Appendix E E-5
3. Adequately mitigates the hazard. Compliance with the requirement eliminates the hazard or provides a means to avoid the hazard completely in many cases. However, the hazard is not eliminated or avoided in all probable or likely cases. Usually this action only addresses a significant part of a larger or broader hazard.
4. Hazard only partly addressed. In some cases, compliance with the requirement partly eliminates the hazard or does not completely avoid the hazard. The hazard is not eliminated or avoided in all probable or likely cases. Usually this action only addresses part of a hazard.
5. Hazard only partly addressed but action has negative side effect.
Compliance with the requirement does not eliminate or avoid the hazard or may have negative safety side effects. The action is of questionable benefit.
E.2.5.4 If it is determined that compliance with the latest regulations does not contribute materially to the product’s level of safety, skip Step 6 of this appendix and go directly to Step 7 to document the conclusion. If it is determined that complying with the latest amendment of the regulation contributes materially to the product’s level of safety, continue to Step 6 of this appendix.
E.2.6 Step 6: Determine the Incremental Resource Costs and Cost Avoidance.
E.2.6.1 There is always cost associated with complying with a requirement. This cost may range from minimal administrative efforts to the resource expenditures that support full-scale testing or the redesign of a large portion of an aircraft. However, there are also potential cost savings from compliance with a requirement. For example, compliance with a requirement may avoid aircraft damage or accidents and the associated costs to the manufacturer for investigating accidents. Compliance with the latest amendment of a requirement may also help a foreign authority certificate a product.
E.2.6.2 When determining the impracticality of applying a requirement at the latest amendment level, only the incremental costs and safety benefits from complying with the existing certification basis should be considered.
E.2.6.3 When evaluating the incremental cost, it may be beneficial for you to compare the increase in cost of complying with the latest requirements to the cost of incorporating the same design feature in a new airplane. In many cases, an estimate for the cost of incorporation in a new airplane is provided in the regulatory evaluation by the FAA, which was presented when the corresponding regulation was first issued. Incremental costs of retrofit/incorporation on existing designs may be higher than that for production. Examples of costs may include, but are not limited to, the following:
Appendix E E-6 Costs The accuracies of fleet size projections, utilization, etc., may be different than that experienced for derived product designs and must be validated.
• Labor: Work carried out in the design, fabrication, inspection, operation, or maintenance of a product for the purpose of incorporating or demonstrating compliance with a proposed action.
Non-recurring labor requirements, including training, for the applicant supporting development and production of the product, should be considered.
• Capital: Construction of new, modified, or temporary facilities for design, production, tooling, training, or maintenance.
• Material: Cost associated with product materials, product components, inventory, kits, and spares.
• Operating Costs: Costs associated with fuel, oil, fees, training, and expendables.
• Revenue/Utility Loss: Costs resulting from earning/usage capability reductions from departure delays, product downtime, and performance loss due to seats, cargo, range, or airport restrictions.
• The cost of changing compliance documentation and/or drawings in itself is not an acceptable reason for an exception.
Cost Avoidance.
• Avoiding cost of accidents, including investigation of accidents, lawsuits, public relations activities, insurance, and lost revenue.
• Foreign Certification: Conducting a single effort that would demonstrate compliance to the requirements of most certifying Authorities, thus minimizing certification costs.
E.2.7 Step 7: Document the Conclusion.
With the information from previous steps documented and reviewed, the applicant’s position and rationale regarding whether complying with the latest regulations contributes materially to the product’s level of safety or its practicality can be documented. The FAA records the determination of whether the conditions for the proposed exception were met. That determination is based on the information and analysis provided by the applicant in the preceding steps. If the determination to grant the exception is based on the product’s design features, those features are documented at a high level in the TCDS. Documentation in the TCDS is required so that the features are maintained during subsequent changes to the product, therefore, maintaining the product’s agreed level of safety. If the results of this analysis are inconclusive, then further discussions with the FAA are warranted.
Appendix E E-7 E.3 Examples of How to Certify Changed Aircraft.
The following examples illustrate the typical process an applicant follows. The process will be the same for all product types.
E.3.1 Example 1: § 25.963, Fuel Tank Access Covers.
This example is part of a significant change to a transport airplane that increases passenger payload and gross weight by extending the fuselage 20 feet. To accommodate the higher design weights and increased braking requirements and to reduce runway loading, the applicant will change the landing gear from a two-wheel to four-wheel configuration; this changes the debris scatter on the wing from the landing gear. The FAA will require that the new model airplane comply with the latest applicable regulations based on the date of application.
The wing will be strengthened locally at the side of the body and at the attachment of engines and landing gear, but the applicant would not like to alter wing access panels and the fuel tank access covers. Although the applicant recognizes that the scatter pattern and impact loading on the wing from debris thrown from the landing gear will change, the applicant proposes that it would be impractical to redesign the fuel tank access covers.
Note: Sections 121.316 and 21.21(b)(2) may be additional reasons the FAA would require compliance with § 25.963(e), regardless of the significant determination.
E.3.1.1 Step 1: Identify the Regulatory Change being Evaluated.
The existing certification basis of the airplane that is being changed is part 25 prior to Amendment 25-69. Amendment 25-69 added the requirement that fuel tank access covers on transport category airplanes be designed to minimize penetration by likely foreign objects, and that they be fire resistant.
E.3.1.2 Step 2: Identify the Specific Hazard that the Regulation Addresses.
Fuel tank access covers have failed in service due to impact with high-energy objects such as failed tire tread material and engine debris following engine failures. In one accident, debris from the runway impacted a fuel tank access cover, causing its failure and subsequent fire, which resulted in fatalities and loss of the airplane. Amendment 25-69 will ensure that all access covers on all fuel tanks are designed or located to minimize penetration by likely foreign objects, and that they are fire resistant.
E.3.1.3 Step 3: Review the History of the Consequences of the Hazard(s).
There have been occurrences with injuries and with more than 10 percent deaths.
Appendix E E-8 E.3.1.4 Step 4: Identify the Historical and Predicted Frequency of Each Consequence.
In 200 million departures of large jets—
• One occurrence with more than 10 percent deaths, and
• One occurrence with injuries.
There is no reason to believe that the future rate of accidents will be significantly different than the historical record.
E.3.1.5 Step 5: Determine How Effective Full Compliance with the Latest Amendment of the Regulation would be at Addressing the Hazard.
Considerable potential for eliminating or avoiding the hazard. Compliance with Amendment 25-69 eliminates the hazard or provides a means to avoid the hazard completely for all probable or likely cases. However, it does not cover all situations or scenarios.
E.3.1.6 Step 6: Determine Resource Costs and Cost Avoidance.
Costs.
• For a newly developed airplane, there would be minor increases in labor resulting from design and fabrication.
• There would be a negligible increase in costs related to materials, operating costs, and revenue utility loss.
Cost Avoidance.
• There were two accidents in 200 million departures. The applicant believes that it will manufacture more than 2,000 of these airplanes.
These airplanes would average five flights a day. Therefore, statistically there will be accidents in the future if the hazard is not alleviated. Compliance will provide cost benefits related to avoiding lawsuits, accident investigations, and public relation costs.
• There are cost savings associated with meeting a single certification basis for FAA and foreign regulations.
E.3.1.7 Step 7: Document the Conclusion.
It is concluded that compliance with the latest regulation increases the level of safety at a minimal cost to the applicant. Based on the arguments and information presented by the applicant through the issue paper process, the FAA determined that meeting the latest amendment would be practical. Additionally, operators are required to comply with § 25.963(e) under § 121.316. The FAA has also found that fuel tank access covers that are not impact resistant and fire resistant located where a strike is likely is an unsafe feature or characteristic, which precludes issuance of a type certificate under § 21.21(b)(2).
Appendix E E-9 E.3.2 Example 2: § 25.365, Pressurized Compartment Loads.
This example is a passenger-to-freighter conversion STC. This change affects the floor loads on the airplane as well as the decompression venting.
E.3.2.1 Step 1: Identify the Regulatory Change being Evaluated.
The existing certification basis of the airplane that is being changed includes § 25.365 at Amendment 25-00. The initial release of § 25.365 required that the interior structure of passenger compartments be designed to withstand the effects of a sudden release of pressure through an opening resulting from the failure or penetration of an external door, window, or windshield panel, or from structural fatigue or penetration of the fuselage, unless shown to be extremely remote.
Amendment 25-54 revised § 25.365 to require that the interior structure be designed for an opening resulting from penetration by a portion of an engine, an opening in any compartment of a size defined by § 25.365(e)(2), or the maximum opening caused by a failure not shown to be extremely improbable. The most significant change is the “formula hole size” requirement introduced into § 25.365(e)(2) at Amendment 25-54.
Amendment 25-71/72 (Amendments 25-71 and 25-72 are identical) extended the regulation to all pressurized compartments, not just passenger compartments, and to the pressurization of unpressurized areas.
Pressurization of unpressurized areas had previously been identified as an unsafe feature under § 21.21(b)(2).
Amendment 25-87 redefined the pressure differential load factor that applies above an altitude of 45,000 feet. Compliance with Amendment 25-87 is not affected since the airplane does not operate above an altitude of 45,000 feet. The applicant proposes to meet the “pressurization into unpressurized areas” requirement introduced in Amendment 25-71/72.
The applicant does not propose to comply with the formula hole size requirement introduced in § 25.365(e)(2) at Amendment 25-54.
E.3.2.2 Step 2: Identify the Specific Hazard that the Regulation Addresses.
The hazard is a catastrophic structure and/or system failure produced by a sudden release of pressure through an opening in any compartment in flight. This opening could be caused by an uncontained engine failure, an opening of a prescribed size due to the inadvertent opening of an external door in flight, or an opening caused by a failure not shown to be extremely improbable. The opening could be produced by an event that has yet to be identified.
E.3.2.3 Step 3: Review the History of the Consequences of the Hazard(s).
There have been occurrences with injuries, with less than 10 percent deaths and with more than 10 percent deaths.
Appendix E E-10 E.3.2.4 Step 4: Identify the Historical and Predicted Frequency of Each Consequence.
In 200 million departures of large jets—
• Two occurrences with more than 10 percent deaths,
• One occurrence with less than 10 percent deaths, and
• One occurrence with injuries.
There is no reason to believe that the future rate of accidents will be significantly different than the historical record.
E.3.2.5 Step 5: Determine How Effective Full Compliance with the Latest Amendment of the Regulation would be at Addressing the Hazard.
Compliance with the latest amendment eliminates the hazard or provides a means to avoid the hazard completely.
Design changes made to the proposed airplane bring it closer to full compliance with § 25.365 at Amendment 25-54. The original airplane was shown to meet the requirements for a hole size of 1.1 square feet.
Amendment 25-54 would require a hole size of 5.74 square feet, and the current reinforcements for the converted airplane can sustain a hole size of
3.65 square feet in the forward area and 2.65 square feet at the aft area.
This is 3.1 and 2.4 times, respectively, better than the original design condition of Amendment 25-0 and is a significant improvement over the worldwide passenger fleet in service.
E.3.2.6 Step 6: Determine Resource Costs and Cost Avoidance.
Costs.
There would be savings in both labor and capital costs if compliance were shown to Amendment 25-0 instead of Amendment 25-54. Major modifications to the floor beams would be necessary to meet the formula hole size requirement in Amendment 25-54.
Cost Avoidance.
There were four accidents in 200 million departures. The applicant believes that it will manufacture more than 2,000 of these airplanes. These airplanes would average two flights a day. Therefore, statistically there will be accidents in the future if the hazard is not alleviated. Compliance will provide cost benefits related to avoiding lawsuits, accident investigations, and public relation costs.
There are cost savings associated with meeting a single certification basis for FAA and foreign regulations.
E.3.2.7 Step 7: Document the Conclusion Regarding Practicality.
The design complies with § 25.365 at Amendments 25-0, 25-71/72, and 25-87, and it is nearly in full compliance with Amendment 25-54. The
Appendix E E-11 design would adequately address the hazard at an acceptable cost.
Therefore, based on arguments of impracticality discussed in an issue paper, the FAA accepts the applicant’s proposal to comply with § 25.365 at Amendment 25-0.
E.3.3 Example 3: § 25.981, Fuel Tank Ignition Prevention.
This example is part of a significant change to a transport airplane that increases passenger payload and gross weight by extending the fuselage 20 feet. To accommodate the longer fuselage, the applicant will modify systems wiring installations; this includes changing fuel tank system wiring. The new model airplane will be required to comply with the latest applicable regulations based on the date of application.
E.3.3.1 Step 1: Identify the Regulatory Change Being Evaluated.
The existing certification basis of the airplane that is being changed is part 25 prior to Amendment 25-102 but includes Amendment 25-40.
Note: If the original certification basis does not include Amendment 25-40, the certification basis should be considered not adequate for fuel tank ignition prevention.
The 2001 Fuel Tank Safety (FTS) rule adopted Amendment 25-102 to add explicit requirements in § 25.981(a)(3) for demonstrating that the design precludes fuel tank ignition sources that was required but had in several cases not been properly applied in demonstrating compliance to §§ 25.901 and 25.1309. Amendment 25-102, § 25.981(b), added a requirement to develop fuel tank system airworthiness limitations to maintain the ignition prevention features of the design. Section H25.4, Amendment 25-102, requires including those fuel tank system airworthiness limitations in the Airworthiness Limitations section of the Instructions for Continued Airworthiness (ICA).
Since the FAA policy for performing the failure analysis to demonstrate compliance with §§ 25.901 and 25.1309 at Amendment 25-40 and 25-46 was adopted in the explicit fuel tank ignition prevention failure analysis requirements of § 25.981(a)(3), the incremental requirement for demonstrating compliance to the ignition prevention requirements of Amendment 25-102 is to develop and implement the fuel tank system airworthiness limitations instead of developing Certification Maintenance Requirements in accordance with § 25.901(b)(2) at Amendments 25-40 through 25-46 and AC 25-19A.
E.3.3.2 Step 2: Identify the Specific Hazard that the Regulation Addresses.
The FAA issued the 2001 FTS rule to preclude fuel tank ignition sources because of a history of fuel tank explosions. The catastrophic TWA Flight 800 in-flight fuel tank explosion on July 17, 1996, caused the death of all 230 people onboard.
Appendix E E-12 E.3.3.3 Step 3: Review the History of the Consequences of the Hazard(s).
There have been occurrences with injuries, with more than 10 percent deaths, less than 10 percent deaths, and no deaths.
E.3.3.4 Step 4: Identify the Historical and Predicted Frequency of Each Consequence.
The 1998 Aviation Rulemaking Advisory Committee Fuel Tank Harmonization Working Group report documents the historical frequency of fuel tank explosions as 16, which caused a total of 539 fatalities.
There have been two additional fuel tank explosions since that report was issued:
• March 3, 2001—Thai Airways International Flight 114 experienced a fuel tank explosion on the ground that caused 1 fatality and 3 serious injuries. The explosion and subsequent fire destroyed the airplane.
• May 4, 2006—A Malaysia Airlines Boeing 727 experienced a wing tank low pressure explosion during ground operations. There was no fire and no injuries. The wing structure suffered significant damage.
There is no reason to believe that the future rate of accidents will be significantly different than the historical record if fuel tank system airworthiness limitations are not included in the ICA as is permitted in earlier amendment levels.
E.3.3.5 Step 5: Determine How Effective Full Compliance with the Latest Amendment of the Regulation would be at Addressing the Hazard.
Considerable potential for eliminating or avoiding the hazard.
In the 2008 Fuel Tank Flammability Reduction (FTFR) rule, the FAA estimated compliance with the ignition prevention requirements of Amendment 25-102 together with the fuel tank ignition prevention airworthiness directives issued as a result of the Special Federal Aviation Regulation number 88 reviews resulted in the range of effectiveness in preventing fuel tank explosions between 25 to 75 percent with a median value of 50 percent (73 FR 42449).
E.3.3.6 Step 6: Determine Resource Costs and Cost Avoidance.
Costs.
• For newly developed designs, there would be minor increases in costs resulting from identification and implementation of fuel tank system airworthiness limitations.
• There would be no increase in costs related to materials, operating costs, and revenue utility loss.
Appendix E E-13 Cost Avoidance.
There were 18 accidents in 200 million departures. The applicant believes that it will manufacture more than 2,000 of these airplanes or derivatives of these airplanes. These airplanes would average five flights a day.
Therefore, statistically there will be accidents in the future if the hazard is not alleviated. Compliance will provide cost benefits related to avoiding fatalities and injuries.
E.3.3.7 Step 7: Document the Conclusion.
It is concluded that compliance with the latest regulation increases the level of safety at a minimal cost to the applicant. Based on the arguments and information presented by the applicant through the issue paper process, the FAA determined that meeting the latest amendment would be practical.
The following is additional background on the specific hazard the regulation addresses:
As stated in the 2001 FTS rule under “Changes to part 25,” § 25.981(a)(3) was adopted because the previous regulations (§§ 25.901 and 25.1309) were not always properly applied.
Section 25.901(b)(2), Amendments 25-40 through 46, requires in part preventative maintenance as necessary to ensure that components of the powerplant installation, which includes the fuel tank system, will safely perform their intended function between inspections and overhauls defined in the maintenance instructions. When demonstrating compliance to the requirements of § 25.901(b) for maintenance of fuel tank ignition prevention features, the policy has been that the applicant identify critical features as critical maintenance requirements using the guidance in AC 25-19A.
Appendix F F-1 APPENDIX F. THE USE OF SERVICE EXPERIENCE IN THE EXCEPTION PROCESS F.1 Introduction.
Service experience may support the application of an earlier regulatory standard pursuant to § 21.101(b)(3) if, in conjunction with the applicable service experience and other compliance measures, the earlier standard provides a level of safety comparable to that provided by the latest requirements. The applicant must provide sufficient substantiation to allow the FAA to make this determination. A statistical approach may be used, subject to the availability and relevance of data, but sound engineering judgment must be used. For service history to be acceptable, the data must be both sufficient and pertinent. The essentials of the process involve—
• A clear understanding of the requirement change and the purpose for the change,
• A determination based on detailed knowledge of the proposed design feature,
• The availability of pertinent and sufficient service experience data, and
• A comprehensive review of that service experience data.
F.2 Guidelines.
The issue paper process (either as a stand-alone issue paper or included in the G-1 issue paper) would be used, and the applicant should provide documentation to support the following:
F.2.1 The identification of the differences between the requirement in the existing basis and the requirement as amended, and the effect of the change in the requirement.
F.2.2 A description as to what aspect(s) of the latest requirements the proposed changed product would not meet.
F.2.3 Evidence showing that the proposed certification basis for the changed product, together with applicable service experience, relative to the hazard, provides a level of safety that approaches the latest regulations, yet is not fully compliant with the latest regulations.
F.2.4 A description of the design feature and its intended function.
F.2.5 Data for the product pertinent to the requirement.
F.2.5.1 Service experience from such data sources such as—
• Accident reports,
• Incident reports,
• Service bulletins,
• Airworthiness directives,
• Repairs,
Appendix F F-2
• Modifications,
• Flight hours/cycles for fleet leader and total fleet,
• World airline accident summary data,
• Service difficulty reports,
• National Transportation Safety Board reports, and
• Warranty, repair, and parts usage data.
F.2.5.2 Show that the data presented represent all relevant service experience for the product, including the results of any operator surveys, and is comprehensive enough to be representative.
F.2.5.3 Show that the service experience is relevant to the hazard.
F.2.5.4 Identification and evaluation of each of the main areas of concern with regard to—
• Recurring and/or common failure modes,
• Cause,
• Probability by qualitative reasoning, and
• Measures already taken and their effects.
F.2.5.5 Relevant data pertaining to aircraft of similar design and construction may be included.
F.2.5.6 Evaluation of failure modes and consequences through analytical processes. The analytical processes should be supported by—
• A review of previous test results,
• Additional detailed testing as required, or
• A review of aircraft functional hazard assessments (FHA) and any applicable system safety assessments (SSA) as required.
F.2.6 A conclusion that draws together the data and the rationale.
F.2.7 These guidelines are not intended to be limiting, either in setting the required minimum elements or in precluding alternative forms of submission. Each case may be different, based on the particulars of the system being examined and the requirement to be addressed.
Appendix F F-3 F.3 Example: § 25.1141(f) for Transport Category Airplanes.
F.3.1 The following example, for transport category airplanes (§ 25.1141(f), APU Fuel Valve Position Indication System), illustrates the typical process an applicant follows. The process will be the same for all product types.
F.3.2 This example comes from a derived model transport airplane where significant changes were made to the main airframe components, engines and systems, and APU. The baseline airplane has an extensive service history. The example shows how the use of service experience supports a finding that compliance with the latest regulation would not contribute materially to the level of safety and that application of the existing certification basis (or earlier amendment) would be appropriate. The example is for significant derived models of transport airplanes with extensive service history. It illustrates the process, following the guidelines in this appendix, but does not include the level of detail normally required.
F.3.2.1 Determine the differences between the regulation in the existing certification basis and the regulation as amended, and the effect of the change in the regulation. The existing certification basis of the airplane that is being changed is the initial release of part 25. Amendment 25-40 added requirement § 25.1141(f), which mandates that power-assisted valves must have a means to indicate to the flightcrew when the valve is in the fully open or closed position, or is moving between these positions.
The addressed hazard would be risk of APU fire due to fuel accumulation caused by excessive unsuccessful APU start attempts.
F.3.2.2 What aspect of the proposed changed product would not meet the latest regulations? The proposed APU fuel valve position indication system does not provide the flightcrew with fuel valve position or transition indication and, therefore, does not comply with the requirements of § 25.1141(f).
F.3.2.3 The applicant provides evidence that the proposed certification basis for the changed product, together with applicable service experience of the existing design, provide a level of safety that approaches yet is not fully compliant with the latest regulations. The APU fuel shut-off valve and actuator are unchanged from those used on the current family of airplanes, and have been found to comply with the earlier Amendment 25-11 of § 25.1141. The existing fleet has achieved approximately (#) flights during which service experience of the existing design has been found to be acceptable. If one assumes a complete APU cycle, i.e., start-up and shutdown for each flight, the number of APU fuel shut-off valve operations would be over 108 cycles, which demonstrates that the valve successfully meets its intended function and complies with the intent of the regulation.
F.3.2.4 The applicant provides a description of the design feature and its intended function. The fuel shut-off valve, actuator design, and operation is