maintained for pressure fueling to the maximum automatic fuel shutoff level, verify tank(s) pressures during failure of the auto shutoff and also provide the correct values for usable and unusable system fuel.
(3) Pressure Relief (Water Hammer and Thermal Expansion) ($$ 25.995 and 25.1189(h)). The designer should evaluate the pressure fueling and transfer or direct feed system operation to ensure that no damaging fuel line pressures will occur during flow shutoff or due to thermal expansion effects. Normally, sufficient flex line length and the use of "slow" shutoff valves or valves with thermal relief features will negate this problem. In some cases relief valves or other means may need to be incorporated in the system.
(4) Vent System Anti-Siphoning ($ 25.975). The auxiliary tank vent system should be arranged so that no hazardous quantities of fuel can migrate from one tank to another tank or discharged overboard during any normal flight attitudes.
Operating Limits ($$ 25.1503 through 25.1533). Assuming that the airspeed, c.g., maximum takeoff weight and maximum landing weight limitations will not be changed as a result of the auxiliary fuel system installation, the applicant's alternatives will be tradeoffs between payload weight and auxiliary fuel system weight at maximum capacity loading. Using these criteria, the applicant should review the requirements of Part 25 Subpart G, Operating Limitations and Information, to ensure that the auxiliary fuel system design does not degrade the airplane performance and other requirements stated in this subpart. If the c.g., airspeed, maximum takeoff or landing weight limits are increased, recertification efforts beyond the scope of this AC will be required.
(1) Operating Airplane Flight Envelope. The installation of the auxiliary fuel system should not restrict the operating flight envelope of the airplane, or a major recertitication eftort may be required. This does not nean that the auxiliary fuel system must function (transfer fuel) at all existing extremes of the airplane flight envelope. Envelope limitations on the transfer of auxiliary tank fuel must, however, be stated in the AFM. Using the above criteria the applicant should ensure that the auxiliary fuel system will not be adversely affected by exposure to the temperatures, pressures, altitude variation, and flight loads encountered in all regions of the airplane flight envelope. Specific examples of the above are discussed in Chapter 3 of this AC, in particular sections 8a(3) and 8a(5).
(2) System Electrical Power Requirements ($$ 25.1351, 25.1357).
If additional equipment which consumes electrical power is installed in an airplane, the revised total electrical loads should not exceed the generator or alternator output ratings and limits prescribed for the airplane, or the ratings of any airplane bus(es). To ensure that the design meets the criteria, the applicant should provide the following:
(A) Power requirements for each of the equipment items which will be installed.
Chap 4 Par 11 31
(B) Wiring diagrams for the equipment installation.
(C) An updated, electrical load analysis for the airplane including the auxiliary fuel system.
(ii) An appropriate circuit protective device (circuit breaker or fuse) should be installed as close as possible to the electrical power-source DUS . Good engineering practices for selection of circuit breakers would consider the following:
(A) The minimum rating commercially-available airplane circuit breaker size which will power the normal (i.e. intended) load without nuisance trips, there by minimizing deliverable power to possible fault loads.
(B) Integral three-phase circuit breakers to protect three-phase loads.
(C) The selected circuit protective device must be consistent with the airplane electrical system protection and must protect the smallest wiring in the circuit.
(3) System Pneumatic Requirements (If Applicable) ($$ 25.981 and
25.965). If pneumatic pressure is used to transfer the fuel, it should be demonstrated that safe air supply temperatures and pressures are maintained under all normal and failure conditions of the pneumatic system. Air supply temperature, verified by test, should never exceed a safe margin below the lowest expected autoignition temperature of the fuel during fuel transfer.
Safeguards should be provided, such as pressure regulators or relief valves, to ensure that over pressurization of the tanks will not occur in event of a pressure regulation failure in the pneumatic system. Cockpit pressure gauges indicating actual transfer pressure may also be required to ensure correct and adequate pressure levels.
(4) Fuel Quantity System Calibrations and Limitations ($ 25.1337(b)).
Part 25 requires that fuel quantity gages read zero when the fuel remaining in the tank is equal to the unusable fuel supply. In this respect fuel quantity systems are calibrated for usable fuel wet, i.e., with a specific fuel of known density to substantiate that the fuel measurement system, as installed in the airplane, indicates zero in a level flight attitude. The applicant may want to the unusable fuel to the zero limit of the gage in some cases where the gage can not be calibrated down to the actual unusable tank fuel level, in lieu of replacing the gage. The calibration also encompasses additional readings of the fuel quantity gage which are compared against a standard, usually the readings taken from a fueling system having a calibrated accuracy of 0.5 percent.
with the exception of the zero reading, all other calibration errors should be defined so that the acceptability for the particular auxiliary fuel system under review can be determined.
Chap 4 32 • Par 11
12. FAIL SAFE AND EMERGENCY OPERATION EVALUATION ($$ 25.952 and 25.901 (c)). It is the applicant's responsibility, as a part of the certification compliance program, to analyze and submit a reports) on the auxiliary fuel system component failure modes and consequences of these failures. It must be shown that the resulting consequence of any single detectable failure or combination of undetectable failures will not jeopardize the safety of the airplane. The fail safe criteria as defined in Appendix 1, Definitions, should be used as a guide in all design and failure mode analyses.
a. System Failure Modes.
(1) Component Failure Modes.
(i) The applicant will analyze the effects of malfunction or failure of each piece of equipment installed in the auxiliary fuel system and ensure that no malfunction will result in a hazard to the airplane. The.
analysis will include the effects of failure for all modes of component failure and all modes of auxiliary fuel system operation, such as, pressure fueling and defueling, fuel transfer or engine feed, and emergency fuel jettisoning. The effects of both detectable and undetectable failures shall be analyzed.
(ii) Wherever possible the configuration should incorporate means to detect component failures in the system. An example of such detecting means is the momentary "on" position detecting circuit incorporated in electric motor operated fuel shutoff valves. Valves with this feature are available as off-the-shelf items.
(2) Component Failure Indication.
(i) As discussed in the previous section, failure indication should be incorporated wherever possible to preclude situations of undetectable failure which can jeopardize airplane safety. Failure indication can be provided in a number of ways. The best from a recognition standpoint is indication which is immediate and draws attention. The momentary "on" position, or in-transit light for a motor operated shutoff valve, a low fuel state warning light, and an audible warning and light indicating fire or overheat are all examples of this type of indication. Continuous monitoring indicators such as pressure gauges, fuel quantity indicators, and temperature gauges can also provide failure indication. However, these devices are not as eftective because they rely heavily on numan judgment and alertness. where crew workloads are heavy, such indications may go unnoticed for long periods or until the failure produces a critical flight incident.
(ii) Periodic inspection, such as the preflight inspection for fuel dripping from the auxiliary fuel system shroud drain (indication of fuel system leakage) is an essential function, but does not preclude the chance ot failure occurring during long duration flights. Thus, assuming other means of detecting leakage are not incorporated, design precautions (for example, Chap 4 Par 12 33
placing electrical wiring in conduits where it is routed through shroud spaces) may be necessary to preclude the chances that another failure will affect the safety of the airplane.
(3) Special Considerations for Auxiliary Fuel Systems Used for C.G.
Control. On occasion, an applicant has elected to offset an airplane's c.g.
shift by retaining fuel in an auxiliary tank for use late in the flight profile. Normally, auxiliary system fuel is used after takeoff and early in flight. This allows a somewhat simpler system having reduced redundancy compared to that of the main fuel tank system for the airplane. If the auxiliary fuel system should fail to transfer, the flight can return to the point of departure. However, for an auxiliary fuel system used for c.g.
control, as where fuel is consumed late in flight, it may not be possible for the airplane to return to the original point of departure in the event of a fuel transfer malfunction. For this reason the system should have fail-safe transfer capability similar, in part, to the main tank fuel system. The safety of this system must stand on its own merits, i.e., a failure or malfunction of the auxiliary system should not prevent continued safe operation of the engines nor require reliance on the basic airplane's reserve fuel to complete the planned flight. Consideration must be given to the amount of vibration, wing flexure loads transferred to connections, support brackets, locking devices, etc., and the consequences of failure on the ability to maintain critical transfer flow rate. Therefore, the configuration should provide appropriate fail-safe features to assure that auxiliary fuel is always available in the event of a malfunction. Examples of some of the fail safe features which have been incorporated in a c.g. managed system in the past are shown in Figure 6 and include:
(i) Verification that in event of a significant failure of a feed line, the shroud would act as a redundant line to transfer the required (i1) Incorporation of dual transfer pumps, line check valves and additional line support brackets. The added brackets ensured that if the feed line couplings inside the tank failed and separated, sufficient line alignment was maintained to ensure the fuel transfer. The added braces restricted both longitudinal and lateral line movement in event of coupling separation.
(iii) A fuel transfer verification check procedure incorporated in the AFM. This check procedure required that a sufficient quantity of fuel be tranferred early in flight to ensure that the system was functioning properly.
b. Operating Limits ($ 25.1351 (d)).
(1) Emergency Electric Power Requirements. Generally there are no auxiliary fuel system electrical components which are required to be on the airplane essential bus circuits. There are however two exceptions which the designer should consider carefully:
Chap 4 34 Par 12
(i) Direct engine feed auxiliary systems where the loss of pump electrical power could create an unsafe operating condition, such as an engine flame-out.
(ii) Direct engine feed or transfer auxiliary systems where fuel management is required to maintain proper airplane c.g. control (such as, fuel used late in the flight).
(iii) If, in either of these cases, fail-safe features are used which require the need for emergency electrical power, these needs should be assessed to ensure that sufficient power is available from the airp ane essential power system. (See also Chapter 4, paragraph 11b(2).)
(2) Fuel Jettisoning ($ 25.1001).
(1) It the applicant uses a trade-oft between auxiliary fuel system weight at maximum fuel capacity and payload weight (and thus there is no change in the airplane maximum takeoff and landing weights) the fuel jettisoning requirements of the airplane will be the same as for the original, unmodified airplane. There will therefore be no need to jettison auxiliary tank fuel. Addition of fuel capacity which increases the maximum take-off weight of the airplane would require recertification efforts which are beyond the scope of this AC. One of these efforts would, however, be to evaluate the need of auxiliary fuel jettisoning.
(ii) Regardless of the need for auxiliary fuel jettisoning, the applicant should ensure by failure mode analysis or demonstration, that main tank fuel jettisoning can still be accomplished without hazard to the modified airplane (see also the discussion in Chapter 1, paragraph 3b).
Chap 4 Par 12 35
Figure 5
EXAMPLES OF EXPANSION SPACE DEFINITION Expansion Space Expansion Space Expansion Space Vent Fuel Level Tank (A) (B) (C Chap 4 36
Figure 6 AN EXAMPLE OF AN AUXILIARY FUEL SYSTEM USED FOR C.G. CONTROL Essential Fuel System To Engine To Engine Center Wing Main Tank Shutoff Valve Feed Line Shroud Line Coupling Coupling Restraint Brackets Secondary Barrier Check Valve Aft Fuel Pump Tank Chap 4 37 (and 38)
CHAPTER 5 - IMPACT OF SYSTEM ON AIRPLANE OPERATION AND PERFORMANCE.
13. ENGINE OIL SYSTEM CAPACITY ($ 25.1011). The applicant should ensure that he additional fuel capacity of the auxiliary fuel system, thus the added light duration, does not cause depletion of the engine oil supply under maximur oil consumption conditions and engine out operation. Adequacy of the engine oll capacity must be shown as a part of the compliance for certification of the auxiliary fuel system.
MAIN FUEL SYSTEM CAPACITY AND FLOW REGULATION. The applicant should show that there is no condition in which a receiving tank could be over filled from the auxiliary tank fuel. If necessary, means should be provided in tanks supplied with auxiliary fuel to regulate the fuel level in those tanks. Also, there should be no condition in which a receiving tank could be depleted during auxiliary tank transfer. In some cases, auxiliary tank fuel transfer cannot be in the AFM all limitations on the use of auxiliary tank fuel and any warnings necessary in the operation of the system. Limitations and procedures should be evaluated with regard to practicality and pilot workload.
RADIO FREQUENCY INTERFERENCE. The applicant should ensure that the system will not cause objectionable radio frequency interference and not be adversely affected by radio frequency interference from other airplane systems.
16. AIRPLANE CENTER OF GRAVITY CONTROL.
Since auxiliary fuel tanks are usually installed after initial certification of the airplane and are not part of the basic fuel system, the weight and location of the installation may introduce complex procedures in
c.g. control. Several modes of auxiliary fuel transfer may be used, requiring
c.g. control for each. If a failure can trap fuel in an auxiliary fuel system, there must be a means provided to feed the engines and stay within the c.g.
limits for the remainder of the flight (to reach the airport of destination or an alternate airport). Instructions necessary to maintain the airplane within the established c.g. limits are required by the operating regulations and by § 25.1583(c).
b. An auxiliary fuel system installed aft of the main gear may affect the airplane ground handling operations. Especially for airplanes which have not normally been ground handling limit critical, special cautions and placards may be required in both cargo and refueling station areas. It may be necessary in some cases to institute refuel sequence controls to prevent tipping of the the airplane. Since removal of interiors or other equipment could also aggravate ground aft c.g. problems, maintenance manual supplements should include appropriate procedures and cautions (see Chapter 6, paragraph 20, also).
c. A means of controlling the center of gravity can be attained by configuration, zero fuel weight, and fuel schedules in the limitations sectior Chap 5 Par 13 39
of the AFM. In addition, fue! transfer procedures should be provided for al!
modes of transfer along with instructions for c.g. control if fuel transfer is not available. If the airplane is loaded within the zero fuel limits of the charts and fuel is used per the approved transfer schedules, the airplane should remain within the allowable center of gravity limits. See Appendix 1 for definition of zero fuel weight.
Chap 5 40 Par 16
CHAPTER 6 - USER INSTRUCTIONAL REQUIREMENTS.
17. AIRPLANE PLACARDS AND INSTRUMENT MARKING EVALUATION.
a. Location of Placards, Markings, Gauges, Switches, etc. ($ 25.1557(a) and (b)).
(1) Cockpit and tueling station placards, markings, annunciator lights, gauges, switches and controls for the auxiliary fuel system should be located in suitable areas with sutticient illumination to assure they are easily readable during day and night operations. The switches and controls must be easily accessible to the ground or flightcrews as required by the applicable regulations.
(2) Special placards, located in the cargo compartment, or adjacent to the auxiliary fuel tank installation may be necessary to infor or caution the ground crew about certain aspects of the installation. These placards may, or example, state certain cargo compartment loading limits or restrictions, lexible cargo barrier tensioning requirements or cautionary flammable fluid requirements as required. Also suitable markings on the airplane exterior surface are required, identifying drain access doors, masts, etc.
Instrument, Instrument identitication, Leghting and Calibration $§ 25.1305, 25.1337, 25.1381, 25.1541, 25.1543, 25.1553, 25.1555 and 25.1583).
(1) A fuel quantity indicator should be installed for each independent auxiliary fuel tank which provides indication to the flightcrew of the quantity, in gallons or equivalent units, of usable fuel in each tank during light (see also chapter 4, paragraph lib(4)). indicators should De as accurate and compatible with the existinq airplane fuel quantity indicators as possible and calibrated using the same units of volume (metric or English).
(2) Instrument and switch markings should be easily readable with instrument lights.
(3) Each instrument, indicator and switch must have markings/placards which permit the crew to easily identity it. Markings and placards shall be displayed in conspicuous places and shall be such that they cannot be easily erased, disfigured or obscured.
(4) If the instrument markings are on the cover glass of the instrument, inere must de means to maintain the correct alignment of the glass cover with the face of the dial.
(5) Each fuel tank selector control, if used, must be marked to indicate the position corresponding to each tank.
Chap 6 Par 17 41
18. AIRPLANE FLIGHT MANUAL (AFM) ($$ 25.1581 through 25.1587).
Auxiliary fuel tanks installed after initial certification of the airplane require an FAA-approved AFM supplement or an appendix to the existing basic AFM to provide appropriate operating information, procedures and limitations. Generally, an appendix to an AFM is appropriate when written by the manufacturer of the basic airplane, and a supplement is appropriate when the applicant for an auxiliary fuel tank installation is other than the manufacturer.
appendix which will be incorporated into the basic AFM. The operating The applicant is responsible for preparing the AFM supplement or procedures and limitations will be evaluated by the FAA flight test crew as part of the flight test evaluations prescribed by the Type Inspection Authorization (TIA). Crew workload also will be evaluated to determine whether it is still acceptable with the addition of an auxiliary fuel system. Crew workload should be considered early in the design of the system, with FAA participation, to ensure that all considerations are properly coordinated.
Sufficient information and data should be provided in the AFM to assure that the flightcrew will be able to understand and operate the system during normal, abnormal, and emergency operations of the airplane.
d. Abnormal procedures are those that are not normal procedures and also are not emergency procedures. They include procedures for foreseeable failure situations in which the use of special systems, or the use of regular systems, may be expected to maintain an acceptable level of airworthiness. Immediate action is not usually required. Since most auxiliary fuel systems are add-on systems, which are not included in the flight training syllabus of the airplane, the AFM supplement or appendix must be complete in providing the required information. To assure completeness of the AFM supplement (or appendix) the following discussion and format are provided as a guide for the type of information that should be considered.
(1) Limitations.
(1) Weight Limitations. Maximum zero fuel weight changes and weight and center of gravity limits should be specified. It should be emphasized that when fuel is loaded into fuselage auxiliary tanks, the maximum zero fuel weight must be reduced by the weight of the added fuel.
(ii) Fuel Loading Limitations. The maximum allowable fuel in each auxiliary tank should be specified. Loading limitations may be required co maintain weight/c.g. within limits, i.e., certain main fuel tanks may be required to be loaded before the auxiliary tanks and the auxiliary tanks may be required to be loaded in a particular sequence depending on the design of the system.
(iii) Fuel Management Limitations.
Chap 6 42 Par 18
(A) Specific fuel usage procedures may be required to maintain the weight and balance of the airplane within limits. Additionally.
right planning limitations may be required it a single failure can trap fuel in the auxiliary fuel system; the main fuel system must still provide sufficient fuel to the engines for the remainder of the flight, i.e., to reach the airport (B) A specific sequence of transferring auxiliary fuel may be required as a result of fuel flow rates.
(C) If auxiliary fuel is used for ballast, a placard indicating the amount of ballast fuel is required in the cockpit.
(iv) Operating Limitations.
(A) Maneuvering limitations should be specified.
(B) Tank pressurization or transfer of fuel during takeoff and landing are usually prohibited because of the crashworthiness fire hazard.
(C) Transfer of fuel during climb or descent may be prohibited because of usable fuel considerations.
(v) Miscellaneous Limitations. Cargo and floor loading restrictions may be required due to the auxiliary fuel tank installation.
(2) Emergency Procedures.
(i) Ditching. If applicable, procedures must be provided regarding transfer of fuel from auxiliary fuel tanks and placement of controls and switches prior to ditching.
(ii) No Fuel Transfer. Should fuel not transfer and become trapped in the auxiliary tanks, procedures should be included to regain transfer capability. If transfer is still not available, management procedures should specify how to maintain weight/c.g. within limits.
(iii) Engine Inoperative. In the event of an engine failure, auxiliary fuel systems which use engine bleed air for fuel transfer may lose cranster capability. In order to restore transfer, procedures must be includec which define the steps required for obtaining bleed air from the remaininc These procedures should also define engine operating restrictions, if required, which apply during transfer following engine-out Continued use of bleed air for fuel transfer may be affected by the engine-out enroute climb performance requirements of Part 25.
Chap 6 Par 18 43