U.S. Department

of Transportation

Federal Aviation

Administration

Advisory 

Circular

Subject: Fuel Tank Ignition Source Prevention 

Guidelines

Date: dd/mm/yy

Initiated By: ANM-110

AC No: 25.981-1X

This advisory circular (AC) provides guidance for demonstrating compliance with the 

certification requirements for prevention of ignition sources, except lightning, which is addressed 

in AC 25.954-X, within the fuel tanks of transport category airplanes. This guidance is 

applicable to transport category airplanes for which a new, amended, or supplemental type 

certificate is requested.

Revisions to this AC include: 1) Removing all the lightning-related aspects with the purpose of 

incorporating them into a newly-developed AC that addresses compliance to the requirements of 

Title 14, Code of Federal Regulations 25.945; and 2) Describing means of compliance for 

prevention of failure conditions by which ignition will be created from sources other than 

lightning, using circuit protective devices such as arc fault circuit breakers or ground fault 

interrupter to provide fail safe features.
mm/dd/yy D R A F T AC 25.981-1X

ii

1 Purpose.......................................................................................................................................1

2 Applicability. .............................................................................................................................1

3 Cancellation. ..............................................................................................................................1

4 Background................................................................................................................................1

5 Objective....................................................................................................................................3

6 Fuel Vapor Ignition Sources. .....................................................................................................7

7 Design Considerations. ............................................................................................................11

8 Safety Analysis. .......................................................................................................................17

9 Component Qualification Considerations................................................................................29

10 Instructions for Continued Airworthiness of the Fuel Tank System—§ 25.1529. ..................33

Appendix A. Certification of Arc Fault Circuit Breaker (AFCB) or Ground Fault Interrupter 

(GFI) ........................................................................................................................................... A-1

Appendix B. References and Related Documents.......................................................................B-1

Appendix C. Definitions. .............................................................................................................C-1

Figures

Figure 1: Examples of Fuel Tank Ignition Source Considerations................................................19
mm/dd/yy D R A F T AC 25.981-1X

1

1 PURPOSE.

This AC provides guidance for demonstrating compliance with the certification 

requirements for prevention of ignition sources, except lightning, which is addressed in 

AC 25.954-X, within the fuel tanks of transport category airplanes. This AC also 

identifies the need for prevention of failure conditions by which ignition will be created 

from sources other than lightning and describes a method using circuit protective 

devices such as arc fault circuit breakers (AFCB) or ground fault interrupter (GFI) to 

provide fail-safe features that have been approved as demonstrating compliance with 

§ 25.981. This guidance is applicable to transport category airplanes for which a new, 

amended, or supplemental type certificate is requested.

2 APPLICABILITY.

2.1 The guidance provided in this document is directed to airplane manufacturers, 

modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) 

transport airplane type certification engineers and their designees.

2.2 This material is neither mandatory nor regulatory in nature and does not constitute a 

regulation. It describes acceptable means, but not the only means, for demonstrating 

compliance with the applicable regulations. The FAA will consider other methods of 

demonstrating compliance that an applicant may elect to present. While these guidelines 

are not mandatory, they are derived from extensive FAA and industry experience in 

determining compliance with the relevant regulations. On the other hand, if we become 

aware of circumstances that convince us that following this AC would not result in 

compliance with the applicable regulations, we will not be bound by the terms of this 

AC, and we may require additional substantiation or design changes as a basis for 

finding compliance.

2.3 The material in this AC does not change or create any additional regulatory 

requirements, nor does it authorize changes in, or permit deviations from, existing 

regulatory requirements.

3 CANCELLATION.

This AC cancels AC 25.981-1C, Fuel Tank Ignition Source Prevention Guidelines, 

dated September 19, 2008.

4 BACKGROUND.

4.1 Regulatory History.

4.1.1 The regulatory standards of Title 14, Code of Federal Regulations (14 CFR) part 25 

require that ignition sources not be present or develop in the fuel tanks of transport 

airplanes. Amendment 25-11, effective May 5, 1967, introduced § 25.981, Fuel tank 
mm/dd/yy D R A F T AC 25.981-1X

2

temperature. This requirement was prompted by a need for protection of airplane fuel 

tanks from possible ignition sources because of advances in electrical system sealing. 

These advances made it possible to place electrical system components, such as pumps 

and fuel gauging elements, as well as the wiring to these components, in immersed 

locations within fuel tanks. Additionally, fuel tank walls were subject to local “hot 

spots” by the proximity of airplane equipment and compressor bleed air ducts that carry

air at high temperatures.

4.1.2 The need for a regulation was further demonstrated by the possibility that the surface 

temperature of the fuel tank internal wall, or the fuel system components within the fuel 

tank, could exceed the auto-ignition temperature. Section 25.981, as originally adopted, 

focused on preventing ignition of fuel vapors in the fuel tanks from hot surfaces. It 

required that the applicant determine the highest temperature allowable in fuel tanks 

that provided a safe margin below the lowest expected auto-ignition temperature of the 

fuel approved for use in the fuel tanks. In addition, this regulation established a 

requirement that no temperature at any place inside any fuel tank where fuel ignition is 

possible may then exceed that maximum allowable temperature.

4.1.3 Other sections of part 25 require that ignition from lightning be prevented (§ 25.954), as 

well as ignition from failures in the fuel system (§ 25.901). Applicants have been 

required by § 25.901 to complete a safety assessment of the fuel system and show that 

“no single failure or malfunction or probable combination of failures will jeopardize the 

safe operation of the airplane....” However, service history has shown that ignition 

sources have developed in airplane fuel tanks due to unforeseen failure modes or factors 

that were not considered at the time of original certification of the airplane, including 

arcs, sparks, or hot surfaces within the fuel tanks.

4.2 AC 25.981-1A, Guidelines for Substantiating Compliance with the Fuel Tank 

Temperature Requirements, issued in 1972, provided guidance that included failure 

modes that used to be considered when determining compliance with the fuel tank 

temperature requirements defined in § 25.981. This regulation originally focused on 

preventing ignition of fuel vapors in the fuel tanks from hot surfaces. The AC also 

stated the accepted practice of establishing a minimum 50 °F temperature margin below 

the lowest auto-ignition temperature of the approved fuels.

4.3 Amendment 25-102, issued on April 18, 2001, renamed § 25.981 as Fuel tank ignition 

prevention. That amendment also added new requirements to address causes of ignition 

sources within fuel tanks, and minimization of the development of flammable vapors in 

the fuel tanks or mitigation of the effects of an ignition of vapors in the tanks. The new

ignition source prevention standard requires a safety assessment of the fuel tank system 

that includes:

 Consideration of single failures;

 Probable combinations of failures;
mm/dd/yy D R A F T AC 25.981-1X

3

 Development of long-term instructions for continued airworthiness (ICA), including

mandatory replacement time, inspection interval, related inspection procedure, and 

critical design configuration control limitations (CDCCLs); and

 Maintainability of the airplane fuel tank system.

4.4 Special Federal Aviation Regulations (SFAR) No. 88, promulgated by Amendment

21-78, also issued on April 18, 2001, requires a one-time reassessment of the fuel tank 

systems of many in-service transport airplanes per the ignition source prevention 

requirements of §§ 25.901 and 25.981, Amendment 25-102.

4.5 Amendment 25-125, issued July 9, 2008, amended § 25.981 to add specific 

requirements for the fuel tank flammability. The requirements for CDCCLs were 

expanded to include flammability reduction means and ignition mitigation.

4.6 Amendment xxx, issued date enhanced § 25.954 requirements to prevent catastrophic 

fuel tank failures due to the effect of lightning on the fuel tank structure and systems 

including fault tolerant fuel system lightning ignition source protection. This 

amendment removed lightning as an ignition source threat to be assessed under 

§ 25.981, because it was impractical to demonstrate § 25.981 compliance for lightning 

in some cases. It also renamed § 25.981 as Fuel tank explosion prevention, which was 

intended by Amendment 25-125.

5 OBJECTIVE.

5.1 The objective of this AC is to provide guidelines that address the prevention of possible 

sources of ignition in airplane fuel tanks in order to comply with § 25.981. Analytical 

evaluation of the fuel tank system, including consideration of lessons learned from the 

transport airplane service history, provides insight into design features that should be 

carefully considered when determining compliance with the regulations that are 

intended to prevent ignition sources within fuel tanks. Prior to conducting a fuel system 

safety assessment (SSA), each applicant should assemble and review relevant lessons 

learned from the overall transport fleet history, as described in this AC, as well as from 

their previous products, their suppliers, and any other available sources to assist in 

identifying any unforeseen failures, wear, or other conditions that could result in an 

ignition source. Sources of information include airplane service records, flight logs, 

inspection records, and component supplier service and sales records. Guidance relating 

to the flammability requirements adopted in the amended § 25.981 is provided 

separately in AC 25.981-2A. Guidance relating to fuel system lightning protection is 

provided in AC 25.954-X.

5.2 Safety assessments of previously certificated fuel systems may require additional 

considerations. For these safety assessments, component sales records may assist in 

identifying if component failures and replacements are occurring. In addition, in some 

cases, changes to components have been introduced following original type design 

certification without consideration of the possible effects of the changes on the system’s 

compliance with the requirements to prevent ignition sources. For example, certain 
mm/dd/yy D R A F T AC 25.981-1X

4

components within fuel pumps have been changed to improve pump life, which 

defeated the original fail-safe features of the pumps. Therefore, results of reviewing this 

service history information, and a review of any changes to components from the 

original type design, should be documented as part of the safety analysis of the fuel tank 

system.

5.3 The following list summarizes fuel tank system design features, malfunctions, failures, 

and maintenance/operational-related actions that have been identified through service 

experience as resulting in a degradation of the safety features of airplane fuel tank 

systems. This list is provided as guidance and not inclusive of all failures that need to be 

considered in the failure assessment. They may assist in evaluating possible failure 

modes during evaluation of the fuel tank installation.

5.3.1 Pumps.

1. Ingestion of pump inlet components (e.g., inducers, fasteners) into the pump 

impeller releasing debris into the fuel tank.

2. Pump inlet case degradation, allowing the pump inlet check valve to contact the 

impeller.

3. Failure of one phase of the stator winding during operation of the fuel pump motor 

together with subsequent failure of a second phase of the motor windings, resulting 

in arcing through the fuel pump housing.

4. Arcing due to the exposure of electrical connections within the pump housing that 

has been designed with inadequate clearance to the pump cover.

5. Omission of cooling port tubes between the pump assembly and the pump motor 

assembly during pump overhaul.

6. Extended dry running of fuel pumps in empty fuel tanks, which was contrary to the 

manufacturer’s recommended procedures.

7. Use of steel impellers that may produce friction sparks if debris enters the pump.

8. Debris lodged inside pumps.

9. Pump power supply connectors that have corroded resulting in fuel leakage and 

electrical arcing.

10. Electrical connections within the pump housing that have been designed with 

inadequate clearance or insulation from the metallic pump housing, resulting in 

arcing.

11. Thermal switches aging over time resulting in a higher trip temperature.

12. Flame arrestors falling out of their respective mounting.

13. Internal wires coming in contact with the pump rotating group, energizing the rotor,

and arcing at the impeller/adapter interface.

14. Poor bonding across component interfaces.

15. Insufficient arc-fault or ground-fault current protection capability.
mm/dd/yy D R A F T AC 25.981-1X

5

16. Poor bonding of components to structure.

17. Loads from the airplane fuel-feed plumbing transferred into the pump housing 

resulting in failure of the housing mounts and subsequent failure of the pump case, 

which defeated the explosion-proof capabilities of the pump.

18. Premature failure of fuel pump thrust bearings allowing steel rotating parts to 

contact the steel pump side plate.

5.3.2 Wiring to Fuel Pumps.

1. Wear of Teflon sleeving and wiring insulation on wires in metallic conduits located 

inside fuel tanks, allowing arcing from wire through the conduits into fuel tank 

ullages.

2. Damage to insulation on wiring routed adjacent to the fuel tank exterior surfaces 

that resulted in arcing to the metallic fuel tank surface.

5.3.3 Fuel Pump Connectors.

1. Electrical arcing at connections within electrical connectors due to bent pins or 

corrosion.

2. Fuel leakage and subsequent fuel fire outside of the fuel tank caused by corrosion of 

electrical connectors inside the pump motor which led to electrical arcing through 

the connector housing (connector was located outside the fuel tank).

3. Selection of improper insulating materials in connector design resulting in 

degrading of the material because of contact with fuel that is used to cool and 

lubricate the pump motor.

5.3.4 Fuel Quantity Indicating System (FQIS) Wiring.

1. Degradation of wire insulation (cracking).

2. Conductive or semi-conductive (silver, copper, or cadmium) deposits at electrical 

connectors inside fuel tanks.

3. Inadequate wire separation between FQIS wiring and structure or other wiring, 

causing chafing of the wiring.

4. Unshielded FQIS wires routed in wire bundles together with high voltage wires, 

creating the possibility of short circuit failures or induced current on the FQIS wires 

in excess of intrinsically safe levels.

5. FQIS wiring that does not adhere to aircraft manufacturer’s standard wiring 

practices (i.e., wires bent back along themselves with bend radius less than defined 

in the aircraft manufacturer’s standard wiring practices, multiple splices lying next 

to one another, etc.).

5.3.5 FQIS Probes.

1. Conductive or semi-conductive corrosion (copper or silver sulfur deposits) causing 

reduced breakdown voltage in FQIS wiring.
mm/dd/yy D R A F T AC 25.981-1X

6

2. Damage to FQIS wire insulation resulting in reduced breakdown voltage as a result 

of wire clamping features at electrical connections on fuel quantity probes.

3. Contamination in the fuel tanks creating an arc path for low levels of electrical 

energy between FQIS probe walls (steel wool, lock wire, nuts, rivets, bolts, and 

mechanical impact damage to probes).

5.3.6 Valve Actuators.

Failure of one solenoid in a dual solenoid actuated valve resulting in overheating of one 

solenoid above the auto-ignition temperature.

5.3.7 Float Switch Systems.

1. Conduits containing float switch wiring failure due to freezing of water that entered 

the conduit, allowing fuel leakage into the conduit and along the airplane front spar 

resulting in an engine tailpipe fire.

2. Float switch wire chaffing observed, which might have provided potential for 

subsequent electrical short to the conduit.

3. Float switch sealing failure has allowed fuel/water to egress into the switch, 

compromising switch operation in an explosive environment.

5.3.8 Fuel Tubes, Vent Tubes, Conduits, Hydraulic Lines.

1. Poorly conducting pipe couplings that may become electrical arc sources when 

exposed to electric currents.

2. Insufficient clearances between tubes and surrounding structure.

3. Intermittent electrical bonding in flexible couplers.

4. Bonded couplers unable to conduct expected power fault currents without arcing.

5.3.9 Electrical Generator Power Feeder Cables.

1. Arcing of electrical power feeder cables to a pressurized fuel line resulting in fire 

adjacent to the fuel tank.

2. Arcing of electrical power feeder cables to aluminum conduit resulting in molten 

metal dropping onto a pressurized fuel line causing leakage.

5.3.10 Bonding Straps.

1. Corrosion of bonding strap wires resulting in failure to provide required current 

paths.

2. Inappropriately attached connections (loose or improperly grounded attachment 

points).

3. Static bonds on fuel system plumbing connections inside the fuel tank worn due to 

mechanical wear of the plumbing from wing movement and corrosion.

4. Corrosion of bonding surfaces near fuel tank access panels that could diminish the 

effectiveness of bonding features.
mm/dd/yy D R A F T AC 25.981-1X

7

5. Aging of self-bonding fuel system plumbing connections resulting in higher 

resistance bonding.

6. Missing bonds.

7. Loose or intermittent contacts between bond straps and other conductive 

components.

5.3.11 Pneumatic System Failures.

Leakage of air from ducting located near fuel tanks due to duct failure resulting in 

undetected heating of tank surfaces above the auto-ignition temperature.

5.3.12 Electrostatic Charge.

1. Use of a non-conductive type of reticulated polyurethane foam in only a portion of a 

fuel tank system that allowed electrostatic charge build-up and arcing in the 

unprotected portion of the system.

2. Spraying of fuel through refueling nozzles located at the upper portion of the tank.

6 FUEL VAPOR IGNITION SOURCES.

6.1 There are four primary phenomena that can result in ignition of fuel vapors from within 

airplane fuel tanks:

 Electrical arcs and sparks,

 Filament heating,

 Friction sparks, and

 Hot surface ignition or auto-ignition.

6.1.1 The conditions required to ignite fuel vapors from these ignition sources vary with 

pressures and temperatures within the fuel tank and can be affected by sloshing or 

spraying of fuel in the tank. Due to the difficulty in predicting fuel tank flammability

and eliminating flammable vapors from the fuel tank, the regulatory authorities have 

always assumed that a flammable fuel air mixture may exist in airplane fuel tanks and 

have required that no ignition sources be present.

6.1.2 Any components located in or adjacent to a fuel tank must be designed and installed in 

such a manner that, during both normal and anticipated failure conditions, ignition of 

flammable fluid vapors will not occur. Compliance with this requirement is typically

shown by a combination of component testing and analysis. Testing of components to 

meet the appropriate level of explosion-proof requirements may be carried out for 

various single failures, and combinations of failures, to show that arcing, sparking, autoignition, hot surface ignition, or flame propagation from the component will not occur. 

Testing of components has been accomplished using several military standards and 

component qualification tests. For example, military standard MIL-STD-810, Method 

511, Procedure I and II, defines one method that has been accepted for demonstrating 
mm/dd/yy D R A F T AC 25.981-1X

8

that a component is explosion proof. Section 9 of RTCA Document DO-160F has also 

been accepted for demonstrating that airborne equipment is explosion proof.

6.2 Electrical Sparks and Electrical Arcs.

6.2.1 Laboratory testing has shown that the minimum ignition energy in an electrical spark 

required to ignite hydrocarbon fuel vapor is 200 microjoules1. Therefore, for electrical 

or electronic systems that introduce electrical energy into fuel tanks, such as FQIS, any 

electrical arcs or sparks that are created into any fuel tank should be less than 200 

microjoules during either normal operation or operation with failures.

Note: In the past some components have been qualified to standards that allow 320 

microjoules, but this level is not acceptable for showing intrinsic safety.

6.2.2 To ensure that the design has adequate reliability and acceptable maintenance intervals, 

a factor of safety should be applied to this value when establishing a design limit. Fuel 

tank systems should be designed to limit the allowable energy level to the lowest 

practical level. Systems with a maximum energy of 20 microjoules are considered 

technologically feasible. Normal systems operations at minimum ignition energies of up

to 50 microjoules would be acceptable. Under failure conditions, the system should not 

have an ignition energy that would exceed 200 microjoules.

6.3 Filament Heating Current Limit.

Analyses and testing indicate a small piece of steel wool will ignite a flammable 

mixture when a current of approximately 100 milliamperes (mA) root mean square 

(rms) is applied to the steel wool2. Therefore, for electrical or electronic systems that 

introduce electrical energy into fuel tanks, such as FQIS, the electrical current 

introduced into any fuel tank should be limited. Because there is considerable 

uncertainty associated with the level of current necessary to produce an ignition source 

from filament heating, a factor of safety should be applied to this value when 

establishing a design limit. A maximum of steady-state current of 25 mA rms is 

considered an intrinsically safe design limit for electronic and electrical systems that 

introduce electrical energy into fuel tanks. For failure conditions, limit the current to 

50 mA rms and induced transients to 125 mA peak current.

6.4 Friction Sparks.

Service experience has shown that pump inlet check valves, inducers, nuts, bolts, rivets, 

fasteners, lockwire, roll pins, cotter pins, drill chips, and manufacturing debris, etc., 

have been inducted into fuel pumps and contacted the impeller resulting in the 

possibility of metallic deposits on rotating and stationary components within the pump. 

 

1 The 200 microjoule level comes from various sources. The most quoted is Lewis and VonElbe, “Combustion, 

Flames and Explosions of Gases,” that has a set of curves for minimum ignition energy for the various hydrocarbon 

compounds in Jet fuel, and they all have similar minimum ignition energy levels of around220 microjoules.

2 This data was from testing performed by the FAA Technical Center, Report number DOT/FAA/AR-TN05/37. 

Applicants may conduct testing to substantiate alternate values.
mm/dd/yy D R A F T AC 25.981-1X

9

This condition has resulted in creation of friction sparks and should be an assumed 

failure condition when conducting the SSA. Fail-safe features as described in paragraph 

8.2.2 of this AC have been used to mitigate this hazard.

6.5 Hot Surface Ignition.

6.5.1 Maximum Surface Temperature.

Guidance provided in AC 25-8, as well as the original release of this AC, defines

surfaces that come within 50 degrees of the auto-ignition temperature of the fuel air 

mixture for the fluid as ignition sources. The FAA has historically accepted 400 °F for 

maximum surface temperatures inside fuel tanks for kerosene type fuels. (Maximum 

surface temperature considerations for areas outside the fuel tank are discussed in 

paragraph 8.3.6.3 of this AC.) For remote failure conditions of limited duration, it is 

acceptable to provide substantiation of actual hot-surface ignition temperatures (note 

that this is different from the auto-ignition temperature of the fuel), and demonstrate a 

50 °F margin below these temperatures.

6.5.2 Flammable Fluid Properties.

Fuels approved for use on transport category airplanes have differing flammability

characteristics. The auto-ignition temperature of JP-4, as determined by ASTM Test 

Method D286, is approximately 468 °F at one atmosphere of pressure. By this method 

of testing, under the same atmospheric conditions the auto-ignition temperature of JET 

A (kerosene) is approximately 435 to 450 °F, and of gasoline, approximately 800 °F. 

The auto-ignition temperature of these fuels varies inversely with the ambient pressure. 

In view of this, factors affecting the pressure in the fuel tank should be taken into 

consideration when determining compliance with § 25.981.

6.6 Fuel System Electrostatics.

Electrostatic charges are generated in liquid hydrocarbons when they are in motion with 

respect to another surface such as fueling hoses, filters, nozzles, fuel tank structure and 

aircraft plumbing. The references in paragraphs B.1.5.1 and B.1.5.2 of this AC provide 

information on this subject. During airplane refueling, jet fuel is loaded either from a 

tanker truck or from an airport hydrant system. Flowing fuel can generate an electrical 

charge especially through fuel filtration. The accumulation of charge in the fuel is a 

function of many factors. If the fuel conductivity is low, the relaxation time for 

dissipation of the electrical charge is long. As a consequence, the fuel may accumulate 

an electrical charge inside an aircraft fuel tank. This electrical charge may produce a 

high potential on the fuel surface and an electrical discharge to structure. This is 

particularly a concern when large unbonded objects are located inside an airplane fuel 

tank. Smaller components may also become charged and this should be addressed in the 

safety assessment. If the vapor space fuel/air mixture is in the flammable range, ignition 

of the mixture is possible, resulting in a fuel tank explosion and fire.

6.6.1 Charge accumulation is influenced by many factors. Without a static dissipator additive, 

typical Jet A fuel has a low electrical conductivity. A static dissipator additive will 

increase the charging rate of fuel but at the same time greatly improve the conductivity 
mm/dd/yy D R A F T AC 25.981-1X

10

of the fuel to rapidly dissipate the developed charge. Contaminants, considered as ionic 

impurities, enhance the charging tendency of the specific fuel. Fuels from different parts 

of the world and from different refineries will therefore have different charging 

tendencies based on the types of contaminants present. Fuel static dissipator additives 

will increase the charging rate of fuel but at the same time greatly improve the 

conductivity of the fuel to rapidly dissipate the developed charge. Water contamination, 

however, increases the charging tendency of the fuel without a corresponding increase 

in conductivity. The water interacts with the additives or the naturally occurring 

contaminants in the fuel to provide this pro-static effect. Recognizing the dangers of 

water contamination, the National Fire Protection Association (NFPA) also cautions 

that when refueling, care should be taken to not disturb the interface between the fuel 

remaining in the tank and the possible layer of water below it. Disruption of this 

interface up into the tank ullage/vapor space may lead to an electrical discharge capable 

of igniting a flammable fuel vapor/air mixture. Fuel tank inerting is one method of

precluding this ignition source. However, for transport airplanes, this phenomenon are

usually addressed by incorporating an active water removal scavenge system for the 

fuel tanks and periodically sumping the tanks to remove the collected water to minimize 

the existence of the fuel/water interface.

6.6.2 Methods of minimizing the magnitude of the developed charge have been developed 

and are in place on transport airplanes including:

6.6.2.1 The refuel plumbing is sized and includes an orifice to maintain maximum 

flow rates in accordance with the electrostatic guidelines established by

the NFPA and the ASTM; and

6.6.2.2 Flow velocities of 6 to 7 meters per second are considered acceptable after 

the discharge port is covered with fuel. The guidelines also indicate that 

the flow velocity should be held to less than 1 meter per second until the 

discharge port is covered with fuel. This criterion may be met by

incorporating multiple refueling discharge ports, lowering the flow 

velocity through the use of piccolo tubes that distribute the fuel at low 

velocities in the tank, and locating them at or near the bottom of the tank. 

Location of the refueling discharge at the bottom of the tank minimizes 

fuel spray, a contributor to static charge development, and provides for the 

ports to be covered by fuel reserves in main tanks and in the early stages 

of fuel flow as the refuel rate varies from 1 meter per second up to the full 

flow of 6 to 7 meters per second in normally emptied tanks.

Note: It may not be practical to develop a dual flow rate refueling system 

so limiting the refueling velocities to less than one meter per second 

through the use of multiple discharge points and piccolo tubes may be one 

way to address these design guidelines.

6.6.3 Methods of relaxing the charge have also been developed. Bonding straps are used on 

fuel components and plumbing lines to allow the charge to dissipate to the tank 

structure. During refueling, the airplane is bonded to the refueling vehicle with a 

separate bonding wire to provide an electrical path back to fuel filtration, which is the 
mm/dd/yy D R A F T AC 25.981-1X

11

principal electrostatic charge generator. A static dissipator fuel additive may also be 

used to increase fuel conductivity, to quickly dissipate the developed charge. However, 

the FAA does not require this type of additive, unless it is specified as part of the type 

design approval. Any limitations on use of an anti-static additive would need to meet 

the requirements of §§ 25.1521 and 25.1557.

6.6.4 Applications of the above methods and adherence to industry practices and guidelines 

on electrostatics should be identified for each airplane model. Airline operation and 

practices regarding airplane refueling should also be evaluated to verify that the 

procedures necessary for safe operation of the specific airplane model are in place and 

followed. Restrictions, if any, on refuel rates, fuel properties, and the requirement for 

fuel additives should be identified as CDCCLs.

6.6.5 Polyurethane reticulated foams used for ignition suppression within fuel tanks and other 

non-conducting objects may accumulate and retain charge. These items may have to be 

treated with antistatic additives to prevent charge accumulation.

7 DESIGN CONSIDERATIONS.

7.1 Accepted Design Practices for Minimizing Ignition Sources.

The number of components and systems inside airplane fuel tanks whose failure could 

result in an ignition source within the fuel tank should be minimized. For example:

7.1.1 Fiber Optics.

Wiring entering the tank for such purposes as temperature monitoring and fuel quantity

indication should be minimized. Use of new technology, such as fiber optics, may

provide a means of reducing or eliminating electrical powered components from inside 

the fuel tanks.

7.1.2 Routing of Pump Power Supply.

If practical, fuel pumps should be located such that electrical power for the pumps is 

routed outside the fuel tanks in such a manner that failures in the electrical power 

supply cannot create a hot spot inside the tank or arc into the fuel tank. While routing of 

the fuel pump power supply outside of the fuel tank, and away from the fuel tank walls, 

may eliminate the potential for arcing directly into the fuel tank or heating of tank 

surfaces, the failure analysis should consider the need for electrical circuit protective 

devices. For example, arcing at the pump electrical connector has resulted in 

uncontrolled fuel leakage, an ignition source, and an uncontrolled fire outside of the 

fuel tank. This failure mode as well as any pump electrical failures, such as failure of 

the pump wiring is routed inside metallic conduit inside the fuel tank, redundant 

protection means would be required to prevent an arc of the wiring to the conduit from 

penetrating into the fuel tank. A practical means to achieve this is to provide sleeving of 

the wiring and an independent means such as a GFI or AFCB. Providing multiple layers 

of sleeving alone would not be considered acceptable since wear could defeat the 

multiple layer protection.
mm/dd/yy D R A F T AC 25.981-1X

12

Note: Electromagnetic environment and induced transients that may damage the wiring 

or pump should be considered in the design of the pump wiring system and when 

showing compliance.

7.1.3 Location of the Pump Inlet.

Debris that may enter a fuel pump inlet can cause sparks inside the fuel tank. One 

means to address this ignition source has been to locate the pumps such that the pump 

inlet remains covered with fuel at any time the pump is operating within the airplane 

operating envelope. Another means has been preventing the propagation of any ignition 

from the pump into the fuel tank by use of flame arrestor technology. (The performance 

of the flame arrester should be validated by test to verify its effectiveness at stopping a 

flame front.) Any protective means including those shown below should be effective 

under pitch, roll attitudes, and negative G conditions anticipated to occur in service.

7.1.3.1 Main Feed Tanks.

Installation of baffles in tank structure and use of collector tanks that are 

continually filled with fuel using ejector pumps are methods that have 

proven successful at keeping the pump inlets and pump housings 

submerged in fuel.

7.1.3.2 Auxiliary Tanks.

For auxiliary tanks that use motor driven fuel pumps and that are routinely

emptied, accepted design practices include shutting off the motor driven 

pumps prior to uncovering the fuel pump inlet and installation of a flame 

arrestor in the scavenge pump inlet line, or scavenging the remaining fuel 

with ejector pumps. (Note that installation of features such as a flame 

arrestor in the fuel system would need to be shown to meet fuel system 

performance requirements in § 25.951.)

7.1.4 Wiring.

The following paragraphs on wiring represent acceptable approaches for dealing with 

wiring used in and near fuel tanks. For specific requirements and further guidance, the 

applicant should review the wiring installation and design requirements in the new 

Electrical Wiring Interconnect Systems (EWIS) rules, Amendment 25-123, and 

associated advisory circulars.

7.1.4.1 Intrinsically safe wiring.

All wiring that is intended to conduct intrinsically safe levels of electrical 

power into or through the fuel tanks should incorporate protective features 

that prevent exceeding the intrinsically safe levels discussed in paragraphs

6.2 and 6.3 of this AC. This wiring should also be protected from high 

intensity radiated fields (HIRF) induced transients. The following 

protective features could be used to support that objective:

7.1.4.1.1 Separation and shielding of the fuel tank wires from other airplane wiring 

and circuits, and interference, and
mm/dd/yy D R A F T AC 25.981-1X

13

7.1.4.1.2 Shielding for HIRF and other electromagnetic interference (EMI).

7.1.4.1.3 Installation of transient suppression devices, to preclude unwanted 

electrical energy from entering the tank.

7.1.4.2 Higher energy wiring, which includes all wiring that is not intrinsically

safe.

7.1.4.2.1 Wiring should not be routed through metallic conduit inside the fuel tank 

or adjacent to fuel tank surfaces such that damage, inappropriate 

maintenance, or other failure/wear conditions could result in arcing to the 

conduit or metallic tank surface and development of an ignition source in 

the fuel tank. If metallic or other conductive conduit materials are used, 

the single failure of electrical arcing of the wiring to the conduit, adjacent 

tank surfaces, or structure should be assumed to occur. In addition, circuit 

protective features or other features should be incorporated to preclude 

development of an ignition source in the fuel tank. Methods that may be 

used to address this foreseeable failure condition include the use of circuit 

protective features such as dual conduits, thick wall conduit, and/or fastacting AFCB or GFI circuit breakers.

7.1.4.2.2 Where electric wires are routed through metallic conduits installed in a 

fuel tank, high surface temperatures or arcing through the conduit wall can 

be created by short circuits. All wiring conducting levels of power that 

exceed intrinsically safe levels (e.g., fuel pump power supply) into or 

through a fuel tank should be evaluated assuming arcing to adjacent 

surfaces such as metallic conduits or wing surfaces, unless fail-safe 

protective features are provided. A critical electrical wiring condition 

might be one in which the insulation is worn, cracked, broken, or of low 

dielectric strength, allowing intermittent or constant arcing to occur 

without consuming enough power to cause the circuit protection device to 

open. Inspection of wiring from in-service airplanes has shown that 

greater than expected wear may occur on sleeving and wiring insulation 

due to movement of the wire within the conduit. Roughness of the conduit 

material and variations in vibration levels for each installation may

significantly increase wear. In addition, inspections have shown that 

protective sleeving has been missing, improperly installed, or the wrong 

sleeving material used, resulting in damage to the insulation. For these 

reasons, use of protective sleeving on wiring would not by itself be 

adequate for showing compliance. The design should be tolerant to these 

types of foreseeable failure or maintenance errors.

Note: AC 25-8 addresses the use of metallic conduit as an acceptable 

means for routing of electrical power within airplane auxiliary fuel tanks. 

As indicated above, these past practices would not meet the fail-safe 

requirements of § 25.981 for any fuel tank, unless additional fail-safe 

features were incorporated. Therefore, the more recent guidance in this 
mm/dd/yy D R A F T AC 25.981-1X

14

AC, and rulemaking in Amendment 25-102 supplements the guidance in 

AC 25-8.

7.1.4.3 Wire separation.

Wiring designs used on transport airplanes vary significantly between 

manufacturers and models; therefore, it is not possible to define a specific 

universal separation distance or the characteristics of physical barriers 

between wire bundles to protect critical wiring from damage. Separation 

requirements for wiring and other components of EWIS are contained in 

§ 25.1707, (the regulatory definition of an EWIS is provided in 

§ 25.1701). Advisory Circular 25.1701-1, Certification of Electrical 

Wiring Interconnetion Systems on Transport Category Airplanes, 

paragraph 5d, contains guidance on determining adequate separation 

distance between EWIS and between EWIS and airplane systems and 

structures. Even if § 25.1707 is not in the type certification basis of the 

airplane being modified, the guidance contained in the AC should still be 

applied, along with the guidance contained in this AC, when determining 

adequate separation distance. Intrinsically safe wiring for fuel tanks needs 

to be protected from induced currents caused by power system switching 

transients, or EMI due to close proximity to other airplane wiring. In 

addition, damage to wire insulation can result in unwanted electrical 

energy being transmitted into the fuel tank, if the damaged wire can come 

into contact with the conductor of another wire that is not intrinsically

safe. Of particular concern is the possibility of a wire bundle fire that 

exposes and breaks wires that are not intrinsically safe and also damages 

the insulation of intrinsically safe wiring that is in close physical 

proximity. The broken wires may still be energized and could contact 

conductors of the damaged intrinsically safe wire. If physical separation is 

used to protect intrinsically safe fuel system wiring from other wiring or to 

protect fuel tank walls from high power wiring, the minimum physical 

separation must be established by the applicant. The applicant should 

conduct an analysis to verify that current and energies greater than those 

specified in paragraphs 6.2 and 6.3 of this AC will not be applied to 

intrinsically safe wiring, considering the factors listed below. The 

following is based on the guidance contained in paragraphs 5d(3) and (4) 

of AC 25.1701-1.

7.1.4.3.1 The electrical characteristics, power, and criticality of the signals in the 

wire bundle and adjacent wire bundles,

7.1.4.3.2 Installation design features including the number, type, fire resistance and 

location of support devices along the wire path of the intrinsically safe 

wire and adjacent higher power wires,

7.1.4.3.3 The maximum amount of slack wire resulting from wire bundle build

tolerances and other wire bundle manufacturing variations,
mm/dd/yy D R A F T AC 25.981-1X

15

7.1.4.3.4 Probable variations in the installation of the intrinsically safe fuel system 

wiring and adjacent wiring, including the position or omission of wire 

support devices and the amount of slack wire that is possible,

7.1.4.3.5 Expected operating environment including the amount of deflection or 

relative movement that can occur and the effect of a failure of a wire 

support device, or a broken wire, or other methods used to maintain 

physical separation,

7.1.4.3.6 The effects of wire bundle fires,

7.1.4.3.7 Maintenance practices as defined by the airplane manufacturer’s standard 

wiring practices manual and the ICA required by §§ 25.1529, 25.1729, 

26.11(b), and 26.11(c) as applicable, and

7.1.4.3.8 Possible EMI or HIRF effects.

Note: Some areas of an airplane may have localized areas where 

maintaining the minimum physical separation distance is not feasible. This 

is especially true in smaller transport category airplanes. In those cases, 

other means of ensuring equivalent minimum physical separation may be 

acceptable, if testing or analysis demonstrates that safe operation of the 

airplane is not jeopardized. The testing or analysis program should be 

conservative and consider the worst possible condition not shown to be 

extremely improbable. The applicant should substantiate to the aircraft 

certification office that the means to achieve the necessary separation 

provides the necessary level of protection for wire related failures. EMI

protection must also be verified.

7.1.4.4 Inspection.

Means should be provided to allow for the visual inspection of the wiring, 

physical barriers and other physical means of protection. Non-destructive 

inspection aids may be used where it is impracticable to provide for direct 

visual inspection if it is shown that the inspection is effective and the 

inspection procedures are specified in the maintenance manual required by 

§§ 25.1529, 25.1729, 26.11(b), and 26.11(c).

7.1.4.5 Identification.

Means must also be provided so EWIS wires are readily identified and 

visible to maintenance, repair, or alteration personnel. The method of 

identification must remain legible throughout the airplane’s operational 

life. The complete regulatory requirements for EWIS identification are 

contained in § 25.1711.

7.1.4.6 Circuit breakers.

Service experience has indicated that thermal mechanical circuit breakers 

installed in the fuel pump circuits have not been shown to preclude arcing 
mm/dd/yy D R A F T AC 25.981-1X

16

of electrical wiring through metallic barriers such as conduit, fuel pump 

housings, electrical connectors, or the tank wall into the fuel tank on some 

airplane designs. Evidence suggests that arcing from the wiring to metallic 

surfaces may not result in a hard short, which would trip the circuit 

breaker and may result in intermittent low level arcing that gradually arcs 

through the metallic barrier into the fuel tank. For these failure conditions 

circuit protective devices such as AFCB or GFI may be needed to provide 

fail safe features necessary to demonstrate compliance. Appendix A to this 

AC provides guidance for certification of AFCB or GFI.

7.1.4.7 Use of nonmetallic conduit.

If nonmetallic conduit is used, compatibility with fuel should be 

demonstrated. The nonmetallic conduit should be evaluated for the effects 

of aging due to heat, corrosion at the connecting fittings, and resistance to 

heat damage from internal shorts of wires routed within the conduit.

7.1.4.8 Wire splices.

Splices in fuel system wiring have been allowed as a standard repair 

procedure. The acceptability of splices will be based upon the system 

design and fail-safe features. The safety assessment may show that splices 

in fuel tank system wiring, such as fuel quantity indicating wiring within 

the fuel tank and fuel pump windings, are prohibited. This would be 

defined as a CDCCL.

7.1.4.9 Use of silver in fuel tanks.

Silver can combine with sulfur or water and form silver-sulfide or oxide 

deposits between exposed conductors (terminal block connections, etc.). 

The silver-sulfide deposits reduce the resistance between conductors and 

can ignite fuel vapor when exposed to very low levels of electrical energy. 

If use of silver in electrical components and wiring in the tank is 

determined to be critical, it should be defined as a CDCCL. The energy

levels that have been shown to ignite fuel vapor during laboratory tests 

approach the levels normally used on FQIS wires and probes. This issue 

must be carefully addressed.

7.1.4.10 Use of steel wool.

Steel wool has been used as a cleaning tool to remove corrosion and clean 

parts inside the fuel tanks. Steel wool creates small conductive filaments

that can cause ignition sources in the fuel tank if the steel wool comes in 

contact between conductors in fuel tank quantity gauging system 

components. For this reason design approval holders typically do not 

allow the use of steel wool inside fuel tanks and recommend using other 

abrasives. (However, as stated in paragraph 8.3.4 in this AC, the presence 

of conductive debris, such as steel wool, should be assumed when 

performing the fuel tank ignition prevention analysis.)
mm/dd/yy D R A F T AC 25.981-1X

17

8 SAFETY ANALYSIS.

8.1 Ignition Source Failure Analysis.

Compliance with § 25.981 requires each applicant to develop a failure analysis for the 

fuel tank installation to substantiate that ignition sources will not be present in the fuel 

tanks. The requirements of this section are in addition to the more general propulsion 

failure analyses requirements of §§ 25.901 and 25.1309 that have been applied to 

propulsion installations.

8.1.1 Section 25.981(a)(3) defines three failure scenarios that must be addressed in order to 

show compliance with the rule:

8.1.1.1 Each single failure, regardless of the probability of occurrence of the 

failure, must not cause an ignition source.

8.1.1.2 Each single failure, regardless of the probability of occurrence, in 

combination with any latent failure condition not shown to be at least 

extremely remote (i.e., not shown to be extremely remote or extremely 

improbable), must not cause an ignition source.

8.1.1.3 All combinations of failures not shown to be extremely improbable must 

not cause an ignition source.

8.1.2 Compliance with § 25.981 (Amendment 25-102) requires analysis of the airplane fuel 

tank system using analytical methods and documentation currently used by the aviation 

industry in demonstrating compliance with §§ 25.901 and 25.1309 with consideration of 

unique requirements included in the amendment.

8.1.3 SAE document ARP 4761, System Design and Analysis, describes methods for 

completing an SSA. An assessment may range from a simple report that offers

descriptive details associated with a failure condition, interprets test results, compares 

two similar systems, or offers other qualitative information, to a detailed failure analysis 

that may include estimated numerical probabilities. The depth and scope of an 

acceptable SSA depend upon:

8.1.3.1 The complexity and criticality of the functions performed by the system 

under consideration;

8.1.3.2 The severity of related failure conditions;

8.1.3.3 The uniqueness of the design and extent of relevant service experience;

8.1.3.4 The number and complexity of the identified causal failure scenarios; and

8.1.3.5 The detectability of contributing failures.

Note: Sections 25.981 and 25.901 are intended to address system failures 

that may result in the presence of an ignition source in the fuel tanks. 
mm/dd/yy D R A F T AC 25.981-1X

18

These regulations are not intended to address failures or conditions that 

could lead to ignition of fuel vapors from such sources as:

 Uncontained engine debris;

 External engine fires following engine separation or failure;

 Damage resulting from explosive materials, such as bombs;

 Post-crash fire heating of tank surfaces; or

 Propagation of fire through the airplane vent system into the fuel 

tanks.

8.1.4 These hazards are addressed by other regulations.

8.2 Qualitative Safety Assessment.

8.2.1 Typical airplane fuel tank systems have a limited number of possible ignition sources. 

Figure 1 shows some causes of ignition sources and methods that may be used to meet 

the fail-safe requirements. The level of analysis required to show that ignition sources 

will not develop will depend upon the specific design features of the fuel tank system 

being evaluated. Detailed quantitative analysis should not be necessary if a qualitative 

safety assessment shows that features incorporated into the fuel tank system design 

protect against the development of ignition sources within the fuel tank system. For 

example, if intrinsically safe FQIS wiring entering the fuel tanks and the associated line 

replacement unit (LRU) were shown to have protective features such as separation 

(including circuit separation in the LRU) and shielding and/or transient 

suppression/energy limiting devices, the portion of the compliance demonstration for 

the associated wiring would be limited to demonstrating the effectiveness of the features 

and defining any long-term maintenance requirements including mandatory replacement 

time, inspection interval, related inspection procedure, or CDCCL so that the protective 

features are not degraded.

8.2.2 Another example would be installation of a flame arrestor in the inlet line to a fuel 

pump. The compliance demonstration for the fuel pump may be limited to showing that 

the arrestor was effective at precluding propagation of the flame from the pump back 

down the inlet line into the tank, and showing that any anticipated failures or events 

could not violate the explosion-proof features of the pump assembly. In addition, 

revalidation of the fuel system to other regulations (e.g., icing and reduced flow due to 

contamination) would be required if modifications were incorporated into the fuel feed 

system. It may also be possible to show that fuel pumps installed such that the fuel 

pump inlet remains covered whenever the fuel pump is operating throughout the 

airplane operating envelope (as discussed earlier), including anticipated low fuel 

operations and ground conditions, would be a satisfactory method of meeting the failsafe requirement for the failure mode of arcing into the tank ullage (consideration of 

other failure modes, such as the effects of electrical arcing external to the fuel tank, at 

the connectors, etc., would need to be addressed). The SSA criteria, process, analysis 

methods, validation, and documentation should be consistent with the guidance material 
mm/dd/yy D R A F T AC 25.981-1X

19

provided in SAE document ARP 4761, utilizing the unique guidance specific to the fuel 

tank system as defined in this AC.

Figure 1: Examples of Fuel Tank Ignition Source Considerations

8.3 Assumptions and Considerations for Fuel Tank System Analysis.

The analysis should be conducted based upon the following assumptions:

8.3.1 Fuel Tank Flammability.

The analysis should assume that the environment inside the fuel tank is always 

flammable. The conditions required to ignite fuel vapors from ignition sources vary

with pressures and temperatures within the fuel tank and can be affected by sloshing or 

spraying of fuel in the tank. Due to the difficulty in predicting fuel tank flammability, 

the FAA has always assumed that a flammable fuel air mixture exists in airplane fuel 

tanks and has required that no ignition sources be present. The system safety analysis 

should be prepared considering all airplane in-flight, ground, service, and maintenance 

conditions, assuming that an explosive fuel air mixture is present in the vapor space of 

fuel tanks and vent systems at all times, unless the fuel tank has features that mitigate 

the effects of tank ignition (e.g., polyurethane foam).

8.3.2 Failure Condition Classification.

Unless design features are incorporated that mitigate the hazards resulting from a fuel 

tank ignition event (e.g., polyurethane foam, adequate structural margin), the SSA 

should assume that the presence of an ignition source is a catastrophic failure condition.
mm/dd/yy D R A F T AC 25.981-1X

20

8.3.3 Latent Failures.

8.3.3.1 In order to eliminate any ambiguity as to the restrictions on latent failures,

§ 25.981(a)(3) explicitly requires that any anticipated latent failure 

condition not leave the airplane one failure away from a catastrophic fuel 

tank ignition. In addition to this § 25.981(a)(3) limitation on latency, 

§ 25.1309(c) limits latent failure conditions to those that do not create an 

“unsafe system operating condition.” Consequently, if a latent failure 

condition is not extremely remote (i.e., it is anticipated to occur) and it 

creates an “unsafe system operating condition,” then “warning information 

must be provided to alert the crew...and to enable them to take appropriate 

corrective action.” These applicable regulatory restrictions on latency

notwithstanding, there are practical limitations on the available means of 

compliance. For example, detecting a failure condition requires a finite 

period of time and there are not always “appropriate corrective actions” 

that can be taken during the flight. Consequently, for the purposes of 

compliance with § 25.981(a)(3), the period of latency for any anticipated 

significant latent failure condition should be minimized and not allowed to 

exceed one flight cycle. For the purposes of § 25.1309(c) compliance, any 

time the airplane is operating one failure away from a catastrophic fuel 

tank ignition should be considered an “unsafe system operating 

condition,” recognizing that sometimes the only “appropriate corrective 

action when problem detection is available is to continue on to your 

destination but not to initiate another flight without making appropriate 

repairs.”

8.3.3.2 Another practical limitation on the available means of compliance is the 

technological feasibility of providing inherent failure detection within the 

design for all significant failures. Sometimes periodic inspection is the 

only practicable means of reliably detecting a failure condition. 

Consequently, when such inspections are identified within the analysis as 

the means of detection, the inspection method and frequency must be 

sufficient to conclude that the occurrence of the significant latent failure 

condition is extremely remote.

8.3.3.3 Any mandatory replacement time, inspection interval, related inspection 

procedure, and all CDCCLs identified to prevent development of ignition 

sources within the fuel tank system should be identified in the 

Airworthiness Limitations section of the ICA as a fuel system limitation.

If this means is used, the Airworthiness Limitations section should include 

the following:

8.3.3.3.1 A designation of the maintenance actions and alterations that must be 

inspected (critical inspections), including at least those that could result in 

a failure, malfunction, or defect endangering the safe operation of the 

aircraft, if not performed properly or if improper parts or materials are 

used.
mm/dd/yy D R A F T AC 25.981-1X

21

Note: A validation inspection should be conducted to reaffirm all or a 

portion of the initial inspection requirements for those critical inspections 

that, if not performed properly or if improper parts or material are used, 

could result in a failure, malfunction, or defect endangering the safe 

operation of the airplane. For those air carriers that use a mechanic for the 

initial inspection, an inspector should be used to conduct the validation 

inspection. For those air carriers that use an inspector for the initial 

inspection, another qualified inspector should be used to conduct the 

validation inspection.

8.3.3.3.2 Procedures, standards, and limits necessary for critical inspections and 

acceptance or rejection of the items required to be inspected, and for 

periodic inspection and calibration of precision tools, measuring devices, 

and test equipment.

8.3.4 Failure Conditions.

When showing compliance with § 25.981(a)(3), the effects of manufacturing variability, 

aging, wear, corrosion, and likely damage must be considered. For the purpose of 

compliance with § 25.981, “extremely remote” failure conditions are those not 

anticipated to occur to each airplane during its total life, but which may occur a few 

times when considering the total operational life of all airplanes of one type. This 

definition is consistent with that developed by the Aviation Rulemaking Advisory

Committee (ARAC) for a revision to FAA AC 25.1309-1A. “Extremely improbable” 

failure conditions are those so unlikely that they are not anticipated to occur during the 

entire operational life of all airplanes of one type. This definition is consistent with the 

definition provided in AC 25.1309-1A. Likely damage is damage that, using 

engineering judgment or past experience, would lead one to conclude that an occurrence 

is foreseeable. Examples of likely damage are: a wire bundle located where a mechanic 

could use it as a hand hold; an instrument located where, if someone dropped a wrench, 

damage would result; or a fuel probe located where a mechanic could use it as a step in 

the tank, etc.

8.3.4.1 The analysis should be conducted considering the deficiencies and 

anomalies listed in paragraph 5.3 of this AC, failure modes identified by

the review of service information (including review of supplier service 

data), and any other failure modes identified by the functional hazard 

assessment of the fuel tank system. For example, the presence of 

conductive debris such as lockwire, steel wool, nuts, bolts, rivets etc., 

should be assumed. Section 25.981 specifically requires that the effects of 

manufacturing variability, aging, wear, corrosion, and likely damage must 

be considered when demonstrating compliance. Credit for fail-safe 

features must be substantiated.

8.3.4.2 The level of manufacturing variability, aging, wear, corrosion, and likely 

damage that must be considered should be determined based upon 

evaluation of the detectability of degraded or out-of-specification 

configurations, and established and documented within the analysis. In-
mm/dd/yy D R A F T AC 25.981-1X

22

service and production functional tests, component acceptance tests, and 

maintenance checks may be used to substantiate the degree to which these 

states must be considered. For example, inspection of fuel tank system 

bonding on production airplanes has shown that some bonds were 

inadequate. Functional testing of all bonding was incorporated to address 

this deficiency. In some cases (e.g., component bonding or ground paths), 

a degraded state will not be detectable without periodic functional test of 

the feature. For these features, inspection/test intervals should be 

established based on previous service experience on equipment installed in 

the same environment. If previous experience on similar or identical 

components is not available, conservative initial inspection/test intervals 

should be established until design maturity can be assured.

8.3.5 External Environment.

The severity of the external environmental conditions that should be considered when 

demonstrating compliance with § 25.981 are those established by certification 

regulations and advisory.

8.3.6 External Sources of Tank Auto-ignition.

The possibility of fuel tank ignition due to surface-ignition sources created by external 

tank heating should be considered. This includes heating of the tank due to operation or 

failure of systems outside the tank within both the pressurized and unpressurized areas 

of the airplane, such as overloaded electric motors or transformers, failures in the 

pneumatic system and/or ducting that could cause localized heating of tank surfaces. In 

addition, the possibility of localized heating due to external fires must be considered.

8.3.6.1 Section 25.967(e) requires that, “Each fuel tank must be isolated from 

personnel compartments by a fume proof and fuel proof enclosure.” 

Leakage of fuel or vapor into spaces adjacent to the fuel tank, where a 

secondary fuel and fume-proof barrier is not provided, has typically been 

assumed for areas such as:

 The wing leading (including any adjacent compartment such as the 

strut) and trailing edges,

 Fairings located below the fuel tanks,

 Fuel pump enclosures, and

 Unpressurized areas of the fuselage surrounding fuel tanks located in 

the empennage.

8.3.6.1.1 Components located in these areas have been required to meet explosionproof requirements. These components or systems must be included in the 

analysis. Examples of equipment include, but are not limited to, 

environmental control system (ECS) air conditioning packs, motors, 

power assisted valves, fuel pumps, hydraulic pumps/motors, certain flight 

control actuators, ECS controls, wiring and valves.
mm/dd/yy D R A F T AC 25.981-1X

23

8.3.6.2 A safety review of flammable fluid leakage zones adjacent to fuel tanks 

will be needed to determine that the design complies with the 

requirements of §§ 25.863(a) and 25.981. In general, the fire protection 

philosophy for any area considered a flammable fluid leakage zone is to 

assume that flammable vapors may be present in the zone and to minimize 

the probability of ignition of vapors (§ 25.863(a)). This has typically been 

accomplished by using combinations of the following design 

considerations:

 Grounding and bonding of electrical equipment,

 Qualification of electrical equipment as explosion proof,

 Sealing of electrical connectors,

 Proper support, protection and separation of wiring,

 Drainage provisions in the leakage zone,

 Ventilation of the leakage zone in-flight, and areas around auxiliary

tanks, and

 Immediate maintenance action to correct running leaks in these areas.

8.3.6.3 Surface temperatures in areas adjacent to fuel tanks.

The FAA has approved installations, where surfaces adjacent to the tank 

experience temperatures in excess of the internal fuel tank surface 

temperature limit. Manufacturers have substantiated that the conditions 

(ambient pressure, dwell time, fuel type, etc.) within these areas are such 

that a higher value may be used. For example, a maximum allowable 

surface temperature of 400 °F, with a transient excursion up to 500 °F for 

a maximum duration of two minutes, has been accepted for certain 

pneumatic system installations. The excursion above 400 °F occurs only 

during failure conditions such as failure of the engine pneumatic system to 

regulate temperature, or duct rupture. Approval of these elevated 

temperatures has been based on compensating design features, such as an 

over-temperature shutoff of the pneumatic system so that the surface 

temperatures adjacent to the tank cannot exceed the surface ignition

temperature justified for the fluid type including the effect of local airflow 

and ventilation conditions within the zone, e.g., the 500 °F value. Internal 

tank surface temperatures resulting from the failure should not exceed the 

surface temperature limit for the fuel type used as described in paragraph 

6.5 of this AC.

8.3.7 Electrical Ignition Sources.

The applicant should perform a failure analysis of all fuel systems and subsystems with 

wiring routed into fuel tanks. Systems that should be considered include fuel pump 

power and control and indication, fuel quantity indication, fuel temperature indication, 

fuel level sensors, and any other wiring routed into or adjacent to fuel tanks. The 

analysis should consider system level failures, failures within LRUs and component 
mm/dd/yy D R A F T AC 25.981-1X

24

level failures discussed below. The analysis should include existence of latent failures 

and subsequent failures that may lead to an ignition source within the fuel tank. 

Examples include undetected failures of tank components or wiring, the undetected 

presence of conductive debris, damage to FQIS or level sensor probes, or corrosion, in 

combination with external failures such as hot shorts or EMI. In addition, the applicant 

should provide a description of the protective means employed in the fuel system 

wiring. This should include a description of features such as separation/segregation, 

transient suppression devices, shielding of wiring, and methods employed to maintain 

configuration control of critical wiring throughout the life of the airplane.

8.3.8 Electrical Short-Circuits.

8.3.8.1 One method that may provide protection of circuits that enter fuel tanks is 

the incorporation of a transient suppression device (TSD) on the circuit 

close to the point where those wires enter fuel tanks. Consideration should 

also be given to protection of wiring between the TSDs and the tank if the 

protection devices are not located at the tank entrance, and also to the 

possibility of transients being induced in the wiring between the TSDs and 

the electrical devices in the fuel tanks. Caution should be exercised when 

using TSDs to be sure that the TSD addresses both voltage and current 

suppression.

8.3.8.2 Another method of protection that has been used to provide a fail-safe 

design with respect to electrical shorts is separation of wiring to electrical 

devices in the fuel tanks from other electrical power wires and circuits, 

combined with shielding between wiring that enters fuel tanks and any 

other electrical power-carrying wires in the aircraft installation. The

effects of electrical short circuits, including hot shorts, on equipment and 

wiring that enters the fuel tanks should be considered, particularly for the 

FQIS wiring, fuel level sensors, and probes. Latent failures from factors 

such as contamination, damage/pinching of wires during installation, or 

corrosion on the probes, connectors, or wiring should be considered when 

evaluating the effects of short circuits. The wire routing, shielding, and 

segregation outside the fuel tanks, including within the FQIS components

(e.g., gauging units), should also be considered when evaluating the 

effects of short circuits. The evaluation should consider both electrical 

arcing and localized heating that may result from short circuits on 

equipment, FQIS probes, and wiring. The evaluation of electrical short 

circuits should include consideration of shorts within electrical equipment, 

and wiring from the equipment into the fuel tank. Prevention of fuel 

ignition from electrical shorts to wiring that enters fuel tanks may require 

specific wire and circuit separation and wire bundle shielding.

8.3.9 LRU Design Evaluation.

The design review should include evaluation of the separation and/or protective features 

incorporated into any fuel system LRU whose failure could result in high level 

electrical power (above intrinsically safe levels) entering the fuel tank. For example, 
mm/dd/yy D R A F T AC 25.981-1X

25

circuit board failures could cause the fuel quantity gauging system LRU power supply 

circuits to come into contact with circuits that lead into the fuel tank, resulting in a 

possible ignition source. Failures that can lead to violating separation within the LRU 

can be external and internal events. External failures include over voltage or over 

current, high humidity, temperature, vibration, shock, and contamination. Internal 

failures include manufacturing defects or flaws in the conductor, substrate or coating. 

To address these failures isolation and physical separation between critical signals 

should be provided, or adequate protective features, such as transient suppression 

devices as discussed earlier, should be provided to protect the circuits that enter the fuel 

tank. Any LRU that meets the design requirements identified in reference (3), paragraph

B.1.5.2 of this AC, Underwriters Laboratories Inc., UL 913, Intrinsically Safe 

Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous 

(Classified) Locations, is considered acceptable, provided the following issues are 

addressed. Ideally, higher power circuits within the LRU should not be located on the 

same circuit board or in a wire harness or electrical connector with intrinsically safe 

circuits or wiring. There should be a physical barrier between circuit boards to isolate 

the intrinsically safe circuits from the effects of broken components or fire within the 

LRU. If limiting devices are installed on the same circuit board in series with system 

circuitry to limit the amount of power or current transmitted to the fuel tank, there 

should be three inches between the traces, unless the manufacturer can justify a smaller 

separation on the basis that the effects of fire on the circuit board will not compromise 

the intrinsically safe circuit(s).

8.3.10 Electromagnetic Effects including EMI and HIRF.

Refer to AC 25.954-X for guidance in establishing compliance to requirements for fuel 

system protection from lightning effects.

8.3.10.1 The effects of EMI or HIRF on anything conductive (e.g., fuel tank 

plumbing, structure, fuel, equipment and wiring) within the fuel tanks 

should be considered, particularly for the FQIS wiring and probes. Latent 

failures from factors such as contamination, damage, or corrosion on the 

probes or wiring should be considered when evaluating the effects of 

electrical transients. The wire routing, shielding, and segregation of 

conductors (e.g., plumbing, component casings, wiring, etc.) outside the 

fuel tanks should also be considered when evaluating the effects of 

electrical transients, because the transient generation and coupling to 

conductors may occur outside the fuel tanks. The evaluation should 

consider both electrical sparks and arcs and localized heating that may

result from EMI and HIRF on the fuel tank system, FQIS probes, and 

wiring.

8.3.10.2 Latent failure of electromagnetic protection features, such as shielding 

termination corrosion, shield damage, and transient limiting device failure 

should be considered and appropriate indication or inspection intervals 

established to prevent the existence of latent failure conditions. The failure 

of other system components may also affect protection against EMI. 
mm/dd/yy D R A F T AC 25.981-1X

26

Consequently, the effect of any anticipated failure on the continued 

environmental protection should be considered.

8.3.10.3 The evaluation of electromagnetic effects from EMI or HIRF should be 

based on the specific electromagnetic environment of a particular aircraft 

model. Standardized tests, such as those in RTCA DO-160, Sections 19, 

20, and 22, are not sufficient alone, without evaluation of the 

characteristics of the specific electromagnetic environment and induced 

transient levels assigned to systems installed within a particular airplane 

model, to show that appropriate standardized RTCA document DO-160 

test categories, procedures and test levels are selected. Simulation of 

various latent failures of fuel system components within the tanks may be 

required to demonstrate the transient protection effectiveness. 

Effectiveness of the transient protection features should be verified using 

the appropriate RTCA document DO-160 test procedures and test levels 

determined above.

8.3.10.4 Prevention of fuel ignition due to EMI or HIRF may require specific wire 

segregation and separation, wire bundle shielding, or transient suppression 

for wires entering fuel tanks. Effectiveness of the transient protection 

features should be verified using the appropriate RTCA document DO-160 

test procedures and test levels determined above.

8.3.10.5 Redundancy of bond paths.

Failure of bonding jumpers is generally considered a latent failure, since 

there is no annunciation or indication of the bonding failure. The airplane 

fleet fuel tank inspections that occurred as a result of the TWA 800

investigation showed that failure of bonding jumpers, due to damage, 

wear, or manufacturing errors, was not unusual. Based on this, it would be 

difficult to show that failure of a single bonding jumper is extremely

remote or extremely improbable. Therefore, the electrical bonding jumper 

or other bonding provisions would need to consider the consequences of 

these latent failures. This may result in designs that incorporate electrical 

bonding redundancy, if the failure of a single electrical bonding feature 

could create a fuel ignition source. Additionally, manufacturers would 

need to consider the use of appropriate maintenance to detect failed 

bonding jumpers. An example of such maintenance might include periodic 

inspections to limit latency.

8.3.10.6 Self-bonding couplers.

Early generation self-bonding flexible fuel couplers did not have multiple 

bonding paths. Thus these bonding couplers exhibited single-point failures 

which caused loss of function. These self-bonding flex couplers have 

failed because of missing bonding springs, anodizing on bonding surfaces, 

and incorrect installation. The safety assessment of newer designs 

incorporating multiple bonding paths must consider these failure modes 
mm/dd/yy D R A F T AC 25.981-1X

27

and qualification testing should show no ignition sources are present in the 

full up and possible degraded condition with failure modes present within 

the couplings. For example, failure assessments of clam shell type selfbonding metallic couplings in composite fuel tanks have shown arcing 

could occur if a coupling was improperly latched, or became unlatched 

and fell to the bottom of the fuel tank. The design of the coupling would 

need to address these failure modes. Improper latching could be addressed 

through positive latching features with tactile and visual indication that the 

coupling is properly latched. Redundant fail safe features such as dual 

hinge pins, dual latching features, redundant bonding features, etc., would 

be needed to address other possible failure modes.

8.3.10.7 Resistance or impedance limits of airplane electrical bonding provisions.

8.3.10.7.1 There is no specific FAA guidance on maximum resistance or impedance 

of airplane electrical bonding provisions. Electrical bonding within a fuel 

system should be tailored to the performance requirements of a particular 

airplane design. The electrical bonding should consider the electrical 

sources, such as electrical faults, fuel static electrification. The electrical 

bonding should also consider the specific airplane fuel system design, 

which would include the structure material used (aluminum, carbon fiber 

composites, fiberglass composites, etc.), the configuration of the fuel 

system (routing of fuel tubes, wires, and hydraulic tubes), and the 

electrical bonding concept (intentional isolation, self-bonding fittings, 

separate bonding jumpers, etc.). Given the large variation in design 

approaches, and the close relationship between the design approach and 

the electrical bonding requirements, it is not practical for the FAA to 

provide specific guidance on maximum bonding resistance or impedance.

8.3.10.7.2 Some airplane TC holders have performed tests on their airplanes to 

determine the specific requirements for electrical bonding. Others, in the 

absence of specific airplane test data, have chosen conservative electrical 

bonding approaches. The approach is a decision each TC holder should 

make based on the specific situation for that TC holder's airplane models.

8.3.10.8 Bonding integrity checks.

Past experience has shown measurement of bond resistance is the desired 

method of assuring bond path integrity. During bonding resistance 

measurements, damage of protective finish of components may be caused 

in order to penetrate the insulating anodized surface layer, which may lead 

to subsequent corrosion damage. This concern has resulted in some TC 

holders defining non-intrusive inspections for electrical bonding. These 

inspections may include detailed visual inspections, if the quality of the 

electrical bonding feature can be adequately assessed by visual cues, such 

as visible corrosion, breakage, tightness or missing bonding provisions. 

For critical bonds this method would not by itself be adequate. Other 

inspection methods include inductively-coupled loop resistance 
mm/dd/yy D R A F T AC 25.981-1X

28

measurements that eliminate the need to disconnect bonding jumpers or to 

penetrate corrosion-prevention coatings. The need for bonding 

inspections, the frequency of the inspections, and the determination as to 

whether the inspections must be an ALI, should established as a result of 

the fuel tank SSA.

8.3.10.9 Bond Corrosion and Integrity.

8.3.10.9.1 Degradation of electrical bonding provisions, such as bonding jumpers, 

has occurred on in service airplanes. Results from airplane fuel tank 

inspections conducted on a sample of airplanes by manufacturers and 

operators showed discoloration, corrosion, and damage to bonding 

jumpers. It is not clear if the discoloration indicates corrosion that will 

become more severe with time, or is simply a surface color change. The 

applicant must define CDCCLs and the bonding feature characteristics, 

such as visible corrosion, discoloration, jumper strand separation, and 

jumper strand breakage that will be used to distinguish discrepant bonding 

provisions.

8.3.10.9.2 The level of corrosion observed on bonding features, specifically on 

bonding jumpers, varied greatly across airplane fleets. While some 

airplanes within a fleet and certain locations within the fuel tanks showed 

no evidence of corrosion, other airplanes and locations exhibited higher 

levels of corrosion. Inspection results reported to the FAA indicate 

materials used in certain bonding jumpers (tin plated copper) may be more 

prone to corrosion. Nickel plated copper wire does not experience similar 

corrosion. Corrosion programs for airplane structure have long recognized 

the variability of corrosion within the fleet. Factors that influence the level 

of corrosion of bonding jumpers include fuel type (sulfur content, etc.), 

presence of water in the fuel tank, installation effects such as cracking of 

the tin plating when the jumper is installed, temperature, humidity, and 

chemicals used for preparation of the fuel tanks prior to airplane storage, 

etc. While certain levels of corrosion or discoloration may be acceptable 

between inspection intervals, demonstration of compliance should include 

substantiation that the materials used in the bonding jumpers are 

appropriate for use in the fuel tanks in consideration of proposed 

inspection intervals. This substantiation should consider the variability in 

corrosive environments and factors noted above that may exist on inservice and storage of airplanes in the fleet.

8.3.10.10 Definition of major component.

There is no specific FAA guidance on “major components” in 

§ 25.901(b)(4). However, the term “major components,” as specified in 

§ 25.901(b)(4) should not be used to limit the review of fuel system 

ignition sources as required in § 25.981. Section 25.981, Fuel tank ignition 

prevention, states: “(a) No ignition source may be present at each point in 

the fuel tank or fuel tank system where catastrophic failure could occur 
mm/dd/yy D R A F T AC 25.981-1X

29

due to ignition of fuel or vapors.” This stipulation is in addition to the

provisions regarding major components in § 25.901(b)(4). For example, 

fuel tube flexible coupling and components as small as nuts, bolts and 

washers may develop sufficient charge to cause arcing due to electrostatics 

conditions if not properly accounted for in the design. Electrical bonding 

would need to be considered if these couplings are identified as ignition 

sources during the ignition source evaluation and assessment.

8.3.11 Friction Sparks.

The failure modes and effects analysis (FMEA) should include evaluation of the effects 

of debris entering the fuel pumps, including any debris that could be generated 

internally, such as any components upstream of the pump inlet. Industry fuel tank 

cleanliness practices and design features intended to preclude debris entering the fuel 

pumps have not been effective at eliminating debris. Service experience has shown that 

pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, sealant, lockwire, etc. 

have been inducted into fuel pumps and contacted the impeller. This condition could 

result in creation of friction sparks and should be an assumed failure condition when 

conducting the SSA. Fail-safe features should be incorporated into the fuel pump design 

to address this condition. Examples of means that may be incorporated into the fuel 

pump design to address this concern include:

 Installation of inlet flame arrestors,

 Use of reticulated foam,

 Use/installation of jet fuel pumps without impellers to scavenge fuel, or

 Maintaining fuel over the pump inlet throughout the airplane flight attitude 

envelope.

9 COMPONENT QUALIFICATION CONSIDERATIONS.

9.1 Component Qualification Review.

Qualification of components, such as fuel pumps, has not always accounted for 

unforeseen failures, wear, or inappropriate overhaul or maintenance. Also, incomplete 

use of the MIL specification explosion proof procedures has led to some fuel pumps 

entering airline service having never been run in an explosive environment. This 

combined experience suggests that more needs to be done to establish the capabilities of 

fuel pumps and other fuel system components to operate safely in an explosive 

environment. Such capability should be substantiated (or re-substantiated for the SFAR 

compliance) considering these factors in addition to the conditions noted in paragraph 

6.3 of this AC. The amount of qualification review can be significantly reduced if the 

fail-safe features noted earlier in this AC are followed (e.g., not operating pumps in 

vapor spaces of the tank, incorporating arc fault or ground fault protection on the 

electrical circuit, etc.). Therefore, an extensive evaluation of the qualification of 

components may be required if a qualitative assessment does not eliminate the 

component as a potential ignition source.
mm/dd/yy D R A F T AC 25.981-1X

30

9.2 Maximum Component Temperature for Qualification of Fuel System 

Components.

Maximum component temperatures may be determined experimentally. Tests should be 

conducted long enough for the component to reach the maximum temperature. All

foreseeable failures and malfunctions of the fuel tank components (including those 

failures and malfunctions that could be undetected by the flightcrew and maintenance 

personnel) should be considered when determining maximum temperatures.

9.2.1 As discussed in AC 25.981-1, issued in 1971, components mounted adjacent to the 

exterior surface of the fuel tank can create a high localized temperature at the inner 

surface of the tank. This can be investigated by laboratory tests that duplicate the

installation, or by a validated heat transfer analysis using the maximum potential 

temperature of the component.

9.2.2 When engine bleed air ducting, ECS, and other airplane components or systems are 

located near fuel tanks, a FMEA should be done to determine failures of adjacent 

systems or components that could cause elevated surface temperatures. The maximum 

internal tank temperatures that can occur during normal and failure conditions should be 

determined. Systems, such as over-temperature protective devices, should be evaluated 

to determine if periodic health checks are necessary to assure that latent failures do not 

exist.

9.3 Possible Failure Modes for Determination of Maximum Component 

Temperatures.

The following list, although it does not include all possible failure modes, suggests 

some conditions that should be explored in determining the maximum temperature 

expected for fuel tank components:

9.3.1 Fuel Pumps.

9.3.1.1 Normal fuel pump operation considering the highest hot day ambient and 

fuel tank temperatures.

9.3.1.1.1 Single phase operation of three-phase electrical fuel pumps. In many cases 

fuel pump motors are protected by a (single) three-phase circuit breaker. 

In several instances, resetting of circuit breakers has resulted in arcing 

inside the fuel tank and the development of an ignition source. Therefore, 

the fuel pump circuit should also preclude development of an ignition 

source if the breaker is reset or forced in by a mechanic. Methods that may

be used to address this foreseeable failure condition include the use of 

circuit protective features such as fast-acting AFCB or GFI circuit 

breakers.

9.3.1.1.2 Two-phase operation of three-phase electrical fuel pumps. Failure of a 

single phase of a multiple-phase fuel pump may significantly increase the 

load on the remaining phases of the pump and generation of heat in the 

pump. In many cases thermal protection features within the pump have 
mm/dd/yy D R A F T AC 25.981-1X

31

been incorporated to address this failure condition but these means have 

not been effective at preventing continued operation of a pump with a 

failed electrical phase. Another failure condition that should be considered 

is subsequent failure of a second phase of the pump and possible arcing or 

heat damage. In general, pumps should not be allowed to operate 

following failure of a single electrical phase of the pump if such operation 

could result in development of an ignition source. Automatic protective 

means, such as AFCB or GFI or other means, should be provided to shut 

down the pump when a single electrical phase failure occurs. Periodic 

inspections or maintenance of these features may be required.

9.3.1.2 Dry operation of fuel pumps, including lack of lubrication.

9.3.1.2.1 Service history has shown that flightcrews and maintenance personnel 

have inadvertently operated fuel pumps for long periods of time without 

fuel in the fuel tank. Fuel pumps are typically qualified for dry run 

operation for periods of time based upon assumptions made about possible 

duration of inadvertent operation, or failure conditions, which could result 

in dry running of the pump. For example, some pumps were operated 

during qualification testing up to a maximum of 8 hours continuously, 

with total accumulated dry run operation of 24 hours. These qualification 

tests were accomplished in order to demonstrate that fuel pump 

performance was still adequate following the dry pump operation. The 

tests were not demonstrated in an explosive environment and hence were 

not intended to qualify the pumps for such operation. In other cases 

previous approvals were predicated on the assumption that the fuel pump 

would not be dry run operated because the pump would be turned off by

the flight/ground crew following a pump low-pressure indication. 

Indefinite dry operation of pumps may result in surface temperatures 

above the auto-ignition temperature of the fuel or expose the pump to dry

run operation where debris from the fuel tank could enter the impeller and 

cause sparks. Manufacturers recommended procedures have not been 

shown to be adequate in preventing dry run operation. Therefore, 

additional fail-safe features are necessary to preclude dry run operation of 

airplane fuel pumps. One or more of the following fail-safe means should 

be considered for protection of fuel pumps:

1. Incorporate design features to keep the fuel pump inlet submerged in 

jet fuel to prevent dry running of the pump under all operating 

conditions.

2. Incorporate automatic pump shutoff features into the fuel pump or 

airplane to preclude dry run operation.

3. Other means such as installation of flame arrestors in the fuel pump 

inlet to preclude flame propagation into the fuel tank.

9.3.1.3 Temperatures associated with the fuel pump following wet operation with 

wet mechanical components both at zero and reduced fluid flow.
mm/dd/yy D R A F T AC 25.981-1X

32

9.3.1.4 Temperatures considering the moving mechanisms that are locked or

seized.

9.3.1.5 Temperatures generated as a consequence of pump impeller slippage.

9.3.2 Failed Bearings.

9.3.2.1 The effects of wear on fuel pump features incorporated into the design to 

maintain explosion proof characteristics should be evaluated. For example, 

wear of bearings or failures, including spinning of any bushings, and 

possible effects on quenching orifices should be evaluated. In many cases 

fuel pump explosion proof features are not redundant and failure or 

degradation of the features is latent. If single or probable combinations of 

failures in the fuel pump can cause an ignition source, § 25.981 requires

incorporation of fail-safe features noted previously. If wear of the pump 

can cause degradation of fail-safe features, appropriate inspection, 

overhaul or life limiting of the pump should be included in the 

Airworthiness Limitations section of the ICA.

9.3.3 FQIS.

FQIS wiring in the tank, with maximum voltage and current applied considering normal 

and failure conditions including the effects of high voltage systems outside the tank in 

proximity to the co-located FQIS wires.

9.3.3.1 FQIS component in the normal and failed state with the above associated 

maximum voltages and fault currents applied.

9.3.3.2 Float switch system temperatures should be determined considering the 

maximum environment temperatures and the application of the applicable 

maximum voltage and fault currents.

9.3.3.3 Temperatures of the fuel system components should also be evaluated 

considering the failure of bonding straps.

9.3.3.4 Pneumatic system temperatures need to be evaluated for the effects of duct 

rupture impinging on the external tank surface, and radiation and 

conduction heat transfer associated with the tank and components 

affecting tank wall temperatures (see previous discussion of spaces 

adjacent to fuel tanks).

9.3.3.5 Electrical defects that generate excessive heat. Arcing at the electrical 

connections to the pump housing or within the connector.

9.3.4 Submerged Heat Exchangers.

Operating under conditions of maximum heat rejection to the fuel.

9.3.5 Failed or Aged Seals.
mm/dd/yy D R A F T AC 25.981-1X

33

Spraying of fuel in the tank from any pressurized fuel source may cause electrostatic 

charging of components in the fuel tank and significantly lower the flammability

temperature of the fuel tank vapor. Therefore, the design should not include features 

that result in spraying of fuel, such as fuel pump motor cooling flow return to the tank. 

In addition, use of sealant in connectors that is not compatible with the fuel may allow 

leakage into the connector and the possibility of a fire near the connector.

9.3.6 Fuel Line Couplings.

Aging of seals may result in hardening of the seal material and leakage and spraying of 

fuel within the fuel tank; therefore, fuel line coupling designs should be evaluated and a 

design life should be established for all seals that are shown to age and allow leakage 

that can cause unacceptable electrostatic charging of components.

9.3.7 Fuel Pump Cooling Flow.

Fuel used for cooling of fuel pumps may be sprayed from the fuel pump. Fuel pump 

cooling flow should not be sprayed into the fuel tank vapor space. Means should be 

provided to distribute the cooling fuel into the fuel tank at or near the bottom of the fuel 

tank.

9.3.8 Electrical Connector Sealant, Seals, and Explosion Proofness.

Electrical connections to fuel pumps are typically located either inside or outside the 

fuel tank in areas of the airplane where the presence of flammable fuel vapors should be 

assumed because no secondary sealing of fuel is provided. Fuel leakage and corrosion at 

electrical connectors located outside the fuel tank has allowed the presence of both 

flammable vapors and electrical arcing at connectors, resulting in fires. In other 

applications, arcing has occurred at the pump connections inside the fuel tanks, 

requiring installation of appropriately sized steel shields to prevent arcing through the 

connector or pump housing into the fuel tank or areas where flammable vapor could 

exist.

9.3.9 Arcing at the Pump Electrical Connections.

In the safety assessment, arcing at the pump electrical connections should be assumed 

with fuel present. The energy release during an arcing condition may be limited by

installation of AFCB or GFI protection features. The pump connector should be shown 

to contain any resultant arcing or fire and maintain all surface temperatures below the 

auto- ignition temperature of the fuel. Component manufacturer maintenance records 

and qualification test results should be reviewed to establish that the sealant is 

compatible with the fuel and to determine if a design life or periodic inspections for the 

pump connector are needed.

10 INSTRUCTIONS FOR CONTINUED AIRWORTHINESS OF THE FUEL TANK 

SYSTEM—§ 25.1529.

10.1 Based upon the evaluations required by § 25.981(a), Amendment 25-102 also added a 

new requirement to § 25.981(b) to require that CDCCLs, inspections, or other 

procedures be established as necessary to prevent development of ignition sources 
mm/dd/yy D R A F T AC 25.981-1X

34

within the fuel tank system, and that they be included in the Airworthiness Limitations

section of the ICA required by § 25.1529. This requirement is similar to that contained 

in § 25.571 for airplane structure. Amendment 25-102 also added a new requirement to 

appendix H to part 25, Instructions for Continued Airworthiness, to provide any

mandatory fuel tank system inspections or maintenance actions in the section titled

Airworthiness Limitations of the ICA.

10.2 The preamble of Amendment 25-102 (66 FR 23097) states: Critical design 

configuration control limitations include any information necessary to maintain those 

design features that have been defined in the original type design as needed to preclude 

development of ignition sources. This information is essential to ensure that 

maintenance, repairs, or alterations do not unintentionally violate the integrity of the 

original fuel tank system type design. An example of a critical design configuration 

control limitation for current designs discussed previously would be maintaining wire 

separation between FQIS wiring and other high power electrical circuits. The original 

design approval holder must define a method to ensure that this essential information 

will be evident to those that may perform and approve repairs and alterations. Visual 

means to alert the maintenance crew must be placed in areas of the airplane where 

inappropriate actions may degrade the integrity of the design configuration. In 

addition, this information should be communicated by statements in appropriate 

manuals, such as Wiring Diagram Manuals. CDCCLs may include any maintenance 

procedure that could result in a failure, malfunction, or defect endangering the safe 

operation of the airplane, if not performed properly or if improper parts or materials are 

used. This information is essential to ensure that maintenance, repairs, or alterations do 

not unintentionally violate the integrity of the original type design of the fuel tank 

system.)

10.2.1 CDCCLs are intended to identify only critical features of a design that must be 

maintained. A CDCCL has no interval but establishes configuration limitations to 

maintain and to protect the “critical design feature” identified in the CDCCLs. CDCCLs

can also include requirements to have placards on the airplane with information about 

critical features. For example, certain components of a fuel pump (or all components) 

may include critical features that are identified as CDCCLs. These critical features must

be identified in the Airworthiness Limitations section of the ICA and should also be 

identified in the component maintenance manual (CMM) as CDCCLs to provide

awareness to maintenance and repair facilities.

10.2.2 Although not intended by the introduction of CDCCLs and other fuel system 

airworthiness limitations, there are also design approval holders (DAH) that have 

created certain CDCCL airworthiness limitations that include both the critical design 

feature as well as the tasks associated with maintaining the CDCCLs. Typically these 

airworthiness limitations require adhering to a specific CMM at a specific revision level 

when repairing or overhauling fuel system components. In this case, operators are 

required to adhere to all elements of the CMM specified in the CDCCLs. Any

deviations from CMMs specified in the CDCCLs, including using later revisions of 

those CMMs, must be approved by the FAA oversight office. The FAA has been 

working with DAHs to ensure that new design approvals identify only those critical 
mm/dd/yy D R A F T AC 25.981-1X

35

features of components in the CMMs as CDCCLs, instead of identifying the entire 

CMM as CDCCLs (or other types of airworthiness limitations). (Refer to the CMM 

deviation definition in Appendix C of this AC.)

10.3 Any fuel tank system components that are determined to require periodic maintenance, 

inspection, or overhaul to maintain the integrity of the system or maintain protective 

features incorporated to preclude a catastrophic fuel tank ignition event must be defined 

and included in the Airworthiness Limitations section of the ICA. An inspection 

airworthiness limitation has a specific task and interval (such as 10 years). The 

inspection interval should be established based upon the standard practices defined in 

AC 25.1309 for evaluation of component failures. The inspection could also be required 

following maintenance to verify a CDCCL feature is maintained. Examples of 

inspection airworthiness limitation items include:

10.3.1 Aging fuel line couplings seals/O-rings.

In certain instances, materials used in fuel line couplings may lose flexibility and harden 

with age. During suction feed or pressurized operation, the seal may allow air to enter 

the fuel line or leak, allowing spraying of fuel in the tanks or other areas of the airplane 

where spraying fuel could create a fire hazard. Repetitive inspections, functional 

checks, or mandatory replacement intervals may be required to prevent leakage.

10.3.2 Wear of pump bushings, bearings, and seals.

Wearing of pump bushings, bearings, and seals may significantly affect the 

performance of fuel pumps and degradation of features necessary to maintain the 

explosive proof qualification. In most cases these failures conditions are latent, 

therefore incorporation of other fail-safe features, as discussed earlier in this AC, would 

be required. If fail-safe features are incorporated, such as installation of feeder tanks 

that are filled with ejector pumps, functioning of those features would need to be 

assured by indications or periodic functional tests. Installation of fuel level sensors in 

the feeder tanks would provide continuous monitoring of the function. Another means 

could be installation of flow indicators in the flow line of the ejector pump that can be 

viewed by maintenance personnel and a mandatory periodic inspection of this function 

is one example of a method of mandatory maintenance action.

10.3.3 Fuel pump protective features.

If failure of an AFCB or GFI protective feature and/or a thermal fuse (closed) is latent 

and this feature is needed to maintain fail-safe features, periodic checks would likely be 

needed.

10.3.4 Transient suppression/energy limiting devices.

If failure of the device is latent and this feature is needed to maintain fail-safe features, 

periodic checks will be needed.

10.3.5 Wire shield grounding.

Component grounds and wires will likely require inspections and measurements to 

determine proper grounding.
mm/dd/yy D R A F T AC 25.981-1X

36

10.3.6 Fuel tank access panel/door seals leakage, resistance checks.

10.3.7 Fuel pump connectors, corrosion, wear.

10.3.8 Fuel pump electrical supply conduit structural, sealing integrity.

10.4 Maintainability, both in the design and procedures (i.e., master minimum equipment 

list, airplane maintenance manual, etc.), should be verified. This should include, as a 

minimum, verification that the system and procedures support the safety analysis 

assumptions and are tolerant to anticipated human errors, and that any critical 

procedures are highlighted for consideration as required inspection items. (See 14 CFR

121.369(b) for considerations of a “required inspection item.”)

10.5 Incorporation by Reference into Airworthiness Limitations.

10.5.1 When the words “in accordance with” or “per” are cited in the airworthiness limitations, 

the procedures in the referenced document must be followed to ensure that the critical 

design feature is maintained. Any changes to these procedures require FAA Oversight 

Office approval before they are used.

10.5.2 When the words “refer to” are cited in the airworthiness limitation, the procedures in 

the referenced document represent one method of complying with the airworthiness 

limitation. An accepted alternative procedure may be developed by the operator in 

accordance with its procedures in its maintenance program/manual. Prior FAA 

Oversight Office approval is not required for this action.

10.5.3 See AC 120.97A, , for guidance regarding procedures operators should use when 

requesting approval of changes to documents referenced in airworthiness limitations 

and for examples of fuel tank system airworthiness limitations.

10.6 Visible Identification of CDCCLs.

10.6.1 Section 25.981(b) states that “...visible means must be placed in areas of the airplane 

where maintenance, repairs, or alterations may violate the critical design configuration 

control limitations.” The design approval holder should define a method of ensuring 

that this essential information will be communicated by statements in appropriate 

manuals, such as Wiring Diagram Manuals, and be evident to those that may perform 

and approve such repairs and alterations.

10.6.2 An example of a CDCCL that would result in a requirement for visible means would be 

maintaining wire separation between FQIS wiring and other high power electrical 

circuits where separation of the wiring was determined to be a CDCCL. Acceptable 

methods of providing visible means would include color coding of the wiring and 

labeling. For retrofit of markings onto existing wiring, placement of identification tabs 

at specific intervals along the wiring would be acceptable. Industry and regulatory

authorities are currently developing standards for color coding of wiring for various 

systems. Standardization within the industry of color coding of wiring used for the fuel 

tank system would assist maintenance personnel in functional identification of wiring. 
mm/dd/yy D R A F T AC 25.981-1X

37

Pink wiring has been used by some manufacturers for fuel tank system wiring. Use of 

this color as a standard for fuel tank system wiring is recommended by the FAA.

If you have any suggestions for improvements or changes, you may use the template provided at 

the end of this AC.

END
XX/XX/XX D R A F T AC 25.981-1X

Appendix A

A-1

Appendix A. Certification of Arc Fault Circuit Breaker (AFCB) or Ground Fault 

Interrupter (GFI)

A.1 PURPOSE.

This appendix provides guidance for certification of AFCB or GFI devices that have 

been shown to be a practical means to protect the circuits of electric motor driven fuel 

pumps and other components inside fuel tanks that use higher than intrinsically safe 

electrical power (for example, motor operated valves).

A.2 BACKGROUND.

A.2.1 Typical fuel boost pumps are constructed with their electrical components inside 

explosion-proof pump housing. Therefore, electrical arcing inside the pump assembly is 

considered safe provided the integrity of the explosion proof housing is maintained.

A.2.2 However, service experience has demonstrated that the integrity of the explosion-proof 

housing can be lost as a result of fasteners coming loose, flame arrestors being left out 

of the pump assembly, and from intermittent electrical arcs that penetrate the housing. 

Traditional thermal circuit breakers have generally not detected intermittent electrical 

arcs and therefore do not typically protect from intermittent arcs.

A.2.3 AFCBs have been used as a practical means to protect against arcing in fuel pump 

power circuits for both alternating current and direct current motor-powered fuel pump 

motors. The SAE issued two aerospace standards for AFCBs: One for alternating 

current circuits and one for direct current circuits (see Appendix B of this AC).

A.2.4 Fuel pump housings and metallic conduits are grounded to the airframe, and any arcing 

to the cavity wall or conduit creates a ground fault. Therefore, GFI have been used in 

AC pump power circuits as a practical means to ensure that power is quickly

disconnected from the fuel pump in the event of a ground fault in the pump or 

associated power wiring.

A.3 CERTIFICATION GUIDANCE.

One means for the applicant to show compliance with the applicable regulations is to 

demonstrate, through design, review, analysis, and test, that the AFCB or GFI performs 

as intended under any foreseeable operating conditions and addresses the following 

guidance:

A.3.1 Fault Detection Trip Levels.

A.3.1.1 The applicant should demonstrate that the AFCB or GFI can distinguish between actual 

fault events and events characteristic of the normal airplane pump start up operating 

loads and environmental conditions. Laboratory testing and/or airplane ground/flight 

testing should be performed to demonstrate the “intended function” of AFCB or GFI. 
XX/XX/XX D R A F T AC 25.981-1X

Appendix A

A-2

The test methods chosen should be able to reproduce the most common types of arcing 

in fuel pumps that occurs in an airplane environment due to ground or arc faults. The 

AFCB or GFI should be designed to prevent nuisance tripping due to normal airplane 

electrical loads, electrical bus switching, and to operate continuously with normal and 

abnormal airplane electrical bus switching characteristics associated with master 

minimum equipment list dispatch relief configurations. 

A.3.1.2 The installation of the AFCB or GFI should not result in an appreciable increase in the 

loss of fuel pump functions. A reliability requirement on the order of 100,000 hours 

mean time between failures may be satisfactory, but the applicant should show that 

failure of the AFCB or GFI does not result in an appreciable increase in the occurrence 

of failures that result in the loss of fuel pump functions. 

A.3.1.3 Sufficient laboratory testing and airplane testing should be conducted to demonstrate 

AFCB or GFI nuisance trip performance, including tests for lightning, HIRF, and 

electromagnetic compatibility. In addition, sufficient laboratory testing should be 

conducted to demonstrate that the AFCB or GFI trips before arcing in the fuel pump can 

lead to ignition of fuel vapor in the fuel tank.

A.3.1.4 A means should be provided to latch the AFCB or GFI in a state that removes power 

from the fuel pump motor in the event that a ground fault has been detected, until the 

AFCB or GFI is reset. A trip of a single AFCB or GFI should not be reset until the 

reason for the trip has been determined and repaired or that it has been determined that 

no ground fault exists.

A.3.1.5 A means should be provided to verify that the AFCB or GFI, when installed in the 

airplane, is capable of detecting an arc or ground fault and disconnecting power from 

the fuel pump motor. An acceptable approach is each installed GFI should be able to be 

tested without the need for test equipment, i.e. each GFI should have a built in test 

capability. The means provided should verify that the AFCB or GFI protection is 

operational before applying power to the fuel pump prior to each flight. Alternatively, 

the applicant may establish a safety requirement that the probability of a latent failure 

condition of the arc fault or ground fault protection is extremely remote (i.e., less than 

1.0 x 10-7).

A.3.2 Software.

Inadvertent operation of multiple AFCB or GFI devices has the potential to affect the 

continued operation of more than one engine, a condition that the FAA considers to be 

hazardous. Software used by the AFCB or GFI devices should be developed and 

verified in accordance with RTCA DO-178B.

A.3.3 Complex Hardware.

Application-specific integrated circuit and parallel-line assay used by the AFCB or GFI 

devices should be developed and tested in accordance with RTCA DO-254.
XX/XX/XX D R A F T AC 25.981-1X

Appendix A

A-3

A.3.4 System Safety Assessment.

A.3.4.1 AFCB or GFI devices installed in circuits that perform essential or critical functions 

and/or their performance could impact the safety of flight. The applicant should perform 

an installation SSA in accordance with §§ 25.901(c), 25.981(a) and (d), and 25.1309. 

The SSA should include a functional hazard assessment to determine the effects of 

failures of the AFCB or GFI devices on the safety of the airplane and to verify that the 

design limits the probability of undesirable failure conditions to acceptable levels. In 

addition, the applicant should address the potential for possible common cause trips due 

to hardware/software errors and common cause trips due to environmental conditions

such as HIRF (§ 25.1317), lightning (§§ 25.954 and 25.1316), and electromagnetic 

compatibility (§§ 25.1301, 25.1309(e), and 25.1353(a)).

A.3.4.2 Failure to provide fuel pump power due to unintended activation of multiple AFCB or 

GFI devices has the potential to affect the continued operation of more than one engine, 

a condition that the FAA considers is at least hazardous and could be catastrophic 

depending on the type design and mission. Proper design assurance of the AFCB or GFI 

devices, such as appropriate environmental qualifications, will address any concern 

about common cause failures.

A.3.4.3 Failure of an AFCB or GFI device to detect an arc or ground fault condition in a fuel 

pump circuit can contribute to a catastrophic failure condition. The FAA considers the 

undetected failure of an AFCB or GFI alone, which prevents its detection of or response 

to an arc or ground fault, to be a severe-major (hazardous) failure condition. The loss of 

arc or ground fault protection should either be shown to be extremely remote or 

annunciated to the flight crew prior to flight. If failures of the AFCB or GFI can 

contribute to severe-major (hazardous) or catastrophic failure conditions, the safety 

assessment should analyze common cause failures or design errors that could result in 

these conditions and verify that appropriate protection to prevent them is provided. Due 

to the nature of AFCB and GFI devices, special attention should be given to protection 

from lightning, EMI, and HIRF.

A.3.4.4 As discussed in section A.3.6 below, the FAA expects there will be a means for the 

flightcrew to reset the AFCB or GFI in the event that more than one fuel pump AFCB 

or GFI trips simultaneously in flight. With a reset capability, a common mode failure or 

error that could affect the continued operation of more than one engine is considered to 

be hazardous and should therefore be shown to be extremely remote.

A.3.4.5 Furthermore, the applicant should demonstrate by design, analysis, and fault insertion 

testing, if applicable, the validity of failure analysis assumptions, and show that the 

probability of the failure of AFCB or GFI to detect the existence of a ground or arc fault 

condition and remove power from a pump is extremely remote (10

-7

or less). In order to 

meet this requirement, AFCB and GFI installations have typically required an automatic 

built-in test feature that verifies the AFCB or GFI fault protection is operational before 

applying power to the fuel pump prior to each flight (see section 8.3.3).
XX/XX/XX D R A F T AC 25.981-1X

Appendix A

A-4

A.3.5 Power and Ground Requirements.

A.3.5.1 AFCB or GFIs are active devices and require power. The applicant should demonstrate 

that AFCB or GFI power and ground connections are implemented such that all 

airplanes load margins are sufficient and that proper circuit protection or other methods 

are used to protect AFCB or GFI power and ground wiring. The applicant should also 

demonstrate that there are no hazards to maintenance or flightcrews due to possible hot 

shorts to electrical panels containing AFCB or GFI. In addition, if the installation of 

AFCB or GFI will involve the direct replacement of devices on a given electrical panel, 

the applicant should demonstrate adequate power/heat dissipation, and ensure safe 

touch temperature.

A.3.6 Troubleshooting Procedures.

A.3.6.1 Because AFCB or GFIs are capable of detecting ground paths on pumps and airplane 

wiring that may not be detected by visual inspection, the applicant should define the 

operational and maintenance philosophies and methodology associated with an AFCB 

or GFI trip that does not rely solely on visual inspections. The applicant should 

demonstrate how the maintenance procedures would be able to safely distinguish and 

diagnose an AFCB or GFI trip and nuisance trip without causing a fuel tank explosion. 

Operational instructions and maintenance procedures should be provided to prevent 

resetting of tripped AFCB or GFIs until it can be assured that resetting an AFCB or GFI 

will not cause the occurrence of a fuel tank explosion. Human factors considerations 

should be taken into account to minimize the possibility of human error during airplane 

operation and maintenance.

A.3.6.2 If multiple boost pumps are protected with AFCB or GFI devices such that the 

continued operation of multiple engines could be affected, there should be a means for 

the flightcrew to reset tripped AFCB or GFI devices in flight. The applicable airplane 

flight manual should contain a limitation against the reset of a single AFCB or GFI and 

procedures for resetting AFCB or GFI devices when multiple AFCB or GFIs have 

tripped simultaneously in flight.

A.3.7 Hardware Qualification.

Environmental testing including thermal, shock and vibration, humidity, fluid 

susceptibility, altitude, decompression, fungus, waterproofness, salt spray, and 

explosion proofness should be performed in accordance with DO-160D or equivalent 

standards. The applicant should define an insulation, dielectric, and electrical grounding 

and bonding standard acceptable to the FAA for the AFCB or GFI. Appropriate test 

categories in each DO-160 section should be chosen based on the AFCB or GFI 

installation environment defined for the specific airplane. Particular attention should be 

given to the normal and abnormal power input tests outlined in DO-160 section 16. The 

system with AFCB or GFI installed must comply with §§ 25.954 and 25.1316 for 

lightning protection, §§ 25.1301, 25.1309(e), and 25.1353(a) for electromagnetic 

compatibility, and § 25.1317 for HIRF.
XX/XX/XX D R A F T AC 25.981-1X

Appendix A

A-5

A.3.8 Airplane Tests.

The applicant should demonstrate by ground and/or flight tests that all AFCB or GFIs 

remain armed during normal and abnormal electrical power bus and load switching as 

described in paragraph A.3.1.1 of this AC, and are not adversely affected by the 

operation of other airplane systems. The airplane tests should also demonstrate that the 

AFCB or GFI would not produce EMI to other airplane systems.

A.3.9 Instructions for Continued Airworthiness (ICA).

A.3.9.1 The applicant must submit ICAs required by § 25.1529 in order to provide the 

necessary procedures to service and maintain AFCB or GFI installations. As required 

by appendix H25.4, the Airworthiness Limitations section of the ICA must include each 

mandatory replacement time, inspection interval, related inspection procedure, and all 

critical design configuration control limitations (CDCCLs) approved under § 25.981 for 

the AFCB or GFI installation. Consideration should be given to maintenance intervals 

for the detection of latent failures that would prevent the AFCB or GFI from tripping 

during a ground or arc fault event.

A.3.9.2 AFCB or GFIs used for showing compliance to § 25.981 requirements for preventing 

ignition sources are typically a CDCCL in these installations. As required by 

§ 25.981(d), the applicant must provide visible means of identifying the AFCB or GFI 

as a CDCCL and should provide design features to minimize the inadvertent 

substitution of an AFCB or GFI with a non-AFCB or GFI device.

A.3.10 Airplane Flight Manual Limitations

The airplane flight manual Limitations section should address any limitations related to 

AFCB or GFI intended function and any self-test features of the AFCB or GFI design.
XX/XX/XX D R A F T AC 25.981-1X

Appendix B

B-1

Appendix B. References and Related Documents

B.1 REFERENCES AND RELATED DOCUMENTS.

The following related documents are provided for information purposes and are not 

necessarily directly referenced in this AC.

B.1.1 14 CFR Regulations.

Sections that prescribe requirements for the design, substantiation, and certification 

relating to prevention of ignition sources within the fuel tanks of transport category

airplanes include:

 § 21.50, Instructions for continued airworthiness and manufacturer’s maintenance 

manuals having airworthiness limitations sections.

 § 25.729(f), Protection of equipment in wheel wells.

 § 25.863, Flammable fluid fire protection.

 § 25.901, Installation. (Powerplant)

 § 25.954, Fuel system lightning protection.

 § 25.973, Fuel tank filler connection.

 § 25.981, Fuel tank explosion prevention.

 § 25.1301, Function and installation. (Equipment)

 § 25.1309, Equipment, systems, and installations.

 § 25.1316, Electrical and electronic system lightning protection.

 § 25.1317, High-intensity Radiated Fields (HIRF) Protection.

 § 25.1353, Electrical equipment and installations.

 § 25.1529, Instructions for Continued Airworthiness.

 Appendix H to part 25, Instructions for Continued Airworthiness.

B.1.2 Advisory Circulars.

You can view and download the current version of the following ACs from our webbased Regulatory and Guidance Library (RGL) at www.rgl.faa.gov. ACs are also 

available on the FAA website at 

http://www.faa.gov/regulations_policies/advisory_circulars/.

 AC 20-158, The Certification of Aircraft Electrical and Electronic Systems for 

Operation in the High-Intensity Radiated Fields (HIRF) Environment, dated July

30, 2007.

 AC 21-40A, Guide to Obtaining a Supplemental Type Certificate, dated September 

27, 2007.
XX/XX/XX D R A F T AC 25.981-1X

Appendix B

B-2

 AC 25-8, Auxiliary Fuel System Installations, dated May 2, 1986.

 AC 25-16, Electrical Fault and Fire Prevention and Protection, dated September 

25, 1987.

 AC 25-19, Certification Maintenance Requirements, dated October 3, 2011.AC 

25.954-X, Fuel System Lightning Protection, dated XXXXX.

 AC 25.981-2A, Fuel Tank Flammability Reduction Means, dated September 19, 

2008.

 AC 25.1309-1A, System Design and Analysis, dated June 21, 1988.

 AC 25.1701-1, Certification of Electrical Wiring Interconnection Systems on 

Transport Category Airplanes, dated December 4, 2007.

 AC 120.97A, Incorporation of Fuel Tank System Instructions for Continued 

Airworthiness into Operator Maintenance or Inspection Programs, dated May 25, 

2012.

B.1.3 Other FAA Documents.

 Transport Airplane Directorate Designee Newsletter, Edition 15, February 1993. 

Article, “Electrical Wiring used in Commercial Transport Airplanes.” An electronic 

copy of this newsletter is available on the Internet at 

http://www.faa.gov/aircraft/air_cert/design_approvals/transport/Cert_Update/Editio

n11-20/media/Edition15.pdf.

 Report DOT/FAA/AR-98/26, Review of the Flammability Hazard of Jet A Fuel 

Vapor in Civil Transport Aircraft Fuel Tanks, June 1998. An electronic copy of this 

report is available on the Internet at http://www.tc.faa.gov/its/worldpac/techrpt/ar98-

26.pdf.

 Report DOT/FAA/AR-03/61, Silver-Sulfur Deposits on Fuel Quantity Indication 

System and Attendant Wiring, October 2003. An electronic copy of this report is 

available on the Internet at http://www.tc.faa.gov/its/worldpac/techrpt/ar03-61.pdf.

 Technical Note DOT/FAA/AR-TN05/37, Intrinsically Safe Current Limit Study for 

Aircraft Fuel Tank Electronics, October 2005. An electronic copy of this report is 

available on the Internet at http://www.fire.tc.faa.gov/pdf/TN05-37.pdf.

 Order 8110.4C, Type Certification, effective December 20, 2011. An electronic 

copy of this document is available on the Internet at 

http://www.faa.gov/documentLibrary/media/Order/8110.4c%20Changes%201%20t

hru%205.pdf.

B.1.4 Military Specifications.

You can get a copy of these documents from the Department of Defense, Document 

Automation and Production Service, Building 4/D, 700 Robbins Avenue, Philadelphia, 

PA 19111-5094, or on the internet at http://assist.daps.dla.mil/online/start/.
XX/XX/XX D R A F T AC 25.981-1X

Appendix B

B-3

 MIL-E-5272A, Environmental Testing of Aeronautical & Associated Equipment

(Explosion Proof Equipment Qualification Tests).

 MIL-STD-810E, Method 511.3, Explosive Atmosphere, dated September 1, 1993.

 MIL-PRF-6106K, General Specification for Electromagnetic Relays, 

B.1.5 Industry Documents.

B.1.5.1 Society of Automotive Engineers (SAE) Documents.

You can get the following documents from the Society of Automotive Engineers, Inc., 

400 Commonwealth Drive, Warrendale, Pennsylvania, 15096, or from 

http://www.sae.org/.

 AIR 1662, Minimization of Electrostatic Hazards in Aircraft Fuel Systems.

 ARP 4404, Aerospace Recommended Practice, Aircraft Electrical Systems

(guidance document for design of aerospace vehicle electrical systems).

 APR 4754, Aerospace Recommended Practice, Certification Considerations for 

Highly Integrated or Complex Aircraft Systems.

 ARP 4761, Aerospace Recommended Practice, Guidelines and Methods for 

Conducting the Safety Assessment Process on Civil Airborne Systems and 

Equipment.

 ARP 5583, Guide to Certification of Aircraft in a High Intensity Radiated Field

(HIRF) Environment.

 AS50881, Aerospace Vehicle Wiring (procurement document used to specify

aerospace wiring; replaces MIL-W-5088).

 AS5692, A Fault Circuit Breaker (AFCB), Aircraft, Trip-Free Single Phase 115 

VAC, 400 Hz - Constant Frequency.

 AS6019, ARC Fault Circuit Breaker (AFCB), Aircraft, Trip-Free 28 VDC.

B.1.5.2 Other Industry Documents.

 RTCA Document DO-160F, Environmental Conditions and Test Procedures for 

Airborne Equipment, December 6, 2007.

 Underwriters Laboratories Inc., UL 913, Intrinsically Safe Apparatus and 

Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) 

Locations, July 31, 2006.

 Kuchta, Joseph M., Summary of Ignition Properties of Jet Fuels and Other Aircraft 

Combustible Fluids, Air Force Aero Propulsion Laboratory Technical Report 

AFAPL-TR-75-70, U.S. Bureau of Mines PMSRC, September 1975.

 American Society of Testing and Materials, ASTM D 4865, Standard Guide for 

Generation and Dissipation of Static Electricity in Petroleum Fuel Systems, August 
XX/XX/XX D R A F T AC 25.981-1X

Appendix B

B-4

2009. A copy of this standard can be ordered electronically on the Internet at 

http://www.ASTM.org.

 National Fire Protection Association, NFPA 77, Recommended Practice on Static 

Electricity, 1993 edition. A copy of this publication can be ordered electronically on 

the Internet at http://www.NFPA.org.

 F. A. Fisher, Some Notes on Sparks and Ignition of Fuels, NASA report, 

NASA/TM-2000-210077, March 2000.

 EUROCAE ED 107, Guide to Certification of Aircraft in a High Intensity Radiated 

Field (HIRF) Environment. This document is the same as ARP 5583 referenced in 

paragraph B.1.5.1 of this AC.
XX/XX/XX D R A F T AC 25.981-1X

Appendix C

C-1

Appendix C. Definitions.

C.1 DEFINITIONS.

C.1.1 Arc Fault Circuit Breaker (AFCB). A device that provides thermal circuit breaker 

protection and detects electrical arcing faults and interrupts electrical power to the fault. 

(See paragraph B.1.5.1of this AC for SAE standards for alternating current and direct 

current AFCB.)

C.1.2 Auto-Ignition Temperature. The minimum temperature at which an optimized 

flammable vapor and air mixture will spontaneously ignite when heated to a uniform 

temperature in a normal atmosphere without an external source of ignition, such as a 

flame or spark.

C.1.3 Auxiliary Tanks. Fuel tanks installed which make additional fuel available for 

increasing the flight range of that airplane. The term “auxiliary” means that the tank is 

secondary to the airplane’s main fuel tanks; i.e., the functions of the main tanks are 

immediately available and operate without immediate supervision by the flightcrew in 

the event of failure or inadvertent depletion of fuel in an auxiliary tank. Auxiliary tanks

are usually intended to be emptied of usable fuel during flight and have been installed in 

various locations including center wing structure, horizontal stabilizers, wings, and 

cargo compartments.

C.1.4 Barrier. A physical partition attached to airplane structure that separates one wire or 

group of wires from another wire or group of wires in order to prevent arcing, fire, and 

other physical damage between wires or groups of wires.

C.1.5 Component Maintenance Manual (CMM) Deviation.

C.1.5.1 Term used for approval of changes to CMMs that are the subject of CDCCLs or other 

types of airworthiness limitations adopted by a type design change.

C.1.5.2 Term used for the approval of changes to CMMs referenced in CDCCLs or other types 

of airworthiness limitations that are mandated by airworthiness directives (AD), 

provided the CDCCL or airworthiness limitation includes wording that allows use of 

“later approved” CMMs. Otherwise, approval must first be granted as an alternative 

method of compliance (AMOC) to the AD. As with AMOC approvals, a CMM 

deviation approval must be granted by the FAA oversight office.

C.1.6 Critical Design Configuration Control Limitations (CDCCLs). Airworthiness 

limitations that define those critical design features of the design that must be 

maintained to ensure that ignition sources will not develop within the fuel tank system.

C.1.7 Electrical Sparks. A spark that is initiated by a potential difference which causes an 

electrical breakdown of a dielectric, such as a fuel/air mixture, produced between 

electrodes which are initially separated, with the circuit initially carrying no current. 
XX/XX/XX D R A F T AC 25.981-1X

Appendix C

C-2

The term voltage sparks is sometimes used interchangeably with the term electrical 

sparks.

C.1.8 Electrical Arcs. Electrical arcs occur between electrodes which are in contact with each 

other and carry excessive current which results in melting at the contact points. This 

may result in electric arc plasma and/or ejection of molten or burning material. The 

term thermal sparks is used interchangeably with the term electrical arcs.

C.1.9 Explosion Proof. Components designed and constructed so they will not ignite 

flammable vapors or liquids surrounding the component under any normal operating 

condition and any failure condition. Further information on possible failure conditions 

that should be considered is specified in § 25.981(a)(3).

C.1.10 FAA Oversight Office. As defined by 14 CFR part 26, the aircraft certification office or 

office of the Transport Airplane Directorate with oversight responsibility for the 

relevant type certificate, supplemental type certificate, or manufacturer, as determined 

by the Administrator. See AC 25.981-2A, Appendix 1, for a list of FAA Oversight 

Offices by Design Approval Holder.

C.1.11 Flammable. Flammable, with respect to a fluid or gas, means susceptible to igniting 

readily or to exploding (14 CFR part 1, Definitions and Abbreviations). Further 

information on flammable fluids used in airplanes may be found in the documents 

identified in paragraph B.1.5.2 of this AC.

C.1.12 Flash Point. The flash point of a flammable fluid is defined as the lowest temperature at 

which the application of a flame to a heated sample causes the vapor to ignite 

momentarily, or “flash.” The test standard for jet fuel is defined in the fuel 

specification.

C.1.13 Friction Spark. A heat source in the form of a spark that is created by mechanical 

contact, such as debris contacting a rotating fuel pump impeller.

C.1.14 Fuel System Airworthiness Limitation. Any mandatory replacement time, inspection 

interval, related inspection procedure, and all critical design CDCCLs approved under 

§ 25.981 for the fuel tank system identified in the Airworthiness Limitations section of 

the ICA (as required by§ 25.981 and appendix H to part 25, section H25.4).

C.1.15 Ground Fault Interrupter (GFI). A device that provides thermal circuit breaker 

protection and detects an electrical power short circuit-to-ground condition and 

interrupts electrical power to the ground fault.

C.1.16 Hot Short. Electrical energy introduced into equipment or systems as a result of 

unintended contact with a power source, such as bent pins in a connector or damaged 

insulation on adjacent wires.

C.1.17 Ignition Source. A source of sufficient energy to ignite combustion of a fuel/air mixture. 

Surfaces that can exceed the auto-ignition temperature of the flammable vapor under 

consideration are considered to be ignition sources. Electrical arcs, electrical sparks and 
XX/XX/XX D R A F T AC 25.981-1X

Appendix C

C-3

friction sparks are also considered ignition sources if sufficient energy is released to 

initiate combustion.

C.1.18 Installation Appraisal. A qualitative appraisal of the integrity and safety of the 

installation.

C.1.19 Intrinsically Safe. Any instrument, equipment, or wiring that is incapable of releasing 

sufficient electrical or thermal energy under normal operating conditions, anticipated 

failure conditions (see § 25.981(a)(3)), and environmental conditions which could cause 

an ignition source within the fuel tank.

C.1.20 Latent Failure. A failure whose presence may not be readily apparent to the flightcrew 

or maintenance personnel. A significant latent failure is one that would, in combination 

with one or more specific failures or events, result in a hazardous or catastrophic failure 

condition.

C.1.21 Line Replacement Unit (LRU). Any components that can be replaced while the airplane 

remains in operational service. Examples of fuel system LRUs include components such 

as cockpit and refueling panel fuel quantity indicators, fuel quantity system processors, 

and fuel system management control units.

C.1.22 Maximum Allowable Surface Temperatures. A surface temperature within the fuel tank 

(the tank walls, baffles, or any components) that provides a safe margin under all 

normal or failure conditions, which is at least 50 °F (10 °C) below the lowest expected 

auto-ignition temperature of the approved fuels. The auto-ignition temperature of fuels 

will vary because of a variety of factors (ambient pressure, dwell time, fuel type, etc.). 

The value accepted by the FAA without further substantiation for kerosene fuels, such 

as Jet A, under static sea level conditions, is 450 °F (232.2 °C). This results in a 

maximum allowable surface temperature of 400 °F (204.4 °C) for an affected 

component surface.

C.1.23 Qualitative. Those analytical processes that assess system and airplane safety in an 

objective, non-numerical manner.

C.1.24 Quantitative. Those analytical processes that apply mathematical methods to assess 

system and airplane safety.

C.1.25 Transient Suppression Device (TSD). A device that limits transient voltages or currents 

on wiring to systems such as the fuel tank quantity, fuel temperature sensors, and fuel 

level switches, etc., to a predetermined level.
Advisory Circular Feedback

If you find an error in this advisory circular (AC), have recommendations for improving it, or 

have suggestions for new items/subjects to be added, you may let us know by (1) emailing this 

form to 9-AWA-AVS-AIR500-Coord@faa.gov or (2) faxing it to the attention of the Aircraft 

Certification Service Directives Management Officer at (202) 267-3983.

Subject: (insert AC title/number here) Date: Click here to enter text.

Please check all appropriate line items:

☐ An error (procedural or typographical) has been noted in paragraph Click here to enter text.

on page Click here to enter text..

☐ Recommend paragraph Click here to enter text. on page Click here to enter text. be 

changed as follows:

Click here to enter text.

☐ In a future change to this AC, please cover the following subject:

(Briefly describe what you want added.)

Click here to enter text.

☐ Other comments:

Click here to enter text.

☐ I would like to discuss the above. Please contact me.

Submitted by: Date: