Appendix 3 maintenance would increase the cost to the operators because extra tank entry and airplane down time would be needed.
d. Critical Design Configuration Control Limitations.
(1) Section 26.33(e) requires that for fuel tanks equipped with FRM or IMM, holders of TCs affected by this section must establish airworthiness limitations consisting of CDCCL, inspections, or other procedures. The purpose of these limitations is, for tanks equipped with FRM, to prevent increasing the flammability exposure of the tanks above that permitted under § 26.33 and, for tanks equipped with IMM, to prevent degradation of the performance of the IMM installed in accordance with this section.
Appendix 2 of this AC provides additional guidance regarding development of CDCCL.
For example, certain fuel tanks may rely on natural cooling or use of certain fuel types to meet the flammability levels required by the rule. Therefore, CDCCL may be required that define the critical features, such as—
• flammability exposure of the unheated aluminum wing tank,
• cooling rate,
• limits on heat input,
• limits on use of high volatility fuels such as JP-4,
• quantity of engine bleed air flow that is used for inerting,
• limits on penetrations of the fuel tank,
• limits on any changes to fuel management that may affect FRM,
• limits on changes to any placards or means used to visibly identify critical design features of the fuel tank system that must not be compromised for the operational life of the airplane.
(2) Instructions for Continued Airworthiness. As discussed below, airworthiness limitations, such as those in this section, are part of the ICA. Section 21.50 requires that TC holders make changes to the ICA available to persons required to comply with them.
As used throughout this notice, the term “make available” is used in the same sense that it is used in § 21.50.
e. Airworthiness Limitations.
(1) Section 26.33(f) requires creation of an ALS, unless previously established.
The ALS is required by current part 25 and includes those items that have mandatory inspection or replacement times related to fuel systems and structure. The ALS is included in the ICA, approved as part of certification, and distributed with an airplane on delivery. In this way the ALS is visible to all who need it and who would be required to comply with it under §§ 121.1117, 125.509 and 129.117 of this rule. The current part 25 ALS and ICA requirements apply only to airplane types originally certified after Amendment 25-54 (adopted in 1981) and were developed for structural considerations.
As a result, they are not applicable to many current airplanes and do not currently contain information for other systems.
A3-5
Appendix 3
(2) For those TC holders of airplanes that currently do not have an ALS, the regulation only requires establishing an ALS to include fuel tank safety related limits.
This would not require that the ALS for these airplanes include the other requirements for an ALS established under Amendment 25-54 to part 25, or a later amendment. For those TC holders or applicants with airplanes certified to Amendment 25-54 or later, the existing ALS would be revised to include the fuel tank system ALI.
f. Compliance Planning.
(1) Historically, the FAA has worked together with the TC holders when safety issues arise to identify solutions and actions that need to be taken. Some of the safety issues that have been addressed by this process include those involving aging aircraft structure, thrust reversers, cargo doors, and wing icing protection. In some cases service instructions have not been developed in a timely manner. While some manufacturers have addressed these safety issues and developed service instructions, others have not applied the resources necessary to develop service instructions in a timely manner. This has caused delay in the adoption of corrective action(s). The compliance planning requirements of § 26.33(g) and (h) are intended to provide TC holders and the FAA with assurance that they understand what means of compliance is acceptable and have taken necessary actions, including assigning sufficient resources, to achieve compliance with this section. This paragraph is based substantially on “The FAA and Industry Guide to Product Certification,” which describes a process for developing project-specific certification plans for type certification programs. This Guide may be found in the docket. This planning requirement would not apply to future applicants for TC because, as described in the Guide, this type of planning routinely occurs at the beginning of the certification process. (Additional information is available in the Order referenced in paragraph 4e(14).)
(2) The Guide recognizes the importance of ongoing communication and cooperation between applicants and the FAA. Section 26.33, while regulatory in nature, is intended to encourage establishment of the same type of relationship in the process of complying with this section.
(a) Compliance Plan for Flammability Exposure Analysis. Section
26.33(g) requires submittal of a compliance plan within 90 days after September 19, 2008, for the flammability exposure analysis required by this section. The intent of the proposal is to promote early planning and communication between the certificate holders and the FAA. The affected design approval holders would be required to submit a compliance plan that addresses the following:
1 A proposed schedule, identifying all major milestones, for meeting the flammability analysis compliance date of this rule or a determination that compliance with § 26.33(b) of this section is not required because design changes and service instructions for FRM or IMM will be developed and made available as required by § 26.33.
A3-6
Appendix 3 2 If required, a proposed means of performing a flammability exposure analysis.
(b) Compliance Plan for Design Changes and Service Instructions.
1 Section 26.33(h) requires that each holder of a TC required to comply with § 26.33(c) must submit to the FAA oversight office a compliance plan for their project within 210 days after September 19, 2008. In addition to items corresponding to those required for the compliance plan in § 26.33(g), this plan requires--
(aa) A proposal for submitting a draft of all compliance items required by § 26.33(d), (e) and (f) for review by the FAA oversight office not less than 60 days before the compliance times specified in the rules, and
(bb) A proposed means of compliance with this section, identifying all required deliverables, including all compliance items and all data to be developed to substantiate compliance. If the TC holder has already initiated compliance, the FAA oversight office will review the results of those efforts to ensure that the results are acceptable.
(cc) A proposal for how the approved service information and any necessary modification parts will be made available to affected persons.
2 This section is intended to ensure that affected persons and the FAA have a common understanding and agreement of what is necessary to achieve compliance with this section. Integral to the compliance plan will be the inclusion of procedures to allow the FAA to monitor progress toward compliance. These aspects of the plan will help ensure that the expected outcomes will be acceptable and on time. The schedule for the availability of the service information and any required parts is critical to the affected operators ability to schedule the modification of their airplanes and make changes to their maintenance or inspection programs in accordance with the operational rules. We would expect each TC holder to work with the FAA oversight office to develop a plan to create the required service instructions within the specified time. The plan should include periodic reviews with the FAA office.
3 The success of this fuel tank safety initiative hinges upon the timely development of service instructions and production incorporation of FRM or IMM by the affected certificate holders. If service instructions are not available when required, operators will not be able to begin incorporation of the FRM or IMM into their fleet as their airplanes undergo normally scheduled maintenance checks. Delay in availability of the service instructions could result in the need for operators to do unscheduled maintenance to comply with the operational requirements, resulting in significant unnecessary cost.
g. Section 26.33(j) requires that affected type certificate holders implement the compliance plans, as approved under that section. It allows for revisions to the plans, if A3-7
Appendix 3 approved, but such revisions would still have to result in compliance by the specified compliance dates.
2. Section 26.35 Changes to type certificates affecting fuel tank flammability : This section addresses changes to TCs, including installing auxiliary fuel tanks, changes in the capacity of fuel tanks, and changes that may increase the fuel tank flammability exposure of an existing fuel tank that is required by § 26.33(c) to incorporate either a FRM or IMM. An auxiliary fuel tank installed by STC or field approval may result in adverse effects on any FRM or IMM developed by the TC holder as required by § 26.33. This section requires those affected to conduct a flammability exposure analysis of their design, an impact assessment to determine any adverse impact their design may have on tanks for which CDCCL are required, and development of design changes to address adverse changes in flammability exposure. The dates for demonstrating compliance are shown as follow:
TC holders – Service instructions (including CDCCL) submittal date 9/20/10 14 months 4 months 2 months 14 months 60 days Rule effective 9/19/08 Compliance plan for flam.
analysis 12/18/08 Flam.
analysis completed 9/20/09 Impact assessment plan 11/19/10 Impact assessment 3/21/11 FIMM plan 5/19/11 90 days 9 months FIMM draft items 7/21/12 Final FIMM items 9/19/12
FIGURE 3-2 Compliance Timeline for Holders and Applicants of Changes to Certificates (§ 26.35)
a. Applicability. Paragraph 26.35 (a) states that this section applies to holders and applicants for approvals of the following design changes to any airplane subject to § 26.33(a):
• For holders of STCs or field approvals issued before September 19, 2008, and for applicants for STCs or amendments to TCs applied for before September 19, 2008, if the approval was not issued before A3-8
Appendix 3 September 19, 2008, this section applies to installation of a Normally Emptied fuel tank.
• For applicants for STCs or amendments to TCs applied for on or after September 19, 2008, this section applies to installation of a Normally Emptied fuel tank, changes to fuel tank capacity, and changes that may increase the flammability exposure of an existing fuel tank for which FRM or IMM is required by § 26.33 (c).
(1) Existing STCs and Field Approvals. For existing STCs and field approvals, this proposal excludes design changes other than for Normally Emptied fuel tank installations. (Field approvals are no longer issued for fuel tank installations.) The meaning of “Normally Emptied” fuel tank is explained earlier in the discussion of §
25.981 and in paragraph 5 of this AC. As discussed in the background section of the preamble to the flammability rulemaking associated with this AC, SFAR 88 included review of all changes to the airplane that could result in the development of ignition sources. We reviewed the fuel system related STCs in the fleet and did not identify any changes that would significantly increase fuel tank flammability. Therefore we have determined that application of this rule to current STC holders, other than those relating to auxiliary fuel tank installations, would not improve fuel tank safety.
(2) Pending Applications for STCs and TC Amendments to TCs. Except for applications that are pending as of September 19, 2008, for installation of Normally Emptied fuel tanks, pending applications for design change approvals were excluded from the final rule. Under § 26.35(d)(2), applicants with pending applications for design changes to install Normally Emptied fuel tanks must comply with § 25.981 at Amendment
25-125.
(3) Future Applicants for STCs or TC amendments.
(a) Auxiliary Fuel Tanks Installed Under STC or amendment to TC.
The regulation applies to design changes for which application is made on or after September 19, 2008, to install auxiliary fuel tanks on large transport category airplanes subject to the part 26 rule. The applicability list is included in appendix 1 to this AC.
These design changes must be shown to comply with § 25.981, as discussed previously in this AC. For example, the center wing box structure on some versions of certain airplane models did not originally carry fuel, but later models of the airplane may include fuel in these areas. This would be considered to be a change to add a new fuel tank, and compliance with § 25.981 would be required.
(b) Design Changes Affecting Fuel Tank Capacity. An applicant may propose to change the size of sections to an existing fuel wing tank or change the useable fuel capacity in an existing tank. Both increases and decreases in fuel tank capacity must be addressed. Under § 26.35(d)(3), these applicants must comply with the requirements of § 26.33. For example, the applicant must perform a flammability exposure analysis for the modified tank and, if the exposure exceeds 7 percent, the applicant must include FRM or IMM, as required by § 26.33.
A3-9
Appendix 3
(c) Design Changes that May Increase Fuel Tank Flammability Exposure of Tanks for which FRM or IMM are Required. Examples of design changes that may increase fuel tank flammability exposure include installation of hydraulic or electronics system heat exchangers in a fuel tank, installation of heater blankets on the wing, modification of the fuel management that results in changes in fuel tank flammability, installation of a fuel re-circulation system that transfers heat from the engine to the fuel tank, or changes to the flight manual to use lower flash point fuels such as JP-4 or Russian or Chinese fuels. As discussed below, applicants for these types of design changes must perform an impact assessment and, if applicable CDCCL are compromised, develop flammability impact mitigation means.
b. Compliance Times. Section 26.35(b) establishes a timeframe in which the affected persons must submit for approval (to the FAA oversight office) a flammability exposure analysis for their design changes. The rule includes a 12-month timeframe to complete the analysis for existing STCs. Any applicant whose STC or TC amendment is not approved within 12 months after September 19, 2008, would have to complete the analysis before approval.
c. Flammability Analysis.
(1) Supplemental type certificate holders or applicants affected by this section would need to conduct a flammability analysis using the method defined in appendix N of the rule. A number of inputs are required to conduct this analysis. Airplane specific data, such as flight length distributions or airplane climb rate, may not be readily available from the original TC holder. We intend the STC holders to obtain the information by working with the operators of airplanes that have their STC installed.
Applicants would need to work with prospective customers. Operators have business agreements with the original TC holders and access to information they obtained when they purchased the airplane. Conservative assumptions or business agreements with the original TC holders are other possible methods of gathering airplane type specific data needed for the analysis.
(2) The flammability analysis required by this § 26.35(b) is intended to identify applications for fuel tank installations that would require incorporation of FRM or IMM or that may increase the flammability exposure of such tanks. As discussed in the preamble to this rule, for existing fuel tank STCs, the flammability analysis is needed to determine if future action should be taken to address auxiliary fuel tanks installed under STCs or field approvals. Additional analysis after obtaining the CDCCL from the TC holder and developing any FIMM, is necessary to demonstrate that the final configuration complies with the applicable flammability analysis requirements and does not violate the CDCCL defined by the original TC holder.
(3) For design changes that may increase the flammability of fuel tanks equipped with FRM or IMM for which compliance with applicable CDCCL must be shown, the purpose of the requirement to perform flammability analyses is to ensure that A3-10
Appendix 3 the change does not increase flammability exposure in ways that were not anticipated when the CDCCL were developed. If an applicant can show that the design would have no such effect, it may be possible to avoid performance of a full analysis per appendix N through substantiating an equivalent level of safety finding.
d. Impact Assessment.
(1) Section 26.35 requires affected persons1 to submit for approval (to the FAA oversight office) an impact assessment of the fuel tank system, as modified by their design change. The purpose of this requirement is to identify any features of the modification to the original type design that may violate the critical design configuration control limitations developed by the original TC holder under § 26.33(d). For example, if an FRM that utilizes inerting were incorporated into an airplane, a CDCCL would likely be developed that would limit venting of air into the fuel tank because it could introduce oxygen into the tank, resulting in a flammable vapor space. In this case the STC holder would need to assess its design and identify any violation of the CDCCL identified for the FRM. Results from the analysis would be provided to the FAA in the form of a report or summary letter.
(2) Holders of STCs and field approvals for fuel tanks designed to be normally emptied on airplane models listed in Table 3-1 have to submit the safety assessment by March 21, 2011. This date is six months after the TC holder is required to establish their CDCCLs. Applicants for STCs and for amendments to type certificates whose design changes are not approved within that six-month period would have to submit the assessment before approval of the change. Once the CDCCLs are approved, the TC holder is required to make them available to other affected persons, including those subject to this section.
1 This refers to STC holders for auxiliary fuel tanks as of September 19, 2008, and future applicants for design changes that may increase flammability exposure of tanks for which FRM or IMM are required.
A3-11
Appendix 3
TABLE 3-1
AFFECTED AIRPLANE MODELS
Model – Boeing 747 Series 737 Series 777 Series 767 Series 757 Series Model – Airbus A318, A319, A320, A321 Series A300, A310 Series A330, A340 Series
e. Development of Service Instructions. Section 26.35(d) requires development of design changes and service instructions as stated in § 26.35 (d)(1), (d)(2) and (d)(3).
(1) Section 26.35(d)(1) affects persons required to prepare impact assessments, described in the previous paragraph. It includes requirements that apply if the impact assessment shows that a design change compromises any CDCCL applicable to any airplane on which the change is eligible for installation. The holder or applicant would have to develop a means, referred to as a Flammability Impact Mitigation Means (FIMM), to comply with all applicable CDCCLs. FIMM could include either additional design changes or limitations or other procedures. If FIMM are necessary, the applicant or holder would also have to show that their design change, as modified by the FIMM, would still meet the other requirements of this section. For example, § 26.35(d) requires that the flammability analysis for an existing auxiliary fuel tank, as modified by FIMM, would have to be accomplished per § 26.35(b). This paragraph is necessary to ensure that the safety improvements in this rule are not degraded by later design changes.
(2) Section 26.35(d)(2) requires applicants for STCs and amended TCs for installation of a Normally Emptied tank, to meet the requirements of § 25.981 in effect on September 19, 2008 if—
(a) the application is made before September 19, 2008 and the approval was not issued before September 19, 2008, or
(b) the application was made on or after September 19, 2008,
(3) Section 26.35(d)(3) requires applicants for a STC or an amendment to a type certificate made on or after September 19, 2008, that changes the capacity of an A3-12
Appendix 3 existing tank to comply with the requirements of § 26.33, Holders of type certificates:
Fuel tank flammability, as discussed in paragraph 1 of this appendix.
(4) Various methods described in this AC are available for meeting the flammability exposure requirements. The exact modifications needed to comply depend upon specific details of the particular design and choices made by the designers. The most likely solutions include inerting, cooling of the tank, installation of polyurethane foam and pressurizing the tank similar to other tanks that use air pressure for fuel transfer.
f. Compliance Times for Design Changes and Service Instructions . Section
26.35(e) establishes timeframes in which holders of STCs and field approvals and applicants for STCs and amendments to TCs must comply with the requirements of §
26.35(d). Supplemental type certificate holders and holders of field approvals would be required to comply by September 19, 2012, which is 24 months after the TC holder compliance date for § 26.33(c). Applicants for STCs and amendments to TCs whose applications are pending on September 19, 2008, would have to comply before the FAA would issue their approval.
g. Compliance Planning. Section 26.35(f) requires compliance plans for the actions required by this section. Compliance planning is discussed earlier in this appendix with guidance for § 26.33. Because STC holders and applicants would need the TC holders’ CDCCLs to comply with paragraphs (c) and (d) of this section, the compliance times for submitting those plans provide adequate time after the TC holders are required to comply with § 26.33. The compliance planning dates are given in Table 2 of § 26.35(f), which is shown below.
h. Section 26.35(g) requires that affected holders and applicants implement the compliance plans, as approved under that section. It allows for revisions to the plans, if approved, but such revisions would still have to result in compliance by the specified compliance dates.
TABLE 3-2
COMPLIANCE PLANNING DATES
Flammability Exposure Analysis Plan Impact Assessment Plan Design Changes and Service Instructions Plan STC and Field Approval Holders December 18, 2008 November 19, 2010 May 19, 2011
A3-13
Appendix 4
APPENDIX 4
CONSIDERATIONS FOR FUEL TANK THERMAL MODELS
1. The type of thermal model that is needed to show compliance will depend upon the method of compliance selected for the different requirements. For fuel tanks shown to have equivalent flammability to that of an unheated aluminum wing fuel tank, a fuel tank thermal model may not be needed if the qualitative flammability assessment method defined in paragraph 11 of this AC is used. For other tanks where specific flammability levels must be shown, thermal modeling will be needed if fuel temperature affects fuel tank flammability. This appendix provides guidance for validating the thermal modeling of a fuel tank. It is based on using in the Monte Carlo Model defined by the User’s Manual (defined in paragraph 4e(11) of this AC). As stated in paragraph 4.1 of the User’s Manual, if flight test data or a detailed analysis of the fuel tank’s thermal behavior shows that this method cannot yield an accurate representation of the actual fuel tank’s fuel temperature profile, then modification of the thermal model code in the Monte Carlo model is necessary.
2. Validating fuel tank thermal coefficients, “Tau,” for use in the Monte Carlo Model.
a. When a fuel tank is heated or cooled by a change in air temperature, the response of the fuel temperature is to increase or decrease, respectively, following an exponential decay law. On the ground, air temperature is considered to be ambient temperature at the airplane location, and in flight it will be the Total Air Temperature (TAT) experienced by the airplane. This exponential trend is driven by the temperature difference between the fuel and TAT, and the response of the mass of the fuel and tank.
It can be represented by the system exponential decay time constant Tau, and an equilibrium temperature that the fuel temperature will eventually reach. The equilibrium temperature for a totally unheated tank will be very close to the air temperature, and can be expressed as a temperature difference from ambient temperature on the ground and TAT in flight. For this method, the temperature difference will be called Delta T.
b. By taking data from a flight test, the values for Tau and Delta T can be approximated as a function of fuel load and air temperature. This method requires recording fuel tank temperatures and TAT at regular intervals during critical operational ground and flight test conditions so that the fuel tank thermal characteristics can be established.
3. Compliance Testing. Testing should include ground and flight conditions with variable fuel quantities, and any heat transfer from airplane generated sources to the fuel tank at the critical conditions. The Monte Carlo Model includes the capability to use 6 different Tau values, and sufficient testing to confirm the validity of each of the values used in the model should be done. In addition, the thermal characteristics of the critical A4-1
Appendix 4 portion of the fuel tank relative to formation of flammable vapors should be used in the Monte Carlo Model and validated by the testing. Baffling incorporated into most fuel tanks results in segmented volumes that may significantly affect heat transfer and, therefore, the flammability within the tank volume. If barriers or walls result in separate volumes within the tank and prevent mixing of the fuel and/or vapors in the tank, then each of these volumes should be evaluated independently to determine the worst case exposure for that tank. The validation may include a qualitative assessment of the heat sources (warm fuel transfer, hydraulic heat exchanges, fuel return lines, ECS packs, etc.)
and thermal characteristics of different portions of the fuel tank to substantiate critical location for the test evaluation of the Taus.
a. Temperature Measurement. The location of test instrumentation should consider tank configuration and operational factors to determine which locations in the fuel tank require evaluation. The fuel temperature should be measured at critical locations in the tank for each of the critical fuel loading conditions. If an FRM that limits ullage oxygen concentration is included in the design, test instrumentation should be located in critical locations of the ullage to support analysis of the ullage density changes and it’s effect on ullage oxygen concentration. The locations of fuel and ullage test temperature sensors should take into consideration any structural barriers or baffles that may divide the tank into regions that may have different thermal characteristics.
b. Test Conditions. The applicant should conduct sufficient ground and/or flight testing that simulates the actual operation of the airplane type so that a validated fuel tank thermal model can be developed that will accurately model the fuel tank. Fuel tank temperatures should be measured so that the change in bulk average fuel temperature in each affected tank on the ground and in-flight versus time can be determined. The minimum number of test conditions needed to validate the thermal modeling of the fuel tank will depend upon the number of variables that may affect the fuel tank temperature.
For example, a minimum of two test flights would be required, one representative of a short mission for the airplane and one representative of a long mission for a typical CWT design so that variability in mission length, gate time and fuel quantities could be addressed. The short mission should include at least 30 minutes of ground operation prior to flight, and the long mission at least 90 minutes of ground operation prior to flight. For the entire mission (i.e., from the start-up of airplane systems to completion of the flight), temperatures should be recorded in the test tank(s) at locations to represent the bulk fuel temperature in each separate section of the test tank(s) unless less a qualitative assessment shows that fewer locations can be justified. For this discussion, TAT is used to represent ambient temperature on the ground and TAT in flight. The fuel temperature and TAT should be recorded at least once per minute. The test program should be designed to address the fuel tank thermal response as a function of day type including testing on warm days to understand the fuel tank thermal response when the tank is most likely to be flammable.
4. Example of a Flight Test. The sample flight test shown below is an illustration of how to demonstrate that the bulk average fuel temperature modeling used in the Monte Carlo Model, based upon use of Time Constant Tau, is acceptable for the particular tank A4-2
Appendix 4 under evaluation. The fight test shown is for a hypothetical aluminum wing tank on a long-range airplane. The data includes operational time before and after the flight as required by the method. The fuel temperature is recorded every minute and the bulk average fuel tank temperature is then determined from the test data. (Data at 10 minute intervals is shown for the example, to save space.) The Tau value is estimated for a full tank and decreased as the fuel is burned off in flight. Using the value of Tau, the tank bulk average fuel temperatures can be estimated using the exponential decay equation, (the term “Fuel Temp” in the equations is an abbreviation for “bulk average fuel temperature”):
(Fuel Temp change in time t)/(Fuel Temp-TAT)= 1-e (-t/Tau) This can also be written as:
Fuel Temp change in time t = (Fuel Temp-TAT) x (1-e (-t/Tau)) The resultant estimated fuel temperature is then compared to the actual and the Tau values corrected until a satisfactory match is obtained. This can be done manually or using a computer solver approach. If there is no heating of the tank, the Tau values can be obtained directly. If there is significant heating of the tank, the equilibrium temperature can be found by increasing the value for TAT to (TAT + Delta T), where Delta T is the tank equilibrium temperature offset from TAT. In this case, both the values for Tau and Delta T must be found for the tank. The Tau used in the Monte Carlo Model should be shown to predict fuel tank temperatures with an error of less than 3 degrees for a period of time not to exceed 5 minutes. If the accuracy does not meet this level, the applicant may choose to use a Tau that is adjusted so that the predicted temperature would be higher and produce a conservative flammability level or propose an alternative method of modeling fuel tank temperatures.
A4-3