01-10129. Transport Airplane Fuel Tank System Design Review, Flammability Reduction, and Maintenance and Inspection Requirements

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Final rule.

SUMMARY:

This rule requires design approval holders of certain turbine-powered transport category airplanes, and of any subsequent modifications to these airplanes, to substantiate that the design of the fuel tank system precludes the existence of ignition sources within the airplane fuel tanks. It also requires developing and implementing maintenance and inspection instructions to assure the safety of the fuel tank system. For new type designs, this rule also requires demonstrating that ignition sources cannot be present in fuel tanks when failure conditions are considered, identifying any safety-critical maintenance actions, and incorporating a means either to minimize development of flammable vapors in fuel tanks or to prevent catastrophic damage if ignition does occur. These actions are based on accident investigations and adverse service experience, which have shown that unforeseen failure modes and lack of specific maintenance procedures on certain airplane fuel tank systems may result in degradation of design safety features intended to preclude ignition of vapors within the fuel tank.

EFFECTIVE DATE:

June 6, 2001.

FOR FURTHER INFORMATION CONTACT:

Michael E. Dostert, FAA, Propulsion/Mechanical Systems Branch, ANM-112, Transport Airplane Directorate, Aircraft Certification Service, 1601 Lind Avenue SW., Renton, Washington 98055-4056; telephone [phone], facsimile [phone]; e-mail: [e-mail].

SUPPLEMENTARY INFORMATION:

Availability of Final Rules

You can get an electronic copy using the Internet by taking the following steps:

(1) Go to the search function of the Department of Transportation's electronic Docket Management System (DMS) Web page (http://dms.dot.gov/​search).

(2) On the search page type in the last four digits of the Docket number shown at the beginning of this notice. Click on “search.”

(3) On the next page, which contains the Docket summary information for the Docket you selected, click on the final rule.

(4) To view or download the document click on either “Scanned Image (TIFF)” or “Adobe PDF.”

You can also get an electronic copy using the Internet through FAA's web page at http://www.faa.gov/​avr/​arm/​nprm/​nprm.htm or the Federal Register's web page at http://www.access.gpo.gov/​su_​docs/​aces/​aces140.html.

You can also get a copy by submitting a request to the Federal Aviation Administration, Office of Rulemaking, ARM-1, 800 Independence Avenue SW., Washington, DC 20591, or by calling [phone]. Make sure to identify the amendment number or docket number of this final rule.

Small Business Regulatory Enforcement Fairness Act

The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 1996 requires FAA to comply with small entity requests for information or advice about compliance with statutes and regulations within its jurisdiction. Therefore, any small entity that has a question regarding this document may contact their local FAA official, or the person listed under FOR FURTHER INFORMATION CONTACT. You can find out more about SBREFA on the Internet at our site, http://www.gov/​avr/​arm/​sbrefa.htm. For more information on SBREFA, e-mail us at [e-mail].

Background

On October 26, 1999, the FAA issued Notice of Proposed Rulemaking (NPRM) 99-18, which was published in the Federal Register on October 29, 1999 (64 FR 58644). That notice proposed three separate requirements:

First, a requirement was proposed for the design approval holders of certain transport category airplanes to conduct a safety review of the airplane fuel tank system and to develop specific fuel tank system maintenance and inspection instructions for any items determined to require repetitive inspections or maintenance.

Second, a requirement was proposed to prohibit the operation of those airplanes beyond a specified time, unless the operators of those airplanes incorporated instructions for maintenance and inspection of the fuel tank system into their inspection programs.

Third, for new designs, the proposal included a requirement for minimizing the flammability of fuel tanks, a requirement concerning detailed failure analysis to preclude the presence of ignition sources in the fuel tanks and including mandatory fuel system maintenance in the limitations section of the Instructions for Continued Airworthiness.

Issues Prompting This Rulemaking Activity

On July 17, 1996, a 25-year old Boeing Model 747-100 series airplane was involved in an inflight breakup after takeoff from Kennedy International Airport in New York, resulting in 230 fatalities. The accident investigation conducted by the National Transportation Safety Board (NTSB) indicated that the center wing fuel tank exploded due to an unknown ignition source. The NTSB issued recommendations intended to:

• Reduce heating of the fuel in the center wing fuel tanks on the existing fleet of transport airplanes,
• Reduce or eliminate operation with flammable vapors in the fuel tanks of new type certificated airplanes, and
• Reevaluate the fuel system design and maintenance practices on the fleet of transport airplanes.

The accident investigation focused on mechanical failure as providing the energy source that ignited the fuel vapors inside the tank.

The NTSB announced their official findings of the TWA 800 accident at a public meeting held August 22-23, 2000, in Washington, DC. The NTSB determined that the probable cause of the explosion was ignition of the flammable fuel/air mixture in the center wing fuel tank. Although the ignition source could not be determined with certainty, the NTSB determined that the most likely source was a short circuit outside of the center wing tank that allowed excessive voltage to enter the tank through electrical wiring associated with the fuel quantity indication system (FQIS). Opening remarks at the hearing also indicated that:

“* * * This investigation and several others have brought to light some broader issues regarding aircraft certification. For example, there are questions about the adequacy of the risk analyses that are used as the basis for demonstrating compliance with many certification requirements.”

This accident prompted the FAA to examine the underlying safety issues surrounding fuel tank explosions, the adequacy of the existing regulations, the service history of airplanes certificated to these regulations, and existing maintenance practices relative to the fuel tank system.

Flammability Characteristics

The flammability characteristics of the various fuels approved for use in transport airplanes results in the presence of flammable vapors in the vapor space of fuel tanks at various times during the operation of the airplane. Vapors from Jet A fuel (the typical commercial turbojet engine fuel) at temperatures below approximately 100°F are too lean to be flammable at sea level; at higher altitudes the fuel vapors become flammable at temperatures above approximately 45°F (at 40,000 feet altitude).

However, the regulatory authorities and aviation industry have always presumed that a flammable fuel air mixture exists in the fuel tanks at all times and have adopted the philosophy that the best way to ensure airplane fuel tank safety is to preclude ignition sources within fuel tanks. This philosophy has been based on the application of fail-safe design requirements to the airplane fuel tank system to preclude ignition sources from being present in fuel tanks when component failures, malfunctions, or lightning encounters occur.

Possible ignition sources that have been considered include:

• Electrical arcs,
• Friction sparks, and
• Autoignition. (The autoignition temperature is the temperature at which the fuel/air mixture will spontaneously ignite due to heat in the absence of an ignition source.)

Some events that could produce sufficient electrical energy to create an arc include:

• Lightning,
• Electrostatic charging,
• Electromagnetic interference (EMI), or
• Failures in airplane systems or wiring that introduce high-power electrical energy into the fuel tank system.

Friction sparks may be caused by mechanical contact between certain rotating components in the fuel tank, such as a steel fuel pump impeller rubbing on the pump inlet check valve. Autoignition of fuel vapors may be caused by failure of components within the fuel tank, or external components or systems that cause components or tank surfaces to reach a high enough temperature to ignite the fuel vapors in the fuel tank.

Existing Regulations/Certification Methods

The current 14 CFR part 25 regulations that are intended to require designs that preclude the presence of ignition sources within the airplane fuel tanks are as follows:

Section 25.901 is a general requirement that applies to all portions of the propulsion installation, which includes the airplane fuel tank system. It requires, in part, that the propulsion and fuel tank systems be designed to ensure fail-safe operation between normal maintenance and inspection intervals, and that the major components be electrically bonded to the other parts of the airplane.

Sections 25.901(c) and 25.1309 provide airplane system fail-safe requirements. Section 25.901(c) requires that “no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane.” In general, the FAA's policy has been to require applicants to assume the presence of foreseeable latent (undetected) failure conditions when demonstrating that subsequent single failures will not jeopardize the safe operation of the airplane.

Certain subsystem designs must also comply with § 25.1309. That section requires airplane systems and associated systems to be:

“* * * designed so that the occurrence of any failure condition which would prevent the continued safe flight and landing of the airplane is extremely improbable, and the occurrence of any other failure conditions which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions is improbable.”

Compliance with § 25.1309 requires an analysis, and testing where appropriate, considering possible modes of failure, including malfunctions and damage from external sources, the probability of multiple failures and undetected failures, the resulting effects on the airplane and occupants, considering the stage of flight and operating conditions, and the crew warning cues, corrective action required, and the capability of detecting faults.

This provision has the effect of mandating the use of “fail-safe” design methods, which require that the effect of failures and combinations of failures be considered in defining a safe design. Detailed methods of compliance with §§ 25.1309(b), (c), and (d) are described in Advisory Circular (AC) 25.1309-1A, “System Design Analysis,” and are intended as a means to evaluate the overall risk, on average, of an event occurring within a fleet of aircraft. The following guidance involving failures is offered in that AC:

• In any system or subsystem, a single failure of any element or connection during any one flight must be assumed without consideration as to its probability of failing. This single failure must not prevent the continued safe flight and landing of the airplane.
• Additional failures during any one flight following the first single failure must also be considered when the probability of occurrence is not shown to be extremely improbable. The probability of these combined failures includes the probability of occurrence of the first failure.

As described in the AC, the FAA fail-safe design concept consists of the following design principles or techniques intended to ensure a safe design. The use of only one of these principles is seldom adequate. A combination of two or more design principles is usually needed to provide a fail-safe design (i.e., to ensure that catastrophic failure conditions are not expected to occur during the life of the fleet of a particular airplane model).

• Design integrity and quality, including life limits, to ensure intended function and prevent failures.
• Redundancy or backup systems that provide system function after the first failure (e.g., two or more engines, two or more hydraulic systems, dual flight controls, etc.)
• Isolation of systems and components so that failure of one element will not cause failure of the other (sometimes referred to as system independence).
• Detection of failures or failure indication.
• Functional verification (the capability for testing or checking the component's condition).
• Proven reliability and integrity to ensure that multiple component or system failures will not occur in the same flight.
• Damage tolerance that limits the safety impact or effect of the failure.
• Designed failure path that controls and directs the failure, by design, to limit the safety impact.
• Flightcrew procedures following the failure designed to assure continued safe flight by specific crew actions.
• Error tolerant design that considers probable human error in the operation, maintenance, and fabrication of the airplane.
• Margins of safety that allow for undefined and unforeseeable adverse flight conditions.

These regulations, when applied to typical airplane fuel tank systems, are intended to prevent ignition sources inside fuel tanks. The approval of the installation of mechanical and electrical components inside the fuel tanks was typically based on a qualitative system safety analysis and component testing which showed that:

• Mechanical components would not create sparks or high temperature surfaces in the event of any failure; and
• Electrical devices would not create arcs of sufficient energy to ignite a fuel-air mixture in the event of a single failure or probable combination of failures.

Section 25.901(b)(2) requires that the components of the propulsion system be “constructed, arranged, and installed so as to ensure their continued safe operation between normal inspection or overhauls.” Compliance with this regulation is typically demonstrated by substantiating that the propulsion installation, which includes the fuel tank system, will safely perform its intended function between inspections and overhauls defined in the maintenance instructions.

Section 25.901(b)(4) requires electrically bonding the major components of the propulsion system to the other parts of the airplane. The affected major components of the propulsion system include the fuel tank system. Compliance with this requirement for fuel tank systems has been demonstrated by showing that all major components in the fuel tank are electrically bonded to the airplane structure. This precludes accumulation of electrical charge on the components and the possible arcing in the fuel tank that could otherwise occur. In most cases, electrical bonding is accomplished by installing jumper wires from each major fuel tank system component to airplane structure. Advisory Circular 25-8, “Auxiliary Fuel Tank Installations,” also provides guidance for bonding of fuel tank system components and means of precluding ignition sources within transport airplane fuel tanks.

Section 25.954 requires that the fuel tank system be designed and arranged to prevent the ignition of fuel vapor within the system due to the effects of lightning strikes. Compliance with this regulation is typically shown by incorporation of design features such as minimum fuel tank skin thickness, location of vent outlets out of likely lightning strike areas, and bonding of fuel tank system structure and components. Guidance for demonstrating compliance with this regulation is provided in AC 20-53A, “Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Due to Lightning.”

Section 25.981 requires that the applicant determine the highest temperature allowable in fuel tanks that provides a safe margin below the lowest expected autoignition temperature of the fuel that is approved for use in the fuel tanks. No temperature at any place inside any fuel tank where fuel ignition is possible may then exceed that maximum allowable temperature. This must be shown under all probable operating, failure, and malfunction conditions of any component whose operation, failure, or malfunction could increase the temperature inside the tank. Guidance for demonstrating compliance with this regulation has been provided in AC 25.981-1A, “Guidelines For Substantiating Compliance With the Fuel Tank Temperature Requirements.” The AC provides a listing of failure modes of fuel tank system components that should be considered when showing that component failures will not create a hot surface that exceeds the maximum allowable fuel tank component or tank surface temperature for the fuel type for which approval is being requested. Manufacturers have demonstrated compliance with this regulation by testing and analysis of components to show that design features, such as thermal fuses in fuel pump motors, preclude an ignition source in the fuel tank when failures such as a seized fuel pump rotor occur.

Airplane Maintenance Manuals and Instructions for Continued Airworthiness

Historically, manufacturers have been required to provide maintenance-related information for fuel tank systems in the same manner as for other systems. Prior to 1970, most manufacturers provided manuals containing maintenance information for large transport category airplanes, but there were no standards prescribing minimum content, distribution, and a timeframe in which the information must be made available to the operator.

Section 25.1529, as amended by Amendment 25-21 in 1970, required the applicant for a type certificate (TC) to provide airplane maintenance manuals (AMM) to owners of the airplanes. This regulation was amended in 1980 to require that the applicant for type certification provide Instructions for Continued Airworthiness (ICA) prepared in accordance with Appendix H to part 25. In developing the ICA, the applicant is required to include certain information such as a description of the airplane and its systems, servicing information, and maintenance instructions, including the frequency and extent of inspections necessary to provide for the continuing airworthiness of the airplane (including the fuel tank system). As required by Appendix H to part 25, the ICA must also include an FAA-approved Airworthiness Limitations section enumerating those mandatory inspections, inspection intervals, replacement times, and related procedures approved under § 25.571, relating to structural damage tolerance. Before this amendment, the Airworthiness Limitations section of the ICA applied only to airplane structure and not to the fuel tank system.

One method of establishing initial scheduled maintenance and inspection tasks is the Maintenance Steering Group (MSG) process, which develops a Maintenance Review Board (MRB) document for a particular airplane model. Operators may incorporate those provisions, along with other maintenance information contained in the ICA, into their maintenance or inspection program.

Section 21.50 requires the holder of a design approval, including a TC or supplemental type certificate (STC) for an airplane, aircraft engine, or propeller for which application was made after January 28, 1981, to furnish at least one set of the complete ICA to the owner of the product for which the application was made. The ICA for original type certificated products must include instructions for the fuel tank system. A design approval holder who has modified the fuel tank system must furnish a complete set of the ICA for the modification to the owner of the product.

Type Certificate Amendments Based on Major Change in Type Design

Over the years, design changes have been introduced into fuel tank systems that may affect their safety. There are three ways in which major design changes can be approved:

1. The TC holder may be granted an amendment to the type design.

2. Any person, including the TC holder, wanting to alter a product by introducing a major change in the type design not great enough to require a new application for a TC, may be granted an STC.

3. In some instances, a person may also make an alteration to the type design and receive a field approval. The field approval process is a method for obtaining approval of relatively simple modifications to airplanes. In this process, an authorized FAA Flight Standards Inspector can approve the alteration by use of FAA Form 337.

Maintenance and Inspection Program Requirements

Airplane operators are required to have extensive maintenance or inspection programs that include provisions relating to fuel tank systems.

Section 91.409(e), which generally applies to other than commercial operations, requires an operator of a large turbojet multiengine airplane or a turbopropeller-powered multiengined airplane to select one of the following four inspection programs:

1. A continuous airworthiness inspection program that is part of a continuous airworthiness maintenance program currently in use by a person holding an air carrier operating certificate, or an operating certificate issued under part 119 for operations under parts 121 or 135, and operating that make and model of airplane under those parts;

2. An approved airplane inspection program approved under § 135.419 and currently in use by a person holding an operating certificate and operations specifications issued under part 119 for part 135 operations;

3. A current inspection program recommended by the manufacturer; or

4. Any other inspection program established by the registered owner or operator of that airplane and approved by the Administrator.

Section 121.367, which is applicable to those air carrier and commercial operations covered by part 121, requires operators to have an inspection program, as well as a program covering other maintenance, preventative maintenance, and alterations.

Section 125.247, which is generally applicable to operation of large airplanes, other than air carrier operations conducted under part 121, requires operators to inspect their airplanes in accordance with an inspection program approved by the Administrator.

Section 129.14 requires a foreign air carrier and each foreign operator of a U.S. registered airplane in common carriage, within or outside the U.S., to maintain the airplane in accordance with an FAA-approved program.

In general, the operators rely on the TC data sheet, MRB reports, ICA's, the Airworthiness Limitations section of the ICA, other manufacturers' recommendations, and their own operating experience to develop the overall maintenance or inspection program for their airplanes.

The intent of the rules governing the inspection and/or maintenance program is to ensure that the inherent level of safety that was originally designed into the system is maintained and that the airplane is in an airworthy condition.

Historically, for fuel tank systems these required programs include:

• Operational checks (e.g., a task to determine if an item is fulfilling its intended function);
• Functional checks (e.g., a quantitative task to determine if functions perform within specified limits);
• Overhaul of certain components to restore them to a known standard; and
• General zonal visual inspections conducted concurrently with other maintenance actions, such as structural inspections.

However, specific maintenance instructions to detect and correct conditions that degrade fail-safe capabilities have not been deemed necessary because it has been assumed that the original fail-safe capabilities would not be degraded in service.

Design and Service History Review

The FAA has examined the service history of transport airplanes and performed an analysis of the history of fuel tank explosions on these airplanes. While there were a significant number of fuel tank fires and explosions that occurred during the 1960's and 1970's on several airplane types, in most cases, the fire or explosion was found to be related to design practices, maintenance actions, or improper modification of fuel pumps. Some of the events were apparently caused by lightning strikes. Extensive design reviews were conducted to identify possible ignition sources, and actions were taken that were intended to prevent similar occurrences. However, fuel tank system-related accidents have occurred in spite of these efforts.

On May 11, 1990, the center wing fuel tank of a Boeing Model 737-300 exploded while the airplane was on the ground at Nimoy Aquino International Airport, Manila, Philippines. The airplane was less than one year old. In the accident, the fuel-air vapors in the center wing tank exploded as the airplane was being pushed back from a terminal gate prior to flight. The accident resulted in 8 fatalities and injuries to an additional 30 people. Accident investigators considered a plausible scenario in which damaged wiring located outside the fuel tank might have created a short between 115-volt airplane system wires and 28 volt wires to a fuel tank level switch. This, in combination with a possible latent defect of the fuel level float switch, was investigated as a possible source of ignition. However, a definitive ignition source was never confirmed during the accident investigation. This unexplained accident occurred on a newer airplane, in contrast to the July 17, 1996, accident that occurred on an older Boeing Model 747 airplane that was approaching the end of its initial design life.

The Model 747 and 737 accidents indicate that the development of an ignition source inside the fuel tank may be related to both the design and maintenance of the fuel tank systems.

National Transportation Safety Board (NTSB) Recommendations

Since the July 17, 1996, accident, the FAA, NTSB, and aviation industry have been reviewing the design features and service history of the Boeing Model 747 and certain other transport airplane models. Based upon its review, the NTSB has issued the following recommendations to the FAA intended to reduce exposure to operation with flammable vapors in fuel tanks and address possible degradation of the original type certificated fuel tank system designs on transport airplanes.

The following recommendations relate to “Reduced Flammability Exposure”:

“A-96-174: Require the development of and implementation of design or operational changes that will preclude the operation of transport-category airplanes with explosive fuel-air mixtures in the fuel tanks:

LONG TERM DESIGN MODIFICATIONS:

(a) Significant consideration should be given to the development of airplane design modification, such as nitrogen-inerting systems and the addition of insulation between heat-generating equipment and fuel tanks. Appropriate modifications should apply to newly certificated airplanes and, where feasible, to existing airplanes.”

“A-96-175: Require the development of and implementation of design or operational changes that will preclude the operation of transport-category airplanes with explosive fuel-air mixtures in the fuel tanks:

NEAR TERM OPERATIONAL

(b) Pending implementation of design modifications, require modifications in operational procedures to reduce the potential for explosive fuel-air mixtures in the fuel tanks of transport-category aircraft. In the B-747, consideration should be given to refueling the center wing fuel tank (CWT) before flight whenever possible from cooler ground fuel tanks, proper monitoring and management of the CWT fuel temperature, and maintaining an appropriate minimum fuel quantity in the CWT.”

“A-96-176: Require that the B-747 Flight Handbooks of TWA and other operators of B-747s and other aircraft in which fuel tank temperature cannot be determined by flightcrews be immediately revised to reflect the increases in CWT fuel temperatures found by flight tests, including operational procedures to reduce the potential for exceeding CWT temperature limitations.”

“A-96-177: Require modification of the CWT of B-747 airplanes and the fuel tanks of other airplanes that are located near heat sources to incorporate temperature probes and cockpit fuel tank temperature displays to permit determination of the fuel tank temperatures.”

The following recommendations relate to “Ignition Source Reduction”:

“A-98-36: Conduct a survey of fuel quantity indication system probes and wires in Boeing Model 747's equipped with systems other than Honeywell Series 1-3 probes and compensators and in other model airplanes that are used in Title 14 Code of Federal Regulations Part 121 service to determine whether potential fuel tank ignition sources exist that are similar to those found in the Boeing Model 747. The survey should include removing wires from fuel probes and examining the wires for damage. Repair or replacement procedures for any damaged wires that are found should be developed.”

“A-98-38: Require in Boeing Model 747 airplanes, and in other airplanes with fuel quantity indication system (FQIS) wire installations that are co-routed with wires that may be powered, the physical separation and electrical shielding of FQIS wires to the maximum extent possible.”

“A-98-39: Require, in all applicable transport airplane fuel tanks, surge protection systems to prevent electrical power surges from entering fuel tanks through fuel quantity indication system wires.”

Service History

The FAA has reviewed service difficulty reports for the transport airplane fleet and evaluated the certification and design practices utilized on these previously certificated airplanes. An inspection of fuel tanks on Boeing Model 747 airplanes also was initiated. Representatives from the Air Transport Association (ATA), Association of European Airlines (AEA), the Association of Asia Pacific Airlines (AAPA), the Aerospace Industries Association of America, and the European Association of Aerospace Industries initiated a joint effort to inspect and evaluate the condition of the fuel tank system installations on a representative sample of airplanes within the transport fleet. The fuel tanks of more than 800 airplanes were inspected. Data from inspections conducted as part of this effort and shared with the FAA have assisted in establishing a basis for developing corrective action for airplanes within the transport fleet.

In addition to the results from these inspections, the FAA has received reports of anomalies on in-service airplanes that have necessitated actions to preclude development of ignition sources in or adjacent to airplane fuel tanks.

The following provides a summary of findings from design evaluations, service difficulty reports, and a review of current airplane maintenance practices.

Aging Airplane Related Phenomena

Fuel tank inspections initiated as part of the Boeing Model 747 accident investigation identified aging of fuel tank system components, contamination, corrosion of components and sulfide deposits on components as possible conditions that could contribute to development of ignition sources within the fuel tanks. Results of detailed inspection of the fuel pump wiring on several Boeing Model 747 airplanes showed debris within the fuel tanks consisting of lockwire, rivets, and metal shavings. Debris was also found inside scavenge pumps. Corrosion and damage to insulation on FQIS probe wiring was found on 6 out of 8 probes removed from one in-service airplane.

In addition, inspection of airplane fuel tank system components from out-of-service (retired) airplanes, initiated following the accident, revealed damaged wiring and corrosion buildup of conductive sulfide deposits on the FQIS wiring on some Boeing Model 747 airplanes. The conductive deposits or damaged wiring may result in a location where arcing could occur if high power electrical energy was transmitted to the FQIS wiring from adjacent wires that power other airplane systems.

While the effects of corrosion on fuel tank system safety have not been fully evaluated, the FAA has initiated a research program to better understand the effects of sulfide deposits and corrosion on the safety of airplane fuel tank systems.

Wear or chafing of electrical power wires routed in conduits that are located inside fuel tanks can result in arcing through the conduits. On December 23, 1996, the FAA issued Airworthiness Directive (AD) 96-26-06, applicable to certain Boeing Model 747 airplanes, which required inspection of electrical wiring routed within conduits to fuel pumps located in the wing fuel tanks and replacement of any damaged wiring. Inspection reports indicated that many instances of wear had occurred on Teflon sleeves installed over the wiring to protect it from damage and possible arcing to the conduit.

Inspections of wiring to fuel pumps on Boeing Model 737 airplanes with over 35,000 flight hours have shown significant wear to the insulation of wires inside conduits that are located in fuel tanks. In nine reported cases, wear resulted in arcing to the fuel pump wire conduit on airplanes with greater than 50,000 flight hours. In one case, wear resulted in burnthrough of the conduit into the interior of the 737 main tank fuel cell. On May 14, 1998, the FAA issued a telegraphic AD, T98-11-52, which required inspection of wiring to Boeing Model 737 airplane fuel pumps routed within electrical conduits and replacement of any damaged wiring. Results of these inspections showed that wear of the wiring occurred in many instances, particularly on those airplanes with high numbers of flight cycles and operating hours.

The FAA also has received reports of corrosion on bonding jumper wires within the fuel tanks on one in-service Airbus Model A300 airplane. The manufacturer investigating this event did not have sufficient evidence to determine conclusively the level of damage and corrosion found on the jumper wires. Although the airplane was in long-term storage, it does not explain why a high number of damaged/corroded jumper wires were found concentrated in a specific area of the wing tanks. Further inspections of a limited number of other Airbus models did not reveal similar extensive corrosion or damage to bonding jumper wires. However, they did reveal evidence of the accumulation of sulfide deposits around the outer braid of some jumper wires. Tests by the manufacturer have shown that these deposits did not affect the bonding function of the leads. Airbus has developed a one-time-inspection service bulletin for all its airplanes to ascertain the extent of the sulfide deposits and to ensure that the level of jumper wire damage found on the one Model A300 airplane is not widespread.

On March 30, 1998, the FAA received reports of three recent instances of electrical arcing within fuel pumps installed in fuel tanks on Lockheed Model L-1011 airplanes. In one case, the electrical arc had penetrated the pump and housing and entered the fuel tank. Preliminary investigation indicates that features incorporated into the fuel pump design that were intended to preclude overheating and arc-through into the fuel tank may not have functioned as intended due to discrepancies introduced during overhaul of the pumps. Emergency AD 98-08-09 was issued April 3, 1998, to specify a minimum quantity of fuel to be carried in the fuel tanks for the purpose of covering the pumps with liquid fuel and thereby precluding ignition of vapors within the fuel tank until such time as terminating corrective action could be developed.

Unforeseen Fuel Tank System Failures

After an extensive review of the Boeing Model 747 design following the July 17, 1996, accident, the FAA determined that during original certification of the fuel tank system, the degree of tank contamination and the significance of certain failure modes of fuel tank system components had not been considered to the extent that more recent service experience indicates is needed. For example, in the absence of contamination, the FQIS had been shown to preclude creating an arc if FQIS wiring were to come in contact with the highest level of electrical voltage on the airplane. This was shown by demonstrating that the voltage needed to cause an arc in the fuel probes due to an electrical short condition was well above any voltage level available in the airplane systems.

However, recent testing has shown that if contamination, such as conductive debris (lock wire, nuts, bolts, steel wool, corrosion, sulfide deposits, metal filings, etc.) is placed within gaps in the fuel probe, the voltage needed to cause an arc is within values that may occur due to a subsequent electrical short or induced current on the FQIS probe wiring from electromagnetic interference caused by adjacent wiring. These anomalies, by themselves, could not lead to an electrical arc within the fuel tanks without the presence of an additional failure. If any of these anomalies were combined with a subsequent failure within the electrical system that creates an electrical short, or if high-intensity radiated fields (HIRF) or electrical current flow in adjacent wiring induces EMI voltage in the FQIS wiring, sufficient energy could enter the fuel tank and cause an ignition source within the tank.

On November 26, 1997, in Docket No. 97-NM-272-AD, the FAA proposed a requirement for operators of Boeing Model 747-100, -200, and -300 series airplanes to install components for the suppression of electrical transients and/or the installation of shielding and separation of fuel quantity indicating system wiring from other airplane system wiring. After reviewing the comments received on the proposed requirements, the FAA issued AD 98-20-40 on September 23, 1998, that requires the installation of shielding and separation of the electrical wiring of the fuel quantity indication system. On April 14, 1998, the FAA proposed a similar requirement for Boeing Model 737-100, -200, -300, -400, and -500 series airplanes in Docket No. 98-NM-50-AD, which led to the FAA issuing AD 99-03-04 on January 26, 1999. The action required by those two airworthiness directives is intended to preclude high levels of electrical energy from entering the airplane fuel tank wiring due to electromagnetic interference or electrical shorts. Several manufacturers have been granted approval for the use of alternative methods of compliance (AMOC) with these AD's that permit installation of transient suppressing devices in the FQIS wiring that prevent unwanted electrical power from entering the fuel tank. All later model Boeing Model 747 and 737 FQIS's have wire separation and fault isolation features that may meet the intent of these AD actions. This rulemaking will require evaluation of these later designs and the designs of other transport airplanes.

Other examples of unanticipated failure conditions include incidents of parts from fuel pump assemblies impacting or contacting the rotating fuel pump impeller. The first design anomaly was identified when two incidents of damage to fuel pumps were reported on Boeing Model 767 airplanes. In both cases objects from a fuel pump inlet diffuser assembly were ingested into the fuel pump, causing damage to the pump impeller and pump housing. The damage could have caused sparks or hot debris from the pump to enter the fuel tank. To address this unsafe condition, the FAA issued AD 97-19-15. This AD requires revision of the airplane flight manual to include procedures to switch off the fuel pumps when the center tank approaches empty. The intent of this interim action is to maintain liquid fuel over the pump inlet so that any debris generated by a failed fuel pump will not come in contact with fuel vapors and cause a fuel tank explosion.

The second design anomaly was reported on Boeing Model 747-400 series airplanes. The reports indicated that inlet adapters of the override/jettison pumps of the center wing fuel tank were worn. Two of the inlet adapters had worn down enough to cause damage to the rotating blades of the inducer. The inlet check valves also had significant damage. An operator reported damage to the inlet adapter so severe that contact had occurred between the steel disk of the inlet check valve and the steel screw that holds the inducer in place. Wear to the inlet adapters has been attributed to contact between the inlet check valve and the adapter. Such excessive wear of the inlet adapter can lead to contact between the inlet check valve and inducer, which could result in pieces of the check valve being ingested into the inducer and damaging the inducer and impellers. Contact between the steel disk of the inlet check valve and the steel rotating inducer screw can cause sparks. To address this unsafe condition, the FAA issued an immediately adopted rule, AD 98-16-19, on July 30, 1998.

Another design anomaly was reported in 1989 when a fuel tank ignition event occurred in an auxiliary fuel tank during refueling of a Beech Model 400 airplane. The auxiliary fuel tank had been installed under an STC. Polyurethane foam had been installed in portions of the tank to minimize the potential of a fuel tank explosion if uncontained engine debris penetrated those portions of the tank. The accident investigation indicated that electrostatic charging of the foam during refueling resulted in ignition of fuel-air vapors in portions of the adjacent fuel tank system that did not contain the foam. The fuel vapor explosion caused distortion of the tank and fuel leakage from a failed fuel line. Modifications to the design, including use of more conductive polyurethane foam and installation of a standpipe in the refueling system, were incorporated to prevent reoccurrence of electrostatic charging and a resultant fuel tank ignition source.

Review of Fuel Tank System Maintenance Practices

In addition to the review of the design features and service history of the Boeing Model 747 and other airplane models in the transport airplane fleet, the FAA also has reviewed the current fuel tank system maintenance practices for these airplanes.

Typical transport category airplane fuel tank systems are designed with redundancy and fault indication features such that single component failures do not result in any significant reduction in safety. Therefore, fuel tank systems historically have not had any life-limited components or specific detailed inspection requirements, unless mandated by airworthiness directives.

Most of the components are “on condition,” meaning that some test, check, or other inspection is performed to determine continued serviceability, and maintenance is performed only if the inspection identifies a condition requiring correction. Visual inspection of fuel tank system components is by far the predominant method of inspection for components such as boost pumps, fuel lines, couplings, wiring, etc. Typically, these inspections are conducted concurrently with zonal inspections or internal or external fuel tank structural inspections. These inspections normally do not provide information regarding the continued serviceability of components within the fuel tank system, unless the visual inspection indicates a potential problem area. For example, it would be difficult, if not impossible, to detect certain degraded fuel tank system conditions, such as worn wiring routed through conduit to fuel pumps, debris inside fuel pumps, corrosion to bonding wire interfaces, etc., without dedicated intrusive inspections that are much more extensive than those normally conducted.

Listing of Deficiencies

The list provided below summarizes fuel tank system design deficiencies, malfunctions, failures, and maintenance-related actions that have been determined through service experience to result in a degradation of the safety features of airplane fuel tank systems. This list was developed from service difficulty reports and incident and accident reports. These anomalies occurred on in-service transport category airplanes despite regulations and policies in place to preclude the development of ignition sources within airplane fuel tank systems.

1. Pumps:

• Ingestion of the pump inducer into the pump impeller and generation of debris into the fuel tank.
• Pump inlet case degradation, allowing the pump inlet check valve to contact the impeller.
• Stator winding failures during operation of the fuel pump. Subsequent failure of a second phase of the pump resulting in arcing through the fuel pump housing.
• Deactivation of thermal protective features incorporated into the windings of pumps due to inappropriate wrapping of the windings.
• Omission of cooling port tubes between the pump assembly and the pump motor assembly during fuel pump overhaul.
• Extended dry running of fuel pumps in empty fuel tanks, which was contrary to the manufacturer's recommended procedures.
• Use of steel impellers that may produce sparks if debris enters the pump.
• Debris lodged inside pumps.
• Arcing due to the exposure of electrical connections within the pump housing that have been designed with inadequate clearance to the pump cover.
• Thermal switches resetting over time to a higher trip temperature.
• Flame arrestors falling out of their respective mounting.
• Internal wires coming in contact with the pump rotating group, energizing the rotor and arcing at the impeller/adapter interface.
• Poor bonding across component interfaces.
• Insufficient ground fault current protection capability.
• Poor bonding of components to structure.

2. Wiring to pumps in conduits located inside fuel tanks:

• Wear of Teflon sleeving and wiring insulation allowing arcing from wire through metallic conduits into fuel tanks.

3. Fuel pump connectors:

• Electrical arcing at connections within electrical connectors due to bent pins or corrosion.
• Fuel leakage and subsequent fuel fire outside of the fuel tank caused by corrosion of electrical connectors inside the pump motor which lead to electrical arcing through the connector housing (connector was located outside the fuel tank).
• Selection of improper materials in connector design.

4. FQIS wiring:

• Degradation of wire insulation (cracking), corrosion and sulfide deposits at electrical connectors
• Unshielded FQIS wires routed in wire bundles with high voltage wires.

5. FQIS probes:

• Corrosion and sulfide deposits causing reduced breakdown voltage in FQIS wiring.
• Terminal block wiring clamp (strain relief) features at electrical connections on fuel probes causing damage to wiring insulation.
• Contamination in the fuel tanks causing a reduced arc path between FQIS probe walls (steel wool, lock wire, nuts, rivets, bolts; or mechanical impact damage to probes).

6. Bonding straps:

• Corrosion to bonding straps.
• Loose or improperly grounded attachment points.
• Static bonds on fuel tank system plumbing connections inside the fuel tank worn due to mechanical wear of the plumbing from wing movement and corrosion.

7. Electrostatic charge:

• Use of non-conductive reticulated polyurethane foam that holds electrostatic charge buildup.
• Spraying of fuel into fuel tanks through inappropriately designed refueling nozzles or pump cooling flow return methods.

Fuel Tank Flammability

In addition to the review of potential fuel tank ignition, the FAA has undertaken a parallel effort to address the threat of fuel tank explosions by eliminating or significantly reducing the presence of explosive fuel air mixtures within the fuel tanks of new type designs, in-production, and the existing fleet of transport airplanes.

On April 3, 1997, the FAA published a notice in the Federal Register (62 FR 16014) that requested comments concerning the 1996 NTSB recommendations regarding reduced flammability listed earlier in this notice. That notice provided significant discussion of service history, background, and issues relating to reducing flammability in transport airplane fuel tanks. Review of the comments submitted to that notice indicated that additional information was needed before the FAA could initiate rulemaking action to address the recommendations.

On January 23, 1998, the FAA published a notice in the Federal Register that established and tasked an Aviation Rulemaking Advisory Committee (ARAC) working group, the Fuel Tank Harmonization Working Group (FTHWG), to provide additional information prior to rulemaking. The ARAC consists of interested parties, including the public, and provides a public process to advise the FAA concerning development of new regulations.

Note:

The FAA formally established ARAC in 1991 (56 FR 2190, January 22, 1991), to provide advice and recommendations concerning the full range of the FAA's safety-related rulemaking activity.

The FTHWG evaluated numerous possible means of reducing or eliminating hazards associated with explosive vapors in fuel tanks. On July 23, 1998, the ARAC submitted its report to the FAA. The full report is in the docket created for this ARAC working group (Docket No. FAA-1998-4183). This docket can be reviewed on the U.S. Department of Transportation electronic Document Management System on the Internet at http://dms.dot.gov. The full report is also in the docket for this rulemaking.

The report provided a recommendation for the FAA to initiate rulemaking action to amend § 25.981, applicable to new type design airplanes, to include a requirement to limit the time transport airplane fuel tanks could operate with flammable vapors in the vapor space of the tank. The recommended regulatory text proposed, “Limiting the development of flammable conditions in the fuel tanks, based on the intended fuel types, to less than 7 percent of the expected fleet operational time, or providing means to mitigate the effects of an ignition of fuel vapors within the fuel tanks such that any damage caused by an ignition will not prevent continued safe flight and landing.” The report discussed various options of showing compliance with this proposal, including managing heat input to the fuel tanks, installation of inerting systems or polyurethane fire suppressing foam, and suppressing an explosion if one occurred, etc.

The level of flammability defined in the proposal was established based upon comparison of the safety record of center wing fuel tanks that, in certain airplanes, are heated by equipment located under the tank, and unheated fuel tanks located in the wing. The FTHWG concluded that the safety record of fuel tanks located in the wings was adequate and that if the same level could be achieved in center wing fuel tanks, the overall safety objective would be achieved. Results from thermal analyses documented in the report indicate that center wing fuel tanks that are heated by air conditioning equipment located beneath them contain flammable vapors, on a fleet average basis, for up to 30 percent of the fleet operating time.

During the ARAC review it was also determined that certain airplane types do not locate heat sources adjacent to the fuel tanks. These airplanes provide significantly reduced flammability exposure, near the 5 percent value of the wing tanks. The group therefore determined that it would be feasible to design new airplanes such that fuel tank operation in the flammable range would be limited to near that of the wing fuel tanks. The primary method of compliance with the requirement proposed by the ARAC would likely be to control heat transfer into and out of fuel tanks such that heating of the fuel would not occur. Design features such as locating the air conditioning equipment away from the fuel tanks, providing ventilation of the air conditioning bay to limit heating and cool fuel tanks, and/or insulating the tanks from heat sources, would be practical means of complying with the regulation proposed by the ARAC.

In addition to its recommendation to revise § 25.981, the ARAC also recommended that the FAA continue to evaluate means for minimizing the development of flammable vapors within the fuel tanks to determine whether other alternatives, such as ground based inerting of fuel tanks, could be shown to be cost effective.

To address the ARAC recommendations, the FAA initiated research and development activity to determine the feasibility of requiring ground-based inerting. The results of this activity are documented in report No. DOT/FAA/AR-00/19, “The Cost of Implementing Ground-Based Fuel Tank Inerting in the Commercial Fleet.” A copy of the report is in the docket for this rulemaking. In addition, on July 14, 2000 (65 FR 43800), the FAA tasked the ARAC to conduct a technical evaluation of certain fuel tank inerting methods that would reduce the flammability of the fuel tanks on both new type designs and in-service airplanes.

The FAA is also evaluating the potential benefits of using directed ventilation methods to reduce the flammability exposure of fuel tanks that are located near significant heat sources.

Discussion of the Final Rule

The FAA review of the service history, design features, and maintenance instructions of the transport airplane fleet indicates that aging of fuel tank system components and unforeseen fuel tank system failures and malfunctions have become a safety issue for the fleet of turbine-powered transport category airplanes. The FAA is amending the current regulations in four areas.

The first area of concern encompasses the possibility of the development of ignition sources within the existing transport airplane fleet. Many of the design practices used on airplanes in the existing fleet are similar. Therefore, anomalies that have developed on specific airplane models within the fleet could develop on other airplane models. As a result, the FAA considers that a one-time safety review of the fuel tank system for transport airplane models in the current fleet is needed.

The second area of concern encompasses the need to require the design of future transport category airplanes to more completely address potential failures in the fuel tank system that could result in an ignition source in the fuel tank system.

Third, certain airplane types are designed with heat sources adjacent to the fuel tank, which results in heating of the fuel and a significant increase in the formation of flammable vapors in the tank. The FAA considers that fuel tank safety can be enhanced by reducing the time fuel tanks operate with flammable vapors in the tank and is therefore adopting a requirement to provide means to minimize the development of flammable vapors in fuel tanks, or to provide means to prevent catastrophic damage if ignition does occur.

Fourth, the FAA considers that it is necessary to impose operational requirements so that all required maintenance or inspection actions will be included in each operator's FAA-approved maintenance or inspection program.

These regulatory initiatives are being codified as a Special Federal Aviation Regulation (14 CFR part 21), amendments to the airworthiness regulations (14 CFR part 25), and amendments to the operating requirements (14 CFR parts 91, 121, 125, 129)

Part 21 Special Federal Aviation Regulation (SFAR)

Historically, the FAA works with the TC holders when safety issues arise to identify solutions and actions that need to be taken. Some of the safety issues that have been addressed by this voluntary cooperative process include those involving aging aircraft structure, thrust reversers, cargo doors, and wing icing protection. Although some manufacturers have aggressively completed these safety reviews, others have not applied the resources necessary to complete these reviews in a timely manner, which delayed the adoption of corrective action. Although these efforts have frequently been successful in achieving the desired safety objectives, a more uniform and expeditious response is considered necessary to address fuel tank safety issues.

While maintaining the benefits of FAA-TC holder cooperation, the FAA considers that a Special Federal Aviation Regulation (SFAR) provides a means for the FAA to establish clear expectations and standards, as well as a timeframe within which the design approval holders and the public can be confident that fuel tank safety issues on the affected airplanes will be uniformly examined.

This final rule is intended to ensure that the design approval holder completes a comprehensive assessment of the fuel tank system and develops any required inspections, maintenance instructions, or modifications.

Safety Review

The SFAR requires the design approval holder to perform a safety review of the fuel tank system to show that fuel tank fires or explosions will not occur on airplanes of the approved design. In conducting the review, the design approval holder must demonstrate compliance with the new standards adopted for § 25.981(a) and (b) (discussed below) and the existing standards of § 25.901. As part of this review, the design approval holder must submit a report to the cognizant FAA Aircraft Certification Office (ACO) that substantiates that the fuel tank system is fail-safe.

The FAA intends that those failure conditions identified earlier in this document, and any other foreseeable failures, should be assumed when performing the safety review needed to substantiate that the fuel tank system design is fail-safe. The safety review should be prepared considering all airplane inflight, ground, service, and maintenance conditions, assuming that an explosive fuel air mixture is present in the fuel tanks at all times, unless the fuel tank has been purged of fuel vapor for maintenance. The design approval holder is expected to develop a failure modes and effects analysis (FMEA) for all components in the fuel tank system. Analysis of the FMEA would then be used to determine whether single failures, alone or in combination with foreseeable latent failures, could cause an ignition source to exist in a fuel tank. A subsequent quantitative fault tree analysis should then be developed to determine whether combinations of failures expected to occur in the life of the affected fleet could cause an ignition source to exist in a fuel tank system.

Because fuel tank systems typically have few components within the fuel tank, the number of possible internal sources of ignition is limited. The safety review required by this final rule includes all components or systems that could introduce a source of fuel tank ignition. This may require analysis of not only the fuel tank system components, (e.g., pumps, fuel pump power supplies, fuel valves, fuel quantity indication system probes, wiring, compensators, densitometers, fuel level sensors, etc.), but also other airplane systems that may affect the fuel tank system. For example, failures in airplane wiring or electromagnetic interference from other airplane systems that were not properly accounted for in the original safety assessment could cause an ignition source in the airplane fuel tank system under certain conditions and therefore would have to be included in the system safety analysis.

The intent of the safety review is to assure that each fuel tank system design that is affected by this action will be fully assessed and that the design approval holder identifies any required modifications, added flight deck or maintenance indications, and/or maintenance actions necessary to meet the fail-safe criteria.

Maintenance Instructions

The FAA anticipates that the safety review will identify critical areas of the fuel tank and other related systems that require maintenance actions to account for the affects of aging, wear, corrosion, and possible contamination on the fuel tank system. For example, service history indicates that sulfide deposits may form on fuel tank components, including bonding straps and FQIS components, which could degrade the intended design capabilities by providing a mechanism by which arcing could occur. Therefore, it might be necessary to provide maintenance instructions to identify and eliminate such deposits.

The SFAR requires the design approval holder to develop any specific maintenance and inspection instructions necessary to maintain the design features required to preclude the existence or development of an ignition source within the fuel tank system. These instructions must be established to ensure that an ignition source will not develop throughout the remaining operational life of the airplane.

Possible Airworthiness Directives

The safety review may also result in identification of unsafe conditions on certain airplane models that would require issuance of airworthiness directives. For example, the FAA has required or proposed requirements for design changes to the following airplanes:

• Boeing Models 737, 747, and 767;
• Boeing Douglas Products Division (formerly, McDonnell Douglas) Model DC-9 and DC-10;
• Lockheed Model L-1011;
• Bombardier (Canadair) Model CL-600;
• Airbus Models A300-600R, A319, A320, and A321;
• CASA Model C-212;
• British Aerospace (Jetstream) Model 4100; and
• Fokker Model F28.

Design practices used on these models may be similar to those of other airplane types; therefore, the FAA expects that modifications to airplanes with similar design features may also be required.

The number and scope of any possible AD's may vary by airplane type design. For example, wiring separation and shielding of FQIS wires on newer technology airplanes significantly reduces the likelihood of an electrical short causing an electrical arc in the fuel tank; many newer transport airplanes do not route electrical power wiring to fuel pumps inside the airplane fuel tanks. Therefore, some airplane models may not require significant modifications or additional dedicated maintenance procedures.

Other models may require significant modifications or more maintenance. For example, the FQIS wiring on some older technology airplanes is routed in wire bundles with high voltage power supply wires. The original failure analyses conducted on these airplane types did not consider the possibility that the fuel quantity indication system may become degraded, allowing a significantly lower voltage level to produce a spark inside the fuel tank. Causes of degradation observed in service include aging, corrosion, or undetected contamination of the system. As previously discussed, the FAA has issued AD actions for certain Boeing Model 737 and 747 airplanes to address this condition. Modification of similar types of installations on other airplane models may be required to address this unsafe condition and to achieve a fail-safe design.

It should be noted that any design changes might, in themselves, require maintenance actions. For example, transient protection devices typically require scheduled maintenance in order to detect latent failure of the suppression feature. As a part of the required safety review, the manufacturer is expected to define the necessary maintenance procedures and intervals for any required maintenance actions.

Applicability of the SFAR

The requirements of the SFAR are applicable to holders of TC's, and STC's for modifications that affect the fuel tank systems of turbine-powered transport category airplanes, for which the TC was issued after January 1, 1958, and the airplane has either a maximum type certificated passenger capacity of 30 or more, or a maximum type certificated payload capacity of 7,500 pounds or more.

The SFAR is also applicable to applicants for type certificates, amendments to a type certificate, and supplemental type certificates affecting the fuel tank systems for those airplanes identified above, if the application was filed before the effective date of the SFAR and the certificate was not issued before the effective date of the SFAR.

The FAA has determined that turbine-powered airplanes, regardless of whether they are turboprops or turbojets, should be subject to the rule, because the potential for ignition sources in fuel tank systems is unrelated to the engine design. This results in the coverage of the large transport category airplanes where the safety benefits and public interest are greatest. This action affects approximately 7,000 U.S. registered airplanes in part 91, 121, 125, and 129 operations.

The date January 1, 1958, was chosen so that only turbine-powered airplanes, except for a few 1953-1958 vintage Convair 340s and 440s converted from reciprocating power, will be included. No reciprocating-powered transport category airplanes are known to be used currently in passenger service, and the few remaining in cargo service would be excluded. Compliance is not required for those older airplanes because their advanced age and small numbers would likely make compliance impractical from an economic standpoint. This is consistent with similar exclusions made for those airplanes from other requirements applicable to existing airplanes, such as the regulations adopted for flammability of seat cushions (49 FR 43188, October 24, 1984); flammability of cabin interior components (51 FR 26206, July 21, 1986); cargo compartment liners (54 FR 7384, February 17, 1989); access to passenger emergency exits (57 FR 19244, May 4, 1992); and Class D cargo or baggage compartments (63 FR 8032, February 17, 1998).

In order to achieve the benefits of this rulemaking for large transport airplanes as quickly as possible, the FAA has decided to limit the applicability of the SFAR to airplanes with a maximum certificated passenger capacity of at least 30 or at least 7,500 pounds payload. Compliance is not required for smaller airplanes because it is not clear at this time that the possible benefits for those airplanes would be commensurate with the costs involved. For now, the applicability of the rule will remain as proposed in the notice. The FAA will need to conduct the economic analysis to determine if the rule should be applied to smaller airplanes. Should the results of the analysis be favorable, the FAA will develop further rulemaking to address the smaller transports.

Applicability of SFAR to Supplemental Type Certificate (STC) Holders

The SFAR applies to STC holders as well, because a significant number of STC's effect changes to fuel tank systems, and the objectives of this rule would not be achieved unless these systems are also reviewed and their safety ensured. The service experience noted in the background of this rule indicates modifications to airplane fuel tank systems incorporated by STC's may affect the safety of the fuel tank system.

Modifications that could affect the fuel tank system include those that could result in an ignition source in the fuel tank. Examples include installation of auxiliary fuel tanks and installation of, or modification to, other systems such as the fuel quantity indication system, the fuel pump system (including electrical power supply), airplane refueling system, any electrical wiring routed within or adjacent to the fuel tank, and fuel level sensors or float switches. Modifications to systems or components located outside the fuel tank system may also affect fuel tank safety. For example, installation of electrical wiring for other systems that was inappropriately routed with FQIS wiring could violate the wiring separation requirements of the type design. Therefore, the FAA intends that a fuel tank system safety review be conducted for any modification to the airplane that may affect the safety of the fuel tank system. The level of evaluation that is intended would be dependent upon the type of modification. In most cases a simple qualitative evaluation of the modification in relation to the fuel tank system, and a statement that the change has no effect on the fuel tank system, would be all that is necessary. In other cases where the initial qualitative assessment shows that the modification may affect the fuel tank system, a more detailed safety review would be required.

Design approvals for modification of airplane fuel tank systems approved by STC's require the applicant to have knowledge of the airplane fuel tank system in which the modification is installed. The majority of these approvals are held by the original airframe manufacturers or airplane modifiers that specialize in fuel tank system modifications, such as installation of auxiliary fuel tanks. Therefore, the FAA expects that the data needed to complete the required safety review identified in the SFAR would be available to the STC holder.

Compliance With SFAR

This rule provides an 18-month compliance time from the effective date of the final rule, or within 18 months after the issuance of a certificate for which application was filed before the effective date of this SFAR, whichever is later, for design approval holders to conduct the safety review and develop the compliance documentation and any required maintenance and inspection instructions. (Applicants whose applications have not been approved as of the effective date would be allowed 18 months after the approval to comply.) The FAA expects each design approval holder to work with the cognizant FAA Aircraft Certification Office (ACO) and Aircraft Evaluation Group (AEG) to develop a plan to complete the safety review and develop the required maintenance and inspection instructions within the 18-month period. The plan should include periodic reviews with the ACO and AEG of the ongoing safety review and the associated maintenance and inspection instructions.

During the 18-month compliance period, the FAA is committed to working with the affected design approval holders to assist them in complying with the requirements of the SFAR. However, failure to comply within the specified time would constitute a violation of the requirements and may subject the violator to certificate action to amend, suspend, or revoke the affected certificate in accordance with 49 U.S.C. § 44709. In accordance with 49 U.S.C. § 46301, it may also subject the violator to a civil penalty of not more than $1,100 per day until the SFAR is complied with.

Changes to Operating Requirements

This rule requires the affected operators to incorporate FAA-approved fuel tank system maintenance and inspection instructions in their maintenance or inspection program required under the applicable operating rule within 36 months of the effective date of the rule. If the design approval holder has complied with the SFAR and developed an FAA-approved program, the operator can incorporate that program, including any revisions needed to address any modifications to the original type design, to meet the proposed requirement. The operator also has the option of developing its own program independently, and is ultimately responsible for having an FAA-approved program, regardless of the action taken by the design approval holder.

The rule prohibits the operation of certain transport category airplanes operated under parts 91, 121, 125, and 129 beyond the specified compliance time, unless the operator of those airplanes has incorporated FAA-approved fuel tank maintenance and inspection instructions in its maintenance or inspection program, as applicable. The rule requires approval of the maintenance and inspection instructions by the FAA ACO, or office of the Transport Airplane Directorate, having cognizance over the type certificate for the affected airplane The operator would need to consider the following five issues:

1. The fuel tank system maintenance and inspection instructions that would be incorporated into the operator's existing maintenance or inspection program must be approved by the FAA ACO having cognizance over the type certificate or supplemental type certificate. If the operator can establish that the existing maintenance and inspection instructions fulfill the requirements of this rule, then the ACO may approve the operator's existing maintenance and inspection instructions without change.

2. The means by which the FAA-approved fuel tank system maintenance and inspection instructions are incorporated into a certificate holder's FAA-approved maintenance or inspection program is subject to approval by the certificate holder's principal maintenance inspector (PMI) or other cognizant airworthiness inspector. The FAA intends that any escalation to the FAA-approved inspection intervals will require the operator to receive approval of the amended program from the cognizant ACO or office of the Transport Airplane Directorate. Any request for escalation to the FAA approved inspection intervals must include data to substantiate that the proposed interval will provide the level of safety intended by the original approval. If inspection results and service experience indicate that additional or more frequent inspections are necessary, the FAA may issue AD's to mandate such changes to the inspection program.

3. This rule does not impose any new reporting requirements; however, normal reporting required under 14 CFR 121.703 and 125.409 still applies.

4. This rule does not impose any new FAA recordkeeping requirements. However, as with all maintenance, the current operating regulations (e.g., 14 CFR 121.380 and 91.417) already impose recordkeeping requirements that apply to the actions required by this rule. When incorporating the fuel tank system maintenance and inspection instructions into its approved maintenance or inspection program, each operator should address the means by which it will comply with these recordkeeping requirements. That means of compliance, along with the remainder of the program, are subject to approval by the cognizant PMI or other cognizant airworthiness inspector.

5. The maintenance and inspection instructions developed by the TC holder under the rule generally do not apply to portions of the fuel tank systems modified in accordance with an STC, field approval, or otherwise, including any auxiliary fuel tank installations. Similarly, STC holders are required to provide instructions for their STC's. The operator, however, is still responsible for incorporating specific maintenance and inspection instructions applicable to the entire fuel tank system of each airplane that meets the requirements of this rule. This means that the operator must evaluate the fuel tank systems and any alterations to the fuel tank system not addressed by the instructions provided by the TC or STC holder, and then develop, submit, and gain FAA approval of the maintenance and inspection instructions to evaluate changes to the fuel tank systems.

The FAA recognizes that operators may not have the resources to develop maintenance or inspection instructions for the airplane fuel tank system. The rule therefore requires the TC and STC holders to develop fuel tank system maintenance and inspection instructions that may be used by operators. If however, the STC holder is out of business or otherwise unavailable, the operator will independently have to acquire the FAA-approved inspection instructions. To keep the airplanes in service, operators, either individually or as a group, could hire the necessary expertise to develop and gain approval of maintenance and inspection instructions. Guidance on how to comply with this aspect of the rule will be provided in AC 25.981-1B.

After the PMI having oversight responsibilities is satisfied that the operator's continued airworthiness maintenance or inspection program contains all of the elements of the FAA-approved fuel tank system maintenance and inspection instructions, the airworthiness inspector will approve the maintenance or inspection program revision. This approval has the effect of requiring compliance with the maintenance and inspection instructions.

Applicability of the Operating Requirements

This rule prohibits the operation of certain transport category airplanes operated under 14 CFR parts 91, 121, 125, and 129 beyond the specified compliance time, unless the operator of those airplanes has incorporated FAA-approved specific maintenance and inspection instructions applicable to the fuel tank system in its approved maintenance or inspection program, as applicable. The operational applicability was established so that all airplane types affected by the SFAR, regardless of type of operation, are subject to FAA approved fuel tank system maintenance and inspection procedures. As discussed earlier, this rule includes each turbine-powered transport category airplane model, provided its TC was issued after January 1, 1958, and it has either a maximum type certificated passenger capacity of 30 or more, or a maximum type certificated payload capacity of 7,500 pounds or more.

Affect on Field Approvals

A significant number of changes to transport category airplane fuel tank systems have been incorporated through field approvals issued to the operators of those airplanes. These changes may also significantly affect the safety of the fuel tank system. The operator of any airplane with such changes is required to develop the fuel tank system maintenance and inspection program instructions and submit it to the FAA for approval, together with the necessary substantiation of compliance with the safety review requirements of the SFAR.

Compliance With Operating Requirements

This rule establishes a 36-month compliance time from the effective date of the rule for operators to incorporate FAA-approved, long-term, fuel tank system maintenance and inspection instructions into their approved program. The FAA expects each operator to work with the airplane TC holder or STC holder to develop a plan to implement the required maintenance and inspection instructions within the 36-month period. The plan should include periodic reviews with the cognizant ACO and AEG responsible for approval of the associated maintenance and inspection instructions.

The fuel tank safety review may result in maintenance actions that are overdue prior to the effective date of the operational rules. The plan provided by the operator should include recommended timing of initial inspections or maintenance actions that are incorporated in the long term maintenance or inspection program. An analysis of and supporting evidence for the proposed timing of the initial action should be provided to the FAA. For example, it may be determined that an inspection of a certain component should be conducted after 50,000 flight hours. Some airplanes within the fleet may have accumulated over 50,000 flight hours. The timing of the initial inspection must be approved by the FAA and would be dependent upon an evaluation of the safety impact of the inspection. It is desirable to incorporate these inspections in the current heavy maintenance program, such as a “C” or “D” check, without taking airplanes out of service. However, it may be determined that more expeditious action is required, which may be mandated by AD.

Changes to Part 25

Currently, § 25.981 defines limits on surface temperatures within transport airplane fuel tank systems. In order to address future airplane designs, § 25.981 is revised to address both prevention of ignition sources in fuel tanks, and reduction in the time fuel tanks contain flammable vapors. The first part explicitly includes a requirement for effectively precluding ignition sources within the fuel tank systems of transport category airplanes. The second part requires minimizing the formation of flammable vapors in the fuel tanks.

Fuel Tank Ignition Source—Section 25.981

The title of § 25.981 is changed from “Fuel tank temperature” to “Fuel tank ignition prevention.” The substance of existing paragraph (a), which requires the applicant to determine the highest temperature that allows a safe margin below the lowest expected auto ignition temperature of the fuel, is retained. Likewise, the substance of existing paragraph (b), which requires precluding the temperature in the fuel tank from exceeding the temperature determined under paragraph (a), is also retained. These requirements are redesignated as (a)(1) and (2) respectively.

Compliance with these paragraphs requires the determination of the fuel flammability characteristics of the fuels approved for use. Fuels approved for use on transport category airplanes have differing flammability characteristics. The fuel with the lowest autoignition temperature is JET A (kerosene), which has an autoignition temperature of approximately 450°F at sea level. The autoignition temperature of JP-4 is approximately 470°F at sea level. Under the same atmospheric conditions, the autoignition temperature of gasoline is approximately 800°F. The autoignition temperature of these fuels increases at increasing altitudes (lower pressures). For the purposes of this rule, the lowest temperature at which autoignition can occur for the most critical fuel approved for use should be determined. A temperature providing a safe margin is at least 50°F below the lowest expected autoignition temperature of the fuel throughout the altitude and temperature envelopes approved for the airplane type for which approval is requested.

This rulemaking also adds a new paragraph (a)(3) to require that a safety analysis be performed to demonstrate that the presence of an ignition source in the fuel tank system could not result from any single failure, from any single failure in combination with any latent failure condition not shown to be extremely remote, or from any combination of failures not shown to be extremely improbable.

These new requirements define three scenarios that must be addressed in order to show compliance with paragraph (a)(3). The first scenario is that any single failure, regardless of the probability of occurrence of the failure, must not cause an ignition source. The second scenario is that any single failure, regardless of the probability occurrence, in combination with any latent failure condition not shown to be at least extremely remote (i.e., not shown to be extremely remote or extremely improbable), must not cause an ignition source. The third scenario is that any combination of failures not shown to be extremely improbable must not cause an ignition source.

For the purpose of this rule, “extremely remote” failure conditions are those not anticipated to occur to each airplane during its total life, but which may occur a few times when considering the total operational life of all airplanes of the type. This definition is consistent with that proposed by the ARAC for a revision to FAA AC 25.1309-1A and that currently used by the JAA in AMJ 25.1309. “Extremely improbable” failure conditions are those so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. This definition is consistent with the definition provided in FAA AC 25.1309-1A and retained in the draft revision to AC 25.1309-1A proposed by the ARAC.

The severity of the external environmental conditions that should be considered when demonstrating compliance with this rule are those established by certification regulations and special conditions (e.g., HIRF), regardless of the associated probability. The rule also requires that the effects of manufacturing variability, aging, wear, and likely damage be taken into account when demonstrating compliance.

These requirements are consistent with the general powerplant installation failure analysis requirements of § 25.901(c) and the systems failure analysis requirements of § 25.1309, as they have been applied to powerplant installations. This additional requirement is needed because the general requirements of §§ 25.901 and 25.1309 have not been consistently applied and documented when showing that ignition sources are precluded from transport category airplane fuel tanks. Compliance with § 25.981 requires an analysis of the airplane fuel tank system using analytical methods and documentation currently used by the aviation industry in demonstrating compliance with §§ 25.901 and 25.1309. In order to eliminate any ambiguity as to the necessary methods of compliance, the rule explicitly requires that the existence of latent failures be assumed unless they are extremely remote, which is currently required under § 25.901, but not under § 25.1309. The analysis should be conducted assuming design deficiencies listed in the background section of this document, and any other failure modes identified within the fuel tank system functional hazard assessment.

Based upon the evaluations required by § 25.981(a), a new requirement is added to paragraph (b) to require that critical design configuration control limitations, inspections, or other procedures be established as necessary to prevent development of ignition sources within the fuel tank system, and that they be included in the Airworthiness Limitations section of the ICA required by § 25.1529. This requirement is similar to that contained in § 25.571 for airplane structure. Appendix H to part 25 is also revised to add a requirement to provide any mandatory fuel tank system inspections or maintenance actions in the Airworthiness Limitations section of the ICA.

Critical design configuration control limitations include any information necessary to maintain those design features that have been defined in the original type design as needed to preclude development of ignition sources. This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrity of the original fuel tank system type design. An example of a critical design configuration control limitation for current designs discussed previously would be maintaining wire separation between FQIS wiring and other high power electrical circuits. The original design approval holder must define a method to ensure that this essential information will be evident to those that may perform and approve repairs and alterations. Visual means to alert the maintenance crew must be placed in areas of the airplane where inappropriate actions may degrade the integrity of the design configuration. In addition, this information should be communicated by statements in appropriate manuals, such as Wiring Diagram Manuals.

Flammability Requirements

The FAA agrees with the intent of the regulatory text recommended by the ARAC. However, due to the short timeframe that the ARAC was provided to complete the tasking, a sufficient detailed economic evaluation was not completed to determine if practical means, such as ground based inerting, were available to reduce the exposure below the specified value of 7 percent of the operational time included in the ARAC proposal. The FAA is adopting a more objective regulation that is intended to minimize exposure to operation with flammable conditions in the fuel tanks.

As discussed previously, the ARAC has submitted a recommendation to the FAA that the FAA continue to evaluate means for minimizing the development of flammable vapors within the fuel tanks. Development of a definitive standard to address this recommendation will require additional effort that will likely take some time to complete. In the meantime, however, the FAA is aware that historically certain design methods have been found acceptable that, when compared to readily available alternative methods, increase the likelihood that flammable vapors will develop in the fuel tanks. For example, in some designs, including the Boeing Model 747, air conditioning packs have been located immediately below a fuel tank without provisions to reduce transfer of heat from the packs to the tank.

Therefore, in order to preclude the future use of such design practices, § 25.981 is revised to add a requirement that fuel tank installations be designed to minimize the development of flammable vapors in the fuel tanks. Alternatively, if an applicant concludes that such minimization is not advantageous, it may propose means to mitigate the effects of an ignition of fuel vapors in the fuel tanks. For example, such means might include installation of fire suppressing polyurethane foam.

This rule is not intended to prevent the development of flammable vapors in fuel tanks because total prevention has currently not been found to be feasible. Rather, it is intended as an interim measure to preclude, in new designs, the use of design methods that result in a relatively high likelihood that flammable vapors will develop in fuel tanks when other practicable design methods are available that can reduce the likelihood of such development. For example, the rule does not prohibit installation of fuel tanks in the cargo compartment, placing heat exchangers in fuel tanks, or locating a fuel tank in the center wing. It does, however, require that practical means, such as transferring heat from the fuel tank (e.g., use of ventilation or cooling air), be incorporated into the airplane design if heat sources were placed in or near the fuel tanks that significantly increased the formation of flammable fuel vapors in the tank, or if the tank is located in an area of the airplane where little or no cooling occurs. The intent of the rule is to require that fuel tanks are not heated, and cool at a rate equivalent to that of a wing tank in the transport airplane being evaluated. This may require incorporating design features to reduce flammability, for example cooling and ventilation means or inerting for fuel tanks located in the center wing box, horizontal stabilizer, or auxiliary fuel tanks located in the cargo compartment. At such time as the FAA has completed the necessary research and identified an appropriate definitive standard to address this issue, new rulemaking will be considered to revise the standard adopted in this rulemaking.

Applicability of Part 25 Change

The amendments to part 25 apply to all transport category airplane models for which an application for type certification is made after the effective date of the rule, regardless of passenger capacity or size. In addition, as currently required by the provisions of § 21.50, applicants for any future changes to existing part 25 type certificated airplanes, including STC's, that could introduce an ignition source in the fuel tank system are required to provide any necessary Instructions for Continued Airworthiness, as required by § 25.1529 and the change to the Airworthiness Limitations section, paragraph H25.4 of Appendix H. In cases where it is determined that the existing ICA are adequate for the continued airworthiness of the altered product, then it should be noted on the STC, PMA supplement, or major alteration approval.

FAA Advisory Material

In addition to the amendments presented in this rulemaking, the FAA is continuing development of AC 25.981-1B, “Fuel Tank Ignition Source Prevention Guidelines” (a revision to AC 25.981-1A), and a new AC 25.981-2, “Fuel Tank Flammability Minimization.”

AC 25.981-1B includes consideration of failure conditions that could result in sources of ignition of vapors within fuel tanks, and provides guidance on how to substantiate that ignition sources will not be present in airplane fuel tank systems following failures or malfunctions of airplane components or systems. This AC also includes guidance for developing any limitations for the ICA that may be generated by the fuel tank system safety review.

AC 25.981-2 provides information and guidance concerning compliance with the new requirements identified in this rulemaking pertaining to minimizing the formation or mitigation of hazards from flammable fuel air mixtures within fuel tanks.

Discussion of Comments

Thirty four commenters responded to Notice 99-18, including private citizens, foreign aviation authorities, manufacturers of inerting equipment, individual airplane manufacturers and operators (both foreign and domestic), an organization representing the interests of manufacturers of general aviation airplanes, an airline pilots representative, an organization representing the consolidated interests of the aviation industry worldwide, and the National Transportation Safety Board. The majority of commenters agree in principle with the proposals. A discussion of these comments follows, including FAA's response, grouped by subject matter.

Discussion of Comments on Proposed SFAR

For ease of reference, throughout the following discussion, the term “designer” is used to refer to all persons subject to the requirements of the Special Federal Aviation Regulation (SFAR).

General Favorable Comments

Several commenters, including representatives of manufacturers and operators, agree in principle with the safety review that would be required by the proposed new SFAR to part 21 and have, in fact, already engaged in an industry-wide initiative in this area. These commenters state that they believe firmly that the objective of the proposed safety review will enhance the level of safety that already exists in the transport fleet.

Request to Include Smaller Part 25 Airplanes, Rotorcraft, and Part 23 Airplanes in SFAR Applicability

Several commenters disagree with the proposal to limit applicability of the SFAR to larger airplanes (30 or more passengers) due to the time needed to conduct a thorough economic analysis and the possible impact it would have on small businesses. However, the commenters request that this evaluation be completed and that smaller transport airplanes be included because of the design similarities of the smaller airplanes to larger airplanes.

Additionally, one commenter notes that, because the proposal excludes a significant portion of the fleet, the proposal is not in keeping with the FAA's stated goals of the “One level of Safety” initiative. This commenter also notes that the FAA stated in the notice that applying the proposed requirements to certain regional airliners would not significantly increase the expected quantitative benefits of the rule because there have been no in-flight fuel tank explosions on those airplanes. The commenter is concerned that the FAA may be using “faulty reasoning” to eliminate the need for any follow-on action to address this segment of the fleet.

Another commenter strongly recommends that the SFAR be extended to include part 23 aircraft and part 27 rotorcraft because these types of aircraft may be susceptible to fuel tank system problems similar to those addressed in the proposed rule.

FAA's Response: The FAA agrees that, even though the fuel tank systems of smaller transport category airplanes may be simpler, similarities in the designs of the fuel systems of those airplanes may result in a need to apply the standard to them. As discussed in the notice, we plan to conduct the appropriate economic analysis to determine if the rule should be applied to smaller transport airplanes. Should the results of that analysis indicate that the SFAR requirements should be applied to smaller transports, we will consider developing further rulemaking to address those airplanes. For now, the applicability of the final rule will remain as proposed in the notice.

We do not agree that the proposed SFAR should be applied to part 23 aircraft and part 27 rotorcraft at this time. Service experience has not indicated that immediate action is necessary to address the fuel tank systems of those types of aircraft at this time. However, we may reconsider this action if future service experience indicates that it is warranted.

Request to Exclude Mitsubishi YS-11 Airplanes and Lockheed Electra Airplanes

Mitsubishi Heavy Industries America, Inc., requests that the Mitsubishi Model YS-11 airplane be excluded from the SFAR applicability. The commenter's justification for this exclusion is that none of these airplane models is currently being operated in the U.S. and none are likely to be operated in the future. The commenter further states that there has never been a fuel tank-related incident or accident on any of these airplane models. The commenter refers to the FAA's statement in the preamble to the notice that certain older reciprocating engine-powered and converted turbine-powered transport airplanes should be excluded from the rule because:

“* * * the few remaining such airplanes are in cargo service and because their advanced age and small numbers would make compliance impractical from an economic standpoint.”

The commenter asserts that the same rationale should be applicable to the Model YS-11 because not one such airplane is currently operating in the U.S. and the possibility of such airplanes ever returning to cargo service, much less passenger service, in the U.S. is virtually non-existent. Therefore, there are no benefits to be achieved by the design review.

Similarly, Lockheed Martin also requests that its airplane model, the Lockheed Model L-188 Electra airplane, be excluded from the applicability of the SFAR. Like the first commenter, this commenter refers to the statement in the preamble to the notice that certain older reciprocating and turbine-powered airplanes should be excluded because compliance would be impractical from an economic standpoint. The commenter suggests that the Model L-188 Electra also falls into this category and should be excluded from the rule's applicability. The commenter further suggests that the retroactive application of the new requirements to any older model include provisions in the rule that would permit favorable service experience to be submitted instead of extensive failure analysis. The commenter refers to a safety study conducted of the Model L-188 Electra fuel system which shows that the fuel system service experience is excellent.

FAA's Response: The FAA does not concur with these commenters' requests to revise the applicability of the SFAR. As stated in Notice 99-18, parts 91, 121, 125, and 129 would be amended to require operators to incorporate FAA-approved fuel tank system maintenance and inspection instructions into their current maintenance or inspection program of transport category airplanes type-certificated after January 1, 1958. That date was chosen so that all turbine-powered transport category airplanes would be included, except for a few 1947 vintage Grumman Mallards, and 1953-1958 vintage Convair Model 340 and 440 airplanes converted from reciprocating to turbine power.

We do not consider the information presented by either of the commenters sufficient to warrant a general exclusion of either the Model YS-11 or the Model L-188 Electra from the applicability of the SFAR. We do acknowledge, however, that the current operations of Model L-188 Electra airplanes to remote Aleutian points and on military contract flights do involve unique circumstances worthy of further consideration. For example, we might conclude that, while full compliance is not cost effective, some lesser degree of fuel tank system evaluation is necessary.

While there is insufficient basis on which to exclude the Model L-188 Electra airplanes in general, the TC holder may petition the FAA for an exemption from the provisions of this final rule showing that it would be in the public interest. Similarly, we would consider petitions for exemption from the SFAR for the Model YS-11 or any other airplane not currently operated under U.S. registry. Such requests for exemption would be handled outside of this rulemaking action. Even if an exemption were granted from the SFAR to a design approval holder, operators of the affected airplanes would still be subject to the requirements of the operating rules established by this final rule. Petitions for exemption by the operators would involve different considerations.

Request to “Harmonize” the Rule With European Authorities

Several commenters, including representatives from aviation officials of the JAA and Transport Canada, state that the proposed SFAR should have been developed through the Aviation Rulemaking Advisory Committee (ARAC) and its harmonization process. These commenters contend that harmonizing the proposed rule would:

• simplify operations,
• reduce the cost of compliance without compromising safety, and
• extend the latest safety benefits more broadly in the world fleet.

The commenters also state that issuing the rule under the harmonization process would have facilitated eventual delegation of the SFAR compliance findings between the FAA and the JAA. Some commenters request that the disposition of public comments be handled through the ARAC process.

FAA's Response: The FAA does not concur with the commenters. When this rulemaking was initiated, we faced a choice between proceeding unilaterally or proceeding through the harmonization process involving the JAA and the public through ARAC. At that time, we chose to proceed unilaterally in order to address the important safety need on an expedited basis. In a separate action, we did task ARAC with developing proposed regulatory text to eliminate or reduce flammability in airplane fuel tanks. The fundamentals of ARAC's proposal are included in this rule.

With the issuance of this rule, we consider that the safety need has been addressed and we are now open to a harmonization effort. To facilitate harmonization, we have coordinated the proposal with the JAA and Transport Canada. Comments from the JAA and Transport Canada indicate their agreement in principle with our actions, and they have stated their intention to mandate similar fuel tank safety actions. While we will ensure compliance with the SFAR, the operating rules, and the part 25 design standards as adopted in this final rule, we will continue discussions with Transport Canada and the JAA concerning possible harmonization efforts relating to the part 25 change.

The safety improvements provided by this rule are as urgent now as they were when we decided to proceed unilaterally. The comments do not persuade us that the policy judgments reflected in the notice were incorrect. Because expedited adoption of this final rule is necessary, and because further discussion of comments within ARAC would not change the FAA's policy determinations, further review of the proposed rule by ARAC would not be appropriate.

Request To Delegate Compliance Findings

Several commenters request that the FAA delegate SFAR compliance findings to the prime certification authority in accordance with the approved bilateral agreement.

FAA's Response: The FAA interprets the reference to “prime certification authority” to mean the “state of design,” as that term is used in ICAO Annex 8. Because the SFAR imposes requirements on existing designers, the bilateral airworthiness agreements, which address new certifications, do not directly apply. To the extent that bilateral countries choose to become involved in reviewing submissions for compliance with the SFAR, we will work closely with them. This should facilitate the harmonization efforts described previously. However, under the SFAR the FAA must approve the design approval holder's submission.

Request for Definition of Safety Review

One commenter notes that the terms “safety review,” “design review,” “safety analysis,” and “functional hazard assessment” appear to be used interchangeably throughout the notice. However, each of these terms could have significantly different meanings. The commenter requests that, if it is the intent of the FAA to have different meanings for these terms, then the definitions should be clearly stated and the terms should be used in the appropriate context.

The commenter offers the following definitions in an attempt to establish a unified understanding of the objectives:

• “Safety Review”—a comprehensive assessment of the fuel tank system that meets all the requirements of the Special Federal Aviation Regulation.
• “Safety Analysis”—process of ensuring that the fuel system is fail-safe by conducting a design review and failure modes and effects analysis.
• “Design Review”—process of reviewing all relevant engineering design drawings to ensure that appropriate design practices have been used and identify failure modes.
• “Failure Modes Analysis”—process of evaluating all identified failure modes resulting from the design review by conducting a failure modes and effects analysis (FMEA) and a fault tree analysis (FTA).

The commenter requests that a similar set of definitions be provided in the SFAR to clarify the intentions of the regulation.

FAA's Response: The FAA concurs that clarification is appropriate. The objective of the SFAR is to require designers to conduct “safety reviews,” which is the broadest term defined by the commenter. The term “safety review” is the correct term that is used in the text of the SFAR. For clarification sake, we have used the term “safety review” throughout the discussions in this preamble to describe the action required by the SFAR. No change to the final rule text is necessary in this regard, however.

Question on the Need for a System Safety Review

One commenter considers that the proposed safety review required under the new part 21 SFAR is excessive. This commenter regards the proposal as essentially a requirement to re-certify the fuel systems of all turbine-powered commercial transports, with respect to avoiding fuel tank fires and explosions. The commenter points out that, while more than 450 million hours of service experience on these airplanes have identified valuable lessons learned, this same service experience also demonstrates the largely successful outcome of the previously certified designs. The extent of the safety review that the proposed SFAR would require goes beyond what is commensurate with the historical data.

FAA's Response: The FAA does not concur with the commenter that the service history of the affected airplanes does not warrant the type of safety review proposed. Specifically, we disagree that past service has been “largely successful.” While the commenter states that the fleet has achieved a good safety record, we point out that, as discussed in detail in the preamble to the notice, there has been extensive service history data related to anomalies, system failures, aging-related problems, etc., of the fuel tanks of transport category airplanes. Service data show that there have been 16 fuel tank explosion events. Further, the fact that the FAA has issued over 40 airworthiness directives to correct fuel tank safety hazards affecting a large cross section of the transport airplane fleet indicates that extensive revalidation of the fuel tank systems, as proposed, is necessary.

Question on Quantitative vs. Qualitative Safety Review of Older Airplane Designs

One commenter suggests that the proposed SFAR should allow aircraft certificated prior to Amendment 25-23 and § 25.1309 reliability requirements to undergo a qualitative—rather than quantitative—safety review. Then, from the results of the review, an inspection or maintenance plan could be developed, and, finally, a one-time inspection of the entire fleet could be performed. The commenter supports this type of assessment for several reasons:

1. The current version of § 25.1309 requires a safety review and a quantitative assessment to validate that a system is fail-safe. However, accurate statistical reliability information needed to conduct the safety analysis is likely to be unavailable for fuel system components used nearly 30 years ago.

2. When conducting a safety review, conservative assumptions are required when accurate reliability data is unavailable. These conservative assumptions could lead to false and detrimental failure probability results. This circumstance could occur multiple times during the analysis, or even cause compounded error effects, requiring even more severe corrective actions.

3. By the methods proposed in the proposed rule, a “representative” fuel tank system would be created based on 30-year-old drawings that would be “fraught with unavoidable assumptions,” while at the same time be required to meet the “extremely improbable” failure condition probability criteria of 1 × 10⁻⁹. This would lead to unnecessary inspections, maintenance, repairs, and modifications.

To meet the intent of the SFAR more effectively, the commenter proposes that a qualitative safety review be conducted, based on:

• The investigative efforts of the FAA and NTSB,
• AD's,
• Service bulletins,
• Lessons learned,
• Performance history of the aircraft, and
• Results of the recent industry-wide fuel tank inspection program.

In addition, the labor and time costs for a qualitative analysis would be dramatically lower than for a quantitative analysis. A qualitative analysis could be conducted using the knowledge and experience of current in-house personnel and applying familiar methods of evaluation. It likely would take less time, as well.

Several other commenters also question the practicality of requiring the proposed safety review if the latest standards are to be applied to older airplane designs. These commenters maintain that the proposed SFAR effectively requires recertification of older airplanes' fuel tanks to show compliance with the quantitative system safety assessment requirements introduced in § 25.1309 of Amendment 25-23. The commenters point out that those requirements were neither developed nor in effect for the airplanes whose certification basis was approved prior to the time that Amendment 25-23 was issued in May 1970. The majority of the airplanes affected by the proposed SFAR fall into this category.

Further, the commenters note that quantitative analysis methods for showing compliance with the requirements of Amendment 25-23 were not even developed or approved by the FAA until June 1988, when the FAA issued guidance on this subject in Advisory Circular 25.1309-1A. These methods were not necessarily applied to aircraft certified before that date. Thus, the certification documentation and technical archives of pre-amendment 25-23 aircraft may be limited in their usefulness to support a formalized analysis.

These commenters also state that re-evaluation of older aircraft types using today's quantitative analysis methodologies, such as a failure modes and effects analysis (FMEA), would be impractical and present “insurmountable difficulties,” given the unavailability of data and the resources required. One commenter states that this type of safety review would be extremely labor-and resource-intensive, and would have both short- and long-term adverse economic effects on the aviation industry.

Another commenter states that the proposal does not provide a simple design-assessment method that is compatible with the technical information available to TC and STC holders. (The commenter gave no examples of incompatibility, however.)

FAA's Response: The FAA recognizes that the fuel tank systems of most older transport airplane designs were not evaluated during certification using the quantitative safety assessment methods associated with § 25.1309. For these airplanes, the FAA agrees that a qualitative, rather than quantitative, approach can and should be used where possible for the fuel tank system safety review. The level of analysis required to show that ignition sources will not develop will depend upon the specific design features of the fuel tank system being evaluated. Detailed quantitative analysis should not be necessary if a qualitative safety assessment shows that features incorporated into the fuel tank system design protect against the development of ignition sources within the fuel tank system. For example, for wiring entering the fuel tanks, compliance demonstration could be shown in three steps.

• First, the wiring could be shown to have protective features such as separation, shielding, or transient suppression devices;
• Second, the effectiveness of those features could be demonstrated; and
• Third, any long-term maintenance requirements or critical design configuration limitations could be defined so that the protective features are not degraded.

Another example would be showing that fuel pumps are installed in such a way that the fuel pump inlet remains covered whenever the fuel pump is operating throughout the airplane operating attitude envelope, including anticipated low fuel operations and ground conditions. This could be a satisfactory method of meeting the fail-safe requirement for the fuel pump mechanical components, although it would not necessarily address fuel pump motor failure modes. (Advisory Circular 25.981-1B provides additional guidance on the acceptability of qualitative assessments where fail-safe features are provided.)

Additionally, if fail-safe features are incorporated into the design in such a way that the effects of other systems on the fuel tank system can be shown to be benign, then no additional design assessment and inspections would be required. Designers using this approach would be required to provide substantiation that the design features preclude the need for detailed design assessment of the system and future inspections. Designers considering using this approach should coordinate as early as possible with the cognizant ACO.

On the other hand, the fact that a quantitative assessment and related data do not currently exist for some older airplane types does not mean that a similar safety assessment cannot be accomplished on these airplanes. It is feasible to use a modern safety assessment method on older airplanes that will recognize and evaluate potential failures and their effects, and will identify actions that could eliminate or reduce the chance of a potential failure from occurring.

Methods for conducting a quantitative analysis of any system are well-established and readily available. For example, the FMEA and fault tree analysis methodology is widely accepted and understood. In fact, there currently are several software packages available commercially that are specifically designed for assisting in developing FMEA's; these have proven to be particularly useful in reducing the amount of time, labor, clerical support, and monetary burden that normally would be entailed.

In light of this, we anticipate that all affected TC and STC holders will be fully capable of complying with the SFAR requirements.

No change to the final rule is necessary with regard to these comments. The rule requires that applicants “conduct a safety review” of the airplane, but does not specify any particular method of review.

Question on Intent of Safety Review

One commenter questions the FAA's intent regarding the safety review. This commenter notes that the proposed SFAR states, “ * * * single failures will not jeopardize the safe operation * * * “ and “ * * * latent failures have to be assumed * * *” However, there are a number of single failures identified in the SFAR that have the capability to create an ignition source within the fuel tank. Examples include:

• Various mechanical pump failure modes,
• Various electrical pump failure modes, and
• Arcing of pump power cables to the conduit.

There are a number of single failures within the examples listed above that would not be acceptable to show compliance in accordance with the current application of § 25.1309, which requires that “ * * * failure of any single component should be assumed * * * and not prevent continued safe flight * * *” In light of this, the commenter asks if the FAA is expecting modifications to cover all these cases; if not, there is a risk that the interpretation of § 25.1309 may be degraded.

The commenter further states that there are a number of latent failures in fuel tanks that could create an ignition source within the fuel tank, for example:

• Loss of pump over-temperature protection, and
• Loss of bonding (electro-static and lightning protection).

These types of latent failures are not easy to detect without a physical inspection inside the tank. The commenter asks how these types of latent failures will be considered when assessing the safety of fuel tanks. Clearly, frequent internal inspections of fuel tanks are not acceptable, and some means for agreeing to certain design practices on existing aircraft may be needed.

FAA's Response: The intent of the safety review, as stated in the notice, is to apply current system safety assessment standards to the affected airplanes in the existing transport fleet. We fully expect that, where fail-safe features do not exist, modifications to designs and changes to maintenance practices will be required for a significant portion of the fleet to address the single and multiple failures noted by the commenter. If inspections to detect latent failures are impractical, it would be necessary to modify the design to provide fail-safe features or indications to eliminate latency.

Request for a Lessons Learned Approach

Certain commenters state that the proposed safety review would be more useful if it were based strictly on lessons learned, and request that the proposal be changed accordingly. The commenters propose an alternative method that would be based on service experience (lessons learned) and regulated as a “prescriptive-type rule.” As an example, the commenters suggest that the FAA first define a comprehensive list of items that may not have been considered adequately in the original fuel system design and for which there is some service experience. The list could include such items as:

• Fuel pumps,
• Wiring to pumps in conduits located inside fuel tanks,
• Fuel pump connectors,
• Fuel quantity indicating system wiring and probes, and
• Component bonding.

The FAA could then require that fuel system designs be evaluated against this “checklist” to determine if adequate consideration has been made regarding the potential effects of each item listed. Any single failures shown to cause an ignition source in the fuel tank would warrant a design change. A quantitative fault tree analysis could then be developed for combinations of failures shown to cause ignition sources, to determine if such failure combinations could be expected to occur in the remaining fleet life of the affected aircraft type.

These commenters state that among the benefits of this prescriptive design review approach would be:

• A common evaluation criterion for each aircraft type, regardless of its certification basis.
• A more objective evaluation process that simplifies delegating the compliance-finding task by the FAA and ensures equal treatment for each manufacturer and operator.
• Faster completion of the task, submittal of the report to the FAA, and resolution of any deficiencies in the existing fleet.
• Development of a standardized report or checklist to ease the compliance-finding process.
• A far greater pool of people able to accomplish the task, because a prescriptive review method would not demand engineers with detailed expertise in fuel systems and safety assessment methodology.

These commenters maintain that the FAA's safety review proposed in the SFAR would be merely an additional burden that could interfere with realizing the benefits of lessons learned. They consider that their suggested alternative approach is more practical, and equally effective in enhancing fuel system safety.

FAA's Response: The FAA does not concur with these commenters' request. To conduct a safety review based solely on lessons learned would not provide the level of safety that is intended by the proposal. A lessons learned focus would address problems that were known to have occurred in the past; however, it would not necessarily address potential problems and risks that could occur in the future. Thus, a lessons learned focus is a reactive, not a proactive, approach. There may be unforeseen failure modes that would not necessarily be accounted for by only evaluating failure modes that have occurred in the past, as would be done with a lessons-learned approach.

One example is in AC 25.981-1A, published originally in 1971, which included a list of failure modes, based upon lessons learned at that time, that should have been considered in showing compliance with the requirements of § 25.981. Since that AC was published, however, numerous unforeseen failures have occurred, thus, resulting in a much longer list that is now included in the revision to that AC. While such a list is valuable in providing guidance for conducting a safety assessment, it is not all-inclusive and we do not consider it adequate for conducting a comprehensive safety assessment.

On the other hand, the qualitative approach to the required safety review will result in consideration of, and means to address, potential failure modes, even if they have not yet been encountered in service. For example, if a qualitative assessment indicated that a particular design feature could result in a high voltage electrical surge into the fuel tank, then the assessment would conclude that measures should be taken to prevent such an occurrence, regardless of whether it is a “lesson learned” based on past occurrences.

Request for Risk Assessment Only of Remaining Fleet Life

One commenter suggests that the safety review methodology proposed by the FAA should provide a risk assessment over the remaining fleet life of each aircraft type. Many of the aircraft types that would be affected by the proposed SFAR are approaching the end of their fleet lives. The commenter asserts that, when determining if safety reviews and resulting design changes are warranted, the consideration should be based upon a risk assessment based on the remaining fleet life.

FAA's Response: The FAA agrees that the remaining fleet life could be one consideration in establishing a basis for an exemption from the requirement to perform a safety review for particular models, but it is not a general basis for limiting the applicability of the proposal. While some models of airplanes have exceeded their economic design goal (for example the Boeing Model 727 and McDonnell Douglas Model DC-9), there are individual airplanes of those models that are still in service, and extensive future service life is planned for them. Consequently, exposure to the risk of fuel tank explosions remains as valid for these models as for any others in service.

Regarding whether resulting design changes are warranted, those changes would necessarily be mandated by separate regulatory actions (AD's). Therefore, whether the changes are warranted will be assessed in the context of those actions.

Request for Change in Compliance Time for Conducting Safety Review

Several commenters state that the 12-month compliance time for completing the required actions proposed under the SFAR is unrealistic, and request a longer period for compliance. The reasons that these commenters give are as follows:

First, industry lacks the resources to accomplish the requirements within the proposed timeframe. There are limited qualified personnel to conduct the level of safety review that the proposed SFAR would require. Formalized system safety analysis of the type outlined in AC 25.1309-1A requires specialists with extensive knowledge of the system architecture, component details, and service history, as well as the analysis methodology.

Second, the flow time necessary to perform the proposed safety review would exceed the proposed compliance time. The commenters point out that over 100 airplane models would need to be reviewed, and the proposed safety review methodology would require two to four years of effort per major model for large transport aircraft. Some major models of airplanes have numerous minor model variations. These minor model variations would add significant additional review effort. Availability of qualified engineers does not allow these reviews to be conducted in a completely parallel fashion. Assuming a 9-month flow time to accomplish each review and the capability to conduct up to three reviews simultaneously, some manufacturers would require well in excess of 45 months to complete the proposed reviews. In other instances, the resources available to some TC or STC holders may limit their capability to one safety review at a time. These estimates take into account work already accomplished by the industry over the past 4 years.

Third, development of the maintenance instructions could not possibly be accomplished within the proposed 12-month compliance time. As written, the proposed SFAR would require “all maintenance and inspection instructions necessary” to be submitted as part of the safety review report. However, the commenters assert that effective development of a maintenance program cannot practically start until the safety review is completed, and it must be developed in coordination with the operators and regulatory agencies. Therefore, submittal of the maintenance and inspection instructions as part of the safety review report is not feasible. The commenters request that the proposal be revised to allow a period of 6 to 8 months for the development of these instructions once the FAA has approved the safety review report.

Fourth, necessary design changes identified as a result of the safety review could not be developed, evaluated, and shown to comply with the new requirements within the proposed compliance time. The commenters request that the compliance time for design change activity be treated separately from the SFAR review activity.

Fifth, the FAA itself lacks resources to support timely review of the safety review reports required by the SFAR within the 12-month time proposed to complete the review. The commenters believe that the FAA has grossly underestimated its own flow times regarding coordination and approval of the SFAR-mandated safety reviews and resulting compliance substantiation documents. Experience has shown that the FAA typically takes 60 to 90 days to review and approve of documents of this kind. Multiplied by 100 reports or more, it would appear that the FAA itself would require more than the proposed 12 months compliance time to complete its review and approval cycle once the reports are submitted by the industry.

Another commenter considers that the proposed compliance time for developing the maintenance and inspection program is inadequate. The commenter asserts that, without the insights gained through the SFAR design review assessment process, any attempts to accurately revise existing maintenance and inspection programs would be “counterproductive” to the goals of the proposed rule. The commenter maintains that the FAA underestimates the time necessary to prepare and develop the maintenance program, receive approval, and implement the program. This commenter requests that the proposed rule be changed to allow more time for revising the operator's maintenance or inspection programs, and that this time start only after the completion of the design review and the manufacturers' maintenance program for each airplane model.

Certain other commenters request that the proposal be changed to include the following text:

“Compliance time:

(a) All design review reports must be submitted to the Administrator no later than 36 months after the effective date of this rule or within 18 months of the issuance of a certificate for which application was filed before [effective date of the rule], whichever is later.

(b) Maintenance and inspection instructions must be submitted to the Administrator no later than 8 months after the FAA has approved the design review report for the applicable aircraft type.”

Others request that the compliance time for completion of the safety review should be extended to 54 months.

FAA's Response: The FAA has considered the reasons for the commenters' requests and concurs that the compliance time should be extended somewhat. We have revised the final rule to provide a compliance time of 18 months for conducting the safety reviews and submitting them to the FAA. Even for those designers who work closely with the appropriate ACO's in conducting their reviews, we acknowledge that, following submission, some time will be required for FAA review and for any necessary revisions, and we consider that 6 months should be adequate for those activities. We are aware that when the FAA has mandated maintenance program changes in the past, we have typically allowed operators 12 months to incorporate those changes into their programs. Therefore, we have revised the operating rules to require that operators incorporate the maintenance program changes within 36 months after the effective date.

Designers may allocate the 18-month compliance time between the safety review and the development of maintenance and inspection instructions as they deem appropriate. In evaluating the information presented by the commenters and the relevant safety concerns, we have determined that this revision can be made without significantly affecting safety.

These revised compliance times are not as long as those requested by the commenters for the following reasons:

• The commenters based their estimates on the assumption that a quantitative assessment would be required. As discussed previously, in most cases a less time-consuming qualitative assessment will be sufficient.
• There is a substantial degree of commonality in design features of the affected models. Such commonality will allow analysis to be conducted by similarity to previously reviewed designs. In light of this, we do not foresee designers needing to conduct a separate safety analysis “from scratch” for each model.
• Since the TWA 800 accident over 4 years ago, many manufacturers already have completed significant reviews of service history and analysis of fuel tank designs for many airplane types. This will significantly reduce the time and resources that will be needed to complete the requirements of the SFAR.
• We expect that industry will work closely with the cognizant ACO in planning the safety review, and providing feedback as the evaluation progresses. This should allow expedited approval by the local office.

Given the additional time provided in the final rule, we are confident that the technical capability exists and that industry will expend the resources needed to address this critical safety issue in a timely manner.

As for the compliance time for development of needed design changes, we have revised the text of the final rule to include a provision that would allow extensions of the compliance time on a case-by-case basis. The final rule states that the FAA may grant an extension of the compliance time if:

• The safety review is completed within the compliance time, and
• Necessary design changes are identified within the compliance time, and
• Additional time can be justified.

Request for Clarification of SFAR Applicability to STC Holders

Two commenters state that, as worded, the proposed SFAR text does not clearly specify that it applies to holders of STC modifications that may have no direct relationship to the fuel system, but could have an effect on fuel tank safety. The commenters are concerned that some readers may misconstrue the current text as referring only to STC's for modifications directly to the fuel tank system, and not STC's that are adjacent to the fuel tank and may indirectly affect them.

One of these commenters recommends that the proposed phrase “supplemental type certificates affecting the airplane fuel tank system” be revised to “supplemental type certificates capable of affecting the airplane fuel tank system.” The other commenter suggests that the phrase be revised to “supplemental type certificates modifying the airplane fuel tank system.”

The commenters consider that adding the suggested words would make it clear that the SFAR applies not just to fuel system STC's, but to all STC's that could affect the fuel system.

FAA's Response: The FAA concurs with the commenters that a change in the text of the SFAR is necessary to clarify the intent. It was the FAA's intent that the SFAR requirements were to apply to holders of STC's that may affect the fuel system or result in a fuel tank ignition source. This was explained in detail in the preamble to the notice, and that discussion is repeated in this final rule under the heading, “Supplemental Type Certificates,” above.

Based on the comments, we recognize that the proposed text could be construed too narrowly; that is, construed to mean that the requirements apply only to STC modifications that actually change the fuel tank system. We also recognize that it may not be possible to determine whether a modification actually affects the safety of the fuel tank system without conducting at least a rudimentary qualitative evaluation. In order to clarify this point, we have revised the text of the final rule to state that the SFAR applies to all holders of type certificates and supplemental type certificates that “may affect” the safety of the fuel tank system.

Request for Clarification of SFAR Requirements for STC's Not Directly Related to Fuel Tanks

One commenter raises concerns about the requirements of the proposed rule as they apply to STC approvals of modifications that are not specifically fuel tank system modifications. These types of approvals are referred to as “non-ATA 28 STC approvals.” (“ATA 28 STC's” refers to approvals that actually change the fuel tank system.) Specifically, the commenter questions the feasibility of conducting a safety review on the types of modifications whose installation(s) do not actually change, but could affect, the airplane fuel tank system.

The commenter requests that the FAA consider a separate requirement in the SFAR for assessing the effect of these non-ATA 28 STC's on the fuel system. The commenter asserts that airplanes on which non-ATA 28 STC's are installed should only be assessed qualitatively or by inspection, and that only two key areas need to be examined:

1. The modification of wiring next to or near wiring that enters the fuel tank. These commenters suggest that the effects of these STC's could be assessed by a one-time inspection performed on each aircraft model by a specific time, such as:

• At the next heavy-maintenance inspection interval where the area or zone is opened and accessed, or
• In conjunction with any downtime necessitated by a modification program resulting from the safety review required by the proposed SFAR.

The objective of the suggested inspection would be to examine wiring that enters the fuel tank and assess whether any STC modifications introduce non-conformities that may compromise the fail-safe design concept or may be a possible fuel tank ignition source. (Only the wiring external to the tank would need to be inspected.) The nonconformity would be established based on a listing of specific inspection guidelines issued by either the FAA (possibly in the revised AC 25.981-1B) or the OEM's for each aircraft model. As with the SFAR safety review, any non-conformity would be identified and reported to the design approval holder.

As alternatives to this one-time inspection, the commenter suggests:

• A qualitative design review could be conducted, if sufficient technical information is available regarding the installation of the pertinent STC's.
• Alternative methods could be conducted that ensure the continued airworthiness of the airplane (with respect to wiring that enters the fuel tank). For example, installation of a transient suppression device should eliminate the need to inspect or conduct design reviews of modifications that might otherwise affect FQIS wiring.

2. The effect of modifications to the environmental control system (ECS) and other system modifications capable of generating autoignition temperature into the tank structure. The commenter states that a qualitative review of these systems should be conducted by reviewing whether the approved configuration has been altered. If it has been altered, the operator would identify the alteration and “report it to the person responsible” (i.e., the design approval holder of the design modification).

The commenter states that a one-time inspection process, as described above, would need to be developed using:

• The OEM's or STC holder's list of general design practices and precautions obtained during their SFAR safety reviews, and
• The revised maintenance program produced from the SFAR safety review.

The commenters foresee this information as providing operators with guidelines on what to inspect, how to inspect, and what the pass/fail criteria are.

The commenter suggests that this inspection should not repeat the inspections that have been performed to date by the operator. (For example, the operator should receive credit for any inspections performed because of an airworthiness directive or part of the industry-wide Fuel System Safety Program.)

FAA's Response: The FAA does not concur with the commenter's suggestion for several reasons. Although the commenter characterizes its proposal as a “qualitative review,” it would only result in an inspection for “non-conformities,” with the inspection results forwarded to the design approval holder. The suggestion does not specify what, if any, obligation the design approval holder would have to address these non-conformities, which, by definition, are not part of the holder's approved design. It would be unreasonable to impose an obligation on design approval holders to conduct reviews of designs for which they are not responsible. In light of this commenter's adverse comments regarding imposing a requirement for such holders to review their own designs, imposing an additional obligation is inconsistent.

In addition, the commenter's suggestion would result in a long delay in completion of the safety review of the fuel tank system. For example, the commenter suggests that the inspection take place during a heavy maintenance inspection; however, the heavy maintenance inspection intervals are typically every 4 to 5 years. Once the airplane configuration was determined, additional time would be needed to complete the assessment and to develop any necessary maintenance and inspection programs or design changes. The alternative process suggested by the commenters could effectively postpone addressing the effects of wiring on the fuel tank system by as much as 7 or 8 years. The elapsed time to complete this process would not provide the level of safety intended by the FAA or expected by the public.

Question on SFAR Requirements for STC's Where No Technical Data Is Available

Several commenters raise a concern about the proposed SFAR requirements as they pertain to a safety review of pertinent STC's where the STC holder is out of business and the necessary technical data is not readily available. The commenters expect that, for these cases, the burden would fall on the operators to conduct the review required by the SFAR. The commenters are concerned that, for a large number of these operators, the review process for these types of STC's may present “an insurmountable burden” for the following reasons:

• A full review of modifications accomplished by the operators over the decades that some of the affected airplanes have been operated is impracticable.
• Where operators have sold aircraft to another party, it is possible that the current owner of the airplane may come back to the operator and require such an evaluation. This situation is unmanageable.
• Operators will have difficulty performing any type of quantitative analysis due to lack of intensive familiarity with these types of methods.
• The technical information required to perform a quantitative or qualitative analysis may not be available or may not pertain to the specific aircraft model.
• Involvement by the original equipment manufacturer (OEM) in providing operators with assistance is viewed by the operators as likely to be minimal.

The commenters are particularly concerned that the OEM's are probably not familiar with many of the STC's that have been incorporated on the aircraft. Further, the chance of obtaining an assistance contract with the OEMs is slim because they will be stretched for manpower supporting OEM responsibilities relating to the proposed SFAR.

Additionally, the commenters are concerned that technical assistance from the FAA's fuel system specialists cannot be ensured for the operators. The FAA may be prepared to work with the affected type certificate holders to assist them in complying with the requirements of the proposed SFAR, but such assistance may not be possible for operators in this situation due to a lack of manpower.

FAA's Response: The FAA does not agree that the proposed rule would impose “insurmountable burdens” on operators. As with all operating rules, the person ultimately responsible for compliance is the operator. But this rulemaking is unique in the extent to which current designers are required to provide operators with analysis and documentation of maintenance programs to support operators in fulfilling their obligations.

The existing operating rules generally require operators to maintain their aircraft in an airworthy condition. A prerequisite for maintaining an airplane is the ability to understand its configuration, at least with respect to safety critical systems. This is reflected in operating rules such as § 121.380(a)(2)(vii), which requires a list of current major alterations to be retained permanently, and § 121.380a, which requires that these records be transferred with the airplane.

This rulemaking originated from the FAA's conclusion that fuel tank systems on current transport category airplanes may not be airworthy, and that the seriousness of this safety issue warrants substantial efforts to identify safety problems in order to prevent future accidents such as TWA 800. It is unacceptable for operators to claim not only that they are currently unable to understand the configurations of these systems on their airplanes, but that it is unreasonable to expect them to gain that understanding. The objective of this rulemaking would be defeated if operators of airplanes with configuration changes were allowed to rely solely on the instructions developed by TC and STC holders that may not reflect the actual configurations. This would allow for hazards introduced by the configuration changes to remain unaddressed.

As discussed previously, this same commenter suggests a one-time inspection to identify certain aspects of the configuration. We concur that, for those operators who cannot otherwise identify their airplanes' configurations, a one-time inspection of the entire system may be an appropriate means of determining the configurations. Once the configuration is known, the operator can perform a safety review of configuration changes not included in the TC holder and relevant STC holder reviews. As discussed previously, this type of review may be qualitative and does not require a quantitative analysis. In performing this review, the operator can use the guidance provided in AC 25.981-1B and the TC and relevant STC holder maintenance and inspection programs.

These operators could begin inspecting these airplanes immediately so that the differences from the TC and STC configurations can be documented and taken into consideration in the system safety assessment and any subsequent maintenance and inspection instructions. While operators may not have adequate engineering resources to complete the evaluations and may not be able to rely on TC holders for support in evaluating these changes, technical assistance contracts and use of Designated Engineering Representatives (DERs) are possible methods of completing the necessary work.

While we are confident that operators are capable of complying with these requirements, we recognize the validity of the operators concerns regarding the compliance time. Because it is important that this review be done properly, the compliance time for implementing the resulting maintenance and inspection programs is extended from 18 months to 36 months. This provides the operators an additional 18 months after the TC and STC holders are required to complete their programs, to complete the safety review of any field approvals on their airplanes, develop a comprehensive maintenance or inspection program, and implement the FAA approved maintenance or inspection program. We consider this sufficient to address any design changes identified by the operators.

Question on Applicability of SFAR to Modifications Installed via Field Approvals

One commenter points out that, in the preamble to the notice where changes to the operating requirements were explained, the FAA included a discussion of the effect of those requirements on field approvals. [“Field approvals” are defined as those design changes approved by an authorized FAA aviation safety inspector (e.g., Principal Maintenance Inspector, PMI) on an FAA Form 337, “Major Repair and Alteration,” or other document (e.g., an airline engineering order).] However, the preamble did not include a discussion of field approvals in the context of the proposed SFAR. Further, the proposed text of neither the SFAR nor the operating requirements contains any mention of field approvals. Thus, the commenter questions whether the proposed rule actually applies to field approvals whose installations may affect the airplane fuel tank system. Additionally, the commenter questions whether other forms of repairs or modifications permitted on in-service aircraft and not specifically mentioned in the SFAR (for example, approvals used by airlines via SFAR 36 repairs) need to be considered within the context of the proposed rule.

If the FAA intends that all repairs be considered under the rule's requirements, then the commenter requests that field approvals, approved repairs, and so on, be considered in the same fashion as non-ATA 28 STC's (discussed above).

Similarly, another commenter states that modifications approved under a field approval may prove to be problematic when attempting to comply with the safety review analysis that would be required by the proposed SFAR. These types of modifications were discussed in the preamble to the notice, but were not accounted for in the economic analysis. The commenter considers that more details are needed as to how to address them. The field approval does not have the same visibility as an STC, and it could be substantially more difficult to identify which of these types of modification could affect the fuel systems. Furthermore, many might have been approved by an inspector, without certification engineering analysis and data; this would certainly complicate the safety review analysis required by the SFAR. Such modifications are of interest even to foreign parties as they might have been incorporated on aircraft that are now on foreign registries. The commenter requests that the FAA provide more details as to how it intends to apply the SFAR to the modifications approved under a field approval.

FAA's Response: The FAA recognizes that some clarification is necessary. The preamble to the notice and the Discussion of the Final Rule section of this preamble state that the proposed requirements are intended to apply to type designs, supplemental type designs, and field approvals.

The FAA is aware that a significant number of changes to transport category airplane fuel tank systems have been incorporated through field approvals. These changes may significantly affect the safety of the fuel tank system. As discussed previously, the operator of any airplane with such changes would be required to identify them, complete a safety assessment taking into consideration the safety assessments completed by the TC and STC holders, and to develop applicable maintenance and inspection instructions and submit them to the FAA for approval, together with the necessary substantiation of compliance with the safety review requirements of the SFAR. To eliminate any misunderstanding, the operational final rules have been revised to state that the instructions for maintenance and inspection of the fuel tank system must address the actual configuration of each affected airplane.

Question on Applicability of SFAR to Repairs

One commenter requests more details concerning how the proposed safety review required by the SFAR would be applicable to repairs that currently exist on an airplane. The commenter points out that the proposed SFAR text omits any mention of repairs. The commenter states that it would be very difficult to trace back all the repairs, and their supporting engineering data, so that a proper safety analysis could be carried out. The commenter believes that these repairs, like “orphan STC's,” might render the design review by safety analysis approach unworkable in many cases. To help the operators, the manufacturers should be required to provide for an alternative to the safety assessment.

FAA's Response: As discussed above, the FAA intends that the instructions required by the operating rules address the actual configurations of the airplanes. As required by 14 CFR 43.13, a repair must restore the airplane to its original or properly altered condition. Therefore, repairs should not adversely affect fuel tank system safety. To the extent that known repairs may have changed design features affecting fuel tank system safety, they should be addressed in the maintenance and inspection instructions. We recognize that, unlike records of major alterations, repair records are not required to be retained permanently. If operators are unaware of such repairs, this rule does not require that inspections be conducted solely for the purpose of identifying them. On the other hand, if such repairs are identified as a result of inspections performed to identify configuration changes, those repairs must be addressed in the instructions.

Request for Clarification on Role of the Principal Maintenance Inspector in SFAR Actions

One commenter requests a clarification of the role of the principal maintenance inspector (PMI) in the fuel tank safety review process that would be required by the SFAR. The commenter states that there must be technical information available at the airline or PMI level to effectively carry out the objective of the proposed SFAR. However, the commenter is concerned that, even though there will be guidelines available in the new AC 25.981-1B, a PMI “will not have the expertise to be able to evaluate whether an alternative truly satisfies the SFAR.”

FAA's Response: The FAA does not intend that the PMI would evaluate the technical design information. As stated in the preamble to the notice and the Discussion of the Final Rule section of this preamble, the FAA would require that this information be submitted to the cognizant FAA Aircraft Certification Office (ACO). The maintenance and inspection program that is generated also would be approved by the cognizant ACO. The PMI would be responsible for oversight of the operator to verify that any mandatory maintenance or inspection actions are incorporated into the operators' maintenance or inspection programs.

Request for a One-Time Inspection Program

One commenter requests a revision to the proposed rule to require that, prior to conducting a system safety review and analysis for each aircraft type, a detailed inspection should be conducted of the fuel tanks of several representative airplanes for each type certificated aircraft. The purpose of the inspection would be to determine the specific health of the fleet. The inspection should span both old and newer airplanes, and include at least two operators and at least 10 airplanes. The commenter suggests that this should be a very aggressive inspection, which would involve removal and teardown of components and inspection of difficult-to-reach areas. The deficiencies and failures listed in the notice, as well as the findings of the industry-wide inspections of the Boeing 747 fuel tanks, could provide a starting point for defining the nature of the inspections. Based on findings of these inspections, appropriate corrective action could be determined and mandated. Required design changes would become apparent as a result of this inspection program.

The commenter states that there are precedents to this type of inspection. For example, the United States Air Force conducted aggressive inspections of B-52 and KC-135 aircraft in the 1980's to establish the condition of these aircraft, and required corrective action for continued safe operation of these aging aircraft. These inspection programs, referred to as Condition Assessment/Inspection Programs (CA/IP), were conducted for many of the same concerns that were raised in the notice, although the programs covered other aircraft systems as well (i.e., electrical, avionic, hydraulic, pneumatic, etc.). The CA/IP findings resulted in numerous fuel system corrective actions to enhance safety, including maintenance actions and intervals, and design improvements.

FAA's Response: The FAA does not concur with the suggestions of this commenter for several reasons:

There already have been ample inspections, service history reviews, and other assessments of the transport fleet that have confirmed, without question, that the safety of the fuel tank systems on these airplanes must be improved. Most recently, the industry-led Fuel Tank Safety Team conducted an inspection of over 800 transport category airplane fuel tanks, which revealed such things as repairs and alterations that may result in a fuel tank system that does not meet the original type design; improperly installed parts; improperly routed wiring; etc.

We do not consider that the commenters' suggested one-time inspection is necessary for airplanes for which the configuration can be identified by other means. Nevertheless, the development of critical design configuration control limitations and mandatory maintenance and inspection items will likely result in eventual inspection of all critical fuel tank system-related areas of airplanes in the transport fleet.

Question on Redundant vs. Single-Thread Fuel Tank Systems

One commenter questions a statement in the preamble to the notice that introduced the FAA's discussion of its review of maintenance practices for the fuel tank system. The statement read,

Typical transport category airplane fuel tank systems are designed with redundancy and fault indication features such that single component failures do not result in any significant reduction in safety.

The commenter maintains that just the opposite is true: Current designs are single-thread systems. That is because there will be an explosive mixture in the tank on a regular basis, and there is likely to be debris in the tank, so any single failure, such as a hot short, will compromise safety. The same is true for pump insulation failures.

FAA's Response: The FAA disagrees with this commenter's observations in part. Regulations applicable to airplanes affected by this rulemaking require that “no single failure or likely combination of failures may result in a hazard.” However, we do agree that the investigation of fuel tank system designs has shown certain installations do not meet this requirement. This is one of the purposes for the requirements of this rulemaking action.

Request for Clarification of Statement of Probability

One commenter disagrees with a statement that appeared in the preamble to the notice, which stated:

The proposed SFAR would require the design approval holder to perform a safety review of the fuel tank system to show that fuel tank fires or explosions will not occur on airplanes of the approved design.

The commenter states that it is impossible to show that “fuel tank fires or explosions will not occur,” because the probability of such an event, in terms of a system safety analysis, cannot be shown to be equal to zero. The commenter believes that this is not what the FAA intended. The commenter suggests that this phrase be removed because the essence of the requirement of the proposed SFAR is captured in another passage that appeared immediately after the cited phrase in the preamble to the notice, which read:

* * * In conducting the review, the design approval holder would be required to demonstrate compliance with the standards proposed in this notice for § 25.981(a) and (b) * * * and the existing standards of § 25.901.”

The commenter points out that the standards proposed in the notice neither suggest nor require that the probability of the occurrence of a fire or explosion should be zero.

Alternatively, the commenter suggests that the intent of the regulation could be clarified to require practical elimination of ignition sources with the intent to eliminate all sources by use of new technology and design architecture.

FAA's Response: The FAA considers that some clarification is necessary. We agree with the commenter that it is impossible to show that the probability of a fuel tank explosion is equal to zero in numerical terms. The statement cited in the notice was intended to express in very general terms the objective of the proposed rule—that “fuel tank fires or explosions will not occur.” The intended level of safety is clearly defined in the regulatory text. We concur with the clarification of intent provided by the commenter.

Request To Address Third Party Maintenance Activity in Safety Review

One commenter notes that experience has shown that unauthorized processes and materials are sometimes used by third party repair businesses, possibly even unknown to the designer. This may result in service problems that would be unforeseen by the designer, and possibly a reduced level of safety. The commenter argues that it does not seem reasonable to expect a survey of the safety of fuel system designs to take into account the effect of unauthorized and, therefore, unforeseeable maintenance activities. There may be features of the design that are critical to the safe operation of the equipment, but not obvious to a third party. The commenter requests that the FAA consider revising the proposed regulation to ensure that maintenance action carried out by parties not cognizant of the safety consequences of their procedures do not jeopardize the safety of aircraft in service.

FAA's Response: The FAA agrees in part with this commenter. The fuel tank safety review required by this rule must include failures that are foreseeable as well as any that have occurred in service. The evaluation also must include consideration of susceptibility to maintenance errors. The requirement to develop critical design configuration control limitations, discussed later, is intended to provide maintenance personnel with precisely the type of safety critical information identified by the commenter.

Discussion of Comments on § 25.981, Fuel Tank Ignition Prevention

Request for Revision to Requirement for Addressing Latent Failures

One commenter believes that the proposed § 25.981(a)(3), which would require demonstrating that an ignition source could not result from single or latent failures, is too severe. The commenter asserts that it presents requirements that are outside the scope of § 25.1309 and § 25.901(c); these are the same standards that the FAA states in the preamble to be the baseline for the proposed requirements relative to the ignition source prevention assessment. These regulations provide a defined method for assessing latent failures (although the regulations do not specifically address latent failures). The commenter favors the continued use of the fail-safe design concept as defined in AC 25.1309-1A. The commenter maintains that the new wording proposed by the FAA imposes a requirement on latent failure conditions that are just one part of a larger set of combinations leading to the hazard of “ignition sources present in fuel tanks.” It is the larger set that § 25.1309 imposes a requirement on, thus taking into account the complete set of all combinations. The commenter states that the proposed wording of § 25.981(a)(3) “adversely penalizes” the resulting outcome of the analysis, in particular the definition of maintenance intervals and the means for determining whether an added safety feature is required to mitigate or prevent the event.

FAA's Response: The FAA disagrees with the commenter's assertion that current industry practice is adequate to address fuel tank safety issues. Paragraph 5.a.1. of AC 25.1309-1A, which the commenter supports, states in part:

In any system or subsystem, the failure of any single element, component or connection should be assumed to occur during any one flight regardless of the likelihood that it would fail. Any such single-failure should not prevent the continued safe flight and landing of the airplane, nor significantly impair the ability of the crew to cope with the resulting conditions.

Consequently, if “any one flight” is taken literally, this includes flights anticipated to originate with pre-existing failures. However, we recognize that the meaning of “any one flight” has been a contentious issue for many years, and we have agreed to work within ARAC to try and resolve the issue of “specific risk” for the more generally applicable rules, such as § 25.901(c) and § 25.1309. Furthermore, as noted earlier, if a more appropriate means of addressing this issue should result from these ARAC activities, this rule will be amended accordingly to retain consistency. This commitment to ARAC notwithstanding, the FAA is also committed to assuring that transport category airplane designs are acceptably fail-safe on each flight, not just on a typical flight of mean duration or on flights where the airplane initially has no failures present.

The FAA disagrees with the commenters' assertion that the requirements of § 25.981(a)(3) are “outside the scope of § 25.1309 and § 25.901(c).” As stated previously in the notice and in this final rule, the FAA's policy for compliance with § 25.901(c), in general, has been to require applicants to assume the presence of foreseeable latent (operationally undetected) failure conditions when demonstrating that subsequent single failures will not jeopardize the safe operation of the airplane. This requirement (referred to as “latent plus one”) simply provides the same single fault tolerance for aircraft operating with an anticipated latent failure as would be provided by FAA Master Minimum Equipment List (MMEL) policies if that failure is known to exist (i.e., not latent).

As for § 25.1309, the commenter appears to be confusing the objective of the rule (i.e., to prevent the occurrence of catastrophic failure conditions that can be anticipated) with a conditionally acceptable means of demonstrating compliance, as described in AC 25.1309-1A (i.e., that catastrophic failure conditions must have an “average probability per flight hour” of less than 1×10⁻⁹). Since this same misconception has presented itself many times before, the following discussion is intended to clarify the intent of the term “extremely improbable” and the role of “average probability” in demonstrating that a condition is “extremely improbable.”

The term “extremely improbable” (or its predecessor term, “extremely remote”) has been used in 14 CFR part 25 for many years. The objective of this term has been to describe a condition (usually a failure condition) that has a probability of occurrence so remote that it is not anticipated to occur in service on any transport category airplane. While a rule sets a minimum standard for all the airplanes to which it applies, compliance determinations are necessarily limited to individual type designs. Consequently, all that has been required of applicants is a sufficiently conservative demonstration that a condition is not anticipated to occur in service on the type design being assessed.

The means of demonstrating that the occurrence of an event is extremely improbable varies widely, depending on the type of system, component, or situation that must be assessed. There has been a tendency, as evidenced by the comment, to confuse the meaning of this term with the particular means used to demonstrate compliance in those various contexts. This has led to a misunderstanding that the term has a different meaning in different sections of part 25.

As a rule, failure conditions arising from a single failure are not considered extremely improbable; thus, probability assessments normally involve failure conditions arising from multiple failures. Both qualitative and quantitative assessments are used in practice, and both are often necessary to some degree to support a conclusion that an event is extremely improbable.

Qualitative methods are techniques used to structure a logical foundation for any credible assessment. While a best-estimate quantitative analysis is often valuable, there are many situations where the qualitative aspects of the assessment and engineering judgment must be relied on to a much greater degree. These situations include those where:

• There is insufficient reliability information (e.g., unknown operating time or conditions associated with failure data);
• Dependencies among assessment variables are subtle or unpredictable (e.g., independence of two circuit failures on the same microchip, size and shape of impact damage due to foreign objects);
• The range of an assessment variable is extreme or indeterminate; and
• Human factors play a significant role (e.g., safe outcome dependent totally upon the flightcrew immediately, accurately, and completely identifying and mitigating an obscure failure condition).

Qualitative compliance guidance usually involves selecting combinations of failures that, based on experience and engineering judgment, are considered to be just short of “extremely improbable”, and then demonstrating that they will not cause a catastrophe. In some cases, examples of combinations of failures necessary for a qualitative assessment are directly provided in the rule. For example, § 25.671 (concerning flight controls) sets forth several examples of combinations of failures that are intended to help define the outermost boundary of events that are not “extremely improbable.” Judgment would dictate that other combinations, equally likely or more likely, would also be included as not “extremely improbable.” However, combinations less likely than the examples would be considered so remote that they are not expected to occur and are, therefore, considered extremely improbable. Another common qualitative compliance guideline is to assume that any failure condition anticipated to be present for more than one flight, occurring in combination with any other single failure, is not “extremely improbable.” This is the guideline, often used to find compliance with § 25.901(c), that the FAA is adopting as a standard in § 25.981(a)(3).

Quantitative methods are those numerical techniques used to predict the frequency or the probability of the various occurrences within a qualitative analysis. Quantitative methods are vital for supporting the conclusion that a complex condition is extremely improbable. When a quantitative probability analysis is used, one has to accept the fact that the probability of zero is not attainable for the occurrence of a condition that is physically possible. Therefore, a probability level is chosen that is small enough that, when combined with a conservative assessment and good engineering judgment, it provides convincing evidence that the condition would not occur in service.

For conditions that lend themselves to average probability analysis, a guideline on the order of 1 in 1 billion is commonly used as the maximum average probability that an “extremely improbable” condition can have during a typical flight hour. This 1 in 1 billion “average probability per flight hour” criterion was originally derived in an effort to assure the proliferation of critical systems would not increase the historical accident rate. This criterion was based on an assumption that there would be no more than 100 catastrophic failure conditions per airplane. This criterion was later adopted as guidance in AC 25.1309. The historical derivation of this criterion should not be misinterpreted to mean that the rule is only intended to limit the frequency of catastrophe to that historic 1×10⁻⁷ level. The FAA conditionally accepts the use of this guidance only because, when combined with a conservative assessment and good engineering judgment, it has been an effective indicator that a condition is not anticipated to occur, at least not for the reasons identified and assessed in the analysis. Furthermore, decreasing this criterion to anything greater than 1×10⁻¹² would not result in substantially improved designs, only increased line maintenance. The FAA has concluded that the resulting increased exposure to maintenance error would likely counteract any benefits from such a change. An ARAC working group has validated these conclusions.

When using “averages,” care must be taken to assure that the anticipated deviations around that “average” are not so extreme that the “peak” values are unacceptably susceptible to inherent uncertainties. That is to say, the risk on one flight cannot be extremely high simply because the risk on another flight is extremely low. An important example of the flaw in relying solely on consideration of “average” risk is the “specific risk” that results from operation with latent (not operationally detectable) failures. It is this risk that is being addressed by § 25.981(a)(3), as adopted in this final rule. For example, latent failures have been identified as the primary or contributing cause of several accidents. In 1991, a thrust reverser deployment occurred during climb from Bangkok, Thailand, on a Boeing Model 767 due to a latent failure in the reversing system. In 1996, a thrust reverser deployment on a Fokker Model F-100 airplane occurred following takeoff from Sao Paulo, Brazil, due to a latent failure in the system. As noted earlier, the NTSB determined that the probable cause of the TWA 800 accident was ignition of fuel vapors in the center wing fuel from an ignition source:

* * * The source of ignition energy for the explosion could not be determined with certainty but, of the sources evaluated by the investigation, the most likely was a short circuit outside of the center wing tank that allowed excessive voltage to enter it through electrical wiring associated with the fuel quantity indication system [FQIS].

A latent failure or condition creating a reduced arc gap in the FQIS would have to be present to result in an ignition source. This rule is intended to require designs that prevent operation of an airplane with a preexisting condition or failure such as a reduced arc gap in the FQIS (latent failure) and a subsequent single failure resulting in a short circuit that causes an electrical arc inside the fuel tank.

Due to variability and uncertainty in the analytical process, predicting an average probability of 1 in 1 billion does not necessarily mean that a condition is extremely improbable; it is simply evidence that can be used to support the conclusion that a condition is extremely improbable. Wherever part 25 requires that a condition be “extremely improbable,” the compliance method, whether qualitative, quantitative, or a combination of the two, along with engineering judgment, must provide convincing evidence that the condition will not occur in service.

Request To Revise Definition of Critical Design Configuration Control Limitations

One commenter requests that proposed § 25.981(b) be changed to revise or delete the reference to “critical design configuration control limitations.” This commenter cannot agree with the definition stated in the notice as:

* * * any information necessary to maintain those design features that have been defined in the original type design as needed to preclude development of ignition sources.

The commenter raises several concerns regarding the definition and implications of critical design configuration control limitations:

First, the commenter is concerned that within the definition, “any information necessary” can be interpreted as being not only the provision of maintenance and inspection instructions, but also the provision of the fuel tank design features itself. This could include material specifications, specific manufacturing processes, dimensions, etc. The commenter states that this means the type certificate holder would be required to list its proprietary design approach, which could lead to a loss of competitive edge and an infringement on proprietary intellectual property. The commenter objects to this requirement because it would allegedly sacrifice the hard earned competitive advantage that manufacturers derive through their expertise and continuing investment in research and development. As an example, the commenter asserts, “if a certain pump is qualified on the airplane, the industry does not believe it is appropriate or necessary to list all of the features inherent to that pump itself that were qualified as part of the units approval. This approved parts list and the associated installation and maintenance manuals suffice for maintaining the airworthiness of this pump.”

Second, the commenter is concerned that this would put an unprecedented liability risk on the type certificate holder if it omits some features, either through error or because it did not realize a supplementary function provided by the features. (The commenter provided no further explanation or substantiation of this concern, however.)

Third, the commenter states that the notion of critical design configuration control limitations goes beyond the notion of inspection and maintenance. In this regard, it does not imply the same compliance requirement as § 25.571, which is the FAA's stated precedent for the proposed rule.

Fourth, the commenter considers that critical design configuration control limitations go against standard industry practice regarding what manufacturers should provide to users.

Fifth, the commenter states that the notion of critical design configuration control limitations attempts to cover deficiencies in the STC and the airline modification approval process by indirectly “implicating” the manufacturer in changes to the certificated configuration that the manufacturer may not have known about or performed.

For these reasons, the commenter requests that the proposed rule be revised to delete or change the requirement concerning critical design configuration control limitations.

FAA's Response: The FAA does not concur with the commenter's request to revise the rule, and provides the following disposition of each of the commenter's concerns.

1. Concern about release of proprietary information. The FAA has always required manufacturers to provide information that is necessary to maintain the safety of a product. For example, information that is contained in many maintenance manuals might be considered proprietary in nature, but the FAA requires each manufacturer to develop instructions for continued airworthiness for their products containing this information. Defining features of an airplane design, such as wire separation, explosion proof features of a fuel pump, maintenance intervals for transient suppression devices, minimum bonding jumper resistance levels, etc., is needed so that any maintenance actions or subsequent changes to the product made by operators or the manufacturer do not degrade the level of safety of the original type design. The definition of critical design configuration control limitations does not include “all of the features inherent” in the design; it only includes information that is necessary to ensure safety of fuel tank systems. The policy determination underlying this requirement is that design approval applicants subject to this requirement should be required to develop this information and make it available to operators of affected airplanes. This is consistent with the policy regarding airworthiness limitations required by § 25.571 (“Damage-tolerance and fatigue evaluation of structure”).

2. Concern about liability of type certificate holders. The FAA disagrees that risk of liability is an issue. If conscientiously implemented, this requirement will significantly reduce the risk of accidents from fuel tank explosions. This, in turn, will reduce the liability risk of design approval holders.

3. Concern about new inspection and maintenance requirements. The FAA agrees in part with the commenter. While it is true that the term “critical design configuration control limitations” is new and may result in new inspection and maintenance requirements, the very intent of this rule is to require mandatory maintenance and inspection for the fuel tank system. We agree that the compliance requirements are different between § 25.571 and § 25.981. However, these differences are due to the differences between structures and systems. For example, service experience indicates that alterations have been made to systems affecting fuel tank safety without consideration of the effects of the alterations. One purpose of critical design configuration control limitations is to ensure that maintenance personnel are informed of and address these effects. In the context of structures, the primary concern has been aging phenomena such as fatigue, and the limitations are intended to ensure that these phenomena are identified and addressed before they become critical. The result in both instances is mandatory maintenance and inspection requirements for both fuel tank systems and structures. We have determined that the fuel tank system warrants mandatory minimum maintenance criteria to prevent catastrophic failure. By placing these requirements in the Airworthiness Limitations section of the Instructions for Continued Airworthiness, the design approval holder provides consistent mandatory baseline maintenance standards for the fleet.

4. Concern that the requirement goes against standard industry practice regarding what manufacturers should provide to users. The FAA agrees that the proposed rule may differ from historical industry practice. However, the purpose of this rule is to improve both the safety of the fleet and the practices within the industry. The information we are requiring the design approval holder to provide to the operator is basic information needed by the industry to operate airplanes safely. It will provide operators with a baseline document to develop a maintenance and inspection program that will enhance safety within the fleet. It will also aid the operator in establishing the configuration requirements that must be accounted for during any subsequent alterations to the airplane.

5. Concern about covering deficiencies in the STC and modification approval process by indirectly implicating the manufacturer. The FAA disagrees that the definition of critical design configuration control limitations “implicates” the TC holder in configuration changes made by others. On the contrary, these limitations provide TC holders with the ability to limit the types of changes that may be made to their designs that could adversely affect their safety.

Request To Delete Use of Placards and Decals

One commenter requests that § 25.981(b) of the proposed rule be revised to delete the requirements concerning placement of placards or decals in the areas where “maintenance, repairs, or alterations may violate the critical design configuration limitations.” The commenter agrees that adequate information regarding general design practices and precautions must be available to those who perform and approve repairs and alterations to the airplane. However, the commenter argues that placing placards and decals on the airplane may not be practical, considering that they might not remain in place or be readable over time. The commenter suggests that a more effective way to convey fuel system general practices information to operators is via the standard-practices section of the Aircraft Maintenance Manual (or a similar section of another appropriate manual). The commenter does agree that the fuel quantity indicating system (FQIS) wiring could be better identified, and suggests that manufacturers work with the appropriate agencies to develop a standardized system (similar to that for oxygen lines) to identify critical fuel systems wiring for future aircraft designs.

FAA's Response: The FAA concurs in part with the commenter. The rule is meant to be a performance-based rule; therefore, the FAA's objective is not to mandate the use of any specific means of providing visual identification of critical design control limitations. Although the text suggests the use of placards and decals, the rule allows visible means other than placards and decals to be used. Placards are normally used in many locations of transport airplanes to convey information to maintenance personnel, but placards are only one option of identifying critical design configuration limitations. The FAA also recognizes that installation and maintenance of placards in certain locations of the airplane may not be practical.

The objective of this requirement is to provide a means to assist maintenance personnel in reducing maintenance errors. Adverse service experience demonstrates that modifications have inadvertently resulted in routing of high power wiring with FQIS wiring. The need to provide visible identification of critical design configuration control limitations will depend upon the particular airplane configuration.

As an example, the FAA anticipates that the requirements of this rule will result in modifications either to separate FQIS wiring from high power sources, or to install transient suppression devices. If transient suppression devices are incorporated into the FQIS, the FAA would not consider separation of the wiring from other high power wiring a critical design configuration item and, therefore, would not require visible identification. If separation of FQIS from high power sources wiring is critical, the FAA will require a visible means of identification. One acceptable means of compliance in this case would be to install color-coded tape at specified intervals along critical wiring.

To clarify the intent of this requirement, we have revised the wording within the rule to eliminate reference to placards and decals. The text of the final rule states only that a visible means of identification must be provided.

Discussion of Comments on Appendix H25.4, Instructions for Continued Airworthiness

Request To Mandate Certification Maintenance Requirements Instead of Appendix

One commenter opposes the proposed Appendix H25.4(a)(2), which would require revising the Instructions for Continued Airworthiness (ICA) to set forth each mandatory replacement time, inspection interval, related inspection procedure, and all critical design configuration control limitations approved under § 25.981 for the fuel tank system. The commenter considers that singling out just the fuel system for this requirement is not justified because all systems have their own criticalities that must be documented. The commenter asserts that this proposed requirement fails to recognize that equivalent systems-related tasks are already defined under Certification Maintenance Requirements (CMR), a process that has been in place since the early 1980's and formalized in 1994. [CMR's are maintenance requirements that identify aircraft system-related safety tasks for “dormant” (latent) failure conditions related to hazardous and catastrophic failure conditions.] The commenter states that CMR's are considered the systems equivalent of the structural airworthiness limitations and are part of today's certification process, even though CMR's are not included in part 25. The FAA Aircraft Certification Offices (ACO) and other prime certifying authorities regularly approve CMR's, and all operators' maintenance programs use these same CMR's. This commenter states that the proposed requirement indirectly regroups all maintenance tasks associated with the prevention of fuel tank ignition sources under the responsibility of the ACO, and this undermines the MRB process as well as the FAA's Aircraft Evaluation Groups' (AEG) responsibility in approving maintenance programs.

In light of this, the commenter suggests that rather than regulate the CMR concept system-by-system as the proposed Appendix would do, the FAA should pursue a separate regulatory initiative that would give official recognition of the CMR's and make them enforceable. The commenter states that doing so would “fix a long-standing regulatory deficiency.” The advantage of such an alternative rulemaking approach is that it would:

• Keep current procedures and processes in place and avoid the creation of another bureaucratic approval process;
• Accomplish the FAA objective of requiring manufacturers to create an Airworthiness Limitations section in the Instructions for Continued Airworthiness similar to that approved under § 25.571 for structure; and
• Eliminate the need to enforce mandatory inspection or other procedures via § 25.981(b).

Similarly, another commenter believes that the FAA should formally recognize the CMR concept in the proposed rule. This commenter states that in doing so, the concept of declaring “critical configuration control limitations,” as proposed in § 25.981(b), would be unnecessary. The commenter recommends the rule be revised to allow use of the Certification Maintenance Coordination Committee (CMCC) process, as described in AC 25-19 (“Certification Maintenance Requirements,” issued November 28, 1994), to allow operators to absorb tasks within the existing maintenance programs if a MSG-3 task is identified. This reduces costs associated with tracking additional Airworthiness Limitations, which would be required in accordance with the proposed Appendix H requirements.

FAA's Response: The FAA does not concur that the rule should be revised to include the CMR process. The concept of this rule goes beyond the current CMR process. CMR's only address mandatory maintenance that is applied to the airplane at the time of original certification. The requirement of this rule for configuration design control limitations will address not only mandatory maintenance actions, but also design features (e.g., wire separation, pump impeller material specification) that cannot be altered except in accordance with the Instructions for Continued Airworthiness (ICA). The configuration design control limitations will be made part of the Airworthiness Limitations section of the ICA; therefore, they will be mandatory in accordance with § 91.403(c).

Further, the current MRB process does not provide a mandatory, legally enforceable means to require mandatory maintenance tasks; nor does it provide the critical control limitations that are needed to assist operators when making future repairs and alterations to an aircraft.

There would be some value in changing the regulations to mandate either application of the CMR process to all systems or including all systems in the Limitations Section of the ICA. However, such action is beyond the scope of the current rulemaking, and would significantly delay action to address fuel tank safety issues. We are considering tasking ARAC to address this issue. If the ARAC process develops an improved proposal, amendment of the regulations to adopt an alternative to the actions required by this final rule can be made at that time.

Discussion of Comments on Operating Rules

Request To Revise Maintenance Operations Requirements

One commenter agrees in principle with the intent of the proposed changes to §§ 91.410, 121.370, and 125.248, and supports the concept of reviewing and revising, if necessary, the fuel tank system maintenance and inspection program. However, the commenter disagrees with the FAA's proposed methodology and time frame for fulfilling this intent.

As for the FAA's methodology, the commenter opposes mandating changes to maintenance programs via operations rules. Instead, the commenter requests that mandatory maintenance tasks be introduced using current industry practices, such as the use of the Maintenance Review Board (MRB) process and MSG guidelines. The commenter states that the inspection programs developed using these processes are based on a foundation of information derived from various sources using a defined process.

Further, the commenter states that the manufacturers' recommended maintenance and inspection programs already serve as the basis for developing operators' individual maintenance and inspection programs. Within these established programs, safety issues are identified and addressed at both the type certification and continued-airworthiness levels. The FAA has internal processes for managing the approval of manufacturer-developed maintenance and inspections programs, safety tasks, and the final individual-operator maintenance and inspection programs.

However, the commenter maintains that it appears that the proposed requirements will “dissolve” this existing process only to require meeting a calendar deadline. The commenter does not consider that this will lead to a safety enhancement.

This commenter suggests the following alternative for implementing a new or revised maintenance program:

First, the fuel tank system maintenance programs should be reexamined in context both with the results of the required SFAR safety review and with the existing MRB and other mandated programs [such as the Corrosion Protection Control Program (CPCP) and Supplemental Structural Inspection Program (SSID)].

Second, the approval process described in AC 25-19, “Certification Maintenance Requirements (CMR),” should be used, as appropriate, to determine the task classification, interval, and method of task transmission (for example, via service bulletins or via the existing program update process).

Third, the FAA should mandate via AD's the service bulletins or program interval changes developed as an outcome of this process. This way, any changes in maintenance and inspection programs can be communicated to operators in an approved format that is compatible with the aircraft certification basis.

Based on this suggested alternative, the commenter requests that the rule be revised to delete the proposed § § 91.410, 121.370, and 125.248.

FAA's Response: The FAA does not concur with this commenter. First, the MRB process is not a means to mandate compliance; it is a means to identify manufacturers' recommended minimum initial scheduled inspection and maintenance tasks for new aircraft. Further, in light of service history regarding fuel tank events, it is apparent that the MRB using the MSG-3 process has previously been unable to develop adequate maintenance procedures to address various fuel tank safety issues. Second, for the reasons discussed previously, the FAA does not agree that changing the current approach to CMR's is appropriate in this rulemaking. Third, while AD's are enforceable, they generally are limited to safety issues of specific aircraft models. As discussed in the preamble to the notice and previously in this final rule, there is no advantage in addressing this industry-wide safety issue in a piecemeal fashion. We anticipate that in complying with this rule both designers and operators will take advantage of many of the methods developed in existing cooperative programs noted by the commenter.

Request for Definition of “Administrator”

One commenter requests clarification of the term “the Administrator,” as it is used in proposed § § 91.410, 121.320, 125.248, and 129.14. The commenter interprets the term “Administrator” to mean “the Federal Aviation Administration or any person to whom he has delegated his authority in the matter concerned.” This is consistent with the definition of the term that appears in 14 CFR part 1 (§ 1.1).

The commenter objects to the inconsistent definition that appeared in the proposal that identified “the Administrator” as “the manager of the cognizant FAA Aircraft Certification Office (ACO).” Instead, the commenter requests that the FAA revise the proposed rule to reflect the formalized, industry-recognized roles of other authority entities, such as the PMI and the MRB process. Specifically, the commenter requests the following revision:

• For approval of the development of the designer's maintenance and inspection program, “the Administrator” is the FAA ACO, the FAA Aircraft Evaluation Group (AEG), or the non-U.S. airworthiness authority (if the FAA ACO has delegated its authority via a bilateral agreement).
• For approval of the individual operator's maintenance program, “the Administrator” is the Principal Maintenance Inspector (PMI).

FAA's Response: The FAA concurs that clarification is necessary. Part 1 of 14 CFR does define the Administrator to include those delegated the authority to act on her behalf. However, in the case of this rule, we have determined that the cognizant ACO is the appropriate entity that can address the myriad of technical and practical issues faced by implementing and enforcing compliance with this rule. As discussed elsewhere, neither the PMI nor the MRB process is authorized to perform these duties. The final rule has been revised to specifically reference the cognizant ACO, or office of the Transport Airplane Directorate, as the appropriate official for approving the initial and any revisions of the instructions for maintenance and inspection of the fuel tank systems required by the rule.

Request for Extension of Compliance Time

Several commenters request that the proposed compliance time for the required actions of § § 91.410, 121.320, 125.248, and 129.14 be extended. These commenters state that incorporating the new instructions into maintenance and inspection programs cannot possibly be accomplished within 18 months as would be provided by the proposal. These commenters request a minimum compliance time of 54 months.

FAA's Response: The FAA concurs that the compliance time can be extended somewhat. As discussed previously in this preamble, we have revised the compliance time to 36 months.

Request To Issue Airworthiness Directives To Change Maintenance Programs Instead of Operating Rules

One commenter disagrees with the proposed requirement to change operators' maintenance programs through changes to the operating requirements. The commenter suggests that the FAA mandate such maintenance actions via Airworthiness Directives specific to each model type, rather than by modifying the operational rules. The AD's will allow both the FAA and the industry to:

• Assess the actual impact of the maintenance program (cost versus benefit);
• Ensure that the appropriate compliance time scale is mandated versus the effective date of the rule and the resources available; and
• Ensure that foreign authorities and operators are notified of the mandatory continuing-airworthiness information via a recognized document (ICAO obligation, Annex 8, paragraph 4.2.2).

Similarly, another commenter states that the proposed operating rule changes are not needed. This commenter asserts that, if the instructions for maintenance and inspections are developed through the MSG-3 process, there is no need to include them in the Airworthiness Limitation section, as would be required by the proposed rule. If they should be mandatory, then the FAA should mandate them by AD's.

FAA's Response: The FAA does not concur with either of these commenters. As discussed in the notice and elsewhere in this final rule, we will issue AD's to mandate any design changes identified as needed as a result of the design review required by the SFAR established by this final rule. However, the FAA considers it inappropriate to delay requiring implementation of the maintenance programs developed as a result of the SFAR. It is evident that existing maintenance programs are generally inadequate to ensure the safety of fuel tanks systems and that program improvements are necessary. As reflected in the regulatory evaluation prepared for this rulemaking, this approach has been found to be cost effective.

As discussed previously, we have carefully considered the first commenters' concerns regarding compliance times, and have extended the times to address those concerns. Finally, foreign authorities have been fully informed of the FAA's activities, and we will continue to include foreign authorities in future discussions of these issues.

Unlike AD's, the operating rule changes adopted by this final rule do not require the adoption of particular programs developed by design approval holders. Rather, the rules require adoption of programs that meet the objective of providing an acceptable level of safety for fuel tank systems. While the programs developed by design approval holders will provide a foundation for operators' programs, the individual operator is responsible to ensure that its programs address the actual configurations of its fuel tank systems.

In the preamble of the notice, we also discussed use of a SFAR and changes to the operating rules, instead of AD's, as the primary means of achieving the regulatory objective. As we stated, we consider that an SFAR provides a means for the FAA to establish clear expectations and standards, as well as a timeframe within which the design approval holders and the public can be confident that fuel tank safety issues on the affected airplanes will be uniformly examined.

This rule ensures that the designer completes a comprehensive assessment of the fuel tank system and develops any required inspections, maintenance instructions, and modifications, if needed. As such, the requirements of this final rule are intended to provide maintenance requirements that will prevent unsafe conditions from developing. This proactive approach provides predictability and efficiency.

Discussion of Comments on Flammability Minimization—§ 25.981(c)

General Agreement With Reducing Flammability

All comments received support the overall goal of reducing fuel tank flammability. Several commenters strongly support the FAA's position that, despite compliance with the proposed flammability reduction portion of the rule, the applicant must ensure compliance with the ignition source prevention requirements.

Other commenters support the proposed rule, but suggest other alternatives. For example, one commenter asks the FAA to consider increasing the scope of the proposal to minimize fuel tank flammability to totally preventing operation of fuel tanks with flammable vapors. Similarly, another commenter requests that the applicability of the proposal be increased so that the flammability of vapors in certain in-service airplanes would be reduced. Other commenters suggest the FAA mandate the installation of means to mitigate the effects of fuel tank ignition, such as metal foils or polyurethane foam should be mandated. Each of these proposals is discussed below.

Request To Retain Assumption of Flammable Ullage

Several commenters recognize that fuel system design has been based on the assumption that the ullage fuel/air mixture is always flammable. However, these commenters express concern that the proposal to require minimization of fuel tank flammability could result in a relaxation of the requirements for precluding ignition sources within the fuel tanks. One commenter asserts that the FAA has retained this assumption for now, but “seems to indicate a willingness to eventually entertain designs that would rely more on flammability minimization and mitigation, potentially allowing designers to assume the absence of a flammable ullage under certain conditions.” This commenter considers that that affordable technology is remote and, therefore, it should be made clear that the design philosophy behind the proposed § 25.981 has firmly retained the assumption of flammable ullage.

FAA's Response: As noted by the commenter, we affirmed that we are not considering a change to the current philosophy of assuming a flammable ullage. However, if technological changes are developed, such as full-time fuel tank inerting, and prove to be a superior method of eliminating the risk of fuel tank ignition, the FAA could consider a change in this philosophy in future rulemaking.

Request To Mandate Means to Preventing Flammable Vapors—Inerting

Several commenters suggest that flammable vapors in the fuel tank should be prevented and that practical technologies currently exist that should be mandated. One commenter suggests that even with § 25.981(c) in place, circumstances might occur operationally in which even an unheated wing tank has a flammable ullage with a relatively low ignition energy threshold, and that these conditions may warrant attention through amending the rule to further reduce flammability in the future.

FAA's Response: The FAA does not concur that mandating fuel tank inerting technology has been shown to be feasible at this time. This was discussed in detail in the preamble to the notice. We are continuing to evaluate further safety improvements, and are conducting research and development to investigate the feasibility of incorporating nitrogen inerting on both in-service and new type design airplanes. As noted previously in this preamble, we tasked the ARAC on July 14, 2000 (65 FR 43800), to evaluate both on-board and ground-based fuel tank inerting systems. If further improvement is found to be practicable, we may consider initiating further rulemaking to address such improvements. In the meantime, this final rule requires a means to minimize flammability or a means to mitigate the effects of ignition. As a performance-based regulation, this allows the use of any effective, approved means, but does not require the use of any one particular means.

Request To Revise Proposed Flammability Standard

One commenter believes that the ARAC report referenced in the preamble to the notice is flawed in its logic, which arrived at a suggested exposure time to explosive conditions not to exceed “7 percent” of fleet operating time. This recommendation was based on comparison of the incident rate of fuel tank explosions and ignition events for center tanks to that for wing tanks. The commenter states that, due to operating procedures, the wing tanks are seldom empty and are not located near any heat sources. While wing tank vapors may be explosive when taxiing on a hot runway for extended periods, they are never as explosive as are those that often exist in empty center tanks. The most serious situation for wing fuel tanks would be when the airplane lands on a hot runway with nearly empty tanks. However, taxi time at landing is usually short. At takeoff, even with a long taxi, the wing tanks will be nearly full with relatively cool fuel. The commenter concludes that to have comparable safety margins for center tanks as for wing tanks, the degree of explosiveness would have to be equivalent.

Another commenter asserts that the proposed flammability requirement is not sufficiently detailed to ensure that compliance can be achieved without having to resort to external guidance, not published in the rule. The commenter is concerned that the proposed rule text is sufficiently vague to promote lack of standardization in findings of compliance with the regulation. Although relevant material is available in the associated AC 25.981-2, the commenter is aware that guidance in the AC is not mandatory and is concerned that the wording of the rule essentially requires an interpretation of “minimize flammability” from the relevant AC.

FAA's Response: The FAA considers that additional clarification is necessary.

As for the first comment, the ARAC recommendation of a 7 percent flammability standard did not provide an equivalent level of flammability to that of the wing (main) tanks, which the ARAC determined were the tanks with an acceptable level of fuel tank safety in relation to ignition or explosion events. The ARAC calculated a range of 3 to 5 percent for wing tanks. We considered this concern when developing the regulatory text for this rule, and this is why the proposal requires flammability to be “minimized” rather than accepting the ARAC recommendation of 7 percent.

In response to the second commenter, we consider it appropriate to further clarify the intent of the rule by incorporating a definition of the term “minimize” in the text of § 25.981(c), as follows:

In the context of this rule, 'minimize' means to incorporate practicable design methods to reduce the likelihood of flammable vapors.

“Practicable design methods” are feasible means, such as transferring heat from the fuel tank (e.g., use of ventilation or cooling air). We have provided further guidance in AC 25.981-2, which describes how demonstrating that the flammability of the fuel tank is equivalent to that of an unheated wing fuel tank would be one acceptable means of showing compliance. As with all new performance based standards, it will be necessary for the Transport Airplane Directorate to participate in the review of proposed means of compliance to ensure standardization.

Request That Rule Based on Flammability Be Delayed Until Standard Is Established

One commenter representing manufacturers and operators agrees in principle with the FAA's overall intent to enhance the fuel system safety of future aircraft designs through measures to reduce fuel tank flammability exposure. The commenter agrees that action should be taken, as identified by the ARAC Fuel Tank Harmonization Working Group, “to address flammability mitigation as a new layer of protection to the fuel system.” However, the commenter disagrees with the proposed § 25.981(c) that would require minimization of fuel tank flammability, because “there is not an agreed-to definitive industry standard for assessing flammability of aircraft fuel tanks.”

In light of this, the commenter requests that a rule based on flammability be delayed until a standard is defined. In its place, the commenter recommends a new rule that would accomplish some degree of flammability reduction, even though a definitive flammability standard does not exist. The commenter suggests that the new rule should require practical measures to reduce heat transfer from adjacent heat sources into fuel tanks, and proposes the following text for the rule:

§ 25.981(c):

If systems adjacent to fuel tanks could cause significant heat transfer to the tanks:

(1) Means to reduce heating of fuel tanks by adjacent systems shall be provided; or (2) Equivalent flammability reduction means shall be provided to offset flammability increases that would otherwise result from heating; or

(3) Means to mitigate the effects of an ignition of fuel vapors within fuel tanks shall be provided such that no damage caused by an ignition will prevent continued safe flight and landing.

FAA's Response: The FAA does not agree with either the commenter's proposal to delay the rule relating to fuel tank flammability or the commenter's proposed regulatory text. The proposal offered by the commenter would require only that a “means to reduce heating of fuel tanks by adjacent systems shall be provided * * *” The proposed text suggested by the comment does not require any measurable reduction in flammability, which is the objective of this rulemaking. For example, under the commenter's suggested standard, if a fuel tank initially contains a flammable fuel-air mixture, a “means to reduce heating of the tank” may reduce the temperature of the fuel, but not necessarily to the extent that the temperature would remain below the flammable range for the duration of the flight.

The commenter asserts that there is no standard for assessing flammability of airplane fuel tanks. However, industry members represented by the commenter were members of the ARAC group that recommended that the regulatory text mandate a maximum fuel tank flammability of 7 percent of the operating time. The ARAC report provides numerous calculations of fuel tank flammability that were conducted by industry representatives. We are confident that industry is capable of assessing fuel tank flammability, and we have provided guidance in AC 25.981-2, which defines methods of demonstrating compliance with the flammability requirements of the rule. One method described in the AC for showing compliance is to demonstrate that the flammability of the tank is equal to or less than that of an unheated wing tank on the airplane type. As discussed previously, § 25.981(c) has been clarified by adding a definition of “minimize.” For applicants who are unable to demonstrate equivalent flammability to an unheated wing tank, the use of “practicable design methods,” such as transferring heat from the fuel tank, will be required. The final rule is adopted with the change noted.

Request Not To Mandate Fuel Tank Flammability to the Level Proposed

The commenter does not agree with the FAA's statement in the preamble to the notice that read:

“* * * the intent of the proposal is to require that fuel tanks are not heated, and cool at a rate equivalent to that of a wing tank in the transport airplane being evaluated.”

For example, directed ventilation systems may reduce heating of adjacent fuel tanks, but they do not eliminate heating. Furthermore, the commenter asserts that there should not be a requirement to “cool at a rate equivalent to that of a wing tank.” The studies conducted by the ARAC Fuel Tank Harmonization Working Group did not conclude that such a requirement was necessary or achievable. The commenter requests that the FAA not mandate minimizing fuel tank flammability to the level proposed in the notice, because it would not be practical to cool tanks within the fuselage to the same level as tanks located in the wing.

FAA's Response: The FAA disagrees. The rule only affects new type designs. Therefore, possible design considerations to comply with the rule would include:

• Locating heat sources away from fuel tanks;
• Introduction of cool air from outside sources into air gaps between heat sources and fuel tanks to transfer heat from tanks while inflight; and
• Introducing cool air from ground or airplane sources during ground operations.

Some of these features are already incorporated into certain models of the transport fleet. These methods are technically feasible and could provide an equivalent level of exposure to operation with flammable vapors to that of unheated wing fuel tanks—the fuel tanks with a safety level that the ARAC defined as an acceptable standard. The commenter provided no data to support the assertion that “it would not be practical to cool tanks within the fuselage to the same level as tanks located in the wing.”

Request To Provide Alternatives to Minimizing Flammability

Two commenters request that alternative regulatory text be included in the proposed rule concerning the requirement to minimize flammability.

The first commenter believes that the FAA's intent, as stated in the preamble to the notice and restated in draft AC 25.981-2X, is “to require that the exposure to formation or presence of flammable vapors is equivalent to that of an unheated wing tank in the transport airplane being evaluated.” The commenter considers this a reasonable objective. The commenter recommends that the FAA reword the proposed rule text to clearly frame the intent within the rule itself, and believes that the wording would be more specific and less prone to misinterpretation if it contained the following statement:

A means must be provided to ensure that the net heat balance within any tank will be equivalent to that of an unheated wing fuel tank during any portion of the passenger carrying operation.

The commenter adds that, if an unheated wing fuel tank does not exist on a particular design, then one could be modeled and used as the reference standard for all tanks on that design.

The second commenter recommends that the FAA consider an alternative to have the applicant determine an acceptable heat transfer rate at a critical fuel load, rather than determining if a temperature limitation is exceeded, given that the tank ullage is considered flammable. This would alleviate the difficulties of working with a high number of parameters inherent in the numerous aircraft types and conditions (including the effects of pumping, vibration, altitude, fuel load, etc.) by considering a generic installation.

FAA's Response: The FAA does not agree with either commenter. Minimizing flammability is the ultimate objective of the rule. We considered many options when establishing the regulatory text, and determined that a performance-based rule is most appropriate because it allows the designer to control fuel tank flammability by using any number of methods. It also allows the use of new technology designs that may be developed in the future. On the other hand, the commenters' proposals focus only on heat balance and heat transfer, rather than flammability. Their proposals would not allow the designer the flexibility to introduce other means of reducing flammability, other than controlling heating/cooling of the tank, such as with nitrogen inerting. Further, the commenters' proposals would not significantly simplify the compliance demonstration over that of the options described in AC 25.981-2X. In light of this, the commenters' proposals are not accepted.

Request To Require Retroactive Reduction in Flammability

One commenter states that the designs of some in-service airplanes have shown undesirable characteristics. Because the proposed flammability requirements would only affect new airplane type designs, this commenter seeks insurance from the FAA that older and current designs also will be assessed, and suggests a case-by-case approach.

FAA's Response: The FAA agrees that some in-service airplanes have undesirable levels of fuel tank flammability. To address this issue, we tasked the ARAC in 1998 to provide advice and recommendations on methods that could eliminate or significantly reduce the exposure of transport airplane fuel tanks to flammable vapors. Our review of the ARAC report indicates that additional time is needed to perform the in-depth research and economic evaluations necessary to determine if certain technologies that could reduce or eliminate fuel tank flammability would be practical for use on the existing fleet of transport airplanes. As noted previously, we also are studying concepts such as ventilating spaces adjacent to fuel tanks, and recently tasked the ARAC to evaluate inerting systems for possible retrofit into the existing transport fleet. We will consider initiating additional rulemaking if further improvements are found to be effective and practicable.

Request To Ban Use of Low Flash Point Fuels

Several commenters suggest that the use of lower flash point fuels, such as JP-4 or Jet B, should be disallowed because these fuels cause a much greater exposure to flammable vapors. One commenter notes that while it appears that these fuels are no longer commonly used, they may still exist as approved alternative fuels for several transport aircraft. If any operators routinely use Jet B or JP-4 type fuel, then their risk would be much greater than the risk for operators using Jet A.

FAA's Response: The FAA agrees that use of lower flash point fuels increases the exposure to operation with flammable fuels in the fuel tank. In fact, this rule does require consideration of fuel type. The limited use of these fuels on a temporary basis to allow operation from remote airports is discussed in AC 25.981-2. The FAA does not agree that use of these fuels should be banned for in-service airplanes. Data available indicates that these fuels are not routinely used in U.S. operations. However, in some cases, airplanes may divert into locations where JP-4 fuel is the only fuel available. Use of this fuel on a temporary basis allows continuation of the flight without requiring tankering of Jet A fuel to a remote alternate airport and the associated delays and inconvenience to the flying public. If use of lower flash point fuels increases due to market conditions, the FAA will consider rulemaking to limit their use.

Request To Require Use of Means To Prevent Fire Within Fuel Tank

Several commenters request that the FAA revise § 25.981(c)(2) to require the use of specific means to address the requirement to mitigate the effect of an ignition of fuel vapors within the fuel tanks. Some of the commenters' suggestions include flame quenching metallic foils and polyurethane foam. These commenters state that such technologies as these are available and consider them effective in preventing propagation of flame or explosion within the fuel tanks

FAA's Response: The FAA does not agree that a change to the proposed rule is necessary. As stated previously, the final rule is a performance-based regulation. As such, it may permit the use of such means as those suggested by commenters, but the rule does not require the use of any one particular means. AC 25.981-2 provides guidance on use of these means.

Discussion of Comments Concerning Cost of the Rule

The detailed responses and the impacts of the comments on the costs of the rule are contained in the Final Regulatory Evaluation, which is available in the docket. The quantitative effects of the comments on the assumptions and the cost estimates are summarized in the Economic Evaluation discussion later in this final rule. The following discussion is a more general disposition of the comments concerning the cost of the rule.

Number of Airplanes, TC's, and STC's Affected

One commenter notes that the FAA assumed that a U.S. fleet size of 6,006 airplanes would be affected by the proposed rule. While this number may have been appropriate in 1996, the commenter states that by the time the final rule is issued, there likely will be more than 7,000 affected airplanes.

Additionally, the commenter notes that the number of affected type certificates counted by the FAA did not include the Fokker Model F27 Mark 50 or the Boeing Model 717. Further, the FAA's listing of fuel system STC's was incomplete; for example, there were no fuel tank system STC's listed for any Airbus, Fokker, Bombardier, or Aerospatiale airplanes.

Finally, the commenter states that the FAA's cost estimate should take into account the worldwide impact that the proposed rule will have, as other regulatory authorities adopt identical or similar rules. Thus, the true cost of this activity will far exceed the cost associated with only the U.S. fleet.

FAA's Response: The FAA concurs with the commenter that the number of airplanes in the U.S. fleet has increased since the data set used in the notice was collected. As a result, we now estimate that 7,875 U.S.-registered airplanes will undergo the fuel tank system inspections beginning in the year 2004. The economic analysis has been modified accordingly.

We agree with the commenter that our analysis had not included any Fokker Model F27 Mark 50 or Boeing Model 717 airplanes in the fleet. The reason was that the fleet data set that we used contained no U.S.-registered Model F27 Mark 50 airplanes. The more recent data set we used for the final regulatory evaluation also contains no U.S.-registered Model F27 Mark 50 airplanes; thus, those airplanes are not included in the analysis. We did not include any Model 717 airplanes because that fleet data was based on a 1996 listing when no Model 717 airplanes had yet been manufactured. The airplane data set that we used in the final regulatory evaluation is based on 1999 data and contains Model 717 airplanes. We also note that even though the 1999 fleet data set reported no U.S. registered Airbus Model A321, A330, or A340 airplanes, we assumed that these models will enter the U.S. fleet eventually and, therefore, the costs to review these fuel tank systems were included in the analysis.

We agree with the commenter that the analysis had not included all of the fuel tank system STC's. After further research, we discovered one fuel tank system STC for an Airbus airplane model, one fuel tank system STC for a Bombardier airplane model, and no fuel tank system STC's for Fokker or Aerospatiale airplane models. The economic analysis has been adjusted accordingly.

We do not agree with the commenter regarding consideration of worldwide impact of this rulemaking. The FAA is not required to account for costs to foreign operators not operating in the U.S. because those operators are not subject to these rules.

Cost of Evaluating Non-Fuel System-Related STC's

One commenter agrees with the FAA that only a small number of non-fuel-system STC's will require a system assessment. However, the commenter asserts that the FAA's analysis does not account for the significant effort and associated cost that would be required to determine whether or not these non-fuel system-related STC's affect the fuel system and thus merit further attention. Such a determination would be required under the proposed SFAR requirements.

FAA's Response: The FAA agrees that the costs to determine which STC's affect the fuel tank system should be included in the economic analysis. However, we have determined that 90 percent of the non-fuel tank system STC's will need only a minimal degree of engineering effort (with a resultant minimal cost) for a qualitative evaluation of their effects on the fuel tank system. We also have determined that 325 non-fuel tank system STC holders will each need to conduct a more detailed engineering review that will involve an average of 75 hours of engineering time. The economic analysis has been revised accordingly.

Cost of Use of Proprietary Data

One commenter raises concerns regarding the costs associated with STC holders obtaining data from the type approval holder. The commenter points out that, in the “Regulatory Evaluation” section of the notice, the FAA stated:

Many STC holders would be able to incorporate a large portion of a TC holder's fuel tank system assessment into its assessment.

The commenter states that, in practice, the release of such proprietary information to a third party would need to occur under a technical assistance contract. Therefore, the cost of this transaction should be added to the FAA's cost analysis.

FAA's Response: The FAA disagrees with this commenter. While a technical assistance contract may be needed to obtain this information, the overall cost to the aviation industry is not affected because the payment to the data holder will offset some of the engineering costs associated with the fuel tank system design review. As a result, the overall cost of the rule is not affected by these contracts, although the distribution of a part of these costs will shift from certain TC holders to certain STC holders.

Cost of Fuel Tank System Safety Review Required by SFAR

One commenter disagrees with the FAA's estimate of $14.4 million for the costs of completing the fuel tank system reviews required by the proposed SFAR. The commenter points out that the FAA estimated that the review would require 0.5 to 2 engineering years per airplane model. However, the commenter calculates the actual level of effort required will be more like 2 to 4 engineering years for each major model. Minor model variation will add additional effort that is difficult to quantify, but could easily increase the total effort by 30 to 50 percent. In addition, the commenter states that systems do evolve with time, leading to additional permutations that must be considered.

In light of this, the commenter believes that the basic safety reviews will require two to three times more effort and cost than identified by the FAA. Accordingly, the cost of the basic design review may be in the range of $28 million to $52 million, plus an additional $14 million to account for the variations within models.

FAA's Response: The FAA agrees that the number of engineering hours to review the fuel tank systems should be increased but disagrees about the amount of the increase. As discussed later in more detail in the Economic Evaluation section of this preamble, we determined that there were two types of fuel tank system reviews:

• The first, which is referred to as the “full-scale” review, is the first fuel tank review done for a model that has several series.
• The second, which is referred to as the “derivative” review, are the reviews of the other series in that model.

Using the Boeing Model 737-300/-400/-500 as an example, we determined that this model will involve one “full-scale” review and two “derivative” reviews. In addition, the fuel tank system reviews performed for all “extended range” series and freighter series are evaluated as “derivative” reviews. On that basis, we determined that, depending upon the model, it will take 6 months to 4 years of engineering time to perform a “full-scale” fuel tank system review. The FAA also determined that it will take 6 months to 1 year of engineering time to perform a “derivative” fuel tank system review. (See the commonality of design discussion presented earlier in this preamble for an engineering explanation why the review of a model's series after the first review will take less time than the first review.)

The FAA agrees that the number of fuel tank system reviews needs to be increased, but disagrees about the extent of the increase. The FAA determined that the rule will require 46 “full-scale” reviews and 52 “derivative” reviews. The impact on the total cost of these reviews is provided in the Economic Evaluation section of this preamble.

Cost of Safety Review of Older Type Designs

One commenter, Lockheed Martin, considers that the FAA clearly underestimated the costs to conduct the safety review required under the new SFAR on older airplanes, such as the Lockheed Model L-188 Electra. The commenter notes that the FAA's economic analysis of the cost of the design review proposed in the notice is based on a fleet-wide consideration. This approach results in a per-aircraft-cost basis that does not appear unreasonable. However, the expense to perform the design reviews and prepare service documents will be the same for Lockheed as for other manufacturers that have twenty or thirty operators and hundreds of operating aircraft. (They commenter reports that there are only 13 Model L-188 Electras currently operating in the U.S.)

The commenter requests that the FAA take into consideration the following information when finalizing the economic analysis of the proposed rule:

1. The FAA's cost benefit analysis identifies an engineering effort to perform the SFAR safety review and preparation of documents as taking from three-quarters to three person years to perform. However, because the Model L-188 Electra was certified prior to the issuance of § 25.901 and § 25.1309, the SFAR safety review will require all new analysis and possibly testing to prove that the design meets the requirement for all operating conditions. The effort to do this will likely exceed the maximum FAA estimate of three person years.

2. Then, the time to familiarize a new staff with the design, to locate pertinent files, to relate those files to the long history of the aircraft, and to develop test and compliance documents for new regulations are time-consuming tasks that will add significant time and costs to the FAA's estimates.

3. If the analysis shows that the design does not meet the newly imposed requirements, redesign will be necessary. Such redesign would increase the expense by a factor of 3 to 5, depending on the detail. It would also increase considerably the expense to the operator of installing the new design.

FAA's Response: The FAA agrees that additional time and costs will be required to review the designs on some airplane types where design information is not readily available. However, the FAA does not agree that all of the work identified by the commenter is necessarily required. As discussed previously in this preamble, the FAA extended the compliance time for conducting the actions required by the SFAR, which addresses the commenter's concern about the needed time. Further, the FAA increased the number of engineering years to complete a Model L-188 fuel tank system design review to 4 years. Additionally, as noted in the earlier disposition of the comment relating to the applicability of the SFAR, the FAA will consider the merits of exemptions to the requirements of the SFAR based upon the number of airplanes in service and the safety benefits that could be achieved by a safety review.

Cost of Safety Review of STC's on Older Airplanes

While commenters generally agree that the design review should apply to STC's and field modifications, several commenters express concern that the design review will be difficult to conduct on older airplanes. In particular, reviewing non-fuel tank related STC's and field approvals could be unmanageable for airplanes with a long service life and with multiple owners. The commenters note that the FAA did not make any accounting in the notice for the cost of addressing these modifications.

One commenter proposes an alternative approach: A one-time inspection to determine the configuration of the airplane and to verify that wiring entering the fuel tank, and systems capable of generating auto-ignition temperature into fuel tank structure, have not been compromised by STC modifications. The commenter asserts that such an inspection would require about 50 to 100 labor hours to perform. The resultant inspection labor costs alone could amount to $28 million to $52 million, depending upon the number of airplanes to be inspected (for example, 7,000 airplanes × 100 hours per airplane × $70 per labor-hour). This estimate does not include the cost of the downtime (and resultant revenue loss) required to accomplish such an inspection; yet the proposed compliance time of 12 months would require airplanes to be pulled from revenue service for special inspection. In the notice, the FAA had estimated that an annual increase in out-of-service time of 11.5 hours to 32 hours would occur, depending upon the model, and that this would result in lost net revenues of $6.4 million for a 12-month period. The commenter maintains that the one-time inspection alternative would also require this much downtime.

FAA's Response: The FAA agrees that the costs associated with reviewing non-fuel tank-related STC's and field approvals needs to be addressed. However, we disagree with the commenter as to the direction and magnitude of the effort that will be needed to evaluate these factors. Specifically, we agree that a “paper review” of the airplane's service history will be needed for compliance. We disagree that this review will necessitate an airplane inspection that is separate from the initial fuel tank system inspection and that the labor hours for any such airplane inspection have been included in the labor hours to complete the initial fuel tank inspection. We agree that the amount of effort to complete this “paper review” will vary across individual airplanes. Airplanes that have been in near-continuous operation by major, national, and regional airlines (the majority of the airplanes affected by the rule) should possess well-documented service history records such that those operators will need a minimal amount of time to complete the paper reviews for those airplanes. However, we realize that there will be smaller operators that will spend more time to trace their airplanes' service histories—particularly if the airplane has had multiple operators and owners. As a result, we have determined that it will take an average of one engineering day (a cost of $880 per airplane) for an operator to complete this paper review for every airplane.

Cost of Design Changes

Several commenters raise concerns about accounting for the costs of new design changes that could be required under the proposed SFAR requirements. One commenter representing manufacturers and operators agrees, in general, that any design changes resulting from the safety review should be handled outside the scope of the SFAR. However, there would be additional costs associated with developing the necessary design changes identified by the SFAR safety reviews. The commenter points out that, in the notice, the FAA stated:

* * * the design review may identify conditions that would be addressed by specific service bulletins or unsafe conditions that would result in FAA issuance of an airworthiness directive (AD). However, those future costs would be the result of compliance with the service bulletin or the AD and are not costs of compliance with the proposed rulemaking. Those costs would be estimated for each individual AD, when proposed.

This commenter does not consider it appropriate for the FAA to assert that none of these costs are attributable to the proposed rulemaking. In those instances where new rules are created that go beyond existing rules—essentially raising the current level of safety—the cost of any design change driven by these new rules should be considered as part of the total cost of the rule.

The commenter points to § 25.981(a)(3) as such a rule that proposes new, more-stringent requirements associated with evaluating the effects of latent failures. Should compliance with this specific rule require design changes broadly across the fleet, the costs would be substantial. For example, if this rule were to affect half the U.S. fleet (about 3,500 airplanes), and new design change costs averaged $40,000 per airplane, the total cost would be $140 million.

The commenter acknowledges that it is not possible to predict what effect the proposed rule would actually have on the fleet, but the potential obviously exists for costs that range between $100 million and $200 million, or more.

FAA's Response: The FAA disagrees that the cost of new design change requirements should be included in the cost analysis for this rule. As discussed in the notice, new design change requirements will be implemented through the AD process, during which the FAA will fully analyze the costs and the public will have an opportunity to comment on the FAA's estimates.

Cost of Developing Maintenance and Inspection Instructions

One commenter disagrees with the FAA's assumption that the development of maintenance and inspection instructions would simply be part of the required SFAR safety review. On the contrary, this commenter states that this work, in fact, must be done after completion of the safety review. However, the commenter states that, if one assumes that this effort represents 20 to 30 percent of the effort associated with the basic safety review, then the cost could be on the order of $10 million.

FAA's Response: The FAA partially disagrees that the costs of developing the maintenance instructions were not included in the cost analysis of the rule. The estimated labor hours required for the design review specifically included an estimate of 0.15 year to one year of engineering time for the TC holders, and 0.1 year to 0.25 year for the fuel tank system STC holders, to develop the inspection and maintenance recommendations. Further, we had assumed that the design approval holder recommendations would have been completed after the fuel tank system review. Nevertheless, as the proposed compliance time was 1 year, the fact that developing the recommendations after completing the fuel tank system review had no effect on the present value of the estimated costs because all of the expenditures would have occurred in the first year. This is not the case for the 18-month compliance time provided in the final rule. We have determined that all of the engineering costs to develop the recommendations will occur during the second year after the effective date of the rule. We have included those costs in the final economic analysis.

Cost To Comply With the SFAR

One commenter asserts that the combined cost of the safety review and development of instructions may well be $180 to $330 million, rather than the $16 million estimated by the FAA.

FAA's Response: The FAA disagrees with the underlying assumptions made by the commenter to develop this estimate. The commenter's first assumption is that $100 million to $200 million of these costs are based on the commenter's argument that, “Should compliance with this specific rule require design changes broadly across the fleet, the costs would be substantial. For example, if [emphasis FAA] this rule were to impact half the U.S. fleet (about 3,500 airplanes) and modification costs averaged $40,000 per airplane, the total cost would be $140 million. It is not possible to predict what effect this new rule would actually have on the fleet, but the potential obviously exists for costs that range between $100 million and $200 million, or more.” [The commenter is referring to the requirements of § 25.981(a)(3) of the rule, which involve evaluating the effects of latent failures.]

This argument assumes that the cost of the potential future AD's should be attributed to this rule. As stated earlier, we maintain that the cost of complying with potential future AD's is attributed specifically to those individual AD's when they are issued. As a result, we have determined that there are no compliance costs attributable to this rule for any future design changes that will be accomplished through an AD.

The commenter's second assumption is that the fuel tank system review costs will be two to three times the $16 million estimated by the FAA, plus there will be an additional $14 million to review the fuel tanks for the variations within models. As noted earlier, we disagree with the amount of engineering time assumed by the commenter, as well as the number of fuel tank reviews that will be performed. We have recalculated the estimated compliance cost and determined that it will be about $30 million.

Finally, the commenter assumes that each airplane will need a one-time inspection to verify that previous airplane modifications have not compromised the wiring entering the fuel tank and entering the systems capable of generating autoignition temperatures into fuel tank structure. The commenter estimates this will cost $28 million to $52 million for labor, and $6.4 million for lost net revenue due to out-of-service time. As noted earlier, we agree that an individual airplane review will be needed, but we disagree in that the labor hours have been included as part of the labor hours to perform the initial fuel tank system inspection. We have, however, calculated a $5.5 million cost for a “paper review” of every airplane's service history.

Based on these figures, we conclude that the costs to comply with the SFAR will be $35.5 million. (More details concerning these costs are explained later in this preamble.)

Cost of Operating Rule Changes

One commenter agrees with the statement in the notice that read:

The FAA intends that any additional fuel tank system inspection and maintenance actions resulting from the SFAR review would occur during an airplane's regularly scheduled major maintenance checks. From a safety standpoint, repeated entry increases the risk of damage to the airplane. Thus, the proposal would not require air carriers to alter their maintenance schedules, and the FAA anticipates that few or no airplanes would be taken out of service solely to comply with the proposal unless an immediate safety concern is identified.

This commenter strongly recommends that the FAA ensure that the final rule does not penalize the industry by requiring inspection intervals more frequent than truly necessary, or lead to unnecessary hard-timing of (placing life-limits on) components.

FAA's Response: The FAA responds to this commenter by reiterating that the intent is to have the maintenance and inspections generated by this rule be developed so that the tasks can be performed during regularly scheduled maintenance.

Cost of Inspections

One commenter disagrees with the number of hours that the FAA estimated would be required to conduct the added inspections required by the rule. The commenter calculates that the metric will be 300 to 500 labor hours per airplane every 9 to 11 years, plus any parts replacement costs yet to be defined by the manufacturer.

Another commenter suggests that the cost analysis needs to be adjusted to address in-tank inspections. The commenter asserts that the FAA assumes that much of the in-tank inspection work will be accomplished during heavy maintenance checks when the tanks are open and purged. However, for some aircraft, the tanks are opened only once every eight years for scheduled maintenance. Therefore, if in-tank inspections are mandated, some aircraft will have to be removed from scheduled service and the costs associated with this should be considered in the rule. Also, the costs of preparing tanks for entry should be considered.

FAA's Response: The FAA agrees with the first commenter. Assuming the commenter's airplanes were manufactured between 1960 and 1980, we calculated that the initial fuel tank system inspection, plus the two reinspections that will occur during a 12-year period, will result in a total number of 330 labor hours per airplane.

We disagree with the second commenter. The commenter states that 60 percent of the initial fuel tank system inspections will be performed during a “C” check , which will require that the fuel tank be opened, drained, and vented. We included these costs in the number of labor hours for the initial inspection, which are twice the number of labor hours for the later reinspections that will be performed during “D” checks. Further, we included a value for the lost net revenue to the aviation system as a result of the additional number of out-of-service days (from one to three days) for the initial fuel tank system inspections performed during the “C” check.

Cost of Complying With New Method of Addressing Latent Failures

One commenter states that the new treatment of latent failures (to maintain the probability of occurrence of a given latent failure to less than 1×10⁻⁷), as would be required by § 25.981(a)(3), will lead to enormous costs with no attendant benefit. As an example, a component with a latent failure rate of 1 × 10⁻⁹ per flight-hour would have to be inspected (or hard-timed) every 100 hours (or 200 hours, if an average exposure time is assumed to be T/2) to keep the probability of failure under 1×10⁻⁷. A component failure rate of 1×10⁻⁸ per flight-hour would require inspection every day (10 hours). The commenter asserts that the benefit derived from performing such inspections or hard-timing is nil, and the implications of such a rule are self-evident.

Further, this commenter points out that the FAA's cost estimate for the operational rule changes is $154 million over 10 years, and that is based upon the assumption that the required maintenance and inspection programs will coincide with an airplane's regularly scheduled major maintenance checks. However, the commenter states that the situation described above would result in numerous inspections that would not align with these regularly scheduled checks. In addition, it could lead to widespread hard-timing of components (e.g., pumps). The commenter notes that the FAA did not consider either of these possibilities in the cost analysis; however, the magnitude of the cost impact could extend into the billions of dollars.

FAA's Response: The FAA does not concur. The conclusion of this commenter that the costs of compliance with § 25.981(a)(3) “could extend into the billions of dollars” is based upon an assumption concerning the impact of the requirement. The example provided by the commenter, which assumes that the requirement limits the probability of latent failure to less than 1×10⁻⁷, indicates a misinterpretation of the requirement. The rule does not allow a single failure to hazard the airplane, regardless of the probability of its occurrence. The FAA expects that designs that have single failures that can result in an ignition source will be modified to include fail-safe features. Modifications may also be necessary to address combinations of failures. If a fuel tank system is designed such that the safety level is heavily dominated by one of the components or features in the combinations of failures, then added inspections, hard-timing, or installation of annunciation features to eliminate latency are exactly what was intended by the regulation. The need for inspections and hard-timing can be limited by providing redundancy and fail-safe features and/or by eliminating latency. Therefore, inspection or replacement of components at the rate noted by the commenter would not be required.

The FAA position is supported by another commenter who provided information regarding transient suppression units (TSU) developed for the Boeing Model 737 and 747 airplanes. The commenter states, “The TSU eliminates the need to inspect harnesses, probe terminations, etc. The TSU itself would be subject to periodic (25,000 hours) inspections.” It should be noted that heavy maintenance checks typically occur on transport airplane models prior to accumulating 25,000 hours time in service; therefore, the cost of inspections for the TSU units would be low.

The speculation by the commenter that “the magnitude of the cost impact could extend into the billions of dollars” is based on a misunderstanding of the final rule and, therefore, was not considered in the final economic analysis.

Costs of New Modifications

One commenter expresses concern that the cost analysis is “greatly flawed” because it did not consider all the costs that will result from the requirements of the SFAR, such as high cost items like aircraft modifications and “hard timing” of components. The cost analysis takes credit for the benefits that will result from these modifications; however, the commenter considers that the costs should be included as well.

As an example of the potential costs of modifications, this commenter provided the following specific information concerning how the proposal would affect its fleet of airplanes: The commenter owns approximately 160 Boeing Model 727 airplanes. As a result of the proposed SFAR safety review, some of the modifications that might be mandated for these airplanes are:

• Replacement of the analog FQIS with a digital FQIS;
• Installation of current suppression devices;
• Installation of flame arrestors; and
• Possibly, replacement of fuel boost pumps.

The cost of these modifications alone, based on data received from the equipment manufacturers, is approximately $125,000 per airplane. Since some of the commenter's airplanes already have a FQIS installed, the cost to modify the commenter's fleet would be approximately $17,000,000. This figure does not include other modifications that might be mandated for the airplanes. The commenter points out that this is the modification cost for only one aircraft type for one airline. If all costs for all U.S. registered aircraft were to be included, the result would be far greater than the total indicated in FAA's cost analysis presented in the notice.

FAA's Response: The FAA does not agree that the cost analysis concerning possible modifications was flawed. Section 25.901(b)(2) requires that the “Components of the installation must be constructed, arranged and installed so as to ensure their continued safe operation between normal inspections and or overhauls.” As stated in the notice, “Typical transport category airplane fuel tank systems are designed with redundancy and fault indications features such that single component failures do not result in any significant reduction in safety. Therefore, fuel tank systems historically have not had any life-limited components or specific detailed inspection requirements unless mandated by AD.” We agree that some past design practices have been deficient and that adding the specific requirement in § 25.981(a)(3) to address latent failures may require new design features for existing airplanes. We also agree with the commenter that modifications to the FQIS and/or any other wiring entering the fuel tank system may be required (such as separation and shielding of FQIS wiring or, for older airplanes, installation of transient suppression devices). We do not agree that the rule would mandate replacement of analog FQIS with digital systems, although this may be one method used on certain portions of the fleet. However, because correcting those design deficiencies will be accomplished through the AD process, those compliance costs will be estimated when the relevant AD is proposed.

The SFAR does not require installation of flame arrestors in fuel tank vents. We have initiated tasking an ARAC group to provide recommendations addressing both a part 25 amendment and retroactive operational requirement for installation of flame arrestors in fuel tank vent outlets. If any rulemaking is subsequently proposed based on the recommendations, the FAA will conduct separate economic analyses for those proposals.

Cost of Changes to Part 25 on Future Designs

One commenter disagrees with the FAA's cost analysis regarding the affects of changes to part 25 requiring “minimizing flammability.” This commenter points to a statement in the notice that read:

The FAA anticipates that the proposed part 25 change would have minimal effect on the cost of future type certificated airplanes because compliance with the proposed change would be done during the design phase of the airplane model before any new airplanes would be manufactured.

The commenter considers that the FAA's assumption is incorrect. Proposed § 25.981(c)(1) would require that the fuel tank installation include “a means to minimize the development of flammable vapors in the fuel tanks.” Moreover, the FAA states that it intends that the body tanks “cool at a rate equivalent to that of a wing tank.”

The commenter asserts that, based on this requirement, the cost impact to future airplane designs could be substantial. As an example, the commenter presents a preliminary cost assessment of a directed ventilation system, below. The commenter derived the cost estimates from a report prepared by an ARAC working group (Fuel Tank Harmonization Working Group). These fuel tank cooling cost estimates are divided into the categories indicated. The analysis considers the costs associated with small, medium, and large airplane designs. (It should be noted that directed ventilation systems of the type evaluated would not cool a center wing tank at a rate equivalent to that of a wing tank.)

1. Development costs per airplane design = $2.8 million.

2. Installation costs per production airplane = $21,200.

3. Additional airplane operational costs per airplane per year:

• Small airplane = $30,408.
• Medium airplane = $39,295.
• Large airplane = $50,518.

Using these numbers, a simple calculation may be performed to estimate the recurring costs associated with such a system over a 10-year period. These costs would consist of the installation costs per production airplane and the additional operational costs per airplane per year, applied to a fleet of a new airplane design with an assumed production rate. The following table presents the results of this simple estimate for a 10-year period (ignoring inflation, cost of capital, and so on):

Size	Annual production rate	Production cost	Operational cost	Total cost
Small	180	$38,160,000	$301,039,200	$339,199,200
Medium	72	15,264,000	155,608,200	170,872,200
Large	60	15,264,000	129,673,500	144,937,500

Although the above example is simplistic in nature, the commenter maintains that the conclusion may be drawn that the overall potential costs are indeed substantial, even if the initial developmental costs are not.

FAA's Response: The FAA disagrees with the commenter. The requirements of the final rule should result in very little increased production costs. Certain airplane models in production today locate sources of heat away from the center wing fuel tanks. Other models locate the air conditioning packs below the center wing fuel tank, but incorporate air gaps that are ventilated such that heat transfer into the center wing tank is significantly reduced. Other airplane models incorporate directed ventilation means for areas below the heated center wing tanks.

The FAA does not agree with the cost assessment provided by the commenter. The cost estimate referenced by the commenter is stated to apply to “present airplane designs.” It assumes that the environmental control system (ECS) packs will be located adjacent to the center wing tank, and that heat shields and ventilation air would be used to remove heat from the center wing fuel tank. This approach results in added weight and drag penalties. New designs allow the designer numerous options to achieve an optimized design. Air conditioning equipment can, and has been, located away from fuel tanks. Cooling air is available from the ECS system, ground sources and outside air in flight. Incorporation of these features in the initial design would result in little added cost over that of features noted in the preceding paragraph on many airplane designs.

The ARAC report, from which the commenter has gathered data for its cost estimates, includes a discussion to “locate significant heat sources away from fuel tanks.” The report states that, “* * * quantifying the impact of this method would only be possible for specific new designs,” and the report provides little data regarding the costs for locating packs away from fuel tanks. We agree with the commenter that cooling air may be needed to meet the requirements of this regulation and this can result in additional operating costs during certain flight operations. However, these costs are airplane model design-specific and could not be estimated without input from the industry. Nevertheless, in the absence of specific industry design and cost data, we maintain that these additional operating costs will be minimal. Further, these costs will occur on airplanes that will be manufactured many years in the future and, as a result, the present value of those operating costs will be even less.

Paperwork Reduction Act

There are no new requirements for information collection associated with this amendment that would require approval from the Office of Management and Budget pursuant to the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)).

International Compatibility

In keeping with U.S. obligations under the Convention on International Civil Aviation, it is FAA policy to comply with International Civil Aviation Organization (ICAO) Standards and Recommended Practices to the maximum extent practicable. The FAA determined that there are no ICAO Standards and Recommended Practices that correspond to these regulations.

Economic Evaluation, Regulatory Flexibility Determination, Trade Impact Assessment, and Unfunded Mandates Assessment

Changes to Federal regulations must undergo several economic analyses. First, Executive Order 12866 directs each Federal agency to propose or adopt a regulation only if the agency makes a reasoned determination that the benefits of the intended regulation justify its costs. Second, the Regulatory Flexibility Act of 1980 requires agencies to analyze the economic impact of regulatory changes on small entities. Third, the Trade Agreements Act (19 U.S.C. section 2531-2533) prohibits agencies from setting standards that create unnecessary obstacles to the foreign commerce of the United States. In developing U.S. standards, this Trade Act requires agencies to consider international standards. Where appropriate, agencies are directed to use those international standards as the basis of U.S. standards. Fourth, the Unfunded Mandates Reform Act of 1995 requires agencies to prepare a written assessment of the costs, benefits, and other effects of proposed or final rules. This requirement applies only to rules that include a Federal mandate on State, local, or tribal governments, likely to result in a total expenditure of $100 million or more in any one year (adjusted for inflation).

In conducting these analyses, the FAA has determined that this rule: (1) Has benefits which justify its costs and is a “significant regulatory action;” (2) will have a significant impact on a substantial number of small entities; (3) has minimal effects on international trade; and (4) does not impose an unfunded mandate on state, local or tribal governments or the private sector. The FAA has placed these analyses in the docket and summarizes them as follows.

Data Sources

• The principal data sources used for this analysis are:
• The public comments submitted to the notice for this rulemaking action;
• The World Jet Inventory at Year-End 1999;
• Back Aviation Solutions (Fleet PC, Version 4.0);
• Information from service bulletins; and
• FAA discussions with industry engineers.

Affected Airplanes and Aviation Sectors

In the notice, the FAA, using 1996 data, estimated that the proposal would have affected 6,006 airplanes. Of this number:

• 5,700 airplanes were operated by 114 air carriers under part 121 service,
• 193 airplanes were operated by 7 carriers that operated under both part 121 and part 135,
• 22 airplanes were operated by 10 carriers under part 125 service, and
• 91 airplanes were operated by 23 carriers operating U.S.-registered airplanes under part 129.

At that time, the FAA did not have information on airplanes operating under part 91 that would have been affected by the proposal; however, the FAA had stated its belief that very few airplanes operating under part 91 would have been affected by the proposal.

The FAA also estimated that the proposed rule would have affected:

• 12 manufacturers holding 35 part 25 type certificates (TC's);
• 26 manufacturers, airlines, and repair stations holding 168 supplemental type certificates (STC's) for part 25 fuel tank systems, of which 69 were for different modifications;
• Manufacturers of future, new part 25 type certificated airplane models; and
• Holders of future, new part 25 STC's for new fuel tank systems.

At that time, the FAA was unable to predict the number of new airplane TC's but, based on the average of the previous 10 years, the FAA had anticipated that 17 new fuel tank system STC's would be granted annually. The FAA had requested comments on these estimates.

In order to update the aviation industry data, the FAA used a different database for this final rule from what it used for the analysis of the proposed rule. However, as this more current database does not report the same information as that reported in the previous database, an exact comparison between the two databases is not possible. Consequently, using 1999 data, the FAA determined that the final rule affects 6,971 airplanes, of which 6,252 are turbojets and 719 are turboprops. Of these 6,971 airplanes:

• 6,485 (5,802 turbojets and 683 turboprops) are operated by 143 scheduled and non-scheduled air carriers,
• 117 are operated by 76 private operators (primarily corporations), and
• 369 are currently held by 112 manufacturers and brokers and leasing companies.

The FAA also determined that the final rule affects:

• 13 manufacturers holding 37 part 25 type certificates (TC's);
• 46 manufacturers, airlines, and repair stations holding 173 supplemental type certificates (STC's) for part 25 fuel tank systems, of which 79 are for different fuel tank system modifications;
• 325 non-fuel tank system STC holders that will need to evaluate their STC's to determine their impacts on fuel tank systems;
• Manufacturers of future, new part 25 type certificated airplane models; and
• Holders of future, new part 25 STC's for new fuel tank systems.

Based on the previous 10 years, the FAA projects that there will be between two and four new part 25 TC airplane models during the next 10 years. Using the same methodology, the FAA projects that there will be three to four new fuel tank system STC's annually granted during the next 10 years.

Benefits

In the notice, the FAA had assumed that the potential U.S. fuel tank explosion rate due to an unknown internal fuel tank ignition was the same as that rate for the worldwide fleet over the years 1989 through 1998. On that basis, the FAA had estimated that, if no preventative actions were to be taken, then between one and two (the statistically expected value was 1.25) fuel tank explosions would be projected to occur during the next 10 years (2000 through 2009) in U.S. operations. The FAA also determined that the probability that such an accident would have occurred prior to 2006 was equal to the probability that it would have occurred after 2006.

In order to quantify the potential benefits from preventing a “representative” commercial aviation mid-air explosion, the FAA had used:

• A value of $2.7 million to prevent a fatality,
• An average of 130 passengers and crew on a commercial flight,
• A value of $20 million for a destroyed airplane, and
• A cost of $30 million for an investigation of a mid-air explosion accident.

Thus, a total loss would be $401 million.

In the notice, the FAA had assumed that compliance with the proposal would prevent between 75 percent and 90 percent of the future fuel tank explosions. The basis for this prevention is derived primarily from the incorporation of design changes to enhance fail-safe features of design and enhanced fuel tank system inspections that will discover conditions that could result in an ignition source before ignition of flammable fuel vapors could occur. The fuel tank system review, by itself, will have little direct effect on preventing these future accidents, unless it uncovers an immediately hazardous condition that results in an AD being issued. As stated earlier, the FAA has initiated 40 AD's to address unsafe fuel tank system features on numerous airplane types within the current fleet. While the FAA expects these actions will significantly improve safety, an in-depth analysis of all airplane models required by this rule has not been completed and it would be difficult to predict the overall effect on the accident rate. Therefore, the cost/benefit analysis assumes that the accident rate for fuel tank explosions will remain constant until the reviews are complete.

With the proposed 18-month compliance time, the FAA estimated the benefits based on these inspections starting in 2001. The resulting probability analysis indicated that the first such accident would occur in 2006 and the second accident (if a second one would occur) in 2009. On that basis, the estimated present value of the expected benefits discounted over 10 years to 1999 at 7 percent would have been:

• $260 million for one prevented accident and
• $520 million for two prevented accidents.

For the final rule, the FAA revised these earlier estimates to include the effect that lengthening the compliance time from 18 months to 36 months has on the potential benefits. As a result, the 3-year compliance time indicates that, with the exception noted in the previous paragraph, the first benefits from improved fuel tank system inspections will not occur until 2004.

The FAA also revised the earlier estimates to substitute more current fleet and operations data into the calculations. The FAA also noted that 2 years without a mid-air explosion have passed since the analysis of the proposal, which makes the years 1989 through 2000 (rather than 1989 through 1998) the appropriate timeframe for calculating the historical accident rate. On that basis, the FAA calculated that, if no preventative actions were taken, between one and two (the expected value is 1.09) fuel tank explosions would be expected to occur during the 10-year time period of 2004 through 2013. Further, the FAA determined that the probability that the first accident would occur on or before the year 2008 is the same as the probability that it would occur after 2008.

Thus, based on a loss of $401 million for a “representative” accident, the FAA calculated that the present values of the losses from future mid-air explosions that would occur between 2004 and 2013 are:

• $233.7 million for one prevented accident and
• $400.4 million for two prevented accidents

(The statistically expected value is $248.9 million for the 1.09 accidents.)

For this final rule analysis, the FAA reviewed the public comments and its previous analysis for the notice, and determined that the data are insufficient to permit a credible estimate of the percentage of future mid-air explosion accidents that the final rule would prevent. The uncertainty of the causes of the two accidents and the uncertainty of the effects of the 40 AD's on preventing future explosions does not allow a quantitative estimate of the potential effectiveness of the final rule. Thus, although the FAA believes that the rule will significantly reduce the risk of a future accident, the FAA does not calculate quantified benefits resulting from the final rule.

Sources of Compliance Costs for the Proposal and the Final Rule

The costs to comply with the SFAR derive from the engineering time to comprehensively review fuel tank system designs by the design approval holders (i.e., part 25 TC holders, part 25 fuel tank system STC holders, and certain part 25 non-fuel tank system STC holders). There also are costs to operators that derive from the engineering time to conduct the design review for any field approvals on their airplanes and to develop any necessary fuel tank system inspections and maintenance recommendations for operators and repair stations.

These reviews may also identify conditions that will subsequently need to be addressed by specific service bulletins, or unsafe conditions that would subsequently require the FAA to issue AD's. However, those future costs are not the costs of compliance with this SFAR; rather, they are costs to conform to the service bulletin or to comply with the AD, and would be estimated for each individual service bulletin or AD when it is issued or proposed.

The costs to comply with the operational rule changes of this final rule derive from the requirements that operators incorporate these recommendations into their maintenance manuals and then inspect and maintain the fuel tank systems accordingly. As a result, additional airplane mechanic labor time will be needed during an airplane inspection to perform an enhanced inspection of the fuel tank system and components. However, the costs to repair and replace equipment and wiring that the inspection identifies as needing repair or replacement is not a cost of compliance with the operational rules changes. Although these costs can be substantial, they are attributable to existing FAA regulations that require such repairs and replacements to be made in order to assure the airplane's continued airworthiness.

Finally, the part 25 revisions of this final rule may require some future TC and STC's to employ designs of fuel tank systems and other aviation systems that would not have been used were it not for these revised certification requirements.

Estimated Total Compliance Costs for the Proposal

As seen in Table 1, the FAA had estimated in the notice that the present value in 1999 of the compliance costs with the proposal during the time period 2000-2011 would have been about $170 million ($9.5 million for TC holders, $4.9 million for STC holders, and $153 million for operators). The following sections briefly summarize the discussions in the notice about these various cost estimates.

Table 1.—Present Value in 1999 of the Costs of Compliance With the Proposed Rule

[As estimated in the preliminary regulatory evaluation]

Source of cost	Present value in 1999 of the compliance costs (in 1998 $ millions)
Fuel Tank Review (Total)	14.4
[For TC Holders: 9.5]
[For STC Holders: 4.9]
Maintenance and Inspection	100.0
Lost Net Revenue	35.6
Additional Recordkeeping	17.4
Total	167.4

Proposed Costs of Fuel Tank System Design Review

By way of explanation, for the purpose of this analysis, an airplane “model” is defined to refer to a type certificate airplane (for example, a Model 737); whereas, an airplane “series” is defined to refer to a version (often under an Amended TC) of a model (for example, a Model 737-300).

In the notice, the FAA had estimated that 35 TC's and 68 fuel tank system STC's would have needed a fuel tank system design review. Depending upon the airplane model, the FAA had estimated that a fuel tank system design review would have taken between 0.5 to 2.0 engineer years for a TC holder, and an average of 0.25 engineer year for a fuel tank system STC holder. The FAA had also estimated that developing manual revisions and service bulletins would have taken between 0.25 to 1.0 engineer years for a TC holder, and an average of 0.1 engineer year for a fuel tank system STC holder.

Using a total engineer compensation rate (salary and fringe benefits, plus a mark-up for hours spent by management, legal, etc. on the review) of $100 an hour, the FAA had estimated that the one-time fuel tank system design review would have cost TC holders $9.5 million, and it would have cost STC holders $4.9 million.

Proposed Costs of Fuel Tank System Inspections—Operational Rule Changes

The costs to operators of complying with the proposed operational requirements would have been the additional airplane mechanic labor hours and the lost net revenue from the airplane's additional time out-of-service in order to complete the fuel tank system inspections and maintenance. The FAA had assumed that the design approval holders' recommendations would have required fuel tank systems to be inspected only during the regularly scheduled major maintenance checks. As a result, the FAA had expected that no airplanes would have been taken out of service solely to inspect the fuel tank system unless the fuel tank system review would have identified an immediate safety concern. In that case, the corrective action would have been mandated by an AD.

On that basis, the FAA had determined that operators would have needed to take four actions to comply with the proposal that would have either required an expenditure of resources or lost revenue:

• The first action involves the labor time to incorporate the design approval holders' recommendations into the maintenance manuals.
• The second action involves the labor time to perform the enhanced fuel tank system inspections, which includes testing of fuel tank system equipment and wiring.
• The third action involves the lost net revenue from an airplane's increased out-of-service time due to the enhanced fuel tank system inspection.
• The fourth action involves the labor time to provide the increased documentation, recording, and reporting the results from the fuel tank system inspections and tests.

The FAA had assumed that each operator has one maintenance manual for each airplane model in its fleet. The FAA then determined that there were 290 individual airplane model/operator combinations. The FAA estimated that it would have taken 5 engineer days (at a cost of $4,000 per manual) to incorporate these recommendations into the various maintenance manuals. On that basis, the FAA had calculated that this total cost would have been $1.16 million. As these expenses would have occurred in the second year, the present value of these costs was $1.084 million.

With respect to the costs of fuel tank system inspections, the FAA had estimated that it would have taken between 60 and 330 additional labor hours per airplane to complete the initial fuel tank system inspection, and it would have taken between 30 and 180 additional labor hours per airplane for later fuel tank system reinspections. All of the initial inspections would have been completed during the first 3 years after the maintenance manual changes had been approved by the FAA (i.e., during the years 2002 through 2004). Each airplane would have been reinspected every 3 years after the initial fuel tank system inspection. Using a total compensation rate (wages and fringe benefits, plus a mark-up for time spent by supervisors, management, etc. on the inspections) of $70 an hour for airplane mechanics, the FAA had estimated that the initial fuel tank system inspection would have cost between $4,200 and $23,100 per airplane and fuel tank system reinspections would have cost between $2,100 and $12,600 per airplane. The present value of the total fuel tank system inspection costs, discounted at 7 percent over the period 2002 through 2011, would have been $99 million.

In the notice, the FAA had assumed that the initial fuel tank system inspection would have been performed during a “C” or a “D” check. On that basis, the FAA had estimated that the additional out-of-service time would have been between 36 hours and 96 hours per airplane for each airplane inspected during a “C” check, and would have been zero hours for each airplane inspected during a “D” check. Similarly, the FAA had estimated that the additional out-of-service time would have been between 24 hours and 72 hours for each airplane fuel tank system reinspection that would have occurred during a “C” check, and would have been zero hours if the reinspection would have occurred during a “D” check.

The economic cost of out-of-service time is the lost net revenue to the aviation system. Most of the passengers who would have flown on an airplane that has been taken out of service will take another flight. As a result, most of the lost revenue for that out-of-service airplane is actually captured by other airplane flights. The cost of the rule is the loss to the aviation system—not to the individual airplane operator. On that basis, the FAA computed the lost revenue to the aviation system by using the Office of Management and Budget (OMB) determination that the average annual risk-free productive rate of return on capital is 7 percent of the average value of the airplane model. Thus, the FAA had calculated that the out-of-service lost aviation net revenue per fuel tank system inspection would have ranged from $50 to $9,750 per airplane per day. The present value of this total lost aviation net revenue, discounted at 7 percent over 10 years, would have been $35.6 million.

The FAA had determined that the increased annual documentation and reporting time would have been 1 hour of recordkeeping for every 8 hours of labor time for the initial fuel tank system inspection, and would have been 1 hour of recordkeeping for every 10 hours of labor time for the reinspections. Thus, the per airplane documentation cost would have been between $450 and $2,550 for the initial fuel tank system inspection and $300 to $1,620 for a fuel tank system reinspection. The present value of the total recordkeeping cost discounted at 7 percent for 10 years would have been $17.4 million.

Proposed Costs of Future Fuel Tank System Design Changes—Revised Part 25

The FAA had determined that the part 25 changes would have a minimal effect on the cost of future type certificated airplanes because compliance with the proposed changes would be done during the design phase of the airplane model before any new airplanes would be manufactured. In addition, the FAA had determined that the part 25 changes would have a minimal impact on future fuel tank system STC's because current industry design practices could be adapted to allow compliance with the requirement.

Differences in Assumptions and Values Between the Notice and the Final Rule

The most significant difference between the proposal and the final rule is that the proposal allowed only 12 months for design approval holders to complete their fuel tank system reviews and recommendations. The proposal also allowed operators only 6 months to incorporate these recommendations into their maintenance manuals. The final rule allows design approval holders 18 months to be in compliance and also allows operators 18 months after that to incorporate the recommendations into their maintenance manuals.

Table 2 lists the most significant differences in the assumptions made, data used, and the different requirements between the proposal and the final rule. Although there are other differences that have altered the calculated costs, the differences listed in Table 2 are the significant ones.

Table 2.—Significant Differences in Assumptions and Values Between the Preliminary Regulatory Evaluation and the Final Regulatory Evaluation

Assumption or value	Preliminary regulatory analysis	Final regulatory analysis
Number of Airplanes	6,006 (in 1996)	6,971 (in 1999).
Timeframe for Analysis	2000-2011	2001-2013
Net Rate of Fleet Growth	4.3 percent	3.0 percent.
Hourly Compensation per: Engineer; Mechanic	$100; $70	$110; $75.
Number of Fuel Tank System TC Reviews	35	98 (46 “full-scale” and 52 “derivative”).
Number of Engineering Years for TC Review	0.5 to 2	0.5 to 3.
Number of Fuel Tank System STC Reviews	68	74
Number of Engineering Years for Fuel Tank System STC Review	0.35	0.15
Number of Non-Fuel tank system STC Reviews	None (Asked for Comments)	325
Number of Engineering Years for Non-Fuel tank system STC Review	None (Asked for Comments)	0.0375
Operator Paper Review of Airplane Fuel Tank System-Field Approvals/STC's	None	1 engineer day per existing airplane.
Number Months to Compete Safety Review Fuel Tanks	12	18
Number Months to Revise Maintenance Manual (After Review)	6	18
Number Years to Complete Initial Inspection (After Manual Revision)	3 years (Completed between 2002 and 2004)	2 years (Completed during 2004 and 2005).
Determinants of Number Inspection Hours	Airplane Model	Airplane Model plus Year Manufactured.
Time before Initial Inspections Begin	18 months	36 months.
Number Years to Complete Initial Inspection	3 years	2 years.
Number Labor Hours for Initial Inspection	50 to 198	49 to 218.
Number Days Out-of-Service for Initial Inspection	0 to 4 (40 percent inspections done at “C” checks)	0 to 4 (60 percent of inspections done at “C” checks).
Year Reinspections Start	2004 (immediately after initial inspections)	2008 (2 years after initial inspections).
Reinspection Frequency	Every 3 years (Some done during “C” checks)	Every 5 years (All done during “D” checks).
Number Hours for Reinspection	40 to 160	25 to 87.
Reduced Inspection Hours Due to AD's Already Issued	All Model 747 hours not included; 50 hours for Mode 737's not included	No adjustment.
Number Days Out-of-Service for Reinspection	0 to 3 (40 percent of reinspections done at “C” checks)	0 (All reinspections done at “D” checks).

Cost of Compliance With the Final Rule

As seen in Table 3, based on the public comments and the changes in assumptions and values listed in Table 2, the FAA has determined that the present value of the costs of compliance with the rule over the time period 2001—2013 are $165.1 million. This figure includes:

• $27.1 million for TC holders,
• $2.8 million for fuel tank system STC holders,
• $2.6 million for non-fuel tank system STC holders, and
• $132.5 million for operators.

The following sections summarize the results in the Final Regulatory Evaluation.

Table 3.—Present Value of the Costs of Compliance With the Final Rule

Source of cost	Present value in 2001 of the compliance costs (in 2000 $ millions)
Part 25 Fuel Tank Design	0.315
(For TC Airplanes: Minimal)
(For Fuel Tank STC Holders: 0.315)
Fuel Tank Review (Total)	38.157
(For TC Holders: 27.107)
(For Fuel Tank STC Holders: 2.522)
(For Non-Fuel-Tank STC Holders: 2.594)
(For Operators: 5.934)
Maintenance and Inspection	92.043
Lost Net Revenue	24.224
Additional Recordkeeping	10.338
Total	165.077

Costs of Fuel Tank System Design Review

In the Final Regulatory Evaluation, the FAA has determined that existing TC holders will need to complete 46 “full-scale” fuel tank system reviews for the individual airplane models, and 52 “derivative” fuel tank system reviews for the separate series in the models. Using the Model 737-300/400/500 family of airplanes as an illustration, the FAA determined that Boeing will need to complete one “full-scale” review and two “derivative” reviews for this family of airplanes. In addition, each airplane series that has an extended range modification or a freighter modification will require a “derivative” fuel tank system review.

Depending upon the airplane model and the date it was first manufactured, the FAA determined the following average numbers of engineer years for the “full-scale” fuel tank system design review:

• 3 years for large turbojets (1969-1980),
• 2 years for large turbojets (1980-1988),
• 1 year for large turbojets (post-1988),
• 0.5 to 0.75 year for regional jets,
• 0.5 to 0.75 year for large turboprops, and
• 0.5 year for small turbojets and turboprops.

With respect to the “derivative” fuel tank system design reviews, the FAA determined that these will take between 0.5 year and one year for large turbojets, and 0.5 year for regional turbojets and for turboprops.

The FAA determined that the amount of engineering time to develop the recommendations for the maintenance manuals will be 20 percent of the amount of time to complete the fuel tank system review.

Using a total engineer compensation rate of $110 an hour, the FAA calculated that the one-time fuel tank system design review will cost between $200,000 and $1.525 million per airplane model, with most of the individual costs in the range of $500,000 to $800,000. These costs will be about $125,000 to $150,000 for turboprops.

As the TC holder will have 18 months to comply with the final rule, the FAA determined that one-half of the review costs will occur in the first year (2002) and one-half will occur in the second year (2003), and all of the costs to develop recommendations will occur in the second year (2003). On that basis, the present value of the total one-time cost of compliance to TC holders will be $27.1 million, of which $22.7 million will be for the fuel tank system review and $4.390 million will be to develop recommendations for the maintenance manuals.

For part 25 fuel tank system STC holders, the FAA determined that there are 74 fuel tank system STC's that will need to undergo a review. The FAA also determined that it will take an average of 0.15 engineering year to complete the review because the STC holder had to complete a substantial amount of engineering work to obtain FAA approval of the STC, and many of the STC's affect only a part of the fuel tank system. On that basis, the FAA determined that the average cost for a fuel tank system STC review will be $33,000.

As the fuel tank system STC holder will have 18 months to comply with the final rule, the FAA determined that one-half of the review costs will occur in the first year (2002) and one-half will occur in the second year (2003), while all of the time to develop recommendations will occur in the second year (2003). On that basis, the present value of the total one-time cost of compliance will be $2.5 million.

Certain part 25 non-fuel tank system STC holders will also need to complete more than a cursory review of their modifications for the potential impact on the fuel tank system. The FAA determined that there are 325 non-fuel tank system STC's that will need to undergo a review. The FAA also determined that this review will take one quarter of the engineer time to complete a fuel tank system STC review (or 0.375 engineer year). On that basis, the FAA determined that the average cost for a non-fuel tank system STC review will be $8,250.

As the non-fuel tank system STC holder will have 18 months to comply with the final rule, the FAA determined that one-half of the review costs will occur in the first year (2002) and one-half will occur in the second year (2003), while all of the time to develop recommendations will occur in the second year (2003). On that basis, the present value of the total one-time cost of compliance will be $2.6 million.

Finally, based on the comments, the FAA determined that each operator will perform a paper review of each airplane to determine the modifications (including field approvals) that have been made on the airplane. Although the vast majority of these airplanes have been purchased by major, national, and regional airlines that should possess well-documented maintenance history records, a significant minority of these airplanes have had multiple owners or lessors and the maintenance records may not be quite as complete. Thus, the FAA determined that, on average, this paper review will take one day per airplane. On that basis, the average cost per airplane will be $880.

In order to meet the 36-month compliance date, operators will need to discover if their airplanes have any “orphan” STC's or if there are any field approvals that affect the fuel tank system. Completing these paper reviews will then give the operators 18 months, after the TC and STC holders complete their required reviews, to complete any additional fuel tank system engineering reviews and to make the resultant changes to their maintenance manuals. Therefore, the FAA determined that one-half of the review costs will occur in the first year (2002) and one-half will occur in the second year (2003). On that basis, the present value of the total one-time cost of compliance will be $5.9 million.

There is also the potential that this “paper review” will reveal a field approval or an “orphan” STC that affects the safety of the fuel tank system. In that case, the operator would be responsible for the engineering review and for developing inspection and maintenance procedures for the maintenance manual. The FAA did not receive any data on this factor, but maintains that it is likely to infrequently occur and, further, the amount of engineering needed would be relatively minor.

Costs of Fuel Tank System Inspections—Operational Rule Changes

As was true for the analysis in the notice, the costs to operators of complying with the final rule's operational requirements do not include the costs of corrective actions undertaken to repair deficiencies in the fuel tank system that were found because of a fuel tank system inspection, because the airplanes are required to be maintained as airworthy.

On that basis, the FAA determined that operators will take four actions that will generate costs or lost revenue to comply with the final rule.

• The first action involves the labor time to incorporate the design approval holders' recommendations into the maintenance manuals.
• The second action involves the labor time to perform the enhanced fuel tank system inspections, which includes testing of fuel tank system equipment and wiring.
• The third action involves the lost net revenue from an airplane's increased out-of-service time due to the enhanced fuel tank system inspection.
• The fourth action involves the labor time to provide the increased documentation, recording, and reporting the results from the fuel tank system inspections and tests.

In calculating the compliance costs for maintenance manual revisions due to TC holder recommendations, the FAA revised its assumption made in the notice that each operator has one maintenance manual for each model in its fleet. However, the FAA determined that its assumption of 5 days of engineer time to modify a maintenance manual is valid. Since the issuance of the notice, the FAA has been informed that nearly all airlines with fewer than 20 airplanes contract their major maintenance checks to third party (or other operators') repair stations. The FAA determined that 49 airlines (each with 20 or more airplanes) perform their own maintenance. For those 49 airlines, there are 165 airplane model/operator combinations, which produces a cost of $726,400. As these manual changes will not be made until the year 2003, the present value of these compliance costs is $635,000.

The FAA also determined that 15 repair stations will perform these fuel tank system inspections for the smaller operators and, on average, each repair station will perform these inspections for 10 different airplane models. The compliance costs for these repair stations will be $660,000, which will be passed on to the operators. However, as these manual changes will not be made until the year 2003, the present value of these compliance costs is $576,475.

The FAA determined that it will take, on average, one engineer day (or $880) for each maintenance manual to incorporate the recommendations from a fuel tank system STC holder. The FAA also determined that each of the 79 fuel tank system STC's will produce inspection and maintenance recommendations that will affect, on average, two maintenance manuals. On that basis, the compliance costs will be $139,000. However, as these manual changes will not be made until the year 2003, the present value of these compliance costs is $121,450.

The FAA anticipates that implementation of the final rule will result in the initial fuel tank system inspection to be performed at the first major maintenance check after the maintenance manual modifications have been approved by the FAA. As the FAA defines a “C” check (or its equivalents) as a major maintenance check, the FAA determined that all of the affected airplanes will receive an initial fuel tank system inspection by 2 years after the maintenance manuals have been modified. Thus, the FAA determined that all of the initial fuel tank system inspections will be performed in either 2004 or 2005.

The FAA made four adjustments to the number of airplane mechanic hours for an initial fuel tank system inspection as estimated in the notice:

The first adjustment is that the FAA added 20 labor hours across the board in order to account for any unanticipated inspection recommendations from the product approval holders.

The second adjustment is that the FAA varied the number of labor hours not only by certification date but also by manufactured date of the airplane. Older airplanes of an airplane model will require, on average, more labor hours to complete an initial fuel tank system inspection than will newer airplanes. As a result, the FAA separated airplanes into 3 categories based on the date the airplane was manufactured.

• For the 1960-1980 group, the number of labor hours estimated in the notice plus 20 hours was used.
• Airplanes manufactured between 1981 and 1995 require 20 percent fewer labor hours than those for the 1960-1980 group.
• Airplanes manufactured between 1995 and 2003 will require 30 percent fewer labor hours than those for the 1960-1980 group.

The third adjustment is that the number of labor hours to reinspect fuel tank systems will be one-half of the number of labor hours needed for the initial fuel tank system inspection, based on the last year that the airplane model was manufactured.

The fourth adjustment is that the number of labor hours for the first inspection of a future manufactured airplane's fuel tank system will be the same as for later reinspections, and is the same number as that to reinspect the newest airplane category.

Using those adjustments and the changes listed in Table 2, the FAA determined that it will take between 49 and 218 labor hours to complete an initial fuel tank system inspection, and it will take between 25 and 108 labor hours to complete a fuel tank system reinspection. Using a total compensation rate (wages plus fringe benefits) of $75 an hour for airplane mechanics, the FAA estimated that the initial fuel tank system inspection will cost between $3,625 and $16,350 per airplane, and fuel tank system reinspections will cost between $1,875 and $8,100 per airplane. The present value of the total labor cost discounted at 7 percent for the period 2004 through 2013 is $92.043 million.

As stated earlier, the FAA had determined that the initial fuel tank system inspection will be performed during a “C” or a “D” check. The duration and process of major inspections varies by airline and airplane type. Some airlines choose to conduct these checks during one time block of typically 7 to 10 days for a “C” check and 20 to 25 days for a “D” check. Other airlines conduct segmented checks where the airplane is taken out of service for several shorter time intervals that allow the overall task to be completed. The FAA has determined that an airplane undergoing a segmented “C” check is, on average, out-of-service for two days, whereas a segmented “D” check takes an airplane out of service for 14 to 21 days. The FAA determined that two mechanics can simultaneously work on a fuel tank system inspection. On that basis, the FAA determined that no additional out-of-service days will occur for 1 to 48 additional labor hours. Each additional 48 labor hours after the first 48 labor hours will add one day to the out-of-service time. On that basis, the initial fuel tank system inspection will produce between 0 and 4 additional out-of-service days.

The economic cost of out-of-service time is the lost services from a capital asset, which is computed by multiplying the airplane value by the number of days out of service and by 7 percent (the OMB risk-free rate of return). The average residual value of the turbojet models is based on the AVITAS 2nd Half 1999 Jet Aircraft Values, and the average value of the turboprop models is based on the AVITAS 2nd Half 1997 Turboprop Aircraft Values. Thus, the FAA calculated that the out-of-service lost capital services from the initial fuel tank system inspection will be between $200 and $86,000 per airplane per day.

As noted earlier, the FAA determined that one-half of the airplanes will undergo an initial fuel tank system inspection in 2004 and one-half will undergo an initial fuel tank system inspection in 2005. However, 20 percent of these airplanes each year will receive this inspection during a “D” check, in which there are no additional out-of-service days due to the fuel tank system inspection. As a result, the FAA calculated that the present value of the total lost net revenue from the additional out-of-service days is $24.224 million.

For the final rule, the FAA determined that its original estimate that every 8 hours of airplane mechanic labor for the initial fuel tank system inspection will produce one hour of documentation and recordkeeping labor hours is valid. However, the FAA determined that it had overestimated the amount of recordkeeping for reinspections, and used the ratio of 12 hours of reinspection airplane mechanic labor time for 1 hour of documentation and recordkeeping. On that basis, the present value of the recordkeeping cost is $10.338 million.

Costs of Future Fuel Tank System Design Changes—Revised Part 25

The FAA had determined that the part 25 change will have a minimal effect on the cost of future type certificated airplanes because compliance with the proposed change would be done during the design phase of the airplane model before any new airplanes would be manufactured. In addition, the FAA determined that the part 25 changes will have a minimal impact on future fuel tank system STC's because current industry design practices could be adapted to allow compliance with the requirement.

Benefit-Cost Comparison

As noted, the FAA has not quantified the potential benefits from this final rule because there is uncertainty about the actual ignition sources in the two fuel tanks. However, using a “representative” commercial airplane, the FAA calculated that the losses from a mid-air explosion would be $401.6 million. In addition, the FAA determined that the present value of the compliance costs is $165.1 million.

If the final rule would prevent one such accident by the year 2014, the present value of the prevented losses would be greater than the present value of the compliance costs.

Therefore, based on these factors and analysis, the FAA considers the final rule to be cost-beneficial.

Regulatory Flexibility Act

The Regulatory Flexibility Act of 1980 (RFA) establishes “as a principle of regulatory issuance that agencies shall endeavor, consistent with the objective of the rule and of applicable statutes, to fit regulatory and informational requirements to the scale of the business, organizations, and governmental jurisdictions subject to regulation.” To achieve that principle, the RFA requires agencies to solicit and consider flexible regulatory proposals and to explain the rationale for their actions. The RFA covers a wide range of small entities, including small businesses, not-for-profit organizations, and small governmental jurisdictions.

Agencies must perform a review to determine whether a proposed or final rule will have a significant economic impact on a substantial number of small entities. If the determination finds that it will, the agency must prepare a Regulatory Flexibility Analysis as described in the RFA.

However, if an agency determines that a proposed or final rule is not expected to have a significant economic impact on a substantial number of small entities, section 605(b) of the 1980 act provides that the head of the agency may so certify, and a Regulatory Flexibility Analysis is not required. The certification must include a statement providing the factual basis for this determination, and the reasoning should be clear.

For the proposed rule, the FAA had conducted an Initial Regulatory Flexibility Analysis, which established that it would have a significant impact on a substantial number of small entities. As a result, the FAA had specifically requested public comment on the potential impact of the proposed rule on small entities.

Need for and Objectives of the Rule

The final rule is being issued in order to reduce the risk of a mid-air airplane fuel tank explosion with the resultant loss of life (as evidenced by TWA Flight 800). Existing fuel tank system inspections have not provided comprehensive, systematic prevention and control of ignition sources in airplane fuel tanks, thereby allowing a small, but unacceptable risk of a fuel tank explosion.

The objective of the final rule is to ensure the continuing airworthiness of airplanes certificated for 30 or more passengers or with a payload of more than 7,500 pounds. Design approval holders (including TC holders, fuel tank system STC holders, and holders of certain non-fuel tank system STC's) will be required to complete a fuel tank system design review and to provide recommendations and instructions to operators and repair stations concerning fuel tank system inspections and equipment and wiring testing. This review may result in the development of service bulletins and AD's. All operators covered by Title 14, Code of Federal Regulations (CFR) parts 91, 121, and 125, and all U.S.-registered airplanes used in scheduled operations under part 129, will be required to incorporate these recommendations into their maintenance manuals and to perform the inspections and tests as required. In addition, repair stations that are contracted to perform maintenance are also required to comply with these requirements.

Summary of Comments Made in Response to the Initial Regulatory Flexibility Analysis

There were two commenters that indirectly discussed issues of concern in the Initial Regulatory Flexibility Analysis:

The General Aviation Manufacturing Association (GAMA) supported the FAA's decision to exclude airplanes certificated for 30 passengers or fewer from the final rule. Although they did not address the small business aspect of this decision, nearly every operator of these excluded airplanes is a small entity. However, GAMA opposed the proposed part 25 future design requirements as not appropriate for business jets and stated that these airplanes should be excluded from the part 25 requirements. The FAA disagreed with this comment because a future business jet that has a 7,500 pound payload is a large airplane and its fuel tank system faces the same potential for explosion as other large transport category airplanes.

The Regional Airline Association (RAA) supported the FAA's decision to exclude airplanes certificated for 30 passengers or fewer from the final rule. They, too, did not directly address the small business aspect of this decision. However, they opposed the FAA's decision to include airplanes certificated for fewer than 60 passengers or for less than a 15,000 pound payload. Their primary argument in favor of this exclusion is that these airplanes do not have a history of these types of accidents. The FAA disagreed with this comment because, by itself, the accident histories of specific types and classes of airplanes are insufficient to demonstrate that their fuel tank systems attain the required level of safety. An important consideration in these accident histories is that these airplanes have not accumulated the number of flight hours as those of the larger transport category airplanes. As fuel tank explosions are rare events, there is the possibility that such an accident has not occurred in these airplanes because not enough hours have been flown. In addition, it may be that the fuel tank system design review will reveal that these systems do not have the same risk as the risk associated with larger transport category airplanes. In that case, the impact of the rule on operators of these airplanes will be much less than estimated by the FAA. However, until the fuel tank system design review is completed, the FAA does not know what the potential is for these airplanes to have a mid-air explosion and, as the FAA cannot rule out the possibility, the FAA cannot exclude these airplanes from coverage under the final rule.

Description and Estimate of the Number of Small Entities Affected by the Final Rule

The FAA determined that there are a total of 143 U.S. airlines, 76 private operators (primarily corporations with corporate jets), and 112 manufacturers, airplane brokers, and airplane leasing companies affected by the final rule. Of the 143 U.S. airlines, 107 are small airlines. Nearly all of the 76 private operators are large corporations that can afford to operate and maintain a corporate jet airplane. Most of the airplane brokers and airplane leasing companies are privately held corporations or partnerships, and the FAA was unable to establish whether or not most of them are small entities.

Reporting and Recordkeeping Requirements

The final rule requires that operators maintain a record of the results of the fuel tank system inspections and maintenance done on the airplane. For the small operators that contract their maintenance to third party repair stations (nearly all of the small airlines and other operators), they will be required to keep a copy of the report that the repair station will give them. Small entities will not need to acquire additional professional skills to prepare these reports.

Description of the Alternatives Evaluated

In the Initial Regulatory Flexibility Analysis, the FAA had evaluated three alternatives to the proposed rule:

• The first alternative was to require all airplanes with 10 or more seats be covered by the proposed rule.
• The second alternative was to require all airplanes with 30 or more seats and all airplanes with 10 or more seats in commercial service be covered by the proposal.
• The third alternative was to require only turbojet airplanes in commercial service be covered by the proposal.

There were no comments from the public in support of these alternatives. A complete discussion of these alternatives is available in the public docket for this rulemaking.

Differences Between the Proposed Rule and the Final Rule Requirements

The primary change from the proposed rule is that the final rule allows operators 36 months to comply whereas the proposed rule had required compliance within 18 months. In addition, the FAA determined that fewer fuel tank reinspections will be needed than the FAA had estimated in the Preliminary Regulatory Evaluation. As a result, the present value of the costs to operators will be approximately 20 percent less per airplane under the final rule than they would have been under the proposed rule.

Conclusion

Both the proposed and final rule will have a significant impact on a substantial number of small entities. Consistent with SBA guidance, the FAA conducted an initial regulatory flexibility analysis (IRFA) and a final regulatory flexibility analysis (FRFA). The initial regulatory flexibility analysis provided a detailed analysis of the impact on small entities. The FRFA directly addresses five requirements. While no comments specifically addressed the IRFA, the FAA addresses comments related to small entities.

As published in the notice, the FAA did not require fuel tank inspections for aircraft with a payload under 7,500 pounds. The primary difference between the proposed rule and the final rule is that the FAA extended operator compliance time from 18 to 36 months. In addition, the FAA determined that fewer fuel tank reinspections will be needed than originally estimated in the NPRM.

As a result of these changes, about 140 airplanes that would have been required to undergo a fuel tank inspection under the proposed rule will not be required to undergo a fuel tank inspection under the final rule because they will have been retired during the additional 18 months allowed for compliance. In addition, all of the inspections and reinspections would have had to be completed 18 months earlier under the proposed rule than under the final rule, resulting in a higher present value of the compliance costs. Consequently, recalculating (due to the greater number of airplanes and other values) the present value of the costs to operators to comply with the proposed rule would result in a cost of $172.2 million, which is approximately 36 percent more than the $126.6 million costs to operators to comply with the final rule.

Trade Impact Assessment

The Trade Agreement Act of 1979 prohibits Federal agencies from engaging in any standards or related activities that create unnecessary obstacles to the foreign commerce of the United States. Legitimate domestic objectives, such as safety, are not considered unnecessary obstacles. The statute also requires consideration of international standards and, where appropriate, that they be the basis for U.S. standards. In addition, consistent with the Administration's belief in the general superiority and desirability of free trade, it is the policy of the Administration to remove or diminish to the extent feasible, barriers to international trade, including both barriers affecting the export of American goods and services to foreign countries, and barriers affecting the import of foreign goods and services into the United States.

In accordance with the above statute and policy, the FAA assessed the potential effect of this final rule and determined that it will have only a domestic impact and, therefore, a minimal effect on any trade-sensitive activity.

Unfunded Mandates Assessment

The Unfunded Mandates Reform Act of 1995 (the Act), enacted as Pub. L. 104-4 on March 22, 1995, is intended, among other things, to curb the practice of imposing unfunded Federal mandates on State, local, and tribal governments.

Title II of the Act requires each Federal agency to prepare a written statement assessing the effects of any Federal mandate in a proposed or final agency rule that may result in a $100 million or more expenditure (adjusted annually for inflation) in any one year by State, local, and tribal governments, in the aggregate, or by the private sector; such a mandate is deemed to be a “significant regulatory action.”

As seen in Table IV-13 in the Final Regulatory Evaluation (contained in the docket to this rule), this final rule does not contain such a mandate. Therefore, the requirements of Title II of the Unfunded Mandates Reform Act of 1995 do not apply.

Executive Order 3132, Federalism

The FAA has analyzed this final rule under the principles and criteria of Executive Order 13132, Federalism. We determined that this action will not have a substantial direct effect on the States, or the relationship between the national Government and the States, or on the distribution of power and responsibilities among the various levels of government. Therefore, we determined that this final rule does not have federalism implications.

Environmental Analysis

FAA Order 1050.1D defines FAA actions that may be categorically excluded from preparation of a National Environmental Policy Act (NEPA) environmental impact statement. In accordance with FAA Order 1050.1D, appendix 4, paragraph 4(j), this rulemaking action qualifies for a categorical exclusion.

Energy Impact

The energy impact of this final rule has been assessed in accordance with the Energy Policy and Conservation Act (EPCA) Public Law 94-163, as amended (42 U.S.C. 6362) and FAA Order 1053.1. It has been determined that the final rule is not a major regulatory action under the provisions of the EPCA.

Regulations Affecting Intrastate Aviation in Alaska

Section 1205 of the FAA Reauthorization Act of 1996 (110 Stat. 3213) requires the Administrator, when modifying regulations in Title 14 of the CFR in a manner affecting intrastate aviation in Alaska, to consider the extent to which Alaska is not served by transportation modes other than aviation, and to establish such regulatory distinctions as she considers appropriate. The FAA, therefore, specifically requested comments on whether there is justification for applying the proposed rule differently to intrastate operations in Alaska. Although one commenter expressed a concern related to a particular Alaskan intrastate operation involving Lockheed Model L-188 Electra airplanes, no comments were received concerning such justification in general. Since no comments in that regard were received, and since the FAA is not aware of any justification for such regulatory distinction, the final rule is not applied differently to intrastate operations in Alaska.

List of Subjects

14 CFR Parts 21, 25, 91, and 125

• Aircraft
• Aviation safety
• Reporting and recordkeeping requirements

14 CFR Part 121

• Air carriers
• Aircraft
• Aviation safety
• Reporting and recordkeeping requirements
• Safety
• Transportation

14 CFR Part 129

• Air carriers
• Aircraft
• Aviation safety
• Reporting and recordkeeping requirements

The Amendment

In consideration of the foregoing, the Federal Aviation Administration amends parts 21, 25, 91, 121, 125, and 129 of Title 14, Code of Federal Regulations, as follows:

PART 21—CERTIFICATION PROCEDURES FOR PRODUCTS AND PARTS

1. The authority citation for Part 21 continues to read as follows:

Authority: 42 U.S.C. 7572; 40105; 40113; 44701-44702, 44707, 44709, 44711, 44713, 44715, 45303.

2. In part 21, add SFAR No. 88 in numerical order at the beginning of the part to read as follows:

* * * * *

SFAR No. 88—Fuel Tank System Fault Tolerance Evaluation Requirements

1. Applicability. This SFAR applies to the holders of type certificates, and supplemental type certificates that may affect the airplane fuel tank system, for turbine-powered transport category airplanes, provided the type certificate was issued after January 1, 1958, and the airplane has either a maximum type certificated passenger capacity of 30 or more, or a maximum type certificated payload capacity of 7,500 pounds or more. This SFAR also applies to applicants for type certificates, amendments to a type certificate, and supplemental type certificates affecting the fuel tank systems for those airplanes identified above, if the application was filed before June 6, 2001, the effective date of this SFAR, and the certificate was not issued before June 6, 2001.

2. Compliance: No later than December 6, 2002, or within 18 months after the issuance of a certificate for which application was filed before June 6, 2001, whichever is later, each type certificate holder, or supplemental type certificate holder of a modification affecting the airplane fuel tank system, must accomplish the following:

(a) Conduct a safety review of the airplane fuel tank system to determine that the design meets the requirements of §§ 25.901 and 25.981(a) and (b) of this chapter. If the current design does not meet these requirements, develop all design changes to the fuel tank system that are necessary to meet these requirements. The FAA (Aircraft Certification Office (ACO), or office of the Transport Airplane Directorate, having cognizance over the type certificate for the affected airplane) may grant an extension of the 18-month compliance time for development of design changes if:

(1) The safety review is completed within the compliance time;

(2) Necessary design changes are identified within the compliance time; and

(3) Additional time can be justified, based on the holder's demonstrated aggressiveness in performing the safety review, the complexity of the necessary design changes, the availability of interim actions to provide an acceptable level of safety, and the resulting level of safety.

(b) Develop all maintenance and inspection instructions necessary to maintain the design features required to preclude the existence or development of an ignition source within the fuel tank system of the airplane.

(c) Submit a report for approval to the FAA Aircraft Certification Office (ACO), or office of the Transport Airplane Directorate, having cognizance over the type certificate for the affected airplane, that:

(1) Provides substantiation that the airplane fuel tank system design, including all necessary design changes, meets the requirements of §§ 25.901 and 25.981(a) and (b) of this chapter; and

(2) Contains all maintenance and inspection instructions necessary to maintain the design features required to preclude the existence or development of an ignition source within the fuel tank system throughout the operational life of the airplane.

PART 25—AIRWORTHINESS STANDARDS: TRANSPORT CATEGORY AIRPLANES

3. The authority citation for part 25 continues to read:

Authority: 49 U.S.C. 106(g), 40113, 44701-44702, and 44704.

4. Section 25.981 is revised to read as follows:

§ 25.981

Fuel tank ignition prevention.

(a) No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapors. This must be shown by:

(1) Determining the highest temperature allowing a safe margin below the lowest expected autoignition temperature of the fuel in the fuel tanks.

(2) Demonstrating that no temperature at each place inside each fuel tank where fuel ignition is possible will exceed the temperature determined under paragraph (a)(1) of this section. This must be verified under all probable operating, failure, and malfunction conditions of each component whose operation, failure, or malfunction could increase the temperature inside the tank.

(3) Demonstrating that an ignition source could not result from each single failure, from each single failure in combination with each latent failure condition not shown to be extremely remote, and from all combinations of failures not shown to be extremely improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered.

(b) Based on the evaluations required by this section, critical design configuration control limitations, inspections, or other procedures must be established, as necessary, to prevent development of ignition sources within the fuel tank system and must be included in the Airworthiness Limitations section of the Instructions for Continued Airworthiness required by § 25.1529. Visible means to identify critical features of the design must be placed in areas of the airplane where maintenance actions, repairs, or alterations may be apt to violate the critical design configuration limitations (e.g., color-coding of wire to identify separation limitation).

(c) The fuel tank installation must include either—

(1) Means to minimize the development of flammable vapors in the fuel tanks (in the context of this rule, “minimize” means to incorporate practicable design methods to reduce the likelihood of flammable vapors); or

(2) Means to mitigate the effects of an ignition of fuel vapors within fuel tanks such that no damage caused by an ignition will prevent continued safe flight and landing.

5. Paragraph H25.4 of Appendix H to part 25 is revised to read as follows:

Appendix H to Part 25—Instructions for Continued Airworthiness

* * * * *

H25.4 Airworthiness Limitations section.

(a) The Instructions for Continued Airworthiness must contain a section titled Airworthiness Limitations that is segregated and clearly distinguishable from the rest of the document. This section must set forth—

(1) Each mandatory replacement time, structural inspection interval, and related structural inspection procedures approved under § 25.571; and

(2) Each mandatory replacement time, inspection interval, related inspection procedure, and all critical design configuration control limitations approved under § 25.981 for the fuel tank system.

(b) If the Instructions for Continued Airworthiness consist of multiple documents, the section required by this paragraph must be included in the principal manual. This section must contain a legible statement in a prominent location that reads: “The Airworthiness Limitations section is FAA-approved and specifies maintenance required under § § 43.16 and 91.403 of the Federal Aviation Regulations, unless an alternative program has been FAA approved.”

PART 91—GENERAL OPERATING AND FLIGHT RULES

6. The authority citation for part 91 continues to read:

Authority: 49 U.S.C. 1301(7), 1303, 1344, 1348, 1352 through 1355, 1401, 1421 through 1431, 1471, 1472, 1502, 1510, 1522, and 2121 through 2125; Articles 12, 29, 31, and 32(a) of the Convention on International Civil Aviation (61 Stat 1180); 42 U.S.C. 4321 et seq.; E.O. 11514; 49 U.S.C. 106(g) (Revised Pub. L. 97-449, January 21, 1983).

7. Amend § 91.410 by revising the section heading; redesignating the introductory text, paragraphs (a) introductory text, (a)(1), (a)(2) and (a)(3), and paragraphs (b) through (l) as paragraph (a) introductory text, paragraphs (a)(l) introductory text, (a)(1)(i), (a)(1)(ii), and (a)(1)(iii), and paragraphs (a)(2) through (a)(12); and adding a new paragraph (b) to read as follows:

§ 91.410

Special maintenance program requirements.

* * * * *

(b) After June 7, 2004, no person may operate a turbine-powered transport category airplane with a type certificate issued after January 1, 1958, and either a maximum type certificated passenger capacity of 30 or more, or a maximum type certificated payload capacity of 7,500 pounds or more, unless instructions for maintenance and inspection of the fuel tank system are incorporated into its inspection program. These instructions must address the actual configuration of the fuel tank systems of each affected airplane, and must be approved by the FAA Aircraft Certification Office (ACO), or office of the Transport Airplane Directorate, having cognizance over the type certificate for the affected airplane. Operators must submit their request through the cognizant Flight Standards District Office, who may add comments and then send it to the manager of the appropriate office. Thereafter, the approved instructions can be revised only with the approval of the FAA Aircraft Certification Office (ACO), or office of the Transport Airplane Directorate, having cognizance over the type certificate for the affected airplane. Operators must submit their request for revisions through the cognizant Flight Standards District Office, who may add comments and then send it to the manager of the appropriate office.

PART 121—OPERATING REQUIREMENTS: DOMESTIC, FLAG, AND SUPPLEMENTAL OPERATIONS

8. The authority citation for part 121 continues to read:

Authority: 49 U.S.C. 106(g), 40113, 40119, 44101, 44701-44702, 44705, 44709-44711, 44713, 44716-44717, 44722, 44901, 44903-44904, 44912, 46105.

9. Amend § 121.370 by revising the section heading; redesignating the introductory text, paragraphs (a) introductory text, (a)(1), (a)(2) and (a)(3), and paragraphs (b) through (l) as paragraph (a) introductory text, paragraphs (a)(l) introductory text, (a)(1)(i), (a)(1)(ii), and (a) (1)(iii), and paragraphs (a)(2) through (a)(12); and adding a new paragraph (b) to read as follows:

§ 121.370

Special maintenance program requirements.

* * * * *

(b) After June 7, 2004, no certificate holder may operate a turbine-powered transport category airplane with a type certificate issued after January 1, 1958, and either a maximum type certificated passenger capacity of 30 or more, or a maximum type certificated payload capacity of 7,500 pounds or more, unless instructions for maintenance and inspection of the fuel tank system are incorporated in its maintenance program. These instructions must address the actual configuration of the fuel tank systems of each affected airplane and must be approved by the FAA Aircraft Certification Office (ACO), or office of the Transport Airplane Directorate, having cognizance over the type certificate for the affected airplane. Operators must submit their request through an appropriate FAA Principal Maintenance Inspector, who may add comments and then send it to the manager of the appropriate office. Thereafter, the approved instructions can be revised only with the approval of the FAA Aircraft Certification Office (ACO), or office of the Transport Airplane Directorate, having cognizance over the type certificate for the affected airplane. Operators must submit their requests for revisions through an appropriate FAA Principal Maintenance Inspector, who may add comments and then send it to the manager of the appropriate office.

PART 125—CERTIFICATION AND OPERATIONS: AIRPLANES HAVING A SEATING CAPACITY OF 20 OR MORE PASSENGERS OR A MAXIMUM PAYLOAD CAPACITY OF 6,000 POUNDS OR MORE; AND RULES GOVERNING PERSONS ON BOARD SUCH AIRCRAFT

10. The authority citation for part 125 continues to read:

Authority: 49 U.S.C. 106(g), 40113, 44701-44702, 44705, 44710-44711, 44713, 44716-44717, 44722.

11. Amend § 125.248 by revising the section heading; redesignating the introductory text, paragraphs (a) introductory text, (a)(1), (a)(2) and (a)(3), and paragraphs (b) through (l) as paragraph (a) introductory text, paragraphs (a)(l) introductory text, (a)(1)(i), (a)(1)(ii), and (a) (1)(iii), and paragraphs (a)(2) through (a)(12); and adding a new paragraph (b) to read as follows:

§ 125.248

Special maintenance program requirements.

* * * * *

(b) After June 7, 2004, no certificate holder may operate a turbine-powered transport category airplane with a type certificate issued after January 1, 1958, and either a maximum type certificated passenger capacity of 30 or more, or a maximum type certificated payload capacity of 7,500 pounds or more unless instructions for maintenance and inspection of the fuel tank system are incorporated in its inspection program. These instructions must address the actual configuration of the fuel tank systems of each affected airplane and must be approved by the FAA Aircraft Certification Office (ACO), or office of the Transport Airplane Directorate, having cognizance over the type certificate for the affected airplane. Operators must submit their request through an appropriate FAA Principal Maintenance Inspector, who may add comments and then send it to the manager of the appropriate office. Thereafter, the approved instructions can be revised only with the approval of the FAA Aircraft Certification Office (ACO), or office of the Transport Airplane Directorate, having cognizance over the type certificate for the affected airplane. Operators must submit their requests for revisions through an appropriate FAA Principal Maintenance Inspector, who may add comments and then send it to the manager of the appropriate office.

PART 129—OPERATIONS: FOREIGN AIR CARRIERS AND FOREIGN OPERATORS OF U.S.-REGISTERED AIRCRAFT ENGAGED IN COMMON CARRIAGE

12. The authority citation for part 129 continues to read:

Authority: 49 U.S.C. 106(g), 40104-40105, 40113, 40119, 44701-44702, 44712, 44716-44717, 44722, 44901-44904, 44906.

13. Amend § 129.32 by revising the section heading; redesignating the introductory text, paragraphs (a) introductory text, (a)(1), (a)(2) and (a)(3), and paragraphs (b) through (l) as paragraph (a) introductory text, paragraphs (a)(l) introductory text, (a)(1)(i), (a)(1)(ii), and (a) (1)(iii), and paragraphs (a)(2) through (a)(12); and adding a new paragraph (b) to read as follows:

§ 129.32

Special maintenance program requirements.

* * * * *

(b) For turbine-powered transport category airplanes with a type certificate issued after January 1, 1958, and either a maximum type certificated passenger capacity of 30 or more, or a maximum type certificated payload capacity of 7,500 pounds or more, no later than June 7, 2004, the program required by paragraph (a) of this section must include instructions for maintenance and inspection of the fuel tank systems. These instructions must address the actual configuration of the fuel tank systems of each affected airplane and must be approved by the FAA Aircraft Certification Office (ACO), or office of the Transport Airplane Directorate, having cognizance over the type certificate for the affected airplane. Operators must submit their request through an appropriate FAA Principal Maintenance Inspector, who may add comments and then send it to the manager of the appropriate office. Thereafter the approved instructions can be revised only with the approval of the FAA Aircraft Certification Office (ACO), or office of the Transport Airplane Directorate, having cognizance over the type certificate for the affected airplane. Operators must submit their requests for revisions through an appropriate FAA Principal Maintenance Inspector, who may add comments and then send it to the manager of the appropriate office.

Issued in Washington, DC, on April 19, 2001.

Jane F. Garvey,

Administrator.