U.S. Department of Transportation

**Federal Aviation Administration**

+-------+-------------------------------------+--------+--------------+
| Sub   | INFORMATION: Compliance Questions   | Date:  | April 30,    |
| ject: | and Answers with Respect to SFAR    |        | 2002         |
|       | No. 88, Fuel Tank Safety, for       |        |              |
|       | Transport Category Airplanes        |        |              |
+-------+-------------------------------------+--------+--------------+
| From: | Manager, Transport Standards Staff, | Reply  | Mark Quam    |
|       | ANM-110                             | to     |              |
|       |                                     |        | AN           |
|       |                                     | Attn.  | M-113-02-013 |
|       |                                     | of:    |              |
+-------+-------------------------------------+--------+--------------+
| To:   | See Distribution                    |        |              |
+-------+-------------------------------------+--------+--------------+

This memorandum includes a compilation of questions and answers raised
with respect to compliance with Special Federal Aviation Regulation
(SFAR) 88, "Transport Airplane Fuel Tank System Design Review,
Flammability Reduction, Maintenance and Inspection Requirements". The
upcoming December, 2002, deadline for compliance with provisions of SFAR
88 has underscored a need to share additional guidance information in an
expedited manner. This memorandum format was used to allow rapid
dissemination of answers to the questions that have arisen and which
need further clarification. This memorandum may be periodically revised
in the future to include additional material as it becomes available.

Please contact Mike Dostert at (425) 227-2132, (email
mike.dostert@faa.gov), or Mike Collins at (425) 227-2689, (email
michael.collins@faa.gov) concerning questions regarding the guidance in
this memo.

Michael J. Kaszycki

[Attachment](../../../../../sfar88/qa-memo.cfm)

DISTRIBUTION:

All Managers, Aircraft Certification Offices

Manager, Aircraft Engineering Division, AIR-100

Manager, Transport Standards Staff, ANM-113

Manager, International Branch, ANM-116

Manager, SEA-AEG

Manager, LGB-AEG

  --------------------------------------------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------- -------------------------- -------------------------------------
  **Aircraft Certification Products and                                                                                                                                                                                                                                                                                                                                                                          
  Services\                                                                                                                                                                                                                                                                                                                                                                                                      
  SFAR 88 - Fuel Tank System Design Review,\                                                                                                                                                                                                                                                                                                                                                                     
  Flammability Reduction, Maintenance and                                                                                                                                                                                                                                                                                                                                                                        
  Inspection Requirements**                                                                                                                                                                                                                                                                                                                                                                                      

  [Transport Airplane\                          Regulations\                                                                                                                                                            Advisory Circulars\                                                                                                                                           Policy Memo\               Additional Info\
  Directorate](../../Transport_Home_Page.htm)   [SFAR No.                                                                                                                                                               [AC                                                                                                                                                           [Questions &\              [Contacts](../aco-list.cfm)\
                                                88](http://www.airweb.faa.gov/regulatory_and_guidance_library/rgfar.nsf/historyfaramendment/1927825cf0bae8d286256a470066f7ec!opendocument&expandsection=2#_Section2)\   25.981-1B](http://www.airweb.faa.gov/regulatory_and_guidance_library/rgadvisorycircular.nsf/0/80c7ed2b669b2caf86256a85004a5ba4?OpenDocument&Highlight=981)\   Answers](../qa-memo.cfm)   [Workshop](../transport_sfar88.htm)
                                                [Amdt 21-78](http://www.airweb.faa.gov/regulatory_and_guidance_library/rgfinalrule.nsf/frpart/f035bc081c98a51686256a4700642e17?OpenDocument)                            [AC 25.981-2](http://www.airweb.faa.gov/regulatory_and_guidance_library/rgadvisorycircular.nsf/0/41064e13a3ca8b2086256a85004a5d02?OpenDocument&Highlight=981)                            

                                                                                                                                                                                                                                                                                                                                                                                                                 
  --------------------------------------------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------- -------------------------- -------------------------------------

**Questions Raised With Respect to SFAR No. 88 (Q&A)**

**1. (6/28/2001) Do holders of STCs, which install APUs that tap into
the Acft. fuel system need to do the analysis required by the SFAR?**

Yes. If the change does not cause any affect on the fuel tank, or add
components, wiring, etc. adjacent to the fuel tank (possibly causing an
external ignition source) then a simple paragraph stating this would be
all that is needed. If that change adds components such as valves,
wiring, pumps adjacent to the fuel tanks then a more detailed assessment
would be needed.

**2. (7/16/2001) Advisory material is required to define the maximum
resistance and impedance for each bonding provision and clear wording is
needed on the need for and type of protection against lightning currents
for bonding provisions in fuel tanks. Neither AC 25.981-A nor ACJ 25X899
provide clarification in this respect. Can you provide us with such
information/advisory material? (Background: Some manufacturers have run
simulated lightning tests on full scale fuel tanks and have promised
sharing of test results but so far this did not materialize. Some TC
holders do not have the capability to do such tests and can therefore
not define the currents running through internal pipes and other
components in fuel tanks from test results.)**

There is no specific FAA guidance on maximum resistance or impedance of
airplane electrical bonding provisions. Electrical bonding within a fuel
system must be tailored to the performance requirements of a particular
airplane design. The electrical bonding must consider the electrical
sources, such as electrical faults, fuel static electrification, and
lightning. The electrical bonding must also consider the specific
airplane fuel system design, which would include the structure material
used (aluminum, carbon fiber composites, fiberglass composites, etc.),
the configuration of the fuel system (routing of fuel tubes, wires, and
hydraulic tubes), and the electrical bonding concept (intentional
isolation, self-bonding fittings, separate bonding jumpers, etc.) Given
the large variation in design approaches, and the close relationship
between the design approach and the electrical bonding requirements, it
is not practical for FAA to provide specific guidance on maximum bonding
resistance or impedance.

Airplane TC holders have performed tests on their airplanes to determine
the specific requirements for electrical bonding for threats such as
lightning. Other TC holders, in the absence of specific airplane test
data, have chosen conservative electrical bonding approaches. Again, the
approach is a decision each TC holder must make based on the specific
situation for their airplane models.

**3. (7/16/2001) \"Major components\" (§ 25.901(b)(4)) need to be
clarified. Can you provide us with this clarification or a definition of
\"major components\"? (Background: Some Wigg-o-flex couplings and
Tee-pieces, which have no bonding provisions, have historically been
used in fuel tanks based on very low or no static charge build-up and
were not considered major components.)**

There is no specific FAA guidance on \"major components\" in §
25.901(b)(4). However, the term \"major components\" in § 25.901(b)(4)
should not be used to limit the review of fuel system ignition sources
as required in FAR 25.981. Section 25.981 Fuel tank ignition prevention
states: \"(a) No ignition source may be present at each point in the
fuel tank or fuel tank system where catastrophic failure could occur due
to ignition of fuel or vapors.\" This is in addition to the major
components in § 25.901(b)(4). Fuel tube flexible coupling electrical
bonding must be considered if these couplings are identified as ignition
sources during the ignition source evaluation and assessment.

**4. (7/16/2001) What is the FAA position on the effects of failure of a
single bonding cable or other bonding provision as well as on the
possible need for redundancy?**

Section 25.981 Fuel tank ignition prevention states: \"(a) No ignition
source may be present at each point in the fuel tank or fuel tank system
where catastrophic failure could occur due to ignition of fuel or
vapors. This must be shown by: ... (3) Demonstrating that an ignition
source could not result from each single failure, from each single
failure in combination with each latent failure condition not shown to
be extremely remote, and from all combinations of failures not shown to
be extremely improbable. The effects of manufacturing variability,
aging, wear, corrosion, and likely damage must be considered.\"

Failure of bonding jumpers is generally considered a latent failure,
since there is no annunciation or indication of the bonding failure. The
airplane fleet fuel tank inspections that occurred as a result of the
TWA 800 investigation showed that failure of bonding jumpers due to
damage, wear, or manufacturing errors was not unusual. Based on this, it
would be difficult to show that failure of a single bonding jumper is
extremely remote or extremely improbable. Therefore, the electrical
bonding jumper or other bonding provisions must consider the
consequences of these latent failures. This may result in design changes
that incorporate electrical bonding redundancy, if the failure of a
single electrical bonding feature could create a fuel ignition source.

**5. (7/16/2001) The need for and method of inspection of bonding
provisions must be clarified. Can you provide us with this
clarification? (Background: During bonding resistance measurements,
damage of protective finish of components is caused in order to
penetrate the insulating anodized surface layer, which is likely to lead
to subsequent corrosion damage.)**

The concern with damage to corrosion protection coatings is valid. This
concern has resulted in some TC holders defining non-intrusive
inspections for electrical bonding. These inspections may include
detailed visual inspections, if the quality of the electrical bonding
feature can be adequately assessed by visual cues, such as visible
corrosion, breakage or missing bonding provisions. For the fuel tank
SFAR detailed visual inspection would not by itself be adequate. Other
inspections include inductively-coupled loop resistance measurements, to
eliminate the need to disconnect bonding jumpers or to penetrate
corrosion-prevention coatings. In any case, the need for and the method
of inspection must be defined based on the specific situation for the TC
holder\'s airplanes. The need for and the method of inspection should be
a result of the assessments and evaluations carried out to determine the
specific electrical bonding requirements referred to in Question 4.

**6. (7/16/2001) [Jet fuel ignition test results]{.underline} One of the
possible fuel tank ignition sources listed in AC 25.981-1B is a heated
filament. It specifically states that; \"Analysis and testing indicate a
small piece of wire from steel wool can ignite jet fuel when a current
of 30 to 40 milliamperes root-mean-square (RMS) is applied to the
wire\". The commenter has been unable to trace the origin of these test
results, it is not mentioned in any of the official standards on
intrinsic safety, nor could it be found in a large number of reports
that deal with flammability and/or the ignition properties of jet fuel.
Can the FAA indicate which document provided the basis for this
limitation?**

Based upon comments from several applicants during the SFAR compliance
process the FAA has revised the information in AC 25.981-1B. We are in
the process of issuing a revised AC that will be placed on the internet
for easy access. The text below is the latest draft text and is provided
as an advanced version for your use (2/12/2002). With regard to the
filament heating energy limit, the data used in development of the AC
was from proprietary testing submitted by several applicants and
therefore is not publicly available. The FAA has initiated testing
through the FAA Technical Center that will develop publicly releasable
information. Applicants may conduct testing to substantiate alternate
values.

a\. Electrical Sparks (Voltage Sparks) and Electrical Arcs (Thermal
Sparks).

\(1\) Electrical sparks or voltage sparks can occur between conductive
elements that are isolated from each other, due to voltage differences
between the conductive elements arising from electrical system
malfunctions, lightning, electrical faults or other electrical
conditions. Electrical arcs or thermal sparks can occur when conductive
elements, in contact with each other, eject molten or burning material
when the current across the contact points exceeds the current-carrying
capability of the contact points. (See references in paragraphs 4f (8),
(9), and (12) of this AC.)

\(2\) Laboratory testing has shown that the minimum ignition energy
required to ignite hydrocarbon fuel vapor is 200 microjoules.^1^
Therefore, for electrical or electronic systems that introduce
electrical energy into fuel tanks, such as fuel quantity indicating
systems, the energy introduced into any fuel tank should be less than
200 microjoules during either normal operation or operation with
failures (note that some components have been qualified to standards
that allow 320 microjoules and this level is not acceptable for showing
intrinsic safety). To ensure that the design has adequate reliability
and acceptable maintenance intervals, a factor of safety should be
applied to this value when establishing a design limit. For example, a
maximum energy of 20 microjoules is considered an intrinsically safe
design limit for fuel quantity indicating systems.

\(3\) Electrical transients caused by environmental conditions, such as
lightning strikes, with the potential to create electrical sparks and
arcs in the fuel tank should be limited so that the energy from any
electrical spark or arc from the electrical transient is less than 200
microjoules. Optical detection methods and combustible vapor ignition
detection methods used to show compliance for electrical transients
caused by environmental conditions should detect sparks with energy
levels of 200 microjoules or less. Optical detection methods consist of
subjecting a fuel tank to a simulated lightning strike while a specific
camera/lens/film configuration is positioned near the fuel system
component, system or fuel tank with the shutter open. The test is passed
if no spark is visible on the developed film. Combustible vapor ignition
detection methods use specific combustible gas mixtures that have high
ignition probability at a specific electrical energy. Fuel system
components, systems, or fuel tanks are tested in the presence of the
combustible vapor. The test passes if the vapor does not ignite during
the test, but does ignite using a standardized ignition energy source at
the specified ignition energy.

^1^ The 200 microjoule level comes from various sources, the most quoted
is Lewis and VonElbe, \"Combustion, Flames and Explosions of Gases\",
that has a set of curves for minimum ignition energy for the various
hydrocarbon compounds in Jet fuel, and they all have similar minimum
ignition energy levels of around 220 microjoules. The 20-microjoule
limit is a safety factor on the 200-microjoule level.

c\. [Filament Heating Current Limit.]{.underline} Analyses and testing
indicate a small piece of steel wool will ignite jet fuel when a current
of approximately 60 milliamperes root-mean-square (RMS) is applied to
the steel wool.^2^. Therefore, for electrical or electronic systems that
introduce electrical energy into fuel tanks, such as fuel quantity
indicating systems, the electrical current introduced into any fuel tank
should be limited. Because there is considerable uncertainty associated
with the level of current necessary to produce an ignition source from
filament heating, a factor of safety should be applied to this value
when establishing a design limit. A maximum of steady-state current of
10 milliamperes RMS is considered an intrinsically safe design limit for
fuel quantity indicating systems. Current levels above 10 milliamperes
RMS, particularly for failures and transient conditions, could also be
considered acceptable, provided that proper substantiation by test
and/or analysis justifies them as intrinsically safe. For example, for
transient conditions, it is acceptable to limit the energy in the
transient to 50 microjoules, and failures that result in steady-state
currents above 10 milliamperes RMS should be improbable and not result
in currents greater than 30 milliamperes RMS.

^2^ This data was from proprietary testing and therefore is not publicly
available. The FAA has initiated testing through the FAA Technical
Center that will be publicly releasable. Applicants may conduct testing
to substantiate alternate values.

**7. (8/02/2001) Should the STC holder work directly with TC ACO?**

The STC holder should work with the cognizant STC ACO per the provisions
of the SFAR. The STC ACO will be reviewing the reports and making
determinations based on the guidance from the Transport Airplane
Directorate. We have established a team of specialists to work with the
ACOs to ensure standardization of the requirements and determinations of
compliance.

**8. What is your view on the need to review these fuel system issues
with the PMA-holders (who do not have an STC)?**

Follow-up: The commenter focused on those PMAs that are issued without
prior STC (identically or reverse engineering). For those parts, the
approval holder could make design changes, with no coordination without
involving the TC holder. Perhaps it\'s not a big concern, but is an area
not addressed by the FAR.

SFAR 88 applies to TCs and STCs, not PMAs. Any PMA issue associated with
TC/STC holders, who have PMAs, will be inherently addressed in their
system safety assessment. Similarly any PMAs that are identical to the
TC/STC holders PMAs will automatically be addressed. Part numbers or
identification could be an issue if ADs are written to modify or change
an affected part. Non identical PMAs should be addressed in the operator
system safety review.

**9. (8/06/2001 & 8/10/2001) Does SFAR 88 apply to the AWACs, 747s,
E4s**

Use criteria in SFAR 88 to determine applicability.

**10. (8/07/2001) With respect to intent of approving maintenance
instructions, is the ACO engineer the one who will actually approve the
maintenance recommended or was it the intent for the engineer in
conjunction with the Directorate AEG to conjointly approve the
applicants recommended maintenance?**

Here are the specific words from one of the SFAR related rules: \"These
instructions must address the actual configuration of the fuel tank
systems of each affected airplane and must be approved by the FAA
Aircraft Certification Office (ACO), or office of the Transport Airplane
Directorate, having cognizance over the type certificate for the
affected airplane.\" The reason for this requirement was in
consideration of the complexity of the system safety assessment. The
expertise of the AFS field offices and the AEG will be utilized in the
final determination of the required maintenance and inspection tasks.
Similarly, any escalation of required maintenance and inspection tasks
would be through the approval of the cognizant ACO with assistance from
appropriate Flight Standards personnel.

**11. (8/2001) [Fuel Pump Inlets]{.underline} - Do design holders need
to assume sparks in the fuel pump inlets - regardless of the fuel pump
design (or whether safety wire is allowed in the pumps, Al rotors on Al
housings, etc.)?**

[Friction Sparks.]{.underline} The failure modes and effects analysis
(FMEA) should include evaluation of the effects of debris entering the
fuel pumps, including any debris that could be generated internally,
such as any components upstream of the pump inlet. Industry fuel tank
cleanliness practices and design features intended to preclude debris
entering the fuel pumps have not been effective at eliminating debris.
Service experience has shown that pump inlet check valves, inducers,
nuts, bolts, rivets, fasteners, sealant, lockwire, etc. have been
inducted into fuel pumps and contacted the impeller. This condition
could result in creation of friction sparks and should be an assumed
failure condition when conducting the system safety assessment.
Fail-safe features should be incorporated into the fuel pump design to
address this condition. Examples of means that may be incorporated into
the fuel pump design to address this concern include:

-   Installation of inlet flame arrestors,

-   Use of reticulated foam,

-   Use/installation of jet fuel pumps without impellers to scavenge
    fuel, or Maintaining fuel over the pump inlet throughout the
    airplane flight attitude envelope.

**12. Are we going to mandate flame arrestors in the inlet lines (for
those pumps that are allowed to run dry)? If we do, do we know of any
other method of containing the resultant ignition of vapor besides using
an arrestor? Are the design holder\'s only options: (1) addition of
flame arrestors, or (2) keeping the inlets covered with fuel?**

Not specifically, the applicant can use other means. Some manufacturers
use collector tanks, filled by ejector pumps to keep the inlet covered.
Others shut off pumps in aux tanks before they uncover and scavenge fuel
using ejector pumps. See text in preceding question.

**13. [Vent System flame arrestors]{.underline} - (a) Are we going to
mandate vent system flame arrestors? Reading the NPRM (FR 19853,
3/22/98) for an AD that was written for the B-737 100 through 500 series
(resulting from the Philippines Airlines accident on may 11, 1990), it
states:**

**One possible scenario which may have caused the 1990 accident is an
external ignition of the fuel vapor exiting the fuel vent system and
consequent propagation of a flame front into the wingtip vent scoop and
through the vent system into the center tank. The Model 737-300 vent
system does not include flame arrestors and pressure relief valves and
would allow a flame front to travel unimpeded into the vent system
through the wingtip vent scoop. The conditions described above, if not
corrected, could result in a potential source of ignition in a fuel
tank.**

**It would appear that we are now considering external ignition sources
outside the vent system.**

**(b) Does this need to be considered in the safety analysis of the SFAR
88 activities?**

\(a\) No, the vent system flame arrestor rulemaking is currently tasked
to ARAC and will be handled as separate rulemaking for post crash fire
related concerns.

\(b\) External ignition sources that may result in explosion of the fuel
tank must be addressed in the SFAR and it is possible that an ignition
source such as a logo light might be identified as part of the safety
assessment. In this case AD action may be taken..

**14. Would it be possible for someone to get an STC for their transport
category, turbine powered airplane that would limit its passenger
capacity to say 29, and the maximum payload capacity to say, 7,499
lbs. - thus alleviating them from being subject to the SFAR 88
requirements?**

Yes, though the STC, AFM, and \"weight and balance manual\" (and
possibly the airplane by placard) should show the limitation. In
addition, a note should be placed in these documents that states if 29
passengers or 7,499 lb. payload is exceeded, the airplane will have to
comply with SFAR 88. The original TC holder would still need to do an
assessment, while the new STC holder would not.

**15. (8/14/2001) Will the airplane have to be on an experimental when
obtaining temperature data for the auxiliary fuel tank?**

The airplane can be tested under an experimental certificate or under a
normal certificate if the test equipment is approved by STC.

**16. (8/14/2001) Who approves the test plan for the temperature
tests?**

The cognizant ACO.

**17. (8/14/2001) Many STC holders are a result of STC transfers. Most
of the new holders have no information about prior operators who
incorporated the STC. How are the operators found so that we can advise
them of the SFAR?**

FAA PMIs will be contacting their operators with respect to SFAR 88; so,
if a STC holder does not know all the operators with their
modifications, it is highly likely that the operators will be contacting
the STC holders using the information from their airplane\'s records
where the STCs that are installed should have been recorded.

**18. Is there a definition of certificated payload?**

The following are accepted definitions:

Payload (P/L): Total weight of maximum allowed passengers, cargo, and
baggage (These may be revenue and (or) non-revenue.)

Maximum payload: Maximum design zero fuel weight minus operational empty
weight.

Maximum design zero fuel weight (MZFW): Maximum weight allowed before
usable fuel and other specified usable agents must be loaded in defined
sections of the aircraft as limited by strength and airworthiness
requirements. (Can be found in AFM)

Operational empty weight (OEW): Basic empty weight or fleet empty weight
plus operational items (Can be found in Weight and Balance Manual or
Operator\'s records)

Operational items: Personnel, equipment, and supplies necessary for a
particular operation, but not included in basic empty weight (These
items may vary for a particular aircraft and may include, but are not
limited to, the following:\
(1) Crew and baggage\
(2) Manuals and navigational equipment\
(3) Removable service equipment for cabin, galley, and bar\
(4) Food and beverages, including liquor.\
(5) Usable fluids other than those in useful load\
(6) Life rafts, life vests, and emergency transmitters\
(7) Aircraft cargo handling system and cargo containers).

Note: To determine the applicability for airplanes that are delivered in
the green (no interior), the certificate holder has the following
options:\
1) Assume no interior in determining payload, or\
2) Assume a typical interior weight (based on the expected typical
interior design) when determining the payload.

Also note the same model delivered in the cargo configuration may have
to comply with SFAR 88 when that model with a business jet passenger
interior may not have to comply or vice versa.

**19. (9/18/2001) If a STC holder identifies an STC that is installed
only on a foreign registered aircraft, what are their
responsibilities?**

The STC holder is still responsible for the type design change since
this is a U.S approved type design. The STC holder is not responsible
for the installation and continued airworthiness under U.S. regulations
but should support the FCAA that has the responsibility.

**20. (9/18/2001) Do foreign registered aircraft operating in the US
under ICAO rules have to comply with SFAR88?**

Foreign registered aircraft operating in the U.S under the ICAO rule are
the responsibility of FCAA.

**21. (9/18/2001) Foreign owned / operated, \'N\' registered aircraft
operating in the US under FAR 129.32 - do they need to comply with SFAR
88?**

All \'N\' registered aircraft must comply. The FAA can impose
airworthiness requirements as the state of registry. The requirements of
sections 129.14, 129.20, and 129.32 are based on our state of registry
powers.

**22. (9/18/2001) For AD written against a TC holder\'s aircraft, what
are the STC holder\'s responsibilities?**

The STC holder is responsible to evaluate how all ADs levied against TC
holders\' aircraft type design affect their STCs.

**23. (9/18/2001) How will a STC holder determine compliance for STCs
for which they don\'t have complete design definition and data?**

This is the STC holder\'s responsibility; they may be required to
conduct a design review for each installation for compliance and to
update STC design data. It is the FAA\'s objective that the STC
holder\'s compliance method with SFAR88 be consistent with the TC
holder\'s, which holds the type design.

**24. (9/18/2001) Can a STC holder surrender any or all of their STCs to
the FAA?**

Yes. However, the FAA cannot take responsibility for continued
airworthiness on these STC installations and the operators assume full
responsibility for the STC installations under SFAR 88. In addition, if
an unsafe condition is found the FAA could issue an AD to modify or
remove the installation, unless an operator can provide a specific
program to show compliance to SFAR88.

**25. (9/10/2001) Clarification of bonding strap requirement: A TC
holder requested clarification of requirements for bonding straps and
jumpers within the fuel tank.**

The following statement at the SFAR Workshop: \"Dual bonding straps for
all components in the fuel tank or fuel vapor space are the only
practical method of protection\".

-   Does this specifically stipulate the requirement of two bond straps
    for each component? From a practical standpoint the safety
    assessment would likely dictate a need for redundant bonding.

-   Is the intent to demonstrate that each component has two means of
    dissipating electrical energy?

Yes. Is the intent to apply this requirement to both bonding \"straps\"
and bonding \"jumpers\"? (i.e. Does \"component\" refer to only to
powered components (such as pumps) or does it refer to items such as
fuel lines.) Both. See question/answer 4.

Reference: FAA SFAR Workshop, Seattle Washington, June 20-21, 2001 -
Fuel Tank Safety Assessment for Fuel Tank Safety, James J. Treacy.

**26. (9/10/2001) Proposed compliance with FAR 25.981(a)(1) and (a)(2).
A TC holder plans to use their original certification report as the
basis of substantiation for FAR 25.981(a)(1) and (a)(2).**

These regulations as stated in the SFAR reflect the same intent as the
previously existing regulations FAR 25.981 (a) and (b). Reference: The
Amendment, § 25.981 Fuel tank ignition proposal, p.23130. The adequacy
of this report can only be judged based upon review of its content.
Compliance documentation submitted by other manufacturers to show
compliance to § 25.981 has not been adequate. However, the TC holder may
have done a more thorough assessment but that would need to be evaluated
on a case by case basis.

**27. (9/10/2001) Subject: Applicability of FAR 25.901**

**A TC holder would like to clarify the intention of compliance
requirement (a) of SFAR No. 88.**

The TC holder is concerned that the SFAR regulation, as stated in
requirement (a) below, captures all applicable requirements contained in
subpart E. This would be a very large undertaking with end results,
which do not reflect the intent of the SFAR.

The first sentence in part (a) of the SFAR compliance requirements
states that...\
\"...each type certificate holder...must accomplish the following:\
(a) Conduct a safety review of the airplane fuel tank system to
determine that the design meets the requirements of §§ 25.901, ...\"

For Subpart E - Powerplant, Section 25.901 Installation, Under section
(b)(1), the regulation states that...\
\"The installation must comply with - ...\
(ii) The applicable provisions of this subpart ;...\"

At the FAA SFAR Workshop held in Seattle, WA June 20-21, 2001, Mike
Dostert (FAA SFAR contact, Propulsion/Mechanical Systems Branch,
ANM-112) stated that the intent of including the reference of FAR 25.901
in the SFAR requirements is solely focused on the \"no single failure\"
requirement as stated in part (c) of FAR 25.901.

Reference: SFAR No. 88 - Fuel Tank System Fault Tolerance Evaluation
Requirements, p. 23129.

Answer: The failure provisions of 25.901 (c) (including combinations of
failures) are the portion of the rule that is intended to be addressed.

**28. (9/10/2001) Item 9: FAA referenced documents in AC 25.981-1B A TC
holder requests assistance in obtaining certain documents referenced in
AC 25.981-1B.**

See FAA Transport Airplane Directorate Designee Newsletter, Edition 15,
February 1993. Article, Electrical Wiring used in Commercial Transport
Airplanes.\
FAA Regulatory Support Division (AFS-500 or -600), Oklahoma City,
Project 414-76a (01603), Explosion Potential for Electrical Items in
Fuel Tanks. (This reference will be deleted from the next revision to
the AC). FAA Document DOT/FAA/AR-98/26, Review of the Flammability
Hazard of Jet A Fuel Vapor in Civil Transport Aircraft Fuel Tanks, June
1998. Copy available from FAA tech center web site,
[www.fire.tc.faa.gov](../www.fire.tc.faa.gov)

Reference: AC 25.981-1B, Section 4.f., page 3.

**29. (9/10/2001) Amendment of AC 25.981-1B? Is an amendment to AC
25.981-1B planned for release as stated at the SFAR Workshop? When is it
scheduled for release?**

The FAA is working to develop a set of revisions to the AC. This work
should be completed within the next 4 weeks such that a final daft can
be issued. At that point we may want to officially transmit it to the
applicant via an issue paper because of the time involved in
publication.

Reference: [FAA SFAR Workshop, Seattle Washington, June
20-21](../transport_sfar88.htm).

**30. (9/24/2001) Are certain Convair models (580, 600, 640) designated
by the change from recip to turboprop under STCs, which were issued
after Jan. 1, 1958, affected by SFAR 88?**

The SFAR 88 does not apply to the Convair 240, 340 and 440s as their
type certificate was issued before Jan. 1, 1958. SFAR does not apply to
the Convair models designated under STC (engine type change) as the
applicability of SFAR 88 is specific to turbine powered aircraft whose
TC was issued after January 1, 1958. Our intent was to make the
delineator TC rather than STC.

**31. (10/2/2001) If an applicant applies after 6/6/2001, what does the
applicant need to do?**

After June 6, 2001\
Under Order 8110.4B, Section 2-10d, Changed Aviation Products, each ACO
is to request the applicant to update the certification basis in the
area of change, which would include adding the revised § 25.981 and
Appendix H (H25.4) \[Amdt. 25-102 effective June 6, 2001\]. If the
applicant does not sufficiently argue to the ACOs satisfaction that the
revised § 25.981 and Appendix H (H25.4) do not apply, then the ACO will
have to review the design in detail.

If the proposed change consists of a new design or a substantially
complete redesign of a component, equipment installation, or system
installation, that might increase the risk of ignition of fuel vapors or
make fuel tank vapors more flammable, the provisions of § 21.101(b)(1)
require incorporation of Amendment 25-102 in the certification basis.
Note that in adopting SFAR 88 and Amendment 25-102, the FAA determined
that earlier regulations incorporated by reference in type certificates
for products applied for before June 6, 2001, do not provide adequate
standards with respect to proposed changes that may affect the airplane
fuel tank system.

If the proposed change is not a new design or not a complete redesign of
a component, equipment installation, or system installation (such as
rerouting of wiring and plumbing) but the change is perceived to
increase the risk of producing a fuel tank ignition source or increase
the risk of having flammable vapors in a fuel tank, that proposed change
may be considered an unsafe design feature (§ 21.21(b)(2)) and should
not be approved until the standards of Amendment 25-102 are met.

When the changed product rule (CPR) becomes effective, which is
currently scheduled to be June 10, 2003, use the revised § 21.101 and
the guidance associated with Amendments 21-77 in determining the
application of Amendment 25-102. (Reference: Amendment 21-77, FR Vol.
65, Notice 1100, page 36244 and Amendment 21-77B, FR Vol. 66, Number
220, page 56989). The FAA will evaluate the need for additional guidance
with respect to the means of applying Amendment 25-102 as the effective
date of the change product rule approaches.

**32. What if the applicant has moved but the data has not?**

The two affected ACOs should work together to work out the transfer of
data to the geographic ACO.

**33. (10/22/2001) SFAR 88 states \"Conduct a safety review of the
airplane...to determine that the design meets the requirements of §
25.901 and 25.981(a) and (b). But § 25.901b(ii) says that the
power-plant installation must comply with the applicable provisions of
this subpart (E). Does this mean that all-applicable paragraphs of
subpart E should be addressed in the safety review?**

The consequences of failures (single and combinations) relative to fuel
tank explosions was what was intended to be re-evaluated by the safety
review. We did not intend to revalidate the fuel system to all possible
aspects of § 25.901.

**34. (10/24/2001) A holder has a STC that SFAR 88 applies, but hasn\'t
sold any STC installations. Is there a way they can put off compliance
pending a sale?**

For existing STCs that have not been installed, the STC holder can
petition for exemption, which would include a limitation that SFAR 88 be
complied with prior to STC installation.

**35. (11/6/2001) In Part 21,SFAR-88 Number 2(c){Federal Register: page
23129,Volume 66, No.88, Monday, May 7,2001} it states \"Submit a report
for approval \...\" What is the intent as to the contents of this
report? Also, what constitutes \"\... substantiation\....\" required in
(c)(1)? The answer to these will assist us in forecasting the level of
future workload we might expect at the NYACO.**

2(c) reads:\
Submit a report for approval to the FAA Aircraft Certification Office
(ACO), or office of the Transport Airplane Directorate, having
cognizance over the type certificate for the affected airplane, that:\
(1) Provides substantiation that the airplane fuel tank system design,
including all necessary design changes, meets the requirements of Secs.
25.901 and 25.981(a) and (b) of this chapter; and\
(2) Contains all maintenance and inspection instructions necessary to
maintain the design features required to preclude the existence or
development of an ignition source within the fuel tank system throughout
the operational life of the airplane.\
The intent of the report mentioned in (c) is to provide substantiation
of compliance with (c)(1) like substantiation of compliance with any
other rule, and the report would also contain maintenance and
inspections (instructions for continued airworthiness) necessary to
maintain the design features.

**36. (12/03/2001) Latent Failure Conditions. What is the FAA
interpretation of the wording in the rule \"demonstrating that an
ignition source could not result from each single failure in combination
with each latent failure condition not shown to be extremely
remote\...\"? This appears to be contradicted by AC 25.981-1B Para.
9(c)(4) \"\...requires that any anticipated failure condition not leave
the airplane one failure away from a catastrophic fuel tank
ignition\...\", and clarification is requested.**

The two statements are intended to require consideration of latent
failures. This requirement is sometimes referred to as \"specific
risk\". The wording in the AC is guidance; therefore, the wording of the
rule takes precedence over the wording in the AC.

**37. (12/03/2001) Filament Heating Energy Limit. AC 25.981-1B states
\"electrical power with the potential to create a filament heating
ignition source in the fuel tank should be limited to less than 30
milliamperes RMS.\" The AC discusses \"analyses and testing\" that show
this current is sufficient to ignite jet fuel, however, a TC holder has
requested more specific information regarding the origin of this 30-mA
limit value.**

The value in the AC is being revised based upon comments from the
Workshop. Testing was conducted using steel wool. See question/answer
number 6b.

**38. (12/03/2001) 3. Electrical Arcs. AC 25.981-1B states \"electrical
transients with the potential to create sparks in the fuel tank should
be limited to less than 200 microjoules\...a factor of safety should be
applied to this value\...For example, a maximum of 20 microjoules is
considered intrinsically safe.\" A TC holder stated their belief that
320 microjoules, as specified in certain other standards, is a safe
level. The TC holder has an action from our 23 Oct meeting to provide
substantiation for the safety of the 320 microjoule level, however, any
guidance or interpretation the FAA can provide on this issue (i.e.
origin of the 200 microjoule value, SF of 10) would be appreciated.**

The 200-microjoule value is based upon test data from Bureau of Mines
testing and the FAA has used it for years. The safety factor of 10 is
based upon the needed to provide margin from the design value to the
\"never exceed during failure conditions and maintenance intervals\"
value. See question/answer number 6a.

**39. (12/03/2001) 4. Bonding. Figure 1 of AC 25.981-1B states that one
of the Fuel Tank Ignition Source considerations is bonding,
specifically, \"Redundant Bond Paths\". This was discussed at some
length in the 23 Oct meeting, as apparently at the FAA SFAR workshop it
was not clear what failures needed to be assumed (i.e. assume one
bonding path is missing due to maintenance, does this mean three are
required in the design?). Clarification is requested as to what the FAA
would consider to be acceptable \"redundant bond paths\" for the SFAR.**

As Jim Treacy stated this at the workshop a minimum, dual bond paths are
likely required to meet the latent failure criteria. Even with dual
paths, constraints on maintenance actions are likely required to prevent
maintenance errors, such as making checks of bonds a required inspection
item. (see AC discussion and workshop info on required inspection
items). The other option is triple redundant paths. See question/answer
numbers 4 and 25.

**40. (12/05/2001) If I interpret the SFAR correctly, an applicant in
before 6/6 has to comply with SFAR-88 by analyzing their product but
only to the requirements of 25.981 a & b (pre amendment 25-102). If the
applicant has to make modifications based on this analysis (amend the TC
or STC), the modifications (as well as the basic design?) would then
have to comply with the (post amendment 25-102) requirements of 25.981
a, b & c. Is this a correct presumption?**

Design changes required as a result of SFAR 88 safety reviews need only
comply with the SFAR criteria - §25.981 (a) & (b). However, if the
design change adversely affects the \"flammability characteristics\" of
the fuel tank(s), then I believe subparagraph §25.981(c) would also come
into play. See Question 31.

**41. (12/12/2001) Where do we stand in regard to having DERs approve
compliance with SFAR-88?**

DERs should recommend approval and the FAA will approve or disapprove.

**42. (12/12/2001) Are Wiggins self-bonding couplings considered dual
bond paths with regard to SFAR?**

Single bond paths will not meet the fail-safe requirements of the SFAR.
Inspections alone of wiring on a system where a single failure will
cause an ignition source in the tank will not be acceptable. See
question/answer 4 and 25.

**43. (12/12/2001) What data do we have to support the 200-milijoule
energy and 5 milliamp current levels?**

See question/answers 6 and 38.

**44. (12/13/2001) What is the FAA position regarding inclusion of SFAR
88 in the certification basis?**

Add an item in the certification bases, \"See note X\" and then in the
notes section add a note that compliance with SFAR 88 has been found in
Document YYY (or similar wording of compliance). For project initiated
after June 6, 2001, SFAR No. 88 does not apply.

**45. (12/17/2001) Should SAE, Aerospace Recommended Practice, ARP 4761,
issued 1996-12, \"Guidelines and methods for conducting the safety
assessment process on civil airborne systems and equipment\" be used in
showing compliance with SFAR 88?**

If the risk being assessed is that associated with random multiple
failures, then utilizing the standard practices of ARP 4761 can be
appropriate. However, if the risk being assessed is that associated with
an obscure single failure, then the most effective analytical tools may
also include Weibull Analysis, Root Cause Analysis, Directed FMEA\'s,
etc. Other analytical tools such as Markov or Monte Carlo modeling may
be more appropriate and effective.

**46. (1/7/2002) What is the status of the FAA modifications to AC
25.981-1B.**

We anticipate the revised AC will be put on the internet for comment by
the end of March. See question/answer 6 and 29.

**47. (1/22/2002) Concerning STC projects that may not be affected by
SFAR 88, can we accept information from the applicant that indicates no
effect without the TC holder\'s SSA document?**

We can certainly accept applicant\'s data. Whether it satisfies the
requirements of SFAR 88 will need to be evaluated.

**48. (2/8/2002) Two operators questioned the applicability of field
approvals, minor changes and airline engineering approvals. Can they be
covered (assessed) after the first 18 month or during?**

Compliance is required by June 7, 2004. Operators may begin their
assessments at any time.

**49. (2/6/2002) Do switches outside the fuel tank need to be
intrinsically safe?**

No. The electrical components outside the fuel tanks but in those areas
considered flammable vapor leakage zones need to be designed to prevent
ignition of flammable vapors.

**50. (2/6/2002) What about STCs that have been surrendered? What about
old STC not currently in production? Who is responsible?**

See Question 25 for surrendered STCs. For old STCs that are not
currently under production, the STC holder is still responsible for
their part of SFAR 88.

**51. (1/29/2002) 1. One operator installed STCs on some Boeing 707
aircraft that have since been sold to the U.S. Air Force. Some of these
aircraft are no longer in service, but some still are. The operator
would like to know if they should treat the U.S. military like any other
operator or are those aircraft exempt from the SFAR 88 process?**

Response: Yes, treat the US military like any other operator, but not
necessarily a US operator. The SFAR does not treat TCs or STCs related
to military airplanes or foreign operators differently than TCs/STCs in
any type of service. It is our understanding that the military normally
requires compliance with the FAA\'s airworthiness requirements. However,
an exemption to the SFAR may be granted IF all of the following
conditions were met: (a) it could be demonstrated that the only STCs are
installed are on US military airplanes, (b) the US military does not
intend to comply with the operating regulations associated with the
SFAR, and (c) the US military would not comply with ADs that may be
issued as a result of the design review required by the SFAR. In
addition, a note would need to be added to the STC stating no further
STCs could be installed until compliance is demonstrated with SFAR 88.

**52. (1/29/2002) 2. What about the same situation with foreign military
operators of aircraft, which have XXX Airlines STC\'s installed?**

Response: Same answer as for #1, except replace the \"US military\" with
\"foreign military operators.\"

**53. (1/29/2002) 3. What about the same situation with former XXX
Airlines aircraft now operated by private foreign operators?**

Response: Same as above, inserting \"foreign operators\".

**54. (2/20/2002) 1. To what extent must repairs be addressed?**

Repairs are not required to be addressed at any time, except when the
operator has knowledge that a repair may affect the system safety
analysis of a critical fuel tank system item.

**55. (2/20/2002) 2. When a repair is known to affect the fuel system,
when would the respective assessment have to be completed?**

The System Safety Analyses (SSA) should be completed early enough to
allow the FAA time to review and approve the operator\'s maintenance and
inspection instructions that must be incorporated in their inspection
program by June 7, 2004.

**56. (2/20/2002) 3. The rule states that major alterations need to be
assessed; when would such assessments have to be completed?**

Major alterations would have to be assessed before June 7, 2004. Only
TCs and STCs have to be assessed by December 6, 2002. Notwithstanding
this intent of the rule, however, operators are advised and encouraged
to coordinate with their PMIs early and often on any and all issues that
may affect the carriers maintenance program required to be implemented
by June 7, 2004, under Section 121.370(b).

**57. (2/20/2002) 4. Do minor alterations have to be assessed?**

An assessment would be required only if the operator is aware that the
alteration has an effect on the fuel system safety.

**58. (2/20/2002) 5. In the case of STC holders (includes some
operators), what provisions are made for SSA\'s that cannot be completed
prior to the Original Equipment Manufacturer having completed SSA\'s on
the original Type Certificate and the OEM fails to complete the SSAs
adequately in advance of the December 6, 2002, deadline?**

STC holders should complete the SSAs to the extent that they can without
the OEM\'s SSA\'s, and then identify in the reports required by SFAR 88
Section 2.(c) that the OEM\'s subsequent SSA on the TC could possibly
affect the ultimate compliant configuration and maintenance requirements
of the STC.

**59. (2/20/2002) 6. In the case of STC holders who ultimately decide
not to perform SSA\'s on their designs, and either are out of business
or abandon or surrender their STC\'s, what provisions are made for the
operators of such STC\'s who desire to continue them in service?**

[Surrendered STCs:]{.underline} The FAA would ask the certificate holder
to provide sufficient data to allow the operator to conduct an SSA. The
STC holder may or may not provide any data to FAA or anyone else to
support SSA\'s for the systems.

[Abandoned STCs:]{.underline} After searching to find the certificate
holder, if not found the FAA can release whatever data it has. Note that
it is the obligation of the operator to ensure that his airplane\'s fuel
system receives a system safety review. Methods that could be used
include pursuing the STC holding company and persuading it to perform
the SSA, having the data transferred to the operator so that the
operator may perform the analysis, or have a third party perform the
SSA. If the STC holder\'s data can not be obtained, the operator should
coordinate with the responsible ACO as soon as such a problem is
recognized.

**60. (2/20/2002) 7. What compliance deadline must the operator observe
when the STC holder fails to complete the required assessment by
December 6, 2002?**

If the STC holder does not complete the design review by the December 6,
2002, deadline, that certificate holder may be subjected to enforcement
action. Nevertheless, it is then the responsibility of the operator of
that aircraft to address the STC as part of the carrier\'s maintenance
program required to be implemented by June 7, 2004, under either §§
91.410(b), 121.370(b), 125.248(b), or 129.32(b).

**61. (2/20/2002) 8. Will the installation of barrier devices (Transient
Suppression Devices, Transient Suppression Units, Isolated Fuel Quantity
Transmitters, Ground Fault Interruptors) constitute an Alternate Means
of Compliance for SFAR 88?**

It is conceivable that the installation of a barrier device, or
transient suppression device, in most circumstances could effectively
constitute a means of compliance for the wiring and equipment protected
by the device, but this would be a question for the TC or STC holder to
determine in coordination with the corresponding ACO following the SSA.
Barrier devices will in all likelihood require continuing maintenance.
Note that SFAR 88 does not provide a provision for an \"Alternate Means
of Compliance\". If a certificate holder plans to propose an Alternate
Means of Compliance, the FAA would consider amending SFAR 88 to provide
that provision.

**62. (2/20/2002) 8. Does the report filed by TC and STC holders on or
before December 6, 2002, per SFAR 88 have to receive prior DER
approval?**

No. The SFAR requires that a report be submitted to the ACO, and the ACO
will approve or disapprove it. However, the fact that a DER has reviewed
the report or portions of it may be beneficial in reducing the amount of
time required by the ACO for its review.

**63. (2/20/2002) What is the \"actual configuration\" of the
aircraft?**

Generally, the configuration of the aircraft is the actual configuration
as indicated by manufacturers delivery documents and other data that
identify subsequent modification by STC\'s, field approvals and major
alterations. To the extent that repairs or minor alterations are known
to exist and have a negative effect on fuel system safety, that
knowledge is part of the configuration.

**64. (2/21/2002) Is a DER review or recommendation needed for the
safety analysis submitted under SFAR 88?**

The use of a DER is desirable, but not required. The downside to not
using the DER system is the additional time required for FAA review.