b. Fuel Tank FRM Model. If FRM is used, the rule requires an FAA-approved Monte Carlo Model be used to show compliance with the flammability requirements of § 25.981 and appendix M of part 25. The program must determine the time periods during each flight phase when the fuel tank or compartment with the FRM would be flammable. The following factors must be considered in establishing these time periods:
(1) Any time periods throughout the FEET and under the full range of expected operating conditions, when the FRM is operating properly but fails to maintain a nonflammable fuel tank because of the effects of the fuel tank vent system or other causes.
(2) The effect of any inerting system may be included in this analysis. The applicant should present a description of the system including its control logic, and data to substantiate its performance at lowering the ullage oxygen content to below the inert level defined in appendix N to this part to comply with the applicable average flammability level. Where the system does not provide continuous protection such as a ground based inerting system as described in paragraph 4e(5) of this AC, the degradation of the ullage inerting level with time, altitude, oxygen evolution from the fuel, air inhalation with fuel use or altitude reduction, and possible effects from vent system operation must be addressed.
c. Compliance Report. The results of the analysis described above, together with substantiation data for the assumptions used in the analysis, including test data validating the thermal analysis used, would be included in the compliance report presented to the FAA. If the tank in question requires a demonstration of equivalence, an analysis of a real or hypothetical unheated wing tank on the same airplane must also be presented.
d. Documentation and Validation of Monte Carlo Model. As discussed earlier in paragraph 10, modifications to the Monte Carlo model are limited to the additional features needed to model an FRM, tank thermal characteristics, and fuel management.
All modifications to the model’s code must be thoroughly documented and validated both through detailed analysis and flight test. The compliance report should include a summary section that lists all modifications.
11. Flammability Reduction Means. The available methods of limiting exposure to operation with a flammable ullage space in the tank include preventing the formation of flammable vapors and/or controlling the oxygen concentration. Factors that directly influence the formation of flammable vapors include the fuel type properties, fuel temperature, pressure within the fuel tank, and any design feature that increases the potential for fuel mists to be created. Design precautions described earlier within this AC to limit misting or sloshing of fuel within a fuel tank should be taken.
Demonstrating compliance when an FRM is used requires modification to the Monte Carlo Model to include a simulation of the FRM performance. The simulation must determine the times during the flight when the FRM is effective at maintaining a non- 25
flammable fuel tank. Factors that need to be considered when developing the simulation are discussed within this section.
a. Managing Heat Transfer to the Fuel Tank. In general, heat sources should not be located in or near fuel tanks, and heating from other sources, such as hydraulic heat exchangers or rejection of heat from engine systems, should be avoided unless features are incorporated to maintain fuel tank flammability equivalent to an unheated wing fuel tank. Locating heat-producing systems away from the tanks should be considered. If this is not a practical solution, installation of an FRM using thermal control may be another option. Possible technical solutions include the use of thermal insulation blankets, and/or providing ventilation and/or dedicated cooling to remove excess heat from the fuel tank or areas adjacent to the tank.
b. Cooling/Ventilation of Fuel Tanks. If the fuel tank is located in an area of the airplane where little or no cooling occurs, such as the center wing box, certain horizontal stabilizers, or auxiliary fuel tanks located in the cargo compartment, ventilation or dedicated cooling may also be an effective means of demonstrating compliance. The cooling/ventilation means should be effective under all operating conditions, including ground and flight operation, considered necessary to achieve the desired goal of showing the tank flammability is equivalent to the unheated wing tanks. Adequate cooling/ventilation may be provided for certain airplane types by means such as installation of an air gap in spaces adjacent to fuel tanks and utilizing cold air source during ground operation to cool the tank, and the use of ram air inlets for in-flight operation to transfer heat from the tank. Other means (e.g., bleeding cool air from the ECS packs into the air gap) may also be effective at providing adequate cooling/ventilation of the tank.
c. Controlling Fuel Tank Pressure. The flammability of the fuel tank is affected by the pressure in the tank. Typical transport category airplane fuel tanks are vented to the atmosphere and operate at or slightly above local ambient pressure. Fuel tanks located within the wing typically operate with a pressure equal to the local static pressure unless features are incorporated to increase the fuel tank operating pressure. Designs have been developed that use pressurization of the wing fuel tanks as a means to transfer fuel.
Pressurization of the fuel tanks also provides reduced flammability. Manufacturers have also incorporated National Advisory Committee for Aeronautics (NACA) scoops on the vent outlets of some airplane fuel tank systems to enhance engine suction feed performance. The pressure recovery factor of these scoops varies but in general is in the range of .4 to .6. Therefore fuel tank pressure during flight may be between .5 to 1.25 psi above local static pressure. The increase in tank pressure results in a reduction in fuel tank flammability.
Many recently designed auxiliary fuel tanks, located in pressurized cargo compartments, incorporate structural features that allow utilization of pneumatic pressure to transfer fuel from the fuel tank to the airplane fuel tank system. These tanks typically are designed to operate at the airplane cabin pressure which is normally equivalent to approximately 8000 feet pressure altitude. This results in a significant reduction in fuel 26
tank flammability. Controlling fuel tank pressure is one means of reducing fuel tank flammability. The Body Tank model in the Monte Carlo Model defined in paragraph 4e(11) of this AC has features that allow the user to input a pressure differential relative to ambient pressure so that fuel tank flammability under these conditions can be evaluated.
d. Fuel Tank Ullage Sweeping. A positive ventilation system has been studied to be used to “sweep” the ullage of flammable fuel vapor/air mixtures at a rate that keeps the ullage lean when the fuel temperature and pressure in the tank would otherwise define the tank as being flammable. It is discussed in the ARAC Fuel Tank Harmonization Working Group Final Report in paragraph 4e(2) of this AC. The rule requires that the fuel tank flammability be determined based upon the Monte Carlo analysis, which determines if the fuel tank ullage is flammable based on the fuel temperature and fuel tank altitude (or pressure altitude).
e. Higher Flash Point Fuels. One method of reducing fuel tank flammability is to restrict the fuel type specified in the AFM to higher flash point fuels (e.g., JP-5, 140 degrees F flash point). This method, in combination with other means, may be effective at reducing the exposure. However, as discussed in the ARAC Fuel Tank Harmonization Working Group Final Report in paragraph 4e(2) of this AC, this approach is not considered to be practical at this time. If this method were considered, the applicant would need to request FAA approval for use of a fuel type with a different flash point when conducting the flammability assessment than that required by appendix N to part 25.
f. Oxygen Concentration.
(1) Fuel Tank Inerting. Fuel tank inerting is a highly effective means of reducing or eliminating the flammability exposure within a given tank. This method eliminates flammable vapors by displacing oxygen from the ullage space of the tank with inert gas (reducing the oxygen concentration below the level that would support combustion of flammable vapors). The military has used this method to prevent fuel tank explosions of combat airplanes. While system requirements for commercial applications are different, the development of technology for separation of nitrogen gas from air has allowed the size and weight of inerting systems to be significantly reduced for commercial applications. Additional size and weight reductions may be achieved by new approaches such as catalytic conversion of fuel vapors in fuel tanks to produce carbon dioxide for use as the inert gas that is under development.
(2) Recent technology developments have made it possible to develop inerting systems that use optimized air sources that are part of the initial airplane design. These systems are capable of inerting a fuel tank during normal airplane operating conditions.
Older technology airplanes that have limited bleed air sources are less efficient and it may not be practical to provide an inerting system that inerts the tank throughout the flight envelope. On these airplanes a flammability assessment based upon the time the 27
inerting system is effective, as well as consideration of the fuel tank flammability, may be part of the overall compliance demonstration.
(3) The applicant may show that inerting is only needed for certain missions, for example during warmer days when the fuel ullage would be flammable, or parts of a particular flight to lower the fuel tank vapor/air mixture average exposure to a level that meets the flammability limit. Inerting may be achieved by supplying inert gas from onboard storage bottles, holding either gas or liquid inerting agent, on board inert gas generation systems (OBIGGS), or from a ground storage system if the tank is inerted only on the ground. Nitrogen is currently the inert gas of choice for inerting fuel tanks and the requirements in the § 25.981 address the requirements for use of nitrogen based inerting systems. Use of other gases, such as carbon dioxide, to inert a fuel tank would include many of the same considerations for markings and maintenance procedures.
However there may be other considerations that need to be addressed in the certification plan, such as gas absorbed by the fuel and the effect of the gas absorbed on the fuel system performance, such as suction feed performance.
(4) FRM designs that reduce the oxygen concentration to very low levels during cruise and increase the flow of nitrogen enriched air (NEA) into the fuel tank during decent have been found to optimize the design. One nitrogen inerting system designed for retrofit into airplanes with limited air sources has a dual flow mode that takes into consideration the performance of the air separation modules (see paragraph 4e(12) of this AC). During cruise the system operates at low flow mode where high nitrogen concentration NEA is introduced into the fuel tank to lower the oxygen concentration to very low levels. During decent the system is operated in high flow mode where the flow rate of NEA is increased. At high flow rates the nitrogen concentration of the NEA is lower.
(5) Oxygen Level. The accepted practice for tank inerting used by the military for a nitrogen based system is to reduce the oxygen concentration in the tank ullage to less than 9 percent. Data obtained from military testing that was conducted in 1991 (see paragraph 4e(7) of this AC), as well as FAA testing (see paragraph 4e(8) of this AC), shows that 12 percent oxygen concentration at sea level, will provide sufficient protection for transport category airplanes when using nitrogen based systems. As stated in the definitions paragraph of this AC, a fuel tank is considered to be inert when the bulk average oxygen concentration within each compartment of the fuel tank is 12 percent or less from sea level up to 10,000 feet altitude, then linearly increasing from 12 percent at 10,000 feet to 14.5 percent at 40,000 feet altitude, and extrapolated linearly above that altitude.
g. Oxygen Evolution. Fuel loaded on the airplane from sources vented to the atmosphere contains dissolved oxygen. Systems added to inert fuel tanks must take into account the dissolved and entrained oxygen in the fuel when loaded onto the airplane.
The applicant can either design the system to allow and compensate for the evolution of the oxygen or include provisions to remove or “scrub” the oxygen from the fuel during refueling. The effect of oxygen that may rapidly evolve from the fuel during pressure reduction conditions, such as during climb, must be accounted for in the Monte Carlo 28
Model. Section 4.3 of the User’s Manual discusses how oxygen evolution should be treated in the Monte Carlo analysis when an FRM using inerting is developed.
NOTE: An FAA ground and flight test program evaluated the effectiveness of inerting a center wing fuel tank with a ground based nitrogen enriched air supply without a closed vent system. The testing included measuring the effects of oxygen evolution. The results of the test progr am are contained in FAA Report, Ground and Flight Testing of a Boeing 737 Center Wing Fuel Tank Inerted with Nitrogen Enriched Air, Report # DOT/FAA/AR-01/63, (July 2001). The report is available on the internet at http://www.fire.tc.faa.gov/pdf/01-63.pdf.
h. Overnight Temperature Change. As the airplane sits overnight, the temperature will change accompanied by an associated density change of the fuel tank ullage.
Usually, the change in temperature is downward from the last flight of the day to the first flight the next day. The result is that the fuel tank will “breathe in” additional air as the ullage density increases. The applicant must take this effect into consideration.
Appendix N defines the required distribution the applicant must use in a Monte Carlo analysis to determine the change in temperature. The starting temperature is the temperature of the ullage at the end of the last flight as determined by the validated thermal model. The ending temperature is the ambient outside temperature before the next flight after an overnight temperature change. The applicant must substantiate the number of flights per day for a particular airplane and apply the overnight temperature change effect once “per day” in the FRM module developed by the applicant for the Monte Carlo analysis. Some airplane operations (such as executive jets) result in routine operations with consecutive days of overnight temperature changes that may cause the oxygen concentration in the fuel tanks to be elevated so the tank is no longer inert. The effects of consecutive overnight temperature changes on FRM performance should be provided by the DAH in the airplane operating and maintenance instructions.
i. Other Considerations Related to Oxygen. The applicant should consider any other environmental conditions or airplane system that may have an effect on the oxygen concentration within the fuel tank in question. Some existing fuel tank vent systems are designed to vent to both wing tips. For a fuel tank that may be vented to both sides of the airplane, the applicant must consider the effects of pressure differences across the wing and the resulting cross flow through the tank. Differential pressures created during maneuvers, between the vents located near each wing tip result in significant flow of air through the fuel tank and can result in adverse effects on an FRM that is based upon limiting oxygen concentrations. Installation of check features, such as a lightly loaded check valve in the vent system, or limiting the venting to one vent outlet have been shown to limit cross-flow. Any changes to an existing airplane vent system must meet the associated regulations (e.g., §§ 25.975 and 25.979). For example, one factor that needs to be considered is possible increases in fuel tank bottom pressures during refueling conditions due to any additional pressure losses resulting from modifications to the vent system. When inerting is used as the means of compliance, the inert gas distribution system must be shown to be effective in all compartments of a fuel tank. The 29
design may be optimized by incorporation of features to maintain even distribution of the inerting gas.
j. Compliance Demonstration. Flight test demonstration and analysis will be required to demonstrate the effectiveness of the inerting system (see appendix 5 for information on measurement of oxygen concentrations in airplane fuel tanks). The demonstration should include critical conditions and demonstration that the inerting system reduces the oxygen concentration in the tank to an acceptable level, without leaving pockets of oxygen concentrations above the maximum level within the tank.
Where the applicant uses inerting as one part of an overall method to reduce flammability (for example inerting in combination with tank temperature control), the applicant should demonstrate the effectiveness of each part of the overall method independently, as well as in combination to show overall effectiveness at meeting the flammability requirements.
(1) The amount of flight testing that is acceptable for showing compliance depends upon the proposed method of compliance. For example, an applicant may choose to develop an FRM performance model and then substantiate by airplane testing that the model accurately predicts the system performance. An applicant may also choose to define the critical points in the airplane operating envelope and then conduct flight test conditions at the critical points to show compliance.
(2) For an inerting-based FRM that is effective at preventing fuel tank flammability during normal airplane operating conditions, the demonstration that would be needed may be limited to providing substantiation that the distribution system is effective at inerting all sections of the tank, that the system provides adequate flow, and that the reliability of the system meets the overall requirements.
(3) In addition, the applicant must substantiate that the added system meets the installation requirements of part 25.
k. System Reliability Considerations.
(1) The overall time the fuel tank is flammable cannot exceed 3 percent of the Flammability Exposure Evaluation Time (FEET), which is the total time, including both ground and flight time, considered in the flammability assessment defined in appendix N. As a portion of this 3 percent, if flammability reduction means (FRM) are used, each of the following time periods cannot exceed 1.8 percent of the FEET: (a) when any FRM is operational but the fuel tank is not inert and the tank is flammable; and (b) when any FRM is inoperative and the tank is flammable.
(2) Master Minimum Equipment List (MMEL) Interval. Inerting systems designed as a flammability reduction means are considered part of a balanced fuel tank safety approach together with design features incorporated to prevent ignition sources in fuel tanks. These FRM are not considered flight critical and airplanes may be eligible for dispatch under the MMEL with the FRM inoperative. The FAA Flight Operations Evaluation Board (FOEB) will establish the MMEL dispatch relief interval for the FRM 30
based on data submitted by the applicant to the FAA. This value should reflect the value the applicant uses in the reliability analysis and the requirements of appendix N25.3(d)(2), which states that if dispatch with the system inoperative under the MMEL is requested, the time period assumed in the reliability analysis must be 60 flight hours for a 10-day MMEL dispatch limit unless an alternative period has been approved by the Administrator. The FOEB may accept a system reliability analysis using the Monte Carlo Model. As shown in section 3.2 of the User’s Manual, inputs needed to conduct an analysis include, mean time between failures (MTBF) of the FRM, average time to restore the system function after it is placed on the Minimum Equipment List (MEL), and the number of flights before a failed FRM would be detected. These inputs are discussed in more detail in the User’s Manual.
(3) Reliability Reporting. The regulation requires that the applicant demonstrate effective means to ensure collection of FRM reliability data so that the effects of component failures can be assessed on an on-going basis. The reporting requirement is contained in appendix M, paragraph M25.5, and applies to applicants and DAH.
(4) The rule requires the TC or STC holder to provide the FAA with summaries of the FRM reliability data in compliance with appendix M to part 25 on a quarterly basis for the first five years after the FRM is installed and operational. After that time, continued quarterly reporting requirements may be replaced with other reliability tracking methods approved by the FAA Oversight Office. The requirement for quarterly reports may be eliminated if the FAA determines that the reliability of the FRM meets, and will continue to meet, the requirements of the rule.
(5) Operators are not required to report FRM reliability information. Type certificate holders are required to gather the needed data and may use existing reporting systems that are currently used for airplane maintenance, reliability, and warranty claims to gather the data from operators using existing business arrangements between the TC holders and the airlines.
(6) The reliability report should include information regarding overall system dispatch reliability, including identification of the component that caused the failure of the system, and the number of days on average the system was placed on the MMEL.
The report should be submitted to the FAA Oversight Office by a letter on a quarterly basis as required by the regulation.
l. Indications.
(1) Since inerting systems are considered a safety enhancing system, similar to a flight data recorder, no indication to the flightcrew of the flammability of the fuel tank, and associated flightcrew procedures for fuel tank flammability or oxygen concentration are specifically required by the regulation. The need to provide indication of the FRM status will depend on the particular FRM design. Various design methods may be used to make sure an FRM meets the reliability and performance requirements. These may 31
include a combination of system integrity monitoring and indication, redundancy of components, and maintenance actions. A combination of maintenance indication or maintenance check procedures could be used to limit exposure to latent failures within the system, or high inherent reliability may be used to make sure the system will meet the fuel tank flammability exposure requirements.
(2) The need for FRM indications and the frequency of checking system performance (maintenance intervals) must be determined as part of the FRM fuel tank flammability exposure analysis. The determination of a proper maintenance interval and procedure will follow completion of the certification testing and demonstration of the system’s reliability and performance prior to certification or as part of the FAA review process for airplanes manufactured under existing TC or auxiliary fuel tanks under existing STC.
(3) Appropriate maintenance level indications and limitations should be placed in the MMEL to maintain the reliability of the inerting system to the level required by the regulations. For example, maintenance level messages would likely be needed to meet the reliability requirements for an FRM to show when the system is not functioning properly so the inoperative interval that goes into the reliability analysis can be limited to short periods. Installation of an oxygen sensor to measure the oxygen concentration, and appropriate maintenance messages may be needed to meet reliability requirements or may be a desirable feature that may eliminate the need for frequent maintenance checks.
m. Inerting System Safety Considerations.
(1) For inerting systems that generate NEA on board, the waste gas may create additional fire hazards or change the hazards within certain areas of the airplane.
Therefore, these effects should be considered a potential hazard to the airplane. By the very nature of the process of separating nitrogen from air, the waste gas will be of a higher concentration of oxygen than normal air. Since higher concentrations of oxygen may lead to a greater likelihood of ignition, given the availability of fuel vapor and a spark, safety assessment and special precautions may be required.
(2) Inerting systems that use combustion or catalytic processes to produce inerting gas typically operate at elevated temperatures that may introduce hazards into the airplane design. These systems must be located and designed such that they comply with airplane fire protection regulations, such as § 25.863, etc.
(3) Special maintenance procedures may be required to meet the reliability and performance requirements for fuel tanks that utilize nitrogen inerting. Maintenance actions that require entry into a fuel tank that contains inert gas or an area adjacent to an inerted fuel tank may be hazardous if appropriate safety precautions are not utilized. The fuel tank should be ventilated and appropriate air source provided. Appropriate warning information should be included in the maintenance manuals and placards placed at fuel tank entry points warning maintenance personnel.
(4) Confined spaces are compartments or enclosures with limited openings for entry and exit, not intended for continuous human occupancy, and only suitable for temporary work such as inspections, maintenance, or repairs. A fuel tank has potential hazards that include toxic chemicals, insufficient oxygen with a concentration that is below 19.5 percent or excess oxygen that is above 23.5 percent, and a flammable gas, vapor, or mist in excess of 10 percent of its LFL. (Reference U.S. Department of Labor Occupational Safety & Health Administration (OSHA), 29 CFR §1910.146(b)). Specific procedures must be in place that identify, control, or eliminate these hazards prior to maintenance personnel entering into fuel tanks.
(5) A large percentage of the work involved in properly inspecting and modifying airplane fuel tanks and their associated systems must be done in the interior of the tanks. Performing the necessary tasks requires inspection and maintenance personnel to physically enter the tank, where environmental hazards exist. These hazards exist in any fuel tank (regardless of whether a nitrogen inerting system is installed) and include fire and explosion, toxic and irritating chemicals, oxygen deficiency, and the confinement to the fuel tank itself. To prevent related injuries, operator and repair station maintenance organizations have developed specific procedures for identifying, controlling, or eliminating the hazards of fuel-tank entry. In addition, government agencies have adopted safety requirements for use when entering fuel tanks and other confined spaces.
These same procedures along with additional markings would be applied to the reduced oxygen environment likely to be present in and adjacent to an inerted fuel tank.
(6) Confined and Adjacent Space Markings. The addition of a system that utilizes inerting to reduce the flammability of a fuel tank may result in reduced oxygen concentrations due to leakage of the inert gas in locations in the airplane where service personnel would not expect it.
(7 ) A worker is considered to have entered a confined space just by putting his or her head across the plane of the opening. If the confined space contains high concentrations of inert gases, workers who are simply working near the opening may be at risk. These gases may be under pressure because of the design of the inerting system, and any hazards associated with working in adjacent spaces near the opening, should be identified in the marking of the opening to the confined space.
(8) Introduction of NEA within the fuel tanks creates additional risks because of the possibility of NEA leaking into compartments adjacent to the fuel tanks. Lack of oxygen in these areas could be hazardous to maintenance personnel, and in some cases could affect the passengers, or flightcrew. Existing certification requirements address these hazards. Appendix M25.3(c) requires markings to emphasize the potential hazards associated with confined spaces and areas where a hazardous atmosphere could be present as a result of the addition of FRM. That paragraph requires that the access doors and panels to the fuel tanks with FRMs and to any other enclosed areas that could contain hazardous atmosphere under either normal conditions or failure conditions be permanently stenciled, marked, or placarded to warn of hazards.
(9) Fuel tanks are confined spaces and contain high concentrations of fuel vapors that must be exhausted from the fuel tank before entry. Other precautions such as measurement of oxygen concentrations before entering a fuel tank are already required.
(10) Designs currently being implemented locate the FRM in the fairing below the center wing fuel tank. Access to these areas is obtained by opening doors or removing panels which allow some ventilation of the spaces adjacent to the FRM.
Leakage of NEA into areas adjacent to the FRM equipment or tanks may create a hazard for maintenance personnel. Confined space hazards in the areas adjacent to the fuel tanks should be assumed unless it can be shown that adequate ventilation is provided so air quality for maintenance personnel is assured. Unless the design eliminates this hazard, markings should be provided to warn service personnel of possible hazards associated with the reduced oxygen concentrations in the areas adjacent to the FRM. Appropriate markings would be required for all inerted fuel tanks, tanks adjacent to inerted fuel tanks and all fuel tanks connected to the inerted tanks via plumbing. The plumbing includes, but is not limited to, plumbing for the vent system, fuel feed system, refuel system, transfer system and cross-feed system. The markings should also be stenciled on the external upper and lower surfaces of the inerted tank adjacent to any openings to ensure maintenance personnel understand the possible hazards of fuel vapors and lack of oxygen in and adjacent to the fuel tank.
(11) Markings/placards. The regulation requires that if an inerting system is installed on an airplane, the access doors and panels to the fuel tank(s) and any other enclosed areas that could contain hazardous atmosphere under either normal conditions or failure conditions must be permanently stenciled, marked, or placarded to warn of hazards. These placards would be considered CDCCL and should be included in the required markings section of the maintenance instructions.
The following is an example of wording that may be used:
• Low oxygen content possible during nitrogen generation system operation.
• Obey employer safety procedures.
• Failure to obey may cause injury.
FIGURE 2
Low Oxygen Level Placard