(B) An appropriate circuit protective device (circuit breaker of fuse) should be installed as close as possible to the electrical power-source bus. Good engineering practices for selection of circuit breakers should consider the following:
(1) The minimum rating commercially-available airplane circuit breaker size which will power the normal (i.e., intended) load without nuisance trips, thereby minimizing deliverable power to possible fault loads.
(2) Integral three-phase circuit breakers to protect three-phase loads.
(3) The selected circuit protective device should be consistent with the airplane electrical system protection and should protect the smallest wiring in the circuit.
(iii) Fuel Quantity System Calibration and Limitations (§ 23.1337(b)). Part 23 requires that fuel quantity gages read zero when the fuel remaining in the tank is equal to the unusable fuel supply. If a fuel quantity indicator is installed (see § 23.1337(b) (5)), it should be calibrated for usable fuel wet, i.e., with a specific fuel of known density to substantiate that the fuel measurement system, as installed in the airplane, indicates zero in a level flight attitude. The applicant may want to increase the unusable fuel to the zero limit of the gage in some cases where the gage cannot be calibrated down to the actual unusable tank fuel level, in lieu of replacing the gage. The calibration also encompasses additional readings of the fuel quantity gage which are compared against a standard, usually the readings taken from a fueling system having a calibrated accuracy of 0.5 percent.
Fail-Safe and Emergency Operation Evaluation (§ 23.903 (c)).
It is the applicant's responsibility, as a part of the certification compliance program, to analyze and submit a report (s) on the auxiliary fuel system component failure modes and consequences of these failures. It should be shown that the resulting consequence of any single or probable combination of failures will not affect the functional isolation of the engines or jeopardize the safety of the airplane. The fail-safe criteria as defined in appendix 1, Definitions, should be used as a guide in all design and failure mode analyses.
(1) System Failure Modes.
(i) Component Failure Modes.
(A) The applicant should analyze the effects of malfunction or failure of each piece of equipment installed in the auxiliary fuel system and ensure that no malfunction will result in a hazard to the airplane. The analysis should include the effects of Par 7 25
AC 23-10 8/5/91/ failure for all modes of component failure and all modes of auxiliary fuel system operation, such as, pressure fueling and defueling, fuel transfer or engine feed, and emergency fuel jettisoning. The effects of both detectable and undetectable failures should be analyzed.
(B) wherever possible, the configuration shoulo incorporate means to detect component failure in the system.
example of such detecting means is the momentary "on" position detecting circuit incorporated in electric motor-operated fuel shutoff Valves with this feature are available as off-the-shelf items.
(ii) Component Failure Indication.
(A) As discussed in the previous section, failure indication should be incorporated wherever possible to preclude situations of undetectable failure which can jeopardize airplane safety. Failure indication can be provided in a number of ways.
best from a recognition standpoint is indication which is immediate and draws attention. The momentary "on" position, or in-transit light for a motor-operated shutoff valve, a low fuel state warning light, and an audible warning and light indicating fire or overheat are all examples of this type of indication. Continuous monitoring indicators such as pressure gages, fuel quantity indicators, and temperature gages can also provide failure indication. However, these devices are not as effective because they rely heavily on human judgment and alertness. Where crew workloads are heavy, such indications may go unnoticed for long periods or until the failure produces a critical flight incident.
Periodic inspection, such as the preflight inspection for fuel dripping from the auxiliary fuel system shroud drain (indication of fuel system leakage) is an essential function, but does not preclude the chance of failure occurring during long duration flights. Thus, assuming other means of detecting leakage are not incorporated, design precautions (for example, placing electrical wiring in conduits where it is routed through shroud spaces) may be necessary to preclude the chances that another failure will affect the safety of the airplane.
(2) Operating Limits.
(i) Emergency Electric Power Requirements. There are two conditions where the designer should carefully consider the availability of electrical power in the event of a generator failure:
(A) Direct engine feed auxiliary systems where the loss of pump electrical power could create an unsafe operating condition, such as an engine flame-out.
26 Par 7
(B) Direct engine feed or transfer auxiliary systems where fuel management is required to maintain proper airplane
c.g. control (such as, fuel used late in the flight).
(C) If, in either of these cases, fail-safe features are used which require the need for emergency electrical power, these needs should be assessed to ensure that sufficient power is available.
(ii) Fuel Jettisoning (§ 23.1001).
auxiliary fuel system weight at maximum fuel capacity and payload weight (and thus there is no change in the airplane maximum takeoff and landing weight), the fuel jettisoning requirements of the airplane should be the same as for the original, unmodified airplane.
Therefore, there should be no need to jettison auxiliary tank fuel.
Addition of fuel capacity which increases the maximum takeoff weight of the airplane would require additional certification efforts which are beyond the scope of this AC. One of these efforts would, however, be to evaluate the need of auxiliary fuel jettisoning.
Regardless of the need for auxiliary fuel jettisoning, the applicant should ensure by failure mode analysis or demonstration that main tank fuel jettisoning can still be accomplished without hazard to the modified airplane.
Engine Oil System Capacity (§ 23.1011). The applicant should ensure that the additional fuel capacity of the auxiliary fuel system, thus the added flight duration, does not cause depletion of the engine oll supply under maximum oil consumption conditions and engine out Adequacy of the engine oil capacity should be shown as a part of the compliance for certification of the auxiliary fuel system.
n. Main Fuel System Capacity and Flow Regulation. The applicant should show that there is no condition in which a receiving tank could be overfilled from the auxiliary tank fuel. If necessary, means should be provided in tanks supplied with auxiliary fuel to regulate the fuel level in those tanks. There should be no condition in which a receiving tank could be depleted during auxiliary tank transfer.
some cases, auxiliary tank fuel transfer cannot be initiated until the receiving tank fuel has been used down to a certain quantity.
limitation should be clearly stated in the AFM. The applicant should include in the AFM all limitations on the use of auxiliary tank fuel and any warnings necessary in the operation of the system.
Limitations and procedures should be evaluated with regard to practicality and pilot workload.
o. Radio Frequency Interference. The applicant should ensure that the system will not cause objectionable radio frequency interference and not be adversely affected by radio frequency interference from other airplane systems.
Par 7 27
p. Airplane Center of Gravity Control.
Since auxiliary fuel tanks are usually installed after initial certification of the airplane and are not part of the basic fuel system, the weight and location of the installation may introduce complex procedures in c.g. control. Several models of auxiliary fuel transfer may be used, requiring c.g. control for each. If a failure can trap fuel in an auxiliary fuel system, there should be a means provided to feed the engines and stay within the c.g. limits for the remainder of the flight (to reach the airport of destination or an alternate airport). Instructions necessary to maintain the airplane within the established c.g. limits are required by the operating regulations and by § 23.1583.
An auxiliary fuel system installed aft of the main gear may affect the airplane ground handling operations. Especially for airplanes which have not normally been ground handling limit critical, special cautions and placards may be required. It may be necessary in some cases to institute refuel sequence controls to prevent tipping of the airplane. Since removal of interiors or other equipment could also aggravate ground aft c.g. problems, maintenance manual supplements should include appropriate procedures and cautions.
(3) A means of controlling the center of gravity may be attained by providing c.g. limit charts with associated limits on alrplane gross weight, configuration, zero fuel weight, and fuel schedules in the limitations section of the AFM.
transfer procedures should be provided for all modes of transfer along with instructions for c.g. control if fuel transfer is not available.
q. Airplane Placards and Instrument Marking Evaluation.
(1) Location of Placards, Markings, Gages, and Switches, etc.
(§§ 23.1555 and 23.1557).
(1) Cockpit placards, markings, annunciator lights, gages, switches, and controls for the auxiliary fuel system should be located in suitable areas with sufficient illumination to ensure they are easily readable during day and night operations. The switches and controls should be easily accessible to the ground or flight crews as required by the applicable regulations.
(ii) Special placards, located in the cargo compartment, or adjacent to the auxiliary fuel tank installation may be necessary to inform or caution the ground crew about certain aspects of the installation. For example, these placards may state certain cargo compartment loading limits or restrictions, flexible cargo barrier tensioning requirements, or cautionary flammable fluid requirements as required. Suitable markings on the airplane exterior surface are required identifying drain access doors, masts, fuel filler openings, 28 Par 7
(2) Instrument, Instrument Identification, Lighting, and Calibration (§§ 23.1305, 23.1337, 23.1381, 23.1541, 23.1543, 23.1553,
23.1555, and 23.1583).
(i) A fuel quantity indicator should be installed for each independent auxiliary fuel tank which provides indication to flight crew of the quantity, in gallons or pound, of usable fuel in each tank during flight unless § 23.1337(b) (b)(5) is met. Indicators should be as accurate and compatible with the existing airplane fuel quantity indicators as possible and calibrated using the same units of volume.
readable with instrument lights. Instrument and switch markings should be easily
(iii) Each instrument, indicator, and switch should have markings/placards which permit the crew to easily identify it.
Markings and placards should be displayed in conspicuous places and should be such that they cannot be easily erased, disfigured, or obscured.
(iv) If the instrument markings are on the cover glass of the instrument, there should be means to maintain the correct alignment of the glass cover with the face of the dial.
(v) Each fuel tank selector control, if used, should be marked to indicate the position corresponding to each tank.
Pilot's Operating Handbook (POH) or Airplane Flight Manual (AFM) (§§ 23.1581 through 23.1587) (reference AC 23-8A).
(1) Auxiliary fuel tanks installed after initial certification of the airplane require an FAA approved AFM supplement or an appendix to the existing basic AFM to provide appropriate operating information, procedures, and limitations. Generally, an appendix to an AFM is appropriate when written by the manufacturer of the basic airplane, and a supplement is appropriate when the applicant for an auxiliary fuel tank installation is other than the manufacturer.
(2) The applicant is responsible for preparing the AFM supplement or appendix which should be incorporated into the basic The operating procedures and limitations should be evaluated by the FAA flight test crew as part of the flight test evaluations prescribed by the Type Inspection Authorization (TIA). Crew workload should be evaluated to determine whether it is still acceptable with the addition of an auxiliary fuel system. Crew workload should be considered early in the design of the system, with FAA participation, to ensure that all considerations are properly coordinated.
Par 7 29
Sufficient information and data should be provided in the AFM to ensure that the flight crew will be able to understand and operate the system during normal, abnormal, and emergency operations of the airplane.
(4) Abnormal procedures are those that are not normal procedures and also are not emergency procedures. They include procedures for foreseeable failure situations where the use of special systems or the use of regular systems may be expected to maintain an acceptable level of airworthiness. Immediate action is not usually required. Since most auxiliary fuel systems are add-on systems, which are not included in the flight training syllabus of the airplane, the AFM supplement or appendix should be complete in providing the required information. To ensure completeness of the AFM supplement (or appendix), the following discussion and format are provided as a guide for the type of information that should be considered.
(i) Limitations.
(A) Fuel Loading Limitations. The maximum allowable fuel in each auxiliary tank should be specified. Loading limitations may be required to maintain weight/c.g. within limits;
auxiliary tanks and the auxiliary tanks may be required to be loaded certain main fuel tanks may be required to be loaded before the in a particular sequence depending on the design of the system.
(B) Fuel Management Limitations.
Specific fuel usage procedures may be required to maintain the weight and balance of the airplane within limits.
Additionally, flight planning limitations may be required if a single failure can trap fuel in the auxiliary fuel system; the main fuel system should still provide sufficient fuel to the engines for the remainder of the flight, to reach the airport of destination or to an alternate airport.
(2) A specific sequence of transferring auxiliary fuel may be required as a result of fuel flow rates.
(C) Operating Limitations.
(1) Maneuvering limitations should be specified.
(2) Transfer of fuel during takeoff and landing are usually prohibited because of the crashworthiness fire hazard.
(3) Transfer of fuel during climb or descent may be prohibited because of usable fuel consideration.
(D) Miscellaneous Limitations. Cargo and floor loading restrictions may be required due to the auxiliary fuel tank installation.
30 Par 7
(ii) Emergency Procedures.
(A) Ditching. If applicable, procedures should be provided regarding transfer of fuel from auxiliary fuel tanks and placement of controls and switches prior to ditching.
(B) No Fuel Transfer. Should fuel not transfer and become trapped in the auxiliary tanks, procedures should be included to regain transfer capability. If transfer is still not available, management procedures should specify how to maintain weight/c.g.
within limits.
(iii) Normal Procedures/Abnormal Procedures.
(A) Fuel Loading. Instructions necessary to enable loading of the airplane within the established limits of weight and center of gravity, and to maintain the loading within these limits in flight should be provided.
(B) External Preflight Check. Detailed procedures should be specified.
(C) Cockpit Preflight Check. Detailed procedures should be specified.
(D) Fuel Management and Transfer Procedures.
Fuel Transfer. Detailed procedures should be specified for each fuel transfer schedule approved and should include normal fuel transfer rates for use.
(2) Flow Check. Procedures to determine that auxiliary fuel transfer is available should be specified, where required.
(3) Fuel Jettison (If installed). Procedures should be established to dump fuel, if desired, listing airspeed, altitude, and configuration.
(E) Unusable Fuel (§ 23.1585(f)). The unusable fuel should be specified.
(F) Usable Fuel (§ 23.1585(g)). Maximum usable fuel should be specified.
(iv) Performance. Any change in airplane performance should be provided.
Par 7 31
(v) Auxiliary Fuel System Description. A detailed description and functional schematic arrangement should be provided.
This information may be provided in an unapproved section of the AFM supplement (or appendix) or may be included in the approved Section 3, Normal Procedures. A suggested outline includes the following:
(A) Fuel Transfer System.
(B) Control Panel.
(C) Refueling System.
(D) Electrical System.
(E) Schematics.
S . Weight and Balance Manual Information (§ 23.1589). Weight and loading distribution information including loading instructions should be presented either in the AFM supplement or in a separate weight and balance control and loading document which should be referenced in the AFM .
Continued Airworthiness (§ 23.1529). The inspections, tests, repairs, and related intervals upon which compliance with the applicable certification basis is based should be included in a maintenance manual supplement supplied by the applicant. The manual should also contain complete servicing information for the auxiliary tanks and systems. If the applicant proposes to have a system where a tank (s) may be removed or made inoperable for maintenance purposes and the remainder of the system remains airworthy (as where more than one tank configuration is an approved configuration) or where the entire system is classified as removable, complete maintenance instructions should also be provided detailing the methods of system modification or removal, resealing and restoring the compartments, and other considerations necessary to make the airplane airworthy. The applicant should refer to Part 23, appendix G, Instructions for Continued Airworthiness, when providing maintenance instructions.
same ити BARRY D. CLEMENTS Managey, Small Airplane Directorate Aircraft Certification Service 32 Par 7
Appendix 1 APPENDIX 1. DEFINITIONS The following definitions are applicable as used in the text of this AC.
An auxiliary fuel system is a system installed within the airplane which makes additional fuel available for increasing the flight range of that airplane. The term "auxiliary" means that this system is secondary to the airplane's main fuel system; i.e., that the functions of the main fuel system are immediately available and operative in the event of failure or inadvertent depletion of fuel in the auxiliary fuel system (reference In essence, an airplane equipped with an auxiliary fuel system is capable of safe flight even when the auxiliary fuel system is not used, i.e., where its fuel storage capacity is not
b. Main Fuel System. A main fuel system is a system installed within an airplane which is required for safe operation of the airplane. Its primary function is to provide an independent, uninterrupted flow of fuel to each airplane engine. Main fuel tanks are those tanks which normally supply fuel directly to the engine in at least one operating mode and are necessary to satisfy the independent feed requirements of the airplane (reference § 23.953).
These tanks also contain the reserve fuel necessary for all flight diversions and other contingencies.
c. Fail-Safe.
The FAA fail-safe design concept is a design methodology where the effect of failures and failure combinations must be considered in defining a safe design. The following basic rules involving failure events apply:
(1) In any system or subsystem, a single failure of any element or connection during any one flight (brake release through ground deceleration to stop) must be assumed without consideration as to its probability of failing. This single failure event must not prevent the continued safe flight and landing of the airplane.
(ii) Additional independent failure events during any one flight following the first single failure must also be considered when he probability of occurrence is likely (1.e., those combinations o ailures not shown to be extremely improbable). If a critical failure event cannot readily be detected, it must be counted as a latent existing failure in addition to the first failure. The probability of these combined failures includes the probability of occurrence of the first failure event.
Appendix 1
(2) The following design principles and techniques are generally utilized to prevent single failures and likely combinations of failures from jeopardizing the continued safe flight and landing of the airplane:
(i) Redundancy or backup systems that provide system function after the first failure, i.e., two or more engines, two or more hydraulic systems, dual flight controls, etc.
(ii) Isolation of systems and components, both physically and functionally, so that failure of one element will not cause failure of the other. This is sometimes referred to as system independence.
(iii) Detection of failures or failure indication.
(iv) Functional verification, i.e., the capability for testing or checking the condition of the components.
(v) Proven reliability and integrity to ensure that multiple component or system failures will not occur in the same flight.
(vi) Damage tolerance that limits the safety impact or effect of the failure.
(vii) Design failure path that controls and directs the failure event by design to limit the safety impact.
(viii) Flight crew procedures following the failure event designed to ensure continued safe flight by specific crew actions.
sight design 1-5922 (3) The FAA fail-safe design concept utilizes all of the above eight design principles in whatever combinations are required tc roduce a fail-safe design. The employment of only one of the above principles is seldom adequate; generally, two or more are used in the design to satisfy the fail-safe design concept, i.e., ensure that catastrophic failures will be extremely improbable.
d. Passenger/Cargo Compartments. All compartments specifically designed to provide a suitable life support environment for people and animals during all operating modes of the airplane. These areas may or may not be pressurized. These areas include, but are not limited to, the cockpit, passenger compartments, and cargo and baggage compartments.
e. Zero/Fuel Weight. Typically, civil airplanes are designed to carry fuel in the wings. In addition to any other advantages, locating the fuel in the wings relieves wing bending stresses allows a higher maximum weight than would be possible with the same 2
AC 23-10 8/5/91 Appendix 1 quantity of fuel located within the fuselage. For such airplanes, zero fuel weight is established as a limit to ensure that maximum wing exceeded by bending stresses are not exceeded by replacing fuel in the wings with an equal weight of payload carried in the fuselage. When an auxiliary fuel tank is installed within the fuselage, the existing zero fuel weight limit is no longer directly applicable because the fuel contained in that tank does not relieve wing bending stresses. It is, therefore, necessary to reduce the zero fuel weight limit by the maximum usable fuel capacity of the auxiliary tank. Alternatively, the zero fuel weight limit may be redefined as the maximum zero wing fuel weight limit. Any fuel contained in the auxiliary tank would then be treated as payload from a weight and balance standpoint.
Regardless of which procedure is used, the AFM must clearly state the limit and its meaning.
3 (and 4)
( (