13 improver would need to meet the requirements of §§ 25.1521, Powerplant limitations, and 25.1557, Miscellaneous markings and placards.
7.6.6 Applications of the above methods, and adherence to industry practices and guidelines on electrostatics, should be identified for each airplane model. Airline operation and practices regarding airplane refueling should also be evaluated to verify that the procedures necessary for safe operation of the specific airplane model are in place and followed. Restrictions, if any, on refuel rates, fuel properties, and the requirement for fuel additives should be identified as CDCCLs.
7.6.7 Polyurethane reticulated foams used for ignition suppression within fuel tanks and other non-conducting objects may accumulate and retain charge. These items may have to be treated with antistatic additives to prevent charge accumulation.
8 DESIGN CONSIDERATIONS.
The number of components and systems inside airplane fuel tanks whose failure could result in an ignition source within the fuel tank should be minimized. The following examples are FAA-accepted design practices for minimizing ignition sources:
8.1 Fiber Optics.
Wiring entering the tank for such purposes as temperature monitoring and fuel quantity indication should be minimized. Use of alternate technology, such as fiber optics, may provide a means of reducing or eliminating electrical powered components from inside the fuel tanks.
8.1.1 Fuel Pump Electrical Power Supply.
8.1.2 Fuel Pump Power Wiring.
If practical, fuel pumps should be located such that electrical power for the pumps is routed outside the fuel tanks in such a manner that failures in the electrical power supply cannot create a hot spot inside the tank or arc into the fuel tank. While the routing of fuel pump power supply outside of the fuel tank, and away from the fuel tank walls, may eliminate the potential for arcing directly into the fuel tank or heating of tank surfaces, the failure analysis should consider the need for electrical circuit protective devices. If the power supply cannot be routed outside the tank, additional design features should be considered as discussed in paragraph 8.3.2 below.
Note: The applicant should consider, in the design of the pump wiring system and when showing compliance, the electromagnetic effects and electrical transients that may damage the wiring or pump.
8.1.3 Fuel Pump Electrical Connectors.
8.1.3.1 Arcing at the pump electrical connector has resulted in uncontrolled fuel leakage, an ignition source, and an uncontrolled fire outside of the fuel tank. This can create a fuel tank ignition source due to the external fire
14 heating the fuel tank surfaces. Manufacturers have developed fuel pumps that include features to isolate the electrical connector from the portion of the fuel pump where fuel is located. Applicants should show that arcing that occurs in these designs cannot cause a cascading failure from arcing in the electrical connection resulting in a fuel leak and a fire. One approach includes incorporation of a dry area between the electrical connector and the fuel pump. Another approach includes extending the fuel pump power wire so the electrical connector is well away from the fuel pump. This approach has included a drip loop on the wire to prevent any fuel leaking onto the wire from being present at the electrical connector.
8.1.3.2 Alternatively, or in addition to isolating electrical connector from the fuel, limiting the electrical energy into the fuel tank can prevent an ignition source from occurring. The design of traditional fuel pumps has resulted in the need to install AFCB or GFI protection features to limit the energy release during an arcing event to prevent an ignition source from occurring.
8.2 Location of the Pump Inlet.
Debris that may enter a fuel pump inlet can cause sparks inside the fuel tank. One means to address this ignition source has been to locate the pumps such that the pump inlet remains covered with fuel any time the pump is operating within the airplane operating envelope. Another means has been to prevent the propagation of any ignition from the pump into the fuel tank by using flame arrestor technology. (The performance of the flame arrestor should be validated by test to verify its effectiveness at stopping a flame front.) Any protective means, including those shown in paragraphs 8.2.1 and
8.2.2 below, should be demonstrated to be effective under the pitch, roll attitudes, and negative G conditions anticipated to occur in service.
8.2.1 Main Feed Tanks.
Installation of baffles in tank structure, and use of collector tanks that are continually filled with fuel using ejector pumps, are methods that have proven successful at keeping the pump inlets and pump housings submerged in fuel.
8.2.2 Auxiliary Tanks.
For auxiliary tanks that use motor-driven fuel pumps and that are routinely emptied, accepted design practices include shutting off the motor driven pumps before uncovering the fuel pump inlet and installation of a flame arrestor in the scavenge pump inlet line, or scavenging the remaining fuel with ejector pumps. (Note that installation of features such as a flame arrestor in the fuel system would need to meet fuel system performance requirements in § 25.951, Fuel System: General.)
8.3 Wiring.
The following paragraphs on wiring represent acceptable approaches for dealing with wiring used in and near fuel tanks. For specific requirements and further guidance, the
15 applicant should review the wiring installation and design requirements in the Electrical Wiring Interconnect Systems (EWIS) rules, amendment 25-123, and associated ACs.
8.3.1 Intrinsically Safe Wiring.
All wiring that is intended to conduct intrinsically safe levels of electrical power into or through the fuel tanks should incorporate protective features that prevent exceeding the intrinsically safe levels discussed in paragraphs 7.2 and 7.3 of this AC. This wiring should also be protected from high intensity radiated fields (HIRF) induced transients.
The following protective features could be used to support that objective:
Separation and shielding of the fuel tank wires from other airplane wiring and circuits, Shielding for HIRF and other electromagnetic effects, and Installation of transient suppression devices to preclude unwanted electrical energy from entering the tank.
8.3.2 Higher Energy Wiring.
This includes all wiring that is not intrinsically safe.
8.3.2.1 Wiring should not be routed through metallic conduit inside the fuel tank or adjacent to fuel tank surfaces such that damage, inappropriate maintenance, or other failure/wear conditions could result in arcing to the conduit or metallic tank surface and consequent development of an ignition source in the fuel tank. If metallic or other conductive conduit materials are used, the single failure of electrical arcing of the wiring to the conduit, adjacent tank surfaces, or structure should be assumed to occur. In addition, circuit protective features or other features should be incorporated to preclude development of an ignition source in the fuel tank. Methods that may be used to address this foreseeable failure condition include the use of circuit protective features such as dual conduits, thick wall conduit, and/or fast-acting AFCB or GFI circuit breakers. Providing multiple layers of sleeving alone would not be considered acceptable since wear could defeat the multiple layer protection.
8.3.2.2 Where electric wires are routed through metallic conduits installed in a fuel tank, high surface temperatures or arcing through the conduit wall can be created by short circuits. All wiring conducting levels of power that exceed intrinsically safe levels (e.g., fuel pump power supply) into or through a fuel tank should be evaluated assuming arcing to adjacent surfaces, such as metallic conduits or wing surfaces, unless fail-safe protective features are provided. A critical electrical wiring condition might be one in which the insulation is worn, cracked, broken, or of low dielectric strength, allowing intermittent or constant arcing to occur without consuming enough power to cause the circuit protection device, such as a thermal mechanical circuit breaker, to open. Inspection of wiring
16 from in-service airplanes has shown that greater than expected wear may occur on sleeving and wiring insulation due to movement of the wire within the conduit. Roughness of the conduit material and variations in vibration levels for each installation may significantly increase wear. In addition, inspections have shown that protective sleeving has been missing or improperly installed, or the wrong sleeving material has been used, resulting in damage to the insulation. For these reasons, use of protective sleeving on wiring would not by itself be adequate for showing compliance. The design should be tolerant to these types of foreseeable failure or maintenance errors.
Note: AC 25-8 addresses the use of metallic conduit as an acceptable means for routing electrical power within auxiliary fuel tanks. As indicated above, these past practices would not meet the fail-safe requirements of § 25.981 for any fuel tank, unless additional fail-safe features were incorporated. Therefore, the more recent guidance in this AC, and rulemaking in amendment 25-102, supplements the guidance in AC 25-8.
8.3.3 Wire Separation.
Wiring designs used on transport category airplanes vary significantly between manufacturers and models; therefore, it is not possible to define a specific, universal, separation distance, or the characteristics of physical barriers between wire bundles, to protect critical wiring from damage. Separation requirements for wiring and other components of EWIS are contained in § 25.1707, System separation: EWIS. (The regulatory definition of EWIS is provided in § 25.1701, Definition.) AC 25.1701-1, Certification of Electrical Wiring Interconnection Systems on Transport Category Airplanes, paragraph 5d, contains guidance on determining adequate separation distance between EWIS and between EWIS and airplane systems and structures. Even if § 25.1707 is not in the type certification basis of the airplane being modified, the guidance contained in AC 25.1701-1 should still be applied, along with the guidance contained in this AC, when determining adequate separation distance. Intrinsically safe wiring for fuel tanks needs to be protected from induced currents caused by power system switching transients, or electromagnetic interference due to close proximity to other airplane wiring. In addition, damage to wire insulation can result in unwanted electrical energy being transmitted into the fuel tank, if the damaged wire can come into contact with the conductor of another wire that is not intrinsically safe. Of particular concern is the possibility of a wire bundle fire that exposes and breaks wires that are not intrinsically safe and also damages the insulation of intrinsically safe wiring that is in close physical proximity. The broken wires may still be energized and could contact conductors of the damaged intrinsically safe wire. If physical separation is used to protect intrinsically safe fuel system wiring from other wiring, or to protect fuel tank walls from high power wiring, the applicant must establish the minimum physical separation. The applicant should conduct an analysis to verify that current and energies greater than those specified in paragraphs 7.2 and 7.3 of this AC will not be applied to intrinsically safe wiring, considering the factors listed below. The following factors are based on the guidance contained in paragraphs 5d(3) and (4) of AC 25.1701-1:
8.3.3.1 The electrical characteristics, power, and criticality of the signals in the wire bundle and adjacent wire bundles;
8.3.3.2 Installation design features including the number, type, fire resistance, and location of support devices along the wire path of the intrinsically safe wire and adjacent higher power wires;
8.3.3.3 The maximum amount of slack wire resulting from wire bundle build tolerances and other wire bundle manufacturing variations;
8.3.3.4 Probable variations in the installation of the intrinsically safe fuel system wiring and adjacent wiring, including the position or omission of wire support devices and the amount of slack wire that is possible;
8.3.3.5 Expected operating environment including the amount of deflection or relative movement that can occur and the effect of a failure of a wire support device, or a broken wire, or other methods used to maintain physical separation;
8.3.3.6 The effects of wire bundle fires;
8.3.3.7 Maintenance practices, as defined by the airplane manufacturer’s standard wiring practices manual, and the ICA required by §§ 25.1529, 25.1729,
26.11(b), and 26.11(c), as applicable; and
8.3.3.8 Localized separation.
Note: Some areas of an airplane may have localized areas where maintaining a general physical separation distance is not feasible. This is especially true in smaller transport category airplanes or in areas where wiring spans the wing-to-body join of larger transport airplanes. In those areas that limit separation distance, additional means of ensuring physical separation and protection of the wiring may be necessary. Testing and/or analysis used to show that the reduced separation distance is acceptable should be conservative and consider the worst possible failure condition not shown to be extremely improbable. The applicant should substantiate that the means to achieve the reduced separation provides the necessary level of protection for wire-related failures and electromagnetic effects.
8.3.4 Inspection.
Means should be provided to allow for the visual inspection of the wiring, physical barriers, and other physical means of protection. Non-destructive inspection aids may be used where it is impracticable to provide for direct visual inspection, if it is shown that the inspection is effective and the inspection procedures are specified in the maintenance manual required by §§ 25.1529, 25.1729, 26.11(b), and 26.11(c).
8.3.5 Identification.
Means must also be provided so EWIS wires are readily identified and visible to maintenance, repair, or alteration personnel. The method of identification must remain legible throughout the airplane’s operational life. The complete regulatory requirements for EWIS identification are contained in § 25.1711, Component identification: EWIS.
8.3.6 Circuit Breakers.
Service experience has indicated that thermal mechanical circuit breakers installed in fuel pump circuits have not been shown, on some airplane designs, to preclude arcing of electrical wiring through metallic barriers into the fuel tank, barriers such as conduit, fuel pump housings, electrical connectors, or the tank wall. Evidence suggests that arcing from the wiring to metallic surfaces may not result in a hard short, which would trip the circuit breaker and may result in intermittent low level arcing that gradually arcs through the metallic barrier into the fuel tank. For these failure conditions, circuit protective devices such as an AFCB or GFI may be used to provide fail-safe features necessary to show compliance. Appendix A of this AC provides guidance for certification of an AFCB or GFI.
8.3.7 Use of Nonmetallic Conduit.
If nonmetallic conduit is used, its compatibility with fuel should be shown. The nonmetallic conduit should be evaluated for the effects of aging due to heat, corrosion at the connecting fittings, electrostatic charge buildup, and resistance to heat damage from internal shorts of wires routed within the conduit.
8.3.8 Wire Splices.
Splices in fuel system wiring have been allowed as a standard repair procedure. The acceptability of splices will be based upon the system design and fail-safe features. The safety assessment may show that splices in fuel tank system wiring, such as fuel quantity indicating wiring within the fuel tank and fuel pump windings, are prohibited.
This would be defined as a CDCCL.
8.3.9 Use of Silver in Fuel Tanks.
Silver can combine with sulfur or water and form silver-sulfide or oxide deposits between exposed conductors (terminal block connections, etc.). The silver-sulfide deposits reduce the resistance between conductors and can ignite fuel vapor when exposed to very low levels of electrical energy. If use of silver in electrical components and wiring in the tank is determined to be critical, it should be defined as a CDCCL.
The energy levels that have been shown to ignite fuel vapor during laboratory tests approach the levels normally used on FQIS wires and probes.8 This issue must be carefully addressed.
8 FAA Report No. DOT/FAA/AR-03/61, Silver-Sulfur Deposits on Fuel Quantity Indication System and Attendant Wiring.
8.3.10 Use of Steel Wool.
Steel wool has been used as a cleaning tool to remove corrosion and clean parts inside the fuel tanks. Steel wool creates small conductive filaments that can cause ignition sources in the fuel tank if the steel wool comes in contact between conductors in fuel tank quantity gauging system components. For this reason, design approval holders (DAHs) typically do not allow the use of steel wool inside fuel tanks and recommend using other abrasives. (However, as stated in paragraph 9.3.4.1 in this AC, the applicant should assume the presence of conductive debris, such as steel wool, when performing the fuel tank ignition prevention analysis.)
9 SAFETY ANALYSIS.
9.1 Ignition Source Failure Analysis.
Compliance with § 25.981 requires each applicant to develop a failure analysis for the fuel tank installation to substantiate that ignition sources will not be present in the fuel tanks. The requirements of § 25.981 are in addition to the more general propulsion failure analyses requirements of §§ 25.901 and 25.1309 that have been applied to propulsion installations.
9.1.1 Section 25.981(a)(3) defines three failure scenarios that must be addressed in order to show compliance with the rule:
9.1.1.1 Each single failure, regardless of the probability of occurrence of the failure, must not cause an ignition source.
9.1.1.2 Each single failure, regardless of the probability of occurrence, in combination with any latent failure condition not shown to be at least extremely remote (i.e., not shown to be extremely remote or extremely improbable), must not cause an ignition source.
9.1.1.3 All combinations of failures not shown to be extremely improbable must not cause an ignition source. That is, each combination of failures that can create an ignition source must be separately shown to be extremely improbable.
9.1.2 Compliance with § 25.981, at amendment 25-102, requires analysis of the airplane fuel tank system using analytical methods and documentation currently used by the aviation industry in showing compliance with §§ 25.901 and 25.1309 with consideration of unique requirements included in the amendment.
9.1.3 SAE ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, describes methods for completing an SSA.
An assessment may range from a simple report, which offers descriptive details associated with a failure condition, interprets test results, compares two similar systems, or offers other qualitative information, to a detailed failure analysis that may include
20 estimated numerical probabilities. The depth and scope of an acceptable SSA depend on the following:
9.1.3.1 The complexity and criticality of the functions performed by the system under consideration,
9.1.3.2 The severity of related failure conditions,
9.1.3.3 The uniqueness of the design and extent of relevant service experience,
9.1.3.4 The number and complexity of the identified causal failure scenarios, and
9.1.3.5 The detectability of contributing failures.
Note: Sections 25.981 and 25.901 are intended to address system failures or conditions that may result in the presence of an ignition source in the fuel tanks. These regulations are not intended to address failures or conditions that could lead to ignition of fuel vapors, which are addressed by other regulations, such as:
Uncontained engine debris, External engine fires following engine separation, Damage resulting from explosive materials such as bombs, Post-crash fire heating of tank surfaces, Propagation of fire through the airplane vent system into the fuel tanks, or A fire originating within the engine that burns through the engine case.
9.2 Qualitative Safety Assessment.
9.2.1 Typical airplane fuel tank systems have a limited number of possible ignition sources.
Figure 1 below shows some causes of ignition sources and methods that may be used to meet the fail-safe requirements. The level of analysis required to show that ignition sources will not develop will depend on the specific design features of the fuel tank system being evaluated. Detailed quantitative analysis should not be necessary if a qualitative safety assessment shows that features incorporated into the fuel tank system design protect against the development of ignition sources within the fuel tank system.
For example, if intrinsically safe FQIS wiring entering the fuel tanks and the associated line replacement unit (LRU) were shown to have protective features such as separation (including circuit separation in the LRU) and shielding and/or transient suppression/energy limiting devices, the portion of the compliance demonstration for the associated wiring would likely be limited to showing the effectiveness of the features and defining any long-term maintenance requirements, including mandatory replacement time, inspection interval, related inspection procedure, or CDCCL so that the protective features are not degraded.
21 Figure 1. Examples of Fuel Tank Ignition Source Considerations
9.2.2 Another example would be installation of a flame arrestor in the inlet line to a fuel pump. The compliance demonstration for the fuel pump may be limited to showing that the arrestor was effective at precluding propagation of the flame from the pump back down the inlet line into the tank, and showing that any anticipated failures or events could not violate the explosion-proof features of the pump assembly. A CDCCL may be necessary to maintain the flame arrestor design feature. If the flame arrestor cannot be shown to be effective for the life of the installation, an airworthiness limitation limiting the life of the flame arrestor would be necessary. In addition, revalidation of the fuel system with other regulations (e.g., icing and reduced flow due to contamination) would be required if modifications were incorporated into the fuel feed system. The SSA criteria, process, analysis methods, validation, and documentation should be consistent with the guidance material provided in SAE ARP4761, using the unique guidance specific to the fuel tank system as defined in this AC.
9.3 Assumptions and Considerations for Fuel Tank System Analysis.
The applicant should conduct the fuel tank system analysis based on the following assumptions:
9.3.1 Fuel Tank Flammability.
The analysis should assume that the environment inside the fuel tank is always flammable. The conditions required to ignite fuel vapors from ignition sources vary with pressures and temperatures within the fuel tank and can be affected by sloshing or
22 spraying of fuel in the tank. Due to the difficulty in predicting fuel tank flammability, the FAA has always assumed that a flammable fuel/air mixture exists in airplane fuel tanks and has required that no ignition sources be present. The SSA should be prepared considering all in-flight, ground, service, and maintenance conditions for the airplane, assuming that an explosive fuel/air mixture is present in the vapor space of fuel tanks and vent systems at all times9, unless the fuel tank has features that mitigate the effects of tank ignition (e.g., polyurethane foam).
9.3.2 Failure Condition Classification.
Unless design features are incorporated that mitigate the hazards resulting from a fuel tank ignition event (e.g., polyurethane foam, adequate structural margin), the SSA should assume that the presence of an ignition source is a catastrophic failure condition.
9.3.3 Latent Failures.
9.3.3.1 In order to eliminate any ambiguity as to the restrictions on latent failures, § 25.981(a)(3) explicitly requires that any anticipated latent failure condition not leave the airplane one failure away from a catastrophic fuel tank ignition. In addition to this limitation on latency, § 25.1309(c) limits latent failure conditions to those that do not create an “unsafe system operating condition.” Consequently, if a latent failure condition is not extremely remote (i.e., it is anticipated to occur) and it creates an “unsafe system operating condition,” then “warning information must be provided to alert the crew…and to enable them to take appropriate corrective action.” Notwithstanding these applicable regulatory restrictions on latency, there are practical limitations on the available means of compliance. For example, detecting a failure condition requires a finite period of time, and there are not always “appropriate corrective actions” that can be taken during the flight. Consequently, for the purpose of complying with § 25.981(a)(3), the period of latency for any anticipated significant latent failure condition should be minimized and not allowed to exceed one flight cycle. For the purpose of complying with § 25.1309(c), any time the airplane is operating one failure away from a catastrophic fuel tank ignition should be considered an “unsafe system operating condition,” recognizing that sometimes the only “appropriate corrective action when problem detection is available is to continue on to your destination but not to initiate another flight without making appropriate repairs.”
9.3.3.2 Another practical limitation on the available means of compliance is the technological feasibility of providing inherent failure detection within the design for all significant failures. Sometimes periodic inspection is the
9 The preamble to amendment 25-102 states “The FAA intends that those failure conditions identified earlier in this document, and any other foreseeable failures, should be assumed when performing the safety review needed to substantiate that the fuel tank system design is fail-safe. The safety review should be prepared considering all airplane inflight, ground, service, and maintenance conditions, assuming that an explosive fuel air mixture is present in the fuel tanks at all times, unless the fuel tank has been purged of fuel vapor for maintenance .” (66 FR 23094)
23 only practicable means of reliably detecting a failure condition.
Consequently, when such inspections are identified within the analysis as the means of detection, the inspection method and frequency must be sufficient to conclude that the occurrence of the significant latent failure condition is extremely remote.
9.3.3.3 Any mandatory replacement time, inspection interval, related inspection procedure, and all CDCCLs identified as required to prevent development of ignition sources within the fuel tank system for § 25.981(a) must be identified in the Airworthiness Limitations section of the ICA as a fuel system Airworthiness Limitation. The Airworthiness Limitations section should include the following:
9.3.3.3.1 A designation of the maintenance actions and alterations that must be inspected (critical inspections), including at least those that could result in a failure, malfunction, or defect endangering the safe operation of the aircraft, if not performed properly or if improper parts or materials are used.
Note: A validation inspection should be conducted to reaffirm all or a portion of the initial inspection requirements for those critical inspections that, if not performed properly or if improper parts or material are used, could result in a failure, malfunction, or defect endangering the safe operation of the airplane. For those air carriers that use a mechanic for the initial inspection, an inspector should be used to conduct the validation inspection. For those air carriers that use an inspector for the initial inspection, another qualified inspector should be used to conduct the validation inspection.
9.3.3.3.2 Procedures, standards, and limits necessary for critical inspections and acceptance or rejection of the items required to be inspected, and for periodic inspection and calibration of precision tools, measuring devices, and test equipment.
9.3.4 Failure Conditions.
When showing compliance with § 25.981(a)(3), the analysis must consider the effects of manufacturing variability, aging, wear, corrosion, and likely damage. For the purpose of compliance with § 25.981, “extremely remote” failure conditions are those not anticipated to occur to each airplane during its total life, but which may occur a few times when considering the total operational life of all airplanes of one type. This definition is consistent with that developed by the Aviation Rulemaking Advisory Committee (ARAC) for a revision to AC 25.1309-1A, System Design and Analysis.
“Extremely improbable” failure conditions are those so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. This definition is consistent with the definition provided in AC 25.1309-1A. Likely damage is damage that, using engineering judgment or past experience, would lead one to conclude that an occurrence is foreseeable. Examples of likely damage are a wire
24 bundle located where a mechanic could use it as a handhold; an instrument located where, if someone dropped a wrench, damage would result; or a fuel probe located where a mechanic could use it as a step in the tank; etc.
9.3.4.1 The analysis should be conducted considering the deficiencies and anomalies listed in paragraph 6.3 of this AC, failure modes identified by the review of service information (including review of supplier service data), and any other failure modes identified by the functional hazard assessment of the fuel tank system. For example, the applicant should assume the presence of conductive debris such as lockwire, steel wool, nuts, bolts, rivets, etc. Section 25.981 requires that the effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered when showing compliance, which is needed to show compliance with § 25.901(c).10 Credit for fail-safe features must be substantiated.
9.3.4.2 The level of manufacturing variability, aging, wear, corrosion, and likely damage that must be considered should be determined based upon evaluation of the detectability of degraded or out-of-specification configurations, and established and documented within the analysis.
In-service and production functional tests, component acceptance tests, and maintenance checks may be used to substantiate the degree to which these states must be considered. For example, inspection of fuel tank system bonding on production airplanes has shown that some bonds were inadequate. Functional testing of all bonding was incorporated to address this deficiency. In some cases (e.g., component bonding or ground paths), a degraded state will not be detectable without periodic functional test of the feature. For these features, inspection/test intervals should be established based on previous service experience of equipment installed in the same environment. If previous experience on similar or identical components is not available, conservative initial inspection/test intervals should be established until design maturity can be assured.
9.3.5 External Environment.
The severity of the external environmental conditions that should be considered when showing compliance with § 25.981 are those established by certification regulations.
9.3.6 External Sources of Tank Autoignition.
The possibility of fuel tank ignition due to surface-ignition sources created by external tank heating should be considered. This includes heating of the tank due to operation or failure of systems outside the tank within both the pressurized and unpressurized areas of the airplane, such as overloaded electric motors or transformers, failures in the
10 See Docket No. FAA-1999-6411 (66 FR 23097, May 7, 2001), Transport Airplane Fuel Tank System Design Review, Flammability Reduction, and Maintenance and Inspection Requirements , amendment 25-102, https://www.gpo.gov/fdsys/pkg/FR-2001-05-07/pdf/01-10129.pdf.