(3) Latent Failures.
(a) In order to eliminate any ambiguity as to the restrictions on latent failures, § 25.981(a)(3) explicitly requires that any anticipated latent failure condition not leave the airplane one failure away from a catastrophic fuel tank ignition. In addition to this § 25.981(a)(3) limitation on latency, § 25.1309(c) limits latent failure conditions to those that do not create an “unsafe system operating condition.” Consequently, if a latent failure condition is not extremely remote (i.e., it is anticipated to occur) and it creates an “unsafe system operating condition,” then “warning information must be provided to alert the crew…and to enable them to take appropriate corrective action.” These applicable regulatory restrictions on latency notwithstanding, there are practical limitations on the available means of compliance. For example, detecting a failure condition requires a finite period of time and there are not always “appropriate corrective actions” that can be taken during the flight. Consequently, for the purposes of compliance with § 25.981(a)(3), the period of latency for any anticipated significant latent failure condition should be minimized and not allowed to exceed one flight cycle. For the purposes of § 25.1309(c) compliance, any time the airplane is operating one failure away from a catastrophic fuel tank ignition should be considered an “unsafe system operating condition,” recognizing that sometimes the only “appropriate corrective action when problem detection is available is to continue on to your destination but not to initiate another flight without making appropriate repairs.”
(b) Another practical limitation on the available means of compliance is the technological feasibility of providing inherent failure detection within the design for all significant failures. Sometimes periodic inspection is the only practicable means of reliably detecting a failure condition. Consequently, when such inspections are identified within the analysis as the means of detection, the inspection method and frequency must be sufficient to conclude that the occurrence of the significant latent failure condition is extremely remote.
(c) Any inspection that is identified to assure integrity of items identified as critical design configuration control limitations should be identified in the limitations section of the instructions for continued airworthiness as a fuel system limitation (FSL). If this means is used, the limitations section should include the following:
1 A designation of the maintenance actions and alterations that must be inspected (critical inspections), including at least those that could result in a failure, malfunction, or defect endangering the safe operation of the aircraft, if not performed properly or if improper parts or materials are used.
NOTE: A validation inspection should be conducted to reaffirm all or a portion of the initial inspection requirements for those critical inspections that, if not performed properly or if improper parts or material are used, could result in a failure, malfunction, or defect endangering the safe operation of the airplane. For those air carriers that use a mechanic for the initial inspection, an inspector should be used to conduct the validation inspection. For those air carriers that use an inspector for the initial inspection, another qualified inspector should be used to conduct the validation inspection.
2 Procedures, standards, and limits necessary for critical inspections and acceptance or rejection of the items required to be inspected, and for periodic inspection and calibration of precision tools, measuring devices, and test equipment.
(4) Failure Conditions. When showing compliance with § 25.981(a)(3), the effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered.
For the purpose of compliance with § 25.981, “extremely remote” failure conditions are those not anticipated to occur to each airplane during its total life, but which may occur a few times when considering the total operational life of all airplanes of one type. This definition is consistent with that developed by the Aviation Rulemaking Advisory Committee (ARAC) for a revision to FAA AC 25.1309-1A. “Extremely improbable” failure conditions are those so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. This definition is consistent with the definition provided in AC 25.1309-1A. Likely damage is damage that using engineering judgement or past experience would lead one to conclude that an occurrence is foreseeable. Examples of likely damage are: a wire bundle located where a mechanic could use it as a hand hold; an instrument located where if someone dropped a wrench, damage would result; or a fuel probe located where a mechanic could use it as a step in the tank, etc.
(a) The analysis should be conducted considering the deficiencies and anomalies listed in paragraph 7c of this AC, failure modes identified by the review of service information (including review of supplier service data), and any other failure modes identified by the functional hazard assessment of the fuel tank system. For example, the presence of conductive debris such as lockwire, steel wool, nuts, bolts, rivets etc., should be assumed. Section 25.981 specifically requires that the effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered when demonstrating compliance. Credit for fail-safe features must be substantiated. For example dual layers of insulation on wires or addition of sleeving has been claimed as providing fail-safe features.
(b) The level of manufacturing variability, aging, wear, corrosion, and likely damage that must be considered should be determined based upon evaluation of the detectability of degraded or out-of-specification configurations, and established and documented within the analysis. In-service and production functional tests, component acceptance tests, and maintenance checks may be used to substantiate the degree to which these states must be considered. For example, inspection of fuel tank system bonding on production airplanes has shown that some bonds were inadequate. Functional testing of all bonding was incorporated to address this deficiency. In some cases (e.g., component bonding or ground paths), a degraded state will not be detectable without periodic functional test of the feature. For these features, inspection/test intervals should be established based on previous service experience on equipment installed in the same environment. If previous experience on similar or identical components is not available, conservative initial inspection/test intervals should be established until design maturity can be assured.
(5) External Environment. The severity of the external environmental conditions that should be considered when demonstrating compliance with § 25.981 are those 26
established by certification regulations and advisory material (e.g., HIRF, lightning) regardless of the associated probability of exposure to any external environment. For example, the probability of lightning encounter should be assumed to be one.
(6) External Sources of Tank Auto-ignition. The possibility of fuel tank ignition due to surface-ignition sources created by external tank heating should be considered. This includes heating of the tank due to operation or failure of systems outside the tank within both the pressurized and unpressurized areas of the airplane, such as overloaded electric motors or transformers, failures in the pneumatic system and/or ducting that could cause localized heating of tank surfaces. In addition, the possibility of localized heating due to external fires must be considered.
(a) Section 25.967(e) requires that, “Each fuel tank must be isolated from personnel compartments by a fume proof and fuel proof enclosure.” Leakage of fuel or vapor into spaces adjacent to the fuel tank, where a secondary fuel and fume-proof barrier is not provided, has typically been assumed for areas such as:
• the wing leading (including any adjacent compartment such as the strut) and trailing edges,
• fairings located below the fuel tanks,
• fuel pump enclosures, and
• unpressurized areas of the fuselage surrounding fuel tanks located in the empennage.
Components located in these areas have been required to meet explosion-proof requirements. These components or systems must be included in the analysis. Examples of equipment include, but are not limited to, Environmental Control System (ECS) air conditioning packs, motors, power assisted valves, fuel pumps, hydraulic pumps/motors, certain flight control actuators, ECS controls, wiring and valves.
(b) A safety review of flammable fluid leakage zones adjacent to fuel tanks will be needed to determine that the design complies with the requirements of §§ 25.863(a) and 25.981. In general, the fire protection philosophy for any area considered a flammable fluid leakage zone is to assume that flammable vapors may be present in the zone and to minimize the probability of ignition of vapors (§ 25.863(a)). This has typically been accomplished by using combinations of the following design considerations:
• grounding and bonding of electrical equipment,
• qualification of electrical equipment as explosion proof,
• sealing of electrical connectors,
• proper support, protection and separation of wiring,
• drainage provisions in the leakage zone,
• ventilation of the leakage zone in-flight, and areas around auxiliary tanks, and 27
• immediate maintenance action to correct running leaks in these areas.
(c) Surface temperatures in areas adjacent to fuel tanks. The FAA has approved installations, where surfaces adjacent to the tank experience temperatures in excess of the internal fuel tank surface temperature limit. Manufacturers have substantiated that the conditions (ambient pressure, dwell time, fuel type, etc.) within these areas are such that a higher value may be used. For example, a maximum allowable surface temperature of 400 °F, with a transient excursion up to 500 °F for a maximum duration of two minutes, has been accepted for certain pneumatic system installations. The excursion above 400 °F occurs only during failure conditions such as failure of the engine pneumatic system to regulate temperature, or duct rupture. Approval of these elevated temperatures has been based on compensating design features, such as an over-temperature shutoff of the pneumatic system so that the surface temperatures adjacent to the tank cannot exceed the surface ignition temperature justified for the fluid type including the effect of local airflow and ventilation conditions within the zone, e.g., the 500 °F value. Internal tank surface temperatures resulting from the failure should not exceed the surface temperature limit for the fuel type used as described in paragraph 8e of this AC.
(7) Electrical Ignition Sources. The applicant should perform a failure analysis of all fuel systems and subsystems with wiring routed into fuel tanks. Systems that should be considered include fuel pump power and control and indication, fuel quantity indication, fuel temperature indication, fuel level sensors, and any other wiring routed into or adjacent to fuel tanks. The analysis should consider system level failures, failures within LRUs and component level failures discussed below. The analysis should include existence of latent failures and subsequent failures that may lead to an ignition source within the fuel tank.
Examples include undetected failures of tank components or wiring, the undetected presence of conductive debris, damage to FQIS or level sensor probes, or corrosion, in combination with external failures such as hot shorts or induced transients (EMI and lightning). In addition, the applicant should provide a description of the protective means employed in the fuel system wiring. This should include a description of features such as separation/segregation, transient suppression devices, shielding of wiring, and methods employed to maintain configuration control of critical wiring throughout the life of the airplane.
NOTE: EMI protection is often a function of circuit and surrounding structural characteristics. Therefore care should be taken when determining the effects of exposing a system with faults present to some EMI threats especially lightning.
(8) Electrical Short-Circuits.
(a) One method that may provide protection of circuits that enter fuel tanks is the incorporation of a transient suppression device (TSD) on the circuit close to the point where those wires enter fuel tanks. Consideration should also be given to protection of wiring between the TSDs and the tank if the protection devices are not located at the tank entrance, and also to the possibility of transients being induced in the wiring between the 28
TSDs and the electrical devices in the fuel tanks. Caution should be exercised when using TSDs to be sure that the TSD addresses both voltage and current suppression.
(b) Another method of protection that has been used to provide a fail-safe design with respect to electrical shorts is separation of wiring to electrical devices in the fuel tanks from other electrical power wires and circuits, combined with shielding between wiring that enters fuel tanks and any other electrical power-carrying wires in the aircraft installation.
The effects of electrical short circuits, including hot shorts, on equipment and wiring that enters the fuel tanks should be considered, particularly for the fuel quantity indicating system wiring, fuel level sensors, and probes. Latent failures from factors such as contamination, damage/pinching of wires during installation, or corrosion on the probes, connectors, or wiring should be considered when evaluating the effects of short circuits. The wire routing, shielding, and segregation outside the fuel tanks, including within the FQIS components
(e.g., gauging units), should also be considered when evaluating the effects of short circuits.
The evaluation should consider both electrical arcing and localized heating that may result from short circuits on equipment, fuel quantity indicating system probes, and wiring. The evaluation of electrical short circuits should include consideration of shorts within electrical equipment, and wiring from the equipment into the fuel tank. Prevention of fuel ignition from electrical shorts to wiring that enters fuel tanks may require specific wire and circuit separation and wire bundle shielding.
(9) Line Replacement Unit (LRU) Design Evaluation. The design review should include evaluation of the separation and/or protective features incorporated into any fuel system LRU whose failure could result in high level electrical power (above intrinsically safe levels) entering the fuel tank. For example, circuit board failures could cause the fuel quantity gauging system LRU power supply circuits to come into contact with circuits that lead into the fuel tank, resulting in a possible ignition source. Failures that can lead to violating separation within the LRU can be external and internal events. External failures include over voltage or over current, high humidity, temperature, vibration, shock, and contamination. Internal failures include manufacturing defects or flaws in the conductor, substrate or coating. To address these failures isolation and physical separation between critical signals should be provided, or adequate protective features, such as transient suppression devices as discussed earlier, should be provided to protect the circuits that enter the fuel tank. Any LRU that meets the design requirements identified in reference (3), paragraph 4e, of this AC, Underwriters Laboratories Inc., UL 913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations, is considered acceptable, provided the following issues are addressed.
Ideally, higher power circuits within the LRU should not be located on the same circuit board or in a wire harness or electrical connector with intrinsically safe circuits or wiring. There should be a physical barrier between circuit boards to isolate the intrinsically safe circuits from the effects of broken components or fire within the LRU. If limiting devices are installed on the same circuit board in series with system circuitry to limit the amount of power or current transmitted to the fuel tank, there should be three inches between the traces, unless the manufacturer can justify a smaller separation on the basis that the effects of fire on the circuit board will not compromise the intrinsically safe circuit(s).
(10) Electromagnetic Effects, including Lightning, Electromagnetic Interference (EMI), and High-Intensity Radiated Fields (HIRF).
(a) The effects of electrical transi ents from lightning, EMI, or HIRF on anything conductive (e.g., fuel tank plumbing, structure, fuel, equipment and wiring) within the fuel tanks should be considered, particularly for the fuel quantity indicating system wiring and probes. Latent failures from factors such as contamination, damage, or corrosion on the probes or wiring should be considered when evaluating the effects of electrical transients. The wire routing, shielding, and segregation of conductors (e.g., plumbing, component casings, wiring, etc.) outside the fuel tanks should also be considered when evaluating the effects of electrical transients, because the transient generation and coupling to conductors may occur outside the fuel tanks. The evaluation should consider both electrical sparks and arcs and localized heating that may result from lightning, EMI, and HIRF transients on the fuel tank system, fuel quantity indicating system probes, and wiring.
(b) Latent failure of electromagnetic protection features, such as shielding termination corrosion, shield damage, and transient limiting device failure should be considered and appropriate indication or inspection intervals established to prevent the existence of latent failure conditions. The failure of other system components may also affect EMI protection. Consequently, the effect of any anticipated failure on the continued environmental protection should be considered. For example, a normally high impedance electrical load that fails due to an electrical short, or a normally low impedance load that fails to an open state, can cause a significant redistribution of the lightning currents within a wire bundle; hence, the voltage induced at components within the fuel tank.
(c) The evaluation of electromagnetic effects from lightning, EMI, or HIRF should be based on the specific electromagnetic environment of a particular aircraft model.
Standardized tests, such as those in RTCA DO-160, Sections 19, 20, and 22, are not sufficient alone, without evaluation of the characteristics of the specific electromagnetic environment and induced transient levels assigned to systems installed within a particular airplane model, to show that appropriate standardized RTCA document DO-160 test categories, procedures and test levels are selected. Simulation of various latent failures of fuel system components within the tanks may be required to demonstrate the transient protection effectiveness. Effectiveness of the transient protection features should be verified using the appropriate RTCA document DO-160 test procedures and test levels determined above.
(d) Prevention of fuel ignition due to electrical transients from lightning, EMI, or HIRF may require specific wire segregation and separation, wire bundle shielding, or transient suppression for wires entering fuel tanks. Effectiveness of the transient protection features should be verified using the appropriate RTCA document DO-160 test procedures and test levels determined above.
(e) Redundancy of bond paths. Failure of bonding jumpers is generally considered a latent failure, since there is no annunciation or indication of the bonding failure.
The airplane fleet fuel tank inspections that occurred as a result of the TWA 800 30
investigation showed that failure of bonding jumpers, due to damage, wear, or manufacturing errors, was not unusual. Based on this, it would be difficult to show that failure of a single bonding jumper is extremely remote or extremely improbable. Therefore, the electrical bonding jumper or other bonding provisions would need to consider the consequences of these latent failures. This may result in designs that incorporate electrical bonding redundancy, if the failure of a single electrical bonding feature could create a fuel ignition source. Additionally, manufacturers would need to consider the use of appropriate maintenance to detect failed bonding jumpers. An example of such maintenance might include periodic inspections to limit latency.
(f) Self-bonding couplers. Early generation self-bonding flexible fuel couplers did not have multiple bonding paths. Thus these bonding couplers exhibited single-point failures which caused loss of function. These self-bonding flex couplers have failed because of missing bonding springs, anodizing on bonding surfaces, and incorrect installation. The safety assessment of newer designs incorporating multiple bonding paths must consider these failure modes and qualification testing should show no ignition sources are present in the full up and possible degraded condition with failure modes present within the couplings. For example, failure assessements of clam shell type self bonding metallic couplings in composite fuel tanks have shown arcing could occur during lightning conditions if a coupling was improperly latched, or became unlatched and fell to the bottom of the fuel tank. The design of the coupling would need to address these failure modes. Improper latching could be addressed through positive latching features with tactile and visual indication that the coupling is properly latched. Redundant fail safe features such as dual hinge pins, dual latching features, redundant bonding features, etc., would be needed to address other possible failure modes.
(g) Resistance or impedance limits of airplane electrical bonding provisions.
1 There is no specific FAA guidance on maximum resistance or impedance of airplane electrical bonding provisions. Electrical bonding within a fuel system should be tailored to the performance requirements of a particular airplane design. The electrical bonding should consider the electrical sources, such as electrical faults, fuel static electrification, and lightning. The electrical bonding should also consider the specific airplane fuel system design, which would include the structure material used (aluminum, carbon fiber composites, fiberglass composites, etc.), the configuration of the fuel system (routing of fuel tubes, wires, and hydraulic tubes), and the electrical bonding concept (intentional isolation, self-bonding fittings, separate bonding jumpers, etc.). Given the large variation in design approaches, and the close relationship between the design approach and the electrical bonding requirements, it is not practical for the FAA to provide specific guidance on maximum bonding resistance or impedance.
2 Some airplane TC holders have performed tests on their airplanes to determine the specific requirements for electrical bonding for threats such as lightning.
Others, in the absence of specific airplane test data, have chosen conservative electrical bonding approaches. The approach is a decision each TC holder should make based on the specific situation for that TC holder's airplane models.
(h) Bonding integrity checks. Past experience has shown measurement of bond resistance is the desired method of assuring bond path integrity. During bonding resistance measurements, damage of protective finish of components may be caused in order to penetrate the insulating anodized surface layer, which may lead to subsequent corrosion damage. This concern has resulted in some TC holders defining non-intrusive inspections for electrical bonding. These inspections may include detailed visual inspections, if the quality of the electrical bonding feature can be adequately assessed by visual cues, such as visible corrosion, breakage, tightness or missing bonding provisions. For critical bonds this method would not by itself be adequate. Other inspection methods include inductivelycoupled loop resistance measurements that eliminate the need to disconnect bonding jumpers or to penetrate corrosion-prevention coatings. The need for bonding inspections, the frequency of the inspections, and the determination as to whether the inspections must be an ALI, should established as a result of the fuel tank system safety assessment.
(i) Bond Corrosion and Integrity.
1 Degradation of electrical bonding provisions, such as bonding jumpers, has occurred on in service airplanes. Results from airplane fuel tank inspections conducted on a sample of airplanes by manufacturers and operators showed discoloration, corrosion, and damage to bonding jumpers. It is not clear if the discoloration indicates corrosion that will become more severe with time, or is simply a surface color change. The applicant must define CDCCLs and the bonding feature characteristics, such as visible corrosion, discoloration, jumper strand separation, and jumper strand breakage that will be used to distinguish discrepant bonding provisions.
2 The level of corrosion observed on bonding features, specifically on bonding jumpers, varied greatly across airplane fleets. While some airplanes within a fleet and certain locations within the fuel tanks showed no evidence of corrosion, other airplanes and locations exhibited higher levels of corrosion. Inspection results reported to the FAA indicate materials used in certain bonding jumpers (tin plated copper) may be more prone to corrosion. Nickel plated copper wire does not experience similar corrosion. Corrosion programs for airplane structure have long recognized the variability of corrosion within the fleet. Factors that influence the level of corrosion of bonding jumpers include fuel type (sulfur content, etc.), presence of water in the fuel tank, installation effects such as cracking of the tin plating when the jumper is installed, temperature, humidity, and chemicals used for preparation of the fuel tanks prior to airplane storage, etc. While certain levels of corrosion or discoloration may be acceptable between inspection intervals, demonstration of compliance should include substantiation that the materials used in the bonding jumpers are appropriate for use in the fuel tanks in consideration of proposed inspection intervals. This substantiation should include test data that considers the variability in corrosive environments and factors noted above that may exist on in-service and storage of airplanes in the fleet.
(j) Definition of major component. There is no specific FAA guidance on “major components” in § 25.901(b)(4). However, the term “major components,” as specified in § 25.901(b)(4) should not be used to limit the review of fuel system ignition sources as 32
required in § 25.981. Section 25.981, Fuel tank ignition prevention, states: “(a) No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapors.” This stipulation is in addition to the provisions regarding major components in § 25.901(b)(4). For example, fuel tube flexible coupling and components as small as nuts, bolts and washers may develop sufficient charge to cause arcing due to electrostatics and lightning conditions if not properly accounted for in the design. Electrical bonding would need to be considered if these couplings are identified as ignition sources during the ignition source evaluation and assessment.
(11) Friction Sparks. The failure modes and effects analysis (FMEA) should include evaluation of the effects of debris entering the fuel pumps, including any debris that could be generated internally, such as any components upstream of the pump inlet. Industry fuel tank cleanliness practices and design features intended to preclude debris entering the fuel pumps have not been effective at eliminating debris. Service experience has shown that pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, sealant, lockwire, etc. have been inducted into fuel pumps and contacted the impeller. This condition could result in creation of friction sparks and should be an assumed failure condition when conducting the system safety assessment. Fail-safe features should be incorporated into the fuel pump design to address this condition. Examples of means that may be incorporated into the fuel pump design to address this concern include:
• installation of inlet flame arrestors,
• use of reticulated foam,
• use/installation of jet fuel pumps without impellers to scavenge fuel, or
• maintaining fuel over the pump inlet throughout the airplane flight attitude envelope.
11. Component Qualification Considerations.
a. Component Qualification Review. Qua lification of components, such as fuel pumps, has not always accounted for unforeseen failures, wear, or inappropriate overhaul or maintenance. Also, incomplete use of the MIL specification explosion proof procedures has led to some fuel pumps entering airline service having never been run in an explosive environment. This combined experience suggests that more needs to be done to establish the capabilities of fuel pumps and other fuel system components to operate safely in an explosive environment. Such capability should be substantiated (or resubstantiated for the SFAR compliance) considering these factors in addition to the conditions noted in paragraph 7c of this AC. The amount of qualification review can be significantly reduced if the fail-safe features noted earlier in this AC are followed (e.g., not operating pumps in vapor spaces of the tank, incorporating ground fault protection on the electrical circuit, etc.). Therefore, an extensive evaluation of the qualification of components may be required if a qualitative assessment does not eliminate the component as a potential ignition source.
b. Maximum Component Temperature for Qua lification of Fuel System Components.
Maximum component temperatures may be determined experimentally. Tests should be conducted long enough for the component to reach the maximum temperature. All 33
foreseeable failures and malfunctions of the fuel tank components (including those failures and malfunctions that could be undetected by the flightcrew and maintenance personnel) should be considered when determining maximum temperatures.
(1) As discussed in AC 25.981-1, issued in 1971, components mounted adjacent to the exterior surface of the fuel tank can create a high localized temperature at the inner surface of the tank. This can be investigated by laboratory tests that duplicate the installation, or by a validated heat transfer analysis using the maximum potential temperature of the component.
(2) When engine bleed air ducting, ECS, and other airplane components or systems are located near fuel tanks, a FMEA should be done to determine failures of adjacent systems or components that could cause elevated surface temperatures. The maximum internal tank temperatures that can occur during normal and failure conditions should be determined.
Systems, such as over-temperature protective devices, should be evaluated to determine if periodic health checks are necessary to assure that latent failures do not exist.
c. Possible Failure Modes for Determination of Maximum Component Temperatures.
The following list, although it does not include all possible failure modes, suggests some conditions that should be explored in determining the maximum temperature expected for fuel tank components:
(1) Fuel Pumps.
(a) Normal fuel pump operation considering the highest hot day ambient and fuel tank temperatures.
(b) Single phase operation of three-phase electrical fuel pumps. In many cases fuel pump motors are protected by a (single) three-phase circuit breaker. In several instances, resetting of circuit breakers has resulted in arcing inside the fuel tank and the development of an ignition source. Therefore, the fuel pump circuit should also preclude development of an ignition source if the breaker is reset or forced in by a mechanic. Features such as non-resettable breakers or fuses are design features that would meet the fail-safe requirements of § 25.901 that apply to this failure condition.
(c) Two-phase operation of three-phase electrical fuel pumps. Failure of a single phase of a multiple-phase fuel pump may significantly increase the load on the remaining phases of the pump and generation of heat in the pump. In many cases thermal protection features within the pump have been incorporated to address this failure condition but these means have not been effective at preventing continued operation of a pump with a failed electrical phase. Another failure condition that should be considered is subsequent failure of a second phase of the pump and possible arcing or heat damage. In general, pumps should not be allowed to operate following failure of a single electrical phase of the pump if such operation could result in development of an ignition source. Automatic protective means, such as arc/ground fault interrupters or other means, should be provided to shut down 34
the pump when a single electrical phase failure occurs. Periodic inspections or maintenance of these features may be required.
(d) Dry operation of fuel pumps, including lack of lubrication. Service history has shown that flightcrews and maintenance personnel have inadvertently operated fuel pumps for long periods of time without fuel in the fuel tank. Fuel pumps are typically qualified for dry run operation for periods of time based upon assumptions made about possible duration of inadvertent operation, or failure conditions, that could result in dry running of the pump. For example, some pumps were operated during qualification testing up to a maximum of 8 hours continuously, with total accumulated dry run operation of 24 hours. These qualification tests were accomplished in order to demonstrate that fuel pump performance was still adequate following the dry pump operation. The tests were not demonstrated in an explosive environment and hence were not intended to qualify the pumps for such operation. In other cases previous approvals were predicated on the assumption that the fuel pump would not be dry run operated because the pump would be turned off by the flight/ground crew following a pump low-pressure indication. Indefinite dry operation of pumps may result in surface temperatures above the auto-ignition temperature of the fuel or expose the pump to dry run operation where debris from the fuel tank could enter the impeller and cause sparks. Manufacturers recommended procedures have not been shown to be adequate in preventing dry run operation. Therefore, additional fail-safe features are necessary to preclude dry run operation of airplane fuel pumps. One or more of the following fail-safe means should be considered for protection of fuel pumps:
1 Incorporate design features to keep the fuel pump inlet submerged in jet fuel to prevent dry running of the pump under all operating conditions.
2 Incorporate automatic pump shutoff features into the fuel pump or airplane to preclude dry run operation.
3 Other means such as installation of flame arrestors in the fuel pump inlet to preclude flame propagation into the fuel tank.
(e) Temperatures associated with the fuel pump following wet operation with wet mechanical components both at zero and reduced fluid flow.
(f) Temperatures considering the moving mechanisms that are locked or seized.
(g) Temperatures generated as a consequence of pump impeller slippage.
(h) Failed Bearings. The effects of wear on fuel pump features incorporated into the design to maintain explosion proof characteristics should be evaluated. For example, wear of bearings or failures, including spinning of any bushings, and possible effects on quenching orifices should be evaluated. In many cases fuel pump explosion proof features are not redundant and failure or degradation of the features is latent. If single or probable combinations of failures in the fuel pump can cause an ignition source, § 25.981 requires 35
incorporation of fail-safe features noted previously. If wear of the pump can cause degradation of fail-safe features, appropriate inspection, overhaul or life limiting of the pump should be included in the Limitations section of the Instructions for Continued Airworthiness.
(2) Fuel Quantity Indicating System (FQIS) wiring in the tank, with maximum voltage and current applied considering normal and failure conditions including the effects of high voltage systems outside the tank in proximity to the co-located FQIS wires.
(3) FQIS component in the normal and failed state with the above associated maximum voltages and fault currents applied.
(4) Float Switch System temperatures should be determined considering the maximum environment temperatures and the application of the applicable maximum voltage and fault currents.
(5) Temperatures of the fuel system components should also be evaluated considering the failure of bonding straps.
(6) Pneumatic system temperatures need to be evaluated for the effects of duct rupture impinging on the external tank surface, and radiation and conduction heat transfer associated with the tank and components affecting tank wall temperatures (see previous discussion of spaces adjacent to fuel tanks).
(7) Electrical defects that generate excessive heat. Arcing at the electrical connections to the pump housing or within the connector.
(8) Submerged heat exchangers. Operating under conditions of maximum heat rejection to the fuel.
(9) Failed or Aged seals. Spraying of fuel in the tank from any pressurized fuel source may cause electrostatic charging of components in the fuel tank and significantly lower the flammability temperature of the fuel tank vapor. Therefore, the design should not include features that result in spraying of fuel, such as fuel pump motor cooling flow return to the tank. In addition, use of sealant in connectors that is not compatible with the fuel may allow leakage into the connector and the possibility of a fire near the connector.
(10) Fuel Line Couplings. Aging of seals may result in hardening of the seal material and leakage and spraying of fuel within the fuel tank; therefore, fuel line coupling designs should be evaluated and a design life should be established for all seals that are shown to age and allow leakage that can cause unacceptable electrostatic charging of components.
(11) Fuel Pump Cooling Flow. Fuel used for cooling of fuel pumps may be sprayed from the fuel pump. Fuel pump cooling flow should not be sprayed into the fuel tank vapor 36