33 adjacent systems or components that could cause elevated surface temperatures. The maximum internal tank temperatures that can occur during normal and failure conditions should be determined. Systems, such as over-temperature protective devices, should be evaluated to determine if periodic health checks are necessary to ensure that latent failures do not exist.
10.3 Possible Failure Modes for Determination of Maximum Component Temperatures.
The following list identifies some possible failure modes, but not all conditions, that should be explored in determining the maximum temperature expected for fuel tank components:
10.3.1 Fuel Pumps.
10.3.1.1 Normal fuel pump operation considering the highest hot day ambient and fuel tank temperatures: In many cases, fuel pump motors are protected by a (single) three-phase thermal circuit breaker. In several instances, resetting of circuit breakers has resulted in arcing inside the fuel tank and the development of an ignition source from an existing failure. Therefore, the fuel pump circuit should also preclude development of an ignition source if the breaker is reset or forced in by a mechanic. Methods that may be used to address this foreseeable failure condition include the use of circuit protective features such as non-resettable, fast-acting AFCB or GFI circuit breakers.
10.3.1.2 Two-phase operation of three-phase electrical fuel pumps: Failure of a single phase of a multiple-phase fuel pump will significantly increase the load on the remaining phases of the pump and generation of heat in the pump. In many cases, thermal protection features within the pump have been incorporated to address this failure condition, but these means have not been effective at preventing continued operation of a pump with a failed electrical phase. Another failure condition that should be considered is subsequent failure of a second phase of the pump and possible arcing or heat damage. In general, pumps should not be allowed to operate following failure of a single electrical phase of the pump if such operation could result in development of an ignition source. Automatic protective means, such as AFCB or GFI or other means, should be provided to shut down the pump when a single electrical phase failure occurs. Periodic inspections or maintenance of these features may be required.
10.3.1.3 Dry operation of fuel pumps, including lack of lubrication: Service history has shown that flightcrews and maintenance personnel have inadvertently operated fuel pumps for long periods of time without fuel in the fuel tank.
Fuel pumps are typically qualified for dry run operation for periods of time based upon assumptions made about possible duration of inadvertent operation, or failure conditions, which could result in dry running of the pump. For example, some pumps were operated during qualification
34 testing up to a maximum of 8 hours continuously, with total accumulated dry run operation of 24 hours. These qualification tests were accomplished in order to show that fuel pump performance was still adequate following the dry pump operation. The tests were not shown in an explosive environment and, hence, were not intended to qualify the pumps for such operation. In other cases, previous approvals were predicated on the assumption that the fuel pump would not be dry run operated because the pump would be turned off by the flight/ground crew following a pump low-pressure indication. Extended dry operation of pumps may result in surface temperatures above the autoignition temperature of the fuel, or may expose the pump to dry run operation where debris from the fuel tank could enter the impeller and cause sparks. Manufacturers’ recommended procedures have not been shown to be adequate in preventing dry run operation. Therefore, additional fail-safe features are necessary to preclude ignition sources caused by dry run operation of airplane fuel pumps. One or more of the following fail-safe means should be considered for protection of fuel pumps:
1. Incorporate design features to keep the fuel pump inlet submerged in jet fuel to prevent dry running of the pump under all operating conditions.
2. Incorporate automatic pump shutoff features into the fuel pump or airplane to preclude dry run operation.
3. Other means such as installation of flame arrestors in the fuel pump inlet to preclude flame propagation into the fuel tank.
10.3.1.4 Temperatures associated with the fuel pump following wet operation with wet mechanical components both at zero and reduced fluid flow.
10.3.1.5 Temperatures associated with moving mechanisms that are locked or seized.
10.3.1.6 Temperatures generated as a consequence of pump impeller slippage.
10.3.1.7 High temperatures or high current due to a broken shaft. The design has to contain the broken shaft, and the pump and its control system must consider the high currents and temperatures that would follow.
10.3.1.8 Failed bearings: The effects of wear on fuel pump features incorporated into the design to maintain explosion-proof characteristics should be evaluated. For example, wear of bearings or failures, including spinning of any bushings, and possible effects on quenching orifices should be evaluated. In many cases, fuel pump explosion-proof features are not redundant, and failure or degradation of the features is latent. If single or probable combinations of failures in the fuel pump can cause an ignition source, § 25.981 requires incorporation of fail-safe features noted previously. If wear of the pump can cause degradation of fail-safe
35 features, appropriate inspection, overhaul, or life limiting of the pump should be included in the Airworthiness Limitations section of the ICA, per § 25.981(d) and section H25.4.
10.3.2 FQIS.
10.3.2.1 FQIS wiring in the tank, with maximum voltage and current applied, considering normal and failure conditions, including the effects of high-voltage systems outside the tank in proximity to the FQIS wires.
10.3.2.2 FQIS component in the normal and failed state with the above associated maximum voltages and fault currents applied.
10.3.3 Float Switch System.
Float switch system temperatures should be determined considering the maximum environment temperatures and the application of the applicable maximum voltage and fault currents.
10.3.4 Fuel System Components.
Temperatures of the fuel system components should also be evaluated considering the failure of bonding straps.
10.3.5 Pneumatic System.
Pneumatic system temperatures need to be evaluated for the effects of duct rupture impinging on the external tank surface. Radiant and conducted heat transfer associated with the tank and components affecting tank wall temperatures should also be considered (see previous discussion of spaces adjacent to fuel tanks).
10.3.6 Electrical Defects and Arcing.
Electrical defects that generate excessive heat, and arcing at the electrical connections to the pump housing or within the connector.
10.3.7 Submerged Heat Exchangers.
Submerged heat exchangers and supply tubing operating under conditions of maximum heat rejection to the fuel. This should include failures in any systems outside the fuel tank that could result in heat exchanger or supply tubing surface temperatures exceeding 400 °F.
10.3.8 Failed or Aged Seals.
10.3.8.1 Spraying of fuel in the tank from any pressurized fuel source may cause electrostatic charging of components in the fuel tank. In addition, use of sealant in connectors that is not compatible with the fuel may allow leakage into the connector and the possibility of a fire near the connector.
10.3.8.2 Fuel Line Couplings.
Aging of seals may result in hardening of the seal material and leakage and spraying of fuel within the fuel tank; therefore, fuel line coupling designs should be evaluated and a design life should be established for all seals that are shown to age and allow leakage that can cause unacceptable electrostatic charging of components.
10.3.9 Fuel Pump Cooling Flow.
Fuel used for cooling of fuel pumps may be sprayed from the fuel pump. Fuel pump cooling flow should not be sprayed into the fuel tank vapor space for the same reason as stated in 10.3.8 for spraying of fuel. Means should be provided to distribute the discharged cooling fuel into the fuel tank at or near the bottom of the fuel tank.
10.3.10 Explosion-Proof Electrical Connector Sealant and Seals.
Electrical connections to fuel pumps are typically located either inside or outside the fuel tank in areas of the airplane where the presence of flammable fuel vapors should be assumed because no secondary sealing of fuel is provided. Fuel leakage and corrosion at electrical connectors located outside the fuel tank has allowed the presence of both flammable vapors and electrical arcing at connectors, resulting in fires. In other applications, arcing has occurred at the pump connections inside the fuel tanks, requiring installation of appropriately sized steel shields to prevent arcing through the connector or pump housing into the fuel tank or areas where flammable vapor could exist.
10.3.11 Arcing at the Pump Electrical Connections.
Wear, corrosion, manufacturing variability (e.g. tolerances), connector distortion and seal damage from ice, and bent pins in the connector are examples of failures that have caused high resistance or shorting and arcing in arcing electrical connectors. Based upon historical data showing these and other failure modes listed previously in this AC have occurred in fuel pump connectors, arcing in the connectors is a foreseeable failure.
Each of these single or cascading failure modes should be included in the FMEA. High current loads present during pump start up and operation exacerbate arcing in the connector. The size and duration of the arcing event should be established based upon the fuel pump electrical circuit protection features. Arcing at the pump electrical connections, and resultant damage to the pump connector, housing, and explosion-proof features due to intermittent, and maximum energy, arcing events should be assumed. If fuel is present on the backside of the connector, failures resulting in fuel leakage in conjunction with arcing in the connector should be assumed if the fuel leak is a latent failure or is the result of a cascading failure. The design of traditional fuel pumps has resulted in the need to install AFCB or GFI protection features to address foreseeable failures and limit the energy release during an arcing event to prevent an ignition source from occurring. The pump connector should be shown to contain any resultant arcing or fire and to maintain all surface temperatures below the autoignition temperature of the fuel. Component manufacturer maintenance records and qualification test results should be reviewed as part of the safety analysis process to establish that any sealants and
37 materials in the connector are compatible with the operating environment and to determine if a design life or periodic inspections for the pump connector are needed.
11 AIRWORTHINESS LIMITATIONS FOR THE FUEL TANK SYSTEM.
11.1 Based upon the evaluations required by § 25.981(a), amendment 25-102 also added a requirement to § 25.981(b), that CDCCLs, inspections, or other procedures be established as necessary to prevent development of ignition sources within the fuel tank system, and that they be included in the Airworthiness Limitations section of the ICA required by § 25.1529. This requirement is similar to that contained in § 25.571 for airplane structure. Amendment 25-102 also added a new requirement to part 25, appendix H, Instructions for Continued Airworthiness, requiring that each mandatory replacement time, inspection interval, related inspection procedure, and all CDCCLs approved under § 25.981 for the fuel tank system be included in the section titled “Airworthiness Limitations” of the ICA.
11.2 The preamble of amendment 25-102 (66 FR 23097) states:
Critical design configuration control limitations include any information necessary to maintain those design features that have been defined in the original type design as needed to preclude development of ignition sources.
This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the original fuel tank system type design. An example of a critical design configuration control limitation for current designs discussed previously would be maintaining wire separation between FQIS wiring and other high power electrical circuits. The original design approval holder must define a method to ensure that this essential information will be evident to those that may perform and approve repairs and alterations. Visual means to alert the maintenance crew must be placed in areas of the airplane where inappropriate actions may degrade the integrity of the design configuration. In addition, this information should be communicated by statements in appropriate manuals, such as Wiring Diagram Manuals.
11.2.1 CDCCLs may include any maintenance procedure that could result in a failure, malfunction, or defect endangering the safe operation of the airplane, if not performed properly or if improper parts or materials are used. This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the original type design of the fuel tank system.
11.2.2 CDCCLs are intended to identify only critical features of a design that must be maintained. CDCCLs have no intervals; they establish configuration limitations to maintain and to protect the “critical design feature” identified in the CDCCLs. CDCCLs can also include requirements to have placards on the airplane with information about critical features. For example, certain components of a fuel pump (or all components) may include critical features that are identified as CDCCLs. These critical features must be identified in the Airworthiness Limitations section of the ICA and should also be
38 identified in the component maintenance manual (CMM) as CDCCLs to provide awareness to maintenance and repair facilities.
11.2.3 Certain CDCCLs apply to elements of fuel system components. As such, maintenance of those critical features may be covered in a CMM. When airworthiness limitations need to call out aspects of CMMs, it is a best practice to limit the CDCCL-controlled content to only those maintenance tasks directly impacting a CDCCL feature, rather than requiring the complete CMM to be a CDCCL. (See the CMM deviation definition in appendix C of this AC.)
11.2.4 Any component that is the subject of a CDCCL is considered a critical part. Therefore, new parts manufacturer approvals issued for fuel tank system components that are the subject of CDCCLs should be treated as “critical parts” in accordance with FAA Order 8110.42D, Parts Manufacturer Approval Procedures.
11.3 Any fuel tank system components that are determined to require periodic maintenance, inspection, or overhaul to maintain the integrity of the system or maintain protective features incorporated to preclude a catastrophic fuel tank ignition event must be defined and included in the Airworthiness Limitations section of the ICA. An inspection airworthiness limitation has a specific task and interval (such as 10 years). The inspection interval should be established based on the standard practices defined in AC 25.1309-1A for evaluation of component failures. The inspection could also be required following maintenance to verify a CDCCL feature is maintained. Examples of inspection airworthiness limitations include the following:
11.3.1 Aging Fuel Line Couplings Seals/O-Rings.
In certain instances, materials used in fuel line couplings may lose flexibility and harden with age. Under pressurized operation, the seal may allow fuel leakage. This will allow spraying of fuel in the tanks or other areas of the airplane where spraying fuel could create a fire hazard. Repetitive inspections, functional checks, or mandatory replacement intervals may be required to prevent leakage.
Note: While not related to compliance with § 25.981, hazards associated with the aging of fuel coupling O-rings, resulting in air entering fuel lines during suction feed operation, should also be addressed when developing the fuel system maintenance program.
11.3.2 Wear of Pump Bushings, Bearings, and Seals.
Wearing of pump bushings, bearings, and seals may significantly affect the performance of fuel pumps and degrade the features necessary to maintain the explosive-proof qualification. In most cases, these failure conditions are latent;
therefore, incorporation of other fail-safe features, as discussed earlier in this AC, would likely be required. If fail-safe features, such as installation of feeder tanks that are filled using ejector pumps, are incorporated, functioning of those features would need to be ensured by indications or periodic functional tests. Installation of fuel level sensors in the feeder tanks would provide continuous monitoring of the function.
Another means could be installation of flow indicators in the flow line of the ejector
39 pump that can be viewed by maintenance personnel, and a mandatory periodic inspection of this function is one example of a method of mandatory maintenance action.
11.3.3 Fuel Pump Electrical Power Protective Features.
If failure of an AFCB or GFI protective feature and/or a thermal fuse (closed) is latent and this feature is needed to maintain fail-safe features, periodic checks would likely be needed. The inspection interval, and need for built-in test features with indication of failures, should be established through the safety analysis process and should consider factors described in paragraph A.3.4.3 of appendix A.
11.3.4 Transient Suppression/Energy Limiting Devices.
If failure of the device is latent and this feature is needed to maintain fail-safe features, periodic checks will likely be needed.
11.3.5 Wire Shield Grounding.
Component grounds and wires will likely require inspections and measurements to determine proper grounding.
11.3.6 Fuel Tank Access Panel/Door Seals.
Maintenance tasks should adequately provide procedures for inspection and checks of access panels and door seals.
11.3.7 Corrosion, Wear, and Damage to Fuel Pump Connectors.
Maintenance tasks should provide adequate procedures for inspecting and checking fuel pump connectors for wear, corrosion, and damage.
11.3.8 Integrity of Fuel Pump Electrical Supply Conduit.
Maintenance tasks should provide adequate procedures for inspecting the integrity of the structure, sealing, drain holes, and bends of the electrical supply conduit to the fuel pump.
11.4 Maintainability of Design and Procedures.
Maintainability, both in the design and procedures (i.e., master minimum equipment list, airplane maintenance manual, etc.), should be verified by the applicant. This should include, as a minimum, verification that the system and procedures support the safety analysis assumptions and are tolerant to anticipated human errors, and that any critical procedures are highlighted for consideration as required inspection items. (See 14 CFR
121.369(b) for considerations of a “required inspection item.”)
11.5 Incorporation by Reference into Airworthiness Limitations.
11.5.1 Where the words “in accordance with” or “per” are cited in the airworthiness limitations, the procedures in the referenced document must be followed to ensure that the critical design feature is maintained. Any changes to these procedures require
40 approval from the responsible Aircraft Certification Service office before they can be used.
11.5.2 Where the words “refer to” are cited in the airworthiness limitation, the procedures in the referenced document represent one method of complying with the airworthiness limitation. An accepted alternative procedure may be developed by the operator in accordance with its procedures in its maintenance program/manual. Prior approval from the responsible Aircraft Certification Service office is not required for this action.
11.5.3 See AC 120-97A, Incorporation of Fuel Tank System Instructions for Continued Airworthiness into Operator Maintenance or Inspection Programs, for guidance regarding procedures operators should use when requesting approval of changes to documents referenced in airworthiness limitations and for examples of fuel tank system airworthiness limitations.
11.6 Visible Identification of CDCCLs.
11.6.1 Section 25.981(d) establishes a requirement for visibly identifying critical features of a design that are located in certain areas. The DAH should define a method of ensuring that this essential information will be communicated with statements in the appropriate manuals, such as wiring diagram manuals, and be evident to those who perform and approve such repairs and alterations and are identified as a CDCCL.
11.6.2 An example of a CDCCL that would result in a requirement for visible means would be maintaining wire separation between FQIS wiring and other high-power electrical circuits where separation of the wiring was determined to be a CDCCL. Acceptable methods of providing visible means would include color coding and labeling the wiring.
For retrofit of markings onto existing wiring, placement of identification tabs at specific intervals along the wiring would be acceptable. Standardization within the industry for color coding of wiring used for the fuel tank system would assist maintenance personnel in functional identification of wiring. Some manufacturers use pink wiring for fuel tank system wiring, and FAA recommends using this color as a standard for fuel tank system wiring.
Appendix A A-1 Appendix A. Certification of Arc Fault Circuit Breaker (AFCB) or Ground Fault Interrupter (GFI) A.1 PURPOSE.
This appendix provides guidance for certification of AFCB or GFI devices that have been shown to be a practical means to protect the circuits of electric-motor fuel pumps and other fuel tank components that use higher than intrinsically safe electrical power (for example, motor operated valves).
A.2 BACKGROUND.
A.2.1 Service experience has shown that failures in the power supply circuit of the fuel pump, discussed in the body of this AC, can result in ignition sources and, therefore, must be assumed as a foreseeable failure condition. Traditional thermal circuit breakers are sized to prevent nuisance trips during fuel pump transient power demands and have not tripped when intermittent electrical arcs occur. Intermittent arcing can erode metallic barriers such as conduit, electrical connectors, and the pump housing, resulting in loss of the integrity of explosion-proof features, or create ignition sources outside in areas adjacent to the fuel tank. Addressing the failure modes discussed in this AC has resulted in the need to provide fast-acting GFI or AFCBs in traditional fuel pump electrical circuits in order to show compliance with § 25.981.
A.2.2 AFCBs have been used as a practical means to protect against arcing in the power circuits of fuel pump motors powered by both alternating current and direct current.
SAE International issued two aerospace standards for AFCBs—one for alternating current circuits and one for direct current circuits. (See paragraph B.7 of appendix B of this AC).
A.2.3 Fuel pump housings and metallic conduits are grounded to the airframe, and any arcing to the cavity wall or conduit creates a ground fault. Therefore, GFI have been used in AC pump power circuits as a practical means to ensure that power is quickly disconnected from the fuel pump in the event of a ground fault in the pump or associated power wiring.
A.3 CERTIFICATION GUIDANCE.
One means for the applicant to show compliance with the applicable regulations is to demonstrate, through design, review, analysis, and test, that the AFCB or GFI performs as intended under any foreseeable operating conditions and addresses the following guidance:
A.3.1 Fault Detection Trip Levels.
A.3.1.1 The applicant should show that the AFCB or GFI can distinguish between actual fault events and events characteristic of the normal airplane pump start up operating loads
Appendix A A-2 and environmental conditions. Laboratory testing and/or airplane ground/flight testing should be performed to show the “intended function” of AFCB or GFI. The test methods chosen should reproduce the most common types of arcing in fuel pumps that occur in an airplane environment due to ground or arc faults. The AFCB or GFI should be designed to prevent nuisance tripping due to normal airplane electrical loads and electrical bus switching; and to operate continuously with normal and abnormal airplane electrical bus switching characteristics associated with master minimum equipment list dispatch relief configurations.
A.3.1.2 Installation of the AFCB or GFI should not result in an appreciable increase in the loss of fuel pump function. A reliability requirement on the order of 100,000 hours mean time between failures may be satisfactory, but the applicant should show that failure of the AFCB or GFI does not result in an appreciable increase in the occurrence of failures that result in the loss of fuel pump function.
A.3.1.3 Sufficient laboratory testing and airplane testing should be conducted to show AFCB or GFI nuisance trip performance, including tests for lightning, HIRF, and electromagnetic compatibility. In addition, sufficient laboratory testing should be conducted to show that the AFCB or GFI trips before arcing in the fuel pump can lead to ignition of fuel vapor in the fuel tank.
A.3.1.4 A means should be provided to latch the AFCB or GFI in a state that removes power from the fuel pump motor in the event that a ground fault has been detected, until the AFCB or GFI is reset. A trip of a single AFCB or GFI should not be reset until the reason for the trip has been determined and repaired, or until it has been determined that no ground fault exists. Intermittent arcing can cause tripping of circuit protection devices resulting from failures that are difficult to isolate during maintenance actions.
Single trip events may be attributed to a nuisance fault. However, maintenance instructions should include notes that state repeated tripping of devices indicates an intermittent fault exists, and the circuit should not be energized until the fault is isolated and repaired.
A.3.2 Software.
Inadvertent operation of multiple AFCB or GFI devices has the potential to affect the continued operation of more than one engine, a condition that the FAA considers to be hazardous. Software used by the AFCB or GFI devices should be developed and verified in accordance with the latest version of RTCA DO-178.
A.3.3 Complex Hardware.
Application-specific integrated and complex circuits used by the AFCB or GFI devices should be developed and tested in accordance with RTCA DO-254 and FAA Order 8110.105A, Simple and Complex Electronic Hardware Approval Guidance, dated April 5, 2017.
Appendix A A-3 A.3.4 System Safety Assessment.
A.3.4.1 AFCB or GFI devices installed in circuits that perform essential or critical functions and/or their performance could impact the safety of flight. The applicant should perform an installation SSA in accordance with §§ 25.901(c), 25.981(a) and (d), and 25.1309.
The SSA should include a functional hazard assessment to determine the effects of failures of the AFCB or GFI devices on the safety of the airplane and to verify that the design limits the probability of undesirable failure conditions to acceptable levels. In addition, the applicant should address the potential for possible common cause trips due to hardware/software errors and common cause trips due to environmental conditions such as HIRF (§ 25.1317), lightning (§§ 25.954 and 25.1316), and electromagnetic compatibility (§§ 25.1301, 25.1309(e), and 25.1353(a)).
A.3.4.2 Failure to provide fuel pump power due to unintended activation of multiple AFCB or GFI devices has the potential to affect the continued operation of more than one engine.
A circuit protective device failure, cascading failure, or common cause failure that affects multiple engines would be non-compliant with § 25.903(b) if it prevents continued operation of the remaining engines, or requires immediate crew action to prevent a multiple engine power loss.
A.3.4.3 Failure of an AFCB or GFI device to detect an arc or ground fault condition in a fuel pump circuit can contribute to a catastrophic failure condition. Assuming the loss of explosion-proof features of the pump (examples discussed in paragraph A.2.1) or arcing at the electrical connector could result from a single failure, the FAA considers the undetected failure of an AFCB or GFI alone, which prevents its detection of or response to an arc or ground fault, to be a severe-major (hazardous) failure condition. The loss of arc or ground fault protection should either be shown to be extremely remote (if latent, consistent with the requirement of § 25.981(a)(3)) or annunciated to the flightcrew prior to flight. If failures of the AFCB or GFI can contribute to severe-major (hazardous) or catastrophic failure conditions, the safety assessment should analyze common cause failures or design errors that could result in these conditions and verify that appropriate protection to prevent them is provided. Due to the nature of AFCB and GFI devices, special attention should be given to protection from lightning, EMI, and HIRF.
A.3.4.4 As discussed in section A.3.7 below, the FAA expects there will be a means for the flightcrew to reset the AFCB or GFI in the event that more than one fuel pump AFCB or GFI trips simultaneously in flight.
A.3.4.5 Further, the applicant should show by design, analysis, and fault insertion testing, if applicable, the validity of failure analysis assumptions, and show that the probability of the failure of AFCB or GFI to detect the existence of a ground or arc fault condition and remove power from a pump is extremely remote (10-7 or less). In order to make this showing, AFCB and GFI installations have typically required an automatic built-in test feature that verifies the AFCB or GFI is operational before applying power to the fuel pump prior to each flight (see section 9.3.3 of this AC).
Appendix A A-4 A.3.5 Power and Ground Requirements.
AFCB or GFIs are active devices and require power to function. The applicant should show that AFCB or GFI power and ground connections are implemented such that all airplanes load margins are sufficient and that proper circuit protection or other methods are used to protect AFCB or GFI power and ground wiring. The applicant should also show that there are no hazards to maintenance or flightcrews due to possible hot shorts to electrical panels containing AFCB or GFI. In addition, if the installation of AFCB or GFI involves the direct replacement of devices on a given electrical panel, the applicant should show adequate power/heat dissipation and ensure safe touch temperature.
A.3.6 Built-In Test.
AFCB and GFI devices should incorporate built-in test and annunciation features needed to meet the reliability requirements for showing compliance with § 25.981(a)(3).
For example, if single or cascading failure in the fuel pump electrical circuit can result in an ignition source, a circuit protection feature failure rate less than extremely remote (1 x 10-7), would be required in order to comply with § 25.981. Traditional protective devices without built-in test and annunciation of failures have not been shown to achieve this level of reliability. Applicants have installed multiple protective devices in series or provided built-in test with annunciation in order to comply.
A.3.7 Troubleshooting Procedures.
A.3.7.1 Because AFCB or GFIs are capable of detecting ground paths on pumps and airplane wiring that may not be detected by visual inspection, the applicant should define the operational and maintenance philosophies and methodology associated with an AFCB or GFI trip that does not rely solely on visual inspections. The applicant should show how the maintenance procedures would be able to safely distinguish and diagnose an AFCB or GFI trip and nuisance trip without causing a fuel tank explosion. Operational instructions and maintenance procedures should be provided to prevent resetting of tripped AFCB or GFIs until it can be assured that resetting an AFCB or GFI will not cause the occurrence of a fuel tank explosion. Human factors should be taken into account to minimize the possibility of human error during airplane operation and maintenance.
A.3.7.2 If multiple boost pumps are protected with AFCB or GFI devices such that the continued operation of multiple engines could be affected, there should be a means for the flightcrew to reset tripped AFCB or GFI devices in flight. Loss of fuel pump capability due to inadvertent tripping in some fuel tanks could result in loss of fuel reserves needed to complete an Extended Operations (ETOPs) flight or safe diversion.
To prevent causing an ignition source, the applicable airplane flight manual should contain a limitation against the reset of a single AFCB or GFI. However, in order to address common cause inadvertent tripping, procedures should be provided for resetting AFCB or GFI devices when multiple AFCB or GFIs have tripped simultaneously in flight.