should prevent failure of the tank support from causing failure of the fuel lines, for the maximum tank displacement that could occur. It may be necessary to incorporate redundant supports or secondary constraint bulkheads to accomplish this.
the in Tie alone a fore certication basin Damage Tolerance and Fatigue Evaluation. Each structural element of amended by Amendment 25-45 or subsequent amendment, must be evaluated using damage tolerance criteria or, as provided by $ 25.571(c), by fatigue (safe-life) criteria. Airplanes having earlier certification basis may be evaluated using fail-safe criteria.
(1) For fail-safe design, it must be shown by analysis, tests, or botn, that catastrophic tallure or excessive structural deformation, that could adversely attect the tight characteristics of the airplane, are not probable after fatigue failure or obvious partial failure of a single principal structural element. After these types of failure of a single principal structural element, the remaining structure must be able to withstand certain prescribed loads considered as ultimate loads.
2) ror sate-ite design, the structure must De shown by analysis ests, or both to be able to withstand the repeated loads of variable magnitude expected in service. The evaluation must include the typical loading spectrum expected in service and identification of principal structural elements and detail design points, the fatigue failure of which could cause loss of the airplane.
(3) For damage tolerant design, the structure must be evaluated to ensure that should serious fatigue, corrosion, or accidental damage occur within the operational life, the remaining structure can withstand reasonable loads without failure or excessive deformation until the damage is detected. To achieve this design objective, it is important to draw on test results for design data. Damage-tolerant design is required unless it entails such complications that effective damage-tolerant structure is impractical.
Structures for which application of damage tolerance criteria may not be practical include single load path designs where in-service inspections are not feasible due to comparatively small critical crack sizes (tank hangers, attach fittings, single fuel containment structure, joints, splices, fuel lines, etc.).
Where damage-tolerant design is impractical, the fatigue characteristics are established to ensure that the anticipated service life can be attained. The fatigue evaluation should be based on test results. In this regard, the tank should be pressure cycled appropriate to its design life and all significant details should undergo fatigue tests including adjoining structure and supports that contribute to an accurate picture of its deflection pattern. If the tank installation results in increased loads to the airframe, and there is a required structural inspection program, the applicant must provide a damage tolerance design assessment and associated airworthiness limitations. If the airframe is safe-life, fatigue substantiation is required. In any event, more Chap 1 Par 1
stringent inspections are to be provided where they are needed. Refer to AC
25.571-1, Damage Tolerance and Fatigue Evaluation of Structure, for further guidance concerning damage tolerance.
2. TANK LOCATION CRITERIA.
Uncontained Engine Rotor and Blade Failure Considerations ($$ 25.571 and
25.903(d)).
(1) The applicant should evaluate the location of fuel tanks and other major fuel system components from the standpoint of the protection afforded against uncontained engine and auxiliary power unit (APU) rotor or blade failures. For this evaluation the applicant should review the information and recommendations given in Order 8110.11, Design Considerations for Minimizing Damage Caused by Uncontained Aircraft Turbine Engine Rotor Failures, or any superseding FAA guidance material. The applicant should also obtain information about the containment features which may be incorporated in the particular engines or APUs used on the airplane involved. The energy levels of uncontained rotor/blade fragments specified by the engine/APU manufacturer should be used.
(2) The criteria to predict the probable fragmentation scatter, shown in Figure l, can be used as a generalized guideline. Past service experience has shown that the expected overall fragmentation zone, for both large and small fragments, lies within a total spread angle of approximately + 15 degrees of the plane of any rotor. In many cases fuel tanks and critical system components can be located outside of these tragmentation zones, theredi ninimizing the hazards to the system and the airplane. Where locations withir engine fragment zones are unavoidable, the applicant should refer to Order 8110.11 for information and suggestions regarding possible design techniques to minimize the hazards to the airplane. In any event, installation of these types of systems into already certified airplanes should ensure that the basic airplane safety level is maintained and not degraded.
(3) For certification compliance, a report which addresses the above considerations should be prepared and submitted. The report should adequately consider uncontained rotor and blade failures from all engine and APU sources which may effect the integrity of the auxiliary fuel system and show that design precautions have been taken to minimize hazards to the airplane in the event of these failures and that the airplane safety level has not been degraded by the auxiliary fuel tank/system installation.
Proximity to High Temperature Ducting and Equipment ($$ 25.609,
25.613(c), 25.981 and 25.1185(a)).
(1) The applicant should evaluate the location of fuel tanks from the standpoint of exposure to heat from other adjacent systems and components. The evaluation should include an analysis of heat exposure due to failure of an adjacent component (tor example, the failure of a high temperature pneumatic duct coupling located near the tank). For this evaluation the effects oi temperature on the tank allowable stresses should be considered and it should Chap 1 Par 1 5
be shown that no hazardous loss of strength or other unsafe condition will result from the heat exposure.
(2) Consideration of the effects of external heat exposure on the fuel in the tank should also be included in this evaluation. In some cases, although the tank structure will satisfactorily withstand heat exposure, heat conduction through the tank wall could elevate the fuel temperature causing unacceptable engine performance or flammability or explosion hazard (see also Chapter 2, paragraph 6h., Maximum Surface Temperatures). For tanks which use flexible bladder cells, the effects on bladder material due to neat conducted through the supporting tank wall should also be evaluated.
(3) For the particular model of airplane under review, identification of all probable heat sources with respect to the tank system location should be provided, and it should be demonstrated that the tank installation will remain safe even after a single failure of the adjacent system. Detection systems or other means which provide adequate overheat indication are acceptable provided sufficient instructions are provided in the AFM to show the interrelationship of the "failed" system to the auxiliary tank system installation.
Proximity to ruselage Break/Separation Points. Fuselage break points (Appendix I) are typically found at areas of structural discontinuity in the fuselage shell. where possible, avoid locating the tank and its support structure at these discontinuities.
d. Installations in Cargo and Baggage Compartments ($$ 25.855(b),
25.855(a-1), (a-2) and 25.857).
(1) The various components of an auxiliary fuel system installed in cargo and baggage compartments should be protected from damage caused by shifting cargo. A cargo barrier should be used to separate the auxiliary fuel system from the cargo. The barrier should be designed to contain the maximum cargo loading for which the compartment is approved under all load conditions including the emergency landing conditions. This barrier may be either a rigid or a flexible type. Solid barriers are sometimes installed to totally separate and isolate the auxiliary fuel system from the compartment, resulting in a reduced compartment size. If the barrier is flexible, consideration should be given to deformation or displacement of the barrier when under load. If minimum tension requirements are necessary to maintain the structural integrity of a flexible barrier, the requirements should be specified and conspicuously displayed in the compartment. Finally, the barrier should prevent any type of bulk cargo, particularly slender or sharp objects, from penetrating components of the auxiliary fuel system, and be structurally capable of preventing cargo from contacting the fuel system installation under all load conditions including emergency landing inertia loads. Alternatively, a barrier would not be needed if it can be shown that the fuel tank system shroud or outer wall can offer equivalent protection to the remaining components of the system. In addition, the auxiliary fuel system installation should not adversely affect intercompartmental venting incorporated in the basic airplane.
Chap 1 6 Par 2
When the fuel system is installed in cargo and baggage compartments, ensure all material used, including cargo barriers and replacement compartment liners, meet the applicable flammability requirements. The materials in the fuel system and the cargo barrier, it installed, should protect the fuel system from fire or heat from a fire that could occur in the cargo and baggage compartment. As a minimum, a cargo barrier should meet the flammability requirements of cargo and baggage compartment liners.
(3) If the compartment is a Class B compartment, consideration should be given to the required smoke/fire detector and to the access required for a crewmember to fight a fire. If the compartment is a Class C compartment, care should be taken to avoid interfering with or reducing the effectiveness of the approved smoke or fire detector, built-in fire-extinguishing system or ventilation control system. If the compartment is a Class D compartment, consideration should be given to retaining the effectiveness of the ventilation control system and to the prolonged effect of heat from a smoldering fire on the fuel tank system. Classification of the type of cargo and baggage compartment in which the auxiliary fuel system is to be installed should be defined by the applicant and verified by the applicable FAA aircraft certification office.
(4) If holes must be cut through cargo and baggage compartment liners for auxiliary fuel system lines, care should be taken to reseal the liner.
the fuel system is installed in a cargo and baggage compartment and if positive sealing cannot be verified by inspection or localized test, the certified allowable leakage from the compartment should be obtained and evaluated with the auxiliary fuel system total leakage included to ensure that the compartment classification is not affected. This may require a flight test.
(5) When the auxiliary fuel system is designed to be quickly removed, consideration should be given to the method for resealing or plugging holes while the system is removed. Complete maintenance instructions should be provided detailing the method of removal, resealing and restoring the airplane essentially to its original configuration.
AIRPLANE FUEL SYSTEM COMPATIBILITY ($$ 25.901(C), 25.951, 25.953, 25.955,
25.957 and 25.961).
a. Configuration Criteria.
(1) the essential fuel system to ensure that no hazardous fuel transfer or feed conditions exist. The criteria used to make this evaluation will depend on the type of auxiliary fuel system selected. The requirements for the two primary types of auxiliary fuel systems, the transfer and the direct feed type, vary considerably. The transfer type system supplies fuel from the auxiliary tank to an existing main tank or tanks. The direct feed system supplies fuel, in at least one operating mode, directly to an engine.
Chap 1 Par 2 7
(2) The requirements for a direct feed auxiliary fuel system are considerably more stringent than those for a transfer auxiliary fuel system.
These requirements, in general, ensure that an uninterrupted flow of fuel at the required pressure and flow rate is provided to each engine for all operating conditions of the airplane. These requirements also address altitude performance effects and low and high temperature fuel aspects as well as providing fuel system independence in at least one configuration. Failure mode and effects analyses (FMEA) are needed to ensure that no hazardous conditions exist due to a failure of the auxiliary system. Continuous engine operation should be verified when the auxiliary tank system is depleted of fuel, to prevent engine flameout or other unacceptable operating conditions.
(3) Transfer type system requirements are not as stringent but do require basic fuel system considerations such as damage to tank and vent lines due to excessive pressure from over filling, high and low temperature fuel effects, transfer rates, drainage, altitude effects, etc. The auxiliary tank depletion characteristics, especially for bleed pressurization type systems, should also be evaluated to ensure air entrainment, overpressure, etc., does not alter main tank performance. The applicant will need to determine when transfer to an essential system tank should be established and whether transfer should be in increments or continuous. The auxiliary tank quantity, tlow rates, essential system tank levels, etc., are considerations for when to initiate transfer and should be a part of the AFM procedures.
b. Interface Considerations.
(1) The interface of the auxiliary fuel system and the existing airplane fuel system should be evaluated. Use of existing fuel system lines and manifolds can provide considerable weight savings; however, the functions of these lines should be checked to ensure that the added usage does not conflict vith other requirements. for example, auxiliary tuel tanks mignt be pressure fueled from the existing airplane fueling receptacle(s); however, in manj cases, the pressure fueling manifold is also used for emergency fuel dumping or as part of the engine crossfeed system. The use of portions of the original system may create conflicting flow requirements if not thoroughly checked, particularly when a component failure, such as a valve failing to open or close, is involved.
Another example is the use of the existing airplane vent system for venting of the auxiliary tank(s). The existing vents have been sized to maintain acceptable pressure levels during refueling and flight maneuvers.
When combining the systems, the applicant should verify that no failure conditions result in an overpressure condition, i.e., during refueling or emergency descent. Some systems may require two phase flow analysis (air venting from one tank and liquid fuel venting from another tank through a combined vent system). If the essential fuel system tanks use flexible tank liners, it may be necessary to show by analysis or test that the combined vent system does not cause any hazardous bladder collapse in the essential system tanks due to rapid descent or other operating condition.
Chap 1 8 • Par 3
(3) When the auxiliary fuel system arrangement has been determined and the interfaces with the main fuel system established, a total system failure mode analysis should be conducted to ensure that no hidden failures in the system will lead to an unsafe operating condition. Analyze the system for all modes of operation, including venting, pressure tue ing, detueling, transter, engine feed, crossfeed, and emergency fuel dumping. For example, the auxiliary tank system should be designed so that failure of the system will not result in uncontrollable transfer of fuel from the main tank to the auxiliary tank when the main tank system is in its normal operating configuration.
Other Considerations. Other systems must also be evaluated tor compatibility with the auxiTiary fuel system. Ensure that the auxiliary fuel system electrical power demands do not overtax the airplane electrical system.
Use auxiliary fuel system cockpit indicators and nomenclature which are compatible with the existing cockpit displays. Cockpit instrument compatibility is especially important for the two-man crew cockpit, where pilot workload can become a critical factor and should be evaluated for Adequate cockpit display to indicate auxiliary tank depletion or improper fuel scheduling should be provided and cockpit indication of low fuel state, c.g.
unbalance or other unsafe condition should be considered for the particular Chap 1 Par 3 9
Figure l
OVERALL FRAGMENTATION ZONES Chap 1 10
CHAPTER 2 - AUXILIARY FUEL SYSTEM ARRANGEMENT
4. GENERAL ARRANGEMENT EVALUATION.
System Layout. In addition to the criteria described in the previous section, consideration should be given to the following:
(1) Line Routing, Flexibility and Support ($ 25.993).
(i) General fuel system practices should be adhered to in installing fuel and vent lines. All flexible lines should be adequately supported along the entire line installation length. Ensure that lines will not chafe against control cables, airframe structure or other equipment items.
Avoid locating lines near high temperature sources or near electrical wiring.
Where close proximity of a fuel line to electric wiring is unavoidable, locate the fuel line so that leakage cannot drip onto the wiring. Ensure that the fuel line is adequately clamped to structure to maintain the required spacing. Do not support wire bundles from fuel or vent lines. If adequate compartment ventilation or fuel line shrouding cannot be provided, isolation of electrical wiring from fuel lines may require a vapor barrier or a conduit for the wiring.
(See Chapter 2, paragraph 4a(4).)
(11) Consider the crashworthiness characteristics of the line routing. Where possible, interconnect tanks, rigid metal lines and other major fuel system components with flexible lines. Allow sufficient flexible line length to permit some shifting of the components without breaking the lines or connections. The flexibility of the entire fuselage auxiliary fuel line routing should be sufficient to account for fuselage break points. If lines are routed near structural members, the effect of "guillotine" or slashing action due to a crash landing should be addressed. When routing fuel lines through cabin floor structural lightening holes is necessary, provide sufficient clearance to prevent line severing due to floor deformations on a crash landing. A crashworthiness evaluation report of the auxiliary fuel system installation should be submitted during certification which shows, by analysis or test, that precautions have been taken to minimize the hazards due a survivable crash environment.
(2) Fuel Tank and Component Location, Access, Mounting and Protection ($$ 25.901 (b)(ii), 25.963, 25.965, 25.993 and 25.994).
(i) Each auxiliary fuel tank or tank module design should be evaluated for the basic requirements of $$ 25.963 and 25.965. These requirements address, for example, the basic integrity of the tank, bladder cell requirements, pressurized tank requirements and the tank tests, such as, slosh and vibration, that may be required.
(ii) As a general rule, all components, such as valves, pressure transmitters or switches, filters, etc., should be directly mounted to the airplane structure or to supports which are directly attached to the structure.
If fuel or other system lines or fittings are used to support auxiliary fuel Chap 2 Par 4 11
system "in-line" small/lightweight components, it should be shown that this practice does not result in excessive structural stresses when subjected to the vibration and other loads expected in service.
Although function will dictate the appropriate location of components in the airplane, there is usually some latitude which will allow selection of a specific area which is more suitable than others. Component location should be considered from the aspects of both access and protection.
Access is especially important for components which will require routine periodic inspection and maintenance such as strainers, filters and drain valves or components with known short service life expectancy. Where possible, such components should be located in areas where there are currently existing access doors and openings on the airplane. When new access provisions are required, lightning and crashworthiness vulnerability as well as structural security should be considered.
(iv) Locating components in areas where there is a high probability that they can be stepped on or tripped over by personnel during the routine servicing or maintenance of the airplane should be avoided. The crashworthiness of the location should also be considered. Components should not be installed below the fuselage cargo floor if they may be crushed, scraped oft, or cause penetration into the auxiliary fuel tank which can result in leakage during a wheels-up landing. Protection from damage due to shifting baggage and other objects which may not be tied down in the cargo area should be provided. See Chapter 1, paragraph 2d for cargo barrier criteria.
(v) For components which must be located inside the fuel tanks, the crashworthiness aspects of the installation should be considered. Means to prevent component sharp edges from penetrating the tank surface due to deflection of the surface under crash load conditions should be provided, especially where flexible tank bladder cells are used.
(3) Tank Penetration Points (Access, Quantity Probes, Float Switches and Fuel Fittings) ($§ 25.963, 25.973; 25.975, 25.977).
(!) The location and arrangement of all tank penetration points should be considered. Tank penetration points are all locations where openings exist in the tank walls for access (inspection or repairs), for mounting fuel quantity probes, float switches, etc., and for tank venting, drainage and tuel transfer or fueling.
(ii) Auxiliary tanks should have access openings large enough to permit completion of required inspections. Component and line penetrations may be usable as access/inspection openings, dependent on size and location, and should be evaluated for acceptability.
(iii) All tank fuel line to airplane structure attachments should be evaluated tor the flight, flight vibration and crash loads which may be ransmitted to the tank walls. From the crashworthiness standpoint, to prevent fuel tank fittings from being torn out of the tank wall, it may be advisable to Chap 2 12 Par 4
consider the need for frangible disconnect valves or fittings, mounted on the external surface of the tank, which separate and shut off any hazardous fuel flow from the tank in event of a crash. However, a tallure analysis must show that inadvertent closure of these frangible fittings will not interfere with continued safe flight.
(4) Electrical Wiring Routing and Support ($$ 25.1301 and 43.13). The following practices should be adhered to for wire routing and support; however, in all cases, clearance between wires and fuel or oxygen lines and control cables should be adequate to prevent damage due to deflections of structure or support which may occur during a survivable crash.
(i) A minimum clearance of 3 inches between wires and any control cable should be maintained unless a shield is provided.
(ii) Wires should be located above (preferably), or on a level with, metallic fluid lines. A minimum clearance of 6 inches between wires and combustible fluid or oxygen lines should be maintained whenever possible.
a 6-inch clearance cannot be maintained, install additional clamps to provide separation. The fluid lines should not be used as a means of supporting wire bundles. Additional clamps should be installed to support the wire bundle and these clamps fastened to the same structure used to support the fluid or oxygen lines to prevent relative motion.
(iii) A minimum separation of at least 1/2-inch should be maintained between noncombustible plumbing lines and any wire.
(iv) Wires and wire bundles should be supported with clamps meeting Specification MS-21919, Clamp, Looptype, Cushion Support, or equivalent.
(v) Where wires or wire bundles pass through cutouts in bulkheads or other structural members, a grommet and suitable clamp should be provided to prevent abrasion if the clearance is less than 1/4-inch.
(vi) Refer to AC 43.13-1A, Acceptable Methods, Techniques, and Practices--Aircraft Inspection and Repair, for more details regarding routing and supporting of wires, acceptable methods, techniques and practices-aircraft inspection and repair.
b. Fuel Containment Secondary Barriers ($$ 25.967, 25.863). For auxiliary fuel systems which are located in the passenger or cargo and baggage compartments (Appendix 1), isolation of the fuel and tue, vapors trom other areas of the compartment is of critical importance. lanks, line tittings, connections and other components, such as valves, pressure transmitters, regulators etc., must de shrouded or provided with redundant barriers such that eaks from any of these sources will not present a fire hazard. Some of the important characteristics of the secondary barrier system are:
(1) The system should be capable of containing and isolating any leakage. To contain any leakage, integrity at the maximum system operating pressure should be demonstrated.
Chap 2 Par 4 13
(2) Secondary barrier spaces should be vented and drained in accordance The drain system also serves as a periodic visual means of detecting any be connected to other types of fluid drain systems.
(3) The secondary barrier drain system materials, construction and sealing characteristics must be compatible with fuel and capable of long life under the altitude/cabin pressure cycling, vibration and wear to which they will be exposed in service.
(4) The drain system should be reviewed from the installation location aspects to preclude the possibility of inadvertant damage by ground personnel or shifting cargo.
c. Tank, Fuel and Vent Line and Component Shrouds ($ 25.967).
Auxiliary fuel tanks installed in a passenger or cargo and baggage compartment should be completely shrouded. This means that all fittings connected to and through the tank walls should also be provided with secondary barriers. Figures 2 and 3 show some acceptable designs for shrouding equipment items and fittings installed on or through the tank walls. Each tank penetration design should be reviewed to ensure a single failure (such as a seal failure) does not result in fuel or fuel vapors entering the compartment.
A primary seal with a secondary shroud/seal provides the required protection if indication of a primary seal failure is also provided and the secondary seal is pressure tested periodically.
(2) All vent and fuel fittings and connections in a passenger or cargo compartment should also be shrouded. An example of this is shown in Figure 4.
3) valves and other components, unless otherwise protected, can nave possible leak paths through shatts and at control motor or solenoid connections or other seals in addition to their line connections, and should be completely shrouded.
(4) Electrically operated components are of particular concern because of the possible need to route electrical leads through the secondary barrier spaces. The space should be considered an abnormal vapor zone containing flammable fluid similar to the interior of the fuel tank. Thus an evaluation of the electrical connector and wiring temperatures should be made for both normal and fault load conditions. It may be necessary from this evaluation to install the wiring in vapor-proof conduit, except where shown to be intrinsically safe.
d. Fuel Tank Secondary Barrier Cavity Venting ($ 25.967). The changes in tank secondary barrier cavity pressure during all airplane maneuvers, including emergency descent, must be accounted for in the design of the auxiliary fuel tank. Bladder type tanks may be critical under emergency descent conditions, Chap 2 14 Par 4
depending on the cavity vent line sizing. The vent/drain configuration must provide the required positive and negative pressure reliet between the outer shell and the bladder or inner wall to prevent collapse or over expansion of the inner tank. Depending on the location of the overboard vent/drain exit and the airtlow characteristics around the exit or exit mast, a flight test may be required to evaluate the emergency descent characteristics of the cavity vent system with the airplane in both the "clean" and "wheels and flaps down" configuration.
e. Other Secondary Barrier Vent and Drain Provisions ($$ 25.954 and
25.967).
(1) All secondary barrier spaces should be vented and drained. The spaces in some designs are manifolded for venting and drainage as shown in the figures in the previous section or are independently vented and drained.
Figures 2 and 3 the tank fitting cavities are ported into the tank shroud cavity proper. In Figure 4 the line fitting shroud vents to the tank fitting cavity; and this cavity, in turn, is vented to the tank shroud cavity.
Eventually all cavities must vent and drain to an exit external to the airplane.
The overboard exit should be located to prevent fluid reingestion into such areas as the wheelwell and other critical areas of the airplane. On many airplanes there are existing exit drain masts, which are used to vent and drain the secondary barrier cavities of the airplane main fuel tanks or shrouds. The use of these existing drain masts is recommended. The attachment of the auxiliary system drain to the existing airplane drain should ensure that backflow does not occur in either system.
(2) For secondary barriers located in passenger or cargo areas, the cavity vent and drain exit should always be open and vented to ambient pressure.
Avoid the use of push-to-drain valves at both ends of the drain to check the cavity condition. Multiple drain outlets utilizing push-to-drain or other type valves should not inhibit venting.
(3) If a new exit mast is required, consider carefully the location and configuration from the standpoint of lightning vulnerability and conductivity (see Chapter 2, paragraph 6b). Drain masts should not be located upstream of air inlets or other openings in the airplane external surface. Physical inspection by the cognizant FAA personnel of all drain locations on the actual airplane should be accomplished to ensure all interfaces are considered.
Verification that liquid discharge from the mast will flow clear of the airplane and not impinge or reenter at another airplane surface should be accomplished by impingement tests conducted in flight. Ensure that freezing does not occur during the tests and that the test results will be representative of a fuel leak.
5. FUEL SYSTEM CONTAMINATION PREVENTION ASSESSMENT (99 25.971, 25.977 and
25.997). The primary concerns of fuel contamination with respect to auxiliary fuel system design are water and debris contamination. The certification requirements are quite specific, and the installer should be familiar with the requirements of § 25.971, Fuel Tank Sumps, and § 25.977, Fuel Tank Outlets.
Chap 2 Par 4 15