23086 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Parts 21, 25, 91, 121, 125, and

129

[Docket No. FAA–1999–6411; Amendment

Nos. 21–78, 25–102, 91–266, 121–282, 125–

36, 129–30]

RIN 2120–AG62

Transport Airplane Fuel Tank System

Design Review, Flammability

Reduction, and Maintenance and

Inspection Requirements

AGENCY: Federal Aviation

Administration (FAA), DOT.

ACTION: Final rule.

SUMMARY: This rule requires design

approval holders of certain turbinepowered transport category airplanes,

and of any subsequent modifications to

these airplanes, to substantiate that the

design of the fuel tank system precludes

the existence of ignition sources within

the airplane fuel tanks. It also requires

developing and implementing

maintenance and inspection

instructions to assure the safety of the

fuel tank system. For new type designs,

this rule also requires demonstrating

that ignition sources cannot be present

in fuel tanks when failure conditions are

considered, identifying any safetycritical maintenance actions, and

incorporating a means either to

minimize development of flammable

vapors in fuel tanks or to prevent

catastrophic damage if ignition does

occur. These actions are based on

accident investigations and adverse

service experience, which have shown

that unforeseen failure modes and lack

of specific maintenance procedures on

certain airplane fuel tank systems may

result in degradation of design safety

features intended to preclude ignition of

vapors within the fuel tank.

EFFECTIVE DATE: June 6, 2001.

FOR FURTHER INFORMATION CONTACT:

Michael E. Dostert, FAA, Propulsion/

Mechanical Systems Branch, ANM–112,

Transport Airplane Directorate, Aircraft

Certification Service, 1601 Lind Avenue

SW., Renton, Washington 98055–4056;

telephone (425) 227–2132, facsimile

(425) 227–1320; e-mail:

mike.dostert@faa.gov.

SUPPLEMENTARY INFORMATION:

Availability of Final Rules

You can get an electronic copy using

the Internet by taking the following

steps:

(1) Go to the search function of the

Department of Transportation’s

electronic Docket Management System

(DMS) Web page (http://dms.dot.gov/

search).

(2) On the search page type in the last

four digits of the Docket number shown

at the beginning of this notice. Click on

‘‘search.’’

(3) On the next page, which contains

the Docket summary information for the

Docket you selected, click on the final

rule.

(4) To view or download the

document click on either ‘‘Scanned

Image (TIFF)’’ or ‘‘Adobe PDF.’’

You can also get an electronic copy

using the Internet through FAA’s web

page at http://www.faa.gov/avr/arm/

nprm/nprm.htm or the Federal

Register’s web page at http://

www.access.gpo.gov/su_docs/aces/

aces140.html.

You can also get a copy by submitting

a request to the Federal Aviation

Administration, Office of Rulemaking,

ARM–1, 800 Independence Avenue

SW., Washington, DC 20591, or by

calling (202) 267–9680. Make sure to

identify the amendment number or

docket number of this final rule.

Small Business Regulatory Enforcement

Fairness Act

The Small Business Regulatory

Enforcement Fairness Act (SBREFA) of

1996 requires FAA to comply with

small entity requests for information or

advice about compliance with statutes

and regulations within its jurisdiction.

Therefore, any small entity that has a

question regarding this document may

contact their local FAA official, or the

person listed under FOR FURTHER

INFORMATION CONTACT. You can find out

more about SBREFA on the Internet at

our site, http://www.gov/avr/arm/

sbrefa.htm. For more information on

SBREFA, e-mail us at 9–AWA–

SBREFA@faa.gov.

Background

On October 26, 1999, the FAA issued

Notice of Proposed Rulemaking (NPRM)

99–18, which was published in the

Federal Register on October 29, 1999

(64 FR 58644). That notice proposed

three separate requirements:

First, a requirement was proposed for

the design approval holders of certain

transport category airplanes to conduct

a safety review of the airplane fuel tank

system and to develop specific fuel tank

system maintenance and inspection

instructions for any items determined to

require repetitive inspections or

maintenance.

Second, a requirement was proposed

to prohibit the operation of those

airplanes beyond a specified time,

unless the operators of those airplanes

incorporated instructions for

maintenance and inspection of the fuel

tank system into their inspection

programs.

Third, for new designs, the proposal

included a requirement for minimizing

the flammability of fuel tanks, a

requirement concerning detailed failure

analysis to preclude the presence of

ignition sources in the fuel tanks and

including mandatory fuel system

maintenance in the limitations section

of the Instructions for Continued

Airworthiness.

Issues Prompting This Rulemaking

Activity

On July 17, 1996, a 25-year old Boeing

Model 747–100 series airplane was

involved in an inflight breakup after

takeoff from Kennedy International

Airport in New York, resulting in 230

fatalities. The accident investigation

conducted by the National

Transportation Safety Board (NTSB)

indicated that the center wing fuel tank

exploded due to an unknown ignition

source. The NTSB issued

recommendations intended to:

• Reduce heating of the fuel in the

center wing fuel tanks on the existing

fleet of transport airplanes,

• Reduce or eliminate operation with

flammable vapors in the fuel tanks of

new type certificated airplanes, and

• Reevaluate the fuel system design

and maintenance practices on the fleet

of transport airplanes.

The accident investigation focused on

mechanical failure as providing the

energy source that ignited the fuel

vapors inside the tank.

The NTSB announced their official

findings of the TWA 800 accident at a

public meeting held August 22–23,

2000, in Washington, DC. The NTSB

determined that the probable cause of

the explosion was ignition of the

flammable fuel/air mixture in the center

wing fuel tank. Although the ignition

source could not be determined with

certainty, the NTSB determined that the

most likely source was a short circuit

outside of the center wing tank that

allowed excessive voltage to enter the

tank through electrical wiring associated

with the fuel quantity indication system

(FQIS). Opening remarks at the hearing

also indicated that:

‘‘* * * This investigation and several others

have brought to light some broader issues

regarding aircraft certification. For example,

there are questions about the adequacy of the

risk analyses that are used as the basis for

demonstrating compliance with many

certification requirements.’’

This accident prompted the FAA to

examine the underlying safety issues

surrounding fuel tank explosions, the

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23087

adequacy of the existing regulations, the

service history of airplanes certificated

to these regulations, and existing

maintenance practices relative to the

fuel tank system.

Flammability Characteristics

The flammability characteristics of

the various fuels approved for use in

transport airplanes results in the

presence of flammable vapors in the

vapor space of fuel tanks at various

times during the operation of the

airplane. Vapors from Jet A fuel (the

typical commercial turbojet engine fuel)

at temperatures below approximately

100°F are too lean to be flammable at

sea level; at higher altitudes the fuel

vapors become flammable at

temperatures above approximately 45°F

(at 40,000 feet altitude).

However, the regulatory authorities

and aviation industry have always

presumed that a flammable fuel air

mixture exists in the fuel tanks at all

times and have adopted the philosophy

that the best way to ensure airplane fuel

tank safety is to preclude ignition

sources within fuel tanks. This

philosophy has been based on the

application of fail-safe design

requirements to the airplane fuel tank

system to preclude ignition sources

from being present in fuel tanks when

component failures, malfunctions, or

lightning encounters occur.

Possible ignition sources that have

been considered include:

• Electrical arcs,

• Friction sparks, and

• Autoignition. (The autoignition

temperature is the temperature at which

the fuel/air mixture will spontaneously

ignite due to heat in the absence of an

ignition source.)

Some events that could produce

sufficient electrical energy to create an

arc include:

• Lightning,

• Electrostatic charging,

• Electromagnetic interference (EMI),

or

• Failures in airplane systems or

wiring that introduce high-power

electrical energy into the fuel tank

system.

Friction sparks may be caused by

mechanical contact between certain

rotating components in the fuel tank,

such as a steel fuel pump impeller

rubbing on the pump inlet check valve.

Autoignition of fuel vapors may be

caused by failure of components within

the fuel tank, or external components or

systems that cause components or tank

surfaces to reach a high enough

temperature to ignite the fuel vapors in

the fuel tank.

Existing Regulations/Certification

Methods

The current 14 CFR part 25

regulations that are intended to require

designs that preclude the presence of

ignition sources within the airplane fuel

tanks are as follows:

Section 25.901 is a general

requirement that applies to all portions

of the propulsion installation, which

includes the airplane fuel tank system.

It requires, in part, that the propulsion

and fuel tank systems be designed to

ensure fail-safe operation between

normal maintenance and inspection

intervals, and that the major

components be electrically bonded to

the other parts of the airplane.

Sections 25.901(c) and 25.1309

provide airplane system fail-safe

requirements. Section 25.901(c) requires

that ‘‘no single failure or malfunction or

probable combination of failures will

jeopardize the safe operation of the

airplane.’’ In general, the FAA’s policy

has been to require applicants to assume

the presence of foreseeable latent

(undetected) failure conditions when

demonstrating that subsequent single

failures will not jeopardize the safe

operation of the airplane.

Certain subsystem designs must also

comply with § 25.1309. That section

requires airplane systems and associated

systems to be:

‘‘* * * designed so that the occurrence of

any failure condition which would prevent

the continued safe flight and landing of the

airplane is extremely improbable, and the

occurrence of any other failure conditions

which would reduce the capability of the

airplane or the ability of the crew to cope

with adverse operating conditions is

improbable.’’

Compliance with § 25.1309 requires

an analysis, and testing where

appropriate, considering possible modes

of failure, including malfunctions and

damage from external sources, the

probability of multiple failures and

undetected failures, the resulting effects

on the airplane and occupants,

considering the stage of flight and

operating conditions, and the crew

warning cues, corrective action

required, and the capability of detecting

faults.

This provision has the effect of

mandating the use of ‘‘fail-safe’’ design

methods, which require that the effect of

failures and combinations of failures be

considered in defining a safe design.

Detailed methods of compliance with

§§ 25.1309(b), (c), and (d) are described

in Advisory Circular (AC) 25.1309–1A,

‘‘System Design Analysis,’’ and are

intended as a means to evaluate the

overall risk, on average, of an event

occurring within a fleet of aircraft. The

following guidance involving failures is

offered in that AC:

• In any system or subsystem, a single

failure of any element or connection

during any one flight must be assumed

without consideration as to its

probability of failing. This single failure

must not prevent the continued safe

flight and landing of the airplane.

• Additional failures during any one

flight following the first single failure

must also be considered when the

probability of occurrence is not shown

to be extremely improbable. The

probability of these combined failures

includes the probability of occurrence of

the first failure.

As described in the AC, the FAA failsafe design concept consists of the

following design principles or

techniques intended to ensure a safe

design. The use of only one of these

principles is seldom adequate. A

combination of two or more design

principles is usually needed to provide

a fail-safe design (i.e., to ensure that

catastrophic failure conditions are not

expected to occur during the life of the

fleet of a particular airplane model).

• Design integrity and quality,

including life limits, to ensure intended

function and prevent failures.

• Redundancy or backup systems that

provide system function after the first

failure (e.g., two or more engines, two or

more hydraulic systems, dual flight

controls, etc.)

• Isolation of systems and

components so that failure of one

element will not cause failure of the

other (sometimes referred to as system

independence).

• Detection of failures or failure

indication.

• Functional verification (the

capability for testing or checking the

component’s condition).

• Proven reliability and integrity to

ensure that multiple component or

system failures will not occur in the

same flight.

• Damage tolerance that limits the

safety impact or effect of the failure.

• Designed failure path that controls

and directs the failure, by design, to

limit the safety impact.

• Flightcrew procedures following

the failure designed to assure continued

safe flight by specific crew actions.

• Error tolerant design that considers

probable human error in the operation,

maintenance, and fabrication of the

airplane.

• Margins of safety that allow for

undefined and unforeseeable adverse

flight conditions.

These regulations, when applied to

typical airplane fuel tank systems, are

23088 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

intended to prevent ignition sources

inside fuel tanks. The approval of the

installation of mechanical and electrical

components inside the fuel tanks was

typically based on a qualitative system

safety analysis and component testing

which showed that:

• Mechanical components would not

create sparks or high temperature

surfaces in the event of any failure; and

• Electrical devices would not create

arcs of sufficient energy to ignite a fuelair mixture in the event of a single

failure or probable combination of

failures.

Section 25.901(b)(2) requires that the

components of the propulsion system be

‘‘constructed, arranged, and installed so

as to ensure their continued safe

operation between normal inspection or

overhauls.’’ Compliance with this

regulation is typically demonstrated by

substantiating that the propulsion

installation, which includes the fuel

tank system, will safely perform its

intended function between inspections

and overhauls defined in the

maintenance instructions.

Section 25.901(b)(4) requires

electrically bonding the major

components of the propulsion system to

the other parts of the airplane. The

affected major components of the

propulsion system include the fuel tank

system. Compliance with this

requirement for fuel tank systems has

been demonstrated by showing that all

major components in the fuel tank are

electrically bonded to the airplane

structure. This precludes accumulation

of electrical charge on the components

and the possible arcing in the fuel tank

that could otherwise occur. In most

cases, electrical bonding is

accomplished by installing jumper

wires from each major fuel tank system

component to airplane structure.

Advisory Circular 25–8, ‘‘Auxiliary Fuel

Tank Installations,’’ also provides

guidance for bonding of fuel tank

system components and means of

precluding ignition sources within

transport airplane fuel tanks.

Section 25.954 requires that the fuel

tank system be designed and arranged to

prevent the ignition of fuel vapor within

the system due to the effects of lightning

strikes. Compliance with this regulation

is typically shown by incorporation of

design features such as minimum fuel

tank skin thickness, location of vent

outlets out of likely lightning strike

areas, and bonding of fuel tank system

structure and components. Guidance for

demonstrating compliance with this

regulation is provided in AC 20–53A,

‘‘Protection of Aircraft Fuel Systems

Against Fuel Vapor Ignition Due to

Lightning.’’

Section 25.981 requires that the

applicant determine the highest

temperature allowable in fuel tanks that

provides a safe margin below the lowest

expected autoignition temperature of

the fuel that is approved for use in the

fuel tanks. No temperature at any place

inside any fuel tank where fuel ignition

is possible may then exceed that

maximum allowable temperature. This

must be shown under all probable

operating, failure, and malfunction

conditions of any component whose

operation, failure, or malfunction could

increase the temperature inside the

tank. Guidance for demonstrating

compliance with this regulation has

been provided in AC 25.981–1A,

‘‘Guidelines For Substantiating

Compliance With the Fuel Tank

Temperature Requirements.’’ The AC

provides a listing of failure modes of

fuel tank system components that

should be considered when showing

that component failures will not create

a hot surface that exceeds the maximum

allowable fuel tank component or tank

surface temperature for the fuel type for

which approval is being requested.

Manufacturers have demonstrated

compliance with this regulation by

testing and analysis of components to

show that design features, such as

thermal fuses in fuel pump motors,

preclude an ignition source in the fuel

tank when failures such as a seized fuel

pump rotor occur.

Airplane Maintenance Manuals and

Instructions for Continued

Airworthiness

Historically, manufacturers have been

required to provide maintenance-related

information for fuel tank systems in the

same manner as for other systems. Prior

to 1970, most manufacturers provided

manuals containing maintenance

information for large transport category

airplanes, but there were no standards

prescribing minimum content,

distribution, and a timeframe in which

the information must be made available

to the operator.

Section 25.1529, as amended by

Amendment 25–21 in 1970, required the

applicant for a type certificate (TC) to

provide airplane maintenance manuals

(AMM) to owners of the airplanes. This

regulation was amended in 1980 to

require that the applicant for type

certification provide Instructions for

Continued Airworthiness (ICA)

prepared in accordance with Appendix

H to part 25. In developing the ICA, the

applicant is required to include certain

information such as a description of the

airplane and its systems, servicing

information, and maintenance

instructions, including the frequency

and extent of inspections necessary to

provide for the continuing airworthiness

of the airplane (including the fuel tank

system). As required by Appendix H to

part 25, the ICA must also include an

FAA-approved Airworthiness

Limitations section enumerating those

mandatory inspections, inspection

intervals, replacement times, and

related procedures approved under

§ 25.571, relating to structural damage

tolerance. Before this amendment, the

Airworthiness Limitations section of the

ICA applied only to airplane structure

and not to the fuel tank system.

One method of establishing initial

scheduled maintenance and inspection

tasks is the Maintenance Steering Group

(MSG) process, which develops a

Maintenance Review Board (MRB)

document for a particular airplane

model. Operators may incorporate those

provisions, along with other

maintenance information contained in

the ICA, into their maintenance or

inspection program.

Section 21.50 requires the holder of a

design approval, including a TC or

supplemental type certificate (STC) for

an airplane, aircraft engine, or propeller

for which application was made after

January 28, 1981, to furnish at least one

set of the complete ICA to the owner of

the product for which the application

was made. The ICA for original type

certificated products must include

instructions for the fuel tank system. A

design approval holder who has

modified the fuel tank system must

furnish a complete set of the ICA for the

modification to the owner of the

product.

Type Certificate Amendments Based on

Major Change in Type Design

Over the years, design changes have

been introduced into fuel tank systems

that may affect their safety. There are

three ways in which major design

changes can be approved:

1. The TC holder may be granted an

amendment to the type design.

2. Any person, including the TC

holder, wanting to alter a product by

introducing a major change in the type

design not great enough to require a new

application for a TC, may be granted an

STC.

3. In some instances, a person may

also make an alteration to the type

design and receive a field approval. The

field approval process is a method for

obtaining approval of relatively simple

modifications to airplanes. In this

process, an authorized FAA Flight

Standards Inspector can approve the

alteration by use of FAA Form 337.

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23089

Maintenance and Inspection Program

Requirements

Airplane operators are required to

have extensive maintenance or

inspection programs that include

provisions relating to fuel tank systems.

Section 91.409(e), which generally

applies to other than commercial

operations, requires an operator of a

large turbojet multiengine airplane or a

turbopropeller-powered multiengined

airplane to select one of the following

four inspection programs:

1. A continuous airworthiness

inspection program that is part of a

continuous airworthiness maintenance

program currently in use by a person

holding an air carrier operating

certificate, or an operating certificate

issued under part 119 for operations

under parts 121 or 135, and operating

that make and model of airplane under

those parts;

2. An approved airplane inspection

program approved under § 135.419 and

currently in use by a person holding an

operating certificate and operations

specifications issued under part 119 for

part 135 operations;

3. A current inspection program

recommended by the manufacturer; or

4. Any other inspection program

established by the registered owner or

operator of that airplane and approved

by the Administrator.

Section 121.367, which is applicable

to those air carrier and commercial

operations covered by part 121, requires

operators to have an inspection

program, as well as a program covering

other maintenance, preventative

maintenance, and alterations.

Section 125.247, which is generally

applicable to operation of large

airplanes, other than air carrier

operations conducted under part 121,

requires operators to inspect their

airplanes in accordance with an

inspection program approved by the

Administrator.

Section 129.14 requires a foreign air

carrier and each foreign operator of a

U.S. registered airplane in common

carriage, within or outside the U.S., to

maintain the airplane in accordance

with an FAA-approved program.

In general, the operators rely on the

TC data sheet, MRB reports, ICA’s, the

Airworthiness Limitations section of the

ICA, other manufacturers’

recommendations, and their own

operating experience to develop the

overall maintenance or inspection

program for their airplanes.

The intent of the rules governing the

inspection and/or maintenance program

is to ensure that the inherent level of

safety that was originally designed into

the system is maintained and that the

airplane is in an airworthy condition.

Historically, for fuel tank systems

these required programs include:

• Operational checks (e.g., a task to

determine if an item is fulfilling its

intended function);

• Functional checks (e.g., a

quantitative task to determine if

functions perform within specified

limits);

• Overhaul of certain components to

restore them to a known standard; and

• General zonal visual inspections

conducted concurrently with other

maintenance actions, such as structural

inspections.

However, specific maintenance

instructions to detect and correct

conditions that degrade fail-safe

capabilities have not been deemed

necessary because it has been assumed

that the original fail-safe capabilities

would not be degraded in service.

Design and Service History Review

The FAA has examined the service

history of transport airplanes and

performed an analysis of the history of

fuel tank explosions on these airplanes.

While there were a significant number

of fuel tank fires and explosions that

occurred during the 1960’s and 1970’s

on several airplane types, in most cases,

the fire or explosion was found to be

related to design practices, maintenance

actions, or improper modification of

fuel pumps. Some of the events were

apparently caused by lightning strikes.

Extensive design reviews were

conducted to identify possible ignition

sources, and actions were taken that

were intended to prevent similar

occurrences. However, fuel tank systemrelated accidents have occurred in spite

of these efforts.

On May 11, 1990, the center wing fuel

tank of a Boeing Model 737–300

exploded while the airplane was on the

ground at Nimoy Aquino International

Airport, Manila, Philippines. The

airplane was less than one year old. In

the accident, the fuel-air vapors in the

center wing tank exploded as the

airplane was being pushed back from a

terminal gate prior to flight. The

accident resulted in 8 fatalities and

injuries to an additional 30 people.

Accident investigators considered a

plausible scenario in which damaged

wiring located outside the fuel tank

might have created a short between 115-

volt airplane system wires and 28 volt

wires to a fuel tank level switch. This,

in combination with a possible latent

defect of the fuel level float switch, was

investigated as a possible source of

ignition. However, a definitive ignition

source was never confirmed during the

accident investigation. This

unexplained accident occurred on a

newer airplane, in contrast to the July

17, 1996, accident that occurred on an

older Boeing Model 747 airplane that

was approaching the end of its initial

design life.

The Model 747 and 737 accidents

indicate that the development of an

ignition source inside the fuel tank may

be related to both the design and

maintenance of the fuel tank systems.

National Transportation Safety Board

(NTSB) Recommendations

Since the July 17, 1996, accident, the

FAA, NTSB, and aviation industry have

been reviewing the design features and

service history of the Boeing Model 747

and certain other transport airplane

models. Based upon its review, the

NTSB has issued the following

recommendations to the FAA intended

to reduce exposure to operation with

flammable vapors in fuel tanks and

address possible degradation of the

original type certificated fuel tank

system designs on transport airplanes.

The following recommendations

relate to ‘‘Reduced Flammability

Exposure’’:

‘‘A–96–174: Require the development

of and implementation of design or

operational changes that will preclude

the operation of transport-category

airplanes with explosive fuel-air

mixtures in the fuel tanks:

LONG TERM DESIGN

MODIFICATIONS:

(a) Significant consideration should

be given to the development of airplane

design modification, such as nitrogeninerting systems and the addition of

insulation between heat-generating

equipment and fuel tanks. Appropriate

modifications should apply to newly

certificated airplanes and, where

feasible, to existing airplanes.’’

‘‘A–96–175: Require the development

of and implementation of design or

operational changes that will preclude

the operation of transport-category

airplanes with explosive fuel-air

mixtures in the fuel tanks:

NEAR TERM OPERATIONAL

(b) Pending implementation of design

modifications, require modifications in

operational procedures to reduce the

potential for explosive fuel-air mixtures

in the fuel tanks of transport-category

aircraft. In the B–747, consideration

should be given to refueling the center

wing fuel tank (CWT) before flight

whenever possible from cooler ground

fuel tanks, proper monitoring and

management of the CWT fuel

temperature, and maintaining an

appropriate minimum fuel quantity in

the CWT.’’

23090 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

‘‘A–96–176: Require that the B–747

Flight Handbooks of TWA and other

operators of B–747s and other aircraft in

which fuel tank temperature cannot be

determined by flightcrews be

immediately revised to reflect the

increases in CWT fuel temperatures

found by flight tests, including

operational procedures to reduce the

potential for exceeding CWT

temperature limitations.’’

‘‘A–96–177: Require modification of

the CWT of B–747 airplanes and the fuel

tanks of other airplanes that are located

near heat sources to incorporate

temperature probes and cockpit fuel

tank temperature displays to permit

determination of the fuel tank

temperatures.’’

The following recommendations

relate to ‘‘Ignition Source Reduction’’:

‘‘A–98–36: Conduct a survey of fuel

quantity indication system probes and

wires in Boeing Model 747’s equipped

with systems other than Honeywell

Series 1–3 probes and compensators and

in other model airplanes that are used

in Title 14 Code of Federal Regulations

Part 121 service to determine whether

potential fuel tank ignition sources exist

that are similar to those found in the

Boeing Model 747. The survey should

include removing wires from fuel

probes and examining the wires for

damage. Repair or replacement

procedures for any damaged wires that

are found should be developed.’’

‘‘A–98–38: Require in Boeing Model

747 airplanes, and in other airplanes

with fuel quantity indication system

(FQIS) wire installations that are corouted with wires that may be powered,

the physical separation and electrical

shielding of FQIS wires to the maximum

extent possible.’’

‘‘A–98–39: Require, in all applicable

transport airplane fuel tanks, surge

protection systems to prevent electrical

power surges from entering fuel tanks

through fuel quantity indication system

wires.’’

Service History

The FAA has reviewed service

difficulty reports for the transport

airplane fleet and evaluated the

certification and design practices

utilized on these previously certificated

airplanes. An inspection of fuel tanks on

Boeing Model 747 airplanes also was

initiated. Representatives from the Air

Transport Association (ATA),

Association of European Airlines (AEA),

the Association of Asia Pacific Airlines

(AAPA), the Aerospace Industries

Association of America, and the

European Association of Aerospace

Industries initiated a joint effort to

inspect and evaluate the condition of

the fuel tank system installations on a

representative sample of airplanes

within the transport fleet. The fuel tanks

of more than 800 airplanes were

inspected. Data from inspections

conducted as part of this effort and

shared with the FAA have assisted in

establishing a basis for developing

corrective action for airplanes within

the transport fleet.

In addition to the results from these

inspections, the FAA has received

reports of anomalies on in-service

airplanes that have necessitated actions

to preclude development of ignition

sources in or adjacent to airplane fuel

tanks.

The following provides a summary of

findings from design evaluations,

service difficulty reports, and a review

of current airplane maintenance

practices.

Aging Airplane Related Phenomena

Fuel tank inspections initiated as part

of the Boeing Model 747 accident

investigation identified aging of fuel

tank system components,

contamination, corrosion of components

and sulfide deposits on components as

possible conditions that could

contribute to development of ignition

sources within the fuel tanks. Results of

detailed inspection of the fuel pump

wiring on several Boeing Model 747

airplanes showed debris within the fuel

tanks consisting of lockwire, rivets, and

metal shavings. Debris was also found

inside scavenge pumps. Corrosion and

damage to insulation on FQIS probe

wiring was found on 6 out of 8 probes

removed from one in-service airplane.

In addition, inspection of airplane

fuel tank system components from outof-service (retired) airplanes, initiated

following the accident, revealed

damaged wiring and corrosion buildup

of conductive sulfide deposits on the

FQIS wiring on some Boeing Model 747

airplanes. The conductive deposits or

damaged wiring may result in a location

where arcing could occur if high power

electrical energy was transmitted to the

FQIS wiring from adjacent wires that

power other airplane systems.

While the effects of corrosion on fuel

tank system safety have not been fully

evaluated, the FAA has initiated a

research program to better understand

the effects of sulfide deposits and

corrosion on the safety of airplane fuel

tank systems.

Wear or chafing of electrical power

wires routed in conduits that are located

inside fuel tanks can result in arcing

through the conduits. On December 23,

1996, the FAA issued Airworthiness

Directive (AD) 96–26–06, applicable to

certain Boeing Model 747 airplanes,

which required inspection of electrical

wiring routed within conduits to fuel

pumps located in the wing fuel tanks

and replacement of any damaged

wiring. Inspection reports indicated that

many instances of wear had occurred on

Teflon sleeves installed over the wiring

to protect it from damage and possible

arcing to the conduit.

Inspections of wiring to fuel pumps

on Boeing Model 737 airplanes with

over 35,000 flight hours have shown

significant wear to the insulation of

wires inside conduits that are located in

fuel tanks. In nine reported cases, wear

resulted in arcing to the fuel pump wire

conduit on airplanes with greater than

50,000 flight hours. In one case, wear

resulted in burnthrough of the conduit

into the interior of the 737 main tank

fuel cell. On May 14, 1998, the FAA

issued a telegraphic AD, T98–11–52,

which required inspection of wiring to

Boeing Model 737 airplane fuel pumps

routed within electrical conduits and

replacement of any damaged wiring.

Results of these inspections showed that

wear of the wiring occurred in many

instances, particularly on those

airplanes with high numbers of flight

cycles and operating hours.

The FAA also has received reports of

corrosion on bonding jumper wires

within the fuel tanks on one in-service

Airbus Model A300 airplane. The

manufacturer investigating this event

did not have sufficient evidence to

determine conclusively the level of

damage and corrosion found on the

jumper wires. Although the airplane

was in long-term storage, it does not

explain why a high number of damaged/

corroded jumper wires were found

concentrated in a specific area of the

wing tanks. Further inspections of a

limited number of other Airbus models

did not reveal similar extensive

corrosion or damage to bonding jumper

wires. However, they did reveal

evidence of the accumulation of sulfide

deposits around the outer braid of some

jumper wires. Tests by the manufacturer

have shown that these deposits did not

affect the bonding function of the leads.

Airbus has developed a one-timeinspection service bulletin for all its

airplanes to ascertain the extent of the

sulfide deposits and to ensure that the

level of jumper wire damage found on

the one Model A300 airplane is not

widespread.

On March 30, 1998, the FAA received

reports of three recent instances of

electrical arcing within fuel pumps

installed in fuel tanks on Lockheed

Model L–1011 airplanes. In one case,

the electrical arc had penetrated the

pump and housing and entered the fuel

tank. Preliminary investigation indicates

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23091

that features incorporated into the fuel

pump design that were intended to

preclude overheating and arc-through

into the fuel tank may not have

functioned as intended due to

discrepancies introduced during

overhaul of the pumps. Emergency AD

98–08–09 was issued April 3, 1998, to

specify a minimum quantity of fuel to

be carried in the fuel tanks for the

purpose of covering the pumps with

liquid fuel and thereby precluding

ignition of vapors within the fuel tank

until such time as terminating corrective

action could be developed.

Unforeseen Fuel Tank System Failures

After an extensive review of the

Boeing Model 747 design following the

July 17, 1996, accident, the FAA

determined that during original

certification of the fuel tank system, the

degree of tank contamination and the

significance of certain failure modes of

fuel tank system components had not

been considered to the extent that more

recent service experience indicates is

needed. For example, in the absence of

contamination, the FQIS had been

shown to preclude creating an arc if

FQIS wiring were to come in contact

with the highest level of electrical

voltage on the airplane. This was shown

by demonstrating that the voltage

needed to cause an arc in the fuel

probes due to an electrical short

condition was well above any voltage

level available in the airplane systems.

However, recent testing has shown

that if contamination, such as

conductive debris (lock wire, nuts,

bolts, steel wool, corrosion, sulfide

deposits, metal filings, etc.) is placed

within gaps in the fuel probe, the

voltage needed to cause an arc is within

values that may occur due to a

subsequent electrical short or induced

current on the FQIS probe wiring from

electromagnetic interference caused by

adjacent wiring. These anomalies, by

themselves, could not lead to an

electrical arc within the fuel tanks

without the presence of an additional

failure. If any of these anomalies were

combined with a subsequent failure

within the electrical system that creates

an electrical short, or if high-intensity

radiated fields (HIRF) or electrical

current flow in adjacent wiring induces

EMI voltage in the FQIS wiring,

sufficient energy could enter the fuel

tank and cause an ignition source

within the tank.

On November 26, 1997, in Docket No.

97–NM–272–AD, the FAA proposed a

requirement for operators of Boeing

Model 747–100, –200, and –300 series

airplanes to install components for the

suppression of electrical transients and/

or the installation of shielding and

separation of fuel quantity indicating

system wiring from other airplane

system wiring. After reviewing the

comments received on the proposed

requirements, the FAA issued AD 98–

20–40 on September 23, 1998, that

requires the installation of shielding and

separation of the electrical wiring of the

fuel quantity indication system. On

April 14, 1998, the FAA proposed a

similar requirement for Boeing Model

737–100, –200, –300, –400, and –500

series airplanes in Docket No. 98–NM–

50–AD, which led to the FAA issuing

AD 99–03–04 on January 26, 1999. The

action required by those two

airworthiness directives is intended to

preclude high levels of electrical energy

from entering the airplane fuel tank

wiring due to electromagnetic

interference or electrical shorts. Several

manufacturers have been granted

approval for the use of alternative

methods of compliance (AMOC) with

these AD’s that permit installation of

transient suppressing devices in the

FQIS wiring that prevent unwanted

electrical power from entering the fuel

tank. All later model Boeing Model 747

and 737 FQIS’s have wire separation

and fault isolation features that may

meet the intent of these AD actions.

This rulemaking will require evaluation

of these later designs and the designs of

other transport airplanes.

Other examples of unanticipated

failure conditions include incidents of

parts from fuel pump assemblies

impacting or contacting the rotating fuel

pump impeller. The first design

anomaly was identified when two

incidents of damage to fuel pumps were

reported on Boeing Model 767

airplanes. In both cases objects from a

fuel pump inlet diffuser assembly were

ingested into the fuel pump, causing

damage to the pump impeller and pump

housing. The damage could have caused

sparks or hot debris from the pump to

enter the fuel tank. To address this

unsafe condition, the FAA issued AD

97–19–15. This AD requires revision of

the airplane flight manual to include

procedures to switch off the fuel pumps

when the center tank approaches empty.

The intent of this interim action is to

maintain liquid fuel over the pump inlet

so that any debris generated by a failed

fuel pump will not come in contact with

fuel vapors and cause a fuel tank

explosion.

The second design anomaly was

reported on Boeing Model 747–400

series airplanes. The reports indicated

that inlet adapters of the override/

jettison pumps of the center wing fuel

tank were worn. Two of the inlet

adapters had worn down enough to

cause damage to the rotating blades of

the inducer. The inlet check valves also

had significant damage. An operator

reported damage to the inlet adapter so

severe that contact had occurred

between the steel disk of the inlet check

valve and the steel screw that holds the

inducer in place. Wear to the inlet

adapters has been attributed to contact

between the inlet check valve and the

adapter. Such excessive wear of the

inlet adapter can lead to contact

between the inlet check valve and

inducer, which could result in pieces of

the check valve being ingested into the

inducer and damaging the inducer and

impellers. Contact between the steel

disk of the inlet check valve and the

steel rotating inducer screw can cause

sparks. To address this unsafe

condition, the FAA issued an

immediately adopted rule, AD 98–16–

19, on July 30, 1998.

Another design anomaly was reported

in 1989 when a fuel tank ignition event

occurred in an auxiliary fuel tank

during refueling of a Beech Model 400

airplane. The auxiliary fuel tank had

been installed under an STC.

Polyurethane foam had been installed in

portions of the tank to minimize the

potential of a fuel tank explosion if

uncontained engine debris penetrated

those portions of the tank. The accident

investigation indicated that electrostatic

charging of the foam during refueling

resulted in ignition of fuel-air vapors in

portions of the adjacent fuel tank system

that did not contain the foam. The fuel

vapor explosion caused distortion of the

tank and fuel leakage from a failed fuel

line. Modifications to the design,

including use of more conductive

polyurethane foam and installation of a

standpipe in the refueling system, were

incorporated to prevent reoccurrence of

electrostatic charging and a resultant

fuel tank ignition source.

Review of Fuel Tank System

Maintenance Practices

In addition to the review of the design

features and service history of the

Boeing Model 747 and other airplane

models in the transport airplane fleet,

the FAA also has reviewed the current

fuel tank system maintenance practices

for these airplanes.

Typical transport category airplane

fuel tank systems are designed with

redundancy and fault indication

features such that single component

failures do not result in any significant

reduction in safety. Therefore, fuel tank

systems historically have not had any

life-limited components or specific

detailed inspection requirements, unless

mandated by airworthiness directives.

23092 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

Most of the components are ‘‘on

condition,’’ meaning that some test,

check, or other inspection is performed

to determine continued serviceability,

and maintenance is performed only if

the inspection identifies a condition

requiring correction. Visual inspection

of fuel tank system components is by far

the predominant method of inspection

for components such as boost pumps,

fuel lines, couplings, wiring, etc.

Typically, these inspections are

conducted concurrently with zonal

inspections or internal or external fuel

tank structural inspections. These

inspections normally do not provide

information regarding the continued

serviceability of components within the

fuel tank system, unless the visual

inspection indicates a potential problem

area. For example, it would be difficult,

if not impossible, to detect certain

degraded fuel tank system conditions,

such as worn wiring routed through

conduit to fuel pumps, debris inside

fuel pumps, corrosion to bonding wire

interfaces, etc., without dedicated

intrusive inspections that are much

more extensive than those normally

conducted.

Listing of Deficiencies

The list provided below summarizes

fuel tank system design deficiencies,

malfunctions, failures, and

maintenance-related actions that have

been determined through service

experience to result in a degradation of

the safety features of airplane fuel tank

systems. This list was developed from

service difficulty reports and incident

and accident reports. These anomalies

occurred on in-service transport

category airplanes despite regulations

and policies in place to preclude the

development of ignition sources within

airplane fuel tank systems.

1. Pumps:

• Ingestion of the pump inducer into

the pump impeller and generation of

debris into the fuel tank.

• Pump inlet case degradation,

allowing the pump inlet check valve to

contact the impeller.

• Stator winding failures during

operation of the fuel pump. Subsequent

failure of a second phase of the pump

resulting in arcing through the fuel

pump housing.

• Deactivation of thermal protective

features incorporated into the windings

of pumps due to inappropriate

wrapping of the windings.

• Omission of cooling port tubes

between the pump assembly and the

pump motor assembly during fuel pump

overhaul.

• Extended dry running of fuel

pumps in empty fuel tanks, which was

contrary to the manufacturer’s

recommended procedures.

• Use of steel impellers that may

produce sparks if debris enters the

pump.

• Debris lodged inside pumps.

• Arcing due to the exposure of

electrical connections within the pump

housing that have been designed with

inadequate clearance to the pump cover.

• Thermal switches resetting over

time to a higher trip temperature.

• Flame arrestors falling out of their

respective mounting.

• Internal wires coming in contact

with the pump rotating group,

energizing the rotor and arcing at the

impeller/adapter interface.

• Poor bonding across component

interfaces.

• Insufficient ground fault current

protection capability.

• Poor bonding of components to

structure.

2. Wiring to pumps in conduits

located inside fuel tanks: 

• Wear of Teflon sleeving and wiring

insulation allowing arcing from wire

through metallic conduits into fuel

tanks.

3. Fuel pump connectors: 

• Electrical arcing at connections

within electrical connectors due to bent

pins or corrosion.

• Fuel leakage and subsequent fuel

fire outside of the fuel tank caused by

corrosion of electrical connectors inside

the pump motor which lead to electrical

arcing through the connector housing

(connector was located outside the fuel

tank).

• Selection of improper materials in

connector design.

4. FQIS wiring: 

• Degradation of wire insulation

(cracking), corrosion and sulfide

deposits at electrical connectors

• Unshielded FQIS wires routed in

wire bundles with high voltage wires.

5. FQIS probes: 

• Corrosion and sulfide deposits

causing reduced breakdown voltage in

FQIS wiring.

• Terminal block wiring clamp (strain

relief) features at electrical connections

on fuel probes causing damage to wiring

insulation.

• Contamination in the fuel tanks

causing a reduced arc path between

FQIS probe walls (steel wool, lock wire,

nuts, rivets, bolts; or mechanical impact

damage to probes).

6. Bonding straps: 

• Corrosion to bonding straps.

• Loose or improperly grounded

attachment points.

• Static bonds on fuel tank system

plumbing connections inside the fuel

tank worn due to mechanical wear of

the plumbing from wing movement and

corrosion.

7. Electrostatic charge: 

• Use of non-conductive reticulated

polyurethane foam that holds

electrostatic charge buildup.

• Spraying of fuel into fuel tanks

through inappropriately designed

refueling nozzles or pump cooling flow

return methods.

Fuel Tank Flammability

In addition to the review of potential

fuel tank ignition, the FAA has

undertaken a parallel effort to address

the threat of fuel tank explosions by

eliminating or significantly reducing the

presence of explosive fuel air mixtures

within the fuel tanks of new type

designs, in-production, and the existing

fleet of transport airplanes.

On April 3, 1997, the FAA published

a notice in the Federal Register (62 FR

16014) that requested comments

concerning the 1996 NTSB

recommendations regarding reduced

flammability listed earlier in this notice.

That notice provided significant

discussion of service history,

background, and issues relating to

reducing flammability in transport

airplane fuel tanks. Review of the

comments submitted to that notice

indicated that additional information

was needed before the FAA could

initiate rulemaking action to address the

recommendations.

On January 23, 1998, the FAA

published a notice in the Federal

Register that established and tasked an

Aviation Rulemaking Advisory

Committee (ARAC) working group, the

Fuel Tank Harmonization Working

Group (FTHWG), to provide additional

information prior to rulemaking. The

ARAC consists of interested parties,

including the public, and provides a

public process to advise the FAA

concerning development of new

regulations.

Note: The FAA formally established ARAC

in 1991 (56 FR 2190, January 22, 1991), to

provide advice and recommendations

concerning the full range of the FAA’s safetyrelated rulemaking activity.

The FTHWG evaluated numerous

possible means of reducing or

eliminating hazards associated with

explosive vapors in fuel tanks. On July

23, 1998, the ARAC submitted its report

to the FAA. The full report is in the

docket created for this ARAC working

group (Docket No. FAA–1998–4183).

This docket can be reviewed on the U.S.

Department of Transportation electronic

Document Management System on the

Internet at http://dms.dot.gov. The full

report is also in the docket for this

rulemaking.

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23093

The report provided a

recommendation for the FAA to initiate

rulemaking action to amend § 25.981,

applicable to new type design airplanes,

to include a requirement to limit the

time transport airplane fuel tanks could

operate with flammable vapors in the

vapor space of the tank. The

recommended regulatory text proposed,

‘‘Limiting the development of

flammable conditions in the fuel tanks,

based on the intended fuel types, to less

than 7 percent of the expected fleet

operational time, or providing means to

mitigate the effects of an ignition of fuel

vapors within the fuel tanks such that

any damage caused by an ignition will

not prevent continued safe flight and

landing.’’ The report discussed various

options of showing compliance with

this proposal, including managing heat

input to the fuel tanks, installation of

inerting systems or polyurethane fire

suppressing foam, and suppressing an

explosion if one occurred, etc.

The level of flammability defined in

the proposal was established based

upon comparison of the safety record of

center wing fuel tanks that, in certain

airplanes, are heated by equipment

located under the tank, and unheated

fuel tanks located in the wing. The

FTHWG concluded that the safety

record of fuel tanks located in the wings

was adequate and that if the same level

could be achieved in center wing fuel

tanks, the overall safety objective would

be achieved. Results from thermal

analyses documented in the report

indicate that center wing fuel tanks that

are heated by air conditioning

equipment located beneath them

contain flammable vapors, on a fleet

average basis, for up to 30 percent of the

fleet operating time.

During the ARAC review it was also

determined that certain airplane types

do not locate heat sources adjacent to

the fuel tanks. These airplanes provide

significantly reduced flammability

exposure, near the 5 percent value of the

wing tanks. The group therefore

determined that it would be feasible to

design new airplanes such that fuel tank

operation in the flammable range would

be limited to near that of the wing fuel

tanks. The primary method of

compliance with the requirement

proposed by the ARAC would likely be

to control heat transfer into and out of

fuel tanks such that heating of the fuel

would not occur. Design features such

as locating the air conditioning

equipment away from the fuel tanks,

providing ventilation of the air

conditioning bay to limit heating and

cool fuel tanks, and/or insulating the

tanks from heat sources, would be

practical means of complying with the

regulation proposed by the ARAC.

In addition to its recommendation to

revise § 25.981, the ARAC also

recommended that the FAA continue to

evaluate means for minimizing the

development of flammable vapors

within the fuel tanks to determine

whether other alternatives, such as

ground based inerting of fuel tanks,

could be shown to be cost effective.

To address the ARAC

recommendations, the FAA initiated

research and development activity to

determine the feasibility of requiring

ground-based inerting. The results of

this activity are documented in report

No. DOT/FAA/AR–00/19, ‘‘The Cost of

Implementing Ground-Based Fuel Tank

Inerting in the Commercial Fleet.’’ A

copy of the report is in the docket for

this rulemaking. In addition, on July 14,

2000 (65 FR 43800), the FAA tasked the

ARAC to conduct a technical evaluation

of certain fuel tank inerting methods

that would reduce the flammability of

the fuel tanks on both new type designs

and in-service airplanes.

The FAA is also evaluating the

potential benefits of using directed

ventilation methods to reduce the

flammability exposure of fuel tanks that

are located near significant heat sources.

Discussion of the Final Rule

The FAA review of the service

history, design features, and

maintenance instructions of the

transport airplane fleet indicates that

aging of fuel tank system components

and unforeseen fuel tank system failures

and malfunctions have become a safety

issue for the fleet of turbine-powered

transport category airplanes. The FAA is

amending the current regulations in four

areas.

The first area of concern encompasses

the possibility of the development of

ignition sources within the existing

transport airplane fleet. Many of the

design practices used on airplanes in

the existing fleet are similar. Therefore,

anomalies that have developed on

specific airplane models within the fleet

could develop on other airplane models.

As a result, the FAA considers that a

one-time safety review of the fuel tank

system for transport airplane models in

the current fleet is needed.

The second area of concern

encompasses the need to require the

design of future transport category

airplanes to more completely address

potential failures in the fuel tank system

that could result in an ignition source in

the fuel tank system.

Third, certain airplane types are

designed with heat sources adjacent to

the fuel tank, which results in heating

of the fuel and a significant increase in

the formation of flammable vapors in

the tank. The FAA considers that fuel

tank safety can be enhanced by reducing

the time fuel tanks operate with

flammable vapors in the tank and is

therefore adopting a requirement to

provide means to minimize the

development of flammable vapors in

fuel tanks, or to provide means to

prevent catastrophic damage if ignition

does occur.

Fourth, the FAA considers that it is

necessary to impose operational

requirements so that all required

maintenance or inspection actions will

be included in each operator’s FAAapproved maintenance or inspection

program.

These regulatory initiatives are being

codified as a Special Federal Aviation

Regulation (14 CFR part 21),

amendments to the airworthiness

regulations (14 CFR part 25), and

amendments to the operating

requirements (14 CFR parts 91, 121, 125,

129)

Part 21 Special Federal Aviation

Regulation (SFAR)

Historically, the FAA works with the

TC holders when safety issues arise to

identify solutions and actions that need

to be taken. Some of the safety issues

that have been addressed by this

voluntary cooperative process include

those involving aging aircraft structure,

thrust reversers, cargo doors, and wing

icing protection. Although some

manufacturers have aggressively

completed these safety reviews, others

have not applied the resources

necessary to complete these reviews in

a timely manner, which delayed the

adoption of corrective action. Although

these efforts have frequently been

successful in achieving the desired

safety objectives, a more uniform and

expeditious response is considered

necessary to address fuel tank safety

issues.

While maintaining the benefits of

FAA-TC holder cooperation, the FAA

considers that a Special Federal

Aviation Regulation (SFAR) provides a

means for the FAA to establish clear

expectations and standards, as well as a

timeframe within which the design

approval holders and the public can be

confident that fuel tank safety issues on

the affected airplanes will be uniformly

examined.

This final rule is intended to ensure

that the design approval holder

completes a comprehensive assessment

of the fuel tank system and develops

any required inspections, maintenance

instructions, or modifications.

23094 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

Safety Review

The SFAR requires the design

approval holder to perform a safety

review of the fuel tank system to show

that fuel tank fires or explosions will

not occur on airplanes of the approved

design. In conducting the review, the

design approval holder must

demonstrate compliance with the new

standards adopted for § 25.981(a) and

(b) (discussed below) and the existing

standards of § 25.901. As part of this

review, the design approval holder must

submit a report to the cognizant FAA

Aircraft Certification Office (ACO) that

substantiates that the fuel tank system is

fail-safe.

The FAA intends that those failure

conditions identified earlier in this

document, and any other foreseeable

failures, should be assumed when

performing the safety review needed to

substantiate that the fuel tank system

design is fail-safe. The safety review

should be prepared considering all

airplane inflight, ground, service, and

maintenance conditions, assuming that

an explosive fuel air mixture is present

in the fuel tanks at all times, unless the

fuel tank has been purged of fuel vapor

for maintenance. The design approval

holder is expected to develop a failure

modes and effects analysis (FMEA) for

all components in the fuel tank system.

Analysis of the FMEA would then be

used to determine whether single

failures, alone or in combination with

foreseeable latent failures, could cause

an ignition source to exist in a fuel tank.

A subsequent quantitative fault tree

analysis should then be developed to

determine whether combinations of

failures expected to occur in the life of

the affected fleet could cause an ignition

source to exist in a fuel tank system.

Because fuel tank systems typically

have few components within the fuel

tank, the number of possible internal

sources of ignition is limited. The safety

review required by this final rule

includes all components or systems that

could introduce a source of fuel tank

ignition. This may require analysis of

not only the fuel tank system

components, (e.g., pumps, fuel pump

power supplies, fuel valves, fuel

quantity indication system probes,

wiring, compensators, densitometers,

fuel level sensors, etc.), but also other

airplane systems that may affect the fuel

tank system. For example, failures in

airplane wiring or electromagnetic

interference from other airplane systems

that were not properly accounted for in

the original safety assessment could

cause an ignition source in the airplane

fuel tank system under certain

conditions and therefore would have to

be included in the system safety

analysis.

The intent of the safety review is to

assure that each fuel tank system design

that is affected by this action will be

fully assessed and that the design

approval holder identifies any required

modifications, added flight deck or

maintenance indications, and/or

maintenance actions necessary to meet

the fail-safe criteria.

Maintenance Instructions

The FAA anticipates that the safety

review will identify critical areas of the

fuel tank and other related systems that

require maintenance actions to account

for the affects of aging, wear, corrosion,

and possible contamination on the fuel

tank system. For example, service

history indicates that sulfide deposits

may form on fuel tank components,

including bonding straps and FQIS

components, which could degrade the

intended design capabilities by

providing a mechanism by which arcing

could occur. Therefore, it might be

necessary to provide maintenance

instructions to identify and eliminate

such deposits.

The SFAR requires the design

approval holder to develop any specific

maintenance and inspection

instructions necessary to maintain the

design features required to preclude the

existence or development of an ignition

source within the fuel tank system.

These instructions must be established

to ensure that an ignition source will

not develop throughout the remaining

operational life of the airplane.

Possible Airworthiness Directives

The safety review may also result in

identification of unsafe conditions on

certain airplane models that would

require issuance of airworthiness

directives. For example, the FAA has

required or proposed requirements for

design changes to the following

airplanes:

• Boeing Models 737, 747, and 767;

• Boeing Douglas Products Division

(formerly, McDonnell Douglas) Model

DC–9 and DC–10;

• Lockheed Model L–1011;

• Bombardier (Canadair) Model CL–

600;

• Airbus Models A300–600R, A319,

A320, and A321;

• CASA Model C–212;

• British Aerospace (Jetstream) Model

4100; and

• Fokker Model F28.

Design practices used on these models

may be similar to those of other airplane

types; therefore, the FAA expects that

modifications to airplanes with similar

design features may also be required.

The number and scope of any possible

AD’s may vary by airplane type design.

For example, wiring separation and

shielding of FQIS wires on newer

technology airplanes significantly

reduces the likelihood of an electrical

short causing an electrical arc in the fuel

tank; many newer transport airplanes do

not route electrical power wiring to fuel

pumps inside the airplane fuel tanks.

Therefore, some airplane models may

not require significant modifications or

additional dedicated maintenance

procedures.

Other models may require significant

modifications or more maintenance. For

example, the FQIS wiring on some older

technology airplanes is routed in wire

bundles with high voltage power supply

wires. The original failure analyses

conducted on these airplane types did

not consider the possibility that the fuel

quantity indication system may become

degraded, allowing a significantly lower

voltage level to produce a spark inside

the fuel tank. Causes of degradation

observed in service include aging,

corrosion, or undetected contamination

of the system. As previously discussed,

the FAA has issued AD actions for

certain Boeing Model 737 and 747

airplanes to address this condition.

Modification of similar types of

installations on other airplane models

may be required to address this unsafe

condition and to achieve a fail-safe

design.

It should be noted that any design

changes might, in themselves, require

maintenance actions. For example,

transient protection devices typically

require scheduled maintenance in order

to detect latent failure of the

suppression feature. As a part of the

required safety review, the manufacturer

is expected to define the necessary

maintenance procedures and intervals

for any required maintenance actions.

Applicability of the SFAR

The requirements of the SFAR are

applicable to holders of TC’s, and STC’s

for modifications that affect the fuel

tank systems of turbine-powered

transport category airplanes, for which

the TC was issued after January 1, 1958,

and the airplane has either a maximum

type certificated passenger capacity of

30 or more, or a maximum type

certificated payload capacity of 7,500

pounds or more.

The SFAR is also applicable to

applicants for type certificates,

amendments to a type certificate, and

supplemental type certificates affecting

the fuel tank systems for those airplanes

identified above, if the application was

filed before the effective date of the

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23095

SFAR and the certificate was not issued

before the effective date of the SFAR.

The FAA has determined that turbinepowered airplanes, regardless of

whether they are turboprops or

turbojets, should be subject to the rule,

because the potential for ignition

sources in fuel tank systems is unrelated

to the engine design. This results in the

coverage of the large transport category

airplanes where the safety benefits and

public interest are greatest. This action

affects approximately 7,000 U.S.

registered airplanes in part 91, 121, 125,

and 129 operations.

The date January 1, 1958, was chosen

so that only turbine-powered airplanes,

except for a few 1953–1958 vintage

Convair 340s and 440s converted from

reciprocating power, will be included.

No reciprocating-powered transport

category airplanes are known to be used

currently in passenger service, and the

few remaining in cargo service would be

excluded. Compliance is not required

for those older airplanes because their

advanced age and small numbers would

likely make compliance impractical

from an economic standpoint. This is

consistent with similar exclusions made

for those airplanes from other

requirements applicable to existing

airplanes, such as the regulations

adopted for flammability of seat

cushions (49 FR 43188, October 24,

1984); flammability of cabin interior

components (51 FR 26206, July 21,

1986); cargo compartment liners (54 FR

7384, February 17, 1989); access to

passenger emergency exits (57 FR

19244, May 4, 1992); and Class D cargo

or baggage compartments (63 FR 8032,

February 17, 1998).

In order to achieve the benefits of this

rulemaking for large transport airplanes

as quickly as possible, the FAA has

decided to limit the applicability of the

SFAR to airplanes with a maximum

certificated passenger capacity of at

least 30 or at least 7,500 pounds

payload. Compliance is not required for

smaller airplanes because it is not clear

at this time that the possible benefits for

those airplanes would be commensurate

with the costs involved. For now, the

applicability of the rule will remain as

proposed in the notice. The FAA will

need to conduct the economic analysis

to determine if the rule should be

applied to smaller airplanes. Should the

results of the analysis be favorable, the

FAA will develop further rulemaking to

address the smaller transports.

Applicability of SFAR to Supplemental

Type Certificate (STC) Holders

The SFAR applies to STC holders as

well, because a significant number of

STC’s effect changes to fuel tank

systems, and the objectives of this rule

would not be achieved unless these

systems are also reviewed and their

safety ensured. The service experience

noted in the background of this rule

indicates modifications to airplane fuel

tank systems incorporated by STC’s may

affect the safety of the fuel tank system.

Modifications that could affect the

fuel tank system include those that

could result in an ignition source in the

fuel tank. Examples include installation

of auxiliary fuel tanks and installation

of, or modification to, other systems

such as the fuel quantity indication

system, the fuel pump system

(including electrical power supply),

airplane refueling system, any electrical

wiring routed within or adjacent to the

fuel tank, and fuel level sensors or float

switches. Modifications to systems or

components located outside the fuel

tank system may also affect fuel tank

safety. For example, installation of

electrical wiring for other systems that

was inappropriately routed with FQIS

wiring could violate the wiring

separation requirements of the type

design. Therefore, the FAA intends that

a fuel tank system safety review be

conducted for any modification to the

airplane that may affect the safety of the

fuel tank system. The level of evaluation

that is intended would be dependent

upon the type of modification. In most

cases a simple qualitative evaluation of

the modification in relation to the fuel

tank system, and a statement that the

change has no effect on the fuel tank

system, would be all that is necessary.

In other cases where the initial

qualitative assessment shows that the

modification may affect the fuel tank

system, a more detailed safety review

would be required.

Design approvals for modification of

airplane fuel tank systems approved by

STC’s require the applicant to have

knowledge of the airplane fuel tank

system in which the modification is

installed. The majority of these

approvals are held by the original

airframe manufacturers or airplane

modifiers that specialize in fuel tank

system modifications, such as

installation of auxiliary fuel tanks.

Therefore, the FAA expects that the data

needed to complete the required safety

review identified in the SFAR would be

available to the STC holder.

Compliance With SFAR

This rule provides an 18-month

compliance time from the effective date

of the final rule, or within 18 months

after the issuance of a certificate for

which application was filed before the

effective date of this SFAR, whichever

is later, for design approval holders to

conduct the safety review and develop

the compliance documentation and any

required maintenance and inspection

instructions. (Applicants whose

applications have not been approved as

of the effective date would be allowed

18 months after the approval to

comply.) The FAA expects each design

approval holder to work with the

cognizant FAA Aircraft Certification

Office (ACO) and Aircraft Evaluation

Group (AEG) to develop a plan to

complete the safety review and develop

the required maintenance and

inspection instructions within the 18-

month period. The plan should include

periodic reviews with the ACO and AEG

of the ongoing safety review and the

associated maintenance and inspection

instructions.

During the 18-month compliance

period, the FAA is committed to

working with the affected design

approval holders to assist them in

complying with the requirements of the

SFAR. However, failure to comply

within the specified time would

constitute a violation of the

requirements and may subject the

violator to certificate action to amend,

suspend, or revoke the affected

certificate in accordance with 49 U.S.C.

§ 44709. In accordance with 49 U.S.C.

§ 46301, it may also subject the violator

to a civil penalty of not more than

$1,100 per day until the SFAR is

complied with.

Changes to Operating Requirements

This rule requires the affected

operators to incorporate FAA-approved

fuel tank system maintenance and

inspection instructions in their

maintenance or inspection program

required under the applicable operating

rule within 36 months of the effective

date of the rule. If the design approval

holder has complied with the SFAR and

developed an FAA-approved program,

the operator can incorporate that

program, including any revisions

needed to address any modifications to

the original type design, to meet the

proposed requirement. The operator

also has the option of developing its

own program independently, and is

ultimately responsible for having an

FAA-approved program, regardless of

the action taken by the design approval

holder.

The rule prohibits the operation of

certain transport category airplanes

operated under parts 91, 121, 125, and

129 beyond the specified compliance

time, unless the operator of those

airplanes has incorporated FAAapproved fuel tank maintenance and

inspection instructions in its

maintenance or inspection program, as

23096 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

applicable. The rule requires approval

of the maintenance and inspection

instructions by the FAA ACO, or office

of the Transport Airplane Directorate,

having cognizance over the type

certificate for the affected airplaneThe

operator would need to consider the

following five issues:

1. The fuel tank system maintenance

and inspection instructions that would

be incorporated into the operator’s

existing maintenance or inspection

program must be approved by the FAA

ACO having cognizance over the type

certificate or supplemental type

certificate. If the operator can establish

that the existing maintenance and

inspection instructions fulfill the

requirements of this rule, then the ACO

may approve the operator’s existing

maintenance and inspection

instructions without change.

2. The means by which the FAAapproved fuel tank system maintenance

and inspection instructions are

incorporated into a certificate holder’s

FAA-approved maintenance or

inspection program is subject to

approval by the certificate holder’s

principal maintenance inspector (PMI)

or other cognizant airworthiness

inspector. The FAA intends that any

escalation to the FAA-approved

inspection intervals will require the

operator to receive approval of the

amended program from the cognizant

ACO or office of the Transport Airplane

Directorate. Any request for escalation

to the FAA approved inspection

intervals must include data to

substantiate that the proposed interval

will provide the level of safety intended

by the original approval. If inspection

results and service experience indicate

that additional or more frequent

inspections are necessary, the FAA may

issue AD’s to mandate such changes to

the inspection program.

3. This rule does not impose any new

reporting requirements; however,

normal reporting required under 14 CFR

121.703 and 125.409 still applies.

4. This rule does not impose any new

FAA recordkeeping requirements.

However, as with all maintenance, the

current operating regulations (e.g., 14

CFR 121.380 and 91.417) already

impose recordkeeping requirements that

apply to the actions required by this

rule. When incorporating the fuel tank

system maintenance and inspection

instructions into its approved

maintenance or inspection program,

each operator should address the means

by which it will comply with these

recordkeeping requirements. That

means of compliance, along with the

remainder of the program, are subject to

approval by the cognizant PMI or other

cognizant airworthiness inspector.

5. The maintenance and inspection

instructions developed by the TC holder

under the rule generally do not apply to

portions of the fuel tank systems

modified in accordance with an STC,

field approval, or otherwise, including

any auxiliary fuel tank installations.

Similarly, STC holders are required to

provide instructions for their STC’s. The

operator, however, is still responsible

for incorporating specific maintenance

and inspection instructions applicable

to the entire fuel tank system of each

airplane that meets the requirements of

this rule. This means that the operator

must evaluate the fuel tank systems and

any alterations to the fuel tank system

not addressed by the instructions

provided by the TC or STC holder, and

then develop, submit, and gain FAA

approval of the maintenance and

inspection instructions to evaluate

changes to the fuel tank systems.

The FAA recognizes that operators

may not have the resources to develop

maintenance or inspection instructions

for the airplane fuel tank system. The

rule therefore requires the TC and STC

holders to develop fuel tank system

maintenance and inspection

instructions that may be used by

operators. If however, the STC holder is

out of business or otherwise

unavailable, the operator will

independently have to acquire the FAAapproved inspection instructions. To

keep the airplanes in service, operators,

either individually or as a group, could

hire the necessary expertise to develop

and gain approval of maintenance and

inspection instructions. Guidance on

how to comply with this aspect of the

rule will be provided in AC 25.981–1B.

After the PMI having oversight

responsibilities is satisfied that the

operator’s continued airworthiness

maintenance or inspection program

contains all of the elements of the FAAapproved fuel tank system maintenance

and inspection instructions, the

airworthiness inspector will approve the

maintenance or inspection program

revision. This approval has the effect of

requiring compliance with the

maintenance and inspection

instructions.

Applicability of the Operating

Requirements

This rule prohibits the operation of

certain transport category airplanes

operated under 14 CFR parts 91, 121,

125, and 129 beyond the specified

compliance time, unless the operator of

those airplanes has incorporated FAAapproved specific maintenance and

inspection instructions applicable to the

fuel tank system in its approved

maintenance or inspection program, as

applicable. The operational

applicability was established so that all

airplane types affected by the SFAR,

regardless of type of operation, are

subject to FAA approved fuel tank

system maintenance and inspection

procedures. As discussed earlier, this

rule includes each turbine-powered

transport category airplane model,

provided its TC was issued after January

1, 1958, and it has either a maximum

type certificated passenger capacity of

30 or more, or a maximum type

certificated payload capacity of 7,500

pounds or more.

Affect on Field Approvals

A significant number of changes to

transport category airplane fuel tank

systems have been incorporated through

field approvals issued to the operators

of those airplanes. These changes may

also significantly affect the safety of the

fuel tank system. The operator of any

airplane with such changes is required

to develop the fuel tank system

maintenance and inspection program

instructions and submit it to the FAA

for approval, together with the

necessary substantiation of compliance

with the safety review requirements of

the SFAR.

Compliance With Operating

Requirements

This rule establishes a 36-month

compliance time from the effective date

of the rule for operators to incorporate

FAA-approved, long-term, fuel tank

system maintenance and inspection

instructions into their approved

program. The FAA expects each

operator to work with the airplane TC

holder or STC holder to develop a plan

to implement the required maintenance

and inspection instructions within the

36-month period. The plan should

include periodic reviews with the

cognizant ACO and AEG responsible for

approval of the associated maintenance

and inspection instructions.

The fuel tank safety review may result

in maintenance actions that are overdue

prior to the effective date of the

operational rules. The plan provided by

the operator should include

recommended timing of initial

inspections or maintenance actions that

are incorporated in the long term

maintenance or inspection program. An

analysis of and supporting evidence for

the proposed timing of the initial action

should be provided to the FAA. For

example, it may be determined that an

inspection of a certain component

should be conducted after 50,000 flight

hours. Some airplanes within the fleet

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23097

may have accumulated over 50,000

flight hours. The timing of the initial

inspection must be approved by the

FAA and would be dependent upon an

evaluation of the safety impact of the

inspection. It is desirable to incorporate

these inspections in the current heavy

maintenance program, such as a ‘‘C’’ or

‘‘D’’ check, without taking airplanes out

of service. However, it may be

determined that more expeditious

action is required, which may be

mandated by AD.

Changes to Part 25

Currently, § 25.981 defines limits on

surface temperatures within transport

airplane fuel tank systems. In order to

address future airplane designs, § 25.981

is revised to address both prevention of

ignition sources in fuel tanks, and

reduction in the time fuel tanks contain

flammable vapors. The first part

explicitly includes a requirement for

effectively precluding ignition sources

within the fuel tank systems of transport

category airplanes. The second part

requires minimizing the formation of

flammable vapors in the fuel tanks.

Fuel Tank Ignition Source—Section

25.981

The title of § 25.981 is changed from

‘‘Fuel tank temperature’’ to ‘‘Fuel tank

ignition prevention.’’ The substance of

existing paragraph (a), which requires

the applicant to determine the highest

temperature that allows a safe margin

below the lowest expected auto ignition

temperature of the fuel, is retained.

Likewise, the substance of existing

paragraph (b), which requires

precluding the temperature in the fuel

tank from exceeding the temperature

determined under paragraph (a), is also

retained. These requirements are

redesignated as (a)(1) and (2)

respectively.

Compliance with these paragraphs

requires the determination of the fuel

flammability characteristics of the fuels

approved for use. Fuels approved for

use on transport category airplanes have

differing flammability characteristics.

The fuel with the lowest autoignition

temperature is JET A (kerosene), which

has an autoignition temperature of

approximately 450°F at sea level. The

autoignition temperature of JP–4 is

approximately 470°F at sea level. Under

the same atmospheric conditions, the

autoignition temperature of gasoline is

approximately 800°F. The autoignition

temperature of these fuels increases at

increasing altitudes (lower pressures).

For the purposes of this rule, the lowest

temperature at which autoignition can

occur for the most critical fuel approved

for use should be determined. A

temperature providing a safe margin is

at least 50°F below the lowest expected

autoignition temperature of the fuel

throughout the altitude and temperature

envelopes approved for the airplane

type for which approval is requested.

This rulemaking also adds a new

paragraph (a)(3) to require that a safety

analysis be performed to demonstrate

that the presence of an ignition source

in the fuel tank system could not result

from any single failure, from any single

failure in combination with any latent

failure condition not shown to be

extremely remote, or from any

combination of failures not shown to be

extremely improbable.

These new requirements define three

scenarios that must be addressed in

order to show compliance with

paragraph (a)(3). The first scenario is

that any single failure, regardless of the

probability of occurrence of the failure,

must not cause an ignition source. The

second scenario is that any single

failure, regardless of the probability

occurrence, in combination with any

latent failure condition not shown to be

at least extremely remote (i.e., not

shown to be extremely remote or

extremely improbable), must not cause

an ignition source. The third scenario is

that any combination of failures not

shown to be extremely improbable must

not cause an ignition source.

For the purpose of this rule,

‘‘extremely remote’’ failure conditions

are those not anticipated to occur to

each airplane during its total life, but

which may occur a few times when

considering the total operational life of

all airplanes of the type. This definition

is consistent with that proposed by the

ARAC for a revision to FAA AC

25.1309–1A and that currently used by

the JAA in AMJ 25.1309. ‘‘Extremely

improbable’’ failure conditions are those

so unlikely that they are not anticipated

to occur during the entire operational

life of all airplanes of one type. This

definition is consistent with the

definition provided in FAA AC

25.1309–1A and retained in the draft

revision to AC 25.1309–1A proposed by

the ARAC.

The severity of the external

environmental conditions that should

be considered when demonstrating

compliance with this rule are those

established by certification regulations

and special conditions (e.g., HIRF),

regardless of the associated probability.

The rule also requires that the effects of

manufacturing variability, aging, wear,

and likely damage be taken into account

when demonstrating compliance.

These requirements are consistent

with the general powerplant installation

failure analysis requirements of

§ 25.901(c) and the systems failure

analysis requirements of § 25.1309, as

they have been applied to powerplant

installations. This additional

requirement is needed because the

general requirements of §§ 25.901 and

25.1309 have not been consistently

applied and documented when showing

that ignition sources are precluded from

transport category airplane fuel tanks.

Compliance with § 25.981 requires an

analysis of the airplane fuel tank system

using analytical methods and

documentation currently used by the

aviation industry in demonstrating

compliance with §§ 25.901 and 25.1309.

In order to eliminate any ambiguity as

to the necessary methods of compliance,

the rule explicitly requires that the

existence of latent failures be assumed

unless they are extremely remote, which

is currently required under § 25.901, but

not under § 25.1309. The analysis

should be conducted assuming design

deficiencies listed in the background

section of this document, and any other

failure modes identified within the fuel

tank system functional hazard

assessment.

Based upon the evaluations required

by § 25.981(a), a new requirement is

added to paragraph (b) to require that

critical design configuration control

limitations, inspections, or other

procedures be established as necessary

to prevent development of ignition

sources within the fuel tank system, and

that they be included in the

Airworthiness Limitations section of the

ICA required by § 25.1529. This

requirement is similar to that contained

in § 25.571 for airplane structure.

Appendix H to part 25 is also revised to

add a requirement to provide any

mandatory fuel tank system inspections

or maintenance actions in the

Airworthiness Limitations section of the

ICA.

Critical design configuration control

limitations include any information

necessary to maintain those design

features that have been defined in the

original type design as needed to

preclude development of ignition

sources. This information is essential to

ensure that maintenance, repairs, or

alterations do not unintentionally

violate the integrity of the original fuel

tank system type design. An example of

a critical design configuration control

limitation for current designs discussed

previously would be maintaining wire

separation between FQIS wiring and

other high power electrical circuits. The

original design approval holder must

define a method to ensure that this

essential information will be evident to

those that may perform and approve

repairs and alterations. Visual means to

23098 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

alert the maintenance crew must be

placed in areas of the airplane where

inappropriate actions may degrade the

integrity of the design configuration. In

addition, this information should be

communicated by statements in

appropriate manuals, such as Wiring

Diagram Manuals.

Flammability Requirements

The FAA agrees with the intent of the

regulatory text recommended by the

ARAC. However, due to the short

timeframe that the ARAC was provided

to complete the tasking, a sufficient

detailed economic evaluation was not

completed to determine if practical

means, such as ground based inerting,

were available to reduce the exposure

below the specified value of 7 percent

of the operational time included in the

ARAC proposal. The FAA is adopting a

more objective regulation that is

intended to minimize exposure to

operation with flammable conditions in

the fuel tanks.

As discussed previously, the ARAC

has submitted a recommendation to the

FAA that the FAA continue to evaluate

means for minimizing the development

of flammable vapors within the fuel

tanks. Development of a definitive

standard to address this

recommendation will require additional

effort that will likely take some time to

complete. In the meantime, however,

the FAA is aware that historically

certain design methods have been found

acceptable that, when compared to

readily available alternative methods,

increase the likelihood that flammable

vapors will develop in the fuel tanks.

For example, in some designs, including

the Boeing Model 747, air conditioning

packs have been located immediately

below a fuel tank without provisions to

reduce transfer of heat from the packs to

the tank.

Therefore, in order to preclude the

future use of such design practices,

§ 25.981 is revised to add a requirement

that fuel tank installations be designed

to minimize the development of

flammable vapors in the fuel tanks.

Alternatively, if an applicant concludes

that such minimization is not

advantageous, it may propose means to

mitigate the effects of an ignition of fuel

vapors in the fuel tanks. For example,

such means might include installation

of fire suppressing polyurethane foam.

This rule is not intended to prevent

the development of flammable vapors in

fuel tanks because total prevention has

currently not been found to be feasible.

Rather, it is intended as an interim

measure to preclude, in new designs,

the use of design methods that result in

a relatively high likelihood that

flammable vapors will develop in fuel

tanks when other practicable design

methods are available that can reduce

the likelihood of such development. For

example, the rule does not prohibit

installation of fuel tanks in the cargo

compartment, placing heat exchangers

in fuel tanks, or locating a fuel tank in

the center wing. It does, however,

require that practical means, such as

transferring heat from the fuel tank (e.g.,

use of ventilation or cooling air), be

incorporated into the airplane design if

heat sources were placed in or near the

fuel tanks that significantly increased

the formation of flammable fuel vapors

in the tank, or if the tank is located in

an area of the airplane where little or no

cooling occurs. The intent of the rule is

to require that fuel tanks are not heated,

and cool at a rate equivalent to that of

a wing tank in the transport airplane

being evaluated. This may require

incorporating design features to reduce

flammability, for example cooling and

ventilation means or inerting for fuel

tanks located in the center wing box,

horizontal stabilizer, or auxiliary fuel

tanks located in the cargo compartment.

At such time as the FAA has completed

the necessary research and identified an

appropriate definitive standard to

address this issue, new rulemaking will

be considered to revise the standard

adopted in this rulemaking.

Applicability of Part 25 Change

The amendments to part 25 apply to

all transport category airplane models

for which an application for type

certification is made after the effective

date of the rule, regardless of passenger

capacity or size. In addition, as

currently required by the provisions of

§ 21.50, applicants for any future

changes to existing part 25 type

certificated airplanes, including STC’s,

that could introduce an ignition source

in the fuel tank system are required to

provide any necessary Instructions for

Continued Airworthiness, as required

by § 25.1529 and the change to the

Airworthiness Limitations section,

paragraph H25.4 of Appendix H. In

cases where it is determined that the

existing ICA are adequate for the

continued airworthiness of the altered

product, then it should be noted on the

STC, PMA supplement, or major

alteration approval.

FAA Advisory Material

In addition to the amendments

presented in this rulemaking, the FAA

is continuing development of AC

25.981–1B, ‘‘Fuel Tank Ignition Source

Prevention Guidelines’’ (a revision to

AC 25.981–1A), and a new AC 25.981–

2, ‘‘Fuel Tank Flammability

Minimization.’’

AC 25.981–1B includes consideration

of failure conditions that could result in

sources of ignition of vapors within fuel

tanks, and provides guidance on how to

substantiate that ignition sources will

not be present in airplane fuel tank

systems following failures or

malfunctions of airplane components or

systems. This AC also includes

guidance for developing any limitations

for the ICA that may be generated by the

fuel tank system safety review.

AC 25.981–2 provides information

and guidance concerning compliance

with the new requirements identified in

this rulemaking pertaining to

minimizing the formation or mitigation

of hazards from flammable fuel air

mixtures within fuel tanks.

Discussion of Comments

Thirty four commenters responded to

Notice 99–18, including private citizens,

foreign aviation authorities,

manufacturers of inerting equipment,

individual airplane manufacturers and

operators (both foreign and domestic),

an organization representing the

interests of manufacturers of general

aviation airplanes, an airline pilots

representative, an organization

representing the consolidated interests

of the aviation industry worldwide, and

the National Transportation Safety

Board. The majority of commenters

agree in principle with the proposals. A

discussion of these comments follows,

including FAA’s response, grouped by

subject matter.

Discussion of Comments on Proposed

SFAR

For ease of reference, throughout the

following discussion, the term

‘‘designer’’ is used to refer to all persons

subject to the requirements of the

Special Federal Aviation Regulation

(SFAR).

General Favorable Comments

Several commenters, including

representatives of manufacturers and

operators, agree in principle with the

safety review that would be required by

the proposed new SFAR to part 21 and

have, in fact, already engaged in an

industry-wide initiative in this area.

These commenters state that they

believe firmly that the objective of the

proposed safety review will enhance the

level of safety that already exists in the

transport fleet.

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23099

Request to Include Smaller Part 25

Airplanes, Rotorcraft, and Part 23

Airplanes in SFAR Applicability

Several commenters disagree with the

proposal to limit applicability of the

SFAR to larger airplanes (30 or more

passengers) due to the time needed to

conduct a thorough economic analysis

and the possible impact it would have

on small businesses. However, the

commenters request that this evaluation

be completed and that smaller transport

airplanes be included because of the

design similarities of the smaller

airplanes to larger airplanes.

Additionally, one commenter notes

that, because the proposal excludes a

significant portion of the fleet, the

proposal is not in keeping with the

FAA’s stated goals of the ‘‘One level of

Safety’’ initiative. This commenter also

notes that the FAA stated in the notice

that applying the proposed

requirements to certain regional

airliners would not significantly

increase the expected quantitative

benefits of the rule because there have

been no in-flight fuel tank explosions on

those airplanes. The commenter is

concerned that the FAA may be using

‘‘faulty reasoning’’ to eliminate the need

for any follow-on action to address this

segment of the fleet.

Another commenter strongly

recommends that the SFAR be extended

to include part 23 aircraft and part 27

rotorcraft because these types of aircraft

may be susceptible to fuel tank system

problems similar to those addressed in

the proposed rule.

FAA’s Response: The FAA agrees that,

even though the fuel tank systems of

smaller transport category airplanes may

be simpler, similarities in the designs of

the fuel systems of those airplanes may

result in a need to apply the standard to

them. As discussed in the notice, we

plan to conduct the appropriate

economic analysis to determine if the

rule should be applied to smaller

transport airplanes. Should the results

of that analysis indicate that the SFAR

requirements should be applied to

smaller transports, we will consider

developing further rulemaking to

address those airplanes. For now, the

applicability of the final rule will

remain as proposed in the notice.

We do not agree that the proposed

SFAR should be applied to part 23

aircraft and part 27 rotorcraft at this

time. Service experience has not

indicated that immediate action is

necessary to address the fuel tank

systems of those types of aircraft at this

time. However, we may reconsider this

action if future service experience

indicates that it is warranted.

Request to Exclude Mitsubishi YS–11

Airplanes and Lockheed Electra

Airplanes

Mitsubishi Heavy Industries America,

Inc., requests that the Mitsubishi Model

YS–11 airplane be excluded from the

SFAR applicability. The commenter’s

justification for this exclusion is that

none of these airplane models is

currently being operated in the U.S. and

none are likely to be operated in the

future. The commenter further states

that there has never been a fuel tankrelated incident or accident on any of

these airplane models. The commenter

refers to the FAA’s statement in the

preamble to the notice that certain older

reciprocating engine-powered and

converted turbine-powered transport

airplanes should be excluded from the

rule because:

‘‘* * * the few remaining such airplanes

are in cargo service and because their

advanced age and small numbers would

make compliance impractical from an

economic standpoint.’’

The commenter asserts that the same

rationale should be applicable to the

Model YS–11 because not one such

airplane is currently operating in the

U.S. and the possibility of such

airplanes ever returning to cargo service,

much less passenger service, in the U.S.

is virtually non-existent. Therefore,

there are no benefits to be achieved by

the design review.

Similarly, Lockheed Martin also

requests that its airplane model, the

Lockheed Model L–188 Electra airplane,

be excluded from the applicability of

the SFAR. Like the first commenter, this

commenter refers to the statement in the

preamble to the notice that certain older

reciprocating and turbine-powered

airplanes should be excluded because

compliance would be impractical from

an economic standpoint. The

commenter suggests that the Model L–

188 Electra also falls into this category

and should be excluded from the rule’s

applicability. The commenter further

suggests that the retroactive application

of the new requirements to any older

model include provisions in the rule

that would permit favorable service

experience to be submitted instead of

extensive failure analysis. The

commenter refers to a safety study

conducted of the Model L–188 Electra

fuel system which shows that the fuel

system service experience is excellent.

FAA’s Response: The FAA does not

concur with these commenters’ requests

to revise the applicability of the SFAR.

As stated in Notice 99–18, parts 91, 121,

125, and 129 would be amended to

require operators to incorporate FAAapproved fuel tank system maintenance

and inspection instructions into their

current maintenance or inspection

program of transport category airplanes

type-certificated after January 1, 1958.

That date was chosen so that all turbinepowered transport category airplanes

would be included, except for a few

1947 vintage Grumman Mallards, and

1953–1958 vintage Convair Model 340

and 440 airplanes converted from

reciprocating to turbine power.

We do not consider the information

presented by either of the commenters

sufficient to warrant a general exclusion

of either the Model YS–11 or the Model

L–188 Electra from the applicability of

the SFAR. We do acknowledge,

however, that the current operations of

Model L–188 Electra airplanes to remote

Aleutian points and on military contract

flights do involve unique circumstances

worthy of further consideration. For

example, we might conclude that, while

full compliance is not cost effective,

some lesser degree of fuel tank system

evaluation is necessary.

While there is insufficient basis on

which to exclude the Model L–188

Electra airplanes in general, the TC

holder may petition the FAA for an

exemption from the provisions of this

final rule showing that it would be in

the public interest. Similarly, we would

consider petitions for exemption from

the SFAR for the Model YS–11 or any

other airplane not currently operated

under U.S. registry. Such requests for

exemption would be handled outside of

this rulemaking action. Even if an

exemption were granted from the SFAR

to a design approval holder, operators of

the affected airplanes would still be

subject to the requirements of the

operating rules established by this final

rule. Petitions for exemption by the

operators would involve different

considerations.

Request to ‘‘Harmonize’’ the Rule With

European Authorities

Several commenters, including

representatives from aviation officials of

the JAA and Transport Canada, state

that the proposed SFAR should have

been developed through the Aviation

Rulemaking Advisory Committee

(ARAC) and its harmonization process.

These commenters contend that

harmonizing the proposed rule would:

• simplify operations,

• reduce the cost of compliance

without compromising safety, and

• extend the latest safety benefits

more broadly in the world fleet.

The commenters also state that

issuing the rule under the

harmonization process would have

facilitated eventual delegation of the

SFAR compliance findings between the

23100 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

FAA and the JAA. Some commenters

request that the disposition of public

comments be handled through the

ARAC process.

FAA’s Response: The FAA does not

concur with the commenters. When this

rulemaking was initiated, we faced a

choice between proceeding unilaterally

or proceeding through the

harmonization process involving the

JAA and the public through ARAC. At

that time, we chose to proceed

unilaterally in order to address the

important safety need on an expedited

basis. In a separate action, we did task

ARAC with developing proposed

regulatory text to eliminate or reduce

flammability in airplane fuel tanks. The

fundamentals of ARAC’s proposal are

included in this rule.

With the issuance of this rule, we

consider that the safety need has been

addressed and we are now open to a

harmonization effort. To facilitate

harmonization, we have coordinated the

proposal with the JAA and Transport

Canada. Comments from the JAA and

Transport Canada indicate their

agreement in principle with our actions,

and they have stated their intention to

mandate similar fuel tank safety actions.

While we will ensure compliance with

the SFAR, the operating rules, and the

part 25 design standards as adopted in

this final rule, we will continue

discussions with Transport Canada and

the JAA concerning possible

harmonization efforts relating to the part

25 change.

The safety improvements provided by

this rule are as urgent now as they were

when we decided to proceed

unilaterally. The comments do not

persuade us that the policy judgments

reflected in the notice were incorrect.

Because expedited adoption of this final

rule is necessary, and because further

discussion of comments within ARAC

would not change the FAA’s policy

determinations, further review of the

proposed rule by ARAC would not be

appropriate.

Request To Delegate Compliance

Findings

Several commenters request that the

FAA delegate SFAR compliance

findings to the prime certification

authority in accordance with the

approved bilateral agreement.

FAA’s Response: The FAA interprets

the reference to ‘‘prime certification

authority’’ to mean the ‘‘state of design,’’

as that term is used in ICAO Annex 8.

Because the SFAR imposes

requirements on existing designers, the

bilateral airworthiness agreements,

which address new certifications, do not

directly apply. To the extent that

bilateral countries choose to become

involved in reviewing submissions for

compliance with the SFAR, we will

work closely with them. This should

facilitate the harmonization efforts

described previously. However, under

the SFAR the FAA must approve the

design approval holder’s submission.

Request for Definition of Safety Review

One commenter notes that the terms

‘‘safety review,’’ ‘‘design review,’’

‘‘safety analysis,’’ and ‘‘functional

hazard assessment’’ appear to be used

interchangeably throughout the notice.

However, each of these terms could

have significantly different meanings.

The commenter requests that, if it is the

intent of the FAA to have different

meanings for these terms, then the

definitions should be clearly stated and

the terms should be used in the

appropriate context.

The commenter offers the following

definitions in an attempt to establish a

unified understanding of the objectives:

• ‘‘Safety Review’’—a comprehensive

assessment of the fuel tank system that

meets all the requirements of the

Special Federal Aviation Regulation.

• ‘‘Safety Analysis’’—process of

ensuring that the fuel system is fail-safe

by conducting a design review and

failure modes and effects analysis.

• ‘‘Design Review’’—process of

reviewing all relevant engineering

design drawings to ensure that

appropriate design practices have been

used and identify failure modes.

• ‘‘Failure Modes Analysis’’—process

of evaluating all identified failure

modes resulting from the design review

by conducting a failure modes and

effects analysis (FMEA) and a fault tree

analysis (FTA).

The commenter requests that a similar

set of definitions be provided in the

SFAR to clarify the intentions of the

regulation.

FAA’s Response: The FAA concurs

that clarification is appropriate. The

objective of the SFAR is to require

designers to conduct ‘‘safety reviews,’’

which is the broadest term defined by

the commenter. The term ‘‘safety

review’’ is the correct term that is used

in the text of the SFAR. For clarification

sake, we have used the term ‘‘safety

review’’ throughout the discussions in

this preamble to describe the action

required by the SFAR. No change to the

final rule text is necessary in this regard,

however.

Question on the Need for a System

Safety Review

One commenter considers that the

proposed safety review required under

the new part 21 SFAR is excessive. This

commenter regards the proposal as

essentially a requirement to re-certify

the fuel systems of all turbine-powered

commercial transports, with respect to

avoiding fuel tank fires and explosions.

The commenter points out that, while

more than 450 million hours of service

experience on these airplanes have

identified valuable lessons learned, this

same service experience also

demonstrates the largely successful

outcome of the previously certified

designs. The extent of the safety review

that the proposed SFAR would require

goes beyond what is commensurate with

the historical data.

FAA’s Response: The FAA does not

concur with the commenter that the

service history of the affected airplanes

does not warrant the type of safety

review proposed. Specifically, we

disagree that past service has been

‘‘largely successful.’’ While the

commenter states that the fleet has

achieved a good safety record, we point

out that, as discussed in detail in the

preamble to the notice, there has been

extensive service history data related to

anomalies, system failures, aging-related

problems, etc., of the fuel tanks of

transport category airplanes. Service

data show that there have been 16 fuel

tank explosion events. Further, the fact

that the FAA has issued over 40

airworthiness directives to correct fuel

tank safety hazards affecting a large

cross section of the transport airplane

fleet indicates that extensive

revalidation of the fuel tank systems, as

proposed, is necessary.

Question on Quantitative vs. Qualitative

Safety Review of Older Airplane Designs

One commenter suggests that the

proposed SFAR should allow aircraft

certificated prior to Amendment 25–23

and § 25.1309 reliability requirements to

undergo a qualitative—rather than

quantitative—safety review. Then, from

the results of the review, an inspection

or maintenance plan could be

developed, and, finally, a one-time

inspection of the entire fleet could be

performed. The commenter supports

this type of assessment for several

reasons:

1. The current version of § 25.1309

requires a safety review and a

quantitative assessment to validate that

a system is fail-safe. However, accurate

statistical reliability information needed

to conduct the safety analysis is likely

to be unavailable for fuel system

components used nearly 30 years ago.

2. When conducting a safety review,

conservative assumptions are required

when accurate reliability data is

unavailable. These conservative

assumptions could lead to false and

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23101

detrimental failure probability results.

This circumstance could occur multiple

times during the analysis, or even cause

compounded error effects, requiring

even more severe corrective actions.

3. By the methods proposed in the

proposed rule, a ‘‘representative’’ fuel

tank system would be created based on

30-year-old drawings that would be

‘‘fraught with unavoidable

assumptions,’’ while at the same time be

required to meet the ‘‘extremely

improbable’’ failure condition

probability criteria of 1 × 10 ¥9. This

would lead to unnecessary inspections,

maintenance, repairs, and

modifications.

To meet the intent of the SFAR more

effectively, the commenter proposes that

a qualitative safety review be

conducted, based on:

• The investigative efforts of the FAA

and NTSB,

• AD’s,

• Service bulletins,

• Lessons learned,

• Performance history of the aircraft,

and

• Results of the recent industry-wide

fuel tank inspection program.

In addition, the labor and time costs

for a qualitative analysis would be

dramatically lower than for a

quantitative analysis. A qualitative

analysis could be conducted using the

knowledge and experience of current inhouse personnel and applying familiar

methods of evaluation. It likely would

take less time, as well.

Several other commenters also

question the practicality of requiring the

proposed safety review if the latest

standards are to be applied to older

airplane designs. These commenters

maintain that the proposed SFAR

effectively requires recertification of

older airplanes’ fuel tanks to show

compliance with the quantitative system

safety assessment requirements

introduced in § 25.1309 of Amendment

25–23. The commenters point out that

those requirements were neither

developed nor in effect for the airplanes

whose certification basis was approved

prior to the time that Amendment 25–

23 was issued in May 1970. The

majority of the airplanes affected by the

proposed SFAR fall into this category.

Further, the commenters note that

quantitative analysis methods for

showing compliance with the

requirements of Amendment 25–23

were not even developed or approved

by the FAA until June 1988, when the

FAA issued guidance on this subject in

Advisory Circular 25.1309–1A. These

methods were not necessarily applied to

aircraft certified before that date. Thus,

the certification documentation and

technical archives of pre-amendment

25–23 aircraft may be limited in their

usefulness to support a formalized

analysis.

These commenters also state that reevaluation of older aircraft types using

today’s quantitative analysis

methodologies, such as a failure modes

and effects analysis (FMEA), would be

impractical and present

‘‘insurmountable difficulties,’’ given the

unavailability of data and the resources

required. One commenter states that this

type of safety review would be

extremely labor-and resource-intensive,

and would have both short- and longterm adverse economic effects on the

aviation industry.

Another commenter states that the

proposal does not provide a simple

design-assessment method that is

compatible with the technical

information available to TC and STC

holders. (The commenter gave no

examples of incompatibility, however.)

FAA’s Response: The FAA recognizes

that the fuel tank systems of most older

transport airplane designs were not

evaluated during certification using the

quantitative safety assessment methods

associated with § 25.1309. For these

airplanes, the FAA agrees that a

qualitative, rather than quantitative,

approach can and should be used where

possible for the fuel tank system safety

review. The level of analysis required to

show that ignition sources will not

develop will depend upon the specific

design features of the fuel tank system

being evaluated. Detailed quantitative

analysis should not be necessary if a

qualitative safety assessment shows that

features incorporated into the fuel tank

system design protect against the

development of ignition sources within

the fuel tank system. For example, for

wiring entering the fuel tanks,

compliance demonstration could be

shown in three steps.

• First, the wiring could be shown to

have protective features such as

separation, shielding, or transient

suppression devices;

• Second, the effectiveness of those

features could be demonstrated; and

• Third, any long-term maintenance

requirements or critical design

configuration limitations could be

defined so that the protective features

are not degraded.

Another example would be showing

that fuel pumps are installed in such a

way that the fuel pump inlet remains

covered whenever the fuel pump is

operating throughout the airplane

operating attitude envelope, including

anticipated low fuel operations and

ground conditions. This could be a

satisfactory method of meeting the failsafe requirement for the fuel pump

mechanical components, although it

would not necessarily address fuel

pump motor failure modes. (Advisory

Circular 25.981–1B provides additional

guidance on the acceptability of

qualitative assessments where fail-safe

features are provided.)

Additionally, if fail-safe features are

incorporated into the design in such a

way that the effects of other systems on

the fuel tank system can be shown to be

benign, then no additional design

assessment and inspections would be

required. Designers using this approach

would be required to provide

substantiation that the design features

preclude the need for detailed design

assessment of the system and future

inspections. Designers considering

using this approach should coordinate

as early as possible with the cognizant

ACO.

On the other hand, the fact that a

quantitative assessment and related data

do not currently exist for some older

airplane types does not mean that a

similar safety assessment cannot be

accomplished on these airplanes. It is

feasible to use a modern safety

assessment method on older airplanes

that will recognize and evaluate

potential failures and their effects, and

will identify actions that could

eliminate or reduce the chance of a

potential failure from occurring.

Methods for conducting a quantitative

analysis of any system are wellestablished and readily available. For

example, the FMEA and fault tree

analysis methodology is widely

accepted and understood. In fact, there

currently are several software packages

available commercially that are

specifically designed for assisting in

developing FMEA’s; these have proven

to be particularly useful in reducing the

amount of time, labor, clerical support,

and monetary burden that normally

would be entailed.

In light of this, we anticipate that all

affected TC and STC holders will be

fully capable of complying with the

SFAR requirements.

No change to the final rule is

necessary with regard to these

comments. The rule requires that

applicants ‘‘conduct a safety review’’ of

the airplane, but does not specify any

particular method of review.

Question on Intent of Safety Review

One commenter questions the FAA’s

intent regarding the safety review. This

commenter notes that the proposed

SFAR states, ‘‘ * * * single failures will

not jeopardize the safe operation * * *

‘‘ and ‘‘ * * * latent failures have to be

assumed * * *’’ However, there are a

23102 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

number of single failures identified in

the SFAR that have the capability to

create an ignition source within the fuel

tank. Examples include:

• Various mechanical pump failure

modes,

• Various electrical pump failure

modes, and

• Arcing of pump power cables to the

conduit.

There are a number of single failures

within the examples listed above that

would not be acceptable to show

compliance in accordance with the

current application of § 25.1309, which

requires that ‘‘ * * * failure of any

single component should be assumed

* * * and not prevent continued safe

flight * * *’’ In light of this, the

commenter asks if the FAA is expecting

modifications to cover all these cases; if

not, there is a risk that the interpretation

of § 25.1309 may be degraded.

The commenter further states that

there are a number of latent failures in

fuel tanks that could create an ignition

source within the fuel tank, for example:

• Loss of pump over-temperature

protection, and

• Loss of bonding (electro-static and

lightning protection).

These types of latent failures are not

easy to detect without a physical

inspection inside the tank. The

commenter asks how these types of

latent failures will be considered when

assessing the safety of fuel tanks.

Clearly, frequent internal inspections of

fuel tanks are not acceptable, and some

means for agreeing to certain design

practices on existing aircraft may be

needed.

FAA’s Response: The intent of the

safety review, as stated in the notice, is

to apply current system safety

assessment standards to the affected

airplanes in the existing transport fleet.

We fully expect that, where fail-safe

features do not exist, modifications to

designs and changes to maintenance

practices will be required for a

significant portion of the fleet to address

the single and multiple failures noted by

the commenter. If inspections to detect

latent failures are impractical, it would

be necessary to modify the design to

provide fail-safe features or indications

to eliminate latency.

Request for a Lessons Learned

Approach

Certain commenters state that the

proposed safety review would be more

useful if it were based strictly on lessons

learned, and request that the proposal

be changed accordingly. The

commenters propose an alternative

method that would be based on service

experience (lessons learned) and

regulated as a ‘‘prescriptive-type rule.’’

As an example, the commenters suggest

that the FAA first define a

comprehensive list of items that may

not have been considered adequately in

the original fuel system design and for

which there is some service experience.

The list could include such items as:

• Fuel pumps,

• Wiring to pumps in conduits

located inside fuel tanks,

• Fuel pump connectors,

• Fuel quantity indicating system

wiring and probes, and

• Component bonding.

The FAA could then require that fuel

system designs be evaluated against this

‘‘checklist’’ to determine if adequate

consideration has been made regarding

the potential effects of each item listed.

Any single failures shown to cause an

ignition source in the fuel tank would

warrant a design change. A quantitative

fault tree analysis could then be

developed for combinations of failures

shown to cause ignition sources, to

determine if such failure combinations

could be expected to occur in the

remaining fleet life of the affected

aircraft type.

These commenters state that among

the benefits of this prescriptive design

review approach would be:

• A common evaluation criterion for

each aircraft type, regardless of its

certification basis.

• A more objective evaluation process

that simplifies delegating the

compliance-finding task by the FAA and

ensures equal treatment for each

manufacturer and operator.

• Faster completion of the task,

submittal of the report to the FAA, and

resolution of any deficiencies in the

existing fleet.

• Development of a standardized

report or checklist to ease the

compliance-finding process.

• A far greater pool of people able to

accomplish the task, because a

prescriptive review method would not

demand engineers with detailed

expertise in fuel systems and safety

assessment methodology.

These commenters maintain that the

FAA’s safety review proposed in the

SFAR would be merely an additional

burden that could interfere with

realizing the benefits of lessons learned.

They consider that their suggested

alternative approach is more practical,

and equally effective in enhancing fuel

system safety.

FAA’s Response: The FAA does not

concur with these commenters’ request.

To conduct a safety review based solely

on lessons learned would not provide

the level of safety that is intended by the

proposal. A lessons learned focus would

address problems that were known to

have occurred in the past; however, it

would not necessarily address potential

problems and risks that could occur in

the future. Thus, a lessons learned focus

is a reactive, not a proactive, approach.

There may be unforeseen failure modes

that would not necessarily be accounted

for by only evaluating failure modes that

have occurred in the past, as would be

done with a lessons-learned approach.

One example is in AC 25.981–1A,

published originally in 1971, which

included a list of failure modes, based

upon lessons learned at that time, that

should have been considered in

showing compliance with the

requirements of § 25.981. Since that AC

was published, however, numerous

unforeseen failures have occurred, thus,

resulting in a much longer list that is

now included in the revision to that AC.

While such a list is valuable in

providing guidance for conducting a

safety assessment, it is not all-inclusive

and we do not consider it adequate for

conducting a comprehensive safety

assessment.

On the other hand, the qualitative

approach to the required safety review

will result in consideration of, and

means to address, potential failure

modes, even if they have not yet been

encountered in service. For example, if

a qualitative assessment indicated that a

particular design feature could result in

a high voltage electrical surge into the

fuel tank, then the assessment would

conclude that measures should be taken

to prevent such an occurrence,

regardless of whether it is a ‘‘lesson

learned’’ based on past occurrences.

Request for Risk Assessment Only of

Remaining Fleet Life

One commenter suggests that the

safety review methodology proposed by

the FAA should provide a risk

assessment over the remaining fleet life

of each aircraft type. Many of the

aircraft types that would be affected by

the proposed SFAR are approaching the

end of their fleet lives. The commenter

asserts that, when determining if safety

reviews and resulting design changes

are warranted, the consideration should

be based upon a risk assessment based

on the remaining fleet life.

FAA’s Response: The FAA agrees that

the remaining fleet life could be one

consideration in establishing a basis for

an exemption from the requirement to

perform a safety review for particular

models, but it is not a general basis for

limiting the applicability of the

proposal. While some models of

airplanes have exceeded their economic

design goal (for example the Boeing

Model 727 and McDonnell Douglas

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23103

Model DC–9), there are individual

airplanes of those models that are still

in service, and extensive future service

life is planned for them. Consequently,

exposure to the risk of fuel tank

explosions remains as valid for these

models as for any others in service.

Regarding whether resulting design

changes are warranted, those changes

would necessarily be mandated by

separate regulatory actions (AD’s).

Therefore, whether the changes are

warranted will be assessed in the

context of those actions.

Request for Change in Compliance Time

for Conducting Safety Review

Several commenters state that the 12-

month compliance time for completing

the required actions proposed under the

SFAR is unrealistic, and request a

longer period for compliance. The

reasons that these commenters give are

as follows:

First, industry lacks the resources to

accomplish the requirements within the

proposed timeframe. There are limited

qualified personnel to conduct the level

of safety review that the proposed SFAR

would require. Formalized system safety

analysis of the type outlined in AC

25.1309–1A requires specialists with

extensive knowledge of the system

architecture, component details, and

service history, as well as the analysis

methodology.

Second, the flow time necessary to

perform the proposed safety review

would exceed the proposed compliance

time. The commenters point out that

over 100 airplane models would need to

be reviewed, and the proposed safety

review methodology would require two

to four years of effort per major model

for large transport aircraft. Some major

models of airplanes have numerous

minor model variations. These minor

model variations would add significant

additional review effort. Availability of

qualified engineers does not allow these

reviews to be conducted in a completely

parallel fashion. Assuming a 9-month

flow time to accomplish each review

and the capability to conduct up to

three reviews simultaneously, some

manufacturers would require well in

excess of 45 months to complete the

proposed reviews. In other instances,

the resources available to some TC or

STC holders may limit their capability

to one safety review at a time. These

estimates take into account work

already accomplished by the industry

over the past 4 years.

Third, development of the

maintenance instructions could not

possibly be accomplished within the

proposed 12-month compliance time.

As written, the proposed SFAR would

require ‘‘all maintenance and inspection

instructions necessary’’ to be submitted

as part of the safety review report.

However, the commenters assert that

effective development of a maintenance

program cannot practically start until

the safety review is completed, and it

must be developed in coordination with

the operators and regulatory agencies.

Therefore, submittal of the maintenance

and inspection instructions as part of

the safety review report is not feasible.

The commenters request that the

proposal be revised to allow a period of

6 to 8 months for the development of

these instructions once the FAA has

approved the safety review report.

Fourth, necessary design changes

identified as a result of the safety review

could not be developed, evaluated, and

shown to comply with the new

requirements within the proposed

compliance time. The commenters

request that the compliance time for

design change activity be treated

separately from the SFAR review

activity.

Fifth, the FAA itself lacks resources to

support timely review of the safety

review reports required by the SFAR

within the 12-month time proposed to

complete the review. The commenters

believe that the FAA has grossly

underestimated its own flow times

regarding coordination and approval of

the SFAR-mandated safety reviews and

resulting compliance substantiation

documents. Experience has shown that

the FAA typically takes 60 to 90 days

to review and approve of documents of

this kind. Multiplied by 100 reports or

more, it would appear that the FAA

itself would require more than the

proposed 12 months compliance time to

complete its review and approval cycle

once the reports are submitted by the

industry.

Another commenter considers that the

proposed compliance time for

developing the maintenance and

inspection program is inadequate. The

commenter asserts that, without the

insights gained through the SFAR

design review assessment process, any

attempts to accurately revise existing

maintenance and inspection programs

would be ‘‘counterproductive’’ to the

goals of the proposed rule. The

commenter maintains that the FAA

underestimates the time necessary to

prepare and develop the maintenance

program, receive approval, and

implement the program. This

commenter requests that the proposed

rule be changed to allow more time for

revising the operator’s maintenance or

inspection programs, and that this time

start only after the completion of the

design review and the manufacturers’

maintenance program for each airplane

model.

Certain other commenters request that

the proposal be changed to include the

following text:

‘‘Compliance time:

(a) All design review reports must be

submitted to the Administrator no later than

36 months after the effective date of this rule

or within 18 months of the issuance of a

certificate for which application was filed

before [effective date of the rule], whichever

is later.

(b) Maintenance and inspection

instructions must be submitted to the

Administrator no later than 8 months after

the FAA has approved the design review

report for the applicable aircraft type.’’

Others request that the compliance

time for completion of the safety review

should be extended to 54 months.

FAA’s Response: The FAA has

considered the reasons for the

commenters’ requests and concurs that

the compliance time should be extended

somewhat. We have revised the final

rule to provide a compliance time of 18

months for conducting the safety

reviews and submitting them to the

FAA. Even for those designers who

work closely with the appropriate

ACO’s in conducting their reviews, we

acknowledge that, following

submission, some time will be required

for FAA review and for any necessary

revisions, and we consider that 6

months should be adequate for those

activities. We are aware that when the

FAA has mandated maintenance

program changes in the past, we have

typically allowed operators 12 months

to incorporate those changes into their

programs. Therefore, we have revised

the operating rules to require that

operators incorporate the maintenance

program changes within 36 months after

the effective date.

Designers may allocate the 18-month

compliance time between the safety

review and the development of

maintenance and inspection

instructions as they deem appropriate.

In evaluating the information presented

by the commenters and the relevant

safety concerns, we have determined

that this revision can be made without

significantly affecting safety.

These revised compliance times are

not as long as those requested by the

commenters for the following reasons:

• The commenters based their

estimates on the assumption that a

quantitative assessment would be

required. As discussed previously, in

most cases a less time-consuming

qualitative assessment will be sufficient.

• There is a substantial degree of

commonality in design features of the

affected models. Such commonality will

23104 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

allow analysis to be conducted by

similarity to previously reviewed

designs. In light of this, we do not

foresee designers needing to conduct a

separate safety analysis ‘‘from scratch’’

for each model.

• Since the TWA 800 accident over 4

years ago, many manufacturers already

have completed significant reviews of

service history and analysis of fuel tank

designs for many airplane types. This

will significantly reduce the time and

resources that will be needed to

complete the requirements of the SFAR.

• We expect that industry will work

closely with the cognizant ACO in

planning the safety review, and

providing feedback as the evaluation

progresses. This should allow expedited

approval by the local office.

Given the additional time provided in

the final rule, we are confident that the

technical capability exists and that

industry will expend the resources

needed to address this critical safety

issue in a timely manner.

As for the compliance time for

development of needed design changes,

we have revised the text of the final rule

to include a provision that would allow

extensions of the compliance time on a

case-by-case basis. The final rule states

that the FAA may grant an extension of

the compliance time if:

• The safety review is completed

within the compliance time, and

• Necessary design changes are

identified within the compliance time,

and

• Additional time can be justified.

Request for Clarification of SFAR

Applicability to STC Holders

Two commenters state that, as

worded, the proposed SFAR text does

not clearly specify that it applies to

holders of STC modifications that may

have no direct relationship to the fuel

system, but could have an effect on fuel

tank safety. The commenters are

concerned that some readers may

misconstrue the current text as referring

only to STC’s for modifications directly

to the fuel tank system, and not STC’s

that are adjacent to the fuel tank and

may indirectly affect them.

One of these commenters

recommends that the proposed phrase

‘‘supplemental type certificates affecting

the airplane fuel tank system’’ be

revised to ‘‘supplemental type

certificates capable of affecting the

airplane fuel tank system.’’ The other

commenter suggests that the phrase be

revised to ‘‘supplemental type

certificates modifying the airplane fuel

tank system.’’

The commenters consider that adding

the suggested words would make it clear

that the SFAR applies not just to fuel

system STC’s, but to all STC’s that could

affect the fuel system.

FAA’s Response: The FAA concurs

with the commenters that a change in

the text of the SFAR is necessary to

clarify the intent. It was the FAA’s

intent that the SFAR requirements were

to apply to holders of STC’s that may

affect the fuel system or result in a fuel

tank ignition source. This was explained

in detail in the preamble to the notice,

and that discussion is repeated in this

final rule under the heading,

‘‘Supplemental Type Certificates,’’

above.

Based on the comments, we recognize

that the proposed text could be

construed too narrowly; that is,

construed to mean that the requirements

apply only to STC modifications that

actually change the fuel tank system.

We also recognize that it may not be

possible to determine whether a

modification actually affects the safety

of the fuel tank system without

conducting at least a rudimentary

qualitative evaluation. In order to clarify

this point, we have revised the text of

the final rule to state that the SFAR

applies to all holders of type certificates

and supplemental type certificates that

‘‘may affect’’ the safety of the fuel tank

system.

Request for Clarification of SFAR

Requirements for STC’s Not Directly

Related to Fuel Tanks

One commenter raises concerns about

the requirements of the proposed rule as

they apply to STC approvals of

modifications that are not specifically

fuel tank system modifications. These

types of approvals are referred to as

‘‘non-ATA 28 STC approvals.’’ (‘‘ATA

28 STC’s’’ refers to approvals that

actually change the fuel tank system.)

Specifically, the commenter questions

the feasibility of conducting a safety

review on the types of modifications

whose installation(s) do not actually

change, but could affect, the airplane

fuel tank system.

The commenter requests that the FAA

consider a separate requirement in the

SFAR for assessing the effect of these

non-ATA 28 STC’s on the fuel system.

The commenter asserts that airplanes on

which non-ATA 28 STC’s are installed

should only be assessed qualitatively or

by inspection, and that only two key

areas need to be examined:

1. The modification of wiring next to

or near wiring that enters the fuel tank.

These commenters suggest that the

effects of these STC’s could be assessed

by a one-time inspection performed on

each aircraft model by a specific time,

such as:

• At the next heavy-maintenance

inspection interval where the area or

zone is opened and accessed, or

• In conjunction with any downtime

necessitated by a modification program

resulting from the safety review

required by the proposed SFAR.

The objective of the suggested

inspection would be to examine wiring

that enters the fuel tank and assess

whether any STC modifications

introduce non-conformities that may

compromise the fail-safe design concept

or may be a possible fuel tank ignition

source. (Only the wiring external to the

tank would need to be inspected.) The

nonconformity would be established

based on a listing of specific inspection

guidelines issued by either the FAA

(possibly in the revised AC 25.981–1B)

or the OEM’s for each aircraft model. As

with the SFAR safety review, any nonconformity would be identified and

reported to the design approval holder.

As alternatives to this one-time

inspection, the commenter suggests:

• A qualitative design review could

be conducted, if sufficient technical

information is available regarding the

installation of the pertinent STC’s.

• Alternative methods could be

conducted that ensure the continued

airworthiness of the airplane (with

respect to wiring that enters the fuel

tank). For example, installation of a

transient suppression device should

eliminate the need to inspect or conduct

design reviews of modifications that

might otherwise affect FQIS wiring.

2. The effect of modifications to the

environmental control system (ECS) and

other system modifications capable of

generating autoignition temperature into

the tank structure. The commenter

states that a qualitative review of these

systems should be conducted by

reviewing whether the approved

configuration has been altered. If it has

been altered, the operator would

identify the alteration and ‘‘report it to

the person responsible’’ (i.e., the design

approval holder of the design

modification).

The commenter states that a one-time

inspection process, as described above,

would need to be developed using:

• The OEM’s or STC holder’s list of

general design practices and precautions

obtained during their SFAR safety

reviews, and

• The revised maintenance program

produced from the SFAR safety review.

The commenters foresee this

information as providing operators with

guidelines on what to inspect, how to

inspect, and what the pass/fail criteria

are.

The commenter suggests that this

inspection should not repeat the

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23105

inspections that have been performed to

date by the operator. (For example, the

operator should receive credit for any

inspections performed because of an

airworthiness directive or part of the

industry-wide Fuel System Safety

Program.)

FAA’s Response: The FAA does not

concur with the commenter’s suggestion

for several reasons. Although the

commenter characterizes its proposal as

a ‘‘qualitative review,’’ it would only

result in an inspection for ‘‘nonconformities,’’ with the inspection

results forwarded to the design approval

holder. The suggestion does not specify

what, if any, obligation the design

approval holder would have to address

these non-conformities, which, by

definition, are not part of the holder’s

approved design. It would be

unreasonable to impose an obligation on

design approval holders to conduct

reviews of designs for which they are

not responsible. In light of this

commenter’s adverse comments

regarding imposing a requirement for

such holders to review their own

designs, imposing an additional

obligation is inconsistent.

In addition, the commenter’s

suggestion would result in a long delay

in completion of the safety review of the

fuel tank system. For example, the

commenter suggests that the inspection

take place during a heavy maintenance

inspection; however, the heavy

maintenance inspection intervals are

typically every 4 to 5 years. Once the

airplane configuration was determined,

additional time would be needed to

complete the assessment and to develop

any necessary maintenance and

inspection programs or design changes.

The alternative process suggested by the

commenters could effectively postpone

addressing the effects of wiring on the

fuel tank system by as much as 7 or 8

years. The elapsed time to complete this

process would not provide the level of

safety intended by the FAA or expected

by the public.

Question on SFAR Requirements for

STC’s Where No Technical Data Is

Available

Several commenters raise a concern

about the proposed SFAR requirements

as they pertain to a safety review of

pertinent STC’s where the STC holder is

out of business and the necessary

technical data is not readily available.

The commenters expect that, for these

cases, the burden would fall on the

operators to conduct the review

required by the SFAR. The commenters

are concerned that, for a large number

of these operators, the review process

for these types of STC’s may present ‘‘an

insurmountable burden’’ for the

following reasons:

• A full review of modifications

accomplished by the operators over the

decades that some of the affected

airplanes have been operated is

impracticable.

• Where operators have sold aircraft

to another party, it is possible that the

current owner of the airplane may come

back to the operator and require such an

evaluation. This situation is

unmanageable.

• Operators will have difficulty

performing any type of quantitative

analysis due to lack of intensive

familiarity with these types of methods.

• The technical information required

to perform a quantitative or qualitative

analysis may not be available or may not

pertain to the specific aircraft model.

• Involvement by the original

equipment manufacturer (OEM) in

providing operators with assistance is

viewed by the operators as likely to be

minimal.

The commenters are particularly

concerned that the OEM’s are probably

not familiar with many of the STC’s that

have been incorporated on the aircraft.

Further, the chance of obtaining an

assistance contract with the OEMs is

slim because they will be stretched for

manpower supporting OEM

responsibilities relating to the proposed

SFAR.

Additionally, the commenters are

concerned that technical assistance from

the FAA’s fuel system specialists cannot

be ensured for the operators. The FAA

may be prepared to work with the

affected type certificate holders to assist

them in complying with the

requirements of the proposed SFAR, but

such assistance may not be possible for

operators in this situation due to a lack

of manpower.

FAA’s Response: The FAA does not

agree that the proposed rule would

impose ‘‘insurmountable burdens’’ on

operators. As with all operating rules,

the person ultimately responsible for

compliance is the operator. But this

rulemaking is unique in the extent to

which current designers are required to

provide operators with analysis and

documentation of maintenance

programs to support operators in

fulfilling their obligations.

The existing operating rules generally

require operators to maintain their

aircraft in an airworthy condition. A

prerequisite for maintaining an airplane

is the ability to understand its

configuration, at least with respect to

safety critical systems. This is reflected

in operating rules such as

§ 121.380(a)(2)(vii), which requires a list

of current major alterations to be

retained permanently, and § 121.380a,

which requires that these records be

transferred with the airplane.

This rulemaking originated from the

FAA’s conclusion that fuel tank systems

on current transport category airplanes

may not be airworthy, and that the

seriousness of this safety issue warrants

substantial efforts to identify safety

problems in order to prevent future

accidents such as TWA 800. It is

unacceptable for operators to claim not

only that they are currently unable to

understand the configurations of these

systems on their airplanes, but that it is

unreasonable to expect them to gain that

understanding. The objective of this

rulemaking would be defeated if

operators of airplanes with

configuration changes were allowed to

rely solely on the instructions

developed by TC and STC holders that

may not reflect the actual

configurations. This would allow for

hazards introduced by the configuration

changes to remain unaddressed.

As discussed previously, this same

commenter suggests a one-time

inspection to identify certain aspects of

the configuration. We concur that, for

those operators who cannot otherwise

identify their airplanes’ configurations,

a one-time inspection of the entire

system may be an appropriate means of

determining the configurations. Once

the configuration is known, the operator

can perform a safety review of

configuration changes not included in

the TC holder and relevant STC holder

reviews. As discussed previously, this

type of review may be qualitative and

does not require a quantitative analysis.

In performing this review, the operator

can use the guidance provided in AC

25.981–1B and the TC and relevant STC

holder maintenance and inspection

programs.

These operators could begin

inspecting these airplanes immediately

so that the differences from the TC and

STC configurations can be documented

and taken into consideration in the

system safety assessment and any

subsequent maintenance and inspection

instructions. While operators may not

have adequate engineering resources to

complete the evaluations and may not

be able to rely on TC holders for support

in evaluating these changes, technical

assistance contracts and use of

Designated Engineering Representatives

(DERs) are possible methods of

completing the necessary work.

While we are confident that operators

are capable of complying with these

requirements, we recognize the validity

of the operators concerns regarding the

compliance time. Because it is

important that this review be done

23106 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

properly, the compliance time for

implementing the resulting maintenance

and inspection programs is extended

from 18 months to 36 months. This

provides the operators an additional 18

months after the TC and STC holders

are required to complete their programs,

to complete the safety review of any

field approvals on their airplanes,

develop a comprehensive maintenance

or inspection program, and implement

the FAA approved maintenance or

inspection program. We consider this

sufficient to address any design changes

identified by the operators.

Question on Applicability of SFAR to

Modifications Installed via Field

Approvals

One commenter points out that, in the

preamble to the notice where changes to

the operating requirements were

explained, the FAA included a

discussion of the effect of those

requirements on field approvals. [‘‘Field

approvals’’ are defined as those design

changes approved by an authorized

FAA aviation safety inspector (e.g.,

Principal Maintenance Inspector, PMI)

on an FAA Form 337, ‘‘Major Repair

and Alteration,’’ or other document

(e.g., an airline engineering order).]

However, the preamble did not include

a discussion of field approvals in the

context of the proposed SFAR. Further,

the proposed text of neither the SFAR

nor the operating requirements contains

any mention of field approvals. Thus,

the commenter questions whether the

proposed rule actually applies to field

approvals whose installations may affect

the airplane fuel tank system.

Additionally, the commenter questions

whether other forms of repairs or

modifications permitted on in-service

aircraft and not specifically mentioned

in the SFAR (for example, approvals

used by airlines via SFAR 36 repairs)

need to be considered within the

context of the proposed rule.

If the FAA intends that all repairs be

considered under the rule’s

requirements, then the commenter

requests that field approvals, approved

repairs, and so on, be considered in the

same fashion as non-ATA 28 STC’s

(discussed above).

Similarly, another commenter states

that modifications approved under a

field approval may prove to be

problematic when attempting to comply

with the safety review analysis that

would be required by the proposed

SFAR. These types of modifications

were discussed in the preamble to the

notice, but were not accounted for in the

economic analysis. The commenter

considers that more details are needed

as to how to address them. The field

approval does not have the same

visibility as an STC, and it could be

substantially more difficult to identify

which of these types of modification

could affect the fuel systems.

Furthermore, many might have been

approved by an inspector, without

certification engineering analysis and

data; this would certainly complicate

the safety review analysis required by

the SFAR. Such modifications are of

interest even to foreign parties as they

might have been incorporated on

aircraft that are now on foreign

registries. The commenter requests that

the FAA provide more details as to how

it intends to apply the SFAR to the

modifications approved under a field

approval.

FAA’s Response: The FAA recognizes

that some clarification is necessary. The

preamble to the notice and the

Discussion of the Final Rule section of

this preamble state that the proposed

requirements are intended to apply to

type designs, supplemental type

designs, and field approvals.

The FAA is aware that a significant

number of changes to transport category

airplane fuel tank systems have been

incorporated through field approvals.

These changes may significantly affect

the safety of the fuel tank system. As

discussed previously, the operator of

any airplane with such changes would

be required to identify them, complete

a safety assessment taking into

consideration the safety assessments

completed by the TC and STC holders,

and to develop applicable maintenance

and inspection instructions and submit

them to the FAA for approval, together

with the necessary substantiation of

compliance with the safety review

requirements of the SFAR. To eliminate

any misunderstanding, the operational

final rules have been revised to state

that the instructions for maintenance

and inspection of the fuel tank system

must address the actual configuration of

each affected airplane.

Question on Applicability of SFAR to

Repairs

One commenter requests more details

concerning how the proposed safety

review required by the SFAR would be

applicable to repairs that currently exist

on an airplane. The commenter points

out that the proposed SFAR text omits

any mention of repairs. The commenter

states that it would be very difficult to

trace back all the repairs, and their

supporting engineering data, so that a

proper safety analysis could be carried

out. The commenter believes that these

repairs, like ‘‘orphan STC’s,’’ might

render the design review by safety

analysis approach unworkable in many

cases. To help the operators, the

manufacturers should be required to

provide for an alternative to the safety

assessment.

FAA’s Response: As discussed above,

the FAA intends that the instructions

required by the operating rules address

the actual configurations of the

airplanes. As required by 14 CFR 43.13,

a repair must restore the airplane to its

original or properly altered condition.

Therefore, repairs should not adversely

affect fuel tank system safety. To the

extent that known repairs may have

changed design features affecting fuel

tank system safety, they should be

addressed in the maintenance and

inspection instructions. We recognize

that, unlike records of major alterations,

repair records are not required to be

retained permanently. If operators are

unaware of such repairs, this rule does

not require that inspections be

conducted solely for the purpose of

identifying them. On the other hand, if

such repairs are identified as a result of

inspections performed to identify

configuration changes, those repairs

must be addressed in the instructions.

Request for Clarification on Role of the

Principal Maintenance Inspector in

SFAR Actions

One commenter requests a

clarification of the role of the principal

maintenance inspector (PMI) in the fuel

tank safety review process that would be

required by the SFAR. The commenter

states that there must be technical

information available at the airline or

PMI level to effectively carry out the

objective of the proposed SFAR.

However, the commenter is concerned

that, even though there will be

guidelines available in the new AC

25.981–1B, a PMI ‘‘will not have the

expertise to be able to evaluate whether

an alternative truly satisfies the SFAR.’’

FAA’s Response: The FAA does not

intend that the PMI would evaluate the

technical design information. As stated

in the preamble to the notice and the

Discussion of the Final Rule section of

this preamble, the FAA would require

that this information be submitted to the

cognizant FAA Aircraft Certification

Office (ACO). The maintenance and

inspection program that is generated

also would be approved by the

cognizant ACO. The PMI would be

responsible for oversight of the operator

to verify that any mandatory

maintenance or inspection actions are

incorporated into the operators’

maintenance or inspection programs.

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23107

Request for a One-Time Inspection

Program

One commenter requests a revision to

the proposed rule to require that, prior

to conducting a system safety review

and analysis for each aircraft type, a

detailed inspection should be

conducted of the fuel tanks of several

representative airplanes for each type

certificated aircraft. The purpose of the

inspection would be to determine the

specific health of the fleet. The

inspection should span both old and

newer airplanes, and include at least

two operators and at least 10 airplanes.

The commenter suggests that this

should be a very aggressive inspection,

which would involve removal and

teardown of components and inspection

of difficult-to-reach areas. The

deficiencies and failures listed in the

notice, as well as the findings of the

industry-wide inspections of the Boeing

747 fuel tanks, could provide a starting

point for defining the nature of the

inspections. Based on findings of these

inspections, appropriate corrective

action could be determined and

mandated. Required design changes

would become apparent as a result of

this inspection program.

The commenter states that there are

precedents to this type of inspection.

For example, the United States Air

Force conducted aggressive inspections

of B–52 and KC–135 aircraft in the

1980’s to establish the condition of

these aircraft, and required corrective

action for continued safe operation of

these aging aircraft. These inspection

programs, referred to as Condition

Assessment/Inspection Programs (CA/

IP), were conducted for many of the

same concerns that were raised in the

notice, although the programs covered

other aircraft systems as well (i.e.,

electrical, avionic, hydraulic,

pneumatic, etc.). The CA/IP findings

resulted in numerous fuel system

corrective actions to enhance safety,

including maintenance actions and

intervals, and design improvements.

FAA’s Response: The FAA does not

concur with the suggestions of this

commenter for several reasons:

There already have been ample

inspections, service history reviews, and

other assessments of the transport fleet

that have confirmed, without question,

that the safety of the fuel tank systems

on these airplanes must be improved.

Most recently, the industry-led Fuel

Tank Safety Team conducted an

inspection of over 800 transport

category airplane fuel tanks, which

revealed such things as repairs and

alterations that may result in a fuel tank

system that does not meet the original

type design; improperly installed parts;

improperly routed wiring; etc.

We do not consider that the

commenters’ suggested one-time

inspection is necessary for airplanes for

which the configuration can be

identified by other means. Nevertheless,

the development of critical design

configuration control limitations and

mandatory maintenance and inspection

items will likely result in eventual

inspection of all critical fuel tank

system-related areas of airplanes in the

transport fleet.

Question on Redundant vs. SingleThread Fuel Tank Systems

One commenter questions a statement

in the preamble to the notice that

introduced the FAA’s discussion of its

review of maintenance practices for the

fuel tank system. The statement read,

Typical transport category airplane fuel

tank systems are designed with redundancy

and fault indication features such that single

component failures do not result in any

significant reduction in safety.

The commenter maintains that just

the opposite is true: Current designs are

single-thread systems. That is because

there will be an explosive mixture in the

tank on a regular basis, and there is

likely to be debris in the tank, so any

single failure, such as a hot short, will

compromise safety. The same is true for

pump insulation failures.

FAA’s Response: The FAA disagrees

with this commenter’s observations in

part. Regulations applicable to airplanes

affected by this rulemaking require that

‘‘no single failure or likely combination

of failures may result in a hazard.’’

However, we do agree that the

investigation of fuel tank system designs

has shown certain installations do not

meet this requirement. This is one of the

purposes for the requirements of this

rulemaking action.

Request for Clarification of Statement of

Probability

One commenter disagrees with a

statement that appeared in the preamble

to the notice, which stated:

The proposed SFAR would require the

design approval holder to perform a safety

review of the fuel tank system to show that

fuel tank fires or explosions will not occur

on airplanes of the approved design.

The commenter states that it is

impossible to show that ‘‘fuel tank fires

or explosions will not occur,’’ because

the probability of such an event, in

terms of a system safety analysis, cannot

be shown to be equal to zero. The

commenter believes that this is not what

the FAA intended. The commenter

suggests that this phrase be removed

because the essence of the requirement

of the proposed SFAR is captured in

another passage that appeared

immediately after the cited phrase in the

preamble to the notice, which read:

* * * In conducting the review, the design

approval holder would be required to

demonstrate compliance with the standards

proposed in this notice for § 25.981(a) and (b)

* * * and the existing standards of

§ 25.901.’’

The commenter points out that the

standards proposed in the notice neither

suggest nor require that the probability

of the occurrence of a fire or explosion

should be zero.

Alternatively, the commenter suggests

that the intent of the regulation could be

clarified to require practical elimination

of ignition sources with the intent to

eliminate all sources by use of new

technology and design architecture.

FAA’s Response: The FAA considers

that some clarification is necessary. We

agree with the commenter that it is

impossible to show that the probability

of a fuel tank explosion is equal to zero

in numerical terms. The statement cited

in the notice was intended to express in

very general terms the objective of the

proposed rule—that ‘‘fuel tank fires or

explosions will not occur.’’ The

intended level of safety is clearly

defined in the regulatory text. We

concur with the clarification of intent

provided by the commenter.

Request To Address Third Party

Maintenance Activity in Safety Review

One commenter notes that experience

has shown that unauthorized processes

and materials are sometimes used by

third party repair businesses, possibly

even unknown to the designer. This

may result in service problems that

would be unforeseen by the designer,

and possibly a reduced level of safety.

The commenter argues that it does not

seem reasonable to expect a survey of

the safety of fuel system designs to take

into account the effect of unauthorized

and, therefore, unforeseeable

maintenance activities. There may be

features of the design that are critical to

the safe operation of the equipment, but

not obvious to a third party. The

commenter requests that the FAA

consider revising the proposed

regulation to ensure that maintenance

action carried out by parties not

cognizant of the safety consequences of

their procedures do not jeopardize the

safety of aircraft in service.

FAA’s Response: The FAA agrees in

part with this commenter. The fuel tank

safety review required by this rule must

include failures that are foreseeable as

well as any that have occurred in

service. The evaluation also must

23108 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

include consideration of susceptibility

to maintenance errors. The requirement

to develop critical design configuration

control limitations, discussed later, is

intended to provide maintenance

personnel with precisely the type of

safety critical information identified by

the commenter.

Discussion of Comments on § 25.981,

Fuel Tank Ignition Prevention

Request for Revision to Requirement for

Addressing Latent Failures

One commenter believes that the

proposed § 25.981(a)(3), which would

require demonstrating that an ignition

source could not result from single or

latent failures, is too severe. The

commenter asserts that it presents

requirements that are outside the scope

of § 25.1309 and § 25.901(c); these are

the same standards that the FAA states

in the preamble to be the baseline for

the proposed requirements relative to

the ignition source prevention

assessment. These regulations provide a

defined method for assessing latent

failures (although the regulations do not

specifically address latent failures). The

commenter favors the continued use of

the fail-safe design concept as defined

in AC 25.1309–1A. The commenter

maintains that the new wording

proposed by the FAA imposes a

requirement on latent failure conditions

that are just one part of a larger set of

combinations leading to the hazard of

‘‘ignition sources present in fuel tanks.’’

It is the larger set that § 25.1309 imposes

a requirement on, thus taking into

account the complete set of all

combinations. The commenter states

that the proposed wording of

§ 25.981(a)(3) ‘‘adversely penalizes’’ the

resulting outcome of the analysis, in

particular the definition of maintenance

intervals and the means for determining

whether an added safety feature is

required to mitigate or prevent the

event.

FAA’s Response: The FAA disagrees

with the commenter’s assertion that

current industry practice is adequate to

address fuel tank safety issues.

Paragraph 5.a.1. of AC 25.1309–1A,

which the commenter supports, states in

part:

In any system or subsystem, the failure of

any single element, component or connection

should be assumed to occur during any one

flight regardless of the likelihood that it

would fail. Any such single-failure should

not prevent the continued safe flight and

landing of the airplane, nor significantly

impair the ability of the crew to cope with

the resulting conditions.

Consequently, if ‘‘any one flight’’ is

taken literally, this includes flights

anticipated to originate with preexisting failures. However, we recognize

that the meaning of ‘‘any one flight’’ has

been a contentious issue for many years,

and we have agreed to work within

ARAC to try and resolve the issue of

‘‘specific risk’’ for the more generally

applicable rules, such as § 25.901(c) and

§ 25.1309. Furthermore, as noted earlier,

if a more appropriate means of

addressing this issue should result from

these ARAC activities, this rule will be

amended accordingly to retain

consistency. This commitment to ARAC

notwithstanding, the FAA is also

committed to assuring that transport

category airplane designs are acceptably

fail-safe on each flight, not just on a

typical flight of mean duration or on

flights where the airplane initially has

no failures present.

The FAA disagrees with the

commenters’ assertion that the

requirements of § 25.981(a)(3) are

‘‘outside the scope of § 25.1309 and

§ 25.901(c).’’ As stated previously in the

notice and in this final rule, the FAA’s

policy for compliance with § 25.901(c),

in general, has been to require

applicants to assume the presence of

foreseeable latent (operationally

undetected) failure conditions when

demonstrating that subsequent single

failures will not jeopardize the safe

operation of the airplane. This

requirement (referred to as ‘‘latent plus

one’’) simply provides the same single

fault tolerance for aircraft operating

with an anticipated latent failure as

would be provided by FAA Master

Minimum Equipment List (MMEL)

policies if that failure is known to exist

(i.e., not latent).

As for § 25.1309, the commenter

appears to be confusing the objective of

the rule (i.e., to prevent the occurrence

of catastrophic failure conditions that

can be anticipated) with a conditionally

acceptable means of demonstrating

compliance, as described in AC

25.1309–1A (i.e., that catastrophic

failure conditions must have an

‘‘average probability per flight hour’’ of

less than 1×10¥9). Since this same

misconception has presented itself

many times before, the following

discussion is intended to clarify the

intent of the term ‘‘extremely

improbable’’ and the role of ‘‘average

probability’’ in demonstrating that a

condition is ‘‘extremely improbable.’’

The term ‘‘extremely improbable’’ (or

its predecessor term, ‘‘extremely

remote’’) has been used in 14 CFR part

25 for many years. The objective of this

term has been to describe a condition

(usually a failure condition) that has a

probability of occurrence so remote that

it is not anticipated to occur in service

on any transport category airplane.

While a rule sets a minimum standard

for all the airplanes to which it applies,

compliance determinations are

necessarily limited to individual type

designs. Consequently, all that has been

required of applicants is a sufficiently

conservative demonstration that a

condition is not anticipated to occur in

service on the type design being

assessed.

The means of demonstrating that the

occurrence of an event is extremely

improbable varies widely, depending on

the type of system, component, or

situation that must be assessed. There

has been a tendency, as evidenced by

the comment, to confuse the meaning of

this term with the particular means used

to demonstrate compliance in those

various contexts. This has led to a

misunderstanding that the term has a

different meaning in different sections

of part 25.

As a rule, failure conditions arising

from a single failure are not considered

extremely improbable; thus, probability

assessments normally involve failure

conditions arising from multiple

failures. Both qualitative and

quantitative assessments are used in

practice, and both are often necessary to

some degree to support a conclusion

that an event is extremely improbable.

Qualitative methods are techniques

used to structure a logical foundation

for any credible assessment. While a

best-estimate quantitative analysis is

often valuable, there are many situations

where the qualitative aspects of the

assessment and engineering judgment

must be relied on to a much greater

degree. These situations include those

where:

• There is insufficient reliability

information (e.g., unknown operating

time or conditions associated with

failure data);

• Dependencies among assessment

variables are subtle or unpredictable

(e.g., independence of two circuit

failures on the same microchip, size and

shape of impact damage due to foreign

objects);

• The range of an assessment variable

is extreme or indeterminate; and

• Human factors play a significant

role (e.g., safe outcome dependent

totally upon the flightcrew immediately,

accurately, and completely identifying

and mitigating an obscure failure

condition).

Qualitative compliance guidance

usually involves selecting combinations

of failures that, based on experience and

engineering judgment, are considered to

be just short of ‘‘extremely improbable’’,

and then demonstrating that they will

not cause a catastrophe. In some cases,

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23109

examples of combinations of failures

necessary for a qualitative assessment

are directly provided in the rule. For

example, § 25.671 (concerning flight

controls) sets forth several examples of

combinations of failures that are

intended to help define the outermost

boundary of events that are not

‘‘extremely improbable.’’ Judgment

would dictate that other combinations,

equally likely or more likely, would also

be included as not ‘‘extremely

improbable.’’ However, combinations

less likely than the examples would be

considered so remote that they are not

expected to occur and are, therefore,

considered extremely improbable.

Another common qualitative

compliance guideline is to assume that

any failure condition anticipated to be

present for more than one flight,

occurring in combination with any other

single failure, is not ‘‘extremely

improbable.’’ This is the guideline, often

used to find compliance with

§ 25.901(c), that the FAA is adopting as

a standard in § 25.981(a)(3).

Quantitative methods are those

numerical techniques used to predict

the frequency or the probability of the

various occurrences within a qualitative

analysis. Quantitative methods are vital

for supporting the conclusion that a

complex condition is extremely

improbable. When a quantitative

probability analysis is used, one has to

accept the fact that the probability of

zero is not attainable for the occurrence

of a condition that is physically

possible. Therefore, a probability level

is chosen that is small enough that,

when combined with a conservative

assessment and good engineering

judgment, it provides convincing

evidence that the condition would not

occur in service.

For conditions that lend themselves to

average probability analysis, a guideline

on the order of 1 in 1 billion is

commonly used as the maximum

average probability that an ‘‘extremely

improbable’’ condition can have during

a typical flight hour. This 1 in 1 billion

‘‘average probability per flight hour’’

criterion was originally derived in an

effort to assure the proliferation of

critical systems would not increase the

historical accident rate. This criterion

was based on an assumption that there

would be no more than 100 catastrophic

failure conditions per airplane. This

criterion was later adopted as guidance

in AC 25.1309. The historical derivation

of this criterion should not be

misinterpreted to mean that the rule is

only intended to limit the frequency of

catastrophe to that historic 1×10¥7

level. The FAA conditionally accepts

the use of this guidance only because,

when combined with a conservative

assessment and good engineering

judgment, it has been an effective

indicator that a condition is not

anticipated to occur, at least not for the

reasons identified and assessed in the

analysis. Furthermore, decreasing this

criterion to anything greater than

1×10¥12 would not result in

substantially improved designs, only

increased line maintenance. The FAA

has concluded that the resulting

increased exposure to maintenance error

would likely counteract any benefits

from such a change. An ARAC working

group has validated these conclusions.

When using ‘‘averages,’’ care must be

taken to assure that the anticipated

deviations around that ‘‘average’’ are not

so extreme that the ‘‘peak’’ values are

unacceptably susceptible to inherent

uncertainties. That is to say, the risk on

one flight cannot be extremely high

simply because the risk on another

flight is extremely low. An important

example of the flaw in relying solely on

consideration of ‘‘average’’ risk is the

‘‘specific risk’’ that results from

operation with latent (not operationally

detectable) failures. It is this risk that is

being addressed by § 25.981(a)(3), as

adopted in this final rule. For example,

latent failures have been identified as

the primary or contributing cause of

several accidents. In 1991, a thrust

reverser deployment occurred during

climb from Bangkok, Thailand, on a

Boeing Model 767 due to a latent failure

in the reversing system. In 1996, a thrust

reverser deployment on a Fokker Model

F–100 airplane occurred following

takeoff from Sao Paulo, Brazil, due to a

latent failure in the system. As noted

earlier, the NTSB determined that the

probable cause of the TWA 800 accident

was ignition of fuel vapors in the center

wing fuel from an ignition source:

* * * The source of ignition energy for the

explosion could not be determined with

certainty but, of the sources evaluated by the

investigation, the most likely was a short

circuit outside of the center wing tank that

allowed excessive voltage to enter it through

electrical wiring associated with the fuel

quantity indication system [FQIS].

A latent failure or condition creating

a reduced arc gap in the FQIS would

have to be present to result in an

ignition source. This rule is intended to

require designs that prevent operation of

an airplane with a preexisting condition

or failure such as a reduced arc gap in

the FQIS (latent failure) and a

subsequent single failure resulting in a

short circuit that causes an electrical arc

inside the fuel tank.

Due to variability and uncertainty in

the analytical process, predicting an

average probability of 1 in 1 billion does

not necessarily mean that a condition is

extremely improbable; it is simply

evidence that can be used to support the

conclusion that a condition is extremely

improbable. Wherever part 25 requires

that a condition be ‘‘extremely

improbable,’’ the compliance method,

whether qualitative, quantitative, or a

combination of the two, along with

engineering judgment, must provide

convincing evidence that the condition

will not occur in service.

Request To Revise Definition of Critical

Design Configuration Control

Limitations

One commenter requests that

proposed § 25.981(b) be changed to

revise or delete the reference to ‘‘critical

design configuration control

limitations.’’ This commenter cannot

agree with the definition stated in the

notice as:

* * * any information necessary to

maintain those design features that have been

defined in the original type design as needed

to preclude development of ignition sources.

The commenter raises several

concerns regarding the definition and

implications of critical design

configuration control limitations:

First, the commenter is concerned

that within the definition, ‘‘any

information necessary’’ can be

interpreted as being not only the

provision of maintenance and

inspection instructions, but also the

provision of the fuel tank design

features itself. This could include

material specifications, specific

manufacturing processes, dimensions,

etc. The commenter states that this

means the type certificate holder would

be required to list its proprietary design

approach, which could lead to a loss of

competitive edge and an infringement

on proprietary intellectual property. The

commenter objects to this requirement

because it would allegedly sacrifice the

hard earned competitive advantage that

manufacturers derive through their

expertise and continuing investment in

research and development. As an

example, the commenter asserts, ‘‘if a

certain pump is qualified on the

airplane, the industry does not believe

it is appropriate or necessary to list all

of the features inherent to that pump

itself that were qualified as part of the

units approval. This approved parts list

and the associated installation and

maintenance manuals suffice for

maintaining the airworthiness of this

pump.’’

Second, the commenter is concerned

that this would put an unprecedented

liability risk on the type certificate

holder if it omits some features, either

23110 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

through error or because it did not

realize a supplementary function

provided by the features. (The

commenter provided no further

explanation or substantiation of this

concern, however.)

Third, the commenter states that the

notion of critical design configuration

control limitations goes beyond the

notion of inspection and maintenance.

In this regard, it does not imply the

same compliance requirement as

§ 25.571, which is the FAA’s stated

precedent for the proposed rule.

Fourth, the commenter considers that

critical design configuration control

limitations go against standard industry

practice regarding what manufacturers

should provide to users.

Fifth, the commenter states that the

notion of critical design configuration

control limitations attempts to cover

deficiencies in the STC and the airline

modification approval process by

indirectly ‘‘implicating’’ the

manufacturer in changes to the

certificated configuration that the

manufacturer may not have known

about or performed.

For these reasons, the commenter

requests that the proposed rule be

revised to delete or change the

requirement concerning critical design

configuration control limitations.

FAA’s Response: The FAA does not

concur with the commenter’s request to

revise the rule, and provides the

following disposition of each of the

commenter’s concerns.

1. Concern about release of

proprietary information. The FAA has

always required manufacturers to

provide information that is necessary to

maintain the safety of a product. For

example, information that is contained

in many maintenance manuals might be

considered proprietary in nature, but

the FAA requires each manufacturer to

develop instructions for continued

airworthiness for their products

containing this information. Defining

features of an airplane design, such as

wire separation, explosion proof

features of a fuel pump, maintenance

intervals for transient suppression

devices, minimum bonding jumper

resistance levels, etc., is needed so that

any maintenance actions or subsequent

changes to the product made by

operators or the manufacturer do not

degrade the level of safety of the original

type design. The definition of critical

design configuration control limitations

does not include ‘‘all of the features

inherent’’ in the design; it only includes

information that is necessary to ensure

safety of fuel tank systems. The policy

determination underlying this

requirement is that design approval

applicants subject to this requirement

should be required to develop this

information and make it available to

operators of affected airplanes. This is

consistent with the policy regarding

airworthiness limitations required by

§ 25.571 (‘‘Damage-tolerance and fatigue

evaluation of structure’’).

2. Concern about liability of type

certificate holders. The FAA disagrees

that risk of liability is an issue. If

conscientiously implemented, this

requirement will significantly reduce

the risk of accidents from fuel tank

explosions. This, in turn, will reduce

the liability risk of design approval

holders.

3. Concern about new inspection and

maintenance requirements. The FAA

agrees in part with the commenter.

While it is true that the term ‘‘critical

design configuration control

limitations’’ is new and may result in

new inspection and maintenance

requirements, the very intent of this rule

is to require mandatory maintenance

and inspection for the fuel tank system.

We agree that the compliance

requirements are different between

§ 25.571 and § 25.981. However, these

differences are due to the differences

between structures and systems. For

example, service experience indicates

that alterations have been made to

systems affecting fuel tank safety

without consideration of the effects of

the alterations. One purpose of critical

design configuration control limitations

is to ensure that maintenance personnel

are informed of and address these

effects. In the context of structures, the

primary concern has been aging

phenomena such as fatigue, and the

limitations are intended to ensure that

these phenomena are identified and

addressed before they become critical.

The result in both instances is

mandatory maintenance and inspection

requirements for both fuel tank systems

and structures. We have determined that

the fuel tank system warrants

mandatory minimum maintenance

criteria to prevent catastrophic failure.

By placing these requirements in the

Airworthiness Limitations section of the

Instructions for Continued

Airworthiness, the design approval

holder provides consistent mandatory

baseline maintenance standards for the

fleet.

4. Concern that the requirement goes

against standard industry practice

regarding what manufacturers should

provide to users. The FAA agrees that

the proposed rule may differ from

historical industry practice. However,

the purpose of this rule is to improve

both the safety of the fleet and the

practices within the industry. The

information we are requiring the design

approval holder to provide to the

operator is basic information needed by

the industry to operate airplanes safely.

It will provide operators with a baseline

document to develop a maintenance and

inspection program that will enhance

safety within the fleet. It will also aid

the operator in establishing the

configuration requirements that must be

accounted for during any subsequent

alterations to the airplane.

5. Concern about covering

deficiencies in the STC and

modification approval process by

indirectly implicating the manufacturer.

The FAA disagrees that the definition of

critical design configuration control

limitations ‘‘implicates’’ the TC holder

in configuration changes made by

others. On the contrary, these

limitations provide TC holders with the

ability to limit the types of changes that

may be made to their designs that could

adversely affect their safety.

Request To Delete Use of Placards and

Decals

One commenter requests that

§ 25.981(b) of the proposed rule be

revised to delete the requirements

concerning placement of placards or

decals in the areas where ‘‘maintenance,

repairs, or alterations may violate the

critical design configuration

limitations.’’ The commenter agrees that

adequate information regarding general

design practices and precautions must

be available to those who perform and

approve repairs and alterations to the

airplane. However, the commenter

argues that placing placards and decals

on the airplane may not be practical,

considering that they might not remain

in place or be readable over time. The

commenter suggests that a more

effective way to convey fuel system

general practices information to

operators is via the standard-practices

section of the Aircraft Maintenance

Manual (or a similar section of another

appropriate manual). The commenter

does agree that the fuel quantity

indicating system (FQIS) wiring could

be better identified, and suggests that

manufacturers work with the

appropriate agencies to develop a

standardized system (similar to that for

oxygen lines) to identify critical fuel

systems wiring for future aircraft

designs.

FAA’s Response: The FAA concurs in

part with the commenter. The rule is

meant to be a performance-based rule;

therefore, the FAA’s objective is not to

mandate the use of any specific means

of providing visual identification of

critical design control limitations.

Although the text suggests the use of

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23111

placards and decals, the rule allows

visible means other than placards and

decals to be used. Placards are normally

used in many locations of transport

airplanes to convey information to

maintenance personnel, but placards are

only one option of identifying critical

design configuration limitations. The

FAA also recognizes that installation

and maintenance of placards in certain

locations of the airplane may not be

practical.

The objective of this requirement is to

provide a means to assist maintenance

personnel in reducing maintenance

errors. Adverse service experience

demonstrates that modifications have

inadvertently resulted in routing of high

power wiring with FQIS wiring. The

need to provide visible identification of

critical design configuration control

limitations will depend upon the

particular airplane configuration.

As an example, the FAA anticipates

that the requirements of this rule will

result in modifications either to separate

FQIS wiring from high power sources,

or to install transient suppression

devices. If transient suppression devices

are incorporated into the FQIS, the FAA

would not consider separation of the

wiring from other high power wiring a

critical design configuration item and,

therefore, would not require visible

identification. If separation of FQIS

from high power sources wiring is

critical, the FAA will require a visible

means of identification. One acceptable

means of compliance in this case would

be to install color-coded tape at

specified intervals along critical wiring.

To clarify the intent of this

requirement, we have revised the

wording within the rule to eliminate

reference to placards and decals. The

text of the final rule states only that a

visible means of identification must be

provided.

Discussion of Comments on Appendix

H25.4, Instructions for Continued

Airworthiness

Request To Mandate Certification

Maintenance Requirements Instead of

Appendix

One commenter opposes the proposed

Appendix H25.4(a)(2), which would

require revising the Instructions for

Continued Airworthiness (ICA) to set

forth each mandatory replacement time,

inspection interval, related inspection

procedure, and all critical design

configuration control limitations

approved under § 25.981 for the fuel

tank system. The commenter considers

that singling out just the fuel system for

this requirement is not justified because

all systems have their own criticalities

that must be documented. The

commenter asserts that this proposed

requirement fails to recognize that

equivalent systems-related tasks are

already defined under Certification

Maintenance Requirements (CMR), a

process that has been in place since the

early 1980’s and formalized in 1994.

[CMR’s are maintenance requirements

that identify aircraft system-related

safety tasks for ‘‘dormant’’ (latent)

failure conditions related to hazardous

and catastrophic failure conditions.]

The commenter states that CMR’s are

considered the systems equivalent of the

structural airworthiness limitations and

are part of today’s certification process,

even though CMR’s are not included in

part 25. The FAA Aircraft Certification

Offices (ACO) and other prime

certifying authorities regularly approve

CMR’s, and all operators’ maintenance

programs use these same CMR’s. This

commenter states that the proposed

requirement indirectly regroups all

maintenance tasks associated with the

prevention of fuel tank ignition sources

under the responsibility of the ACO,

and this undermines the MRB process

as well as the FAA’s Aircraft Evaluation

Groups’ (AEG) responsibility in

approving maintenance programs.

In light of this, the commenter

suggests that rather than regulate the

CMR concept system-by-system as the

proposed Appendix would do, the FAA

should pursue a separate regulatory

initiative that would give official

recognition of the CMR’s and make

them enforceable. The commenter states

that doing so would ‘‘fix a long-standing

regulatory deficiency.’’ The advantage of

such an alternative rulemaking

approach is that it would:

• Keep current procedures and

processes in place and avoid the

creation of another bureaucratic

approval process;

• Accomplish the FAA objective of

requiring manufacturers to create an

Airworthiness Limitations section in the

Instructions for Continued

Airworthiness similar to that approved

under § 25.571 for structure; and

• Eliminate the need to enforce

mandatory inspection or other

procedures via § 25.981(b).

Similarly, another commenter

believes that the FAA should formally

recognize the CMR concept in the

proposed rule. This commenter states

that in doing so, the concept of

declaring ‘‘critical configuration control

limitations,’’ as proposed in § 25.981(b),

would be unnecessary. The commenter

recommends the rule be revised to allow

use of the Certification Maintenance

Coordination Committee (CMCC)

process, as described in AC 25–19

(‘‘Certification Maintenance

Requirements,’’ issued November 28,

1994), to allow operators to absorb tasks

within the existing maintenance

programs if a MSG–3 task is identified.

This reduces costs associated with

tracking additional Airworthiness

Limitations, which would be required in

accordance with the proposed

Appendix H requirements.

FAA’s Response: The FAA does not

concur that the rule should be revised

to include the CMR process. The

concept of this rule goes beyond the

current CMR process. CMR’s only

address mandatory maintenance that is

applied to the airplane at the time of

original certification. The requirement

of this rule for configuration design

control limitations will address not only

mandatory maintenance actions, but

also design features (e.g., wire

separation, pump impeller material

specification) that cannot be altered

except in accordance with the

Instructions for Continued

Airworthiness (ICA). The configuration

design control limitations will be made

part of the Airworthiness Limitations

section of the ICA; therefore, they will

be mandatory in accordance with

§ 91.403(c).

Further, the current MRB process

does not provide a mandatory, legally

enforceable means to require mandatory

maintenance tasks; nor does it provide

the critical control limitations that are

needed to assist operators when making

future repairs and alterations to an

aircraft.

There would be some value in

changing the regulations to mandate

either application of the CMR process to

all systems or including all systems in

the Limitations Section of the ICA.

However, such action is beyond the

scope of the current rulemaking, and

would significantly delay action to

address fuel tank safety issues. We are

considering tasking ARAC to address

this issue. If the ARAC process develops

an improved proposal, amendment of

the regulations to adopt an alternative to

the actions required by this final rule

can be made at that time.

Discussion of Comments on Operating

Rules

Request To Revise Maintenance

Operations Requirements

One commenter agrees in principle

with the intent of the proposed changes

to §§ 91.410, 121.370, and 125.248, and

supports the concept of reviewing and

revising, if necessary, the fuel tank

system maintenance and inspection

program. However, the commenter

disagrees with the FAA’s proposed

23112 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

methodology and time frame for

fulfilling this intent.

As for the FAA’s methodology, the

commenter opposes mandating changes

to maintenance programs via operations

rules. Instead, the commenter requests

that mandatory maintenance tasks be

introduced using current industry

practices, such as the use of the

Maintenance Review Board (MRB)

process and MSG guidelines. The

commenter states that the inspection

programs developed using these

processes are based on a foundation of

information derived from various

sources using a defined process.

Further, the commenter states that the

manufacturers’ recommended

maintenance and inspection programs

already serve as the basis for developing

operators’ individual maintenance and

inspection programs. Within these

established programs, safety issues are

identified and addressed at both the

type certification and continuedairworthiness levels. The FAA has

internal processes for managing the

approval of manufacturer-developed

maintenance and inspections programs,

safety tasks, and the final individualoperator maintenance and inspection

programs.

However, the commenter maintains

that it appears that the proposed

requirements will ‘‘dissolve’’ this

existing process only to require meeting

a calendar deadline. The commenter

does not consider that this will lead to

a safety enhancement.

This commenter suggests the

following alternative for implementing a

new or revised maintenance program:

First, the fuel tank system

maintenance programs should be

reexamined in context both with the

results of the required SFAR safety

review and with the existing MRB and

other mandated programs [such as the

Corrosion Protection Control Program

(CPCP) and Supplemental Structural

Inspection Program (SSID)].

Second, the approval process

described in AC 25–19, ‘‘Certification

Maintenance Requirements (CMR),’’

should be used, as appropriate, to

determine the task classification,

interval, and method of task

transmission (for example, via service

bulletins or via the existing program

update process).

Third, the FAA should mandate via

AD’s the service bulletins or program

interval changes developed as an

outcome of this process. This way, any

changes in maintenance and inspection

programs can be communicated to

operators in an approved format that is

compatible with the aircraft certification

basis.

Based on this suggested alternative,

the commenter requests that the rule be

revised to delete the proposed

§ § 91.410, 121.370, and 125.248.

FAA’s Response: The FAA does not

concur with this commenter. First, the

MRB process is not a means to mandate

compliance; it is a means to identify

manufacturers’ recommended minimum

initial scheduled inspection and

maintenance tasks for new aircraft.

Further, in light of service history

regarding fuel tank events, it is apparent

that the MRB using the MSG–3 process

has previously been unable to develop

adequate maintenance procedures to

address various fuel tank safety issues.

Second, for the reasons discussed

previously, the FAA does not agree that

changing the current approach to CMR’s

is appropriate in this rulemaking. Third,

while AD’s are enforceable, they

generally are limited to safety issues of

specific aircraft models. As discussed in

the preamble to the notice and

previously in this final rule, there is no

advantage in addressing this industrywide safety issue in a piecemeal

fashion. We anticipate that in

complying with this rule both designers

and operators will take advantage of

many of the methods developed in

existing cooperative programs noted by

the commenter.

Request for Definition of

‘‘Administrator’’

One commenter requests clarification

of the term ‘‘the Administrator,’’ as it is

used in proposed § § 91.410, 121.320,

125.248, and 129.14. The commenter

interprets the term ‘‘Administrator’’ to

mean ‘‘the Federal Aviation

Administration or any person to whom

he has delegated his authority in the

matter concerned.’’ This is consistent

with the definition of the term that

appears in 14 CFR part 1 (§ 1.1).

The commenter objects to the

inconsistent definition that appeared in

the proposal that identified ‘‘the

Administrator’’ as ‘‘the manager of the

cognizant FAA Aircraft Certification

Office (ACO).’’ Instead, the commenter

requests that the FAA revise the

proposed rule to reflect the formalized,

industry-recognized roles of other

authority entities, such as the PMI and

the MRB process. Specifically, the

commenter requests the following

revision:

• For approval of the development of

the designer’s maintenance and

inspection program, ‘‘the

Administrator’’ is the FAA ACO, the

FAA Aircraft Evaluation Group (AEG),

or the non-U.S. airworthiness authority

(if the FAA ACO has delegated its

authority via a bilateral agreement).

• For approval of the individual

operator’s maintenance program, ‘‘the

Administrator’’ is the Principal

Maintenance Inspector (PMI).

FAA’s Response: The FAA concurs

that clarification is necessary. Part 1 of

14 CFR does define the Administrator to

include those delegated the authority to

act on her behalf. However, in the case

of this rule, we have determined that the

cognizant ACO is the appropriate entity

that can address the myriad of technical

and practical issues faced by

implementing and enforcing compliance

with this rule. As discussed elsewhere,

neither the PMI nor the MRB process is

authorized to perform these duties. The

final rule has been revised to

specifically reference the cognizant

ACO, or office of the Transport Airplane

Directorate, as the appropriate official

for approving the initial and any

revisions of the instructions for

maintenance and inspection of the fuel

tank systems required by the rule.

Request for Extension of Compliance

Time

Several commenters request that the

proposed compliance time for the

required actions of § § 91.410, 121.320,

125.248, and 129.14 be extended. These

commenters state that incorporating the

new instructions into maintenance and

inspection programs cannot possibly be

accomplished within 18 months as

would be provided by the proposal.

These commenters request a minimum

compliance time of 54 months.

FAA’s Response: The FAA concurs

that the compliance time can be

extended somewhat. As discussed

previously in this preamble, we have

revised the compliance time to 36

months.

Request To Issue Airworthiness

Directives To Change Maintenance

Programs Instead of Operating Rules

One commenter disagrees with the

proposed requirement to change

operators’ maintenance programs

through changes to the operating

requirements. The commenter suggests

that the FAA mandate such

maintenance actions via Airworthiness

Directives specific to each model type,

rather than by modifying the operational

rules. The AD’s will allow both the FAA

and the industry to:

• Assess the actual impact of the

maintenance program (cost versus

benefit);

• Ensure that the appropriate

compliance time scale is mandated

versus the effective date of the rule and

the resources available; and

• Ensure that foreign authorities and

operators are notified of the mandatory

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23113

continuing-airworthiness information

via a recognized document (ICAO

obligation, Annex 8, paragraph 4.2.2).

Similarly, another commenter states

that the proposed operating rule

changes are not needed. This

commenter asserts that, if the

instructions for maintenance and

inspections are developed through the

MSG–3 process, there is no need to

include them in the Airworthiness

Limitation section, as would be required

by the proposed rule. If they should be

mandatory, then the FAA should

mandate them by AD’s.

FAA’s Response: The FAA does not

concur with either of these commenters.

As discussed in the notice and

elsewhere in this final rule, we will

issue AD’s to mandate any design

changes identified as needed as a result

of the design review required by the

SFAR established by this final rule.

However, the FAA considers it

inappropriate to delay requiring

implementation of the maintenance

programs developed as a result of the

SFAR. It is evident that existing

maintenance programs are generally

inadequate to ensure the safety of fuel

tanks systems and that program

improvements are necessary. As

reflected in the regulatory evaluation

prepared for this rulemaking, this

approach has been found to be cost

effective.

As discussed previously, we have

carefully considered the first

commenters’ concerns regarding

compliance times, and have extended

the times to address those concerns.

Finally, foreign authorities have been

fully informed of the FAA’s activities,

and we will continue to include foreign

authorities in future discussions of these

issues.

Unlike AD’s, the operating rule

changes adopted by this final rule do

not require the adoption of particular

programs developed by design approval

holders. Rather, the rules require

adoption of programs that meet the

objective of providing an acceptable

level of safety for fuel tank systems.

While the programs developed by

design approval holders will provide a

foundation for operators’ programs, the

individual operator is responsible to

ensure that its programs address the

actual configurations of its fuel tank

systems.

In the preamble of the notice, we also

discussed use of a SFAR and changes to

the operating rules, instead of AD’s, as

the primary means of achieving the

regulatory objective. As we stated, we

consider that an SFAR provides a means

for the FAA to establish clear

expectations and standards, as well as a

timeframe within which the design

approval holders and the public can be

confident that fuel tank safety issues on

the affected airplanes will be uniformly

examined.

This rule ensures that the designer

completes a comprehensive assessment

of the fuel tank system and develops

any required inspections, maintenance

instructions, and modifications, if

needed. As such, the requirements of

this final rule are intended to provide

maintenance requirements that will

prevent unsafe conditions from

developing. This proactive approach

provides predictability and efficiency.

Discussion of Comments on

Flammability Minimization—

§ 25.981(c)

General Agreement With Reducing

Flammability

All comments received support the

overall goal of reducing fuel tank

flammability. Several commenters

strongly support the FAA’s position

that, despite compliance with the

proposed flammability reduction

portion of the rule, the applicant must

ensure compliance with the ignition

source prevention requirements.

Other commenters support the

proposed rule, but suggest other

alternatives. For example, one

commenter asks the FAA to consider

increasing the scope of the proposal to

minimize fuel tank flammability to

totally preventing operation of fuel

tanks with flammable vapors. Similarly,

another commenter requests that the

applicability of the proposal be

increased so that the flammability of

vapors in certain in-service airplanes

would be reduced. Other commenters

suggest the FAA mandate the

installation of means to mitigate the

effects of fuel tank ignition, such as

metal foils or polyurethane foam should

be mandated. Each of these proposals is

discussed below.

Request To Retain Assumption of

Flammable Ullage

Several commenters recognize that

fuel system design has been based on

the assumption that the ullage fuel/air

mixture is always flammable. However,

these commenters express concern that

the proposal to require minimization of

fuel tank flammability could result in a

relaxation of the requirements for

precluding ignition sources within the

fuel tanks. One commenter asserts that

the FAA has retained this assumption

for now, but ‘‘seems to indicate a

willingness to eventually entertain

designs that would rely more on

flammability minimization and

mitigation, potentially allowing

designers to assume the absence of a

flammable ullage under certain

conditions.’’ This commenter considers

that that affordable technology is remote

and, therefore, it should be made clear

that the design philosophy behind the

proposed § 25.981 has firmly retained

the assumption of flammable ullage.

FAA’s Response: As noted by the

commenter, we affirmed that we are not

considering a change to the current

philosophy of assuming a flammable

ullage. However, if technological

changes are developed, such as full-time

fuel tank inerting, and prove to be a

superior method of eliminating the risk

of fuel tank ignition, the FAA could

consider a change in this philosophy in

future rulemaking.

Request To Mandate Means to

Preventing Flammable Vapors—Inerting

Several commenters suggest that

flammable vapors in the fuel tank

should be prevented and that practical

technologies currently exist that should

be mandated. One commenter suggests

that even with § 25.981(c) in place,

circumstances might occur

operationally in which even an

unheated wing tank has a flammable

ullage with a relatively low ignition

energy threshold, and that these

conditions may warrant attention

through amending the rule to further

reduce flammability in the future.

FAA’s Response: The FAA does not

concur that mandating fuel tank inerting

technology has been shown to be

feasible at this time. This was discussed

in detail in the preamble to the notice.

We are continuing to evaluate further

safety improvements, and are

conducting research and development

to investigate the feasibility of

incorporating nitrogen inerting on both

in-service and new type design

airplanes. As noted previously in this

preamble, we tasked the ARAC on July

14, 2000 (65 FR 43800), to evaluate both

on-board and ground-based fuel tank

inerting systems. If further improvement

is found to be practicable, we may

consider initiating further rulemaking to

address such improvements. In the

meantime, this final rule requires a

means to minimize flammability or a

means to mitigate the effects of ignition.

As a performance-based regulation, this

allows the use of any effective,

approved means, but does not require

the use of any one particular means.

Request To Revise Proposed

Flammability Standard

One commenter believes that the

ARAC report referenced in the preamble

to the notice is flawed in its logic,

23114 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

which arrived at a suggested exposure

time to explosive conditions not to

exceed ‘‘7 percent’’ of fleet operating

time. This recommendation was based

on comparison of the incident rate of

fuel tank explosions and ignition events

for center tanks to that for wing tanks.

The commenter states that, due to

operating procedures, the wing tanks are

seldom empty and are not located near

any heat sources. While wing tank

vapors may be explosive when taxiing

on a hot runway for extended periods,

they are never as explosive as are those

that often exist in empty center tanks.

The most serious situation for wing fuel

tanks would be when the airplane lands

on a hot runway with nearly empty

tanks. However, taxi time at landing is

usually short. At takeoff, even with a

long taxi, the wing tanks will be nearly

full with relatively cool fuel. The

commenter concludes that to have

comparable safety margins for center

tanks as for wing tanks, the degree of

explosiveness would have to be

equivalent.

Another commenter asserts that the

proposed flammability requirement is

not sufficiently detailed to ensure that

compliance can be achieved without

having to resort to external guidance,

not published in the rule. The

commenter is concerned that the

proposed rule text is sufficiently vague

to promote lack of standardization in

findings of compliance with the

regulation. Although relevant material is

available in the associated AC 25.981–

2, the commenter is aware that guidance

in the AC is not mandatory and is

concerned that the wording of the rule

essentially requires an interpretation of

‘‘minimize flammability’’ from the

relevant AC.

FAA’s Response: The FAA considers

that additional clarification is necessary.

As for the first comment, the ARAC

recommendation of a 7 percent

flammability standard did not provide

an equivalent level of flammability to

that of the wing (main) tanks, which the

ARAC determined were the tanks with

an acceptable level of fuel tank safety in

relation to ignition or explosion events.

The ARAC calculated a range of 3 to 5

percent for wing tanks. We considered

this concern when developing the

regulatory text for this rule, and this is

why the proposal requires flammability

to be ‘‘minimized’’ rather than accepting

the ARAC recommendation of 7 percent.

In response to the second commenter,

we consider it appropriate to further

clarify the intent of the rule by

incorporating a definition of the term

‘‘minimize’’ in the text of § 25.981(c), as

follows:

In the context of this rule, ’minimize’

means to incorporate practicable design

methods to reduce the likelihood of

flammable vapors.

‘‘Practicable design methods’’ are

feasible means, such as transferring heat

from the fuel tank (e.g., use of

ventilation or cooling air). We have

provided further guidance in AC

25.981–2, which describes how

demonstrating that the flammability of

the fuel tank is equivalent to that of an

unheated wing fuel tank would be one

acceptable means of showing

compliance. As with all new

performance based standards, it will be

necessary for the Transport Airplane

Directorate to participate in the review

of proposed means of compliance to

ensure standardization.

Request That Rule Based on

Flammability Be Delayed Until

Standard Is Established

One commenter representing

manufacturers and operators agrees in

principle with the FAA’s overall intent

to enhance the fuel system safety of

future aircraft designs through measures

to reduce fuel tank flammability

exposure. The commenter agrees that

action should be taken, as identified by

the ARAC Fuel Tank Harmonization

Working Group, ‘‘to address

flammability mitigation as a new layer

of protection to the fuel system.’’

However, the commenter disagrees with

the proposed § 25.981(c) that would

require minimization of fuel tank

flammability, because ‘‘there is not an

agreed-to definitive industry standard

for assessing flammability of aircraft

fuel tanks.’’

In light of this, the commenter

requests that a rule based on

flammability be delayed until a standard

is defined. In its place, the commenter

recommends a new rule that would

accomplish some degree of flammability

reduction, even though a definitive

flammability standard does not exist.

The commenter suggests that the new

rule should require practical measures

to reduce heat transfer from adjacent

heat sources into fuel tanks, and

proposes the following text for the rule:

§ 25.981(c):

If systems adjacent to fuel tanks could

cause significant heat transfer to the tanks:

(1) Means to reduce heating of fuel tanks

by adjacent systems shall be provided; or (2)

Equivalent flammability reduction means

shall be provided to offset flammability

increases that would otherwise result from

heating; or

(3) Means to mitigate the effects of an

ignition of fuel vapors within fuel tanks shall

be provided such that no damage caused by

an ignition will prevent continued safe flight

and landing.

FAA’s Response: The FAA does not

agree with either the commenter’s

proposal to delay the rule relating to

fuel tank flammability or the

commenter’s proposed regulatory text.

The proposal offered by the commenter

would require only that a ‘‘means to

reduce heating of fuel tanks by adjacent

systems shall be provided * * *’’ The

proposed text suggested by the comment

does not require any measurable

reduction in flammability, which is the

objective of this rulemaking. For

example, under the commenter’s

suggested standard, if a fuel tank

initially contains a flammable fuel-air

mixture, a ‘‘means to reduce heating of

the tank’’ may reduce the temperature of

the fuel, but not necessarily to the

extent that the temperature would

remain below the flammable range for

the duration of the flight.

The commenter asserts that there is

no standard for assessing flammability

of airplane fuel tanks. However,

industry members represented by the

commenter were members of the ARAC

group that recommended that the

regulatory text mandate a maximum fuel

tank flammability of 7 percent of the

operating time. The ARAC report

provides numerous calculations of fuel

tank flammability that were conducted

by industry representatives. We are

confident that industry is capable of

assessing fuel tank flammability, and we

have provided guidance in AC 25.981–

2, which defines methods of

demonstrating compliance with the

flammability requirements of the rule.

One method described in the AC for

showing compliance is to demonstrate

that the flammability of the tank is equal

to or less than that of an unheated wing

tank on the airplane type. As discussed

previously, § 25.981(c) has been

clarified by adding a definition of

‘‘minimize.’’ For applicants who are

unable to demonstrate equivalent

flammability to an unheated wing tank,

the use of ‘‘practicable design methods,’’

such as transferring heat from the fuel

tank, will be required. The final rule is

adopted with the change noted.

Request Not To Mandate Fuel Tank

Flammability to the Level Proposed

The commenter does not agree with

the FAA’s statement in the preamble to

the notice that read:

‘‘* * * the intent of the proposal is to

require that fuel tanks are not heated, and

cool at a rate equivalent to that of a wing tank

in the transport airplane being evaluated.’’

For example, directed ventilation

systems may reduce heating of adjacent

fuel tanks, but they do not eliminate

heating. Furthermore, the commenter

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23115

asserts that there should not be a

requirement to ‘‘cool at a rate equivalent

to that of a wing tank.’’ The studies

conducted by the ARAC Fuel Tank

Harmonization Working Group did not

conclude that such a requirement was

necessary or achievable. The commenter

requests that the FAA not mandate

minimizing fuel tank flammability to

the level proposed in the notice,

because it would not be practical to cool

tanks within the fuselage to the same

level as tanks located in the wing.

FAA’s Response: The FAA disagrees.

The rule only affects new type designs.

Therefore, possible design

considerations to comply with the rule

would include:

• Locating heat sources away from

fuel tanks;

• Introduction of cool air from

outside sources into air gaps between

heat sources and fuel tanks to transfer

heat from tanks while inflight; and

• Introducing cool air from ground or

airplane sources during ground

operations.

Some of these features are already

incorporated into certain models of the

transport fleet. These methods are

technically feasible and could provide

an equivalent level of exposure to

operation with flammable vapors to that

of unheated wing fuel tanks—the fuel

tanks with a safety level that the ARAC

defined as an acceptable standard. The

commenter provided no data to support

the assertion that ‘‘it would not be

practical to cool tanks within the

fuselage to the same level as tanks

located in the wing.’’

Request To Provide Alternatives to

Minimizing Flammability

Two commenters request that

alternative regulatory text be included

in the proposed rule concerning the

requirement to minimize flammability.

The first commenter believes that the

FAA’s intent, as stated in the preamble

to the notice and restated in draft AC

25.981–2X, is ‘‘to require that the

exposure to formation or presence of

flammable vapors is equivalent to that

of an unheated wing tank in the

transport airplane being evaluated.’’ The

commenter considers this a reasonable

objective. The commenter recommends

that the FAA reword the proposed rule

text to clearly frame the intent within

the rule itself, and believes that the

wording would be more specific and

less prone to misinterpretation if it

contained the following statement:

A means must be provided to ensure that

the net heat balance within any tank will be

equivalent to that of an unheated wing fuel

tank during any portion of the passenger

carrying operation.

The commenter adds that, if an

unheated wing fuel tank does not exist

on a particular design, then one could

be modeled and used as the reference

standard for all tanks on that design.

The second commenter recommends

that the FAA consider an alternative to

have the applicant determine an

acceptable heat transfer rate at a critical

fuel load, rather than determining if a

temperature limitation is exceeded,

given that the tank ullage is considered

flammable. This would alleviate the

difficulties of working with a high

number of parameters inherent in the

numerous aircraft types and conditions

(including the effects of pumping,

vibration, altitude, fuel load, etc.) by

considering a generic installation.

FAA’s Response: The FAA does not

agree with either commenter.

Minimizing flammability is the ultimate

objective of the rule. We considered

many options when establishing the

regulatory text, and determined that a

performance-based rule is most

appropriate because it allows the

designer to control fuel tank

flammability by using any number of

methods. It also allows the use of new

technology designs that may be

developed in the future. On the other

hand, the commenters’ proposals focus

only on heat balance and heat transfer,

rather than flammability. Their

proposals would not allow the designer

the flexibility to introduce other means

of reducing flammability, other than

controlling heating/cooling of the tank,

such as with nitrogen inerting. Further,

the commenters’ proposals would not

significantly simplify the compliance

demonstration over that of the options

described in AC 25.981–2X. In light of

this, the commenters’ proposals are not

accepted.

Request To Require Retroactive

Reduction in Flammability

One commenter states that the designs

of some in-service airplanes have shown

undesirable characteristics. Because the

proposed flammability requirements

would only affect new airplane type

designs, this commenter seeks insurance

from the FAA that older and current

designs also will be assessed, and

suggests a case-by-case approach.

FAA’s Response: The FAA agrees that

some in-service airplanes have

undesirable levels of fuel tank

flammability. To address this issue, we

tasked the ARAC in 1998 to provide

advice and recommendations on

methods that could eliminate or

significantly reduce the exposure of

transport airplane fuel tanks to

flammable vapors. Our review of the

ARAC report indicates that additional

time is needed to perform the in-depth

research and economic evaluations

necessary to determine if certain

technologies that could reduce or

eliminate fuel tank flammability would

be practical for use on the existing fleet

of transport airplanes. As noted

previously, we also are studying

concepts such as ventilating spaces

adjacent to fuel tanks, and recently

tasked the ARAC to evaluate inerting

systems for possible retrofit into the

existing transport fleet. We will

consider initiating additional

rulemaking if further improvements are

found to be effective and practicable.

Request To Ban Use of Low Flash Point

Fuels

Several commenters suggest that the

use of lower flash point fuels, such as

JP–4 or Jet B, should be disallowed

because these fuels cause a much greater

exposure to flammable vapors. One

commenter notes that while it appears

that these fuels are no longer commonly

used, they may still exist as approved

alternative fuels for several transport

aircraft. If any operators routinely use

Jet B or JP–4 type fuel, then their risk

would be much greater than the risk for

operators using Jet A.

FAA’s Response: The FAA agrees that

use of lower flash point fuels increases

the exposure to operation with

flammable fuels in the fuel tank. In fact,

this rule does require consideration of

fuel type. The limited use of these fuels

on a temporary basis to allow operation

from remote airports is discussed in AC

25.981–2. The FAA does not agree that

use of these fuels should be banned for

in-service airplanes. Data available

indicates that these fuels are not

routinely used in U.S. operations.

However, in some cases, airplanes may

divert into locations where JP–4 fuel is

the only fuel available. Use of this fuel

on a temporary basis allows

continuation of the flight without

requiring tankering of Jet A fuel to a

remote alternate airport and the

associated delays and inconvenience to

the flying public. If use of lower flash

point fuels increases due to market

conditions, the FAA will consider

rulemaking to limit their use.

Request To Require Use of Means To

Prevent Fire Within Fuel Tank

Several commenters request that the

FAA revise § 25.981(c)(2) to require the

use of specific means to address the

requirement to mitigate the effect of an

ignition of fuel vapors within the fuel

tanks. Some of the commenters’

suggestions include flame quenching

metallic foils and polyurethane foam.

These commenters state that such

23116 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

technologies as these are available and

consider them effective in preventing

propagation of flame or explosion

within the fuel tanks

FAA’s Response: The FAA does not

agree that a change to the proposed rule

is necessary. As stated previously, the

final rule is a performance-based

regulation. As such, it may permit the

use of such means as those suggested by

commenters, but the rule does not

require the use of any one particular

means. AC 25.981–2 provides guidance

on use of these means.

Discussion of Comments Concerning

Cost of the Rule

The detailed responses and the

impacts of the comments on the costs of

the rule are contained in the Final

Regulatory Evaluation, which is

available in the docket. The quantitative

effects of the comments on the

assumptions and the cost estimates are

summarized in the Economic Evaluation

discussion later in this final rule. The

following discussion is a more general

disposition of the comments concerning

the cost of the rule.

Number of Airplanes, TC’s, and STC’s

Affected

One commenter notes that the FAA

assumed that a U.S. fleet size of 6,006

airplanes would be affected by the

proposed rule. While this number may

have been appropriate in 1996, the

commenter states that by the time the

final rule is issued, there likely will be

more than 7,000 affected airplanes.

Additionally, the commenter notes

that the number of affected type

certificates counted by the FAA did not

include the Fokker Model F27 Mark 50

or the Boeing Model 717. Further, the

FAA’s listing of fuel system STC’s was

incomplete; for example, there were no

fuel tank system STC’s listed for any

Airbus, Fokker, Bombardier, or

Aerospatiale airplanes.

Finally, the commenter states that the

FAA’s cost estimate should take into

account the worldwide impact that the

proposed rule will have, as other

regulatory authorities adopt identical or

similar rules. Thus, the true cost of this

activity will far exceed the cost

associated with only the U.S. fleet.

FAA’s Response: The FAA concurs

with the commenter that the number of

airplanes in the U.S. fleet has increased

since the data set used in the notice was

collected. As a result, we now estimate

that 7,875 U.S.-registered airplanes will

undergo the fuel tank system

inspections beginning in the year 2004.

The economic analysis has been

modified accordingly.

We agree with the commenter that our

analysis had not included any Fokker

Model F27 Mark 50 or Boeing Model

717 airplanes in the fleet. The reason

was that the fleet data set that we used

contained no U.S.-registered Model F27

Mark 50 airplanes. The more recent data

set we used for the final regulatory

evaluation also contains no U.S.-

registered Model F27 Mark 50 airplanes;

thus, those airplanes are not included in

the analysis. We did not include any

Model 717 airplanes because that fleet

data was based on a 1996 listing when

no Model 717 airplanes had yet been

manufactured. The airplane data set that

we used in the final regulatory

evaluation is based on 1999 data and

contains Model 717 airplanes. We also

note that even though the 1999 fleet

data set reported no U.S. registered

Airbus Model A321, A330, or A340

airplanes, we assumed that these

models will enter the U.S. fleet

eventually and, therefore, the costs to

review these fuel tank systems were

included in the analysis.

We agree with the commenter that the

analysis had not included all of the fuel

tank system STC’s. After further

research, we discovered one fuel tank

system STC for an Airbus airplane

model, one fuel tank system STC for a

Bombardier airplane model, and no fuel

tank system STC’s for Fokker or

Aerospatiale airplane models. The

economic analysis has been adjusted

accordingly.

We do not agree with the commenter

regarding consideration of worldwide

impact of this rulemaking. The FAA is

not required to account for costs to

foreign operators not operating in the

U.S. because those operators are not

subject to these rules.

Cost of Evaluating Non-Fuel SystemRelated STC’s

One commenter agrees with the FAA

that only a small number of non-fuelsystem STC’s will require a system

assessment. However, the commenter

asserts that the FAA’s analysis does not

account for the significant effort and

associated cost that would be required

to determine whether or not these nonfuel system-related STC’s affect the fuel

system and thus merit further attention.

Such a determination would be required

under the proposed SFAR requirements.

FAA’s Response: The FAA agrees that

the costs to determine which STC’s

affect the fuel tank system should be

included in the economic analysis.

However, we have determined that 90

percent of the non-fuel tank system

STC’s will need only a minimal degree

of engineering effort (with a resultant

minimal cost) for a qualitative

evaluation of their effects on the fuel

tank system. We also have determined

that 325 non-fuel tank system STC

holders will each need to conduct a

more detailed engineering review that

will involve an average of 75 hours of

engineering time. The economic

analysis has been revised accordingly.

Cost of Use of Proprietary Data

One commenter raises concerns

regarding the costs associated with STC

holders obtaining data from the type

approval holder. The commenter points

out that, in the ‘‘Regulatory Evaluation’’

section of the notice, the FAA stated:

Many STC holders would be able to

incorporate a large portion of a TC holder’s

fuel tank system assessment into its

assessment.

The commenter states that, in

practice, the release of such proprietary

information to a third party would need

to occur under a technical assistance

contract. Therefore, the cost of this

transaction should be added to the

FAA’s cost analysis.

FAA’s Response: The FAA disagrees

with this commenter. While a technical

assistance contract may be needed to

obtain this information, the overall cost

to the aviation industry is not affected

because the payment to the data holder

will offset some of the engineering costs

associated with the fuel tank system

design review. As a result, the overall

cost of the rule is not affected by these

contracts, although the distribution of a

part of these costs will shift from certain

TC holders to certain STC holders.

Cost of Fuel Tank System Safety Review

Required by SFAR

One commenter disagrees with the

FAA’s estimate of $14.4 million for the

costs of completing the fuel tank system

reviews required by the proposed SFAR.

The commenter points out that the FAA

estimated that the review would require

0.5 to 2 engineering years per airplane

model. However, the commenter

calculates the actual level of effort

required will be more like 2 to 4

engineering years for each major model.

Minor model variation will add

additional effort that is difficult to

quantify, but could easily increase the

total effort by 30 to 50 percent. In

addition, the commenter states that

systems do evolve with time, leading to

additional permutations that must be

considered.

In light of this, the commenter

believes that the basic safety reviews

will require two to three times more

effort and cost than identified by the

FAA. Accordingly, the cost of the basic

design review may be in the range of

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23117

$28 million to $52 million, plus an

additional $14 million to account for the

variations within models.

FAA’s Response: The FAA agrees that

the number of engineering hours to

review the fuel tank systems should be

increased but disagrees about the

amount of the increase. As discussed

later in more detail in the Economic

Evaluation section of this preamble, we

determined that there were two types of

fuel tank system reviews:

• The first, which is referred to as the

‘‘full-scale’’ review, is the first fuel tank

review done for a model that has several

series.

• The second, which is referred to as

the ‘‘derivative’’ review, are the reviews

of the other series in that model.

Using the Boeing Model 737–300/–

400/–500 as an example, we determined

that this model will involve one ‘‘fullscale’’ review and two ‘‘derivative’’

reviews. In addition, the fuel tank

system reviews performed for all

‘‘extended range’’ series and freighter

series are evaluated as ‘‘derivative’’

reviews. On that basis, we determined

that, depending upon the model, it will

take 6 months to 4 years of engineering

time to perform a ‘‘full-scale’’ fuel tank

system review. The FAA also

determined that it will take 6 months to

1 year of engineering time to perform a

‘‘derivative’’ fuel tank system review.

(See the commonality of design

discussion presented earlier in this

preamble for an engineering explanation

why the review of a model’s series after

the first review will take less time than

the first review.)

The FAA agrees that the number of

fuel tank system reviews needs to be

increased, but disagrees about the extent

of the increase. The FAA determined

that the rule will require 46 ‘‘full-scale’’

reviews and 52 ‘‘derivative’’ reviews.

The impact on the total cost of these

reviews is provided in the Economic

Evaluation section of this preamble.

Cost of Safety Review of Older Type

Designs

One commenter, Lockheed Martin,

considers that the FAA clearly

underestimated the costs to conduct the

safety review required under the new

SFAR on older airplanes, such as the

Lockheed Model L–188 Electra. The

commenter notes that the FAA’s

economic analysis of the cost of the

design review proposed in the notice is

based on a fleet-wide consideration.

This approach results in a per-aircraftcost basis that does not appear

unreasonable. However, the expense to

perform the design reviews and prepare

service documents will be the same for

Lockheed as for other manufacturers

that have twenty or thirty operators and

hundreds of operating aircraft. (They

commenter reports that there are only

13 Model L–188 Electras currently

operating in the U.S.)

The commenter requests that the FAA

take into consideration the following

information when finalizing the

economic analysis of the proposed rule:

1. The FAA’s cost benefit analysis

identifies an engineering effort to

perform the SFAR safety review and

preparation of documents as taking from

three-quarters to three person years to

perform. However, because the Model

L–188 Electra was certified prior to the

issuance of § 25.901 and § 25.1309, the

SFAR safety review will require all new

analysis and possibly testing to prove

that the design meets the requirement

for all operating conditions. The effort

to do this will likely exceed the

maximum FAA estimate of three person

years.

2. Then, the time to familiarize a new

staff with the design, to locate pertinent

files, to relate those files to the long

history of the aircraft, and to develop

test and compliance documents for new

regulations are time-consuming tasks

that will add significant time and costs

to the FAA’s estimates.

3. If the analysis shows that the

design does not meet the newly

imposed requirements, redesign will be

necessary. Such redesign would

increase the expense by a factor of 3 to

5, depending on the detail. It would also

increase considerably the expense to the

operator of installing the new design.

FAA’s Response: The FAA agrees that

additional time and costs will be

required to review the designs on some

airplane types where design information

is not readily available. However, the

FAA does not agree that all of the work

identified by the commenter is

necessarily required. As discussed

previously in this preamble, the FAA

extended the compliance time for

conducting the actions required by the

SFAR, which addresses the

commenter’s concern about the needed

time. Further, the FAA increased the

number of engineering years to

complete a Model L–188 fuel tank

system design review to 4 years.

Additionally, as noted in the earlier

disposition of the comment relating to

the applicability of the SFAR, the FAA

will consider the merits of exemptions

to the requirements of the SFAR based

upon the number of airplanes in service

and the safety benefits that could be

achieved by a safety review.

Cost of Safety Review of STC’s on Older

Airplanes

While commenters generally agree

that the design review should apply to

STC’s and field modifications, several

commenters express concern that the

design review will be difficult to

conduct on older airplanes. In

particular, reviewing non-fuel tank

related STC’s and field approvals could

be unmanageable for airplanes with a

long service life and with multiple

owners. The commenters note that the

FAA did not make any accounting in

the notice for the cost of addressing

these modifications.

One commenter proposes an

alternative approach: A one-time

inspection to determine the

configuration of the airplane and to

verify that wiring entering the fuel tank,

and systems capable of generating autoignition temperature into fuel tank

structure, have not been compromised

by STC modifications. The commenter

asserts that such an inspection would

require about 50 to 100 labor hours to

perform. The resultant inspection labor

costs alone could amount to $28 million

to $52 million, depending upon the

number of airplanes to be inspected (for

example, 7,000 airplanes × 100 hours

per airplane × $70 per labor-hour). This

estimate does not include the cost of the

downtime (and resultant revenue loss)

required to accomplish such an

inspection; yet the proposed compliance

time of 12 months would require

airplanes to be pulled from revenue

service for special inspection. In the

notice, the FAA had estimated that an

annual increase in out-of-service time of

11.5 hours to 32 hours would occur,

depending upon the model, and that

this would result in lost net revenues of

$6.4 million for a 12-month period. The

commenter maintains that the one-time

inspection alternative would also

require this much downtime.

FAA’s Response: The FAA agrees that

the costs associated with reviewing nonfuel tank-related STC’s and field

approvals needs to be addressed.

However, we disagree with the

commenter as to the direction and

magnitude of the effort that will be

needed to evaluate these factors.

Specifically, we agree that a ‘‘paper

review’’ of the airplane’s service history

will be needed for compliance. We

disagree that this review will necessitate

an airplane inspection that is separate

from the initial fuel tank system

inspection and that the labor hours for

any such airplane inspection have been

included in the labor hours to complete

the initial fuel tank inspection. We agree

that the amount of effort to complete

23118 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

this ‘‘paper review’’ will vary across

individual airplanes. Airplanes that

have been in near-continuous operation

by major, national, and regional airlines

(the majority of the airplanes affected by

the rule) should possess welldocumented service history records

such that those operators will need a

minimal amount of time to complete the

paper reviews for those airplanes.

However, we realize that there will be

smaller operators that will spend more

time to trace their airplanes’ service

histories—particularly if the airplane

has had multiple operators and owners.

As a result, we have determined that it

will take an average of one engineering

day (a cost of $880 per airplane) for an

operator to complete this paper review

for every airplane.

Cost of Design Changes

Several commenters raise concerns

about accounting for the costs of new

design changes that could be required

under the proposed SFAR requirements.

One commenter representing

manufacturers and operators agrees, in

general, that any design changes

resulting from the safety review should

be handled outside the scope of the

SFAR. However, there would be

additional costs associated with

developing the necessary design

changes identified by the SFAR safety

reviews. The commenter points out that,

in the notice, the FAA stated:

* * * the design review may identify

conditions that would be addressed by

specific service bulletins or unsafe

conditions that would result in FAA issuance

of an airworthiness directive (AD). However,

those future costs would be the result of

compliance with the service bulletin or the

AD and are not costs of compliance with the

proposed rulemaking. Those costs would be

estimated for each individual AD, when

proposed.

This commenter does not consider it

appropriate for the FAA to assert that

none of these costs are attributable to

the proposed rulemaking. In those

instances where new rules are created

that go beyond existing rules—

essentially raising the current level of

safety—the cost of any design change

driven by these new rules should be

considered as part of the total cost of the

rule.

The commenter points to

§ 25.981(a)(3) as such a rule that

proposes new, more-stringent

requirements associated with evaluating

the effects of latent failures. Should

compliance with this specific rule

require design changes broadly across

the fleet, the costs would be substantial.

For example, if this rule were to affect

half the U.S. fleet (about 3,500

airplanes), and new design change costs

averaged $40,000 per airplane, the total

cost would be $140 million.

The commenter acknowledges that it

is not possible to predict what effect the

proposed rule would actually have on

the fleet, but the potential obviously

exists for costs that range between $100

million and $200 million, or more.

FAA’s Response: The FAA disagrees

that the cost of new design change

requirements should be included in the

cost analysis for this rule. As discussed

in the notice, new design change

requirements will be implemented

through the AD process, during which

the FAA will fully analyze the costs and

the public will have an opportunity to

comment on the FAA’s estimates.

Cost of Developing Maintenance and

Inspection Instructions

One commenter disagrees with the

FAA’s assumption that the development

of maintenance and inspection

instructions would simply be part of the

required SFAR safety review. On the

contrary, this commenter states that this

work, in fact, must be done after

completion of the safety review.

However, the commenter states that, if

one assumes that this effort represents

20 to 30 percent of the effort associated

with the basic safety review, then the

cost could be on the order of $10

million.

FAA’s Response: The FAA partially

disagrees that the costs of developing

the maintenance instructions were not

included in the cost analysis of the rule.

The estimated labor hours required for

the design review specifically included

an estimate of 0.15 year to one year of

engineering time for the TC holders, and

0.1 year to 0.25 year for the fuel tank

system STC holders, to develop the

inspection and maintenance

recommendations. Further, we had

assumed that the design approval holder

recommendations would have been

completed after the fuel tank system

review. Nevertheless, as the proposed

compliance time was 1 year, the fact

that developing the recommendations

after completing the fuel tank system

review had no effect on the present

value of the estimated costs because all

of the expenditures would have

occurred in the first year. This is not the

case for the 18-month compliance time

provided in the final rule. We have

determined that all of the engineering

costs to develop the recommendations

will occur during the second year after

the effective date of the rule. We have

included those costs in the final

economic analysis.

Cost To Comply With the SFAR

One commenter asserts that the

combined cost of the safety review and

development of instructions may well

be $180 to $330 million, rather than the

$16 million estimated by the FAA.

FAA’s Response: The FAA disagrees

with the underlying assumptions made

by the commenter to develop this

estimate. The commenter’s first

assumption is that $100 million to $200

million of these costs are based on the

commenter’s argument that, ‘‘Should

compliance with this specific rule

require design changes broadly across

the fleet, the costs would be substantial.

For example, if [emphasis FAA] this

rule were to impact half the U.S. fleet

(about 3,500 airplanes) and modification

costs averaged $40,000 per airplane, the

total cost would be $140 million. It is

not possible to predict what effect this

new rule would actually have on the

fleet, but the potential obviously exists

for costs that range between $100

million and $200 million, or more.’’

[The commenter is referring to the

requirements of § 25.981(a)(3) of the

rule, which involve evaluating the

effects of latent failures.]

This argument assumes that the cost

of the potential future AD’s should be

attributed to this rule. As stated earlier,

we maintain that the cost of complying

with potential future AD’s is attributed

specifically to those individual AD’s

when they are issued. As a result, we

have determined that there are no

compliance costs attributable to this

rule for any future design changes that

will be accomplished through an AD.

The commenter’s second assumption

is that the fuel tank system review costs

will be two to three times the $16

million estimated by the FAA, plus

there will be an additional $14 million

to review the fuel tanks for the

variations within models. As noted

earlier, we disagree with the amount of

engineering time assumed by the

commenter, as well as the number of

fuel tank reviews that will be

performed. We have recalculated the

estimated compliance cost and

determined that it will be about $30

million.

Finally, the commenter assumes that

each airplane will need a one-time

inspection to verify that previous

airplane modifications have not

compromised the wiring entering the

fuel tank and entering the systems

capable of generating autoignition

temperatures into fuel tank structure.

The commenter estimates this will cost

$28 million to $52 million for labor, and

$6.4 million for lost net revenue due to

out-of-service time. As noted earlier, we

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23119

agree that an individual airplane review

will be needed, but we disagree in that

the labor hours have been included as

part of the labor hours to perform the

initial fuel tank system inspection. We

have, however, calculated a $5.5 million

cost for a ‘‘paper review’’ of every

airplane’s service history.

Based on these figures, we conclude

that the costs to comply with the SFAR

will be $35.5 million. (More details

concerning these costs are explained

later in this preamble.)

Cost of Operating Rule Changes

One commenter agrees with the

statement in the notice that read:

The FAA intends that any additional fuel

tank system inspection and maintenance

actions resulting from the SFAR review

would occur during an airplane’s regularly

scheduled major maintenance checks. From

a safety standpoint, repeated entry increases

the risk of damage to the airplane. Thus, the

proposal would not require air carriers to

alter their maintenance schedules, and the

FAA anticipates that few or no airplanes

would be taken out of service solely to

comply with the proposal unless an

immediate safety concern is identified.

This commenter strongly recommends

that the FAA ensure that the final rule

does not penalize the industry by

requiring inspection intervals more

frequent than truly necessary, or lead to

unnecessary hard-timing of (placing lifelimits on) components.

FAA’s Response: The FAA responds

to this commenter by reiterating that the

intent is to have the maintenance and

inspections generated by this rule be

developed so that the tasks can be

performed during regularly scheduled

maintenance.

Cost of Inspections

One commenter disagrees with the

number of hours that the FAA estimated

would be required to conduct the added

inspections required by the rule. The

commenter calculates that the metric

will be 300 to 500 labor hours per

airplane every 9 to 11 years, plus any

parts replacement costs yet to be

defined by the manufacturer.

Another commenter suggests that the

cost analysis needs to be adjusted to

address in-tank inspections. The

commenter asserts that the FAA

assumes that much of the in-tank

inspection work will be accomplished

during heavy maintenance checks when

the tanks are open and purged.

However, for some aircraft, the tanks are

opened only once every eight years for

scheduled maintenance. Therefore, if intank inspections are mandated, some

aircraft will have to be removed from

scheduled service and the costs

associated with this should be

considered in the rule. Also, the costs of

preparing tanks for entry should be

considered.

FAA’s Response: The FAA agrees

with the first commenter. Assuming the

commenter’s airplanes were

manufactured between 1960 and 1980,

we calculated that the initial fuel tank

system inspection, plus the two

reinspections that will occur during a

12-year period, will result in a total

number of 330 labor hours per airplane.

We disagree with the second

commenter. The commenter states that

60 percent of the initial fuel tank system

inspections will be performed during a

‘‘C’’ check , which will require that the

fuel tank be opened, drained, and

vented. We included these costs in the

number of labor hours for the initial

inspection, which are twice the number

of labor hours for the later reinspections

that will be performed during ‘‘D’’

checks. Further, we included a value for

the lost net revenue to the aviation

system as a result of the additional

number of out-of-service days (from one

to three days) for the initial fuel tank

system inspections performed during

the ‘‘C’’ check.

Cost of Complying With New Method of

Addressing Latent Failures

One commenter states that the new

treatment of latent failures (to maintain

the probability of occurrence of a given

latent failure to less than 1×10¥7), as

would be required by § 25.981(a)(3), will

lead to enormous costs with no

attendant benefit. As an example, a

component with a latent failure rate of

1 × 10¥9 per flight-hour would have to

be inspected (or hard-timed) every 100

hours (or 200 hours, if an average

exposure time is assumed to be T/2) to

keep the probability of failure under

1×10¥7. A component failure rate of

1×10¥8 per flight-hour would require

inspection every day (10 hours). The

commenter asserts that the benefit

derived from performing such

inspections or hard-timing is nil, and

the implications of such a rule are selfevident.

Further, this commenter points out

that the FAA’s cost estimate for the

operational rule changes is $154 million

over 10 years, and that is based upon

the assumption that the required

maintenance and inspection programs

will coincide with an airplane’s

regularly scheduled major maintenance

checks. However, the commenter states

that the situation described above

would result in numerous inspections

that would not align with these

regularly scheduled checks. In addition,

it could lead to widespread hard-timing

of components (e.g., pumps). The

commenter notes that the FAA did not

consider either of these possibilities in

the cost analysis; however, the

magnitude of the cost impact could

extend into the billions of dollars.

FAA’s Response: The FAA does not

concur. The conclusion of this

commenter that the costs of compliance

with § 25.981(a)(3) ‘‘could extend into

the billions of dollars’’ is based upon an

assumption concerning the impact of

the requirement. The example provided

by the commenter, which assumes that

the requirement limits the probability of

latent failure to less than 1×10¥7,

indicates a misinterpretation of the

requirement. The rule does not allow a

single failure to hazard the airplane,

regardless of the probability of its

occurrence. The FAA expects that

designs that have single failures that can

result in an ignition source will be

modified to include fail-safe features.

Modifications may also be necessary to

address combinations of failures. If a

fuel tank system is designed such that

the safety level is heavily dominated by

one of the components or features in the

combinations of failures, then added

inspections, hard-timing, or installation

of annunciation features to eliminate

latency are exactly what was intended

by the regulation. The need for

inspections and hard-timing can be

limited by providing redundancy and

fail-safe features and/or by eliminating

latency. Therefore, inspection or

replacement of components at the rate

noted by the commenter would not be

required.

The FAA position is supported by

another commenter who provided

information regarding transient

suppression units (TSU) developed for

the Boeing Model 737 and 747

airplanes. The commenter states, ‘‘The

TSU eliminates the need to inspect

harnesses, probe terminations, etc. The

TSU itself would be subject to periodic

(25,000 hours) inspections.’’ It should

be noted that heavy maintenance checks

typically occur on transport airplane

models prior to accumulating 25,000

hours time in service; therefore, the cost

of inspections for the TSU units would

be low.

The speculation by the commenter

that ‘‘the magnitude of the cost impact

could extend into the billions of

dollars’’ is based on a misunderstanding

of the final rule and, therefore, was not

considered in the final economic

analysis.

Costs of New Modifications

One commenter expresses concern

that the cost analysis is ‘‘greatly flawed’’

because it did not consider all the costs

23120 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

that will result from the requirements of

the SFAR, such as high cost items like

aircraft modifications and ‘‘hard timing’’

of components. The cost analysis takes

credit for the benefits that will result

from these modifications; however, the

commenter considers that the costs

should be included as well.

As an example of the potential costs

of modifications, this commenter

provided the following specific

information concerning how the

proposal would affect its fleet of

airplanes: The commenter owns

approximately 160 Boeing Model 727

airplanes. As a result of the proposed

SFAR safety review, some of the

modifications that might be mandated

for these airplanes are:

• Replacement of the analog FQIS

with a digital FQIS;

• Installation of current suppression

devices;

• Installation of flame arrestors; and

• Possibly, replacement of fuel boost

pumps.

The cost of these modifications alone,

based on data received from the

equipment manufacturers, is

approximately $125,000 per airplane.

Since some of the commenter’s

airplanes already have a FQIS installed,

the cost to modify the commenter’s fleet

would be approximately $17,000,000.

This figure does not include other

modifications that might be mandated

for the airplanes. The commenter points

out that this is the modification cost for

only one aircraft type for one airline. If

all costs for all U.S. registered aircraft

were to be included, the result would be

far greater than the total indicated in

FAA’s cost analysis presented in the

notice.

FAA’s Response: The FAA does not

agree that the cost analysis concerning

possible modifications was flawed.

Section 25.901(b)(2) requires that the

‘‘Components of the installation must be

constructed, arranged and installed so

as to ensure their continued safe

operation between normal inspections

and or overhauls.’’ As stated in the

notice, ‘‘Typical transport category

airplane fuel tank systems are designed

with redundancy and fault indications

features such that single component

failures do not result in any significant

reduction in safety. Therefore, fuel tank

systems historically have not had any

life-limited components or specific

detailed inspection requirements unless

mandated by AD.’’ We agree that some

past design practices have been

deficient and that adding the specific

requirement in § 25.981(a)(3) to address

latent failures may require new design

features for existing airplanes. We also

agree with the commenter that

modifications to the FQIS and/or any

other wiring entering the fuel tank

system may be required (such as

separation and shielding of FQIS wiring

or, for older airplanes, installation of

transient suppression devices). We do

not agree that the rule would mandate

replacement of analog FQIS with digital

systems, although this may be one

method used on certain portions of the

fleet. However, because correcting those

design deficiencies will be

accomplished through the AD process,

those compliance costs will be

estimated when the relevant AD is

proposed.

The SFAR does not require

installation of flame arrestors in fuel

tank vents. We have initiated tasking an

ARAC group to provide

recommendations addressing both a part

25 amendment and retroactive

operational requirement for installation

of flame arrestors in fuel tank vent

outlets. If any rulemaking is

subsequently proposed based on the

recommendations, the FAA will

conduct separate economic analyses for

those proposals.

Cost of Changes to Part 25 on Future

Designs

One commenter disagrees with the

FAA’s cost analysis regarding the affects

of changes to part 25 requiring

‘‘minimizing flammability.’’ This

commenter points to a statement in the

notice that read:

The FAA anticipates that the proposed part

25 change would have minimal effect on the

cost of future type certificated airplanes

because compliance with the proposed

change would be done during the design

phase of the airplane model before any new

airplanes would be manufactured.

The commenter considers that the

FAA’s assumption is incorrect.

Proposed § 25.981(c)(1) would require

that the fuel tank installation include ‘‘a

means to minimize the development of

flammable vapors in the fuel tanks.’’

Moreover, the FAA states that it intends

that the body tanks ‘‘cool at a rate

equivalent to that of a wing tank.’’

The commenter asserts that, based on

this requirement, the cost impact to

future airplane designs could be

substantial. As an example, the

commenter presents a preliminary cost

assessment of a directed ventilation

system, below. The commenter derived

the cost estimates from a report

prepared by an ARAC working group

(Fuel Tank Harmonization Working

Group). These fuel tank cooling cost

estimates are divided into the categories

indicated. The analysis considers the

costs associated with small, medium,

and large airplane designs. (It should be

noted that directed ventilation systems

of the type evaluated would not cool a

center wing tank at a rate equivalent to

that of a wing tank.)

1. Development costs per airplane

design = $2.8 million.

2. Installation costs per production

airplane = $21,200.

3. Additional airplane operational costs

per airplane per year:

• Small airplane = $30,408.

• Medium airplane = $39,295.

• Large airplane = $50,518.

Using these numbers, a simple

calculation may be performed to

estimate the recurring costs associated

with such a system over a 10-year

period. These costs would consist of the

installation costs per production

airplane and the additional operational

costs per airplane per year, applied to a

fleet of a new airplane design with an

assumed production rate. The following

table presents the results of this simple

estimate for a 10-year period (ignoring

inflation, cost of capital, and so on):

Size Annual production rate Production cost Operational

cost Total cost

Small ........................................................................................................ 180 $38,160,000 $301,039,200 $339,199,200

Medium .................................................................................................... 72 15,264,000 155,608,200 170,872,200

Large ........................................................................................................ 60 15,264,000 129,673,500 144,937,500

Although the above example is

simplistic in nature, the commenter

maintains that the conclusion may be

drawn that the overall potential costs

are indeed substantial, even if the initial

developmental costs are not.

FAA’s Response: The FAA disagrees

with the commenter. The requirements

of the final rule should result in very

little increased production costs. Certain

airplane models in production today

locate sources of heat away from the

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23121

center wing fuel tanks. Other models

locate the air conditioning packs below

the center wing fuel tank, but

incorporate air gaps that are ventilated

such that heat transfer into the center

wing tank is significantly reduced.

Other airplane models incorporate

directed ventilation means for areas

below the heated center wing tanks.

The FAA does not agree with the cost

assessment provided by the commenter.

The cost estimate referenced by the

commenter is stated to apply to ‘‘present

airplane designs.’’ It assumes that the

environmental control system (ECS)

packs will be located adjacent to the

center wing tank, and that heat shields

and ventilation air would be used to

remove heat from the center wing fuel

tank. This approach results in added

weight and drag penalties. New designs

allow the designer numerous options to

achieve an optimized design. Air

conditioning equipment can, and has

been, located away from fuel tanks.

Cooling air is available from the ECS

system, ground sources and outside air

in flight. Incorporation of these features

in the initial design would result in

little added cost over that of features

noted in the preceding paragraph on

many airplane designs.

The ARAC report, from which the

commenter has gathered data for its cost

estimates, includes a discussion to

‘‘locate significant heat sources away

from fuel tanks.’’ The report states that,

‘‘* * * quantifying the impact of this

method would only be possible for

specific new designs,’’ and the report

provides little data regarding the costs

for locating packs away from fuel tanks.

We agree with the commenter that

cooling air may be needed to meet the

requirements of this regulation and this

can result in additional operating costs

during certain flight operations.

However, these costs are airplane model

design-specific and could not be

estimated without input from the

industry. Nevertheless, in the absence of

specific industry design and cost data,

we maintain that these additional

operating costs will be minimal.

Further, these costs will occur on

airplanes that will be manufactured

many years in the future and, as a result,

the present value of those operating

costs will be even less.

Paperwork Reduction Act

There are no new requirements for

information collection associated with

this amendment that would require

approval from the Office of Management

and Budget pursuant to the Paperwork

Reduction Act of 1995 (44 U.S.C.

3507(d)).

International Compatibility

In keeping with U.S. obligations

under the Convention on International

Civil Aviation, it is FAA policy to

comply with International Civil

Aviation Organization (ICAO) Standards

and Recommended Practices to the

maximum extent practicable. The FAA

determined that there are no ICAO

Standards and Recommended Practices

that correspond to these regulations.

Economic Evaluation, Regulatory

Flexibility Determination, Trade Impact

Assessment, and Unfunded Mandates

Assessment

Changes to Federal regulations must

undergo several economic analyses.

First, Executive Order 12866 directs

each Federal agency to propose or adopt

a regulation only if the agency makes a

reasoned determination that the benefits

of the intended regulation justify its

costs. Second, the Regulatory Flexibility

Act of 1980 requires agencies to analyze

the economic impact of regulatory

changes on small entities. Third, the

Trade Agreements Act (19 U.S.C.

section 2531–2533) prohibits agencies

from setting standards that create

unnecessary obstacles to the foreign

commerce of the United States. In

developing U.S. standards, this Trade

Act requires agencies to consider

international standards. Where

appropriate, agencies are directed to use

those international standards as the

basis of U.S. standards. Fourth, the

Unfunded Mandates Reform Act of 1995

requires agencies to prepare a written

assessment of the costs, benefits, and

other effects of proposed or final rules.

This requirement applies only to rules

that include a Federal mandate on State,

local, or tribal governments, likely to

result in a total expenditure of $100

million or more in any one year

(adjusted for inflation).

In conducting these analyses, the FAA

has determined that this rule: (1) Has

benefits which justify its costs and is a

‘‘significant regulatory action;’’ (2) will

have a significant impact on a

substantial number of small entities; (3)

has minimal effects on international

trade; and (4) does not impose an

unfunded mandate on state, local or

tribal governments or the private sector.

The FAA has placed these analyses in

the docket and summarizes them as

follows.

Data Sources

• The principal data sources used for

this analysis are:

• The public comments submitted to

the notice for this rulemaking action;

• The World Jet Inventory at YearEnd 1999;

• Back Aviation Solutions (Fleet PC,

Version 4.0);

• Information from service bulletins;

and

• FAA discussions with industry

engineers.

Affected Airplanes and Aviation Sectors

In the notice, the FAA, using 1996

data, estimated that the proposal would

have affected 6,006 airplanes. Of this

number:

• 5,700 airplanes were operated by

114 air carriers under part 121 service,

• 193 airplanes were operated by 7

carriers that operated under both part

121 and part 135,

• 22 airplanes were operated by 10

carriers under part 125 service, and

• 91 airplanes were operated by 23

carriers operating U.S.-registered

airplanes under part 129.

At that time, the FAA did not have

information on airplanes operating

under part 91 that would have been

affected by the proposal; however, the

FAA had stated its belief that very few

airplanes operating under part 91 would

have been affected by the proposal.

The FAA also estimated that the

proposed rule would have affected:

• 12 manufacturers holding 35 part

25 type certificates (TC’s);

• 26 manufacturers, airlines, and

repair stations holding 168

supplemental type certificates (STC’s)

for part 25 fuel tank systems, of which

69 were for different modifications;

• Manufacturers of future, new part

25 type certificated airplane models;

and

• Holders of future, new part 25

STC’s for new fuel tank systems.

At that time, the FAA was unable to

predict the number of new airplane TC’s

but, based on the average of the

previous 10 years, the FAA had

anticipated that 17 new fuel tank system

STC’s would be granted annually. The

FAA had requested comments on these

estimates.

In order to update the aviation

industry data, the FAA used a different

database for this final rule from what it

used for the analysis of the proposed

rule. However, as this more current

database does not report the same

information as that reported in the

previous database, an exact comparison

between the two databases is not

possible. Consequently, using 1999 data,

the FAA determined that the final rule

affects 6,971 airplanes, of which 6,252

are turbojets and 719 are turboprops. Of

these 6,971 airplanes:

• 6,485 (5,802 turbojets and 683

turboprops) are operated by 143

scheduled and non-scheduled air

carriers,

23122 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

• 117 are operated by 76 private

operators (primarily corporations), and

• 369 are currently held by 112

manufacturers and brokers and leasing

companies.

The FAA also determined that the

final rule affects:

• 13 manufacturers holding 37 part

25 type certificates (TC’s);

• 46 manufacturers, airlines, and

repair stations holding 173

supplemental type certificates (STC’s)

for part 25 fuel tank systems, of which

79 are for different fuel tank system

modifications;

• 325 non-fuel tank system STC

holders that will need to evaluate their

STC’s to determine their impacts on fuel

tank systems;

• Manufacturers of future, new part

25 type certificated airplane models;

and

• Holders of future, new part 25

STC’s for new fuel tank systems.

Based on the previous 10 years, the

FAA projects that there will be between

two and four new part 25 TC airplane

models during the next 10 years. Using

the same methodology, the FAA projects

that there will be three to four new fuel

tank system STC’s annually granted

during the next 10 years.

Benefits

In the notice, the FAA had assumed

that the potential U.S. fuel tank

explosion rate due to an unknown

internal fuel tank ignition was the same

as that rate for the worldwide fleet over

the years 1989 through 1998. On that

basis, the FAA had estimated that, if no

preventative actions were to be taken,

then between one and two (the

statistically expected value was 1.25)

fuel tank explosions would be projected

to occur during the next 10 years (2000

through 2009) in U.S. operations. The

FAA also determined that the

probability that such an accident would

have occurred prior to 2006 was equal

to the probability that it would have

occurred after 2006.

In order to quantify the potential

benefits from preventing a

‘‘representative’’ commercial aviation

mid-air explosion, the FAA had used:

• A value of $2.7 million to prevent

a fatality,

• An average of 130 passengers and

crew on a commercial flight,

• A value of $20 million for a

destroyed airplane, and

• A cost of $30 million for an

investigation of a mid-air explosion

accident.

Thus, a total loss would be $401

million.

In the notice, the FAA had assumed

that compliance with the proposal

would prevent between 75 percent and

90 percent of the future fuel tank

explosions. The basis for this prevention

is derived primarily from the

incorporation of design changes to

enhance fail-safe features of design and

enhanced fuel tank system inspections

that will discover conditions that could

result in an ignition source before

ignition of flammable fuel vapors could

occur. The fuel tank system review, by

itself, will have little direct effect on

preventing these future accidents,

unless it uncovers an immediately

hazardous condition that results in an

AD being issued. As stated earlier, the

FAA has initiated 40 AD’s to address

unsafe fuel tank system features on

numerous airplane types within the

current fleet. While the FAA expects

these actions will significantly improve

safety, an in-depth analysis of all

airplane models required by this rule

has not been completed and it would be

difficult to predict the overall effect on

the accident rate. Therefore, the cost/

benefit analysis assumes that the

accident rate for fuel tank explosions

will remain constant until the reviews

are complete.

With the proposed 18-month

compliance time, the FAA estimated the

benefits based on these inspections

starting in 2001. The resulting

probability analysis indicated that the

first such accident would occur in 2006

and the second accident (if a second one

would occur) in 2009. On that basis, the

estimated present value of the expected

benefits discounted over 10 years to

1999 at 7 percent would have been:

• $260 million for one prevented

accident and

• $520 million for two prevented

accidents.

For the final rule, the FAA revised

these earlier estimates to include the

effect that lengthening the compliance

time from 18 months to 36 months has

on the potential benefits. As a result, the

3-year compliance time indicates that,

with the exception noted in the

previous paragraph, the first benefits

from improved fuel tank system

inspections will not occur until 2004.

The FAA also revised the earlier

estimates to substitute more current

fleet and operations data into the

calculations. The FAA also noted that 2

years without a mid-air explosion have

passed since the analysis of the

proposal, which makes the years 1989

through 2000 (rather than 1989 through

1998) the appropriate timeframe for

calculating the historical accident rate.

On that basis, the FAA calculated that,

if no preventative actions were taken,

between one and two (the expected

value is 1.09) fuel tank explosions

would be expected to occur during the

10-year time period of 2004 through

2013. Further, the FAA determined that

the probability that the first accident

would occur on or before the year 2008

is the same as the probability that it

would occur after 2008.

Thus, based on a loss of $401 million

for a ‘‘representative’’ accident, the FAA

calculated that the present values of the

losses from future mid-air explosions

that would occur between 2004 and

2013 are:

• $233.7 million for one prevented

accident and

• $400.4 million for two prevented

accidents

(The statistically expected value is

$248.9 million for the 1.09 accidents.)

For this final rule analysis, the FAA

reviewed the public comments and its

previous analysis for the notice, and

determined that the data are insufficient

to permit a credible estimate of the

percentage of future mid-air explosion

accidents that the final rule would

prevent. The uncertainty of the causes

of the two accidents and the uncertainty

of the effects of the 40 AD’s on

preventing future explosions does not

allow a quantitative estimate of the

potential effectiveness of the final rule.

Thus, although the FAA believes that

the rule will significantly reduce the

risk of a future accident, the FAA does

not calculate quantified benefits

resulting from the final rule.

Sources of Compliance Costs for the

Proposal and the Final Rule

The costs to comply with the SFAR

derive from the engineering time to

comprehensively review fuel tank

system designs by the design approval

holders (i.e., part 25 TC holders, part 25

fuel tank system STC holders, and

certain part 25 non-fuel tank system

STC holders). There also are costs to

operators that derive from the

engineering time to conduct the design

review for any field approvals on their

airplanes and to develop any necessary

fuel tank system inspections and

maintenance recommendations for

operators and repair stations.

These reviews may also identify

conditions that will subsequently need

to be addressed by specific service

bulletins, or unsafe conditions that

would subsequently require the FAA to

issue AD’s. However, those future costs

are not the costs of compliance with this

SFAR; rather, they are costs to conform

to the service bulletin or to comply with

the AD, and would be estimated for

each individual service bulletin or AD

when it is issued or proposed.

The costs to comply with the

operational rule changes of this final

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23123

rule derive from the requirements that

operators incorporate these

recommendations into their

maintenance manuals and then inspect

and maintain the fuel tank systems

accordingly. As a result, additional

airplane mechanic labor time will be

needed during an airplane inspection to

perform an enhanced inspection of the

fuel tank system and components.

However, the costs to repair and replace

equipment and wiring that the

inspection identifies as needing repair

or replacement is not a cost of

compliance with the operational rules

changes. Although these costs can be

substantial, they are attributable to

existing FAA regulations that require

such repairs and replacements to be

made in order to assure the airplane’s

continued airworthiness.

Finally, the part 25 revisions of this

final rule may require some future TC

and STC’s to employ designs of fuel

tank systems and other aviation systems

that would not have been used were it

not for these revised certification

requirements.

Estimated Total Compliance Costs for

the Proposal

As seen in Table 1, the FAA had

estimated in the notice that the present

value in 1999 of the compliance costs

with the proposal during the time

period 2000–2011 would have been

about $170 million ($9.5 million for TC

holders, $4.9 million for STC holders,

and $153 million for operators). The

following sections briefly summarize

the discussions in the notice about these

various cost estimates.

TABLE 1.—PRESENT VALUE IN 1999

OF THE COSTS OF COMPLIANCE

WITH THE PROPOSED RULE

[As estimated in the preliminary regulatory

evaluation]

Source of cost

Present value

in 1999 of the

compliance

costs

(in 1998

$ millions)

Fuel Tank Review (Total) ..... 14.4

[For TC Holders: 9.5]

[For STC Holders: 4.9]

Maintenance and Inspection 100.0

Lost Net Revenue ................. 35.6

Additional Recordkeeping ..... 17.4

Total ............................... 167.4

Proposed Costs of Fuel Tank System

Design Review

By way of explanation, for the

purpose of this analysis, an airplane

‘‘model’’ is defined to refer to a type

certificate airplane (for example, a

Model 737); whereas, an airplane

‘‘series’’ is defined to refer to a version

(often under an Amended TC) of a

model (for example, a Model 737–300).

In the notice, the FAA had estimated

that 35 TC’s and 68 fuel tank system

STC’s would have needed a fuel tank

system design review. Depending upon

the airplane model, the FAA had

estimated that a fuel tank system design

review would have taken between 0.5 to

2.0 engineer years for a TC holder, and

an average of 0.25 engineer year for a

fuel tank system STC holder. The FAA

had also estimated that developing

manual revisions and service bulletins

would have taken between 0.25 to 1.0

engineer years for a TC holder, and an

average of 0.1 engineer year for a fuel

tank system STC holder.

Using a total engineer compensation

rate (salary and fringe benefits, plus a

mark-up for hours spent by

management, legal, etc. on the review)

of $100 an hour, the FAA had estimated

that the one-time fuel tank system

design review would have cost TC

holders $9.5 million, and it would have

cost STC holders $4.9 million.

Proposed Costs of Fuel Tank System

Inspections—Operational Rule Changes

The costs to operators of complying

with the proposed operational

requirements would have been the

additional airplane mechanic labor

hours and the lost net revenue from the

airplane’s additional time out-of-service

in order to complete the fuel tank

system inspections and maintenance.

The FAA had assumed that the design

approval holders’ recommendations

would have required fuel tank systems

to be inspected only during the

regularly scheduled major maintenance

checks. As a result, the FAA had

expected that no airplanes would have

been taken out of service solely to

inspect the fuel tank system unless the

fuel tank system review would have

identified an immediate safety concern.

In that case, the corrective action would

have been mandated by an AD.

On that basis, the FAA had

determined that operators would have

needed to take four actions to comply

with the proposal that would have

either required an expenditure of

resources or lost revenue:

• The first action involves the labor

time to incorporate the design approval

holders’ recommendations into the

maintenance manuals.

• The second action involves the

labor time to perform the enhanced fuel

tank system inspections, which includes

testing of fuel tank system equipment

and wiring.

• The third action involves the lost

net revenue from an airplane’s increased

out-of-service time due to the enhanced

fuel tank system inspection.

• The fourth action involves the labor

time to provide the increased

documentation, recording, and reporting

the results from the fuel tank system

inspections and tests.

The FAA had assumed that each

operator has one maintenance manual

for each airplane model in its fleet. The

FAA then determined that there were

290 individual airplane model/operator

combinations. The FAA estimated that

it would have taken 5 engineer days (at

a cost of $4,000 per manual) to

incorporate these recommendations into

the various maintenance manuals. On

that basis, the FAA had calculated that

this total cost would have been $1.16

million. As these expenses would have

occurred in the second year, the present

value of these costs was $1.084 million.

With respect to the costs of fuel tank

system inspections, the FAA had

estimated that it would have taken

between 60 and 330 additional labor

hours per airplane to complete the

initial fuel tank system inspection, and

it would have taken between 30 and 180

additional labor hours per airplane for

later fuel tank system reinspections. All

of the initial inspections would have

been completed during the first 3 years

after the maintenance manual changes

had been approved by the FAA (i.e.,

during the years 2002 through 2004).

Each airplane would have been

reinspected every 3 years after the

initial fuel tank system inspection.

Using a total compensation rate (wages

and fringe benefits, plus a mark-up for

time spent by supervisors, management,

etc. on the inspections) of $70 an hour

for airplane mechanics, the FAA had

estimated that the initial fuel tank

system inspection would have cost

between $4,200 and $23,100 per

airplane and fuel tank system

reinspections would have cost between

$2,100 and $12,600 per airplane. The

present value of the total fuel tank

system inspection costs, discounted at 7

percent over the period 2002 through

2011, would have been $99 million.

In the notice, the FAA had assumed

that the initial fuel tank system

inspection would have been performed

during a ‘‘C’’ or a ‘‘D’’ check. On that

basis, the FAA had estimated that the

additional out-of-service time would

have been between 36 hours and 96

hours per airplane for each airplane

inspected during a ‘‘C’’ check, and

would have been zero hours for each

airplane inspected during a ‘‘D’’ check.

Similarly, the FAA had estimated that

the additional out-of-service time would

23124 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

have been between 24 hours and 72

hours for each airplane fuel tank system

reinspection that would have occurred

during a ‘‘C’’ check, and would have

been zero hours if the reinspection

would have occurred during a ‘‘D’’

check.

The economic cost of out-of-service

time is the lost net revenue to the

aviation system. Most of the passengers

who would have flown on an airplane

that has been taken out of service will

take another flight. As a result, most of

the lost revenue for that out-of-service

airplane is actually captured by other

airplane flights. The cost of the rule is

the loss to the aviation system—not to

the individual airplane operator. On

that basis, the FAA computed the lost

revenue to the aviation system by using

the Office of Management and Budget

(OMB) determination that the average

annual risk-free productive rate of

return on capital is 7 percent of the

average value of the airplane model.

Thus, the FAA had calculated that the

out-of-service lost aviation net revenue

per fuel tank system inspection would

have ranged from $50 to $9,750 per

airplane per day. The present value of

this total lost aviation net revenue,

discounted at 7 percent over 10 years,

would have been $35.6 million.

The FAA had determined that the

increased annual documentation and

reporting time would have been 1 hour

of recordkeeping for every 8 hours of

labor time for the initial fuel tank

system inspection, and would have been

1 hour of recordkeeping for every 10

hours of labor time for the

reinspections. Thus, the per airplane

documentation cost would have been

between $450 and $2,550 for the initial

fuel tank system inspection and $300 to

$1,620 for a fuel tank system

reinspection. The present value of the

total recordkeeping cost discounted at 7

percent for 10 years would have been

$17.4 million.

Proposed Costs of Future Fuel Tank

System Design Changes—Revised Part

25

The FAA had determined that the part

25 changes would have a minimal effect

on the cost of future type certificated

airplanes because compliance with the

proposed changes would be done during

the design phase of the airplane model

before any new airplanes would be

manufactured. In addition, the FAA had

determined that the part 25 changes

would have a minimal impact on future

fuel tank system STC’s because current

industry design practices could be

adapted to allow compliance with the

requirement.

Differences in Assumptions and Values

Between the Notice and the Final Rule

The most significant difference

between the proposal and the final rule

is that the proposal allowed only 12

months for design approval holders to

complete their fuel tank system reviews

and recommendations. The proposal

also allowed operators only 6 months to

incorporate these recommendations into

their maintenance manuals. The final

rule allows design approval holders 18

months to be in compliance and also

allows operators 18 months after that to

incorporate the recommendations into

their maintenance manuals.

Table 2 lists the most significant

differences in the assumptions made,

data used, and the different

requirements between the proposal and

the final rule. Although there are other

differences that have altered the

calculated costs, the differences listed in

Table 2 are the significant ones.

TABLE 2.—SIGNIFICANT DIFFERENCES IN ASSUMPTIONS AND VALUES BETWEEN THE PRELIMINARY REGULATORY

EVALUATION AND THE FINAL REGULATORY EVALUATION

Assumption or value Preliminary regulatory analysis Final regulatory analysis

Number of Airplanes .......................................... 6,006 (in 1996) ................................................. 6,971 (in 1999).

Timeframe for Analysis ...................................... 2000–2011 ....................................................... 2001–2013

Net Rate of Fleet Growth ................................... 4.3 percent ....................................................... 3.0 percent.

Hourly Compensation per: Engineer; Mechanic $100; $70 ......................................................... $110; $75.

Number of Fuel Tank System TC Reviews ....... 35 ..................................................................... 98 (46 ‘‘full-scale’’ and 52 ‘‘derivative’’).

Number of Engineering Years for TC Review ... 0.5 to 2 ............................................................. 0.5 to 3.

Number of Fuel Tank System STC Reviews .... 68 ..................................................................... 74

Number of Engineering Years for Fuel Tank

System STC Review.

0.35 .................................................................. 0.15

Number of Non-Fuel tank system STC Reviews None (Asked for Comments) ........................... 325

Number of Engineering Years for Non-Fuel

tank system STC Review.

None (Asked for Comments) ........................... 0.0375

Operator Paper Review of Airplane Fuel Tank

System-Field Approvals/STC’s.

None ................................................................. 1 engineer day per existing airplane.

Number Months to Compete Safety Review

Fuel Tanks.

12 ..................................................................... 18

Number Months to Revise Maintenance Manual

(After Review).

6 ....................................................................... 18

Number Years to Complete Initial Inspection

(After Manual Revision).

3 years (Completed between 2002 and 2004) 2 years (Completed during 2004 and 2005).

Determinants of Number Inspection Hours ....... Airplane Model ................................................. Airplane Model plus Year Manufactured.

Time before Initial Inspections Begin ................ 18 months ........................................................ 36 months.

Number Years to Complete Initial Inspection .... 3 years ............................................................. 2 years.

Number Labor Hours for Initial Inspection ......... 50 to 198 .......................................................... 49 to 218.

Number Days Out-of-Service for Initial Inspection.0 to 4 (40 percent inspections done at ‘‘C’’

checks).

0 to 4 (60 percent of inspections done at ‘‘C’’

checks).

Year Reinspections Start ................................... 2004 (immediately after initial inspections) ...... 2008 (2 years after initial inspections).

Reinspection Frequency .................................... Every 3 years (Some done during ‘‘C’’

checks).

Every 5 years (All done during ‘‘D’’ checks).

Number Hours for Reinspection ........................ 40 to 160 .......................................................... 25 to 87.

Reduced Inspection Hours Due to AD’s Already

Issued.

All Model 747 hours not included; 50 hours for

Mode 737’s not included.

No adjustment.

Number Days Out-of-Service for Reinspection 0 to 3 (40 percent of reinspections done at

‘‘C’’ checks).

0 (All reinspections done at ‘‘D’’ checks).

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23125

Cost of Compliance With the Final Rule

As seen in Table 3, based on the

public comments and the changes in

assumptions and values listed in Table

2, the FAA has determined that the

present value of the costs of compliance

with the rule over the time period

2001—2013 are $165.1 million. This

figure includes:

• $27.1 million for TC holders,

• $2.8 million for fuel tank system

STC holders,

• $2.6 million for non-fuel tank

system STC holders, and

• $132.5 million for operators.

The following sections summarize the

results in the Final Regulatory

Evaluation.

TABLE 3.—PRESENT VALUE OF THE

COSTS OF COMPLIANCE WITH THE

FINAL RULE

Source of cost

Present value

in 2001 of the

compliance

costs

(in 2000

$ millions)

Part 25 Fuel Tank Design .... 0.315

(For TC Airplanes: Minimal).

(For Fuel Tank STC Holders: 0.315).

Fuel Tank Review (Total) ..... 38.157

(For TC Holders: 27.107).

(For Fuel Tank STC Holders: 2.522).

(For Non-Fuel-Tank STC

Holders: 2.594).

(For Operators: 5.934).

Maintenance and Inspection 92.043

Lost Net Revenue ................. 24.224

Additional Recordkeeping ..... 10.338

Total ............................... 165.077

Costs of Fuel Tank System Design

Review

In the Final Regulatory Evaluation,

the FAA has determined that existing

TC holders will need to complete 46

‘‘full-scale’’ fuel tank system reviews for

the individual airplane models, and 52

‘‘derivative’’ fuel tank system reviews

for the separate series in the models.

Using the Model 737–300/400/500

family of airplanes as an illustration, the

FAA determined that Boeing will need

to complete one ‘‘full-scale’’ review and

two ‘‘derivative’’ reviews for this family

of airplanes. In addition, each airplane

series that has an extended range

modification or a freighter modification

will require a ‘‘derivative’’ fuel tank

system review.

Depending upon the airplane model

and the date it was first manufactured,

the FAA determined the following

average numbers of engineer years for

the ‘‘full-scale’’ fuel tank system design

review:

• 3 years for large turbojets (1969–

1980),

• 2 years for large turbojets (1980–

1988),

• 1 year for large turbojets (post1988),

• 0.5 to 0.75 year for regional jets,

• 0.5 to 0.75 year for large turboprops,

and

• 0.5 year for small turbojets and

turboprops.

With respect to the ‘‘derivative’’ fuel

tank system design reviews, the FAA

determined that these will take between

0.5 year and one year for large turbojets,

and 0.5 year for regional turbojets and

for turboprops.

The FAA determined that the amount

of engineering time to develop the

recommendations for the maintenance

manuals will be 20 percent of the

amount of time to complete the fuel

tank system review.

Using a total engineer compensation

rate of $110 an hour, the FAA calculated

that the one-time fuel tank system

design review will cost between

$200,000 and $1.525 million per

airplane model, with most of the

individual costs in the range of

$500,000 to $800,000. These costs will

be about $125,000 to $150,000 for

turboprops.

As the TC holder will have 18 months

to comply with the final rule, the FAA

determined that one-half of the review

costs will occur in the first year (2002)

and one-half will occur in the second

year (2003), and all of the costs to

develop recommendations will occur in

the second year (2003). On that basis,

the present value of the total one-time

cost of compliance to TC holders will be

$27.1 million, of which $22.7 million

will be for the fuel tank system review

and $4.390 million will be to develop

recommendations for the maintenance

manuals.

For part 25 fuel tank system STC

holders, the FAA determined that there

are 74 fuel tank system STC’s that will

need to undergo a review. The FAA also

determined that it will take an average

of 0.15 engineering year to complete the

review because the STC holder had to

complete a substantial amount of

engineering work to obtain FAA

approval of the STC, and many of the

STC’s affect only a part of the fuel tank

system. On that basis, the FAA

determined that the average cost for a

fuel tank system STC review will be

$33,000.

As the fuel tank system STC holder

will have 18 months to comply with the

final rule, the FAA determined that onehalf of the review costs will occur in the

first year (2002) and one-half will occur

in the second year (2003), while all of

the time to develop recommendations

will occur in the second year (2003). On

that basis, the present value of the total

one-time cost of compliance will be $2.5

million.

Certain part 25 non-fuel tank system

STC holders will also need to complete

more than a cursory review of their

modifications for the potential impact

on the fuel tank system. The FAA

determined that there are 325 non-fuel

tank system STC’s that will need to

undergo a review. The FAA also

determined that this review will take

one quarter of the engineer time to

complete a fuel tank system STC review

(or 0.375 engineer year). On that basis,

the FAA determined that the average

cost for a non-fuel tank system STC

review will be $8,250.

As the non-fuel tank system STC

holder will have 18 months to comply

with the final rule, the FAA determined

that one-half of the review costs will

occur in the first year (2002) and onehalf will occur in the second year

(2003), while all of the time to develop

recommendations will occur in the

second year (2003). On that basis, the

present value of the total one-time cost

of compliance will be $2.6 million.

Finally, based on the comments, the

FAA determined that each operator will

perform a paper review of each airplane

to determine the modifications

(including field approvals) that have

been made on the airplane. Although

the vast majority of these airplanes have

been purchased by major, national, and

regional airlines that should possess

well-documented maintenance history

records, a significant minority of these

airplanes have had multiple owners or

lessors and the maintenance records

may not be quite as complete. Thus, the

FAA determined that, on average, this

paper review will take one day per

airplane. On that basis, the average cost

per airplane will be $880.

In order to meet the 36-month

compliance date, operators will need to

discover if their airplanes have any

‘‘orphan’’ STC’s or if there are any field

approvals that affect the fuel tank

system. Completing these paper reviews

will then give the operators 18 months,

after the TC and STC holders complete

their required reviews, to complete any

additional fuel tank system engineering

reviews and to make the resultant

changes to their maintenance manuals.

Therefore, the FAA determined that

one-half of the review costs will occur

in the first year (2002) and one-half will

occur in the second year (2003). On that

basis, the present value of the total oneVerDate 11<MAY>2000 15:26 May 04, 2001 Jkt 194001 PO 00000 Frm 00041 Fmt 4701 Sfmt 4700 E:\FR\FM\07MYR2.SGM pfrm01 PsN: 07MYR2
23126 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

time cost of compliance will be $5.9

million.

There is also the potential that this

‘‘paper review’’ will reveal a field

approval or an ‘‘orphan’’ STC that

affects the safety of the fuel tank system.

In that case, the operator would be

responsible for the engineering review

and for developing inspection and

maintenance procedures for the

maintenance manual. The FAA did not

receive any data on this factor, but

maintains that it is likely to infrequently

occur and, further, the amount of

engineering needed would be relatively

minor.

Costs of Fuel Tank System

Inspections—Operational Rule Changes

As was true for the analysis in the

notice, the costs to operators of

complying with the final rule’s

operational requirements do not include

the costs of corrective actions

undertaken to repair deficiencies in the

fuel tank system that were found

because of a fuel tank system

inspection, because the airplanes are

required to be maintained as airworthy.

On that basis, the FAA determined

that operators will take four actions that

will generate costs or lost revenue to

comply with the final rule.

• The first action involves the labor

time to incorporate the design approval

holders’ recommendations into the

maintenance manuals.

• The second action involves the

labor time to perform the enhanced fuel

tank system inspections, which includes

testing of fuel tank system equipment

and wiring.

• The third action involves the lost

net revenue from an airplane’s increased

out-of-service time due to the enhanced

fuel tank system inspection.

• The fourth action involves the labor

time to provide the increased

documentation, recording, and reporting

the results from the fuel tank system

inspections and tests.

In calculating the compliance costs

for maintenance manual revisions due

to TC holder recommendations, the

FAA revised its assumption made in the

notice that each operator has one

maintenance manual for each model in

its fleet. However, the FAA determined

that its assumption of 5 days of engineer

time to modify a maintenance manual is

valid. Since the issuance of the notice,

the FAA has been informed that nearly

all airlines with fewer than 20 airplanes

contract their major maintenance checks

to third party (or other operators’) repair

stations. The FAA determined that 49

airlines (each with 20 or more airplanes)

perform their own maintenance. For

those 49 airlines, there are 165 airplane

model/operator combinations, which

produces a cost of $726,400. As these

manual changes will not be made until

the year 2003, the present value of these

compliance costs is $635,000.

The FAA also determined that 15

repair stations will perform these fuel

tank system inspections for the smaller

operators and, on average, each repair

station will perform these inspections

for 10 different airplane models. The

compliance costs for these repair

stations will be $660,000, which will be

passed on to the operators. However, as

these manual changes will not be made

until the year 2003, the present value of

these compliance costs is $576,475.

The FAA determined that it will take,

on average, one engineer day (or $880)

for each maintenance manual to

incorporate the recommendations from

a fuel tank system STC holder. The FAA

also determined that each of the 79 fuel

tank system STC’s will produce

inspection and maintenance

recommendations that will affect, on

average, two maintenance manuals. On

that basis, the compliance costs will be

$139,000. However, as these manual

changes will not be made until the year

2003, the present value of these

compliance costs is $121,450.

The FAA anticipates that

implementation of the final rule will

result in the initial fuel tank system

inspection to be performed at the first

major maintenance check after the

maintenance manual modifications have

been approved by the FAA. As the FAA

defines a ‘‘C’’ check (or its equivalents)

as a major maintenance check, the FAA

determined that all of the affected

airplanes will receive an initial fuel tank

system inspection by 2 years after the

maintenance manuals have been

modified. Thus, the FAA determined

that all of the initial fuel tank system

inspections will be performed in either

2004 or 2005.

The FAA made four adjustments to

the number of airplane mechanic hours

for an initial fuel tank system inspection

as estimated in the notice:

The first adjustment is that the FAA

added 20 labor hours across the board

in order to account for any

unanticipated inspection

recommendations from the product

approval holders.

The second adjustment is that the

FAA varied the number of labor hours

not only by certification date but also by

manufactured date of the airplane.

Older airplanes of an airplane model

will require, on average, more labor

hours to complete an initial fuel tank

system inspection than will newer

airplanes. As a result, the FAA

separated airplanes into 3 categories

based on the date the airplane was

manufactured.

• For the 1960–1980 group, the

number of labor hours estimated in the

notice plus 20 hours was used.

• Airplanes manufactured between

1981 and 1995 require 20 percent fewer

labor hours than those for the 1960–

1980 group.

• Airplanes manufactured between

1995 and 2003 will require 30 percent

fewer labor hours than those for the

1960–1980 group.

The third adjustment is that the

number of labor hours to reinspect fuel

tank systems will be one-half of the

number of labor hours needed for the

initial fuel tank system inspection,

based on the last year that the airplane

model was manufactured.

The fourth adjustment is that the

number of labor hours for the first

inspection of a future manufactured

airplane’s fuel tank system will be the

same as for later reinspections, and is

the same number as that to reinspect the

newest airplane category.

Using those adjustments and the

changes listed in Table 2, the FAA

determined that it will take between 49

and 218 labor hours to complete an

initial fuel tank system inspection, and

it will take between 25 and 108 labor

hours to complete a fuel tank system

reinspection. Using a total

compensation rate (wages plus fringe

benefits) of $75 an hour for airplane

mechanics, the FAA estimated that the

initial fuel tank system inspection will

cost between $3,625 and $16,350 per

airplane, and fuel tank system

reinspections will cost between $1,875

and $8,100 per airplane. The present

value of the total labor cost discounted

at 7 percent for the period 2004 through

2013 is $92.043 million.

As stated earlier, the FAA had

determined that the initial fuel tank

system inspection will be performed

during a ‘‘C’’ or a ‘‘D’’ check. The

duration and process of major

inspections varies by airline and

airplane type. Some airlines choose to

conduct these checks during one time

block of typically 7 to 10 days for a ‘‘C’’

check and 20 to 25 days for a ‘‘D’’ check.

Other airlines conduct segmented

checks where the airplane is taken out

of service for several shorter time

intervals that allow the overall task to be

completed. The FAA has determined

that an airplane undergoing a segmented

‘‘C’’ check is, on average, out-of-service

for two days, whereas a segmented ‘‘D’’

check takes an airplane out of service

for 14 to 21 days. The FAA determined

that two mechanics can simultaneously

work on a fuel tank system inspection.

On that basis, the FAA determined that

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23127

no additional out-of-service days will

occur for 1 to 48 additional labor hours.

Each additional 48 labor hours after the

first 48 labor hours will add one day to

the out-of-service time. On that basis,

the initial fuel tank system inspection

will produce between 0 and 4 additional

out-of-service days.

The economic cost of out-of-service

time is the lost services from a capital

asset, which is computed by

multiplying the airplane value by the

number of days out of service and by 7

percent (the OMB risk-free rate of

return). The average residual value of

the turbojet models is based on the

AVITAS 2nd Half 1999 Jet Aircraft

Values, and the average value of the

turboprop models is based on the

AVITAS 2nd Half 1997 Turboprop

Aircraft Values. Thus, the FAA

calculated that the out-of-service lost

capital services from the initial fuel tank

system inspection will be between $200

and $86,000 per airplane per day.

As noted earlier, the FAA determined

that one-half of the airplanes will

undergo an initial fuel tank system

inspection in 2004 and one-half will

undergo an initial fuel tank system

inspection in 2005. However, 20 percent

of these airplanes each year will receive

this inspection during a ‘‘D’’ check, in

which there are no additional out-ofservice days due to the fuel tank system

inspection. As a result, the FAA

calculated that the present value of the

total lost net revenue from the

additional out-of-service days is $24.224

million.

For the final rule, the FAA

determined that its original estimate

that every 8 hours of airplane mechanic

labor for the initial fuel tank system

inspection will produce one hour of

documentation and recordkeeping labor

hours is valid. However, the FAA

determined that it had overestimated

the amount of recordkeeping for

reinspections, and used the ratio of 12

hours of reinspection airplane mechanic

labor time for 1 hour of documentation

and recordkeeping. On that basis, the

present value of the recordkeeping cost

is $10.338 million.

Costs of Future Fuel Tank System

Design Changes—Revised Part 25

The FAA had determined that the part

25 change will have a minimal effect on

the cost of future type certificated

airplanes because compliance with the

proposed change would be done during

the design phase of the airplane model

before any new airplanes would be

manufactured. In addition, the FAA

determined that the part 25 changes will

have a minimal impact on future fuel

tank system STC’s because current

industry design practices could be

adapted to allow compliance with the

requirement.

Benefit-Cost Comparison

As noted, the FAA has not quantified

the potential benefits from this final rule

because there is uncertainty about the

actual ignition sources in the two fuel

tanks. However, using a

‘‘representative’’ commercial airplane,

the FAA calculated that the losses from

a mid-air explosion would be $401.6

million. In addition, the FAA

determined that the present value of the

compliance costs is $165.1 million.

If the final rule would prevent one

such accident by the year 2014, the

present value of the prevented losses

would be greater than the present value

of the compliance costs.

Therefore, based on these factors and

analysis, the FAA considers the final

rule to be cost-beneficial.

Regulatory Flexibility Act

The Regulatory Flexibility Act of 1980

(RFA) establishes ‘‘as a principle of

regulatory issuance that agencies shall

endeavor, consistent with the objective

of the rule and of applicable statutes, to

fit regulatory and informational

requirements to the scale of the

business, organizations, and

governmental jurisdictions subject to

regulation.’’ To achieve that principle,

the RFA requires agencies to solicit and

consider flexible regulatory proposals

and to explain the rationale for their

actions. The RFA covers a wide range of

small entities, including small

businesses, not-for-profit organizations,

and small governmental jurisdictions.

Agencies must perform a review to

determine whether a proposed or final

rule will have a significant economic

impact on a substantial number of small

entities. If the determination finds that

it will, the agency must prepare a

Regulatory Flexibility Analysis as

described in the RFA.

However, if an agency determines that

a proposed or final rule is not expected

to have a significant economic impact

on a substantial number of small

entities, section 605(b) of the 1980 act

provides that the head of the agency

may so certify, and a Regulatory

Flexibility Analysis is not required. The

certification must include a statement

providing the factual basis for this

determination, and the reasoning should

be clear.

For the proposed rule, the FAA had

conducted an Initial Regulatory

Flexibility Analysis, which established

that it would have a significant impact

on a substantial number of small

entities. As a result, the FAA had

specifically requested public comment

on the potential impact of the proposed

rule on small entities.

Need for and Objectives of the Rule

The final rule is being issued in order

to reduce the risk of a mid-air airplane

fuel tank explosion with the resultant

loss of life (as evidenced by TWA Flight

800). Existing fuel tank system

inspections have not provided

comprehensive, systematic prevention

and control of ignition sources in

airplane fuel tanks, thereby allowing a

small, but unacceptable risk of a fuel

tank explosion.

The objective of the final rule is to

ensure the continuing airworthiness of

airplanes certificated for 30 or more

passengers or with a payload of more

than 7,500 pounds. Design approval

holders (including TC holders, fuel tank

system STC holders, and holders of

certain non-fuel tank system STC’s) will

be required to complete a fuel tank

system design review and to provide

recommendations and instructions to

operators and repair stations concerning

fuel tank system inspections and

equipment and wiring testing. This

review may result in the development of

service bulletins and AD’s. All operators

covered by Title 14, Code of Federal

Regulations (CFR) parts 91, 121, and

125, and all U.S.-registered airplanes

used in scheduled operations under part

129, will be required to incorporate

these recommendations into their

maintenance manuals and to perform

the inspections and tests as required. In

addition, repair stations that are

contracted to perform maintenance are

also required to comply with these

requirements.

Summary of Comments Made in

Response to the Initial Regulatory

Flexibility Analysis

There were two commenters that

indirectly discussed issues of concern in

the Initial Regulatory Flexibility

Analysis:

The General Aviation Manufacturing

Association (GAMA) supported the

FAA’s decision to exclude airplanes

certificated for 30 passengers or fewer

from the final rule. Although they did

not address the small business aspect of

this decision, nearly every operator of

these excluded airplanes is a small

entity. However, GAMA opposed the

proposed part 25 future design

requirements as not appropriate for

business jets and stated that these

airplanes should be excluded from the

part 25 requirements. The FAA

disagreed with this comment because a

future business jet that has a 7,500

pound payload is a large airplane and

23128 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

its fuel tank system faces the same

potential for explosion as other large

transport category airplanes.

The Regional Airline Association

(RAA) supported the FAA’s decision to

exclude airplanes certificated for 30

passengers or fewer from the final rule.

They, too, did not directly address the

small business aspect of this decision.

However, they opposed the FAA’s

decision to include airplanes

certificated for fewer than 60 passengers

or for less than a 15,000 pound payload.

Their primary argument in favor of this

exclusion is that these airplanes do not

have a history of these types of

accidents. The FAA disagreed with this

comment because, by itself, the accident

histories of specific types and classes of

airplanes are insufficient to demonstrate

that their fuel tank systems attain the

required level of safety. An important

consideration in these accident histories

is that these airplanes have not

accumulated the number of flight hours

as those of the larger transport category

airplanes. As fuel tank explosions are

rare events, there is the possibility that

such an accident has not occurred in

these airplanes because not enough

hours have been flown. In addition, it

may be that the fuel tank system design

review will reveal that these systems do

not have the same risk as the risk

associated with larger transport category

airplanes. In that case, the impact of the

rule on operators of these airplanes will

be much less than estimated by the

FAA. However, until the fuel tank

system design review is completed, the

FAA does not know what the potential

is for these airplanes to have a mid-air

explosion and, as the FAA cannot rule

out the possibility, the FAA cannot

exclude these airplanes from coverage

under the final rule.

Description and Estimate of the Number

of Small Entities Affected by the Final

Rule

The FAA determined that there are a

total of 143 U.S. airlines, 76 private

operators (primarily corporations with

corporate jets), and 112 manufacturers,

airplane brokers, and airplane leasing

companies affected by the final rule. Of

the 143 U.S. airlines, 107 are small

airlines. Nearly all of the 76 private

operators are large corporations that can

afford to operate and maintain a

corporate jet airplane. Most of the

airplane brokers and airplane leasing

companies are privately held

corporations or partnerships, and the

FAA was unable to establish whether or

not most of them are small entities.

Reporting and Recordkeeping

Requirements

The final rule requires that operators

maintain a record of the results of the

fuel tank system inspections and

maintenance done on the airplane. For

the small operators that contract their

maintenance to third party repair

stations (nearly all of the small airlines

and other operators), they will be

required to keep a copy of the report

that the repair station will give them.

Small entities will not need to acquire

additional professional skills to prepare

these reports.

Description of the Alternatives

Evaluated

In the Initial Regulatory Flexibility

Analysis, the FAA had evaluated three

alternatives to the proposed rule:

• The first alternative was to require

all airplanes with 10 or more seats be

covered by the proposed rule.

• The second alternative was to

require all airplanes with 30 or more

seats and all airplanes with 10 or more

seats in commercial service be covered

by the proposal.

• The third alternative was to require

only turbojet airplanes in commercial

service be covered by the proposal.

There were no comments from the

public in support of these alternatives.

A complete discussion of these

alternatives is available in the public

docket for this rulemaking.

Differences Between the Proposed Rule

and the Final Rule Requirements

The primary change from the

proposed rule is that the final rule

allows operators 36 months to comply

whereas the proposed rule had required

compliance within 18 months. In

addition, the FAA determined that

fewer fuel tank reinspections will be

needed than the FAA had estimated in

the Preliminary Regulatory Evaluation.

As a result, the present value of the

costs to operators will be approximately

20 percent less per airplane under the

final rule than they would have been

under the proposed rule.

Conclusion

Both the proposed and final rule will

have a significant impact on a

substantial number of small entities.

Consistent with SBA guidance, the FAA

conducted an initial regulatory

flexibility analysis (IRFA) and a final

regulatory flexibility analysis (FRFA).

The initial regulatory flexibility analysis

provided a detailed analysis of the

impact on small entities. The FRFA

directly addresses five requirements.

While no comments specifically

addressed the IRFA, the FAA addresses

comments related to small entities.

As published in the notice, the FAA

did not require fuel tank inspections for

aircraft with a payload under 7,500

pounds. The primary difference

between the proposed rule and the final

rule is that the FAA extended operator

compliance time from 18 to 36 months.

In addition, the FAA determined that

fewer fuel tank reinspections will be

needed than originally estimated in the

NPRM.

As a result of these changes, about

140 airplanes that would have been

required to undergo a fuel tank

inspection under the proposed rule will

not be required to undergo a fuel tank

inspection under the final rule because

they will have been retired during the

additional 18 months allowed for

compliance. In addition, all of the

inspections and reinspections would

have had to be completed 18 months

earlier under the proposed rule than

under the final rule, resulting in a

higher present value of the compliance

costs. Consequently, recalculating (due

to the greater number of airplanes and

other values) the present value of the

costs to operators to comply with the

proposed rule would result in a cost of

$172.2 million, which is approximately

36 percent more than the $126.6 million

costs to operators to comply with the

final rule.

Trade Impact Assessment

The Trade Agreement Act of 1979

prohibits Federal agencies from

engaging in any standards or related

activities that create unnecessary

obstacles to the foreign commerce of the

United States. Legitimate domestic

objectives, such as safety, are not

considered unnecessary obstacles. The

statute also requires consideration of

international standards and, where

appropriate, that they be the basis for

U.S. standards. In addition, consistent

with the Administration’s belief in the

general superiority and desirability of

free trade, it is the policy of the

Administration to remove or diminish

to the extent feasible, barriers to

international trade, including both

barriers affecting the export of American

goods and services to foreign countries,

and barriers affecting the import of

foreign goods and services into the

United States.

In accordance with the above statute

and policy, the FAA assessed the

potential effect of this final rule and

determined that it will have only a

domestic impact and, therefore, a

minimal effect on any trade-sensitive

activity.

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23129

Unfunded Mandates Assessment

The Unfunded Mandates Reform Act

of 1995 (the Act), enacted as Pub. L.

104–4 on March 22, 1995, is intended,

among other things, to curb the practice

of imposing unfunded Federal mandates

on State, local, and tribal governments.

Title II of the Act requires each

Federal agency to prepare a written

statement assessing the effects of any

Federal mandate in a proposed or final

agency rule that may result in a $100

million or more expenditure (adjusted

annually for inflation) in any one year

by State, local, and tribal governments,

in the aggregate, or by the private sector;

such a mandate is deemed to be a

‘‘significant regulatory action.’’

As seen in Table IV–13 in the Final

Regulatory Evaluation (contained in the

docket to this rule), this final rule does

not contain such a mandate. Therefore,

the requirements of Title II of the

Unfunded Mandates Reform Act of 1995

do not apply.

Executive Order 3132, Federalism

The FAA has analyzed this final rule

under the principles and criteria of

Executive Order 13132, Federalism. We

determined that this action will not

have a substantial direct effect on the

States, or the relationship between the

national Government and the States, or

on the distribution of power and

responsibilities among the various

levels of government. Therefore, we

determined that this final rule does not

have federalism implications.

Environmental Analysis

FAA Order 1050.1D defines FAA

actions that may be categorically

excluded from preparation of a National

Environmental Policy Act (NEPA)

environmental impact statement. In

accordance with FAA Order 1050.1D,

appendix 4, paragraph 4(j), this

rulemaking action qualifies for a

categorical exclusion.

Energy Impact

The energy impact of this final rule

has been assessed in accordance with

the Energy Policy and Conservation Act

(EPCA) Public Law 94–163, as amended

(42 U.S.C. 6362) and FAA Order 1053.1.

It has been determined that the final

rule is not a major regulatory action

under the provisions of the EPCA.

Regulations Affecting Intrastate

Aviation in Alaska

Section 1205 of the FAA

Reauthorization Act of 1996 (110 Stat.

3213) requires the Administrator, when

modifying regulations in Title 14 of the

CFR in a manner affecting intrastate

aviation in Alaska, to consider the

extent to which Alaska is not served by

transportation modes other than

aviation, and to establish such

regulatory distinctions as she considers

appropriate. The FAA, therefore,

specifically requested comments on

whether there is justification for

applying the proposed rule differently

to intrastate operations in Alaska.

Although one commenter expressed a

concern related to a particular Alaskan

intrastate operation involving Lockheed

Model L–188 Electra airplanes, no

comments were received concerning

such justification in general. Since no

comments in that regard were received,

and since the FAA is not aware of any

justification for such regulatory

distinction, the final rule is not applied

differently to intrastate operations in

Alaska.

List of Subjects

14 CFR Parts 21, 25, 91, and 125

Aircraft, Aviation safety, Reporting

and recordkeeping requirements.

14 CFR Part 121

Air carriers, Aircraft, Aviation safety,

Reporting and recordkeeping

requirements, Safety, Transportation.

14 CFR Part 129

Air carriers, Aircraft, Aviation safety,

Reporting and recordkeeping

requirements.

The Amendment

In consideration of the foregoing, the

Federal Aviation Administration

amends parts 21, 25, 91, 121, 125, and

129 of Title 14, Code of Federal

Regulations, as follows:

PART 21—CERTIFICATION

PROCEDURES FOR PRODUCTS AND

PARTS

1. The authority citation for Part 21

continues to read as follows:

Authority: 42 U.S.C. 7572; 40105; 40113;

44701–44702, 44707, 44709, 44711, 44713,

44715, 45303.

2. In part 21, add SFAR No. 88 in

numerical order at the beginning of the

part to read as follows:

* * * * *

SFAR No. 88—Fuel Tank System Fault

Tolerance Evaluation Requirements

1. Applicability. This SFAR applies to the

holders of type certificates, and supplemental

type certificates that may affect the airplane

fuel tank system, for turbine-powered

transport category airplanes, provided the

type certificate was issued after January 1,

1958, and the airplane has either a maximum

type certificated passenger capacity of 30 or

more, or a maximum type certificated

payload capacity of 7,500 pounds or more.

This SFAR also applies to applicants for type

certificates, amendments to a type certificate,

and supplemental type certificates affecting

the fuel tank systems for those airplanes

identified above, if the application was filed

before June 6, 2001, the effective date of this

SFAR, and the certificate was not issued

before June 6, 2001.

2. Compliance: No later than December 6,

2002, or within 18 months after the issuance

of a certificate for which application was

filed before June 6, 2001, whichever is later,

each type certificate holder, or supplemental

type certificate holder of a modification

affecting the airplane fuel tank system, must

accomplish the following:

(a) Conduct a safety review of the airplane

fuel tank system to determine that the design

meets the requirements of §§ 25.901 and

25.981(a) and (b) of this chapter. If the

current design does not meet these

requirements, develop all design changes to

the fuel tank system that are necessary to

meet these requirements. The FAA (Aircraft

Certification Office (ACO), or office of the

Transport Airplane Directorate, having

cognizance over the type certificate for the

affected airplane) may grant an extension of

the 18-month compliance time for

development of design changes if:

(1) The safety review is completed within

the compliance time;

(2) Necessary design changes are identified

within the compliance time; and

(3) Additional time can be justified, based

on the holder’s demonstrated aggressiveness

in performing the safety review, the

complexity of the necessary design changes,

the availability of interim actions to provide

an acceptable level of safety, and the

resulting level of safety.

(b) Develop all maintenance and inspection

instructions necessary to maintain the design

features required to preclude the existence or

development of an ignition source within the

fuel tank system of the airplane.

(c) Submit a report for approval to the FAA

Aircraft Certification Office (ACO), or office

of the Transport Airplane Directorate, having

cognizance over the type certificate for the

affected airplane, that:

(1) Provides substantiation that the

airplane fuel tank system design, including

all necessary design changes, meets the

requirements of §§ 25.901 and 25.981(a) and

(b) of this chapter; and

(2) Contains all maintenance and

inspection instructions necessary to maintain

the design features required to preclude the

existence or development of an ignition

source within the fuel tank system

throughout the operational life of the

airplane.

PART 25—AIRWORTHINESS

STANDARDS: TRANSPORT

CATEGORY AIRPLANES

3. The authority citation for part 25

continues to read:

Authority: 49 U.S.C. 106(g), 40113, 44701–

44702, and 44704.

4. Section 25.981 is revised to read as

follows:

23130 Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations

§ 25.981 Fuel tank ignition prevention.

(a) No ignition source may be present

at each point in the fuel tank or fuel

tank system where catastrophic failure

could occur due to ignition of fuel or

vapors. This must be shown by:

(1) Determining the highest

temperature allowing a safe margin

below the lowest expected autoignition

temperature of the fuel in the fuel tanks.

(2) Demonstrating that no temperature

at each place inside each fuel tank

where fuel ignition is possible will

exceed the temperature determined

under paragraph (a)(1) of this section.

This must be verified under all probable

operating, failure, and malfunction

conditions of each component whose

operation, failure, or malfunction could

increase the temperature inside the

tank.

(3) Demonstrating that an ignition

source could not result from each single

failure, from each single failure in

combination with each latent failure

condition not shown to be extremely

remote, and from all combinations of

failures not shown to be extremely

improbable. The effects of

manufacturing variability, aging, wear,

corrosion, and likely damage must be

considered.

(b) Based on the evaluations required

by this section, critical design

configuration control limitations,

inspections, or other procedures must

be established, as necessary, to prevent

development of ignition sources within

the fuel tank system and must be

included in the Airworthiness

Limitations section of the Instructions

for Continued Airworthiness required

by § 25.1529. Visible means to identify

critical features of the design must be

placed in areas of the airplane where

maintenance actions, repairs, or

alterations may be apt to violate the

critical design configuration limitations

(e.g., color-coding of wire to identify

separation limitation).

(c) The fuel tank installation must

include either—

(1) Means to minimize the

development of flammable vapors in the

fuel tanks (in the context of this rule,

‘‘minimize’’ means to incorporate

practicable design methods to reduce

the likelihood of flammable vapors); or

(2) Means to mitigate the effects of an

ignition of fuel vapors within fuel tanks

such that no damage caused by an

ignition will prevent continued safe

flight and landing.

5. Paragraph H25.4 of Appendix H to

part 25 is revised to read as follows:

Appendix H to Part 25—Instructions for

Continued Airworthiness

* * * * *

H25.4 Airworthiness Limitations section.

(a) The Instructions for Continued

Airworthiness must contain a section titled

Airworthiness Limitations that is segregated

and clearly distinguishable from the rest of

the document. This section must set forth—

(1) Each mandatory replacement time,

structural inspection interval, and related

structural inspection procedures approved

under § 25.571; and

(2) Each mandatory replacement time,

inspection interval, related inspection

procedure, and all critical design

configuration control limitations approved

under § 25.981 for the fuel tank system.

(b) If the Instructions for Continued

Airworthiness consist of multiple

documents, the section required by this

paragraph must be included in the principal

manual. This section must contain a legible

statement in a prominent location that reads:

‘‘The Airworthiness Limitations section is

FAA-approved and specifies maintenance

required under § § 43.16 and 91.403 of the

Federal Aviation Regulations, unless an

alternative program has been FAA

approved.’’

PART 91—GENERAL OPERATING AND

FLIGHT RULES

6. The authority citation for part 91

continues to read:

Authority: 49 U.S.C. 1301(7), 1303, 1344,

1348, 1352 through 1355, 1401, 1421 through

1431, 1471, 1472, 1502, 1510, 1522, and 2121

through 2125; Articles 12, 29, 31, and 32(a)

of the Convention on International Civil

Aviation (61 Stat 1180); 42 U.S.C. 4321 et

seq.; E.O. 11514; 49 U.S.C. 106(g) (Revised

Pub. L. 97–449, January 21, 1983).

7. Amend § 91.410 by revising the

section heading; redesignating the

introductory text, paragraphs (a)

introductory text, (a)(1), (a)(2) and (a)(3),

and paragraphs (b) through (l) as

paragraph (a) introductory text,

paragraphs (a)(l) introductory text,

(a)(1)(i), (a)(1)(ii), and (a)(1)(iii), and

paragraphs (a)(2) through (a)(12); and

adding a new paragraph (b) to read as

follows:

§ 91.410 Special maintenance program

requirements.

* * * * *

(b) After June 7, 2004, no person may

operate a turbine-powered transport

category airplane with a type certificate

issued after January 1, 1958, and either

a maximum type certificated passenger

capacity of 30 or more, or a maximum

type certificated payload capacity of

7,500 pounds or more, unless

instructions for maintenance and

inspection of the fuel tank system are

incorporated into its inspection

program. These instructions must

address the actual configuration of the

fuel tank systems of each affected

airplane, and must be approved by the

FAA Aircraft Certification Office (ACO),

or office of the Transport Airplane

Directorate, having cognizance over the

type certificate for the affected airplane.

Operators must submit their request

through the cognizant Flight Standards

District Office, who may add comments

and then send it to the manager of the

appropriate office. Thereafter, the

approved instructions can be revised

only with the approval of the FAA

Aircraft Certification Office (ACO), or

office of the Transport Airplane

Directorate, having cognizance over the

type certificate for the affected airplane.

Operators must submit their request for

revisions through the cognizant Flight

Standards District Office, who may add

comments and then send it to the

manager of the appropriate office.

PART 121—OPERATING

REQUIREMENTS: DOMESTIC, FLAG,

AND SUPPLEMENTAL OPERATIONS

8. The authority citation for part 121

continues to read:

Authority: 49 U.S.C. 106(g), 40113, 40119,

44101, 44701–44702, 44705, 44709–44711,

44713, 44716–44717, 44722, 44901, 44903–

44904, 44912, 46105.

9. Amend § 121.370 by revising the

section heading; redesignating the

introductory text, paragraphs (a)

introductory text, (a)(1), (a)(2) and (a)(3),

and paragraphs (b) through (l) as

paragraph (a) introductory text,

paragraphs (a)(l) introductory text,

(a)(1)(i), (a)(1)(ii), and (a) (1)(iii), and

paragraphs (a)(2) through (a)(12); and

adding a new paragraph (b) to read as

follows:

§ 121.370 Special maintenance program

requirements.

* * * * *

(b) After June 7, 2004, no certificate

holder may operate a turbine-powered

transport category airplane with a type

certificate issued after January 1, 1958,

and either a maximum type certificated

passenger capacity of 30 or more, or a

maximum type certificated payload

capacity of 7,500 pounds or more,

unless instructions for maintenance and

inspection of the fuel tank system are

incorporated in its maintenance

program. These instructions must

address the actual configuration of the

fuel tank systems of each affected

airplane and must be approved by the

FAA Aircraft Certification Office (ACO),

or office of the Transport Airplane

Directorate, having cognizance over the

type certificate for the affected airplane.

Operators must submit their request

through an appropriate FAA Principal

Maintenance Inspector, who may add

comments and then send it to the

manager of the appropriate office.

Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and Regulations 23131

Thereafter, the approved instructions

can be revised only with the approval of

the FAA Aircraft Certification Office

(ACO), or office of the Transport

Airplane Directorate, having cognizance

over the type certificate for the affected

airplane. Operators must submit their

requests for revisions through an

appropriate FAA Principal Maintenance

Inspector, who may add comments and

then send it to the manager of the

appropriate office.

PART 125—CERTIFICATION AND

OPERATIONS: AIRPLANES HAVING A

SEATING CAPACITY OF 20 OR MORE

PASSENGERS OR A MAXIMUM

PAYLOAD CAPACITY OF 6,000

POUNDS OR MORE; AND RULES

GOVERNING PERSONS ON BOARD

SUCH AIRCRAFT

10. The authority citation for part 125

continues to read:

Authority: 49 U.S.C. 106(g), 40113, 44701–

44702, 44705, 44710–44711, 44713, 44716–

44717, 44722.

11. Amend § 125.248 by revising the

section heading; redesignating the

introductory text, paragraphs (a)

introductory text, (a)(1), (a)(2) and (a)(3),

and paragraphs (b) through (l) as

paragraph (a) introductory text,

paragraphs (a)(l) introductory text,

(a)(1)(i), (a)(1)(ii), and (a) (1)(iii), and

paragraphs (a)(2) through (a)(12); and

adding a new paragraph (b) to read as

follows:

§ 125.248 Special maintenance program

requirements.

* * * * *

(b) After June 7, 2004, no certificate

holder may operate a turbine-powered

transport category airplane with a type

certificate issued after January 1, 1958,

and either a maximum type certificated

passenger capacity of 30 or more, or a

maximum type certificated payload

capacity of 7,500 pounds or more unless

instructions for maintenance and

inspection of the fuel tank system are

incorporated in its inspection program.

These instructions must address the

actual configuration of the fuel tank

systems of each affected airplane and

must be approved by the FAA Aircraft

Certification Office (ACO), or office of

the Transport Airplane Directorate,

having cognizance over the type

certificate for the affected airplane.

Operators must submit their request

through an appropriate FAA Principal

Maintenance Inspector, who may add

comments and then send it to the

manager of the appropriate office.

Thereafter, the approved instructions

can be revised only with the approval of

the FAA Aircraft Certification Office

(ACO), or office of the Transport

Airplane Directorate, having cognizance

over the type certificate for the affected

airplane. Operators must submit their

requests for revisions through an

appropriate FAA Principal Maintenance

Inspector, who may add comments and

then send it to the manager of the

appropriate office.

PART 129—OPERATIONS: FOREIGN

AIR CARRIERS AND FOREIGN

OPERATORS OF U.S.-REGISTERED

AIRCRAFT ENGAGED IN COMMON

CARRIAGE

12. The authority citation for part 129

continues to read:

Authority: 49 U.S.C. 106(g), 40104–40105,

40113, 40119, 44701–44702, 44712, 44716–

44717, 44722, 44901–44904, 44906.

13. Amend § 129.32 by revising the

section heading; redesignating the

introductory text, paragraphs (a)

introductory text, (a)(1), (a)(2) and (a)(3),

and paragraphs (b) through (l) as

paragraph (a) introductory text,

paragraphs (a)(l) introductory text,

(a)(1)(i), (a)(1)(ii), and (a) (1)(iii), and

paragraphs (a)(2) through (a)(12); and

adding a new paragraph (b) to read as

follows:

§ 129.32 Special maintenance program

requirements.

* * * * *

(b) For turbine-powered transport

category airplanes with a type certificate

issued after January 1, 1958, and either

a maximum type certificated passenger

capacity of 30 or more, or a maximum

type certificated payload capacity of

7,500 pounds or more, no later than

June 7, 2004, the program required by

paragraph (a) of this section must

include instructions for maintenance

and inspection of the fuel tank systems.

These instructions must address the

actual configuration of the fuel tank

systems of each affected airplane and

must be approved by the FAA Aircraft

Certification Office (ACO), or office of

the Transport Airplane Directorate,

having cognizance over the type

certificate for the affected airplane.

Operators must submit their request

through an appropriate FAA Principal

Maintenance Inspector, who may add

comments and then send it to the

manager of the appropriate office.

Thereafter the approved instructions

can be revised only with the approval of

the FAA Aircraft Certification Office

(ACO), or office of the Transport

Airplane Directorate, having cognizance

over the type certificate for the affected

airplane. Operators must submit their

requests for revisions through an

appropriate FAA Principal Maintenance

Inspector, who may add comments and

then send it to the manager of the

appropriate office.

Issued in Washington, DC, on April 19,

2001.

Jane F. Garvey,

Administrator.

[FR Doc. 01–10129 Filed 5–4–01; 8:45 am]

BILLING CODE 4910–13–P