Department of Transportation - California Institute of ...€¦ · rotating components in the fuel tank, such as a steel fuel pump impeller rubbing on the pump inlet check valve.

Monday,

May 7, 2001

Part II

Department ofTransportationFederal Aviation Administration

14 CFR Part 21 et al.Transport Airplane Fuel Tank SystemDesign Review, Flammability Reductionand Maintenance and InspectionRequirements; Final Rule

VerDate 11<MAY>2000 18:54 May 04, 2001 Jkt 194001 PO 00000 Frm 00001 Fmt 4717 Sfmt 4717 E:\FR\FM\07MYR2.SGM pfrm11 PsN: 07MYR2

23086 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Parts 21, 25, 91, 121, 125, and129

[Docket No. FAA–1999–6411; AmendmentNos. 21–78, 25–102, 91–266, 121–282, 125–36, 129–30]

RIN 2120–AG62

Transport Airplane Fuel Tank SystemDesign Review, FlammabilityReduction, and Maintenance andInspection Requirements

AGENCY: Federal AviationAdministration (FAA), DOT.ACTION: Final rule.

SUMMARY: This rule requires designapproval holders of certain turbine-powered transport category airplanes,and of any subsequent modifications tothese airplanes, to substantiate that thedesign of the fuel tank system precludesthe existence of ignition sources withinthe airplane fuel tanks. It also requiresdeveloping and implementingmaintenance and inspectioninstructions to assure the safety of thefuel tank system. For new type designs,this rule also requires demonstratingthat ignition sources cannot be presentin fuel tanks when failure conditions areconsidered, identifying any safety-critical maintenance actions, andincorporating a means either tominimize development of flammablevapors in fuel tanks or to preventcatastrophic damage if ignition doesoccur. These actions are based onaccident investigations and adverseservice experience, which have shownthat unforeseen failure modes and lackof specific maintenance procedures oncertain airplane fuel tank systems mayresult in degradation of design safetyfeatures intended to preclude ignition ofvapors within the fuel tank.EFFECTIVE DATE: June 6, 2001.FOR FURTHER INFORMATION CONTACT:Michael E. Dostert, FAA, Propulsion/Mechanical Systems Branch, ANM–112,Transport Airplane Directorate, AircraftCertification Service, 1601 Lind AvenueSW., Renton, Washington 98055–4056;telephone (425) 227–2132, facsimile(425) 227–1320; e-mail:[email protected].

SUPPLEMENTARY INFORMATION:

Availability of Final Rules

You can get an electronic copy usingthe Internet by taking the followingsteps:

(1) Go to the search function of theDepartment of Transportation’s

electronic Docket Management System(DMS) Web page (http://dms.dot.gov/search).

(2) On the search page type in the lastfour digits of the Docket number shownat the beginning of this notice. Click on‘‘search.’’

(3) On the next page, which containsthe Docket summary information for theDocket you selected, click on the finalrule.

(4) To view or download thedocument click on either ‘‘ScannedImage (TIFF)’’ or ‘‘Adobe PDF.’’

You can also get an electronic copyusing the Internet through FAA’s webpage at http://www.faa.gov/avr/arm/nprm/nprm.htm or the FederalRegister’s web page at http://www.access.gpo.gov/su_docs/aces/aces140.html.

You can also get a copy by submittinga request to the Federal AviationAdministration, Office of Rulemaking,ARM–1, 800 Independence AvenueSW., Washington, DC 20591, or bycalling (202) 267–9680. Make sure toidentify the amendment number ordocket number of this final rule.

Small Business Regulatory EnforcementFairness Act

The Small Business RegulatoryEnforcement Fairness Act (SBREFA) of1996 requires FAA to comply withsmall entity requests for information oradvice about compliance with statutesand regulations within its jurisdiction.Therefore, any small entity that has aquestion regarding this document maycontact their local FAA official, or theperson listed under FOR FURTHERINFORMATION CONTACT. You can find outmore about SBREFA on the Internet atour site, http://www.gov/avr/arm/sbrefa.htm. For more information onSBREFA, e-mail us at 9–AWA–[email protected].

BackgroundOn October 26, 1999, the FAA issued

Notice of Proposed Rulemaking (NPRM)99–18, which was published in theFederal Register on October 29, 1999(64 FR 58644). That notice proposedthree separate requirements:

First, a requirement was proposed forthe design approval holders of certaintransport category airplanes to conducta safety review of the airplane fuel tanksystem and to develop specific fuel tanksystem maintenance and inspectioninstructions for any items determined torequire repetitive inspections ormaintenance.

Second, a requirement was proposedto prohibit the operation of thoseairplanes beyond a specified time,unless the operators of those airplanes

incorporated instructions formaintenance and inspection of the fueltank system into their inspectionprograms.

Third, for new designs, the proposalincluded a requirement for minimizingthe flammability of fuel tanks, arequirement concerning detailed failureanalysis to preclude the presence ofignition sources in the fuel tanks andincluding mandatory fuel systemmaintenance in the limitations sectionof the Instructions for ContinuedAirworthiness.

Issues Prompting This RulemakingActivity

On July 17, 1996, a 25-year old BoeingModel 747–100 series airplane wasinvolved in an inflight breakup aftertakeoff from Kennedy InternationalAirport in New York, resulting in 230fatalities. The accident investigationconducted by the NationalTransportation Safety Board (NTSB)indicated that the center wing fuel tankexploded due to an unknown ignitionsource. The NTSB issuedrecommendations intended to:

• Reduce heating of the fuel in thecenter wing fuel tanks on the existingfleet of transport airplanes,

• Reduce or eliminate operation withflammable vapors in the fuel tanks ofnew type certificated airplanes, and

• Reevaluate the fuel system designand maintenance practices on the fleetof transport airplanes.

The accident investigation focused onmechanical failure as providing theenergy source that ignited the fuelvapors inside the tank.

The NTSB announced their officialfindings of the TWA 800 accident at apublic meeting held August 22–23,2000, in Washington, DC. The NTSBdetermined that the probable cause ofthe explosion was ignition of theflammable fuel/air mixture in the centerwing fuel tank. Although the ignitionsource could not be determined withcertainty, the NTSB determined that themost likely source was a short circuitoutside of the center wing tank thatallowed excessive voltage to enter thetank through electrical wiring associatedwith the fuel quantity indication system(FQIS). Opening remarks at the hearingalso indicated that:‘‘* * * This investigation and several othershave brought to light some broader issuesregarding aircraft certification. For example,there are questions about the adequacy of therisk analyses that are used as the basis fordemonstrating compliance with manycertification requirements.’’

This accident prompted the FAA toexamine the underlying safety issuessurrounding fuel tank explosions, the


23087Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

adequacy of the existing regulations, theservice history of airplanes certificatedto these regulations, and existingmaintenance practices relative to thefuel tank system.

Flammability Characteristics

The flammability characteristics ofthe various fuels approved for use intransport airplanes results in thepresence of flammable vapors in thevapor space of fuel tanks at varioustimes during the operation of theairplane. Vapors from Jet A fuel (thetypical commercial turbojet engine fuel)at temperatures below approximately100°F are too lean to be flammable atsea level; at higher altitudes the fuelvapors become flammable attemperatures above approximately 45°F(at 40,000 feet altitude).

However, the regulatory authoritiesand aviation industry have alwayspresumed that a flammable fuel airmixture exists in the fuel tanks at alltimes and have adopted the philosophythat the best way to ensure airplane fueltank safety is to preclude ignitionsources within fuel tanks. Thisphilosophy has been based on theapplication of fail-safe designrequirements to the airplane fuel tanksystem to preclude ignition sourcesfrom being present in fuel tanks whencomponent failures, malfunctions, orlightning encounters occur.

Possible ignition sources that havebeen considered include:

• Electrical arcs,• Friction sparks, and• Autoignition. (The autoignition

temperature is the temperature at whichthe fuel/air mixture will spontaneouslyignite due to heat in the absence of anignition source.)

Some events that could producesufficient electrical energy to create anarc include:

• Lightning,• Electrostatic charging,• Electromagnetic interference (EMI),

or• Failures in airplane systems or

wiring that introduce high-powerelectrical energy into the fuel tanksystem.

Friction sparks may be caused bymechanical contact between certainrotating components in the fuel tank,such as a steel fuel pump impellerrubbing on the pump inlet check valve.Autoignition of fuel vapors may becaused by failure of components withinthe fuel tank, or external components orsystems that cause components or tanksurfaces to reach a high enoughtemperature to ignite the fuel vapors inthe fuel tank.

Existing Regulations/CertificationMethods

The current 14 CFR part 25regulations that are intended to requiredesigns that preclude the presence ofignition sources within the airplane fueltanks are as follows:

Section 25.901 is a generalrequirement that applies to all portionsof the propulsion installation, whichincludes the airplane fuel tank system.It requires, in part, that the propulsionand fuel tank systems be designed toensure fail-safe operation betweennormal maintenance and inspectionintervals, and that the majorcomponents be electrically bonded tothe other parts of the airplane.

Sections 25.901(c) and 25.1309provide airplane system fail-saferequirements. Section 25.901(c) requiresthat ‘‘no single failure or malfunction orprobable combination of failures willjeopardize the safe operation of theairplane.’’ In general, the FAA’s policyhas been to require applicants to assumethe presence of foreseeable latent(undetected) failure conditions whendemonstrating that subsequent singlefailures will not jeopardize the safeoperation of the airplane.

Certain subsystem designs must alsocomply with § 25.1309. That sectionrequires airplane systems and associatedsystems to be:

‘‘* * * designed so that the occurrence ofany failure condition which would preventthe continued safe flight and landing of theairplane is extremely improbable, and theoccurrence of any other failure conditionswhich would reduce the capability of theairplane or the ability of the crew to copewith adverse operating conditions isimprobable.’’

Compliance with § 25.1309 requiresan analysis, and testing whereappropriate, considering possible modesof failure, including malfunctions anddamage from external sources, theprobability of multiple failures andundetected failures, the resulting effectson the airplane and occupants,considering the stage of flight andoperating conditions, and the crewwarning cues, corrective actionrequired, and the capability of detectingfaults.

This provision has the effect ofmandating the use of ‘‘fail-safe’’ designmethods, which require that the effect offailures and combinations of failures beconsidered in defining a safe design.Detailed methods of compliance with§§ 25.1309(b), (c), and (d) are describedin Advisory Circular (AC) 25.1309–1A,‘‘System Design Analysis,’’ and areintended as a means to evaluate theoverall risk, on average, of an event

occurring within a fleet of aircraft. Thefollowing guidance involving failures isoffered in that AC:

• In any system or subsystem, a singlefailure of any element or connectionduring any one flight must be assumedwithout consideration as to itsprobability of failing. This single failuremust not prevent the continued safeflight and landing of the airplane.

• Additional failures during any oneflight following the first single failuremust also be considered when theprobability of occurrence is not shownto be extremely improbable. Theprobability of these combined failuresincludes the probability of occurrence ofthe first failure.

As described in the AC, the FAA fail-safe design concept consists of thefollowing design principles ortechniques intended to ensure a safedesign. The use of only one of theseprinciples is seldom adequate. Acombination of two or more designprinciples is usually needed to providea fail-safe design (i.e., to ensure thatcatastrophic failure conditions are notexpected to occur during the life of thefleet of a particular airplane model).

• Design integrity and quality,including life limits, to ensure intendedfunction and prevent failures.

• Redundancy or backup systems thatprovide system function after the firstfailure (e.g., two or more engines, two ormore hydraulic systems, dual flightcontrols, etc.)

• Isolation of systems andcomponents so that failure of oneelement will not cause failure of theother (sometimes referred to as systemindependence).

• Detection of failures or failureindication.

• Functional verification (thecapability for testing or checking thecomponent’s condition).

• Proven reliability and integrity toensure that multiple component orsystem failures will not occur in thesame flight.

• Damage tolerance that limits thesafety impact or effect of the failure.

• Designed failure path that controlsand directs the failure, by design, tolimit the safety impact.

• Flightcrew procedures followingthe failure designed to assure continuedsafe flight by specific crew actions.

• Error tolerant design that considersprobable human error in the operation,maintenance, and fabrication of theairplane.

• Margins of safety that allow forundefined and unforeseeable adverseflight conditions.

These regulations, when applied totypical airplane fuel tank systems, are



intended to prevent ignition sourcesinside fuel tanks. The approval of theinstallation of mechanical and electricalcomponents inside the fuel tanks wastypically based on a qualitative systemsafety analysis and component testingwhich showed that:

• Mechanical components would notcreate sparks or high temperaturesurfaces in the event of any failure; and

• Electrical devices would not createarcs of sufficient energy to ignite a fuel-air mixture in the event of a singlefailure or probable combination offailures.

Section 25.901(b)(2) requires that thecomponents of the propulsion system be‘‘constructed, arranged, and installed soas to ensure their continued safeoperation between normal inspection oroverhauls.’’ Compliance with thisregulation is typically demonstrated bysubstantiating that the propulsioninstallation, which includes the fueltank system, will safely perform itsintended function between inspectionsand overhauls defined in themaintenance instructions.

Section 25.901(b)(4) requireselectrically bonding the majorcomponents of the propulsion system tothe other parts of the airplane. Theaffected major components of thepropulsion system include the fuel tanksystem. Compliance with thisrequirement for fuel tank systems hasbeen demonstrated by showing that allmajor components in the fuel tank areelectrically bonded to the airplanestructure. This precludes accumulationof electrical charge on the componentsand the possible arcing in the fuel tankthat could otherwise occur. In mostcases, electrical bonding isaccomplished by installing jumperwires from each major fuel tank systemcomponent to airplane structure.Advisory Circular 25–8, ‘‘Auxiliary FuelTank Installations,’’ also providesguidance for bonding of fuel tanksystem components and means ofprecluding ignition sources withintransport airplane fuel tanks.

Section 25.954 requires that the fueltank system be designed and arranged toprevent the ignition of fuel vapor withinthe system due to the effects of lightningstrikes. Compliance with this regulationis typically shown by incorporation ofdesign features such as minimum fueltank skin thickness, location of ventoutlets out of likely lightning strikeareas, and bonding of fuel tank systemstructure and components. Guidance fordemonstrating compliance with thisregulation is provided in AC 20–53A,‘‘Protection of Aircraft Fuel SystemsAgainst Fuel Vapor Ignition Due toLightning.’’

Section 25.981 requires that theapplicant determine the highesttemperature allowable in fuel tanks thatprovides a safe margin below the lowestexpected autoignition temperature ofthe fuel that is approved for use in thefuel tanks. No temperature at any placeinside any fuel tank where fuel ignitionis possible may then exceed thatmaximum allowable temperature. Thismust be shown under all probableoperating, failure, and malfunctionconditions of any component whoseoperation, failure, or malfunction couldincrease the temperature inside thetank. Guidance for demonstratingcompliance with this regulation hasbeen provided in AC 25.981–1A,‘‘Guidelines For SubstantiatingCompliance With the Fuel TankTemperature Requirements.’’ The ACprovides a listing of failure modes offuel tank system components thatshould be considered when showingthat component failures will not createa hot surface that exceeds the maximumallowable fuel tank component or tanksurface temperature for the fuel type forwhich approval is being requested.Manufacturers have demonstratedcompliance with this regulation bytesting and analysis of components toshow that design features, such asthermal fuses in fuel pump motors,preclude an ignition source in the fueltank when failures such as a seized fuelpump rotor occur.

Airplane Maintenance Manuals andInstructions for ContinuedAirworthiness

Historically, manufacturers have beenrequired to provide maintenance-relatedinformation for fuel tank systems in thesame manner as for other systems. Priorto 1970, most manufacturers providedmanuals containing maintenanceinformation for large transport categoryairplanes, but there were no standardsprescribing minimum content,distribution, and a timeframe in whichthe information must be made availableto the operator.

Section 25.1529, as amended byAmendment 25–21 in 1970, required theapplicant for a type certificate (TC) toprovide airplane maintenance manuals(AMM) to owners of the airplanes. Thisregulation was amended in 1980 torequire that the applicant for typecertification provide Instructions forContinued Airworthiness (ICA)prepared in accordance with AppendixH to part 25. In developing the ICA, theapplicant is required to include certaininformation such as a description of theairplane and its systems, servicinginformation, and maintenanceinstructions, including the frequency

and extent of inspections necessary toprovide for the continuing airworthinessof the airplane (including the fuel tanksystem). As required by Appendix H topart 25, the ICA must also include anFAA-approved AirworthinessLimitations section enumerating thosemandatory inspections, inspectionintervals, replacement times, andrelated procedures approved under§ 25.571, relating to structural damagetolerance. Before this amendment, theAirworthiness Limitations section of theICA applied only to airplane structureand not to the fuel tank system.

One method of establishing initialscheduled maintenance and inspectiontasks is the Maintenance Steering Group(MSG) process, which develops aMaintenance Review Board (MRB)document for a particular airplanemodel. Operators may incorporate thoseprovisions, along with othermaintenance information contained inthe ICA, into their maintenance orinspection program.

Section 21.50 requires the holder of adesign approval, including a TC orsupplemental type certificate (STC) foran airplane, aircraft engine, or propellerfor which application was made afterJanuary 28, 1981, to furnish at least oneset of the complete ICA to the owner ofthe product for which the applicationwas made. The ICA for original typecertificated products must includeinstructions for the fuel tank system. Adesign approval holder who hasmodified the fuel tank system mustfurnish a complete set of the ICA for themodification to the owner of theproduct.

Type Certificate Amendments Based onMajor Change in Type Design

Over the years, design changes havebeen introduced into fuel tank systemsthat may affect their safety. There arethree ways in which major designchanges can be approved:

1. The TC holder may be granted anamendment to the type design.

2. Any person, including the TCholder, wanting to alter a product byintroducing a major change in the typedesign not great enough to require a newapplication for a TC, may be granted anSTC.

3. In some instances, a person mayalso make an alteration to the typedesign and receive a field approval. Thefield approval process is a method forobtaining approval of relatively simplemodifications to airplanes. In thisprocess, an authorized FAA FlightStandards Inspector can approve thealteration by use of FAA Form 337.



Maintenance and Inspection ProgramRequirements

Airplane operators are required tohave extensive maintenance orinspection programs that includeprovisions relating to fuel tank systems.

Section 91.409(e), which generallyapplies to other than commercialoperations, requires an operator of alarge turbojet multiengine airplane or aturbopropeller-powered multienginedairplane to select one of the followingfour inspection programs:

1. A continuous airworthinessinspection program that is part of acontinuous airworthiness maintenanceprogram currently in use by a personholding an air carrier operatingcertificate, or an operating certificateissued under part 119 for operationsunder parts 121 or 135, and operatingthat make and model of airplane underthose parts;

2. An approved airplane inspectionprogram approved under § 135.419 andcurrently in use by a person holding anoperating certificate and operationsspecifications issued under part 119 forpart 135 operations;

3. A current inspection programrecommended by the manufacturer; or

4. Any other inspection programestablished by the registered owner oroperator of that airplane and approvedby the Administrator.

Section 121.367, which is applicableto those air carrier and commercialoperations covered by part 121, requiresoperators to have an inspectionprogram, as well as a program coveringother maintenance, preventativemaintenance, and alterations.

Section 125.247, which is generallyapplicable to operation of largeairplanes, other than air carrieroperations conducted under part 121,requires operators to inspect theirairplanes in accordance with aninspection program approved by theAdministrator.

Section 129.14 requires a foreign aircarrier and each foreign operator of aU.S. registered airplane in commoncarriage, within or outside the U.S., tomaintain the airplane in accordancewith an FAA-approved program.

In general, the operators rely on theTC data sheet, MRB reports, ICA’s, theAirworthiness Limitations section of theICA, other manufacturers’recommendations, and their ownoperating experience to develop theoverall maintenance or inspectionprogram for their airplanes.

The intent of the rules governing theinspection and/or maintenance programis to ensure that the inherent level ofsafety that was originally designed into

the system is maintained and that theairplane is in an airworthy condition.

Historically, for fuel tank systemsthese required programs include:

• Operational checks (e.g., a task todetermine if an item is fulfilling itsintended function);

• Functional checks (e.g., aquantitative task to determine iffunctions perform within specifiedlimits);

• Overhaul of certain components torestore them to a known standard; and

• General zonal visual inspectionsconducted concurrently with othermaintenance actions, such as structuralinspections.

However, specific maintenanceinstructions to detect and correctconditions that degrade fail-safecapabilities have not been deemednecessary because it has been assumedthat the original fail-safe capabilitieswould not be degraded in service.

Design and Service History ReviewThe FAA has examined the service

history of transport airplanes andperformed an analysis of the history offuel tank explosions on these airplanes.While there were a significant numberof fuel tank fires and explosions thatoccurred during the 1960’s and 1970’son several airplane types, in most cases,the fire or explosion was found to berelated to design practices, maintenanceactions, or improper modification offuel pumps. Some of the events wereapparently caused by lightning strikes.Extensive design reviews wereconducted to identify possible ignitionsources, and actions were taken thatwere intended to prevent similaroccurrences. However, fuel tank system-related accidents have occurred in spiteof these efforts.

On May 11, 1990, the center wing fueltank of a Boeing Model 737–300exploded while the airplane was on theground at Nimoy Aquino InternationalAirport, Manila, Philippines. Theairplane was less than one year old. Inthe accident, the fuel-air vapors in thecenter wing tank exploded as theairplane was being pushed back from aterminal gate prior to flight. Theaccident resulted in 8 fatalities andinjuries to an additional 30 people.Accident investigators considered aplausible scenario in which damagedwiring located outside the fuel tankmight have created a short between 115-volt airplane system wires and 28 voltwires to a fuel tank level switch. This,in combination with a possible latentdefect of the fuel level float switch, wasinvestigated as a possible source ofignition. However, a definitive ignitionsource was never confirmed during the

accident investigation. Thisunexplained accident occurred on anewer airplane, in contrast to the July17, 1996, accident that occurred on anolder Boeing Model 747 airplane thatwas approaching the end of its initialdesign life.

The Model 747 and 737 accidentsindicate that the development of anignition source inside the fuel tank maybe related to both the design andmaintenance of the fuel tank systems.

National Transportation Safety Board(NTSB) Recommendations

Since the July 17, 1996, accident, theFAA, NTSB, and aviation industry havebeen reviewing the design features andservice history of the Boeing Model 747and certain other transport airplanemodels. Based upon its review, theNTSB has issued the followingrecommendations to the FAA intendedto reduce exposure to operation withflammable vapors in fuel tanks andaddress possible degradation of theoriginal type certificated fuel tanksystem designs on transport airplanes.

The following recommendationsrelate to ‘‘Reduced FlammabilityExposure’’:

‘‘A–96–174: Require the developmentof and implementation of design oroperational changes that will precludethe operation of transport-categoryairplanes with explosive fuel-airmixtures in the fuel tanks:

LONG TERM DESIGNMODIFICATIONS:

(a) Significant consideration shouldbe given to the development of airplanedesign modification, such as nitrogen-inerting systems and the addition ofinsulation between heat-generatingequipment and fuel tanks. Appropriatemodifications should apply to newlycertificated airplanes and, wherefeasible, to existing airplanes.’’

‘‘A–96–175: Require the developmentof and implementation of design oroperational changes that will precludethe operation of transport-categoryairplanes with explosive fuel-airmixtures in the fuel tanks:

NEAR TERM OPERATIONAL(b) Pending implementation of design

modifications, require modifications inoperational procedures to reduce thepotential for explosive fuel-air mixturesin the fuel tanks of transport-categoryaircraft. In the B–747, considerationshould be given to refueling the centerwing fuel tank (CWT) before flightwhenever possible from cooler groundfuel tanks, proper monitoring andmanagement of the CWT fueltemperature, and maintaining anappropriate minimum fuel quantity inthe CWT.’’



‘‘A–96–176: Require that the B–747Flight Handbooks of TWA and otheroperators of B–747s and other aircraft inwhich fuel tank temperature cannot bedetermined by flightcrews beimmediately revised to reflect theincreases in CWT fuel temperaturesfound by flight tests, includingoperational procedures to reduce thepotential for exceeding CWTtemperature limitations.’’

‘‘A–96–177: Require modification ofthe CWT of B–747 airplanes and the fueltanks of other airplanes that are locatednear heat sources to incorporatetemperature probes and cockpit fueltank temperature displays to permitdetermination of the fuel tanktemperatures.’’

The following recommendationsrelate to ‘‘Ignition Source Reduction’’:

‘‘A–98–36: Conduct a survey of fuelquantity indication system probes andwires in Boeing Model 747’s equippedwith systems other than HoneywellSeries 1–3 probes and compensators andin other model airplanes that are usedin Title 14 Code of Federal RegulationsPart 121 service to determine whetherpotential fuel tank ignition sources existthat are similar to those found in theBoeing Model 747. The survey shouldinclude removing wires from fuelprobes and examining the wires fordamage. Repair or replacementprocedures for any damaged wires thatare found should be developed.’’

‘‘A–98–38: Require in Boeing Model747 airplanes, and in other airplaneswith fuel quantity indication system(FQIS) wire installations that are co-routed with wires that may be powered,the physical separation and electricalshielding of FQIS wires to the maximumextent possible.’’

‘‘A–98–39: Require, in all applicabletransport airplane fuel tanks, surgeprotection systems to prevent electricalpower surges from entering fuel tanksthrough fuel quantity indication systemwires.’’

Service HistoryThe FAA has reviewed service

difficulty reports for the transportairplane fleet and evaluated thecertification and design practicesutilized on these previously certificatedairplanes. An inspection of fuel tanks onBoeing Model 747 airplanes also wasinitiated. Representatives from the AirTransport Association (ATA),Association of European Airlines (AEA),the Association of Asia Pacific Airlines(AAPA), the Aerospace IndustriesAssociation of America, and theEuropean Association of AerospaceIndustries initiated a joint effort toinspect and evaluate the condition of

the fuel tank system installations on arepresentative sample of airplaneswithin the transport fleet. The fuel tanksof more than 800 airplanes wereinspected. Data from inspectionsconducted as part of this effort andshared with the FAA have assisted inestablishing a basis for developingcorrective action for airplanes withinthe transport fleet.

In addition to the results from theseinspections, the FAA has receivedreports of anomalies on in-serviceairplanes that have necessitated actionsto preclude development of ignitionsources in or adjacent to airplane fueltanks.

The following provides a summary offindings from design evaluations,service difficulty reports, and a reviewof current airplane maintenancepractices.

Aging Airplane Related PhenomenaFuel tank inspections initiated as part

of the Boeing Model 747 accidentinvestigation identified aging of fueltank system components,contamination, corrosion of componentsand sulfide deposits on components aspossible conditions that couldcontribute to development of ignitionsources within the fuel tanks. Results ofdetailed inspection of the fuel pumpwiring on several Boeing Model 747airplanes showed debris within the fueltanks consisting of lockwire, rivets, andmetal shavings. Debris was also foundinside scavenge pumps. Corrosion anddamage to insulation on FQIS probewiring was found on 6 out of 8 probesremoved from one in-service airplane.

In addition, inspection of airplanefuel tank system components from out-of-service (retired) airplanes, initiatedfollowing the accident, revealeddamaged wiring and corrosion buildupof conductive sulfide deposits on theFQIS wiring on some Boeing Model 747airplanes. The conductive deposits ordamaged wiring may result in a locationwhere arcing could occur if high powerelectrical energy was transmitted to theFQIS wiring from adjacent wires thatpower other airplane systems.

While the effects of corrosion on fueltank system safety have not been fullyevaluated, the FAA has initiated aresearch program to better understandthe effects of sulfide deposits andcorrosion on the safety of airplane fueltank systems.

Wear or chafing of electrical powerwires routed in conduits that are locatedinside fuel tanks can result in arcingthrough the conduits. On December 23,1996, the FAA issued AirworthinessDirective (AD) 96–26–06, applicable tocertain Boeing Model 747 airplanes,

which required inspection of electricalwiring routed within conduits to fuelpumps located in the wing fuel tanksand replacement of any damagedwiring. Inspection reports indicated thatmany instances of wear had occurred onTeflon sleeves installed over the wiringto protect it from damage and possiblearcing to the conduit.

Inspections of wiring to fuel pumpson Boeing Model 737 airplanes withover 35,000 flight hours have shownsignificant wear to the insulation ofwires inside conduits that are located infuel tanks. In nine reported cases, wearresulted in arcing to the fuel pump wireconduit on airplanes with greater than50,000 flight hours. In one case, wearresulted in burnthrough of the conduitinto the interior of the 737 main tankfuel cell. On May 14, 1998, the FAAissued a telegraphic AD, T98–11–52,which required inspection of wiring toBoeing Model 737 airplane fuel pumpsrouted within electrical conduits andreplacement of any damaged wiring.Results of these inspections showed thatwear of the wiring occurred in manyinstances, particularly on thoseairplanes with high numbers of flightcycles and operating hours.

The FAA also has received reports ofcorrosion on bonding jumper wireswithin the fuel tanks on one in-serviceAirbus Model A300 airplane. Themanufacturer investigating this eventdid not have sufficient evidence todetermine conclusively the level ofdamage and corrosion found on thejumper wires. Although the airplanewas in long-term storage, it does notexplain why a high number of damaged/corroded jumper wires were foundconcentrated in a specific area of thewing tanks. Further inspections of alimited number of other Airbus modelsdid not reveal similar extensivecorrosion or damage to bonding jumperwires. However, they did revealevidence of the accumulation of sulfidedeposits around the outer braid of somejumper wires. Tests by the manufacturerhave shown that these deposits did notaffect the bonding function of the leads.Airbus has developed a one-time-inspection service bulletin for all itsairplanes to ascertain the extent of thesulfide deposits and to ensure that thelevel of jumper wire damage found onthe one Model A300 airplane is notwidespread.

On March 30, 1998, the FAA receivedreports of three recent instances ofelectrical arcing within fuel pumpsinstalled in fuel tanks on LockheedModel L–1011 airplanes. In one case,the electrical arc had penetrated thepump and housing and entered the fueltank. Preliminary investigation indicates



that features incorporated into the fuelpump design that were intended topreclude overheating and arc-throughinto the fuel tank may not havefunctioned as intended due todiscrepancies introduced duringoverhaul of the pumps. Emergency AD98–08–09 was issued April 3, 1998, tospecify a minimum quantity of fuel tobe carried in the fuel tanks for thepurpose of covering the pumps withliquid fuel and thereby precludingignition of vapors within the fuel tankuntil such time as terminating correctiveaction could be developed.

Unforeseen Fuel Tank System FailuresAfter an extensive review of the

Boeing Model 747 design following theJuly 17, 1996, accident, the FAAdetermined that during originalcertification of the fuel tank system, thedegree of tank contamination and thesignificance of certain failure modes offuel tank system components had notbeen considered to the extent that morerecent service experience indicates isneeded. For example, in the absence ofcontamination, the FQIS had beenshown to preclude creating an arc ifFQIS wiring were to come in contactwith the highest level of electricalvoltage on the airplane. This was shownby demonstrating that the voltageneeded to cause an arc in the fuelprobes due to an electrical shortcondition was well above any voltagelevel available in the airplane systems.

However, recent testing has shownthat if contamination, such asconductive debris (lock wire, nuts,bolts, steel wool, corrosion, sulfidedeposits, metal filings, etc.) is placedwithin gaps in the fuel probe, thevoltage needed to cause an arc is withinvalues that may occur due to asubsequent electrical short or inducedcurrent on the FQIS probe wiring fromelectromagnetic interference caused byadjacent wiring. These anomalies, bythemselves, could not lead to anelectrical arc within the fuel tankswithout the presence of an additionalfailure. If any of these anomalies werecombined with a subsequent failurewithin the electrical system that createsan electrical short, or if high-intensityradiated fields (HIRF) or electricalcurrent flow in adjacent wiring inducesEMI voltage in the FQIS wiring,sufficient energy could enter the fueltank and cause an ignition sourcewithin the tank.

On November 26, 1997, in Docket No.97–NM–272–AD, the FAA proposed arequirement for operators of BoeingModel 747–100, –200, and –300 seriesairplanes to install components for thesuppression of electrical transients and/

or the installation of shielding andseparation of fuel quantity indicatingsystem wiring from other airplanesystem wiring. After reviewing thecomments received on the proposedrequirements, the FAA issued AD 98–20–40 on September 23, 1998, thatrequires the installation of shielding andseparation of the electrical wiring of thefuel quantity indication system. OnApril 14, 1998, the FAA proposed asimilar requirement for Boeing Model737–100, –200, –300, –400, and –500series airplanes in Docket No. 98–NM–50–AD, which led to the FAA issuingAD 99–03–04 on January 26, 1999. Theaction required by those twoairworthiness directives is intended topreclude high levels of electrical energyfrom entering the airplane fuel tankwiring due to electromagneticinterference or electrical shorts. Severalmanufacturers have been grantedapproval for the use of alternativemethods of compliance (AMOC) withthese AD’s that permit installation oftransient suppressing devices in theFQIS wiring that prevent unwantedelectrical power from entering the fueltank. All later model Boeing Model 747and 737 FQIS’s have wire separationand fault isolation features that maymeet the intent of these AD actions.This rulemaking will require evaluationof these later designs and the designs ofother transport airplanes.

Other examples of unanticipatedfailure conditions include incidents ofparts from fuel pump assembliesimpacting or contacting the rotating fuelpump impeller. The first designanomaly was identified when twoincidents of damage to fuel pumps werereported on Boeing Model 767airplanes. In both cases objects from afuel pump inlet diffuser assembly wereingested into the fuel pump, causingdamage to the pump impeller and pumphousing. The damage could have causedsparks or hot debris from the pump toenter the fuel tank. To address thisunsafe condition, the FAA issued AD97–19–15. This AD requires revision ofthe airplane flight manual to includeprocedures to switch off the fuel pumpswhen the center tank approaches empty.The intent of this interim action is tomaintain liquid fuel over the pump inletso that any debris generated by a failedfuel pump will not come in contact withfuel vapors and cause a fuel tankexplosion.

The second design anomaly wasreported on Boeing Model 747–400series airplanes. The reports indicatedthat inlet adapters of the override/jettison pumps of the center wing fueltank were worn. Two of the inletadapters had worn down enough to

cause damage to the rotating blades ofthe inducer. The inlet check valves alsohad significant damage. An operatorreported damage to the inlet adapter sosevere that contact had occurredbetween the steel disk of the inlet checkvalve and the steel screw that holds theinducer in place. Wear to the inletadapters has been attributed to contactbetween the inlet check valve and theadapter. Such excessive wear of theinlet adapter can lead to contactbetween the inlet check valve andinducer, which could result in pieces ofthe check valve being ingested into theinducer and damaging the inducer andimpellers. Contact between the steeldisk of the inlet check valve and thesteel rotating inducer screw can causesparks. To address this unsafecondition, the FAA issued animmediately adopted rule, AD 98–16–19, on July 30, 1998.

Another design anomaly was reportedin 1989 when a fuel tank ignition eventoccurred in an auxiliary fuel tankduring refueling of a Beech Model 400airplane. The auxiliary fuel tank hadbeen installed under an STC.Polyurethane foam had been installed inportions of the tank to minimize thepotential of a fuel tank explosion ifuncontained engine debris penetratedthose portions of the tank. The accidentinvestigation indicated that electrostaticcharging of the foam during refuelingresulted in ignition of fuel-air vapors inportions of the adjacent fuel tank systemthat did not contain the foam. The fuelvapor explosion caused distortion of thetank and fuel leakage from a failed fuelline. Modifications to the design,including use of more conductivepolyurethane foam and installation of astandpipe in the refueling system, wereincorporated to prevent reoccurrence ofelectrostatic charging and a resultantfuel tank ignition source.

Review of Fuel Tank SystemMaintenance Practices

In addition to the review of the designfeatures and service history of theBoeing Model 747 and other airplanemodels in the transport airplane fleet,the FAA also has reviewed the currentfuel tank system maintenance practicesfor these airplanes.

Typical transport category airplanefuel tank systems are designed withredundancy and fault indicationfeatures such that single componentfailures do not result in any significantreduction in safety. Therefore, fuel tanksystems historically have not had anylife-limited components or specificdetailed inspection requirements, unlessmandated by airworthiness directives.



Most of the components are ‘‘oncondition,’’ meaning that some test,check, or other inspection is performedto determine continued serviceability,and maintenance is performed only ifthe inspection identifies a conditionrequiring correction. Visual inspectionof fuel tank system components is by farthe predominant method of inspectionfor components such as boost pumps,fuel lines, couplings, wiring, etc.Typically, these inspections areconducted concurrently with zonalinspections or internal or external fueltank structural inspections. Theseinspections normally do not provideinformation regarding the continuedserviceability of components within thefuel tank system, unless the visualinspection indicates a potential problemarea. For example, it would be difficult,if not impossible, to detect certaindegraded fuel tank system conditions,such as worn wiring routed throughconduit to fuel pumps, debris insidefuel pumps, corrosion to bonding wireinterfaces, etc., without dedicatedintrusive inspections that are muchmore extensive than those normallyconducted.

Listing of DeficienciesThe list provided below summarizes

fuel tank system design deficiencies,malfunctions, failures, andmaintenance-related actions that havebeen determined through serviceexperience to result in a degradation ofthe safety features of airplane fuel tanksystems. This list was developed fromservice difficulty reports and incidentand accident reports. These anomaliesoccurred on in-service transportcategory airplanes despite regulationsand policies in place to preclude thedevelopment of ignition sources withinairplane fuel tank systems.

1. Pumps:• Ingestion of the pump inducer into

the pump impeller and generation ofdebris into the fuel tank.

• Pump inlet case degradation,allowing the pump inlet check valve tocontact the impeller.

• Stator winding failures duringoperation of the fuel pump. Subsequentfailure of a second phase of the pumpresulting in arcing through the fuelpump housing.

• Deactivation of thermal protectivefeatures incorporated into the windingsof pumps due to inappropriatewrapping of the windings.

• Omission of cooling port tubesbetween the pump assembly and thepump motor assembly during fuel pumpoverhaul.

• Extended dry running of fuelpumps in empty fuel tanks, which was

contrary to the manufacturer’srecommended procedures.

• Use of steel impellers that mayproduce sparks if debris enters thepump.

• Debris lodged inside pumps.• Arcing due to the exposure of

electrical connections within the pumphousing that have been designed withinadequate clearance to the pump cover.

• Thermal switches resetting overtime to a higher trip temperature.

• Flame arrestors falling out of theirrespective mounting.

• Internal wires coming in contactwith the pump rotating group,energizing the rotor and arcing at theimpeller/adapter interface.

• Poor bonding across componentinterfaces.

• Insufficient ground fault currentprotection capability.

• Poor bonding of components tostructure.

2. Wiring to pumps in conduitslocated inside fuel tanks:

• Wear of Teflon sleeving and wiringinsulation allowing arcing from wirethrough metallic conduits into fueltanks.

3. Fuel pump connectors: • Electrical arcing at connections

within electrical connectors due to bentpins or corrosion.

• Fuel leakage and subsequent fuelfire outside of the fuel tank caused bycorrosion of electrical connectors insidethe pump motor which lead to electricalarcing through the connector housing(connector was located outside the fueltank).

• Selection of improper materials inconnector design.

4. FQIS wiring: • Degradation of wire insulation

(cracking), corrosion and sulfidedeposits at electrical connectors

• Unshielded FQIS wires routed inwire bundles with high voltage wires.

5. FQIS probes: • Corrosion and sulfide deposits

causing reduced breakdown voltage inFQIS wiring.

• Terminal block wiring clamp (strainrelief) features at electrical connectionson fuel probes causing damage to wiringinsulation.

• Contamination in the fuel tankscausing a reduced arc path betweenFQIS probe walls (steel wool, lock wire,nuts, rivets, bolts; or mechanical impactdamage to probes).

6. Bonding straps: • Corrosion to bonding straps.• Loose or improperly grounded

attachment points.• Static bonds on fuel tank system

plumbing connections inside the fueltank worn due to mechanical wear of

the plumbing from wing movement andcorrosion.

7. Electrostatic charge: • Use of non-conductive reticulated

polyurethane foam that holdselectrostatic charge buildup.

• Spraying of fuel into fuel tanksthrough inappropriately designedrefueling nozzles or pump cooling flowreturn methods.

Fuel Tank FlammabilityIn addition to the review of potential

fuel tank ignition, the FAA hasundertaken a parallel effort to addressthe threat of fuel tank explosions byeliminating or significantly reducing thepresence of explosive fuel air mixtureswithin the fuel tanks of new typedesigns, in-production, and the existingfleet of transport airplanes.

On April 3, 1997, the FAA publisheda notice in the Federal Register (62 FR16014) that requested commentsconcerning the 1996 NTSBrecommendations regarding reducedflammability listed earlier in this notice.That notice provided significantdiscussion of service history,background, and issues relating toreducing flammability in transportairplane fuel tanks. Review of thecomments submitted to that noticeindicated that additional informationwas needed before the FAA couldinitiate rulemaking action to address therecommendations.

On January 23, 1998, the FAApublished a notice in the FederalRegister that established and tasked anAviation Rulemaking AdvisoryCommittee (ARAC) working group, theFuel Tank Harmonization WorkingGroup (FTHWG), to provide additionalinformation prior to rulemaking. TheARAC consists of interested parties,including the public, and provides apublic process to advise the FAAconcerning development of newregulations.

Note: The FAA formally established ARACin 1991 (56 FR 2190, January 22, 1991), toprovide advice and recommendationsconcerning the full range of the FAA’s safety-related rulemaking activity.

The FTHWG evaluated numerouspossible means of reducing oreliminating hazards associated withexplosive vapors in fuel tanks. On July23, 1998, the ARAC submitted its reportto the FAA. The full report is in thedocket created for this ARAC workinggroup (Docket No. FAA–1998–4183).This docket can be reviewed on the U.S.Department of Transportation electronicDocument Management System on theInternet at http://dms.dot.gov. The fullreport is also in the docket for thisrulemaking.



The report provided arecommendation for the FAA to initiaterulemaking action to amend § 25.981,applicable to new type design airplanes,to include a requirement to limit thetime transport airplane fuel tanks couldoperate with flammable vapors in thevapor space of the tank. Therecommended regulatory text proposed,‘‘Limiting the development offlammable conditions in the fuel tanks,based on the intended fuel types, to lessthan 7 percent of the expected fleetoperational time, or providing means tomitigate the effects of an ignition of fuelvapors within the fuel tanks such thatany damage caused by an ignition willnot prevent continued safe flight andlanding.’’ The report discussed variousoptions of showing compliance withthis proposal, including managing heatinput to the fuel tanks, installation ofinerting systems or polyurethane firesuppressing foam, and suppressing anexplosion if one occurred, etc.

The level of flammability defined inthe proposal was established basedupon comparison of the safety record ofcenter wing fuel tanks that, in certainairplanes, are heated by equipmentlocated under the tank, and unheatedfuel tanks located in the wing. TheFTHWG concluded that the safetyrecord of fuel tanks located in the wingswas adequate and that if the same levelcould be achieved in center wing fueltanks, the overall safety objective wouldbe achieved. Results from thermalanalyses documented in the reportindicate that center wing fuel tanks thatare heated by air conditioningequipment located beneath themcontain flammable vapors, on a fleetaverage basis, for up to 30 percent of thefleet operating time.

During the ARAC review it was alsodetermined that certain airplane typesdo not locate heat sources adjacent tothe fuel tanks. These airplanes providesignificantly reduced flammabilityexposure, near the 5 percent value of thewing tanks. The group thereforedetermined that it would be feasible todesign new airplanes such that fuel tankoperation in the flammable range wouldbe limited to near that of the wing fueltanks. The primary method ofcompliance with the requirementproposed by the ARAC would likely beto control heat transfer into and out offuel tanks such that heating of the fuelwould not occur. Design features suchas locating the air conditioningequipment away from the fuel tanks,providing ventilation of the airconditioning bay to limit heating andcool fuel tanks, and/or insulating thetanks from heat sources, would be

practical means of complying with theregulation proposed by the ARAC.

In addition to its recommendation torevise § 25.981, the ARAC alsorecommended that the FAA continue toevaluate means for minimizing thedevelopment of flammable vaporswithin the fuel tanks to determinewhether other alternatives, such asground based inerting of fuel tanks,could be shown to be cost effective.

To address the ARACrecommendations, the FAA initiatedresearch and development activity todetermine the feasibility of requiringground-based inerting. The results ofthis activity are documented in reportNo. DOT/FAA/AR–00/19, ‘‘The Cost ofImplementing Ground-Based Fuel TankInerting in the Commercial Fleet.’’ Acopy of the report is in the docket forthis rulemaking. In addition, on July 14,2000 (65 FR 43800), the FAA tasked theARAC to conduct a technical evaluationof certain fuel tank inerting methodsthat would reduce the flammability ofthe fuel tanks on both new type designsand in-service airplanes.

The FAA is also evaluating thepotential benefits of using directedventilation methods to reduce theflammability exposure of fuel tanks thatare located near significant heat sources.

Discussion of the Final RuleThe FAA review of the service

history, design features, andmaintenance instructions of thetransport airplane fleet indicates thataging of fuel tank system componentsand unforeseen fuel tank system failuresand malfunctions have become a safetyissue for the fleet of turbine-poweredtransport category airplanes. The FAA isamending the current regulations in fourareas.

The first area of concern encompassesthe possibility of the development ofignition sources within the existingtransport airplane fleet. Many of thedesign practices used on airplanes inthe existing fleet are similar. Therefore,anomalies that have developed onspecific airplane models within the fleetcould develop on other airplane models.As a result, the FAA considers that aone-time safety review of the fuel tanksystem for transport airplane models inthe current fleet is needed.

The second area of concernencompasses the need to require thedesign of future transport categoryairplanes to more completely addresspotential failures in the fuel tank systemthat could result in an ignition source inthe fuel tank system.

Third, certain airplane types aredesigned with heat sources adjacent tothe fuel tank, which results in heating

of the fuel and a significant increase inthe formation of flammable vapors inthe tank. The FAA considers that fueltank safety can be enhanced by reducingthe time fuel tanks operate withflammable vapors in the tank and istherefore adopting a requirement toprovide means to minimize thedevelopment of flammable vapors infuel tanks, or to provide means toprevent catastrophic damage if ignitiondoes occur.

Fourth, the FAA considers that it isnecessary to impose operationalrequirements so that all requiredmaintenance or inspection actions willbe included in each operator’s FAA-approved maintenance or inspectionprogram.

These regulatory initiatives are beingcodified as a Special Federal AviationRegulation (14 CFR part 21),amendments to the airworthinessregulations (14 CFR part 25), andamendments to the operatingrequirements (14 CFR parts 91, 121, 125,129)

Part 21 Special Federal AviationRegulation (SFAR)

Historically, the FAA works with theTC holders when safety issues arise toidentify solutions and actions that needto be taken. Some of the safety issuesthat have been addressed by thisvoluntary cooperative process includethose involving aging aircraft structure,thrust reversers, cargo doors, and wingicing protection. Although somemanufacturers have aggressivelycompleted these safety reviews, othershave not applied the resourcesnecessary to complete these reviews ina timely manner, which delayed theadoption of corrective action. Althoughthese efforts have frequently beensuccessful in achieving the desiredsafety objectives, a more uniform andexpeditious response is considerednecessary to address fuel tank safetyissues.

While maintaining the benefits ofFAA-TC holder cooperation, the FAAconsiders that a Special FederalAviation Regulation (SFAR) provides ameans for the FAA to establish clearexpectations and standards, as well as atimeframe within which the designapproval holders and the public can beconfident that fuel tank safety issues onthe affected airplanes will be uniformlyexamined.

This final rule is intended to ensurethat the design approval holdercompletes a comprehensive assessmentof the fuel tank system and developsany required inspections, maintenanceinstructions, or modifications.



Safety Review

The SFAR requires the designapproval holder to perform a safetyreview of the fuel tank system to showthat fuel tank fires or explosions willnot occur on airplanes of the approveddesign. In conducting the review, thedesign approval holder mustdemonstrate compliance with the newstandards adopted for § 25.981(a) and(b) (discussed below) and the existingstandards of § 25.901. As part of thisreview, the design approval holder mustsubmit a report to the cognizant FAAAircraft Certification Office (ACO) thatsubstantiates that the fuel tank system isfail-safe.

The FAA intends that those failureconditions identified earlier in thisdocument, and any other foreseeablefailures, should be assumed whenperforming the safety review needed tosubstantiate that the fuel tank systemdesign is fail-safe. The safety reviewshould be prepared considering allairplane inflight, ground, service, andmaintenance conditions, assuming thatan explosive fuel air mixture is presentin the fuel tanks at all times, unless thefuel tank has been purged of fuel vaporfor maintenance. The design approvalholder is expected to develop a failuremodes and effects analysis (FMEA) forall components in the fuel tank system.Analysis of the FMEA would then beused to determine whether singlefailures, alone or in combination withforeseeable latent failures, could causean ignition source to exist in a fuel tank.A subsequent quantitative fault treeanalysis should then be developed todetermine whether combinations offailures expected to occur in the life ofthe affected fleet could cause an ignitionsource to exist in a fuel tank system.

Because fuel tank systems typicallyhave few components within the fueltank, the number of possible internalsources of ignition is limited. The safetyreview required by this final ruleincludes all components or systems thatcould introduce a source of fuel tankignition. This may require analysis ofnot only the fuel tank systemcomponents, (e.g., pumps, fuel pumppower supplies, fuel valves, fuelquantity indication system probes,wiring, compensators, densitometers,fuel level sensors, etc.), but also otherairplane systems that may affect the fueltank system. For example, failures inairplane wiring or electromagneticinterference from other airplane systemsthat were not properly accounted for inthe original safety assessment couldcause an ignition source in the airplanefuel tank system under certainconditions and therefore would have to

be included in the system safetyanalysis.

The intent of the safety review is toassure that each fuel tank system designthat is affected by this action will befully assessed and that the designapproval holder identifies any requiredmodifications, added flight deck ormaintenance indications, and/ormaintenance actions necessary to meetthe fail-safe criteria.

Maintenance Instructions

The FAA anticipates that the safetyreview will identify critical areas of thefuel tank and other related systems thatrequire maintenance actions to accountfor the affects of aging, wear, corrosion,and possible contamination on the fueltank system. For example, servicehistory indicates that sulfide depositsmay form on fuel tank components,including bonding straps and FQIScomponents, which could degrade theintended design capabilities byproviding a mechanism by which arcingcould occur. Therefore, it might benecessary to provide maintenanceinstructions to identify and eliminatesuch deposits.

The SFAR requires the designapproval holder to develop any specificmaintenance and inspectioninstructions necessary to maintain thedesign features required to preclude theexistence or development of an ignitionsource within the fuel tank system.These instructions must be establishedto ensure that an ignition source willnot develop throughout the remainingoperational life of the airplane.

Possible Airworthiness Directives

The safety review may also result inidentification of unsafe conditions oncertain airplane models that wouldrequire issuance of airworthinessdirectives. For example, the FAA hasrequired or proposed requirements fordesign changes to the followingairplanes:

• Boeing Models 737, 747, and 767;• Boeing Douglas Products Division

(formerly, McDonnell Douglas) ModelDC–9 and DC–10;

• Lockheed Model L–1011;• Bombardier (Canadair) Model CL–

600;• Airbus Models A300–600R, A319,

A320, and A321;• CASA Model C–212;• British Aerospace (Jetstream) Model

4100; and• Fokker Model F28.Design practices used on these models

may be similar to those of other airplanetypes; therefore, the FAA expects thatmodifications to airplanes with similardesign features may also be required.

The number and scope of any possibleAD’s may vary by airplane type design.For example, wiring separation andshielding of FQIS wires on newertechnology airplanes significantlyreduces the likelihood of an electricalshort causing an electrical arc in the fueltank; many newer transport airplanes donot route electrical power wiring to fuelpumps inside the airplane fuel tanks.Therefore, some airplane models maynot require significant modifications oradditional dedicated maintenanceprocedures.

Other models may require significantmodifications or more maintenance. Forexample, the FQIS wiring on some oldertechnology airplanes is routed in wirebundles with high voltage power supplywires. The original failure analysesconducted on these airplane types didnot consider the possibility that the fuelquantity indication system may becomedegraded, allowing a significantly lowervoltage level to produce a spark insidethe fuel tank. Causes of degradationobserved in service include aging,corrosion, or undetected contaminationof the system. As previously discussed,the FAA has issued AD actions forcertain Boeing Model 737 and 747airplanes to address this condition.Modification of similar types ofinstallations on other airplane modelsmay be required to address this unsafecondition and to achieve a fail-safedesign.

It should be noted that any designchanges might, in themselves, requiremaintenance actions. For example,transient protection devices typicallyrequire scheduled maintenance in orderto detect latent failure of thesuppression feature. As a part of therequired safety review, the manufactureris expected to define the necessarymaintenance procedures and intervalsfor any required maintenance actions.

Applicability of the SFAR

The requirements of the SFAR areapplicable to holders of TC’s, and STC’sfor modifications that affect the fueltank systems of turbine-poweredtransport category airplanes, for whichthe TC was issued after January 1, 1958,and the airplane has either a maximumtype certificated passenger capacity of30 or more, or a maximum typecertificated payload capacity of 7,500pounds or more.

The SFAR is also applicable toapplicants for type certificates,amendments to a type certificate, andsupplemental type certificates affectingthe fuel tank systems for those airplanesidentified above, if the application wasfiled before the effective date of the



SFAR and the certificate was not issuedbefore the effective date of the SFAR.

The FAA has determined that turbine-powered airplanes, regardless ofwhether they are turboprops orturbojets, should be subject to the rule,because the potential for ignitionsources in fuel tank systems is unrelatedto the engine design. This results in thecoverage of the large transport categoryairplanes where the safety benefits andpublic interest are greatest. This actionaffects approximately 7,000 U.S.registered airplanes in part 91, 121, 125,and 129 operations.

The date January 1, 1958, was chosenso that only turbine-powered airplanes,except for a few 1953–1958 vintageConvair 340s and 440s converted fromreciprocating power, will be included.No reciprocating-powered transportcategory airplanes are known to be usedcurrently in passenger service, and thefew remaining in cargo service would beexcluded. Compliance is not requiredfor those older airplanes because theiradvanced age and small numbers wouldlikely make compliance impracticalfrom an economic standpoint. This isconsistent with similar exclusions madefor those airplanes from otherrequirements applicable to existingairplanes, such as the regulationsadopted for flammability of seatcushions (49 FR 43188, October 24,1984); flammability of cabin interiorcomponents (51 FR 26206, July 21,1986); cargo compartment liners (54 FR7384, February 17, 1989); access topassenger emergency exits (57 FR19244, May 4, 1992); and Class D cargoor baggage compartments (63 FR 8032,February 17, 1998).

In order to achieve the benefits of thisrulemaking for large transport airplanesas quickly as possible, the FAA hasdecided to limit the applicability of theSFAR to airplanes with a maximumcertificated passenger capacity of atleast 30 or at least 7,500 poundspayload. Compliance is not required forsmaller airplanes because it is not clearat this time that the possible benefits forthose airplanes would be commensuratewith the costs involved. For now, theapplicability of the rule will remain asproposed in the notice. The FAA willneed to conduct the economic analysisto determine if the rule should beapplied to smaller airplanes. Should theresults of the analysis be favorable, theFAA will develop further rulemaking toaddress the smaller transports.

Applicability of SFAR to SupplementalType Certificate (STC) Holders

The SFAR applies to STC holders aswell, because a significant number ofSTC’s effect changes to fuel tank

systems, and the objectives of this rulewould not be achieved unless thesesystems are also reviewed and theirsafety ensured. The service experiencenoted in the background of this ruleindicates modifications to airplane fueltank systems incorporated by STC’s mayaffect the safety of the fuel tank system.

Modifications that could affect thefuel tank system include those thatcould result in an ignition source in thefuel tank. Examples include installationof auxiliary fuel tanks and installationof, or modification to, other systemssuch as the fuel quantity indicationsystem, the fuel pump system(including electrical power supply),airplane refueling system, any electricalwiring routed within or adjacent to thefuel tank, and fuel level sensors or floatswitches. Modifications to systems orcomponents located outside the fueltank system may also affect fuel tanksafety. For example, installation ofelectrical wiring for other systems thatwas inappropriately routed with FQISwiring could violate the wiringseparation requirements of the typedesign. Therefore, the FAA intends thata fuel tank system safety review beconducted for any modification to theairplane that may affect the safety of thefuel tank system. The level of evaluationthat is intended would be dependentupon the type of modification. In mostcases a simple qualitative evaluation ofthe modification in relation to the fueltank system, and a statement that thechange has no effect on the fuel tanksystem, would be all that is necessary.In other cases where the initialqualitative assessment shows that themodification may affect the fuel tanksystem, a more detailed safety reviewwould be required.

Design approvals for modification ofairplane fuel tank systems approved bySTC’s require the applicant to haveknowledge of the airplane fuel tanksystem in which the modification isinstalled. The majority of theseapprovals are held by the originalairframe manufacturers or airplanemodifiers that specialize in fuel tanksystem modifications, such asinstallation of auxiliary fuel tanks.Therefore, the FAA expects that the dataneeded to complete the required safetyreview identified in the SFAR would beavailable to the STC holder.

Compliance With SFARThis rule provides an 18-month

compliance time from the effective dateof the final rule, or within 18 monthsafter the issuance of a certificate forwhich application was filed before theeffective date of this SFAR, whicheveris later, for design approval holders to

conduct the safety review and developthe compliance documentation and anyrequired maintenance and inspectioninstructions. (Applicants whoseapplications have not been approved asof the effective date would be allowed18 months after the approval tocomply.) The FAA expects each designapproval holder to work with thecognizant FAA Aircraft CertificationOffice (ACO) and Aircraft EvaluationGroup (AEG) to develop a plan tocomplete the safety review and developthe required maintenance andinspection instructions within the 18-month period. The plan should includeperiodic reviews with the ACO and AEGof the ongoing safety review and theassociated maintenance and inspectioninstructions.

During the 18-month complianceperiod, the FAA is committed toworking with the affected designapproval holders to assist them incomplying with the requirements of theSFAR. However, failure to complywithin the specified time wouldconstitute a violation of therequirements and may subject theviolator to certificate action to amend,suspend, or revoke the affectedcertificate in accordance with 49 U.S.C.§ 44709. In accordance with 49 U.S.C.§ 46301, it may also subject the violatorto a civil penalty of not more than$1,100 per day until the SFAR iscomplied with.

Changes to Operating RequirementsThis rule requires the affected

operators to incorporate FAA-approvedfuel tank system maintenance andinspection instructions in theirmaintenance or inspection programrequired under the applicable operatingrule within 36 months of the effectivedate of the rule. If the design approvalholder has complied with the SFAR anddeveloped an FAA-approved program,the operator can incorporate thatprogram, including any revisionsneeded to address any modifications tothe original type design, to meet theproposed requirement. The operatoralso has the option of developing itsown program independently, and isultimately responsible for having anFAA-approved program, regardless ofthe action taken by the design approvalholder.

The rule prohibits the operation ofcertain transport category airplanesoperated under parts 91, 121, 125, and129 beyond the specified compliancetime, unless the operator of thoseairplanes has incorporated FAA-approved fuel tank maintenance andinspection instructions in itsmaintenance or inspection program, as



applicable. The rule requires approvalof the maintenance and inspectioninstructions by the FAA ACO, or officeof the Transport Airplane Directorate,having cognizance over the typecertificate for the affected airplaneTheoperator would need to consider thefollowing five issues:

1. The fuel tank system maintenanceand inspection instructions that wouldbe incorporated into the operator’sexisting maintenance or inspectionprogram must be approved by the FAAACO having cognizance over the typecertificate or supplemental typecertificate. If the operator can establishthat the existing maintenance andinspection instructions fulfill therequirements of this rule, then the ACOmay approve the operator’s existingmaintenance and inspectioninstructions without change.

2. The means by which the FAA-approved fuel tank system maintenanceand inspection instructions areincorporated into a certificate holder’sFAA-approved maintenance orinspection program is subject toapproval by the certificate holder’sprincipal maintenance inspector (PMI)or other cognizant airworthinessinspector. The FAA intends that anyescalation to the FAA-approvedinspection intervals will require theoperator to receive approval of theamended program from the cognizantACO or office of the Transport AirplaneDirectorate. Any request for escalationto the FAA approved inspectionintervals must include data tosubstantiate that the proposed intervalwill provide the level of safety intendedby the original approval. If inspectionresults and service experience indicatethat additional or more frequentinspections are necessary, the FAA mayissue AD’s to mandate such changes tothe inspection program.

3. This rule does not impose any newreporting requirements; however,normal reporting required under 14 CFR121.703 and 125.409 still applies.

4. This rule does not impose any newFAA recordkeeping requirements.However, as with all maintenance, thecurrent operating regulations (e.g., 14CFR 121.380 and 91.417) alreadyimpose recordkeeping requirements thatapply to the actions required by thisrule. When incorporating the fuel tanksystem maintenance and inspectioninstructions into its approvedmaintenance or inspection program,each operator should address the meansby which it will comply with theserecordkeeping requirements. Thatmeans of compliance, along with theremainder of the program, are subject to

approval by the cognizant PMI or othercognizant airworthiness inspector.

5. The maintenance and inspectioninstructions developed by the TC holderunder the rule generally do not apply toportions of the fuel tank systemsmodified in accordance with an STC,field approval, or otherwise, includingany auxiliary fuel tank installations.Similarly, STC holders are required toprovide instructions for their STC’s. Theoperator, however, is still responsiblefor incorporating specific maintenanceand inspection instructions applicableto the entire fuel tank system of eachairplane that meets the requirements ofthis rule. This means that the operatormust evaluate the fuel tank systems andany alterations to the fuel tank systemnot addressed by the instructionsprovided by the TC or STC holder, andthen develop, submit, and gain FAAapproval of the maintenance andinspection instructions to evaluatechanges to the fuel tank systems.

The FAA recognizes that operatorsmay not have the resources to developmaintenance or inspection instructionsfor the airplane fuel tank system. Therule therefore requires the TC and STCholders to develop fuel tank systemmaintenance and inspectioninstructions that may be used byoperators. If however, the STC holder isout of business or otherwiseunavailable, the operator willindependently have to acquire the FAA-approved inspection instructions. Tokeep the airplanes in service, operators,either individually or as a group, couldhire the necessary expertise to developand gain approval of maintenance andinspection instructions. Guidance onhow to comply with this aspect of therule will be provided in AC 25.981–1B.

After the PMI having oversightresponsibilities is satisfied that theoperator’s continued airworthinessmaintenance or inspection programcontains all of the elements of the FAA-approved fuel tank system maintenanceand inspection instructions, theairworthiness inspector will approve themaintenance or inspection programrevision. This approval has the effect ofrequiring compliance with themaintenance and inspectioninstructions.

Applicability of the OperatingRequirements

This rule prohibits the operation ofcertain transport category airplanesoperated under 14 CFR parts 91, 121,125, and 129 beyond the specifiedcompliance time, unless the operator ofthose airplanes has incorporated FAA-approved specific maintenance andinspection instructions applicable to the

fuel tank system in its approvedmaintenance or inspection program, asapplicable. The operationalapplicability was established so that allairplane types affected by the SFAR,regardless of type of operation, aresubject to FAA approved fuel tanksystem maintenance and inspectionprocedures. As discussed earlier, thisrule includes each turbine-poweredtransport category airplane model,provided its TC was issued after January1, 1958, and it has either a maximumtype certificated passenger capacity of30 or more, or a maximum typecertificated payload capacity of 7,500pounds or more.

Affect on Field ApprovalsA significant number of changes to

transport category airplane fuel tanksystems have been incorporated throughfield approvals issued to the operatorsof those airplanes. These changes mayalso significantly affect the safety of thefuel tank system. The operator of anyairplane with such changes is requiredto develop the fuel tank systemmaintenance and inspection programinstructions and submit it to the FAAfor approval, together with thenecessary substantiation of compliancewith the safety review requirements ofthe SFAR.

Compliance With OperatingRequirements

This rule establishes a 36-monthcompliance time from the effective dateof the rule for operators to incorporateFAA-approved, long-term, fuel tanksystem maintenance and inspectioninstructions into their approvedprogram. The FAA expects eachoperator to work with the airplane TCholder or STC holder to develop a planto implement the required maintenanceand inspection instructions within the36-month period. The plan shouldinclude periodic reviews with thecognizant ACO and AEG responsible forapproval of the associated maintenanceand inspection instructions.

The fuel tank safety review may resultin maintenance actions that are overdueprior to the effective date of theoperational rules. The plan provided bythe operator should includerecommended timing of initialinspections or maintenance actions thatare incorporated in the long termmaintenance or inspection program. Ananalysis of and supporting evidence forthe proposed timing of the initial actionshould be provided to the FAA. Forexample, it may be determined that aninspection of a certain componentshould be conducted after 50,000 flighthours. Some airplanes within the fleet



may have accumulated over 50,000flight hours. The timing of the initialinspection must be approved by theFAA and would be dependent upon anevaluation of the safety impact of theinspection. It is desirable to incorporatethese inspections in the current heavymaintenance program, such as a ‘‘C’’ or‘‘D’’ check, without taking airplanes outof service. However, it may bedetermined that more expeditiousaction is required, which may bemandated by AD.

Changes to Part 25Currently, § 25.981 defines limits on

surface temperatures within transportairplane fuel tank systems. In order toaddress future airplane designs, § 25.981is revised to address both prevention ofignition sources in fuel tanks, andreduction in the time fuel tanks containflammable vapors. The first partexplicitly includes a requirement foreffectively precluding ignition sourceswithin the fuel tank systems of transportcategory airplanes. The second partrequires minimizing the formation offlammable vapors in the fuel tanks.

Fuel Tank Ignition Source—Section25.981

The title of § 25.981 is changed from‘‘Fuel tank temperature’’ to ‘‘Fuel tankignition prevention.’’ The substance ofexisting paragraph (a), which requiresthe applicant to determine the highesttemperature that allows a safe marginbelow the lowest expected auto ignitiontemperature of the fuel, is retained.Likewise, the substance of existingparagraph (b), which requiresprecluding the temperature in the fueltank from exceeding the temperaturedetermined under paragraph (a), is alsoretained. These requirements areredesignated as (a)(1) and (2)respectively.

Compliance with these paragraphsrequires the determination of the fuelflammability characteristics of the fuelsapproved for use. Fuels approved foruse on transport category airplanes havediffering flammability characteristics.The fuel with the lowest autoignitiontemperature is JET A (kerosene), whichhas an autoignition temperature ofapproximately 450°F at sea level. Theautoignition temperature of JP–4 isapproximately 470°F at sea level. Underthe same atmospheric conditions, theautoignition temperature of gasoline isapproximately 800°F. The autoignitiontemperature of these fuels increases atincreasing altitudes (lower pressures).For the purposes of this rule, the lowesttemperature at which autoignition canoccur for the most critical fuel approvedfor use should be determined. A

temperature providing a safe margin isat least 50°F below the lowest expectedautoignition temperature of the fuelthroughout the altitude and temperatureenvelopes approved for the airplanetype for which approval is requested.

This rulemaking also adds a newparagraph (a)(3) to require that a safetyanalysis be performed to demonstratethat the presence of an ignition sourcein the fuel tank system could not resultfrom any single failure, from any singlefailure in combination with any latentfailure condition not shown to beextremely remote, or from anycombination of failures not shown to beextremely improbable.

These new requirements define threescenarios that must be addressed inorder to show compliance withparagraph (a)(3). The first scenario isthat any single failure, regardless of theprobability of occurrence of the failure,must not cause an ignition source. Thesecond scenario is that any singlefailure, regardless of the probabilityoccurrence, in combination with anylatent failure condition not shown to beat least extremely remote (i.e., notshown to be extremely remote orextremely improbable), must not causean ignition source. The third scenario isthat any combination of failures notshown to be extremely improbable mustnot cause an ignition source.

For the purpose of this rule,‘‘extremely remote’’ failure conditionsare those not anticipated to occur toeach airplane during its total life, butwhich may occur a few times whenconsidering the total operational life ofall airplanes of the type. This definitionis consistent with that proposed by theARAC for a revision to FAA AC25.1309–1A and that currently used bythe JAA in AMJ 25.1309. ‘‘Extremelyimprobable’’ failure conditions are thoseso unlikely that they are not anticipatedto occur during the entire operationallife of all airplanes of one type. Thisdefinition is consistent with thedefinition provided in FAA AC25.1309–1A and retained in the draftrevision to AC 25.1309–1A proposed bythe ARAC.

The severity of the externalenvironmental conditions that shouldbe considered when demonstratingcompliance with this rule are thoseestablished by certification regulationsand special conditions (e.g., HIRF),regardless of the associated probability.The rule also requires that the effects ofmanufacturing variability, aging, wear,and likely damage be taken into accountwhen demonstrating compliance.

These requirements are consistentwith the general powerplant installationfailure analysis requirements of

§ 25.901(c) and the systems failureanalysis requirements of § 25.1309, asthey have been applied to powerplantinstallations. This additionalrequirement is needed because thegeneral requirements of §§ 25.901 and25.1309 have not been consistentlyapplied and documented when showingthat ignition sources are precluded fromtransport category airplane fuel tanks.Compliance with § 25.981 requires ananalysis of the airplane fuel tank systemusing analytical methods anddocumentation currently used by theaviation industry in demonstratingcompliance with §§ 25.901 and 25.1309.In order to eliminate any ambiguity asto the necessary methods of compliance,the rule explicitly requires that theexistence of latent failures be assumedunless they are extremely remote, whichis currently required under § 25.901, butnot under § 25.1309. The analysisshould be conducted assuming designdeficiencies listed in the backgroundsection of this document, and any otherfailure modes identified within the fueltank system functional hazardassessment.

Based upon the evaluations requiredby § 25.981(a), a new requirement isadded to paragraph (b) to require thatcritical design configuration controllimitations, inspections, or otherprocedures be established as necessaryto prevent development of ignitionsources within the fuel tank system, andthat they be included in theAirworthiness Limitations section of theICA required by § 25.1529. Thisrequirement is similar to that containedin § 25.571 for airplane structure.Appendix H to part 25 is also revised toadd a requirement to provide anymandatory fuel tank system inspectionsor maintenance actions in theAirworthiness Limitations section of theICA.

Critical design configuration controllimitations include any informationnecessary to maintain those designfeatures that have been defined in theoriginal type design as needed topreclude development of ignitionsources. This information is essential toensure that maintenance, repairs, oralterations do not unintentionallyviolate the integrity of the original fueltank system type design. An example ofa critical design configuration controllimitation for current designs discussedpreviously would be maintaining wireseparation between FQIS wiring andother high power electrical circuits. Theoriginal design approval holder mustdefine a method to ensure that thisessential information will be evident tothose that may perform and approverepairs and alterations. Visual means to



alert the maintenance crew must beplaced in areas of the airplane whereinappropriate actions may degrade theintegrity of the design configuration. Inaddition, this information should becommunicated by statements inappropriate manuals, such as WiringDiagram Manuals.

Flammability RequirementsThe FAA agrees with the intent of the

regulatory text recommended by theARAC. However, due to the shorttimeframe that the ARAC was providedto complete the tasking, a sufficientdetailed economic evaluation was notcompleted to determine if practicalmeans, such as ground based inerting,were available to reduce the exposurebelow the specified value of 7 percentof the operational time included in theARAC proposal. The FAA is adopting amore objective regulation that isintended to minimize exposure tooperation with flammable conditions inthe fuel tanks.

As discussed previously, the ARAChas submitted a recommendation to theFAA that the FAA continue to evaluatemeans for minimizing the developmentof flammable vapors within the fueltanks. Development of a definitivestandard to address thisrecommendation will require additionaleffort that will likely take some time tocomplete. In the meantime, however,the FAA is aware that historicallycertain design methods have been foundacceptable that, when compared toreadily available alternative methods,increase the likelihood that flammablevapors will develop in the fuel tanks.For example, in some designs, includingthe Boeing Model 747, air conditioningpacks have been located immediatelybelow a fuel tank without provisions toreduce transfer of heat from the packs tothe tank.

Therefore, in order to preclude thefuture use of such design practices,§ 25.981 is revised to add a requirementthat fuel tank installations be designedto minimize the development offlammable vapors in the fuel tanks.Alternatively, if an applicant concludesthat such minimization is notadvantageous, it may propose means tomitigate the effects of an ignition of fuelvapors in the fuel tanks. For example,such means might include installationof fire suppressing polyurethane foam.

This rule is not intended to preventthe development of flammable vapors infuel tanks because total prevention hascurrently not been found to be feasible.Rather, it is intended as an interimmeasure to preclude, in new designs,the use of design methods that result ina relatively high likelihood that

flammable vapors will develop in fueltanks when other practicable designmethods are available that can reducethe likelihood of such development. Forexample, the rule does not prohibitinstallation of fuel tanks in the cargocompartment, placing heat exchangersin fuel tanks, or locating a fuel tank inthe center wing. It does, however,require that practical means, such astransferring heat from the fuel tank (e.g.,use of ventilation or cooling air), beincorporated into the airplane design ifheat sources were placed in or near thefuel tanks that significantly increasedthe formation of flammable fuel vaporsin the tank, or if the tank is located inan area of the airplane where little or nocooling occurs. The intent of the rule isto require that fuel tanks are not heated,and cool at a rate equivalent to that ofa wing tank in the transport airplanebeing evaluated. This may requireincorporating design features to reduceflammability, for example cooling andventilation means or inerting for fueltanks located in the center wing box,horizontal stabilizer, or auxiliary fueltanks located in the cargo compartment.At such time as the FAA has completedthe necessary research and identified anappropriate definitive standard toaddress this issue, new rulemaking willbe considered to revise the standardadopted in this rulemaking.

Applicability of Part 25 Change

The amendments to part 25 apply toall transport category airplane modelsfor which an application for typecertification is made after the effectivedate of the rule, regardless of passengercapacity or size. In addition, ascurrently required by the provisions of§ 21.50, applicants for any futurechanges to existing part 25 typecertificated airplanes, including STC’s,that could introduce an ignition sourcein the fuel tank system are required toprovide any necessary Instructions forContinued Airworthiness, as requiredby § 25.1529 and the change to theAirworthiness Limitations section,paragraph H25.4 of Appendix H. Incases where it is determined that theexisting ICA are adequate for thecontinued airworthiness of the alteredproduct, then it should be noted on theSTC, PMA supplement, or majoralteration approval.

FAA Advisory Material

In addition to the amendmentspresented in this rulemaking, the FAAis continuing development of AC25.981–1B, ‘‘Fuel Tank Ignition SourcePrevention Guidelines’’ (a revision toAC 25.981–1A), and a new AC 25.981–

2, ‘‘Fuel Tank FlammabilityMinimization.’’

AC 25.981–1B includes considerationof failure conditions that could result insources of ignition of vapors within fueltanks, and provides guidance on how tosubstantiate that ignition sources willnot be present in airplane fuel tanksystems following failures ormalfunctions of airplane components orsystems. This AC also includesguidance for developing any limitationsfor the ICA that may be generated by thefuel tank system safety review.

AC 25.981–2 provides informationand guidance concerning compliancewith the new requirements identified inthis rulemaking pertaining tominimizing the formation or mitigationof hazards from flammable fuel airmixtures within fuel tanks.

Discussion of Comments

Thirty four commenters responded toNotice 99–18, including private citizens,foreign aviation authorities,manufacturers of inerting equipment,individual airplane manufacturers andoperators (both foreign and domestic),an organization representing theinterests of manufacturers of generalaviation airplanes, an airline pilotsrepresentative, an organizationrepresenting the consolidated interestsof the aviation industry worldwide, andthe National Transportation SafetyBoard. The majority of commentersagree in principle with the proposals. Adiscussion of these comments follows,including FAA’s response, grouped bysubject matter.

Discussion of Comments on ProposedSFAR

For ease of reference, throughout thefollowing discussion, the term‘‘designer’’ is used to refer to all personssubject to the requirements of theSpecial Federal Aviation Regulation(SFAR).

General Favorable Comments

Several commenters, includingrepresentatives of manufacturers andoperators, agree in principle with thesafety review that would be required bythe proposed new SFAR to part 21 andhave, in fact, already engaged in anindustry-wide initiative in this area.These commenters state that theybelieve firmly that the objective of theproposed safety review will enhance thelevel of safety that already exists in thetransport fleet.



Request to Include Smaller Part 25Airplanes, Rotorcraft, and Part 23Airplanes in SFAR Applicability

Several commenters disagree with theproposal to limit applicability of theSFAR to larger airplanes (30 or morepassengers) due to the time needed toconduct a thorough economic analysisand the possible impact it would haveon small businesses. However, thecommenters request that this evaluationbe completed and that smaller transportairplanes be included because of thedesign similarities of the smallerairplanes to larger airplanes.

Additionally, one commenter notesthat, because the proposal excludes asignificant portion of the fleet, theproposal is not in keeping with theFAA’s stated goals of the ‘‘One level ofSafety’’ initiative. This commenter alsonotes that the FAA stated in the noticethat applying the proposedrequirements to certain regionalairliners would not significantlyincrease the expected quantitativebenefits of the rule because there havebeen no in-flight fuel tank explosions onthose airplanes. The commenter isconcerned that the FAA may be using‘‘faulty reasoning’’ to eliminate the needfor any follow-on action to address thissegment of the fleet.

Another commenter stronglyrecommends that the SFAR be extendedto include part 23 aircraft and part 27rotorcraft because these types of aircraftmay be susceptible to fuel tank systemproblems similar to those addressed inthe proposed rule.

FAA’s Response: The FAA agrees that,even though the fuel tank systems ofsmaller transport category airplanes maybe simpler, similarities in the designs ofthe fuel systems of those airplanes mayresult in a need to apply the standard tothem. As discussed in the notice, weplan to conduct the appropriateeconomic analysis to determine if therule should be applied to smallertransport airplanes. Should the resultsof that analysis indicate that the SFARrequirements should be applied tosmaller transports, we will considerdeveloping further rulemaking toaddress those airplanes. For now, theapplicability of the final rule willremain as proposed in the notice.

We do not agree that the proposedSFAR should be applied to part 23aircraft and part 27 rotorcraft at thistime. Service experience has notindicated that immediate action isnecessary to address the fuel tanksystems of those types of aircraft at thistime. However, we may reconsider thisaction if future service experienceindicates that it is warranted.

Request to Exclude Mitsubishi YS–11Airplanes and Lockheed ElectraAirplanes

Mitsubishi Heavy Industries America,Inc., requests that the Mitsubishi ModelYS–11 airplane be excluded from theSFAR applicability. The commenter’sjustification for this exclusion is thatnone of these airplane models iscurrently being operated in the U.S. andnone are likely to be operated in thefuture. The commenter further statesthat there has never been a fuel tank-related incident or accident on any ofthese airplane models. The commenterrefers to the FAA’s statement in thepreamble to the notice that certain olderreciprocating engine-powered andconverted turbine-powered transportairplanes should be excluded from therule because:

‘‘* * * the few remaining such airplanesare in cargo service and because theiradvanced age and small numbers wouldmake compliance impractical from aneconomic standpoint.’’

The commenter asserts that the samerationale should be applicable to theModel YS–11 because not one suchairplane is currently operating in theU.S. and the possibility of suchairplanes ever returning to cargo service,much less passenger service, in the U.S.is virtually non-existent. Therefore,there are no benefits to be achieved bythe design review.

Similarly, Lockheed Martin alsorequests that its airplane model, theLockheed Model L–188 Electra airplane,be excluded from the applicability ofthe SFAR. Like the first commenter, thiscommenter refers to the statement in thepreamble to the notice that certain olderreciprocating and turbine-poweredairplanes should be excluded becausecompliance would be impractical froman economic standpoint. Thecommenter suggests that the Model L–188 Electra also falls into this categoryand should be excluded from the rule’sapplicability. The commenter furthersuggests that the retroactive applicationof the new requirements to any oldermodel include provisions in the rulethat would permit favorable serviceexperience to be submitted instead ofextensive failure analysis. Thecommenter refers to a safety studyconducted of the Model L–188 Electrafuel system which shows that the fuelsystem service experience is excellent.

FAA’s Response: The FAA does notconcur with these commenters’ requeststo revise the applicability of the SFAR.As stated in Notice 99–18, parts 91, 121,125, and 129 would be amended torequire operators to incorporate FAA-approved fuel tank system maintenance

and inspection instructions into theircurrent maintenance or inspectionprogram of transport category airplanestype-certificated after January 1, 1958.That date was chosen so that all turbine-powered transport category airplaneswould be included, except for a few1947 vintage Grumman Mallards, and1953–1958 vintage Convair Model 340and 440 airplanes converted fromreciprocating to turbine power.

We do not consider the informationpresented by either of the commenterssufficient to warrant a general exclusionof either the Model YS–11 or the ModelL–188 Electra from the applicability ofthe SFAR. We do acknowledge,however, that the current operations ofModel L–188 Electra airplanes to remoteAleutian points and on military contractflights do involve unique circumstancesworthy of further consideration. Forexample, we might conclude that, whilefull compliance is not cost effective,some lesser degree of fuel tank systemevaluation is necessary.

While there is insufficient basis onwhich to exclude the Model L–188Electra airplanes in general, the TCholder may petition the FAA for anexemption from the provisions of thisfinal rule showing that it would be inthe public interest. Similarly, we wouldconsider petitions for exemption fromthe SFAR for the Model YS–11 or anyother airplane not currently operatedunder U.S. registry. Such requests forexemption would be handled outside ofthis rulemaking action. Even if anexemption were granted from the SFARto a design approval holder, operators ofthe affected airplanes would still besubject to the requirements of theoperating rules established by this finalrule. Petitions for exemption by theoperators would involve differentconsiderations.

Request to ‘‘Harmonize’’ the Rule WithEuropean Authorities

Several commenters, includingrepresentatives from aviation officials ofthe JAA and Transport Canada, statethat the proposed SFAR should havebeen developed through the AviationRulemaking Advisory Committee(ARAC) and its harmonization process.These commenters contend thatharmonizing the proposed rule would:

• simplify operations,• reduce the cost of compliance

without compromising safety, and• extend the latest safety benefits

more broadly in the world fleet.The commenters also state that

issuing the rule under theharmonization process would havefacilitated eventual delegation of theSFAR compliance findings between the



FAA and the JAA. Some commentersrequest that the disposition of publiccomments be handled through theARAC process.

FAA’s Response: The FAA does notconcur with the commenters. When thisrulemaking was initiated, we faced achoice between proceeding unilaterallyor proceeding through theharmonization process involving theJAA and the public through ARAC. Atthat time, we chose to proceedunilaterally in order to address theimportant safety need on an expeditedbasis. In a separate action, we did taskARAC with developing proposedregulatory text to eliminate or reduceflammability in airplane fuel tanks. Thefundamentals of ARAC’s proposal areincluded in this rule.

With the issuance of this rule, weconsider that the safety need has beenaddressed and we are now open to aharmonization effort. To facilitateharmonization, we have coordinated theproposal with the JAA and TransportCanada. Comments from the JAA andTransport Canada indicate theiragreement in principle with our actions,and they have stated their intention tomandate similar fuel tank safety actions.While we will ensure compliance withthe SFAR, the operating rules, and thepart 25 design standards as adopted inthis final rule, we will continuediscussions with Transport Canada andthe JAA concerning possibleharmonization efforts relating to the part25 change.

The safety improvements provided bythis rule are as urgent now as they werewhen we decided to proceedunilaterally. The comments do notpersuade us that the policy judgmentsreflected in the notice were incorrect.Because expedited adoption of this finalrule is necessary, and because furtherdiscussion of comments within ARACwould not change the FAA’s policydeterminations, further review of theproposed rule by ARAC would not beappropriate.

Request To Delegate ComplianceFindings

Several commenters request that theFAA delegate SFAR compliancefindings to the prime certificationauthority in accordance with theapproved bilateral agreement.

FAA’s Response: The FAA interpretsthe reference to ‘‘prime certificationauthority’’ to mean the ‘‘state of design,’’as that term is used in ICAO Annex 8.Because the SFAR imposesrequirements on existing designers, thebilateral airworthiness agreements,which address new certifications, do notdirectly apply. To the extent that

bilateral countries choose to becomeinvolved in reviewing submissions forcompliance with the SFAR, we willwork closely with them. This shouldfacilitate the harmonization effortsdescribed previously. However, underthe SFAR the FAA must approve thedesign approval holder’s submission.

Request for Definition of Safety Review

One commenter notes that the terms‘‘safety review,’’ ‘‘design review,’’‘‘safety analysis,’’ and ‘‘functionalhazard assessment’’ appear to be usedinterchangeably throughout the notice.However, each of these terms couldhave significantly different meanings.The commenter requests that, if it is theintent of the FAA to have differentmeanings for these terms, then thedefinitions should be clearly stated andthe terms should be used in theappropriate context.

The commenter offers the followingdefinitions in an attempt to establish aunified understanding of the objectives:

• ‘‘Safety Review’’—a comprehensiveassessment of the fuel tank system thatmeets all the requirements of theSpecial Federal Aviation Regulation.

• ‘‘Safety Analysis’’—process ofensuring that the fuel system is fail-safeby conducting a design review andfailure modes and effects analysis.

• ‘‘Design Review’’—process ofreviewing all relevant engineeringdesign drawings to ensure thatappropriate design practices have beenused and identify failure modes.

• ‘‘Failure Modes Analysis’’—processof evaluating all identified failuremodes resulting from the design reviewby conducting a failure modes andeffects analysis (FMEA) and a fault treeanalysis (FTA).

The commenter requests that a similarset of definitions be provided in theSFAR to clarify the intentions of theregulation.

FAA’s Response: The FAA concursthat clarification is appropriate. Theobjective of the SFAR is to requiredesigners to conduct ‘‘safety reviews,’’which is the broadest term defined bythe commenter. The term ‘‘safetyreview’’ is the correct term that is usedin the text of the SFAR. For clarificationsake, we have used the term ‘‘safetyreview’’ throughout the discussions inthis preamble to describe the actionrequired by the SFAR. No change to thefinal rule text is necessary in this regard,however.

Question on the Need for a SystemSafety Review

One commenter considers that theproposed safety review required underthe new part 21 SFAR is excessive. This

commenter regards the proposal asessentially a requirement to re-certifythe fuel systems of all turbine-poweredcommercial transports, with respect toavoiding fuel tank fires and explosions.The commenter points out that, whilemore than 450 million hours of serviceexperience on these airplanes haveidentified valuable lessons learned, thissame service experience alsodemonstrates the largely successfuloutcome of the previously certifieddesigns. The extent of the safety reviewthat the proposed SFAR would requiregoes beyond what is commensurate withthe historical data.

FAA’s Response: The FAA does notconcur with the commenter that theservice history of the affected airplanesdoes not warrant the type of safetyreview proposed. Specifically, wedisagree that past service has been‘‘largely successful.’’ While thecommenter states that the fleet hasachieved a good safety record, we pointout that, as discussed in detail in thepreamble to the notice, there has beenextensive service history data related toanomalies, system failures, aging-relatedproblems, etc., of the fuel tanks oftransport category airplanes. Servicedata show that there have been 16 fueltank explosion events. Further, the factthat the FAA has issued over 40airworthiness directives to correct fueltank safety hazards affecting a largecross section of the transport airplanefleet indicates that extensiverevalidation of the fuel tank systems, asproposed, is necessary.

Question on Quantitative vs. QualitativeSafety Review of Older Airplane Designs

One commenter suggests that theproposed SFAR should allow aircraftcertificated prior to Amendment 25–23and § 25.1309 reliability requirements toundergo a qualitative—rather thanquantitative—safety review. Then, fromthe results of the review, an inspectionor maintenance plan could bedeveloped, and, finally, a one-timeinspection of the entire fleet could beperformed. The commenter supportsthis type of assessment for severalreasons:

1. The current version of § 25.1309requires a safety review and aquantitative assessment to validate thata system is fail-safe. However, accuratestatistical reliability information neededto conduct the safety analysis is likelyto be unavailable for fuel systemcomponents used nearly 30 years ago.

2. When conducting a safety review,conservative assumptions are requiredwhen accurate reliability data isunavailable. These conservativeassumptions could lead to false and



detrimental failure probability results.This circumstance could occur multipletimes during the analysis, or even causecompounded error effects, requiringeven more severe corrective actions.

3. By the methods proposed in theproposed rule, a ‘‘representative’’ fueltank system would be created based on30-year-old drawings that would be‘‘fraught with unavoidableassumptions,’’ while at the same time berequired to meet the ‘‘extremelyimprobable’’ failure conditionprobability criteria of 1 × 10 ¥9. Thiswould lead to unnecessary inspections,maintenance, repairs, andmodifications.

To meet the intent of the SFAR moreeffectively, the commenter proposes thata qualitative safety review beconducted, based on:

• The investigative efforts of the FAAand NTSB,

• AD’s,• Service bulletins,• Lessons learned,• Performance history of the aircraft,

and• Results of the recent industry-wide

fuel tank inspection program.In addition, the labor and time costs

for a qualitative analysis would bedramatically lower than for aquantitative analysis. A qualitativeanalysis could be conducted using theknowledge and experience of current in-house personnel and applying familiarmethods of evaluation. It likely wouldtake less time, as well.

Several other commenters alsoquestion the practicality of requiring theproposed safety review if the lateststandards are to be applied to olderairplane designs. These commentersmaintain that the proposed SFAReffectively requires recertification ofolder airplanes’ fuel tanks to showcompliance with the quantitative systemsafety assessment requirementsintroduced in § 25.1309 of Amendment25–23. The commenters point out thatthose requirements were neitherdeveloped nor in effect for the airplaneswhose certification basis was approvedprior to the time that Amendment 25–23 was issued in May 1970. Themajority of the airplanes affected by theproposed SFAR fall into this category.

Further, the commenters note thatquantitative analysis methods forshowing compliance with therequirements of Amendment 25–23were not even developed or approvedby the FAA until June 1988, when theFAA issued guidance on this subject inAdvisory Circular 25.1309–1A. Thesemethods were not necessarily applied toaircraft certified before that date. Thus,the certification documentation and

technical archives of pre-amendment25–23 aircraft may be limited in theirusefulness to support a formalizedanalysis.

These commenters also state that re-evaluation of older aircraft types usingtoday’s quantitative analysismethodologies, such as a failure modesand effects analysis (FMEA), would beimpractical and present‘‘insurmountable difficulties,’’ given theunavailability of data and the resourcesrequired. One commenter states that thistype of safety review would beextremely labor-and resource-intensive,and would have both short- and long-term adverse economic effects on theaviation industry.

Another commenter states that theproposal does not provide a simpledesign-assessment method that iscompatible with the technicalinformation available to TC and STCholders. (The commenter gave noexamples of incompatibility, however.)

FAA’s Response: The FAA recognizesthat the fuel tank systems of most oldertransport airplane designs were notevaluated during certification using thequantitative safety assessment methodsassociated with § 25.1309. For theseairplanes, the FAA agrees that aqualitative, rather than quantitative,approach can and should be used wherepossible for the fuel tank system safetyreview. The level of analysis required toshow that ignition sources will notdevelop will depend upon the specificdesign features of the fuel tank systembeing evaluated. Detailed quantitativeanalysis should not be necessary if aqualitative safety assessment shows thatfeatures incorporated into the fuel tanksystem design protect against thedevelopment of ignition sources withinthe fuel tank system. For example, forwiring entering the fuel tanks,compliance demonstration could beshown in three steps.

• First, the wiring could be shown tohave protective features such asseparation, shielding, or transientsuppression devices;

• Second, the effectiveness of thosefeatures could be demonstrated; and

• Third, any long-term maintenancerequirements or critical designconfiguration limitations could bedefined so that the protective featuresare not degraded.

Another example would be showingthat fuel pumps are installed in such away that the fuel pump inlet remainscovered whenever the fuel pump isoperating throughout the airplaneoperating attitude envelope, includinganticipated low fuel operations andground conditions. This could be asatisfactory method of meeting the fail-

safe requirement for the fuel pumpmechanical components, although itwould not necessarily address fuelpump motor failure modes. (AdvisoryCircular 25.981–1B provides additionalguidance on the acceptability ofqualitative assessments where fail-safefeatures are provided.)

Additionally, if fail-safe features areincorporated into the design in such away that the effects of other systems onthe fuel tank system can be shown to bebenign, then no additional designassessment and inspections would berequired. Designers using this approachwould be required to providesubstantiation that the design featurespreclude the need for detailed designassessment of the system and futureinspections. Designers consideringusing this approach should coordinateas early as possible with the cognizantACO.

On the other hand, the fact that aquantitative assessment and related datado not currently exist for some olderairplane types does not mean that asimilar safety assessment cannot beaccomplished on these airplanes. It isfeasible to use a modern safetyassessment method on older airplanesthat will recognize and evaluatepotential failures and their effects, andwill identify actions that couldeliminate or reduce the chance of apotential failure from occurring.

Methods for conducting a quantitativeanalysis of any system are well-established and readily available. Forexample, the FMEA and fault treeanalysis methodology is widelyaccepted and understood. In fact, therecurrently are several software packagesavailable commercially that arespecifically designed for assisting indeveloping FMEA’s; these have provento be particularly useful in reducing theamount of time, labor, clerical support,and monetary burden that normallywould be entailed.

In light of this, we anticipate that allaffected TC and STC holders will befully capable of complying with theSFAR requirements.

No change to the final rule isnecessary with regard to thesecomments. The rule requires thatapplicants ‘‘conduct a safety review’’ ofthe airplane, but does not specify anyparticular method of review.

Question on Intent of Safety ReviewOne commenter questions the FAA’s

intent regarding the safety review. Thiscommenter notes that the proposedSFAR states, ‘‘ * * * single failures willnot jeopardize the safe operation * * *‘‘ and ‘‘ * * * latent failures have to beassumed * * *’’ However, there are a



number of single failures identified inthe SFAR that have the capability tocreate an ignition source within the fueltank. Examples include:

• Various mechanical pump failuremodes,

• Various electrical pump failuremodes, and

• Arcing of pump power cables to theconduit.

There are a number of single failureswithin the examples listed above thatwould not be acceptable to showcompliance in accordance with thecurrent application of § 25.1309, whichrequires that ‘‘ * * * failure of anysingle component should be assumed* * * and not prevent continued safeflight * * *’’ In light of this, thecommenter asks if the FAA is expectingmodifications to cover all these cases; ifnot, there is a risk that the interpretationof § 25.1309 may be degraded.

The commenter further states thatthere are a number of latent failures infuel tanks that could create an ignitionsource within the fuel tank, for example:

• Loss of pump over-temperatureprotection, and

• Loss of bonding (electro-static andlightning protection).

These types of latent failures are noteasy to detect without a physicalinspection inside the tank. Thecommenter asks how these types oflatent failures will be considered whenassessing the safety of fuel tanks.Clearly, frequent internal inspections offuel tanks are not acceptable, and somemeans for agreeing to certain designpractices on existing aircraft may beneeded.

FAA’s Response: The intent of thesafety review, as stated in the notice, isto apply current system safetyassessment standards to the affectedairplanes in the existing transport fleet.We fully expect that, where fail-safefeatures do not exist, modifications todesigns and changes to maintenancepractices will be required for asignificant portion of the fleet to addressthe single and multiple failures noted bythe commenter. If inspections to detectlatent failures are impractical, it wouldbe necessary to modify the design toprovide fail-safe features or indicationsto eliminate latency.

Request for a Lessons LearnedApproach

Certain commenters state that theproposed safety review would be moreuseful if it were based strictly on lessonslearned, and request that the proposalbe changed accordingly. Thecommenters propose an alternativemethod that would be based on serviceexperience (lessons learned) and

regulated as a ‘‘prescriptive-type rule.’’As an example, the commenters suggestthat the FAA first define acomprehensive list of items that maynot have been considered adequately inthe original fuel system design and forwhich there is some service experience.The list could include such items as:

• Fuel pumps,• Wiring to pumps in conduits

located inside fuel tanks,• Fuel pump connectors,• Fuel quantity indicating system

wiring and probes, and• Component bonding.The FAA could then require that fuel

system designs be evaluated against this‘‘checklist’’ to determine if adequateconsideration has been made regardingthe potential effects of each item listed.Any single failures shown to cause anignition source in the fuel tank wouldwarrant a design change. A quantitativefault tree analysis could then bedeveloped for combinations of failuresshown to cause ignition sources, todetermine if such failure combinationscould be expected to occur in theremaining fleet life of the affectedaircraft type.

These commenters state that amongthe benefits of this prescriptive designreview approach would be:

• A common evaluation criterion foreach aircraft type, regardless of itscertification basis.

• A more objective evaluation processthat simplifies delegating thecompliance-finding task by the FAA andensures equal treatment for eachmanufacturer and operator.

• Faster completion of the task,submittal of the report to the FAA, andresolution of any deficiencies in theexisting fleet.

• Development of a standardizedreport or checklist to ease thecompliance-finding process.

• A far greater pool of people able toaccomplish the task, because aprescriptive review method would notdemand engineers with detailedexpertise in fuel systems and safetyassessment methodology.

These commenters maintain that theFAA’s safety review proposed in theSFAR would be merely an additionalburden that could interfere withrealizing the benefits of lessons learned.They consider that their suggestedalternative approach is more practical,and equally effective in enhancing fuelsystem safety.

FAA’s Response: The FAA does notconcur with these commenters’ request.To conduct a safety review based solelyon lessons learned would not providethe level of safety that is intended by theproposal. A lessons learned focus would

address problems that were known tohave occurred in the past; however, itwould not necessarily address potentialproblems and risks that could occur inthe future. Thus, a lessons learned focusis a reactive, not a proactive, approach.There may be unforeseen failure modesthat would not necessarily be accountedfor by only evaluating failure modes thathave occurred in the past, as would bedone with a lessons-learned approach.

One example is in AC 25.981–1A,published originally in 1971, whichincluded a list of failure modes, basedupon lessons learned at that time, thatshould have been considered inshowing compliance with therequirements of § 25.981. Since that ACwas published, however, numerousunforeseen failures have occurred, thus,resulting in a much longer list that isnow included in the revision to that AC.While such a list is valuable inproviding guidance for conducting asafety assessment, it is not all-inclusiveand we do not consider it adequate forconducting a comprehensive safetyassessment.

On the other hand, the qualitativeapproach to the required safety reviewwill result in consideration of, andmeans to address, potential failuremodes, even if they have not yet beenencountered in service. For example, ifa qualitative assessment indicated that aparticular design feature could result ina high voltage electrical surge into thefuel tank, then the assessment wouldconclude that measures should be takento prevent such an occurrence,regardless of whether it is a ‘‘lessonlearned’’ based on past occurrences.

Request for Risk Assessment Only ofRemaining Fleet Life

One commenter suggests that thesafety review methodology proposed bythe FAA should provide a riskassessment over the remaining fleet lifeof each aircraft type. Many of theaircraft types that would be affected bythe proposed SFAR are approaching theend of their fleet lives. The commenterasserts that, when determining if safetyreviews and resulting design changesare warranted, the consideration shouldbe based upon a risk assessment basedon the remaining fleet life.

FAA’s Response: The FAA agrees thatthe remaining fleet life could be oneconsideration in establishing a basis foran exemption from the requirement toperform a safety review for particularmodels, but it is not a general basis forlimiting the applicability of theproposal. While some models ofairplanes have exceeded their economicdesign goal (for example the BoeingModel 727 and McDonnell Douglas



Model DC–9), there are individualairplanes of those models that are stillin service, and extensive future servicelife is planned for them. Consequently,exposure to the risk of fuel tankexplosions remains as valid for thesemodels as for any others in service.

Regarding whether resulting designchanges are warranted, those changeswould necessarily be mandated byseparate regulatory actions (AD’s).Therefore, whether the changes arewarranted will be assessed in thecontext of those actions.

Request for Change in Compliance Timefor Conducting Safety Review

Several commenters state that the 12-month compliance time for completingthe required actions proposed under theSFAR is unrealistic, and request alonger period for compliance. Thereasons that these commenters give areas follows:

First, industry lacks the resources toaccomplish the requirements within theproposed timeframe. There are limitedqualified personnel to conduct the levelof safety review that the proposed SFARwould require. Formalized system safetyanalysis of the type outlined in AC25.1309–1A requires specialists withextensive knowledge of the systemarchitecture, component details, andservice history, as well as the analysismethodology.

Second, the flow time necessary toperform the proposed safety reviewwould exceed the proposed compliancetime. The commenters point out thatover 100 airplane models would need tobe reviewed, and the proposed safetyreview methodology would require twoto four years of effort per major modelfor large transport aircraft. Some majormodels of airplanes have numerousminor model variations. These minormodel variations would add significantadditional review effort. Availability ofqualified engineers does not allow thesereviews to be conducted in a completelyparallel fashion. Assuming a 9-monthflow time to accomplish each reviewand the capability to conduct up tothree reviews simultaneously, somemanufacturers would require well inexcess of 45 months to complete theproposed reviews. In other instances,the resources available to some TC orSTC holders may limit their capabilityto one safety review at a time. Theseestimates take into account workalready accomplished by the industryover the past 4 years.

Third, development of themaintenance instructions could notpossibly be accomplished within theproposed 12-month compliance time.As written, the proposed SFAR would

require ‘‘all maintenance and inspectioninstructions necessary’’ to be submittedas part of the safety review report.However, the commenters assert thateffective development of a maintenanceprogram cannot practically start untilthe safety review is completed, and itmust be developed in coordination withthe operators and regulatory agencies.Therefore, submittal of the maintenanceand inspection instructions as part ofthe safety review report is not feasible.The commenters request that theproposal be revised to allow a period of6 to 8 months for the development ofthese instructions once the FAA hasapproved the safety review report.

Fourth, necessary design changesidentified as a result of the safety reviewcould not be developed, evaluated, andshown to comply with the newrequirements within the proposedcompliance time. The commentersrequest that the compliance time fordesign change activity be treatedseparately from the SFAR reviewactivity.

Fifth, the FAA itself lacks resources tosupport timely review of the safetyreview reports required by the SFARwithin the 12-month time proposed tocomplete the review. The commentersbelieve that the FAA has grosslyunderestimated its own flow timesregarding coordination and approval ofthe SFAR-mandated safety reviews andresulting compliance substantiationdocuments. Experience has shown thatthe FAA typically takes 60 to 90 daysto review and approve of documents ofthis kind. Multiplied by 100 reports ormore, it would appear that the FAAitself would require more than theproposed 12 months compliance time tocomplete its review and approval cycleonce the reports are submitted by theindustry.

Another commenter considers that theproposed compliance time fordeveloping the maintenance andinspection program is inadequate. Thecommenter asserts that, without theinsights gained through the SFARdesign review assessment process, anyattempts to accurately revise existingmaintenance and inspection programswould be ‘‘counterproductive’’ to thegoals of the proposed rule. Thecommenter maintains that the FAAunderestimates the time necessary toprepare and develop the maintenanceprogram, receive approval, andimplement the program. Thiscommenter requests that the proposedrule be changed to allow more time forrevising the operator’s maintenance orinspection programs, and that this timestart only after the completion of thedesign review and the manufacturers’

maintenance program for each airplanemodel.

Certain other commenters request thatthe proposal be changed to include thefollowing text:‘‘Compliance time:

(a) All design review reports must besubmitted to the Administrator no later than36 months after the effective date of this ruleor within 18 months of the issuance of acertificate for which application was filedbefore [effective date of the rule], whicheveris later.

(b) Maintenance and inspectioninstructions must be submitted to theAdministrator no later than 8 months afterthe FAA has approved the design reviewreport for the applicable aircraft type.’’

Others request that the compliancetime for completion of the safety reviewshould be extended to 54 months.

FAA’s Response: The FAA hasconsidered the reasons for thecommenters’ requests and concurs thatthe compliance time should be extendedsomewhat. We have revised the finalrule to provide a compliance time of 18months for conducting the safetyreviews and submitting them to theFAA. Even for those designers whowork closely with the appropriateACO’s in conducting their reviews, weacknowledge that, followingsubmission, some time will be requiredfor FAA review and for any necessaryrevisions, and we consider that 6months should be adequate for thoseactivities. We are aware that when theFAA has mandated maintenanceprogram changes in the past, we havetypically allowed operators 12 monthsto incorporate those changes into theirprograms. Therefore, we have revisedthe operating rules to require thatoperators incorporate the maintenanceprogram changes within 36 months afterthe effective date.

Designers may allocate the 18-monthcompliance time between the safetyreview and the development ofmaintenance and inspectioninstructions as they deem appropriate.In evaluating the information presentedby the commenters and the relevantsafety concerns, we have determinedthat this revision can be made withoutsignificantly affecting safety.

These revised compliance times arenot as long as those requested by thecommenters for the following reasons:

• The commenters based theirestimates on the assumption that aquantitative assessment would berequired. As discussed previously, inmost cases a less time-consumingqualitative assessment will be sufficient.

• There is a substantial degree ofcommonality in design features of theaffected models. Such commonality will



allow analysis to be conducted bysimilarity to previously revieweddesigns. In light of this, we do notforesee designers needing to conduct aseparate safety analysis ‘‘from scratch’’for each model.

• Since the TWA 800 accident over 4years ago, many manufacturers alreadyhave completed significant reviews ofservice history and analysis of fuel tankdesigns for many airplane types. Thiswill significantly reduce the time andresources that will be needed tocomplete the requirements of the SFAR.

• We expect that industry will workclosely with the cognizant ACO inplanning the safety review, andproviding feedback as the evaluationprogresses. This should allow expeditedapproval by the local office.

Given the additional time provided inthe final rule, we are confident that thetechnical capability exists and thatindustry will expend the resourcesneeded to address this critical safetyissue in a timely manner.

As for the compliance time fordevelopment of needed design changes,we have revised the text of the final ruleto include a provision that would allowextensions of the compliance time on acase-by-case basis. The final rule statesthat the FAA may grant an extension ofthe compliance time if:

• The safety review is completedwithin the compliance time, and

• Necessary design changes areidentified within the compliance time,and

• Additional time can be justified.

Request for Clarification of SFARApplicability to STC Holders

Two commenters state that, asworded, the proposed SFAR text doesnot clearly specify that it applies toholders of STC modifications that mayhave no direct relationship to the fuelsystem, but could have an effect on fueltank safety. The commenters areconcerned that some readers maymisconstrue the current text as referringonly to STC’s for modifications directlyto the fuel tank system, and not STC’sthat are adjacent to the fuel tank andmay indirectly affect them.

One of these commentersrecommends that the proposed phrase‘‘supplemental type certificates affectingthe airplane fuel tank system’’ berevised to ‘‘supplemental typecertificates capable of affecting theairplane fuel tank system.’’ The othercommenter suggests that the phrase berevised to ‘‘supplemental typecertificates modifying the airplane fueltank system.’’

The commenters consider that addingthe suggested words would make it clear

that the SFAR applies not just to fuelsystem STC’s, but to all STC’s that couldaffect the fuel system.

FAA’s Response: The FAA concurswith the commenters that a change inthe text of the SFAR is necessary toclarify the intent. It was the FAA’sintent that the SFAR requirements wereto apply to holders of STC’s that mayaffect the fuel system or result in a fueltank ignition source. This was explainedin detail in the preamble to the notice,and that discussion is repeated in thisfinal rule under the heading,‘‘Supplemental Type Certificates,’’above.

Based on the comments, we recognizethat the proposed text could beconstrued too narrowly; that is,construed to mean that the requirementsapply only to STC modifications thatactually change the fuel tank system.We also recognize that it may not bepossible to determine whether amodification actually affects the safetyof the fuel tank system withoutconducting at least a rudimentaryqualitative evaluation. In order to clarifythis point, we have revised the text ofthe final rule to state that the SFARapplies to all holders of type certificatesand supplemental type certificates that‘‘may affect’’ the safety of the fuel tanksystem.

Request for Clarification of SFARRequirements for STC’s Not DirectlyRelated to Fuel Tanks

One commenter raises concerns aboutthe requirements of the proposed rule asthey apply to STC approvals ofmodifications that are not specificallyfuel tank system modifications. Thesetypes of approvals are referred to as‘‘non-ATA 28 STC approvals.’’ (‘‘ATA28 STC’s’’ refers to approvals thatactually change the fuel tank system.)Specifically, the commenter questionsthe feasibility of conducting a safetyreview on the types of modificationswhose installation(s) do not actuallychange, but could affect, the airplanefuel tank system.

The commenter requests that the FAAconsider a separate requirement in theSFAR for assessing the effect of thesenon-ATA 28 STC’s on the fuel system.The commenter asserts that airplanes onwhich non-ATA 28 STC’s are installedshould only be assessed qualitatively orby inspection, and that only two keyareas need to be examined:

1. The modification of wiring next toor near wiring that enters the fuel tank.These commenters suggest that theeffects of these STC’s could be assessedby a one-time inspection performed oneach aircraft model by a specific time,such as:

• At the next heavy-maintenanceinspection interval where the area orzone is opened and accessed, or

• In conjunction with any downtimenecessitated by a modification programresulting from the safety reviewrequired by the proposed SFAR.

The objective of the suggestedinspection would be to examine wiringthat enters the fuel tank and assesswhether any STC modificationsintroduce non-conformities that maycompromise the fail-safe design conceptor may be a possible fuel tank ignitionsource. (Only the wiring external to thetank would need to be inspected.) Thenonconformity would be establishedbased on a listing of specific inspectionguidelines issued by either the FAA(possibly in the revised AC 25.981–1B)or the OEM’s for each aircraft model. Aswith the SFAR safety review, any non-conformity would be identified andreported to the design approval holder.

As alternatives to this one-timeinspection, the commenter suggests:

• A qualitative design review couldbe conducted, if sufficient technicalinformation is available regarding theinstallation of the pertinent STC’s.

• Alternative methods could beconducted that ensure the continuedairworthiness of the airplane (withrespect to wiring that enters the fueltank). For example, installation of atransient suppression device shouldeliminate the need to inspect or conductdesign reviews of modifications thatmight otherwise affect FQIS wiring.

2. The effect of modifications to theenvironmental control system (ECS) andother system modifications capable ofgenerating autoignition temperature intothe tank structure. The commenterstates that a qualitative review of thesesystems should be conducted byreviewing whether the approvedconfiguration has been altered. If it hasbeen altered, the operator wouldidentify the alteration and ‘‘report it tothe person responsible’’ (i.e., the designapproval holder of the designmodification).

The commenter states that a one-timeinspection process, as described above,would need to be developed using:

• The OEM’s or STC holder’s list ofgeneral design practices and precautionsobtained during their SFAR safetyreviews, and

• The revised maintenance programproduced from the SFAR safety review.

The commenters foresee thisinformation as providing operators withguidelines on what to inspect, how toinspect, and what the pass/fail criteriaare.

The commenter suggests that thisinspection should not repeat the



inspections that have been performed todate by the operator. (For example, theoperator should receive credit for anyinspections performed because of anairworthiness directive or part of theindustry-wide Fuel System SafetyProgram.)

FAA’s Response: The FAA does notconcur with the commenter’s suggestionfor several reasons. Although thecommenter characterizes its proposal asa ‘‘qualitative review,’’ it would onlyresult in an inspection for ‘‘non-conformities,’’ with the inspectionresults forwarded to the design approvalholder. The suggestion does not specifywhat, if any, obligation the designapproval holder would have to addressthese non-conformities, which, bydefinition, are not part of the holder’sapproved design. It would beunreasonable to impose an obligation ondesign approval holders to conductreviews of designs for which they arenot responsible. In light of thiscommenter’s adverse commentsregarding imposing a requirement forsuch holders to review their owndesigns, imposing an additionalobligation is inconsistent.

In addition, the commenter’ssuggestion would result in a long delayin completion of the safety review of thefuel tank system. For example, thecommenter suggests that the inspectiontake place during a heavy maintenanceinspection; however, the heavymaintenance inspection intervals aretypically every 4 to 5 years. Once theairplane configuration was determined,additional time would be needed tocomplete the assessment and to developany necessary maintenance andinspection programs or design changes.The alternative process suggested by thecommenters could effectively postponeaddressing the effects of wiring on thefuel tank system by as much as 7 or 8years. The elapsed time to complete thisprocess would not provide the level ofsafety intended by the FAA or expectedby the public.

Question on SFAR Requirements forSTC’s Where No Technical Data IsAvailable

Several commenters raise a concernabout the proposed SFAR requirementsas they pertain to a safety review ofpertinent STC’s where the STC holder isout of business and the necessarytechnical data is not readily available.The commenters expect that, for thesecases, the burden would fall on theoperators to conduct the reviewrequired by the SFAR. The commentersare concerned that, for a large numberof these operators, the review processfor these types of STC’s may present ‘‘an

insurmountable burden’’ for thefollowing reasons:

• A full review of modificationsaccomplished by the operators over thedecades that some of the affectedairplanes have been operated isimpracticable.

• Where operators have sold aircraftto another party, it is possible that thecurrent owner of the airplane may comeback to the operator and require such anevaluation. This situation isunmanageable.

• Operators will have difficultyperforming any type of quantitativeanalysis due to lack of intensivefamiliarity with these types of methods.

• The technical information requiredto perform a quantitative or qualitativeanalysis may not be available or may notpertain to the specific aircraft model.

• Involvement by the originalequipment manufacturer (OEM) inproviding operators with assistance isviewed by the operators as likely to beminimal.

The commenters are particularlyconcerned that the OEM’s are probablynot familiar with many of the STC’s thathave been incorporated on the aircraft.Further, the chance of obtaining anassistance contract with the OEMs isslim because they will be stretched formanpower supporting OEMresponsibilities relating to the proposedSFAR.

Additionally, the commenters areconcerned that technical assistance fromthe FAA’s fuel system specialists cannotbe ensured for the operators. The FAAmay be prepared to work with theaffected type certificate holders to assistthem in complying with therequirements of the proposed SFAR, butsuch assistance may not be possible foroperators in this situation due to a lackof manpower.

FAA’s Response: The FAA does notagree that the proposed rule wouldimpose ‘‘insurmountable burdens’’ onoperators. As with all operating rules,the person ultimately responsible forcompliance is the operator. But thisrulemaking is unique in the extent towhich current designers are required toprovide operators with analysis anddocumentation of maintenanceprograms to support operators infulfilling their obligations.

The existing operating rules generallyrequire operators to maintain theiraircraft in an airworthy condition. Aprerequisite for maintaining an airplaneis the ability to understand itsconfiguration, at least with respect tosafety critical systems. This is reflectedin operating rules such as§ 121.380(a)(2)(vii), which requires a listof current major alterations to be

retained permanently, and § 121.380a,which requires that these records betransferred with the airplane.

This rulemaking originated from theFAA’s conclusion that fuel tank systemson current transport category airplanesmay not be airworthy, and that theseriousness of this safety issue warrantssubstantial efforts to identify safetyproblems in order to prevent futureaccidents such as TWA 800. It isunacceptable for operators to claim notonly that they are currently unable tounderstand the configurations of thesesystems on their airplanes, but that it isunreasonable to expect them to gain thatunderstanding. The objective of thisrulemaking would be defeated ifoperators of airplanes withconfiguration changes were allowed torely solely on the instructionsdeveloped by TC and STC holders thatmay not reflect the actualconfigurations. This would allow forhazards introduced by the configurationchanges to remain unaddressed.

As discussed previously, this samecommenter suggests a one-timeinspection to identify certain aspects ofthe configuration. We concur that, forthose operators who cannot otherwiseidentify their airplanes’ configurations,a one-time inspection of the entiresystem may be an appropriate means ofdetermining the configurations. Oncethe configuration is known, the operatorcan perform a safety review ofconfiguration changes not included inthe TC holder and relevant STC holderreviews. As discussed previously, thistype of review may be qualitative anddoes not require a quantitative analysis.In performing this review, the operatorcan use the guidance provided in AC25.981–1B and the TC and relevant STCholder maintenance and inspectionprograms.

These operators could begininspecting these airplanes immediatelyso that the differences from the TC andSTC configurations can be documentedand taken into consideration in thesystem safety assessment and anysubsequent maintenance and inspectioninstructions. While operators may nothave adequate engineering resources tocomplete the evaluations and may notbe able to rely on TC holders for supportin evaluating these changes, technicalassistance contracts and use ofDesignated Engineering Representatives(DERs) are possible methods ofcompleting the necessary work.

While we are confident that operatorsare capable of complying with theserequirements, we recognize the validityof the operators concerns regarding thecompliance time. Because it isimportant that this review be done



properly, the compliance time forimplementing the resulting maintenanceand inspection programs is extendedfrom 18 months to 36 months. Thisprovides the operators an additional 18months after the TC and STC holdersare required to complete their programs,to complete the safety review of anyfield approvals on their airplanes,develop a comprehensive maintenanceor inspection program, and implementthe FAA approved maintenance orinspection program. We consider thissufficient to address any design changesidentified by the operators.

Question on Applicability of SFAR toModifications Installed via FieldApprovals

One commenter points out that, in thepreamble to the notice where changes tothe operating requirements wereexplained, the FAA included adiscussion of the effect of thoserequirements on field approvals. [‘‘Fieldapprovals’’ are defined as those designchanges approved by an authorizedFAA aviation safety inspector (e.g.,Principal Maintenance Inspector, PMI)on an FAA Form 337, ‘‘Major Repairand Alteration,’’ or other document(e.g., an airline engineering order).]However, the preamble did not includea discussion of field approvals in thecontext of the proposed SFAR. Further,the proposed text of neither the SFARnor the operating requirements containsany mention of field approvals. Thus,the commenter questions whether theproposed rule actually applies to fieldapprovals whose installations may affectthe airplane fuel tank system.Additionally, the commenter questionswhether other forms of repairs ormodifications permitted on in-serviceaircraft and not specifically mentionedin the SFAR (for example, approvalsused by airlines via SFAR 36 repairs)need to be considered within thecontext of the proposed rule.

If the FAA intends that all repairs beconsidered under the rule’srequirements, then the commenterrequests that field approvals, approvedrepairs, and so on, be considered in thesame fashion as non-ATA 28 STC’s(discussed above).

Similarly, another commenter statesthat modifications approved under afield approval may prove to beproblematic when attempting to complywith the safety review analysis thatwould be required by the proposedSFAR. These types of modificationswere discussed in the preamble to thenotice, but were not accounted for in theeconomic analysis. The commenterconsiders that more details are neededas to how to address them. The field

approval does not have the samevisibility as an STC, and it could besubstantially more difficult to identifywhich of these types of modificationcould affect the fuel systems.Furthermore, many might have beenapproved by an inspector, withoutcertification engineering analysis anddata; this would certainly complicatethe safety review analysis required bythe SFAR. Such modifications are ofinterest even to foreign parties as theymight have been incorporated onaircraft that are now on foreignregistries. The commenter requests thatthe FAA provide more details as to howit intends to apply the SFAR to themodifications approved under a fieldapproval.

FAA’s Response: The FAA recognizesthat some clarification is necessary. Thepreamble to the notice and theDiscussion of the Final Rule section ofthis preamble state that the proposedrequirements are intended to apply totype designs, supplemental typedesigns, and field approvals.

The FAA is aware that a significantnumber of changes to transport categoryairplane fuel tank systems have beenincorporated through field approvals.These changes may significantly affectthe safety of the fuel tank system. Asdiscussed previously, the operator ofany airplane with such changes wouldbe required to identify them, completea safety assessment taking intoconsideration the safety assessmentscompleted by the TC and STC holders,and to develop applicable maintenanceand inspection instructions and submitthem to the FAA for approval, togetherwith the necessary substantiation ofcompliance with the safety reviewrequirements of the SFAR. To eliminateany misunderstanding, the operationalfinal rules have been revised to statethat the instructions for maintenanceand inspection of the fuel tank systemmust address the actual configuration ofeach affected airplane.

Question on Applicability of SFAR toRepairs

One commenter requests more detailsconcerning how the proposed safetyreview required by the SFAR would beapplicable to repairs that currently existon an airplane. The commenter pointsout that the proposed SFAR text omitsany mention of repairs. The commenterstates that it would be very difficult totrace back all the repairs, and theirsupporting engineering data, so that aproper safety analysis could be carriedout. The commenter believes that theserepairs, like ‘‘orphan STC’s,’’ mightrender the design review by safetyanalysis approach unworkable in many

cases. To help the operators, themanufacturers should be required toprovide for an alternative to the safetyassessment.

FAA’s Response: As discussed above,the FAA intends that the instructionsrequired by the operating rules addressthe actual configurations of theairplanes. As required by 14 CFR 43.13,a repair must restore the airplane to itsoriginal or properly altered condition.Therefore, repairs should not adverselyaffect fuel tank system safety. To theextent that known repairs may havechanged design features affecting fueltank system safety, they should beaddressed in the maintenance andinspection instructions. We recognizethat, unlike records of major alterations,repair records are not required to beretained permanently. If operators areunaware of such repairs, this rule doesnot require that inspections beconducted solely for the purpose ofidentifying them. On the other hand, ifsuch repairs are identified as a result ofinspections performed to identifyconfiguration changes, those repairsmust be addressed in the instructions.

Request for Clarification on Role of thePrincipal Maintenance Inspector inSFAR Actions

One commenter requests aclarification of the role of the principalmaintenance inspector (PMI) in the fueltank safety review process that would berequired by the SFAR. The commenterstates that there must be technicalinformation available at the airline orPMI level to effectively carry out theobjective of the proposed SFAR.However, the commenter is concernedthat, even though there will beguidelines available in the new AC25.981–1B, a PMI ‘‘will not have theexpertise to be able to evaluate whetheran alternative truly satisfies the SFAR.’’

FAA’s Response: The FAA does notintend that the PMI would evaluate thetechnical design information. As statedin the preamble to the notice and theDiscussion of the Final Rule section ofthis preamble, the FAA would requirethat this information be submitted to thecognizant FAA Aircraft CertificationOffice (ACO). The maintenance andinspection program that is generatedalso would be approved by thecognizant ACO. The PMI would beresponsible for oversight of the operatorto verify that any mandatorymaintenance or inspection actions areincorporated into the operators’maintenance or inspection programs.



Request for a One-Time InspectionProgram

One commenter requests a revision tothe proposed rule to require that, priorto conducting a system safety reviewand analysis for each aircraft type, adetailed inspection should beconducted of the fuel tanks of severalrepresentative airplanes for each typecertificated aircraft. The purpose of theinspection would be to determine thespecific health of the fleet. Theinspection should span both old andnewer airplanes, and include at leasttwo operators and at least 10 airplanes.The commenter suggests that thisshould be a very aggressive inspection,which would involve removal andteardown of components and inspectionof difficult-to-reach areas. Thedeficiencies and failures listed in thenotice, as well as the findings of theindustry-wide inspections of the Boeing747 fuel tanks, could provide a startingpoint for defining the nature of theinspections. Based on findings of theseinspections, appropriate correctiveaction could be determined andmandated. Required design changeswould become apparent as a result ofthis inspection program.

The commenter states that there areprecedents to this type of inspection.For example, the United States AirForce conducted aggressive inspectionsof B–52 and KC–135 aircraft in the1980’s to establish the condition ofthese aircraft, and required correctiveaction for continued safe operation ofthese aging aircraft. These inspectionprograms, referred to as ConditionAssessment/Inspection Programs (CA/IP), were conducted for many of thesame concerns that were raised in thenotice, although the programs coveredother aircraft systems as well (i.e.,electrical, avionic, hydraulic,pneumatic, etc.). The CA/IP findingsresulted in numerous fuel systemcorrective actions to enhance safety,including maintenance actions andintervals, and design improvements.

FAA’s Response: The FAA does notconcur with the suggestions of thiscommenter for several reasons:

There already have been ampleinspections, service history reviews, andother assessments of the transport fleetthat have confirmed, without question,that the safety of the fuel tank systemson these airplanes must be improved.Most recently, the industry-led FuelTank Safety Team conducted aninspection of over 800 transportcategory airplane fuel tanks, whichrevealed such things as repairs andalterations that may result in a fuel tanksystem that does not meet the original

type design; improperly installed parts;improperly routed wiring; etc.

We do not consider that thecommenters’ suggested one-timeinspection is necessary for airplanes forwhich the configuration can beidentified by other means. Nevertheless,the development of critical designconfiguration control limitations andmandatory maintenance and inspectionitems will likely result in eventualinspection of all critical fuel tanksystem-related areas of airplanes in thetransport fleet.

Question on Redundant vs. Single-Thread Fuel Tank Systems

One commenter questions a statementin the preamble to the notice thatintroduced the FAA’s discussion of itsreview of maintenance practices for thefuel tank system. The statement read,

Typical transport category airplane fueltank systems are designed with redundancyand fault indication features such that singlecomponent failures do not result in anysignificant reduction in safety.

The commenter maintains that justthe opposite is true: Current designs aresingle-thread systems. That is becausethere will be an explosive mixture in thetank on a regular basis, and there islikely to be debris in the tank, so anysingle failure, such as a hot short, willcompromise safety. The same is true forpump insulation failures.

FAA’s Response: The FAA disagreeswith this commenter’s observations inpart. Regulations applicable to airplanesaffected by this rulemaking require that‘‘no single failure or likely combinationof failures may result in a hazard.’’However, we do agree that theinvestigation of fuel tank system designshas shown certain installations do notmeet this requirement. This is one of thepurposes for the requirements of thisrulemaking action.

Request for Clarification of Statement ofProbability

One commenter disagrees with astatement that appeared in the preambleto the notice, which stated:

The proposed SFAR would require thedesign approval holder to perform a safetyreview of the fuel tank system to show thatfuel tank fires or explosions will not occuron airplanes of the approved design.

The commenter states that it isimpossible to show that ‘‘fuel tank firesor explosions will not occur,’’ becausethe probability of such an event, interms of a system safety analysis, cannotbe shown to be equal to zero. Thecommenter believes that this is not whatthe FAA intended. The commentersuggests that this phrase be removed

because the essence of the requirementof the proposed SFAR is captured inanother passage that appearedimmediately after the cited phrase in thepreamble to the notice, which read:

* * * In conducting the review, the designapproval holder would be required todemonstrate compliance with the standardsproposed in this notice for § 25.981(a) and (b)* * * and the existing standards of§ 25.901.’’

The commenter points out that thestandards proposed in the notice neithersuggest nor require that the probabilityof the occurrence of a fire or explosionshould be zero.

Alternatively, the commenter suggeststhat the intent of the regulation could beclarified to require practical eliminationof ignition sources with the intent toeliminate all sources by use of newtechnology and design architecture.

FAA’s Response: The FAA considersthat some clarification is necessary. Weagree with the commenter that it isimpossible to show that the probabilityof a fuel tank explosion is equal to zeroin numerical terms. The statement citedin the notice was intended to express invery general terms the objective of theproposed rule—that ‘‘fuel tank fires orexplosions will not occur.’’ Theintended level of safety is clearlydefined in the regulatory text. Weconcur with the clarification of intentprovided by the commenter.

Request To Address Third PartyMaintenance Activity in Safety Review

One commenter notes that experiencehas shown that unauthorized processesand materials are sometimes used bythird party repair businesses, possiblyeven unknown to the designer. Thismay result in service problems thatwould be unforeseen by the designer,and possibly a reduced level of safety.The commenter argues that it does notseem reasonable to expect a survey ofthe safety of fuel system designs to takeinto account the effect of unauthorizedand, therefore, unforeseeablemaintenance activities. There may befeatures of the design that are critical tothe safe operation of the equipment, butnot obvious to a third party. Thecommenter requests that the FAAconsider revising the proposedregulation to ensure that maintenanceaction carried out by parties notcognizant of the safety consequences oftheir procedures do not jeopardize thesafety of aircraft in service.

FAA’s Response: The FAA agrees inpart with this commenter. The fuel tanksafety review required by this rule mustinclude failures that are foreseeable aswell as any that have occurred inservice. The evaluation also must



include consideration of susceptibilityto maintenance errors. The requirementto develop critical design configurationcontrol limitations, discussed later, isintended to provide maintenancepersonnel with precisely the type ofsafety critical information identified bythe commenter.

Discussion of Comments on § 25.981,Fuel Tank Ignition Prevention

Request for Revision to Requirement forAddressing Latent Failures

One commenter believes that theproposed § 25.981(a)(3), which wouldrequire demonstrating that an ignitionsource could not result from single orlatent failures, is too severe. Thecommenter asserts that it presentsrequirements that are outside the scopeof § 25.1309 and § 25.901(c); these arethe same standards that the FAA statesin the preamble to be the baseline forthe proposed requirements relative tothe ignition source preventionassessment. These regulations provide adefined method for assessing latentfailures (although the regulations do notspecifically address latent failures). Thecommenter favors the continued use ofthe fail-safe design concept as definedin AC 25.1309–1A. The commentermaintains that the new wordingproposed by the FAA imposes arequirement on latent failure conditionsthat are just one part of a larger set ofcombinations leading to the hazard of‘‘ignition sources present in fuel tanks.’’It is the larger set that § 25.1309 imposesa requirement on, thus taking intoaccount the complete set of allcombinations. The commenter statesthat the proposed wording of§ 25.981(a)(3) ‘‘adversely penalizes’’ theresulting outcome of the analysis, inparticular the definition of maintenanceintervals and the means for determiningwhether an added safety feature isrequired to mitigate or prevent theevent.

FAA’s Response: The FAA disagreeswith the commenter’s assertion thatcurrent industry practice is adequate toaddress fuel tank safety issues.Paragraph 5.a.1. of AC 25.1309–1A,which the commenter supports, states inpart:

In any system or subsystem, the failure ofany single element, component or connectionshould be assumed to occur during any oneflight regardless of the likelihood that itwould fail. Any such single-failure shouldnot prevent the continued safe flight andlanding of the airplane, nor significantlyimpair the ability of the crew to cope withthe resulting conditions.

Consequently, if ‘‘any one flight’’ istaken literally, this includes flights

anticipated to originate with pre-existing failures. However, we recognizethat the meaning of ‘‘any one flight’’ hasbeen a contentious issue for many years,and we have agreed to work withinARAC to try and resolve the issue of‘‘specific risk’’ for the more generallyapplicable rules, such as § 25.901(c) and§ 25.1309. Furthermore, as noted earlier,if a more appropriate means ofaddressing this issue should result fromthese ARAC activities, this rule will beamended accordingly to retainconsistency. This commitment to ARACnotwithstanding, the FAA is alsocommitted to assuring that transportcategory airplane designs are acceptablyfail-safe on each flight, not just on atypical flight of mean duration or onflights where the airplane initially hasno failures present.

The FAA disagrees with thecommenters’ assertion that therequirements of § 25.981(a)(3) are‘‘outside the scope of § 25.1309 and§ 25.901(c).’’ As stated previously in thenotice and in this final rule, the FAA’spolicy for compliance with § 25.901(c),in general, has been to requireapplicants to assume the presence offoreseeable latent (operationallyundetected) failure conditions whendemonstrating that subsequent singlefailures will not jeopardize the safeoperation of the airplane. Thisrequirement (referred to as ‘‘latent plusone’’) simply provides the same singlefault tolerance for aircraft operatingwith an anticipated latent failure aswould be provided by FAA MasterMinimum Equipment List (MMEL)policies if that failure is known to exist(i.e., not latent).

As for § 25.1309, the commenterappears to be confusing the objective ofthe rule (i.e., to prevent the occurrenceof catastrophic failure conditions thatcan be anticipated) with a conditionallyacceptable means of demonstratingcompliance, as described in AC25.1309–1A (i.e., that catastrophicfailure conditions must have an‘‘average probability per flight hour’’ ofless than 1×10¥9). Since this samemisconception has presented itselfmany times before, the followingdiscussion is intended to clarify theintent of the term ‘‘extremelyimprobable’’ and the role of ‘‘averageprobability’’ in demonstrating that acondition is ‘‘extremely improbable.’’

The term ‘‘extremely improbable’’ (orits predecessor term, ‘‘extremelyremote’’) has been used in 14 CFR part25 for many years. The objective of thisterm has been to describe a condition(usually a failure condition) that has aprobability of occurrence so remote thatit is not anticipated to occur in service

on any transport category airplane.While a rule sets a minimum standardfor all the airplanes to which it applies,compliance determinations arenecessarily limited to individual typedesigns. Consequently, all that has beenrequired of applicants is a sufficientlyconservative demonstration that acondition is not anticipated to occur inservice on the type design beingassessed.

The means of demonstrating that theoccurrence of an event is extremelyimprobable varies widely, depending onthe type of system, component, orsituation that must be assessed. Therehas been a tendency, as evidenced bythe comment, to confuse the meaning ofthis term with the particular means usedto demonstrate compliance in thosevarious contexts. This has led to amisunderstanding that the term has adifferent meaning in different sectionsof part 25.

As a rule, failure conditions arisingfrom a single failure are not consideredextremely improbable; thus, probabilityassessments normally involve failureconditions arising from multiplefailures. Both qualitative andquantitative assessments are used inpractice, and both are often necessary tosome degree to support a conclusionthat an event is extremely improbable.

Qualitative methods are techniquesused to structure a logical foundationfor any credible assessment. While abest-estimate quantitative analysis isoften valuable, there are many situationswhere the qualitative aspects of theassessment and engineering judgmentmust be relied on to a much greaterdegree. These situations include thosewhere:

• There is insufficient reliabilityinformation (e.g., unknown operatingtime or conditions associated withfailure data);

• Dependencies among assessmentvariables are subtle or unpredictable(e.g., independence of two circuitfailures on the same microchip, size andshape of impact damage due to foreignobjects);

• The range of an assessment variableis extreme or indeterminate; and

• Human factors play a significantrole (e.g., safe outcome dependenttotally upon the flightcrew immediately,accurately, and completely identifyingand mitigating an obscure failurecondition).

Qualitative compliance guidanceusually involves selecting combinationsof failures that, based on experience andengineering judgment, are considered tobe just short of ‘‘extremely improbable’’,and then demonstrating that they willnot cause a catastrophe. In some cases,



examples of combinations of failuresnecessary for a qualitative assessmentare directly provided in the rule. Forexample, § 25.671 (concerning flightcontrols) sets forth several examples ofcombinations of failures that areintended to help define the outermostboundary of events that are not‘‘extremely improbable.’’ Judgmentwould dictate that other combinations,equally likely or more likely, would alsobe included as not ‘‘extremelyimprobable.’’ However, combinationsless likely than the examples would beconsidered so remote that they are notexpected to occur and are, therefore,considered extremely improbable.Another common qualitativecompliance guideline is to assume thatany failure condition anticipated to bepresent for more than one flight,occurring in combination with any othersingle failure, is not ‘‘extremelyimprobable.’’ This is the guideline, oftenused to find compliance with§ 25.901(c), that the FAA is adopting asa standard in § 25.981(a)(3).

Quantitative methods are thosenumerical techniques used to predictthe frequency or the probability of thevarious occurrences within a qualitativeanalysis. Quantitative methods are vitalfor supporting the conclusion that acomplex condition is extremelyimprobable. When a quantitativeprobability analysis is used, one has toaccept the fact that the probability ofzero is not attainable for the occurrenceof a condition that is physicallypossible. Therefore, a probability levelis chosen that is small enough that,when combined with a conservativeassessment and good engineeringjudgment, it provides convincingevidence that the condition would notoccur in service.

For conditions that lend themselves toaverage probability analysis, a guidelineon the order of 1 in 1 billion iscommonly used as the maximumaverage probability that an ‘‘extremelyimprobable’’ condition can have duringa typical flight hour. This 1 in 1 billion‘‘average probability per flight hour’’criterion was originally derived in aneffort to assure the proliferation ofcritical systems would not increase thehistorical accident rate. This criterionwas based on an assumption that therewould be no more than 100 catastrophicfailure conditions per airplane. Thiscriterion was later adopted as guidancein AC 25.1309. The historical derivationof this criterion should not bemisinterpreted to mean that the rule isonly intended to limit the frequency ofcatastrophe to that historic 1×10¥7

level. The FAA conditionally acceptsthe use of this guidance only because,

when combined with a conservativeassessment and good engineeringjudgment, it has been an effectiveindicator that a condition is notanticipated to occur, at least not for thereasons identified and assessed in theanalysis. Furthermore, decreasing thiscriterion to anything greater than1×10¥12 would not result insubstantially improved designs, onlyincreased line maintenance. The FAAhas concluded that the resultingincreased exposure to maintenance errorwould likely counteract any benefitsfrom such a change. An ARAC workinggroup has validated these conclusions.

When using ‘‘averages,’’ care must betaken to assure that the anticipateddeviations around that ‘‘average’’ are notso extreme that the ‘‘peak’’ values areunacceptably susceptible to inherentuncertainties. That is to say, the risk onone flight cannot be extremely highsimply because the risk on anotherflight is extremely low. An importantexample of the flaw in relying solely onconsideration of ‘‘average’’ risk is the‘‘specific risk’’ that results fromoperation with latent (not operationallydetectable) failures. It is this risk that isbeing addressed by § 25.981(a)(3), asadopted in this final rule. For example,latent failures have been identified asthe primary or contributing cause ofseveral accidents. In 1991, a thrustreverser deployment occurred duringclimb from Bangkok, Thailand, on aBoeing Model 767 due to a latent failurein the reversing system. In 1996, a thrustreverser deployment on a Fokker ModelF–100 airplane occurred followingtakeoff from Sao Paulo, Brazil, due to alatent failure in the system. As notedearlier, the NTSB determined that theprobable cause of the TWA 800 accidentwas ignition of fuel vapors in the centerwing fuel from an ignition source:

* * * The source of ignition energy for theexplosion could not be determined withcertainty but, of the sources evaluated by theinvestigation, the most likely was a shortcircuit outside of the center wing tank thatallowed excessive voltage to enter it throughelectrical wiring associated with the fuelquantity indication system [FQIS].

A latent failure or condition creatinga reduced arc gap in the FQIS wouldhave to be present to result in anignition source. This rule is intended torequire designs that prevent operation ofan airplane with a preexisting conditionor failure such as a reduced arc gap inthe FQIS (latent failure) and asubsequent single failure resulting in ashort circuit that causes an electrical arcinside the fuel tank.

Due to variability and uncertainty inthe analytical process, predicting anaverage probability of 1 in 1 billion does

not necessarily mean that a condition isextremely improbable; it is simplyevidence that can be used to support theconclusion that a condition is extremelyimprobable. Wherever part 25 requiresthat a condition be ‘‘extremelyimprobable,’’ the compliance method,whether qualitative, quantitative, or acombination of the two, along withengineering judgment, must provideconvincing evidence that the conditionwill not occur in service.

Request To Revise Definition of CriticalDesign Configuration ControlLimitations

One commenter requests thatproposed § 25.981(b) be changed torevise or delete the reference to ‘‘criticaldesign configuration controllimitations.’’ This commenter cannotagree with the definition stated in thenotice as:

* * * any information necessary tomaintain those design features that have beendefined in the original type design as neededto preclude development of ignition sources.

The commenter raises severalconcerns regarding the definition andimplications of critical designconfiguration control limitations:

First, the commenter is concernedthat within the definition, ‘‘anyinformation necessary’’ can beinterpreted as being not only theprovision of maintenance andinspection instructions, but also theprovision of the fuel tank designfeatures itself. This could includematerial specifications, specificmanufacturing processes, dimensions,etc. The commenter states that thismeans the type certificate holder wouldbe required to list its proprietary designapproach, which could lead to a loss ofcompetitive edge and an infringementon proprietary intellectual property. Thecommenter objects to this requirementbecause it would allegedly sacrifice thehard earned competitive advantage thatmanufacturers derive through theirexpertise and continuing investment inresearch and development. As anexample, the commenter asserts, ‘‘if acertain pump is qualified on theairplane, the industry does not believeit is appropriate or necessary to list allof the features inherent to that pumpitself that were qualified as part of theunits approval. This approved parts listand the associated installation andmaintenance manuals suffice formaintaining the airworthiness of thispump.’’

Second, the commenter is concernedthat this would put an unprecedentedliability risk on the type certificateholder if it omits some features, either



through error or because it did notrealize a supplementary functionprovided by the features. (Thecommenter provided no furtherexplanation or substantiation of thisconcern, however.)

Third, the commenter states that thenotion of critical design configurationcontrol limitations goes beyond thenotion of inspection and maintenance.In this regard, it does not imply thesame compliance requirement as§ 25.571, which is the FAA’s statedprecedent for the proposed rule.

Fourth, the commenter considers thatcritical design configuration controllimitations go against standard industrypractice regarding what manufacturersshould provide to users.

Fifth, the commenter states that thenotion of critical design configurationcontrol limitations attempts to coverdeficiencies in the STC and the airlinemodification approval process byindirectly ‘‘implicating’’ themanufacturer in changes to thecertificated configuration that themanufacturer may not have knownabout or performed.

For these reasons, the commenterrequests that the proposed rule berevised to delete or change therequirement concerning critical designconfiguration control limitations.

FAA’s Response: The FAA does notconcur with the commenter’s request torevise the rule, and provides thefollowing disposition of each of thecommenter’s concerns.

1. Concern about release ofproprietary information. The FAA hasalways required manufacturers toprovide information that is necessary tomaintain the safety of a product. Forexample, information that is containedin many maintenance manuals might beconsidered proprietary in nature, butthe FAA requires each manufacturer todevelop instructions for continuedairworthiness for their productscontaining this information. Definingfeatures of an airplane design, such aswire separation, explosion prooffeatures of a fuel pump, maintenanceintervals for transient suppressiondevices, minimum bonding jumperresistance levels, etc., is needed so thatany maintenance actions or subsequentchanges to the product made byoperators or the manufacturer do notdegrade the level of safety of the originaltype design. The definition of criticaldesign configuration control limitationsdoes not include ‘‘all of the featuresinherent’’ in the design; it only includesinformation that is necessary to ensuresafety of fuel tank systems. The policydetermination underlying thisrequirement is that design approval

applicants subject to this requirementshould be required to develop thisinformation and make it available tooperators of affected airplanes. This isconsistent with the policy regardingairworthiness limitations required by§ 25.571 (‘‘Damage-tolerance and fatigueevaluation of structure’’).

2. Concern about liability of typecertificate holders. The FAA disagreesthat risk of liability is an issue. Ifconscientiously implemented, thisrequirement will significantly reducethe risk of accidents from fuel tankexplosions. This, in turn, will reducethe liability risk of design approvalholders.

3. Concern about new inspection andmaintenance requirements. The FAAagrees in part with the commenter.While it is true that the term ‘‘criticaldesign configuration controllimitations’’ is new and may result innew inspection and maintenancerequirements, the very intent of this ruleis to require mandatory maintenanceand inspection for the fuel tank system.We agree that the compliancerequirements are different between§ 25.571 and § 25.981. However, thesedifferences are due to the differencesbetween structures and systems. Forexample, service experience indicatesthat alterations have been made tosystems affecting fuel tank safetywithout consideration of the effects ofthe alterations. One purpose of criticaldesign configuration control limitationsis to ensure that maintenance personnelare informed of and address theseeffects. In the context of structures, theprimary concern has been agingphenomena such as fatigue, and thelimitations are intended to ensure thatthese phenomena are identified andaddressed before they become critical.The result in both instances ismandatory maintenance and inspectionrequirements for both fuel tank systemsand structures. We have determined thatthe fuel tank system warrantsmandatory minimum maintenancecriteria to prevent catastrophic failure.By placing these requirements in theAirworthiness Limitations section of theInstructions for ContinuedAirworthiness, the design approvalholder provides consistent mandatorybaseline maintenance standards for thefleet.

4. Concern that the requirement goesagainst standard industry practiceregarding what manufacturers shouldprovide to users. The FAA agrees thatthe proposed rule may differ fromhistorical industry practice. However,the purpose of this rule is to improveboth the safety of the fleet and thepractices within the industry. The

information we are requiring the designapproval holder to provide to theoperator is basic information needed bythe industry to operate airplanes safely.It will provide operators with a baselinedocument to develop a maintenance andinspection program that will enhancesafety within the fleet. It will also aidthe operator in establishing theconfiguration requirements that must beaccounted for during any subsequentalterations to the airplane.

5. Concern about coveringdeficiencies in the STC andmodification approval process byindirectly implicating the manufacturer.The FAA disagrees that the definition ofcritical design configuration controllimitations ‘‘implicates’’ the TC holderin configuration changes made byothers. On the contrary, theselimitations provide TC holders with theability to limit the types of changes thatmay be made to their designs that couldadversely affect their safety.

Request To Delete Use of Placards andDecals

One commenter requests that§ 25.981(b) of the proposed rule berevised to delete the requirementsconcerning placement of placards ordecals in the areas where ‘‘maintenance,repairs, or alterations may violate thecritical design configurationlimitations.’’ The commenter agrees thatadequate information regarding generaldesign practices and precautions mustbe available to those who perform andapprove repairs and alterations to theairplane. However, the commenterargues that placing placards and decalson the airplane may not be practical,considering that they might not remainin place or be readable over time. Thecommenter suggests that a moreeffective way to convey fuel systemgeneral practices information tooperators is via the standard-practicessection of the Aircraft MaintenanceManual (or a similar section of anotherappropriate manual). The commenterdoes agree that the fuel quantityindicating system (FQIS) wiring couldbe better identified, and suggests thatmanufacturers work with theappropriate agencies to develop astandardized system (similar to that foroxygen lines) to identify critical fuelsystems wiring for future aircraftdesigns.

FAA’s Response: The FAA concurs inpart with the commenter. The rule ismeant to be a performance-based rule;therefore, the FAA’s objective is not tomandate the use of any specific meansof providing visual identification ofcritical design control limitations.Although the text suggests the use of



placards and decals, the rule allowsvisible means other than placards anddecals to be used. Placards are normallyused in many locations of transportairplanes to convey information tomaintenance personnel, but placards areonly one option of identifying criticaldesign configuration limitations. TheFAA also recognizes that installationand maintenance of placards in certainlocations of the airplane may not bepractical.

The objective of this requirement is toprovide a means to assist maintenancepersonnel in reducing maintenanceerrors. Adverse service experiencedemonstrates that modifications haveinadvertently resulted in routing of highpower wiring with FQIS wiring. Theneed to provide visible identification ofcritical design configuration controllimitations will depend upon theparticular airplane configuration.

As an example, the FAA anticipatesthat the requirements of this rule willresult in modifications either to separateFQIS wiring from high power sources,or to install transient suppressiondevices. If transient suppression devicesare incorporated into the FQIS, the FAAwould not consider separation of thewiring from other high power wiring acritical design configuration item and,therefore, would not require visibleidentification. If separation of FQISfrom high power sources wiring iscritical, the FAA will require a visiblemeans of identification. One acceptablemeans of compliance in this case wouldbe to install color-coded tape atspecified intervals along critical wiring.

To clarify the intent of thisrequirement, we have revised thewording within the rule to eliminatereference to placards and decals. Thetext of the final rule states only that avisible means of identification must beprovided.

Discussion of Comments on AppendixH25.4, Instructions for ContinuedAirworthiness

Request To Mandate CertificationMaintenance Requirements Instead ofAppendix

One commenter opposes the proposedAppendix H25.4(a)(2), which wouldrequire revising the Instructions forContinued Airworthiness (ICA) to setforth each mandatory replacement time,inspection interval, related inspectionprocedure, and all critical designconfiguration control limitationsapproved under § 25.981 for the fueltank system. The commenter considersthat singling out just the fuel system forthis requirement is not justified becauseall systems have their own criticalities

that must be documented. Thecommenter asserts that this proposedrequirement fails to recognize thatequivalent systems-related tasks arealready defined under CertificationMaintenance Requirements (CMR), aprocess that has been in place since theearly 1980’s and formalized in 1994.[CMR’s are maintenance requirementsthat identify aircraft system-relatedsafety tasks for ‘‘dormant’’ (latent)failure conditions related to hazardousand catastrophic failure conditions.]The commenter states that CMR’s areconsidered the systems equivalent of thestructural airworthiness limitations andare part of today’s certification process,even though CMR’s are not included inpart 25. The FAA Aircraft CertificationOffices (ACO) and other primecertifying authorities regularly approveCMR’s, and all operators’ maintenanceprograms use these same CMR’s. Thiscommenter states that the proposedrequirement indirectly regroups allmaintenance tasks associated with theprevention of fuel tank ignition sourcesunder the responsibility of the ACO,and this undermines the MRB processas well as the FAA’s Aircraft EvaluationGroups’ (AEG) responsibility inapproving maintenance programs.

In light of this, the commentersuggests that rather than regulate theCMR concept system-by-system as theproposed Appendix would do, the FAAshould pursue a separate regulatoryinitiative that would give officialrecognition of the CMR’s and makethem enforceable. The commenter statesthat doing so would ‘‘fix a long-standingregulatory deficiency.’’ The advantage ofsuch an alternative rulemakingapproach is that it would:

• Keep current procedures andprocesses in place and avoid thecreation of another bureaucraticapproval process;

• Accomplish the FAA objective ofrequiring manufacturers to create anAirworthiness Limitations section in theInstructions for ContinuedAirworthiness similar to that approvedunder § 25.571 for structure; and

• Eliminate the need to enforcemandatory inspection or otherprocedures via § 25.981(b).

Similarly, another commenterbelieves that the FAA should formallyrecognize the CMR concept in theproposed rule. This commenter statesthat in doing so, the concept ofdeclaring ‘‘critical configuration controllimitations,’’ as proposed in § 25.981(b),would be unnecessary. The commenterrecommends the rule be revised to allowuse of the Certification MaintenanceCoordination Committee (CMCC)process, as described in AC 25–19

(‘‘Certification MaintenanceRequirements,’’ issued November 28,1994), to allow operators to absorb taskswithin the existing maintenanceprograms if a MSG–3 task is identified.This reduces costs associated withtracking additional AirworthinessLimitations, which would be required inaccordance with the proposedAppendix H requirements.

FAA’s Response: The FAA does notconcur that the rule should be revisedto include the CMR process. Theconcept of this rule goes beyond thecurrent CMR process. CMR’s onlyaddress mandatory maintenance that isapplied to the airplane at the time oforiginal certification. The requirementof this rule for configuration designcontrol limitations will address not onlymandatory maintenance actions, butalso design features (e.g., wireseparation, pump impeller materialspecification) that cannot be alteredexcept in accordance with theInstructions for ContinuedAirworthiness (ICA). The configurationdesign control limitations will be madepart of the Airworthiness Limitationssection of the ICA; therefore, they willbe mandatory in accordance with§ 91.403(c).

Further, the current MRB processdoes not provide a mandatory, legallyenforceable means to require mandatorymaintenance tasks; nor does it providethe critical control limitations that areneeded to assist operators when makingfuture repairs and alterations to anaircraft.

There would be some value inchanging the regulations to mandateeither application of the CMR process toall systems or including all systems inthe Limitations Section of the ICA.However, such action is beyond thescope of the current rulemaking, andwould significantly delay action toaddress fuel tank safety issues. We areconsidering tasking ARAC to addressthis issue. If the ARAC process developsan improved proposal, amendment ofthe regulations to adopt an alternative tothe actions required by this final rulecan be made at that time.

Discussion of Comments on OperatingRules

Request To Revise MaintenanceOperations Requirements

One commenter agrees in principlewith the intent of the proposed changesto §§ 91.410, 121.370, and 125.248, andsupports the concept of reviewing andrevising, if necessary, the fuel tanksystem maintenance and inspectionprogram. However, the commenterdisagrees with the FAA’s proposed



methodology and time frame forfulfilling this intent.

As for the FAA’s methodology, thecommenter opposes mandating changesto maintenance programs via operationsrules. Instead, the commenter requeststhat mandatory maintenance tasks beintroduced using current industrypractices, such as the use of theMaintenance Review Board (MRB)process and MSG guidelines. Thecommenter states that the inspectionprograms developed using theseprocesses are based on a foundation ofinformation derived from varioussources using a defined process.

Further, the commenter states that themanufacturers’ recommendedmaintenance and inspection programsalready serve as the basis for developingoperators’ individual maintenance andinspection programs. Within theseestablished programs, safety issues areidentified and addressed at both thetype certification and continued-airworthiness levels. The FAA hasinternal processes for managing theapproval of manufacturer-developedmaintenance and inspections programs,safety tasks, and the final individual-operator maintenance and inspectionprograms.

However, the commenter maintainsthat it appears that the proposedrequirements will ‘‘dissolve’’ thisexisting process only to require meetinga calendar deadline. The commenterdoes not consider that this will lead toa safety enhancement.

This commenter suggests thefollowing alternative for implementing anew or revised maintenance program:

First, the fuel tank systemmaintenance programs should bereexamined in context both with theresults of the required SFAR safetyreview and with the existing MRB andother mandated programs [such as theCorrosion Protection Control Program(CPCP) and Supplemental StructuralInspection Program (SSID)].

Second, the approval processdescribed in AC 25–19, ‘‘CertificationMaintenance Requirements (CMR),’’should be used, as appropriate, todetermine the task classification,interval, and method of tasktransmission (for example, via servicebulletins or via the existing programupdate process).

Third, the FAA should mandate viaAD’s the service bulletins or programinterval changes developed as anoutcome of this process. This way, anychanges in maintenance and inspectionprograms can be communicated tooperators in an approved format that iscompatible with the aircraft certificationbasis.

Based on this suggested alternative,the commenter requests that the rule berevised to delete the proposed§ § 91.410, 121.370, and 125.248.

FAA’s Response: The FAA does notconcur with this commenter. First, theMRB process is not a means to mandatecompliance; it is a means to identifymanufacturers’ recommended minimuminitial scheduled inspection andmaintenance tasks for new aircraft.Further, in light of service historyregarding fuel tank events, it is apparentthat the MRB using the MSG–3 processhas previously been unable to developadequate maintenance procedures toaddress various fuel tank safety issues.Second, for the reasons discussedpreviously, the FAA does not agree thatchanging the current approach to CMR’sis appropriate in this rulemaking. Third,while AD’s are enforceable, theygenerally are limited to safety issues ofspecific aircraft models. As discussed inthe preamble to the notice andpreviously in this final rule, there is noadvantage in addressing this industry-wide safety issue in a piecemealfashion. We anticipate that incomplying with this rule both designersand operators will take advantage ofmany of the methods developed inexisting cooperative programs noted bythe commenter.

Request for Definition of‘‘Administrator’’

One commenter requests clarificationof the term ‘‘the Administrator,’’ as it isused in proposed § § 91.410, 121.320,125.248, and 129.14. The commenterinterprets the term ‘‘Administrator’’ tomean ‘‘the Federal AviationAdministration or any person to whomhe has delegated his authority in thematter concerned.’’ This is consistentwith the definition of the term thatappears in 14 CFR part 1 (§ 1.1).

The commenter objects to theinconsistent definition that appeared inthe proposal that identified ‘‘theAdministrator’’ as ‘‘the manager of thecognizant FAA Aircraft CertificationOffice (ACO).’’ Instead, the commenterrequests that the FAA revise theproposed rule to reflect the formalized,industry-recognized roles of otherauthority entities, such as the PMI andthe MRB process. Specifically, thecommenter requests the followingrevision:

• For approval of the development ofthe designer’s maintenance andinspection program, ‘‘theAdministrator’’ is the FAA ACO, theFAA Aircraft Evaluation Group (AEG),or the non-U.S. airworthiness authority(if the FAA ACO has delegated itsauthority via a bilateral agreement).

• For approval of the individualoperator’s maintenance program, ‘‘theAdministrator’’ is the PrincipalMaintenance Inspector (PMI).

FAA’s Response: The FAA concursthat clarification is necessary. Part 1 of14 CFR does define the Administrator toinclude those delegated the authority toact on her behalf. However, in the caseof this rule, we have determined that thecognizant ACO is the appropriate entitythat can address the myriad of technicaland practical issues faced byimplementing and enforcing compliancewith this rule. As discussed elsewhere,neither the PMI nor the MRB process isauthorized to perform these duties. Thefinal rule has been revised tospecifically reference the cognizantACO, or office of the Transport AirplaneDirectorate, as the appropriate officialfor approving the initial and anyrevisions of the instructions formaintenance and inspection of the fueltank systems required by the rule.

Request for Extension of ComplianceTime

Several commenters request that theproposed compliance time for therequired actions of § § 91.410, 121.320,125.248, and 129.14 be extended. Thesecommenters state that incorporating thenew instructions into maintenance andinspection programs cannot possibly beaccomplished within 18 months aswould be provided by the proposal.These commenters request a minimumcompliance time of 54 months.

FAA’s Response: The FAA concursthat the compliance time can beextended somewhat. As discussedpreviously in this preamble, we haverevised the compliance time to 36months.

Request To Issue AirworthinessDirectives To Change MaintenancePrograms Instead of Operating Rules

One commenter disagrees with theproposed requirement to changeoperators’ maintenance programsthrough changes to the operatingrequirements. The commenter suggeststhat the FAA mandate suchmaintenance actions via AirworthinessDirectives specific to each model type,rather than by modifying the operationalrules. The AD’s will allow both the FAAand the industry to:

• Assess the actual impact of themaintenance program (cost versusbenefit);

• Ensure that the appropriatecompliance time scale is mandatedversus the effective date of the rule andthe resources available; and

• Ensure that foreign authorities andoperators are notified of the mandatory



continuing-airworthiness informationvia a recognized document (ICAOobligation, Annex 8, paragraph 4.2.2).

Similarly, another commenter statesthat the proposed operating rulechanges are not needed. Thiscommenter asserts that, if theinstructions for maintenance andinspections are developed through theMSG–3 process, there is no need toinclude them in the AirworthinessLimitation section, as would be requiredby the proposed rule. If they should bemandatory, then the FAA shouldmandate them by AD’s.

FAA’s Response: The FAA does notconcur with either of these commenters.As discussed in the notice andelsewhere in this final rule, we willissue AD’s to mandate any designchanges identified as needed as a resultof the design review required by theSFAR established by this final rule.However, the FAA considers itinappropriate to delay requiringimplementation of the maintenanceprograms developed as a result of theSFAR. It is evident that existingmaintenance programs are generallyinadequate to ensure the safety of fueltanks systems and that programimprovements are necessary. Asreflected in the regulatory evaluationprepared for this rulemaking, thisapproach has been found to be costeffective.

As discussed previously, we havecarefully considered the firstcommenters’ concerns regardingcompliance times, and have extendedthe times to address those concerns.Finally, foreign authorities have beenfully informed of the FAA’s activities,and we will continue to include foreignauthorities in future discussions of theseissues.

Unlike AD’s, the operating rulechanges adopted by this final rule donot require the adoption of particularprograms developed by design approvalholders. Rather, the rules requireadoption of programs that meet theobjective of providing an acceptablelevel of safety for fuel tank systems.While the programs developed bydesign approval holders will provide afoundation for operators’ programs, theindividual operator is responsible toensure that its programs address theactual configurations of its fuel tanksystems.

In the preamble of the notice, we alsodiscussed use of a SFAR and changes tothe operating rules, instead of AD’s, asthe primary means of achieving theregulatory objective. As we stated, weconsider that an SFAR provides a meansfor the FAA to establish clearexpectations and standards, as well as a

timeframe within which the designapproval holders and the public can beconfident that fuel tank safety issues onthe affected airplanes will be uniformlyexamined.

This rule ensures that the designercompletes a comprehensive assessmentof the fuel tank system and developsany required inspections, maintenanceinstructions, and modifications, ifneeded. As such, the requirements ofthis final rule are intended to providemaintenance requirements that willprevent unsafe conditions fromdeveloping. This proactive approachprovides predictability and efficiency.

Discussion of Comments onFlammability Minimization—§ 25.981(c)

General Agreement With ReducingFlammability

All comments received support theoverall goal of reducing fuel tankflammability. Several commentersstrongly support the FAA’s positionthat, despite compliance with theproposed flammability reductionportion of the rule, the applicant mustensure compliance with the ignitionsource prevention requirements.

Other commenters support theproposed rule, but suggest otheralternatives. For example, onecommenter asks the FAA to considerincreasing the scope of the proposal tominimize fuel tank flammability tototally preventing operation of fueltanks with flammable vapors. Similarly,another commenter requests that theapplicability of the proposal beincreased so that the flammability ofvapors in certain in-service airplaneswould be reduced. Other commenterssuggest the FAA mandate theinstallation of means to mitigate theeffects of fuel tank ignition, such asmetal foils or polyurethane foam shouldbe mandated. Each of these proposals isdiscussed below.

Request To Retain Assumption ofFlammable Ullage

Several commenters recognize thatfuel system design has been based onthe assumption that the ullage fuel/airmixture is always flammable. However,these commenters express concern thatthe proposal to require minimization offuel tank flammability could result in arelaxation of the requirements forprecluding ignition sources within thefuel tanks. One commenter asserts thatthe FAA has retained this assumptionfor now, but ‘‘seems to indicate awillingness to eventually entertaindesigns that would rely more onflammability minimization and

mitigation, potentially allowingdesigners to assume the absence of aflammable ullage under certainconditions.’’ This commenter considersthat that affordable technology is remoteand, therefore, it should be made clearthat the design philosophy behind theproposed § 25.981 has firmly retainedthe assumption of flammable ullage.

FAA’s Response: As noted by thecommenter, we affirmed that we are notconsidering a change to the currentphilosophy of assuming a flammableullage. However, if technologicalchanges are developed, such as full-timefuel tank inerting, and prove to be asuperior method of eliminating the riskof fuel tank ignition, the FAA couldconsider a change in this philosophy infuture rulemaking.

Request To Mandate Means toPreventing Flammable Vapors—Inerting

Several commenters suggest thatflammable vapors in the fuel tankshould be prevented and that practicaltechnologies currently exist that shouldbe mandated. One commenter suggeststhat even with § 25.981(c) in place,circumstances might occuroperationally in which even anunheated wing tank has a flammableullage with a relatively low ignitionenergy threshold, and that theseconditions may warrant attentionthrough amending the rule to furtherreduce flammability in the future.

FAA’s Response: The FAA does notconcur that mandating fuel tank inertingtechnology has been shown to befeasible at this time. This was discussedin detail in the preamble to the notice.We are continuing to evaluate furthersafety improvements, and areconducting research and developmentto investigate the feasibility ofincorporating nitrogen inerting on bothin-service and new type designairplanes. As noted previously in thispreamble, we tasked the ARAC on July14, 2000 (65 FR 43800), to evaluate bothon-board and ground-based fuel tankinerting systems. If further improvementis found to be practicable, we mayconsider initiating further rulemaking toaddress such improvements. In themeantime, this final rule requires ameans to minimize flammability or ameans to mitigate the effects of ignition.As a performance-based regulation, thisallows the use of any effective,approved means, but does not requirethe use of any one particular means.

Request To Revise ProposedFlammability Standard

One commenter believes that theARAC report referenced in the preambleto the notice is flawed in its logic,



which arrived at a suggested exposuretime to explosive conditions not toexceed ‘‘7 percent’’ of fleet operatingtime. This recommendation was basedon comparison of the incident rate offuel tank explosions and ignition eventsfor center tanks to that for wing tanks.The commenter states that, due tooperating procedures, the wing tanks areseldom empty and are not located nearany heat sources. While wing tankvapors may be explosive when taxiingon a hot runway for extended periods,they are never as explosive as are thosethat often exist in empty center tanks.The most serious situation for wing fueltanks would be when the airplane landson a hot runway with nearly emptytanks. However, taxi time at landing isusually short. At takeoff, even with along taxi, the wing tanks will be nearlyfull with relatively cool fuel. Thecommenter concludes that to havecomparable safety margins for centertanks as for wing tanks, the degree ofexplosiveness would have to beequivalent.

Another commenter asserts that theproposed flammability requirement isnot sufficiently detailed to ensure thatcompliance can be achieved withouthaving to resort to external guidance,not published in the rule. Thecommenter is concerned that theproposed rule text is sufficiently vagueto promote lack of standardization infindings of compliance with theregulation. Although relevant material isavailable in the associated AC 25.981–2, the commenter is aware that guidancein the AC is not mandatory and isconcerned that the wording of the ruleessentially requires an interpretation of‘‘minimize flammability’’ from therelevant AC.

FAA’s Response: The FAA considersthat additional clarification is necessary.

As for the first comment, the ARACrecommendation of a 7 percentflammability standard did not providean equivalent level of flammability tothat of the wing (main) tanks, which theARAC determined were the tanks withan acceptable level of fuel tank safety inrelation to ignition or explosion events.The ARAC calculated a range of 3 to 5percent for wing tanks. We consideredthis concern when developing theregulatory text for this rule, and this iswhy the proposal requires flammabilityto be ‘‘minimized’’ rather than acceptingthe ARAC recommendation of 7 percent.

In response to the second commenter,we consider it appropriate to furtherclarify the intent of the rule byincorporating a definition of the term‘‘minimize’’ in the text of § 25.981(c), asfollows:

In the context of this rule, ’minimize’means to incorporate practicable designmethods to reduce the likelihood offlammable vapors.

‘‘Practicable design methods’’ arefeasible means, such as transferring heatfrom the fuel tank (e.g., use ofventilation or cooling air). We haveprovided further guidance in AC25.981–2, which describes howdemonstrating that the flammability ofthe fuel tank is equivalent to that of anunheated wing fuel tank would be oneacceptable means of showingcompliance. As with all newperformance based standards, it will benecessary for the Transport AirplaneDirectorate to participate in the reviewof proposed means of compliance toensure standardization.

Request That Rule Based onFlammability Be Delayed UntilStandard Is Established

One commenter representingmanufacturers and operators agrees inprinciple with the FAA’s overall intentto enhance the fuel system safety offuture aircraft designs through measuresto reduce fuel tank flammabilityexposure. The commenter agrees thataction should be taken, as identified bythe ARAC Fuel Tank HarmonizationWorking Group, ‘‘to addressflammability mitigation as a new layerof protection to the fuel system.’’However, the commenter disagrees withthe proposed § 25.981(c) that wouldrequire minimization of fuel tankflammability, because ‘‘there is not anagreed-to definitive industry standardfor assessing flammability of aircraftfuel tanks.’’

In light of this, the commenterrequests that a rule based onflammability be delayed until a standardis defined. In its place, the commenterrecommends a new rule that wouldaccomplish some degree of flammabilityreduction, even though a definitiveflammability standard does not exist.The commenter suggests that the newrule should require practical measuresto reduce heat transfer from adjacentheat sources into fuel tanks, andproposes the following text for the rule:

§ 25.981(c):If systems adjacent to fuel tanks could

cause significant heat transfer to the tanks:(1) Means to reduce heating of fuel tanks

by adjacent systems shall be provided; or (2)Equivalent flammability reduction meansshall be provided to offset flammabilityincreases that would otherwise result fromheating; or

(3) Means to mitigate the effects of anignition of fuel vapors within fuel tanks shallbe provided such that no damage caused byan ignition will prevent continued safe flightand landing.

FAA’s Response: The FAA does notagree with either the commenter’sproposal to delay the rule relating tofuel tank flammability or thecommenter’s proposed regulatory text.The proposal offered by the commenterwould require only that a ‘‘means toreduce heating of fuel tanks by adjacentsystems shall be provided * * *’’ Theproposed text suggested by the commentdoes not require any measurablereduction in flammability, which is theobjective of this rulemaking. Forexample, under the commenter’ssuggested standard, if a fuel tankinitially contains a flammable fuel-airmixture, a ‘‘means to reduce heating ofthe tank’’ may reduce the temperature ofthe fuel, but not necessarily to theextent that the temperature wouldremain below the flammable range forthe duration of the flight.

The commenter asserts that there isno standard for assessing flammabilityof airplane fuel tanks. However,industry members represented by thecommenter were members of the ARACgroup that recommended that theregulatory text mandate a maximum fueltank flammability of 7 percent of theoperating time. The ARAC reportprovides numerous calculations of fueltank flammability that were conductedby industry representatives. We areconfident that industry is capable ofassessing fuel tank flammability, and wehave provided guidance in AC 25.981–2, which defines methods ofdemonstrating compliance with theflammability requirements of the rule.One method described in the AC forshowing compliance is to demonstratethat the flammability of the tank is equalto or less than that of an unheated wingtank on the airplane type. As discussedpreviously, § 25.981(c) has beenclarified by adding a definition of‘‘minimize.’’ For applicants who areunable to demonstrate equivalentflammability to an unheated wing tank,the use of ‘‘practicable design methods,’’such as transferring heat from the fueltank, will be required. The final rule isadopted with the change noted.

Request Not To Mandate Fuel TankFlammability to the Level Proposed

The commenter does not agree withthe FAA’s statement in the preamble tothe notice that read:

‘‘* * * the intent of the proposal is torequire that fuel tanks are not heated, andcool at a rate equivalent to that of a wing tankin the transport airplane being evaluated.’’

For example, directed ventilationsystems may reduce heating of adjacentfuel tanks, but they do not eliminateheating. Furthermore, the commenter



asserts that there should not be arequirement to ‘‘cool at a rate equivalentto that of a wing tank.’’ The studiesconducted by the ARAC Fuel TankHarmonization Working Group did notconclude that such a requirement wasnecessary or achievable. The commenterrequests that the FAA not mandateminimizing fuel tank flammability tothe level proposed in the notice,because it would not be practical to cooltanks within the fuselage to the samelevel as tanks located in the wing.

FAA’s Response: The FAA disagrees.The rule only affects new type designs.Therefore, possible designconsiderations to comply with the rulewould include:

• Locating heat sources away fromfuel tanks;

• Introduction of cool air fromoutside sources into air gaps betweenheat sources and fuel tanks to transferheat from tanks while inflight; and

• Introducing cool air from ground orairplane sources during groundoperations.

Some of these features are alreadyincorporated into certain models of thetransport fleet. These methods aretechnically feasible and could providean equivalent level of exposure tooperation with flammable vapors to thatof unheated wing fuel tanks—the fueltanks with a safety level that the ARACdefined as an acceptable standard. Thecommenter provided no data to supportthe assertion that ‘‘it would not bepractical to cool tanks within thefuselage to the same level as tankslocated in the wing.’’

Request To Provide Alternatives toMinimizing Flammability

Two commenters request thatalternative regulatory text be includedin the proposed rule concerning therequirement to minimize flammability.

The first commenter believes that theFAA’s intent, as stated in the preambleto the notice and restated in draft AC25.981–2X, is ‘‘to require that theexposure to formation or presence offlammable vapors is equivalent to thatof an unheated wing tank in thetransport airplane being evaluated.’’ Thecommenter considers this a reasonableobjective. The commenter recommendsthat the FAA reword the proposed ruletext to clearly frame the intent withinthe rule itself, and believes that thewording would be more specific andless prone to misinterpretation if itcontained the following statement:

A means must be provided to ensure thatthe net heat balance within any tank will beequivalent to that of an unheated wing fueltank during any portion of the passengercarrying operation.

The commenter adds that, if anunheated wing fuel tank does not existon a particular design, then one couldbe modeled and used as the referencestandard for all tanks on that design.

The second commenter recommendsthat the FAA consider an alternative tohave the applicant determine anacceptable heat transfer rate at a criticalfuel load, rather than determining if atemperature limitation is exceeded,given that the tank ullage is consideredflammable. This would alleviate thedifficulties of working with a highnumber of parameters inherent in thenumerous aircraft types and conditions(including the effects of pumping,vibration, altitude, fuel load, etc.) byconsidering a generic installation.

FAA’s Response: The FAA does notagree with either commenter.Minimizing flammability is the ultimateobjective of the rule. We consideredmany options when establishing theregulatory text, and determined that aperformance-based rule is mostappropriate because it allows thedesigner to control fuel tankflammability by using any number ofmethods. It also allows the use of newtechnology designs that may bedeveloped in the future. On the otherhand, the commenters’ proposals focusonly on heat balance and heat transfer,rather than flammability. Theirproposals would not allow the designerthe flexibility to introduce other meansof reducing flammability, other thancontrolling heating/cooling of the tank,such as with nitrogen inerting. Further,the commenters’ proposals would notsignificantly simplify the compliancedemonstration over that of the optionsdescribed in AC 25.981–2X. In light ofthis, the commenters’ proposals are notaccepted.

Request To Require RetroactiveReduction in Flammability

One commenter states that the designsof some in-service airplanes have shownundesirable characteristics. Because theproposed flammability requirementswould only affect new airplane typedesigns, this commenter seeks insurancefrom the FAA that older and currentdesigns also will be assessed, andsuggests a case-by-case approach.

FAA’s Response: The FAA agrees thatsome in-service airplanes haveundesirable levels of fuel tankflammability. To address this issue, wetasked the ARAC in 1998 to provideadvice and recommendations onmethods that could eliminate orsignificantly reduce the exposure oftransport airplane fuel tanks toflammable vapors. Our review of theARAC report indicates that additional

time is needed to perform the in-depthresearch and economic evaluationsnecessary to determine if certaintechnologies that could reduce oreliminate fuel tank flammability wouldbe practical for use on the existing fleetof transport airplanes. As notedpreviously, we also are studyingconcepts such as ventilating spacesadjacent to fuel tanks, and recentlytasked the ARAC to evaluate inertingsystems for possible retrofit into theexisting transport fleet. We willconsider initiating additionalrulemaking if further improvements arefound to be effective and practicable.

Request To Ban Use of Low Flash PointFuels

Several commenters suggest that theuse of lower flash point fuels, such asJP–4 or Jet B, should be disallowedbecause these fuels cause a much greaterexposure to flammable vapors. Onecommenter notes that while it appearsthat these fuels are no longer commonlyused, they may still exist as approvedalternative fuels for several transportaircraft. If any operators routinely useJet B or JP–4 type fuel, then their riskwould be much greater than the risk foroperators using Jet A.

FAA’s Response: The FAA agrees thatuse of lower flash point fuels increasesthe exposure to operation withflammable fuels in the fuel tank. In fact,this rule does require consideration offuel type. The limited use of these fuelson a temporary basis to allow operationfrom remote airports is discussed in AC25.981–2. The FAA does not agree thatuse of these fuels should be banned forin-service airplanes. Data availableindicates that these fuels are notroutinely used in U.S. operations.However, in some cases, airplanes maydivert into locations where JP–4 fuel isthe only fuel available. Use of this fuelon a temporary basis allowscontinuation of the flight withoutrequiring tankering of Jet A fuel to aremote alternate airport and theassociated delays and inconvenience tothe flying public. If use of lower flashpoint fuels increases due to marketconditions, the FAA will considerrulemaking to limit their use.

Request To Require Use of Means ToPrevent Fire Within Fuel Tank

Several commenters request that theFAA revise § 25.981(c)(2) to require theuse of specific means to address therequirement to mitigate the effect of anignition of fuel vapors within the fueltanks. Some of the commenters’suggestions include flame quenchingmetallic foils and polyurethane foam.These commenters state that such



technologies as these are available andconsider them effective in preventingpropagation of flame or explosionwithin the fuel tanks

FAA’s Response: The FAA does notagree that a change to the proposed ruleis necessary. As stated previously, thefinal rule is a performance-basedregulation. As such, it may permit theuse of such means as those suggested bycommenters, but the rule does notrequire the use of any one particularmeans. AC 25.981–2 provides guidanceon use of these means.

Discussion of Comments ConcerningCost of the Rule

The detailed responses and theimpacts of the comments on the costs ofthe rule are contained in the FinalRegulatory Evaluation, which isavailable in the docket. The quantitativeeffects of the comments on theassumptions and the cost estimates aresummarized in the Economic Evaluationdiscussion later in this final rule. Thefollowing discussion is a more generaldisposition of the comments concerningthe cost of the rule.

Number of Airplanes, TC’s, and STC’sAffected

One commenter notes that the FAAassumed that a U.S. fleet size of 6,006airplanes would be affected by theproposed rule. While this number mayhave been appropriate in 1996, thecommenter states that by the time thefinal rule is issued, there likely will bemore than 7,000 affected airplanes.

Additionally, the commenter notesthat the number of affected typecertificates counted by the FAA did notinclude the Fokker Model F27 Mark 50or the Boeing Model 717. Further, theFAA’s listing of fuel system STC’s wasincomplete; for example, there were nofuel tank system STC’s listed for anyAirbus, Fokker, Bombardier, orAerospatiale airplanes.

Finally, the commenter states that theFAA’s cost estimate should take intoaccount the worldwide impact that theproposed rule will have, as otherregulatory authorities adopt identical orsimilar rules. Thus, the true cost of thisactivity will far exceed the costassociated with only the U.S. fleet.

FAA’s Response: The FAA concurswith the commenter that the number ofairplanes in the U.S. fleet has increasedsince the data set used in the notice wascollected. As a result, we now estimatethat 7,875 U.S.-registered airplanes willundergo the fuel tank systeminspections beginning in the year 2004.The economic analysis has beenmodified accordingly.

We agree with the commenter that ouranalysis had not included any FokkerModel F27 Mark 50 or Boeing Model717 airplanes in the fleet. The reasonwas that the fleet data set that we usedcontained no U.S.-registered Model F27Mark 50 airplanes. The more recent dataset we used for the final regulatoryevaluation also contains no U.S.-registered Model F27 Mark 50 airplanes;thus, those airplanes are not included inthe analysis. We did not include anyModel 717 airplanes because that fleetdata was based on a 1996 listing whenno Model 717 airplanes had yet beenmanufactured. The airplane data set thatwe used in the final regulatoryevaluation is based on 1999 data andcontains Model 717 airplanes. We alsonote that even though the 1999 fleetdata set reported no U.S. registeredAirbus Model A321, A330, or A340airplanes, we assumed that thesemodels will enter the U.S. fleeteventually and, therefore, the costs toreview these fuel tank systems wereincluded in the analysis.

We agree with the commenter that theanalysis had not included all of the fueltank system STC’s. After furtherresearch, we discovered one fuel tanksystem STC for an Airbus airplanemodel, one fuel tank system STC for aBombardier airplane model, and no fueltank system STC’s for Fokker orAerospatiale airplane models. Theeconomic analysis has been adjustedaccordingly.

We do not agree with the commenterregarding consideration of worldwideimpact of this rulemaking. The FAA isnot required to account for costs toforeign operators not operating in theU.S. because those operators are notsubject to these rules.

Cost of Evaluating Non-Fuel System-Related STC’s

One commenter agrees with the FAAthat only a small number of non-fuel-system STC’s will require a systemassessment. However, the commenterasserts that the FAA’s analysis does notaccount for the significant effort andassociated cost that would be requiredto determine whether or not these non-fuel system-related STC’s affect the fuelsystem and thus merit further attention.Such a determination would be requiredunder the proposed SFAR requirements.

FAA’s Response: The FAA agrees thatthe costs to determine which STC’saffect the fuel tank system should beincluded in the economic analysis.However, we have determined that 90percent of the non-fuel tank systemSTC’s will need only a minimal degreeof engineering effort (with a resultantminimal cost) for a qualitative

evaluation of their effects on the fueltank system. We also have determinedthat 325 non-fuel tank system STCholders will each need to conduct amore detailed engineering review thatwill involve an average of 75 hours ofengineering time. The economicanalysis has been revised accordingly.

Cost of Use of Proprietary Data

One commenter raises concernsregarding the costs associated with STCholders obtaining data from the typeapproval holder. The commenter pointsout that, in the ‘‘Regulatory Evaluation’’section of the notice, the FAA stated:

Many STC holders would be able toincorporate a large portion of a TC holder’sfuel tank system assessment into itsassessment.

The commenter states that, inpractice, the release of such proprietaryinformation to a third party would needto occur under a technical assistancecontract. Therefore, the cost of thistransaction should be added to theFAA’s cost analysis.

FAA’s Response: The FAA disagreeswith this commenter. While a technicalassistance contract may be needed toobtain this information, the overall costto the aviation industry is not affectedbecause the payment to the data holderwill offset some of the engineering costsassociated with the fuel tank systemdesign review. As a result, the overallcost of the rule is not affected by thesecontracts, although the distribution of apart of these costs will shift from certainTC holders to certain STC holders.

Cost of Fuel Tank System Safety ReviewRequired by SFAR

One commenter disagrees with theFAA’s estimate of $14.4 million for thecosts of completing the fuel tank systemreviews required by the proposed SFAR.The commenter points out that the FAAestimated that the review would require0.5 to 2 engineering years per airplanemodel. However, the commentercalculates the actual level of effortrequired will be more like 2 to 4engineering years for each major model.Minor model variation will addadditional effort that is difficult toquantify, but could easily increase thetotal effort by 30 to 50 percent. Inaddition, the commenter states thatsystems do evolve with time, leading toadditional permutations that must beconsidered.

In light of this, the commenterbelieves that the basic safety reviewswill require two to three times moreeffort and cost than identified by theFAA. Accordingly, the cost of the basicdesign review may be in the range of



$28 million to $52 million, plus anadditional $14 million to account for thevariations within models.

FAA’s Response: The FAA agrees thatthe number of engineering hours toreview the fuel tank systems should beincreased but disagrees about theamount of the increase. As discussedlater in more detail in the EconomicEvaluation section of this preamble, wedetermined that there were two types offuel tank system reviews:

• The first, which is referred to as the‘‘full-scale’’ review, is the first fuel tankreview done for a model that has severalseries.

• The second, which is referred to asthe ‘‘derivative’’ review, are the reviewsof the other series in that model.

Using the Boeing Model 737–300/–400/–500 as an example, we determinedthat this model will involve one ‘‘full-scale’’ review and two ‘‘derivative’’reviews. In addition, the fuel tanksystem reviews performed for all‘‘extended range’’ series and freighterseries are evaluated as ‘‘derivative’’reviews. On that basis, we determinedthat, depending upon the model, it willtake 6 months to 4 years of engineeringtime to perform a ‘‘full-scale’’ fuel tanksystem review. The FAA alsodetermined that it will take 6 months to1 year of engineering time to perform a‘‘derivative’’ fuel tank system review.(See the commonality of designdiscussion presented earlier in thispreamble for an engineering explanationwhy the review of a model’s series afterthe first review will take less time thanthe first review.)

The FAA agrees that the number offuel tank system reviews needs to beincreased, but disagrees about the extentof the increase. The FAA determinedthat the rule will require 46 ‘‘full-scale’’reviews and 52 ‘‘derivative’’ reviews.The impact on the total cost of thesereviews is provided in the EconomicEvaluation section of this preamble.

Cost of Safety Review of Older TypeDesigns

One commenter, Lockheed Martin,considers that the FAA clearlyunderestimated the costs to conduct thesafety review required under the newSFAR on older airplanes, such as theLockheed Model L–188 Electra. Thecommenter notes that the FAA’seconomic analysis of the cost of thedesign review proposed in the notice isbased on a fleet-wide consideration.This approach results in a per-aircraft-cost basis that does not appearunreasonable. However, the expense toperform the design reviews and prepareservice documents will be the same forLockheed as for other manufacturers

that have twenty or thirty operators andhundreds of operating aircraft. (Theycommenter reports that there are only13 Model L–188 Electras currentlyoperating in the U.S.)

The commenter requests that the FAAtake into consideration the followinginformation when finalizing theeconomic analysis of the proposed rule:

1. The FAA’s cost benefit analysisidentifies an engineering effort toperform the SFAR safety review andpreparation of documents as taking fromthree-quarters to three person years toperform. However, because the ModelL–188 Electra was certified prior to theissuance of § 25.901 and § 25.1309, theSFAR safety review will require all newanalysis and possibly testing to provethat the design meets the requirementfor all operating conditions. The effortto do this will likely exceed themaximum FAA estimate of three personyears.

2. Then, the time to familiarize a newstaff with the design, to locate pertinentfiles, to relate those files to the longhistory of the aircraft, and to developtest and compliance documents for newregulations are time-consuming tasksthat will add significant time and coststo the FAA’s estimates.

3. If the analysis shows that thedesign does not meet the newlyimposed requirements, redesign will benecessary. Such redesign wouldincrease the expense by a factor of 3 to5, depending on the detail. It would alsoincrease considerably the expense to theoperator of installing the new design.

FAA’s Response: The FAA agrees thatadditional time and costs will berequired to review the designs on someairplane types where design informationis not readily available. However, theFAA does not agree that all of the workidentified by the commenter isnecessarily required. As discussedpreviously in this preamble, the FAAextended the compliance time forconducting the actions required by theSFAR, which addresses thecommenter’s concern about the neededtime. Further, the FAA increased thenumber of engineering years tocomplete a Model L–188 fuel tanksystem design review to 4 years.Additionally, as noted in the earlierdisposition of the comment relating tothe applicability of the SFAR, the FAAwill consider the merits of exemptionsto the requirements of the SFAR basedupon the number of airplanes in serviceand the safety benefits that could beachieved by a safety review.

Cost of Safety Review of STC’s on OlderAirplanes

While commenters generally agreethat the design review should apply toSTC’s and field modifications, severalcommenters express concern that thedesign review will be difficult toconduct on older airplanes. Inparticular, reviewing non-fuel tankrelated STC’s and field approvals couldbe unmanageable for airplanes with along service life and with multipleowners. The commenters note that theFAA did not make any accounting inthe notice for the cost of addressingthese modifications.

One commenter proposes analternative approach: A one-timeinspection to determine theconfiguration of the airplane and toverify that wiring entering the fuel tank,and systems capable of generating auto-ignition temperature into fuel tankstructure, have not been compromisedby STC modifications. The commenterasserts that such an inspection wouldrequire about 50 to 100 labor hours toperform. The resultant inspection laborcosts alone could amount to $28 millionto $52 million, depending upon thenumber of airplanes to be inspected (forexample, 7,000 airplanes × 100 hoursper airplane × $70 per labor-hour). Thisestimate does not include the cost of thedowntime (and resultant revenue loss)required to accomplish such aninspection; yet the proposed compliancetime of 12 months would requireairplanes to be pulled from revenueservice for special inspection. In thenotice, the FAA had estimated that anannual increase in out-of-service time of11.5 hours to 32 hours would occur,depending upon the model, and thatthis would result in lost net revenues of$6.4 million for a 12-month period. Thecommenter maintains that the one-timeinspection alternative would alsorequire this much downtime.

FAA’s Response: The FAA agrees thatthe costs associated with reviewing non-fuel tank-related STC’s and fieldapprovals needs to be addressed.However, we disagree with thecommenter as to the direction andmagnitude of the effort that will beneeded to evaluate these factors.Specifically, we agree that a ‘‘paperreview’’ of the airplane’s service historywill be needed for compliance. Wedisagree that this review will necessitatean airplane inspection that is separatefrom the initial fuel tank systeminspection and that the labor hours forany such airplane inspection have beenincluded in the labor hours to completethe initial fuel tank inspection. We agreethat the amount of effort to complete



this ‘‘paper review’’ will vary acrossindividual airplanes. Airplanes thathave been in near-continuous operationby major, national, and regional airlines(the majority of the airplanes affected bythe rule) should possess well-documented service history recordssuch that those operators will need aminimal amount of time to complete thepaper reviews for those airplanes.However, we realize that there will besmaller operators that will spend moretime to trace their airplanes’ servicehistories—particularly if the airplanehas had multiple operators and owners.As a result, we have determined that itwill take an average of one engineeringday (a cost of $880 per airplane) for anoperator to complete this paper reviewfor every airplane.

Cost of Design ChangesSeveral commenters raise concerns

about accounting for the costs of newdesign changes that could be requiredunder the proposed SFAR requirements.One commenter representingmanufacturers and operators agrees, ingeneral, that any design changesresulting from the safety review shouldbe handled outside the scope of theSFAR. However, there would beadditional costs associated withdeveloping the necessary designchanges identified by the SFAR safetyreviews. The commenter points out that,in the notice, the FAA stated:

* * * the design review may identifyconditions that would be addressed byspecific service bulletins or unsafeconditions that would result in FAA issuanceof an airworthiness directive (AD). However,those future costs would be the result ofcompliance with the service bulletin or theAD and are not costs of compliance with theproposed rulemaking. Those costs would beestimated for each individual AD, whenproposed.

This commenter does not consider itappropriate for the FAA to assert thatnone of these costs are attributable tothe proposed rulemaking. In thoseinstances where new rules are createdthat go beyond existing rules—essentially raising the current level ofsafety—the cost of any design changedriven by these new rules should beconsidered as part of the total cost of therule.

The commenter points to§ 25.981(a)(3) as such a rule thatproposes new, more-stringentrequirements associated with evaluatingthe effects of latent failures. Shouldcompliance with this specific rulerequire design changes broadly acrossthe fleet, the costs would be substantial.For example, if this rule were to affecthalf the U.S. fleet (about 3,500

airplanes), and new design change costsaveraged $40,000 per airplane, the totalcost would be $140 million.

The commenter acknowledges that itis not possible to predict what effect theproposed rule would actually have onthe fleet, but the potential obviouslyexists for costs that range between $100million and $200 million, or more.

FAA’s Response: The FAA disagreesthat the cost of new design changerequirements should be included in thecost analysis for this rule. As discussedin the notice, new design changerequirements will be implementedthrough the AD process, during whichthe FAA will fully analyze the costs andthe public will have an opportunity tocomment on the FAA’s estimates.

Cost of Developing Maintenance andInspection Instructions

One commenter disagrees with theFAA’s assumption that the developmentof maintenance and inspectioninstructions would simply be part of therequired SFAR safety review. On thecontrary, this commenter states that thiswork, in fact, must be done aftercompletion of the safety review.However, the commenter states that, ifone assumes that this effort represents20 to 30 percent of the effort associatedwith the basic safety review, then thecost could be on the order of $10million.

FAA’s Response: The FAA partiallydisagrees that the costs of developingthe maintenance instructions were notincluded in the cost analysis of the rule.The estimated labor hours required forthe design review specifically includedan estimate of 0.15 year to one year ofengineering time for the TC holders, and0.1 year to 0.25 year for the fuel tanksystem STC holders, to develop theinspection and maintenancerecommendations. Further, we hadassumed that the design approval holderrecommendations would have beencompleted after the fuel tank systemreview. Nevertheless, as the proposedcompliance time was 1 year, the factthat developing the recommendationsafter completing the fuel tank systemreview had no effect on the presentvalue of the estimated costs because allof the expenditures would haveoccurred in the first year. This is not thecase for the 18-month compliance timeprovided in the final rule. We havedetermined that all of the engineeringcosts to develop the recommendationswill occur during the second year afterthe effective date of the rule. We haveincluded those costs in the finaleconomic analysis.

Cost To Comply With the SFAR

One commenter asserts that thecombined cost of the safety review anddevelopment of instructions may wellbe $180 to $330 million, rather than the$16 million estimated by the FAA.

FAA’s Response: The FAA disagreeswith the underlying assumptions madeby the commenter to develop thisestimate. The commenter’s firstassumption is that $100 million to $200million of these costs are based on thecommenter’s argument that, ‘‘Shouldcompliance with this specific rulerequire design changes broadly acrossthe fleet, the costs would be substantial.For example, if [emphasis FAA] thisrule were to impact half the U.S. fleet(about 3,500 airplanes) and modificationcosts averaged $40,000 per airplane, thetotal cost would be $140 million. It isnot possible to predict what effect thisnew rule would actually have on thefleet, but the potential obviously existsfor costs that range between $100million and $200 million, or more.’’[The commenter is referring to therequirements of § 25.981(a)(3) of therule, which involve evaluating theeffects of latent failures.]

This argument assumes that the costof the potential future AD’s should beattributed to this rule. As stated earlier,we maintain that the cost of complyingwith potential future AD’s is attributedspecifically to those individual AD’swhen they are issued. As a result, wehave determined that there are nocompliance costs attributable to thisrule for any future design changes thatwill be accomplished through an AD.

The commenter’s second assumptionis that the fuel tank system review costswill be two to three times the $16million estimated by the FAA, plusthere will be an additional $14 millionto review the fuel tanks for thevariations within models. As notedearlier, we disagree with the amount ofengineering time assumed by thecommenter, as well as the number offuel tank reviews that will beperformed. We have recalculated theestimated compliance cost anddetermined that it will be about $30million.

Finally, the commenter assumes thateach airplane will need a one-timeinspection to verify that previousairplane modifications have notcompromised the wiring entering thefuel tank and entering the systemscapable of generating autoignitiontemperatures into fuel tank structure.The commenter estimates this will cost$28 million to $52 million for labor, and$6.4 million for lost net revenue due toout-of-service time. As noted earlier, we



agree that an individual airplane reviewwill be needed, but we disagree in thatthe labor hours have been included aspart of the labor hours to perform theinitial fuel tank system inspection. Wehave, however, calculated a $5.5 millioncost for a ‘‘paper review’’ of everyairplane’s service history.

Based on these figures, we concludethat the costs to comply with the SFARwill be $35.5 million. (More detailsconcerning these costs are explainedlater in this preamble.)

Cost of Operating Rule Changes

One commenter agrees with thestatement in the notice that read:

The FAA intends that any additional fueltank system inspection and maintenanceactions resulting from the SFAR reviewwould occur during an airplane’s regularlyscheduled major maintenance checks. Froma safety standpoint, repeated entry increasesthe risk of damage to the airplane. Thus, theproposal would not require air carriers toalter their maintenance schedules, and theFAA anticipates that few or no airplaneswould be taken out of service solely tocomply with the proposal unless animmediate safety concern is identified.

This commenter strongly recommendsthat the FAA ensure that the final ruledoes not penalize the industry byrequiring inspection intervals morefrequent than truly necessary, or lead tounnecessary hard-timing of (placing life-limits on) components.

FAA’s Response: The FAA respondsto this commenter by reiterating that theintent is to have the maintenance andinspections generated by this rule bedeveloped so that the tasks can beperformed during regularly scheduledmaintenance.

Cost of Inspections

One commenter disagrees with thenumber of hours that the FAA estimatedwould be required to conduct the addedinspections required by the rule. Thecommenter calculates that the metricwill be 300 to 500 labor hours perairplane every 9 to 11 years, plus anyparts replacement costs yet to bedefined by the manufacturer.

Another commenter suggests that thecost analysis needs to be adjusted toaddress in-tank inspections. Thecommenter asserts that the FAAassumes that much of the in-tankinspection work will be accomplishedduring heavy maintenance checks whenthe tanks are open and purged.However, for some aircraft, the tanks areopened only once every eight years forscheduled maintenance. Therefore, if in-tank inspections are mandated, someaircraft will have to be removed fromscheduled service and the costs

associated with this should beconsidered in the rule. Also, the costs ofpreparing tanks for entry should beconsidered.

FAA’s Response: The FAA agreeswith the first commenter. Assuming thecommenter’s airplanes weremanufactured between 1960 and 1980,we calculated that the initial fuel tanksystem inspection, plus the tworeinspections that will occur during a12-year period, will result in a totalnumber of 330 labor hours per airplane.

We disagree with the secondcommenter. The commenter states that60 percent of the initial fuel tank systeminspections will be performed during a‘‘C’’ check , which will require that thefuel tank be opened, drained, andvented. We included these costs in thenumber of labor hours for the initialinspection, which are twice the numberof labor hours for the later reinspectionsthat will be performed during ‘‘D’’checks. Further, we included a value forthe lost net revenue to the aviationsystem as a result of the additionalnumber of out-of-service days (from oneto three days) for the initial fuel tanksystem inspections performed duringthe ‘‘C’’ check.

Cost of Complying With New Method ofAddressing Latent Failures

One commenter states that the newtreatment of latent failures (to maintainthe probability of occurrence of a givenlatent failure to less than 1×10¥7), aswould be required by § 25.981(a)(3), willlead to enormous costs with noattendant benefit. As an example, acomponent with a latent failure rate of1 × 10¥9 per flight-hour would have tobe inspected (or hard-timed) every 100hours (or 200 hours, if an averageexposure time is assumed to be T/2) tokeep the probability of failure under1×10¥7. A component failure rate of1×10¥8 per flight-hour would requireinspection every day (10 hours). Thecommenter asserts that the benefitderived from performing suchinspections or hard-timing is nil, andthe implications of such a rule are self-evident.

Further, this commenter points outthat the FAA’s cost estimate for theoperational rule changes is $154 millionover 10 years, and that is based uponthe assumption that the requiredmaintenance and inspection programswill coincide with an airplane’sregularly scheduled major maintenancechecks. However, the commenter statesthat the situation described abovewould result in numerous inspectionsthat would not align with theseregularly scheduled checks. In addition,it could lead to widespread hard-timing

of components (e.g., pumps). Thecommenter notes that the FAA did notconsider either of these possibilities inthe cost analysis; however, themagnitude of the cost impact couldextend into the billions of dollars.

FAA’s Response: The FAA does notconcur. The conclusion of thiscommenter that the costs of compliancewith § 25.981(a)(3) ‘‘could extend intothe billions of dollars’’ is based upon anassumption concerning the impact ofthe requirement. The example providedby the commenter, which assumes thatthe requirement limits the probability oflatent failure to less than 1×10¥7,indicates a misinterpretation of therequirement. The rule does not allow asingle failure to hazard the airplane,regardless of the probability of itsoccurrence. The FAA expects thatdesigns that have single failures that canresult in an ignition source will bemodified to include fail-safe features.Modifications may also be necessary toaddress combinations of failures. If afuel tank system is designed such thatthe safety level is heavily dominated byone of the components or features in thecombinations of failures, then addedinspections, hard-timing, or installationof annunciation features to eliminatelatency are exactly what was intendedby the regulation. The need forinspections and hard-timing can belimited by providing redundancy andfail-safe features and/or by eliminatinglatency. Therefore, inspection orreplacement of components at the ratenoted by the commenter would not berequired.

The FAA position is supported byanother commenter who providedinformation regarding transientsuppression units (TSU) developed forthe Boeing Model 737 and 747airplanes. The commenter states, ‘‘TheTSU eliminates the need to inspectharnesses, probe terminations, etc. TheTSU itself would be subject to periodic(25,000 hours) inspections.’’ It shouldbe noted that heavy maintenance checkstypically occur on transport airplanemodels prior to accumulating 25,000hours time in service; therefore, the costof inspections for the TSU units wouldbe low.

The speculation by the commenterthat ‘‘the magnitude of the cost impactcould extend into the billions ofdollars’’ is based on a misunderstandingof the final rule and, therefore, was notconsidered in the final economicanalysis.

Costs of New ModificationsOne commenter expresses concern

that the cost analysis is ‘‘greatly flawed’’because it did not consider all the costs



that will result from the requirements ofthe SFAR, such as high cost items likeaircraft modifications and ‘‘hard timing’’of components. The cost analysis takescredit for the benefits that will resultfrom these modifications; however, thecommenter considers that the costsshould be included as well.

As an example of the potential costsof modifications, this commenterprovided the following specificinformation concerning how theproposal would affect its fleet ofairplanes: The commenter ownsapproximately 160 Boeing Model 727airplanes. As a result of the proposedSFAR safety review, some of themodifications that might be mandatedfor these airplanes are:

• Replacement of the analog FQISwith a digital FQIS;

• Installation of current suppressiondevices;

• Installation of flame arrestors; and• Possibly, replacement of fuel boost

pumps.The cost of these modifications alone,

based on data received from theequipment manufacturers, isapproximately $125,000 per airplane.Since some of the commenter’sairplanes already have a FQIS installed,the cost to modify the commenter’s fleetwould be approximately $17,000,000.This figure does not include othermodifications that might be mandatedfor the airplanes. The commenter pointsout that this is the modification cost foronly one aircraft type for one airline. Ifall costs for all U.S. registered aircraftwere to be included, the result would befar greater than the total indicated inFAA’s cost analysis presented in thenotice.

FAA’s Response: The FAA does notagree that the cost analysis concerningpossible modifications was flawed.Section 25.901(b)(2) requires that the‘‘Components of the installation must beconstructed, arranged and installed soas to ensure their continued safeoperation between normal inspectionsand or overhauls.’’ As stated in thenotice, ‘‘Typical transport categoryairplane fuel tank systems are designed

with redundancy and fault indicationsfeatures such that single componentfailures do not result in any significantreduction in safety. Therefore, fuel tanksystems historically have not had anylife-limited components or specificdetailed inspection requirements unlessmandated by AD.’’ We agree that somepast design practices have beendeficient and that adding the specificrequirement in § 25.981(a)(3) to addresslatent failures may require new designfeatures for existing airplanes. We alsoagree with the commenter thatmodifications to the FQIS and/or anyother wiring entering the fuel tanksystem may be required (such asseparation and shielding of FQIS wiringor, for older airplanes, installation oftransient suppression devices). We donot agree that the rule would mandatereplacement of analog FQIS with digitalsystems, although this may be onemethod used on certain portions of thefleet. However, because correcting thosedesign deficiencies will beaccomplished through the AD process,those compliance costs will beestimated when the relevant AD isproposed.

The SFAR does not requireinstallation of flame arrestors in fueltank vents. We have initiated tasking anARAC group to providerecommendations addressing both a part25 amendment and retroactiveoperational requirement for installationof flame arrestors in fuel tank ventoutlets. If any rulemaking issubsequently proposed based on therecommendations, the FAA willconduct separate economic analyses forthose proposals.

Cost of Changes to Part 25 on FutureDesigns

One commenter disagrees with theFAA’s cost analysis regarding the affectsof changes to part 25 requiring‘‘minimizing flammability.’’ Thiscommenter points to a statement in thenotice that read:

The FAA anticipates that the proposed part25 change would have minimal effect on thecost of future type certificated airplanes

because compliance with the proposedchange would be done during the designphase of the airplane model before any newairplanes would be manufactured.

The commenter considers that theFAA’s assumption is incorrect.Proposed § 25.981(c)(1) would requirethat the fuel tank installation include ‘‘ameans to minimize the development offlammable vapors in the fuel tanks.’’Moreover, the FAA states that it intendsthat the body tanks ‘‘cool at a rateequivalent to that of a wing tank.’’

The commenter asserts that, based onthis requirement, the cost impact tofuture airplane designs could besubstantial. As an example, thecommenter presents a preliminary costassessment of a directed ventilationsystem, below. The commenter derivedthe cost estimates from a reportprepared by an ARAC working group(Fuel Tank Harmonization WorkingGroup). These fuel tank cooling costestimates are divided into the categoriesindicated. The analysis considers thecosts associated with small, medium,and large airplane designs. (It should benoted that directed ventilation systemsof the type evaluated would not cool acenter wing tank at a rate equivalent tothat of a wing tank.)1. Development costs per airplane

design = $2.8 million.2. Installation costs per production

airplane = $21,200.3. Additional airplane operational costs

per airplane per year:• Small airplane = $30,408.• Medium airplane = $39,295.• Large airplane = $50,518.Using these numbers, a simple

calculation may be performed toestimate the recurring costs associatedwith such a system over a 10-yearperiod. These costs would consist of theinstallation costs per productionairplane and the additional operationalcosts per airplane per year, applied to afleet of a new airplane design with anassumed production rate. The followingtable presents the results of this simpleestimate for a 10-year period (ignoringinflation, cost of capital, and so on):

Size Annual produc-tion rate Production cost Operational

cost Total cost

Small ........................................................................................................ 180 $38,160,000 $301,039,200 $339,199,200Medium .................................................................................................... 72 15,264,000 155,608,200 170,872,200Large ........................................................................................................ 60 15,264,000 129,673,500 144,937,500

Although the above example issimplistic in nature, the commentermaintains that the conclusion may bedrawn that the overall potential costs

are indeed substantial, even if the initialdevelopmental costs are not.

FAA’s Response: The FAA disagreeswith the commenter. The requirements

of the final rule should result in verylittle increased production costs. Certainairplane models in production todaylocate sources of heat away from the



center wing fuel tanks. Other modelslocate the air conditioning packs belowthe center wing fuel tank, butincorporate air gaps that are ventilatedsuch that heat transfer into the centerwing tank is significantly reduced.Other airplane models incorporatedirected ventilation means for areasbelow the heated center wing tanks.

The FAA does not agree with the costassessment provided by the commenter.The cost estimate referenced by thecommenter is stated to apply to ‘‘presentairplane designs.’’ It assumes that theenvironmental control system (ECS)packs will be located adjacent to thecenter wing tank, and that heat shieldsand ventilation air would be used toremove heat from the center wing fueltank. This approach results in addedweight and drag penalties. New designsallow the designer numerous options toachieve an optimized design. Airconditioning equipment can, and hasbeen, located away from fuel tanks.Cooling air is available from the ECSsystem, ground sources and outside airin flight. Incorporation of these featuresin the initial design would result inlittle added cost over that of featuresnoted in the preceding paragraph onmany airplane designs.

The ARAC report, from which thecommenter has gathered data for its costestimates, includes a discussion to‘‘locate significant heat sources awayfrom fuel tanks.’’ The report states that,‘‘* * * quantifying the impact of thismethod would only be possible forspecific new designs,’’ and the reportprovides little data regarding the costsfor locating packs away from fuel tanks.We agree with the commenter thatcooling air may be needed to meet therequirements of this regulation and thiscan result in additional operating costsduring certain flight operations.However, these costs are airplane modeldesign-specific and could not beestimated without input from theindustry. Nevertheless, in the absence ofspecific industry design and cost data,we maintain that these additionaloperating costs will be minimal.Further, these costs will occur onairplanes that will be manufacturedmany years in the future and, as a result,the present value of those operatingcosts will be even less.

Paperwork Reduction Act

There are no new requirements forinformation collection associated withthis amendment that would requireapproval from the Office of Managementand Budget pursuant to the PaperworkReduction Act of 1995 (44 U.S.C.3507(d)).

International CompatibilityIn keeping with U.S. obligations

under the Convention on InternationalCivil Aviation, it is FAA policy tocomply with International CivilAviation Organization (ICAO) Standardsand Recommended Practices to themaximum extent practicable. The FAAdetermined that there are no ICAOStandards and Recommended Practicesthat correspond to these regulations.

Economic Evaluation, RegulatoryFlexibility Determination, Trade ImpactAssessment, and Unfunded MandatesAssessment

Changes to Federal regulations mustundergo several economic analyses.First, Executive Order 12866 directseach Federal agency to propose or adopta regulation only if the agency makes areasoned determination that the benefitsof the intended regulation justify itscosts. Second, the Regulatory FlexibilityAct of 1980 requires agencies to analyzethe economic impact of regulatorychanges on small entities. Third, theTrade Agreements Act (19 U.S.C.section 2531–2533) prohibits agenciesfrom setting standards that createunnecessary obstacles to the foreigncommerce of the United States. Indeveloping U.S. standards, this TradeAct requires agencies to considerinternational standards. Whereappropriate, agencies are directed to usethose international standards as thebasis of U.S. standards. Fourth, theUnfunded Mandates Reform Act of 1995requires agencies to prepare a writtenassessment of the costs, benefits, andother effects of proposed or final rules.This requirement applies only to rulesthat include a Federal mandate on State,local, or tribal governments, likely toresult in a total expenditure of $100million or more in any one year(adjusted for inflation).

In conducting these analyses, the FAAhas determined that this rule: (1) Hasbenefits which justify its costs and is a‘‘significant regulatory action;’’ (2) willhave a significant impact on asubstantial number of small entities; (3)has minimal effects on internationaltrade; and (4) does not impose anunfunded mandate on state, local ortribal governments or the private sector.The FAA has placed these analyses inthe docket and summarizes them asfollows.

Data Sources• The principal data sources used for

this analysis are:• The public comments submitted to

the notice for this rulemaking action;• The World Jet Inventory at Year-

End 1999;

• Back Aviation Solutions (Fleet PC,Version 4.0);

• Information from service bulletins;and

• FAA discussions with industryengineers.

Affected Airplanes and Aviation Sectors

In the notice, the FAA, using 1996data, estimated that the proposal wouldhave affected 6,006 airplanes. Of thisnumber:

• 5,700 airplanes were operated by114 air carriers under part 121 service,

• 193 airplanes were operated by 7carriers that operated under both part121 and part 135,

• 22 airplanes were operated by 10carriers under part 125 service, and

• 91 airplanes were operated by 23carriers operating U.S.-registeredairplanes under part 129.

At that time, the FAA did not haveinformation on airplanes operatingunder part 91 that would have beenaffected by the proposal; however, theFAA had stated its belief that very fewairplanes operating under part 91 wouldhave been affected by the proposal.

The FAA also estimated that theproposed rule would have affected:

• 12 manufacturers holding 35 part25 type certificates (TC’s);

• 26 manufacturers, airlines, andrepair stations holding 168supplemental type certificates (STC’s)for part 25 fuel tank systems, of which69 were for different modifications;

• Manufacturers of future, new part25 type certificated airplane models;and

• Holders of future, new part 25STC’s for new fuel tank systems.

At that time, the FAA was unable topredict the number of new airplane TC’sbut, based on the average of theprevious 10 years, the FAA hadanticipated that 17 new fuel tank systemSTC’s would be granted annually. TheFAA had requested comments on theseestimates.

In order to update the aviationindustry data, the FAA used a differentdatabase for this final rule from what itused for the analysis of the proposedrule. However, as this more currentdatabase does not report the sameinformation as that reported in theprevious database, an exact comparisonbetween the two databases is notpossible. Consequently, using 1999 data,the FAA determined that the final ruleaffects 6,971 airplanes, of which 6,252are turbojets and 719 are turboprops. Ofthese 6,971 airplanes:

• 6,485 (5,802 turbojets and 683turboprops) are operated by 143scheduled and non-scheduled aircarriers,



• 117 are operated by 76 privateoperators (primarily corporations), and

• 369 are currently held by 112manufacturers and brokers and leasingcompanies.

The FAA also determined that thefinal rule affects:

• 13 manufacturers holding 37 part25 type certificates (TC’s);

• 46 manufacturers, airlines, andrepair stations holding 173supplemental type certificates (STC’s)for part 25 fuel tank systems, of which79 are for different fuel tank systemmodifications;

• 325 non-fuel tank system STCholders that will need to evaluate theirSTC’s to determine their impacts on fueltank systems;

• Manufacturers of future, new part25 type certificated airplane models;and

• Holders of future, new part 25STC’s for new fuel tank systems.

Based on the previous 10 years, theFAA projects that there will be betweentwo and four new part 25 TC airplanemodels during the next 10 years. Usingthe same methodology, the FAA projectsthat there will be three to four new fueltank system STC’s annually grantedduring the next 10 years.

Benefits

In the notice, the FAA had assumedthat the potential U.S. fuel tankexplosion rate due to an unknowninternal fuel tank ignition was the sameas that rate for the worldwide fleet overthe years 1989 through 1998. On thatbasis, the FAA had estimated that, if nopreventative actions were to be taken,then between one and two (thestatistically expected value was 1.25)fuel tank explosions would be projectedto occur during the next 10 years (2000through 2009) in U.S. operations. TheFAA also determined that theprobability that such an accident wouldhave occurred prior to 2006 was equalto the probability that it would haveoccurred after 2006.

In order to quantify the potentialbenefits from preventing a‘‘representative’’ commercial aviationmid-air explosion, the FAA had used:

• A value of $2.7 million to preventa fatality,

• An average of 130 passengers andcrew on a commercial flight,

• A value of $20 million for adestroyed airplane, and

• A cost of $30 million for aninvestigation of a mid-air explosionaccident.

Thus, a total loss would be $401million.

In the notice, the FAA had assumedthat compliance with the proposal

would prevent between 75 percent and90 percent of the future fuel tankexplosions. The basis for this preventionis derived primarily from theincorporation of design changes toenhance fail-safe features of design andenhanced fuel tank system inspectionsthat will discover conditions that couldresult in an ignition source beforeignition of flammable fuel vapors couldoccur. The fuel tank system review, byitself, will have little direct effect onpreventing these future accidents,unless it uncovers an immediatelyhazardous condition that results in anAD being issued. As stated earlier, theFAA has initiated 40 AD’s to addressunsafe fuel tank system features onnumerous airplane types within thecurrent fleet. While the FAA expectsthese actions will significantly improvesafety, an in-depth analysis of allairplane models required by this rulehas not been completed and it would bedifficult to predict the overall effect onthe accident rate. Therefore, the cost/benefit analysis assumes that theaccident rate for fuel tank explosionswill remain constant until the reviewsare complete.

With the proposed 18-monthcompliance time, the FAA estimated thebenefits based on these inspectionsstarting in 2001. The resultingprobability analysis indicated that thefirst such accident would occur in 2006and the second accident (if a second onewould occur) in 2009. On that basis, theestimated present value of the expectedbenefits discounted over 10 years to1999 at 7 percent would have been:

• $260 million for one preventedaccident and

• $520 million for two preventedaccidents.

For the final rule, the FAA revisedthese earlier estimates to include theeffect that lengthening the compliancetime from 18 months to 36 months hason the potential benefits. As a result, the3-year compliance time indicates that,with the exception noted in theprevious paragraph, the first benefitsfrom improved fuel tank systeminspections will not occur until 2004.

The FAA also revised the earlierestimates to substitute more currentfleet and operations data into thecalculations. The FAA also noted that 2years without a mid-air explosion havepassed since the analysis of theproposal, which makes the years 1989through 2000 (rather than 1989 through1998) the appropriate timeframe forcalculating the historical accident rate.On that basis, the FAA calculated that,if no preventative actions were taken,between one and two (the expectedvalue is 1.09) fuel tank explosions

would be expected to occur during the10-year time period of 2004 through2013. Further, the FAA determined thatthe probability that the first accidentwould occur on or before the year 2008is the same as the probability that itwould occur after 2008.

Thus, based on a loss of $401 millionfor a ‘‘representative’’ accident, the FAAcalculated that the present values of thelosses from future mid-air explosionsthat would occur between 2004 and2013 are:

• $233.7 million for one preventedaccident and

• $400.4 million for two preventedaccidents(The statistically expected value is$248.9 million for the 1.09 accidents.)

For this final rule analysis, the FAAreviewed the public comments and itsprevious analysis for the notice, anddetermined that the data are insufficientto permit a credible estimate of thepercentage of future mid-air explosionaccidents that the final rule wouldprevent. The uncertainty of the causesof the two accidents and the uncertaintyof the effects of the 40 AD’s onpreventing future explosions does notallow a quantitative estimate of thepotential effectiveness of the final rule.Thus, although the FAA believes thatthe rule will significantly reduce therisk of a future accident, the FAA doesnot calculate quantified benefitsresulting from the final rule.

Sources of Compliance Costs for theProposal and the Final Rule

The costs to comply with the SFARderive from the engineering time tocomprehensively review fuel tanksystem designs by the design approvalholders (i.e., part 25 TC holders, part 25fuel tank system STC holders, andcertain part 25 non-fuel tank systemSTC holders). There also are costs tooperators that derive from theengineering time to conduct the designreview for any field approvals on theirairplanes and to develop any necessaryfuel tank system inspections andmaintenance recommendations foroperators and repair stations.

These reviews may also identifyconditions that will subsequently needto be addressed by specific servicebulletins, or unsafe conditions thatwould subsequently require the FAA toissue AD’s. However, those future costsare not the costs of compliance with thisSFAR; rather, they are costs to conformto the service bulletin or to comply withthe AD, and would be estimated foreach individual service bulletin or ADwhen it is issued or proposed.

The costs to comply with theoperational rule changes of this final



rule derive from the requirements thatoperators incorporate theserecommendations into theirmaintenance manuals and then inspectand maintain the fuel tank systemsaccordingly. As a result, additionalairplane mechanic labor time will beneeded during an airplane inspection toperform an enhanced inspection of thefuel tank system and components.However, the costs to repair and replaceequipment and wiring that theinspection identifies as needing repairor replacement is not a cost ofcompliance with the operational ruleschanges. Although these costs can besubstantial, they are attributable toexisting FAA regulations that requiresuch repairs and replacements to bemade in order to assure the airplane’scontinued airworthiness.

Finally, the part 25 revisions of thisfinal rule may require some future TCand STC’s to employ designs of fueltank systems and other aviation systemsthat would not have been used were itnot for these revised certificationrequirements.

Estimated Total Compliance Costs forthe Proposal

As seen in Table 1, the FAA hadestimated in the notice that the presentvalue in 1999 of the compliance costswith the proposal during the timeperiod 2000–2011 would have beenabout $170 million ($9.5 million for TCholders, $4.9 million for STC holders,and $153 million for operators). Thefollowing sections briefly summarizethe discussions in the notice about thesevarious cost estimates.

TABLE 1.—PRESENT VALUE IN 1999OF THE COSTS OF COMPLIANCEWITH THE PROPOSED RULE

[As estimated in the preliminary regulatoryevaluation]

Source of cost

Present valuein 1999 of the

compliancecosts

(in 1998$ millions)

Fuel Tank Review (Total) ..... 14.4[For TC Holders: 9.5][For STC Holders: 4.9]

Maintenance and Inspection 100.0Lost Net Revenue ................. 35.6Additional Recordkeeping ..... 17.4

Total ............................... 167.4

Proposed Costs of Fuel Tank SystemDesign Review

By way of explanation, for thepurpose of this analysis, an airplane‘‘model’’ is defined to refer to a type

certificate airplane (for example, aModel 737); whereas, an airplane‘‘series’’ is defined to refer to a version(often under an Amended TC) of amodel (for example, a Model 737–300).

In the notice, the FAA had estimatedthat 35 TC’s and 68 fuel tank systemSTC’s would have needed a fuel tanksystem design review. Depending uponthe airplane model, the FAA hadestimated that a fuel tank system designreview would have taken between 0.5 to2.0 engineer years for a TC holder, andan average of 0.25 engineer year for afuel tank system STC holder. The FAAhad also estimated that developingmanual revisions and service bulletinswould have taken between 0.25 to 1.0engineer years for a TC holder, and anaverage of 0.1 engineer year for a fueltank system STC holder.

Using a total engineer compensationrate (salary and fringe benefits, plus amark-up for hours spent bymanagement, legal, etc. on the review)of $100 an hour, the FAA had estimatedthat the one-time fuel tank systemdesign review would have cost TCholders $9.5 million, and it would havecost STC holders $4.9 million.

Proposed Costs of Fuel Tank SystemInspections—Operational Rule Changes

The costs to operators of complyingwith the proposed operationalrequirements would have been theadditional airplane mechanic laborhours and the lost net revenue from theairplane’s additional time out-of-servicein order to complete the fuel tanksystem inspections and maintenance.The FAA had assumed that the designapproval holders’ recommendationswould have required fuel tank systemsto be inspected only during theregularly scheduled major maintenancechecks. As a result, the FAA hadexpected that no airplanes would havebeen taken out of service solely toinspect the fuel tank system unless thefuel tank system review would haveidentified an immediate safety concern.In that case, the corrective action wouldhave been mandated by an AD.

On that basis, the FAA haddetermined that operators would haveneeded to take four actions to complywith the proposal that would haveeither required an expenditure ofresources or lost revenue:

• The first action involves the labortime to incorporate the design approvalholders’ recommendations into themaintenance manuals.

• The second action involves thelabor time to perform the enhanced fueltank system inspections, which includestesting of fuel tank system equipmentand wiring.

• The third action involves the lostnet revenue from an airplane’s increasedout-of-service time due to the enhancedfuel tank system inspection.

• The fourth action involves the labortime to provide the increaseddocumentation, recording, and reportingthe results from the fuel tank systeminspections and tests.

The FAA had assumed that eachoperator has one maintenance manualfor each airplane model in its fleet. TheFAA then determined that there were290 individual airplane model/operatorcombinations. The FAA estimated thatit would have taken 5 engineer days (ata cost of $4,000 per manual) toincorporate these recommendations intothe various maintenance manuals. Onthat basis, the FAA had calculated thatthis total cost would have been $1.16million. As these expenses would haveoccurred in the second year, the presentvalue of these costs was $1.084 million.

With respect to the costs of fuel tanksystem inspections, the FAA hadestimated that it would have takenbetween 60 and 330 additional laborhours per airplane to complete theinitial fuel tank system inspection, andit would have taken between 30 and 180additional labor hours per airplane forlater fuel tank system reinspections. Allof the initial inspections would havebeen completed during the first 3 yearsafter the maintenance manual changeshad been approved by the FAA (i.e.,during the years 2002 through 2004).Each airplane would have beenreinspected every 3 years after theinitial fuel tank system inspection.Using a total compensation rate (wagesand fringe benefits, plus a mark-up fortime spent by supervisors, management,etc. on the inspections) of $70 an hourfor airplane mechanics, the FAA hadestimated that the initial fuel tanksystem inspection would have costbetween $4,200 and $23,100 perairplane and fuel tank systemreinspections would have cost between$2,100 and $12,600 per airplane. Thepresent value of the total fuel tanksystem inspection costs, discounted at 7percent over the period 2002 through2011, would have been $99 million.

In the notice, the FAA had assumedthat the initial fuel tank systeminspection would have been performedduring a ‘‘C’’ or a ‘‘D’’ check. On thatbasis, the FAA had estimated that theadditional out-of-service time wouldhave been between 36 hours and 96hours per airplane for each airplaneinspected during a ‘‘C’’ check, andwould have been zero hours for eachairplane inspected during a ‘‘D’’ check.Similarly, the FAA had estimated thatthe additional out-of-service time would



have been between 24 hours and 72hours for each airplane fuel tank systemreinspection that would have occurredduring a ‘‘C’’ check, and would havebeen zero hours if the reinspectionwould have occurred during a ‘‘D’’check.

The economic cost of out-of-servicetime is the lost net revenue to theaviation system. Most of the passengerswho would have flown on an airplanethat has been taken out of service willtake another flight. As a result, most ofthe lost revenue for that out-of-serviceairplane is actually captured by otherairplane flights. The cost of the rule isthe loss to the aviation system—not tothe individual airplane operator. Onthat basis, the FAA computed the lostrevenue to the aviation system by usingthe Office of Management and Budget(OMB) determination that the averageannual risk-free productive rate ofreturn on capital is 7 percent of theaverage value of the airplane model.Thus, the FAA had calculated that theout-of-service lost aviation net revenueper fuel tank system inspection wouldhave ranged from $50 to $9,750 perairplane per day. The present value ofthis total lost aviation net revenue,

discounted at 7 percent over 10 years,would have been $35.6 million.

The FAA had determined that theincreased annual documentation andreporting time would have been 1 hourof recordkeeping for every 8 hours oflabor time for the initial fuel tanksystem inspection, and would have been1 hour of recordkeeping for every 10hours of labor time for thereinspections. Thus, the per airplanedocumentation cost would have beenbetween $450 and $2,550 for the initialfuel tank system inspection and $300 to$1,620 for a fuel tank systemreinspection. The present value of thetotal recordkeeping cost discounted at 7percent for 10 years would have been$17.4 million.

Proposed Costs of Future Fuel TankSystem Design Changes—Revised Part25

The FAA had determined that the part25 changes would have a minimal effecton the cost of future type certificatedairplanes because compliance with theproposed changes would be done duringthe design phase of the airplane modelbefore any new airplanes would bemanufactured. In addition, the FAA had

determined that the part 25 changeswould have a minimal impact on futurefuel tank system STC’s because currentindustry design practices could beadapted to allow compliance with therequirement.

Differences in Assumptions and ValuesBetween the Notice and the Final Rule

The most significant differencebetween the proposal and the final ruleis that the proposal allowed only 12months for design approval holders tocomplete their fuel tank system reviewsand recommendations. The proposalalso allowed operators only 6 months toincorporate these recommendations intotheir maintenance manuals. The finalrule allows design approval holders 18months to be in compliance and alsoallows operators 18 months after that toincorporate the recommendations intotheir maintenance manuals.

Table 2 lists the most significantdifferences in the assumptions made,data used, and the differentrequirements between the proposal andthe final rule. Although there are otherdifferences that have altered thecalculated costs, the differences listed inTable 2 are the significant ones.

TABLE 2.—SIGNIFICANT DIFFERENCES IN ASSUMPTIONS AND VALUES BETWEEN THE PRELIMINARY REGULATORYEVALUATION AND THE FINAL REGULATORY EVALUATION

Assumption or value Preliminary regulatory analysis Final regulatory analysis

Number of Airplanes .......................................... 6,006 (in 1996) ................................................. 6,971 (in 1999).Timeframe for Analysis ...................................... 2000–2011 ....................................................... 2001–2013Net Rate of Fleet Growth ................................... 4.3 percent ....................................................... 3.0 percent.Hourly Compensation per: Engineer; Mechanic $100; $70 ......................................................... $110; $75.Number of Fuel Tank System TC Reviews ....... 35 ..................................................................... 98 (46 ‘‘full-scale’’ and 52 ‘‘derivative’’).Number of Engineering Years for TC Review ... 0.5 to 2 ............................................................. 0.5 to 3.Number of Fuel Tank System STC Reviews .... 68 ..................................................................... 74Number of Engineering Years for Fuel Tank

System STC Review.0.35 .................................................................. 0.15

Number of Non-Fuel tank system STC Reviews None (Asked for Comments) ........................... 325Number of Engineering Years for Non-Fuel

tank system STC Review.None (Asked for Comments) ........................... 0.0375

Operator Paper Review of Airplane Fuel TankSystem-Field Approvals/STC’s.

None ................................................................. 1 engineer day per existing airplane.

Number Months to Compete Safety ReviewFuel Tanks.

12 ..................................................................... 18

Number Months to Revise Maintenance Manual(After Review).

6 ....................................................................... 18

Number Years to Complete Initial Inspection(After Manual Revision).

3 years (Completed between 2002 and 2004) 2 years (Completed during 2004 and 2005).

Determinants of Number Inspection Hours ....... Airplane Model ................................................. Airplane Model plus Year Manufactured.Time before Initial Inspections Begin ................ 18 months ........................................................ 36 months.Number Years to Complete Initial Inspection .... 3 years ............................................................. 2 years.Number Labor Hours for Initial Inspection ......... 50 to 198 .......................................................... 49 to 218.Number Days Out-of-Service for Initial Inspec-

tion.0 to 4 (40 percent inspections done at ‘‘C’’

checks).0 to 4 (60 percent of inspections done at ‘‘C’’

checks).Year Reinspections Start ................................... 2004 (immediately after initial inspections) ...... 2008 (2 years after initial inspections).Reinspection Frequency .................................... Every 3 years (Some done during ‘‘C’’

checks).Every 5 years (All done during ‘‘D’’ checks).

Number Hours for Reinspection ........................ 40 to 160 .......................................................... 25 to 87.Reduced Inspection Hours Due to AD’s Already

Issued.All Model 747 hours not included; 50 hours for

Mode 737’s not included.No adjustment.

Number Days Out-of-Service for Reinspection 0 to 3 (40 percent of reinspections done at‘‘C’’ checks).

0 (All reinspections done at ‘‘D’’ checks).



Cost of Compliance With the Final RuleAs seen in Table 3, based on the

public comments and the changes inassumptions and values listed in Table2, the FAA has determined that thepresent value of the costs of compliancewith the rule over the time period2001—2013 are $165.1 million. Thisfigure includes:

• $27.1 million for TC holders,• $2.8 million for fuel tank system

STC holders,• $2.6 million for non-fuel tank

system STC holders, and• $132.5 million for operators.The following sections summarize the

results in the Final RegulatoryEvaluation.

TABLE 3.—PRESENT VALUE OF THECOSTS OF COMPLIANCE WITH THEFINAL RULE

Source of cost

Present valuein 2001 of the

compliancecosts

(in 2000$ millions)

Part 25 Fuel Tank Design .... 0.315(For TC Airplanes: Mini-

mal).(For Fuel Tank STC Hold-

ers: 0.315).Fuel Tank Review (Total) ..... 38.157

(For TC Holders: 27.107).(For Fuel Tank STC Hold-

ers: 2.522).(For Non-Fuel-Tank STC

Holders: 2.594).(For Operators: 5.934).

Maintenance and Inspection 92.043Lost Net Revenue ................. 24.224Additional Recordkeeping ..... 10.338

Total ............................... 165.077

Costs of Fuel Tank System DesignReview

In the Final Regulatory Evaluation,the FAA has determined that existingTC holders will need to complete 46‘‘full-scale’’ fuel tank system reviews forthe individual airplane models, and 52‘‘derivative’’ fuel tank system reviewsfor the separate series in the models.Using the Model 737–300/400/500family of airplanes as an illustration, theFAA determined that Boeing will needto complete one ‘‘full-scale’’ review andtwo ‘‘derivative’’ reviews for this familyof airplanes. In addition, each airplaneseries that has an extended rangemodification or a freighter modificationwill require a ‘‘derivative’’ fuel tanksystem review.

Depending upon the airplane modeland the date it was first manufactured,the FAA determined the followingaverage numbers of engineer years for

the ‘‘full-scale’’ fuel tank system designreview:

• 3 years for large turbojets (1969–1980),

• 2 years for large turbojets (1980–1988),

• 1 year for large turbojets (post-1988),

• 0.5 to 0.75 year for regional jets,• 0.5 to 0.75 year for large turboprops,

and• 0.5 year for small turbojets and

turboprops.With respect to the ‘‘derivative’’ fuel

tank system design reviews, the FAAdetermined that these will take between0.5 year and one year for large turbojets,and 0.5 year for regional turbojets andfor turboprops.

The FAA determined that the amountof engineering time to develop therecommendations for the maintenancemanuals will be 20 percent of theamount of time to complete the fueltank system review.

Using a total engineer compensationrate of $110 an hour, the FAA calculatedthat the one-time fuel tank systemdesign review will cost between$200,000 and $1.525 million perairplane model, with most of theindividual costs in the range of$500,000 to $800,000. These costs willbe about $125,000 to $150,000 forturboprops.

As the TC holder will have 18 monthsto comply with the final rule, the FAAdetermined that one-half of the reviewcosts will occur in the first year (2002)and one-half will occur in the secondyear (2003), and all of the costs todevelop recommendations will occur inthe second year (2003). On that basis,the present value of the total one-timecost of compliance to TC holders will be$27.1 million, of which $22.7 millionwill be for the fuel tank system reviewand $4.390 million will be to developrecommendations for the maintenancemanuals.

For part 25 fuel tank system STCholders, the FAA determined that thereare 74 fuel tank system STC’s that willneed to undergo a review. The FAA alsodetermined that it will take an averageof 0.15 engineering year to complete thereview because the STC holder had tocomplete a substantial amount ofengineering work to obtain FAAapproval of the STC, and many of theSTC’s affect only a part of the fuel tanksystem. On that basis, the FAAdetermined that the average cost for afuel tank system STC review will be$33,000.

As the fuel tank system STC holderwill have 18 months to comply with thefinal rule, the FAA determined that one-half of the review costs will occur in the

first year (2002) and one-half will occurin the second year (2003), while all ofthe time to develop recommendationswill occur in the second year (2003). Onthat basis, the present value of the totalone-time cost of compliance will be $2.5million.

Certain part 25 non-fuel tank systemSTC holders will also need to completemore than a cursory review of theirmodifications for the potential impacton the fuel tank system. The FAAdetermined that there are 325 non-fueltank system STC’s that will need toundergo a review. The FAA alsodetermined that this review will takeone quarter of the engineer time tocomplete a fuel tank system STC review(or 0.375 engineer year). On that basis,the FAA determined that the averagecost for a non-fuel tank system STCreview will be $8,250.

As the non-fuel tank system STCholder will have 18 months to complywith the final rule, the FAA determinedthat one-half of the review costs willoccur in the first year (2002) and one-half will occur in the second year(2003), while all of the time to developrecommendations will occur in thesecond year (2003). On that basis, thepresent value of the total one-time costof compliance will be $2.6 million.

Finally, based on the comments, theFAA determined that each operator willperform a paper review of each airplaneto determine the modifications(including field approvals) that havebeen made on the airplane. Althoughthe vast majority of these airplanes havebeen purchased by major, national, andregional airlines that should possesswell-documented maintenance historyrecords, a significant minority of theseairplanes have had multiple owners orlessors and the maintenance recordsmay not be quite as complete. Thus, theFAA determined that, on average, thispaper review will take one day perairplane. On that basis, the average costper airplane will be $880.

In order to meet the 36-monthcompliance date, operators will need todiscover if their airplanes have any‘‘orphan’’ STC’s or if there are any fieldapprovals that affect the fuel tanksystem. Completing these paper reviewswill then give the operators 18 months,after the TC and STC holders completetheir required reviews, to complete anyadditional fuel tank system engineeringreviews and to make the resultantchanges to their maintenance manuals.Therefore, the FAA determined thatone-half of the review costs will occurin the first year (2002) and one-half willoccur in the second year (2003). On thatbasis, the present value of the total one-



time cost of compliance will be $5.9million.

There is also the potential that this‘‘paper review’’ will reveal a fieldapproval or an ‘‘orphan’’ STC thataffects the safety of the fuel tank system.In that case, the operator would beresponsible for the engineering reviewand for developing inspection andmaintenance procedures for themaintenance manual. The FAA did notreceive any data on this factor, butmaintains that it is likely to infrequentlyoccur and, further, the amount ofengineering needed would be relativelyminor.

Costs of Fuel Tank SystemInspections—Operational Rule Changes

As was true for the analysis in thenotice, the costs to operators ofcomplying with the final rule’soperational requirements do not includethe costs of corrective actionsundertaken to repair deficiencies in thefuel tank system that were foundbecause of a fuel tank systeminspection, because the airplanes arerequired to be maintained as airworthy.

On that basis, the FAA determinedthat operators will take four actions thatwill generate costs or lost revenue tocomply with the final rule.

• The first action involves the labortime to incorporate the design approvalholders’ recommendations into themaintenance manuals.

• The second action involves thelabor time to perform the enhanced fueltank system inspections, which includestesting of fuel tank system equipmentand wiring.

• The third action involves the lostnet revenue from an airplane’s increasedout-of-service time due to the enhancedfuel tank system inspection.

• The fourth action involves the labortime to provide the increaseddocumentation, recording, and reportingthe results from the fuel tank systeminspections and tests.

In calculating the compliance costsfor maintenance manual revisions dueto TC holder recommendations, theFAA revised its assumption made in thenotice that each operator has onemaintenance manual for each model inits fleet. However, the FAA determinedthat its assumption of 5 days of engineertime to modify a maintenance manual isvalid. Since the issuance of the notice,the FAA has been informed that nearlyall airlines with fewer than 20 airplanescontract their major maintenance checksto third party (or other operators’) repairstations. The FAA determined that 49airlines (each with 20 or more airplanes)perform their own maintenance. Forthose 49 airlines, there are 165 airplane

model/operator combinations, whichproduces a cost of $726,400. As thesemanual changes will not be made untilthe year 2003, the present value of thesecompliance costs is $635,000.

The FAA also determined that 15repair stations will perform these fueltank system inspections for the smalleroperators and, on average, each repairstation will perform these inspectionsfor 10 different airplane models. Thecompliance costs for these repairstations will be $660,000, which will bepassed on to the operators. However, asthese manual changes will not be madeuntil the year 2003, the present value ofthese compliance costs is $576,475.

The FAA determined that it will take,on average, one engineer day (or $880)for each maintenance manual toincorporate the recommendations froma fuel tank system STC holder. The FAAalso determined that each of the 79 fueltank system STC’s will produceinspection and maintenancerecommendations that will affect, onaverage, two maintenance manuals. Onthat basis, the compliance costs will be$139,000. However, as these manualchanges will not be made until the year2003, the present value of thesecompliance costs is $121,450.

The FAA anticipates thatimplementation of the final rule willresult in the initial fuel tank systeminspection to be performed at the firstmajor maintenance check after themaintenance manual modifications havebeen approved by the FAA. As the FAAdefines a ‘‘C’’ check (or its equivalents)as a major maintenance check, the FAAdetermined that all of the affectedairplanes will receive an initial fuel tanksystem inspection by 2 years after themaintenance manuals have beenmodified. Thus, the FAA determinedthat all of the initial fuel tank systeminspections will be performed in either2004 or 2005.

The FAA made four adjustments tothe number of airplane mechanic hoursfor an initial fuel tank system inspectionas estimated in the notice:

The first adjustment is that the FAAadded 20 labor hours across the boardin order to account for anyunanticipated inspectionrecommendations from the productapproval holders.

The second adjustment is that theFAA varied the number of labor hoursnot only by certification date but also bymanufactured date of the airplane.Older airplanes of an airplane modelwill require, on average, more laborhours to complete an initial fuel tanksystem inspection than will newerairplanes. As a result, the FAAseparated airplanes into 3 categories

based on the date the airplane wasmanufactured.

• For the 1960–1980 group, thenumber of labor hours estimated in thenotice plus 20 hours was used.

• Airplanes manufactured between1981 and 1995 require 20 percent fewerlabor hours than those for the 1960–1980 group.

• Airplanes manufactured between1995 and 2003 will require 30 percentfewer labor hours than those for the1960–1980 group.

The third adjustment is that thenumber of labor hours to reinspect fueltank systems will be one-half of thenumber of labor hours needed for theinitial fuel tank system inspection,based on the last year that the airplanemodel was manufactured.

The fourth adjustment is that thenumber of labor hours for the firstinspection of a future manufacturedairplane’s fuel tank system will be thesame as for later reinspections, and isthe same number as that to reinspect thenewest airplane category.

Using those adjustments and thechanges listed in Table 2, the FAAdetermined that it will take between 49and 218 labor hours to complete aninitial fuel tank system inspection, andit will take between 25 and 108 laborhours to complete a fuel tank systemreinspection. Using a totalcompensation rate (wages plus fringebenefits) of $75 an hour for airplanemechanics, the FAA estimated that theinitial fuel tank system inspection willcost between $3,625 and $16,350 perairplane, and fuel tank systemreinspections will cost between $1,875and $8,100 per airplane. The presentvalue of the total labor cost discountedat 7 percent for the period 2004 through2013 is $92.043 million.

As stated earlier, the FAA haddetermined that the initial fuel tanksystem inspection will be performedduring a ‘‘C’’ or a ‘‘D’’ check. Theduration and process of majorinspections varies by airline andairplane type. Some airlines choose toconduct these checks during one timeblock of typically 7 to 10 days for a ‘‘C’’check and 20 to 25 days for a ‘‘D’’ check.Other airlines conduct segmentedchecks where the airplane is taken outof service for several shorter timeintervals that allow the overall task to becompleted. The FAA has determinedthat an airplane undergoing a segmented‘‘C’’ check is, on average, out-of-servicefor two days, whereas a segmented ‘‘D’’check takes an airplane out of servicefor 14 to 21 days. The FAA determinedthat two mechanics can simultaneouslywork on a fuel tank system inspection.On that basis, the FAA determined that



no additional out-of-service days willoccur for 1 to 48 additional labor hours.Each additional 48 labor hours after thefirst 48 labor hours will add one day tothe out-of-service time. On that basis,the initial fuel tank system inspectionwill produce between 0 and 4 additionalout-of-service days.

The economic cost of out-of-servicetime is the lost services from a capitalasset, which is computed bymultiplying the airplane value by thenumber of days out of service and by 7percent (the OMB risk-free rate ofreturn). The average residual value ofthe turbojet models is based on theAVITAS 2nd Half 1999 Jet AircraftValues, and the average value of theturboprop models is based on theAVITAS 2nd Half 1997 TurbopropAircraft Values. Thus, the FAAcalculated that the out-of-service lostcapital services from the initial fuel tanksystem inspection will be between $200and $86,000 per airplane per day.

As noted earlier, the FAA determinedthat one-half of the airplanes willundergo an initial fuel tank systeminspection in 2004 and one-half willundergo an initial fuel tank systeminspection in 2005. However, 20 percentof these airplanes each year will receivethis inspection during a ‘‘D’’ check, inwhich there are no additional out-of-service days due to the fuel tank systeminspection. As a result, the FAAcalculated that the present value of thetotal lost net revenue from theadditional out-of-service days is $24.224million.

For the final rule, the FAAdetermined that its original estimatethat every 8 hours of airplane mechaniclabor for the initial fuel tank systeminspection will produce one hour ofdocumentation and recordkeeping laborhours is valid. However, the FAAdetermined that it had overestimatedthe amount of recordkeeping forreinspections, and used the ratio of 12hours of reinspection airplane mechaniclabor time for 1 hour of documentationand recordkeeping. On that basis, thepresent value of the recordkeeping costis $10.338 million.

Costs of Future Fuel Tank SystemDesign Changes—Revised Part 25

The FAA had determined that the part25 change will have a minimal effect onthe cost of future type certificatedairplanes because compliance with theproposed change would be done duringthe design phase of the airplane modelbefore any new airplanes would bemanufactured. In addition, the FAAdetermined that the part 25 changes willhave a minimal impact on future fueltank system STC’s because current

industry design practices could beadapted to allow compliance with therequirement.

Benefit-Cost ComparisonAs noted, the FAA has not quantified

the potential benefits from this final rulebecause there is uncertainty about theactual ignition sources in the two fueltanks. However, using a‘‘representative’’ commercial airplane,the FAA calculated that the losses froma mid-air explosion would be $401.6million. In addition, the FAAdetermined that the present value of thecompliance costs is $165.1 million.

If the final rule would prevent onesuch accident by the year 2014, thepresent value of the prevented losseswould be greater than the present valueof the compliance costs.

Therefore, based on these factors andanalysis, the FAA considers the finalrule to be cost-beneficial.

Regulatory Flexibility ActThe Regulatory Flexibility Act of 1980

(RFA) establishes ‘‘as a principle ofregulatory issuance that agencies shallendeavor, consistent with the objectiveof the rule and of applicable statutes, tofit regulatory and informationalrequirements to the scale of thebusiness, organizations, andgovernmental jurisdictions subject toregulation.’’ To achieve that principle,the RFA requires agencies to solicit andconsider flexible regulatory proposalsand to explain the rationale for theiractions. The RFA covers a wide range ofsmall entities, including smallbusinesses, not-for-profit organizations,and small governmental jurisdictions.

Agencies must perform a review todetermine whether a proposed or finalrule will have a significant economicimpact on a substantial number of smallentities. If the determination finds thatit will, the agency must prepare aRegulatory Flexibility Analysis asdescribed in the RFA.

However, if an agency determines thata proposed or final rule is not expectedto have a significant economic impacton a substantial number of smallentities, section 605(b) of the 1980 actprovides that the head of the agencymay so certify, and a RegulatoryFlexibility Analysis is not required. Thecertification must include a statementproviding the factual basis for thisdetermination, and the reasoning shouldbe clear.

For the proposed rule, the FAA hadconducted an Initial RegulatoryFlexibility Analysis, which establishedthat it would have a significant impacton a substantial number of smallentities. As a result, the FAA had

specifically requested public commenton the potential impact of the proposedrule on small entities.

Need for and Objectives of the RuleThe final rule is being issued in order

to reduce the risk of a mid-air airplanefuel tank explosion with the resultantloss of life (as evidenced by TWA Flight800). Existing fuel tank systeminspections have not providedcomprehensive, systematic preventionand control of ignition sources inairplane fuel tanks, thereby allowing asmall, but unacceptable risk of a fueltank explosion.

The objective of the final rule is toensure the continuing airworthiness ofairplanes certificated for 30 or morepassengers or with a payload of morethan 7,500 pounds. Design approvalholders (including TC holders, fuel tanksystem STC holders, and holders ofcertain non-fuel tank system STC’s) willbe required to complete a fuel tanksystem design review and to providerecommendations and instructions tooperators and repair stations concerningfuel tank system inspections andequipment and wiring testing. Thisreview may result in the development ofservice bulletins and AD’s. All operatorscovered by Title 14, Code of FederalRegulations (CFR) parts 91, 121, and125, and all U.S.-registered airplanesused in scheduled operations under part129, will be required to incorporatethese recommendations into theirmaintenance manuals and to performthe inspections and tests as required. Inaddition, repair stations that arecontracted to perform maintenance arealso required to comply with theserequirements.

Summary of Comments Made inResponse to the Initial RegulatoryFlexibility Analysis

There were two commenters thatindirectly discussed issues of concern inthe Initial Regulatory FlexibilityAnalysis:

The General Aviation ManufacturingAssociation (GAMA) supported theFAA’s decision to exclude airplanescertificated for 30 passengers or fewerfrom the final rule. Although they didnot address the small business aspect ofthis decision, nearly every operator ofthese excluded airplanes is a smallentity. However, GAMA opposed theproposed part 25 future designrequirements as not appropriate forbusiness jets and stated that theseairplanes should be excluded from thepart 25 requirements. The FAAdisagreed with this comment because afuture business jet that has a 7,500pound payload is a large airplane and



its fuel tank system faces the samepotential for explosion as other largetransport category airplanes.

The Regional Airline Association(RAA) supported the FAA’s decision toexclude airplanes certificated for 30passengers or fewer from the final rule.They, too, did not directly address thesmall business aspect of this decision.However, they opposed the FAA’sdecision to include airplanescertificated for fewer than 60 passengersor for less than a 15,000 pound payload.Their primary argument in favor of thisexclusion is that these airplanes do nothave a history of these types ofaccidents. The FAA disagreed with thiscomment because, by itself, the accidenthistories of specific types and classes ofairplanes are insufficient to demonstratethat their fuel tank systems attain therequired level of safety. An importantconsideration in these accident historiesis that these airplanes have notaccumulated the number of flight hoursas those of the larger transport categoryairplanes. As fuel tank explosions arerare events, there is the possibility thatsuch an accident has not occurred inthese airplanes because not enoughhours have been flown. In addition, itmay be that the fuel tank system designreview will reveal that these systems donot have the same risk as the riskassociated with larger transport categoryairplanes. In that case, the impact of therule on operators of these airplanes willbe much less than estimated by theFAA. However, until the fuel tanksystem design review is completed, theFAA does not know what the potentialis for these airplanes to have a mid-airexplosion and, as the FAA cannot ruleout the possibility, the FAA cannotexclude these airplanes from coverageunder the final rule.

Description and Estimate of the Numberof Small Entities Affected by the FinalRule

The FAA determined that there are atotal of 143 U.S. airlines, 76 privateoperators (primarily corporations withcorporate jets), and 112 manufacturers,airplane brokers, and airplane leasingcompanies affected by the final rule. Ofthe 143 U.S. airlines, 107 are smallairlines. Nearly all of the 76 privateoperators are large corporations that canafford to operate and maintain acorporate jet airplane. Most of theairplane brokers and airplane leasingcompanies are privately heldcorporations or partnerships, and theFAA was unable to establish whether ornot most of them are small entities.

Reporting and RecordkeepingRequirements

The final rule requires that operatorsmaintain a record of the results of thefuel tank system inspections andmaintenance done on the airplane. Forthe small operators that contract theirmaintenance to third party repairstations (nearly all of the small airlinesand other operators), they will berequired to keep a copy of the reportthat the repair station will give them.Small entities will not need to acquireadditional professional skills to preparethese reports.

Description of the AlternativesEvaluated

In the Initial Regulatory FlexibilityAnalysis, the FAA had evaluated threealternatives to the proposed rule:

• The first alternative was to requireall airplanes with 10 or more seats becovered by the proposed rule.

• The second alternative was torequire all airplanes with 30 or moreseats and all airplanes with 10 or moreseats in commercial service be coveredby the proposal.

• The third alternative was to requireonly turbojet airplanes in commercialservice be covered by the proposal.

There were no comments from thepublic in support of these alternatives.A complete discussion of thesealternatives is available in the publicdocket for this rulemaking.

Differences Between the Proposed Ruleand the Final Rule Requirements

The primary change from theproposed rule is that the final ruleallows operators 36 months to complywhereas the proposed rule had requiredcompliance within 18 months. Inaddition, the FAA determined thatfewer fuel tank reinspections will beneeded than the FAA had estimated inthe Preliminary Regulatory Evaluation.As a result, the present value of thecosts to operators will be approximately20 percent less per airplane under thefinal rule than they would have beenunder the proposed rule.

Conclusion

Both the proposed and final rule willhave a significant impact on asubstantial number of small entities.Consistent with SBA guidance, the FAAconducted an initial regulatoryflexibility analysis (IRFA) and a finalregulatory flexibility analysis (FRFA).The initial regulatory flexibility analysisprovided a detailed analysis of theimpact on small entities. The FRFAdirectly addresses five requirements.While no comments specifically

addressed the IRFA, the FAA addressescomments related to small entities.

As published in the notice, the FAAdid not require fuel tank inspections foraircraft with a payload under 7,500pounds. The primary differencebetween the proposed rule and the finalrule is that the FAA extended operatorcompliance time from 18 to 36 months.In addition, the FAA determined thatfewer fuel tank reinspections will beneeded than originally estimated in theNPRM.

As a result of these changes, about140 airplanes that would have beenrequired to undergo a fuel tankinspection under the proposed rule willnot be required to undergo a fuel tankinspection under the final rule becausethey will have been retired during theadditional 18 months allowed forcompliance. In addition, all of theinspections and reinspections wouldhave had to be completed 18 monthsearlier under the proposed rule thanunder the final rule, resulting in ahigher present value of the compliancecosts. Consequently, recalculating (dueto the greater number of airplanes andother values) the present value of thecosts to operators to comply with theproposed rule would result in a cost of$172.2 million, which is approximately36 percent more than the $126.6 millioncosts to operators to comply with thefinal rule.

Trade Impact Assessment

The Trade Agreement Act of 1979prohibits Federal agencies fromengaging in any standards or relatedactivities that create unnecessaryobstacles to the foreign commerce of theUnited States. Legitimate domesticobjectives, such as safety, are notconsidered unnecessary obstacles. Thestatute also requires consideration ofinternational standards and, whereappropriate, that they be the basis forU.S. standards. In addition, consistentwith the Administration’s belief in thegeneral superiority and desirability offree trade, it is the policy of theAdministration to remove or diminishto the extent feasible, barriers tointernational trade, including bothbarriers affecting the export of Americangoods and services to foreign countries,and barriers affecting the import offoreign goods and services into theUnited States.

In accordance with the above statuteand policy, the FAA assessed thepotential effect of this final rule anddetermined that it will have only adomestic impact and, therefore, aminimal effect on any trade-sensitiveactivity.



Unfunded Mandates AssessmentThe Unfunded Mandates Reform Act

of 1995 (the Act), enacted as Pub. L.104–4 on March 22, 1995, is intended,among other things, to curb the practiceof imposing unfunded Federal mandateson State, local, and tribal governments.

Title II of the Act requires eachFederal agency to prepare a writtenstatement assessing the effects of anyFederal mandate in a proposed or finalagency rule that may result in a $100million or more expenditure (adjustedannually for inflation) in any one yearby State, local, and tribal governments,in the aggregate, or by the private sector;such a mandate is deemed to be a‘‘significant regulatory action.’’

As seen in Table IV–13 in the FinalRegulatory Evaluation (contained in thedocket to this rule), this final rule doesnot contain such a mandate. Therefore,the requirements of Title II of theUnfunded Mandates Reform Act of 1995do not apply.

Executive Order 3132, FederalismThe FAA has analyzed this final rule

under the principles and criteria ofExecutive Order 13132, Federalism. Wedetermined that this action will nothave a substantial direct effect on theStates, or the relationship between thenational Government and the States, oron the distribution of power andresponsibilities among the variouslevels of government. Therefore, wedetermined that this final rule does nothave federalism implications.

Environmental AnalysisFAA Order 1050.1D defines FAA

actions that may be categoricallyexcluded from preparation of a NationalEnvironmental Policy Act (NEPA)environmental impact statement. Inaccordance with FAA Order 1050.1D,appendix 4, paragraph 4(j), thisrulemaking action qualifies for acategorical exclusion.

Energy ImpactThe energy impact of this final rule

has been assessed in accordance withthe Energy Policy and Conservation Act(EPCA) Public Law 94–163, as amended(42 U.S.C. 6362) and FAA Order 1053.1.It has been determined that the finalrule is not a major regulatory actionunder the provisions of the EPCA.

Regulations Affecting IntrastateAviation in Alaska

Section 1205 of the FAAReauthorization Act of 1996 (110 Stat.3213) requires the Administrator, whenmodifying regulations in Title 14 of theCFR in a manner affecting intrastateaviation in Alaska, to consider the

extent to which Alaska is not served bytransportation modes other thanaviation, and to establish suchregulatory distinctions as she considersappropriate. The FAA, therefore,specifically requested comments onwhether there is justification forapplying the proposed rule differentlyto intrastate operations in Alaska.Although one commenter expressed aconcern related to a particular Alaskanintrastate operation involving LockheedModel L–188 Electra airplanes, nocomments were received concerningsuch justification in general. Since nocomments in that regard were received,and since the FAA is not aware of anyjustification for such regulatorydistinction, the final rule is not applieddifferently to intrastate operations inAlaska.

List of Subjects

14 CFR Parts 21, 25, 91, and 125

Aircraft, Aviation safety, Reportingand recordkeeping requirements.

14 CFR Part 121

Air carriers, Aircraft, Aviation safety,Reporting and recordkeepingrequirements, Safety, Transportation.

14 CFR Part 129

Air carriers, Aircraft, Aviation safety,Reporting and recordkeepingrequirements.

The Amendment

In consideration of the foregoing, theFederal Aviation Administrationamends parts 21, 25, 91, 121, 125, and129 of Title 14, Code of FederalRegulations, as follows:

PART 21—CERTIFICATIONPROCEDURES FOR PRODUCTS ANDPARTS

1. The authority citation for Part 21continues to read as follows:

Authority: 42 U.S.C. 7572; 40105; 40113;44701–44702, 44707, 44709, 44711, 44713,44715, 45303.

2. In part 21, add SFAR No. 88 innumerical order at the beginning of thepart to read as follows:* * * * *

SFAR No. 88—Fuel Tank System FaultTolerance Evaluation Requirements

1. Applicability. This SFAR applies to theholders of type certificates, and supplementaltype certificates that may affect the airplanefuel tank system, for turbine-poweredtransport category airplanes, provided thetype certificate was issued after January 1,1958, and the airplane has either a maximumtype certificated passenger capacity of 30 ormore, or a maximum type certificated

payload capacity of 7,500 pounds or more.This SFAR also applies to applicants for typecertificates, amendments to a type certificate,and supplemental type certificates affectingthe fuel tank systems for those airplanesidentified above, if the application was filedbefore June 6, 2001, the effective date of thisSFAR, and the certificate was not issuedbefore June 6, 2001.

2. Compliance: No later than December 6,2002, or within 18 months after the issuanceof a certificate for which application wasfiled before June 6, 2001, whichever is later,each type certificate holder, or supplementaltype certificate holder of a modificationaffecting the airplane fuel tank system, mustaccomplish the following:

(a) Conduct a safety review of the airplanefuel tank system to determine that the designmeets the requirements of §§ 25.901 and25.981(a) and (b) of this chapter. If thecurrent design does not meet theserequirements, develop all design changes tothe fuel tank system that are necessary tomeet these requirements. The FAA (AircraftCertification Office (ACO), or office of theTransport Airplane Directorate, havingcognizance over the type certificate for theaffected airplane) may grant an extension ofthe 18-month compliance time fordevelopment of design changes if:

(1) The safety review is completed withinthe compliance time;

(2) Necessary design changes are identifiedwithin the compliance time; and

(3) Additional time can be justified, basedon the holder’s demonstrated aggressivenessin performing the safety review, thecomplexity of the necessary design changes,the availability of interim actions to providean acceptable level of safety, and theresulting level of safety.

(b) Develop all maintenance and inspectioninstructions necessary to maintain the designfeatures required to preclude the existence ordevelopment of an ignition source within thefuel tank system of the airplane.

(c) Submit a report for approval to the FAAAircraft Certification Office (ACO), or officeof the Transport Airplane Directorate, havingcognizance over the type certificate for theaffected airplane, that:

(1) Provides substantiation that theairplane fuel tank system design, includingall necessary design changes, meets therequirements of §§ 25.901 and 25.981(a) and(b) of this chapter; and

(2) Contains all maintenance andinspection instructions necessary to maintainthe design features required to preclude theexistence or development of an ignitionsource within the fuel tank systemthroughout the operational life of theairplane.

PART 25—AIRWORTHINESSSTANDARDS: TRANSPORTCATEGORY AIRPLANES

3. The authority citation for part 25continues to read:

Authority: 49 U.S.C. 106(g), 40113, 44701–44702, and 44704.

4. Section 25.981 is revised to read asfollows:



§ 25.981 Fuel tank ignition prevention.(a) No ignition source may be present

at each point in the fuel tank or fueltank system where catastrophic failurecould occur due to ignition of fuel orvapors. This must be shown by:

(1) Determining the highesttemperature allowing a safe marginbelow the lowest expected autoignitiontemperature of the fuel in the fuel tanks.

(2) Demonstrating that no temperatureat each place inside each fuel tankwhere fuel ignition is possible willexceed the temperature determinedunder paragraph (a)(1) of this section.This must be verified under all probableoperating, failure, and malfunctionconditions of each component whoseoperation, failure, or malfunction couldincrease the temperature inside thetank.

(3) Demonstrating that an ignitionsource could not result from each singlefailure, from each single failure incombination with each latent failurecondition not shown to be extremelyremote, and from all combinations offailures not shown to be extremelyimprobable. The effects ofmanufacturing variability, aging, wear,corrosion, and likely damage must beconsidered.

(b) Based on the evaluations requiredby this section, critical designconfiguration control limitations,inspections, or other procedures mustbe established, as necessary, to preventdevelopment of ignition sources withinthe fuel tank system and must beincluded in the AirworthinessLimitations section of the Instructionsfor Continued Airworthiness requiredby § 25.1529. Visible means to identifycritical features of the design must beplaced in areas of the airplane wheremaintenance actions, repairs, oralterations may be apt to violate thecritical design configuration limitations(e.g., color-coding of wire to identifyseparation limitation).

(c) The fuel tank installation mustinclude either—

(1) Means to minimize thedevelopment of flammable vapors in thefuel tanks (in the context of this rule,‘‘minimize’’ means to incorporatepracticable design methods to reducethe likelihood of flammable vapors); or

(2) Means to mitigate the effects of anignition of fuel vapors within fuel tankssuch that no damage caused by anignition will prevent continued safeflight and landing.

5. Paragraph H25.4 of Appendix H topart 25 is revised to read as follows:

Appendix H to Part 25—Instructions forContinued Airworthiness

* * * * *

H25.4 Airworthiness Limitations section.(a) The Instructions for Continued

Airworthiness must contain a section titledAirworthiness Limitations that is segregatedand clearly distinguishable from the rest ofthe document. This section must set forth—

(1) Each mandatory replacement time,structural inspection interval, and relatedstructural inspection procedures approvedunder § 25.571; and

(2) Each mandatory replacement time,inspection interval, related inspectionprocedure, and all critical designconfiguration control limitations approvedunder § 25.981 for the fuel tank system.

(b) If the Instructions for ContinuedAirworthiness consist of multipledocuments, the section required by thisparagraph must be included in the principalmanual. This section must contain a legiblestatement in a prominent location that reads:‘‘The Airworthiness Limitations section isFAA-approved and specifies maintenancerequired under § § 43.16 and 91.403 of theFederal Aviation Regulations, unless analternative program has been FAAapproved.’’

PART 91—GENERAL OPERATING ANDFLIGHT RULES


Authority: 49 U.S.C. 1301(7), 1303, 1344,1348, 1352 through 1355, 1401, 1421 through1431, 1471, 1472, 1502, 1510, 1522, and 2121through 2125; Articles 12, 29, 31, and 32(a)of the Convention on International CivilAviation (61 Stat 1180); 42 U.S.C. 4321 etseq.; E.O. 11514; 49 U.S.C. 106(g) (RevisedPub. L. 97–449, January 21, 1983).

7. Amend § 91.410 by revising thesection heading; redesignating theintroductory text, paragraphs (a)introductory text, (a)(1), (a)(2) and (a)(3),and paragraphs (b) through (l) asparagraph (a) introductory text,paragraphs (a)(l) introductory text,(a)(1)(i), (a)(1)(ii), and (a)(1)(iii), andparagraphs (a)(2) through (a)(12); andadding a new paragraph (b) to read asfollows:

§ 91.410 Special maintenance programrequirements.

* * * * *(b) After June 7, 2004, no person may

operate a turbine-powered transportcategory airplane with a type certificateissued after January 1, 1958, and eithera maximum type certificated passengercapacity of 30 or more, or a maximumtype certificated payload capacity of7,500 pounds or more, unlessinstructions for maintenance andinspection of the fuel tank system areincorporated into its inspectionprogram. These instructions mustaddress the actual configuration of thefuel tank systems of each affectedairplane, and must be approved by theFAA Aircraft Certification Office (ACO),

or office of the Transport AirplaneDirectorate, having cognizance over thetype certificate for the affected airplane.Operators must submit their requestthrough the cognizant Flight StandardsDistrict Office, who may add commentsand then send it to the manager of theappropriate office. Thereafter, theapproved instructions can be revisedonly with the approval of the FAAAircraft Certification Office (ACO), oroffice of the Transport AirplaneDirectorate, having cognizance over thetype certificate for the affected airplane.Operators must submit their request forrevisions through the cognizant FlightStandards District Office, who may addcomments and then send it to themanager of the appropriate office.

PART 121—OPERATINGREQUIREMENTS: DOMESTIC, FLAG,AND SUPPLEMENTAL OPERATIONS


Authority: 49 U.S.C. 106(g), 40113, 40119,44101, 44701–44702, 44705, 44709–44711,44713, 44716–44717, 44722, 44901, 44903–44904, 44912, 46105.

9. Amend § 121.370 by revising thesection heading; redesignating theintroductory text, paragraphs (a)introductory text, (a)(1), (a)(2) and (a)(3),and paragraphs (b) through (l) asparagraph (a) introductory text,paragraphs (a)(l) introductory text,(a)(1)(i), (a)(1)(ii), and (a) (1)(iii), andparagraphs (a)(2) through (a)(12); andadding a new paragraph (b) to read asfollows:


* * * * *(b) After June 7, 2004, no certificate

holder may operate a turbine-poweredtransport category airplane with a typecertificate issued after January 1, 1958,and either a maximum type certificatedpassenger capacity of 30 or more, or amaximum type certificated payloadcapacity of 7,500 pounds or more,unless instructions for maintenance andinspection of the fuel tank system areincorporated in its maintenanceprogram. These instructions mustaddress the actual configuration of thefuel tank systems of each affectedairplane and must be approved by theFAA Aircraft Certification Office (ACO),or office of the Transport AirplaneDirectorate, having cognizance over thetype certificate for the affected airplane.Operators must submit their requestthrough an appropriate FAA PrincipalMaintenance Inspector, who may addcomments and then send it to themanager of the appropriate office.



Thereafter, the approved instructionscan be revised only with the approval ofthe FAA Aircraft Certification Office(ACO), or office of the TransportAirplane Directorate, having cognizanceover the type certificate for the affectedairplane. Operators must submit theirrequests for revisions through anappropriate FAA Principal MaintenanceInspector, who may add comments andthen send it to the manager of theappropriate office.

PART 125—CERTIFICATION ANDOPERATIONS: AIRPLANES HAVING ASEATING CAPACITY OF 20 OR MOREPASSENGERS OR A MAXIMUMPAYLOAD CAPACITY OF 6,000POUNDS OR MORE; AND RULESGOVERNING PERSONS ON BOARDSUCH AIRCRAFT


Authority: 49 U.S.C. 106(g), 40113, 44701–44702, 44705, 44710–44711, 44713, 44716–44717, 44722.

11. Amend § 125.248 by revising thesection heading; redesignating theintroductory text, paragraphs (a)introductory text, (a)(1), (a)(2) and (a)(3),and paragraphs (b) through (l) asparagraph (a) introductory text,paragraphs (a)(l) introductory text,(a)(1)(i), (a)(1)(ii), and (a) (1)(iii), andparagraphs (a)(2) through (a)(12); andadding a new paragraph (b) to read asfollows:

§ 125.248 Special maintenance programrequirements.* * * * *

(b) After June 7, 2004, no certificateholder may operate a turbine-poweredtransport category airplane with a typecertificate issued after January 1, 1958,and either a maximum type certificatedpassenger capacity of 30 or more, or amaximum type certificated payloadcapacity of 7,500 pounds or more unless

instructions for maintenance andinspection of the fuel tank system areincorporated in its inspection program.These instructions must address theactual configuration of the fuel tanksystems of each affected airplane andmust be approved by the FAA AircraftCertification Office (ACO), or office ofthe Transport Airplane Directorate,having cognizance over the typecertificate for the affected airplane.Operators must submit their requestthrough an appropriate FAA PrincipalMaintenance Inspector, who may addcomments and then send it to themanager of the appropriate office.Thereafter, the approved instructionscan be revised only with the approval ofthe FAA Aircraft Certification Office(ACO), or office of the TransportAirplane Directorate, having cognizanceover the type certificate for the affectedairplane. Operators must submit theirrequests for revisions through anappropriate FAA Principal MaintenanceInspector, who may add comments andthen send it to the manager of theappropriate office.

PART 129—OPERATIONS: FOREIGNAIR CARRIERS AND FOREIGNOPERATORS OF U.S.-REGISTEREDAIRCRAFT ENGAGED IN COMMONCARRIAGE


Authority: 49 U.S.C. 106(g), 40104–40105,40113, 40119, 44701–44702, 44712, 44716–44717, 44722, 44901–44904, 44906.

13. Amend § 129.32 by revising thesection heading; redesignating theintroductory text, paragraphs (a)introductory text, (a)(1), (a)(2) and (a)(3),and paragraphs (b) through (l) asparagraph (a) introductory text,paragraphs (a)(l) introductory text,(a)(1)(i), (a)(1)(ii), and (a) (1)(iii), andparagraphs (a)(2) through (a)(12); and

adding a new paragraph (b) to read asfollows:


* * * * *(b) For turbine-powered transport

category airplanes with a type certificateissued after January 1, 1958, and eithera maximum type certificated passengercapacity of 30 or more, or a maximumtype certificated payload capacity of7,500 pounds or more, no later thanJune 7, 2004, the program required byparagraph (a) of this section mustinclude instructions for maintenanceand inspection of the fuel tank systems.These instructions must address theactual configuration of the fuel tanksystems of each affected airplane andmust be approved by the FAA AircraftCertification Office (ACO), or office ofthe Transport Airplane Directorate,having cognizance over the typecertificate for the affected airplane.Operators must submit their requestthrough an appropriate FAA PrincipalMaintenance Inspector, who may addcomments and then send it to themanager of the appropriate office.Thereafter the approved instructionscan be revised only with the approval ofthe FAA Aircraft Certification Office(ACO), or office of the TransportAirplane Directorate, having cognizanceover the type certificate for the affectedairplane. Operators must submit theirrequests for revisions through anappropriate FAA Principal MaintenanceInspector, who may add comments andthen send it to the manager of theappropriate office.

Issued in Washington, DC, on April 19,2001.Jane F. Garvey,Administrator.[FR Doc. 01–10129 Filed 5–4–01; 8:45 am]BILLING CODE 4910–13–P


Department of Transportation - California Institute of ...€¦ · rotating components in the fuel tank, such as a steel fuel pump impeller rubbing on the pump inlet check valve.

Documents