Fuel Tank Ignition Source Prevention Guidelines

09/24/18 AC 25.981 - 1D Contents (continued) Paragraph Page Appendix A. Certification of Arc Fault Circuit Breaker (AFCB) or Ground Fault Interrupter (GFI) ................................ ................................ ................................ ................................ ........... A - 1 A.1 Purpose. ................................ ................................ ................................ ........................ A - 1 A.2 Background. ................................ ................................ ................................ ................. A - 1 A.3 Certification Guidance. ................................ ................................ ................................ A - 1 Appendix B. Related Documents ................................ ................................ ................................ . B - 1 B.1 Regulations. ................................ ................................ ................................ .................. B - 1 B.2 Advisory Circulars. ................................ ................................ ................................ ....... B - 2 B.3 Orders. ................................ ................................ ................................ ........................... B - 2 B.4 Reports. ................................ ................................ ................................ ......................... B - 3 B.5 Military Specifications. ................................ ................................ ................................ . B - 3 B.6 Industry Documents. ................................ ....................... Error! Bookmark not defined.

Appendix C. Definitions ................................ ................................ ................................ .............. C - 1 C.1 Arc Fault Circuit Breaker (AFCB). ................................ ................................ .............. C - 1 C.2 Autoignition Temperature. ................................ ................................ ............................ C - 1 C.3 Auxiliary Tanks. ................................ ................................ ................................ ........... C - 1 C.4 Barrier. ................................ ................................ ................................ .......................... C - 1 C.5 Component Maintenance Manual (CMM) Deviation. ................................ .................. C - 1 C.6 Critical Design Configuration Control Limitations (CDCCLs). ................................ ... C - 2 C.7 Electrical Sparks. ................................ ................................ ................................ .......... C - 2 C.8 Electrical Arcs. ................................ ................................ ................................ .............. C - 2 C.9 Explosion Proof. ................................ ................................ ................................ ........... C - 2 C.10 Fail - Safe. ................................ ................................ ................................ ....................... C - 2 C.11 Filament Heating. ................................ ................................ ................................ .......... C - 2 C.12 Flammable. ................................ ................................ ................................ .................... C - 2 C.13 Flash Point. ................................ ................................ ................................ ................... C - 3 C.14 Friction Spark. ................................ ................................ ................................ ............... C - 3 C.15 Fuel System Airworthiness Limitation. ................................ ................................ ........ C - 3 C.16 Ground Fault Interrupter (GFI). ................................ ................................ .................... C - 3 C.17 Hot Short. ................................ ................................ ................................ ...................... C - 3 iii 09/24/18 AC 25.981 - 1D Contents (continued) Paragraph Page C.18 Ignition Source. ................................ ................................ ................................ ............. C - 3 C.19 Installation Apprais al. ................................ ................................ ................................ ... C - 3 C.20 Intrinsically Safe. ................................ ................................ ................................ .......... C - 3 C.21 Latent Failure. ................................ ................................ ................................ ............... C - 4 C.22 Line Replacement Unit (LRU). ................................ ................................ ..................... C - 4 C.23 Maximum Allowable Surface Temperatures. ................................ ............................... C - 4 C.24 Qualitative. ................................ ................................ ................................ .................... C - 4 C.25 Quantitative. ................................ ................................ ................................ .................. C - 4 C.26 Transient Suppression Device (TSD). ................................ ................................ .......... C - 4 Figures Number Page iv 09/24/18 AC 25.981 - 1D 1 PURPOSE .

This AC provides guidance for showing compliance with § 25.981, which provides the certification requirements for the preventio n of ignition sources , other than lightning , within the fuel tanks o f transport category airplanes. ( AC 25.954 - 1 addresses ignition sources due to lightning. ) This AC includes guidance for prevention of failure conditions created from ignition sources othe r than lightning . It describes a means of compliance, using circuit protective devices such as an arc fault circuit breaker (AFCB) or ground fault interrupter (GFI) , to provide fail - safe features that have been accepted as showing compliance with § 25.981 .

2 APPLICABILITY .

2.1 This AC applies to transport category airplanes for which a new, amended, or supplemental type certificate is requested. The guidance in this AC is for airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) transport airplane type certification engineers and the Administrator’s designees. This guidance is applicable for showing compliance with the fail - safe fuel tank system ignition prevention requirements of § 25.981, a mendment 25 - 102 an d later amendments. This guidance does not apply to the flammability requirements in § 25.981(b) and (c) ( at amendment s 25 - 125 and 25 - 102, respectively ).

It may also be used for showing compliance with the fail - safe requirements of §§ 25.901 and 25.1309, a mendments 25 - 40 through 25 - 46, for fuel tank system ignition prevention when a mendment 25 - 102 or later is not in the certification basis.

2.2 The material in this AC neither mandatory nor regulatory in nature and doe s not constitute a regulation. It describes acceptable means, but not the only means, for showing compliance with the applicable re gulations. The FAA will consider other means of showing compliance that an a pplicant may elect to present. While these guidelines are not mandatory, they are derived fro m extensive FAA and industry experience in determining compliance with the relevant regulations . I f , however, we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will n ot be bound by the terms of this AC, and we may require additional substantiation or design changes as a basis for finding compliance.

2.3 Th e material in this AC does not change or create any additional regulatory requirements, nor does it authorize changes i n, or permit deviations from, existing regulatory requirements.

3 CANCELLATION .

This AC cancels AC 25.981 - 1C , Fuel Tank Ignition Source Prevention Guidelines , dated September 19 , 2 008 .

09/24/18 AC 25.981 - 1D 4 BACKGROUND : REGULATORY HISTORY .

4.1 The regulatory standards of part 25 requi re that ignition sources not be present or develop in the fuel tanks of transport category airplanes. Amendment 25 - 11, effective May 5, 1967, introduced § 25.981, Fuel tank temperature . This requirement was prompted by a need for protection of airplane fue l tanks from possible ignition sources because of advances in electrical system sealing. These advances made it possible to place electrical system components, such as pumps and fuel gauging elements, as well as the wiring to these components, in immersed locations within fuel tanks.

Additionally, fuel tank walls were subject to local “hot spots” by the proximity of airplane equipment and compressor bleed air ducts that carry air at high temperatures.

4.2 The need for a regulation was further substantiated by t he possibility that the surface temperature of the fuel tank internal wall, or the fuel system components within the fuel tank, could exceed the autoignition temperature of the fuel . Section 25.981, as originally adopted, focused on preventing ignition of fuel vapors in the fuel tanks from hot surfaces. It required that the applicant determine the highest temperature allowable in fuel tanks that provided a safe margin below the lowest expected autoignition temperature of the fuel approved for use in the fue l tanks . In addition, this regulation established a requirement that no temperature at any place inside any fuel tank where fuel ignition is possible may then exceed that maximum allowable temperature.

4.3 Other sections of part 25 require that ignition from l ightning be prevented (§ 25.954 , Fuel system lightning protection ), as well as ignition from failures in the fuel system (§ 25.901 , Powerplant: Installation ). Section 25.901 requires a pplicants to co m plete a safety assess m ent of the fuel system and show th at “no single f ailure or m al f unction or probable co m bination of f ailures will jeopardize the sa f e operation of the airplane....” However, service history has shown that ignition sources have developed in airplane fuel tanks due to unfo r eseen failure m odes or factors that were not considered at the ti m e of original certification of the airplane model , including arcs, sparks, or hot surfaces within the fuel tanks.

4.4 AC 25.981 - 1A, Guidelines for Substantiating Compliance with the Fuel Tank Temperature Requiremen ts , dated January 20, 1971 , provided guidance that included failure m odes that use d to be considered when deter m ining co m pliance with the fuel tank te m perature require m ents defined in § 25.981 , a mendment 25 - 11 . This regulation originally focused on prevent ing ignition of fuel vapors in the fuel tanks from hot surfaces. The AC also stated the accepted practice of establishing a m ini m um 50 °F te m perature m argin below the lowest autoignition te m perature of the approved fuels.

4.5 Amendment 25 - 102, issued on April 18, 2001, renamed § 25.981 as Fuel tank ignition prevention . That amendment also added new requirements to address causes of ignition sources within fuel tanks , and to minimiz e the development of flammable vapors in the fuel tanks or mitigat e the effects o f ignition of vapors in the tanks. The ignition source prevention standard requires a safety assessment of the fuel tank system that includes:  C onsideration of single failures ; 09/24/18 AC 25.981 - 1D  P robable co m binations of failures ;  D evelop m ent of long - term instructions for co ntinued airworthiness (ICA) , including m andatory replacement time, inspection interval, related inspection procedure, and c ritical d esign c onfiguration c ontrol l i m itations (CDCCL s ) ; and  M aintainability of the airplane f uel tank syste m .

4.6 Special Federal Avia tion Regulation (SFAR) No. 88 to part 21, Fuel Tank System Fault Tolerance Evaluation Requirements , issued at a mendment 21 - 78 on April 18, 2001, requires a one - time reassessment of the fuel tank systems of many in - service transport category airplanes accor ding to the ignition source prevention requirements of § § 25.901 and 25.981, at a mendment s 26 - 46 and 25 - 102 , respectively .

4.7 A m end m ent 25 - 125, issued July 9, 2008, add ed specific require m ents f or the f uel tank f la mm ability to § 25.981 . The require m ents f or C DCCL s were expanded to include fla mm ability reduction m eans and ignition m itigation.

4.8 Amendment 25 - 146 , issued on September 6, 2018 (83 FR 47548, September 20, 2018) , enhanced § 25.954 requirements to prevent catastrophic fuel tank failures due to the ef fect of lightning on the fuel t ank structure and syst ems including fault tolerant fuel system lightning ignition source protection. This a mendment removed lightning as an ignition source threat to be assessed under § 25.981 because it was often impractical to show compliance with § 25.981 for lightning in so me cases. It also renamed § 25.981 from Fuel tank ignition prevention to Fuel tank explosion prevention .

5 OBJECTIVE .

The objective of this AC is to provide guid ance that address es the prevention of possible sources of ignition in airplane fuel tanks in orde r to comply with § 25.981 , at a mendment 25 - 1 46 . Analytical evaluation of the fuel tank system, including consideration of lessons learned from the service history of transport category airplanes , provides insight into design features that should be carefull y considered when determining compliance with the regulations that are intended to prevent igni tion sources within fuel tanks.

6 SYSTEM S AFETY A SSESSMENT (SSA).

T he preamble to a mendment 25 - 102 states : This rulemaking also adds a new paragraph (a)(3) to requ ire that a safety analysis be performed to demonstrate that the presence of an ignition source in the fuel tank system could not result from any single failure, from any single failure in combination with any latent failure condition not shown to be extrem ely remote, or from any combination of failures not shown to be extremely improbabl e … . Compliance with § 25.981 requires an analysis of the airplane fuel tank system using analytical methods and documentation 09/24/18 AC 25.981 - 1D currently used by the aviation industry in demon strating compliance with §§ 25.901 and 25.1309.

6.1 Before conducting a n SSA of the fuel system , each applicant should assemble and review relevant lessons learned from the overall transport fleet history, as described in this AC, as well as from its previous products and suppliers and any other available sources to assist in identifying any unforeseen failures, wear, or other conditions that could result in an ignition source. Sources of information include airplane service records, flight logs, inspection rec ords, and component supplier service and sales records. Guidance relating to the flammability requirements adopted in the amended § 25.981 is provided separately in AC 25.981 - 2A , Fuel Tank Flammability Reduction Means . Gu idance relating to fuel system ligh tni ng protection is provided in AC 25.954 - 1 .

6.2 Safety assessments of previously certificated fuel systems may require additional considerations. For these safety assessments , component sales records may assist in identifying if component failures and replace ment s are occurring. In addition, in some cases , changes to components have been introduced following original type design certification without consideration of the possible effects of the changes on the system’s compliance with the requirements to preven t ignition sources. For example, certain components within fuel pumps (e.g. , thrust washer) have been changed to improve pump life, which defeated the original fail - safe features of the pumps. Therefore, results of reviewing this service history informatio n, and a review of any changes to components from the original type design, should be documented as part of the safety analysis of the fuel tank system.

6.3 T he following list s summarize design features, malfunctions, failures, and maintenance/operational - rela ted actions that have been identified through service experience as resulting in a degradation of the safety features of airplane fuel tank systems. Th ese list s are provided as guidance and are not inclusive of all failures that need to be considered in th e failure assessment. They may assist in evaluating possible failure modes during evaluation of the fuel tank installation.

6.3.1 Pumps.

1. Ingestion of pump inlet components (e.g., inducers, fasteners) into the pump impeller , releasing debris into the fuel tank.

2. P ump inlet case degradation, allowing the pump inlet check valve to contact the impeller.

3. Failure of one phase of the stator winding during operation of the fuel pump motor together with subsequent failure of a second phase of the motor windings, resulting in arcing through the fuel pump housing.

4. Arcing due to the exposure of electrical connections within the pump housing that has been designed with inadequate clearance to the pump cover.

5. Omission of cooling port tubes between the pump assembly and the pump motor assembly during pump overhaul.

09/24/18 AC 25.981 - 1D 6. Extended dry running of fuel pumps in empty fuel tanks (e.g. caused by failure of the fuel pump relay in the on position) .

7. Use of steel impellers that may produce friction sparks if debris enters the pump.

8. Debris lodged inside pumps.

9. Pump power supply connectors that have been damaged, worn, or corroded , resulting in arcing within the connector that damages the hermetic seal, causing fuel leakage.

10. Electrical connections within the pump housing that have been designed wit h inadequate clearance or insulation from the metallic pump housing, resulting in arcing.

11. Thermal switches aging over time , resulting in a higher trip temperature.

12. Flame arrestors falling out of their respective mounting.

13. Internal wires coming in contact w ith the pump rotating group, energizing the rotor , and arcing at the impeller/adapter interface.

14. Poor bonding across component interfaces.

15. Insufficient arc - fault or ground - fault current protection capability.

16. Poor bonding of components to structure.

17. Loads transferred from the airplane fuel - feed plumbing into the pump housing , resulting in failure of the housing mounts and subsequent failure of the pump case, which defeated the explosion - proof capabilities of the pump.

18. Premature failure of fuel pump thrust b earings allowing steel rotating parts to contact the steel pum p side plate.

19. Erosion of the fuel pump housing, causing loss of the fuel pump explosion - proof capability and exposure of fuel pump wiring to the fuel tank.

6.3.2 Wiring to Fuel Pumps.

1. Wear of Teflon o r other insulating sleeving and wiring insulation on wires in metallic conduits located inside fuel tanks, allowing arcing from the wire through the conduits into fuel tank ullages.

2. Damage to insulation on wiring routed adjacent to the fuel tank exterior s urfaces , result ing in arcing to the metallic fuel tank surface.

6.3.3 Fuel Pump Connectors.

1. Electrical arcing at connections within electrical connectors due to bent pins , wear, manufacturing variability (e.g. tolerances), or corrosion.

2. Fuel leakage and subseque nt fuel fire outside of the fuel tank caused by corrosion or wear of electrical connectors to the pump motor , le a d ing to electrical arcing through the connector housing (connector was located outside the fuel tank).

09/24/18 AC 25.981 - 1D 3. Selection of improper insulating materia ls in connector design , resulting in degrad ation of the material because of contact with fuel that is used to cool and lubricate the pump motor.

6.3.4 Fuel Quantity Indicating System (FQIS) Wiring.

1. Degradation of wire insulation material (cracking).

2. Conductive o r semi - conductive (silver, copper , or cadmium) deposits at electrical connectors inside fuel tanks.

3. Inadequate wire separation between FQIS wiring and structure , or between other wiring, result ing in contact that caus es chafing of the wiring.

4. Unshielded FQ IS wires routed in wire bundles together with high voltage wires, creating the possibility of short circuit failures on the FQIS wires in excess of intrinsically safe levels.

5. FQIS wiring that does not adhere to the airplane manufacturer’s standard wiring p ractices (i.e., wires bent back along themselves with bend radius less than defined in the airplane manufacturer’s standard wiring practices, multiple splices lying next to one another, etc.).

6.3.5 FQIS Probe Installation .

1. Conductive or semi - conductive corrosio n (copper or silver sulfur deposits) causing reduced breakdown voltage in FQIS wiring.

2. Damage to FQIS wire insulation resulting in reduced breakdown voltage because of wire clamping features at electrical connections on fuel quantity probes.

3. Contamination in the fuel tanks creating an arc path for low levels of electrical energy between FQIS probe walls (steel wool, lock wire, nuts, rivets, bolts, and mechanical impact damage to probes).

6.3.6 Valve Actuators.

Failure of one solenoid in a dual solenoid actuated v alve resulting in overheating of one solenoid above the autoignition temperature.

6.3.7 Float Switch Systems.

1. Conduits containing float switch wiring fail ure due to freezing of water that entered the conduit, allowing fuel leakage into the conduit and along the airplane front spar resulting in an engine tailpipe fire.

2. Float switch wire chaffing observed , which might have provided potential for subsequent electrical short to the conduit.

3. Float switch sealing failure that allowed fuel/water to egress into the switc h, compromising switch operation in an explosive environment.

09/24/18 AC 25.981 - 1D 6.3.8 Fuel Tubes, Vent Tubes, Conduits, and Hydraulic Lines.

1. Poorly conducting pipe couplings that may become electrical arc sources when exposed to electric currents.

2. Insufficient clearances between tubes and surrounding structure.

3. Intermittent electrical bonding in flexible couplers.

4. Bonded couplers unable to conduct expected power fault currents without arcing.

6.3.9 Electrical Generator Power Feeder Cables.

1. Arcing of electrical power feeder cables to a p ressurized fuel line , resulting in fire adjacent to the fuel tank.

2. Arcing of electrical power feeder cables to aluminum conduit , resulting in molten metal dropping onto a pressurized fuel line and consequently causing pressurized fuel leakage.

6.3.10 Bonding Stra ps.

1. Corrosion of bonding strap wires resulting in failure to provide required current paths.

2. Inappropriately attached connections (loose or improperly grounded attachment points).

3. Worn s tatic bonds on fuel system plumbing connections inside the fuel tank , due to mechanical wear of the plumbing from wing movement and corrosion.

4. Corrosion of bonding surfaces near fuel tank access panels that could diminish the effectiveness of bonding features.

5. Aging of self - bonding fuel system plumbing connections , resulting in higher resistance bonding.

6. Missing bonds.

7. Loose or intermittent contacts between bond straps and other conductive components.

6.3.11 Pneumatic System Failures.

Leakage of hot air from ducting located near fuel tanks due to duct failure resulting in undetected heating of tank surfaces above the autoignition temperature.

6.3.12 Electrostatic Charge.

1. U se of a non - conductive type of reticulated polyurethane foam in only a portion of the fuel tank system that allowed electrostatic charge build - up and arcing in the unprote cted portion of the system.

2. Spraying of fuel through refueling nozzles located at the upper portion of the tank.

09/24/18 AC 25.981 - 1D 7 FUEL VAPOR IGNITION SOURCES.

7.1 Overview.

There are four primary phenomena that can result in ignition of fuel vapors within airplane fuel tanks:  E lectrical sparks and arcs ,  F ilament heating,  F riction sparks, and  A utoignition or h ot surface ignition.

7.1.1 The conditions required to ignite fuel vapors from these ignition sources vary with pressures and temperatures within the fuel tank and can be affected by sloshing or spraying of fuel in the tank . Due to the difficulty in predicting fuel tank flammability and eliminating flammable vapors from the fuel tank, the regulatory authorities have always assumed that a flammable fuel / air mixture may exist in airp lane fuel tanks and have required that no ignition sources be present.

7.1.2 Any components located in or adjacent to a fuel tank must be designed and installed in such a manner that, during both normal and anticipated failure conditions, ignition of flammable f luid vapors will not occur . Compliance with this requirement is typically shown by a combination of component testing and analysis . Testing of components to meet the appropriate level of explosion - proof requirements should be carried out for various single failures, and combinations of failures, to show that arcing, sparking, autoignition, hot surface ignition, or flame propagation from the component will not occur . Testing of components has been accomplished using several military standards and component q ualification tests . For example, Method 511.5, Procedures I and II, of M ilitary S tandard MIL - STD - 810 N defines one method that the FAA has accepted for showing that a component is explosion proof as defined in a ppendix C of this AC .

Section 9 of RTCA DO - 160 G has also been accepted for showing that airborne equipment is explosion proof.

7.2 Electrical Sparks and Electrical Arcs.

7.2.1 Laboratory testing has shown that the minimum ignition energy in an electrical spark required to ignite hydrocarbon fuel vapor is 200 mi crojoules . Therefore, for electrical or electronic systems that introduce electrical energy into fuel tanks, such as FQIS , any electrical arcs or sparks that are created into any fuel tank should be less than 200 microjoules during either normal operation or operation with failures.

The 200 - microjoule s level comes from various sources . The most quoted is fr om Lewis and Von Elbe ’s book , “Combustion, Flames and Explosions of Gases” (Florida: Academic Press, Inc., 1987; (orig. publ. 1938)). It has a set of curves for minimum ignition energy for the various hydrocarbon compounds in j et fuel, and they all have si milar minimum ignition energy levels of around 220 microjoules.

09/24/18 AC 25.981 - 1D Note: In the past , some components have been qualif ied to standards that allow 320 microjoules, but this level is not acceptable for showing intrinsic safety .

7.2.2 To ensure that the design has adequate reliability and acceptable mainten ance intervals, a factor of safety should be applied to this value when establishing a design limit. Fuel tank systems should be designed to limit the allowable energy level to the lowest practical level . Systems with a maximum energy of 20 microjoules are considered technologically feasible . Normal systems operations at minimum ignition energies of up to 50 microjoules would be acceptable . Under failure conditions, the system should have an ignition energy of less than 2 00 microjoules.

7.3 Filament Heating Cur rent Limit.

Analyses and testing indicate a small piece of steel wool will ignite a flammable mixture when a current of approximately 100 milliamperes ( m A) root mean square ( rms ) is applied to the steel wool . Therefore, for electrical or electronic system s that introduce electrical energy into fuel tanks, such as FQIS , the electrical current introduced into any fuel tank should be limited . Because there is considerable uncertainty associated with the level of current necessary to produce an ignition source from filament heating, a factor of safety should be applied to this value when establishing a design limit . A maximum steady - state current of 25 m A rms is considered an intrinsically safe design limit for electronic and electrical systems that introduce e lectrical energy into fuel tanks . For failure conditions, the system should limit the current to 50 m A rms and induced transients to 125 m A peak current.

7.4 Friction Sparks.

Service experience has shown that pump inlet check valves, inducers, nuts, bolts, riv ets, fasteners, lockwire, roll pins, cotter pins, drill chips, manufacturing debris, and so forth have been drawn into fuel pumps and contacted the impeller , resulting in the possibility of metallic deposits on rotating and stationary components within the pump . This condition has resulted in creation of friction sparks and should be an assumed failure condition when conducting the SSA . Fail - safe features as described in paragraph 9.2.1 9.2.2 of this AC have been used to mitigate this hazard.

7.5 Maximum Allowable Surface Temperature s .

Section 25.981(a)(1) and (2) requires: (1) Determining the highest temperature allowing a safe margin below the lowest expected autoignition temperatur e of the fuel in the f uel tanks .

(2) Demonstrating that no temperature at each place inside each fuel tank where fuel ignition is possible will exceed the temperature determined under paragraph (a)(1) of this section. This must be verified under all probable operating, failure, and malfunction conditions of each component whose Intrinsically safe is defined in appendix C, paragraph C.20 , of this AC.

This data was from testing performed by the FAA, found in Report No. DOT/FAA/AR - TN05/3 7. Applicants may conduct testing to substantiate alternate values.

09/24/18 AC 25.981 - 1D operation, failure, or malfunction could increase the temperature inside the tank .

7.5.1 Autoignition Temperatures of Fuels .

Fuels approved for use on transport category airplanes have differing autoignition te mperatures . The autoignition temperature of JP - 4 (wide - cut jet fuel) , as determined by 4 5 ASTM International Test Method D286 , is approximately 468 °F at one atmosphere of pressure . By this method of testing under the same atmospheric conditions , the autoig nition temperature of JET A (kerosene) is approximately 435 °F to 450 °F, and gasoline is approximately 800 °F . The autoignition temperature of these fuels varies inversely with the ambient pressure . A l s o, as stated in ASTM E659 , Standard Test Method for A utoignition Temperature of Chemicals , “the autoignition temperature by a given method does not necessarily represent the minimum temperature at which a given material will self - ignite in air. The volume of the vessel used is particularly important since lo wer autoignition temperatures will be achieved in larger vessels.” In view of this, factors affecting the pressure in the fuel tank should be taken into consideration when determining compliance with § 25.981.

7.5.2 Maximum Surface Temperature.

Guidance provided in AC 25 - 8, Auxiliary Fuel System Installations , as well as the original release of AC 25.981 - 1 , define s surfaces that come within 50 °F of the autoignition temperature of the fuel air mixture as defining a maximum allowable surface temperature providing a safe margin below the lowest autoignition temperature of the fuel . The FAA has historically accepted 400 °F for maximum surface temperatures inside fuel tanks for kerosene type fuels without further substantiation .

(Maximum surface temperature considerat ions for areas outside the fuel tank are discussed in paragraph 9.3.6.3 of this AC.)

7.5.3 Transient Higher Surface Temperature .

Manufacturers have substantiated that the conditions (ambient pressure, dwell time, fuel type, etc.) wit hin fuel tanks are such that a higher value may be used as a transient surface temperature limit . For example, a maximum allowable fuel tank surface temperature of 400 °F, with a transient excursion that reduces the safe margin below 450 °F (i.e . , the lowe st expected autoignit i o n temperature) for a maximum of two minutes, has been substantiated for kerosene type fuels . The excursion above 400 °F occurs only during failure conditions such as failure of the engine pneumatic system to regulate temperature, or duct rupture. Utilizing elevated temperatures has been based on F ormerly known a s the American Society for Testing and Materials.

ASTM D286, Method of Test for Autogenous Ignition Temperatures of Petroleum Products , was withdrawn by ASTM Internatio nal in 1966 shortly before a mendment 25 - 11 established the autoignition temperature limit requirements now contained in § 25.981(a)(1) and (2). It was referenced in AC 25.981 - 1A, dated January 20 1971, and all subsequent issues of this AC. Therefore, we co ntinue to accept the autoignition temperatures established using ASTM D286 as a means of compliance with § 25.981(a)(1) and (2). The ASTM website says it was replaced by ASTM D2155 - 12, Standard Test Method for Determination of Fire Resistance of Aircraft H ydraulic Fluids by Autoignition Temperature . The C oordinating R esearch C ouncil Handbook of Fuels says it was replaced by ASTM E659 - 15, Standard Test Method for Autoignition Temperature of Chemicals . Either test method should provide similar results to ASTM D286.

09/24/18 AC 25.981 - 1D specific design features, such as an overtemperature shutoff of the pneumatic system so that the temperature cannot reach or exceed the accepted autoignition temperature of 450 °F for kerosene type fuels . Applicants should submit comprehensive test data and analytical rationale substantiating a ny transient excursion in order to show that they are maintain ing a safe margin below the lowest expected autoigniti on temperature of the fuel.

7.6 Fuel Syst em Electrostatics.

7.6.1 Electrostatic charges are generated in liquid hydrocarbons when they are in motion with respect to another surface such as fueling hoses, filters, nozzles, fuel tank structure , and airplane plumbing . The documents reference d in paragraph s B.6 through B.8 of this AC provide information on this subject . For example, d uring airplane refueling jet fuel is loaded either from a tanker truck or from an airport hydrant system . Flowing fuel can generate an electrical charge especially through fuel filtration . The accumulation of charge in the fuel is a function of many factors . If the fuel conductivity is low, the relaxation time for dissipation of the electrical charge is long . Additionally , if airplane structure conductivity is low , as it is common ly in composite wings, the relaxation time of the fuel bulk charge to structure may be longer than it would be for a traditional metallic wing structure. Some composite structure has a lower condu ctivity than traditional metallic structures. A comparison can be made of the conductivity of the fuel with the conductivity of the airplane structure. Jet fuel typically has significantly lower conductivity than composite structure, meaning the conductivi ty of the jet fuel dominates the charge relaxation rate and consequently result s in similar charge relaxation rates between the different types of airplane structure s . Regardless, the fuel will accumulate an electrical charge inside an airplane fuel tank . This electrical charge may produce a high potential on the fuel surface and an electrical discharge to structure .

This is particularly a concern if large unbonded objects are located inside an airplane fuel tank . Smaller components may also become charged , and the applicant should address this in the safety assessment . If the vapor space fuel/air mixture is in the flammable range, ignition of the mixture is possible, resulting in a fuel tank explosion and fire.

7.6.2 Charge accumulation is influenced by many fact ors . Without a n electrical conductivity improver , typical Jet A fuel has a low electrical conductivity . A n electrical conductivity improver will increase the charging rate of fuel , but at the same time greatly improve the conductivity of the fuel to rapid ly dissipate the developed charge .

Contaminants, considered as ionic impurities, enhance the charging tendency of the specific fuel . Fuels from different parts of the world and from different refineries will therefore have different charging tendencies bas ed on the types of contaminants present .

7.6.3 Water contamination, however, increases the charging tendency of the fuel without a corresponding increase in conductivity . W ater interacts with the additives or the naturally occurring contaminants in the fuel to p rovide this pro - static effect.

In some industry documents, “electrical conductivity improver” may also be referred to as a dissipator/dissipater, static dissipater additive, electrical conductivity additive, or conductivity improver additive.

09/24/18 AC 25.981 - 1D Recognizing the dangers of water contamination, the National Fire Protection Association (NFPA) also cautions that when refueling, care should be taken to not disturb the interface between the fuel remaining in the tank and t he possible layer of water below it . Disruption of this interface up into the tank ullage/vapor space may lead to an electrical discharge capable of igniting a mixture of flammable fuel vapor and air.

7.6.4 Methods for minimizing the magnitude of the developed c harge have been developed and are in place on transport category airplanes including the following: 7.6.4.1 The refuel plumbing is sized and includes an orifice to maintain maximum flow rates in accordance with the electrostatic guidelines established by the NFPA and the ASTM .

7.6.4.2 The NFPA and ASTM have published guidelines to limit f low velocities to 6 to 7 meters per second while the discharge port is covered with fuel .

The NFPA/ASTM guidelines also indicate that the flow velocity should be held to less than 1 meter per second until the discharge port is covered with fuel. These guidelines were developed with gasoline in mind and are, therefore, conservative when applied to kerosene type fuels used in commercial aviation. The design guidelines for commercial aircraft in SAE AIR1662 limit velocities to 6 to 9 m eters per s econd in fuel plumbing and 3 m eters per s econd at the exit nozzle. Limiting the flow velocity may be met by incorporating multiple refueling discharge ports, lowering the flow velocity through the use of piccolo tubes that distribute the fuel at low velocities in the tank, and locating them at or near the bottom of the tank . Location of the refueling discharge at the bottom of the tank minimizes fuel spray — a contributor to static charge development — and provides for the ports to be covered by fuel reserves in main tanks and in the early stages of fuel flow as the refuel rate varies from 1 meter per second up to the full flow of 6 to 7 meters per second in normally emptied tanks.

Note: It may not be practical to develop a dual flow rate refueling system , so one way to address these guidelines may be to limit the refueling velocities to less than 1 meter per second through the use of multiple discharge points and piccolo tubes.

7.6.5 Methods of relaxing the charge have also been developed . Bonding straps are used on fuel components and plumbing lines to allow the charge to dissipate to the tank structure. During refueling, the airplane is bonded to the refueling vehicle with a separate bonding wire to provide an electric al path back to fuel filtration, which is the principal electrostatic charge generator . A n electrical conductivity improver may also be used to increase fuel conductivity to quickly dissipate the developed charge .

However, the FAA does not require this typ e of additive, unless it is specified as part of the type design approval . Any limitations on the use of an electrical conductivity Formerly known as the Society of Automotive Engineers.

09/24/18 AC 25.981 - 1D improver would need to meet the requirements of § § 25.1521 , Powerplant limitations , and 25.1557 , Miscellaneous markings and placards .

7.6.6 Applications of the above methods , and adherence to industry practices and guidelines on electrostatics , should be identified for each airplane model . Airline operation and practices regarding airplane refueling should also be evaluated to verify that the procedures necessary for safe operation of the specific airplane model are in place and followed . Restrictions, if any, on refuel rates, fuel properties, and the requirement for fuel additives should be identified as CDCCL s .

7.6.7 Polyurethane reticula ted foams used for ignition suppression within fuel tanks and other non - conducting objects may accumulate and retain charge . These items may have to be treated with antistatic additives to prevent charge accumulation.

8 DESIGN CONSIDERATION S.

The number of c omponents and systems inside airplane fuel tanks whose failure could result in an ignition source within the fuel tank should be minimized . The following example s are FAA - accepted design practices for minimizing ignition sources : 8.1 Fiber Optics .

Wiring enter ing the tank for such purposes as temperature monitoring and fuel quantity indication should be minimized . Use of alternate technology, such as fiber optics, may provide a means of reducing or eliminating electrical powered components from inside the fuel tanks.

8.1.1 Fuel Pump Electrical Power Supply.

8.1.2 Fuel Pump Power Wiring .

If practical, fuel pumps should be located such that electrical power for the pumps is routed outside the fuel tanks in such a manner that failures in the electrical power supply cannot crea te a hot spot inside the tank or arc into the fuel tank . While the routing of fuel pump power supply outside of the fuel tank, and away from the fuel tank walls, may eliminate the potential for arcing directly into the fuel tank or heating of tank surfaces , the failure analysis should consider the need for electrical circuit protective devices . If the power supply cannot be routed outside the tank, additional design features should be considered as discussed in paragraph 8.3.2 b elow.

Note: The applicant should consider , in the design of the pump wiring system and when showing compliance, the e lectromagnetic effects and electrical transients that may damage the wiring or pump.

8.1.3 Fuel Pump Electrical Connectors.

8.1.3.1 A rcing at the pump electric al connector has resulted in uncontrolled fuel leakage, an ignition source, and an uncontrolled fire outside of the fuel tank . This can create a fuel tank ignition source due to the external fire 09/24/18 AC 25.981 - 1D heating the fuel tank surfaces. Manufacturers have developed fuel pumps that include features to isolate the electrical connector from the portion of the fuel pump where fuel is located. Applicants should show that a rcing that occurs in these designs cannot cause a cascading failure from arcing in the electrical co nnection resulting in a fuel leak and a fire. One approach includes incorporation of a dry area between the electrical connector and the fuel pump. Another approach includes extending the fuel pump power wire so the electrical connector is well away from t he fuel pump. This approach has include d a drip loop on the wire to prevent any fuel leaking onto the wire from being present at the electrical connector.

8.1.3.2 Alternatively, or in addition to isolating electrical connector from the fuel, limiting the electrica l energy into the fuel tank can prevent an ignition source from occurring. The design of traditional fuel pumps has resulted in the need to install AFCB or GFI protection features to limit the energy release during an arcing event to prevent an ignition so urce from occurring.

8.2 Location of the Pump Inlet.

Debris that may enter a fuel pump inlet can cause sparks inside the fuel tank . One means to address this ignition source has been to locate the pumps such that the pump inlet remains covered with fuel any ti me the pump is operating within the airplane operating envelope . Another means has been to prevent the propagation of any ignition from the pump into the fuel tank by us ing flame arrestor technology . (The performance of the flame arrest o r should be validat ed by test to verify its effectivene ss at stopping a flame front.) Any protective means , including those shown in paragraphs 8.2.1 and 8.2.2 below , should be demonstrated to be effective under the p itch, roll attitudes, and negative G conditions anticipated to occur in service.

8.2.1 Main Feed Tanks.

Installation of baffles in tank structure , and use of collector tanks that are continually filled with fuel using ejector pumps , are methods that have proven successful at keeping the pump inlets and pump housings submerged in fuel.

8.2.2 Auxiliary Tanks.

For auxiliary tanks that use motor - driven fuel pumps and that are routinely emptied, accepted design practices include shutting off the motor driven pumps before un covering the fuel pump inlet and installation of a flame arrestor in the scavenge pump inlet line, or scavenging the remaining fuel with ejector pumps. (Note that installation of features such as a flame arrestor in the fuel system would need to meet fuel system performance requirements in § 25.951 , Fuel System: General .)

8.3 Wiring.

The following paragraphs on wiring represent acceptable approaches for dealing with wiring used in and near fuel tanks . For specific requirements and further guidance, the 09/24/18 AC 25.981 - 1D applican t should review the wiring installation and design requirements in the Electrical Wiring Interconnect Systems (EWIS) rules, a mendment 25 - 123, and associated ACs .

8.3.1 Intrinsically S afe W iring.

All wiring that is intended to conduct intrinsically safe levels of electrical power into or through the fuel tanks should incorporate protective features that prevent exceeding the intrinsically safe levels discussed in paragraphs 7.2 and 7.3 of thi s AC. This wiring should also be protected from h igh i ntensity r a d iated f ields (HIRF) induced transients .

The following protective features could be used to support that objective:  Separation and shielding of the fuel tank wires from other airplane wiring and circuits,  Shielding for HIRF and other electromagnetic effects , and  Installation of transient suppression devices to preclude unwanted electrical energy from entering the tank .

8.3.2 Higher E nergy W iring .

This i ncludes all wiring that is not intrinsically safe .

8.3.2.1 Wiring should not be routed through metallic conduit inside the fuel tank or adjacent to fuel tank surfaces such that damage, inappropriate maintenance, or other failure/wear conditions could result in arcing to the conduit or metallic tank surface and consequent development of an ignition source in the fuel tank . If metallic or other conductive conduit materials are used, the single failure of electrical arcing of the wiring to the conduit, adjacent tank surfaces, or structure should b e assumed to occur . In addition, circuit protective features or other features should be incorporated to preclude development of an ignition source in the fuel tank . Methods that may be used to address this foreseeable failure condition include the use of circuit protective features such as dual conduits, thick wall conduit, and/or fast - acting AFCB or GFI circuit breakers. Providing multiple layers of sleeving alone would not be considered acceptable since wear could defeat the multiple layer protection.

8.3.2.2 W h ere electric wires are routed through metallic conduits installed in a fuel tank, high surface temperatures or arcing th r ough the conduit wall can be created by short circuits . All wiring conducting levels of power that exceed intrinsically safe levels (e. g., fuel pump power supply) into or through a fuel tank should be evaluated assuming arcing to adjacent surfaces , such as metallic conduits or wing surfaces, unless fail - safe protective features are provided . A critical electrical wiring condition might be one in which the insulation is worn, cracked, broken, or of low dielectric strength, allowing intermittent or constant arcing to occur without consuming enough power to cause the circuit protection device , such as a thermal mechanical circuit breaker , to open . Inspection of wiring 09/24/18 AC 25.981 - 1D from in - service airplanes has shown that greater than expected wear may occur on sleeving and wiring insulation due to movement of the wire within the conduit . Roughness of the conduit material and variations in vibration levels for each installation may significantly increase wear . In addition, inspections have shown that protective sleeving has been missing or improperly installed, or the wrong sleeving material has been used, resulting in damage to the insulation . For these rea sons, use of protective sleeving on wiring would not by itself be adequate for showing compliance . The design should be tolerant to these types of foreseeable failure or maintenance errors.

Note: AC 25 - 8 addresses the use of metallic conduit as an acceptable mea ns for routing electrical power within auxiliary fuel tanks. As indicated above, these past practices would not meet the fail - safe requirements of § 25.981 for any fuel tank, unless additional fail - safe features were incorporated. Therefore, the more recen t guidance in this AC, and rulemaking in a mendment 25 - 102 , supplements the guidance in AC 25 - 8.

8.3.3 Wire S eparation.

Wiring designs used on transport category airplanes vary significantly between manufacturers and models ; therefore, it is not possible to defin e a specific , universal , separation distance , or the characteristics of physical barriers between wire bundles , to protect critical wiring from damage . Separation requirements for wiring and other components of EWIS are contained in § 25.1707, System separ ation: EWIS . ( Th e regulatory defin i tion of EWIS is provided in § 25.1701 , Definition . ) AC 25.1701 - 1, Certification of Electrical Wiring Interconne c tion Systems on Transport Category Airplanes , paragraph 5d, contains guidance on determining adequate separat ion distance between EWIS and between EWIS and airplane systems and structures . Even if § 25.1707 is not in the type certification basis of the airplane being modified , the guidance contained in AC 25.1701 - 1 should still be applied, along with the guidance contained in this AC, when determining adequate separation distance . Intrinsically safe wiring for fuel tanks needs to be protected from induced currents caused by power system switching transients, or electromagnetic interference due to close proximity t o other airplane wiring. In addition, damage to wire insulation can result in unwanted electrical energy being transmitted into the fuel tank, if the damaged wire can come into contact with the conductor of another wire that is not intrinsically safe. Of p articular concern is the possibility of a wire bundle fire that exposes and breaks wires that are not intrinsically safe and also damages the insulation of intrinsically safe wiring that is in close physical proximity. The broken wires may still be energiz ed and could contact conductors of the damaged intrinsically safe wire. If physical separation is used to protect intrinsically safe fuel system wiring from other wiring , or to protect fuel tank walls from high power wiring, the applicant must establish th e minimum physical separation. The applicant should conduct an analysis to verify that current and energies greater than those specified in paragraphs 7.2 and 7.3 of this AC will not be applied to intrinsically safe wiring, considering the factors listed below . The following factors are based on the guidance contained in paragraphs 5d(3) and (4) of AC 25.1701 - 1 : 09/24/18 AC 25.981 - 1D 8.3.3.1 The electrical characteristics, power, and criticality of the signals in the wire bundle and adjacent wire bundles ; 8.3.3.2 Installation design features including the number, type, fire resistance , and location of support devices along the wire path of the intrinsically safe wire and adjacent higher power wires ; 8.3.3.3 The max imum amount of slack wire resulting from wire bundle build tolerances and other wire bundle manufacturing variations ; 8.3.3.4 Probable variations in the installation of the intrinsically safe fuel system wiring and adjacent wiring, including the position or omissi on of wire support devices and the amount of slack wire that is possible ; 8.3.3.5 Expected operating environment including the amount of deflection or relative movement that can occur and the effect of a failure of a wire support device, or a broken wire, or other methods used to maintain physical separation ; 8.3.3.6 The effects of wire bundle fires ; 8.3.3.7 Maintenance practices , as defined by the airplane manufacturer’s standard wiring practices manual , and the ICA required by § § 25.1529, 25.1729, 26.11(b), and 26.11(c) , as appl icable ; and 8.3.3.8 Localized s eparation .

Note: Some areas of an airplane may have localized areas where maintaining a general physical separation distance is not feasible. This is especially true in smaller transport category airplanes or in areas where wiring spans th e wing - to - body join of larger transport airplanes . In those areas that limit separation distance , additional means of ensuring physical separation and protection of the wiring may be necessary. Testing and/ or analysis used to show that the reduced separati on distance is acceptable should be conservative and consider the worst possible failure condition not shown to be extremely improbable. The applicant should substantiate that the means to achieve the reduced separation provides the necessary level of prot ection for wire - related failures and electromagnetic effects .

8.3.4 Inspection.

Means should be provided to allow for the visual inspection of the wiring, physical barriers , and other physical means of protection . Non - destructive inspection aids may be used wher e it is impracticable to provide for direct visual inspection , if it is shown that the inspection is effective and the inspection procedures are specified in the maintenance manual required by § § 25.1529, 25.1729, 26.11(b), and 26.11(c).

09/24/18 AC 25.981 - 1D 8.3.5 Identification.

Me ans must also be provided so EWIS wires are readily identified and visible to maintenance, repair, or alteration personnel . The method of identification must remain legible throughout the airplane’s operational life . The complete regulatory requirements fo r EWIS identification are contained in § 25.1711 , Component identification: EWIS .

8.3.6 Circuit B reakers.

Service experience has indicated that thermal mechanical circuit breakers installed in fuel pump circuits have not been shown , on some airplane designs, to preclude arcing of electrical wiring through metallic barriers into the fuel tank, barriers such as conduit, fuel pump housings, electrical connectors, or the tank wall . Evidence suggests that arcing from the wiring to metallic surfaces may not result in a hard short, which would trip the circuit breaker and may result in intermittent low level arcing that gradually arcs through the metallic barrier into the fuel tank. For these failure conditions , circuit protective devices such as an AFCB or GFI may be us ed to provide fail - safe features necessary to show compliance. Appendix A of this AC provides guidance for certification of an AFCB or GFI .

8.3.7 Use of N onmetallic C onduit.

If nonmetallic conduit is used, its compati bility with fuel should be shown . The nonmetallic conduit should be evaluated for the effects of aging due to heat, corrosion at the connecting fittings, electrostatic charge buildup, and resistance to heat damage from internal shorts of wires routed withi n the conduit.

8.3.8 Wire S plices.

Splices in fuel system wiring have been allowed as a standard repair procedure . The acceptability of splices will be based upon the system design and fail - safe features . The safety assessment may show that splices in fuel tank system wiring, such as fuel quantity indicating wiring within the fuel tank and fuel pump windings, are prohibited .

This would be defined as a CDCCL .

8.3.9 Use of S ilver in F uel T anks.

Silver can combine with sulfur or water and form silver - sulfide or oxide depo sits between exposed conductors (terminal block connections, etc.) . The silver - sulfide deposits reduce the resistance between conductors and can ignite fuel vapor when exposed to very low levels of electrical energy . If use of silver in electrical componen ts and wiring in the tank is determined to be critical, it should be defined as a CDCCL .

The energy levels that have been shown to ignite fuel vapor during laboratory tests approach the levels normally used on FQIS wires and probes. This issue must be car efully addressed.

FAA Report No. DOT/FAA/AR - 03/61 , Silver - Sulfur Deposits on Fuel Quantity Indication System and Attendant Wiring .

09/24/18 AC 25.981 - 1D 8.3.10 Use of S teel W ool.

Steel wool has been used as a cleaning tool to remove corrosion and clean parts inside the fuel tanks . Steel wool creates small conductive filaments that can cause ignition sources in the fuel tank if the steel wool com es in contact between conductors in fuel tank quantity gauging system components . For this reason , design approval holders (DAHs) typically do not allow the use of steel wool inside fuel tanks and recommend using other abrasives. (However, as stated in par agraph 9.3.4.1 in this AC , the applicant should assume the presence of conductive debris , such as steel wool , when performing the fuel tank ignition prevention analysis.)

9 SAFETY ANALYSIS .

9.1 Ignition Source Failure Analysis.

Compliance with § 25.981 requires each applicant to develop a failure analysis for the fuel tank installation to substantiate that ignition sources will not be present in the fuel tanks . The requirements of § 25.981 are in addition to the more g eneral propulsion failure analyses requirements of § § 25.901 and 25.1309 that have been applied to propulsion installations.

9.1.1 Section 25.981(a)(3) defines three failure scenarios that must be addressed in order to show compliance with the rule: 9.1.1.1 Each single failure, regardless of the probability of occurrence of the failure, must not cause an ignition source.

9.1.1.2 Each single failure, regardless of the probability of occurrence, in combination with any latent failure condition not shown to be at least extremely re mote (i.e., not shown to be extremely remote or extremely improbable), must not cause an ignition source.

9.1.1.3 All combinations of failures not shown to be extremely improbable must not cause an ignition source. That is, each combination of failures that can cr eate an ignition source must be separately shown to be extremely improbable.

9.1.2 Compliance with § 25.981 , at a mendment 25 - 102 , requires analysis of the airplane fuel tank system using analytical methods and documentation currently used by the aviation industr y in showing compliance with §§ 25.901 and 25 . 1309 with consideration of unique requirements included in the amendment.

9.1.3 SAE ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment , describes meth ods for completing an SSA .

An assessment may range from a simple report , which offers descriptive details associated with a failure condition, interprets test results, compares two similar systems, or offers other qualitative information, to a detailed fai lure analysis that may include 09/24/18 AC 25.981 - 1D estimated numerical probabilities . The depth and scope of an acceptable SSA depend on the following : 9.1.3.1 The complexity and criticality of the functions performed by the system under consideration , 9.1.3.2 T he severity of related failure conditions , 9.1.3.3 The uniqueness of the design and extent of relevant service experience , 9.1.3.4 The number and complexity of the identified causal failure scenarios , and 9.1.3.5 The detectability of contributing failures.

Note: Sections 25.981 and 25.901 are intended to address sy stem failures or conditions that may result in the presence of an ignition source in the fuel tanks . These regulations are not intended to address failures or conditions that could lead to ignition of fuel vapors , which are addressed by other regulations , such as:  U ncontained engine debris ,  E xternal engine fires following engine separation ,  D amage resulting from explosive materials such as bombs ,  P ost - crash fire heating of tank surfaces ,  P ropagation of fire through the airplane vent system into the fuel tan ks , or  A fire originating within the engine that burns through the engine case .

9.2 Qualitative Safety Assessment.

9.2.1 Typical airplane fuel tank systems have a limited number of possible ignition sources .

Figure 1 below shows some causes of ignition sources and m ethods that may be used to meet the fail - safe requirements . The level of analysis required to show that ignition sources will not develop will depend on the specific design features of the fuel tank system being evaluated . Detailed quantitative analysis sh ould not be necessary if a qualitative safety assessment shows that features incorporated into the fuel tank system design protect against the development of ignition sources within the fuel tank system .

For example, if intrinsically safe FQIS wiring enter ing the fuel tanks and the associated line replacement unit ( LRU ) were shown to have protective features such as separation (including circuit separation in the LRU) and shielding and/or transient suppression/energy limiting devices, the portion of the com pliance demonstration for the associated wiring would likely be limited to showing the effectiveness of the features and defining any long - term maintenance requirements , including mandatory replacement time, inspection interval, related inspection procedur e , or CDCCL so that the protective features are not degraded.

09/24/18 AC 25.981 - 1D Figure 1 . Examples of Fuel Tank Ignition Source Considerations 9.2.2 Another example would be installation of a flame arrestor in the inlet line to a fuel pump . The complian ce demonstration for the fuel pump may be limited to showing that the arrestor was effective at precluding propagation of the flame from the pump back down the inlet line into the tank , and showing that any anticipated failures or events could not violate the explosion - proof features of the pump assembly . A CDCCL may be necessary to maintain the flame arrest o r design feature . If the flame arrestor cannot be shown to be effective for the life of the installation , an airworthiness limitation limiting the life of the flame arrestor would be necessary. In addition, revalidation of the fuel system with other regulations (e.g., icing and reduced flow due to contamination) would be required if modifications were incorporated into the fuel feed system . The SSA crite ria, process, analysis methods, validation, and documentation should be consistent with the guidance material provided in SAE ARP4761, using the unique guidance specific to the fuel tank system as defined in this AC.

9.3 Assumptions and Considerations for Fuel Tank System Analysis.

The applicant should conduct the fuel tank system analysis based on the following assumptions: 9.3.1 Fuel Tank Flammability.

The analysis should assume that the environment inside the fuel tank is always flammable . The conditions required to ignite fuel vapors from ignition sources vary with pressures and temperatures within the fuel tank and can be affected by sloshing or 09/24/18 AC 25.981 - 1D spraying of fuel in the tank . Due to the difficulty in predicting fuel tank flammability, the FAA has always assumed th at a flammable fuel / air mixture exists in airplane fuel tanks and has required that no ignition sources be present . The SSA should be prepared considering all in - flight, ground, service, and maintenance conditions for the airplane , assuming that an explosi ve fuel / air mixture is present in the vapor space of fuel tanks and vent systems at all times , unless the fuel tank has features that mitigate the effects of tank ignition (e.g., polyurethane foam).

9.3.2 Failure Condition Classification.

Unless design features are incorporated that mitigate the hazards resulting from a fuel tank ignition event (e.g., polyurethane foam, adequate structural margin), the SSA should assume that the presence of an ignition source is a catastrophic failure condition.

9.3.3 Latent Failures.

9.3.3.1 In order to eliminate any ambiguity as to the restrictions on latent failures, § 25.981(a)(3) explicitly requires that any anticipated latent failure condition not leave the airplane one failure away from a catastrophic fuel tank ignition . In addition to this limitation on latency, § 25.1309(c) limits latent failure conditions to those that do not create an “unsaf e system operating condition.” Consequently, if a latent failure condition is not extremely remote (i.e., it is anticipated to occur) and it crea tes an “unsafe system operating condition,” then “warning information must be provided to alert the crew…and to enable them to take a ppropriate corrective action.” Notwithstanding t hese applicable regulatory restrictions on latency, there are practical lim itations on the available means of compliance . For example, detecting a failure condition requires a finite period of time , and there are not always “appropriate corrective actions” that can be taken during the flight . Consequently, for the purpose of comp l ying with § 25.981(a)(3), the period of latency for any anticipated significant latent failure condition should be minimized and not allowed to exceed one flight cycle . For the purpose of complying with § 25.1309(c), any time the airplane is operating one failure away from a catastrophic fuel tank ignition should be considered an “unsafe system operating condition,” recognizing that sometimes the only “appropriate corrective action when problem detection is available is to continue on to your destination b ut not to initiate another flight without making appropriate repairs.” 9.3.3.2 Another practical limitation on the available means of compliance is the technological feasibility of providing inherent failure detection within the design for all significant failures . Sometimes periodic inspection is the The preamble to amendment 25 - 102 states “ The FAA intends that those failure conditions identified earlier in this doc ument, and any other foreseeable failures, should be assumed when performing the safety review needed to substantiate that the fuel tank system design is fail - safe. The safety review should be prepared considering all airplane inflight, ground, service, an d maintenance conditions, assuming that an explosive fuel air mixture is present in the fuel tanks at all times, unless the fuel tank has been purged of fuel vapor for maintenance .” ( 66 FR 23094 ) 09/24/18 AC 25.981 - 1D only practicable means of reliably detecting a failure condition .

Consequently, when such inspections are identified within the analysis as the means of detection, the inspection method and frequency must be sufficien t to conclude that the occurrence of the significant latent failure condition is extremely remote.

9.3.3.3 Any mandatory replacement time, inspection interval, related inspection procedure, and all CDCCL s identified as required to prevent development of ignition s ources within the fuel tank system for § 25.981(a ) must be identified in the A irworthiness L imitations section of the ICA as a fuel system Airworthiness L imitation . The A irworthiness L imitations section should include the following: 9.3.3.3.1 A designation of the ma intenance actions and alterations that must be inspected (critical inspections), including at least those that could result in a failure, malfunction, or defect endangering the safe operation of the aircraft, if not performed properly or if improper parts or materials are used.

Note: A validation inspection should be conducted to reaffirm all or a portion of the initial inspection requirements for those critical inspections that, if not performed properly or if improper parts or material are used, could result in a failure, malfunction, or defect endangering the safe operation of the airplane . For those air carriers that use a mechanic for the initial inspection, an inspector should be used to conduct the validation inspection . For those air carriers that use an i nspector for the initial inspection, another qualified inspector should be used to conduct the validation inspection.

9.3.3.3.2 Procedures, standards, and limits necessary for critical inspections and acceptance or rejection of the items required to be inspected, an d for periodic inspection and calibration of precision tools, measuring devices, and test equipment.

9.3.4 Failure Conditions.

When showing compliance with § 25.981(a)(3), the analysis must consider the effects of manufacturing variability, aging, wear, corrosio n, and likely damage. For the purpose of compliance with § 25.981, “extremely remote” failure conditions are those not anticipated to occur to each airplane during its total life, but which may occur a few times when considering the total operational life of all airplanes of one type . This definition is consistent with that developed by the Aviation Rulemaking Advisory Committee (ARAC) for a revision to AC 25.1309 - 1A , System Design and Analysis .

“Extremely improbable” failure conditions are those so unlikel y that they are not anticipated to occur during the entire operational life of all airplanes of one type . This definition is consistent with the definition provided in AC 25.1309 - 1A . Likely damage is damage that , using engineering judgment or past experien ce , would lead one to conclude that an occurrence is foreseeable . Examples of likely damage are a wire 09/24/18 AC 25.981 - 1D bundle located where a mechanic could use it as a handhold; an instrument located where , if someone dropped a wrench, damage would result; or a fuel prob e located where a mechanic could use it as a step in the tank ; etc.

9.3.4.1 The analysis should be conducted considering the deficiencies and anomalies listed in paragraph 6.3 of this AC, failure modes identified by the review of servi ce information (including review of supplier service data), and any other failure modes identified by the functional hazard assessment of the fuel tank system . For example, the applicant should assume the presence of conductive debris such as lockwire, ste el wool, nuts, bolts, rivets , etc . Section 25.981 requires that the effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered when showing compliance , which is needed to show compliance with § 25.901(c) . Credit for fail - safe features must be substantiated .

9.3.4.2 The level of manufacturing variability, aging, wear, corrosion, and likely damage that must be considered should be determined based upon evaluation of the detectability of degraded or out - of - specification configu rations, and established and documented within the analysis .

In - service and production functional tests, component acceptance tests, and maintenance checks may be used to substantiate the degree to which these states must be considered . For example, inspec tion of fuel tank system bonding on production airplanes has shown that some bonds were inadequate . Functional testing of all bonding was incorporated to address this deficiency . In some cases (e.g., component bonding or ground paths), a degraded state wil l not be detectable without periodic functional test of the feature . For these features, inspection/test intervals should be established based on previous service experience o f equipment installed in the same environment . If previous experience on similar or identical components is not available, conservative initial inspection/test intervals should be established until design maturity can be assured.

9.3.5 External Environment.

The severity of the external environmental conditions that should be considered when showing compliance with § 25.981 are those established by certification regulations .

9.3.6 External Sources of Tank Autoignition.

The possibility of fuel tank ignition due to surface - ignition sources created by external tank heating should be considered. This in cludes heating of the tank due to operation or failure of systems outside the tank within both the pressurized and unpressurized areas of the airplane, such as overloaded electric motors or transformers, failures in the See Docket No. FAA - 1999 - 6411 ( 66 FR 23097 , May 7, 2001), T ransport Airplane Fuel Tank System Design Review, Flammability Reduction, and Maintenance and Inspection Requirements , amendment 25 - 102, https://www.gpo.gov/fdsys/pkg/FR - 2001 - 05 - 07 /pdf/01 - 10129.pdf .

09/24/18 AC 25.981 - 1D pneumatic system , and/or ducting tha t could cause localized heating of tank su rfaces. In addition, the possibility of localized heating due to external fires should be considered.

9.3.6.1 Section 25.967(e) requires that, “Each fuel tank must be isolated from personnel compartments by a fumeproof and fuelproof enclosure.” 9.3.6.1.1 Leakage of fuel or vapor into spaces adjacent to the fuel tank, where a secondary fuel proof and fume proof barrier is not provided, has typically been assumed for areas such as:  T he wing leading (including any adjacent compartment suc h as the strut) and trailing edges,  F airings located below the fuel tanks,  F uel pump enclosures, and  U npressurized areas of the fuselage surrounding fuel tanks located in the empennage.

9.3.6.1.2 Components located in these areas have been required to meet explosion - proof requirements . These components or systems should be included in the analysis . Examples of equipment include, but are not limited to, e nvironmental c ontrol s ystem (ECS) air conditioning packs, motors, power assisted valves, fuel pumps, hydraulic pump s/motors, certain flight control actuators, ECS controls, and wiring and valves.

9.3.6.2 A safety review of flammable fluid leakage zones adjacent to fuel tanks should be conducted to determine that the design complies with the requirements of §§ 25.863(a) and 25. 981. In general, the fire protection philosophy for any area considered a flammable fluid leakage zone is to assume that flammable vapors may be present in the zone and to minimize the probability of ignition of vapors ( § 25.863(a)) . This has typically bee n accomplished by using combinations of the following design considerations:  G rounding and bonding of electrical equipment,  Q ualification of electrical equipment as explosion proof,  S ealing of electrical connectors,  P roper support, protection , and separati on of wiring,  D rainage provisions in the leakage zone,  V entilation of the leakage zone in flight and of areas around the auxiliary tanks, and  I mmediate maintenance action to correct leaks in these areas.

09/24/18 AC 25.981 - 1D 9.3.6.3 Surface T emperatures in A reas A djacent to F uel T anks .

T he FAA has approved installations where surfaces adjacent to the tank experience temperatures in excess of the internal fuel tank surface temperature limit. Manufacturers have substantiated that the conditions (ambient pressure, dwell time, fuel type, e tc.) within these areas are such that a higher value may be used. For example, applicant s have successfully substantiated , for certain pneumatic system installations, a maximum allowable surface temperature of 400 °F with a transient excursion up to 500 °F for a maximum duration of two minutes. The excursion above 400 °F occurs only during failure conditions such as failure of the engine pneumatic system to regulate temperature, or duct rupture. Approval of these elevated temperatures has been based on spec ific design features, such as an over - temperature shutoff of the pneumatic system so that the surface temperatures adjacent to the tank cannot exceed the surface ignition temperature justified for the fluid type including the effect of local airflow and ve ntilation conditions within the zone . Internal tank surface temperatures resulting from the failure should not exceed the surface temperature limit for the fuel type used as described in paragraph 7.5 of this AC .

9.3.7 Electrical Ignition Sources.

The applicant should perform a failure analysis of all fuel systems and subsystems with wiring routed into fuel tanks . Systems that should be considered include fuel pump power and control and indication, fuel quantity indica tion, fuel temperature indication, fuel level sensors, and any other wiring routed into or adjacent to fuel tanks . The analysis should consider system level failures, failures within LRUs , and component level failures discussed below . The analysis should i nclude existence of latent failures and subsequent failures that may lead to an ignition source within the fuel tank.

Examples include undetected failures of tank components or wiring, the undetected presence of conductive debris, damage to FQIS or level s ensor probes, or corrosion, in combination with external failures such as hot shorts or electromagnetic effects . In addition, the applicant should provide a description of the protective means employed in the fuel system wiring . This should include a descr iption of features such as separation/segregation, transient suppression devices, shielding of wiring, and methods employed to maintain configuration control of critical wiring throughout the life of the airplane.

9.3.8 Electrical Short - Circuits.

9.3.8.1 One method that may provide protection of circuits that enter fuel tanks is the incorporation of a transient suppression device (TSD) on the circuit close to the point where those wires enter fuel tanks . Consideration should also be given to protection of wiring between the TSDs and the tank if the protection devices are not located at the tank entrance, and also to the possibility of transients being induced in the wiring between the TSDs and the electrical devices in the fuel tanks . Caution should be exercised when 09/24/18 AC 25.981 - 1D usin g a TSD to en sure that the TSD addresses both voltage and current suppression in order to limit the energy and current below the limits provided in section 7.2 of this AC .

9.3.8.2 Another method of protection that has been used to prov ide a fail - safe design with respect to electrical shorts is separation of wiring to electrical devices in the fuel tanks from other electrical power wires and circuits, combined with shielding between wiring that enters fuel tanks and any other electrical power - carrying wires in the aircraft installation. The effects of electrical short circuits, including hot shorts, on equipment and wiring that enters the fuel tanks should be considered, particularly for the FQIS wiring, fuel level sensors, and probes . La tent failures from factors such as contamination, damage/pinching of wires during installation, or corrosion on the probes, connectors, or wiring should be considered when evaluating the effects of short circuits . The wire routing, shielding, and segregati on outside the fuel tanks, including within the FQIS components (e.g., gauging units), should also be considered when evaluating the effects of short circuits. The evaluation should consider both electrical arcing and localized heating that may result from short circuits on equipment, FQIS probes, and wiring . The evaluation of electrical short circuits should include consideration of shorts within electrical equipment, and wiring from the equipment into the fuel tank . Prevention of fuel ignition from electr ical shorts to wiring that enters fuel tanks may require specific wire and circuit separation and wire bundle shielding.

9.3.9 LRU Design Evaluation.

The design review should include evaluation of the separation and protective features incorporated into any fuel system LRU whose failure could result in high - level electrical power ( i.e., above intrinsically safe levels) entering the fuel tank . For example, circuit board failures could cause the LRU power supply circuits for the fuel quantity gauging system to come into contact with circuits that lead into the fuel tank, resulting in a possible ignition source . Failures that can lead to violating separation within the LRU can be external and internal events. External failures include over voltage or over current, hi gh humidity, temperature, vibration, shock, and contamination. Internal failures include manufacturing defects or flaws in the conductor, substrate , or coating . To address these failures , the design should either provide isolation and physical separation b etween critical circuits , such as circuits that enter a fuel tank , or adequate protective features, such as transient suppression devices as discussed earlier, to protect the circuits that enter the fuel tank. Any LRU that meets the design requirements ide ntified in Und erwriters Laboratories Inc., UL 913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations , is considered acceptable, provided the following issues are addressed. Ideal ly, higher power circuits within the LRU should not be located on the same circuit board or in a wire harness or electrical connector with intrinsically safe circuits or wiring . There should be a physical barrier between circuit boards to isolate the intri nsically safe circuits from the effects of broken components or 09/24/18 AC 25.981 - 1D fire within the LRU . If limiting devices are installed on the same circuit board in series with system circuitry to limit the amount of power or current transmitted to the fuel tank, there sho uld be three inches between the traces, unless the manufacturer can justify a smaller separation on the basis that the effects of fire on the circuit board will not compromise the intrinsically safe circuit(s).

9.3.10 Electromagnetic Effects including HIRF .

See A C 25.954 - 1 for guidance in establishing compliance with the requirements for fuel system protection from lightning effects.

9.3.10.1 The evaluation should consider e lectromagnetic effects due to HIRF, electrical transients , and RF emissions on fuel system conductor s (e.g., fuel tank plumbing, structure, fuel, equipment and wiring) within the fuel tanks, particularly for the FQIS wiring and probes . The applicant should also consider l atent failures from factors such as contamination, damage, or corrosion on the probe s or wiring when evaluating the effects of electrical transients . The wire routing, shielding, and segregation of conductors (e.g., plumbing, component casings, wiring, etc.) outside the fuel tanks should also be considered when evaluating the effects of e lectrical transients because the transient generation and coupling to conductors may occur outside the fuel tanks . The evaluation should consider both electrical sparks and arcs , and localized heating , that may result from electromagnetic effects on the fu el tank system, FQIS probes, and wiring.

9.3.10.2 The evaluation should consider l atent failure of electromagnetic protection features, such as shielding termination corrosion, shield damage, and transient limiting device failure , and the applicant should establish appropriate indication or inspection intervals to prevent the existence of latent failure conditions . The failure of other system components may also affect protection against electromagnetic effects . Consequently, the evaluation should consider the effec t of any anticipated failure on the continued environmental protection.

9.3.10.3 The evaluation of electromagnetic effects should be based on the specific electromagnetic environment of a particular air plane model. Standardized tests, such as those in RTCA DO - 160 G , s ections 19 and 20 , are not sufficient alone to show that the appropriate standardized test categories, procedures , and test levels of RTCA DO - 160 G are selected , without an evaluation of the characteristics of the specific electromagnetic environment and induced transient levels assigned to systems installed within a particular airplane model . Simulation of various latent failures of fuel system components within the tanks may be needed to show the effectiveness of the transient protection . Effectiveness o f the se features should be verified using the appropriate test procedures and test levels of RTCA DO - 160G, determined above.

09/24/18 AC 25.981 - 1D 9.3.10.4 Prevention of fuel ignition due to electromagnetic effects may require specific wire segregation and separation, wire bundle shield ing, or transient suppression for wires entering fuel tanks . Effectiveness of the transient protection features should be verified using the appropriate test procedures and test levels of RTCA DO - 160 G, determined above.

9.3.10.5 Redundancy of B ond P aths.

Failure of bonding jumpers is generally considered a latent failure, since there is no annunciation or indication of the bonding failure. The airplane fleet fuel tank inspections that occurred as a result of the TWA 800 investigation showed that failure of bonding jumpers, due to damage, wear, or manufacturing errors, was not unusual . Based on this, it would be difficult to show that failure of a single bonding jumper is extremely remote or extremely improbable . Therefore, the electrical bonding jumper or other bond ing provisions would need to consider the consequences of these latent failures . This may result in designs that incorporate electrical bonding redundancy, if the failure of a single electrical bonding feature could create a fuel tank ignition source . Addi tionally, manufacturers would need to consider the use of appropriate maintenance to detect failed bonding jumpers . An example of such maintenance might include periodic inspections to limit latency.

9.3.10.6 Self - B onding C ouplers .

Early generation , self - bonding , f lexible fuel couplers did not have multiple bonding paths. Thus , these bonding couplers exhibited single - point failures that caused loss of function . These self - bonding flex ible couplers have failed because of missing bonding springs, anodizing on bonding surfaces, and incorrect installation . The safety assessment of newer designs incorporating multiple bonding paths must consider these failure modes , and qualification testing should show no ignition sources are present in the full - up (non - degraded conditio n) and possible degraded condition with failure modes present within the couplings . For example, failure assessments of clamshell - type , self - bonding metallic couplings in composite fuel tanks have shown arcing could occur if a coupling was improperly latch ed, or became unlatched and fell to the bottom of the fuel tank . The design of the coupling would need to address these failure modes . Improper latching could be addressed through positive latching features with tactile and visual indication that the coupl ing is properly latched . Redundant fail - safe features , such as redundant hinge and latching features, redundant bonding features, etc., may be needed to address other possible failure modes.

National Transportation Safety Board Aircraft Accident Report NTSB/AAR - 00/03, “In - flight Breakup Over the Atlantic Ocean Trans World Airlines Flight 800, Boeing 747 - 131, N93119, Near East Moriches, New York,” dated July 17, 1996.

09/24/18 AC 25.981 - 1D 9.3.10.7 Resistance or I mpedance L imits of A irplane E lectrical B onding P ro visions.

9.3.10.7.1 There is no specific FAA guidance on maximum resistance or impedance of airplane electrical bonding provisions because e lectrical bonding within a fuel system should be tailored to the performance requirements of a particular airplane design . The electrical bonding should consider the electrical sources, electrical faults , and electrostatic charges . The electrical bonding should also consider the fuel system design of the specific airplane , which would include the structure material used (aluminum, carbon fiber composites, fiberglass composites, etc.), the configuration of the fuel system (routing of fuel tubes, wires, and hydraulic tubes), and the electrical bonding concept (intentional isolation, self - bonding fittings, separate bonding jumpers, et c.) . Given the large variation in design approaches and the close relationship between the design approach and the electrical bonding requirements, it is not practical for the FAA to provide specific guidance on maximum bonding resistance or impedance.

9.3.10.7.2 Som e type certificate ( TC ) holders have performed tests on their airplanes to determine the specific requirements for electrical bonding. Others, in the absence of specific airplane test data, have chosen conservative electrical bonding approaches . The approa ch is a decision each TC holder should make based on the specific situation for that TC holder ’ s airplane models.

9.3.10.8 Bonding I ntegrity C hecks .

Past experience has shown measurement of bond resistance is the desired method of en suring bond path integrity . Duri ng bonding resistance measurements, the protective finish of components might be damaged in order to penetrate the insulating anodized surface layer, which may lead to subsequent corrosion damage . This concern has resulted in some TC holders defining non - i ntrusive inspections for electrical bonding . These inspections may include detailed visual inspections provided the quality of the electrical bonding feature can be adequately assessed by visual cues, such as visible corrosion, breakage, tightness , or miss ing bonding provisions . For critical bonds , this method would not by itself be adequate .

Other inspection methods include inductively - coupled loop resistance measurements that eliminate the need to disconnect bonding jumpers , or penetrate corrosion - prevent ion coatings . The need for bonding inspections, frequency of the inspections, and determination as to whether t he inspections must be an airworthiness limitation should be established under the fuel tank SS A .

9.3.10.9 Bond Corrosion and Integrity.

9.3.10.9.1 Degradation of el ectrical bonding provisions, such as bonding jumpers, has occurred on in - service airplanes . Results from airplane fuel tank 09/24/18 AC 25.981 - 1D inspections conducted on a sample of airplanes by manufacturers and operators showed discoloration, corrosion, and damage to bonding jumpers. It is not clear if the discoloration indicates corrosion that will become more severe with time, or if it is simply a surface color change .

The applicant should define the bonding feature characteristics — such as visible corrosion, discoloration, jumper strand separation, and jumper strand breakage — that will be used to distinguish discrepant bonding provisions.

9.3.10.9.2 The level of corrosion observed on bonding features, specifically on bonding jumpers, varie s greatly across airplane fleets . While some air planes within a fleet and certain locations within the fuel tanks showed no evidence of corrosion, other airplanes and locations exhibited higher levels of corrosion . Inspection results reported to the FAA indicate materials used in certain bonding jumpers (tin - plated copper) may be more prone to corrosion . Nickel - plated copper wire does not experience similar corrosion . Corrosion programs for airplane structure have long recognized the variability of corrosion within the fleet . Factors that influence the l evel of corrosion of bonding jumpers include fuel type (sulfur content, etc.), presence of water in the fuel tank, installation effects such as cracking of the tin plating when the jumper is installed, temperature, humidity, and chemicals used for preparat ion of the fuel tanks prior to airplane storage, etc . While certain levels of corrosion or discoloration may be acceptable between inspection intervals, compliance should include substantiation that the materials used in the bonding jumpers are appropriate for use in the fuel tanks in consideration of the proposed inspection intervals . This substantiation should consider the variability in corrosive environments and factors noted above that may exist on in - service and stored airplanes in the fleet.

9.3.10.10 Section 25.981 states : “(a) No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapors.” F uel tube flexible coupling s and components as small as nuts, bolts , and was hers may develop sufficient charge to cause arcing due to electrostatic conditions if not properly accounted for in the design . Electrical bonding would need to be considered if these couplings are identified as ignition sources during the ignition source evaluation and assessment.

9.3.11 Friction Sparks.

The failure modes and effects analysis (FMEA) should include evaluation of the effects of debris entering the fuel pumps, including any debris that could be generated internally, such as any components upstream o f the pump inlet . Industry practices for fuel tank cleanliness , and design features intended to preclude debris entering the fuel pumps , have not been effective at eliminating debris . Service experience has shown that pump inlet check valves, inducers, nut s, bolts, rivets, fasteners, sealant, lockwire, and so forth have been drawn into fuel pumps and contacted the impeller. This condition could 09/24/18 AC 25.981 - 1D result in creation of friction sparks , and it should be an assumed failure condition when conducting the SSA . Fail - safe features should be incorporated into the fuel pump design to address this condition . Examples of means that may be incorporated into the fuel pump design to address this concern include:  I nstallation of inlet flame arrestors,  U se of reticulated foam,  U se/installation of ejector fuel pumps without impellers to scavenge fuel, or  M aintaining fuel over the pump inlet throughout the airplane flight attitude envelope.

10 COMPONENT FAILURE MODE CONSIDERATIONS.

10.1 Component Qualification Review.

Qualification of co mponents, such as fuel pumps, has not always accounted for unforeseen failures, wear, or inappropriate overhaul or maintenance. Failure to account for these failure modes and testing the pump , using the procedures defined in Military Standard MIL - STD - 810E, Method 511.3 , Explosive Atmosphere , has led to some fuel pumps entering airline service having never been tested to demonstrate explosion - proof capabilities . This combined experience suggests that more needs to be done to establish the capabilities of fue l pumps and other fuel system components to operate safely in an explosive environment. Such capability should be substantiated considering these factors in addition to the conditions noted in paragraph 7.3 of t his AC . The amount of qualification review can be significantly reduced if the fail - safe features noted earlier in this AC are followed (e.g., not operating pumps in vapor spaces of the tank, incorporating arc fault or ground fault protection on the electr ical circuit, etc.) .

Therefore, an extensive evaluation of the qualification of components may be required if a qualitative assessment of the component and installation features do es not eliminate the component as a potential ignition source.

10.2 Maximum Compo nent Temperature for Qualification of Fuel System Components.

Maximum component temperatures may be determined experimentally . Tests should be conducted long enough for the component to reach the maximum temperature . All foreseeable failures and malfunctio ns of the fuel tank components (including those failures and malfunctions that could be undetected by the flightcrew and maintenance personnel) should be considered when determining maximum temperatures.

10.2.1 C omponents mounted adjacent to the exterior surface of the fuel tank can create a high localized temperature at the inner surface of the tank . This can be investigated by laboratory tests that duplicate the installation, or by a validated heat transfer analysis using the maximum potential temperature of the component.

10.2.2 When airplane equipment or system components such as engine bleed air ducting or ECS are located near fuel tanks, a n FMEA should be done to determine failures of 09/24/18 AC 25.981 - 1D adjacent systems or components that could cause elevated surface temperatures . The maximum internal tank temperatures that can occur during normal and failure conditions should be determined. Systems, such as over - temperature protective devices, should be evaluated to determine if periodic health checks are necessary to en sure that late nt failures do not exist.

10.3 Possible Failure Modes for Determination of Maximum Component Temperatures.

The following list identifies some possible failure modes, but not all conditions , that should be explored in determining the maximum temperature expected for fuel tank components: 10.3.1 Fuel Pumps.

10.3.1.1 Normal fuel pump operation considering the highest hot day ambient and fuel tank temperatures : In many cases, fuel pump motors are protected by a (single) three - phase thermal circuit breaker. In several instances, res etting of circuit breakers has resulted in arcing inside the fuel tank and the development of an ignition source from an existing failure. Therefore, the fuel pump circuit should also preclude development of an ignition source if the breaker is reset or fo rced in by a mechanic. Methods that may be used to address this foreseeable failure condition include the use of circuit protective features such as non - resettable, fast - acting AFCB or GFI circuit breakers.

10.3.1.2 Two - phase operation of three - phase electrical fue l pumps : Failure of a single phase of a multiple - phase fuel pump will significantly increase the load on the remaining phases of the pump and generation of heat in the pump. In many cases, thermal protection features within the pump have been incorporated to address this failure condition, but these means have not been effective at preventing continued operation of a pump with a failed electrical phase. Another failure condition that should be considered is subsequent failure of a second phase of the pump a nd possible arcing or heat damage. In general, pumps should not be allowed to operate following failure of a single electrical phase of the pump if such operation could result in development of an ignition source. Automatic protective means, such as AFCB o r GFI or other means, should be provided to shut down the pump when a single electrical phase failure occurs. Periodic inspections or maintenance of these features may be required.

10.3.1.3 Dry operation of fuel pumps, including lack of lubrication : Service history has shown that flightcrews and maintenance personnel have inadvertently operated fuel pumps for long periods of time without fuel in the fuel tank .

Fuel pumps are typically qualified for dry run operation for periods of time based upon assumptions made ab out possible duration of inadvertent operation, or failure conditions, which could result in dry running of the pump . For example, some pumps were operated during qualification 09/24/18 AC 25.981 - 1D testing up to a maximum of 8 hours continuously, with total accumulated dry run operation of 24 hours . These qualification tests were accomplished in order to show that fuel pump performance was still adequate following the dry pump operation . The tests were not shown in an explosive environment and , hence , were not intended to quali fy the pumps for such operation . In other cases , previous approvals were predicated on the assumption that the fuel pump would not be dry run operated because the pump would be turned off by the flight/ground crew following a pump low - pressure indication . Extended dry operation of pumps may result in surface temperatures above the autoignition temperature of the fuel , or may expose the pump to dry run operation where debris from the fuel tank could enter the impeller and cause sparks . Manufacturers ’ recomme nded procedures have not been shown to be adequate in preventing dry run operation . Therefore, additional fail - safe features are necessary to preclude ignition sources caused by dry run operation of airplane fuel pumps . One or more of the following fail - sa fe means should be considered for protection of fuel pumps: 1. Incorporate design features to keep the fuel pump inlet submerged in jet fuel to prevent dry running of the pump under all operating conditions.

2. Incorporate automatic pump shutoff features into th e fuel pump or airplane to preclude dry run operation.

3. Other means such as installation of flame arrestors in the fuel pump inlet to preclude flame propagation into the fuel tank.

10.3.1.4 Temperatures associated with the fuel pump following wet operation with wet mechanical components both at zero and reduced fluid flow.

10.3.1.5 Temperatures associated with moving mechanisms that are locked or seized.

10.3.1.6 Temperatures generated as a consequence of pump impeller slippage.

10.3.1.7 High temperatures or high current due to a broken shaft. The design has to contain the broken shaft, and the pump and its control system must consider the high currents and temperatures that would follow.

10.3.1.8 Failed b earings : The effects of wear on fuel pump features incorporated into the design to maintain explosi on - proof characteristics should be evaluated . For example, wear of bearings or failures, including spinning of any bushings, and possible effects on quenching orifices should be evaluated . In many cases , fuel pump explosion - proof features are not redundant , and failure or degradation of the features is latent . If single or probable combinations of failures in the fuel pump can cause an ignition source, § 25.981 requires incorporation of fail - safe features noted previously . If wear of the pump can cause degr adation of fail - safe 3 4 09/24/18 AC 25.981 - 1D features, appropriate inspection, overhaul , or life limiting of the pump should be included in the Airworthiness L imitations section of the ICA, per § 25 . 981(d) and section H25.4.

10.3.2 FQIS .

10.3.2.1 FQIS wiring in the tank, with maximum voltage and current applied , considering normal and failure conditions , including the effects of high - voltage systems outside the tank in proximity to the FQIS wires.

10.3.2.2 FQIS component in the normal and failed state with the above associated maximum voltages and fault c urrents applied.

10.3.3 Float Switch System.

Float s witch s ystem temperatures should be determined considering the maximum environment temperatures and the application of the applicable maximum voltage and fault currents.

10.3.4 Fuel System Components.

Temperatures of t he fuel system components should also be evaluated considering the failure of bonding straps.

10.3.5 Pneumatic System.

Pneumatic system temperatures need to be evaluated for the effects of duct rupture impinging on the external tank surface . R adia n t and conduct ed heat transfer associated with the tank and components affecting tank wall temperatures should also be considered (see previous discussion of spaces adjacent to fuel tanks).

10.3.6 Electrical Defects and Arcing.

Electrical d efects that g enerate e xcessive h eat , an d a rcin g at the electrical connections to the pump housing or within the connector.

10.3.7 Submerged H eat E xchangers .

Submerged heat exchange r s and supply tubing o perating under conditions of maximum heat rejection to the fuel. This should include failures in any systems outside the fuel tank that could result in heat exchanger or supply tubing surface temperatures exceeding 400 ° F.

10.3.8 Failed or Aged S eals .

10.3.8.1 Spraying of fuel in the tank from any pressurized fuel source may cause electrostatic charging of components in the fuel tank . In addition, use of sealant in connectors that is not compatible with the fuel may allow leakage into the connector and the possibility of a fire near the connector.

09/24/18 AC 25.981 - 1D 10.3.8.2 Fuel Line Couplings .

Aging of seals may result in hardening of the seal ma terial and leakage and spraying of fuel within the fuel tank; therefore, fuel line coupling designs should be evaluated and a design life should be established for all seals that are shown to age and allow leakage that can cause unacceptable electrostatic charging of components.

10.3.9 Fuel Pump Cooling Flow .

Fuel used for cooling of fuel pumps may be sprayed from the fuel pump . Fuel pump cooling flow should not be sprayed into the fuel tank vapor space for the same reason as stated in 10.3.8 for spraying of fuel . Means should be provided to distribute the discharged cooling fuel into the fuel tank at or near the bottom of the fuel tank.

10.3.10 Explosion - Proof Electrical Connector Sealant and Seals .

Electrical connections to fuel pumps are typ ically located either inside or outside the fuel tank in areas of the airplane where the presence of flammable fuel vapors should be assumed because no secondary sealing of fuel is provided . Fuel leakage and corrosion at electrical connectors located outsi de the fuel tank has allowed the presence of both flammable vapors and electrical arcing at connectors, resulting in fires . In other applications, arcing has occurred at the pump connections inside the fuel tanks, requiring installation of appropriately si zed steel shields to prevent arcing through the connector or pump housing into the fuel tank or areas where flammable vapor could exist.

10.3.11 Arcing at the P ump E lectrical C onnections .

Wear, corrosion, manufacturing variability (e.g. tolerances), connector dist ortion and seal damage from ice, and bent pins in the connector are examples of failures that have caused high resistance or shorting and arcing in arcing electrical connectors. Based upon historical data showing these and other failure modes listed previo usly in this AC have occurred in fuel pump connectors, arcing in the connectors is a foreseeable failure.

Each of these single or cascading failure modes should be included in the FMEA. High current loads present during pump start up and operation exacerba te arcing in the connector. The size and duration of the arcing event should be established based upon the fuel pump electrical circuit protection features. A r cing at the pump electrical connections , and resultant damage to the pump connector, housing, and explosion - proof features due to intermittent, and maximum energy, arcing events should be assumed. If fuel is present on the backside of the connector, failures resulting in fuel leakage in conjunction with arcing in the connector s hould be assumed if the fuel leak is a latent failure or is the result of a cascading failure . The design of traditional fuel pumps has resulted in the need to install AFCB or GFI protection features to address foreseeable failures and limit t he energy release during an arcing e vent to prevent an ignition source from occurring. The pump connector should be shown to contain any resultant arcing or fire and to maintain all surface temperatures below the autoignition temperature of the fuel . Component manufacturer maintenance record s and qualification test results should be reviewed as part of the safety analysis process to establish that any sealant s and 09/24/18 AC 25.981 - 1D materials in the connector are compatible with the operating environment and to determine if a design life or periodic inspections for the pump connector are needed .

11 AIRWORTHINESS LIMITATIONS FOR THE FUEL TANK SYSTE M .

11.1 Based upon the evaluations required by § 25.981(a), a mendment 25 - 102 also added a requirement to § 25.981(b) , that CDCCL s , inspections, or other procedures be establish ed as necessary to prevent development of ignition sources within the fuel tank system, and that they be included in the Airworthiness L imitations section of the ICA required by § 25.1529 . This requirement is similar to that contained in § 25.571 for airpl ane structure. Amendment 25 - 102 also added a new requirement to part 25, appendix H, Instructions for Continued Airworthiness , requir ing that each mandatory replacement time, inspection interval, related inspection procedure, and all CDCCL s approved under § 25.981 for the fuel tank system be included in the section titled “ A irworthiness L imitations ” of the ICA.

11.2 T he preamble of a mendment 25 - 102 (66 FR 2309 7) states: Critical design configuration control limitations include any information necessary to mainta in those design features that have been defined in the original type design as needed to preclude development of ignition sources.

This information is essential to ensure that maintenance, repairs, or alterations do not unintentionally violate the integrit y of the original fuel tank system type design. An example of a critical design configuration control limitation for current designs discussed previously would be maintaining wire separation between FQIS wiring and other high power electrical circuits. The original design approval holder must define a method to ensure that this essential information will be evident to those that may perform and approve repairs and alterations. Visual means to alert the maintenance crew must be placed in areas of the airplan e where inappropriate actions may degrade the integrity of the design configuration. In addition, this information should be communicated by statements in appropriate manuals, such as Wiring Diagram Manuals.

11.2.1 CDCCLs may include any maintenance procedure tha t could result in a failure, malfunction, or defect endangering the safe operation of the airplane, if not performed properly or if improper parts or materials are used . This information is essential to ensure that maintenance, repairs, or alterations do n ot unintentionally violate the integrity of the original type design of the fuel tank system.

11.2.2 CDCCLs are intended to identify only critical features of a design that must be maintained. CDCCL s ha ve no interval s ; they establish configuration limitations to maintain and to protect the “critical design feature” identified in the CDCCL s . CDCCL s can also include requirements to have placards on the airplane with information about critical features. For example, certain components of a fuel pump (or all component s) may include critical features that are identified as CDCCLs. These critical features must be identified in the Airworthiness Limitations section of the ICA and should also be 09/24/18 AC 25.981 - 1D identified in the component maintenance manual (CMM) as CDCCL s to provide awar eness to maintenance and repair facilities .

11.2.3 Certain CDCCLs apply to elements of fuel system components. As such, maintenance of those critical features may be covered in a CMM. When airworthiness limitations need to call out aspects of CMMs, it is a best p ractice to limit the CDCCL - controlled content to only those maintenance tasks directly impacting a CDCCL feature, rather than requiring the complete CMM to be a CDCCL. ( See the CMM deviation definition in appendix C of this AC.)

11.2.4 A ny component that is the subject of a CDCCL is considered a critical part. Therefore, new parts manufacturer approvals issued for fuel tank system components that are the subject of CDCCLs should be treated as “critical parts” in acc ordance with FAA Order 8110.42 D , Parts Manufacturer Approval Procedures .

11.3 Any fuel tank system components that are determined to require periodic maintenance, inspection, or overhaul to maintain the integrity of the system or maintain protective features in corporated to preclude a catastrophic fuel tank ignition event must be defined and included in the A irworthiness L imitations section of the ICA . An inspection airworthiness limitation has a specific task and interval (such as 10 years). The inspection inte rval should be established based on the standard practices defined in AC 25.1309 - 1 A for evaluation of component failures . The inspection could also be required following maintenance to verify a CDCCL feature is maintained. Examples of inspection airworthin ess limitation s include the following : 11.3.1 A ging F uel L ine C ouplings S eals/ O - R ings.

In certain instances, materials used in fuel line couplings may lose flexibility and harden with age . U nder pressurized operation, the seal may allow fuel leak age. This will al low spraying of fuel in the tanks or other areas of the airplane where spraying fuel could create a fire hazard . Repetitive inspections, functional checks, or mandatory replacement intervals may be required to prevent leakage.

Note: While not related to complian ce with § 25.981, hazards associated with the aging of fuel coupling O - rings , resulting in air enter ing fuel lines during suction feed operation , should also be addressed when developing the fuel system maintenance program .

11.3.2 Wear of P ump B ushings, B earings, and S eals .

Wearing of pump bushings, bearings, and seals may significantly affect the performance of fuel pumps and degrad e the features necessary to maintain the explosive - proof qualification . In most cases , these failure conditions are latent ; therefore , incorporation of other fail - safe features, as discussed earlier in this AC, would likely be required . If fail - safe features, such as installation of feeder tanks that are filled using ejector pumps, are incorporated, functioning of those features would n eed to be en sured by indications or periodic functional tests . Installation of fuel level sensors in the feeder tanks would provide continuous monitoring of the function .

Another means could be installation of flow indicators in the flow line of the ejecto r 09/24/18 AC 25.981 - 1D pump that can be viewed by maintenance personnel , and a mandatory periodic inspection of this function is one example of a method of mandatory maintenance action.

11.3.3 Fuel P ump Electrical Power P rotective F eatures.

If failure of an AFCB or GFI protective fea ture and/or a thermal fuse (closed) is latent and this feature is needed to maintain fail - safe features, periodic checks would likely be needed. The inspection interval, and need for built - in test features with indication of failures, should be established through the safety analysis process and should consider factors described in paragraph A.3.4.3 of appendix A.

11.3.4 Transient S uppression/ E nergy L imiting D evices.

If failure of the device is latent and this feature is needed to main tain fail - safe features, periodic checks will likely be needed.

11.3.5 Wire S hield G rounding.

Component grounds and wires will likely require inspections and measurements to determine proper grounding.

11.3.6 Fuel T ank A ccess P anel/ D oor S eals .

Maintenance tasks should a dequately provide procedures for inspection and checks of access panels and door seals.

11.3.7 Corrosion, Wear , and Damage to Fuel Pump Connectors .

Maintenance tasks should provide adequate procedures for inspecting and checking fuel pump connectors for wear, cor rosion, and damage.

11.3.8 Integrity of Fuel Pump Electrical Supply Conduit .

Maintenance tasks should provide adequate procedures for inspecting the integrity of the structure, sealing, drain holes, and bends of the electrical supply conduit to the fuel pump .

11.4 Mai ntainability of Design and Procedures.

Maintainability, both in the design and procedures (i.e., m aster m inimum e quipment l ist, a irplane m aintenance m anu al, etc.), should be verified by the applicant . This should include, as a minimum, verification that th e system and procedures support the safety analysis assumptions and are tolerant to anticipated human errors, and that any critical procedures are highlighted for consideration as required inspection items . (See 14 CFR 121.369(b) for considerations of a “r equired inspection item.”) 11.5 Incorporation by Reference into Airworthiness Limitations .

11.5.1 Whe re the words “in accordance with” or “per” are cited in the airworthiness limitations, the procedures in the referenced document must be followed to ensure that the cr itical design feature is maintained. Any changes to these procedures require 09/24/18 AC 25.981 - 1D approval from the responsible Aircraft Certification Service office before they can be used.

11.5.2 Whe re the words “refer to” are cited in the airworthiness limitation, the procedures i n the referenced document represent one method of complying with the airworthiness limitation. An accepted alternative procedure may be developed by the operator in accordance with its procedures in its maintenance program/manual. Prior approval from the r esponsible Aircraft Certification Service office is not required for this action.

11.5.3 See AC 120 - 97A, Incorporation of Fuel Tank System Instructions for Continued Airworthiness into Operator Maintenance or Inspection Programs , for guidance regarding procedures operators should use when requesting approval of changes to documents referenced in airworthiness limitations and for examples of fuel tank system airworthiness limitations.

11.6 Visible Identification of CDCCLs .

11.6.1 Section 25.981( d ) establishes a requirement for visibly identifying critical features of a design that are located in certain areas . The DAH should define a method of ensuring that this essential information will be communicated with statements in the appropriate manuals, such as w iring d iagram m anuals , and be evident to those who perform and approve such repairs and alterations and are identified as a CDCCL .

11.6.2 An example of a CDCCL that would result in a requirement for visible means would be maintaining wire separation between FQIS wiring and other high - power electrical circuits where separation of the wiring was determined to be a CDCCL . Acceptable methods of providing visible means would include color coding and labeling the wiring .

For retrofit of markings onto existing wiring, placement of identifica tion tabs at specific intervals along the wiring would be acceptable . Standardization within the industry for color coding of wiring used for the fuel tank system would assist maintenance personnel in functional identification of wiring . Some manufacturers use p ink wiring for fuel tank system wiring , and FAA recommends using this color as a standard for fuel tank system wiring.

09/24/18 AC 25.981 - 1D Appendix A Appendix A. Certificatio n of Arc Fault Circuit Breaker (AFCB) or Ground Fault Interrupter (GFI) A.1 P URPOSE.

This appendix provides guidance for c ertification of AFCB or GFI devices that have been shown to be a practical means to protect the circuits of electric - motor fuel pumps and other fuel tank components that use higher than intrinsically safe electrical power (for example, motor operated valve s).

A.2 B ACKGROUND.

A.2.1 S ervice experience has shown that failures in the power supply circuit of the fuel pump, discussed in the body of this AC , can result in ignition sources and , therefore , must be assumed as a foreseeable failure condition. Traditional therma l circuit breakers are sized to prevent nuisance trips during fuel pump transient power demands and have not tripped when intermittent electrical arcs occur. Intermittent arcing can erode metallic barriers such as conduit, electrical connectors, and the pu mp housing, resulting in loss of the integrity of explosion - proof features, or create ignition sources outside in areas adjacent to the fuel tank. Addressing the failure modes discussed in this AC has resulted in the need to provide fast - acting GFI or AFCB s in traditional fuel pump electrical circuits in order to show compliance with § 25.981 .

A.2.2 AFCBs have been used as a practical means to protect against arcing in the power circuits of fuel pump motors powered by both alternating current and direct current .

SAE International issued two a erospace s tandards for AFCBs — o ne for alternating current circuits and one for direct current circuits . (S ee paragraph B.7 of appendix B of this AC ).

A.2.3 Fuel pump housings and metallic conduits are gro unded to the airframe , and any arcing to the cavity wall or c onduit creates a ground fault. Therefore, GFI have been used in AC pump power circuits as a practical means to ensure that power is quickly disconnected from the fuel pump in the event of a groun d fault in the pump or associated power wiring.

A.3 C ERTIFICATION G UIDANCE .

One means for the applicant to show compliance with the applicable regulations is to demonstrate, through design, review, analysis , and test , that the AFCB or GFI performs as intended under any foreseeable operating condition s and addresses the following guidance : A.3.1 Fault Detection Trip Levels.

A.3.1.1 The applicant should show that the AFCB or GFI can distinguish between actual fault events and events characteristic of the normal airplane pump s tart up operating loads A - 1

09/24/18 AC 25.981 - 1D Appendix A and environmental conditions. Laboratory testing and/or airplane ground/flight testing should be performed to show the “intended function” of AFCB or GFI. The test methods chosen should reproduce the most common types of arcing in f uel pumps that occur in an airplane environment due to ground or arc faults. The AFCB or GFI should be designed to prevent nuisance tripping due to normal airplane electrical loads and electrical bus switching ; and to operate continuously with normal and a bnormal airplane electrical bus switching characteristics associated with mast er minimum equipment list dispatch relief configurations .

A.3.1.2 I nstallation of the AFCB or GFI should not result in an appreciable increase in the loss of fuel pump function. A reliab ility requirement on the order of 100,000 hours mean time between failures may be satisfactory, but the applicant should show that failure of the AFCB or GFI does not result in an appreciable increase in the occurrence of failures that result in the loss o f fuel pump function .

A.3.1.3 Sufficient laboratory testing and airplane testing should be conducted to show AFCB or GFI nuisance trip performance, including tests for lightning, HIRF , and electromagnetic compatibility . In addition, sufficient laboratory testing s hould be conducted to show that the AFCB or GFI trips before arcing in the fuel pump can lead to ignition of fuel vapor in the fuel tank.

A.3.1.4 A means should be provided to latch the AFCB or GFI in a state that removes power from the fuel pump motor in the even t that a ground fault has been detected, until the AFCB or GFI is reset. A trip of a single AFCB or GFI should not be reset until the reason for the trip has been determined and repaired , or until it has been determined that no ground fault exists. Intermi ttent arcing can cause tripping of circuit protection devices resulting from failures that are difficult to isolate during maintenance actions.

Single trip events may be attributed to a nuisance fault. However, maintenance instructions should include notes that state repeated tripping of devices indicates an intermittent fault exists, and the circuit should not be energized until the fault is isolated and repaired.

A.3.2 Software.

Inadvertent operation of multiple AFCB or GFI devices has the potential to affect t he continued operation of more than one engine, a condition that the FAA considers to be hazardous . Software used by the AFCB or GFI devices should be developed and verified i n accordance with the latest version of RTCA DO - 178.

A.3.3 Complex Hardware.

A pplicatio n - specific integrated and complex circu it s used by the AFCB or GFI devices should be developed and te sted in accordance with RTCA DO - 254 and FAA Order 8110.105 A, Simple and Complex Electronic Hardware Approval Guidance , dated April 5, 2017 .

A - 2

09/24/18 AC 25.981 - 1D Appendix A A.3.4 System Safety A ssessment.

A.3.4.1 AFCB or GFI devices installed in circuits that perform essential or critical functions and/or their performance could impact the safety of flight . T he applicant should perform an installation SSA in accordance with §§ 25.901(c), 25.981(a) and (d ), and 25.1309.

The SSA should include a functional hazard assessment to determine the effects of failures of the AFCB or GFI devices on the safety of the airplane and to verify that the design limits the probability of undesirable failure conditions to ac ceptable levels. In addition, the applicant should address the potential for possible common cause trips due to hardware/software errors and common cause trips due to environmental conditions such as HIRF (§ 25.1317) , lightning (§§ 25.954 and 25.1316) , and electromagnetic compatibility (§ § 25.1301 , 25.1309(e), and 25.1353(a) ) .

A.3.4.2 Failure to provide fuel pump power due to unintended activation of multiple AFCB or GFI devices has the potential to affect the continued operation of more than one engine .

A circuit protective device failure, cascading failure, or common cause failure that affects multiple engines would be non - compliant with § 25.903(b) if it prevents continued operation of the remaining engines, or requires immediate crew action to prevent a multiple engine power loss .

A.3.4.3 Failure of a n AFCB or GFI device to detect an arc or ground fault condition in a fuel pump circuit can contribute to a catastrophic failure condition. Assuming the loss of explosion - proof features of the pump (examples discussed in para graph A.2.1 ) or arcing at the electrical connector could result from a single failure, t he FAA considers the undetected failure of a n AFCB or GFI alone, which prevents its detection of or response to a n arc or g round fault , to be a severe - major (hazardous) failure condition. The loss of arc or ground fault protection should either be shown to be extremely remote (if latent, consistent with the requirement of § 25.981(a)(3)) or annunciated to th e flightcrew prior to flight. If failures of the AFCB or GFI can contribute to severe - major (hazardous) or catastrophic failure conditions, the safety assessment should analyze common cause failures or design errors that could result in these conditions and verify that appro priate protection to prevent them is prov ided. Due to the nature of AFCB and GFI devices, special attention should be given to protection from lightning, EMI, and HIRF.

A.3.4.4 As discussed in section A.3.7 below, the FAA expects there will be a means for the flight crew to reset the AFCB or GFI in the event that more than one fuel pump AFCB or GFI trips simultaneously in flight.

A.3.4.5 Further, the applicant should show by design, analysis, and fault insertion testing , if applicable, the valid ity of failure analysis assumptions, and show that the probability of the failure of AFCB or GFI to detect the existence of a ground or arc fault condition and - 7 remove power from a pump is extremely remote (1 0 or less). In order to make this showing , AFCB and GFI installations have typically required an automatic built - i n test feature that verif ies the AFCB or GFI is operational before applying power to the fuel pump prior to each flight (see section 9.3.3 of this AC ).

A - 3

09/24/18 AC 25.981 - 1D Appendix A A.3.5 Power an d Ground Requirements.

AFCB or GFIs are active devices and require power to function . T he applicant should show that AFCB or GFI power and ground connections are implemented such that all airplanes load margins are sufficient and that proper circuit protec tion or other methods are used to protect AFCB or GFI power and ground wiring. The applicant should also show that there are no h azards to maintenance or flight crews due to possible hot shorts to electrical panels contai ning AFCB or GFI. In addition, if th e installation of AFCB or GFI involve s the direct replacement of devices on a given electrical panel, the applicant should show adequate power/heat dissipation and e nsure safe touch temperature.

A.3.6 Built - In Test.

AFCB and GFI devices should incorporate built - in test and annunciation features needed to meet the reliability requirements for showing compliance with § 25.981(a)(3).

For example, if single or cascading failure in the fuel pump electrical circuit can result in an ignition source, a circuit protection feature failure rate less than extremely remote - 7 (1 x 10 ), would be required in order to comply with § 25.981. Traditional protective devices without built - in test and annunciation of failures have not been shown to achieve this level of reliability. App licants have installed multiple protective devices in series or provided built - in test with annunciation in order to comply.

A.3.7 Troubleshooti ng Procedures.

A.3.7.1 Because AFCB or GFIs are capable of detecting ground paths on pumps and airplane wiring that may not be detected by visual inspection, the applicant should define the operational and maintenance philosophies and methodology associated with a n AFCB or GFI trip that does not rely solely on visual inspections. The applicant should show how the maintenance proc edures would be able to safely distinguish and diagnose a n AFCB or GFI trip and nuisance trip without causing a fuel tank explosion. Operational instructions and maintenance procedures should be provided to prevent resetting of tripped AFCB or GFIs until i t can be assured that resetting a n AFCB or GFI will not cause the occurrence of a fuel tank explosion. Human factors should be taken into account to minimize the possibility of human error during airplane operation and maintenance.

A.3.7.2 If multiple boost pumps are protected with AFCB or GFI devices such that the continued operation of multiple engines could be affected, there should be a means for the flightcrew to reset tripped AFCB or GFI devices in flight. Loss of fuel pump capability due to inadvertent tripp ing in some fuel tanks could result in loss of fuel reserves needed to complete an Extended Operations (ETOPs) flight or safe diversion.

To prevent causing an ignition source, t he applicable airplane flight manual should contain a limitation against the re set of a single AFCB or GFI . However, in order to address common cause inadvertent tripping, procedures should be provided for resetting AFCB or GFI devices when multiple AFCB or GFIs have tripped simultaneously in flight.

A - 4

09/24/18 AC 25.981 - 1D Appendix A A.3.8 Hardware Qualification.

Environme ntal testing — including thermal, shock and vibration, humidity, fluid susceptibility, altitude, decompression, fungus, waterproof, salt spray, and explosion - proof — should be performed in accordance with RTCA DO - 160 G or equivalent standards. The applicant sho uld define an insulation, dielectric , and electrical grounding and bonding standard acceptable t o the FAA for the AFCB or GFI. Appropriate test categories in each section of RTCA DO - 160G should be chosen based on the AFCB or GFI installation environment de fined for the specific airplane. Particular attention should be given to the normal and abnormal power input tests outlined in s ection 16 of RTCA DO - 160G . The system with AFCB or GFI installed must comply with §§ 25.954 and 25.1316 for lightning protection ; § § 25.1301 , 25.1309(e), and 25.1353(a) for electromagnetic compatibility ; and § 25.1317 for HIRF.

A.3.9 Airplane Tests.

The applicant should show by ground tests, flight tests , or both that all AFCB or GFIs remain armed during normal and abnormal electrical po wer bus and load switching as described in paragraph A.3.1.1 of this AC , and are not adversely affected by the opera tion of other airplane systems. The airplane tests should also show that the AFCB or GFI would not produce elec tromagnetic interference on other airplane systems.

A.3.10 Instructions for Continued Airworthiness (ICA).

A.3.10.1 The applicant must submit ICAs required by § 2 5.1529 in order to provide the necessary procedures to service and maint ain AFCB or GFI installations. As requ ired by appendix H25.4, the A irworthiness L imitations section of the ICA must include each mandatory replacement time, inspection interval, related inspection procedure, and all critical design configuration control limitations (CDCCL s ) approved under § 25 .981 for the AFCB or GFI installation. Inspection intervals determined from the safety analysis would be included for the detection of latent failures that would prevent the AFCB or GFI from tripping during a ground or arc fault event.

A.3.10.2 AFCB or GFIs used fo r showing compliance to § 2 5.981 requirements for preventing ignition sources are typically a CDCCL in these installations. As required by § 25.981(d), t he applicant must provide visible means of identifying the AFCB or GFI as a CDCCL and should provide de sign features to minimize the inadvertent substitution of a n AFCB or GFI with a non - AFCB or GFI device.

A.3.11 Airplane Flight Manual Limitations .

The airplane flight manual L imitations section should address any limitations related to AFCB or GFI intended functi on and any self - test features of the AFCB or GFI design .

A - 5

09/24/18 AC 25.981 - 1D Appendix B Appendix B. Related Documents The following related documents are provided for information purposes and are not necessarily directly referenced in this AC.

B.1 R EGULATIONS.

The following 14 CFR regulations prescribe require m ents for the design, substantiation, and certification relating to prevention of ignition sources within the fuel tanks of transport category airplanes . You can download the full text of these regulations at the U.S. Government Printing Office e - CFR website. Or you can order a paper copy by sending a request to the U.S. Superintendent of Documents, U.S. Government Printing Offi ce, Washington, D.C. 20402 - 0001; by calling telep hone number (202) 512 - 1800; or b y sending a request by fax to (202) 512 - 2250.

 Section 21.50, Instructions for continued airworthiness and manufacturer’s maintenance manuals having airworthiness limitations sections.

 Section 25.729(f), Protection of equipme nt on landing gear and in wheel wells.

 Section 25.863, Flammable fluid fire protection.

 Section 25.901, Powerplant : Installation.

 Section 25.903 (b) , Engine isolation .

 Section 25.951, Fuel System : General .

 Section 25.954, Fuel system lightning protection .

 S ection 25.973, Fuel tank filler connection.

 Section 25.981, Fuel tank explosion prevention .

 Section 25.1301, Equipment : Function and installation.

 Section 25.1309, Equipment, systems, and installations.

 Section 25.1316, Electrical and electronic system lig htning protection.

 Section 25.131 7 , High - intensity Radiated Fields (HIRF) Protection .

 Section 25.1353, Electrical equipment and installations .

 Section 25.1521, Powerplant limitations .

 Section 25.1529, Instructions for Continued Airworthiness.

 Section 25.15 57 , Miscellaneous markings and placards .

 Section 25.1701 , Electrical Wiring Interconnection Systems (EWIS): Definition .

 Section 25.1707 , System separation: EWIS .

 Appendix H to part 25, Instructions for Continued Airworthiness.

B - 1

09/24/18 AC 25.981 - 1D Appendix B B.2 ADVISORY CIRCULARS.

The follo wing FAA ACs are related to the guidance in this AC. The latest version of each AC at the time of publication of this AC is identified below. If any AC is revised after publication of this AC, you should refer to the latest version for guidance, which can be downloaded from the Internet at http://www.faa.gov/regulations_policies/advisory_circulars/ .

 AC 20 - 158 A , The Certification of Aircraft Electrical and Electronic Systems for Oper ation in the High - Intensity Radiated Fields (HIRF) Environment , dated May 30, 2014 .

 AC 21 - 40A, Guide for Obtaining a Supplemental Type Certificate , dated September 27, 2007.

 AC 25 - 8, Auxiliary Fuel System Installations , dated May 2, 1986.

 AC 25 - 16 , Electri cal Fault and Fire Prevention and Protection , dated September 25 , 1987 .

 AC 25 - 19, Certification Maintenance Requirements , dated October 3, 2011.

 AC 25.954 - 1 , Transport Airplane Fuel System Lightning Protection , dated September 2 4, 2018 .

 AC 25.981 - 2A, Fuel Tank Flammabilit y Reduction Means , dated September 19, 2008.

 AC 25.1309 - 1A, System Design and Analysis , dated June 21, 1988.

 AC 25.1701 - 1, Certification of Electrical Wiring Interconnection Systems on Transport Category Airplanes , dated December 4, 2007.

 AC 120 - 97A, Incor poration of Fuel Tank System Instructions for Continued Airworthiness into Operator Maintenance and/ or Inspection Programs , dated May 25, 2012 .

B.3 ORDERS.

The following FAA orders are related to the guidance in this AC. You can download the latest version fro m the Internet at http://www.faa.gov/regulations_policies/orders_notices/ .

 Order 8110.4C, Change 6, Type Certification , dated October 12, 2005 .

 Order 8110.42 D , Parts Manufacturer Appro val Procedures , dated March 21, 2014.

 Order 8110.105A, Simple and Complex Electronic Hardware Approval Guidance , dated April 5, 2017.

B - 2

09/24/18 AC 25.981 - 1D Appendix B B.4 REPORTS .

The following FAA reports are related to this AC:  Report No. DOT/FAA/AR - 98/26, A Review of the Flammability Hazar d of Jet A Fuel Vapor in Civil Transport Aircraft Fuel Tanks , dated June 1998. T his report can be downloaded from the Internet at http://www.tc.faa.gov/its/worldpac/techrpt/ar98 - 26.pdf .

 Report No. DOT/FAA/AR - 03/61 , Silver - Sulfur Deposits on Fuel Quantity Indication System and Attendant Wiring , dated October 2003. This report can be downloaded from the Internet at http: //www.tc.faa.gov/its/worldpac/techrpt/ar03 - 61.pdf .

 Report No. DOT/FAA/AR - TN05/37 , Intrinsically Safe Current Limit Study for Aircraft Fuel Tank Electronics , dated October 2005. This report can be downloaded from the Internet at http://www.fire.tc.faa.gov/pdf/TN05 - 37.pdf .

B.5 MILITARY SPECIFICATI ONS.

The following docu m ents are available from the Depart m ent of Defense, Docu m ent Auto m ation and Production Service, Building 4/D, 700 Robbins Avenue, Philade lphia, P A 19111 - 5094 .

 MIL - STD - 810 N , Environmental Test Methods and E n gineering Guidelines , Method 511. 5 , Explosive Atmosphere , dated October 31, 2008 .

 MIL - PRF - 6106 N , General Specification for Electromagnetic Relays , dated September 14 , 200 9.

B.6 RTCA DOCUMENTS .

You can order of the following documents from RTCA, Inc., 1150 18th Street NW, Suite 910, Washington, DC 20036; telephone: 202 - 833 - 9339 or fax : 202 - 833 - 9434.

You can also order copies online at http:/www.rtca.org .

 RTCA DO - 160G, Environmental Conditions and Test Procedures for Airborne Equipment , December 6, 2010.

 RTCA DO - 178B, Software Considerations in Airborne Systems and Equipment Certification , dated December 13, 2011 .

 RTCA DO - 254, Design Assurance Guidance for Airb orne Electronic Hardware , dated April 4, 2000 .

B.7 SAE INTERNATIONAL DOCUMENTS.

T he versions of the following docu m ents are current at the time of publication of this AC. You can o rder copies of them f rom SAE International, 400 Commonwealth Drive, War rendale, Pennsylvania 15096; or online at http://www.sae.org .

 AIR1662, Minimization of Electrostatic Hazards in Aircraft Fuel Systems.

B - 3

09/24/18 AC 25.981 - 1D Appendix B  ARP4404, Aircraft Electrical Systems (guidance docu m ent for design of aerospace vehicle electri cal syste m s).

 ARP 4754, Certification Considerations for Highly Integrated or Complex Aircraft Systems.

 ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.

 ARP5583 A , Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment.

 AS50881, Aerospace Vehicle Wiring (procure m ent docu m ent used to specify aerospace wiring; replaces MIL - W - 5088).

 AS5692 A , A RC Fault Circuit Breaker (AFCB), Aircraft, Trip - Free Single Phase and Three Phase 115 VAC, 400 Hz - Constant Frequency , dated December 29, 2009 .

 AS6019, ARC Fault Circuit Breaker (AFCB), Aircraft, Trip - Free 28 VDC , dated June 6 , 20 12 .

B.8 OTHER INDUSTRY DOCUMENTS.

 Air Force Aero Propulsion Laboratory Technical Report AFAPL - TR - 7 5 - 70, Summary of Ignition Properties o f Jet Fuels and Other Aircraft Combustible Fluids , dated September 1975, http://www.dtic.mil/get - tr - doc/pdf?AD=ADA021320 .

 ASTM D2155 - 12, Standard Test Met hod for Determination of Fire Resistance of Aircraft Hydraulic Fluids by Autoignition Temperature , http://www.astm.org (replaced ASTM D286, Method of Test for Autogenous Ignition Temperatures of Petroleum Products , whic h was w ithdrawn in 1966).

 ASTM D 4865, Standard Guide for Generation and Dissipation of Static Electricity in Petroleum Fuel Systems , August 2009 , http://www.astm.org .

 ASTM E659 - 15, Standard Test Method for Autoignition Temperature of Chemicals, ASTM International , http://www.astm.org .

 EUROCAE ED - 107A, Guide to Certification of Aircraft in a High Intensity Radiated Field (HIRF) Environment. This document is the same as SAE A RP5583A ref erenced in paragraph B.7 of this AC .

 NASA Report NASA/TM - 2000 - 210077, Some Notes on Sparks and Ignition of Fuels , dated March 2000, https://ntrs.nasa.gov/search.jsp? R=20000053468 .

 National Fire Protection Association NFPA 77, Recommended Practice on Static Electricity , 1993 edition, http://www.nfpa.org .

 Underwriters Laboratories Inc., UL 913, Intrinsically Safe Apparatus and Associated Apparatus for use in Class I, II, III, Division 1, Hazardous (Classified) Locations , dated July 31, 2006, https://standardscatalog.ul.com/standards/en/ standard_913_8 .

B - 4

09/24/18 AC 25.981 - 1D Appendix C Appendix C. Definitions C.1 ARC FAULT CIRCUIT BR EAKER (AFCB).

A device that provides thermal circuit breaker protection , detects electrical arcing faults , and interrupts electrical p ower to the fault. (See paragraph B.7 of th is AC for SAE standards for alternating current and direct current AFCB.)

C.2 AUTO I GNITION TEMPERATURE.

The minimum temperature at which an optimized flammable vapor and air mixture will spontaneously ignite when heated to a uniform temperature in a normal atm osphere without an external source of ignition, such as a flame or spark.

C.3 AUXILIARY TANKS.

Fuel tanks installed that make additional fuel available for increasing the flight range of the airplane. The term “auxiliary” means that the tank is secondary to th e airplane’s main fuel tanks; i.e., the functions of the main tanks are immediately available and operate without immediate supervision by the flightcrew in the event of failure or inadvertent depletion of fuel in an auxiliary tank. Auxiliary tanks are usu ally intended to be emptied of usable fuel during flight and have been installed in various locations including center wing structure, horizontal stabilizers, wings, and cargo compartments.

C.4 BARRIER.

A physical partition attached to airplane structure that separates one wire or group of wires from another wire or group of wires in order to prevent arcing, fire , and other physical damage between wires or groups of wires.

C.5 COMPONENT MAINTENANC E MANUAL ( CMM ) DEVIATION.

1. Term used for approval of changes to CMMs t hat are the subject of CDCCL s or other types of airworthiness limitations adopted by a type design change.

2. Term used for the approval of changes to CMMs referenced in CDCCL s or other types of airworthiness limitations that are mandated by airworthiness dir ective s (AD s ) , provided the CDCCL or airworthiness limitation includes wording that allows use of “later approved” CMMs. Otherwise, approval must first be granted as an alternative method of compliance (AMOC) to the AD. As with AMOC approvals, a CMM deviat ion approval must be granted by the responsible Aircraft Certification Service office .

C - 1

09/24/18 AC 25.981 - 1D Appendix C C.6 CRITICAL DESIGN CONF IGURATION CONTROL LI MITATIONS (CDCCL S ) .

Airworthiness limitations that define those critical design feature s of the design that must be maintained to ensure that ignition sources will not develop within the fuel tank system .

C.7 ELECTRICAL SPARKS.

A spark that is initiated by a potential difference , which causes an electrical breakdown of a dielectric such as a fuel/air mixture, produced between electrodes that are initially separated, with the circuit initially carrying no current. The term voltage sparks is sometimes used interchangeably with the term electrical sparks.

C.8 ELECTRICAL ARCS.

Electrical arcs occur between electrodes that are in contact with eac h other and carry excessive current , which results in melting at the contact points. This may result in electric arc plasma and/or ejection of molten or burning material. The term thermal sparks is used interchangeably with the term electrical arcs.

C.9 EXPLOS ION PROOF.

Components designed and constructed so they will not ignite flammable vapors or liquids surrounding the component under any normal operating condition and any failure condition. Further information on possible failure conditions that should be c onsidered is specified in § 25.981(a)(3).

C.10 FAIL - SAFE.

As defined in the preamble to a mendment 25 - 102, “the FAA’s policy has been to require applicants to assume the presence of foreseeable latent (undetected) failure conditions when demonstrating that subse quent single failures will not jeopardize the safe operation of the airplane.” Section 25.981(a)(3) incorporated the fail - safe principles of §§ 25.901(c) and 25.1309. (66 FR 23087) C.11 FILAMENT HEATING.

The heating of a small diameter conductive material when exposed to electrical current.

C.12 FLAMMABLE.

Flammable, with respect to a fluid or gas, means susceptible to igniting readily or to exploding (14 CFR 1. 1, General definitions ). Further information on flammable fluids used in airplanes may be found in the docu ments identified in paragraph B.8 of this AC.

C - 2

09/24/18 AC 25.981 - 1D Appendix C C.13 FLASH POINT.

The flash point of a flammable fluid is defined as the lowest temperature at which the application of a flame to a heated sample causes the vapor to ign ite momentarily, or “flash.” The test standard for jet fuel is defined in the fuel specification.

C.14 FRICTION SPARK.

A heat source in the form of a spark that is created by mechanical contact, such as debris contacting a rotating fuel pump impeller.

C.15 FUEL SYST EM AIRWORTHINESS LIMITATION .

Any mandatory replacement time, inspection interval, related inspection procedure, and all critical design CDCCL s approved under § 25.981 for the fuel tank system identified in the A irworthiness L imitations section of the ICA ( as required by § 25.981 (d) and section H25.4 of appendix H to part 25 ).

C.16 GROUND FAULT INTERRU PTER (GFI).

A device that provides thermal circuit breaker protection , detects an electrical power short circuit - to - ground condition , and interrupts electrical powe r to the ground fault.

C.17 HOT SHORT.

Electrical energy introduced into equipment or systems as a result of unintended contact with a power source, such as bent pins in a connector or damaged insulation on adjacent wires.

C.18 IGNITION SOURCE.

A source of sufficien t energy to initiate combustion of a fuel/air mixture. Hot s urfaces that can exceed the autoignition temperature of the flammable vapor under consideration are considered to be ignition sources. Electrical arcs, electrical sparks , and friction sparks are a lso considered ignition sources if sufficient energy is released to initiate combustion.

C.19 INSTALLATION APPRAIS AL.

A qualitative appraisal of the integrity and safety of the installation.

C.20 INTRINSICALLY SAFE.

Any instrument, equipment, or wiring that is incap able of releasing sufficient electrical or thermal energy under normal operating conditions, anticipated failure conditions (see § 25.981(a)(3)), and environmental conditions , which could cause an ignition source within the fuel tank.

C - 3

09/24/18 AC 25.981 - 1D Appendix C C.21 LATENT FAILURE.

A fai lure whose presence is not apparent to the flightcrew or maintenance personnel. A significant latent failure is one that would, in combination with one or more specific failures or events, result in a hazardous or catastrophic failure condition.

C.22 LINE REPLA CEMENT UNIT (LRU).

Any components that can be replaced while the airplane remains in operational service.

Examples of fuel system LRUs include components such as flight deck and refueling panel fuel quantity indicators, fuel quantity system processors, and fuel system management control units.

C.23 MAXIMUM ALLOWABLE SU RFACE TEMPERATURES.

A s defined in 14 CFR 25.981(a)(1) and (2), the surface temperature within the fuel tank (the tank walls, baffles, or any components) that provides a safe margin under all normal or failure conditions, which is at least 50 °F ( 27.8 °C) below the lowest expected autoignition temperature of the approved fuels. The autoignition temperature of fuels will vary because of a variety of factors (ambient pressure, dwell time, fuel type, et c.).

The value accepted by the FAA without further substantiation for kerosene fuels, such as Jet A, under static sea level conditions, is 450 °F (232.2 °C). This results in a maximum allowable surface temperature of 400 °F (204.4 °C) for an affected compo nent surface.

C.24 QUALITATIVE.

Those analytical processes that assess system and airpl ane safety in an objective, non - numerical manner.

C.25 QUANTITATIVE.

Those analytical processes that apply mathematical methods to assess system and airplane safety.

C.26 TRANSIENT SUP PRESSION DEVICE (TSD ).

A device that limits transient voltages or currents on wiring to systems such as the fuel tank quantity, fuel temperature sensors, and fuel level switches, etc., to a predetermined level.

C - 4

09/24/18 AC 25.981 - 1D Appendix D Appendix D. Advisory Circular Feedback If you find an err or in this AC , have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to 9 - AWA - AVS - AIR - DMO@faa.gov or (2) faxing it to (2 02) 267 - 181 3.

Subject: AC 25.981 - 1D , Fuel Tank Ignition Source Prevention Guidelines Please check all appropriate line items: ☐ An error (procedural or typographical) has been noted in paragraph _______ on page _______.

☐ Recommend paragraph _______ on page _______ be changed as follows: ☐ In a future change to this AC, please cover the following subject: (Briefly describe what you want added.)

☐ Other comments: ☐ I would like to discuss the above. Please contact me.

I would like to discuss the above. Please contact me.

Submitted by: __________________________________ Date: __________________ Telephone Number: __________________ Email Address : ________ ________ _________ D - 1