inerting system is effective, as well as consideration of the fuel tank flammability, may be part of the overall compliance demonstration.
(3) The applicant may show that inerting is only needed for certain missions, for example during warmer days when the fuel ullage would be flammable, or parts of a particular flight to lower the fuel tank vapor/air mixture average exposure to a level that meets the flammability limit. Inerting may be achieved by supplying inert gas from onboard storage bottles, holding either gas or liquid inerting agent, on board inert gas generation systems (OBIGGS), or from a ground storage system if the tank is inerted only on the ground. Nitrogen is currently the inert gas of choice for inerting fuel tanks and the requirements in the § 25.981 address the requirements for use of nitrogen based inerting systems. Use of other gases, such as carbon dioxide, to inert a fuel tank would include many of the same considerations for markings and maintenance procedures.
However there may be other considerations that need to be addressed in the certification plan, such as gas absorbed by the fuel and the effect of the gas absorbed on the fuel system performance, such as suction feed performance.
(4) FRM designs that reduce the oxygen concentration to very low levels during cruise and increase the flow of nitrogen enriched air (NEA) into the fuel tank during decent have been found to optimize the design. One nitrogen inerting system designed for retrofit into airplanes with limited air sources has a dual flow mode that takes into consideration the performance of the air separation modules (see paragraph 4e(12) of this AC). During cruise the system operates at low flow mode where high nitrogen concentration NEA is introduced into the fuel tank to lower the oxygen concentration to very low levels. During decent the system is operated in high flow mode where the flow rate of NEA is increased. At high flow rates the nitrogen concentration of the NEA is lower.
(5) Oxygen Level. The accepted practice for tank inerting used by the military for a nitrogen based system is to reduce the oxygen concentration in the tank ullage to less than 9 percent. Data obtained from military testing that was conducted in 1991 (see paragraph 4e(7) of this AC), as well as FAA testing (see paragraph 4e(8) of this AC), shows that 12 percent oxygen concentration at sea level, will provide sufficient protection for transport category airplanes when using nitrogen based systems. As stated in the definitions paragraph of this AC, a fuel tank is considered to be inert when the bulk average oxygen concentration within each compartment of the fuel tank is 12 percent or less from sea level up to 10,000 feet altitude, then linearly increasing from 12 percent at 10,000 feet to 14.5 percent at 40,000 feet altitude, and extrapolated linearly above that altitude.
g. Oxygen Evolution. Fuel loaded on the airplane from sources vented to the atmosphere contains dissolved oxygen. Systems added to inert fuel tanks must take into account the dissolved and entrained oxygen in the fuel when loaded onto the airplane.
The applicant can either design the system to allow and compensate for the evolution of the oxygen or include provisions to remove or “scrub” the oxygen from the fuel during refueling. The effect of oxygen that may rapidly evolve from the fuel during pressure reduction conditions, such as during climb, must be accounted for in the Monte Carlo 28
Model. Section 4.3 of the User’s Manual discusses how oxygen evolution should be treated in the Monte Carlo analysis when an FRM using inerting is developed.
NOTE: An FAA ground and flight test program evaluated the effectiveness of inerting a center wing fuel tank with a ground based nitrogen enriched air supply without a closed vent system. The testing included measuring the effects of oxygen evolution. The results of the test progr am are contained in FAA Report, Ground and Flight Testing of a Boeing 737 Center Wing Fuel Tank Inerted with Nitrogen Enriched Air, Report # DOT/FAA/AR-01/63, (July 2001). The report is available on the internet at http://www.fire.tc.faa.gov/pdf/01-63.pdf.
h. Overnight Temperature Change. As the airplane sits overnight, the temperature will change accompanied by an associated density change of the fuel tank ullage.
Usually, the change in temperature is downward from the last flight of the day to the first flight the next day. The result is that the fuel tank will “breathe in” additional air as the ullage density increases. The applicant must take this effect into consideration.
Appendix N defines the required distribution the applicant must use in a Monte Carlo analysis to determine the change in temperature. The starting temperature is the temperature of the ullage at the end of the last flight as determined by the validated thermal model. The ending temperature is the ambient outside temperature before the next flight after an overnight temperature change. The applicant must substantiate the number of flights per day for a particular airplane and apply the overnight temperature change effect once “per day” in the FRM module developed by the applicant for the Monte Carlo analysis. Some airplane operations (such as executive jets) result in routine operations with consecutive days of overnight temperature changes that may cause the oxygen concentration in the fuel tanks to be elevated so the tank is no longer inert. The effects of consecutive overnight temperature changes on FRM performance should be provided by the DAH in the airplane operating and maintenance instructions.
i. Other Considerations Related to Oxygen. The applicant should consider any other environmental conditions or airplane system that may have an effect on the oxygen concentration within the fuel tank in question. Some existing fuel tank vent systems are designed to vent to both wing tips. For a fuel tank that may be vented to both sides of the airplane, the applicant must consider the effects of pressure differences across the wing and the resulting cross flow through the tank. Differential pressures created during maneuvers, between the vents located near each wing tip result in significant flow of air through the fuel tank and can result in adverse effects on an FRM that is based upon limiting oxygen concentrations. Installation of check features, such as a lightly loaded check valve in the vent system, or limiting the venting to one vent outlet have been shown to limit cross-flow. Any changes to an existing airplane vent system must meet the associated regulations (e.g., §§ 25.975 and 25.979). For example, one factor that needs to be considered is possible increases in fuel tank bottom pressures during refueling conditions due to any additional pressure losses resulting from modifications to the vent system. When inerting is used as the means of compliance, the inert gas distribution system must be shown to be effective in all compartments of a fuel tank. The 29
design may be optimized by incorporation of features to maintain even distribution of the inerting gas.
j. Compliance Demonstration. Flight test demonstration and analysis will be required to demonstrate the effectiveness of the inerting system (see appendix 5 for information on measurement of oxygen concentrations in airplane fuel tanks). The demonstration should include critical conditions and demonstration that the inerting system reduces the oxygen concentration in the tank to an acceptable level, without leaving pockets of oxygen concentrations above the maximum level within the tank.
Where the applicant uses inerting as one part of an overall method to reduce flammability (for example inerting in combination with tank temperature control), the applicant should demonstrate the effectiveness of each part of the overall method independently, as well as in combination to show overall effectiveness at meeting the flammability requirements.
(1) The amount of flight testing that is acceptable for showing compliance depends upon the proposed method of compliance. For example, an applicant may choose to develop an FRM performance model and then substantiate by airplane testing that the model accurately predicts the system performance. An applicant may also choose to define the critical points in the airplane operating envelope and then conduct flight test conditions at the critical points to show compliance.
(2) For an inerting-based FRM that is effective at preventing fuel tank flammability during normal airplane operating conditions, the demonstration that would be needed may be limited to providing substantiation that the distribution system is effective at inerting all sections of the tank, that the system provides adequate flow, and that the reliability of the system meets the overall requirements.
(3) In addition, the applicant must substantiate that the added system meets the installation requirements of part 25.
k. System Reliability Considerations.
(1) The overall time the fuel tank is flammable cannot exceed 3 percent of the Flammability Exposure Evaluation Time (FEET), which is the total time, including both ground and flight time, considered in the flammability assessment defined in appendix N. As a portion of this 3 percent, if flammability reduction means (FRM) are used, each of the following time periods cannot exceed 1.8 percent of the FEET: (a) when any FRM is operational but the fuel tank is not inert and the tank is flammable; and (b) when any FRM is inoperative and the tank is flammable.
(2) Master Minimum Equipment List (MMEL) Interval. Inerting systems designed as a flammability reduction means are considered part of a balanced fuel tank safety approach together with design features incorporated to prevent ignition sources in fuel tanks. These FRM are not considered flight critical and airplanes may be eligible for dispatch under the MMEL with the FRM inoperative. The FAA Flight Operations Evaluation Board (FOEB) will establish the MMEL dispatch relief interval for the FRM 30
based on data submitted by the applicant to the FAA. This value should reflect the value the applicant uses in the reliability analysis and the requirements of appendix N25.3(d)(2), which states that if dispatch with the system inoperative under the MMEL is requested, the time period assumed in the reliability analysis must be 60 flight hours for a 10-day MMEL dispatch limit unless an alternative period has been approved by the Administrator. The FOEB may accept a system reliability analysis using the Monte Carlo Model. As shown in section 3.2 of the User’s Manual, inputs needed to conduct an analysis include, mean time between failures (MTBF) of the FRM, average time to restore the system function after it is placed on the Minimum Equipment List (MEL), and the number of flights before a failed FRM would be detected. These inputs are discussed in more detail in the User’s Manual.
(3) Reliability Reporting. The regulation requires that the applicant demonstrate effective means to ensure collection of FRM reliability data so that the effects of component failures can be assessed on an on-going basis. The reporting requirement is contained in appendix M, paragraph M25.5, and applies to applicants and DAH.
(4) The rule requires the TC or STC holder to provide the FAA with summaries of the FRM reliability data in compliance with appendix M to part 25 on a quarterly basis for the first five years after the FRM is installed and operational. After that time, continued quarterly reporting requirements may be replaced with other reliability tracking methods approved by the FAA Oversight Office. The requirement for quarterly reports may be eliminated if the FAA determines that the reliability of the FRM meets, and will continue to meet, the requirements of the rule.
(5) Operators are not required to report FRM reliability information. Type certificate holders are required to gather the needed data and may use existing reporting systems that are currently used for airplane maintenance, reliability, and warranty claims to gather the data from operators using existing business arrangements between the TC holders and the airlines.
(6) The reliability report should include information regarding overall system dispatch reliability, including identification of the component that caused the failure of the system, and the number of days on average the system was placed on the MMEL.
The report should be submitted to the FAA Oversight Office by a letter on a quarterly basis as required by the regulation.
l. Indications.
(1) Since inerting systems are considered a safety enhancing system, similar to a flight data recorder, no indication to the flightcrew of the flammability of the fuel tank, and associated flightcrew procedures for fuel tank flammability or oxygen concentration are specifically required by the regulation. The need to provide indication of the FRM status will depend on the particular FRM design. Various design methods may be used to make sure an FRM meets the reliability and performance requirements. These may 31
include a combination of system integrity monitoring and indication, redundancy of components, and maintenance actions. A combination of maintenance indication or maintenance check procedures could be used to limit exposure to latent failures within the system, or high inherent reliability may be used to make sure the system will meet the fuel tank flammability exposure requirements.
(2) The need for FRM indications and the frequency of checking system performance (maintenance intervals) must be determined as part of the FRM fuel tank flammability exposure analysis. The determination of a proper maintenance interval and procedure will follow completion of the certification testing and demonstration of the system’s reliability and performance prior to certification or as part of the FAA review process for airplanes manufactured under existing TC or auxiliary fuel tanks under existing STC.
(3) Appropriate maintenance level indications and limitations should be placed in the MMEL to maintain the reliability of the inerting system to the level required by the regulations. For example, maintenance level messages would likely be needed to meet the reliability requirements for an FRM to show when the system is not functioning properly so the inoperative interval that goes into the reliability analysis can be limited to short periods. Installation of an oxygen sensor to measure the oxygen concentration, and appropriate maintenance messages may be needed to meet reliability requirements or may be a desirable feature that may eliminate the need for frequent maintenance checks.
m. Inerting System Safety Considerations.
(1) For inerting systems that generate NEA on board, the waste gas may create additional fire hazards or change the hazards within certain areas of the airplane.
Therefore, these effects should be considered a potential hazard to the airplane. By the very nature of the process of separating nitrogen from air, the waste gas will be of a higher concentration of oxygen than normal air. Since higher concentrations of oxygen may lead to a greater likelihood of ignition, given the availability of fuel vapor and a spark, safety assessment and special precautions may be required.
(2) Inerting systems that use combustion or catalytic processes to produce inerting gas typically operate at elevated temperatures that may introduce hazards into the airplane design. These systems must be located and designed such that they comply with airplane fire protection regulations, such as § 25.863, etc.
(3) Special maintenance procedures may be required to meet the reliability and performance requirements for fuel tanks that utilize nitrogen inerting. Maintenance actions that require entry into a fuel tank that contains inert gas or an area adjacent to an inerted fuel tank may be hazardous if appropriate safety precautions are not utilized. The fuel tank should be ventilated and appropriate air source provided. Appropriate warning information should be included in the maintenance manuals and placards placed at fuel tank entry points warning maintenance personnel.
(4) Confined spaces are compartments or enclosures with limited openings for entry and exit, not intended for continuous human occupancy, and only suitable for temporary work such as inspections, maintenance, or repairs. A fuel tank has potential hazards that include toxic chemicals, insufficient oxygen with a concentration that is below 19.5 percent or excess oxygen that is above 23.5 percent, and a flammable gas, vapor, or mist in excess of 10 percent of its LFL. (Reference U.S. Department of Labor Occupational Safety & Health Administration (OSHA), 29 CFR §1910.146(b)). Specific procedures must be in place that identify, control, or eliminate these hazards prior to maintenance personnel entering into fuel tanks.
(5) A large percentage of the work involved in properly inspecting and modifying airplane fuel tanks and their associated systems must be done in the interior of the tanks. Performing the necessary tasks requires inspection and maintenance personnel to physically enter the tank, where environmental hazards exist. These hazards exist in any fuel tank (regardless of whether a nitrogen inerting system is installed) and include fire and explosion, toxic and irritating chemicals, oxygen deficiency, and the confinement to the fuel tank itself. To prevent related injuries, operator and repair station maintenance organizations have developed specific procedures for identifying, controlling, or eliminating the hazards of fuel-tank entry. In addition, government agencies have adopted safety requirements for use when entering fuel tanks and other confined spaces.
These same procedures along with additional markings would be applied to the reduced oxygen environment likely to be present in and adjacent to an inerted fuel tank.
(6) Confined and Adjacent Space Markings. The addition of a system that utilizes inerting to reduce the flammability of a fuel tank may result in reduced oxygen concentrations due to leakage of the inert gas in locations in the airplane where service personnel would not expect it.
(7 ) A worker is considered to have entered a confined space just by putting his or her head across the plane of the opening. If the confined space contains high concentrations of inert gases, workers who are simply working near the opening may be at risk. These gases may be under pressure because of the design of the inerting system, and any hazards associated with working in adjacent spaces near the opening, should be identified in the marking of the opening to the confined space.
(8) Introduction of NEA within the fuel tanks creates additional risks because of the possibility of NEA leaking into compartments adjacent to the fuel tanks. Lack of oxygen in these areas could be hazardous to maintenance personnel, and in some cases could affect the passengers, or flightcrew. Existing certification requirements address these hazards. Appendix M25.3(c) requires markings to emphasize the potential hazards associated with confined spaces and areas where a hazardous atmosphere could be present as a result of the addition of FRM. That paragraph requires that the access doors and panels to the fuel tanks with FRMs and to any other enclosed areas that could contain hazardous atmosphere under either normal conditions or failure conditions be permanently stenciled, marked, or placarded to warn of hazards.
(9) Fuel tanks are confined spaces and contain high concentrations of fuel vapors that must be exhausted from the fuel tank before entry. Other precautions such as measurement of oxygen concentrations before entering a fuel tank are already required.
(10) Designs currently being implemented locate the FRM in the fairing below the center wing fuel tank. Access to these areas is obtained by opening doors or removing panels which allow some ventilation of the spaces adjacent to the FRM.
Leakage of NEA into areas adjacent to the FRM equipment or tanks may create a hazard for maintenance personnel. Confined space hazards in the areas adjacent to the fuel tanks should be assumed unless it can be shown that adequate ventilation is provided so air quality for maintenance personnel is assured. Unless the design eliminates this hazard, markings should be provided to warn service personnel of possible hazards associated with the reduced oxygen concentrations in the areas adjacent to the FRM. Appropriate markings would be required for all inerted fuel tanks, tanks adjacent to inerted fuel tanks and all fuel tanks connected to the inerted tanks via plumbing. The plumbing includes, but is not limited to, plumbing for the vent system, fuel feed system, refuel system, transfer system and cross-feed system. The markings should also be stenciled on the external upper and lower surfaces of the inerted tank adjacent to any openings to ensure maintenance personnel understand the possible hazards of fuel vapors and lack of oxygen in and adjacent to the fuel tank.
(11) Markings/placards. The regulation requires that if an inerting system is installed on an airplane, the access doors and panels to the fuel tank(s) and any other enclosed areas that could contain hazardous atmosphere under either normal conditions or failure conditions must be permanently stenciled, marked, or placarded to warn of hazards. These placards would be considered CDCCL and should be included in the required markings section of the maintenance instructions.
The following is an example of wording that may be used:
• Low oxygen content possible during nitrogen generation system operation.
• Obey employer safety procedures.
• Failure to obey may cause injury.
FIGURE 2
Low Oxygen Level Placard
FIGURE 3
Confined Space Placard
12. Ignition Mitigation Means (IMM).
The following are acceptable means to mitigate the effects of an explosion.
a. One means to meet § 25.981 is to protect a tank from structural and systems damage that could prevent continued safe flight and landing of the airplane. This alternative recognizes that an applicant may choose to accept a high flammability exposure in a given tank and to provide additional protection to extinguish or suppress an explosion in a tank if an ignition occurs.
b. The use of appropriate foams to fill the fuel tank and thereby control the pressure rise following an ignition of the fuel vapor/air mixture has been demonstrated to be effective by the United States Air Force (USAF) and other military forces. Foams are in use on several civilian transport category airplane types. Detailed design information regarding use of reticulated polyurethane safety foam for explosion suppression is provided in the report referenced in paragraph 4d(1) of this AC. The applicant may use such a foam installation to satisfy the requirement of § 25.981. The foam type should be demonstrated to be effective in suppressing explosions to a level where structural and system damage is prevented. The applicant should:
(1) Provide data on the foam, including material, pore size, and intended method for installing the foam in the tank.
(2) Address the potential for, and the effects of, degradation of the foam, from any environmental effects and long term aging, on both the airplane and engine fuel systems. If the foam has a limited useful life, particular installation requirements, or other features that are essential for the IMM to perform its intended function, they should be defined as CDCCLs.
(3) Address the effects of the foam installation on fuel system performance, including engine feed, venting, unusable fuel, sump capacity, expansion space capacity, fueling, and defueling, including the effect of the foam on electrostatic buildup in the tank.
(4) Address the effect of the foam installation on the airplane fuel system, as well as the auxiliary power unit (APU) and engine fuel systems, and develop maintenance procedures to ensure the foam is correctly installed, both initially and when reinstalled, if removed for access to the tank.
/s/ Ali Bahrami
Ali Bahrami Manager, Transport Airplane Directorate Aircraft Certification Service 39