probability of fatigue failure. Chapter 9 of MIL-HDBK-5D, Metallic Materials and Elements for Aerospace Vehicle Structures, and MIL-HDBK-17, Plastics for light Vehicles, contain procedures for establishing such properties.
h. Composite repair procedures defined by the applicant and approved by the FAA.
Chap 3 28 Par 9
CHAPTER 4 - AUXILIARY FUEL SYSTEM PERFORMANCE GENERAL. The designer should evaluate the auxiliary fuel system performance for all normal operating conditions of the airplane. This will, as a minimum, require a FAA witnessed functional ground and flight test program.
Some of the performance criteria discussed in this section can be sufficiently evaluated by analytical methods, and substantiation reports submitted to the applicable FAA aircraft certification office for approval. As noted earlier, installations that involve changes in primary structure, aerodynamics, or mass distribution may require additional extensive substantiation that is beyond the scope of this AC. The following criteria should be considered by the applicant in generating test plans and substantiation reports for certification of the system.
11. NORMAL OPERATION EVALUATION.
a - Refueling and Transfer Performance.
(1) Refueling and Transfer Flow Rates and Pressures ($$ 25.951,
25.955, 25.957, 25.961, 25.991 and 25.979).
(i) The auxiliary refueling system should be analyzed to determine that the flow rates and pressures are acceptable. Fueling flow rates should also be demonstrated and verified by ground tests. The tank vent system capacity should be verified for the required operations and to ensure that over pressurization of the tanks, including the existing airplane main tanks when applicable, does not occur. Verification is also required that the pressure fueling automatic shutoff means does not produce unacceptable surge pressures which may damage the system or fueling equipment or rupture fueling lines.
verification can be accomplished by ground or laboratory refueling tests using fast response pressure transducers and recorders or submittal of previously accepted similar tests and service history data.
(ii) Transfer rates should be determined for all flight conditions in which transfer will be permitted to ensure that the receiving tank will be neither overfilled nor depleted before transfer is completed.
should be shown that transfer does not present any hazard, such as unwanted fuel migration, during such flight conditions. Any restrictions on transfer, such as duration or flight operating condition, must be outlined in the limitations section of the AFM. It should be assumed that the transfer system might be left on inadvertently; therefore, it should also be shown that transter under conditions not permitted by the AFM would not present any hazard.
(iii) Compliance with the hot weather operational performance requirements of § 25.961 must be shown for auxiliary feed systems that feed directly to the engine. This is normally accomplished by conducting a hot fuel test; however, it may, in some instances, be sufficient to show that the system is similar to a previously approved system or to submit an analysis that is supplemented with component test data.
Chap 4 Par 10 29
For auxiliary fuel systems that depend on bleed air for fuel transfer the airplane engine is, in effect, a transter pump, and tail-sate requirements for pump transfer apply. This means that there must be an alternate means of providing fuel transfer in event of an engine inflight shutdown in accordance with § 25.901(c). This is usually provided by extracting bleed air for auxiliary tank transfer downstream of the pneumatic cross-over point. It is suggested that the applicant consult the airplane type certificate holder concerning the proper location of bleed air extraction points.
(2) Fuel Tank Capacities (Usable Fuel, Sump Capacity, Undrainable Fuel, and Expansion Space) ($$ 25.959, 25.969, and 25.971).
(1) For direct feed auxiliary tuel systems, the unusable fuel requirements of $ 25.959, apply. For transfer type auxiliary fuel systems, the systems the unusable fuel is the quantity of fuel remaining after transfer under the most critical steady state airplane flight attitude and altitude conditions permitted by the AFM.
Sump capacity is a part of the unusable fuel and as previously noted, is defined by § 25.971 (a).
.The undrainable fuel quantity should be measured, usually during the initial filling of the auxiliary tanks as a part of FAA witnessed ground tests. The undrainable fuel quantity is the fuel remaining in the system after all fuel possible has been sump drained from the system. It is not usually necessary to completely fill the tanks to determine the undrainable fuel, as the undrainable fuel is fuel trapped between stringers, at low points in fuel fittings, etc: Usually measuring the quantity of fuel necessary to fill all trapping cavities in the system is all that is necessary.
(iv) The maximum tank fueling capacity must take into consideration the expansion space requirements of $ 25.969, Fuel Tank Expansion Space. The expansion space volume is the space available for fuel thermal expansion within the tank itself and does not include vent line volume.
Basically, the expansion space is the volume from the tank full level to the level where fuel will just begin to enter the vent line.
(v) Figure 5 shows how the expansion space would be defined for three different vent configurations. The expansion space volume must be subtracted from the total volume of fuel at the level at which fuel will just begin to enter the vent line, and does not include the "compression" space above the vent opening. The expansion space should be derived for the airplane in its normal ground attitude. Expansion space capacity is verified during the airplane ground fueling tests conducted as a part of the test program.
(vi) Ground and flight tests of the installed system must be conducted in accordance with § 25.979 with the airplane in the correct ground and flight attitudes to verify that the expansion space requirements are Chap 4 30 Par 11
maintained for pressure fueling to the maximum automatic fuel shutoff level, verify tank(s) pressures during failure of the auto shutoff and also provide the correct values for usable and unusable system fuel.
(3) Pressure Relief (Water Hammer and Thermal Expansion) ($$ 25.995 and 25.1189(h)). The designer should evaluate the pressure fueling and transfer or direct feed system operation to ensure that no damaging fuel line pressures will occur during flow shutoff or due to thermal expansion effects. Normally, sufficient flex line length and the use of "slow" shutoff valves or valves with thermal relief features will negate this problem. In some cases relief valves or other means may need to be incorporated in the system.
(4) Vent System Anti-Siphoning ($ 25.975). The auxiliary tank vent system should be arranged so that no hazardous quantities of fuel can migrate from one tank to another tank or discharged overboard during any normal flight attitudes.
Operating Limits ($$ 25.1503 through 25.1533). Assuming that the airspeed, c.g., maximum takeoff weight and maximum landing weight limitations will not be changed as a result of the auxiliary fuel system installation, the applicant's alternatives will be tradeoffs between payload weight and auxiliary fuel system weight at maximum capacity loading. Using these criteria, the applicant should review the requirements of Part 25 Subpart G, Operating Limitations and Information, to ensure that the auxiliary fuel system design does not degrade the airplane performance and other requirements stated in this subpart. If the c.g., airspeed, maximum takeoff or landing weight limits are increased, recertification efforts beyond the scope of this AC will be required.
(1) Operating Airplane Flight Envelope. The installation of the auxiliary fuel system should not restrict the operating flight envelope of the airplane, or a major recertitication eftort may be required. This does not nean that the auxiliary fuel system must function (transfer fuel) at all existing extremes of the airplane flight envelope. Envelope limitations on the transfer of auxiliary tank fuel must, however, be stated in the AFM. Using the above criteria the applicant should ensure that the auxiliary fuel system will not be adversely affected by exposure to the temperatures, pressures, altitude variation, and flight loads encountered in all regions of the airplane flight envelope. Specific examples of the above are discussed in Chapter 3 of this AC, in particular sections 8a(3) and 8a(5).
(2) System Electrical Power Requirements ($$ 25.1351, 25.1357).
If additional equipment which consumes electrical power is installed in an airplane, the revised total electrical loads should not exceed the generator or alternator output ratings and limits prescribed for the airplane, or the ratings of any airplane bus(es). To ensure that the design meets the criteria, the applicant should provide the following:
(A) Power requirements for each of the equipment items which will be installed.
Chap 4 Par 11 31
(B) Wiring diagrams for the equipment installation.
(C) An updated, electrical load analysis for the airplane including the auxiliary fuel system.
(ii) An appropriate circuit protective device (circuit breaker or fuse) should be installed as close as possible to the electrical power-source DUS . Good engineering practices for selection of circuit breakers would consider the following:
(A) The minimum rating commercially-available airplane circuit breaker size which will power the normal (i.e. intended) load without nuisance trips, there by minimizing deliverable power to possible fault loads.
(B) Integral three-phase circuit breakers to protect three-phase loads.
(C) The selected circuit protective device must be consistent with the airplane electrical system protection and must protect the smallest wiring in the circuit.
(3) System Pneumatic Requirements (If Applicable) ($$ 25.981 and
25.965). If pneumatic pressure is used to transfer the fuel, it should be demonstrated that safe air supply temperatures and pressures are maintained under all normal and failure conditions of the pneumatic system. Air supply temperature, verified by test, should never exceed a safe margin below the lowest expected autoignition temperature of the fuel during fuel transfer.
Safeguards should be provided, such as pressure regulators or relief valves, to ensure that over pressurization of the tanks will not occur in event of a pressure regulation failure in the pneumatic system. Cockpit pressure gauges indicating actual transfer pressure may also be required to ensure correct and adequate pressure levels.
(4) Fuel Quantity System Calibrations and Limitations ($ 25.1337(b)).
Part 25 requires that fuel quantity gages read zero when the fuel remaining in the tank is equal to the unusable fuel supply. In this respect fuel quantity systems are calibrated for usable fuel wet, i.e., with a specific fuel of known density to substantiate that the fuel measurement system, as installed in the airplane, indicates zero in a level flight attitude. The applicant may want to the unusable fuel to the zero limit of the gage in some cases where the gage can not be calibrated down to the actual unusable tank fuel level, in lieu of replacing the gage. The calibration also encompasses additional readings of the fuel quantity gage which are compared against a standard, usually the readings taken from a fueling system having a calibrated accuracy of 0.5 percent.
with the exception of the zero reading, all other calibration errors should be defined so that the acceptability for the particular auxiliary fuel system under review can be determined.
Chap 4 32 • Par 11
12. FAIL SAFE AND EMERGENCY OPERATION EVALUATION ($$ 25.952 and 25.901 (c)). It is the applicant's responsibility, as a part of the certification compliance program, to analyze and submit a reports) on the auxiliary fuel system component failure modes and consequences of these failures. It must be shown that the resulting consequence of any single detectable failure or combination of undetectable failures will not jeopardize the safety of the airplane. The fail safe criteria as defined in Appendix 1, Definitions, should be used as a guide in all design and failure mode analyses.
a. System Failure Modes.
(1) Component Failure Modes.
(i) The applicant will analyze the effects of malfunction or failure of each piece of equipment installed in the auxiliary fuel system and ensure that no malfunction will result in a hazard to the airplane. The.
analysis will include the effects of failure for all modes of component failure and all modes of auxiliary fuel system operation, such as, pressure fueling and defueling, fuel transfer or engine feed, and emergency fuel jettisoning. The effects of both detectable and undetectable failures shall be analyzed.
(ii) Wherever possible the configuration should incorporate means to detect component failures in the system. An example of such detecting means is the momentary "on" position detecting circuit incorporated in electric motor operated fuel shutoff valves. Valves with this feature are available as off-the-shelf items.
(2) Component Failure Indication.
(i) As discussed in the previous section, failure indication should be incorporated wherever possible to preclude situations of undetectable failure which can jeopardize airplane safety. Failure indication can be provided in a number of ways. The best from a recognition standpoint is indication which is immediate and draws attention. The momentary "on" position, or in-transit light for a motor operated shutoff valve, a low fuel state warning light, and an audible warning and light indicating fire or overheat are all examples of this type of indication. Continuous monitoring indicators such as pressure gauges, fuel quantity indicators, and temperature gauges can also provide failure indication. However, these devices are not as eftective because they rely heavily on numan judgment and alertness. where crew workloads are heavy, such indications may go unnoticed for long periods or until the failure produces a critical flight incident.
(ii) Periodic inspection, such as the preflight inspection for fuel dripping from the auxiliary fuel system shroud drain (indication of fuel system leakage) is an essential function, but does not preclude the chance ot failure occurring during long duration flights. Thus, assuming other means of detecting leakage are not incorporated, design precautions (for example, Chap 4 Par 12 33
placing electrical wiring in conduits where it is routed through shroud spaces) may be necessary to preclude the chances that another failure will affect the safety of the airplane.
(3) Special Considerations for Auxiliary Fuel Systems Used for C.G.
Control. On occasion, an applicant has elected to offset an airplane's c.g.
shift by retaining fuel in an auxiliary tank for use late in the flight profile. Normally, auxiliary system fuel is used after takeoff and early in flight. This allows a somewhat simpler system having reduced redundancy compared to that of the main fuel tank system for the airplane. If the auxiliary fuel system should fail to transfer, the flight can return to the point of departure. However, for an auxiliary fuel system used for c.g.
control, as where fuel is consumed late in flight, it may not be possible for the airplane to return to the original point of departure in the event of a fuel transfer malfunction. For this reason the system should have fail-safe transfer capability similar, in part, to the main tank fuel system. The safety of this system must stand on its own merits, i.e., a failure or malfunction of the auxiliary system should not prevent continued safe operation of the engines nor require reliance on the basic airplane's reserve fuel to complete the planned flight. Consideration must be given to the amount of vibration, wing flexure loads transferred to connections, support brackets, locking devices, etc., and the consequences of failure on the ability to maintain critical transfer flow rate. Therefore, the configuration should provide appropriate fail-safe features to assure that auxiliary fuel is always available in the event of a malfunction. Examples of some of the fail safe features which have been incorporated in a c.g. managed system in the past are shown in Figure 6 and include:
(i) Verification that in event of a significant failure of a feed line, the shroud would act as a redundant line to transfer the required (i1) Incorporation of dual transfer pumps, line check valves and additional line support brackets. The added brackets ensured that if the feed line couplings inside the tank failed and separated, sufficient line alignment was maintained to ensure the fuel transfer. The added braces restricted both longitudinal and lateral line movement in event of coupling separation.
(iii) A fuel transfer verification check procedure incorporated in the AFM. This check procedure required that a sufficient quantity of fuel be tranferred early in flight to ensure that the system was functioning properly.
b. Operating Limits ($ 25.1351 (d)).
(1) Emergency Electric Power Requirements. Generally there are no auxiliary fuel system electrical components which are required to be on the airplane essential bus circuits. There are however two exceptions which the designer should consider carefully:
Chap 4 34 Par 12
(i) Direct engine feed auxiliary systems where the loss of pump electrical power could create an unsafe operating condition, such as an engine flame-out.
(ii) Direct engine feed or transfer auxiliary systems where fuel management is required to maintain proper airplane c.g. control (such as, fuel used late in the flight).
(iii) If, in either of these cases, fail-safe features are used which require the need for emergency electrical power, these needs should be assessed to ensure that sufficient power is available from the airp ane essential power system. (See also Chapter 4, paragraph 11b(2).)
(2) Fuel Jettisoning ($ 25.1001).
(1) It the applicant uses a trade-oft between auxiliary fuel system weight at maximum fuel capacity and payload weight (and thus there is no change in the airplane maximum takeoff and landing weights) the fuel jettisoning requirements of the airplane will be the same as for the original, unmodified airplane. There will therefore be no need to jettison auxiliary tank fuel. Addition of fuel capacity which increases the maximum take-off weight of the airplane would require recertification efforts which are beyond the scope of this AC. One of these efforts would, however, be to evaluate the need of auxiliary fuel jettisoning.
(ii) Regardless of the need for auxiliary fuel jettisoning, the applicant should ensure by failure mode analysis or demonstration, that main tank fuel jettisoning can still be accomplished without hazard to the modified airplane (see also the discussion in Chapter 1, paragraph 3b).
Chap 4 Par 12 35
Figure 5
EXAMPLES OF EXPANSION SPACE DEFINITION Expansion Space Expansion Space Expansion Space Vent Fuel Level Tank (A) (B) (C Chap 4 36
Figure 6 AN EXAMPLE OF AN AUXILIARY FUEL SYSTEM USED FOR C.G. CONTROL Essential Fuel System To Engine To Engine Center Wing Main Tank Shutoff Valve Feed Line Shroud Line Coupling Coupling Restraint Brackets Secondary Barrier Check Valve Aft Fuel Pump Tank Chap 4 37 (and 38)
CHAPTER 5 - IMPACT OF SYSTEM ON AIRPLANE OPERATION AND PERFORMANCE.
13. ENGINE OIL SYSTEM CAPACITY ($ 25.1011). The applicant should ensure that he additional fuel capacity of the auxiliary fuel system, thus the added light duration, does not cause depletion of the engine oil supply under maximur oil consumption conditions and engine out operation. Adequacy of the engine oll capacity must be shown as a part of the compliance for certification of the auxiliary fuel system.
MAIN FUEL SYSTEM CAPACITY AND FLOW REGULATION. The applicant should show that there is no condition in which a receiving tank could be over filled from the auxiliary tank fuel. If necessary, means should be provided in tanks supplied with auxiliary fuel to regulate the fuel level in those tanks. Also, there should be no condition in which a receiving tank could be depleted during auxiliary tank transfer. In some cases, auxiliary tank fuel transfer cannot be in the AFM all limitations on the use of auxiliary tank fuel and any warnings necessary in the operation of the system. Limitations and procedures should be evaluated with regard to practicality and pilot workload.
RADIO FREQUENCY INTERFERENCE. The applicant should ensure that the system will not cause objectionable radio frequency interference and not be adversely affected by radio frequency interference from other airplane systems.
16. AIRPLANE CENTER OF GRAVITY CONTROL.
Since auxiliary fuel tanks are usually installed after initial certification of the airplane and are not part of the basic fuel system, the weight and location of the installation may introduce complex procedures in
c.g. control. Several modes of auxiliary fuel transfer may be used, requiring
c.g. control for each. If a failure can trap fuel in an auxiliary fuel system, there must be a means provided to feed the engines and stay within the c.g.
limits for the remainder of the flight (to reach the airport of destination or an alternate airport). Instructions necessary to maintain the airplane within the established c.g. limits are required by the operating regulations and by § 25.1583(c).
b. An auxiliary fuel system installed aft of the main gear may affect the airplane ground handling operations. Especially for airplanes which have not normally been ground handling limit critical, special cautions and placards may be required in both cargo and refueling station areas. It may be necessary in some cases to institute refuel sequence controls to prevent tipping of the the airplane. Since removal of interiors or other equipment could also aggravate ground aft c.g. problems, maintenance manual supplements should include appropriate procedures and cautions (see Chapter 6, paragraph 20, also).
c. A means of controlling the center of gravity can be attained by configuration, zero fuel weight, and fuel schedules in the limitations sectior Chap 5 Par 13 39
of the AFM. In addition, fue! transfer procedures should be provided for al!
modes of transfer along with instructions for c.g. control if fuel transfer is not available. If the airplane is loaded within the zero fuel limits of the charts and fuel is used per the approved transfer schedules, the airplane should remain within the allowable center of gravity limits. See Appendix 1 for definition of zero fuel weight.
Chap 5 40 Par 16