space. Means should be provided to distribute the cooling fuel into the fuel tank at or near the bottom of the fuel tank.
(12) Electrical Connector Sealant, S eals, and Explosion Proofness. Electrical connections to fuel pumps are typically located either inside or outside the fuel tank in areas of the airplane where the presence of flammable fuel vapors should be assumed because no secondary sealing of fuel is provided. Fuel leakage and corrosion at electrical connectors located outside the fuel tank has allowed the presence of both flammable vapors and electrical arcing at connectors, resulting in fires. In other applications, arcing has occurred at the pump connections inside the fuel tanks, requiring installation of appropriately sized steel shields to prevent arcing through the connector or pump housing into the fuel tank or areas where flammable vapor could exist.
(13) Arcing at the pump electrical connections should be assumed with fuel present in the safety assessment. The energy release during an arcing condition may be limited by installation of arc/ground fault protection features. The pump connector should be shown to contain any resultant arcing or fire and maintain all surface temperatures below the autoignition temperature of the fuel. Component manufacturer maintenance records and qualification test results should be reviewed to establish that the sealant is compatible with the fuel and to determine if a design life or periodic inspections for the pump connector are needed.
12. Instructions for Continued Airworthiness of the Fuel Tank System--§ 25.1529.
a. Based upon the evaluations required by § 25.981(a), Amendment 25-102 also added a new requirement to § 25.981(b) to require that CDCCL, inspections, or other procedures, be established as necessary to prevent development of ignition sources within the fuel tank system, and that they be included in the airworthiness limitations section of the ICA required by § 25.1529. This requirement is similar to that contained in § 25.571 for airplane structure.
Amendment 25-102 also added a new requirement to Appendix H to part 25, Instructions for Continued Airworthiness (ICA), to provide any mandatory fuel tank system inspections or maintenance actions in the limitations section of the ICA.
b. Critical design configuration control limitations include any information necessary to maintain those design features that have been determined by analysis of the fuel tank system as needed to preclude development of ignition sources. They may include any maintenance procedure that could result in a failure, malfunction, or defect endangering the safe operation of the airplane, if not performed properly or if improper parts or materials are used. This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the original type design of the fuel tank system.
c. Any fuel tank system components that are determined to require periodic maintenance, inspection, or overhaul to maintain the integrity of the system or maintain protective features incorporated to preclude a catastrophic fuel tank ignition event must be defined and included in the Limitations section of the ICA. The inspection interval should be 37
established based upon the standard practices defined in AC 25.1309 for evaluation of component failures. Examples of such items include:
(1) Aging fuel line couplings seals/ o-rings. In certain instances, materials used in fuel line couplings may lose flexibility and harden with age. During suction feed or pressurized operation, the seal may allow air to enter the fuel line or leak, allowing spraying of fuel in the tanks or other areas of the airplane where spraying fuel could create a fire hazard. Repetitive inspections, functional checks, or mandatory replacement intervals may be required to prevent leakage.
(2) Wear of pump bushings, bearings, and seals may significantly affect the performance of fuel pumps and degradation of features necessary to maintain the explosive proof qualification. In most cases these failures conditions are latent, therefore incorporation of other fail-safe features, as discussed earlier in this AC, would be required. If fail-safe features are incorporated, such as installation of feeder tanks that are filled with ejector pumps, functioning of those features would need to be assured by indications or periodic functional tests. Installation of fuel level sensors in the feeder tanks would provide continuous monitoring of the function. Another means could be installation of flow indicators in the flow line of the ejector pump that can be viewed by maintenance personnel and a mandatory periodic inspection of this function is one example of a method of mandatory maintenance action.
(3) Fuel pump protective features. If failure of an arc/ground fault protective feature and/or a thermal fuse (closed) is latent and this feature is needed to maintain fail-safe features, periodic checks would likely be needed.
(4) Transient suppression/energy limiting devices. If failure of the device is latent and this feature is needed to maintain fail-safe features, periodic checks will be needed.
(5) Wire shield grounding.
(6) Component grounds and wires will likely require inspections and measurements to determine proper grounding.
(7) Fuel tank access panel/door seals leakage, resistance checks.
(8) Fuel pump connectors, corrosion, wear.
(9) Fuel pump electrical supply conduit structural, sealing integrity.
d. Maintainability, both in the design and procedures (i.e., Master Minimum Equipment List (MMEL, Airplane Maintenance Manual, etc.), should be verified. This should include, as a minimum, verification that the system and procedures support the safety analysis assumptions and are tolerant to anticipated human errors, and that any critical procedures are highlighted for consideration as required inspection items. (See 14 CFR
121.369(b) for considerations of a “required inspection item.”) 38
e. Visible Identification of Critical Design Configuration Control Limitations.
(1) Section 25.981(b) states that “…visible means must be placed in areas of the airplane where maintenance, repairs, or alterations may violate the critical design configuration control limitations.” The design approval holder should define a method of ensuring that this essential information will be communicated by statements in appropriate manuals, such as Wiring Diagram Manuals, and be evident to those that may perform and approve such repairs and alterations.
(2) An example of a CDCCL that would result in a requirement for visible means would be maintaining wire separation between FQIS wiring and other high power electrical circuits where separation of the wiring was determined to be a CDCCL. Acceptable methods of providing visible means would include color coding of the wiring and labeling. For retrofit of markings onto existing wiring, placement of identification tabs at specific intervals along the wiring would be acceptable. Industry and regulatory authorities are currently developing standards for color coding of wiring for various systems. Standardization within the industry of color coding of wiring used for the fuel tank system would assist maintenance personnel in functional identification of wiring. Pink wiring has been used by some manufacturers for fuel tank system wiring. Use of this color as a standard for fuel tank system wiring is recommended by the FAA.
/s/ Ali Bahrami
Ali Bahrami Manager, Transport Airplane Directorate Aircraft Certification Service