U.S. Department

of Transportation **Federal A**

**viation Ad**  **ministration** 

# Advisory

**Circular**

**Subject:** Fuel Tank Ignition Source Prevention Guidelines **Date:** dd/mm/yy **Initiated By:** ANM - 1 10 **AC No:** 25.981 - 1 X This advisory

circular (AC) provides guidance for demonstrating compliance with the certification requirements for prevention of ignition sources, except lightning, which is addressed in AC 25.954 - X , within the fuel tanks of transport category airplanes. This guidance is applicable t o transport category airplanes for which a new, amended, or supplemental ty pe certificate is requested . Revisions to this AC include : 1) Remov ing all the lightning - related aspects with the purpose of incorporating them into a newly- developed AC that addresses compliance to the requirement s of Title 14, Code of Federal Regulations 25.945 ; and 2) Describing means of compliance f or prevention of failure conditions by which ignition will be created from sources other than lightning, using circuit protecti ve devices such as arc f ault c ircuit b reakers or ground f ault i nterrupter to provide fail safe features.mm/dd/yy D R A F T AC 25 .981 - 1X

ii 1 Purpose. ................................ ................................ ................................ ................................ ...... 1 2 Applicability . ................................ ................................ ................................ ............................. 1 3 Cancellation. ................................ ................................ ................................ .............................. 1 4 Background. ................................ ................................ ................................ ............................... 1 5 Objective. ................................ ................................ ................................ ................................ ... 3 6 Fuel Vapor Ignition Sources. ................................ ................................ ................................ ..... 7 7 Design Considerations. ................................ ................................ ................................ ............ 11 8 Safety Anal ys is. ................................ ................................ ................................ ....................... 17 9 Component Qualification Considerations. ................................ ................................ ............... 29 10 Instructions for Continued Airworthiness of the Fuel Tank Sy stem

— § 25.1529. .................. 33 Appendix A. Certification of Arc Fault Circuit Breaker (AFCB) or Ground Fault Interrupter (GFI) ................................ ................................ ................................ ................................ ........... A - 1 Appendix B. References and Related Documents ................................ ................................ ....... B - 1 Appendix C. Definitions. ................................ ................................ ................................ ............. C - 1 **Figures** Figure 1 : Example s of Fuel Tank Ignition Source Considerations ................................ ................ 19mm/dd/yy D R A F T AC 25 .981 - 1X

1 1 **PURPOSE .**  This AC provides guidance for demonstrating compliance with the certification requirements for prevention of ignition sources, except lightning, which is addressed in AC 25.954 - X , within the fuel tanks o f transport category airplanes. This AC also identifies the need f

or prevention of failure conditions by which ignition will be created from sources other than lightning and describes a method using circuit protective devices such as arc fault circuit breakers (AFCB) or ground fault interrupter (GFI) to provide fail - safe features that have been approved as demonstrating compliance with § 25.981 . This guidance is applicable to transport category airplanes for which a new, amended, or supplemental ty pe certificate is requested. 2 **APPLICABILITY .**  2.1 The guidance provided in this document is directed to airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) transport airplane ty

pe certification engineers and their designees. 2.2 This material is neither mandatory nor regulatory in nature and doe s not constitute a regulation. It describes acceptable means, but not the only means, for demonstrating compliance with the applicable re gulations. The FAA will consider other methods of demonstrating compliance that an a pplicant may

elect to present. Wh ile these guidelines are not mandatory , they

are derived from extensive FAA and industry experience in determining compliance with the relevant regulations . On the other hand, if we become aware of circumstances that convince us that following this AC woul d not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may

require additional substantiation or design changes as a basis for finding compliance. 2.3 Th e material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes in, or permit deviations from, existing regulatory

requirements. 3 **CANCELLATION .**  This AC cancels AC 25.981 - 1C , Fuel Tank Ignition Source Prevention Guidelines , dated September 19 , 2 008 . 4 **BACK GROUND**  **.** 4.1 **Regulatory History.** 4.1.1 The regulatory

standards of Title 14, Code of Federal Regulations (14 CFR) part 25 require that ignition sources not be present or develop in the fuel tanks of transport airplanes. Amendment 25 - 11, effective May 5, 1967, introduced § 25.981, Fuel tankmm/dd/yy D R A F T AC 25 .981 - 1X

2 temperature . This requirement was prompted b y a need for protection of airplane fuel tanks from possible ignition sources because of advances in electrical s ys tem sealing. These advances made it possible to place electrical s ys tem components, such as pumps and fuel gauging elements, as well as the wiring to these components, in immersed locations within fuel tanks. Additionally, fuel tank walls were subject to local “hot spots” by the proximity

of airplane equipment and compre ssor bleed air ducts that carry air at high temperatures. 4.1.2 The need for a regulation was further demonstrated by the possibility

that the surface temperature of the fuel tank internal wall, or the fuel sy stem components within the fuel tank, could exceed th e auto - ignition temperature . Section 25.981, as originally adopted, focused on preventing ignition of fuel vapors in the fuel tanks from hot surfaces. It required that the applicant determine the highest temperature allowable in fuel tanks that provided a safe margin below the lowest expected auto - ignition temperature of the fuel approved for use in the fuel tanks . In addition, this regulation established a requirement that no temperature at any place inside any fuel tank where fuel ignition is possible may then exceed that maximum allowable temperature. 4.1.3 Other sections of part 25 require that ignition from lightning be prevented (§ 25.954), as well as ignition from failures in the fuel s ys tem (§ 25.901). Applicants have been required b y § 25.901 to co mplete a safety assess m ent of the fuel s ys tem and show that “no single f

ailure or m al f

unction or probable co mbination of f ailures will jeopardize the sa f e operation of the airplane....” However, service history has shown that ignition sources have developed in airplane fuel tanks due to unfo reseen failure m odes or factors that were not considered at the ti m e of original certification of the airplane, including arcs, sparks, or hot surfaces within the fuel tanks. 4.2 AC 25.981 - 1A, Guidelines for Substantiating Complian ce with the Fuel Tank Temperature Requirements , iss u ed in 1972, provided guidance that included failure m odes that used to be considered when deter m ining co mpliance with the fuel tank te mperature requirem ents defined in § 25.981. This regulation originall y focused on preventing ignition of fuel vapors in the fuel tanks from hot surfaces. The AC also stated the accepted practice of establishing a m ini mum 50 °F temperature m argin below the lowest auto - ignition te mperature of the approved fuels. 4.3 Amendment 25 - 102, issued on April 18, 2001, renamed § 25.981 as Fuel tank ignition prevention . That amendment also added new requirements to address causes of ignition sources within fuel tanks, and minimization of the development of flammable vapors in the fuel tanks or mitigation of the effects of an ignition of vapors in the tanks. The new ignition source prevention standard requires a safety assessment of the fuel tank sy stem that includes:  C onsideration of single failures ;  P robable co mbinations of failures ;mm/dd/yy D R A F T AC 25 .981 - 1X

3  D eve lop m ent of long - term instructions for continued airworthiness (ICA) , including m andatory

replacement time, inspection interval, related inspection procedure, and c ritical d esign c onfiguration c ontrol l i m itations (CDCCL s ) ; and  M aintainability

of the airplane f

uel tank s ys tem . 4.4 Special Federal Aviation Regulations (SFAR) No. 88, promulgated b y Amendment 21 - 78, also issued on April 18, 2001, requires a one - time reassessment of the fuel tank sy stems of many in - service transport airplanes per the ignition source prevention requirements of § § 25.901 and 25.981, Amendment 25 - 102. 4.5 Am endm ent 25 - 125, issued July 9, 2008, am ended § 25.981 to add specific requirem ents f

or the f uel tank f lamm ability . The require m ents f or CDCCL s were expanded to include flamm abi lity reduction m eans and ignition m itigation. 4.6 Amendment xxx , issued date enhanced § 25.954 requirements to prevent catastrophic fuel tank failures due to the ef fect of lightning on the fuel t ank structure and sy stems including fault tolerant fuel sy stem lightning ignition source protection. This amendment removed lightning as an ignition source threat to be assessed under § 25.981, because it was impractical to demonstrate § 25.981 compliance for lightning in some cases. It also renamed § 25.981 as Fuel tank explosion prevention , which was intended by

Amendment 25 - 125. 5 **OBJECTIVE .**  5.1 The objective of this AC is to provide guidelines that address the prevention of possible sources of ignition in airplane fuel tanks in order to comply with § 25.981 . Analy

tical evaluation of the fuel tank sy stem, including consideration of lessons learned from the transport airplane service history , provides insight into design features that should be carefully cons idered when determining compliance with the regulations that are intended to prevent ignition sources within fuel tanks. Prior to conducting a fuel s ys tem safety assessment (SSA) , each applicant should assemble and review relevant lessons learned from the overall transport fleet history , as described in this AC, as well as from their previous products, their suppliers, and any other available sources to assist in identifying any unforeseen failures, wear, or other conditions that could result in an ignition source. Sources of information include airplane service records, flight logs, inspection records, and component supplier service and sales records. Guidance relating to the flammability

requirements adopted in the amended § 25.981 is provided separately i n AC 25.981 - 2A . Guidance relating to fuel sy stem lightning protection is provided in AC 25.954 - X . 5.2 Safety

assessments of previously certificated fuel sy stems may require additional considerations. For these safety assessments, component sales records may as sist in identifying if component failures and replacement s are occurring. In addition, in some cases , changes to components have been introduced following original ty pe design certification without consideration of the possible effects of the changes on th e sy stem’s compliance with the requirements to prevent ignition sources. For example, certainmm/dd/yy D R A F T AC 25 .981 - 1X

4 components within fuel pumps have been changed to improve pump life, which defeated the original fail - safe features of the pumps. Therefore, results of reviewing this service history

information, and a review of any changes to components from the original type design, should be documented as part of the safety anal ys is of the fuel tank sy stem. 5.3 The following list summarizes fuel tank s ys tem design features, malfunctions, failures, and maintenance/operational - related actions that have been identified through service experience as resulting in a degradation of the safety features of airplane fuel tank sy stems. This list is provided as guidance and not inclusive of all failures that need to be considered in the failure assessment. They may assist in evaluating possible failure modes during evaluation of the fuel tank installation. 5.3.1 Pumps. 1. In gestion of pump inlet components (e.g., inducers, fasteners) into the pump impeller releasing debris into the fuel tank. 2. Pump inlet case degradation, allowing the pump inlet check valve to contact the impeller. 3. Failure of one phase of the stator winding during operation of the fuel pump motor together with subsequent failure of a second phase of the motor windings, resulting in arcing through the fuel pump housing. 4. Arcing due to the exposure of electrical connections within the pump housing that has been designed with inadequate clearance to the pump cover. 5. Omission of cooling port tubes between the pump assembly and the pump motor assembly during pump overhaul. 6. Extended dry

running of fuel pumps in empty fuel tanks, which was contrary to the manufacturer’s recommended procedures. 7. Use of steel impellers that may produce friction sparks if debris enters the pump. 8. Debris lodged inside pumps. 9. Pump power supply

connectors that have corroded resulting in fuel leakage and electrical arcing. 10. Electrical connections within the pump housing that have been designed with inadequate clearance or insulation from the metallic pump housing, resulting in arcing. 11. Thermal switches aging over time resulting in a higher trip temperature. 12. Flame arrestors falling out of their respective mounting. 13. Internal wires coming in contact with the pump rotating group, energizing the rotor , and arcing at the impeller/adapter interface. 14. Poor bonding across component interfaces. 15. Insufficient arc - fault or ground - fault current protection capability .mm/dd/yy D R A F T AC 25 .981 - 1X

5 16. Poor bonding of components to structure. 17. Loads from the airplane fuel - feed plumb ing transferred into the pump housing resulting in failure of the housing mounts and subsequent failure of the pump case, which defeated the explosion - proof capabilities of the pump. 18. Premature failure of fuel pump thrust bearings allowing steel rotating pa rts to contact the steel pump side plate. 5.3.2 Wiring to Fuel Pumps. 1. Wear of Teflon sleeving and wiring insulation on wires in metallic conduits located inside fuel tanks, allowing arcing from wire through the conduits into fuel tank ullages. 2. Damage to insulation on wiring routed adjacent to the fuel tank exterior surfaces that resulted in arcing to the metallic fuel tank surface. 5.3.3 Fuel Pump Connectors. 1. Electrical arcing at connections within electrical connectors due to bent pins or corrosion. 2. Fuel leakage and subsequent fuel fire outside of the fuel tank caused b y corrosion of electrical connectors inside the pump motor which led to electrical arcing through the connector housing (connector was located outside the fuel tank). 3. Selection of improper insulating materials in connector design resulting in degrading of the material because of contact with fuel that is used to cool and lubricate the pump motor. 5.3.4 Fuel Quantity Indicating Sy stem (FQIS) Wiring. 1. Degradation of wire insulation (cracking). 2. Conductive or semi - conductive (silver, copper , or cadmium) deposits at electrical connectors inside fuel tanks. 3. In adequate wire separation between FQIS wiring and structure or other wiring, causing chafing of the wiring. 4. Unshielded FQI S wires routed in wire bundl es together with high voltage wires, creating the possibility

of short circuit failures or induced current on the FQIS wires in excess of intrinsically

safe levels. 5. FQIS wiring that does not adhere to aircraft manufacturer’s standard wiring practices (i.e. , wires bent back along themselves with bend radius less than defined in the aircraft manufacturer’s standard wiring practices, multiple splices lying next to one another, etc.). 5.3.5 FQIS Probes. 1. Conductive or semi - conductive corrosion (copper or silver sulfur deposits) causing reduced breakdown voltage in FQIS wiring.mm/dd/yy D R A F T AC 25 .981 - 1X

6 2. Damage to FQIS wire insulation resulting in reduced breakdown voltage as a result of wire clamping features at electrical connections on fuel quantity probes. 3. Contamination in the fuel tanks creating an arc path for low levels of electrical energy between FQIS probe walls (steel wool, lock wire, nuts, rivets, bolts, and mechanical impact damage to probes). 5.3.6 Valve Actuators. Failure of one solenoid in a dual solenoid actuated valve resulting in over heating of one solenoid above the auto - ignition temperature. 5.3.7 Float Switch Sy stems. 1. Conduits containing float switch wiring failure due to freezing of water that entered the conduit, allowing fuel leakage into the conduit and along the airplane front spar resulting in an engine tailpipe fire. 2. Float switch wire chaffing observed , which might have provided potential for subsequent electrical short to the conduit. 3. Float switch sealing failure has allowed fuel/water to egress into the switch, compromising switch operation in an explosive environment. 5.3.8 Fuel Tubes, Vent Tubes, Conduits, Hydraulic Lines. 1. Poorly

conducting pipe couplings that may become electrical arc sources when exposed to electric currents. 2. Insufficient clearances between tubes and surrounding structure. 3. Intermittent electrical bonding in flexible couplers. 4. Bonded couplers unable to conduct expected power fault currents without arcing. 5.3.9 Electrical Generator Power Feeder Cables. 1. Arcing of electrical power feeder cables to a pressurized fuel line resulting in fire adjacent to the fuel tank. 2. Arcing of electrical power feeder cables to aluminum conduit resulting in molten metal dropping onto a pressurized fuel line causing leakage. 5.3.10 Bonding Straps. 1. Corrosion of bonding strap wires resulting in failure to p rovide required current paths. 2. In appropriately

attached connections (loose or improperl y grounded attachment points). 3. Static bonds on fuel sy stem plumbing connections inside the fuel tank worn due to mechanical wear of the plumbing from wing movement and c orrosion. 4. Corrosion of bonding surfaces near fuel tank access panels that could diminish the effectiveness of bonding features.mm/dd/yy D R A F T AC 25 .981 - 1X

7 5. Aging of self

- bonding fuel sy stem plumbing connections resulting in higher resistance bonding. 6. Missing bonds. 7. Loose or intermitt ent contacts between bond straps and other conductive components. 5.3.11 Pneumatic Sy stem Failures. Leakage of air from ducting located near fuel tanks due to duct failure resulting in undetected heating of tank surfaces above the auto - ignition temperature. 5.3.12 Electrostatic Charge. 1. U se of a non - conductive ty pe of reticulated poly

urethane foam in only

a portion of a fuel tank s ys tem that allowed electrostatic charge build - up and arcing in the unprotected portion of the sy stem. 2. Spraying of fuel through refueling nozzle s located at the upper portion of the tank. 6 **FUEL VAPOR IGNITION SOURCES.**  6.1 There are four primary phenomena that can result in ignition of fuel vapors from within airplane fuel tanks:  E lectrical arcs and sparks ,  F ilament heating,  F riction sparks, and  H ot surface ignition or auto - ignition. 6.1.1 The conditions required to ignite fuel vapors from these ignition sources vary with pressures and temperatures within the fuel tank and can be affected b y sloshing or spraying of fuel in the tank . Due to the difficulty i n predicting fuel tank flammability and eliminating flammable vapors from the fuel tank, the regulatory authorities have alway s assumed that a flammable fuel air mixture may exist in airplane fuel tanks and have required that no ignition sources be present. 6.1.2 Any

components located in or adjacent to a fuel tank must be designed and installed in such a manner that, during both normal and anticipated failure conditions, ignition of flammable fluid vapors will not occur . Compliance with this requirement is ty pically shown by a combination of component testing and anal ys is . Testing of components to meet the appropriate level of explosion - proof requirements may be carried out for various single failures, and combinations of failures, to show that arcing, sparking, auto ignition, hot surface ignition, or flame propagation from the component will not occur . Testing of components has been accomplished using several military standards and component qualification tests . For example, military standard MIL - STD - 810, Method 5 11, Procedure I and II, defines one method that has been accepted for demonstratingmm/dd/yy D R A F T AC 25 .981 - 1X

8 that a component is explosion proof . Section 9 of RTCA Document DO - 160F has also been accepted for demonstrating that airborne equipment is explosion proof. 6.2 **Electrical Spar ks**  **and Electrical Arcs.** 6.2.1 Laboratory

testing has shown that the minimum ignition energy in an electrical spark required to ignite hydrocarbon fuel vapor is 200 microjoules 1

. Therefore, for electrical or electronic sy stems that introduce electrical energy int o fuel tanks, such as FQIS , any electrical arcs or sparks that are created into any fuel tank should be less than 200 microjoules during either normal operation or operation with failures. **Note:** In the past some components have been qualified to standards that allow 320 microjoules, but this level is not acceptable for showing intrinsic safety. 6.2.2 To ensure that the design has adequate reliability and acceptable maintenance intervals, a factor of safety should be applied to this value when establishing a design limit. Fuel tank sy stems should be designed to limit the allowable energy level to the lowest practical level . Sy stems with a maximum energy of 20 microjoules are considered technologicall y feasible . Normal sy stems operations at minimum ignition energies of up to 50 microjoules would be acceptable . Under failure conditions, the sy stem should not have an ignition energy that would exceed 200 microjoules. 6.3 **Filament Heating Current Limit.** Analy ses and testing indicate a small piece of steel wool will ignite a flammable mixture when a current of approximately 100 milliamperes (mA) root mean square (rms ) is applied to the steel wool 2 . Therefore, for electrical or electronic s ys tems that intro duce electrical energy into fuel tanks, such as FQIS , the electrical current introduced into any fuel tank should be limited . Because there is considerable uncertainty associated with the level of current necessary to produce an ignition source from filament heating, a factor of safety should be applied to this value when establishing a design limit . A maximum of steady- state current of 25 mA rms is considered an intrinsically safe design limit for electronic and electrical systems that introduce electrical energy into fuel tanks . For failure conditions, limit the current to 50 mA rms and induced transients to 125 mA peak current. 6.4 **Friction Sparks.** Service experience has shown that pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, lockwire, roll pins, cotter pins, drill chips, and manufacturing debris, etc., have been inducted into fuel pumps and contacted the impeller resulting in the possibility

of metallic deposits on rotating and stationary components within the pump .

1 The 200 microjoule level comes from various sources . The most quoted is Lewis and VonElbe, “Combustion, Flames and Explosions of Gases,” that has a se t of curves for minimum ignition energy for the various hydrocarbon compounds in Jet fuel, and they all have similar minimum ignition energy levels of around220 microjoules. 2 This data was from testing performed by the FAA Technical Center, Report number DOT/FAA/AR - TN05/37. Applicants may conduct testing to substantiate alternate values.mm/dd/yy D R A F T AC 25 .981 - 1X

9 This condition has re sulted in creation of friction sparks and should be an assumed failure condition when conducting the SSA . Fail - safe features as described in paragraph 8.2.2 of this AC have been used to mitigate this hazard. 6.5 **Hot Surface Ignition.** 6.5.1 Maximum Surface Temperature. Guidance provided in AC 25 - 8, as well as the original release of this AC, define s surfaces that come within 50 degrees of the auto - ignition temperature of the fuel air mixture for the fluid as ignition sources . The FAA has historically accepted 400 °F for maximum surface temperatures inside fuel tanks for kerosene ty pe fuels . (Maximum surface temperature considerations for areas outside the fuel tank are di scu ssed in paragraph 8.3.6.3 of this AC.) For remote failure conditions of limited duration, it is acceptable to provide substantiation of actual hot - surface igniti on temperatures (note that this is different from the auto - ignition temperature of the fuel), and demonstrate a 50 °F margin below these temperatures. 6.5.2 Flammable Fluid Properties. Fuels approved for use on transport category airplanes have differing flammab ility characteristics . The auto - ignition temperature of JP - 4, as determined b y ASTM Test Method D286, is approximately 468 °F at one atmosphere of pressure . By this method of testing, under the same atmospheric conditions the auto - ignition temperature of J ET A (kerosene) is approximately 435 to 450 °F, and of gasoline, approximately 800 °F . The auto - ignition temperature of these fuels varies inversel y with the ambient pressure . In view of this, factors affecting the pressure in the fuel tank should be taken into consideration when determining compliance with § 25.981. 6.6 **Fuel System Electrostatics.** Electrostatic charges are generated in liquid hydrocarbons when they are in motion with respect to another surface such as fueling hoses, filters, nozzles, fuel tank structure and aircraft plumbing . The references in paragraphs B.1.5.1 and B.1.5.2 of this AC provide information on this subject . During airplane refueling, jet fuel is loaded either from a tanker truck or from an airport hydrant sy stem . Flowing fuel can generate an electrical charge especially

through fuel filtration . The accumulation of charge in the fuel is a function of many factors . If the fuel conductivity is low, the relaxation time for dissipation of the electrical charge is long . As a consequence, the fuel may accumulate an electrical charge inside an aircraft fuel tank . This electrical charge may produce a high potential on the fuel surface and an electrical disc harge to structure . This is particularl y a concern when large unbonded objects are located inside an airplane fuel tank . Smaller components may also become charged and this should be addressed in the safety assessment. If the vapor space fuel/air mixture i s in the flammable range, ignition of the mixture is possible, resulting in a fuel tank explosion and fire. 6.6.1 Charge accumulation is influenced b y many factors . Without a static dissipator additive, ty pical Jet A fuel has a low electrical conductivity . A static dissipator additive will increase the charging rate of fuel but at the same time greatl y improve the conductivitymm/dd/yy D R A F T AC 25 .981 - 1X

10 of the fuel to rapidl y dissipate the developed charge . Contaminants, considered as ionic impurities, enhance the charging tendency of the specific fuel . Fuels from different parts of the world and from different refineries will therefore have different charging tendencies based on the ty pes of contaminants present . Fuel static dissipat o r additives will increase the charging rate of fuel but at the same time greatl y improve the conductivity

of the fuel to rapidly

dissipate the developed charge . Water contamination, however, increases the charging tendency of the fuel without a corresponding increase in conductivity . The water interacts with th e additives or the naturally occurring contaminants in the fuel to provide this pro - static effect. Recognizing the dangers of water contamination, the National Fire Protection Association (NFPA) also cautions that when refueling, care should be taken to no t disturb the interface between the fuel remaining in the tank and the possible layer of water below it . Disruption of this interface up into the tank ullage/vapor space may lead to an electrical discharge capable of igniting a flammable fuel vapor/air mixture. Fuel tank inerting is one method of precluding this ignition source . However, for transport airplanes, this phenomenon are usually addressed b y incorporating an active water removal scavenge s ys tem for the fuel tanks and periodically sumping the tank s to remove the collected water to minimize the existence of the fuel/water interface. 6.6.2 Methods of minimizing the magnitude of the developed charge have been developed and are in place on transport airplanes including: 6.6.2.1 The refuel plumbing is sized and inclu des an orifice to maintain maximum

flow rates in accordance with the electrostatic guidelines established by the NFPA and the ASTM; and 6.6.2.2 Flow velocities of 6 to 7 meters per second are considered acceptable after

the discharge port is covered with fuel . The guidelines also indicate that the flow velocity should be held to less than 1 meter per second until the discharge port is covered with fuel. This criterion may be met by incorporating multiple refueling discharge ports, lowering the flow velocity through the use of piccolo tubes that distribute the fuel at low velocities in the tank, and locating them at or near the bottom of the tank . Location of the refueling discharge at the bottom of the tank minimizes fuel spray , a contributor to static charge development, and provides for the ports to be covered b y fuel reserves in main tanks and in the earl y stages of fuel flow as the refuel rate varies from 1 meter per second up to the full flow of 6 to 7 meters per second in normall y emptied tanks. **Note:** It may

no t be practical to develop a dual flow rate refueling s ys tem so limiting the refueling velocities to less than one meter per second through the use of multiple discharge points and piccolo tubes may be one way to address these design guidelines. 6.6.3 Methods of relaxing the charge have also been developed . Bonding straps are used on fuel components and plumbing lines to allow the charge to dissipate to the tank structure . During refueling, the airplane is bonded to the refueling vehicle with a separate bonding wire to provide an electrical path back to fuel filtration, which is themm/dd/yy D R A F T AC 25 .981 - 1X

11 principal electrostatic charge generator . A static dissipat o r fuel additive may also be used to increase fuel conductivity , to quickly dissipate the developed charge . However, the FAA d oes not require this ty pe of additive, unless it is specified as part of the ty pe design approval . Any limitations on use of an anti - static additive would need to meet the requirements of § § 25.1521 and 25.1557. 6.6.4 Applications of the above methods and adherence to industry practices and guidelines on electrostatics should be identified for each airplane model . Airline operation and practices regarding airplane refueling should also be evaluated to verify that the procedures necessary

for safe operation of the specific airplane model are in place and followed . Restrictions, if any , on refuel rates, fuel properties, and the requirement for fuel additives should be identified as CDCCL s . 6.6.5 Poly

urethane reticulated foams used for ignition suppression within fuel tank s and other non - conducting objects may accumulate and retain charge . These items may have to be treated with antistatic additives to prevent charge accumulation. 7 **DESIGN CONSIDERATION S.**  7.1 **Accepted Design Practices for Minimizing Ignition Sources.** The number o f components and sy stems inside airplane fuel tanks whose failure could result in an ignition source within the fuel tank should be minimized . For example: 7.1.1 Fiber Optics . Wiring entering the tank for such purposes as temperature monitoring and fuel quantity indication should be minimized . Use of new technology , such as fiber optics, may provide a means of reducing or eliminating electrical powered components from inside the fuel tanks. 7.1.2 Routing of Pump Power Supply . If practical, fuel pumps should be located such that electrical power for the pumps is routed outside the fuel tanks in such a manner that failures in the electrical power supply cannot create a hot spot inside the tank or arc into the fuel tank . While routing of the fuel pump power supply outside of the fuel tank, and away from the fuel tank walls, may eliminate the potential for arcing directly into the fuel tank or heating of tank surfaces, the failure analysis should consider the need for electrical circuit protective devices . For example, arcin g at the pump electrical connector has resulted in uncontrolled fuel leakage, an ignition source, and an uncontrolled fire outside of the fuel tank . This failure mode as well as any pump electrical failures, such as failure of the pump wiring is routed inside metallic conduit inside the fuel tank, redundant protection means would be required to prevent an arc of the wiring to the conduit from penetrating into the fuel tank . A practical means to achieve this is to provide sleeving of the wiring and an ind ependent means such as a GFI or AFCB . Providing multiple layers of sleeving alone would not be considered acceptable since wear could defeat the multiple layer protection.mm/dd/yy D R A F T AC 25 .981 - 1X

12 **Note:** Electromagnetic environment and induced transients that may damage the wiring or pump should be considered in the design of the pump wiring s ys tem and when showing compliance. 7.1.3 Location of the Pump Inlet. Debris that may

enter a fuel pump inlet can cause sparks inside the fuel tank . One means to address this ignition source has been to loc ate the pumps such that the pump inlet remains covered with fuel at any time the pump is operating within the airplane operating envelope . Another means has been preventing the propagation of any ignition from the pump into the fuel tank by use of flame ar

restor technology . (The performance of the flame arrester should be validated b y test to verify its effectivene ss at stopping a flame front.) Any protective means including those shown below should be effective under pitch, roll attitudes, and negative G c onditions anticipated to occur in service. 7.1.3.1 Main Feed Tanks.

Installation of baffles in tank structure and use of collector tanks that are continually

filled with fuel using ejector pumps are methods that have proven successful at keeping the pump inlets an d pump housings submerged in fuel. 7.1.3.2 Auxiliary

Tanks. For auxiliary

tanks that use motor driven fuel pumps and that are routinely emptied, accepted design practices include shutting off the motor driven pumps prior to uncovering the fuel pump inlet and installation of a flame arrestor in the scavenge pump inlet line, or scavenging the r emaining fuel with ejector pumps. (Note that installation of features such as a flame arrestor in the fuel s ys tem would need to be shown to meet fuel s ys tem performance requirements in § 25.951.) 7.1.4 Wiring. The following paragraphs on wiring represent accepta ble approaches for dealing with wiring used in and near fuel tanks . For specific requirements and further guidance, the applicant should review the wiring installation and design requirements in the new Electrical Wiring Interconnect Sy stems (EWIS) rules, Amendment 25 - 123, and associated advisory

circulars. 7.1.4.1 Intrinsically s afe w iring.

All wiring that is intended to conduct intrinsically safe levels of electrical power into or through the fuel tanks should incorporate protective features that prevent exceedin g the intrinsically safe levels discussed in paragraphs 6.2 and 6.3 of thi s AC. This wiring should also be protected from h igh i ntensity radiated f

ields (HIRF) induced transients . The following protective features could be used to support that objective: 7.1.4.1.1 Separation and shielding of the fuel tank wires from other airplane wiring

and circuits, and interference, andmm/dd/yy D R A F T AC 25 .981 - 1X

13 7.1.4.1.2 Shielding for HIRF and other electromagnetic interference (EMI). 7.1.4.1.3 Installation of transient suppression devices, to preclude unwanted

electrical energy

from entering the tank. 7.1.4.2 Higher energy w iring , which i ncludes all wiring that is not intrinsically

safe. 7.1.4.2.1 Wiring should not be routed through metallic conduit inside the fuel tank

or adjacent to fuel tank surfaces such that damage, inappropriate maintenance, or other failure/wear conditio ns could result in arcing to the conduit or metallic tank surface and development of an ignition source in the fuel tank . If metallic or other conductive conduit materials are used, the single failure of electrical arcing of the wiring to the conduit, adjacent tank surfaces, or structure should be assumed to occur . In addition, circuit protective features or other features should be incorporated to preclude development of an ignition source in the fuel tank . Methods that may be used to address this foreseea ble failure condition include the use of circuit protective features such as dual conduits, thick wall conduit, and/or fast acting AFCB or GFI circuit breakers. 7.1.4.2.2 Where electric wires are routed through metallic conduits installed in a

fuel tank, high surfac e temperatures or arcing through the conduit wall can be created b y short circuits . All wiring conducting levels of power that exceed intrinsically

safe levels (e.g., fuel pump power suppl y) into or through a fuel tank should be evaluated assuming arcing t o adjacent surfaces such as metallic conduits or wing surfaces, unless fail - safe protective features are provided . A critical electrical wiring condition might be one in which the insulation is worn, cracked, broken, or of low dielectric strength, allowing intermittent or constant arcing to occur without consuming enough power to cause the circuit protection device to open . Inspection of wiring from in - service airplanes has shown that greater than expected wear may occur on sleeving and wiring insulation du e to movement of the wire within the conduit . Roughness of the conduit material and variations in vibration levels for each installation may significantl y increase wear . In addition, inspections have shown that protective sleeving has been missing, imprope rly installed, or the wrong sleeving material used, resulting in damage to the insulation . For these reasons, use of protective sleeving on wiring would not by itself be adequate for showing compliance . The design should be tolerant to these ty pes of fores eeable failure or maintenance errors. **Note:** AC 25 - 8 addresses the use of metallic conduit as an acceptable means for routing of electrical power within airplane auxiliary fuel tanks. As indicated above, these past practices would not meet the fail - safe requirements of § 25.981 for any fuel tank, unless additional fail - safe features were incorporated. Therefore, the more recent guidance in thismm/dd/yy D R A F T AC 25 .981 - 1X

14 AC, and rulemaking in Amendment 25 - 102 supplements the guidance in AC 25 - 8. 7.1.4.3 Wire s eparation.

Wiring designs used on trans port airplanes vary significantly

between manufacturers and models; therefore, it is not possible to define a specific universal separation distance or the characteristics of physical barriers between wire bundles to protect critical wiring from damage. Separation requirements for wiring and other components of EWI S are contained in § 25.1707, (the regulatory defini tion of an EWI S is provided in § 25.1701) . Advisory

Circular 25.1701 - 1, Certification of Electrical Wiring Interconnetion Systems on Transport Category Airplanes , paragraph 5d, contains guidance on determining adequate separation distance between EWI S and between EWI S and airplane s ys tems and structures . Even if § 25.1707 is not in the ty pe certification basis of the airplan e being modified, the guidance contained in the AC should still be applied, along with the guidance contained in this AC, when determining adequate separation distance . Intrinsicall y safe wiring for fuel tanks needs to be protected from induced currents ca used b y power s ys tem switching transients, or EMI due to close proximity to other airplane wiring. In addition, damage to wire insulation can result in unwanted electrical energy being transmitted into the fuel tank, if the damaged wire can come into contact with the conductor of another wire that is not intrinsically safe. Of particular concern is the possibility of a wire bundle fire that exposes and breaks wires that are not intrinsicall y safe and also damages the insulation of intrinsically safe wiring that is in close phy sical proximity . The broken wires may still be energized and could contact conductors of the damaged intrinsically safe wire. If phy sical separation is used to protect intrinsically safe fuel s ys tem wiring from other wiring or to protec t fuel tank walls from high power wiring, the minimum physical separation must be established by the applicant. The applicant should conduct an anal ys is to verify that current and energies greater than those specified in paragraphs 6.2 and 6.3 of this AC will not be applied to intrinsically

saf e wiring, considering the factors listed below . The following is based on the guidance contained in paragraphs 5d(3) and (4) of AC 25.1701 - 1. 7.1.4.3.1 The electrical characteristics, power, and criticality of the signals in the

wire bundle and adjacent wire bundles , 7.1.4.3.2 Installation design features including the number, ty pe, fire resistance and location of support devices along the wire path of the intrinsically safe wire and adjacent higher power wires, 7.1.4.3.3 The maximum amount of slack wire resulting from wire bundle build

tolerances and other wire bundle manufacturing variations,mm/dd/yy D R A F T AC 25 .981 - 1X

15 7.1.4.3.4 Probable variations in the installation of the intrinsically safe fuel sy stem wiring and adjacent wiring, including the position or omission of wire support devices and the amount of slack wire th at is possible, 7.1.4.3.5 Expected operating environment including the amount of deflection or

relative movement that can occur and the effect of a failure of a wire support device, or a broken wire, or other methods used to maintain phy sical separation, 7.1.4.3.6 The effects of wire bundle fires, 7.1.4.3.7 Maintenance practices as defined b y the airplane manufacturer’s standard

wiring practices manual and the ICA required b y § § 25.1529, 25.1729, 26.11(b), and 26.11(c) as applicable, and 7.1.4.3.8 Possible EMIor HIRF effects.

**Note:** Some areas of an airplane may have localized areas where maintaining the minimum phy sical separation distance is not feasible. This is especiall y true in smaller transport category airplanes. In those cases, other means of ensuring equivalent minimum phy si cal separation may be acceptable, if testing or analy sis demonstrates that safe operation of the airplane is not jeopardized. The testing or anal ys is program should be conservative and consider the worst possible condition not shown to be extremely improba ble. The applicant should substantiate to the aircraft certification office that the means to achieve the necessary separation provides the necessary

level of protection for wire related failures. EMI protection must also be verified. 7.1.4.4 Inspection.

Means sho uld be provided to allow for the visual inspection of the wiring, phy sical barriers and other phy sical means of protection . Non - destructive inspection aids may

be used where it is impracticable to provide for direct visual inspection if it is shown that th e inspection is effective and the inspection procedures are specified in the maintenance manual required b y § § 25.1529, 25.1729, 26.11(b), and 26.11(c). 7.1.4.5 Id entification.

Means must also be provided so EWI S wires are readily identified and visible to mainten ance, repair, or alteration personnel . The method of identification must remain legible throughout the airplane’s operational life . The complete regulatory requirements for EWI S identification are contained in § 25.1711. 7.1.4.6 Circuit b reakers.

Service experience has indicated that thermal mechanical circuit breakers installed in the fuel pump circuits have not been shown to preclude arcingmm/dd/yy D R A F T AC 25 .981 - 1X

16 of electrical wiring through metallic barriers such as conduit, fuel pump housings, electrical connectors, or the tank wall into the fuel tank on some airplane designs . Evidence suggests that arcing from the wiring to metallic surfaces may

not result in a hard short, which would trip the circuit breaker and may

result in intermittent low level arcing that gradu all y arcs through the metallic barrier into the fuel tank. For these failure conditions circuit protective devices such as AFCB or GFI may be needed to provide fail safe features necessary to demonstrate compliance. Appendix A to this AC provides guidance for certification of AFCB or GFI . 7.1.4.7 Use of n onmetallic c onduit.

If nonmetallic conduit is used, compatibility with fuel should be demonstrated . The nonmetallic condui t should be evaluated for the effects of aging due to heat, corrosion at the connecting fittings, and resistance to heat damage from internal shorts of wires routed within the conduit. 7.1.4.8 Wire s plices.

Splices in fuel sy stem wiring have been allowed as a stan dard repair procedure . The acceptability of splices will be based upon the s ys tem design and fail - safe features . The safety assessment may show that splices in fuel tank sy stem wiring, such as fuel quantity indicating wiring within the fuel tank and fuel p ump windings, are prohibited . This would be defined as a CDCCL . 7.1.4.9 Use of s ilver in f uel t anks. Silver can combine with sulfur or water and form silver - sulfide or oxide deposits between exposed conductors (terminal block connections, etc.) . The silver- sulfide deposits reduce the resistance between conductors and can ignite fuel vapor when exposed to very low levels of electrical energy . If use of silver in electrical components and wiring in the tank is determined to be critical, it should be defined as a CDCC L . The energy levels that have been shown to ignite fuel vapor during laboratory tests approach the levels normally used on FQIS wires and probes. This issue must be carefully

addressed. 7.1.4.10 Use of s teel w ool.

Steel wool has been used as a cleaning tool to remove corrosion and clean parts inside the fuel tanks . Steel wool creates small conductive filaments that can cause ignition sources in the fuel tank if the steel wool comes in contact between conductors in fuel tank quantity gauging sy stem components . Fo r this reason design approval holders ty picall y do not allow the use of steel wool inside fuel tanks and recommend using other abrasives. (However, as stated in paragraph 8.3.4 in this AC , the presence of conductive debris , such as steel wool , should be as sumed when performing the fuel tank ignition prevention analysis.)mm/dd/yy D R A F T AC 25 .981 - 1X

17 8 **SAFETY ANALYSIS .**  8.1 **Ignition Source Failure Analysis.** Compliance with § 25.981 requires each applicant to develop a failure analysis for the fuel tank installation to substantiate that ignitio n sources will not be present in the fuel tanks . The requirements of this section are in addition to the more general propulsion failure anal ys es requirements of § § 25.901 and 25.1309 that have been applied to propulsion installations. 8.1.1 Section 25.981(a)(3) defines three failure scenarios that must be addressed in order to show compliance with the rule: 8.1.1.1 Each single failure, regardless of the probability of occurrence of the failure, must not cause an ignition source. 8.1.1.2 Each single failure, regardless of the probability of occurrence, in combination with any

latent failure condition not shown to be at least extremely remote (i.e., not shown to be extremely remote or extremel y improbable), must not cause an ignition source. 8.1.1.3 All combinations of failures not shown to be extremely improbable must not cause an ignition source. 8.1.2 Compliance with § 25.981 (Amendment 25 - 102) requires analy sis of the airplane fuel tank sy stem using anal ytical methods and documentation currentl y used b y the aviation industry in demonstrating compliance with §§ 25.901 and 25 . 1309 with consideration of unique requirements included in the amendment. 8.1.3 SAE document ARP 4761, Sy stem Design and Analy sis, describes methods for completing an SSA . An assessment may range from a simple report that offers descriptive details associated with a failure condition, interprets test results, compares two similar sy stems, or offers other qualitative information, to a detailed failure anal ys is that may include estimated numerical probabilities . The depth and scope of an acceptable SSA depend upon: 8.1.3.1 The complexity and criticality

of the functions performed b y the s ys tem under consideration ; 8.1.3.2 The severity of related failure conditions ; 8.1.3.3 The uniqueness of the design and extent of relevant service experience ; 8.1.3.4 The number and complexity of the identified causal failure scenarios ; and 8.1.3.5 The detectability of contributing failures. **Note:** Sections 25.981 and 25.901 are intended to address sy stem failures that may result in the presence of an ignition source in the fuel tanks .mm/dd/yy D R A F T AC 25 .981 - 1X

18 These regulations are not intended to address failures or conditions that could lead to ignition of fuel vapors from such sources as:  Uncontained engine debris ;  E xternal engine fires following engine separation or failure ;  D amage resulting from explosive materials, such as bombs ;  P ost - crash fire heating of tank surfaces ; or  P ropagation of fire through the airplane vent system into the fuel tanks. 8.1.4 These hazards are addressed by other regulations. 8.2 **Qualitative Safety Assessment.** 8.2.1 Ty

pical airplane fuel tank sy ste ms have a limited number of possible ignition sources . Figure 1 shows some causes of ignition sources and methods that may be used to meet the fail - safe requirements . The level of anal ys is required to show that ignition sources will not develop will depend upon the specific design features of the fuel tank sy stem being evaluated . Detailed quantitative anal ys is should not be necessary if a qualitative safety assessment shows that features incorporated into the fuel tank system design protect against the deve lopment of ignition sources within the fuel tank s ystem . For example, if intrinsically

safe FQIS wiring entering the fuel tanks and the associated line replacement unit ( LRU) were shown to have protective features such as separation (including circuit separation in the LRU) and shielding and/or transient suppression/energy

limiting devices, the portion of the compliance demonstration for the associated wiring would be limited to demonstrating the effectiveness of the features and defining any long - term maintenance requirements including mandatory replacement time, inspection interval, related inspection procedure , or CDCCL so that the protective features are not degraded. 8.2.2 Another example would be installation of a flame arrestor in the inlet line to a fuel p ump . The compliance demonstration for the fuel pump may be limited to showing that the arrestor was effective at precluding propagation of the flame from the pump back down the inlet line into the tank, and showing that any anticipated failures or events c ould not violate the explosion - proof features of the pump assembly . In addition, revalidation of the fuel sy stem to other regulations (e.g., icing and reduced flow due to contamination) would be required if modifications were incorporated into the fuel fee d sy stem . It may

also be possible to show that fuel pumps installed such that the fuel pump inlet remains covered whenever the fuel pump is operating throughout the airplane operating envelope (as discussed earlier), including anticipated low fuel operatio ns and ground conditions, would be a satisfactory method of meeting the fail safe requirement for the failure mode of arcing into the tank ullage (consideration of other failure modes, such as the effects of electrical arcing external to the fuel tank, at the connectors, etc . , would need to be addressed) . The SSA criteria, process, anal ys is methods, validation, and documentation should be consistent with the guidance materialmm/dd/yy D R A F T AC 25 .981 - 1X

19 provided in SAE document ARP 4761, utilizing the unique guidance specific to the f uel tank sy stem as defined in this AC. **Figure 1**  **: Example**  **s of Fuel Tank**  **Ignition Source Considerations** 

8.3 **Assumptions and Considerations for Fuel Tank System Analysis.** The anal ys is should be conducted based upon the following assumptions: 8.3.1 Fuel Tank Flammability . The anal ys is should assume that the environment inside the fuel tank is alway s flammable . The conditions required to ignite fuel vapors from ignition sources vary with pressures and temperatures within the fuel tank and can be affected by sloshing or spraying of fuel in the tank . Due to the difficulty i n predicting fuel tank flammability, the FAA has alway s assumed that a flammable fuel air mixture exists in airplane fuel tanks and has required that no ignition sources b e present . The s ys tem safety analysis should be prepared considering all airplane in - flight, ground, service, and maintenance conditions, assuming that an explosive fuel air mixture is present in the vapor space of fuel tanks and vent s ys tems at all times, unless the fuel tank has features that mitigate the effects of tank ignition (e.g., pol yurethane foam). 8.3.2 Failure Condition Classification. Unless design features are incorporated that mitigate the hazards resulting from a fuel tank ignition event (e.g., po ly urethane foam, adequate structural margin), the SSA should assume that the presence of an ignition source is a catastrophic failure condition.mm/dd/yy D R A F T AC 25 .981 - 1X

20 8.3.3 Latent Failures. 8.3.3.1 In order to eliminate any ambiguity as to the restrictions on latent failures,

§ 25.981(a)(3) explicitly

requires that any anticipated latent failure condition not leave the airplane one failure away from a catastrophic fuel tank ignition . In addition to this § 25.981(a)(3) limitation on latency, § 25.1309(c) limits latent failure conditions to tho se that do not create an “unsaf e s ys tem operating condition.” Consequently, if a latent failure condition is not extremely remote (i.e., it is anticipated to occur) and it creates an “unsafe s ys tem operating condition,” then “warning information must be provided to alert the crew...and to enable them to take a ppropriate corrective action.” These applicable regulatory restrictions on latency notwithstanding, there are practical limitations on the available means of compliance . For example, detecting a failure condition requires a finite period of time and there are not alway s “appropriate corrective actions” that can be taken during the flight . Consequentl y, for the purposes of compliance with § 25.981(a)(3), the period of latency for any anticipated significant latent failure condition should be minimized and not allowed to exceed one flight cycle . For the purposes of § 25.1309(c) compliance, any time the airplane is operating one failure away from a catastrophic fuel tank ignition should be considered an “unsa fe system operating condition,” recognizing that sometimes the only “appropriate corrective action when problem detection is available is to continue on to your destination but not to initiate another flight without making appropriate repairs.” 8.3.3.2 Another pra ctical limitation on the available means of compliance is the

technological feasibility

of providing inherent failure detection within the design for all significant failures . Sometimes periodic inspection is the only practicable means of reliabl y detectin g a failure condition . Consequently , when such inspections are identified within the anal ys is as the means of detection, the inspection method and frequency must be sufficient to conclude that the occurrence of the significant latent failure condition is e xtremely

remote. 8.3.3.3 Any mandatory replacement time, inspection interval, related inspection procedure, and all CDCCL s identified to prevent development of ignition sources within the fuel tank sy stem should be identified in the A irworthiness L imitations section of the ICA as a fuel sy stem limitation . If this means is used, the A irworthiness L imitations section should include the following: 8.3.3.3.1 A designation of the maintenance actions and alterations that must be

inspected (critical inspections), including at least those that could result in a failure, malfunction, or defect endangering the safe operation of the aircraft, if not performed properl y or if improper parts or materials are used.mm/dd/yy D R A F T AC 25 .981 - 1X

21 **Note:** A validation inspection should be conducted to reaffirm all or a porti on of the initial inspection requirements for those critical inspections that, if not performed properly or if improper parts or material are used, could result in a failure, malfunction, or defect endangering the safe operation of the airplane . For those air carriers that use a mechanic for the initial inspection, an inspector should be used to conduct the validation inspection . For those air carriers that use an inspector for the initial inspection, another qualified inspector should be used to conduct th e validation inspection. 8.3.3.3.2 Procedures, standards, and limits necessary for critical inspections and acceptance or rejection of the items required to be inspected, and for periodic inspection and calibration of precision tools, measuring devices, and test equipment. 8.3.4 Failure Conditions. When showing compliance with § 25.981(a)(3), the effects of manufacturing variability , aging, wear, corrosion, and likely damage must be considered. For the purpose of compliance with § 25.981, “extremely remote” failure conditi ons are those not anticipated to occur to each airplane during its total life, but which may occur a few times when considering the total operational life of all airplanes of one type . This definition is consistent with that developed b y the Aviation Rulem aking Advisory Committee (ARAC) for a revision to FAA AC 25.1309 - 1A . “Extremely improbable” failure conditions are those so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one ty pe . This definition is consistent with the definition provided in AC 25.1309 - 1A . Li kely damage is damage that , using engineering judgment or past experience , would lead one to conclude that an occurrence is foreseeable . Examples of likely damage are: a wire bundle located where a mechanic could use it as a hand hold; an instrument located where , if someone dropped a wrench, damage would result; or a fuel probe located where a mechanic could use it as a step in the tank, etc. 8.3.4.1 The anal ys is should be conducted considering the defici encies and

anomalies listed in paragraph 5.3 of this AC, failure modes identified by the review of service information (including review of supplier service data), and any other failure modes identified b y the functional hazard assessment of the fuel tank sy stem . For example, the presence of conductive debris such as lockwire, steel wool, nuts, bolts, rivets etc., should be assumed . Section 25.981 specificall y requires that the effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered when demonstrating complianc e . Credit for fail - safe features must be substantiated . 8.3.4.2 The level of manufacturing variability , aging, wear, corrosion, and likel y

damage that must be considered should be determined based upon evaluation of the detectability of degraded or out - of

- specific ation configurations, and established and documented within the analy sis . In -mm/dd/yy D R A F T AC 25 .981 - 1X

22 service and production functional tests, component acceptance tests, and maintenance checks may be used to substantiate the degree to which these states must be considered . For ex ample, inspection of fuel tank s ys tem bonding on production airplanes has shown that some bonds were inadequate . Functional testing of all bonding was incorporated to address this deficiency . In some cases (e.g., component bonding or ground paths), a degraded state will not be detectable without periodic functional test of the feature . For these features, inspection/test intervals should be established based on previous service experience on equipment installed in the same environment . If

previous experienc e on similar or identical components is not available, conservative initial inspection/test intervals should be established until design maturity can be assured. 8.3.5 External Environment. The severity of the external environmental conditions that should be con sidered when demonstrating compliance with § 25.981 are those established by certification regulations and advisory . 8.3.6 External Sources of Tank Auto - ignition. The possibility

of fuel tank ignition due to surface - ignition sources created by external tank heating should be considered. This includes heating of the tank due to operation or failure of s ys tems outside the tank within both the pressurized and unpressurized areas of the airplane, such as overloaded electric motors or transformers, failures in the pneumatic sy stem and/or ducting that could cause localized heating of tank surfaces. In addition, the possibility

of localized heating due to external fires must be considered. 8.3.6.1 Section 25.967(e) requires that, “Each fuel tank must be isolated from

personnel c ompartments by a fume proof and fuel proof enclosure.” Leakage of fuel or vapor into spaces adjacent to the fuel tank, where a secondary fuel and fume - proof barrier is not provided, has typicall y been assumed for areas such as:  The wing leading (including any adjacent compartment such as the strut) and trailing edges,  F airings located below the fuel tanks,  F uel pump enclosures, and  Unpressurized areas of the fuselage surrounding fuel tanks located in the empennage. 8.3.6.1.1 Components located in these areas have been required to meet explosion proof requirements . These components or s ys tems must be included in the anal ys is . Examples of equipment include, but are not limited to, environmental c ontrol s ystem (ECS) air conditioning packs, motors, power assisted valve s, fuel pumps, hydraulic pumps/motors, certain flight control actuators, ECS controls, wiring and valves.mm/dd/yy D R A F T AC 25 .981 - 1X

23 8.3.6.2 A safety review of flammable fluid leakage zones adjacent to fuel tanks

will be needed to determine that the design complies with the requirements of §§ 25.863(a) and 25.981. In general, the fire protection philosophy

for any area considered a flammable fluid leakage zone is to assume that flammable vapors may be present in the zone and to minimize the probability

of ignition of vapors ( § 25.863(a)) . Th is has ty picall y been accomplished b y using combinations of the following design considerations:  Grounding and bonding of electrical equipment,  Q ualification of electrical equipment as explosion proof,  S ealing of electrical connectors,  P roper support, prot ection and separation of wiring,  D rainage provisions in the leakage zone,  V entilation of the leakage zone in - flight, and areas around auxiliary tanks, and  Immediate maintenance action to correct running leaks in these areas. 8.3.6.3 Surface temperatures in areas adjacent to fuel tanks.

The FAA has approved installations, where surfaces adjacent to the tank experience temperatures in excess of the internal fuel tank surface temperature limit. Manufacturers have substantiated that the conditions (ambient pressure, dwell time, fuel ty pe, etc.) within these areas are such that a higher value may

be used. For example, a maximum allowable surface temperature of 400 °F, with a transient excursion up to 500 °F for a maximum duration of two minutes, has been accepted for certain pneumatic sy stem installations. The excursion above 400 °F occurs onl y during failure conditions such as failure of the engine pneumatic s ys tem to regulate temperature, or duct rupture. Approval of these elevated temperatures has been based on compen sating design features, such as an over- temperature shutoff of the pneumatic s ys tem so that the surface temperatures adjacent to the tank cannot exceed the surface ignition temperature justified for the fluid ty pe including the effect of local airflow and ventilation conditions within the zone, e.g., the 500 °F value . Internal tank surface temperatures resulting from the failure should not exceed the surface temperature limit for the fuel type used as described in paragraph 6.5 of this AC. 8.3.7 Electrical Ignition Sources. The applicant should perform a failure analy sis of all fuel sy stems and subsy stems with wiring routed into fuel tanks . Systems that should be considered include fuel pump power and control and indication, fuel quantity indication, fuel temperature indication, fuel level sensors, and any other wiring routed into or adjacent to fuel tanks . The anal ys is should consider sy stem level failures, failures within LRUs and componentmm/dd/yy D R A F T AC 25 .981 - 1X

24 level failures discussed below . The analy sis should include existence of latent failures and subsequent failures that may lead to an ignition source within the fuel tank. Examples include undetected failures of tank compo nents or wiring, the undetected presence of conductive debris, damage to FQIS or level sensor probes, or corrosion, in combination with external failures such as hot shorts or EMI . In addition, the applicant should provide a description of the protective m eans employed in the fuel sy stem wiring . This should include a description of features such as separation/segregation, transient suppression devices, shielding of wiring, and methods employed to maintain configuration control of critical wiring throughout the life of the airplane. 8.3.8 Electrical Short - Circuits. 8.3.8.1 One method that may provide protection of circuits that enter fuel tanks is the incorporation of a transient suppression device (TSD) on the circuit close to the point where those wires enter fuel tanks . Consideration should also be given to protection of wiring between the TSDs and the tank if the protection devices are not located at the tank entrance, and also to the possibility

of transients being induced in the wiring between the TSDs and the electri cal devices in the fuel tanks . Caution should be exercised when using TSDs to be sure that the TSD addresses both voltage and current suppression. 8.3.8.2 Another method of protection that has been used to provide a fail - safe

design with respect to electrical shor ts is separation of wiring to electrical devices in the fuel tanks from other electrical power wires and circuits, combined with shielding between wiring that enters fuel tanks and any other electrical power- carrying wires in the aircraft installation. The effects of electrical short circuits, including hot shorts, on equipment and wiring that enters the fuel tanks should be considered, particularl y for the FQIS wiring, fuel level sensors, and probes . Latent failures from factors such as contamination, dama ge/pinching of wires during installation, or corrosion on the probes, connectors, or wiring should be considered when evaluating the effects of short circuits . The wire routing, shielding, and segregation outside the fuel tanks, including within the FQIS c omponents (e.g., gauging units), should also be considered when evaluating the effects of short circuits. The evaluation should consider both electrical arcing and localized heating that may result from short circuits on equipment, FQIS probes, and wiring . The evaluation of electrical short circuits should include consideration of shorts within electrical equipment, and wiring from the equipment into the fuel tank . Prevention of fuel ignition from electrical shorts to wiring that enters fuel tanks may require specific wire and circuit separation and wire bundle shielding. 8.3.9 LRU Design Evaluation. The design review should include evaluation of the separation and/or protective features incorporated into any fuel sy stem LRU whose failure could result in high lev el electrical power (above intrinsically safe levels) entering the fuel tank . For example,mm/dd/yy D R A F T AC 25 .981 - 1X

25 circuit board failures could cause the fuel quantity gauging s ys tem LRU power suppl y circuits to come into contact with circuits that lead into the fuel tank, resulting in a possible ignition source . Failures that can lead to violating separation within the LRU can be external and internal events. External failures include over voltage or over current, high humidity , temperature, vibration, shock, and contamination. Internal failures include manufacturing defects or flaws in the conductor, substrate or coating . To address these failures isolation and phy sical separation between critical signals should be provided, or adequate protective features, such as transient supp ression devices as discussed earlier, should be provided to protect the circuits that enter the fuel tank. Any LRU that meets the design requirements identified in reference (3), paragraph B.1.5.2 of this AC, Underwriters Laboratories Inc., UL913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations , is considered acceptable, provided the fol lowing issues are addressed. Ideall y, higher power circuits within the LRU should not be located on the same circuit board or in a wire harness or electrical connector with intrinsically safe circuits or wiring . There should be a physical barrier between c ircuit boards to isolate the intrinsically

safe circuits from the effects of broken components or fire within the LRU . If limiting devices are installed on the same circuit board in series with sy stem circuitry to limit the amount of power or current trans mitted to the fuel tank, there should be three inches between the traces, unless the manufacturer can justify a smaller separation on the basis that the effects of fire on the circuit board will not compromise the intrinsically

safe circuit(s). 8.3.10 Electromagn etic Effects including EMI and HIRF . Refer to AC 25.954 - X for guidance in establishing compliance to requirements for fuel sy stem protection from lightning effects. 8.3.10.1 The effects of EM I or HIRF on anything conductive (e.g., fuel tank

plumbing, structure, fuel, equipment and wiring) within the fuel tanks should be considered, particularly for the FQIS wiring and probes . Latent failures from factors such as contamination, damage, or corrosion on the probes or wiring should be considered when evaluating the effects of electrical transients . The wire routing, shielding, and segregation of conductors (e.g., plumbing, component casings, wiring, etc.) outside the fuel tanks sho uld also be considered when evaluating the effects of electrical transients, because the transient generation and coupling to conductors may

occur outside the fuel tanks . The evaluation should consider both electrical sparks and arcs and localized heating that may result from EMI and HIRF on the fuel tank sy stem, FQIS probes, and wiring. 8.3.10.2 Latent failure of electromagnetic protection features, such as shielding

termination corrosion, shield damage, and transient limiting device failure should be considered an d appropriate indication or inspection intervals established to prevent the existence of latent failure conditions . The failure of other s ys tem components may also affect protection against EMI .mm/dd/yy D R A F T AC 25 .981 - 1X

26 Consequently , the effect of any anticipated failure on the continued environmental protection should be considered. 8.3.10.3 The evaluation of electromagnetic effects from EMI or HIRF should be based on the specific electromagnetic environment of a particular aircraft model. Standardized tests, such as those in RTCA DO - 160 , Sections 19, 20, and 22, are not sufficient alone, without evaluation of the characteristics of the specific electromagnetic environment and induced transient levels assigned to sy stems installed within a particular airplane model, to show that appropriate standardized RTCA document DO - 160 test categories, procedures and test levels are selected . Simulation of various latent failures of fuel sy stem components within the tanks may be required to demonstrate the transient protection effectiveness . Effectiveness of the transient protection features should be verified using the appropriate RTCA document DO - 160 test procedures and test levels determined above. 8.3.10.4 Prevention of fuel ignition due to EMI or HIRF may require specific wire segregation and separation, w ire bundle shielding, or transient suppression for wires entering fuel tanks . Effectiveness of the transient protection features should be verified using the appropriate RTCA document DO - 160 test procedures and test levels determined above. 8.3.10.5 Redundancy of b ond paths. Failure of bonding jumpers is generall y considered a latent failure, since there is no annunciation or indication of the bonding failure. The airplane fleet fuel tank inspections that occurred as a result of the TWA 800 investigation showed that failure of bonding jumpers, due to damage, wear, or manufacturing errors, was not unusual . Based on this, it would be difficult to show that failure of a single bonding jumper is extremely remote or extremel y improbable . Therefore, the electrical bonding jumper or other bonding provisions would need to consider the consequences of these latent failures . This may result in designs that incorporate electrical bonding redundancy , if the failure of a single electrical bonding feature could create a fuel igniti on source . Additionall y, manufacturers would need to consider the use of appropriate maintenance to detect failed bonding jumpers . An example of such maintenance might include periodic inspections to limit latency . 8.3.10.6 Self

- bonding couplers . Earl y generation s elf

- bonding flexible fuel couplers did not have multiple bonding paths. Thus these bonding couplers exhibited single - point failures which caused loss of function . These self - bonding flex couplers have failed because of missing bonding springs, anodizing on bonding surfaces, and incorrect installation . The safety assessment of newer designs incorporating multiple bonding paths must consider these failure modesmm/dd/yy D R A F T AC 25 .981 - 1X

27 and qualification testing should show no ignition sources are present in the full up and possible d egraded condition with failure modes present within the couplings . For example, failure assessments of clam shell ty pe selfbonding metallic couplings in composite fuel tanks have shown arcing could occur if a coupling was improperl y latched, or became unl atched and fell to the bottom of the fuel tank . The design of the coupling would need to address these failure modes . Improper latching could be addressed through positive latching features with tactile and visual indication that the coupling is properly

l atched . Redundant fail safe features such as dual hinge pins, dual latching features, redundant bonding features, etc., would be needed to address other possible failure modes. 8.3.10.7 Resistance or impedance limits of airplane electrical bonding provisions. 8.3.10.7.1 There is no specific FAA guidance on maximum resistance or impedance

of airplane electrical bonding provisions. Electrical bonding within a fuel sy stem should be tailored to the performance requirements of a particular airplane design . The electrical bonding sh ould consider the electrical sources, such as electrical faults, fuel static electrification . The electrical bonding should also consider the specific airplane fuel sy stem design, which would include the structure material used (aluminum, carbon fiber comp osites, fiberglass composites, etc.), the configuration of the fuel sy stem (routing of fuel tubes, wires, and hydraulic tubes), and the electrical bonding concept (intentional isolation, self - bonding fittings, separate bonding jumpers, etc.) . Given the large variation in design approaches, and the close relationship between the design approach and the electrical bonding requirements, it is not practical for the FAA to provide specific guidance on maximum bonding resistance or impedance. 8.3.10.7.2 Some airplane TC hol ders have performed tests on their airplanes to

determine the specific requirements for electrical bonding. Others, in the absence of specific airplane test data, have chosen conservative electrical bonding approaches . The approach is a decision each TC ho lder should make based on the specific situation for that TC holder's airplane models. 8.3.10.8 Bonding integrity checks . Past experience has shown measurement of bond resistance is the desired method of assuring bond path integrity . During bonding resistance measurements, damage of protective finish of components may be caused in order to penetrate the insulating anodized surface layer, which may lead to subsequent corrosion damage . This concern has resulted in some TC holders defining non - intrusive inspections for electrical bonding . These inspections may

include detailed visual inspections, if the quality of the electrical bonding feature can be adequately assessed by

visual cues, such as visible corrosion, breakage, tightness or missing bonding provisions . For critical bonds this method would not by itself be adequate . Other inspection methods include inductively- coupled loop resistancemm/dd/yy D R A F T AC 25 .981 - 1X

28 measurements that eliminate the need to disconnect bonding jumpers or to penetrate corrosion - prevention coatings . The need for bo nding inspections, the frequency of the inspections, and the determination as to whether the inspections must be an ALI, should established as a result of the fuel tank SS A . 8.3.10.9 Bond Corrosion and Integrity. 8.3.10.9.1 Degradation of electrical bonding provisions, such a s bonding jumpers,

has occurred on in service airplanes . Results from airplane fuel tank inspections conducted on a sample of airplanes b y manufacturers and operators showed discoloration, corrosion, and damage to bonding jumpers. It is not clear if the di scoloration indicates corrosion that will become more severe with time, or is simply a surface color change . The applicant must define CDCCL s and the bonding feature characteristics, such as visible corrosion, discoloration, jumper strand separation, and j umper strand breakage that will be used to distinguish discrepant bonding provisions. 8.3.10.9.2 The level of corrosion observed on bonding features, specifically on bonding jumpers, varied greatl y across airplane fleets . While some airplanes within a fleet and certain locations within the fuel tanks showed no evidence of corrosion, other airplanes and locations exhibited higher levels of corrosion . Inspection results reported to the FAA indicate materials used in certain bonding jumpers (tin plated copper) may b e more prone to corrosion . Nickel plated copper wire does not experience similar corrosion . Corrosion programs for airplane structure have long recognized the variability

of corrosion within the fleet . Factors that influence the level of corrosion of bonding jumpers include fuel type (sulfur content, etc.), presence of water in the fuel tank, installation effects such as cracking of the tin plating when the jumper is installed, temperature, humidity , and chemicals used for preparation of the fuel tanks prio r to airplane storage, etc . While certain levels of corrosion or discoloration may be acceptable between inspection intervals, demonstration of compliance should include substantiation that the materials used in the bonding jumpers are appropriate for use in the fuel tanks in consideration of proposed inspection intervals . This substantiation should consider the variability in corrosive environments and factors noted above that may exist on in service and storage of airplanes in the fleet. 8.3.10.10 Definition of maj or component.

There is no specific FAA guidance on “major components” in § 25.901(b)(4) . However, the term “major components,” as specified in § 25.901(b)(4) should not be used to limit the review of fuel sy stem ignition sources as required in § 25.981 . Se ction 25.981, Fuel tank igni tion prevention, states: “(a) No ignition source may be present at each point in the fuel tank or fuel tank sy stem where catastrophic failure could occurmm/dd/yy D R A F T AC 25 .981 - 1X

29 due to ignition of fuel or vapors.” This stipulation is in addition to the provisions regarding major components in § 25.901(b)(4) . For example, fuel tube flexible coupling and components as small as nuts, bolts and washers may

develop sufficient charge to cause arcing due to electrostatics conditions if not properly accounted f or in the design . Electrical bonding would need to be considered if these couplings are identified as ignition sources during the ignition source evaluation and assessment. 8.3.11 Friction Sparks. The failure modes and effects analy sis (FMEA) should include evalu ation of the effects of debris entering the fuel pumps, including any debris that could be generated internally , such as any

components upstream of the pump inlet . In dustry fuel tank cleanliness practices and design features intended to preclude debris ent ering the fuel pumps have not been effective at eliminating debris . Service experience has shown that pump inlet check valves, inducers, nuts, bolts, rivets, fasteners, sealant, lockwire, etc. have been inducted into fuel pumps and contacted the impeller. This condition could result in creation of friction sparks and should be an assumed failure condition when conducting the SSA . Fail - safe features should be incorporated into the fuel pump design to address this condition . Examples of means that may be inco rporated into the fuel pump design to address this concern include:  Installation of inlet flame arrestors,  U se of reticulated foam,  U se/installation of jet fuel pumps without impellers to scavenge fuel, or  M aintaining fuel over the pump inlet throughout th e airplane flight attitude envelope. 9 **COMPONENT QUALIFICAT ION CONSIDERATIONS.**  9.1 **Component Qualification Review.** Qualification of components, such as fuel pumps, has not alway s accounted for unforeseen failures, wear, or inappropriate overhaul or maintenance. Also, incomplete use of the MIL specification explosion proof procedures has led to some fuel pumps entering airline service having never been run in an explosive environment. This combined experience suggests that more needs to be done to establish the ca pabilities of fuel pumps and other fuel sy stem components to operate safel y in an explosive environment. Such capability should be substantiated (or re - substantiated for the SFAR compliance) considering these factors in addition to the conditions noted in paragraph 6.3 of this AC . The amount of qualification review can be significantly reduced if the fail - safe features noted earlier in this AC are followed (e.g., not operating pumps in vapor spaces of the t ank, incorporating arc fault or ground fault protection on the electrical circuit, etc.) . Therefore, an extensive evaluation of the qualification of components may

be required if a qualitative assessment does not eliminate the component as a potential igni tion source.mm/dd/yy D R A F T AC 25 .981 - 1X

30 9.2 **Maximum Component Temperature for Qualification of Fuel System Components.**  Maximum component temperatures may be determined experimentally . Tests should be conducted long enough for the component to reach the maximum temperature . All foreseeab le failures and malfunctions of the fuel tank components (including those failures and malfunctions that could be undetected by the flightcrew and maintenance personnel) should be considered when determining maximum temperatures. 9.2.1 As discussed in AC 25.981 - 1, issued in 1971, components mounted adjacent to the exterior surface of the fuel tank can create a high localized temperature at the inner surface of the tank . This can be investigated b y l aboratory tests that duplicate the installation, or by

a validate d heat transfer anal ys is using the maximum potential temperature of the component. 9.2.2 When engine bleed air ducting, ECS, and other airplane components or s ys tems are located near fuel tanks, a FMEA should be done to determine failures of adjacent sy stems or components that could cause elevated surface temperatures . The maximum internal tank temperatures that can occur during normal and failure conditions should be determined. Sy stems, such as over - temperature protective devices, should be evaluated to determine if periodic health checks are necessary to assure that latent failures do not exist. 9.3 **Possible Failure Modes for Determination of Maximum Component Temperatures.**  The following list, although it does not include all possible failure modes, suggests some c onditions that should be explored in determining the maximum temperature expected for fuel tank components: 9.3.1 Fuel Pumps. 9.3.1.1 Normal fuel pump operation considering the highest hot day ambient and fuel tank temperatures. 9.3.1.1.1 Single phase operation of three - phase ele ctrical fuel pumps . Inmany cases

fuel pump motors are protected b y a (single) three - phase circuit breaker . In several instances, resetting of circuit breakers has resulted in arcing inside the fuel tank and the development of an ignition source . Therefore , the fuel pump circuit should also preclude development of an ignition source if the breaker is reset or forced in b y a mechanic . Methods that may be used to address this foreseeable failure condition include the use of circuit protective features such as fast - acting AFCB or GFI circuit breakers . 9.3.1.1.2 Two - phase operation of three - phase electrical fuel pumps . Failure of a

single phase of a multiple - phase fuel pump may significantl y increase the load on the remaining phases of the pump and generation of heat in the pump . Inmany cases thermal protection features within the pump havemm/dd/yy D R A F T AC 25 .981 - 1X

31 been incorporated to address this failure condition but these means have not been effective at preventing continued operation of a pump with a failed electrical phase . Another failure condition that should be considered is subsequent failure of a second phase of the pump and possible arcing or heat damage . In general, pumps should not be allowed to operate following failure of a single electrical phase of the pump if such operation coul d result in development of an ignition source . Automatic protective means, such as AFCB or GFI or other means, should be provided to shut down the pump when a single electrical phase failure occurs . Periodic inspections or maintenance of these features may be required. 9.3.1.2 Dry

operation of fuel pumps, including lack of lubrication . 9.3.1.2.1 Service history has shown that flightcrews and maintenance personnel have inadvertently

operated fuel pumps for long periods of time without fuel in the fuel tank . Fuel pumps are typ icall y qualified for dry run operation for periods of time based upon assumptions made about possible duration of inadvertent operation, or failure conditions, which could result in dry running of the pump . For example, some pumps were operated during qual ification testing up to a maximum of 8 hours continuously , with total accumulated dry run operation of 24 hours . These qualification tests were accomplished in order to demonstrate that fuel pump performance was still adequate following the dry pump operation . The tests were not demonstrated in an explosive environment and hence were not intended to qualify

the pumps for such operation . Inother cases previous approvals were predicated on the assumption that the fuel pump would not be dry

run operated becau se the pump would be turned off by the flight/ground crew following a pump low - pressure indication . Indefinite dry

operation of pumps may result in surface temperatures above the auto - ignition temperature of the fuel or expose the pump to dry run operation where debris from the fuel tank could enter the impeller and cause sparks . Manufacturers recommended procedures have not been shown to be adequate in preventing dry run operation . Therefore, additional fail - safe features are necessary to preclude dry

run operation of airplane fuel pumps . One or more of the following fail - safe means should be considered for protection of fuel pumps: 1. In corporate design features to keep the fuel pump inlet submerged in jet fuel to prevent dry

running of the pump under all operating conditions. 2. In corporate automatic pump shutoff features into the fuel pump or airplane to preclude dry

run operation. 3. Other means such as installation of flame arrestors in the fuel pump inlet to preclude flame propagation into the fuel tank. 9.3.1.3 Temperatures associated with the fuel pump following wet operation with

wet mechanical components both at zero and reduced fluid flow.mm/dd/yy D R A F T AC 25 .981 - 1X

32 9.3.1.4 Temperatures considering the moving mechanisms that are locked or

seized. 9.3.1.5 Temperatures generated as a consequence of pump impel ler slippage. 9.3.2 Failed Bearings. 9.3.2.1 The effects of wear on fuel pump features incorporated into the design to

maintain explosion proof characteristics should be evaluated . For example, wear of bearings or failures, including spinning of any bushings, and possible effects on quenching orifices should be evaluated . In many cases fuel pump explosion proof features are not redundant and failure or degradation of the features is latent . If single or probable combinations of failures in the fuel pump can cause an ignition source, § 25.981 requires incorporation of fail - safe features noted previously . If wear of the pump can cause degradation of fail - safe features, appropriate inspection, overhaul or life limiting of the pump should be included in the A irworthines s L imitations section of the ICA . 9.3.3 FQIS . FQIS wiring in the tank, with maximum voltage and current applied considering normal and failure conditions including the effects of high voltage s ys tems outside the tank in proximity to the co - located FQI S wires. 9.3.3.1 FQIS component in the normal and failed state with the above associated

maximum voltages and fault currents applied. 9.3.3.2 Float s witch s ys tem temperatures should be determined considering the

maximum environment temperatures and the application of the applicabl e maximum voltage and fault currents. 9.3.3.3 Temperatures of the fuel sy stem components should also be evaluated

considering the failure of bonding straps. 9.3.3.4 Pneumatic sy stem temperatures need to be evaluated for the effects of duct

rupture impinging on the external tank surface, and radiation and conduction heat transfer associated with the tank and components affecting tank wall temperatures (see previous discussion of spaces adjacent to fuel tanks). 9.3.3.5 Electrical d efects that g enerate e xcessive h eat . Arcing at the e lectrical

connections to the pump housing or within the connector. 9.3.4 Submerged H eat E xchangers . Operating under conditions of maximum heat rejection to the fuel. 9.3.5 Failed or Aged S eals .mm/dd/yy D R A F T AC 25 .981 - 1X

33 Spraying of fuel in the tank from any pressurized fuel source may cause el ectrostatic charging of components in the fuel tank and significantly lower the flammability temperature of the fuel tank vapor . Therefore, the design should not include features that result in spraying of fuel, such as fuel pump motor cooling flow return to the tank . In addition, use of sealant in connectors that is not compatible with the fuel may allow leakage into the connector and the possibility of a fire near the connector. 9.3.6 Fuel Line Couplings . Aging of seals may

result in hardening of the seal material and leakage and spraying of fuel within the fuel tank; therefore, fuel line coupling designs should be evaluated and a design life should be established for all seals that are shown to age and allow leakage that can cause unacceptable electrostatic cha rging of components. 9.3.7 Fuel Pump Cooling Flow . Fuel used for cooling of fuel pumps may be sprayed from the fuel pump . Fuel pump cooling flow should not be sprayed into the fuel tank vapor space . Means should be provided to distribute the cooling fuel into th e fuel tank at or near the bottom of the fuel tank. 9.3.8 Electrical Connector Sealant, Seals, and Explosion Proofness . Electrical connections to fuel pumps are typically located either inside or outside the fuel tank in areas of the airplane where the presence of flammable fuel vapors should be assumed because no secondary sealing of fuel is provided . Fuel leakage and corrosion at electrical connectors located outside the fuel tank has allowed the presence of both flammable vapors and electrical arcing at connec tors, resulting in fires . In other applications, arcing has occurred at the pump connections inside the fuel tanks, requiring installation of appropriatel y sized steel shields to prevent arcing through the connector or pump housing into the fuel tank or areas where flammable vapor could exist. 9.3.9 Arcing at the P ump E lectrical C onnections . In the safety assessment, arcing at the pump electrical connections s hould be assumed with fuel present . The energy release during an arcing condition may be limited by ins tallation of AFCB or GFI protection features . The pump connector should be shown to contain any resultant arcing or fire and maintain all surface temperatures below the auto - ignition temperature of the fuel . Component manufacturer maintenance records and qualification test results should be reviewed to establish that the sealant is compatible with the fuel and to determine if a design life or periodic inspections for the pump connector are needed. 10 **INSTRUCTIONS FOR CON TINUED AIRWORTHINESS**  **OF THE FUEL TANK S**  **YSTEM —**  **§ 25.1529.**  10.1 Based upon the evaluations required b y § 25.981(a), Amendment 25 - 102 also added a new requirement to § 25.981(b) to require that CDCCL s , inspections, or other procedures be established as necessary to prevent development of ignition sourcesmm/dd/yy D R A F T AC 25 .981 - 1X

34 within the fuel tank sy stem, and that they be included in the Airworthiness L imitations section of the ICA required by § 25.1529 . This requirement is similar to that contained in § 25.5 71 for airplane structure. Amendment 25 - 102 also added a new requirement to a ppendix H to part 25, Instructions for Continued Airworthiness , to provide any mandatory

fuel tank s ys tem inspections or maintenance actions in the section titled A irworthiness L i mitations of the I CA. 10.2 The preamble of Amendment 25 - 102 (66 FR 2309 7) states: Critical design configuration control limitations include any information necessary to maintain those design features that have been defined in the original type design as needed to preclude development of ignition sources. This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the original fuel tank system type design. An example of a critical design configuration control limitation for current designs discussed previously would be maintaining wire separation between FQIS wiring and other high power electrical circuits. The original design approval holder must define a method to ensure that this essential in formation will be evident to those that may perform and approve repairs and alterations. Visual means to alert the maintenance crew must be placed in areas of the airplane where inappropriate actions may degrade the integrity of the design configuration. I n addition, this information should be communicated by statements in appropriate manuals, such as W

iring Diagram Manuals . CDCCL s may include any

maintenance procedure that could result in a failure, malfunction, or defect endangering the safe operation of the airplane, if not performed properly or if improper parts or materials are used . This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally

violate the integrity

of the original ty

pe design of the fuel tank sy stem. ) 10.2.1 CDCCL s are intended to identify onl y critical features of a design that must be maintained. A CDCCLhas no interval but establishes configuration limitations to maintain and to protect the “critical design feature” identified in the CDCCL s . CDCCL s can also include requirements to have placards on the airplane with information about critical features. For example, certain components of a fuel pump (or all components) may include critical features that are identified as CDCCL s . These critical feature s must be identified in the Airworthiness Limitations section of the I CA and should also be identified in the component maintenance manual (CMM) as CDCCL s to provide awareness to maintenance and repair facilities . 10.2.2 Although not intended by the introduction of CDCCL s and other fuel s ys tem airworthiness limitations, there are also design approval holders ( DAH ) that have created certain CDCCL airworthiness limitations that include both the critical design feature as well as the tasks associated with maintaining the CDCCL s . Ty pically these airworthiness limitations require adhering to a specific CMM at a specific revision level when repairing or overhauling fuel s ys tem components. In this case, operators are required to adhere to all elements of the CMM specified in the CDCCL s . Any deviations from CMMs specified in the CDCCL s , including using later revisions of those CMMs, must be approved b y the FAA o versight o ffice. The FAA has been working with DAHs to ensure that new design approvals identify on ly those critic almm/dd/yy D R A F T AC 25 .981 - 1X

35 features of components in the CMMs as CDCCL s , instead of identifying the entire CMM as CDCCL s ( or other ty pes of airworthiness limitation s) . (Refer to the CMM deviation definition in Appendix C of this AC .) 10.3 Any

fuel tank s ys tem components that are determined to require periodic maintenance, inspection, or overhaul to maintain the integrity of the system or maintain protective features incorporated to preclude a catastrophic fuel tank ignition event must be defined and included in the A irworthiness Limitations section of the I CA . An inspection airworthiness limitation has a specific task and interval (such as 10 years). The inspection interval should be established based upon the standard practices defined in AC 25.1309 for evaluation of component failures . The inspection could also be required following maintenance to verify a CDCCL feature is maintained. Examples of inspection airworthiness limitation items include : 10.3.1 A ging fuel line couplings seals/O - rings. In certain instances, materials used in fuel line couplings may lose flexibility

and harden with age . During suction feed or pressurized operation, the seal may allow air to enter the fuel line or leak, allowing spraying of fuel in the tanks or other areas of the airplane where spraying fuel could create a fire hazard . Repetitive inspections, functional checks, or mandatory

replacement intervals may be required to prevent leakage. 10.3.2 Wear of pump bushings, bearings, and seals . Wearing of pump bushings, bearings, and seals may significantly

affect the performance of fuel pumps and degradation of features necessary to maintain the explosive proof qualification . Inmost cases these failures conditions are latent, therefo re incorporation of other fail - safe features, as discussed earlier in this AC, would be required . If fail - safe features are incorporated, such as installation of feeder tanks that are filled with ejector pumps, functioning of those features would need to b e assured b y indications or periodic functional tests . Installation of fuel level sensors in the feeder tanks would provide continuous monitoring of the function . Another means could be installation of flow indicators in the flow line of the ejector pump t hat can be viewed b y maintenance personnel and a mandatory periodic inspection of this function is one example of a method of mandatory maintenance action. 10.3.3 Fuel pump protective features. If failure of an AFCB or GFI protective feature and/or a thermal fuse (closed) is latent and this feature is needed to maintain fail - safe features, periodic checks would likely be needed. 10.3.4 Transient suppression/energy limiting devices. If failure of the device is latent and this feature is needed to maintain fail - safe featur es, periodic checks will be needed. 10.3.5 Wire shield grounding. Component grounds and wires will likely require inspections and measurements to determine proper grounding.mm/dd/yy D R A F T AC 25 .981 - 1X

36 10.3.6 Fuel tank access panel/door seals leakage, resistance checks. 10.3.7 Fuel pump connectors, corro sion, wear. 10.3.8 Fuel pump electrical supply conduit structural, sealing integrity. 10.4 Maintainability , both in the design and procedures (i.e., m aster m inimum e quipment l ist, airplane m aintenance m anu al, etc.), should be verified. This should include, as a minimum, verification that the sy stem and procedures support the safety analysis assumptions and are tolerant to anticipated human errors, and that any critical procedures are highlighted for consideration as required inspection items . (See 14 CFR 121.369(b) for considerations of a “required inspection item.”) 10.5 **Incorporation by Reference into Airworthiness Limitations .**  10.5.1 When the words “in accordance with” or “per” are cited in the airworthiness limitations, the procedures in the referenced document must be followed to ensure that the critical design feature is maintained. Any changes to these procedures require FAA Oversight Office approval before they are used. 10.5.2 When the words “refer to” are cited in the airworthiness limitation, the procedures in the referenced document represent one method of complying with the airworthiness limitation. An accepted alternative procedure may be developed b y the operator in accordance with its procedures in its maintenance program/manual. Prior FAA Oversight Office approval is not required for this action. 10.5.3 See AC 120.97A, , for guidance regarding procedures operators should use when requesting approval of changes to documents referenced in airworthiness limitations and for examples of fuel tank sy stem airworthiness limitations. 10.6 **Vis ible Identification of**  **CDCCLs .**  10.6.1 Section 25.981(b) states that “...visible means must be placed in areas of the airplane where maintenance, repairs, or alterations may violate the critical design confi guration control limitations.” The design approval holder s hould define a method of ensuring that this essential information will be communicated by statements in appropriate manuals, such as Wiring Diagram Manuals, and be evident to those that may perform and approve such repairs and alterations. 10.6.2 An example of a CDCCL that would result in a requirement for visible means would be maintaining wire separation between FQIS wiring and other high power electrical circuits where separation of the wiring was determined to be a CDCCL . Acceptable methods of providing visibl e means would include color coding of the wiring and labeling . For retrofit of markings onto existing wiring, placement of identification tabs at specific intervals along the wiring would be acceptable . Industry and regulatory authorities are currently

dev eloping standards for color coding of wiring for various sy stems . Standardization within the industry of color coding of wiring used for the fuel tank sy stem would assist maintenance personnel in functional identification of wiring .mm/dd/yy D R A F T AC 25 .981 - 1X

37 Pink wiring has been us ed by some manufacturers for fuel tank s ys tem wiring . Use of this color as a standard for fuel tank s ys tem wiring is recommended b y the FAA. If you have any suggestions for improvements or changes, you may use the template provided at the end of this AC.

ENDXX/XX/XX D R A F T AC 25.981 - 1X Appendix A

A - 1 **Appendix A. Certificatio**  **n of Arc Fault Circuit Breaker (AFCB) or Ground Fault**  **Interrupter (GFI)**  A.1 **PURPOSE.** This appendix provides guidance for certification of AFCB or GFI devices that have been shown to be a practical means to protect the circuits of electric motor driven fuel pumps and other components inside fuel tanks that use higher than intrinsically safe electrical power (for example, motor operated valves). A.2 **BACKGROUND.** A.2.1 Ty

pical fuel boost pumps are constructed with their electri cal components inside explosion - proof pump housing. Therefore, electrical arcing inside the pump assembly is considered safe provided the integrity of the explosion proof housing is maintained. A.2.2 However, service experience has demonstrated th at the integrity of the explosion - proof housing can be lost as a result of fasteners coming loose, flame arrestors being left out of the pump assembly , and from intermittent electrical arcs that penetrate the housing. Traditional thermal circuit breakers h ave generally not detect ed intermittent electrical arcs and therefore do not ty picall y protect from intermittent arcs. A.2.3 AFCBs have been used as a practical means to protect against arcing in fuel pump power circuits for both alternating current and direct current motor- powered fuel pump motors. The SAE issued two a erospace s tandards for AFCBs : O ne for alternating current circuits and one for direct current circuits (see Appendix B of this AC ). A.2.4 Fuel pump housings and metallic conduits are grounded to the airframe , and any arcing to the cavity

wall or c onduit creates a ground fault. Therefore, GFI have been used in AC pump power circuits as a practical means to ensure that power is quickly disconnected from the fuel pump in the event of a ground fault in the pump or associated power wiring. A.3 **CERTIFICATION GUIDANCE**  **.** One means for the applicant to show compliance with the applicable regulations is to demonstrate, through design, review, analy sis , and test , that the AFCB or GFI performs as intended under any foreseeable operating condition s and addresses the following guidance : A.3.1 **Fault Detection Trip Levels.** A.3.1.1 The applicant should demonstrate that the AFCB or GFI can distinguish between actual fault events and events characteristic of the normal airplane pump start up operating loads and environmental conditions. L aboratory testing and/or airplane ground/flight testing should be per formed to demonstrate the “intended function” of AFCB or GFI.XX/XX/XX D R A F T AC 25.981 - 1X Appendix A

A - 2 The test methods chosen should be able to reproduce the most common ty pes of arcing in fuel pumps that occurs in an airplane environment due to ground or arc faults. The AFCB or GFI should be de signed to prevent nuisance tripping due to normal airplane electrical loads, electrical bus switching, and to operate continuously with normal and abnormal airplane electrical bus switching characteristics associated with mast er minimum equipment list disp atch relief configurations. A.3.1.2 The installation of the AFCB or GFI should not result in an appreciable increase in the loss of fuel pump functions. A reliability requirement on the order of 100,000 hours mean time between failures may be satisfactory , but the applicant should show that failure of the AFCB or GFI does not result in an appreciable increase in the occurrence of failures that result in the loss of fuel pump functions . A.3.1.3 Sufficient laboratory testing and airplane testing should be conducted to demonstrate AFCB or GFI nuisance trip performance, including tests for lightning, HIRF , and electromagnetic compatibility . In addition, sufficient laboratory testing should be conducted to demonstrate that the AFCB or GFI trips before arcing in the fuel pump can lead to ignition of fuel vapor in the fuel tank. A.3.1.4 A means should be p rovided to latch the AFCB or GFI in a state that removes power from the fuel pump motor in the event that a ground fault has been detected, until the AFCB or GFI is reset. A trip of a single AFCB or GFI should not be reset until the reason for the trip has been determined and repaired or that it has been determined that no ground fault exists. A.3.1.5 A means should be provided to verify that the AFCB or GFI, when installed in the airp lane, is capable of detecting an arc or ground fault and disconnecting power from the fuel pump motor. An acceptable approach is each installed GFI should be able to be tested without the need for test equipment, i.e. each GFI should have a built in test capability . The means provided should verify that the AFCB or GFI protection is operational before applying power to the fuel pump prior to each flight. Alternativel y, the applicant may

establish a safety requirement that the probability of a latent failure condition of the arc fault or ground fa ult protection is extremely remote (i.e., less than 1.0 x 10 - 7 ). A.3.2 **Software.** In advertent operation of multiple AFCB or GFI devices has the potential to affect the continued operation of more than one engine, a condition that the FAA considers to be hazardous . Software used by the AFCB or GFI devices should be developed and verified i n accordance with RTCA DO - 178B. A.3.3 **Complex Hardware.** Application - specific integrated circuit and parallel - line assay used b y the AFCB or GFI devices should be developed and tested in accordance with RTCA DO - 254.XX/XX/XX D R A F T AC 25.981 - 1X Appendix A

A - 3 A.3.4 **System Safety Assessment.**  A.3.4.1 AFCB or GFI devices installed in circuits that perform essential or critical functions and/or their performance could impact the safety of flight . The applicant should perform an installation SSA in accordance with §§ 25.901(c), 25.981(a) and (d), and 25.1309. The SSA should include a functional hazard assessment to determine the effects of failures of the AFCB or GFI devices on the safety of the airplane and to verify that the design limits the probability of undesirable failure conditions to acceptable levels. In addition, the applicant should address the potential for possible common cause trips due to hardware/software errors and common cause trips due to environmental conditions such as HIRF (§ 25.1317) , lightning (§§ 25.954 and 25.1316) , and electromagnetic compatibility (§ § 25.1301 , 25.1309(e), and 25.1353(a) ) . A.3.4.2 Failure to provide fuel pump power due to unintended activation of multiple AFCB or GFI devices has the potential to affect the continued operation of more than one engine, a condition that the FAA considers is at least hazardous and co uld be catastrophic depending on the type design and mission . Proper design assurance of the AFCB or GFI devices , such as appropriate environmental qualifications , will address any concern about common cause failures. A.3.4.3 Failure of an AF CB or GFI device to detect an arc or ground fault condition in a fuel pump circuit can contribute to a catastrophic failure condition. The FAA considers the undetected failure of an AFCB or GFI alone, which prevents its detection of or response to an arc o r ground fault , to be a severe - major (hazardous) failure condition. The loss of arc or ground fault protection should either be shown to be extremely remote or annunciated to th e flight crew prior to flight. If failures of the AFCB or GFI can contribute to severe - major (hazardous) or catastrophic failure conditions, the safety assessment should anal yz e common cause failures or design errors that could result in these conditions and verify that appropriate protection to prevent them is p rov ided. Due to the nature of AFCB and GFI devices, special attention should be given to protection from lightning, EMI, and HIRF. A.3.4.4 As discussed in section A.3.6 bel ow, the FAA expects there will be a means for the flight crew to reset the AFCB or GFI in the event that more than one fuel pump AFCB or GFI trips simultaneously in flight. With a reset capability , a common mode failure or error that could affect the continued operation of more than one engine is considered to be hazardous and should therefore be shown to be extremely remote. A.3.4.5 Furthermore, the applicant should demonstrate by design, anal ys is, and fault insertion testing , if applicable, the validity of failure analy sis assumptions, and show that the probability

of the failure of AFCB or GFI to detect the existence of a ground or arc fault condition and remove power from a pump is extremely remote (1 0 - 7 or less). In order to meet this requirement, AFCB and GFI installations have ty picall y required an automatic built - i n test feature that verif ies the AFCB or GFI fault protection is operational before applying power to the fuel pump prior to each flight (see section 8.3.3 ).XX/XX/XX D R A F T AC 25.981 - 1X Appendix A

A - 4 A.3.5 **Power and Ground Requirements.** A.3.5.1 AFCB or GFIs are active devices and require power . The applicant should demonstrate that AFCB or GFI power and ground connections are implemented such that all airplanes load margins are sufficient and that proper circuit protection or other methods are used to protect AFCB or GFI power and ground wiring. The applicant should also demonstrate that there are no h azards to maintenance or flight crews due to possible hot shorts to electrical panels containing AFCB or GFI. In addition, if the installation of AFCB or GFI will involve the direct replacement of devices on a given electrical panel, the applicant should demonstrate adequate power/heat dissipation, and ensure safe touch temperature. A.3.6 **Troubleshooti ng Procedures.**  A.3.6.1 Because AFCB or GFIs are capable of detecting ground paths on pumps and airplane wiring that may

not be detected b y visual inspection, the applicant should define the operational and maintenance philosophies and methodology associated with an AFCB or GFI trip that does not rely solely on visual inspections. The applicant should demonstrate how the maintenance procedures would be able to safely distinguish and diagnose an AFCB or GFI trip and nuisance trip without causing a fuel tank explosion. Operational instructions and maintenance procedures should be provided to prevent resetting of tripped AFCB or GFIs until it can be assured that resetting an AFCB or GFI will not cause the occurrence of a fuel tank explosion. Human factors considerations should be taken into account to minimize the possibility of human error during airplane operation and maintenance. A.3.6.2 If multiple b oost pumps are protected with AFCB or GFI devices such that the continued operation of multiple engines could be affected, there should be a means for the flightcrew to reset tripped AFCB or GFI devices in flight. The applicable airplane flight manual should contain a limitation against the reset of a single AFCB or GFI and procedures for resetting AFCB or GFI devices when multiple AFCB or GFIs have tripped simultaneously

in flight. A.3.7 **Hardware Qualification.** Environmental testing including thermal, shock and vibration, humidity, fluid susceptibility, altitude, decompression, fungus, waterproofness, salt spray , and explosion proofness should be performed in accordance with DO - 160D or equivalent standards. The applicant should define an insulation, dielectric , and electrical grounding and bonding standard acceptable t o the FAA for the AFCB or GFI. Appropriate test categories in each DO - 160 section should be chosen based on the AFCB or GFI installation environment defined for the specific airplane. Particular attention should be given to the normal and abnormal power input tests outlined in DO - 160 s ection 16. The sy stem with AFCB or GFI installed must comply with §§ 25.954 and 25.1316 for lightning protection , § § 25.1301 , 25.1309(e), and 25.1353(a) for electromagnetic compatibility, and § 25.1317 for HIRF.XX/XX/XX D R A F T AC 25.981 - 1X Appendix A

A - 5 A.3.8 **Airplane Tests.** The applicant should demonstrate by ground and/or flight tests that all AFCB or GFIs remain armed during normal and abnormal electrical power bus and load switching as described in paragraph A.3.1.1 of this AC , and are not adversel y affected by the operation of other airplane sy stems. The airplane tests should also demonstrate that the AFCB o r GFI would not produce EMI to other airplane sy stems. A.3.9 **Instructions for Continued Airworthiness (ICA).** A.3.9.1 The applicant must submit I CAs required by § 2 5.1529 in order to provide the necessary procedures to service and maint ain AFCB or GFI installations. As required by appendix H25.4, the A irworthiness L imitations section of the ICA must include each mandatory

replacement time, inspection interval, related inspection procedure, and all critical design configuration control limitations (CDCCL s ) approved under § 25.981 for the AFCB or GFI installation. Consideration should be given to maintenance intervals for the detection of latent failures that would prevent the AFCB or GFI from tripping durin g a ground or arc fault event. A.3.9.2 AFCB or GFIs used for showing compliance to § 2 5.981 requirements for preventing ignition sources are ty

pically a CDCCL in these installations. As required by § 25.981(d), the applicant must provide visible means of identifying the AFCB or GFI as a CDCCLand should provide design features to minimize the inadvertent substitution of an AFCB or GFI with a non - AFCB or GFI device. A.3.10 **Airplane Flight Manual Limitations**  The airplane flight manual Limitations section should address any limitations related to AFCB or GFI intended function and any self - te st features of the AFCB or GFI design .XX/XX/XX D R A F T AC 25.981 - 1X Appendix B

B - 1 **Appendix B. References**  **and Related Documents** B.1 **REFERENCES AND RELATED**  **DOCUMENTS .**  The following related documents are provided for information purposes and are not necessarily

directl y referenced in this AC. B.1.1 **14 CFR R** **egulations.** Sections that prescribe requirem ents for the design, substantiation, and certification relating to prevention of ignition sources within the fuel tanks of transport category airplanes include:  § 21.50, Instructions for continued airworthiness and manufacturer’s maintenance manuals having airworthiness limitations sections.  § 25.729(f), Protection of equipment in wheel wells.  § 25.863, Flammable fluid fire protection.  § 25.901, Installation. (Powerplant)  § 25.954, Fuel system lightning protection .  § 25.973, Fuel tank filler connection.  § 25.981, Fuel tank explosion prevention .  § 25.1301, Function and installation. (Equipment)  § 25.1309, Equipment, systems, and installations.  § 25.1316, Electrical and electronic system lightning protection.  § 25.131 7 , High - intensity Radiated Fields (HIRF) Protection .  § 25.1353, Electrical equipment and installations .  § 25.1529, Instructions for Continued Airworthiness.  Appendix H to part 25, Instructions for Continued Airworthiness. B.1.2 **Advisory Circulars.** You can view and download the current version of the following ACs from our web based Regulatory

and Guidance Library

(RGL) at www.rgl.faa.gov . ACs are also available on the FAA website at http://www.faa.gov/regulations_policies/advisory _circulars/ .  AC 20 - 158, The Certification of Aircraft Electrical and Electronic Systems for Operation in the High -Intensity Radiated Fields (HIRF) Environment , dated July 30, 2007.  AC 21 - 40A, Guide to Obtaining a Supplemental Type Certificate , dated September 27, 2007.XX/XX/XX D R A F T AC 25.981 - 1X Appendix B

B - 2  AC 25 - 8, Auxiliary Fuel System Installations , dated May 2, 1986.  A C 25 - 16 , Electrical Fault and Fire Prevention and Protection , dated September 25, 1987.  AC 25 - 19, Certification Maintenance Requirements , dated October 3, 2011. AC 25.954 - X , Fuel System Lightning Protection , dated XXXXX .  AC 25.981 - 2A, Fuel Tank Flammability Reduction Means , dated September 19, 2008.  AC 25.1309 - 1A, System Design and Analysis , dated June 21, 1988.  AC 25.1701 - 1, Certification of Electrical W iring Interconnection Systems on Transport Category Airplanes , dated December 4, 2007.  AC 120.97A, Incorporation of Fuel Tank System Instructions for Continued Airworthiness into Operator Maintenance or Inspection Programs , dated May 25, 2012 . B.1.3 **O ther**  **FAA D**  **ocuments.**  Transport Airplane Directorate Designee Newsletter, Edition 15, February 1993. Article, “ Electrical Wiring used in Commercial Transport Airplanes . ” An electroni c copy of this newsletter is available on the Internet at http://www.faa.gov/aircraft/air_cert/design_approvals/transport/Cert_Update/Editio n11 - 20/media/Edition15.pdf .  Report DOT/FAA/AR - 98/26, Review of the Flammability Hazard of Jet A Fuel Vapor in Civil Transport Aircraft Fuel Tanks , June 1998. An electronic copy of this report is available on the Internet at http://www.tc.faa.gov/its/worldpac/techrpt/ar98 - 26.pdf .  Report DOT/FAA/AR - 03/61 , Silver- Sulfur Deposits on Fuel Quantity Indication System and Attendant Wiring , October 2003. An electronic cop y of this report is available on the Internet at http://www.tc.faa.gov/its/worldpac/techrpt/ar03 - 61.pdf .  Technical Note DOT/F AA/AR - TN05/37 , Intrinsically Safe Current Limit Study for Aircraft Fuel Tank Electronics , October 2005. An electronic copy of this report is available on the Internet at http://www.fire.tc.faa.gov/pdf/TN05 - 37.pdf .  Order 8110.4C, Type Certification , effective December 20, 2011. An electronic copy of this document is available on the Internet at http://www.faa.gov/documentLibrary /media/Order/8110.4c%20Changes%201%20t hru%205.pdf

. B.1.4 **Military Specifications.** You can get a cop y of these docum ents from the Departm ent of Defense, Docum ent Auto m ation and Production Service, Building 4/D , 700 Robbins Avenue, Philadelphia, P A 19111 - 5094, or on the internet at http://assist.daps.dla. mil/online/start/.XX/XX/XX D R A F T AC 25.981 - 1X Appendix B

B - 3  MIL - E - 5272A, Environmental Testing of Aeronautical &Associated Equipment (Explos ion Proof Equipm ent Qualification Tests).  MIL - STD - 810E, Method 511.3, Explosive Atmosphere , dated September 1, 1993 .  MIL - PRF - 6106K, General Specification for Electromagnetic Relays , B.1.5 **I ndustry**  **D ocuments.**  B.1.5.1 Society

of Automotive Engineers (SAE) Documents. You can get the following docum ents from the Society of Auto m otive Engineers, Inc., 400 Co mm onwealth Drive, W arrendale, Penns ylvania, 15096, or from http://www.sae.org/ .  AIR 1662, Minimization of Electrostatic Hazards in Aircraft Fuel Systems.  ARP 4404, Aerospace Recommended Practice, Aircraft Electrical Systems (guidance docum ent for design of aerospace vehicle electrical s ys tem s).  APR 4754, Aerospace Recommended Practice, Certification Considerations for Highly Integrated or Complex Aircraft Systems.  ARP 4761, Aerospace Recommended Practice, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.  ARP 5583, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment.  AS50881, Aerospace Vehicle W iring (procure m ent docum ent used to specify aerospace wiring; replaces MIL - W - 5088).  AS5692, A Fault Circuit Breaker (AFCB), Aircraft, Trip -Free Single Phase 115 VAC, 400 Hz - Constant Frequency .  AS6019, ARC Fault Circuit Breaker (AFCB), Aircraft, Trip -Free 28 VDC . B.1.5.2 Other Industry Documents.  RTCA Docum ent DO - 160F, Environmental Conditions and Test Procedures for Airborne Equipment , December 6, 2007.  Underwriters Laboratories Inc., UL 913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations , July

31, 2006.  Kuchta, Joseph M., Summary of Ignition Properties o f Jet Fuels and Other Aircraft Combustible Fluids , Air Force Aero Propulsion Laboratory Technical Report AFAPL - TR - 75 - 70, U.S. Bureau of Mines PMSRC, September 1975.  Am erican Society of Testing and Materials, ASTM D 4865, Standard Guide for Generation and Dissipation of Static Electricity in Petroleum Fuel Systems , AugustXX/XX/XX D R A F T AC 25.981 - 1X Appendix B

B - 4 2009. A cop y of this standard can be ordered electronically on the Internet at http://www.ASTM.org .  National Fire Protection Association, NFPA 77, Recommended Practice on Static Electricity , 1993 editi on. A cop y of this publication can be ordered electronically on the Internet at http://www.NFPA.org .  F. A . Fisher

, Some Notes on Sparks and Ignition of Fuels , NASA report, NASA/TM - 2000 - 210077, March 2000.  EUROCAE ED 107, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment. This document is the same as ARP 5583 referenced in paragraph B.1.5.1 of this AC .XX/XX/XX D R A F T AC 25.981 - 1X Appendix C

C - 1 **Appendix C. Definitions.**  C.1 **DEFINITIONS.** C.1.1 Arc Fault Circuit Breaker (AFCB). A device that provides thermal circuit breaker protection and detects electrical arcing faults and interrupts electrical p ower to the fault. (See paragraph B.1.5.1 of this AC for SAE standards for alternating current and direct current AFCB.) C.1.2 Auto - Ignition Temperature. The minimum temperature at which an optimized flammable vapor and air mixture will spontaneously ignite when heated to a uniform temperature in a norm al atmosphere without an external source of ignition, such as a flame or spark. C.1.3 Auxiliary

Tanks. Fuel tanks installed which make additional fuel available for increasing the flight range of that airplane. The term “auxiliary” means that the tank is secondary to the airplane’s main fuel tanks; i.e., the functions of the main tanks are immediately

available and operate without immediate supervision by the flightcrew in the event of failure or inadvertent depletion of fuel in an auxiliary tank. Auxiliary

tanks are usuall y intended to be emptied of usable fuel during flight and have been installed in various locations including center wing structure, horizontal stabilizers, wings, and cargo compartments. C.1.4 Barrier. A ph ys ical partition attached to airplane structure that separates one wire or group of wires from another wire or group of wires in order to prevent arcing, fire , and other phy sical damage between wires or groups of wires. C.1.5 Component Maintenance Manual ( CMM ) Deviation. C.1.5.1 Term used for approval of changes t o CMMs that are the subject of CDCCL s or other ty pes of airworthiness limitations adopted by a type design change. C.1.5.2 Term used for the approval of changes to CMMs referenced in CDCCL s or other ty pes of airworthiness limitations that are mandated b y airworthiness directive s (AD) , provided the CDCCL or airworthiness limitation includes wording that allows use of “later approved” CMMs. Otherwise, approval must first be granted as an alternative method of compliance (AMOC) to the AD. As with AMOC approvals, a CMM deviation approval must be granted by the FAA o versight o ffice. C.1.6 Critical Design Configuration Control Limitations (CDCCL s ) . Airworthiness limitations that define those critical design feature s of the design that must be maintained to ensure that ignition sources will not develop within the fuel tank sy stem . C.1.7 Electrical Sparks. A spark that is initiated by a potential difference which causes an electrical breakdown of a dielectric, such as a fuel/air mixture, produced between electrodes which are initially separated, with the circuit initially carrying no current.XX/XX/XX D R A F T AC 25.981 - 1X Appendix C

C - 2 The term voltage sparks is sometimes used interchangeabl y with the term electrical sparks. C.1.8 Electrical Arcs. Electrical arcs occur between electrodes which are in contact with each other and carry

excessive current which results in melting at the contact points. This may result in electric arc plasma and/or ejection of molten or burning material. The term thermal sparks is used interchangeabl y with the term electrical arcs. C.1.9 Explosion Proof. C omponents designed and constructed so they will not ignite flammable vapors or liquids surrounding the component under any normal operating condition and any failure condition. Further information on possible failure conditions that should be considered is specified in § 25.981(a)(3). C.1.10 FAA Oversight Office . As defined by 14 CFR part 26, the aircraft certification office or office of the Transport Airplane Directorate with oversight responsibility for the relevant type certificate, supplemental type certificate, or manufacturer, as determined by the Administrator . See AC 25.981 - 2A , Appendix 1, for a list of FAA Oversight O ffices b y Design Approval Holder. C.1.11 Flammable. Flammable, with respect to a fluid or gas, means susceptible to igniting readil y or to exploding (14 CFR part 1, Definitions and Abbreviations ). Further information on flammable fluids used in airplanes may be found in the documents identified in paragraph B.1.5.2 of this AC. C.1.12 Flash Point. The flash point of a flammable fluid is defined as the lowest temperature at which the application of a flame to a heated sample causes the vapor to ignite momentarily , or “flash.” The test standard f or jet fuel is defined in the fuel specification. C.1.13 Friction Spark. A heat source in the form of a spark that is created by mechanical contact, such as debris contacting a rotating fuel pump impeller. C.1.14 Fuel Sy stem Airworthiness Li mitation . Any mandatory

replacement time, inspection interval, related inspection procedure, and all critical design CDCCL s approved under § 25.981 for the fuel tank sy stem identified in the A irworthiness L imitations section of the I CA (as required by § 25.981 and a ppendix H to part 25, section H25.4). C.1.15 Ground Fault Interrupter (GFI). A device that provides thermal circuit breaker protection and detects an electrical power short circuit - to - ground condition and interrupts electrical power to the ground fault. C.1.16 Hot Short. Electrical energy introduced into equipment or sy stems as a result of unintended contact with a power source, such as bent pins in a connector or damaged insulation on adjacent wires. C.1.17 Ignition Source. A source of sufficient energy to ignite combusti on of a fuel/air mixture. Surfaces that can exceed the auto - ignition temperature of the flammable vapor under consideration are considered to be ignition sources. Electrical arcs, electrical sparks andXX/XX/XX D R A F T AC 25.981 - 1X Appendix C

C - 3 friction sparks are also considered ignition sources i f sufficient energy is released to initiate combustion. C.1.18 Installation Appraisal. A qualitative appraisal of the integrity and safety

of the installation. C.1.19 Intrinsically

Safe. Any instrument, equipment, or wiring that is incapable of releasing sufficient elec trical or thermal energy under normal operating conditions, anticipated failure conditions (see § 25.981(a)(3)), and environmental conditions which could cause an ignition source within the fuel tank. C.1.20 Latent Failure. A failure whose presence may not be readil y apparent to the flightcrew or maintenance personnel. A significant latent failure is one that would, in combination with one or more specific failures or events, result in a hazardous or catastrophic failure condition. C.1.21 Line Replacement Unit (LRU). Any components that can be replaced while the airplane remains in operational service. Examples of fuel sy stem LRUs include components such as cockpit and refueling panel fuel quantity indicators, fuel quantity s ys tem processors, and fuel s ys tem management co ntrol units. C.1.22 Maximum Allowable Surface Temperatures. A surface temperature within the fuel tank (the tank walls, baffles, or any components) that provides a safe margin under all normal or failure conditions, which is at least 50 °F (10 °C) below the lowes t expected auto - ignition temperature of the approved fuels. The auto - ignition temperature of fuels will vary because of a variety

of factors (ambient pressure, dwell time, fuel ty pe, etc.). The value accepted b y the FAA without further substantiation for kerosene fuels, such as Jet A, under static sea level conditions, is 450 °F (232.2 °C). This results in a maximum allowable surface temperature of 400 °F (204.4 °C) for an affected component surface. C.1.23 Qualitative. Those analy tical processes that assess sy ste m and airplane safety in an objective, non - numerical manner. C.1.24 Quantitative. Those analy tical processes that apply mathematical methods to assess sy stem and airplane safety . C.1.25 Transient Suppression Device (TSD). A device that limits transient voltages or currents on wiring to s ys tems such as the fuel tank quantity , fuel temperature sensors, and fuel level switches, etc., to a predetermined level.**Advisory Circular Feedba ck** 

If you find an error in this advisory circular (AC), have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by

(1) emailing this form to 9 - AWA - AVS - AI R500 - Coord@faa.gov or (2) faxing it to the attention of the Aircraft Certification Service Directives Management Officer at (202) 267 - 3983. Subject: (insert AC title/number here) Date: Click here to enter text. Please check all appropriate line items: ☐ An error (procedural or ty pographical) has been noted in paragraph Click here to enter text. on page Click here to enter text. . ☐ Recommend paragraph Click here to enter text. on page Click here to enter text. be changed as follows: Click here to enter text. ☐ In a future change to this AC, please cover the following subject: (Briefly describe what you want added.) Click here to enter text. ☐ Other comments: Click here to enter text. ☐ I would like to discuss the above. Please contact me. Submitted by : Date: