cooperative process include those involving aging aircraft structure,
thrust reversers, cargo doors, and wing icing protection. Although some
manufacturers have aggressively completed these safety reviews, others
have not applied the resources necessary to complete these reviews in a
timely manner, which delayed the adoption of corrective action.
Although these efforts have frequently been successful in achieving the
desired safety objectives, a more uniform and expeditious response is
considered necessary to address fuel tank safety issues.
While maintaining the benefits of FAA-TC holder cooperation, the
FAA considers that a Special Federal Aviation Regulation (SFAR)
provides a means for the FAA to establish clear expectations and
standards, as well as a timeframe within which the design approval
holders and the public can be confident that fuel tank safety issues on
the affected airplanes will be uniformly examined.
This final rule is intended to ensure that the design approval
holder completes a comprehensive assessment of the fuel tank system and
develops any required inspections, maintenance instructions, or
modifications.
[[Page 23094]]
Safety Review
The SFAR requires the design approval holder to perform a safety
review of the fuel tank system to show that fuel tank fires or
explosions will not occur on airplanes of the approved design. In
conducting the review, the design approval holder must demonstrate
compliance with the new standards adopted for Sec. 25.981(a) and (b)
(discussed below) and the existing standards of Sec. 25.901. As part of
this review, the design approval holder must submit a report to the
cognizant FAA Aircraft Certification Office (ACO) that substantiates
that the fuel tank system is fail-safe.
The FAA intends that those failure conditions identified earlier in
this document, and any other foreseeable failures, should be assumed
when performing the safety review needed to substantiate that the fuel
tank system design is fail-safe. The safety review should be prepared
considering all airplane inflight, ground, service, and maintenance
conditions, assuming that an explosive fuel air mixture is present in
the fuel tanks at all times, unless the fuel tank has been purged of
fuel vapor for maintenance. The design approval holder is expected to
develop a failure modes and effects analysis (FMEA) for all components
in the fuel tank system. Analysis of the FMEA would then be used to
determine whether single failures, alone or in combination with
foreseeable latent failures, could cause an ignition source to exist in
a fuel tank. A subsequent quantitative fault tree analysis should then
be developed to determine whether combinations of failures expected to
occur in the life of the affected fleet could cause an ignition source
to exist in a fuel tank system.
Because fuel tank systems typically have few components within the
fuel tank, the number of possible internal sources of ignition is
limited. The safety review required by this final rule includes all
components or systems that could introduce a source of fuel tank
ignition. This may require analysis of not only the fuel tank system
components, (e.g., pumps, fuel pump power supplies, fuel valves, fuel
quantity indication system probes, wiring, compensators, densitometers,
fuel level sensors, etc.), but also other airplane systems that may
affect the fuel tank system. For example, failures in airplane wiring
or electromagnetic interference from other airplane systems that were
not properly accounted for in the original safety assessment could
cause an ignition source in the airplane fuel tank system under certain
conditions and therefore would have to be included in the system safety
analysis.
The intent of the safety review is to assure that each fuel tank
system design that is affected by this action will be fully assessed
and that the design approval holder identifies any required
modifications, added flight deck or maintenance indications, and/or
maintenance actions necessary to meet the fail-safe criteria.
Maintenance Instructions
The FAA anticipates that the safety review will identify critical
areas of the fuel tank and other related systems that require
maintenance actions to account for the affects of aging, wear,
corrosion, and possible contamination on the fuel tank system. For
example, service history indicates that sulfide deposits may form on
fuel tank components, including bonding straps and FQIS components,
which could degrade the intended design capabilities by providing a
mechanism by which arcing could occur. Therefore, it might be necessary
to provide maintenance instructions to identify and eliminate such
deposits.
The SFAR requires the design approval holder to develop any
specific maintenance and inspection instructions necessary to maintain
the design features required to preclude the existence or development
of an ignition source within the fuel tank system. These instructions
must be established to ensure that an ignition source will not develop
throughout the remaining operational life of the airplane.
Possible Airworthiness Directives
The safety review may also result in identification of unsafe
conditions on certain airplane models that would require issuance of
airworthiness directives. For example, the FAA has required or proposed
requirements for design changes to the following airplanes:
Boeing Models 737, 747, and 767;
Boeing Douglas Products Division (formerly, McDonnell
Douglas) Model DC-9 and DC-10;
Lockheed Model L-1011;
Bombardier (Canadair) Model CL-600;
Airbus Models A300-600R, A319, A320, and A321;
CASA Model C-212;
British Aerospace (Jetstream) Model 4100; and
Fokker Model F28.
Design practices used on these models may be similar to those of
other airplane types; therefore, the FAA expects that modifications to
airplanes with similar design features may also be required.
The number and scope of any possible AD's may vary by airplane type
design. For example, wiring separation and shielding of FQIS wires on
newer technology airplanes significantly reduces the likelihood of an
electrical short causing an electrical arc in the fuel tank; many newer
transport airplanes do not route electrical power wiring to fuel pumps
inside the airplane fuel tanks. Therefore, some airplane models may not
require significant modifications or additional dedicated maintenance
procedures.
Other models may require significant modifications or more
maintenance. For example, the FQIS wiring on some older technology
airplanes is routed in wire bundles with high voltage power supply
wires. The original failure analyses conducted on these airplane types
did not consider the possibility that the fuel quantity indication
system may become degraded, allowing a significantly lower voltage
level to produce a spark inside the fuel tank. Causes of degradation
observed in service include aging, corrosion, or undetected
contamination of the system. As previously discussed, the FAA has
issued AD actions for certain Boeing Model 737 and 747 airplanes to
address this condition. Modification of similar types of installations
on other airplane models may be required to address this unsafe
condition and to achieve a fail-safe design.
It should be noted that any design changes might, in themselves,
require maintenance actions. For example, transient protection devices
typically require scheduled maintenance in order to detect latent
failure of the suppression feature. As a part of the required safety
review, the manufacturer is expected to define the necessary
maintenance procedures and intervals for any required maintenance
actions.
Applicability of the SFAR
The requirements of the SFAR are applicable to holders of TC's, and
STC's for modifications that affect the fuel tank systems of turbine-
powered transport category airplanes, for which the TC was issued after
January 1, 1958, and the airplane has either a maximum type
certificated passenger capacity of 30 or more, or a maximum type
certificated payload capacity of 7,500 pounds or more.
The SFAR is also applicable to applicants for type certificates,
amendments to a type certificate, and supplemental type certificates
affecting the fuel tank systems for those airplanes identified above,
if the application was filed before the effective date of the
[[Page 23095]]
SFAR and the certificate was not issued before the effective date of
the SFAR.
The FAA has determined that turbine-powered airplanes, regardless
of whether they are turboprops or turbojets, should be subject to the
rule, because the potential for ignition sources in fuel tank systems
is unrelated to the engine design. This results in the coverage of the
large transport category airplanes where the safety benefits and public
interest are greatest. This action affects approximately 7,000 U.S.
registered airplanes in part 91, 121, 125, and 129 operations.
The date January 1, 1958, was chosen so that only turbine-powered
airplanes, except for a few 1953-1958 vintage Convair 340s and 440s
converted from reciprocating power, will be included. No reciprocating-
powered transport category airplanes are known to be used currently in
passenger service, and the few remaining in cargo service would be
excluded. Compliance is not required for those older airplanes because
their advanced age and small numbers would likely make compliance
impractical from an economic standpoint. This is consistent with
similar exclusions made for those airplanes from other requirements
applicable to existing airplanes, such as the regulations adopted for
flammability of seat cushions (49 FR 43188, October 24, 1984);
flammability of cabin interior components (51 FR 26206, July 21, 1986);
cargo compartment liners (54 FR 7384, February 17, 1989); access to
passenger emergency exits (57 FR 19244, May 4, 1992); and Class D cargo
or baggage compartments (63 FR 8032, February 17, 1998).
In order to achieve the benefits of this rulemaking for large
transport airplanes as quickly as possible, the FAA has decided to
limit the applicability of the SFAR to airplanes with a maximum
certificated passenger capacity of at least 30 or at least 7,500 pounds
payload. Compliance is not required for smaller airplanes because it is
not clear at this time that the possible benefits for those airplanes
would be commensurate with the costs involved. For now, the
applicability of the rule will remain as proposed in the notice. The
FAA will need to conduct the economic analysis to determine if the rule
should be applied to smaller airplanes. Should the results of the
analysis be favorable, the FAA will develop further rulemaking to
address the smaller transports.
Applicability of SFAR to Supplemental Type Certificate (STC) Holders
The SFAR applies to STC holders as well, because a significant
number of STC's effect changes to fuel tank systems, and the objectives
of this rule would not be achieved unless these systems are also
reviewed and their safety ensured. The service experience noted in the
background of this rule indicates modifications to airplane fuel tank
systems incorporated by STC's may affect the safety of the fuel tank
system.
Modifications that could affect the fuel tank system include those
that could result in an ignition source in the fuel tank. Examples
include installation of auxiliary fuel tanks and installation of, or
modification to, other systems such as the fuel quantity indication
system, the fuel pump system (including electrical power supply),
airplane refueling system, any electrical wiring routed within or
adjacent to the fuel tank, and fuel level sensors or float switches.
Modifications to systems or components located outside the fuel tank
system may also affect fuel tank safety. For example, installation of
electrical wiring for other systems that was inappropriately routed
with FQIS wiring could violate the wiring separation requirements of
the type design. Therefore, the FAA intends that a fuel tank system
safety review be conducted for any modification to the airplane that
may affect the safety of the fuel tank system. The level of evaluation
that is intended would be dependent upon the type of modification. In
most cases a simple qualitative evaluation of the modification in
relation to the fuel tank system, and a statement that the change has
no effect on the fuel tank system, would be all that is necessary. In
other cases where the initial qualitative assessment shows that the
modification may affect the fuel tank system, a more detailed safety
review would be required.
Design approvals for modification of airplane fuel tank systems
approved by STC's require the applicant to have knowledge of the
airplane fuel tank system in which the modification is installed. The
majority of these approvals are held by the original airframe
manufacturers or airplane modifiers that specialize in fuel tank system
modifications, such as installation of auxiliary fuel tanks. Therefore,
the FAA expects that the data needed to complete the required safety
review identified in the SFAR would be available to the STC holder.
Compliance With SFAR
This rule provides an 18-month compliance time from the effective
date of the final rule, or within 18 months after the issuance of a
certificate for which application was filed before the effective date
of this SFAR, whichever is later, for design approval holders to
conduct the safety review and develop the compliance documentation and
any required maintenance and inspection instructions. (Applicants whose
applications have not been approved as of the effective date would be
allowed 18 months after the approval to comply.) The FAA expects each
design approval holder to work with the cognizant FAA Aircraft
Certification Office (ACO) and Aircraft Evaluation Group (AEG) to
develop a plan to complete the safety review and develop the required
maintenance and inspection instructions within the 18-month period. The
plan should include periodic reviews with the ACO and AEG of the
ongoing safety review and the associated maintenance and inspection
instructions.
During the 18-month compliance period, the FAA is committed to
working with the affected design approval holders to assist them in
complying with the requirements of the SFAR. However, failure to comply
within the specified time would constitute a violation of the
requirements and may subject the violator to certificate action to
amend, suspend, or revoke the affected certificate in accordance with
49 U.S.C. Sec. 44709. In accordance with 49 U.S.C. Sec. 46301, it may
also subject the violator to a civil penalty of not more than $1,100
per day until the SFAR is complied with.
Changes to Operating Requirements
This rule requires the affected operators to incorporate FAA-
approved fuel tank system maintenance and inspection instructions in
their maintenance or inspection program required under the applicable
operating rule within 36 months of the effective date of the rule. If
the design approval holder has complied with the SFAR and developed an
FAA-approved program, the operator can incorporate that program,
including any revisions needed to address any modifications to the
original type design, to meet the proposed requirement. The operator
also has the option of developing its own program independently, and is
ultimately responsible for having an FAA-approved program, regardless
of the action taken by the design approval holder.
The rule prohibits the operation of certain transport category
airplanes operated under parts 91, 121, 125, and 129 beyond the
specified compliance time, unless the operator of those airplanes has
incorporated FAA-approved fuel tank maintenance and inspection
instructions in its maintenance or inspection program, as
[[Page 23096]]
applicable. The rule requires approval of the maintenance and
inspection instructions by the FAA ACO, or office of the Transport
Airplane Directorate, having cognizance over the type certificate for
the affected airplaneThe operator would need to consider the following
five issues:
1. The fuel tank system maintenance and inspection instructions
that would be incorporated into the operator's existing maintenance or
inspection program must be approved by the FAA ACO having cognizance
over the type certificate or supplemental type certificate. If the
operator can establish that the existing maintenance and inspection
instructions fulfill the requirements of this rule, then the ACO may
approve the operator's existing maintenance and inspection instructions
without change.
2. The means by which the FAA-approved fuel tank system maintenance
and inspection instructions are incorporated into a certificate
holder's FAA-approved maintenance or inspection program is subject to
approval by the certificate holder's principal maintenance inspector
(PMI) or other cognizant airworthiness inspector. The FAA intends that
any escalation to the FAA-approved inspection intervals will require
the operator to receive approval of the amended program from the
cognizant ACO or office of the Transport Airplane Directorate. Any
request for escalation to the FAA approved inspection intervals must
include data to substantiate that the proposed interval will provide
the level of safety intended by the original approval. If inspection
results and service experience indicate that additional or more
frequent inspections are necessary, the FAA may issue AD's to mandate
such changes to the inspection program.
3. This rule does not impose any new reporting requirements;
however, normal reporting required under 14 CFR 121.703 and 125.409
still applies.
4. This rule does not impose any new FAA recordkeeping
requirements. However, as with all maintenance, the current operating
regulations (e.g., 14 CFR 121.380 and 91.417) already impose
recordkeeping requirements that apply to the actions required by this
rule. When incorporating the fuel tank system maintenance and
inspection instructions into its approved maintenance or inspection
program, each operator should address the means by which it will comply
with these recordkeeping requirements. That means of compliance, along
with the remainder of the program, are subject to approval by the
cognizant PMI or other cognizant airworthiness inspector.
5. The maintenance and inspection instructions developed by the TC
holder under the rule generally do not apply to portions of the fuel
tank systems modified in accordance with an STC, field approval, or
otherwise, including any auxiliary fuel tank installations. Similarly,
STC holders are required to provide instructions for their STC's. The
operator, however, is still responsible for incorporating specific
maintenance and inspection instructions applicable to the entire fuel
tank system of each airplane that meets the requirements of this rule.
This means that the operator must evaluate the fuel tank systems and
any alterations to the fuel tank system not addressed by the
instructions provided by the TC or STC holder, and then develop,
submit, and gain FAA approval of the maintenance and inspection
instructions to evaluate changes to the fuel tank systems.
The FAA recognizes that operators may not have the resources to
develop maintenance or inspection instructions for the airplane fuel
tank system. The rule therefore requires the TC and STC holders to
develop fuel tank system maintenance and inspection instructions that
may be used by operators. If however, the STC holder is out of business
or otherwise unavailable, the operator will independently have to
acquire the FAA-approved inspection instructions. To keep the airplanes
in service, operators, either individually or as a group, could hire
the necessary expertise to develop and gain approval of maintenance and
inspection instructions. Guidance on how to comply with this aspect of
the rule will be provided in AC 25.981-1B.
After the PMI having oversight responsibilities is satisfied that
the operator's continued airworthiness maintenance or inspection
program contains all of the elements of the FAA-approved fuel tank
system maintenance and inspection instructions, the airworthiness
inspector will approve the maintenance or inspection program revision.
This approval has the effect of requiring compliance with the
maintenance and inspection instructions.
Applicability of the Operating Requirements
This rule prohibits the operation of certain transport category
airplanes operated under 14 CFR parts 91, 121, 125, and 129 beyond the
specified compliance time, unless the operator of those airplanes has
incorporated FAA-approved specific maintenance and inspection
instructions applicable to the fuel tank system in its approved
maintenance or inspection program, as applicable. The operational
applicability was established so that all airplane types affected by
the SFAR, regardless of type of operation, are subject to FAA approved
fuel tank system maintenance and inspection procedures. As discussed
earlier, this rule includes each turbine-powered transport category
airplane model, provided its TC was issued after January 1, 1958, and
it has either a maximum type certificated passenger capacity of 30 or
more, or a maximum type certificated payload capacity of 7,500 pounds
or more.
Affect on Field Approvals
A significant number of changes to transport category airplane fuel
tank systems have been incorporated through field approvals issued to
the operators of those airplanes. These changes may also significantly
affect the safety of the fuel tank system. The operator of any airplane
with such changes is required to develop the fuel tank system
maintenance and inspection program instructions and submit it to the
FAA for approval, together with the necessary substantiation of
compliance with the safety review requirements of the SFAR.
Compliance With Operating Requirements
This rule establishes a 36-month compliance time from the effective
date of the rule for operators to incorporate FAA-approved, long-term,
fuel tank system maintenance and inspection instructions into their
approved program. The FAA expects each operator to work with the
airplane TC holder or STC holder to develop a plan to implement the
required maintenance and inspection instructions within the 36-month
period. The plan should include periodic reviews with the cognizant ACO
and AEG responsible for approval of the associated maintenance and
inspection instructions.
The fuel tank safety review may result in maintenance actions that
are overdue prior to the effective date of the operational rules. The
plan provided by the operator should include recommended timing of
initial inspections or maintenance actions that are incorporated in the
long term maintenance or inspection program. An analysis of and
supporting evidence for the proposed timing of the initial action
should be provided to the FAA. For example, it may be determined that
an inspection of a certain component should be conducted after 50,000
flight hours. Some airplanes within the fleet
[[Page 23097]]
may have accumulated over 50,000 flight hours. The timing of the
initial inspection must be approved by the FAA and would be dependent
upon an evaluation of the safety impact of the inspection. It is
desirable to incorporate these inspections in the current heavy
maintenance program, such as a ``C'' or ``D'' check, without taking
airplanes out of service. However, it may be determined that more
expeditious action is required, which may be mandated by AD.
Changes to Part 25
Currently, Sec. 25.981 defines limits on surface temperatures
within transport airplane fuel tank systems. In order to address future
airplane designs, Sec. 25.981 is revised to address both prevention of
ignition sources in fuel tanks, and reduction in the time fuel tanks
contain flammable vapors. The first part explicitly includes a
requirement for effectively precluding ignition sources within the fuel
tank systems of transport category airplanes. The second part requires
minimizing the formation of flammable vapors in the fuel tanks.
Fuel Tank Ignition Source--Section 25.981
The title of Sec. 25.981 is changed from ``Fuel tank temperature''
to ``Fuel tank ignition prevention.'' The substance of existing
paragraph (a), which requires the applicant to determine the highest
temperature that allows a safe margin below the lowest expected auto
ignition temperature of the fuel, is retained. Likewise, the substance
of existing paragraph (b), which requires precluding the temperature in
the fuel tank from exceeding the temperature determined under paragraph
(a), is also retained. These requirements are redesignated as (a)(1)
and (2) respectively.
Compliance with these paragraphs requires the determination of the
fuel flammability characteristics of the fuels approved for use. Fuels
approved for use on transport category airplanes have differing
flammability characteristics. The fuel with the lowest autoignition
temperature is JET A (kerosene), which has an autoignition temperature
of approximately 450 deg.F at sea level. The autoignition temperature
of JP-4 is approximately 470 deg.F at sea level. Under the same
atmospheric conditions, the autoignition temperature of gasoline is
approximately 800 deg.F. The autoignition temperature of these fuels
increases at increasing altitudes (lower pressures). For the purposes
of this rule, the lowest temperature at which autoignition can occur
for the most critical fuel approved for use should be determined. A
temperature providing a safe margin is at least 50 deg.F below the
lowest expected autoignition temperature of the fuel throughout the
altitude and temperature envelopes approved for the airplane type for
which approval is requested.
This rulemaking also adds a new paragraph (a)(3) to require that a
safety analysis be performed to demonstrate that the presence of an
ignition source in the fuel tank system could not result from any
single failure, from any single failure in combination with any latent
failure condition not shown to be extremely remote, or from any
combination of failures not shown to be extremely improbable.
These new requirements define three scenarios that must be
addressed in order to show compliance with paragraph (a)(3). The first
scenario is that any single failure, regardless of the probability of
occurrence of the failure, must not cause an ignition source. The
second scenario is that any single failure, regardless of the
probability occurrence, in combination with any latent failure
condition not shown to be at least extremely remote (i.e., not shown to
be extremely remote or extremely improbable), must not cause an
ignition source. The third scenario is that any combination of failures
not shown to be extremely improbable must not cause an ignition source.
For the purpose of this rule, ``extremely remote'' failure
conditions are those not anticipated to occur to each airplane during
its total life, but which may occur a few times when considering the
total operational life of all airplanes of the type. This definition is
consistent with that proposed by the ARAC for a revision to FAA AC
25.1309-1A and that currently used by the JAA in AMJ 25.1309.
``Extremely improbable'' failure conditions are those so unlikely that
they are not anticipated to occur during the entire operational life of
all airplanes of one type. This definition is consistent with the
definition provided in FAA AC 25.1309-1A and retained in the draft
revision to AC 25.1309-1A proposed by the ARAC.
The severity of the external environmental conditions that should
be considered when demonstrating compliance with this rule are those
established by certification regulations and special conditions (e.g.,
HIRF), regardless of the associated probability. The rule also requires
that the effects of manufacturing variability, aging, wear, and likely
damage be taken into account when demonstrating compliance.
These requirements are consistent with the general powerplant
installation failure analysis requirements of Sec. 25.901(c) and the
systems failure analysis requirements of Sec. 25.1309, as they have
been applied to powerplant installations. This additional requirement
is needed because the general requirements of Secs. 25.901 and 25.1309
have not been consistently applied and documented when showing that
ignition sources are precluded from transport category airplane fuel
tanks. Compliance with Sec. 25.981 requires an analysis of the airplane
fuel tank system using analytical methods and documentation currently
used by the aviation industry in demonstrating compliance with
Secs. 25.901 and 25.1309. In order to eliminate any ambiguity as to the
necessary methods of compliance, the rule explicitly requires that the
existence of latent failures be assumed unless they are extremely
remote, which is currently required under Sec. 25.901, but not under
Sec. 25.1309. The analysis should be conducted assuming design
deficiencies listed in the background section of this document, and any
other failure modes identified within the fuel tank system functional
hazard assessment.
Based upon the evaluations required by Sec. 25.981(a), a new
requirement is added to paragraph (b) to require that critical design
configuration control limitations, inspections, or other procedures be
established as necessary to prevent development of ignition sources
within the fuel tank system, and that they be included in the
Airworthiness Limitations section of the ICA required by Sec. 25.1529.
This requirement is similar to that contained in Sec. 25.571 for
airplane structure. Appendix H to part 25 is also revised to add a
requirement to provide any mandatory fuel tank system inspections or
maintenance actions in the Airworthiness Limitations section of the
ICA.
Critical design configuration control limitations include any
information necessary to maintain those design features that have been
defined in the original type design as needed to preclude development
of ignition sources. This information is essential to ensure that
maintenance, repairs, or alterations do not unintentionally violate the
integrity of the original fuel tank system type design. An example of a
critical design configuration control limitation for current designs
discussed previously would be maintaining wire separation between FQIS
wiring and other high power electrical circuits. The original design
approval holder must define a method to ensure that this essential
information will be evident to those that may perform and approve
repairs and alterations. Visual means to
[[Page 23098]]
alert the maintenance crew must be placed in areas of the airplane
where inappropriate actions may degrade the integrity of the design
configuration. In addition, this information should be communicated by
statements in appropriate manuals, such as Wiring Diagram Manuals.
Flammability Requirements
The FAA agrees with the intent of the regulatory text recommended
by the ARAC. However, due to the short timeframe that the ARAC was
provided to complete the tasking, a sufficient detailed economic
evaluation was not completed to determine if practical means, such as
ground based inerting, were available to reduce the exposure below the
specified value of 7 percent of the operational time included in the
ARAC proposal. The FAA is adopting a more objective regulation that is
intended to minimize exposure to operation with flammable conditions in
the fuel tanks.
As discussed previously, the ARAC has submitted a recommendation to
the FAA that the FAA continue to evaluate means for minimizing the
development of flammable vapors within the fuel tanks. Development of a
definitive standard to address this recommendation will require
additional effort that will likely take some time to complete. In the
meantime, however, the FAA is aware that historically certain design
methods have been found acceptable that, when compared to readily
available alternative methods, increase the likelihood that flammable
vapors will develop in the fuel tanks. For example, in some designs,
including the Boeing Model 747, air conditioning packs have been
located immediately below a fuel tank without provisions to reduce
transfer of heat from the packs to the tank.
Therefore, in order to preclude the future use of such design
practices, Sec. 25.981 is revised to add a requirement that fuel tank
installations be designed to minimize the development of flammable
vapors in the fuel tanks. Alternatively, if an applicant concludes that
such minimization is not advantageous, it may propose means to mitigate
the effects of an ignition of fuel vapors in the fuel tanks. For
example, such means might include installation of fire suppressing
polyurethane foam.
This rule is not intended to prevent the development of flammable
vapors in fuel tanks because total prevention has currently not been
found to be feasible. Rather, it is intended as an interim measure to
preclude, in new designs, the use of design methods that result in a
relatively high likelihood that flammable vapors will develop in fuel
tanks when other practicable design methods are available that can
reduce the likelihood of such development. For example, the rule does
not prohibit installation of fuel tanks in the cargo compartment,
placing heat exchangers in fuel tanks, or locating a fuel tank in the
center wing. It does, however, require that practical means, such as
transferring heat from the fuel tank (e.g., use of ventilation or
cooling air), be incorporated into the airplane design if heat sources
were placed in or near the fuel tanks that significantly increased the
formation of flammable fuel vapors in the tank, or if the tank is
located in an area of the airplane where little or no cooling occurs.
The intent of the rule is to require that fuel tanks are not heated,
and cool at a rate equivalent to that of a wing tank in the transport
airplane being evaluated. This may require incorporating design
features to reduce flammability, for example cooling and ventilation
means or inerting for fuel tanks located in the center wing box,
horizontal stabilizer, or auxiliary fuel tanks located in the cargo
compartment. At such time as the FAA has completed the necessary
research and identified an appropriate definitive standard to address
this issue, new rulemaking will be considered to revise the standard
adopted in this rulemaking.
Applicability of Part 25 Change
The amendments to part 25 apply to all transport category airplane
models for which an application for type certification is made after
the effective date of the rule, regardless of passenger capacity or
size. In addition, as currently required by the provisions of
Sec. 21.50, applicants for any future changes to existing part 25 type
certificated airplanes, including STC's, that could introduce an
ignition source in the fuel tank system are required to provide any
necessary Instructions for Continued Airworthiness, as required by
Sec. 25.1529 and the change to the Airworthiness Limitations section,
paragraph H25.4 of Appendix H. In cases where it is determined that the
existing ICA are adequate for the continued airworthiness of the
altered product, then it should be noted on the STC, PMA supplement, or
major alteration approval.
FAA Advisory Material
In addition to the amendments presented in this rulemaking, the FAA
is continuing development of AC 25.981-1B, ``Fuel Tank Ignition Source
Prevention Guidelines'' (a revision to AC 25.981-1A), and a new AC
25.981-2, ``Fuel Tank Flammability Minimization.''
AC 25.981-1B includes consideration of failure conditions that
could result in sources of ignition of vapors within fuel tanks, and
provides guidance on how to substantiate that ignition sources will not
be present in airplane fuel tank systems following failures or
malfunctions of airplane components or systems. This AC also includes
guidance for developing any limitations for the ICA that may be
generated by the fuel tank system safety review.
AC 25.981-2 provides information and guidance concerning compliance
with the new requirements identified in this rulemaking pertaining to
minimizing the formation or mitigation of hazards from flammable fuel
air mixtures within fuel tanks.
Discussion of Comments
Thirty four commenters responded to Notice 99-18, including private
citizens, foreign aviation authorities, manufacturers of inerting
equipment, individual airplane manufacturers and operators (both
foreign and domestic), an organization representing the interests of
manufacturers of general aviation airplanes, an airline pilots
representative, an organization representing the consolidated interests
of the aviation industry worldwide, and the National Transportation
Safety Board. The majority of commenters agree in principle with the
proposals. A discussion of these comments follows, including FAA's
response, grouped by subject matter.
Discussion of Comments on Proposed SFAR
For ease of reference, throughout the following discussion, the
term ``designer'' is used to refer to all persons subject to the
requirements of the Special Federal Aviation Regulation (SFAR).
General Favorable Comments
Several commenters, including representatives of manufacturers and
operators, agree in principle with the safety review that would be
required by the proposed new SFAR to part 21 and have, in fact, already
engaged in an industry-wide initiative in this area. These commenters
state that they believe firmly that the objective of the proposed
safety review will enhance the level of safety that already exists in
the transport fleet.
[[Page 23099]]
Request to Include Smaller Part 25 Airplanes, Rotorcraft, and Part 23
Airplanes in SFAR Applicability
Several commenters disagree with the proposal to limit
applicability of the SFAR to larger airplanes (30 or more passengers)
due to the time needed to conduct a thorough economic analysis and the
possible impact it would have on small businesses. However, the
commenters request that this evaluation be completed and that smaller
transport airplanes be included because of the design similarities of
the smaller airplanes to larger airplanes.
Additionally, one commenter notes that, because the proposal
excludes a significant portion of the fleet, the proposal is not in
keeping with the FAA's stated goals of the ``One level of Safety''
initiative. This commenter also notes that the FAA stated in the notice
that applying the proposed requirements to certain regional airliners
would not significantly increase the expected quantitative benefits of
the rule because there have been no in-flight fuel tank explosions on
those airplanes. The commenter is concerned that the FAA may be using
``faulty reasoning'' to eliminate the need for any follow-on action to
address this segment of the fleet.
Another commenter strongly recommends that the SFAR be extended to
include part 23 aircraft and part 27 rotorcraft because these types of
aircraft may be susceptible to fuel tank system problems similar to
those addressed in the proposed rule.
FAA's Response: The FAA agrees that, even though the fuel tank
systems of smaller transport category airplanes may be simpler,
similarities in the designs of the fuel systems of those airplanes may
result in a need to apply the standard to them. As discussed in the
notice, we plan to conduct the appropriate economic analysis to
determine if the rule should be applied to smaller transport airplanes.
Should the results of that analysis indicate that the SFAR requirements
should be applied to smaller transports, we will consider developing
further rulemaking to address those airplanes. For now, the
applicability of the final rule will remain as proposed in the notice.
We do not agree that the proposed SFAR should be applied to part 23
aircraft and part 27 rotorcraft at this time. Service experience has
not indicated that immediate action is necessary to address the fuel
tank systems of those types of aircraft at this time. However, we may
reconsider this action if future service experience indicates that it
is warranted.
Request to Exclude Mitsubishi YS-11 Airplanes and Lockheed Electra
Airplanes
Mitsubishi Heavy Industries America, Inc., requests that the
Mitsubishi Model YS-11 airplane be excluded from the SFAR
applicability. The commenter's justification for this exclusion is that
none of these airplane models is currently being operated in the U.S.
and none are likely to be operated in the future. The commenter further
states that there has never been a fuel tank-related incident or
accident on any of these airplane models. The commenter refers to the
FAA's statement in the preamble to the notice that certain older
reciprocating engine-powered and converted turbine-powered transport
airplanes should be excluded from the rule because:
``* * * the few remaining such airplanes are in cargo service
and because their advanced age and small numbers would make
compliance impractical from an economic standpoint.''
The commenter asserts that the same rationale should be applicable
to the Model YS-11 because not one such airplane is currently operating
in the U.S. and the possibility of such airplanes ever returning to
cargo service, much less passenger service, in the U.S. is virtually
non-existent. Therefore, there are no benefits to be achieved by the
design review.
Similarly, Lockheed Martin also requests that its airplane model,
the Lockheed Model L-188 Electra airplane, be excluded from the
applicability of the SFAR. Like the first commenter, this commenter
refers to the statement in the preamble to the notice that certain
older reciprocating and turbine-powered airplanes should be excluded
because compliance would be impractical from an economic standpoint.
The commenter suggests that the Model L-188 Electra also falls into
this category and should be excluded from the rule's applicability. The
commenter further suggests that the retroactive application of the new
requirements to any older model include provisions in the rule that
would permit favorable service experience to be submitted instead of
extensive failure analysis. The commenter refers to a safety study
conducted of the Model L-188 Electra fuel system which shows that the
fuel system service experience is excellent.
FAA's Response: The FAA does not concur with these commenters'
requests to revise the applicability of the SFAR. As stated in Notice
99-18, parts 91, 121, 125, and 129 would be amended to require
operators to incorporate FAA-approved fuel tank system maintenance and
inspection instructions into their current maintenance or inspection
program of transport category airplanes type-certificated after January
1, 1958. That date was chosen so that all turbine-powered transport
category airplanes would be included, except for a few 1947 vintage
Grumman Mallards, and 1953-1958 vintage Convair Model 340 and 440
airplanes converted from reciprocating to turbine power.
We do not consider the information presented by either of the
commenters sufficient to warrant a general exclusion of either the
Model YS-11 or the Model L-188 Electra from the applicability of the
SFAR. We do acknowledge, however, that the current operations of Model
L-188 Electra airplanes to remote Aleutian points and on military
contract flights do involve unique circumstances worthy of further
consideration. For example, we might conclude that, while full
compliance is not cost effective, some lesser degree of fuel tank
system evaluation is necessary.
While there is insufficient basis on which to exclude the Model L-
188 Electra airplanes in general, the TC holder may petition the FAA
for an exemption from the provisions of this final rule showing that it
would be in the public interest. Similarly, we would consider petitions
for exemption from the SFAR for the Model YS-11 or any other airplane
not currently operated under U.S. registry. Such requests for exemption
would be handled outside of this rulemaking action. Even if an
exemption were granted from the SFAR to a design approval holder,
operators of the affected airplanes would still be subject to the
requirements of the operating rules established by this final rule.
Petitions for exemption by the operators would involve different
considerations.
Request to ``Harmonize'' the Rule With European Authorities
Several commenters, including representatives from aviation
officials of the JAA and Transport Canada, state that the proposed SFAR
should have been developed through the Aviation Rulemaking Advisory
Committee (ARAC) and its harmonization process. These commenters
contend that harmonizing the proposed rule would:
simplify operations,
reduce the cost of compliance without compromising safety,
and
extend the latest safety benefits more broadly in the
world fleet.
The commenters also state that issuing the rule under the
harmonization process would have facilitated eventual delegation of the
SFAR compliance findings between the
[[Page 23100]]
FAA and the JAA. Some commenters request that the disposition of public
comments be handled through the ARAC process.
FAA's Response: The FAA does not concur with the commenters. When
this rulemaking was initiated, we faced a choice between proceeding
unilaterally or proceeding through the harmonization process involving
the JAA and the public through ARAC. At that time, we chose to proceed
unilaterally in order to address the important safety need on an
expedited basis. In a separate action, we did task ARAC with developing
proposed regulatory text to eliminate or reduce flammability in
airplane fuel tanks. The fundamentals of ARAC's proposal are included
in this rule.
With the issuance of this rule, we consider that the safety need
has been addressed and we are now open to a harmonization effort. To
facilitate harmonization, we have coordinated the proposal with the JAA
and Transport Canada. Comments from the JAA and Transport Canada
indicate their agreement in principle with our actions, and they have
stated their intention to mandate similar fuel tank safety actions.
While we will ensure compliance with the SFAR, the operating rules, and
the part 25 design standards as adopted in this final rule, we will
continue discussions with Transport Canada and the JAA concerning
possible harmonization efforts relating to the part 25 change.
The safety improvements provided by this rule are as urgent now as
they were when we decided to proceed unilaterally. The comments do not
persuade us that the policy judgments reflected in the notice were
incorrect. Because expedited adoption of this final rule is necessary,
and because further discussion of comments within ARAC would not change
the FAA's policy determinations, further review of the proposed rule by
ARAC would not be appropriate.
Request To Delegate Compliance Findings
Several commenters request that the FAA delegate SFAR compliance
findings to the prime certification authority in accordance with the
approved bilateral agreement.
FAA's Response: The FAA interprets the reference to ``prime
certification authority'' to mean the ``state of design,'' as that term
is used in ICAO Annex 8. Because the SFAR imposes requirements on
existing designers, the bilateral airworthiness agreements, which
address new certifications, do not directly apply. To the extent that
bilateral countries choose to become involved in reviewing submissions
for compliance with the SFAR, we will work closely with them. This
should facilitate the harmonization efforts described previously.
However, under the SFAR the FAA must approve the design approval
holder's submission.
Request for Definition of Safety Review
One commenter notes that the terms ``safety review,'' ``design
review,'' ``safety analysis,'' and ``functional hazard assessment''
appear to be used interchangeably throughout the notice. However, each
of these terms could have significantly different meanings. The
commenter requests that, if it is the intent of the FAA to have
different meanings for these terms, then the definitions should be
clearly stated and the terms should be used in the appropriate context.
The commenter offers the following definitions in an attempt to
establish a unified understanding of the objectives:
``Safety Review''--a comprehensive assessment of the fuel
tank system that meets all the requirements of the Special Federal
Aviation Regulation.
``Safety Analysis''--process of ensuring that the fuel
system is fail-safe by conducting a design review and failure modes and
effects analysis.
``Design Review''--process of reviewing all relevant
engineering design drawings to ensure that appropriate design practices
have been used and identify failure modes.
``Failure Modes Analysis''--process of evaluating all
identified failure modes resulting from the design review by conducting
a failure modes and effects analysis (FMEA) and a fault tree analysis
(FTA).
The commenter requests that a similar set of definitions be
provided in the SFAR to clarify the intentions of the regulation.
FAA's Response: The FAA concurs that clarification is appropriate.
The objective of the SFAR is to require designers to conduct ``safety
reviews,'' which is the broadest term defined by the commenter. The
term ``safety review'' is the correct term that is used in the text of
the SFAR. For clarification sake, we have used the term ``safety
review'' throughout the discussions in this preamble to describe the
action required by the SFAR. No change to the final rule text is
necessary in this regard, however.
Question on the Need for a System Safety Review
One commenter considers that the proposed safety review required
under the new part 21 SFAR is excessive. This commenter regards the
proposal as essentially a requirement to re-certify the fuel systems of
all turbine-powered commercial transports, with respect to avoiding
fuel tank fires and explosions. The commenter points out that, while
more than 450 million hours of service experience on these airplanes
have identified valuable lessons learned, this same service experience
also demonstrates the largely successful outcome of the previously
certified designs. The extent of the safety review that the proposed
SFAR would require goes beyond what is commensurate with the historical
data.
FAA's Response: The FAA does not concur with the commenter that the
service history of the affected airplanes does not warrant the type of
safety review proposed. Specifically, we disagree that past service has
been ``largely successful.'' While the commenter states that the fleet
has achieved a good safety record, we point out that, as discussed in
detail in the preamble to the notice, there has been extensive service
history data related to anomalies, system failures, aging-related
problems, etc., of the fuel tanks of transport category airplanes.
Service data show that there have been 16 fuel tank explosion events.
Further, the fact that the FAA has issued over 40 airworthiness
directives to correct fuel tank safety hazards affecting a large cross
section of the transport airplane fleet indicates that extensive
revalidation of the fuel tank systems, as proposed, is necessary.
Question on Quantitative vs. Qualitative Safety Review of Older
Airplane Designs
One commenter suggests that the proposed SFAR should allow aircraft
certificated prior to Amendment 25-23 and Sec. 25.1309 reliability
requirements to undergo a qualitative--rather than quantitative--safety
review. Then, from the results of the review, an inspection or
maintenance plan could be developed, and, finally, a one-time
inspection of the entire fleet could be performed. The commenter
supports this type of assessment for several reasons:
1. The current version of Sec. 25.1309 requires a safety review and
a quantitative assessment to validate that a system is fail-safe.
However, accurate statistical reliability information needed to conduct
the safety analysis is likely to be unavailable for fuel system
components used nearly 30 years ago.
2. When conducting a safety review, conservative assumptions are
required when accurate reliability data is unavailable. These
conservative assumptions could lead to false and
[[Page 23101]]
detrimental failure probability results. This circumstance could occur
multiple times during the analysis, or even cause compounded error
effects, requiring even more severe corrective actions.
3. By the methods proposed in the proposed rule, a
``representative'' fuel tank system would be created based on 30-year-
old drawings that would be ``fraught with unavoidable assumptions,''
while at the same time be required to meet the ``extremely improbable''
failure condition probability criteria of 1 x 10 -9. This
would lead to unnecessary inspections, maintenance, repairs, and
modifications.
To meet the intent of the SFAR more effectively, the commenter
proposes that a qualitative safety review be conducted, based on:
The investigative efforts of the FAA and NTSB,
AD's,
Service bulletins,
Lessons learned,
Performance history of the aircraft, and
Results of the recent industry-wide fuel tank inspection
program.
In addition, the labor and time costs for a qualitative analysis
would be dramatically lower than for a quantitative analysis. A
qualitative analysis could be conducted using the knowledge and
experience of current in-house personnel and applying familiar methods
of evaluation. It likely would take less time, as well.
Several other commenters also question the practicality of
requiring the proposed safety review if the latest standards are to be
applied to older airplane designs. These commenters maintain that the
proposed SFAR effectively requires recertification of older airplanes'
fuel tanks to show compliance with the quantitative system safety
assessment requirements introduced in Sec. 25.1309 of Amendment 25-23.
The commenters point out that those requirements were neither developed
nor in effect for the airplanes whose certification basis was approved
prior to the time that Amendment 25-23 was issued in May 1970. The
majority of the airplanes affected by the proposed SFAR fall into this
category.
Further, the commenters note that quantitative analysis methods for
showing compliance with the requirements of Amendment 25-23 were not
even developed or approved by the FAA until June 1988, when the FAA
issued guidance on this subject in Advisory Circular 25.1309-1A. These
methods were not necessarily applied to aircraft certified before that
date. Thus, the certification documentation and technical archives of
pre-amendment 25-23 aircraft may be limited in their usefulness to
support a formalized analysis.
These commenters also state that re-evaluation of older aircraft
types using today's quantitative analysis methodologies, such as a
failure modes and effects analysis (FMEA), would be impractical and
present ``insurmountable difficulties,'' given the unavailability of
data and the resources required. One commenter states that this type of
safety review would be extremely labor-and resource-intensive, and
would have both short- and long-term adverse economic effects on the
aviation industry.
Another commenter states that the proposal does not provide a
simple design-assessment method that is compatible with the technical
information available to TC and STC holders. (The commenter gave no
examples of incompatibility, however.)
FAA's Response: The FAA recognizes that the fuel tank systems of
most older transport airplane designs were not evaluated during
certification using the quantitative safety assessment methods
associated with Sec. 25.1309. For these airplanes, the FAA agrees that
a qualitative, rather than quantitative, approach can and should be
used where possible for the fuel tank system safety review. The level
of analysis required to show that ignition sources will not develop
will depend upon the specific design features of the fuel tank system
being evaluated. Detailed quantitative analysis should not be necessary
if a qualitative safety assessment shows that features incorporated
into the fuel tank system design protect against the development of
ignition sources within the fuel tank system. For example, for wiring
entering the fuel tanks, compliance demonstration could be shown in
three steps.
First, the wiring could be shown to have protective
features such as separation, shielding, or transient suppression
devices;
Second, the effectiveness of those features could be
demonstrated; and
Third, any long-term maintenance requirements or critical
design configuration limitations could be defined so that the
protective features are not degraded.
Another example would be showing that fuel pumps are installed in
such a way that the fuel pump inlet remains covered whenever the fuel
pump is operating throughout the airplane operating attitude envelope,
including anticipated low fuel operations and ground conditions. This
could be a satisfactory method of meeting the fail-safe requirement for
the fuel pump mechanical components, although it would not necessarily
address fuel pump motor failure modes. (Advisory Circular 25.981-1B
provides additional guidance on the acceptability of qualitative
assessments where fail-safe features are provided.)
Additionally, if fail-safe features are incorporated into the
design in such a way that the effects of other systems on the fuel tank
system can be shown to be benign, then no additional design assessment
and inspections would be required. Designers using this approach would
be required to provide substantiation that the design features preclude
the need for detailed design assessment of the system and future
inspections. Designers considering using this approach should
coordinate as early as possible with the cognizant ACO.
On the other hand, the fact that a quantitative assessment and
related data do not currently exist for some older airplane types does
not mean that a similar safety assessment cannot be accomplished on
these airplanes. It is feasible to use a modern safety assessment
method on older airplanes that will recognize and evaluate potential
failures and their effects, and will identify actions that could
eliminate or reduce the chance of a potential failure from occurring.
Methods for conducting a quantitative analysis of any system are
well-established and readily available. For example, the FMEA and fault
tree analysis methodology is widely accepted and understood. In fact,
there currently are several software packages available commercially
that are specifically designed for assisting in developing FMEA's;
these have proven to be particularly useful in reducing the amount of
time, labor, clerical support, and monetary burden that normally would
be entailed.
In light of this, we anticipate that all affected TC and STC
holders will be fully capable of complying with the SFAR requirements.
No change to the final rule is necessary with regard to these
comments. The rule requires that applicants ``conduct a safety review''
of the airplane, but does not specify any particular method of review.
Question on Intent of Safety Review
One commenter questions the FAA's intent regarding the safety
review. This commenter notes that the proposed SFAR states, `` * * *
single failures will not jeopardize the safe operation * * * `` and ``
* * * latent failures have to be assumed * * *'' However, there are a
[[Page 23102]]
number of single failures identified in the SFAR that have the
capability to create an ignition source within the fuel tank. Examples
include:
Various mechanical pump failure modes,
Various electrical pump failure modes, and
Arcing of pump power cables to the conduit.
There are a number of single failures within the examples listed
above that would not be acceptable to show compliance in accordance
with the current application of Sec. 25.1309, which requires that `` *
* * failure of any single component should be assumed * * * and not
prevent continued safe flight * * *'' In light of this, the commenter
asks if the FAA is expecting modifications to cover all these cases; if
not, there is a risk that the interpretation of Sec. 25.1309 may be
degraded.
The commenter further states that there are a number of latent
failures in fuel tanks that could create an ignition source within the
fuel tank, for example:
Loss of pump over-temperature protection, and
Loss of bonding (electro-static and lightning protection).
These types of latent failures are not easy to detect without a
physical inspection inside the tank. The commenter asks how these types
of latent failures will be considered when assessing the safety of fuel
tanks. Clearly, frequent internal inspections of fuel tanks are not
acceptable, and some means for agreeing to certain design practices on
existing aircraft may be needed.
FAA's Response: The intent of the safety review, as stated in the
notice, is to apply current system safety assessment standards to the
affected airplanes in the existing transport fleet. We fully expect
that, where fail-safe features do not exist, modifications to designs
and changes to maintenance practices will be required for a significant
portion of the fleet to address the single and multiple failures noted
by the commenter. If inspections to detect latent failures are
impractical, it would be necessary to modify the design to provide
fail-safe features or indications to eliminate latency.
Request for a Lessons Learned Approach
Certain commenters state that the proposed safety review would be
more useful if it were based strictly on lessons learned, and request
that the proposal be changed accordingly. The commenters propose an
alternative method that would be based on service experience (lessons
learned) and regulated as a ``prescriptive-type rule.'' As an example,
the commenters suggest that the FAA first define a comprehensive list
of items that may not have been considered adequately in the original
fuel system design and for which there is some service experience. The
list could include such items as:
Fuel pumps,
Wiring to pumps in conduits located inside fuel tanks,
Fuel pump connectors,
Fuel quantity indicating system wiring and probes, and
Component bonding.
The FAA could then require that fuel system designs be evaluated
against this ``checklist'' to determine if adequate consideration has
been made regarding the potential effects of each item listed. Any
single failures shown to cause an ignition source in the fuel tank
would warrant a design change. A quantitative fault tree analysis could
then be developed for combinations of failures shown to cause ignition
sources, to determine if such failure combinations could be expected to
occur in the remaining fleet life of the affected aircraft type.
These commenters state that among the benefits of this prescriptive
design review approach would be:
A common evaluation criterion for each aircraft type,
regardless of its certification basis.
A more objective evaluation process that simplifies
delegating the compliance-finding task by the FAA and ensures equal
treatment for each manufacturer and operator.
Faster completion of the task, submittal of the report to
the FAA, and resolution of any deficiencies in the existing fleet.
Development of a standardized report or checklist to ease
the compliance-finding process.
A far greater pool of people able to accomplish the task,
because a prescriptive review method would not demand engineers with
detailed expertise in fuel systems and safety assessment methodology.
These commenters maintain that the FAA's safety review proposed in
the SFAR would be merely an additional burden that could interfere with
realizing the benefits of lessons learned. They consider that their
suggested alternative approach is more practical, and equally effective
in enhancing fuel system safety.
FAA's Response: The FAA does not concur with these commenters'
request. To conduct a safety review based solely on lessons learned
would not provide the level of safety that is intended by the proposal.
A lessons learned focus would address problems that were known to have
occurred in the past; however, it would not necessarily address
potential problems and risks that could occur in the future. Thus, a
lessons learned focus is a reactive, not a proactive, approach. There
may be unforeseen failure modes that would not necessarily be accounted
for by only evaluating failure modes that have occurred in the past, as
would be done with a lessons-learned approach.
One example is in AC 25.981-1A, published originally in 1971, which
included a list of failure modes, based upon lessons learned at that
time, that should have been considered in showing compliance with the
requirements of Sec. 25.981. Since that AC was published, however,
numerous unforeseen failures have occurred, thus, resulting in a much
longer list that is now included in the revision to that AC. While such
a list is valuable in providing guidance for conducting a safety
assessment, it is not all-inclusive and we do not consider it adequate
for conducting a comprehensive safety assessment.
On the other hand, the qualitative approach to the required safety
review will result in consideration of, and means to address, potential
failure modes, even if they have not yet been encountered in service.
For example, if a qualitative assessment indicated that a particular
design feature could result in a high voltage electrical surge into the
fuel tank, then the assessment would conclude that measures should be
taken to prevent such an occurrence, regardless of whether it is a
``lesson learned'' based on past occurrences.
Request for Risk Assessment Only of Remaining Fleet Life
One commenter suggests that the safety review methodology proposed
by the FAA should provide a risk assessment over the remaining fleet
life of each aircraft type. Many of the aircraft types that would be
affected by the proposed SFAR are approaching the end of their fleet
lives. The commenter asserts that, when determining if safety reviews
and resulting design changes are warranted, the consideration should be
based upon a risk assessment based on the remaining fleet life.
FAA's Response: The FAA agrees that the remaining fleet life could
be one consideration in establishing a basis for an exemption from the
requirement to perform a safety review for particular models, but it is
not a general basis for limiting the applicability of the proposal.
While some models of airplanes have exceeded their economic design goal
(for example the Boeing Model 727 and McDonnell Douglas
[[Page 23103]]
Model DC-9), there are individual airplanes of those models that are
still in service, and extensive future service life is planned for
them. Consequently, exposure to the risk of fuel tank explosions
remains as valid for these models as for any others in service.
Regarding whether resulting design changes are warranted, those
changes would necessarily be mandated by separate regulatory actions
(AD's). Therefore, whether the changes are warranted will be assessed
in the context of those actions.
Request for Change in Compliance Time for Conducting Safety Review
Several commenters state that the 12-month compliance time for
completing the required actions proposed under the SFAR is unrealistic,
and request a longer period for compliance. The reasons that these
commenters give are as follows:
First, industry lacks the resources to accomplish the requirements
within the proposed timeframe. There are limited qualified personnel to
conduct the level of safety review that the proposed SFAR would
require. Formalized system safety analysis of the type outlined in AC
25.1309-1A requires specialists with extensive knowledge of the system
architecture, component details, and service history, as well as the
analysis methodology.
Second, the flow time necessary to perform the proposed safety
review would exceed the proposed compliance time. The commenters point
out that over 100 airplane models would need to be reviewed, and the
proposed safety review methodology would require two to four years of
effort per major model for large transport aircraft. Some major models
of airplanes have numerous minor model variations. These minor model
variations would add significant additional review effort. Availability
of qualified engineers does not allow these reviews to be conducted in
a completely parallel fashion. Assuming a 9-month flow time to
accomplish each review and the capability to conduct up to three
reviews simultaneously, some manufacturers would require well in excess
of 45 months to complete the proposed reviews. In other instances, the
resources available to some TC or STC holders may limit their
capability to one safety review at a time. These estimates take into
account work already accomplished by the industry over the past 4
years.
Third, development of the maintenance instructions could not
possibly be accomplished within the proposed 12-month compliance time.
As written, the proposed SFAR would require ``all maintenance and
inspection instructions necessary'' to be submitted as part of the
safety review report. However, the commenters assert that effective
development of a maintenance program cannot practically start until the
safety review is completed, and it must be developed in coordination
with the operators and regulatory agencies. Therefore, submittal of the
maintenance and inspection instructions as part of the safety review
report is not feasible. The commenters request that the proposal be
revised to allow a period of 6 to 8 months for the development of these
instructions once the FAA has approved the safety review report.
Fourth, necessary design changes identified as a result of the
safety review could not be developed, evaluated, and shown to comply
with the new requirements within the proposed compliance time. The
commenters request that the compliance time for design change activity
be treated separately from the SFAR review activity.
Fifth, the FAA itself lacks resources to support timely review of
the safety review reports required by the SFAR within the 12-month time
proposed to complete the review. The commenters believe that the FAA
has grossly underestimated its own flow times regarding coordination
and approval of the SFAR-mandated safety reviews and resulting
compliance substantiation documents. Experience has shown that the FAA
typically takes 60 to 90 days to review and approve of documents of
this kind. Multiplied by 100 reports or more, it would appear that the
FAA itself would require more than the proposed 12 months compliance
time to complete its review and approval cycle once the reports are
submitted by the industry.
Another commenter considers that the proposed compliance time for
developing the maintenance and inspection program is inadequate. The
commenter asserts that, without the insights gained through the SFAR
design review assessment process, any attempts to accurately revise
existing maintenance and inspection programs would be
``counterproductive'' to the goals of the proposed rule. The commenter
maintains that the FAA underestimates the time necessary to prepare and
develop the maintenance program, receive approval, and implement the
program. This commenter requests that the proposed rule be changed to
allow more time for revising the operator's maintenance or inspection
programs, and that this time start only after the completion of the
design review and the manufacturers' maintenance program for each
airplane model.
Certain other commenters request that the proposal be changed to
include the following text:
``Compliance time:
(a) All design review reports must be submitted to the
Administrator no later than 36 months after the effective date of
this rule or within 18 months of the issuance of a certificate for
which application was filed before [effective date of the rule],
whichever is later.
(b) Maintenance and inspection instructions must be submitted to
the Administrator no later than 8 months after the FAA has approved
the design review report for the applicable aircraft type.''
Others request that the compliance time for completion of the
safety review should be extended to 54 months.
FAA's Response: The FAA has considered the reasons for the
commenters' requests and concurs that the compliance time should be
extended somewhat. We have revised the final rule to provide a
compliance time of 18 months for conducting the safety reviews and
submitting them to the FAA. Even for those designers who work closely
with the appropriate ACO's in conducting their reviews, we acknowledge
that, following submission, some time will be required for FAA review
and for any necessary revisions, and we consider that 6 months should
be adequate for those activities. We are aware that when the FAA has
mandated maintenance program changes in the past, we have typically
allowed operators 12 months to incorporate those changes into their
programs. Therefore, we have revised the operating rules to require
that operators incorporate the maintenance program changes within 36
months after the effective date.
Designers may allocate the 18-month compliance time between the
safety review and the development of maintenance and inspection
instructions as they deem appropriate. In evaluating the information
presented by the commenters and the relevant safety concerns, we have
determined that this revision can be made without significantly
affecting safety.
These revised compliance times are not as long as those requested
by the commenters for the following reasons:
The commenters based their estimates on the assumption
that a quantitative assessment would be required. As discussed
previously, in most cases a less time-consuming qualitative assessment
will be sufficient.
There is a substantial degree of commonality in design
features of the affected models. Such commonality will
[[Page 23104]]
allow analysis to be conducted by similarity to previously reviewed
designs. In light of this, we do not foresee designers needing to
conduct a separate safety analysis ``from scratch'' for each model.
Since the TWA 800 accident over 4 years ago, many
manufacturers already have completed significant reviews of service
history and analysis of fuel tank designs for many airplane types. This
will significantly reduce the time and resources that will be needed to
complete the requirements of the SFAR.
We expect that industry will work closely with the
cognizant ACO in planning the safety review, and providing feedback as
the evaluation progresses. This should allow expedited approval by the
local office.
Given the additional time provided in the final rule, we are
confident that the technical capability exists and that industry will
expend the resources needed to address this critical safety issue in a
timely manner.
As for the compliance time for development of needed design
changes, we have revised the text of the final rule to include a
provision that would allow extensions of the compliance time on a case-
by-case basis. The final rule states that the FAA may grant an
extension of the compliance time if:
The safety review is completed within the compliance time,
and
Necessary design changes are identified within the
compliance time, and
Additional time can be justified.
Request for Clarification of SFAR Applicability to STC Holders
Two commenters state that, as worded, the proposed SFAR text does
not clearly specify that it applies to holders of STC modifications
that may have no direct relationship to the fuel system, but could have
an effect on fuel tank safety. The commenters are concerned that some
readers may misconstrue the current text as referring only to STC's for
modifications directly to the fuel tank system, and not STC's that are
adjacent to the fuel tank and may indirectly affect them.
One of these commenters recommends that the proposed phrase
``supplemental type certificates affecting the airplane fuel tank
system'' be revised to ``supplemental type certificates capable of
affecting the airplane fuel tank system.'' The other commenter suggests
that the phrase be revised to ``supplemental type certificates
modifying the airplane fuel tank system.''
The commenters consider that adding the suggested words would make
it clear that the SFAR applies not just to fuel system STC's, but to
all STC's that could affect the fuel system.
FAA's Response: The FAA concurs with the commenters that a change
in the text of the SFAR is necessary to clarify the intent. It was the
FAA's intent that the SFAR requirements were to apply to holders of
STC's that may affect the fuel system or result in a fuel tank ignition
source. This was explained in detail in the preamble to the notice, and
that discussion is repeated in this final rule under the heading,
``Supplemental Type Certificates,'' above.
Based on the comments, we recognize that the proposed text could be
construed too narrowly; that is, construed to mean that the
requirements apply only to STC modifications that actually change the
fuel tank system. We also recognize that it may not be possible to
determine whether a modification actually affects the safety of the
fuel tank system without conducting at least a rudimentary qualitative
evaluation. In order to clarify this point, we have revised the text of
the final rule to state that the SFAR applies to all holders of type
certificates and supplemental type certificates that ``may affect'' the
safety of the fuel tank system.
Request for Clarification of SFAR Requirements for STC's Not Directly
Related to Fuel Tanks
One commenter raises concerns about the requirements of the
proposed rule as they apply to STC approvals of modifications that are
not specifically fuel tank system modifications. These types of
approvals are referred to as ``non-ATA 28 STC approvals.'' (``ATA 28
STC's'' refers to approvals that actually change the fuel tank system.)
Specifically, the commenter questions the feasibility of conducting a
safety review on the types of modifications whose installation(s) do
not actually change, but could affect, the airplane fuel tank system.
The commenter requests that the FAA consider a separate requirement
in the SFAR for assessing the effect of these non-ATA 28 STC's on the
fuel system. The commenter asserts that airplanes on which non-ATA 28
STC's are installed should only be assessed qualitatively or by
inspection, and that only two key areas need to be examined:
1. The modification of wiring next to or near wiring that enters
the fuel tank. These commenters suggest that the effects of these STC's
could be assessed by a one-time inspection performed on each aircraft
model by a specific time, such as:
At the next heavy-maintenance inspection interval where
the area or zone is opened and accessed, or
In conjunction with any downtime necessitated by a
modification program resulting from the safety review required by the
proposed SFAR.
The objective of the suggested inspection would be to examine
wiring that enters the fuel tank and assess whether any STC
modifications introduce non-conformities that may compromise the fail-
safe design concept or may be a possible fuel tank ignition source.
(Only the wiring external to the tank would need to be inspected.) The
nonconformity would be established based on a listing of specific
inspection guidelines issued by either the FAA (possibly in the revised
AC 25.981-1B) or the OEM's for each aircraft model. As with the SFAR
safety review, any non-conformity would be identified and reported to
the design approval holder.
As alternatives to this one-time inspection, the commenter
suggests:
A qualitative design review could be conducted, if
sufficient technical information is available regarding the
installation of the pertinent STC's.
Alternative methods could be conducted that ensure the
continued airworthiness of the airplane (with respect to wiring that
enters the fuel tank). For example, installation of a transient
suppression device should eliminate the need to inspect or conduct
design reviews of modifications that might otherwise affect FQIS
wiring.
2. The effect of modifications to the environmental control system
(ECS) and other system modifications capable of generating autoignition
temperature into the tank structure. The commenter states that a
qualitative review of these systems should be conducted by reviewing
whether the approved configuration has been altered. If it has been
altered, the operator would identify the alteration and ``report it to
the person responsible'' (i.e., the design approval holder of the
design modification).
The commenter states that a one-time inspection process, as
described above, would need to be developed using:
The OEM's or STC holder's list of general design practices
and precautions obtained during their SFAR safety reviews, and
The revised maintenance program produced from the SFAR
safety review.
The commenters foresee this information as providing operators with
guidelines on what to inspect, how to inspect, and what the pass/fail
criteria are.
The commenter suggests that this inspection should not repeat the
[[Page 23105]]
inspections that have been performed to date by the operator. (For
example, the operator should receive credit for any inspections
performed because of an airworthiness directive or part of the
industry-wide Fuel System Safety Program.)
FAA's Response: The FAA does not concur with the commenter's
suggestion for several reasons. Although the commenter characterizes
its proposal as a ``qualitative review,'' it would only result in an
inspection for ``non-conformities,'' with the inspection results
forwarded to the design approval holder. The suggestion does not
specify what, if any, obligation the design approval holder would have
to address these non-conformities, which, by definition, are not part
of the holder's approved design. It would be unreasonable to impose an
obligation on design approval holders to conduct reviews of designs for
which they are not responsible. In light of this commenter's adverse
comments regarding imposing a requirement for such holders to review
their own designs, imposing an additional obligation is inconsistent.
In addition, the commenter's suggestion would result in a long
delay in completion of the safety review of the fuel tank system. For
example, the commenter suggests that the inspection take place during a
heavy maintenance inspection; however, the heavy maintenance inspection
intervals are typically every 4 to 5 years. Once the airplane
configuration was determined, additional time would be needed to
complete the assessment and to develop any necessary maintenance and
inspection programs or design changes. The alternative process
suggested by the commenters could effectively postpone addressing the
effects of wiring on the fuel tank system by as much as 7 or 8 years.
The elapsed time to complete this process would not provide the level
of safety intended by the FAA or expected by the public.
Question on SFAR Requirements for STC's Where No Technical Data Is
Available
Several commenters raise a concern about the proposed SFAR
requirements as they pertain to a safety review of pertinent STC's
where the STC holder is out of business and the necessary technical
data is not readily available. The commenters expect that, for these
cases, the burden would fall on the operators to conduct the review
required by the SFAR. The commenters are concerned that, for a large
number of these operators, the review process for these types of STC's
may present ``an insurmountable burden'' for the following reasons:
A full review of modifications accomplished by the
operators over the decades that some of the affected airplanes have
been operated is impracticable.
Where operators have sold aircraft to another party, it is
possible that the current owner of the airplane may come back to the
operator and require such an evaluation. This situation is
unmanageable.
Operators will have difficulty performing any type of
quantitative analysis due to lack of intensive familiarity with these
types of methods.
The technical information required to perform a
quantitative or qualitative analysis may not be available or may not
pertain to the specific aircraft model.
Involvement by the original equipment manufacturer (OEM)
in providing operators with assistance is viewed by the operators as
likely to be minimal.
The commenters are particularly concerned that the OEM's are
probably not familiar with many of the STC's that have been
incorporated on the aircraft. Further, the chance of obtaining an
assistance contract with the OEMs is slim because they will be
stretched for manpower supporting OEM responsibilities relating to the
proposed SFAR.
Additionally, the commenters are concerned that technical
assistance from the FAA's fuel system specialists cannot be ensured for
the operators. The FAA may be prepared to work with the affected type
certificate holders to assist them in complying with the requirements
of the proposed SFAR, but such assistance may not be possible for
operators in this situation due to a lack of manpower.
FAA's Response: The FAA does not agree that the proposed rule would
impose ``insurmountable burdens'' on operators. As with all operating
rules, the person ultimately responsible for compliance is the
operator. But this rulemaking is unique in the extent to which current
designers are required to provide operators with analysis and
documentation of maintenance programs to support operators in
fulfilling their obligations.
The existing operating rules generally require operators to
maintain their aircraft in an airworthy condition. A prerequisite for
maintaining an airplane is the ability to understand its configuration,
at least with respect to safety critical systems. This is reflected in
operating rules such as Sec. 121.380(a)(2)(vii), which requires a list
of current major alterations to be retained permanently, and
Sec. 121.380a, which requires that these records be transferred with
the airplane.
This rulemaking originated from the FAA's conclusion that fuel tank
systems on current transport category airplanes may not be airworthy,
and that the seriousness of this safety issue warrants substantial
efforts to identify safety problems in order to prevent future
accidents such as TWA 800. It is unacceptable for operators to claim
not only that they are currently unable to understand the
configurations of these systems on their airplanes, but that it is
unreasonable to expect them to gain that understanding. The objective
of this rulemaking would be defeated if operators of airplanes with
configuration changes were allowed to rely solely on the instructions
developed by TC and STC holders that may not reflect the actual
configurations. This would allow for hazards introduced by the
configuration changes to remain unaddressed.
As discussed previously, this same commenter suggests a one-time
inspection to identify certain aspects of the configuration. We concur
that, for those operators who cannot otherwise identify their
airplanes' configurations, a one-time inspection of the entire system
may be an appropriate means of determining the configurations. Once the
configuration is known, the operator can perform a safety review of
configuration changes not included in the TC holder and relevant STC
holder reviews. As discussed previously, this type of review may be
qualitative and does not require a quantitative analysis. In performing
this review, the operator can use the guidance provided in AC 25.981-1B
and the TC and relevant STC holder maintenance and inspection programs.
These operators could begin inspecting these airplanes immediately
so that the differences from the TC and STC configurations can be
documented and taken into consideration in the system safety assessment
and any subsequent maintenance and inspection instructions. While
operators may not have adequate engineering resources to complete the
evaluations and may not be able to rely on TC holders for support in
evaluating these changes, technical assistance contracts and use of
Designated Engineering Representatives (DERs) are possible methods of
completing the necessary work.
While we are confident that operators are capable of complying with
these requirements, we recognize the validity of the operators concerns
regarding the compliance time. Because it is important that this review
be done
[[Page 23106]]
properly, the compliance time for implementing the resulting
maintenance and inspection programs is extended from 18 months to 36
months. This provides the operators an additional 18 months after the
TC and STC holders are required to complete their programs, to complete
the safety review of any field approvals on their airplanes, develop a
comprehensive maintenance or inspection program, and implement the FAA
approved maintenance or inspection program. We consider this sufficient
to address any design changes identified by the operators.
Question on Applicability of SFAR to Modifications Installed via Field
Approvals
One commenter points out that, in the preamble to the notice where
changes to the operating requirements were explained, the FAA included
a discussion of the effect of those requirements on field approvals.
[``Field approvals'' are defined as those design changes approved by an
authorized FAA aviation safety inspector (e.g., Principal Maintenance
Inspector, PMI) on an FAA Form 337, ``Major Repair and Alteration,'' or
other document (e.g., an airline engineering order).] However, the
preamble did not include a discussion of field approvals in the context
of the proposed SFAR. Further, the proposed text of neither the SFAR
nor the operating requirements contains any mention of field approvals.
Thus, the commenter questions whether the proposed rule actually
applies to field approvals whose installations may affect the airplane
fuel tank system. Additionally, the commenter questions whether other
forms of repairs or modifications permitted on in-service aircraft and
not specifically mentioned in the SFAR (for example, approvals used by
airlines via SFAR 36 repairs) need to be considered within the context
of the proposed rule.
If the FAA intends that all repairs be considered under the rule's
requirements, then the commenter requests that field approvals,
approved repairs, and so on, be considered in the same fashion as non-
ATA 28 STC's (discussed above).
Similarly, another commenter states that modifications approved
under a field approval may prove to be problematic when attempting to
comply with the safety review analysis that would be required by the
proposed SFAR. These types of modifications were discussed in the
preamble to the notice, but were not accounted for in the economic
analysis. The commenter considers that more details are needed as to
how to address them. The field approval does not have the same
visibility as an STC, and it could be substantially more difficult to
identify which of these types of modification could affect the fuel
systems. Furthermore, many might have been approved by an inspector,
without certification engineering analysis and data; this would
certainly complicate the safety review analysis required by the SFAR.
Such modifications are of interest even to foreign parties as they
might have been incorporated on aircraft that are now on foreign
registries. The commenter requests that the FAA provide more details as
to how it intends to apply the SFAR to the modifications approved under
a field approval.
FAA's Response: The FAA recognizes that some clarification is
necessary. The preamble to the notice and the Discussion of the Final
Rule section of this preamble state that the proposed requirements are
intended to apply to type designs, supplemental type designs, and field
approvals.
The FAA is aware that a significant number of changes to transport
category airplane fuel tank systems have been incorporated through
field approvals. These changes may significantly affect the safety of
the fuel tank system. As discussed previously, the operator of any
airplane with such changes would be required to identify them, complete
a safety assessment taking into consideration the safety assessments
completed by the TC and STC holders, and to develop applicable
maintenance and inspection instructions and submit them to the FAA for
approval, together with the necessary substantiation of compliance with
the safety review requirements of the SFAR. To eliminate any
misunderstanding, the operational final rules have been revised to
state that the instructions for maintenance and inspection of the fuel
tank system must address the actual configuration of each affected
airplane.
Question on Applicability of SFAR to Repairs
One commenter requests more details concerning how the proposed
safety review required by the SFAR would be applicable to repairs that
currently exist on an airplane. The commenter points out that the
proposed SFAR text omits any mention of repairs. The commenter states
that it would be very difficult to trace back all the repairs, and
their supporting engineering data, so that a proper safety analysis
could be carried out. The commenter believes that these repairs, like
``orphan STC's,'' might render the design review by safety analysis
approach unworkable in many cases. To help the operators, the
manufacturers should be required to provide for an alternative to the
safety assessment.
FAA's Response: As discussed above, the FAA intends that the
instructions required by the operating rules address the actual
configurations of the airplanes. As required by 14 CFR 43.13, a repair
must restore the airplane to its original or properly altered
condition. Therefore, repairs should not adversely affect fuel tank
system safety. To the extent that known repairs may have changed design
features affecting fuel tank system safety, they should be addressed in
the maintenance and inspection instructions. We recognize that, unlike
records of major alterations, repair records are not required to be
retained permanently. If operators are unaware of such repairs, this
rule does not require that inspections be conducted solely for the
purpose of identifying them. On the other hand, if such repairs are
identified as a result of inspections performed to identify
configuration changes, those repairs must be addressed in the
instructions.
Request for Clarification on Role of the Principal Maintenance
Inspector in SFAR Actions
One commenter requests a clarification of the role of the principal
maintenance inspector (PMI) in the fuel tank safety review process that
would be required by the SFAR. The commenter states that there must be
technical information available at the airline or PMI level to
effectively carry out the objective of the proposed SFAR. However, the
commenter is concerned that, even though there will be guidelines
available in the new AC 25.981-1B, a PMI ``will not have the expertise
to be able to evaluate whether an alternative truly satisfies the
SFAR.''
FAA's Response: The FAA does not intend that the PMI would evaluate
the technical design information. As stated in the preamble to the
notice and the Discussion of the Final Rule section of this preamble,
the FAA would require that this information be submitted to the
cognizant FAA Aircraft Certification Office (ACO). The maintenance and
inspection program that is generated also would be approved by the
cognizant ACO. The PMI would be responsible for oversight of the
operator to verify that any mandatory maintenance or inspection actions
are incorporated into the operators' maintenance or inspection
programs.
[[Page 23107]]
Request for a One-Time Inspection Program
One commenter requests a revision to the proposed rule to require
that, prior to conducting a system safety review and analysis for each
aircraft type, a detailed inspection should be conducted of the fuel
tanks of several representative airplanes for each type certificated
aircraft. The purpose of the inspection would be to determine the
specific health of the fleet. The inspection should span both old and
newer airplanes, and include at least two operators and at least 10
airplanes. The commenter suggests that this should be a very aggressive
inspection, which would involve removal and teardown of components and
inspection of difficult-to-reach areas. The deficiencies and failures
listed in the notice, as well as the findings of the industry-wide
inspections of the Boeing 747 fuel tanks, could provide a starting
point for defining the nature of the inspections. Based on findings of
these inspections, appropriate corrective action could be determined
and mandated. Required design changes would become apparent as a result
of this inspection program.
The commenter states that there are precedents to this type of
inspection. For example, the United States Air Force conducted
aggressive inspections of B-52 and KC-135 aircraft in the 1980's to
establish the condition of these aircraft, and required corrective
action for continued safe operation of these aging aircraft. These
inspection programs, referred to as Condition Assessment/Inspection
Programs (CA/IP), were conducted for many of the same concerns that
were raised in the notice, although the programs covered other aircraft
systems as well (i.e., electrical, avionic, hydraulic, pneumatic,
etc.). The CA/IP findings resulted in numerous fuel system corrective
actions to enhance safety, including maintenance actions and intervals,
and design improvements.
FAA's Response: The FAA does not concur with the suggestions of
this commenter for several reasons:
There already have been ample inspections, service history reviews,
and other assessments of the transport fleet that have confirmed,
without question, that the safety of the fuel tank systems on these
airplanes must be improved. Most recently, the industry-led Fuel Tank
Safety Team conducted an inspection of over 800 transport category
airplane fuel tanks, which revealed such things as repairs and
alterations that may result in a fuel tank system that does not meet
the original type design; improperly installed parts; improperly routed
wiring; etc.
We do not consider that the commenters' suggested one-time
inspection is necessary for airplanes for which the configuration can
be identified by other means. Nevertheless, the development of critical
design configuration control limitations and mandatory maintenance and
inspection items will likely result in eventual inspection of all
critical fuel tank system-related areas of airplanes in the transport
fleet.
Question on Redundant vs. Single-Thread Fuel Tank Systems
One commenter questions a statement in the preamble to the notice
that introduced the FAA's discussion of its review of maintenance
practices for the fuel tank system. The statement read,
Typical transport category airplane fuel tank systems are
designed with redundancy and fault indication features such that
single component failures do not result in any significant reduction
in safety.
The commenter maintains that just the opposite is true: Current
designs are single-thread systems. That is because there will be an
explosive mixture in the tank on a regular basis, and there is likely
to be debris in the tank, so any single failure, such as a hot short,
will compromise safety. The same is true for pump insulation failures.
FAA's Response: The FAA disagrees with this commenter's
observations in part. Regulations applicable to airplanes affected by
this rulemaking require that ``no single failure or likely combination
of failures may result in a hazard.'' However, we do agree that the
investigation of fuel tank system designs has shown certain
installations do not meet this requirement. This is one of the purposes
for the requirements of this rulemaking action.
Request for Clarification of Statement of Probability
One commenter disagrees with a statement that appeared in the
preamble to the notice, which stated:
The proposed SFAR would require the design approval holder to
perform a safety review of the fuel tank system to show that fuel
tank fires or explosions will not occur on airplanes of the approved
design.
The commenter states that it is impossible to show that ``fuel tank
fires or explosions will not occur,'' because the probability of such
an event, in terms of a system safety analysis, cannot be shown to be
equal to zero. The commenter believes that this is not what the FAA
intended. The commenter suggests that this phrase be removed because
the essence of the requirement of the proposed SFAR is captured in
another passage that appeared immediately after the cited phrase in the
preamble to the notice, which read:
* * * In conducting the review, the design approval holder would
be required to demonstrate compliance with the standards proposed in
this notice for Sec. 25.981(a) and (b) * * * and the existing
standards of Sec. 25.901.''
The commenter points out that the standards proposed in the notice
neither suggest nor require that the probability of the occurrence of a
fire or explosion should be zero.
Alternatively, the commenter suggests that the intent of the
regulation could be clarified to require practical elimination of
ignition sources with the intent to eliminate all sources by use of new
technology and design architecture.
FAA's Response: The FAA considers that some clarification is
necessary. We agree with the commenter that it is impossible to show
that the probability of a fuel tank explosion is equal to zero in
numerical terms. The statement cited in the notice was intended to
express in very general terms the objective of the proposed rule--that
``fuel tank fires or explosions will not occur.'' The intended level of
safety is clearly defined in the regulatory text. We concur with the
clarification of intent provided by the commenter.
Request To Address Third Party Maintenance Activity in Safety Review
One commenter notes that experience has shown that unauthorized
processes and materials are sometimes used by third party repair
businesses, possibly even unknown to the designer. This may result in
service problems that would be unforeseen by the designer, and possibly
a reduced level of safety. The commenter argues that it does not seem
reasonable to expect a survey of the safety of fuel system designs to
take into account the effect of unauthorized and, therefore,
unforeseeable maintenance activities. There may be features of the
design that are critical to the safe operation of the equipment, but
not obvious to a third party. The commenter requests that the FAA
consider revising the proposed regulation to ensure that maintenance
action carried out by parties not cognizant of the safety consequences
of their procedures do not jeopardize the safety of aircraft in
service.
FAA's Response: The FAA agrees in part with this commenter. The
fuel tank safety review required by this rule must include failures
that are foreseeable as well as any that have occurred in service. The
evaluation also must
[[Page 23108]]
include consideration of susceptibility to maintenance errors. The
requirement to develop critical design configuration control
limitations, discussed later, is intended to provide maintenance
personnel with precisely the type of safety critical information
identified by the commenter.
Discussion of Comments on Sec. 25.981, Fuel Tank Ignition
Prevention
Request for Revision to Requirement for Addressing Latent Failures
One commenter believes that the proposed Sec. 25.981(a)(3), which
would require demonstrating that an ignition source could not result
from single or latent failures, is too severe. The commenter asserts
that it presents requirements that are outside the scope of
Sec. 25.1309 and Sec. 25.901(c); these are the same standards that the
FAA states in the preamble to be the baseline for the proposed
requirements relative to the ignition source prevention assessment.
These regulations provide a defined method for assessing latent
failures (although the regulations do not specifically address latent
failures). The commenter favors the continued use of the fail-safe
design concept as defined in AC 25.1309-1A. The commenter maintains
that the new wording proposed by the FAA imposes a requirement on
latent failure conditions that are just one part of a larger set of
combinations leading to the hazard of ``ignition sources present in
fuel tanks.'' It is the larger set that Sec. 25.1309 imposes a
requirement on, thus taking into account the complete set of all
combinations. The commenter states that the proposed wording of
Sec. 25.981(a)(3) ``adversely penalizes'' the resulting outcome of the
analysis, in particular the definition of maintenance intervals and the
means for determining whether an added safety feature is required to
mitigate or prevent the event.
FAA's Response: The FAA disagrees with the commenter's assertion
that current industry practice is adequate to address fuel tank safety
issues. Paragraph 5.a.1. of AC 25.1309-1A, which the commenter
supports, states in part:
In any system or subsystem, the failure of any single element,
component or connection should be assumed to occur during any one
flight regardless of the likelihood that it would fail. Any such
single-failure should not prevent the continued safe flight and
landing of the airplane, nor significantly impair the ability of the
crew to cope with the resulting conditions.
Consequently, if ``any one flight'' is taken literally, this
includes flights anticipated to originate with pre-existing failures.
However, we recognize that the meaning of ``any one flight'' has been a
contentious issue for many years, and we have agreed to work within
ARAC to try and resolve the issue of ``specific risk'' for the more
generally applicable rules, such as Sec. 25.901(c) and Sec. 25.1309.
Furthermore, as noted earlier, if a more appropriate means of
addressing this issue should result from these ARAC activities, this
rule will be amended accordingly to retain consistency. This commitment
to ARAC notwithstanding, the FAA is also committed to assuring that
transport category airplane designs are acceptably fail-safe on each
flight, not just on a typical flight of mean duration or on flights
where the airplane initially has no failures present.
The FAA disagrees with the commenters' assertion that the
requirements of Sec. 25.981(a)(3) are ``outside the scope of
Sec. 25.1309 and Sec. 25.901(c).'' As stated previously in the notice
and in this final rule, the FAA's policy for compliance with
Sec. 25.901(c), in general, has been to require applicants to assume
the presence of foreseeable latent (operationally undetected) failure
conditions when demonstrating that subsequent single failures will not
jeopardize the safe operation of the airplane. This requirement
(referred to as ``latent plus one'') simply provides the same single
fault tolerance for aircraft operating with an anticipated latent
failure as would be provided by FAA Master Minimum Equipment List
(MMEL) policies if that failure is known to exist (i.e., not latent).
As for Sec. 25.1309, the commenter appears to be confusing the
objective of the rule (i.e., to prevent the occurrence of catastrophic
failure conditions that can be anticipated) with a conditionally
acceptable means of demonstrating compliance, as described in AC
25.1309-1A (i.e., that catastrophic failure conditions must have an
``average probability per flight hour'' of less than
1 x 10-9). Since this same misconception has presented
itself many times before, the following discussion is intended to
clarify the intent of the term ``extremely improbable'' and the role of
``average probability'' in demonstrating that a condition is
``extremely improbable.''
The term ``extremely improbable'' (or its predecessor term,
``extremely remote'') has been used in 14 CFR part 25 for many years.
The objective of this term has been to describe a condition (usually a
failure condition) that has a probability of occurrence so remote that
it is not anticipated to occur in service on any transport category
airplane. While a rule sets a minimum standard for all the airplanes to
which it applies, compliance determinations are necessarily limited to
individual type designs. Consequently, all that has been required of
applicants is a sufficiently conservative demonstration that a
condition is not anticipated to occur in service on the type design
being assessed.
The means of demonstrating that the occurrence of an event is
extremely improbable varies widely, depending on the type of system,
component, or situation that must be assessed. There has been a
tendency, as evidenced by the comment, to confuse the meaning of this
term with the particular means used to demonstrate compliance in those
various contexts. This has led to a misunderstanding that the term has
a different meaning in different sections of part 25.
As a rule, failure conditions arising from a single failure are not
considered extremely improbable; thus, probability assessments normally
involve failure conditions arising from multiple failures. Both
qualitative and quantitative assessments are used in practice, and both
are often necessary to some degree to support a conclusion that an
event is extremely improbable.
Qualitative methods are techniques used to structure a logical
foundation for any credible assessment. While a best-estimate
quantitative analysis is often valuable, there are many situations
where the qualitative aspects of the assessment and engineering
judgment must be relied on to a much greater degree. These situations
include those where:
There is insufficient reliability information (e.g.,
unknown operating time or conditions associated with failure data);
Dependencies among assessment variables are subtle or
unpredictable (e.g., independence of two circuit failures on the same
microchip, size and shape of impact damage due to foreign objects);
The range of an assessment variable is extreme or
indeterminate; and
Human factors play a significant role (e.g., safe outcome
dependent totally upon the flightcrew immediately, accurately, and
completely identifying and mitigating an obscure failure condition).
Qualitative compliance guidance usually involves selecting
combinations of failures that, based on experience and engineering
judgment, are considered to be just short of ``extremely improbable'',
and then demonstrating that they will not cause a catastrophe. In some
cases,
[[Page 23109]]
examples of combinations of failures necessary for a qualitative
assessment are directly provided in the rule. For example, Sec. 25.671
(concerning flight controls) sets forth several examples of
combinations of failures that are intended to help define the outermost
boundary of events that are not ``extremely improbable.'' Judgment
would dictate that other combinations, equally likely or more likely,
would also be included as not ``extremely improbable.'' However,
combinations less likely than the examples would be considered so
remote that they are not expected to occur and are, therefore,
considered extremely improbable. Another common qualitative compliance
guideline is to assume that any failure condition anticipated to be
present for more than one flight, occurring in combination with any
other single failure, is not ``extremely improbable.'' This is the
guideline, often used to find compliance with Sec. 25.901(c), that the
FAA is adopting as a standard in Sec. 25.981(a)(3).
Quantitative methods are those numerical techniques used to predict
the frequency or the probability of the various occurrences within a
qualitative analysis. Quantitative methods are vital for supporting the
conclusion that a complex condition is extremely improbable. When a
quantitative probability analysis is used, one has to accept the fact
that the probability of zero is not attainable for the occurrence of a
condition that is physically possible. Therefore, a probability level
is chosen that is small enough that, when combined with a conservative
assessment and good engineering judgment, it provides convincing
evidence that the condition would not occur in service.
For conditions that lend themselves to average probability
analysis, a guideline on the order of 1 in 1 billion is commonly used
as the maximum average probability that an ``extremely improbable''
condition can have during a typical flight hour. This 1 in 1 billion
``average probability per flight hour'' criterion was originally
derived in an effort to assure the proliferation of critical systems
would not increase the historical accident rate. This criterion was
based on an assumption that there would be no more than 100
catastrophic failure conditions per airplane. This criterion was later
adopted as guidance in AC 25.1309. The historical derivation of this
criterion should not be misinterpreted to mean that the rule is only
intended to limit the frequency of catastrophe to that historic
1 x 10-7 level. The FAA conditionally accepts the use of
this guidance only because, when combined with a conservative
assessment and good engineering judgment, it has been an effective
indicator that a condition is not anticipated to occur, at least not
for the reasons identified and assessed in the analysis. Furthermore,
decreasing this criterion to anything greater than 1 x 10-12
would not result in substantially improved designs, only increased line
maintenance. The FAA has concluded that the resulting increased
exposure to maintenance error would likely counteract any benefits from
such a change. An ARAC working group has validated these conclusions.
When using ``averages,'' care must be taken to assure that the
anticipated deviations around that ``average'' are not so extreme that
the ``peak'' values are unacceptably susceptible to inherent
uncertainties. That is to say, the risk on one flight cannot be
extremely high simply because the risk on another flight is extremely
low. An important example of the flaw in relying solely on
consideration of ``average'' risk is the ``specific risk'' that results
from operation with latent (not operationally detectable) failures. It
is this risk that is being addressed by Sec. 25.981(a)(3), as adopted
in this final rule. For example, latent failures have been identified
as the primary or contributing cause of several accidents. In 1991, a
thrust reverser deployment occurred during climb from Bangkok,
Thailand, on a Boeing Model 767 due to a latent failure in the
reversing system. In 1996, a thrust reverser deployment on a Fokker
Model F-100 airplane occurred following takeoff from Sao Paulo, Brazil,
due to a latent failure in the system. As noted earlier, the NTSB
determined that the probable cause of the TWA 800 accident was ignition
of fuel vapors in the center wing fuel from an ignition source:
* * * The source of ignition energy for the explosion could not
be determined with certainty but, of the sources evaluated by the
investigation, the most likely was a short circuit outside of the
center wing tank that allowed excessive voltage to enter it through
electrical wiring associated with the fuel quantity indication
system [FQIS].
A latent failure or condition creating a reduced arc gap in the
FQIS would have to be present to result in an ignition source. This
rule is intended to require designs that prevent operation of an
airplane with a preexisting condition or failure such as a reduced arc
gap in the FQIS (latent failure) and a subsequent single failure
resulting in a short circuit that causes an electrical arc inside the
fuel tank.
Due to variability and uncertainty in the analytical process,
predicting an average probability of 1 in 1 billion does not
necessarily mean that a condition is extremely improbable; it is simply
evidence that can be used to support the conclusion that a condition is
extremely improbable. Wherever part 25 requires that a condition be
``extremely improbable,'' the compliance method, whether qualitative,
quantitative, or a combination of the two, along with engineering
judgment, must provide convincing evidence that the condition will not
occur in service.
Request To Revise Definition of Critical Design Configuration Control
Limitations
One commenter requests that proposed Sec. 25.981(b) be changed to
revise or delete the reference to ``critical design configuration
control limitations.'' This commenter cannot agree with the definition
stated in the notice as:
* * * any information necessary to maintain those design
features that have been defined in the original type design as
needed to preclude development of ignition sources.
The commenter raises several concerns regarding the definition and
implications of critical design configuration control limitations:
First, the commenter is concerned that within the definition, ``any
information necessary'' can be interpreted as being not only the
provision of maintenance and inspection instructions, but also the
provision of the fuel tank design features itself. This could include
material specifications, specific manufacturing processes, dimensions,
etc. The commenter states that this means the type certificate holder
would be required to list its proprietary design approach, which could
lead to a loss of competitive edge and an infringement on proprietary
intellectual property. The commenter objects to this requirement
because it would allegedly sacrifice the hard earned competitive
advantage that manufacturers derive through their expertise and
continuing investment in research and development. As an example, the
commenter asserts, ``if a certain pump is qualified on the airplane,
the industry does not believe it is appropriate or necessary to list
all of the features inherent to that pump itself that were qualified as
part of the units approval. This approved parts list and the associated
installation and maintenance manuals suffice for maintaining the
airworthiness of this pump.''
Second, the commenter is concerned that this would put an
unprecedented liability risk on the type certificate holder if it omits
some features, either
[[Page 23110]]
through error or because it did not realize a supplementary function
provided by the features. (The commenter provided no further
explanation or substantiation of this concern, however.)
Third, the commenter states that the notion of critical design
configuration control limitations goes beyond the notion of inspection
and maintenance. In this regard, it does not imply the same compliance
requirement as Sec. 25.571, which is the FAA's stated precedent for the
proposed rule.
Fourth, the commenter considers that critical design configuration
control limitations go against standard industry practice regarding
what manufacturers should provide to users.
Fifth, the commenter states that the notion of critical design
configuration control limitations attempts to cover deficiencies in the
STC and the airline modification approval process by indirectly
``implicating'' the manufacturer in changes to the certificated
configuration that the manufacturer may not have known about or
performed.
For these reasons, the commenter requests that the proposed rule be
revised to delete or change the requirement concerning critical design
configuration control limitations.
FAA's Response: The FAA does not concur with the commenter's
request to revise the rule, and provides the following disposition of
each of the commenter's concerns.
1. Concern about release of proprietary information. The FAA has
always required manufacturers to provide information that is necessary
to maintain the safety of a product. For example, information that is
contained in many maintenance manuals might be considered proprietary
in nature, but the FAA requires each manufacturer to develop
instructions for continued airworthiness for their products containing
this information. Defining features of an airplane design, such as wire
separation, explosion proof features of a fuel pump, maintenance
intervals for transient suppression devices, minimum bonding jumper
resistance levels, etc., is needed so that any maintenance actions or
subsequent changes to the product made by operators or the manufacturer
do not degrade the level of safety of the original type design. The
definition of critical design configuration control limitations does
not include ``all of the features inherent'' in the design; it only
includes information that is necessary to ensure safety of fuel tank
systems. The policy determination underlying this requirement is that
design approval applicants subject to this requirement should be
required to develop this information and make it available to operators
of affected airplanes. This is consistent with the policy regarding
airworthiness limitations required by Sec. 25.571 (``Damage-tolerance
and fatigue evaluation of structure'').
2. Concern about liability of type certificate holders. The FAA
disagrees that risk of liability is an issue. If conscientiously
implemented, this requirement will significantly reduce the risk of
accidents from fuel tank explosions. This, in turn, will reduce the
liability risk of design approval holders.
3. Concern about new inspection and maintenance requirements. The
FAA agrees in part with the commenter. While it is true that the term
``critical design configuration control limitations'' is new and may
result in new inspection and maintenance requirements, the very intent
of this rule is to require mandatory maintenance and inspection for the
fuel tank system. We agree that the compliance requirements are
different between Sec. 25.571 and Sec. 25.981. However, these
differences are due to the differences between structures and systems.
For example, service experience indicates that alterations have been
made to systems affecting fuel tank safety without consideration of the
effects of the alterations. One purpose of critical design
configuration control limitations is to ensure that maintenance
personnel are informed of and address these effects. In the context of
structures, the primary concern has been aging phenomena such as
fatigue, and the limitations are intended to ensure that these
phenomena are identified and addressed before they become critical. The
result in both instances is mandatory maintenance and inspection
requirements for both fuel tank systems and structures. We have
determined that the fuel tank system warrants mandatory minimum
maintenance criteria to prevent catastrophic failure. By placing these
requirements in the Airworthiness Limitations section of the
Instructions for Continued Airworthiness, the design approval holder
provides consistent mandatory baseline maintenance standards for the
fleet.
4. Concern that the requirement goes against standard industry
practice regarding what manufacturers should provide to users. The FAA
agrees that the proposed rule may differ from historical industry
practice. However, the purpose of this rule is to improve both the
safety of the fleet and the practices within the industry. The
information we are requiring the design approval holder to provide to
the operator is basic information needed by the industry to operate
airplanes safely. It will provide operators with a baseline document to
develop a maintenance and inspection program that will enhance safety
within the fleet. It will also aid the operator in establishing the
configuration requirements that must be accounted for during any
subsequent alterations to the airplane.
5. Concern about covering deficiencies in the STC and modification
approval process by indirectly implicating the manufacturer. The FAA
disagrees that the definition of critical design configuration control
limitations ``implicates'' the TC holder in configuration changes made
by others. On the contrary, these limitations provide TC holders with
the ability to limit the types of changes that may be made to their
designs that could adversely affect their safety.
Request To Delete Use of Placards and Decals
One commenter requests that Sec. 25.981(b) of the proposed rule be
revised to delete the requirements concerning placement of placards or
decals in the areas where ``maintenance, repairs, or alterations may
violate the critical design configuration limitations.'' The commenter
agrees that adequate information regarding general design practices and
precautions must be available to those who perform and approve repairs
and alterations to the airplane. However, the commenter argues that
placing placards and decals on the airplane may not be practical,
considering that they might not remain in place or be readable over
time. The commenter suggests that a more effective way to convey fuel
system general practices information to operators is via the standard-
practices section of the Aircraft Maintenance Manual (or a similar
section of another appropriate manual). The commenter does agree that
the fuel quantity indicating system (FQIS) wiring could be better
identified, and suggests that manufacturers work with the appropriate
agencies to develop a standardized system (similar to that for oxygen
lines) to identify critical fuel systems wiring for future aircraft
designs.
FAA's Response: The FAA concurs in part with the commenter. The
rule is meant to be a performance-based rule; therefore, the FAA's
objective is not to mandate the use of any specific means of providing
visual identification of critical design control limitations. Although
the text suggests the use of
[[Page 23111]]
placards and decals, the rule allows visible means other than placards
and decals to be used. Placards are normally used in many locations of
transport airplanes to convey information to maintenance personnel, but
placards are only one option of identifying critical design
configuration limitations. The FAA also recognizes that installation
and maintenance of placards in certain locations of the airplane may
not be practical.
The objective of this requirement is to provide a means to assist
maintenance personnel in reducing maintenance errors. Adverse service
experience demonstrates that modifications have inadvertently resulted
in routing of high power wiring with FQIS wiring. The need to provide
visible identification of critical design configuration control
limitations will depend upon the particular airplane configuration.
As an example, the FAA anticipates that the requirements of this
rule will result in modifications either to separate FQIS wiring from
high power sources, or to install transient suppression devices. If
transient suppression devices are incorporated into the FQIS, the FAA
would not consider separation of the wiring from other high power
wiring a critical design configuration item and, therefore, would not
require visible identification. If separation of FQIS from high power
sources wiring is critical, the FAA will require a visible means of
identification. One acceptable means of compliance in this case would
be to install color-coded tape at specified intervals along critical
wiring.
To clarify the intent of this requirement, we have revised the
wording within the rule to eliminate reference to placards and decals.
The text of the final rule states only that a visible means of
identification must be provided.
Discussion of Comments on Appendix H25.4, Instructions for
Continued Airworthiness
Request To Mandate Certification Maintenance Requirements Instead of
Appendix
One commenter opposes the proposed Appendix H25.4(a)(2), which
would require revising the Instructions for Continued Airworthiness
(ICA) to set forth each mandatory replacement time, inspection
interval, related inspection procedure, and all critical design
configuration control limitations approved under Sec. 25.981 for the
fuel tank system. The commenter considers that singling out just the
fuel system for this requirement is not justified because all systems
have their own criticalities that must be documented. The commenter
asserts that this proposed requirement fails to recognize that
equivalent systems-related tasks are already defined under
Certification Maintenance Requirements (CMR), a process that has been
in place since the early 1980's and formalized in 1994. [CMR's are
maintenance requirements that identify aircraft system-related safety
tasks for ``dormant'' (latent) failure conditions related to hazardous
and catastrophic failure conditions.] The commenter states that CMR's
are considered the systems equivalent of the structural airworthiness
limitations and are part of today's certification process, even though
CMR's are not included in part 25. The FAA Aircraft Certification
Offices (ACO) and other prime certifying authorities regularly approve
CMR's, and all operators' maintenance programs use these same CMR's.
This commenter states that the proposed requirement indirectly regroups
all maintenance tasks associated with the prevention of fuel tank
ignition sources under the responsibility of the ACO, and this
undermines the MRB process as well as the FAA's Aircraft Evaluation
Groups' (AEG) responsibility in approving maintenance programs.
In light of this, the commenter suggests that rather than regulate
the CMR concept system-by-system as the proposed Appendix would do, the
FAA should pursue a separate regulatory initiative that would give
official recognition of the CMR's and make them enforceable. The
commenter states that doing so would ``fix a long-standing regulatory
deficiency.'' The advantage of such an alternative rulemaking approach
is that it would:
Keep current procedures and processes in place and avoid
the creation of another bureaucratic approval process;
Accomplish the FAA objective of requiring manufacturers to
create an Airworthiness Limitations section in the Instructions for
Continued Airworthiness similar to that approved under Sec. 25.571 for
structure; and
Eliminate the need to enforce mandatory inspection or
other procedures via Sec. 25.981(b).
Similarly, another commenter believes that the FAA should formally
recognize the CMR concept in the proposed rule. This commenter states
that in doing so, the concept of declaring ``critical configuration
control limitations,'' as proposed in Sec. 25.981(b), would be
unnecessary. The commenter recommends the rule be revised to allow use
of the Certification Maintenance Coordination Committee (CMCC) process,
as described in AC 25-19 (``Certification Maintenance Requirements,''
issued November 28, 1994), to allow operators to absorb tasks within
the existing maintenance programs if a MSG-3 task is identified. This
reduces costs associated with tracking additional Airworthiness
Limitations, which would be required in accordance with the proposed
Appendix H requirements.
FAA's Response: The FAA does not concur that the rule should be
revised to include the CMR process. The concept of this rule goes
beyond the current CMR process. CMR's only address mandatory
maintenance that is applied to the airplane at the time of original
certification. The requirement of this rule for configuration design
control limitations will address not only mandatory maintenance
actions, but also design features (e.g., wire separation, pump impeller
material specification) that cannot be altered except in accordance
with the Instructions for Continued Airworthiness (ICA). The
configuration design control limitations will be made part of the
Airworthiness Limitations section of the ICA; therefore, they will be
mandatory in accordance with Sec. 91.403(c).
Further, the current MRB process does not provide a mandatory,
legally enforceable means to require mandatory maintenance tasks; nor
does it provide the critical control limitations that are needed to
assist operators when making future repairs and alterations to an
aircraft.
There would be some value in changing the regulations to mandate
either application of the CMR process to all systems or including all
systems in the Limitations Section of the ICA. However, such action is
beyond the scope of the current rulemaking, and would significantly
delay action to address fuel tank safety issues. We are considering
tasking ARAC to address this issue. If the ARAC process develops an
improved proposal, amendment of the regulations to adopt an alternative
to the actions required by this final rule can be made at that time.
Discussion of Comments on Operating Rules
Request To Revise Maintenance Operations Requirements
One commenter agrees in principle with the intent of the proposed
changes to Secs. 91.410, 121.370, and 125.248, and supports the concept
of reviewing and revising, if necessary, the fuel tank system
maintenance and inspection program. However, the commenter disagrees
with the FAA's proposed
[[Page 23112]]
methodology and time frame for fulfilling this intent.
As for the FAA's methodology, the commenter opposes mandating
changes to maintenance programs via operations rules. Instead, the
commenter requests that mandatory maintenance tasks be introduced using
current industry practices, such as the use of the Maintenance Review
Board (MRB) process and MSG guidelines. The commenter states that the
inspection programs developed using these processes are based on a
foundation of information derived from various sources using a defined
process.
Further, the commenter states that the manufacturers' recommended
maintenance and inspection programs already serve as the basis for
developing operators' individual maintenance and inspection programs.
Within these established programs, safety issues are identified and
addressed at both the type certification and continued-airworthiness
levels. The FAA has internal processes for managing the approval of
manufacturer-developed maintenance and inspections programs, safety
tasks, and the final individual-operator maintenance and inspection
programs.
However, the commenter maintains that it appears that the proposed
requirements will ``dissolve'' this existing process only to require
meeting a calendar deadline. The commenter does not consider that this
will lead to a safety enhancement.
This commenter suggests the following alternative for implementing
a new or revised maintenance program:
First, the fuel tank system maintenance programs should be
reexamined in context both with the results of the required SFAR safety
review and with the existing MRB and other mandated programs [such as
the Corrosion Protection Control Program (CPCP) and Supplemental
Structural Inspection Program (SSID)].
Second, the approval process described in AC 25-19, ``Certification
Maintenance Requirements (CMR),'' should be used, as appropriate, to
determine the task classification, interval, and method of task
transmission (for example, via service bulletins or via the existing
program update process).
Third, the FAA should mandate via AD's the service bulletins or
program interval changes developed as an outcome of this process. This
way, any changes in maintenance and inspection programs can be
communicated to operators in an approved format that is compatible with
the aircraft certification basis.
Based on this suggested alternative, the commenter requests that
the rule be revised to delete the proposed Sec. Sec. 91.410, 121.370,
and 125.248.
FAA's Response: The FAA does not concur with this commenter. First,
the MRB process is not a means to mandate compliance; it is a means to
identify manufacturers' recommended minimum initial scheduled
inspection and maintenance tasks for new aircraft. Further, in light of
service history regarding fuel tank events, it is apparent that the MRB
using the MSG-3 process has previously been unable to develop adequate
maintenance procedures to address various fuel tank safety issues.
Second, for the reasons discussed previously, the FAA does not agree
that changing the current approach to CMR's is appropriate in this
rulemaking. Third, while AD's are enforceable, they generally are
limited to safety issues of specific aircraft models. As discussed in
the preamble to the notice and previously in this final rule, there is
no advantage in addressing this industry-wide safety issue in a
piecemeal fashion. We anticipate that in complying with this rule both
designers and operators will take advantage of many of the methods
developed in existing cooperative programs noted by the commenter.
Request for Definition of ``Administrator''
One commenter requests clarification of the term ``the
Administrator,'' as it is used in proposed Sec. Sec. 91.410, 121.320,
125.248, and 129.14. The commenter interprets the term
``Administrator'' to mean ``the Federal Aviation Administration or any
person to whom he has delegated his authority in the matter
concerned.'' This is consistent with the definition of the term that
appears in 14 CFR part 1 (Sec. 1.1).
The commenter objects to the inconsistent definition that appeared
in the proposal that identified ``the Administrator'' as ``the manager
of the cognizant FAA Aircraft Certification Office (ACO).'' Instead,
the commenter requests that the FAA revise the proposed rule to reflect
the formalized, industry-recognized roles of other authority entities,
such as the PMI and the MRB process. Specifically, the commenter
requests the following revision:
For approval of the development of the designer's
maintenance and inspection program, ``the Administrator'' is the FAA
ACO, the FAA Aircraft Evaluation Group (AEG), or the non-U.S.
airworthiness authority (if the FAA ACO has delegated its authority via
a bilateral agreement).
For approval of the individual operator's maintenance
program, ``the Administrator'' is the Principal Maintenance Inspector
(PMI).
FAA's Response: The FAA concurs that clarification is necessary.
Part 1 of 14 CFR does define the Administrator to include those
delegated the authority to act on her behalf. However, in the case of
this rule, we have determined that the cognizant ACO is the appropriate
entity that can address the myriad of technical and practical issues
faced by implementing and enforcing compliance with this rule. As
discussed elsewhere, neither the PMI nor the MRB process is authorized
to perform these duties. The final rule has been revised to
specifically reference the cognizant ACO, or office of the Transport
Airplane Directorate, as the appropriate official for approving the
initial and any revisions of the instructions for maintenance and
inspection of the fuel tank systems required by the rule.
Request for Extension of Compliance Time
Several commenters request that the proposed compliance time for
the required actions of Sec. Sec. 91.410, 121.320, 125.248, and 129.14
be extended. These commenters state that incorporating the new
instructions into maintenance and inspection programs cannot possibly
be accomplished within 18 months as would be provided by the proposal.
These commenters request a minimum compliance time of 54 months.
FAA's Response: The FAA concurs that the compliance time can be
extended somewhat. As discussed previously in this preamble, we have
revised the compliance time to 36 months.
Request To Issue Airworthiness Directives To Change Maintenance
Programs Instead of Operating Rules
One commenter disagrees with the proposed requirement to change
operators' maintenance programs through changes to the operating
requirements. The commenter suggests that the FAA mandate such
maintenance actions via Airworthiness Directives specific to each model
type, rather than by modifying the operational rules. The AD's will
allow both the FAA and the industry to:
Assess the actual impact of the maintenance program (cost
versus benefit);
Ensure that the appropriate compliance time scale is
mandated versus the effective date of the rule and the resources
available; and
Ensure that foreign authorities and operators are notified
of the mandatory
[[Page 23113]]
continuing-airworthiness information via a recognized document (ICAO
obligation, Annex 8, paragraph 4.2.2).
Similarly, another commenter states that the proposed operating
rule changes are not needed. This commenter asserts that, if the
instructions for maintenance and inspections are developed through the
MSG-3 process, there is no need to include them in the Airworthiness
Limitation section, as would be required by the proposed rule. If they
should be mandatory, then the FAA should mandate them by AD's.
FAA's Response: The FAA does not concur with either of these
commenters. As discussed in the notice and elsewhere in this final
rule, we will issue AD's to mandate any design changes identified as
needed as a result of the design review required by the SFAR
established by this final rule. However, the FAA considers it
inappropriate to delay requiring implementation of the maintenance
programs developed as a result of the SFAR. It is evident that existing
maintenance programs are generally inadequate to ensure the safety of
fuel tanks systems and that program improvements are necessary. As
reflected in the regulatory evaluation prepared for this rulemaking,
this approach has been found to be cost effective.
As discussed previously, we have carefully considered the first
commenters' concerns regarding compliance times, and have extended the
times to address those concerns. Finally, foreign authorities have been
fully informed of the FAA's activities, and we will continue to include
foreign authorities in future discussions of these issues.
Unlike AD's, the operating rule changes adopted by this final rule
do not require the adoption of particular programs developed by design
approval holders. Rather, the rules require adoption of programs that
meet the objective of providing an acceptable level of safety for fuel
tank systems. While the programs developed by design approval holders
will provide a foundation for operators' programs, the individual
operator is responsible to ensure that its programs address the actual
configurations of its fuel tank systems.
In the preamble of the notice, we also discussed use of a SFAR and
changes to the operating rules, instead of AD's, as the primary means
of achieving the regulatory objective. As we stated, we consider that
an SFAR provides a means for the FAA to establish clear expectations
and standards, as well as a timeframe within which the design approval
holders and the public can be confident that fuel tank safety issues on
the affected airplanes will be uniformly examined.
This rule ensures that the designer completes a comprehensive
assessment of the fuel tank system and develops any required
inspections, maintenance instructions, and modifications, if needed. As
such, the requirements of this final rule are intended to provide
maintenance requirements that will prevent unsafe conditions from
developing. This proactive approach provides predictability and
efficiency.
Discussion of Comments on Flammability Minimization--Sec. 25.981(c)
General Agreement With Reducing Flammability
All comments received support the overall goal of reducing fuel
tank flammability. Several commenters strongly support the FAA's
position that, despite compliance with the proposed flammability
reduction portion of the rule, the applicant must ensure compliance
with the ignition source prevention requirements.
Other commenters support the proposed rule, but suggest other
alternatives. For example, one commenter asks the FAA to consider
increasing the scope of the proposal to minimize fuel tank flammability
to totally preventing operation of fuel tanks with flammable vapors.
Similarly, another commenter requests that the applicability of the
proposal be increased so that the flammability of vapors in certain in-
service airplanes would be reduced. Other commenters suggest the FAA
mandate the installation of means to mitigate the effects of fuel tank
ignition, such as metal foils or polyurethane foam should be mandated.
Each of these proposals is discussed below.
Request To Retain Assumption of Flammable Ullage
Several commenters recognize that fuel system design has been based
on the assumption that the ullage fuel/air mixture is always flammable.
However, these commenters express concern that the proposal to require
minimization of fuel tank flammability could result in a relaxation of
the requirements for precluding ignition sources within the fuel tanks.
One commenter asserts that the FAA has retained this assumption for
now, but ``seems to indicate a willingness to eventually entertain
designs that would rely more on flammability minimization and
mitigation, potentially allowing designers to assume the absence of a
flammable ullage under certain conditions.'' This commenter considers
that that affordable technology is remote and, therefore, it should be
made clear that the design philosophy behind the proposed Sec. 25.981
has firmly retained the assumption of flammable ullage.
FAA's Response: As noted by the commenter, we affirmed that we are
not considering a change to the current philosophy of assuming a
flammable ullage. However, if technological changes are developed, such
as full-time fuel tank inerting, and prove to be a superior method of
eliminating the risk of fuel tank ignition, the FAA could consider a
change in this philosophy in future rulemaking.
Request To Mandate Means to Preventing Flammable Vapors--Inerting
Several commenters suggest that flammable vapors in the fuel tank
should be prevented and that practical technologies currently exist
that should be mandated. One commenter suggests that even with
Sec. 25.981(c) in place, circumstances might occur operationally in
which even an unheated wing tank has a flammable ullage with a
relatively low ignition energy threshold, and that these conditions may
warrant attention through amending the rule to further reduce
flammability in the future.
FAA's Response: The FAA does not concur that mandating fuel tank
inerting technology has been shown to be feasible at this time. This
was discussed in detail in the preamble to the notice. We are
continuing to evaluate further safety improvements, and are conducting
research and development to investigate the feasibility of
incorporating nitrogen inerting on both in-service and new type design
airplanes. As noted previously in this preamble, we tasked the ARAC on
July 14, 2000 (65 FR 43800), to evaluate both on-board and ground-based
fuel tank inerting systems. If further improvement is found to be
practicable, we may consider initiating further rulemaking to address
such improvements. In the meantime, this final rule requires a means to
minimize flammability or a means to mitigate the effects of ignition.
As a performance-based regulation, this allows the use of any
effective, approved means, but does not require the use of any one
particular means.
Request To Revise Proposed Flammability Standard
One commenter believes that the ARAC report referenced in the
preamble to the notice is flawed in its logic,
[[Page 23114]]
which arrived at a suggested exposure time to explosive conditions not
to exceed ``7 percent'' of fleet operating time. This recommendation
was based on comparison of the incident rate of fuel tank explosions
and ignition events for center tanks to that for wing tanks. The
commenter states that, due to operating procedures, the wing tanks are
seldom empty and are not located near any heat sources. While wing tank
vapors may be explosive when taxiing on a hot runway for extended
periods, they are never as explosive as are those that often exist in
empty center tanks. The most serious situation for wing fuel tanks
would be when the airplane lands on a hot runway with nearly empty
tanks. However, taxi time at landing is usually short. At takeoff, even
with a long taxi, the wing tanks will be nearly full with relatively
cool fuel. The commenter concludes that to have comparable safety
margins for center tanks as for wing tanks, the degree of explosiveness
would have to be equivalent.
Another commenter asserts that the proposed flammability
requirement is not sufficiently detailed to ensure that compliance can
be achieved without having to resort to external guidance, not
published in the rule. The commenter is concerned that the proposed
rule text is sufficiently vague to promote lack of standardization in
findings of compliance with the regulation. Although relevant material
is available in the associated AC 25.981-2, the commenter is aware that
guidance in the AC is not mandatory and is concerned that the wording
of the rule essentially requires an interpretation of ``minimize
flammability'' from the relevant AC.
FAA's Response: The FAA considers that additional clarification is
necessary.
As for the first comment, the ARAC recommendation of a 7 percent
flammability standard did not provide an equivalent level of
flammability to that of the wing (main) tanks, which the ARAC
determined were the tanks with an acceptable level of fuel tank safety
in relation to ignition or explosion events. The ARAC calculated a
range of 3 to 5 percent for wing tanks. We considered this concern when
developing the regulatory text for this rule, and this is why the
proposal requires flammability to be ``minimized'' rather than
accepting the ARAC recommendation of 7 percent.
In response to the second commenter, we consider it appropriate to
further clarify the intent of the rule by incorporating a definition of
the term ``minimize'' in the text of Sec. 25.981(c), as follows:
In the context of this rule, 'minimize' means to incorporate
practicable design methods to reduce the likelihood of flammable
vapors.
``Practicable design methods'' are feasible means, such as
transferring heat from the fuel tank (e.g., use of ventilation or
cooling air). We have provided further guidance in AC 25.981-2, which
describes how demonstrating that the flammability of the fuel tank is
equivalent to that of an unheated wing fuel tank would be one
acceptable means of showing compliance. As with all new performance
based standards, it will be necessary for the Transport Airplane
Directorate to participate in the review of proposed means of
compliance to ensure standardization.
Request That Rule Based on Flammability Be Delayed Until Standard Is
Established
One commenter representing manufacturers and operators agrees in
principle with the FAA's overall intent to enhance the fuel system
safety of future aircraft designs through measures to reduce fuel tank
flammability exposure. The commenter agrees that action should be
taken, as identified by the ARAC Fuel Tank Harmonization Working Group,
``to address flammability mitigation as a new layer of protection to
the fuel system.'' However, the commenter disagrees with the proposed
Sec. 25.981(c) that would require minimization of fuel tank
flammability, because ``there is not an agreed-to definitive industry
standard for assessing flammability of aircraft fuel tanks.''
In light of this, the commenter requests that a rule based on
flammability be delayed until a standard is defined. In its place, the
commenter recommends a new rule that would accomplish some degree of
flammability reduction, even though a definitive flammability standard
does not exist. The commenter suggests that the new rule should require
practical measures to reduce heat transfer from adjacent heat sources
into fuel tanks, and proposes the following text for the rule:
Sec. 25.981(c):
If systems adjacent to fuel tanks could cause significant heat
transfer to the tanks:
(1) Means to reduce heating of fuel tanks by adjacent systems
shall be provided; or (2) Equivalent flammability reduction means
shall be provided to offset flammability increases that would
otherwise result from heating; or
(3) Means to mitigate the effects of an ignition of fuel vapors
within fuel tanks shall be provided such that no damage caused by an
ignition will prevent continued safe flight and landing.
FAA's Response: The FAA does not agree with either the commenter's
proposal to delay the rule relating to fuel tank flammability or the
commenter's proposed regulatory text. The proposal offered by the
commenter would require only that a ``means to reduce heating of fuel
tanks by adjacent systems shall be provided * * *'' The proposed text
suggested by the comment does not require any measurable reduction in
flammability, which is the objective of this rulemaking. For example,
under the commenter's suggested standard, if a fuel tank initially
contains a flammable fuel-air mixture, a ``means to reduce heating of
the tank'' may reduce the temperature of the fuel, but not necessarily
to the extent that the temperature would remain below the flammable
range for the duration of the flight.
The commenter asserts that there is no standard for assessing
flammability of airplane fuel tanks. However, industry members
represented by the commenter were members of the ARAC group that
recommended that the regulatory text mandate a maximum fuel tank
flammability of 7 percent of the operating time. The ARAC report
provides numerous calculations of fuel tank flammability that were
conducted by industry representatives. We are confident that industry
is capable of assessing fuel tank flammability, and we have provided
guidance in AC 25.981-2, which defines methods of demonstrating
compliance with the flammability requirements of the rule. One method
described in the AC for showing compliance is to demonstrate that the
flammability of the tank is equal to or less than that of an unheated
wing tank on the airplane type. As discussed previously, Sec. 25.981(c)
has been clarified by adding a definition of ``minimize.'' For
applicants who are unable to demonstrate equivalent flammability to an
unheated wing tank, the use of ``practicable design methods,'' such as
transferring heat from the fuel tank, will be required. The final rule
is adopted with the change noted.
Request Not To Mandate Fuel Tank Flammability to the Level Proposed
The commenter does not agree with the FAA's statement in the
preamble to the notice that read:
``* * * the intent of the proposal is to require that fuel tanks
are not heated, and cool at a rate equivalent to that of a wing tank
in the transport airplane being evaluated.''
For example, directed ventilation systems may reduce heating of
adjacent fuel tanks, but they do not eliminate heating. Furthermore,
the commenter
[[Page 23115]]
asserts that there should not be a requirement to ``cool at a rate
equivalent to that of a wing tank.'' The studies conducted by the ARAC
Fuel Tank Harmonization Working Group did not conclude that such a
requirement was necessary or achievable. The commenter requests that
the FAA not mandate minimizing fuel tank flammability to the level
proposed in the notice, because it would not be practical to cool tanks
within the fuselage to the same level as tanks located in the wing.
FAA's Response: The FAA disagrees. The rule only affects new type
designs. Therefore, possible design considerations to comply with the
rule would include:
Locating heat sources away from fuel tanks;
Introduction of cool air from outside sources into air
gaps between heat sources and fuel tanks to transfer heat from tanks
while inflight; and
Introducing cool air from ground or airplane sources
during ground operations.
Some of these features are already incorporated into certain models
of the transport fleet. These methods are technically feasible and
could provide an equivalent level of exposure to operation with
flammable vapors to that of unheated wing fuel tanks--the fuel tanks
with a safety level that the ARAC defined as an acceptable standard.
The commenter provided no data to support the assertion that ``it would
not be practical to cool tanks within the fuselage to the same level as
tanks located in the wing.''
Request To Provide Alternatives to Minimizing Flammability
Two commenters request that alternative regulatory text be included
in the proposed rule concerning the requirement to minimize
flammability.
The first commenter believes that the FAA's intent, as stated in
the preamble to the notice and restated in draft AC 25.981-2X, is ``to
require that the exposure to formation or presence of flammable vapors
is equivalent to that of an unheated wing tank in the transport
airplane being evaluated.'' The commenter considers this a reasonable
objective. The commenter recommends that the FAA reword the proposed
rule text to clearly frame the intent within the rule itself, and
believes that the wording would be more specific and less prone to
misinterpretation if it contained the following statement:
A means must be provided to ensure that the net heat balance
within any tank will be equivalent to that of an unheated wing fuel
tank during any portion of the passenger carrying operation.
The commenter adds that, if an unheated wing fuel tank does not
exist on a particular design, then one could be modeled and used as the
reference standard for all tanks on that design.
The second commenter recommends that the FAA consider an
alternative to have the applicant determine an acceptable heat transfer
rate at a critical fuel load, rather than determining if a temperature
limitation is exceeded, given that the tank ullage is considered
flammable. This would alleviate the difficulties of working with a high
number of parameters inherent in the numerous aircraft types and
conditions (including the effects of pumping, vibration, altitude, fuel
load, etc.) by considering a generic installation.
FAA's Response: The FAA does not agree with either commenter.
Minimizing flammability is the ultimate objective of the rule. We
considered many options when establishing the regulatory text, and
determined that a performance-based rule is most appropriate because it
allows the designer to control fuel tank flammability by using any
number of methods. It also allows the use of new technology designs
that may be developed in the future. On the other hand, the commenters'
proposals focus only on heat balance and heat transfer, rather than
flammability. Their proposals would not allow the designer the
flexibility to introduce other means of reducing flammability, other
than controlling heating/cooling of the tank, such as with nitrogen
inerting. Further, the commenters' proposals would not significantly
simplify the compliance demonstration over that of the options
described in AC 25.981-2X. In light of this, the commenters' proposals
are not accepted.
Request To Require Retroactive Reduction in Flammability
One commenter states that the designs of some in-service airplanes
have shown undesirable characteristics. Because the proposed
flammability requirements would only affect new airplane type designs,
this commenter seeks insurance from the FAA that older and current
designs also will be assessed, and suggests a case-by-case approach.
FAA's Response: The FAA agrees that some in-service airplanes have
undesirable levels of fuel tank flammability. To address this issue, we
tasked the ARAC in 1998 to provide advice and recommendations on
methods that could eliminate or significantly reduce the exposure of
transport airplane fuel tanks to flammable vapors. Our review of the
ARAC report indicates that additional time is needed to perform the in-
depth research and economic evaluations necessary to determine if
certain technologies that could reduce or eliminate fuel tank
flammability would be practical for use on the existing fleet of
transport airplanes. As noted previously, we also are studying concepts
such as ventilating spaces adjacent to fuel tanks, and recently tasked
the ARAC to evaluate inerting systems for possible retrofit into the
existing transport fleet. We will consider initiating additional
rulemaking if further improvements are found to be effective and
practicable.
Request To Ban Use of Low Flash Point Fuels
Several commenters suggest that the use of lower flash point fuels,
such as JP-4 or Jet B, should be disallowed because these fuels cause a
much greater exposure to flammable vapors. One commenter notes that
while it appears that these fuels are no longer commonly used, they may
still exist as approved alternative fuels for several transport
aircraft. If any operators routinely use Jet B or JP-4 type fuel, then
their risk would be much greater than the risk for operators using Jet
A.
FAA's Response: The FAA agrees that use of lower flash point fuels
increases the exposure to operation with flammable fuels in the fuel
tank. In fact, this rule does require consideration of fuel type. The
limited use of these fuels on a temporary basis to allow operation from
remote airports is discussed in AC 25.981-2. The FAA does not agree
that use of these fuels should be banned for in-service airplanes. Data
available indicates that these fuels are not routinely used in U.S.
operations. However, in some cases, airplanes may divert into locations
where JP-4 fuel is the only fuel available. Use of this fuel on a
temporary basis allows continuation of the flight without requiring
tankering of Jet A fuel to a remote alternate airport and the
associated delays and inconvenience to the flying public. If use of
lower flash point fuels increases due to market conditions, the FAA
will consider rulemaking to limit their use.
Request To Require Use of Means To Prevent Fire Within Fuel Tank
Several commenters request that the FAA revise Sec. 25.981(c)(2) to
require the use of specific means to address the requirement to
mitigate the effect of an ignition of fuel vapors within the fuel
tanks. Some of the commenters' suggestions include flame quenching
metallic foils and polyurethane foam. These commenters state that such
[[Page 23116]]
technologies as these are available and consider them effective in
preventing propagation of flame or explosion within the fuel tanks
FAA's Response: The FAA does not agree that a change to the
proposed rule is necessary. As stated previously, the final rule is a
performance-based regulation. As such, it may permit the use of such
means as those suggested by commenters, but the rule does not require
the use of any one particular means. AC 25.981-2 provides guidance on
use of these means.
Discussion of Comments Concerning Cost of the Rule
The detailed responses and the impacts of the comments on the costs
of the rule are contained in the Final Regulatory Evaluation, which is
available in the docket. The quantitative effects of the comments on
the assumptions and the cost estimates are summarized in the Economic
Evaluation discussion later in this final rule. The following
discussion is a more general disposition of the comments concerning the
cost of the rule.
Number of Airplanes, TC's, and STC's Affected
One commenter notes that the FAA assumed that a U.S. fleet size of
6,006 airplanes would be affected by the proposed rule. While this
number may have been appropriate in 1996, the commenter states that by
the time the final rule is issued, there likely will be more than 7,000
affected airplanes.
Additionally, the commenter notes that the number of affected type
certificates counted by the FAA did not include the Fokker Model F27
Mark 50 or the Boeing Model 717. Further, the FAA's listing of fuel
system STC's was incomplete; for example, there were no fuel tank
system STC's listed for any Airbus, Fokker, Bombardier, or Aerospatiale
airplanes.
Finally, the commenter states that the FAA's cost estimate should
take into account the worldwide impact that the proposed rule will
have, as other regulatory authorities adopt identical or similar rules.
Thus, the true cost of this activity will far exceed the cost
associated with only the U.S. fleet.
FAA's Response: The FAA concurs with the commenter that the number
of airplanes in the U.S. fleet has increased since the data set used in
the notice was collected. As a result, we now estimate that 7,875 U.S.-
registered airplanes will undergo the fuel tank system inspections
beginning in the year 2004. The economic analysis has been modified
accordingly.
We agree with the commenter that our analysis had not included any
Fokker Model F27 Mark 50 or Boeing Model 717 airplanes in the fleet.
The reason was that the fleet data set that we used contained no U.S.-
registered Model F27 Mark 50 airplanes. The more recent data set we
used for the final regulatory evaluation also contains no U.S.-
registered Model F27 Mark 50 airplanes; thus, those airplanes are not
included in the analysis. We did not include any Model 717 airplanes
because that fleet data was based on a 1996 listing when no Model 717
airplanes had yet been manufactured. The airplane data set that we used
in the final regulatory evaluation is based on 1999 data and contains
Model 717 airplanes. We also note that even though the 1999 fleet data
set reported no U.S. registered Airbus Model A321, A330, or A340
airplanes, we assumed that these models will enter the U.S. fleet
eventually and, therefore, the costs to review these fuel tank systems
were included in the analysis.
We agree with the commenter that the analysis had not included all
of the fuel tank system STC's. After further research, we discovered
one fuel tank system STC for an Airbus airplane model, one fuel tank
system STC for a Bombardier airplane model, and no fuel tank system
STC's for Fokker or Aerospatiale airplane models. The economic analysis
has been adjusted accordingly.
We do not agree with the commenter regarding consideration of
worldwide impact of this rulemaking. The FAA is not required to account
for costs to foreign operators not operating in the U.S. because those
operators are not subject to these rules.
Cost of Evaluating Non-Fuel System-Related STC's
One commenter agrees with the FAA that only a small number of non-
fuel-system STC's will require a system assessment. However, the
commenter asserts that the FAA's analysis does not account for the
significant effort and associated cost that would be required to
determine whether or not these non-fuel system-related STC's affect the
fuel system and thus merit further attention. Such a determination
would be required under the proposed SFAR requirements.
FAA's Response: The FAA agrees that the costs to determine which
STC's affect the fuel tank system should be included in the economic
analysis. However, we have determined that 90 percent of the non-fuel
tank system STC's will need only a minimal degree of engineering effort
(with a resultant minimal cost) for a qualitative evaluation of their
effects on the fuel tank system. We also have determined that 325 non-
fuel tank system STC holders will each need to conduct a more detailed
engineering review that will involve an average of 75 hours of
engineering time. The economic analysis has been revised accordingly.
Cost of Use of Proprietary Data
One commenter raises concerns regarding the costs associated with
STC holders obtaining data from the type approval holder. The commenter
points out that, in the ``Regulatory Evaluation'' section of the
notice, the FAA stated:
Many STC holders would be able to incorporate a large portion of
a TC holder's fuel tank system assessment into its assessment.
The commenter states that, in practice, the release of such
proprietary information to a third party would need to occur under a
technical assistance contract. Therefore, the cost of this transaction
should be added to the FAA's cost analysis.
FAA's Response: The FAA disagrees with this commenter. While a
technical assistance contract may be needed to obtain this information,
the overall cost to the aviation industry is not affected because the
payment to the data holder will offset some of the engineering costs
associated with the fuel tank system design review. As a result, the
overall cost of the rule is not affected by these contracts, although
the distribution of a part of these costs will shift from certain TC
holders to certain STC holders.
Cost of Fuel Tank System Safety Review Required by SFAR
One commenter disagrees with the FAA's estimate of $14.4 million
for the costs of completing the fuel tank system reviews required by
the proposed SFAR. The commenter points out that the FAA estimated that
the review would require 0.5 to 2 engineering years per airplane model.
However, the commenter calculates the actual level of effort required
will be more like 2 to 4 engineering years for each major model. Minor
model variation will add additional effort that is difficult to
quantify, but could easily increase the total effort by 30 to 50
percent. In addition, the commenter states that systems do evolve with
time, leading to additional permutations that must be considered.
In light of this, the commenter believes that the basic safety
reviews will require two to three times more effort and cost than
identified by the FAA. Accordingly, the cost of the basic design review
may be in the range of
[[Page 23117]]
$28 million to $52 million, plus an additional $14 million to account
for the variations within models.
FAA's Response: The FAA agrees that the number of engineering hours
to review the fuel tank systems should be increased but disagrees about
the amount of the increase. As discussed later in more detail in the
Economic Evaluation section of this preamble, we determined that there
were two types of fuel tank system reviews:
The first, which is referred to as the ``full-scale''
review, is the first fuel tank review done for a model that has several
series.
The second, which is referred to as the ``derivative''
review, are the reviews of the other series in that model.
Using the Boeing Model 737-300/-400/-500 as an example, we
determined that this model will involve one ``full-scale'' review and
two ``derivative'' reviews. In addition, the fuel tank system reviews
performed for all ``extended range'' series and freighter series are
evaluated as ``derivative'' reviews. On that basis, we determined that,
depending upon the model, it will take 6 months to 4 years of
engineering time to perform a ``full-scale'' fuel tank system review.
The FAA also determined that it will take 6 months to 1 year of
engineering time to perform a ``derivative'' fuel tank system review.
(See the commonality of design discussion presented earlier in this
preamble for an engineering explanation why the review of a model's
series after the first review will take less time than the first
review.)
The FAA agrees that the number of fuel tank system reviews needs to
be increased, but disagrees about the extent of the increase. The FAA
determined that the rule will require 46 ``full-scale'' reviews and 52
``derivative'' reviews. The impact on the total cost of these reviews
is provided in the Economic Evaluation section of this preamble.
Cost of Safety Review of Older Type Designs
One commenter, Lockheed Martin, considers that the FAA clearly
underestimated the costs to conduct the safety review required under
the new SFAR on older airplanes, such as the Lockheed Model L-188
Electra. The commenter notes that the FAA's economic analysis of the
cost of the design review proposed in the notice is based on a fleet-
wide consideration. This approach results in a per-aircraft-cost basis
that does not appear unreasonable. However, the expense to perform the
design reviews and prepare service documents will be the same for
Lockheed as for other manufacturers that have twenty or thirty
operators and hundreds of operating aircraft. (They commenter reports
that there are only 13 Model L-188 Electras currently operating in the
U.S.)
The commenter requests that the FAA take into consideration the
following information when finalizing the economic analysis of the
proposed rule:
1. The FAA's cost benefit analysis identifies an engineering effort
to perform the SFAR safety review and preparation of documents as
taking from three-quarters to three person years to perform. However,
because the Model L-188 Electra was certified prior to the issuance of
Sec. 25.901 and Sec. 25.1309, the SFAR safety review will require all
new analysis and possibly testing to prove that the design meets the
requirement for all operating conditions. The effort to do this will
likely exceed the maximum FAA estimate of three person years.
2. Then, the time to familiarize a new staff with the design, to
locate pertinent files, to relate those files to the long history of
the aircraft, and to develop test and compliance documents for new
regulations are time-consuming tasks that will add significant time and
costs to the FAA's estimates.
3. If the analysis shows that the design does not meet the newly
imposed requirements, redesign will be necessary. Such redesign would
increase the expense by a factor of 3 to 5, depending on the detail. It
would also increase considerably the expense to the operator of
installing the new design.
FAA's Response: The FAA agrees that additional time and costs will
be required to review the designs on some airplane types where design
information is not readily available. However, the FAA does not agree
that all of the work identified by the commenter is necessarily
required. As discussed previously in this preamble, the FAA extended
the compliance time for conducting the actions required by the SFAR,
which addresses the commenter's concern about the needed time. Further,
the FAA increased the number of engineering years to complete a Model
L-188 fuel tank system design review to 4 years. Additionally, as noted
in the earlier disposition of the comment relating to the applicability
of the SFAR, the FAA will consider the merits of exemptions to the
requirements of the SFAR based upon the number of airplanes in service
and the safety benefits that could be achieved by a safety review.
Cost of Safety Review of STC's on Older Airplanes
While commenters generally agree that the design review should
apply to STC's and field modifications, several commenters express
concern that the design review will be difficult to conduct on older
airplanes. In particular, reviewing non-fuel tank related STC's and
field approvals could be unmanageable for airplanes with a long service
life and with multiple owners. The commenters note that the FAA did not
make any accounting in the notice for the cost of addressing these
modifications.
One commenter proposes an alternative approach: A one-time
inspection to determine the configuration of the airplane and to verify
that wiring entering the fuel tank, and systems capable of generating
auto-ignition temperature into fuel tank structure, have not been
compromised by STC modifications. The commenter asserts that such an
inspection would require about 50 to 100 labor hours to perform. The
resultant inspection labor costs alone could amount to $28 million to
$52 million, depending upon the number of airplanes to be inspected
(for example, 7,000 airplanes x 100 hours per airplane x $70 per
labor-hour). This estimate does not include the cost of the downtime
(and resultant revenue loss) required to accomplish such an inspection;
yet the proposed compliance time of 12 months would require airplanes
to be pulled from revenue service for special inspection. In the
notice, the FAA had estimated that an annual increase in out-of-service
time of 11.5 hours to 32 hours would occur, depending upon the model,
and that this would result in lost net revenues of $6.4 million for a
12-month period. The commenter maintains that the one-time inspection
alternative would also require this much downtime.
FAA's Response: The FAA agrees that the costs associated with
reviewing non-fuel tank-related STC's and field approvals needs to be
addressed. However, we disagree with the commenter as to the direction
and magnitude of the effort that will be needed to evaluate these
factors. Specifically, we agree that a ``paper review'' of the
airplane's service history will be needed for compliance. We disagree
that this review will necessitate an airplane inspection that is
separate from the initial fuel tank system inspection and that the
labor hours for any such airplane inspection have been included in the
labor hours to complete the initial fuel tank inspection. We agree that
the amount of effort to complete
[[Page 23118]]
this ``paper review'' will vary across individual airplanes. Airplanes
that have been in near-continuous operation by major, national, and
regional airlines (the majority of the airplanes affected by the rule)
should possess well-documented service history records such that those
operators will need a minimal amount of time to complete the paper
reviews for those airplanes. However, we realize that there will be
smaller operators that will spend more time to trace their airplanes'
service histories--particularly if the airplane has had multiple
operators and owners. As a result, we have determined that it will take
an average of one engineering day (a cost of $880 per airplane) for an
operator to complete this paper review for every airplane.
Cost of Design Changes
Several commenters raise concerns about accounting for the costs of
new design changes that could be required under the proposed SFAR
requirements. One commenter representing manufacturers and operators
agrees, in general, that any design changes resulting from the safety
review should be handled outside the scope of the SFAR. However, there
would be additional costs associated with developing the necessary
design changes identified by the SFAR safety reviews. The commenter
points out that, in the notice, the FAA stated:
* * * the design review may identify conditions that would be
addressed by specific service bulletins or unsafe conditions that
would result in FAA issuance of an airworthiness directive (AD).
However, those future costs would be the result of compliance with
the service bulletin or the AD and are not costs of compliance with
the proposed rulemaking. Those costs would be estimated for each
individual AD, when proposed.
This commenter does not consider it appropriate for the FAA to
assert that none of these costs are attributable to the proposed
rulemaking. In those instances where new rules are created that go
beyond existing rules--essentially raising the current level of
safety--the cost of any design change driven by these new rules should
be considered as part of the total cost of the rule.
The commenter points to Sec. 25.981(a)(3) as such a rule that
proposes new, more-stringent requirements associated with evaluating
the effects of latent failures. Should compliance with this specific
rule require design changes broadly across the fleet, the costs would
be substantial. For example, if this rule were to affect half the U.S.
fleet (about 3,500 airplanes), and new design change costs averaged
$40,000 per airplane, the total cost would be $140 million.
The commenter acknowledges that it is not possible to predict what
effect the proposed rule would actually have on the fleet, but the
potential obviously exists for costs that range between $100 million
and $200 million, or more.
FAA's Response: The FAA disagrees that the cost of new design
change requirements should be included in the cost analysis for this
rule. As discussed in the notice, new design change requirements will
be implemented through the AD process, during which the FAA will fully
analyze the costs and the public will have an opportunity to comment on
the FAA's estimates.
Cost of Developing Maintenance and Inspection Instructions
One commenter disagrees with the FAA's assumption that the
development of maintenance and inspection instructions would simply be
part of the required SFAR safety review. On the contrary, this
commenter states that this work, in fact, must be done after completion
of the safety review. However, the commenter states that, if one
assumes that this effort represents 20 to 30 percent of the effort
associated with the basic safety review, then the cost could be on the
order of $10 million.
FAA's Response: The FAA partially disagrees that the costs of
developing the maintenance instructions were not included in the cost
analysis of the rule. The estimated labor hours required for the design
review specifically included an estimate of 0.15 year to one year of
engineering time for the TC holders, and 0.1 year to 0.25 year for the
fuel tank system STC holders, to develop the inspection and maintenance
recommendations. Further, we had assumed that the design approval
holder recommendations would have been completed after the fuel tank
system review. Nevertheless, as the proposed compliance time was 1
year, the fact that developing the recommendations after completing the
fuel tank system review had no effect on the present value of the
estimated costs because all of the expenditures would have occurred in
the first year. This is not the case for the 18-month compliance time
provided in the final rule. We have determined that all of the
engineering costs to develop the recommendations will occur during the
second year after the effective date of the rule. We have included
those costs in the final economic analysis.
Cost To Comply With the SFAR
One commenter asserts that the combined cost of the safety review
and development of instructions may well be $180 to $330 million,
rather than the $16 million estimated by the FAA.
FAA's Response: The FAA disagrees with the underlying assumptions
made by the commenter to develop this estimate. The commenter's first
assumption is that $100 million to $200 million of these costs are
based on the commenter's argument that, ``Should compliance with this
specific rule require design changes broadly across the fleet, the
costs would be substantial. For example, if [emphasis FAA] this rule
were to impact half the U.S. fleet (about 3,500 airplanes) and
modification costs averaged $40,000 per airplane, the total cost would
be $140 million. It is not possible to predict what effect this new
rule would actually have on the fleet, but the potential obviously
exists for costs that range between $100 million and $200 million, or
more.'' [The commenter is referring to the requirements of
Sec. 25.981(a)(3) of the rule, which involve evaluating the effects of
latent failures.]
This argument assumes that the cost of the potential future AD's
should be attributed to this rule. As stated earlier, we maintain that
the cost of complying with potential future AD's is attributed
specifically to those individual AD's when they are issued. As a
result, we have determined that there are no compliance costs
attributable to this rule for any future design changes that will be
accomplished through an AD.
The commenter's second assumption is that the fuel tank system
review costs will be two to three times the $16 million estimated by
the FAA, plus there will be an additional $14 million to review the
fuel tanks for the variations within models. As noted earlier, we
disagree with the amount of engineering time assumed by the commenter,
as well as the number of fuel tank reviews that will be performed. We
have recalculated the estimated compliance cost and determined that it
will be about $30 million.
Finally, the commenter assumes that each airplane will need a one-
time inspection to verify that previous airplane modifications have not
compromised the wiring entering the fuel tank and entering the systems
capable of generating autoignition temperatures into fuel tank
structure. The commenter estimates this will cost $28 million to $52
million for labor, and $6.4 million for lost net revenue due to out-of-
service time. As noted earlier, we
[[Page 23119]]
agree that an individual airplane review will be needed, but we
disagree in that the labor hours have been included as part of the
labor hours to perform the initial fuel tank system inspection. We
have, however, calculated a $5.5 million cost for a ``paper review'' of
every airplane's service history.
Based on these figures, we conclude that the costs to comply with
the SFAR will be $35.5 million. (More details concerning these costs
are explained later in this preamble.)
Cost of Operating Rule Changes
One commenter agrees with the statement in the notice that read:
The FAA intends that any additional fuel tank system inspection
and maintenance actions resulting from the SFAR review would occur
during an airplane's regularly scheduled major maintenance checks.
From a safety standpoint, repeated entry increases the risk of
damage to the airplane. Thus, the proposal would not require air
carriers to alter their maintenance schedules, and the FAA
anticipates that few or no airplanes would be taken out of service
solely to comply with the proposal unless an immediate safety
concern is identified.
This commenter strongly recommends that the FAA ensure that the
final rule does not penalize the industry by requiring inspection
intervals more frequent than truly necessary, or lead to unnecessary
hard-timing of (placing life-limits on) components.
FAA's Response: The FAA responds to this commenter by reiterating
that the intent is to have the maintenance and inspections generated by
this rule be developed so that the tasks can be performed during
regularly scheduled maintenance.
Cost of Inspections
One commenter disagrees with the number of hours that the FAA
estimated would be required to conduct the added inspections required
by the rule. The commenter calculates that the metric will be 300 to
500 labor hours per airplane every 9 to 11 years, plus any parts
replacement costs yet to be defined by the manufacturer.
Another commenter suggests that the cost analysis needs to be
adjusted to address in-tank inspections. The commenter asserts that the
FAA assumes that much of the in-tank inspection work will be
accomplished during heavy maintenance checks when the tanks are open
and purged. However, for some aircraft, the tanks are opened only once
every eight years for scheduled maintenance. Therefore, if in-tank
inspections are mandated, some aircraft will have to be removed from
scheduled service and the costs associated with this should be
considered in the rule. Also, the costs of preparing tanks for entry
should be considered.
FAA's Response: The FAA agrees with the first commenter. Assuming
the commenter's airplanes were manufactured between 1960 and 1980, we
calculated that the initial fuel tank system inspection, plus the two
reinspections that will occur during a 12-year period, will result in a
total number of 330 labor hours per airplane.
We disagree with the second commenter. The commenter states that 60
percent of the initial fuel tank system inspections will be performed
during a ``C'' check , which will require that the fuel tank be opened,
drained, and vented. We included these costs in the number of labor
hours for the initial inspection, which are twice the number of labor
hours for the later reinspections that will be performed during ``D''
checks. Further, we included a value for the lost net revenue to the
aviation system as a result of the additional number of out-of-service
days (from one to three days) for the initial fuel tank system
inspections performed during the ``C'' check.
Cost of Complying With New Method of Addressing Latent Failures
One commenter states that the new treatment of latent failures (to
maintain the probability of occurrence of a given latent failure to
less than 1 x 10-\7\), as would be required by
Sec. 25.981(a)(3), will lead to enormous costs with no attendant
benefit. As an example, a component with a latent failure rate of 1 x
10-\9\ per flight-hour would have to be inspected (or hard-
timed) every 100 hours (or 200 hours, if an average exposure time is
assumed to be T/2) to keep the probability of failure under
1 x 10-\7\. A component failure rate of
1 x 10-\8\ per flight-hour would require inspection every
day (10 hours). The commenter asserts that the benefit derived from
performing such inspections or hard-timing is nil, and the implications
of such a rule are self-evident.
Further, this commenter points out that the FAA's cost estimate for
the operational rule changes is $154 million over 10 years, and that is
based upon the assumption that the required maintenance and inspection
programs will coincide with an airplane's regularly scheduled major
maintenance checks. However, the commenter states that the situation
described above would result in numerous inspections that would not
align with these regularly scheduled checks. In addition, it could lead
to widespread hard-timing of components (e.g., pumps). The commenter
notes that the FAA did not consider either of these possibilities in
the cost analysis; however, the magnitude of the cost impact could
extend into the billions of dollars.
FAA's Response: The FAA does not concur. The conclusion of this
commenter that the costs of compliance with Sec. 25.981(a)(3) ``could
extend into the billions of dollars'' is based upon an assumption
concerning the impact of the requirement. The example provided by the
commenter, which assumes that the requirement limits the probability of
latent failure to less than 1 x 10-\7\, indicates a
misinterpretation of the requirement. The rule does not allow a single
failure to hazard the airplane, regardless of the probability of its
occurrence. The FAA expects that designs that have single failures that
can result in an ignition source will be modified to include fail-safe
features. Modifications may also be necessary to address combinations
of failures. If a fuel tank system is designed such that the safety
level is heavily dominated by one of the components or features in the
combinations of failures, then added inspections, hard-timing, or
installation of annunciation features to eliminate latency are exactly
what was intended by the regulation. The need for inspections and hard-
timing can be limited by providing redundancy and fail-safe features
and/or by eliminating latency. Therefore, inspection or replacement of
components at the rate noted by the commenter would not be required.
The FAA position is supported by another commenter who provided
information regarding transient suppression units (TSU) developed for
the Boeing Model 737 and 747 airplanes. The commenter states, ``The TSU
eliminates the need to inspect harnesses, probe terminations, etc. The
TSU itself would be subject to periodic (25,000 hours) inspections.''
It should be noted that heavy maintenance checks typically occur on
transport airplane models prior to accumulating 25,000 hours time in
service; therefore, the cost of inspections for the TSU units would be
low.
The speculation by the commenter that ``the magnitude of the cost
impact could extend into the billions of dollars'' is based on a
misunderstanding of the final rule and, therefore, was not considered
in the final economic analysis.
Costs of New Modifications
One commenter expresses concern that the cost analysis is ``greatly
flawed'' because it did not consider all the costs
[[Page 23120]]
that will result from the requirements of the SFAR, such as high cost
items like aircraft modifications and ``hard timing'' of components.
The cost analysis takes credit for the benefits that will result from
these modifications; however, the commenter considers that the costs
should be included as well.
As an example of the potential costs of modifications, this
commenter provided the following specific information concerning how
the proposal would affect its fleet of airplanes: The commenter owns
approximately 160 Boeing Model 727 airplanes. As a result of the
proposed SFAR safety review, some of the modifications that might be
mandated for these airplanes are:
Replacement of the analog FQIS with a digital FQIS;
Installation of current suppression devices;
Installation of flame arrestors; and
Possibly, replacement of fuel boost pumps.
The cost of these modifications alone, based on data received from
the equipment manufacturers, is approximately $125,000 per airplane.
Since some of the commenter's airplanes already have a FQIS installed,
the cost to modify the commenter's fleet would be approximately
$17,000,000. This figure does not include other modifications that
might be mandated for the airplanes. The commenter points out that this
is the modification cost for only one aircraft type for one airline. If
all costs for all U.S. registered aircraft were to be included, the
result would be far greater than the total indicated in FAA's cost
analysis presented in the notice.
FAA's Response: The FAA does not agree that the cost analysis
concerning possible modifications was flawed. Section 25.901(b)(2)
requires that the ``Components of the installation must be constructed,
arranged and installed so as to ensure their continued safe operation
between normal inspections and or overhauls.'' As stated in the notice,
``Typical transport category airplane fuel tank systems are designed
with redundancy and fault indications features such that single
component failures do not result in any significant reduction in
safety. Therefore, fuel tank systems historically have not had any
life-limited components or specific detailed inspection requirements
unless mandated by AD.'' We agree that some past design practices have
been deficient and that adding the specific requirement in
Sec. 25.981(a)(3) to address latent failures may require new design
features for existing airplanes. We also agree with the commenter that
modifications to the FQIS and/or any other wiring entering the fuel
tank system may be required (such as separation and shielding of FQIS
wiring or, for older airplanes, installation of transient suppression
devices). We do not agree that the rule would mandate replacement of
analog FQIS with digital systems, although this may be one method used
on certain portions of the fleet. However, because correcting those
design deficiencies will be accomplished through the AD process, those
compliance costs will be estimated when the relevant AD is proposed.
The SFAR does not require installation of flame arrestors in fuel
tank vents. We have initiated tasking an ARAC group to provide
recommendations addressing both a part 25 amendment and retroactive
operational requirement for installation of flame arrestors in fuel
tank vent outlets. If any rulemaking is subsequently proposed based on
the recommendations, the FAA will conduct separate economic analyses
for those proposals.
Cost of Changes to Part 25 on Future Designs
One commenter disagrees with the FAA's cost analysis regarding the
affects of changes to part 25 requiring ``minimizing flammability.''
This commenter points to a statement in the notice that read:
The FAA anticipates that the proposed part 25 change would have
minimal effect on the cost of future type certificated airplanes
because compliance with the proposed change would be done during the
design phase of the airplane model before any new airplanes would be
manufactured.
The commenter considers that the FAA's assumption is incorrect.
Proposed Sec. 25.981(c)(1) would require that the fuel tank
installation include ``a means to minimize the development of flammable
vapors in the fuel tanks.'' Moreover, the FAA states that it intends
that the body tanks ``cool at a rate equivalent to that of a wing
tank.''
The commenter asserts that, based on this requirement, the cost
impact to future airplane designs could be substantial. As an example,
the commenter presents a preliminary cost assessment of a directed
ventilation system, below. The commenter derived the cost estimates
from a report prepared by an ARAC working group (Fuel Tank
Harmonization Working Group). These fuel tank cooling cost estimates
are divided into the categories indicated. The analysis considers the
costs associated with small, medium, and large airplane designs. (It
should be noted that directed ventilation systems of the type evaluated
would not cool a center wing tank at a rate equivalent to that of a
wing tank.)
1. Development costs per airplane design = $2.8 million.
2. Installation costs per production airplane = $21,200.
3. Additional airplane operational costs per airplane per year:
Small airplane = $30,408.
Medium airplane = $39,295.
Large airplane = $50,518.
Using these numbers, a simple calculation may be performed to
estimate the recurring costs associated with such a system over a 10-
year period. These costs would consist of the installation costs per
production airplane and the additional operational costs per airplane
per year, applied to a fleet of a new airplane design with an assumed
production rate. The following table presents the results of this
simple estimate for a 10-year period (ignoring inflation, cost of
capital, and so on):
----------------------------------------------------------------------------------------------------------------
Annual Operational
Size production rate Production cost cost Total cost
----------------------------------------------------------------------------------------------------------------
Small....................................... 180 $38,160,000 $301,039,200 $339,199,200
Medium...................................... 72 15,264,000 155,608,200 170,872,200
Large....................................... 60 15,264,000 129,673,500 144,937,500
----------------------------------------------------------------------------------------------------------------
Although the above example is simplistic in nature, the commenter
maintains that the conclusion may be drawn that the overall potential
costs are indeed substantial, even if the initial developmental costs
are not.
FAA's Response: The FAA disagrees with the commenter. The
requirements of the final rule should result in very little increased
production costs. Certain airplane models in production today locate
sources of heat away from the
[[Page 23121]]
center wing fuel tanks. Other models locate the air conditioning packs
below the center wing fuel tank, but incorporate air gaps that are
ventilated such that heat transfer into the center wing tank is
significantly reduced. Other airplane models incorporate directed
ventilation means for areas below the heated center wing tanks.
The FAA does not agree with the cost assessment provided by the
commenter. The cost estimate referenced by the commenter is stated to
apply to ``present airplane designs.'' It assumes that the
environmental control system (ECS) packs will be located adjacent to
the center wing tank, and that heat shields and ventilation air would
be used to remove heat from the center wing fuel tank. This approach
results in added weight and drag penalties. New designs allow the
designer numerous options to achieve an optimized design. Air
conditioning equipment can, and has been, located away from fuel tanks.
Cooling air is available from the ECS system, ground sources and
outside air in flight. Incorporation of these features in the initial
design would result in little added cost over that of features noted in
the preceding paragraph on many airplane designs.
The ARAC report, from which the commenter has gathered data for its
cost estimates, includes a discussion to ``locate significant heat
sources away from fuel tanks.'' The report states that, ``* * *
quantifying the impact of this method would only be possible for
specific new designs,'' and the report provides little data regarding
the costs for locating packs away from fuel tanks. We agree with the
commenter that cooling air may be needed to meet the requirements of
this regulation and this can result in additional operating costs
during certain flight operations. However, these costs are airplane
model design-specific and could not be estimated without input from the
industry. Nevertheless, in the absence of specific industry design and
cost data, we maintain that these additional operating costs will be
minimal. Further, these costs will occur on airplanes that will be
manufactured many years in the future and, as a result, the present
value of those operating costs will be even less.
Paperwork Reduction Act
There are no new requirements for information collection associated
with this amendment that would require approval from the Office of
Management and Budget pursuant to the Paperwork Reduction Act of 1995
(44 U.S.C. 3507(d)).
International Compatibility
In keeping with U.S. obligations under the Convention on
International Civil Aviation, it is FAA policy to comply with
International Civil Aviation Organization (ICAO) Standards and
Recommended Practices to the maximum extent practicable. The FAA
determined that there are no ICAO Standards and Recommended Practices
that correspond to these regulations.
Economic Evaluation, Regulatory Flexibility Determination, Trade Impact
Assessment, and Unfunded Mandates Assessment
Changes to Federal regulations must undergo several economic
analyses. First, Executive Order 12866 directs each Federal agency to
propose or adopt a regulation only if the agency makes a reasoned
determination that the benefits of the intended regulation justify its
costs. Second, the Regulatory Flexibility Act of 1980 requires agencies
to analyze the economic impact of regulatory changes on small entities.
Third, the Trade Agreements Act (19 U.S.C. section 2531-2533) prohibits
agencies from setting standards that create unnecessary obstacles to
the foreign commerce of the United States. In developing U.S.
standards, this Trade Act requires agencies to consider international
standards. Where appropriate, agencies are directed to use those
international standards as the basis of U.S. standards. Fourth, the
Unfunded Mandates Reform Act of 1995 requires agencies to prepare a
written assessment of the costs, benefits, and other effects of
proposed or final rules. This requirement applies only to rules that
include a Federal mandate on State, local, or tribal governments,
likely to result in a total expenditure of $100 million or more in any
one year (adjusted for inflation).
In conducting these analyses, the FAA has determined that this
rule: (1) Has benefits which justify its costs and is a ``significant
regulatory action;'' (2) will have a significant impact on a
substantial number of small entities; (3) has minimal effects on
international trade; and (4) does not impose an unfunded mandate on
state, local or tribal governments or the private sector. The FAA has
placed these analyses in the docket and summarizes them as follows.
Data Sources
The principal data sources used for this analysis are:
The public comments submitted to the notice for this
rulemaking action;
The World Jet Inventory at Year-End 1999;
Back Aviation Solutions (Fleet PC, Version 4.0);
Information from service bulletins; and
FAA discussions with industry engineers.
Affected Airplanes and Aviation Sectors
In the notice, the FAA, using 1996 data, estimated that the
proposal would have affected 6,006 airplanes. Of this number:
5,700 airplanes were operated by 114 air carriers under
part 121 service,
193 airplanes were operated by 7 carriers that operated
under both part 121 and part 135,
22 airplanes were operated by 10 carriers under part 125
service, and
91 airplanes were operated by 23 carriers operating U.S.-
registered airplanes under part 129.
At that time, the FAA did not have information on airplanes
operating under part 91 that would have been affected by the proposal;
however, the FAA had stated its belief that very few airplanes
operating under part 91 would have been affected by the proposal.
The FAA also estimated that the proposed rule would have affected:
12 manufacturers holding 35 part 25 type certificates
(TC's);
26 manufacturers, airlines, and repair stations holding
168 supplemental type certificates (STC's) for part 25 fuel tank
systems, of which 69 were for different modifications;
Manufacturers of future, new part 25 type certificated
airplane models; and
Holders of future, new part 25 STC's for new fuel tank
systems.
At that time, the FAA was unable to predict the number of new
airplane TC's but, based on the average of the previous 10 years, the
FAA had anticipated that 17 new fuel tank system STC's would be granted
annually. The FAA had requested comments on these estimates.
In order to update the aviation industry data, the FAA used a
different database for this final rule from what it used for the
analysis of the proposed rule. However, as this more current database
does not report the same information as that reported in the previous
database, an exact comparison between the two databases is not
possible. Consequently, using 1999 data, the FAA determined that the
final rule affects 6,971 airplanes, of which 6,252 are turbojets and
719 are turboprops. Of these 6,971 airplanes:
6,485 (5,802 turbojets and 683 turboprops) are operated by
143 scheduled and non-scheduled air carriers,
[[Page 23122]]
117 are operated by 76 private operators (primarily
corporations), and
369 are currently held by 112 manufacturers and brokers
and leasing companies.
The FAA also determined that the final rule affects:
13 manufacturers holding 37 part 25 type certificates
(TC's);
46 manufacturers, airlines, and repair stations holding
173 supplemental type certificates (STC's) for part 25 fuel tank
systems, of which 79 are for different fuel tank system modifications;
325 non-fuel tank system STC holders that will need to
evaluate their STC's to determine their impacts on fuel tank systems;
Manufacturers of future, new part 25 type certificated
airplane models; and
Holders of future, new part 25 STC's for new fuel tank
systems.
Based on the previous 10 years, the FAA projects that there will be
between two and four new part 25 TC airplane models during the next 10
years. Using the same methodology, the FAA projects that there will be
three to four new fuel tank system STC's annually granted during the
next 10 years.
Benefits
In the notice, the FAA had assumed that the potential U.S. fuel
tank explosion rate due to an unknown internal fuel tank ignition was
the same as that rate for the worldwide fleet over the years 1989
through 1998. On that basis, the FAA had estimated that, if no
preventative actions were to be taken, then between one and two (the
statistically expected value was 1.25) fuel tank explosions would be
projected to occur during the next 10 years (2000 through 2009) in U.S.
operations. The FAA also determined that the probability that such an
accident would have occurred prior to 2006 was equal to the probability
that it would have occurred after 2006.
In order to quantify the potential benefits from preventing a
``representative'' commercial aviation mid-air explosion, the FAA had
used:
A value of $2.7 million to prevent a fatality,
An average of 130 passengers and crew on a commercial
flight,
A value of $20 million for a destroyed airplane, and
A cost of $30 million for an investigation of a mid-air
explosion accident.
Thus, a total loss would be $401 million.
In the notice, the FAA had assumed that compliance with the
proposal would prevent between 75 percent and 90 percent of the future
fuel tank explosions. The basis for this prevention is derived
primarily from the incorporation of design changes to enhance fail-safe
features of design and enhanced fuel tank system inspections that will
discover conditions that could result in an ignition source before
ignition of flammable fuel vapors could occur. The fuel tank system
review, by itself, will have little direct effect on preventing these
future accidents, unless it uncovers an immediately hazardous condition
that results in an AD being issued. As stated earlier, the FAA has
initiated 40 AD's to address unsafe fuel tank system features on
numerous airplane types within the current fleet. While the FAA expects
these actions will significantly improve safety, an in-depth analysis
of all airplane models required by this rule has not been completed and
it would be difficult to predict the overall effect on the accident
rate. Therefore, the cost/benefit analysis assumes that the accident
rate for fuel tank explosions will remain constant until the reviews
are complete.
With the proposed 18-month compliance time, the FAA estimated the
benefits based on these inspections starting in 2001. The resulting
probability analysis indicated that the first such accident would occur
in 2006 and the second accident (if a second one would occur) in 2009.
On that basis, the estimated present value of the expected benefits
discounted over 10 years to 1999 at 7 percent would have been:
$260 million for one prevented accident and
$520 million for two prevented accidents.
For the final rule, the FAA revised these earlier estimates to
include the effect that lengthening the compliance time from 18 months
to 36 months has on the potential benefits. As a result, the 3-year
compliance time indicates that, with the exception noted in the
previous paragraph, the first benefits from improved fuel tank system
inspections will not occur until 2004.
The FAA also revised the earlier estimates to substitute more
current fleet and operations data into the calculations. The FAA also
noted that 2 years without a mid-air explosion have passed since the
analysis of the proposal, which makes the years 1989 through 2000
(rather than 1989 through 1998) the appropriate timeframe for
calculating the historical accident rate. On that basis, the FAA
calculated that, if no preventative actions were taken, between one and
two (the expected value is 1.09) fuel tank explosions would be expected
to occur during the 10-year time period of 2004 through 2013. Further,
the FAA determined that the probability that the first accident would
occur on or before the year 2008 is the same as the probability that it
would occur after 2008.
Thus, based on a loss of $401 million for a ``representative''
accident, the FAA calculated that the present values of the losses from
future mid-air explosions that would occur between 2004 and 2013 are:
$233.7 million for one prevented accident and
$400.4 million for two prevented accidents
(The statistically expected value is $248.9 million for the 1.09
accidents.)
For this final rule analysis, the FAA reviewed the public comments
and its previous analysis for the notice, and determined that the data
are insufficient to permit a credible estimate of the percentage of
future mid-air explosion accidents that the final rule would prevent.
The uncertainty of the causes of the two accidents and the uncertainty
of the effects of the 40 AD's on preventing future explosions does not
allow a quantitative estimate of the potential effectiveness of the
final rule. Thus, although the FAA believes that the rule will
significantly reduce the risk of a future accident, the FAA does not
calculate quantified benefits resulting from the final rule.
Sources of Compliance Costs for the Proposal and the Final Rule
The costs to comply with the SFAR derive from the engineering time
to comprehensively review fuel tank system designs by the design
approval holders (i.e., part 25 TC holders, part 25 fuel tank system
STC holders, and certain part 25 non-fuel tank system STC holders).
There also are costs to operators that derive from the engineering time
to conduct the design review for any field approvals on their airplanes
and to develop any necessary fuel tank system inspections and
maintenance recommendations for operators and repair stations.
These reviews may also identify conditions that will subsequently
need to be addressed by specific service bulletins, or unsafe
conditions that would subsequently require the FAA to issue AD's.
However, those future costs are not the costs of compliance with this
SFAR; rather, they are costs to conform to the service bulletin or to
comply with the AD, and would be estimated for each individual service
bulletin or AD when it is issued or proposed.
The costs to comply with the operational rule changes of this final
[[Page 23123]]
rule derive from the requirements that operators incorporate these
recommendations into their maintenance manuals and then inspect and
maintain the fuel tank systems accordingly. As a result, additional
airplane mechanic labor time will be needed during an airplane
inspection to perform an enhanced inspection of the fuel tank system
and components. However, the costs to repair and replace equipment and
wiring that the inspection identifies as needing repair or replacement
is not a cost of compliance with the operational rules changes.
Although these costs can be substantial, they are attributable to
existing FAA regulations that require such repairs and replacements to
be made in order to assure the airplane's continued airworthiness.
Finally, the part 25 revisions of this final rule may require some
future TC and STC's to employ designs of fuel tank systems and other
aviation systems that would not have been used were it not for these
revised certification requirements.
Estimated Total Compliance Costs for the Proposal
As seen in Table 1, the FAA had estimated in the notice that the
present value in 1999 of the compliance costs with the proposal during
the time period 2000-2011 would have been about $170 million ($9.5
million for TC holders, $4.9 million for STC holders, and $153 million
for operators). The following sections briefly summarize the
discussions in the notice about these various cost estimates.
Table 1.--Present Value in 1999 of the Costs of Compliance With the
Proposed Rule
[As estimated in the preliminary regulatory evaluation]
------------------------------------------------------------------------
Present value
in 1999 of the
compliance
Source of cost costs (in
1998 $
millions)
------------------------------------------------------------------------
Fuel Tank Review (Total)................................ 14.4
[For TC Holders: 9.5]
[For STC Holders: 4.9]
Maintenance and Inspection.............................. 100.0
Lost Net Revenue........................................ 35.6
Additional Recordkeeping................................ 17.4
---------------
Total............................................... 167.4
------------------------------------------------------------------------
Proposed Costs of Fuel Tank System Design Review
By way of explanation, for the purpose of this analysis, an
airplane ``model'' is defined to refer to a type certificate airplane
(for example, a Model 737); whereas, an airplane ``series'' is defined
to refer to a version (often under an Amended TC) of a model (for
example, a Model 737-300).
In the notice, the FAA had estimated that 35 TC's and 68 fuel tank
system STC's would have needed a fuel tank system design review.
Depending upon the airplane model, the FAA had estimated that a fuel
tank system design review would have taken between 0.5 to 2.0 engineer
years for a TC holder, and an average of 0.25 engineer year for a fuel
tank system STC holder. The FAA had also estimated that developing
manual revisions and service bulletins would have taken between 0.25 to
1.0 engineer years for a TC holder, and an average of 0.1 engineer year
for a fuel tank system STC holder.
Using a total engineer compensation rate (salary and fringe
benefits, plus a mark-up for hours spent by management, legal, etc. on
the review) of $100 an hour, the FAA had estimated that the one-time
fuel tank system design review would have cost TC holders $9.5 million,
and it would have cost STC holders $4.9 million.
Proposed Costs of Fuel Tank System Inspections--Operational Rule
Changes
The costs to operators of complying with the proposed operational
requirements would have been the additional airplane mechanic labor
hours and the lost net revenue from the airplane's additional time out-
of-service in order to complete the fuel tank system inspections and
maintenance. The FAA had assumed that the design approval holders'
recommendations would have required fuel tank systems to be inspected
only during the regularly scheduled major maintenance checks. As a
result, the FAA had expected that no airplanes would have been taken
out of service solely to inspect the fuel tank system unless the fuel
tank system review would have identified an immediate safety concern.
In that case, the corrective action would have been mandated by an AD.
On that basis, the FAA had determined that operators would have
needed to take four actions to comply with the proposal that would have
either required an expenditure of resources or lost revenue:
The first action involves the labor time to incorporate
the design approval holders' recommendations into the maintenance
manuals.
The second action involves the labor time to perform the
enhanced fuel tank system inspections, which includes testing of fuel
tank system equipment and wiring.
The third action involves the lost net revenue from an
airplane's increased out-of-service time due to the enhanced fuel tank
system inspection.
The fourth action involves the labor time to provide the
increased documentation, recording, and reporting the results from the
fuel tank system inspections and tests.
The FAA had assumed that each operator has one maintenance manual
for each airplane model in its fleet. The FAA then determined that
there were 290 individual airplane model/operator combinations. The FAA
estimated that it would have taken 5 engineer days (at a cost of $4,000
per manual) to incorporate these recommendations into the various
maintenance manuals. On that basis, the FAA had calculated that this
total cost would have been $1.16 million. As these expenses would have
occurred in the second year, the present value of these costs was
$1.084 million.
With respect to the costs of fuel tank system inspections, the FAA
had estimated that it would have taken between 60 and 330 additional
labor hours per airplane to complete the initial fuel tank system
inspection, and it would have taken between 30 and 180 additional labor
hours per airplane for later fuel tank system reinspections. All of the
initial inspections would have been completed during the first 3 years
after the maintenance manual changes had been approved by the FAA
(i.e., during the years 2002 through 2004). Each airplane would have
been reinspected every 3 years after the initial fuel tank system
inspection. Using a total compensation rate (wages and fringe benefits,
plus a mark-up for time spent by supervisors, management, etc. on the
inspections) of $70 an hour for airplane mechanics, the FAA had
estimated that the initial fuel tank system inspection would have cost
between $4,200 and $23,100 per airplane and fuel tank system
reinspections would have cost between $2,100 and $12,600 per airplane.
The present value of the total fuel tank system inspection costs,
discounted at 7 percent over the period 2002 through 2011, would have
been $99 million.
In the notice, the FAA had assumed that the initial fuel tank
system inspection would have been performed during a ``C'' or a ``D''
check. On that basis, the FAA had estimated that the additional out-of-
service time would have been between 36 hours and 96 hours per airplane
for each airplane inspected during a ``C'' check, and would have been
zero hours for each airplane inspected during a ``D'' check. Similarly,
the FAA had estimated that the additional out-of-service time would
[[Page 23124]]
have been between 24 hours and 72 hours for each airplane fuel tank
system reinspection that would have occurred during a ``C'' check, and
would have been zero hours if the reinspection would have occurred
during a ``D'' check.
The economic cost of out-of-service time is the lost net revenue to
the aviation system. Most of the passengers who would have flown on an
airplane that has been taken out of service will take another flight.
As a result, most of the lost revenue for that out-of-service airplane
is actually captured by other airplane flights. The cost of the rule is
the loss to the aviation system--not to the individual airplane
operator. On that basis, the FAA computed the lost revenue to the
aviation system by using the Office of Management and Budget (OMB)
determination that the average annual risk-free productive rate of
return on capital is 7 percent of the average value of the airplane
model. Thus, the FAA had calculated that the out-of-service lost
aviation net revenue per fuel tank system inspection would have ranged
from $50 to $9,750 per airplane per day. The present value of this
total lost aviation net revenue, discounted at 7 percent over 10 years,
would have been $35.6 million.
The FAA had determined that the increased annual documentation and
reporting time would have been 1 hour of recordkeeping for every 8
hours of labor time for the initial fuel tank system inspection, and
would have been 1 hour of recordkeeping for every 10 hours of labor
time for the reinspections. Thus, the per airplane documentation cost
would have been between $450 and $2,550 for the initial fuel tank
system inspection and $300 to $1,620 for a fuel tank system
reinspection. The present value of the total recordkeeping cost
discounted at 7 percent for 10 years would have been $17.4 million.
Proposed Costs of Future Fuel Tank System Design Changes--Revised Part
25
The FAA had determined that the part 25 changes would have a
minimal effect on the cost of future type certificated airplanes
because compliance with the proposed changes would be done during the
design phase of the airplane model before any new airplanes would be
manufactured. In addition, the FAA had determined that the part 25
changes would have a minimal impact on future fuel tank system STC's
because current industry design practices could be adapted to allow
compliance with the requirement.
Differences in Assumptions and Values Between the Notice and the Final
Rule
The most significant difference between the proposal and the final
rule is that the proposal allowed only 12 months for design approval
holders to complete their fuel tank system reviews and recommendations.
The proposal also allowed operators only 6 months to incorporate these
recommendations into their maintenance manuals. The final rule allows
design approval holders 18 months to be in compliance and also allows
operators 18 months after that to incorporate the recommendations into
their maintenance manuals.
Table 2 lists the most significant differences in the assumptions
made, data used, and the different requirements between the proposal
and the final rule. Although there are other differences that have
altered the calculated costs, the differences listed in Table 2 are the
significant ones.
Table 2.--Significant Differences in Assumptions and Values Between the
Preliminary Regulatory Evaluation and the Final Regulatory Evaluation
------------------------------------------------------------------------
Preliminary
Assumption or value regulatory Final regulatory
analysis analysis
------------------------------------------------------------------------
Number of Airplanes............. 6,006 (in 1996)... 6,971 (in 1999).
Timeframe for Analysis.......... 2000-2011......... 2001-2013
Net Rate of Fleet Growth........ 4.3 percent....... 3.0 percent.
Hourly Compensation per: $100; $70......... $110; $75.
Engineer; Mechanic.
Number of Fuel Tank System TC 35................ 98 (46 ``full-
Reviews. scale'' and 52
``derivative'').
Number of Engineering Years for 0.5 to 2.......... 0.5 to 3.
TC Review.
Number of Fuel Tank System STC 68................ 74
Reviews.
Number of Engineering Years for 0.35.............. 0.15
Fuel Tank System STC Review.
Number of Non-Fuel tank system None (Asked for 325
STC Reviews. Comments).
Number of Engineering Years for None (Asked for 0.0375
Non-Fuel tank system STC Review. Comments).
Operator Paper Review of None.............. 1 engineer day per
Airplane Fuel Tank System-Field existing
Approvals/STC's. airplane.
Number Months to Compete Safety 12................ 18
Review Fuel Tanks.
Number Months to Revise 6................. 18
Maintenance Manual (After
Review).
Number Years to Complete Initial 3 years (Completed 2 years (Completed
Inspection (After Manual between 2002 and during 2004 and
Revision). 2004). 2005).
Determinants of Number Airplane Model.... Airplane Model
Inspection Hours. plus Year
Manufactured.
Time before Initial Inspections 18 months......... 36 months.
Begin.
Number Years to Complete Initial 3 years........... 2 years.
Inspection.
Number Labor Hours for Initial 50 to 198......... 49 to 218.
Inspection.
Number Days Out-of-Service for 0 to 4 (40 percent 0 to 4 (60 percent
Initial Inspection. inspections done of inspections
at ``C'' checks). done at ``C''
checks).
Year Reinspections Start........ 2004 (immediately 2008 (2 years
after initial after initial
inspections). inspections).
Reinspection Frequency.......... Every 3 years Every 5 years (All
(Some done during done during ``D''
``C'' checks). checks).
Number Hours for Reinspection... 40 to 160......... 25 to 87.
Reduced Inspection Hours Due to All Model 747 No adjustment.
AD's Already Issued. hours not
included; 50
hours for Mode
737's not
included.
Number Days Out-of-Service for 0 to 3 (40 percent 0 (All
Reinspection. of reinspections reinspections
done at ``C'' done at ``D''
checks). checks).
------------------------------------------------------------------------
[[Page 23125]]
Cost of Compliance With the Final Rule
As seen in Table 3, based on the public comments and the changes in
assumptions and values listed in Table 2, the FAA has determined that
the present value of the costs of compliance with the rule over the
time period 2001--2013 are $165.1 million. This figure includes:
$27.1 million for TC holders,
$2.8 million for fuel tank system STC holders,
$2.6 million for non-fuel tank system STC holders, and
$132.5 million for operators.
The following sections summarize the results in the Final
Regulatory Evaluation.
Table 3.--Present Value of the Costs of Compliance With the Final Rule
------------------------------------------------------------------------
Present value
in 2001 of the
compliance
Source of cost costs (in
2000 $
millions)
------------------------------------------------------------------------
Part 25 Fuel Tank Design................................ 0.315
(For TC Airplanes: Minimal)...........................
(For Fuel Tank STC Holders: 0.315)....................
Fuel Tank Review (Total)................................ 38.157
(For TC Holders: 27.107)..............................
(For Fuel Tank STC Holders: 2.522)....................
(For Non-Fuel-Tank STC Holders: 2.594)................
(For Operators: 5.934)................................
Maintenance and Inspection.............................. 92.043
Lost Net Revenue........................................ 24.224
Additional Recordkeeping................................ 10.338
---------------
Total............................................... 165.077
------------------------------------------------------------------------
Costs of Fuel Tank System Design Review
In the Final Regulatory Evaluation, the FAA has determined that
existing TC holders will need to complete 46 ``full-scale'' fuel tank
system reviews for the individual airplane models, and 52
``derivative'' fuel tank system reviews for the separate series in the
models. Using the Model 737-300/400/500 family of airplanes as an
illustration, the FAA determined that Boeing will need to complete one
``full-scale'' review and two ``derivative'' reviews for this family of
airplanes. In addition, each airplane series that has an extended range
modification or a freighter modification will require a ``derivative''
fuel tank system review.
Depending upon the airplane model and the date it was first
manufactured, the FAA determined the following average numbers of
engineer years for the ``full-scale'' fuel tank system design review:
3 years for large turbojets (1969-1980),
2 years for large turbojets (1980-1988),
1 year for large turbojets (post-1988),
0.5 to 0.75 year for regional jets,
0.5 to 0.75 year for large turboprops, and
0.5 year for small turbojets and turboprops.
With respect to the ``derivative'' fuel tank system design reviews,
the FAA determined that these will take between 0.5 year and one year
for large turbojets, and 0.5 year for regional turbojets and for
turboprops.
The FAA determined that the amount of engineering time to develop
the recommendations for the maintenance manuals will be 20 percent of
the amount of time to complete the fuel tank system review.
Using a total engineer compensation rate of $110 an hour, the FAA
calculated that the one-time fuel tank system design review will cost
between $200,000 and $1.525 million per airplane model, with most of
the individual costs in the range of $500,000 to $800,000. These costs
will be about $125,000 to $150,000 for turboprops.
As the TC holder will have 18 months to comply with the final rule,
the FAA determined that one-half of the review costs will occur in the
first year (2002) and one-half will occur in the second year (2003),
and all of the costs to develop recommendations will occur in the
second year (2003). On that basis, the present value of the total one-
time cost of compliance to TC holders will be $27.1 million, of which
$22.7 million will be for the fuel tank system review and $4.390
million will be to develop recommendations for the maintenance manuals.
For part 25 fuel tank system STC holders, the FAA determined that
there are 74 fuel tank system STC's that will need to undergo a review.
The FAA also determined that it will take an average of 0.15
engineering year to complete the review because the STC holder had to
complete a substantial amount of engineering work to obtain FAA
approval of the STC, and many of the STC's affect only a part of the
fuel tank system. On that basis, the FAA determined that the average
cost for a fuel tank system STC review will be $33,000.
As the fuel tank system STC holder will have 18 months to comply
with the final rule, the FAA determined that one-half of the review
costs will occur in the first year (2002) and one-half will occur in
the second year (2003), while all of the time to develop
recommendations will occur in the second year (2003). On that basis,
the present value of the total one-time cost of compliance will be $2.5
million.
Certain part 25 non-fuel tank system STC holders will also need to
complete more than a cursory review of their modifications for the
potential impact on the fuel tank system. The FAA determined that there
are 325 non-fuel tank system STC's that will need to undergo a review.
The FAA also determined that this review will take one quarter of the
engineer time to complete a fuel tank system STC review (or 0.375
engineer year). On that basis, the FAA determined that the average cost
for a non-fuel tank system STC review will be $8,250.
As the non-fuel tank system STC holder will have 18 months to
comply with the final rule, the FAA determined that one-half of the
review costs will occur in the first year (2002) and one-half will
occur in the second year (2003), while all of the time to develop
recommendations will occur in the second year (2003). On that basis,
the present value of the total one-time cost of compliance will be $2.6
million.
Finally, based on the comments, the FAA determined that each
operator will perform a paper review of each airplane to determine the
modifications (including field approvals) that have been made on the
airplane. Although the vast majority of these airplanes have been
purchased by major, national, and regional airlines that should possess
well-documented maintenance history records, a significant minority of
these airplanes have had multiple owners or lessors and the maintenance
records may not be quite as complete. Thus, the FAA determined that, on
average, this paper review will take one day per airplane. On that
basis, the average cost per airplane will be $880.
In order to meet the 36-month compliance date, operators will need
to discover if their airplanes have any ``orphan'' STC's or if there
are any field approvals that affect the fuel tank system. Completing
these paper reviews will then give the operators 18 months, after the
TC and STC holders complete their required reviews, to complete any
additional fuel tank system engineering reviews and to make the
resultant changes to their maintenance manuals. Therefore, the FAA
determined that one-half of the review costs will occur in the first
year (2002) and one-half will occur in the second year (2003). On that
basis, the present value of the total one-
[[Page 23126]]
time cost of compliance will be $5.9 million.
There is also the potential that this ``paper review'' will reveal
a field approval or an ``orphan'' STC that affects the safety of the
fuel tank system. In that case, the operator would be responsible for
the engineering review and for developing inspection and maintenance
procedures for the maintenance manual. The FAA did not receive any data
on this factor, but maintains that it is likely to infrequently occur
and, further, the amount of engineering needed would be relatively
minor.
Costs of Fuel Tank System Inspections--Operational Rule Changes
As was true for the analysis in the notice, the costs to operators
of complying with the final rule's operational requirements do not
include the costs of corrective actions undertaken to repair
deficiencies in the fuel tank system that were found because of a fuel
tank system inspection, because the airplanes are required to be
maintained as airworthy.
On that basis, the FAA determined that operators will take four
actions that will generate costs or lost revenue to comply with the
final rule.
The first action involves the labor time to incorporate
the design approval holders' recommendations into the maintenance
manuals.
The second action involves the labor time to perform the
enhanced fuel tank system inspections, which includes testing of fuel
tank system equipment and wiring.
The third action involves the lost net revenue from an
airplane's increased out-of-service time due to the enhanced fuel tank
system inspection.
The fourth action involves the labor time to provide the
increased documentation, recording, and reporting the results from the
fuel tank system inspections and tests.
In calculating the compliance costs for maintenance manual
revisions due to TC holder recommendations, the FAA revised its
assumption made in the notice that each operator has one maintenance
manual for each model in its fleet. However, the FAA determined that
its assumption of 5 days of engineer time to modify a maintenance
manual is valid. Since the issuance of the notice, the FAA has been
informed that nearly all airlines with fewer than 20 airplanes contract
their major maintenance checks to third party (or other operators')
repair stations. The FAA determined that 49 airlines (each with 20 or
more airplanes) perform their own maintenance. For those 49 airlines,
there are 165 airplane model/operator combinations, which produces a
cost of $726,400. As these manual changes will not be made until the
year 2003, the present value of these compliance costs is $635,000.
The FAA also determined that 15 repair stations will perform these
fuel tank system inspections for the smaller operators and, on average,
each repair station will perform these inspections for 10 different
airplane models. The compliance costs for these repair stations will be
$660,000, which will be passed on to the operators. However, as these
manual changes will not be made until the year 2003, the present value
of these compliance costs is $576,475.
The FAA determined that it will take, on average, one engineer day
(or $880) for each maintenance manual to incorporate the
recommendations from a fuel tank system STC holder. The FAA also
determined that each of the 79 fuel tank system STC's will produce
inspection and maintenance recommendations that will affect, on
average, two maintenance manuals. On that basis, the compliance costs
will be $139,000. However, as these manual changes will not be made
until the year 2003, the present value of these compliance costs is
$121,450.
The FAA anticipates that implementation of the final rule will
result in the initial fuel tank system inspection to be performed at
the first major maintenance check after the maintenance manual
modifications have been approved by the FAA. As the FAA defines a ``C''
check (or its equivalents) as a major maintenance check, the FAA
determined that all of the affected airplanes will receive an initial
fuel tank system inspection by 2 years after the maintenance manuals
have been modified. Thus, the FAA determined that all of the initial
fuel tank system inspections will be performed in either 2004 or 2005.
The FAA made four adjustments to the number of airplane mechanic
hours for an initial fuel tank system inspection as estimated in the
notice:
The first adjustment is that the FAA added 20 labor hours across
the board in order to account for any unanticipated inspection
recommendations from the product approval holders.
The second adjustment is that the FAA varied the number of labor
hours not only by certification date but also by manufactured date of
the airplane. Older airplanes of an airplane model will require, on
average, more labor hours to complete an initial fuel tank system
inspection than will newer airplanes. As a result, the FAA separated
airplanes into 3 categories based on the date the airplane was
manufactured.
For the 1960-1980 group, the number of labor hours
estimated in the notice plus 20 hours was used.
Airplanes manufactured between 1981 and 1995 require 20
percent fewer labor hours than those for the 1960-1980 group.
Airplanes manufactured between 1995 and 2003 will require
30 percent fewer labor hours than those for the 1960-1980 group.
The third adjustment is that the number of labor hours to reinspect
fuel tank systems will be one-half of the number of labor hours needed
for the initial fuel tank system inspection, based on the last year
that the airplane model was manufactured.
The fourth adjustment is that the number of labor hours for the
first inspection of a future manufactured airplane's fuel tank system
will be the same as for later reinspections, and is the same number as
that to reinspect the newest airplane category.
Using those adjustments and the changes listed in Table 2, the FAA
determined that it will take between 49 and 218 labor hours to complete
an initial fuel tank system inspection, and it will take between 25 and
108 labor hours to complete a fuel tank system reinspection. Using a
total compensation rate (wages plus fringe benefits) of $75 an hour for
airplane mechanics, the FAA estimated that the initial fuel tank system
inspection will cost between $3,625 and $16,350 per airplane, and fuel
tank system reinspections will cost between $1,875 and $8,100 per
airplane. The present value of the total labor cost discounted at 7
percent for the period 2004 through 2013 is $92.043 million.
As stated earlier, the FAA had determined that the initial fuel
tank system inspection will be performed during a ``C'' or a ``D''
check. The duration and process of major inspections varies by airline
and airplane type. Some airlines choose to conduct these checks during
one time block of typically 7 to 10 days for a ``C'' check and 20 to 25
days for a ``D'' check. Other airlines conduct segmented checks where
the airplane is taken out of service for several shorter time intervals
that allow the overall task to be completed. The FAA has determined
that an airplane undergoing a segmented ``C'' check is, on average,
out-of-service for two days, whereas a segmented ``D'' check takes an
airplane out of service for 14 to 21 days. The FAA determined that two
mechanics can simultaneously work on a fuel tank system inspection. On
that basis, the FAA determined that
[[Page 23127]]
no additional out-of-service days will occur for 1 to 48 additional
labor hours. Each additional 48 labor hours after the first 48 labor
hours will add one day to the out-of-service time. On that basis, the
initial fuel tank system inspection will produce between 0 and 4
additional out-of-service days.
The economic cost of out-of-service time is the lost services from
a capital asset, which is computed by multiplying the airplane value by
the number of days out of service and by 7 percent (the OMB risk-free
rate of return). The average residual value of the turbojet models is
based on the AVITAS 2nd Half 1999 Jet Aircraft Values, and the average
value of the turboprop models is based on the AVITAS 2nd Half 1997
Turboprop Aircraft Values. Thus, the FAA calculated that the out-of-
service lost capital services from the initial fuel tank system
inspection will be between $200 and $86,000 per airplane per day.
As noted earlier, the FAA determined that one-half of the airplanes
will undergo an initial fuel tank system inspection in 2004 and one-
half will undergo an initial fuel tank system inspection in 2005.
However, 20 percent of these airplanes each year will receive this
inspection during a ``D'' check, in which there are no additional out-
of-service days due to the fuel tank system inspection. As a result,
the FAA calculated that the present value of the total lost net revenue
from the additional out-of-service days is $24.224 million.
For the final rule, the FAA determined that its original estimate
that every 8 hours of airplane mechanic labor for the initial fuel tank
system inspection will produce one hour of documentation and
recordkeeping labor hours is valid. However, the FAA determined that it
had overestimated the amount of recordkeeping for reinspections, and
used the ratio of 12 hours of reinspection airplane mechanic labor time
for 1 hour of documentation and recordkeeping. On that basis, the
present value of the recordkeeping cost is $10.338 million.
Costs of Future Fuel Tank System Design Changes--Revised Part 25
The FAA had determined that the part 25 change will have a minimal
effect on the cost of future type certificated airplanes because
compliance with the proposed change would be done during the design
phase of the airplane model before any new airplanes would be
manufactured. In addition, the FAA determined that the part 25 changes
will have a minimal impact on future fuel tank system STC's because
current industry design practices could be adapted to allow compliance
with the requirement.
Benefit-Cost Comparison
As noted, the FAA has not quantified the potential benefits from
this final rule because there is uncertainty about the actual ignition
sources in the two fuel tanks. However, using a ``representative''
commercial airplane, the FAA calculated that the losses from a mid-air
explosion would be $401.6 million. In addition, the FAA determined that
the present value of the compliance costs is $165.1 million.
If the final rule would prevent one such accident by the year 2014,
the present value of the prevented losses would be greater than the
present value of the compliance costs.
Therefore, based on these factors and analysis, the FAA considers
the final rule to be cost-beneficial.
Regulatory Flexibility Act
The Regulatory Flexibility Act of 1980 (RFA) establishes ``as a
principle of regulatory issuance that agencies shall endeavor,
consistent with the objective of the rule and of applicable statutes,
to fit regulatory and informational requirements to the scale of the
business, organizations, and governmental jurisdictions subject to
regulation.'' To achieve that principle, the RFA requires agencies to
solicit and consider flexible regulatory proposals and to explain the
rationale for their actions. The RFA covers a wide range of small
entities, including small businesses, not-for-profit organizations, and
small governmental jurisdictions.
Agencies must perform a review to determine whether a proposed or
final rule will have a significant economic impact on a substantial
number of small entities. If the determination finds that it will, the
agency must prepare a Regulatory Flexibility Analysis as described in
the RFA.
However, if an agency determines that a proposed or final rule is
not expected to have a significant economic impact on a substantial
number of small entities, section 605(b) of the 1980 act provides that
the head of the agency may so certify, and a Regulatory Flexibility
Analysis is not required. The certification must include a statement
providing the factual basis for this determination, and the reasoning
should be clear.
For the proposed rule, the FAA had conducted an Initial Regulatory
Flexibility Analysis, which established that it would have a
significant impact on a substantial number of small entities. As a
result, the FAA had specifically requested public comment on the
potential impact of the proposed rule on small entities.
Need for and Objectives of the Rule
The final rule is being issued in order to reduce the risk of a
mid-air airplane fuel tank explosion with the resultant loss of life
(as evidenced by TWA Flight 800). Existing fuel tank system inspections
have not provided comprehensive, systematic prevention and control of
ignition sources in airplane fuel tanks, thereby allowing a small, but
unacceptable risk of a fuel tank explosion.
The objective of the final rule is to ensure the continuing
airworthiness of airplanes certificated for 30 or more passengers or
with a payload of more than 7,500 pounds. Design approval holders
(including TC holders, fuel tank system STC holders, and holders of
certain non-fuel tank system STC's) will be required to complete a fuel
tank system design review and to provide recommendations and
instructions to operators and repair stations concerning fuel tank
system inspections and equipment and wiring testing. This review may
result in the development of service bulletins and AD's. All operators
covered by Title 14, Code of Federal Regulations (CFR) parts 91, 121,
and 125, and all U.S.-registered airplanes used in scheduled operations
under part 129, will be required to incorporate these recommendations
into their maintenance manuals and to perform the inspections and tests
as required. In addition, repair stations that are contracted to
perform maintenance are also required to comply with these
requirements.
Summary of Comments Made in Response to the Initial Regulatory
Flexibility Analysis
There were two commenters that indirectly discussed issues of
concern in the Initial Regulatory Flexibility Analysis:
The General Aviation Manufacturing Association (GAMA) supported the
FAA's decision to exclude airplanes certificated for 30 passengers or
fewer from the final rule. Although they did not address the small
business aspect of this decision, nearly every operator of these
excluded airplanes is a small entity. However, GAMA opposed the
proposed part 25 future design requirements as not appropriate for
business jets and stated that these airplanes should be excluded from
the part 25 requirements. The FAA disagreed with this comment because a
future business jet that has a 7,500 pound payload is a large airplane
and
[[Page 23128]]
its fuel tank system faces the same potential for explosion as other
large transport category airplanes.
The Regional Airline Association (RAA) supported the FAA's decision
to exclude airplanes certificated for 30 passengers or fewer from the
final rule. They, too, did not directly address the small business
aspect of this decision. However, they opposed the FAA's decision to
include airplanes certificated for fewer than 60 passengers or for less
than a 15,000 pound payload. Their primary argument in favor of this
exclusion is that these airplanes do not have a history of these types
of accidents. The FAA disagreed with this comment because, by itself,
the accident histories of specific types and classes of airplanes are
insufficient to demonstrate that their fuel tank systems attain the
required level of safety. An important consideration in these accident
histories is that these airplanes have not accumulated the number of
flight hours as those of the larger transport category airplanes. As
fuel tank explosions are rare events, there is the possibility that
such an accident has not occurred in these airplanes because not enough
hours have been flown. In addition, it may be that the fuel tank system
design review will reveal that these systems do not have the same risk
as the risk associated with larger transport category airplanes. In
that case, the impact of the rule on operators of these airplanes will
be much less than estimated by the FAA. However, until the fuel tank
system design review is completed, the FAA does not know what the
potential is for these airplanes to have a mid-air explosion and, as
the FAA cannot rule out the possibility, the FAA cannot exclude these
airplanes from coverage under the final rule.
Description and Estimate of the Number of Small Entities Affected by
the Final Rule
The FAA determined that there are a total of 143 U.S. airlines, 76
private operators (primarily corporations with corporate jets), and 112
manufacturers, airplane brokers, and airplane leasing companies
affected by the final rule. Of the 143 U.S. airlines, 107 are small
airlines. Nearly all of the 76 private operators are large corporations
that can afford to operate and maintain a corporate jet airplane. Most
of the airplane brokers and airplane leasing companies are privately
held corporations or partnerships, and the FAA was unable to establish
whether or not most of them are small entities.
Reporting and Recordkeeping Requirements
The final rule requires that operators maintain a record of the
results of the fuel tank system inspections and maintenance done on the
airplane. For the small operators that contract their maintenance to
third party repair stations (nearly all of the small airlines and other
operators), they will be required to keep a copy of the report that the
repair station will give them. Small entities will not need to acquire
additional professional skills to prepare these reports.
Description of the Alternatives Evaluated
In the Initial Regulatory Flexibility Analysis, the FAA had
evaluated three alternatives to the proposed rule:
The first alternative was to require all airplanes with 10
or more seats be covered by the proposed rule.
The second alternative was to require all airplanes with
30 or more seats and all airplanes with 10 or more seats in commercial
service be covered by the proposal.
The third alternative was to require only turbojet
airplanes in commercial service be covered by the proposal.
There were no comments from the public in support of these
alternatives. A complete discussion of these alternatives is available
in the public docket for this rulemaking.
Differences Between the Proposed Rule and the Final Rule Requirements
The primary change from the proposed rule is that the final rule
allows operators 36 months to comply whereas the proposed rule had
required compliance within 18 months. In addition, the FAA determined
that fewer fuel tank reinspections will be needed than the FAA had
estimated in the Preliminary Regulatory Evaluation. As a result, the
present value of the costs to operators will be approximately 20
percent less per airplane under the final rule than they would have
been under the proposed rule.
Conclusion
Both the proposed and final rule will have a significant impact on
a substantial number of small entities. Consistent with SBA guidance,
the FAA conducted an initial regulatory flexibility analysis (IRFA) and
a final regulatory flexibility analysis (FRFA). The initial regulatory
flexibility analysis provided a detailed analysis of the impact on
small entities. The FRFA directly addresses five requirements. While no
comments specifically addressed the IRFA, the FAA addresses comments
related to small entities.
As published in the notice, the FAA did not require fuel tank
inspections for aircraft with a payload under 7,500 pounds. The primary
difference between the proposed rule and the final rule is that the FAA
extended operator compliance time from 18 to 36 months. In addition,
the FAA determined that fewer fuel tank reinspections will be needed
than originally estimated in the NPRM.
As a result of these changes, about 140 airplanes that would have
been required to undergo a fuel tank inspection under the proposed rule
will not be required to undergo a fuel tank inspection under the final
rule because they will have been retired during the additional 18
months allowed for compliance. In addition, all of the inspections and
reinspections would have had to be completed 18 months earlier under
the proposed rule than under the final rule, resulting in a higher
present value of the compliance costs. Consequently, recalculating (due
to the greater number of airplanes and other values) the present value
of the costs to operators to comply with the proposed rule would result
in a cost of $172.2 million, which is approximately 36 percent more
than the $126.6 million costs to operators to comply with the final
rule.
Trade Impact Assessment
The Trade Agreement Act of 1979 prohibits Federal agencies from
engaging in any standards or related activities that create unnecessary
obstacles to the foreign commerce of the United States. Legitimate
domestic objectives, such as safety, are not considered unnecessary
obstacles. The statute also requires consideration of international
standards and, where appropriate, that they be the basis for U.S.
standards. In addition, consistent with the Administration's belief in
the general superiority and desirability of free trade, it is the
policy of the Administration to remove or diminish to the extent
feasible, barriers to international trade, including both barriers
affecting the export of American goods and services to foreign
countries, and barriers affecting the import of foreign goods and
services into the United States.
In accordance with the above statute and policy, the FAA assessed
the potential effect of this final rule and determined that it will
have only a domestic impact and, therefore, a minimal effect on any
trade-sensitive activity.
[[Page 23129]]
Unfunded Mandates Assessment
The Unfunded Mandates Reform Act of 1995 (the Act), enacted as Pub.
L. 104-4 on March 22, 1995, is intended, among other things, to curb
the practice of imposing unfunded Federal mandates on State, local, and
tribal governments.
Title II of the Act requires each Federal agency to prepare a
written statement assessing the effects of any Federal mandate in a
proposed or final agency rule that may result in a $100 million or more
expenditure (adjusted annually for inflation) in any one year by State,
local, and tribal governments, in the aggregate, or by the private
sector; such a mandate is deemed to be a ``significant regulatory
action.''
As seen in Table IV-13 in the Final Regulatory Evaluation
(contained in the docket to this rule), this final rule does not
contain such a mandate. Therefore, the requirements of Title II of the
Unfunded Mandates Reform Act of 1995 do not apply.
Executive Order 3132, Federalism
The FAA has analyzed this final rule under the principles and
criteria of Executive Order 13132, Federalism. We determined that this
action will not have a substantial direct effect on the States, or the
relationship between the national Government and the States, or on the
distribution of power and responsibilities among the various levels of
government. Therefore, we determined that this final rule does not have
federalism implications.
Environmental Analysis
FAA Order 1050.1D defines FAA actions that may be categorically
excluded from preparation of a National Environmental Policy Act (NEPA)
environmental impact statement. In accordance with FAA Order 1050.1D,
appendix 4, paragraph 4(j), this rulemaking action qualifies for a
categorical exclusion.
Energy Impact
The energy impact of this final rule has been assessed in
accordance with the Energy Policy and Conservation Act (EPCA) Public
Law 94-163, as amended (42 U.S.C. 6362) and FAA Order 1053.1. It has
been determined that the final rule is not a major regulatory action
under the provisions of the EPCA.
Regulations Affecting Intrastate Aviation in Alaska
Section 1205 of the FAA Reauthorization Act of 1996 (110 Stat.
3213) requires the Administrator, when modifying regulations in Title
14 of the CFR in a manner affecting intrastate aviation in Alaska, to
consider the extent to which Alaska is not served by transportation
modes other than aviation, and to establish such regulatory
distinctions as she considers appropriate. The FAA, therefore,
specifically requested comments on whether there is justification for
applying the proposed rule differently to intrastate operations in
Alaska. Although one commenter expressed a concern related to a
particular Alaskan intrastate operation involving Lockheed Model L-188
Electra airplanes, no comments were received concerning such
justification in general. Since no comments in that regard were
received, and since the FAA is not aware of any justification for such
regulatory distinction, the final rule is not applied differently to
intrastate operations in Alaska.
List of Subjects
14 CFR Parts 21, 25, 91, and 125
Aircraft, Aviation safety, Reporting and recordkeeping
requirements.
14 CFR Part 121
Air carriers, Aircraft, Aviation safety, Reporting and
recordkeeping requirements, Safety, Transportation.
14 CFR Part 129
Air carriers, Aircraft, Aviation safety, Reporting and
recordkeeping requirements.
The Amendment
In consideration of the foregoing, the Federal Aviation
Administration amends parts 21, 25, 91, 121, 125, and 129 of Title 14,
Code of Federal Regulations, as follows:
PART 21--CERTIFICATION PROCEDURES FOR PRODUCTS AND PARTS
1. The authority citation for Part 21 continues to read as follows:
Authority: 42 U.S.C. 7572; 40105; 40113; 44701-44702, 44707,
44709, 44711, 44713, 44715, 45303.
2. In part 21, add SFAR No. 88 in numerical order at the beginning
of the part to read as follows:
* * * * *
SFAR No. 88--Fuel Tank System Fault Tolerance Evaluation
Requirements
1. Applicability. This SFAR applies to the holders of type
certificates, and supplemental type certificates that may affect the
airplane fuel tank system, for turbine-powered transport category
airplanes, provided the type certificate was issued after January 1,
1958, and the airplane has either a maximum type certificated
passenger capacity of 30 or more, or a maximum type certificated
payload capacity of 7,500 pounds or more. This SFAR also applies to
applicants for type certificates, amendments to a type certificate,
and supplemental type certificates affecting the fuel tank systems
for those airplanes identified above, if the application was filed
before June 6, 2001, the effective date of this SFAR, and the
certificate was not issued before June 6, 2001.
2. Compliance: No later than December 6, 2002, or within 18
months after the issuance of a certificate for which application was
filed before June 6, 2001, whichever is later, each type certificate
holder, or supplemental type certificate holder of a modification
affecting the airplane fuel tank system, must accomplish the
following:
(a) Conduct a safety review of the airplane fuel tank system to
determine that the design meets the requirements of Secs. 25.901 and
25.981(a) and (b) of this chapter. If the current design does not
meet these requirements, develop all design changes to the fuel tank
system that are necessary to meet these requirements. The FAA
(Aircraft Certification Office (ACO), or office of the Transport
Airplane Directorate, having cognizance over the type certificate
for the affected airplane) may grant an extension of the 18-month
compliance time for development of design changes if:
(1) The safety review is completed within the compliance time;
(2) Necessary design changes are identified within the
compliance time; and
(3) Additional time can be justified, based on the holder's
demonstrated aggressiveness in performing the safety review, the
complexity of the necessary design changes, the availability of
interim actions to provide an acceptable level of safety, and the
resulting level of safety.
(b) Develop all maintenance and inspection instructions
necessary to maintain the design features required to preclude the
existence or development of an ignition source within the fuel tank
system of the airplane.
(c) Submit a report for approval to the FAA Aircraft
Certification Office (ACO), or office of the Transport Airplane
Directorate, having cognizance over the type certificate for the
affected airplane, that:
(1) Provides substantiation that the airplane fuel tank system
design, including all necessary design changes, meets the
requirements of Secs. 25.901 and 25.981(a) and (b) of this chapter;
and
(2) Contains all maintenance and inspection instructions
necessary to maintain the design features required to preclude the
existence or development of an ignition source within the fuel tank
system throughout the operational life of the airplane.
PART 25--AIRWORTHINESS STANDARDS: TRANSPORT CATEGORY AIRPLANES
3. The authority citation for part 25 continues to read:
Authority: 49 U.S.C. 106(g), 40113, 44701-44702, and 44704.
4. Section 25.981 is revised to read as follows:
[[Page 23130]]
Sec. 25.981 Fuel tank ignition prevention.
(a) No ignition source may be present at each point in the fuel
tank or fuel tank system where catastrophic failure could occur due to
ignition of fuel or vapors. This must be shown by:
(1) Determining the highest temperature allowing a safe margin
below the lowest expected autoignition temperature of the fuel in the
fuel tanks.
(2) Demonstrating that no temperature at each place inside each
fuel tank where fuel ignition is possible will exceed the temperature
determined under paragraph (a)(1) of this section. This must be
verified under all probable operating, failure, and malfunction
conditions of each component whose operation, failure, or malfunction
could increase the temperature inside the tank.
(3) Demonstrating that an ignition source could not result from
each single failure, from each single failure in combination with each
latent failure condition not shown to be extremely remote, and from all
combinations of failures not shown to be extremely improbable. The
effects of manufacturing variability, aging, wear, corrosion, and
likely damage must be considered.
(b) Based on the evaluations required by this section, critical
design configuration control limitations, inspections, or other
procedures must be established, as necessary, to prevent development of
ignition sources within the fuel tank system and must be included in
the Airworthiness Limitations section of the Instructions for Continued
Airworthiness required by Sec. 25.1529. Visible means to identify
critical features of the design must be placed in areas of the airplane
where maintenance actions, repairs, or alterations may be apt to
violate the critical design configuration limitations (e.g., color-
coding of wire to identify separation limitation).
(c) The fuel tank installation must include either--
(1) Means to minimize the development of flammable vapors in the
fuel tanks (in the context of this rule, ``minimize'' means to
incorporate practicable design methods to reduce the likelihood of
flammable vapors); or
(2) Means to mitigate the effects of an ignition of fuel vapors
within fuel tanks such that no damage caused by an ignition will
prevent continued safe flight and landing.
5. Paragraph H25.4 of Appendix H to part 25 is revised to read as
follows:
Appendix H to Part 25--Instructions for Continued Airworthiness
* * * * *
H25.4 Airworthiness Limitations section.
(a) The Instructions for Continued Airworthiness must contain a
section titled Airworthiness Limitations that is segregated and
clearly distinguishable from the rest of the document. This section
must set forth--
(1) Each mandatory replacement time, structural inspection
interval, and related structural inspection procedures approved
under Sec. 25.571; and
(2) Each mandatory replacement time, inspection interval,
related inspection procedure, and all critical design configuration
control limitations approved under Sec. 25.981 for the fuel tank
system.
(b) If the Instructions for Continued Airworthiness consist of
multiple documents, the section required by this paragraph must be
included in the principal manual. This section must contain a
legible statement in a prominent location that reads: ``The
Airworthiness Limitations section is FAA-approved and specifies
maintenance required under Sec. Sec. 43.16 and 91.403 of the Federal
Aviation Regulations, unless an alternative program has been FAA
approved.''
PART 91--GENERAL OPERATING AND FLIGHT RULES
6. The authority citation for part 91 continues to read:
Authority: 49 U.S.C. 1301(7), 1303, 1344, 1348, 1352 through
1355, 1401, 1421 through 1431, 1471, 1472, 1502, 1510, 1522, and
2121 through 2125; Articles 12, 29, 31, and 32(a) of the Convention
on International Civil Aviation (61 Stat 1180); 42 U.S.C. 4321 et
seq.; E.O. 11514; 49 U.S.C. 106(g) (Revised Pub. L. 97-449, January
21, 1983).
7. Amend Sec. 91.410 by revising the section heading; redesignating
the introductory text, paragraphs (a) introductory text, (a)(1), (a)(2)
and (a)(3), and paragraphs (b) through (l) as paragraph (a)
introductory text, paragraphs (a)(l) introductory text, (a)(1)(i),
(a)(1)(ii), and (a)(1)(iii), and paragraphs (a)(2) through (a)(12); and
adding a new paragraph (b) to read as follows:
Sec. 91.410 Special maintenance program requirements.
* * * * *
(b) After June 7, 2004, no person may operate a turbine-powered
transport category airplane with a type certificate issued after
January 1, 1958, and either a maximum type certificated passenger
capacity of 30 or more, or a maximum type certificated payload capacity
of 7,500 pounds or more, unless instructions for maintenance and
inspection of the fuel tank system are incorporated into its inspection
program. These instructions must address the actual configuration of
the fuel tank systems of each affected airplane, and must be approved
by the FAA Aircraft Certification Office (ACO), or office of the
Transport Airplane Directorate, having cognizance over the type
certificate for the affected airplane. Operators must submit their
request through the cognizant Flight Standards District Office, who may
add comments and then send it to the manager of the appropriate office.
Thereafter, the approved instructions can be revised only with the
approval of the FAA Aircraft Certification Office (ACO), or office of
the Transport Airplane Directorate, having cognizance over the type
certificate for the affected airplane. Operators must submit their
request for revisions through the cognizant Flight Standards District
Office, who may add comments and then send it to the manager of the
appropriate office.
PART 121--OPERATING REQUIREMENTS: DOMESTIC, FLAG, AND SUPPLEMENTAL
OPERATIONS
8. The authority citation for part 121 continues to read:
Authority: 49 U.S.C. 106(g), 40113, 40119, 44101, 44701-44702,
44705, 44709-44711, 44713, 44716-44717, 44722, 44901, 44903-44904,
44912, 46105.
9. Amend Sec. 121.370 by revising the section heading;
redesignating the introductory text, paragraphs (a) introductory text,
(a)(1), (a)(2) and (a)(3), and paragraphs (b) through (l) as paragraph
(a) introductory text, paragraphs (a)(l) introductory text, (a)(1)(i),
(a)(1)(ii), and (a) (1)(iii), and paragraphs (a)(2) through (a)(12);
and adding a new paragraph (b) to read as follows:
Sec. 121.370 Special maintenance program requirements.
* * * * *
(b) After June 7, 2004, no certificate holder may operate a
turbine-powered transport category airplane with a type certificate
issued after January 1, 1958, and either a maximum type certificated
passenger capacity of 30 or more, or a maximum type certificated
payload capacity of 7,500 pounds or more, unless instructions for
maintenance and inspection of the fuel tank system are incorporated in
its maintenance program. These instructions must address the actual
configuration of the fuel tank systems of each affected airplane and
must be approved by the FAA Aircraft Certification Office (ACO), or
office of the Transport Airplane Directorate, having cognizance over
the type certificate for the affected airplane. Operators must submit
their request through an appropriate FAA Principal Maintenance
Inspector, who may add comments and then send it to the manager of the
appropriate office.
[[Page 23131]]
Thereafter, the approved instructions can be revised only with the
approval of the FAA Aircraft Certification Office (ACO), or office of
the Transport Airplane Directorate, having cognizance over the type
certificate for the affected airplane. Operators must submit their
requests for revisions through an appropriate FAA Principal Maintenance
Inspector, who may add comments and then send it to the manager of the
appropriate office.
PART 125--CERTIFICATION AND OPERATIONS: AIRPLANES HAVING A SEATING
CAPACITY OF 20 OR MORE PASSENGERS OR A MAXIMUM PAYLOAD CAPACITY OF
6,000 POUNDS OR MORE; AND RULES GOVERNING PERSONS ON BOARD SUCH
AIRCRAFT
10. The authority citation for part 125 continues to read:
Authority: 49 U.S.C. 106(g), 40113, 44701-44702, 44705, 44710-
44711, 44713, 44716-44717, 44722.
11. Amend Sec. 125.248 by revising the section heading;
redesignating the introductory text, paragraphs (a) introductory text,
(a)(1), (a)(2) and (a)(3), and paragraphs (b) through (l) as paragraph
(a) introductory text, paragraphs (a)(l) introductory text, (a)(1)(i),
(a)(1)(ii), and (a) (1)(iii), and paragraphs (a)(2) through (a)(12);
and adding a new paragraph (b) to read as follows:
Sec. 125.248 Special maintenance program requirements.
* * * * *
(b) After June 7, 2004, no certificate holder may operate a
turbine-powered transport category airplane with a type certificate
issued after January 1, 1958, and either a maximum type certificated
passenger capacity of 30 or more, or a maximum type certificated
payload capacity of 7,500 pounds or more unless instructions for
maintenance and inspection of the fuel tank system are incorporated in
its inspection program. These instructions must address the actual
configuration of the fuel tank systems of each affected airplane and
must be approved by the FAA Aircraft Certification Office (ACO), or
office of the Transport Airplane Directorate, having cognizance over
the type certificate for the affected airplane. Operators must submit
their request through an appropriate FAA Principal Maintenance
Inspector, who may add comments and then send it to the manager of the
appropriate office. Thereafter, the approved instructions can be
revised only with the approval of the FAA Aircraft Certification Office
(ACO), or office of the Transport Airplane Directorate, having
cognizance over the type certificate for the affected airplane.
Operators must submit their requests for revisions through an
appropriate FAA Principal Maintenance Inspector, who may add comments
and then send it to the manager of the appropriate office.
PART 129--OPERATIONS: FOREIGN AIR CARRIERS AND FOREIGN OPERATORS OF
U.S.-REGISTERED AIRCRAFT ENGAGED IN COMMON CARRIAGE
12. The authority citation for part 129 continues to read:
Authority: 49 U.S.C. 106(g), 40104-40105, 40113, 40119, 44701-
44702, 44712, 44716-44717, 44722, 44901-44904, 44906.
13. Amend Sec. 129.32 by revising the section heading;
redesignating the introductory text, paragraphs (a) introductory text,
(a)(1), (a)(2) and (a)(3), and paragraphs (b) through (l) as paragraph
(a) introductory text, paragraphs (a)(l) introductory text, (a)(1)(i),
(a)(1)(ii), and (a) (1)(iii), and paragraphs (a)(2) through (a)(12);
and adding a new paragraph (b) to read as follows:
Sec. 129.32 Special maintenance program requirements.
* * * * *
(b) For turbine-powered transport category airplanes with a type
certificate issued after January 1, 1958, and either a maximum type
certificated passenger capacity of 30 or more, or a maximum type
certificated payload capacity of 7,500 pounds or more, no later than
June 7, 2004, the program required by paragraph (a) of this section
must include instructions for maintenance and inspection of the fuel
tank systems. These instructions must address the actual configuration
of the fuel tank systems of each affected airplane and must be approved
by the FAA Aircraft Certification Office (ACO), or office of the
Transport Airplane Directorate, having cognizance over the type
certificate for the affected airplane. Operators must submit their
request through an appropriate FAA Principal Maintenance Inspector, who
may add comments and then send it to the manager of the appropriate
office. Thereafter the approved instructions can be revised only with
the approval of the FAA Aircraft Certification Office (ACO), or office
of the Transport Airplane Directorate, having cognizance over the type
certificate for the affected airplane. Operators must submit their
requests for revisions through an appropriate FAA Principal Maintenance
Inspector, who may add comments and then send it to the manager of the
appropriate office.
Issued in Washington, DC, on April 19, 2001.
Jane F. Garvey,
Administrator.
[FR Doc. 01-10129 Filed 5-4-01; 8:45 am]
BILLING CODE 4910-13-P