Federal Aviation Administration (FAA), DOT.
Final special conditions.
These special conditions are issued for the Boeing Model 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes. These airplanes, as modified by Boeing Commercial Airplanes, include a new flammability reduction means that uses a nitrogen generation system to reduce the oxygen content in the center wing fuel tank so that exposure to a combustible mixture of fuel and air is substantially minimized. This system is intended to reduce the average flammability exposure of the fleet of airplanes with the system installed to a level equivalent to 3 percent of the airplane operating time. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for the design and installation of this system. These special conditions contain the additional safety standards the Administrator considers necessary to ensure an acceptable level of safety for the installation of the system and to define performance objectives the system must achieve to be considered an acceptable means for minimizing development of flammable vapors in the fuel tank installation.
The effective date of these special conditions is December 5, 2005.Start Further Info
FOR FURTHER INFORMATION CONTACT:
Mike Dostert, Propulsion and Mechanical Systems Branch, FAA, ANM-112, Transport Airplane Directorate, Aircraft Certification Service, 1601 Lind Avenue, SW., Renton, Washington, 98055-4056; telephone (425) 227-2132, facsimile (425) 227-1320, e-mail firstname.lastname@example.org.End Further Info End Preamble Start Supplemental Information
Boeing Commercial Airplanes intends to modify the Model 737 series airplanes to incorporate a new flammability reduction means (FRM) that will inert the center fuel tanks with nitrogen-enriched air (NEA). Though the provisions of § 25.981, as amended by Amendment 25-102, will apply to this design change, these special conditions address novel design features. These special conditions are similar to those published in the Federal Register [Docket No. NM270; Special Conditions No. 25-285-SC] for incorporation of an FRM on Boeing Model 747-100/200B/200F/200C/SR/SP/100B/300/100B SUD/400/400D/400F series airplanes (70 FR 7800, January 24, 2005).
Regulations used as the standard for certification of transport category airplanes prior to Amendment 25-102, effective June 6, 2001, were intended to prevent fuel tank explosions by eliminating possible ignition sources from inside the fuel tanks. Service experience of airplanes certificated to the earlier standards shows that ignition source prevention alone has not been totally effective at preventing accidents. Commercial transport airplane fuel tank safety requirements have remained relatively unchanged throughout the evolution of piston-powered airplanes and later into the jet age. The fundamental premise for precluding fuel tank explosions has involved establishing that the design does not result in a condition that would cause an ignition source within the fuel tank ullage (the space in the tank occupied by fuel vapor and air). A basic assumption in this approach has been that the fuel tank could contain flammable vapors under a wide range of airplane operating conditions, even though there were periods of time in which the vapor space would not support combustion.
Jet fuel vapors are flammable in certain temperature and pressure ranges. The flammability temperature range of jet engine fuel vapors varies with the type and properties of the fuel, the ambient pressure in the tank, and the amount of dissolved oxygen released from the fuel into the tank. The amount of dissolved oxygen in a tank will also vary depending on the amount of vibration and sloshing of the fuel that occurs within the tank.
Jet A fuel is the most commonly used commercial jet fuel in the United States. Jet A-1 fuel is commonly used in other parts of the world. At sea level and with no sloshing or vibration present, these Start Printed Page 73562fuels have flammability characteristics such that insufficient hydrocarbon molecules will be present in the fuel vapor-air mixture, to ignite when the temperature in the fuel tank is below approximately 100 °F. Too many hydrocarbon molecules will be present in the vapor to allow it to ignite when the fuel temperature is above approximately 175 °F. The temperature range where a flammable fuel vapor will form can vary with different batches of fuel, even for a specific fuel type. In between these temperatures the fuel vapor is flammable. This flammability temperature range decreases as the airplane gains altitude because of the corresponding decrease of internal tank air pressure. For example, at an altitude of 30,000 feet, the flammability temperature range is about 60 °F to 120 °F. Most transport category airplanes used in air carrier service are approved for operation at altitudes from sea level to 45,000 feet. Those airplanes operated in the United States and in most overseas locations use Jet A or Jet A-1 fuel, which typically limits exposure to operation in the flammability range to warmer days.
We have always assumed that airplanes would sometimes be operated with flammable fuel vapors in their fuel tank ullage (the space in the tank occupied by fuel vapor and air).
Three conditions must be present in a fuel tank to support combustion. These include the presence of a suitable amount of fuel vapor, the presence of sufficient oxygen, and the presence of an ignition source. This has been named the “fire triangle.” Each point of the triangle represents one of these conditions. Because of technological limitations in the past, the FAA philosophy regarding the prevention of fuel tank explosions to ensure airplane safety was to only preclude ignition sources within fuel tanks. This philosophy included application of fail-safe design requirements to fuel tank components (lightning design requirements, fuel tank wiring, fuel tank temperature limits, etc.) that are intended to preclude ignition sources from being present in fuel tanks even when component failures occur.
Need To Address Flammability
Three accidents have occurred in the last 13 years as the result of unknown ignition sources within the fuel tank in spite of past efforts, highlighting the difficulty in continuously preventing ignition from occurring within fuel tanks. Between 1996 and 2000 the National Transportation Safety Board (NTSB) issued recommendations to improve fuel tank safety that included prevention of ignition sources and addressing fuel tank flammability (i.e., the other two points of the fire triangle).
The FAA initiated safety reviews of all larger transport airplane type certificates to review the fail-safe features of previously approved designs and also initiated research into the feasibility of amending the regulations to address fuel tank flammability. Results from the safety reviews indicated a significant number of single and combinations of failures that can result in ignition sources within the fuel tanks. The FAA has adopted rulemaking to require design and/or maintenance actions to address these issues; however, past experience indicates unforeseen design and maintenance errors can result in development of ignition sources. These findings show minimizing or preventing the formation of flammable vapors by addressing the flammability points of the fire triangle will enhance fuel tank safety.
On April 3, 1997, the FAA published a notice in the Federal Register (62 FR 16014), Fuel Tank Ignition Prevention Measures, that requested comments concerning the 1996 NTSB recommendations regarding reduced flammability. That notice provided significant discussion of the service history, background, and issues related to reducing flammability in transport airplane fuel tanks. Comments submitted to that notice indicated additional information was needed before the FAA could initiate rulemaking action to address all of the recommendations.
Past safety initiatives by the FAA and industry to reduce the likelihood of fuel tank explosions resulting from post crash ground fires have evaluated means to address other factors of the fire triangle. Previous attempts were made to develop commercially viable systems or features that would reduce or eliminate other aspects of the fire triangle (fuel or oxygen) such as fuel tank inerting or ullage space vapor “scrubbing” (ventilating the tank ullage with air to remove fuel vapor to prevent the accumulation of flammable concentrations of fuel vapor). Those initial attempts proved to be impractical for commercial transport airplanes due to the weight, complexity, and poor reliability of the systems, or undesirable secondary effects such as unacceptable atmospheric pollution.
Fuel Tank Harmonization Working Group
On January 23, 1998, the FAA published a notice in the Federal Register that established an Aviation Rulemaking Advisory Committee (ARAC) working group, the Fuel Tank Harmonization Working Group (FTHWG). The FAA tasked the FTHWG with providing a report to the FAA recommending regulatory text to address limiting fuel tank flammability in both new type certificates and the fleet of in service airplanes. The ARAC consists of interested parties, including the public, and provides a public process to advise the FAA concerning development of new regulations. [NOTE: The FAA formally established ARAC in 1991 (56 FR 2190, January 22, 1991), to provide advice and recommendations concerning the full range of the FAA's safety-related rulemaking activity.]
The FTHWG evaluated numerous possible means of reducing or eliminating hazards associated with explosive vapors in fuel tanks. On July 23, 1998, the ARAC submitted its report to the FAA. The full report is in the docket created for this ARAC working group (Docket No. FAA-1998-4183). This docket can be reviewed on the U.S. Department of Transportation electronic Document Management System on the Internet at http://dms.dot.gov.
The report provided a recommendation for the FAA to initiate rulemaking action to amend § 25.981, applicable to new type design airplanes, to include a requirement to limit the time transport airplane fuel tanks could operate with flammable vapors in the vapor space of the tank. The recommended regulatory text proposed, “Limiting the development of flammable conditions in the fuel tanks, based on the intended fuel types, to less than 7 percent of the expected fleet operational time (defined in this rule as flammability exposure evaluation time (FEET)), or providing means to mitigate the effects of an ignition of fuel vapors within the fuel tanks such that any damage caused by an ignition will not prevent continued safe flight and landing.” The report included a discussion of various options for showing compliance with this proposal, including managing heat input to the fuel tanks, installation of inerting systems or polyurethane fire suppressing foam, and suppressing an explosion if one occurred.
The level of flammability defined in the proposal was established based on a comparison of the safety record of center wing fuel tanks that, in certain airplanes, are heated by equipment located under the tank, and unheated fuel tanks located in the wing. The ARAC concluded that the safety record of fuel tanks located in the wings with Start Printed Page 73563a flammability exposure of 2 to 4 percent of the FEET was adequate and that if the same level could be achieved in center wing fuel tanks, the overall safety objective would be achieved. The thermal analyses documented in the report revealed that center wing fuel tanks that are heated by air conditioning equipment located beneath them contain flammable vapors, on a fleet average basis, in the range of 15 to 30 percent of the fleet operating time.
During the ARAC review, it was also determined that certain airplane types do not locate heat sources adjacent to the fuel tanks and have significant surface areas that allow cooling of the fuel tank by outside air. These airplanes provide significantly reduced flammability exposure, near the 2 to 4 percent value of the wing tanks. The group therefore determined that it would be feasible to design new airplanes such that airplane operation with fuel tanks that were in the flammable range would be limited to nearly that of the wing fuel tanks. Findings from the ARAC report indicated that the primary method of compliance available at that time with the requirement proposed by the ARAC would likely be to control heat transfer into and out of fuel tanks. Design features such as locating the air conditioning equipment away from the fuel tanks, providing ventilation of the air conditioning bay to limit heating and to cool fuel tanks, and/or insulating the tanks from heat sources, would be practical means of complying with the regulation proposed by the ARAC.
In addition to its recommendation to revise § 25.981, the ARAC also recommended that the FAA continue to evaluate means for minimizing the development of flammable vapors within the fuel tanks to determine whether other alternatives, such as ground-based inerting of fuel tanks, could be shown to be cost effective.
To address the ARAC recommendations, the FAA continued with research and development activity to determine the feasibility of requiring inerting for both new and existing designs.
FAA Rulemaking Activity
Based in part on the ARAC recommendations to limit fuel tank flammability exposure on new type designs, the FAA developed and published Amendment 25-102 in the Federal Register on May 7, 2001 (66 FR 23085). The amendment included changes to § 25.981 that require minimization of fuel tank flammability to address both reduction in the time fuel tanks contain flammable vapors, (§ 25.981(c)), and additional changes regarding prevention of ignition sources in fuel tanks. Section 25.981(c) was based on the FTHWG recommendation to achieve a safety level equivalent to that achieved by the fleet of transports with unheated aluminum wing tanks, between 2 to 4 percent flammability. The FAA stated in the preamble to Amendment 25-102 that the intent of the rule was to—
* * * require that practical means, such as transferring heat from the fuel tank (e.g., use of ventilation or cooling air), be incorporated into the airplane design if heat sources were placed in or near the fuel tanks that significantly increased the formation of flammable fuel vapors in the tank, or if the tank is located in an area of the airplane where little or no cooling occurs. The intent of the rule is to require that fuel tanks are not heated, and cool at a rate equivalent to that of a wing tank in the transport airplane being evaluated. This may require incorporating design features to reduce flammability, for example cooling and ventilation means or inerting for fuel tanks located in the center wing box, horizontal stabilizer, or auxiliary fuel tanks located in the cargo compartment.
Advisory circulars associated with Amendment 25-102 include AC 25.981-1B, “Fuel Tank Ignition Source Prevention Guidelines,” and AC 25.981-2, “Fuel Tank Flammability Minimization.” Like all advisory material, these advisory circulars describe an acceptable means, but not the only means, for demonstrating compliance with the regulations.
In addition to the notice published in the Federal Register on April 3, 1997, the FAA initiated research to provide a better understanding of the ignition process of commercial aviation fuel vapors and to explore new concepts for reducing or eliminating the presence of flammable fuel air mixtures within fuel tanks.
Fuel Tank Inerting
In the public comments received in response to the 1997 notice, reference was made to hollow fiber membrane technology that had been developed and was in use in other applications, such as the medical community, to separate oxygen from nitrogen in air. Air is made up of about 78 percent nitrogen and 21 percent oxygen, and the hollow fiber membrane material uses the absorption difference between the nitrogen and oxygen molecules to separate the NEA from the oxygen. In airplane applications NEA is produced when pressurized air from an airplane source such as the engines is forced through the hollow fibers. The NEA is then directed, at appropriate nitrogen concentrations, into the ullage space of fuel tanks and displaces the normal fuel vapor/air mixture in the tank.
Use of the hollow fiber technology allowed nitrogen to be separated from air, which eliminated the need to carry and store the nitrogen in the airplane. Researchers were aware of the earlier system's shortcomings in the areas of weight, reliability, cost, and performance. Recent advances in the technology have resolved those concerns and eliminated the need for storing nitrogen on board the airplane.
Criteria for Inerting
Earlier fuel tank inerting designs produced for military applications were based on defining “inert” as a maximum oxygen concentration of 9 percent. This value was established by the military for protection of fuel tanks from battle damage. One major finding from the FAA's research and development efforts was the determination that the 9 percent maximum oxygen concentration level benchmark, established to protect military airplanes from high-energy ignition sources encountered in battle, was significantly lower than that needed to inert civilian transport airplane fuel tanks from ignition sources resulting from airplane system failures and malfunctions that have much lower energy. This FAA research established a maximum value of 12 percent as being adequate at sea level. The test results are currently available on FAA web site: http://www.fire.tc.faa.gov/pdf/tn02-79.pdf as FAA Technical Note “Limiting Oxygen Concentrations Required to Inert Jet Fuel Vapors Existing at Reduced Fuel Tank Pressures,” report number DOT/FAA/AR-TN02/79. As a result of this research, the quantity of NEA that is needed to inert commercial airplane fuel tanks was lessened so that an effective FRM can now be smaller and less complex than was originally assumed. The 12 percent value is based on the limited energy sources associated with an electrical arc that could be generated by airplane system failures on typical transport airplanes and does not include events such as explosives or hostile fire.
As previously discussed, existing fuel tank system requirements (contained in earlier Civil Air Regulation (CAR) 4b and now in 14 Code of Federal Regulations (CFR) part 25) have focused solely on prevention of ignition sources. The FRM is intended to add an additional layer of safety by reducing the exposure to flammable vapors in the heated center wing tank, not necessarily eliminating them under all operating conditions. Consequently, ignition prevention measures will still be the Start Printed Page 73564principal layer of defense in fuel system safety, now augmented by substantially reducing the time that flammable vapors are present in higher flammability tanks. We expect that by combining these two approaches, particularly for tanks with high flammability exposure, such as the heated center wing tank or tanks with limited cooling, risks for future fuel tank explosions can be substantially reduced.
Boeing Application for Certification of a Fuel Tank Inerting System
On September 23, 2005 (737 Classics) and December 2, 2005 (737 NG), Boeing Commercial Airplanes applied for a change to Type Certificate A16WE to modify Model 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes to incorporate a new FRM that inerts the center fuel tanks with NEA. These airplanes, approved under Type Certificate No. A16WE, are two-engine transport airplanes with a passenger capacity up to 189, depending on the submodel. These airplanes have an approximate maximum gross weight of 174,700 pounds with an operating range up to 3,380 miles.
Type Certification Basis
Under the provisions of § 21.101, Boeing Commercial Airplanes must show that the Model 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes, as changed, continue to meet the applicable provisions of the regulations incorporated by reference in Type Certificate No. A16WE, or the applicable regulations in effect on the date of application for the change. The regulations incorporated by reference in the type certificate are commonly referred to as the “original type certification basis.” The regulations incorporated by reference in Type Certificate A16WE include 14 CFR part 25, dated February 1, 1965, as amended by Amendments 25-1 through 25-94, except for special conditions and exceptions noted in Type Certificate Data Sheet A16WE.
In addition, if the regulations incorporated by reference do not provide adequate standards with respect to the change, the applicant must comply with certain regulations in effect on the date of application for the change. The FAA has determined that the FRM installation on the Boeing Model 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes must also be shown to comply with § 25.981(a) and (b) at Amendment 25-102.
If the Administrator finds that the applicable airworthiness regulations (14 CFR part 25) do not contain adequate or appropriate safety standards for the Boeing Model 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes because of a novel or unusual design feature, special conditions are prescribed under the provisions of § 21.16.
In addition to the applicable airworthiness regulations and special conditions, the Model 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes must comply with the fuel vent and exhaust emission requirements of 14 CFR part 34 and the acoustical change requirements of § 21.93(b).
Special conditions, as defined in § 11.19, are issued in accordance with § 11.38 and become part of the type certification basis in accordance with § 21.101.
Special conditions are initially applicable to the model for which they are issued. Should the type certificate for that model be amended later to include any other model that incorporates the same or similar novel or unusual design feature, or should any other model already included on the same type certificate be modified to incorporate the same or similar novel or unusual design feature, these special conditions would also apply to the other model under the provisions of § 21.101.
Novel or Unusual Design Features
Boeing has applied for approval of an FRM to minimize the development of flammable vapors in the center fuel tanks of Model 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes. Boeing also plans to seek approval of this system on Boeing Model 757, 767, and 777 airplanes.
Boeing has proposed to voluntarily comply with § 25.981(c), Amendment 25-102, which is normally only applicable to new type designs or type design changes affecting fuel tank flammability. The provisions of § 21.101 require Boeing to also comply with §§ 25.981(a) and (b), Amendment 25-102, for the changed aspects of the airplane by showing that the FRM does not introduce any additional potential sources of ignition into the fuel tanks.
The FRM uses a nitrogen generation system (NGS) that comprises a bleed-air shutoff valve, ozone converter, heat exchanger, air conditioning pack air cooling flow shutoff valve, filter, air separation module, temperature regulating valve controller and sensor, high-flow descent control valve, float valve, and system ducting. The system is located in the air conditioning pack bay below the center wing fuel tank. Engine bleed air from the existing engine pneumatic bleed source flows through a control valve into an ozone converter and then through a heat exchanger, where it is cooled using outside cooling air. The cooled air flows through a filter into an air separation module (ASM) that generates NEA, which is supplied to the center fuel tank. Oxygen-enriched air (OEA) that is generated in this process is dumped overboard. The FRM also includes modifications to the fuel tank vent system to minimize dilution of the nitrogen-enriched ullage in the center tank due to cross-venting characteristics of the existing center wing fuel tank vent design.
Boeing has proposed that limited dispatch relief for operation with an inoperative NGS be allowed. Boeing has initially proposed a 10-day Master Minimum Equipment List (MMEL) relief for the system. Boeing has stated that to meet operator needs and system reliability and availability objectives, built-in test functions would be included and system status indication of some kind would be provided. In addition, indications would be provided in the cockpit on certain airplane models that have engine indicating and crew alerting systems. The reliability of the system is expected to be designed to achieve a mean time between failure (MTBF) of 5000 hours or better.
The FAA policy for establishing the type design approval basis of the FRM design will result in application of §§ 25.981(a) and (b), Amendment 25-102, for the changes to the airplane that might increase the risk of ignition of fuel vapors. Boeing will therefore be required to substantiate that changes introduced by the FRM will meet the ignition prevention requirements of §§ 25.981(a) and (b), Amendment 25-102 and other applicable regulations.
With respect to compliance with § 25.981(c), AC 25.981-2 provides guidance in addressing minimization of fuel tank flammability within a heated fuel tank, but there are no specific regulations that address the design and installation of an FRM that inerts the fuel tank. These special conditions include additional requirements above that of Amendment 25-102 to § 25.981(c) to minimize fuel tank flammability, such that the level of minimization in these special conditions would prevent a fuel tank with an FRM from being flammable during specific warm day operating conditions, such as those present when recent accidents occurred.
Definition of “Inert”
For the purpose of these special conditions, the tank is considered inert Start Printed Page 73565when the oxygen concentration within each compartment of the tank is 12 percent or less at sea level up to 10,000 feet, then linearly increasing from 12 percent at 10,000 feet to 14.5 percent at 40,000 feet and extrapolated linearly above that altitude. The reference to each section of the tank is necessary because fuel tanks that are compartmentalized may encounter localized oxygen concentrations in one or more compartments that exceed the 12 percent value. Currently there is not adequate data available to establish whether exceeding the 12 percent limit in one compartment of a fuel tank could create a hazard. For example, ignition of vapors in one compartment could result in a flame front within the compartment that travels to adjacent compartments and results in an ignition source that exceeds the ignition energy (the minimum amount of energy required to ignite fuel vapors) values used to establish the 12 percent limit. Therefore, ignition in other compartments of the tank may be possible. Technical discussions with the applicant indicate the pressure rise in a fuel tank that was at or near the 12 percent oxygen concentration level would likely be well below the value that would rupture a typical transport airplane fuel tank. While this may be possible to show, it is not within the scope of these special conditions. Therefore, the effect of the definition of “inert” within these special conditions is that the average oxygen concentration of each individual compartment or bay of the tank must be evaluated and shown to meet the oxygen concentration limits specified in the definitions section of these special conditions (12 percent or less at sea level) to be considered inert.
The methodology for determining fuel tank flammability defined for use in these special conditions is based on that used by ARAC to compare the flammability of unheated aluminum wing fuel tanks to that of tanks that are heated by adjacent equipment. The ARAC evaluated the relative flammability of airplane fuel tanks using a statistical analysis commonly referred to as a “Monte Carlo” analysis that considered a number of factors affecting formation of flammable vapors in the fuel tanks. The Monte Carlo analysis calculates values for the parameter of interest by randomly selecting values for each of the uncertain variables from distribution tables. This calculation is conducted over and over to simulate a process where the variables are randomly selected from defined distributions for each of the variables. The results of changing these variables for a large number of flights can then be used to approximate the results of the real world exposure of a large fleet of airplanes.
Factors that are considered in the Monte Carlo analysis required by these special conditions include those affecting all airplane models in the transport airplane fleet such as: a statistical distribution of ground, overnight, and cruise air temperatures likely to be experienced worldwide, a statistical distribution of likely fuel types, and properties of those fuels, and a definition of the conditions when the tank in question will be considered flammable. The analysis also includes factors affecting specific airplane models such as climb and descent profiles, fuel management, heat transfer characteristics of the fuel tanks, statistical distribution of flight lengths (mission durations) expected for the airplane model worldwide, etc. To quantify the fleet exposure, the Monte Carlo analysis approach is applied to a statistically significant number (1,000,000) of flights where each of the factors described above is randomly selected. The flights are then selected to be representative of the fleet using the defined distributions of the factors described previously. For example, flight one may be a short mission on a cold day with an average flash point fuel, and flight two may be a long mission on an average day with a low flash point fuel, and on and on until 1,000,000 flights have been defined in this manner. For every one of the 1,000,000 flights, the time that the fuel temperature is above the flash point of the fuel, and the tank is not inert, is calculated and used to establish if the fuel tank is flammable. Averaging the results for all 1,000,000 flights provides an average percentage of the flight time that any particular flight is considered to be flammable. While these special conditions do not require that the analysis be conducted for 1,000,000 flights, the accuracy of the Monte Carlo analysis improves as the number of flights increases. Therefore, to account for this improved accuracy, Appendix 2 of these special conditions defines lower flammability limits if the applicant chooses to use fewer than 1,000,000 flights.
The determination of whether the fuel tank is flammable is based on the temperature of the fuel in the tank determined from the tank thermal model, the atmospheric pressure in the fuel tank, and properties of the fuel quantity loaded for a given flight, which is randomly selected from a database consisting of worldwide data. The criteria in the model are based on the assumption that as these variables change, the concentration of vapors in the tank instantaneously stabilizes and that the fuel tank is at a uniform temperature. This model does not include consideration of the time lag for the vapor concentration to reach equilibrium, the condensation of fuel vapors from differences in temperature that occur in the fuel tanks, or the effect of mass loading (times when the fuel tank is at the unusable fuel level and there is insufficient fuel at a given temperature to form flammable vapors). However, fresh air drawn into an otherwise inert tank during descent does not immediately saturate with fuel vapors so localized concentrations above the inert level during descent do not represent a hazardous condition. These special conditions allow the time during descent, where a localized amount of fresh air may enter a fuel tank, to be excluded from the determination of fuel tank flammability exposure.
Definition of Transport Effects
The effects of low fuel conditions (mass loading) and the effects of fuel vaporization and condensation with time and temperature changes, referred to as “transport effects” in these special conditions, are excluded from consideration in the Monte Carlo model used for demonstrating compliance with these special conditions. These effects have been excluded because they were not considered in the original ARAC analysis, which was based on a relative measure of flammability. For example, the 3 percent flammability value established by the ARAC as the benchmark for fuel tank safety for wing fuel tanks did not include the effects of cooling of the wing tank surfaces and the associated condensation of vapors from the tank ullage. If this effect had been included in the wing tank flammability calculation, it would have resulted in a significantly lower wing tank flammability benchmark value. The ARAC analysis also did not consider the effects of mass loading which would significantly lower the calculated flammability value for fuel tanks that are routinely emptied (e.g., center wing tanks). The FAA and European Aviation Safety Agency (EASA) have determined that using the ARAC methodology provides a suitable basis for determining the adequacy of an FRM system.
The effect of condensation and vaporization in reducing the flammability exposure of wing tanks is comparable to the effect of the low fuel condition in reducing the flammability exposure of center tanks. We therefore Start Printed Page 73566consider these effects to be offsetting, so that by eliminating their consideration, the analysis will produce results for both types of tanks that are comparable. Using this approach, it is possible to follow the ARAC recommendation of using the unheated aluminum wing tank as the standard for evaluating the flammability exposure of all other tanks. For this reason, both factors have been excluded when establishing the flammability exposure limits. During development of these harmonized special conditions, the FAA and EASA agreed that using the ARAC methodology provides a suitable basis for determining the flammability of a fuel tank and consideration of transport effects should not be permitted.
The FAA, in conjunction with EASA and Transport Canada, has developed criteria within these special conditions that require overall fuel tank flammability to be limited to 3 percent of the fleet average operating time. This overall average flammability limit consists of times when the system performance cannot maintain an inert tank ullage, primarily during descent when the change in ambient pressures draws air into the fuel tanks, and those times when the FRM is inoperative due to failures of the system and the airplane is dispatched with the system inoperative.
Specific Risk Flammability Limit
These special conditions also include a requirement to limit fuel tank flammability to 3 percent during ground operations, and climb phases of flight to address the specific risk associated with operation during warmer day conditions when accidents have occurred. The specific risk requirement is intended to establish minimum system performance levels and therefore the 3 percent flammability limit excludes reliability related contributions, which are addressed in the average flammability assessment. The specific risk requirement may be met by conducting a separate Monte Carlo analysis for each of the specific phases of flight during warmer day conditions defined in these special conditions, without including the times when the FRM is not available because of failures of the system or dispatch with the FRM inoperative.
Inerting System Indications
Fleet average flammability exposure involves several elements, including—
- The time the FRM is working properly and inerts the tank or when the tank is not flammable;
- The time when the FRM is working properly but fails to inert the tank or part of the tank, because of mission variation or other effects;
- The time the FRM is not functioning properly and the operator is unaware of the failure; and
- The time the FRM is not functioning properly and the operator is aware of the failure and is operating the airplane for a limited time under MEL relief.
The applicant may propose that MMEL relief is provided for aircraft operation with the FRM unavailable; however, since the intent of § 25.981(c)(1) is to minimize flammability, the FRM system should be operational to the maximum extent practical. Therefore, these special conditions include reliability and reporting requirements to enhance system reliability so that dispatch of airplanes with the FRM inoperative would be very infrequent. Cockpit indication of the system function that is accessible to the flightcrew is not an explicit requirement, but may be required if the results of the Monte Carlo analysis show the system cannot otherwise meet the flammability and reliability requirements defined in these special conditions. Flight test demonstration and analysis will be required to demonstrate that the performance of the inerting system is effective in inerting the tank during those portions of ground and the flight operations where inerting is needed to meet the flammability requirements of these special conditions.
Various means may be used to ensure system reliability and performance. These may include system integrity monitoring and indication, redundancy of components, and maintenance actions. A combination of maintenance indication and/or maintenance check procedures will be required to limit exposure to latent failures within the system, or high inherent reliability is needed to assure the system will meet the fuel tank flammability requirements. The applicant's inerting system does not incorporate redundant features and includes a number of components essential for proper system operation. Past experience has shown inherent reliability of this type of system would be difficult to achieve. Therefore, if system maintenance indication is not provided for features of the system essential for proper system operation, system functional checks at appropriate intervals determined by the reliability analysis will be required for these features. Validation of proper function of essential features of the system would likely be required once per day by maintenance review of indications, reading of stored maintenance messages or functional checks (possibly prior to the first flight of the day) to meet the reliability levels defined in these special conditions. The determination of a proper interval and procedure will follow completion of the certification testing and demonstration of the system's reliability and performance prior to certification.
Any features or maintenance actions needed to achieve the minimum reliability of the FRM will result in fuel system airworthiness limitations similar to those defined in § 25.981(b). Boeing will be required to include in the instructions for continued airworthiness (ICA) the replacement times, inspection intervals, inspection procedures, and the fuel system limitations required by § 25.981(b). Overall system performance and reliability must achieve a fleet average flammability that meets the requirements of these special conditions. If the system reliability falls to a point where the fleet average flammability exposure exceeds these requirements, Boeing will be required to define appropriate corrective actions, to be approved by the FAA, that will bring the exposure back down to the acceptable level.
Boeing proposed that the FRM be eligible for a 10-day MMEL dispatch interval. The Flight Operations Evaluation Board (FOEB) will establish the approved interval based on data the applicant submits to the FAA. The MMEL dispatch interval is one of the factors affecting system reliability analyses that must be considered early in the design of the FRM, prior to FAA approval of the MMEL. Boeing requested that the authorities agree to use of an MMEL inoperative dispatch interval for design of the system. Boeing data indicate that certain systems on the airplane are routinely repaired prior to the maximum allowable interval. These special conditions require that Boeing use an MMEL inoperative dispatch interval of 60 hours in the analysis as representative of the mean time for which an inoperative condition may occur for the 10-day MMEL maximum interval requested. Boeing must also include actual dispatch inoperative interval data in the quarterly reports required by Special Condition III(c)(2). Boeing may request to use an alternative interval in the reliability analysis. Use of a value less than 60 hours would be a factor considered by the FOEB in establishing the maximum MMEL dispatch limit. The reporting requirement will provide data necessary to validate that the reliability of the Start Printed Page 73567FRM achieved in service meets the levels used in the analysis.
Appropriate maintenance and operational limitations with the FRM inoperative may also be required and noted in the MMEL. The MMEL limitations and any operational procedures should be established based on results of the Monte Carlo analysis, including the results associated with operations in warmer climates where the fuel tanks are flammable a significant portion of the FEET when not inert. While the system reliability analysis may show that it is possible to achieve an overall average fleet exposure equal to or less than that of a typical unheated aluminum wing tank, even with an MMEL allowing very long inoperative intervals, the intent of the rule is to minimize flammability. Therefore, the shortest practical MMEL relief interval should be proposed. To ensure limited airplane operation with the system inoperative and to meet the reliability requirements of these special conditions, appropriate level messages that are needed to comply with any dispatch limitations of the MMEL must be provided.
Confined Space Hazard Markings
Introduction of the FRM will result in NEA within the center wing fuel tank and the possibility of NEA in compartments adjacent to the fuel tank if leakage from the tank or NEA supply lines were to occur. Lack of oxygen in these areas could be hazardous to maintenance personnel, the passengers, or flightcrew. Existing certification requirements do not address all aspects of these hazards. Paragraph II(f) of these special conditions requires the applicant to provide markings to emphasize the potential hazards associated with confined spaces and areas where a hazardous atmosphere could be present due to the addition of an FRM.
For the purposes of these special conditions, a confined space is an enclosed or partially enclosed area that is big enough for a worker to enter and perform assigned work and has limited or restricted means for entry or exit. It is not designed for someone to work in regularly, but workers may need to enter the confined space for tasks such as inspection, cleaning, maintenance, and repair. (Reference U.S. Department of Labor Occupational Safety & Health Administration (OSHA), 29 CFR 1910.146(b).) The requirement in these special conditions does not significantly change the procedures maintenance personnel use to enter fuel tanks and are not intended to conflict with existing government agency requirements (e.g., OSHA). Fuel tanks are classified as confined spaces and contain high concentrations of fuel vapors that must be exhausted from the fuel tank before entry. Other precautions such as measurement of the oxygen concentrations before entering a fuel tank are already required. Addition of the FRM that utilizes inerting may result in reduced oxygen concentrations due to leakage of the system in locations in the airplane where service personnel would not expect it. A worker is considered to have entered a confined space just by putting his or her head across the plane of the opening. If the confined space contains high concentrations of inert gases, workers who are simply working near the opening may be at risk. Any hazards associated with working in adjacent spaces near the opening should be identified in the marking of the opening to the confined space. A large percentage of the work involved in properly inspecting and modifying airplane fuel tanks and their associated systems must be done in the interior of the tanks. Performing the necessary tasks requires inspection and maintenance personnel to physically enter the tank, where many environmental hazards exist. These potential hazards that exist in any fuel tank, regardless of whether nitrogen inerting has been installed, include fire and explosion, toxic and irritating chemicals, oxygen deficiency, and the confined nature of the fuel tank itself. In order to prevent related injuries, operator and repair station maintenance organizations have developed specific procedures for identifying, controlling, or eliminating the hazards associated with fuel-tank entry. In addition government agencies have adopted safety requirements for use when entering fuel tanks and other confined spaces. These same procedures would be applied to the reduced oxygen environment likely to be present in an inerted fuel tank.
The designs currently under consideration locate the FRM in the fairing below the center wing fuel tank. Access to these areas is obtained by opening doors or removing panels which could allow some ventilation of the spaces adjacent to the FRM. But this may not be enough to avoid creating a hazard. Therefore, we intend that marking be provided to warn service personnel of possible hazards associated with the reduced oxygen concentrations in the areas adjacent to the FRM.
Appropriate markings would be required for all inerted fuel tanks, tanks adjacent to inerted fuel tanks and all fuel tanks communicating with the inerted tanks via plumbing. The plumbing includes, but is not limited to, plumbing for the vent system, fuel feed system, refuel system, transfer system and cross-feed system. NEA could enter adjacent fuel tanks via structural leaks. It could also enter other fuel tanks through plumbing if valves are operated or fail in the open position. The markings should also be stenciled on the external upper and lower surfaces of the inerted tank adjacent to any openings to ensure maintenance personnel understand the possible contents of the fuel tank. Advisory Circular 25.981-2 provides additional guidance regarding markings and placards.
Effect of FRM on Auxiliary Fuel Tank System Supplemental Type Certificates
Boeing plans to offer a service bulletin that will describe installation of the FRM on existing in-service airplanes. Some in-service airplanes have auxiliary fuel tank systems installed that interface with the center wing tank. The Boeing FRM design is intended to provide inerting of the center wing fuel tank volume of the 737 and does not include consideration of the auxiliary tank installations. Installation of the FRM on existing airplanes with auxiliary fuel tank systems may therefore require additional modifications to the auxiliary fuel tank system to prevent development of a condition that may cause the tank to exceed the 12 percent oxygen limit. The FAA will address these issues during development and approval of the service bulletin for the FRM.
Disposal of Oxygen-Enriched Air (OEA)
The FRM produces both NEA and OEA. The OEA generated by the FRM could result in an increased fire hazard if not disposed of properly. The OEA produced by the ASM is ducted and dumped overboard. Special requirements are included in these special conditions to address potential leakage of OEA due to failures and safe disposal of the OEA during normal operation.
To ensure that an acceptable level of safety is achieved for the modified airplanes using a system that inerts heated fuel tanks with NEA, these special conditions (per § 21.16) are needed to address the unusual design features of an FRM. These special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards. Start Printed Page 73568
Discussion of Comments
Notice of Proposed Special Conditions No. 25-05-06-SC for the Boeing Model 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes was published in the Federal Register on June 15, 2005 (70 FR 34702). Five commenters responded to the notice.
Comment: The commenter disagrees with the premise in the proposed special conditions that wing fuel tanks offer an acceptable minimum level of flammability exposure and is therefore concerned about using this minimum level for development of inerting systems. The commenter believes that the flammability exposure in the fuel tanks should be reduced to the lowest level technically feasible.
FAA Reply: We do not concur. These special conditions address fuel tank flammability for Boeing Model 737 airplanes currently in service. Although technical advancements have made it practical to incorporate FRM into existing airplanes, it is not practical at this time to reduce fuel tank flammability exposure below the levels identified in these special conditions because airplane systems needed to support the current technology that utilizes inerting were not sized to provide an optimized pressurized air source. Compliance with the average fuel tank flammability requirement and the warm day requirement in these special conditions results in a significant reduction in fuel tank flammability, to a level below that of an unheated aluminum wing fuel tank, and improved airplane safety. No changes were made as a result of this comment.
Comment: The commenter requests that the long-term goal for the definition of “inert” at sea level be established as 9 percent oxygen concentration. The commenter believes that the 12 percent value used in the definition of “inert” in the proposed special conditions, should be considered as a “level of reduced flammability.” The commenter states that past research conducted to support development of military aircraft inerting systems has shown that fuel vapors are combustible at 12 percent oxygen concentration. These military systems, designed to protect against high-energy (intentional) ignition threats, have established 9 percent as an acceptable oxygen concentration to prevent ignition.
FAA Reply: We do not concur. The special condition requirement of 12 percent maximum oxygen concentration at sea level is based on FAA fuel vapor ignition testing at various oxygen contents and review of other test data, such as Navy live gunfire tests using 30 mm incendiary ammunition. These data are provided in Naval Weapons Center document NWC TP 7129, “The Effectiveness of Ullage Nitrogen-Inerting Systems Against 30 mm High-Explosive Incendiary Projectiles,” dated May 1991, that is available in the docket file for these special conditions. These data show that 12 percent oxygen concentration will prevent a fuel tank explosion for airplane system failure and malfunction-generated ignition sources. No changes were made as a result of this comment.
Novel or Unusual Design Features
Comment: The commenter requests that the sentence “The OEA from the ASM is mixed with cooling air from the heat exchanger to dilute the oxygen concentration and then exhausted overboard” be deleted. The commenter states this does not apply to the 737 FRM design.
FAA Reply: We concur in part with the commenter. We have removed this sentence from the second to the last paragraph under this section in the final special conditions but have modified the previous sentence to state “The cooled air flows through a filter into an air separation module (ASM) that generates NEA, which is supplied to the center fuel tank. Oxygen-enriched air (OEA) which is generated in this process is dumped overboard.” We have also modified the sentence regarding how OEA will be disposed, under the Disposal of Oxygen-Enriched Air (OEA) section, to state “The OEA produced by the ASM is ducted and dumped overboard” to be consistent with how the system has been designed.
Inerting System Indications
Comment: The commenter requests that alternative options to daily maintenance checks of the FRM system be provided in the instructions for continued airworthiness for operators that would have difficulty in meeting a daily maintenance requirement. The commenter states that a daily maintenance check of the FRM system does not fit into their current maintenance programs and would be a burden to their operation. The preamble to the proposed special conditions states that “if system maintenance indication is not provided for features of the system essential for proper system operation, system functional checks will be required for these features.”
FAA Reply: We recognize the concern stated by the commenter and provide clarification of the intent of these special conditions. We agree that daily maintenance checks could be burdensome to operators of the affected airplanes. The preamble discussion was not intended to mandate daily checks by maintenance personnel. However, in order to comply with the special conditions, the applicant must demonstrate that the FRM meets specific performance and reliability requirements. Various design methods to ensure the reliability and performance is provided may include a combination of system integrity monitoring and indication, redundancy of components, and maintenance actions. The need for system functional checks and the interval between the checks will be established based on the level of “system maintenance indication provided for features of the system essential for proper system operation” and the reliability of the system. If continual system monitoring is provided or features of the system have high inherent reliability, daily checks would not be needed to meet the reliability requirements in these special conditions. As we stated in the preamble, the determination of a proper interval and procedure will follow completion of the certification testing and demonstration of the system's reliability and performance prior to certification. The time interval between system health checks and maintenance will be established by the reliability analysis, any airworthiness limitations, and the FOEB. No changes were made as a result of this comment.
Comment: The commenter states that these special conditions propose that the MMEL permit operation with an inoperative flammability reduction system (FRS) for up to 10 days/60 flight hours. The commenter agrees that the system should be operational to the maximum extent practical and therefore, as stated in the preamble, “the shortest practical MMEL relief interval should be proposed.” The commenter believes that 10 days is an excessive MMEL relief interval for the FRS and states that a 3-day interval, such as adopted for other inoperative safety systems such as flight data recorders, would be a more appropriate interval.
FAA Reply: We do not concur with the commenter regarding setting a specific MMEL interval in the special conditions. The applicant has proposed a 10-day MMEL relief period, but the FOEB will determine and approve the appropriate MMEL intervals based on data the applicant submits to the FAA. The applicant must show that the fleet average flammability exposure of a tank with an FRM installed is equal to or less than 3 percent, including any time Start Printed Page 73569when the system is inoperative. Setting a prescriptive limit on the MMEL interval such as 3 days would not allow the designer to use the more objective performance based criteria that are currently in these special conditions. No changes were made as a result of this comment.
Comment: The commenter requests “bulk average” be removed from the definition of inert. The commenter requests this change in order that the FAA and EASA FRM special conditions for the Boeing 737 series airplanes remain harmonized.
FAA Reply: We concur with the commenter. We have modified the definition to read as follows:
Inert. For the purpose of these special conditions, the tank is considered inert when the oxygen concentration within each compartment of the tank is 12 percent or less at sea level up to 10,000 feet, then linearly increasing from 12 percent at 10,000 feet to 14.5 percent at 40,000 feet and extrapolated linearly above that altitude.
II. System Performance and Reliability
Comment: The commenter would like to know why the takeoff phase of flight was not included in the warm day requirements in paragraphs II(b) and II(b)(2). The commenter states the 747 FRM Special Conditions 25-285-SC included this phase.
FAA Reply: Although the takeoff phase of flight is not specifically called out in these special conditions, it remains one portion of the flight that must be included in the warm day requirements. We changed paragraph II(b)(2) to define the climb portion of the flight to include the short time interval of takeoff. The ground phase of operation is differentiated from the climb phase (that includes takeoff) by aircraft rotation. This was done to simplify the flammability analysis by eliminating the need to conduct a separate warm day flammability analysis for the takeoff phase of flight. No changes were made as a result of this comment.
Comment: The commenter requests that the requirements in paragraphs III(a) and III(b) of the FAA 737 FRM Special Conditions be revised to align with the following maintenance requirement in the EASA 747 FRM Special Condition RP747-E-01 (the maintenance requirement proposed for the EASA 737 FRM Special Conditions is identical):
The FRS [flammability reduction system] shall be subject to analysis using conventional processes and methodology to ensure that the minimum scheduled maintenance tasks required for securing the continuing airworthiness of the system and installation are identified and published as part of the CS 25.1529 compliance. Maintenance tasks arising from either the Monte Carlo analysis or a CS 25.1309 safety assessment shall be dealt with in accordance with the principles laid down in FAA AC 25.19. The applicant shall prepare a validation program for the associated continuing airworthiness maintenance tasks, fault finding procedures, and maintenance procedures.
The commenter agrees that conventional procedures should be used to identify necessary maintenance tasks. The FAA wording implies that limitations must be identified for all maintenance tasks, whereas detailed development of the Model 747 FRM maintenance procedures has identified that this is not appropriate for some tasks (i.e., the daily inspection of status messages on the Engine Indication and Crew Alerting System (EICAS)). Airworthiness limitations in the form of maintenance tasks, inspections, or Critical Design Configuration Control Limitations (CDCCL) were defined by SFAR 88 to address unsafe conditions resulting from ignition source risks. The proposed FRM is intended as an additional layer of safety above ignition source prevention measures. The FRM will be allowed to be inoperative and on the Minimum Equipment List (MEL). Therefore, no feature of the FRM affects the airworthiness of the airplane.
FAA Reply: We agree in part regarding the comment that Airworthiness Limitations, in the form of maintenance tasks, inspections, or CDCCLs were defined by SFAR 88 to address unsafe conditions resulting from ignition source risks and that the FRM is seen as an additional layer of protection to the ignition source prevention measures. However, the performance and reliability of the FRM, are critical to providing that additional layer of safety for the center wing tank and as such, there must be limitations established to ensure that maintenance actions and installations of auxiliary fuel tanks do not increase the overall fleet average flammability exposures above that permitted by these special conditions. Airworthiness Limitations for the FRM system are only required for:
(1) those FRM components that, if failed, would affect the performance and/or reliability of the FRM system as dictated by the requirements in paragraphs II(a) and (b); and
(2) any critical features of a fuel tank system needed in order to prevent an auxiliary fuel tank installation from increasing the flammability exposure in the center wing fuel tank above that required under paragraphs II(a)(1), II(a)(2), and II(b) or degrading the performance or reliability of the FRM.
No changes have been made as a result of this comment.
Comment: This commenter requests that the FAA revise paragraphs III(c) and III(c)(1) in the final 737 FRM Special Conditions to align with the EASA 747 FRM Special Condition RP747-E-01 requirement for In-Service monitoring which states “Following introduction to service the applicant must introduce an event monitoring program, accruing data from a reasonably representative sample of global operations, to ensure that the implications of component failures affecting the FRS are adequately assessed on an on-going basis.” The In-service monitoring requirement proposed for the EASA 737 FRM Special Condition is the same. The commenter states that the sampling approach in the EASA requirement will be sufficient to verify whether the FRM is operating within the expected failure rates, or if changes are necessary to improve reliability. Requirements harmonized with EASA will facilitate consistent requirements for all manufacturers and operators.
FAA Reply: We do not concur with changing the special conditions. The reporting requirements defined in these special conditions allow the design approval holder (DAH) the latitude to develop a reporting system for approval by the authorities based on data obtained through business agreements with certain operators. Since the special conditions do not require data be collected from all operators and allows the DAH to propose a reporting system that does not require data from all operators, the requirements already allow for sampling to some degree. Since the FRS may only be installed on a relatively small number of airplanes operated in distinct portions of the globe, it may not be possible to provide data for “reasonably representative sample of global operations” as stated in the EASA proposed special conditions. No changes were made as a result of this comment.
Appendix 1: Monte Carlo Analysis
Comment: The commenter requests that the phrase “fleet average flammability exposure” be changed to “fleet average or warm day flammability exposure” in paragraph (c) of Appendix 1. The commenter requests this change be made in order that the FAA and Start Printed Page 73570EASA 737 FRM special requirements remain harmonized.
FAA Reply: We concur with the commenter. We intend that paragraph (c) of Appendix 1 require that, in addition to submitting the Monte Carlo analysis, the applicant must also identify any assumed variation in the parameters used in the analysis that affect either the fleet average or the warm day flammability exposure. The requested change is consistent with our intent.
Appendix 2: Monte Carlo Model
Comment: This commenter notes that the Web site listed for retrieving a copy of the FAA developed Monte Carlo model, referenced in Appendix 2, paragraph I(b) of the Boeing Model 747 FRM Final Special Conditions 25-285-SC, has been removed from paragraph (b) in the 737 FRM special conditions and requests the FAA explain this change.
FAA Reply: We removed the reference to the website because of concerns that this website would not be available in the future due to changes being made for the availability of an updated version of the Monte Carlo. The applicant has a copy of the Monte Carlo Model and has completed their flammability assessment using version 6A of the model. Reference to the website was provided primarily so that the public could have access to the model. Version 6A of the model can be obtained by contacting the person listed under FOR FURTHER INFORMATION CONTACT section of these final special conditions. However, since the proposed 737 FRM special conditions were originally published, we have also published a Notice of Proposed Rulemaking that includes the Monte Carlo assessment methodology by reference as part of the proposed rule and we have made this information available on the internet. Therefore, we have included the new website address as follows as a result of this comment. http://www.fire.tc.faa.gov/systems/fueltank/FTFAM.stm.
Comment: Another commenter requests clarification regarding how the FAA will ensure that a later version of the FAA Monte Carlo model will still provide an identical assessment of flammability exposure as Version 6A referenced in Appendix 2, paragraph I(b) in the 747 FRM Special Conditions 25-285-SC. The commenter would also like to know if an applicant can elect to comply with the Monte Carlo Version 6A, referenced in the 747 FRM Special Conditions, regardless of the aircraft type.
FAA Reply: The requirements of these special conditions apply to specific airplane models as shown in the applicability section of these final special conditions. Version 6A of the Monte Carlo has been identified in the Model 747 special conditions as the acceptable means of showing the flammability exposure meets the requirements of those special conditions. We do not expect that the applicant would be required to use a later version of the Monte Carlo to demonstrate compliance with these special conditions. However, we have proposed regulatory changes in the Notice of Proposed Rulemaking published in the Federal Register on November 23, 2005 (70 FR 70922). If the proposed requirements are adopted, Boeing and all other affected design approval holders would be required to conduct a flammability analysis using the Monte Carlo Model incorporated by reference within the amended § 25.981. Changes incorporated into the Monte Carlo in later versions include simplification and standardization of the inputs to the model. The NPRM would not allow use of version 6A of the Monte Carlo Model for demonstrating compliance. Any airplane model that is affected by the NPRM, including the Model 747, would need to comply with the requirements of the final rule. As always, an applicant may choose to request a finding of equivalent safety. No change was made as a result of this comment.
Appendix 2: Monte Carlo Variables and Data Tables
Comment: The commenter requests clarification of the relevance of the last sentence in paragraph (c)(2) of Appendix 2, “The warm day subset (see paragraph II(b)(2) of Appendix 2 of these special conditions) for ground and climb uses a range of temperatures above 80° F and is included in the Monte Carlo model” to the subject of this paragraph on Atmosphere.
FAA Reply: We concur and have changed the wording as follows: “The warm day subset (see paragraph II(b)(1) of these special conditions) for ground and climb phases uses a range of temperatures above 80° F and is included in the Monte Carlo model.”
As discussed above, these special conditions are applicable to the Boeing Model 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes. Should the type certificate be amended later to include any other model that incorporates the same or similar novel or unusual design feature, or should any other model already included on the same type certificate be modified to incorporate the same or similar novel or unusual design feature, the special conditions would also apply to the other model under the provisions of § 21.101.
This action affects only certain novel or unusual design features on Boeing Model 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes. It is not a rule of general applicability and affects only the applicant who applied to the FAA for approval of these features on the airplane.
Under standard practice, the effective date of final special conditions would be 30 days after the date of publication in the Federal Register; however, as the certification date for the Boeing 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes is imminent, the FAA finds that good cause exits to making these special conditions effective upon issuance.Start List of Subjects
List of Subjects in 14 CFR Part 25End List of Subjects Start Amendment Part
The authority citation for these special conditions is as follows:End Amendment Part
The Special ConditionsStart Amendment Part
Accordingly, pursuant to the authority delegated to me by the Administrator, the following special conditions are issued as part of the type certification basis for the Boeing Model 737-200/200C/300/400/500/600/700/700C/800/900 series airplanes, modified by Boeing Commercial Airplanes to include a flammability reduction means (FRM) that uses a nitrogen generation system to inert the center wing tank with nitrogen-enriched air (NEA).End Amendment Part
Compliance with these special conditions does not relieve the applicant from compliance with the existing certification requirements.
(a) Bulk Average Fuel Temperature. The average fuel temperature within the fuel tank, or different sections of the tank if the tank is subdivided by baffles or compartments.
(b) Flammability Exposure Evaluation Time (FEET). For the purpose of these special conditions, the time from the start of preparing the airplane for flight, through the flight and landing, until all payload is unloaded and all passengers and crew have disembarked. In the Monte Carlo program, the flight time is randomly selected from the Mission Start Printed Page 73571Range Distribution (Table 3), the pre-flight times are provided as a function of the flight time, and the post-flight time is a constant 30 minutes.
(c) Flammable. With respect to a fluid or gas, flammable means susceptible to igniting readily or to exploding (14 CFR part 1, Definitions). A non-flammable ullage is one where the gas mixture is too lean or too rich to burn and/or is inert per the definition below.
(d) Flash Point. The flash point of a flammable fluid is the lowest temperature at which the application of a flame to a heated sample causes the vapor to ignite momentarily, or “flash.” The test for jet fuel is defined in ASTM Specification D56, “Standard Test Method for Flash Point by Tag Close Cup Tester.”
(e) Hazardous Atmosphere. An atmosphere that may expose any person(s) to the risk of death, incapacitation, impairment of ability to self-rescue (escape unaided from a space), injury, or acute illness.
(f) Inert. For the purpose of these special conditions, the tank is considered inert when the oxygen concentration within each compartment of the tank is 12 percent or less at sea level up to 10,000 feet, then linearly increasing from 12 percent at 10,000 feet to 14.5 percent at 40,000 feet and extrapolated linearly above that altitude.
(g) Inerting. A process where a noncombustible gas is introduced into the ullage of a fuel tank to displace sufficient oxygen so that the ullage becomes inert.
(h) Monte Carlo Analysis. An analytical tool that provides a means to assess the degree of fleet average and warm day flammability exposure time for a fuel tank. See appendices 1 and 2 of these special conditions for specific requirements for conducting the Monte Carlo analysis.
(i) Transport Effects. Transport effects are the effects on fuel vapor concentration caused by low fuel conditions (mass loading), fuel condensation, and vaporization.
(j) Ullage, or Ullage Space. The volume within the fuel tank not occupied by liquid fuel at the time interval under evaluation.
II. System Performance and Reliability
The FRM, for the airplane model under evaluation, must comply with the following performance and reliability requirements:
(a) The applicant must submit a Monte Carlo analysis, as defined in appendices 1 and 2 of these special conditions, that—
(1) demonstrates that the overall fleet average flammability exposure of each fuel tank with an FRM installed is equal to or less than 3 percent of the FEET; and
(2) demonstrates that neither the performance (when the FRM is operational) nor reliability (including all periods when the FRM is inoperative) contributions to the overall fleet average flammability exposure of a tank with an FRM installed is more than 1.8 percent (this will establish appropriate maintenance inspection procedures and intervals as required in paragraph III (a) of these special conditions).
(3) identifies critical features of the fuel tank system to prevent an auxiliary fuel tank installation from increasing the flammability exposure of the center wing tank above that permitted under paragraphs II(a)(1), II(a)(2), and II(b) of these special conditions and to prevent degradation of the performance and reliability of the FRM.
(b) The applicant must submit a Monte Carlo analysis that demonstrates that the FRM, when functional, reduces the overall flammability exposure of each fuel tank with an FRM installed for warm day ground and climb phases to a level equal to or less than 3 percent of the FEET in each of these phases for the following conditions—
(1) The analysis must use the subset of 80 °F and warmer days from the Monte Carlo analyses done for overall performance; and
(2) The flammability exposure must be calculated by comparing the time during ground and climb phases (takeoff is included in the climb phase) for which the tank was flammable and not inert, with the total time for the ground and climb phases.
(c) The applicant must provide data from ground testing and flight testing that—
(1) validate the inputs to the Monte Carlo analysis needed to show compliance with (or meet the requirements of) paragraphs II (a), (b), and (c)(2) of these special conditions; and
(2) substantiate that the NEA distribution is effective at inerting all portions of the tank where the inerting system is needed to show compliance with these paragraphs.
(d) The applicant must validate that the FRM meets the requirements of paragraphs II (a), (b), and (c)(2) of these special conditions, with any combination of engine model, engine thrust rating, fuel type, and relevant pneumatic system configuration approved for the airplane.
(e) Sufficient accessibility for maintenance personnel, or the flightcrew, must be provided to FRM status indications necessary to meet the reliability requirements of paragraph II (a) of these special conditions.
(f) The access doors and panels to the fuel tanks with an FRM (including any tanks that communicate with an inerted tank via a vent system), and to any other confined spaces or enclosed areas that could contain NEA under normal conditions or failure conditions, must be permanently stenciled, marked, or placarded as appropriate to warn maintenance crews of the possible presence of a potentially hazardous atmosphere. The proposal for markings does not alter the existing requirements that must be addressed when entering airplane fuel tanks.
(g) Any FRM failures, or failures that could affect the FRM, with potential catastrophic consequences must not result from a single failure or a combination of failures not shown to be extremely improbable.
(a) Airworthiness Limitations must be identified for all maintenance and/or inspection tasks required to identify failures of components within the FRM that are needed to meet paragraphs II (a), (b), and (c)(2) of these special conditions. Airworthiness Limitations must also be identified for the critical fuel tank system features identified under paragraph II (a)(3).
(b) The applicant must provide the maintenance procedures that will be necessary and present a design review that identifies any hazardous aspects to be considered during maintenance of the FRM that will be included in the instructions for continued airworthiness (ICA) or appropriate maintenance documents.
(c) To ensure that the effects of component failures on FRM reliability are adequately assessed on an on-going basis, the applicant must—
(1) demonstrate effective means to ensure collection of FRM reliability data. The means must provide data affecting FRM availablity, such as component failures, and the FRM inoperative intervals due to dispatch under the MMEL;
(2) provide a report to the FAA on a quarterly basis for the first five years after service introduction. After that period, continued quarterly reporting may be replaced with other reliability tracking methods found acceptable to the FAA or eliminated if it is established that the reliability of the FRM meets, and will continue to meet, the exposure requirements of paragraphs II (a) and (b) of these special conditions;
(3) provide a report to the validating authorities for a period of at least two Start Printed Page 73572years following introduction to service; and
(4) develop service instructions or revise the applicable airplane manual, per a schedule agreed on by the FAA, to correct any failures of the FRM that occur in service that could increase the fleet average or warm day flammability exposure of the tank to more than the exposure requirements of paragraphs II (a) and (b) of these special conditions.
Monte Carlo Analysis
(a) A Monte Carlo analysis must be conducted for the fuel tank under evaluation to determine fleet average and warm day flammability exposure for the airplane and fuel type under evaluation. The analysis must include the parameters defined in appendices 1 and 2 of these special conditions. The airplane specific parameters and assumptions used in the Monte Carlo analysis must include:
(1) FRM Performance—as defined by system performance.
(2) Cruise Altitude—as defined by airplane performance.
(3) Cruise Ambient Temperature—as defined in appendix 2 of these special conditions.
(4) Overnight Temperature Drop—as defined in appendix 2 of these special conditions.
(5) Fuel Flash Point and Upper and Lower Flammability Limits—as defined in appendix 2 of these special conditions.
(6) Fuel Burn—as defined by airplane performance.
(7) Fuel Quantity—as defined by airplane performance.
(8) Fuel Transfer—as defined by airplane performance.
(9) Fueling Duration—as defined by airplane performance.
(10) Ground Temperature—as defined in appendix 2 of these special conditions.
(11) Mach Number—as defined by airplane performance.
(12) Mission Distribution—the applicant must use the mission distribution defined in appendix 2 of these special conditions or may request FAA approval of alternate data from the service history of the Model 737.
(13) Oxygen Evolution—as defined by airplane performance and as discussed in Appendix 2 of these special conditions.
(14) Maximum Airplane Range—as defined by airplane performance.
(15) Tank Thermal Characteristics—as defined by airplane performance.
(16) Descent Profile Distribution—the applicant must use a fixed 2500 feet per minute descent rate or may request FAA approval of alternate data from the service history of the Model 737.
(b) The assumptions for the analysis must include—
(1) FRM performance throughout the flammability exposure evaluation time;
(2) Vent losses due to crosswind effects and airplane performance;
(3) Any time periods when the system is operating properly but fails to inert the tank;
localized concentrations above the inert level as a result of fresh air that is drawn into the fuel tank through vents during descent would not be considered as flammable.
(4) Expected system reliability;
(5) The MMEL/MEL dispatch inoperative period assumed in the reliability analysis (60 flight hours must be used for a 10-day MMEL dispatch limit unless an alternative period has been approved by the FAA), including action to be taken when dispatching with the FRM inoperative (Note: The actual MMEL dispatch inoperative period data must be included in the engineering reporting requirement of paragraph III(c)(1) of these special conditions.);
(6) Possible time periods of system inoperability due to latent or known failures, including airplane system shut-downs and failures that could cause the FRM to shut down or become inoperative; and
(7) Effects of failures of the FRM that could increase the flammability of the fuel tank.
(c) The Monte Carlo analysis, including a description of any variation assumed in the parameters (as identified under paragraph (a) of this appendix) that affect fleet average or warm day flammability exposure, and substantiating data must be submitted to the FAA for approval.
I. Monte Carlo Model
(a) The FAA has developed a Monte Carlo model that can be used to calculate fleet average and warm day flammability exposure for a fuel tank in an airplane. Use of the program requires the user to enter the airplane performance data specific to the airplane model being evaluated, such as maximum range, cruise mach number, typical step climb altitudes, tank thermal characteristics specified as exponential heating/cooling time constants, and equilibrium temperatures for various fuel tank conditions. The general methodology for conducting a Monte Carlo model is described in AC 25.981-2.
(b) The FAA model, or one with modifications approved by the FAA, must be used as the means of compliance with these special conditions. The accepted model can be obtained from either the person identified in the FOR FURTHER INFORMATION CONTACT section of this document, or the following Web site: http://www.fire.tc.faa.gov/systems/fueltank/FTFAM.stm. The following procedures, input variables, and data tables must be used in the analysis if the applicant develops a unique model to determine fleet average flammability exposure for a specific airplane type.
II. Monte Carlo Variables and Data Tables
(a) Fleet average flammability exposure is the percent of the mission time the fuel tank ullage is flammable for a fleet of an airplane type operating over the range of actual or expected missions and in a world-wide range of environmental conditions and fuel properties. Variables used to calculate fleet average flammability exposure must include atmosphere, mission length (as defined in Special Condition I. Definitions, as FEET), fuel flash point, thermal characteristics of the fuel tank, overnight temperature drop, and oxygen evolution from the fuel into the ullage. Transport effects are not to be allowed as parameters in the analysis.
(b) For the purposes of these special conditions, a fuel tank is considered flammable when the ullage is not inert and the fuel vapor concentration is within the flammable range for the fuel type being used. The fuel vapor concentration of the ullage in a fuel tank must be determined based on the bulk average fuel temperature within the tank. This vapor concentration must be assumed to exist throughout all bays of the tank. For those airplanes with fuel tanks having different flammability exposure within different compartments of the tank, where mixing of the vapor or NEA does not occur, the Monte Carlo analysis must be conducted for the compartment of the tank with the highest flammability. The compartment with the highest flammability exposure for each flight phase must be used in the analysis to establish the fleet average flammability exposure. For example, the center wing fuel tank in some designs extends into the wing and has compartments of the tank that are cooled by outside air, and other compartments of the tank that are insulated from outside air. Therefore, the fuel temperature and flammability is significantly different between these compartments of the fuel tank.
(1) To predict flammability exposure during a given flight, the variation of ground ambient temperatures, cruise ambient temperatures, and a method to compute the transition from ground to cruise and back again must be used. The variation of the ground and cruise ambient temperatures and the flash point of the fuel is defined by a Gaussian curve, given by the 50 percent value and a ± 1 standard deviation value.
(2) The ground and cruise temperatures are linked by a set of assumptions on the atmosphere. The temperature varies with altitude following the International Standard Atmosphere (ISA) rate of change from the ground temperature until the cruise temperature for the flight is reached. Above this altitude, the ambient temperature is fixed at the cruise ambient temperature. This results in a variation in the upper atmospheric (tropopause) temperature. For cold days, an inversion is applied up to 10,000 feet, and then the ISA rate of change is used. The warm day subset (see paragraph II(b)(1) of these special conditions) for ground and climb uses a range of temperatures above 80 °F and is included in the Monte Carlo model.
(3) The analysis must include a minimum number of flights, and for each flight a separate random number must be generated for each of the three parameters (that is, ground ambient temperature, cruise ambient temperature, and fuel flash point) using the Gaussian distribution defined in Table 1. The applicant can verify the output values from the Gaussian distribution using Table 2.
(d) Fuel Properties.
(1) Flash point variation. The variation of the flash point of the fuel is defined by a Gaussian curve, given by the 50 percent value and a ±1 standard deviation value. Start Printed Page 73573
(2) Upper and Lower Flammability Limits. The flammability envelope of the fuel that must be used for the flammability exposure analysis is a function of the flash point of the fuel selected by the Monte Carlo for a given flight. The flammability envelope for the fuel is defined by the upper flammability limit (UFL) and lower flammability limit (LFL) as follows:
(i) LFL at sea level = flash point temperature of the fuel at sea level minus 10 degrees F. LFL decreases from sea level value with increasing altitude at a rate of 1 degree F per 808 ft.
(ii) UFL at sea level = flash point temperature of the fuel at sea level plus 63.5 degrees F. UFL decreases from the sea level value with increasing altitude at a rate of 1 degree F per 512 ft.
Table 1 includes the Gaussian distribution for fuel flash point. Table 2 also includes information to verify output values for fuel properties. Table 2 is based on typical use of Jet A type fuel, with limited TS-1 type fuel use.
|Temperature in deg F|
|Parameter||Ground ambient temperature||Cruise ambient temperature||Flash point (FP)|
|Neg 1 std dev||20.14||8||8|
|Pos 1 std dev||17.28||8||8|
|Percent probability of temps & flash point being below the listed values||Ground ambient temperature deg F||Cruise ambient temperature deg F||Flash Point deg F||Ground ambient temperature deg C||Cruise ambient temperature deg C||Flash point (FP) deg C|
(e) Flight Mission Distribution.
(1) The mission length for each flight is determined from an equation that takes the maximum mission length for the airplane and randomly selects multiple flight lengths based on typical airline use.
(2) The mission length selected for a given flight is used by the Monte Carlo model to select a 30-, 60-, or 90-minute time on the ground prior to takeoff, and the type of flight profile to be followed. Table 3 must be used to define the mission distribution. A linear interpolation between the values in the table must be assumed.Start Printed Page 73574 Start Printed Page 73575
(f) Fuel Tank Thermal Characteristics.
(1) The applicant must account for the thermal conditions of the fuel tank both on the ground and in flight. The Monte Carlo model, defines the ground condition using an equilibrium delta temperature (relative to the ambient temperature) the tank will reach given a long enough time, with any heat inputs from airplane sources. Values are also input to define two exponential time constants (one for a near empty tank and one for a near full tank) for the ground condition. These time constants define the time for the fuel in the fuel tank to heat or cool in response to heat input. The fuel is assumed to heat or cool according to a normal exponential transition, governed by the temperature difference between the current temperature and the equilibrium temperature, given by ambient temperature plus delta temperature. Input values for this data can be obtained from validated thermal models of the tank based on ground and flight test data. The inputs for the in-flight condition are similar but are used for in-flight analysis.
(2) Fuel management techniques are unique to each manufacturer's design. Variations in fuel quantity within the tank for given points in the flight, including fuel transfer for any purpose, must be accounted for in the model. The model uses a “tank full” time, specified in minutes, that defines the time before touchdown when the fuel tank is still full. For a center wing tank used first, this number would be the maximum flight time, and the tank would start to empty at takeoff. For a main tank used last, the tank will remain full for a shorter time before touchdown and would be “empty” at touchdown (that is, tank empty at 0 minutes before touchdown). For a main tank with reserves, the term empty means at reserve level rather than totally empty. The thermal data for tank empty would also be for reserve level.
(3) The model also uses a “tank empty” time to define the time when the tank is emptying, and the program uses a linear interpolation between the exponential time constants for full and empty during the time the tank is emptying. For a tank that is only used for long-range flights, the tank would be full only on longer-range flights and would be empty a long time before touchdown. For short flights, it would be empty for the whole flight. For a main tank that carried reserve fuel, it would be full for a long time and would only be down to empty at touchdown. In this case, empty would really be at reserve level, and the thermal constants at empty should be those for the reserve level.
(4) The applicant, whether using the available model or using another analysis tool, must propose means to validate thermal time constants and equilibrium temperatures to be used in the analysis. The applicant may propose using a more detailed thermal definition, such as changing time constants as a function of fuel quantity, provided the details and substantiating information are acceptable and the Monte Carlo model program changes are validated.
(g) Overnight Temperature Drop.
(1) An overnight temperature drop must be considered in the Monte Carlo analysis as it may affect the oxygen concentration level in the fuel tank. The overnight temperature drop for these special conditions will be defined using:
- A temperature at the beginning of the overnight period based on the landing temperature that is a random value based on a Gaussian distribution; and
- An overnight temperature drop that is a random value based on a Gaussian distribution.
(2) For any flight that will end with an overnight ground period (one flight per day out of an average of “x” number of flights per day, (depending on use of the particular airplane model being evaluated), the landing outside air temperature (OAT) is to be chosen as a random value from the following Gaussian curve:
|Parameter||Landing Temperature °F|
|neg 1 std dev||20.55|
|pos 1 std dev||13.21|
(3) The outside air temperature (OAT) drop for that night is to be chosen as a random value from the following Gaussian curve:
|Parameter||OAT Drop Temperature °F|
|1 std dev||6.0|
(h) Oxygen Evolution. The oxygen evolution rate must be considered in the Monte Carlo analysis if it can affect the flammability of the fuel tank or compartment. Fuel contains dissolved gases, and in the case of oxygen and nitrogen absorbed from the air, the oxygen level in the fuel can exceed 30 percent, instead of the normal 21 percent oxygen in air. Some of these gases will be released from the fuel during the reduction of ambient pressure experienced in the climb and cruise phases of flight. The applicant must consider the effects of air evolution from the fuel on the level of oxygen in the tank ullage during ground and flight operations and address these effects on the overall performance of the FRM. The applicant must provide the air evolution rate for the fuel tank under evaluation, along with substantiation data.
(i) Number of Simulated Flights Required in Analysis. For the Monte Carlo analysis to be valid for showing compliance with the fleet average and warm day flammability exposure requirements of these special conditions, the applicant must run the analysis for an appropriate number of flights to ensure that the fleet average and warm day flammability exposure for the fuel tank under evaluation meets the flammability limits defined in Table 6.
|Number of flights in Monte Carlo analysis||Maximum acceptable fuel tank flammability (percent)|
|Start Printed Page 73576|
Issued in Renton, Washington, on December 5, 2005.
Manager, Transport Airplane Directorate, Aircraft Certification Service.
BILLING CODE 4911-13-P
BILLING CODE 4911-13-C
[FR Doc. 05-23936 Filed 12-12-05; 8:45 am]
BILLING CODE 4910-13-P