9 Note: In the past, some components have been qualified to standards that allow 320 microjoules, but this level is not acceptable for showing intrinsic safety2.
7.2.2 To ensure that the design has adequate reliability and acceptable maintenance intervals, a factor of safety should be applied to this value when establishing a design limit. Fuel tank systems should be designed to limit the allowable energy level to the lowest practical level. Systems with a maximum energy of 20 microjoules are considered technologically feasible. Normal systems operations at minimum ignition energies of up to 50 microjoules would be acceptable. Under failure conditions, the system should have an ignition energy of less than 200 microjoules.
7.3 Filament Heating Current Limit.
Analyses and testing indicate a small piece of steel wool will ignite a flammable mixture when a current of approximately 100 milliamperes (mA) root mean square (rms) is applied to the steel wool.3 Therefore, for electrical or electronic systems that introduce electrical energy into fuel tanks, such as FQIS, the electrical current introduced into any fuel tank should be limited. Because there is considerable uncertainty associated with the level of current necessary to produce an ignition source from filament heating, a factor of safety should be applied to this value when establishing a design limit. A maximum steady-state current of 25 mA rms is considered an intrinsically safe design limit for electronic and electrical systems that introduce electrical energy into fuel tanks. For failure conditions, the system should limit the current to 50 mA rms and induced transients to 125 mA peak current.
7.4 Friction Sparks.
Service experience has shown that pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, lockwire, roll pins, cotter pins, drill chips, manufacturing debris, and so forth have been drawn into fuel pumps and contacted the impeller, resulting in the possibility of metallic deposits on rotating and stationary components within the pump. This condition has resulted in creation of friction sparks and should be an assumed failure condition when conducting the SSA. Fail-safe features as described in paragraph
9.2.19.2.2 of this AC have been used to mitigate this hazard.
7.5 Maximum Allowable Surface Temperatures.
Section 25.981(a)(1) and (2) requires:
(1) Determining the highest temperature allowing a safe margin below the lowest expected autoignition temperature of the fuel in the fuel tanks.
(2) Demonstrating that no temperature at each place inside each fuel tank where fuel ignition is possible will exceed the temperature determined under paragraph (a)(1) of this section. This must be verified under all probable operating, failure, and malfunction conditions of each component whose
2 Intrinsically safe is defined in appendix C, paragraph C.20, of this AC.
3 This data was from testing performed by the FAA, found in Report No. DOT/FAA/AR-TN05/37. Applicants may conduct testing to substantiate alternate values.
10 operation, failure, or malfunction could increase the temperature inside the tank.
7.5.1 Autoignition Temperatures of Fuels.
Fuels approved for use on transport category airplanes have differing autoignition temperatures. The autoignition temperature of JP-4 (wide-cut jet fuel), as determined by ASTM4 International Test Method D2865, is approximately 468 °F at one atmosphere of pressure. By this method of testing under the same atmospheric conditions, the autoignition temperature of JET A (kerosene) is approximately 435 °F to 450 °F, and gasoline is approximately 800 °F. The autoignition temperature of these fuels varies inversely with the ambient pressure. Also, as stated in ASTM E659, Standard Test Method for Autoignition Temperature of Chemicals, “the autoignition temperature by a given method does not necessarily represent the minimum temperature at which a given material will self-ignite in air. The volume of the vessel used is particularly important since lower autoignition temperatures will be achieved in larger vessels.” In view of this, factors affecting the pressure in the fuel tank should be taken into consideration when determining compliance with § 25.981.
7.5.2 Maximum Surface Temperature.
Guidance provided in AC 25-8, Auxiliary Fuel System Installations, as well as the original release of AC 25.981-1, defines surfaces that come within 50 °F of the autoignition temperature of the fuel air mixture as defining a maximum allowable surface temperature providing a safe margin below the lowest autoignition temperature of the fuel. The FAA has historically accepted 400 °F for maximum surface temperatures inside fuel tanks for kerosene type fuels without further substantiation.
(Maximum surface temperature considerations for areas outside the fuel tank are discussed in paragraph 9.3.6.3 of this AC.)
7.5.3 Transient Higher Surface Temperature.
Manufacturers have substantiated that the conditions (ambient pressure, dwell time, fuel type, etc.) within fuel tanks are such that a higher value may be used as a transient surface temperature limit. For example, a maximum allowable fuel tank surface temperature of 400 °F, with a transient excursion that reduces the safe margin below 450 °F (i.e., the lowest expected autoignition temperature) for a maximum of two minutes, has been substantiated for kerosene type fuels. The excursion above 400 °F occurs only during failure conditions such as failure of the engine pneumatic system to regulate temperature, or duct rupture. Utilizing elevated temperatures has been based on
4 Formerly known as the American Society for Testing and Materials.
5 ASTM D286, Method of Test for Autogenous Ignition Temperatures of Petroleum Products, was withdrawn by ASTM International in 1966 shortly before amendment 25-11 established the autoignition temperature limit requirements now contained in § 25.981(a)(1) and (2). It was referenced in AC 25.981-1A, dated January 20 1971, and all subsequent issues of this AC. Therefore, we continue to accept the autoignition temperatures established using ASTM D286 as a means of compliance with § 25.981(a)(1) and (2). The ASTM website says it was replaced by ASTM D2155-12, Standard Test Method for Determination of Fire Resistance of Aircraft Hydraulic Fluids by Autoignition Temperature. The Coordinating Research Council Handbook of Fuels says it was replaced by ASTM E659-15, Standard Test Method for Autoignition Temperature of Chemicals. Either test method should provide similar results to ASTM D286.
11 specific design features, such as an overtemperature shutoff of the pneumatic system so that the temperature cannot reach or exceed the accepted autoignition temperature of 450 °F for kerosene type fuels. Applicants should submit comprehensive test data and analytical rationale substantiating any transient excursion in order to show that they are maintaining a safe margin below the lowest expected autoignition temperature of the fuel.
7.6 Fuel System Electrostatics.
7.6.1 Electrostatic charges are generated in liquid hydrocarbons when they are in motion with respect to another surface such as fueling hoses, filters, nozzles, fuel tank structure, and airplane plumbing. The documents referenced in paragraphs B.6 through B.8 of this AC provide information on this subject. For example, during airplane refueling jet fuel is loaded either from a tanker truck or from an airport hydrant system. Flowing fuel can generate an electrical charge especially through fuel filtration. The accumulation of charge in the fuel is a function of many factors. If the fuel conductivity is low, the relaxation time for dissipation of the electrical charge is long. Additionally, if airplane structure conductivity is low, as it is commonly in composite wings, the relaxation time of the fuel bulk charge to structure may be longer than it would be for a traditional metallic wing structure. Some composite structure has a lower conductivity than traditional metallic structures. A comparison can be made of the conductivity of the fuel with the conductivity of the airplane structure. Jet fuel typically has significantly lower conductivity than composite structure, meaning the conductivity of the jet fuel dominates the charge relaxation rate and consequently results in similar charge relaxation rates between the different types of airplane structures. Regardless, the fuel will accumulate an electrical charge inside an airplane fuel tank. This electrical charge may produce a high potential on the fuel surface and an electrical discharge to structure.
This is particularly a concern if large unbonded objects are located inside an airplane fuel tank. Smaller components may also become charged, and the applicant should address this in the safety assessment. If the vapor space fuel/air mixture is in the flammable range, ignition of the mixture is possible, resulting in a fuel tank explosion and fire.
7.6.2 Charge accumulation is influenced by many factors. Without an electrical conductivity improver,6 typical Jet A fuel has a low electrical conductivity. An electrical conductivity improver will increase the charging rate of fuel, but at the same time greatly improve the conductivity of the fuel to rapidly dissipate the developed charge.
Contaminants, considered as ionic impurities, enhance the charging tendency of the specific fuel. Fuels from different parts of the world and from different refineries will therefore have different charging tendencies based on the types of contaminants present.
7.6.3 Water contamination, however, increases the charging tendency of the fuel without a corresponding increase in conductivity. Water interacts with the additives or the naturally occurring contaminants in the fuel to provide this pro-static effect.
6 In some industry documents, “electrical conductivity improver” may also be referred to as a dissipator/dissipater, static dissipater additive, electrical conductivity additive, or conductivity improver additive.
12 Recognizing the dangers of water contamination, the National Fire Protection Association (NFPA) also cautions that when refueling, care should be taken to not disturb the interface between the fuel remaining in the tank and the possible layer of water below it. Disruption of this interface up into the tank ullage/vapor space may lead to an electrical discharge capable of igniting a mixture of flammable fuel vapor and air.
7.6.4 Methods for minimizing the magnitude of the developed charge have been developed and are in place on transport category airplanes including the following:
7.6.4.1 The refuel plumbing is sized and includes an orifice to maintain maximum flow rates in accordance with the electrostatic guidelines established by the NFPA and the ASTM.
7.6.4.2 The NFPA and ASTM have published guidelines to limit flow velocities to 6 to 7 meters per second while the discharge port is covered with fuel.
The NFPA/ASTM guidelines also indicate that the flow velocity should be held to less than 1 meter per second until the discharge port is covered with fuel. These guidelines were developed with gasoline in mind and are, therefore, conservative when applied to kerosene type fuels used in commercial aviation. The design guidelines for commercial aircraft in SAE7 AIR1662 limit velocities to 6 to 9 meters per second in fuel plumbing and 3 meters per second at the exit nozzle. Limiting the flow velocity may be met by incorporating multiple refueling discharge ports, lowering the flow velocity through the use of piccolo tubes that distribute the fuel at low velocities in the tank, and locating them at or near the bottom of the tank. Location of the refueling discharge at the bottom of the tank minimizes fuel spray—a contributor to static charge development— and provides for the ports to be covered by fuel reserves in main tanks and in the early stages of fuel flow as the refuel rate varies from 1 meter per second up to the full flow of 6 to 7 meters per second in normally emptied tanks.
Note: It may not be practical to develop a dual flow rate refueling system, so one way to address these guidelines may be to limit the refueling velocities to less than 1 meter per second through the use of multiple discharge points and piccolo tubes.
7.6.5 Methods of relaxing the charge have also been developed. Bonding straps are used on fuel components and plumbing lines to allow the charge to dissipate to the tank structure. During refueling, the airplane is bonded to the refueling vehicle with a separate bonding wire to provide an electrical path back to fuel filtration, which is the principal electrostatic charge generator. An electrical conductivity improver may also be used to increase fuel conductivity to quickly dissipate the developed charge.
However, the FAA does not require this type of additive, unless it is specified as part of the type design approval. Any limitations on the use of an electrical conductivity
7 Formerly known as the Society of Automotive Engineers.
13 improver would need to meet the requirements of §§ 25.1521, Powerplant limitations, and 25.1557, Miscellaneous markings and placards.
7.6.6 Applications of the above methods, and adherence to industry practices and guidelines on electrostatics, should be identified for each airplane model. Airline operation and practices regarding airplane refueling should also be evaluated to verify that the procedures necessary for safe operation of the specific airplane model are in place and followed. Restrictions, if any, on refuel rates, fuel properties, and the requirement for fuel additives should be identified as CDCCLs.
7.6.7 Polyurethane reticulated foams used for ignition suppression within fuel tanks and other non-conducting objects may accumulate and retain charge. These items may have to be treated with antistatic additives to prevent charge accumulation.
8 DESIGN CONSIDERATIONS.
The number of components and systems inside airplane fuel tanks whose failure could result in an ignition source within the fuel tank should be minimized. The following examples are FAA-accepted design practices for minimizing ignition sources:
8.1 Fiber Optics.
Wiring entering the tank for such purposes as temperature monitoring and fuel quantity indication should be minimized. Use of alternate technology, such as fiber optics, may provide a means of reducing or eliminating electrical powered components from inside the fuel tanks.
8.1.1 Fuel Pump Electrical Power Supply.
8.1.2 Fuel Pump Power Wiring.
If practical, fuel pumps should be located such that electrical power for the pumps is routed outside the fuel tanks in such a manner that failures in the electrical power supply cannot create a hot spot inside the tank or arc into the fuel tank. While the routing of fuel pump power supply outside of the fuel tank, and away from the fuel tank walls, may eliminate the potential for arcing directly into the fuel tank or heating of tank surfaces, the failure analysis should consider the need for electrical circuit protective devices. If the power supply cannot be routed outside the tank, additional design features should be considered as discussed in paragraph 8.3.2 below.
Note: The applicant should consider, in the design of the pump wiring system and when showing compliance, the electromagnetic effects and electrical transients that may damage the wiring or pump.
8.1.3 Fuel Pump Electrical Connectors.
8.1.3.1 Arcing at the pump electrical connector has resulted in uncontrolled fuel leakage, an ignition source, and an uncontrolled fire outside of the fuel tank. This can create a fuel tank ignition source due to the external fire
14 heating the fuel tank surfaces. Manufacturers have developed fuel pumps that include features to isolate the electrical connector from the portion of the fuel pump where fuel is located. Applicants should show that arcing that occurs in these designs cannot cause a cascading failure from arcing in the electrical connection resulting in a fuel leak and a fire. One approach includes incorporation of a dry area between the electrical connector and the fuel pump. Another approach includes extending the fuel pump power wire so the electrical connector is well away from the fuel pump. This approach has included a drip loop on the wire to prevent any fuel leaking onto the wire from being present at the electrical connector.
8.1.3.2 Alternatively, or in addition to isolating electrical connector from the fuel, limiting the electrical energy into the fuel tank can prevent an ignition source from occurring. The design of traditional fuel pumps has resulted in the need to install AFCB or GFI protection features to limit the energy release during an arcing event to prevent an ignition source from occurring.
8.2 Location of the Pump Inlet.
Debris that may enter a fuel pump inlet can cause sparks inside the fuel tank. One means to address this ignition source has been to locate the pumps such that the pump inlet remains covered with fuel any time the pump is operating within the airplane operating envelope. Another means has been to prevent the propagation of any ignition from the pump into the fuel tank by using flame arrestor technology. (The performance of the flame arrestor should be validated by test to verify its effectiveness at stopping a flame front.) Any protective means, including those shown in paragraphs 8.2.1 and
8.2.2 below, should be demonstrated to be effective under the pitch, roll attitudes, and negative G conditions anticipated to occur in service.
8.2.1 Main Feed Tanks.
Installation of baffles in tank structure, and use of collector tanks that are continually filled with fuel using ejector pumps, are methods that have proven successful at keeping the pump inlets and pump housings submerged in fuel.
8.2.2 Auxiliary Tanks.
For auxiliary tanks that use motor-driven fuel pumps and that are routinely emptied, accepted design practices include shutting off the motor driven pumps before uncovering the fuel pump inlet and installation of a flame arrestor in the scavenge pump inlet line, or scavenging the remaining fuel with ejector pumps. (Note that installation of features such as a flame arrestor in the fuel system would need to meet fuel system performance requirements in § 25.951, Fuel System: General.)
8.3 Wiring.
The following paragraphs on wiring represent acceptable approaches for dealing with wiring used in and near fuel tanks. For specific requirements and further guidance, the
15 applicant should review the wiring installation and design requirements in the Electrical Wiring Interconnect Systems (EWIS) rules, amendment 25-123, and associated ACs.
8.3.1 Intrinsically Safe Wiring.
All wiring that is intended to conduct intrinsically safe levels of electrical power into or through the fuel tanks should incorporate protective features that prevent exceeding the intrinsically safe levels discussed in paragraphs 7.2 and 7.3 of this AC. This wiring should also be protected from high intensity radiated fields (HIRF) induced transients.
The following protective features could be used to support that objective:
Separation and shielding of the fuel tank wires from other airplane wiring and circuits, Shielding for HIRF and other electromagnetic effects, and Installation of transient suppression devices to preclude unwanted electrical energy from entering the tank.
8.3.2 Higher Energy Wiring.
This includes all wiring that is not intrinsically safe.
8.3.2.1 Wiring should not be routed through metallic conduit inside the fuel tank or adjacent to fuel tank surfaces such that damage, inappropriate maintenance, or other failure/wear conditions could result in arcing to the conduit or metallic tank surface and consequent development of an ignition source in the fuel tank. If metallic or other conductive conduit materials are used, the single failure of electrical arcing of the wiring to the conduit, adjacent tank surfaces, or structure should be assumed to occur. In addition, circuit protective features or other features should be incorporated to preclude development of an ignition source in the fuel tank. Methods that may be used to address this foreseeable failure condition include the use of circuit protective features such as dual conduits, thick wall conduit, and/or fast-acting AFCB or GFI circuit breakers. Providing multiple layers of sleeving alone would not be considered acceptable since wear could defeat the multiple layer protection.
8.3.2.2 Where electric wires are routed through metallic conduits installed in a fuel tank, high surface temperatures or arcing through the conduit wall can be created by short circuits. All wiring conducting levels of power that exceed intrinsically safe levels (e.g., fuel pump power supply) into or through a fuel tank should be evaluated assuming arcing to adjacent surfaces, such as metallic conduits or wing surfaces, unless fail-safe protective features are provided. A critical electrical wiring condition might be one in which the insulation is worn, cracked, broken, or of low dielectric strength, allowing intermittent or constant arcing to occur without consuming enough power to cause the circuit protection device, such as a thermal mechanical circuit breaker, to open. Inspection of wiring
16 from in-service airplanes has shown that greater than expected wear may occur on sleeving and wiring insulation due to movement of the wire within the conduit. Roughness of the conduit material and variations in vibration levels for each installation may significantly increase wear. In addition, inspections have shown that protective sleeving has been missing or improperly installed, or the wrong sleeving material has been used, resulting in damage to the insulation. For these reasons, use of protective sleeving on wiring would not by itself be adequate for showing compliance. The design should be tolerant to these types of foreseeable failure or maintenance errors.
Note: AC 25-8 addresses the use of metallic conduit as an acceptable means for routing electrical power within auxiliary fuel tanks. As indicated above, these past practices would not meet the fail-safe requirements of § 25.981 for any fuel tank, unless additional fail-safe features were incorporated. Therefore, the more recent guidance in this AC, and rulemaking in amendment 25-102, supplements the guidance in AC 25-8.
8.3.3 Wire Separation.
Wiring designs used on transport category airplanes vary significantly between manufacturers and models; therefore, it is not possible to define a specific, universal, separation distance, or the characteristics of physical barriers between wire bundles, to protect critical wiring from damage. Separation requirements for wiring and other components of EWIS are contained in § 25.1707, System separation: EWIS. (The regulatory definition of EWIS is provided in § 25.1701, Definition.) AC 25.1701-1, Certification of Electrical Wiring Interconnection Systems on Transport Category Airplanes, paragraph 5d, contains guidance on determining adequate separation distance between EWIS and between EWIS and airplane systems and structures. Even if § 25.1707 is not in the type certification basis of the airplane being modified, the guidance contained in AC 25.1701-1 should still be applied, along with the guidance contained in this AC, when determining adequate separation distance. Intrinsically safe wiring for fuel tanks needs to be protected from induced currents caused by power system switching transients, or electromagnetic interference due to close proximity to other airplane wiring. In addition, damage to wire insulation can result in unwanted electrical energy being transmitted into the fuel tank, if the damaged wire can come into contact with the conductor of another wire that is not intrinsically safe. Of particular concern is the possibility of a wire bundle fire that exposes and breaks wires that are not intrinsically safe and also damages the insulation of intrinsically safe wiring that is in close physical proximity. The broken wires may still be energized and could contact conductors of the damaged intrinsically safe wire. If physical separation is used to protect intrinsically safe fuel system wiring from other wiring, or to protect fuel tank walls from high power wiring, the applicant must establish the minimum physical separation. The applicant should conduct an analysis to verify that current and energies greater than those specified in paragraphs 7.2 and 7.3 of this AC will not be applied to intrinsically safe wiring, considering the factors listed below. The following factors are based on the guidance contained in paragraphs 5d(3) and (4) of AC 25.1701-1:
8.3.3.1 The electrical characteristics, power, and criticality of the signals in the wire bundle and adjacent wire bundles;
8.3.3.2 Installation design features including the number, type, fire resistance, and location of support devices along the wire path of the intrinsically safe wire and adjacent higher power wires;
8.3.3.3 The maximum amount of slack wire resulting from wire bundle build tolerances and other wire bundle manufacturing variations;
8.3.3.4 Probable variations in the installation of the intrinsically safe fuel system wiring and adjacent wiring, including the position or omission of wire support devices and the amount of slack wire that is possible;
8.3.3.5 Expected operating environment including the amount of deflection or relative movement that can occur and the effect of a failure of a wire support device, or a broken wire, or other methods used to maintain physical separation;
8.3.3.6 The effects of wire bundle fires;
8.3.3.7 Maintenance practices, as defined by the airplane manufacturer’s standard wiring practices manual, and the ICA required by §§ 25.1529, 25.1729,
26.11(b), and 26.11(c), as applicable; and
8.3.3.8 Localized separation.
Note: Some areas of an airplane may have localized areas where maintaining a general physical separation distance is not feasible. This is especially true in smaller transport category airplanes or in areas where wiring spans the wing-to-body join of larger transport airplanes. In those areas that limit separation distance, additional means of ensuring physical separation and protection of the wiring may be necessary. Testing and/or analysis used to show that the reduced separation distance is acceptable should be conservative and consider the worst possible failure condition not shown to be extremely improbable. The applicant should substantiate that the means to achieve the reduced separation provides the necessary level of protection for wire-related failures and electromagnetic effects.
8.3.4 Inspection.
Means should be provided to allow for the visual inspection of the wiring, physical barriers, and other physical means of protection. Non-destructive inspection aids may be used where it is impracticable to provide for direct visual inspection, if it is shown that the inspection is effective and the inspection procedures are specified in the maintenance manual required by §§ 25.1529, 25.1729, 26.11(b), and 26.11(c).
8.3.5 Identification.
Means must also be provided so EWIS wires are readily identified and visible to maintenance, repair, or alteration personnel. The method of identification must remain legible throughout the airplane’s operational life. The complete regulatory requirements for EWIS identification are contained in § 25.1711, Component identification: EWIS.
8.3.6 Circuit Breakers.
Service experience has indicated that thermal mechanical circuit breakers installed in fuel pump circuits have not been shown, on some airplane designs, to preclude arcing of electrical wiring through metallic barriers into the fuel tank, barriers such as conduit, fuel pump housings, electrical connectors, or the tank wall. Evidence suggests that arcing from the wiring to metallic surfaces may not result in a hard short, which would trip the circuit breaker and may result in intermittent low level arcing that gradually arcs through the metallic barrier into the fuel tank. For these failure conditions, circuit protective devices such as an AFCB or GFI may be used to provide fail-safe features necessary to show compliance. Appendix A of this AC provides guidance for certification of an AFCB or GFI.
8.3.7 Use of Nonmetallic Conduit.
If nonmetallic conduit is used, its compatibility with fuel should be shown. The nonmetallic conduit should be evaluated for the effects of aging due to heat, corrosion at the connecting fittings, electrostatic charge buildup, and resistance to heat damage from internal shorts of wires routed within the conduit.
8.3.8 Wire Splices.
Splices in fuel system wiring have been allowed as a standard repair procedure. The acceptability of splices will be based upon the system design and fail-safe features. The safety assessment may show that splices in fuel tank system wiring, such as fuel quantity indicating wiring within the fuel tank and fuel pump windings, are prohibited.
This would be defined as a CDCCL.
8.3.9 Use of Silver in Fuel Tanks.
Silver can combine with sulfur or water and form silver-sulfide or oxide deposits between exposed conductors (terminal block connections, etc.). The silver-sulfide deposits reduce the resistance between conductors and can ignite fuel vapor when exposed to very low levels of electrical energy. If use of silver in electrical components and wiring in the tank is determined to be critical, it should be defined as a CDCCL.
The energy levels that have been shown to ignite fuel vapor during laboratory tests approach the levels normally used on FQIS wires and probes.8 This issue must be carefully addressed.
8 FAA Report No. DOT/FAA/AR-03/61, Silver-Sulfur Deposits on Fuel Quantity Indication System and Attendant Wiring.
8.3.10 Use of Steel Wool.
Steel wool has been used as a cleaning tool to remove corrosion and clean parts inside the fuel tanks. Steel wool creates small conductive filaments that can cause ignition sources in the fuel tank if the steel wool comes in contact between conductors in fuel tank quantity gauging system components. For this reason, design approval holders (DAHs) typically do not allow the use of steel wool inside fuel tanks and recommend using other abrasives. (However, as stated in paragraph 9.3.4.1 in this AC, the applicant should assume the presence of conductive debris, such as steel wool, when performing the fuel tank ignition prevention analysis.)
9 SAFETY ANALYSIS.
9.1 Ignition Source Failure Analysis.
Compliance with § 25.981 requires each applicant to develop a failure analysis for the fuel tank installation to substantiate that ignition sources will not be present in the fuel tanks. The requirements of § 25.981 are in addition to the more general propulsion failure analyses requirements of §§ 25.901 and 25.1309 that have been applied to propulsion installations.
9.1.1 Section 25.981(a)(3) defines three failure scenarios that must be addressed in order to show compliance with the rule:
9.1.1.1 Each single failure, regardless of the probability of occurrence of the failure, must not cause an ignition source.
9.1.1.2 Each single failure, regardless of the probability of occurrence, in combination with any latent failure condition not shown to be at least extremely remote (i.e., not shown to be extremely remote or extremely improbable), must not cause an ignition source.
9.1.1.3 All combinations of failures not shown to be extremely improbable must not cause an ignition source. That is, each combination of failures that can create an ignition source must be separately shown to be extremely improbable.
9.1.2 Compliance with § 25.981, at amendment 25-102, requires analysis of the airplane fuel tank system using analytical methods and documentation currently used by the aviation industry in showing compliance with §§ 25.901 and 25.1309 with consideration of unique requirements included in the amendment.
9.1.3 SAE ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, describes methods for completing an SSA.
An assessment may range from a simple report, which offers descriptive details associated with a failure condition, interprets test results, compares two similar systems, or offers other qualitative information, to a detailed failure analysis that may include
20 estimated numerical probabilities. The depth and scope of an acceptable SSA depend on the following:
9.1.3.1 The complexity and criticality of the functions performed by the system under consideration,
9.1.3.2 The severity of related failure conditions,
9.1.3.3 The uniqueness of the design and extent of relevant service experience,
9.1.3.4 The number and complexity of the identified causal failure scenarios, and
9.1.3.5 The detectability of contributing failures.
Note: Sections 25.981 and 25.901 are intended to address system failures or conditions that may result in the presence of an ignition source in the fuel tanks. These regulations are not intended to address failures or conditions that could lead to ignition of fuel vapors, which are addressed by other regulations, such as:
Uncontained engine debris, External engine fires following engine separation, Damage resulting from explosive materials such as bombs, Post-crash fire heating of tank surfaces, Propagation of fire through the airplane vent system into the fuel tanks, or A fire originating within the engine that burns through the engine case.
9.2 Qualitative Safety Assessment.
9.2.1 Typical airplane fuel tank systems have a limited number of possible ignition sources.
Figure 1 below shows some causes of ignition sources and methods that may be used to meet the fail-safe requirements. The level of analysis required to show that ignition sources will not develop will depend on the specific design features of the fuel tank system being evaluated. Detailed quantitative analysis should not be necessary if a qualitative safety assessment shows that features incorporated into the fuel tank system design protect against the development of ignition sources within the fuel tank system.
For example, if intrinsically safe FQIS wiring entering the fuel tanks and the associated line replacement unit (LRU) were shown to have protective features such as separation (including circuit separation in the LRU) and shielding and/or transient suppression/energy limiting devices, the portion of the compliance demonstration for the associated wiring would likely be limited to showing the effectiveness of the features and defining any long-term maintenance requirements, including mandatory replacement time, inspection interval, related inspection procedure, or CDCCL so that the protective features are not degraded.