Appendix 1
TABLE 1-2
FAA Oversight Offices
Airplane manufacturer FAA Oversight Office Aerospatiale Transport Airplane Directorate, International Branch, ANM-116 Airbus Transport Airplane Directorate, International Branch, ANM-116 BAE Transport Airplane Directorate, International Branch, ANM-116 Boeing Seattle Aircraft Certification Office Bombardier New York Aircraft Certification Office CASA Transport Airplane Directorate, International Branch, ANM-116 deHavilland New York Aircraft Certification Office Dornier Transport Airplane Directorate, International Branch, ANM-116 Embraer Transport Airplane Directorate, International Branch, ANM-116 Fokker Transport Airplane Directorate, International Branch, ANM-116 Lockheed Atlanta Aircraft Certification Office McDonnell-Douglas Los Angeles Aircraft Certification Office SAAB Transport Airplane Directorate, International Branch, ANM-116
A1-2
Appendix 2 APPENDIX 2
DEVELOPING CRITICAL DESIGN CONFIGURATION CONTROL
LIMITATIONS - FUEL TANK FLAMMABILITY
1. Introduction. This appendix provides guidance for developing Critical Design Configuration Control Limitations (CDCCL) for fuel tank systems to prevent the fuel tank from exceeding the applicable flammability exposure limits established in the 2008 Fuel Tank Flammability Reduction (FTFR) rule. Guidance for developing CDCCLs to maintain ignition prevention features is located in AC 25.981-1B, Fuel Tank Ignition Source Prevention Guidelines, or the latest revision.
2. Definitions.
a. Aircraft Maintenance Manual (AMM). A manual developed by the manufacturer of a particular airplane that contains information necessary for the continued airworthiness of that airplane.
b. Airworthiness Limitation Item (ALI). Mandatory maintenance of the fuel system that can include CDCCL, inspections, or other procedures determined necessary to ensure, with respect to this AC, the fuel tank flammability exposure does not increase above the certification limits as a result of maintenance actions, repairs, or alterations throughout the operational life of the airplane.
c. Component Maintenance Manual (CMM). A manual developed by a manufacturer that contains information necessary for the continued airworthiness of a particular component.
d. Critical Design Configuration Control Limitations (CDCCL). A limitation requirement to preserve a critical design feature of a flammability reduction system or of the fuel system design that is necessary for the design to meet the performance standards of § 25.981 throughout the life of the airplane model. The purpose of the CDCCL is to provide instructions to retain the critical features during configuration changes that may be caused by alterations, repairs, or maintenance actions.
e. Instructions for Continued Airworthiness (ICA). The information documented in accordance with 14 CFR 25.1529 and 14 CFR part 25, appendix H that includes the applicable methods, inspections, processes, procedures, and airworthiness limitations required to keep the airplane airworthy throughout its operational life.
3. Discussion.
a. Critical Design Configuration Control Li mitations include those features of the design that must be present and maintained to achieve the safety level intended by § 25.981 for the operational life of the airplane. Changes to the airplane, such as installing a fuel re-circulation system, hydraulic heat exchanger in the fuel tank, or a heat source adjacent to the fuel tank, may affect fuel tank flammability exposure. A CDCCL would be necessary in this example to prohibit the addition of heat to the fuel tank.
A2-1
Appendix 2 Another example of a CDCCL might be limits on operation with certain fuel types such as JP-4. The CDCCL would also control or prohibit the kinds of modifications to airplanes, like modifications that affect the vent system of a fuel tank that has an FRM installed or the addition of auxiliary fuel tanks that vent into a fuel tank that has an FRM installed, that could adversely change the flammability exposure of fuel tanks to which it may be connected. All fuel tanks subject to the requirements of Amendment 25-125, even those in airplanes that do not have high flammability fuel tanks, will need to have CDCCL defined so that future modifications do not increase the flammability above the regulatory limit. Under part 26, CDCCL must also be provided for fuel tanks required to be modified by FRM or IMM. The application of CDCCL under the FTFR rule is similar to the requirements already applied to fuel tank ignition source prevention in Amendment 25-102 to § 25.981.
b. The FTFR also includes the requirement that visible means identifying CDCCL be present. This is required to prevent alterations to critical features of the system. As the visible identifications are critical to the FRM or IMM system, they are also considered to be CDCCL. Any tampering or removal would be in violation of the CDCCL. These CDCCLs, inspections, or other procedures would be documented as airworthiness limitations in the ICA.
c. The CDCCLs for fuel tank flammability include any information necessary to maintain those design features that have been determined by analysis of the fuel tank system (e.g., fault tree analysis, failure modes and effects analysis) as needed to maintain the performance of the FRM or IMM, or maintain the fuel tank flammability within the limits established by the applicable regulations. AC 25-981-1B (or latest revision) contains additional guidance on how to perform the analysis for ignition prevention CDCCLs. CDCCLs are intended to preclude the occurrence of any maintenance or inspection task or procedure that could result in a failure, malfunction, or defect that would compromise the intended function of the critical part, component or design feature that ensures the fuel tank flammability exposure does not exceed the regulatory limits.
This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the original type design of the fuel tank system.
CDCCLs may be required that define the critical features, such as:
• Flammability exposure of the unheated aluminum wing tank, and associated cooling rate,
• Limits on heat input such as adding heat blankets or additional hydraulic heat exchangers,
• Limits on how an auxiliary fuel tank is integrated with an existing airplane fuel tank system, such as limiting venting into a tank with FRM based upon inerting or transferring warm fuel from the auxiliary tank,
• Limits on airplane systems such as minimum quantity of engine bleed air flow or electricity that is required to supply power to an FRM,
• Limits on use of high volatility fuels such as JP-4,
• Quantity of engine bleed air flow that is used for inerting, A2-2
Appendix 2
• Limits on penetrations of the fuel tank,
• Limits on any changes to fuel management that may affect FRM,
• Limits on changes to any placards or means used to visibly identify critical design features of the fuel tank system that must not be compromised for the operational life of the airplane,
• Life limits on parts such as polyurethane foam used as an IMM, and the air separation modules used in an inerting system.
d. Airworthiness limitations are part of the ICA. Design approval holders (DAH) need to make available to affected parties pertinent changes to the ICAs. (The term “make available” is used in the same sense that it is used in § 21.50.) The rule is not intended to alter or interfere with the existing commercial relationships between TC holders and these other persons. The FAA anticipates that DAHs would be able to be reasonably compensated for developing these documents, as they are under current practice.
e. The rule requires creation of an Airworthiness Limitations Section (ALS), unless previously established. The ALS is required by current part 25 and includes those items that have mandatory inspection or replacement times related to fuel systems and structure. The ALS is included in the ICA, approved as part of type certification, and distributed with an airplane on delivery. In this way the ALS is visible to all who need it and who would be required to comply with it under §§ 121.917, 125.509 and 129.117.
For those airplanes that currently do not have an ALS, the rule requires an ALS only for fuel tank safety related limits. This rule does not require that the ALS for these airplanes include the other requirements for an ALS established under Amendment 25-54 to part 25, or a later amendment. For those DAH or applicants with airplanes certified to Amendment 25-54 or later, the existing ALS would be revised to include the fuel tank system ALI.
f. The ICA developed by the DAH using the guidance in this advisory circular must be approved by the responsible FAA Oversight Office. Those approved instructions are required by related operational rules to be used by operators to develop and propose changes in their maintenance programs and incorporate design changes needed to maintain the fuel tank flammability within the approved limits and to ensure continued airworthiness of certain features of the FRM and IMM for the operational life of the airplane. These changes to the maintenance programs must be reviewed and approved by the operator’s designated FAA inspector or Principal Inspector.
4. Development of Critical Design C onfiguration Control Limitations.
a. The CDCCLs, which are a type of Airworthiness Limitation, are the primary means of managing and controlling the configuration of the FRM, IMM or design features that affect the flammability of any fuel tank that does not require an FRM or IMM. In the context of this AC, CDCCLs provide limitation requirements for configuration management to preserve the integrity of certain critical flammability features of the fuel tank system design. These critical features are essential to ensure fuel A2-3
Appendix 2 tank flammability does not increase above limits defined in the regulations as a result of configuration changes caused by maintenance action, repair, or alteration of those critical features. While initial inspections may be necessary to ensure that a CDCCL has not been compromised (e.g., because of aging, wear, maintenance, alterations, etc.), they are not intended to require repetitive inspections. Rather the intent of the CDCCL is to ensure that all affected maintenance personnel are aware of the need to make sure the configuration identified by the CDCCL is preserved for the operational life of the airplane.
b. The DAH may determine that the CDCCLs are applicable at the individual part level or at the component level. In the context of this guidance, components are assembled from parts. Design approval holders may elect to identify a CDCCL that applies to the component for the purposes of reducing tracking of ALIs that may apply to individual parts of the component. If the component level is used, the design approval holder is responsible for revising the CMM instructions to identify all of the critical features of the component design for approval by the FAA Oversight Office.
c. To identify the parts or components to which the CDCCLs are applicable, the DAH must first conduct a configuration assessment of the fuel tank system design. The purpose is to identify any foreseeable maintenance or inspection actions or other causes that could compromise the configuration of a critical feature of the fuel tank system. In the context of this guidance, foreseeable causes are those that have occurred in service in the past or those that engineering judgment predicts could compromise the critical feature of a part or component of a fuel tank system. The DAH must develop maintenance and inspection instructions to prevent those foreseeable changes to the design configuration of the critical ignition source prevention features.
d. Airworthiness Limitations Section Content. The ALIs should include the following:
• The Limitation Statements shown below,
• A brief description of the flammability reduction, ignition mitigation means features,
• The flammability issue associated with inadvertent changes to the configuration of each of those design features, and
• The reference to maintenance instructions, if applicable, and other information in manuals (such as airplane maintenance, standard wire practices manual, etc.,) that have been revised or created to advise affected personnel of the CDCCLs.
e. Limitation Statement: The Critical Design Configuration Control Limitation statements are as follows:
A2-4
Appendix 2 LIMITATIONS.
(1) The critical features of the parts or components identified in the CDCCLs must be maintained in a configuration identical to an approved type design for the airplane.
(2) Any repairs or overhauls to the critical features of the parts or components that are identified must be maintained in accordance with the design approval holder’s maintenance manual or with other acceptable repair or overhaul specifications and parts approved by the FAA Oversight Office specifically for that part or component.
(3) In cases where the critical features of a component are specified, any test equipment or tooling utilized to repair or overhaul the component must be in accordance with the CMM or otherwise comply with 14 CFR 43.13(a) and be substantiated and documented as equivalent.
5. Identification and Awareness of CDCCLs.
a. The DAH should list the parts components or features to which the CDCCLs are applicable for a particular airplane in the service information (e.g., maintenance planning document or special certification item document) documenting the CDCCL. This is the mechanism for identifying critical features and requiring their control. To ensure that the operator introducing a modification or the mechanic is aware of the need to consider these critical features, it will be necessary to insert cross-references in certain documents to comply with the CDCCLs.
(1) The DAH should identify a task with WARNING or CAUTION notes for a component or part that has a critical design feature in the AMM. The operator should incorporate acceptable procedures to ensure compliance with the CDCCLs.
(2) The DAH should include information in standard practices manuals to ensure the CDCCL information is provided to those making modifications or maintaining the type design. (see AC 25-26, Development of Standard Wiring Practices Documentation (11/14/07) for guidance on preparation of these manuals).
(3) The DAH should identify the appropriate CMM. In addition, the design approval holder should ensure that a statement is inserted into both the CMM and the Airplane Maintenance Manual that the component is controlled by the CDCCL and, therefore, that it may be repaired or overhauled only in accordance with the CMM or other acceptable maintenance procedures and parts approved by the FAA Aircraft Certification Office.
(4) These documents should include a statement that the part, component or design feature component is controlled by the CDCCL and, therefore, that it may be A2-5
Appendix 2 repaired or overhauled only in accordance with the CMM or other acceptable maintenance procedures approved by the FAA Oversight Office.
A2-6
Appendix 3 APPENDIX 3 COMPLIANCE WITH PART 26, SUBPART D, SECTIONS 26.33 AND 26.35
1. Section 26.33 Holders of type certificates: Fuel tank flammability. This section requires TC holders of certain large transport category airplanes described below to analyze the flammability exposure of all their affected airplanes’ fuel tanks and develop service instructions for those tanks that exceed limits defined in the rule. For example, a TC holder of an affected airplane with any fuel tank that is determined by the analysis to have high flammability exposure (over 7 percent) is required to develop service instructions for IMM or FRM to reduce the flammability exposure of the fuel tank. If the fuel tank is normally emptied and any portion of the fuel tank is located within the fuselage contour, § 26.33(c)(1)(i) requires the FRM meet the flammability exposure criteria of appendix M of part 25. For all other fuel tanks with a flammability exposure over 7 percent, § 26.33(c)(1)(ii) requires the FRM meet the flammability criteria of appendix M except instead of complying with paragraph M25.1 of the appendix the fleet average flammability exposure may not exceed 7 percent. The affected TC holders would also be required to submit compliance plans for the flammability analysis and the development of service instructions for an FRM or IMM. The due dates for items required by this regulation are as follows:
Rule effective 9/19/08 Compliance plan for flam.
analysis 12/18/08 Flam.
analysis completed 2/16/09 Compliance plan for design change and service instructions 4/17/09
FRM/IMM service instructions, ICAs, ALS 9/20/10 Draft of compliance items 7/22/10 90 days 60 days 60 days 15 months 60 days
FIGURE 3-1
Compliance Timeline for TC Holders (§ 26.33) A3-1
Appendix 3
a. Applicability. Section 26.33(a) states that this rule applies to “U.S. type certificated transport category, turbine-powered airplanes, other than those designed solely for all-cargo operations, for which the State of Manufacture issued the original certificate of airworthiness or export airworthiness approval on or after January 1, 1992, that, as a result of original type certification or later increase in capacity have:
(1) A maximum type-certificated passenger capacity of 30 or more, or
(2) A maximum payload capacity of 7,500 pounds or more.”
(1) The reference to the originally certificated capacity, or later increase in capacity, is intended to address two situations:
(a) In the past, some designers and operators have gotten design change approval for a slightly lower capacity to avoid applying requirements mandated only for airplanes over specified capacities. By referencing the capacity resulting from original certification, this rule removes this possible means of avoiding compliance.
(b) It is also possible that an airplane design could be originally certified with a capacity slightly lower than the minimum specified in this section, but through later design changes, the capacity could be increased above this minimum. The reference to later increases in capacity ensures that, if this occurs, the design would have to meet the requirements of this section.
(2) Maximum payload capacity is defined in 14 CFR 119.3, Definitions. Also see the reference in paragraph 4e(15) of this AC.
(3) Foreign Type Certificate Holders. This paragraph applies not only to domestic TC holders, but also to foreign TC holders. In this sense, this section is different from most type certification programs, where foreign applicants typically work with their responsible certification authority, and the FAA relies, to some degree, upon that authority’s findings of compliance under bilateral agreements. Since this rulemaking is not harmonized in all cases, the FAA will initially retain the authority to make all the necessary compliance determinations, and where appropriate, may request certain compliance determinations by the appropriate foreign authorities using procedures developed under the bilateral agreements. The compliance planning provisions of this section (discussed later) are equally important for domestic and foreign TC holders and applicants, and we will work with the foreign authorities to ensure that their TC holders and applicants perform the planning necessary to comply with the requirements of this section.
b. Flammability Determination and Service Instructions.
(1) Flammability Analysis. Section 26.33(b) requires holders of TCs for large transport category airplanes to submit a flammability exposure analysis for approval by the FAA oversight office by December 18, 2008. Section 26.33(b)(2) provides an A3-2
Appendix 3 exception to the flammability analysis requirement for fuel tanks for which the TC holder has notified the FAA that it will provide design changes and service instructions for an FRM or IMM meeting the requirements of § 26.33(c).
(2) Model Variations and Derivatives.
(a) Section 26.33(b) specifies that the flammability analysis must include “all fuel tanks defined in the type design, as well as all design variations approved under the type certificate that affect flammability exposure.” Design variations that may affect fuel tank flammability could include changing the fuel tank volume or usable fuel capacity, changes in the fuel management procedures, engine changes that might affect parameters such as airplane climb rate or bleed air available if needed by an FRM. Other examples of configuration differences that may affect fuel tank flammability exposure are provided in the discussion of § 26.35. It would also include all modifications and changes mandated by airworthiness directives (AD) that affect fuel tank flammability exposure as of the effective date of the rule. These ADs would only be those issued against any configurations developed by TC holders. This would include any ADs issued against modifications defined by a third party STC installed on affected airplanes. The result would be a configuration that is clearly understood by both industry and the FAA.
(b) An example of a design variation is an airplane certificated with the same model and series designation that could have different maximum takeoff gross weights, changes in fuel tank configuration or engine type or thrust, equipment installations, or passenger versus all-cargo carrying capabilities. Derivatives, in most cases, are those model airplanes that historically incorporate significant design changes from the original approved type design. In general, these derivative models would have to comply with later airworthiness standards for those areas incorporating the significant design changes. The derivative models are listed on the same TC data sheet with the original certificated model. Various segments of industry have also defined these changes as “variants.” For the purpose of this regulation, we consider the terms “derivatives” and “variants” to be synonymous.
(3) Service Instructions and Service Bulletins. If the flammability exposure analysis shows that the average exposure for any fuel tank exceeds 7 percent, § 26.33(c) requires the TC holder to develop design changes and service instructions for either FRM or IMM. Modifications incorporated into existing airplanes, including safety related changes (design and/or maintenance) that are mandated by AD, are typically made by operators using service instructions developed by the TC holders. These service instructions are commonly referred to as service bulletins. In this regulation, service instructions must contain sufficient information for the operator to incorporate the design change and any associated procedures and airworthiness limitations. They may include specific step-by-step procedures and information needed by the operator, such as parts lists, drawings, etc. Therefore, the paragraph requires TC holders to develop and submit for approval by the FAA, not just data defining a proposed design change, but a package of complete information that includes all of the information necessary to enable an operator to comply with the operational rules, discussed later. This information should A3-3
Appendix 3 be formatted and completed to a point similar to what would be submitted to the FAA if the FAA were to be issuing a mandatory action.
(4) Flammability Levels.
(a) The guidance in this paragraph applies to the new FRM or IMM requirements of § 25.981(b) and (c), and appendix M, to existing fuel tanks that exceed 7 percent average flammability exposure. For any fuel tank that is normally emptied and exceeds 7 percent average flammability exposure, if any portion of the tank is located in the fuselage contour, the rule requires TC holders to develop IMM or FRM that reduces the flammability exposure to 3 percent average flammability exposure and 3 percent warm day requirements of appendix M. The warm day requirement would limit the average flammability exposure of the tank for each of the ground, takeoff and climb phases of the airplane operation during warm days to 3 percent average flammability exposure. The flammability exposure limit for these particular tanks has been established in consideration of the service experience that shows these tanks to have a higher risk for fuel tank explosion than other tanks. For all other fuel tanks located in other portions of the airplane (for example, the wing and empennage), the proposal would require TC holders to develop IMM or FRM that reduces the flammability exposure below 7 percent and apply the requirements for an FRM of subparagraph M25.2, M25.3, M25.4 of appendix M if an FRM is selected as the means of compliance. This rule is not expected to result in the need for FRM or IMM in any fuel tanks located in the wings of airplanes in the existing fleet because previous assessments estimate these tanks have flammability exposure below 7 percent. However, the analysis required by this rule may reveal some fuel tanks located within the wing that exceed 7 percent.
(b) The definition of tanks that are normally emptied and auxiliary fuel tanks used in this section are the same as that discussed in the preamble to the flammability reduction rulemaking associated with this AC.
c. Compliance Times.
(1) Section 26.33(d) requires submitting for approval by the FAA oversight office the design changes and service instructions required by § 26.33(c) by September 20, 2010.
(2) The compliance times stated in this section are also used as the basis for the compliance dates for introduction of these systems into the operators’ fleets under parts 121, 125, and 129. Extension of the compliance dates for development of the service instructions by the certificate holders would either reduce the amount of time available to operators or delay full deployment of these safety improvements. Incorporation of FRM or IMM will likely require access inside the fuel tanks. Typically fuel tanks are only accessed during heavy maintenance checks that are done on a schedule established during development of the maintenance program. The compliance dates for the operational rules were established to allow a majority of the modifications to be done during these heavy maintenance checks. Introduction of FRM or IMM outside of normally scheduled A3-4
Appendix 3 maintenance would increase the cost to the operators because extra tank entry and airplane down time would be needed.
d. Critical Design Configuration Control Limitations.
(1) Section 26.33(e) requires that for fuel tanks equipped with FRM or IMM, holders of TCs affected by this section must establish airworthiness limitations consisting of CDCCL, inspections, or other procedures. The purpose of these limitations is, for tanks equipped with FRM, to prevent increasing the flammability exposure of the tanks above that permitted under § 26.33 and, for tanks equipped with IMM, to prevent degradation of the performance of the IMM installed in accordance with this section.
Appendix 2 of this AC provides additional guidance regarding development of CDCCL.
For example, certain fuel tanks may rely on natural cooling or use of certain fuel types to meet the flammability levels required by the rule. Therefore, CDCCL may be required that define the critical features, such as—
• flammability exposure of the unheated aluminum wing tank,
• cooling rate,
• limits on heat input,
• limits on use of high volatility fuels such as JP-4,
• quantity of engine bleed air flow that is used for inerting,
• limits on penetrations of the fuel tank,
• limits on any changes to fuel management that may affect FRM,
• limits on changes to any placards or means used to visibly identify critical design features of the fuel tank system that must not be compromised for the operational life of the airplane.
(2) Instructions for Continued Airworthiness. As discussed below, airworthiness limitations, such as those in this section, are part of the ICA. Section 21.50 requires that TC holders make changes to the ICA available to persons required to comply with them.
As used throughout this notice, the term “make available” is used in the same sense that it is used in § 21.50.
e. Airworthiness Limitations.
(1) Section 26.33(f) requires creation of an ALS, unless previously established.
The ALS is required by current part 25 and includes those items that have mandatory inspection or replacement times related to fuel systems and structure. The ALS is included in the ICA, approved as part of certification, and distributed with an airplane on delivery. In this way the ALS is visible to all who need it and who would be required to comply with it under §§ 121.1117, 125.509 and 129.117 of this rule. The current part 25 ALS and ICA requirements apply only to airplane types originally certified after Amendment 25-54 (adopted in 1981) and were developed for structural considerations.
As a result, they are not applicable to many current airplanes and do not currently contain information for other systems.
A3-5