Reduction of Fuel Tank Flammability in Transport Category Airplanes

Federal RegisterJul 21, 2008

Ask Donna

What actually matters in this document.

Text

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Parts 25, 26, 121, 125, and 129

[Docket No. FAA-2005-22997; Amendment Nos. 25-125, 26-2, 121-340, 125-55, and 129-46]

RIN 2120-AI23

Reduction of Fuel Tank Flammability in Transport Category Airplanes

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Final rule, request for comments.

SUMMARY:

This final rule amends FAA regulations that require operators and manufacturers of transport category airplanes to take steps that, in combination with other required actions, should greatly reduce the chances of a catastrophic fuel tank explosion. The final rule does not direct the adoption of specific inerting technology either by manufacturers or operators, but establishes a performance-based set of requirements that set acceptable flammability exposure values in tanks most prone to explosion or require the installation of an ignition mitigation means in an affected fuel tank. Technology now provides a variety of commercially feasible methods to accomplish these vital safety objectives.

DATES:

These amendments become September 19, 2008. Send your comments by January 20, 2009. The incorporation by reference of the document listed in the rule is approved by the Director of the Federal Register as of September 19, 2008.

FOR FURTHER INFORMATION CONTACT:

If you have technical questions about this action, contact Michael E. Dostert, FAA, Propulsion/Mechanical Systems Branch, ANM-112, Transport Airplane Directorate, Aircraft Certification Service, 1601 Lind Avenue, SW., Renton, Washington 98057-3356; telephone (425) 227-2132, facsimile (425) 227-1320; e-mail:

mike.dostert@faa.gov

. Direct any legal questions to Doug Anderson, ANM-7, FAA, Office of Regional Counsel, 1601 Lind Avenue, SW, Renton, WA 98057-3356; telephone (425) 227-2166; facsimile (425) 227-1007, e-mail

Douglas.Anderson@faa.gov

SUPPLEMENTARY INFORMATION:

Later in this preamble under the ADDITIONAL INFORMATION section, we discuss how you can comment on a certain portion of this final rule and how we will handle your comments. Included in this discussion is related information about the docket, privacy, and the handling of proprietary or confidential business information. We also discuss how you can get a copy of this final rule and related rulemaking documents.

Authority for Rulemaking

The FAA's authority to issue rules regarding aviation safety is found in Title 49 of the United States Code. Subtitle I, Section 106 describes the authority of the FAA Administrator. Subtitle VII, Aviation Programs, describes in more detail the scope of the agency's authority.

This rulemaking is promulgated under the authority described in Subtitle VII, Part A, Subpart III, Section 44701, “General requirements.” Under that section, the FAA is charged with promoting safe flight of civil aircraft in air commerce by prescribing minimum standards required in the interest of safety for the design and performance of aircraft; regulations and minimum standards in the interest of aviation safety for inspecting, servicing, and overhauling aircraft; and regulations for other practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it prescribes

• New safety standards for the design of transport category airplanes, and

• New requirements necessary for safety for the design, production, operation and maintenance of those airplanes, and for other practices, methods, and procedures related to those airplanes.

Table of Contents

I. Executive Summary

A. Statement of the Problem

B. Reducing the Chance of Ignition

C. Reducing the Likelihood of an Explosion After Ignition

II. Background

A. Summary of the NPRM

B. Related Activities

C. Differences Between the NPRM and the Final Rule

III. Discussion of the Final Rule

A. Summary of Comments

B. Necessity of Rule

1. Estimates/Conclusions Supporting Need for Rule

2. Additional Research Needed

3. Consistent Safety Level With Other Systems

4. Human Errors

5. Explosion Risk Analysis

6. Special Certification Review Process vs. Rulemaking

7. Flammability Reduction Means (FRM) Effectiveness

C. Applicability

1. Airplanes With Fewer Than 30 Seats

2. Part 91 and 125 Operators

3. All-Cargo Airplanes

4. Specific Airplane Models

5. Wing Tanks

6. Auxiliary Fuel Tanks

7. Existing Horizontal Stabilizer Fuel Tanks

8. Foreign Persons/Air Carriers Operating U.S. Registered Airplanes

9. Airplanes Operated Under § 121.153

10. International Aspects of Production Requirements

D. Requirements for Manufacturers and Holders of Type Certificates, Supplemental Type Certificates and Field Approvals

1. General Comments About Design Approval Holder (DAH) Requirements

2. Flammability Exposure Level Requirements for New Airplane Designs

3. Flammability Exposure Requirements for Current Airplane Designs

4. Continued Airworthiness and Safety Improvements

E. Flammability Exposure Requirements for Airplane Operators

1. General Comments About Applicability to Existing Airplanes

2. Authority to Operate With an Inoperative FRM, IMM or FIMM

3. Availability of Spare Parts

4. Requirement That Center Fuel Tank be Inert Before First Flight of the Day

F. Appendix M—FRM Specifications

1. Fleet Average Flammability Exposure Levels

2. Inclusion of Ground and Takeoff/Climb Phases of Flight

3. Clarification of Sea Level Ground Ambient Temperature

4. Deletion of Proposed Paragraph M25.2 (Showing Compliance)

5. Deletion of “Fuel Type” From List of Requirements in Proposed Paragraph M25.2(b)

6. Latent Failures

7. Identification of Airworthiness Limitations

8. Catastrophic Failure Modes

9. Reliability Reporting

G. Appendix N—Fuel Tank Flammability Exposure and Reliability Analysis

1. General

2. Definitions

3. Input Parameters

4. Verification of “Flash Point Temperature”

H. Critical Design Configuration Control Limitations (CDCCL)

1. Remove Requirement

2. Clarification on Responsibility for Later Modifications

3. Limit CDCCL's to Fuel Tanks That Require FRM or IMM

4. STC Holders May Not Have Data to Comply

I. Methods of Mitigating the Likelihood of a Fuel Tank Explosion

1. Alternatives to Inerting

2. Inerting Systems Could Create Ignition Sources

3. Instruments to Monitor Inerting Systems

4. Risk of Nitrogen Asphyxiation

5. Warning Placards

6. Definition of “Inert”

7. Use of Carbon Dioxide

8. Environmental Impact of FRM

9. Current FRMs Fail to Meet Requirements

10. FRM Based on Immature Technology

J. Compliance Dates

1. Part 26 Design Approval Holder Compliance Dates

2. Operator Fleet Retrofit Compliance Dates

K. Cost/Benefit Analysis

1. Security Benefits

2. Likelihood of Future Explosions in Flight

3. Costs to Society of Future Accidents

4. Value of a Prevented Fatality

5. Cost Savings if Transient Suppression Units (TSUs) are not Required

6. Corrections About Boeing Statements

7. 757 Size Category

8. Number of Future Older In-Service Airplanes Overestimated

9. Revisions to the FRM Kit Costs

10. Revisions to the Labor Time to Retrofit FRM Components

11. Retrofitting Costs per Airplane

12. Percentage of Retrofits Completed During a Heavy Check

13. Number of Additional Days of Out-of-Service Time to Complete a Retrofit

14. Economic Losses From an Out-of-Service Day

15. Updated FRM Weight Data

16. Updated Fuel Consumption Data

17. Updated Fuel Cost Data

18. Cost of Inspections

19. Inspection and Maintenance Labor Hours

20. Daily Check

21. Spare Parts Costs

22. Air Separation Model (ASM) Replacement

L. Miscellaneous

1. Harmonization

2. Part 25 Safety Targets

IV. Regulatory Notices and Analyses

V. The Amendment

I. Executive Summary

A. Statement of the Problem

Fuel tank explosions have been a constant threat with serious aviation safety implications for many years. Since 1960, 18 airplanes have been damaged or destroyed as the result of a fuel tank explosion. Two of the more recent explosions—one involving a Boeing 747 (Trans World Airways (TWA) Flight 800) off Long Island, New York in 1996 and the other, a Boeing 727 terrorist-initiated explosion (Avianca Flight 203) in Bogotá, Columbia in 1989

—occurred during flight and led to catastrophic losses (including the deaths of 337 individuals). Two other recent explosions on airplanes operated by Philippine Airlines and Thai Airlines occurred on the ground (resulting in nine fatalities).

While the accident investigations of the TWA, Philippine Airlines and Thai Airlines accidents failed to identify the ignition source that caused the explosion, the investigations found several similarities. In each instance:

Although it was determined that a terrorist's bomb had caused the explosion of the center tank in the Bogotá accident, the NTSB determined the “bomb explosion did not compromise the structural integrity of the airplane; however, the explosion punctured the [center wing tank] and ignited the fuel-air vapors in the ullage, resulting in destruction of the airplane.”

Philippine Airlines Boeing 737 accidnet in Manila in 1990, and a Thai Airlines Boeing 737 accident in Bangkok in 2001.

1. The weather was warm, with an outside air temperature over 80 °F;

2. The explosion occurred on the ground or soon after takeoff; and

3. The explosion involved empty or nearly empty tanks that contained residual fuel from the previous fueling.

Additionally, investigators were able to conclude that the center wing fuel tank in all three airplanes contained flammable vapors in the ullage (that portion of the fuel tank not occupied by liquid fuel) when the fuel tanks exploded. This was also the case with the Avianca airplane.

A system designed to reduce the likelihood of a fuel tank fire, or mitigate the effects of a fire should one occur, would have prevented these four fuel tank explosions.

A statistical evaluation of these accidents has led the FAA to project that, unless remedial measures are taken, four more United States (U.S.) registered transport category airplanes will likely be destroyed by a fuel tank explosion in the next 35 years. Although we cannot forecast precisely when these accidents will occur, computer modeling that has been an accurate predictor in the past indicates these events are virtually certain to occur. We believe at least three of these explosions are preventable by the adoption of a comprehensive safety regime to reduce both the incidence of ignition sources developing and the likelihood of the fuel tank containing flammable fuel vapors.

B. Reducing the Chance of Ignition

To address the first part of this comprehensive safety regime, we have taken several steps to reduce the chances of ignition. Since 1996, we have imposed numerous airworthiness requirements (including airworthiness directives or “ADs”) directed at the elimination of fuel tank ignition sources. Special Federal Aviation Regulation No. 88 of 14 Code of Federal Regulations (CFR) part 21 (SFAR 88; 66 FR 23086, May 7, 2001) requires the detection and correction of potential system failures that can cause ignition. Although these measures should prevent some of the four forecast explosions, our review of the current transport category airplane designs of all major manufacturers has shown that unanticipated failures and maintenance errors will continue to generate unexpected ignition sources. Since manufacturers completed their SFAR 88 ignition prevention reviews, we have had reports of potential ignition sources (including unsafe conditions) that were not identified in the SFAR 88 reviews. For example:

• We issued AD 2006-06-14 to require the inspection of fuel quantity indicating probes within the fuel tanks of Airbus A320 airplanes to prevent an ignition source due to sparks that could be created following a lightning strike. This failure mode was not identified as a possible ignition source in the SFAR 88 analysis presented to the FAA.

• We issued AD 2006-12-02 following a report of an improperly installed screw inside the fuel pump housings of A320 airplanes that could loosen and fall into the pump's electrical windings. This could create a spark and ignite fuel vapors in the pump. The ignited vapors could then exit the fuel pump housing, enter the fuel tank through the hole created when the screw fell out of the housing, and cause a fuel tank explosion. This failure mode was not identified as a possible ignition source in the SFAR 88 analysis presented to the FAA.

• We received an in-service report on a Boeing 777 that was operated for over 30 days with an open vent hole between the center wing fuel tank and the wheel well of the airplane. During maintenance, a vent hole cover used to facilitate venting of the tank was inadvertently left off. This was not discovered until a flight occurred where the tank was fueled to a level where the fuel spilled from the tank into the wheel well during pitching up of the airplane for takeoff. Since the airplane brakes routinely exceed temperatures that could ignite fuel vapors and the wheels are retracted into the wheel well, the open vent port could have allowed ignition of fuel vapors in the center tank and a fuel tank explosion. This type of maintenance error was also not identified as providing a possible ignition source during the SFAR 88 safety reviews.

• On May 5, 2006, an explosion occurred in the wing fuel tank of a Boeing 727 in Bangalore, India, while the airplane was on the ground. This event occurred after a modification to include special Teflon sleeving and recurring inspections had been implemented to prevent possible arcing of the fuel pump wires to metallic conduits located in the fuel tank. Initial information indicates that the identified

AD action was inadequate to prevent the formation of an ignition source in the fuel tank and that the change intended to improve safety caused premature wear of the sleeving and an unsafe condition. Premature wear of Teflon sleeving on the Boeing 737 has also been reported, resulting in AD action to modify the design and replace the existing sleeving. This failure mode was not identified as a possible ignition source in the SFAR 88 analysis presented to the FAA.

• We also received a report that during a recent certification program test, an ignition source developed in the fuel pumps causing pump failure. These pumps had been designed to meet the most stringent requirements of SFAR 88 and Amendment 25-102 to 14 CFR 25.981 (issued concurrently with SFAR 88), yet the pump failed in a manner that allowed a capacitor to arc to the pump enclosure and create an ignition source. The applicant has since conducted a design review that has resulted in numerous modifications to the pump's design.

• Following the TWA 800 accident, the risk of uncontrolled fire adjacent to the fuel tanks causing a fuel tank explosion was identified as an unsafe condition. In 2006, we issued a MD-80 AD (AD 2006-15-15) to prevent worn insulation on wires from arcing at the auxiliary hydraulic pump, which could result in a fire in the wheel well of the airplane. The AD required inspections to validate the pump wire integrity as well as incorporating sleeving on portions of the wires. In April 2008, we received reports of improper means of compliance being used regarding the requirements of AD 2006-15-15. Human error in completing the procedures required by the AD resulted in airplanes being operated without the needed safety improvements.

Based on the above examples, we have concluded that we are unlikely to identify and eradicate all possible sources of ignition.

C. Reducing the Likelihood of an Explosion After Ignition

To ensure safety, therefore, we must also focus on the environment that permits combustion to occur in the first place. Many transport category airplanes are designed with heated center wing tanks in which the fuel vapors are flammable for significant portions of their operating time. This final rule addresses the risk of a fuel tank explosion by reducing the likelihood that fuel tank vapors will explode when an ignition source is introduced into the tank.

Technology now exists that can prevent ignition of flammable fuel vapors by reducing their oxygen concentration below the level that will support combustion. By making the vapors “inert,” we can significantly reduce the likelihood of an explosion when a fire source is introduced to the fuel tank. FAA-developed prototype onboard fuel tank inerting systems have been successfully flight tested on Airbus A320 and Boeing 747 and 737 airplanes. We have also approved inerting systems for the Boeing 747 and 737 airplanes, and two airplanes of each model type have performed as expected during airline in-service evaluations. Boeing plans to install these systems on all new production airplanes.

Given that ignition sources will develop, the chances of a fuel tank explosion naturally correlate with the exposure of the tank to flammable vapors. The requirements in this final rule mitigate the effects of such flammability exposure and limit it to acceptable levels by mandating the installation of either a Flammability Reduction Means (FRM) or an Ignition Mitigation Means (IMM).

In either case, the technology has to adhere to performance and reliability standards that are set by us and contained in Appendices M and N to Title 14 Code of Federal Regulations (CFR) part 25.

FRM consist of systems or features installed to reduce or control fuel tank flammability to acceptable levels. IMM is based upon mitigating the effects of a fuel vapor ignition in a fuel tank so that an explosion does not occur. Polyurethane foam installed in a fuel tank is one form of an IMM. See AC 25.981-2 for additional information.

This final rule amends the existing airworthiness standards contained in 14 CFR 25.981 to require all future type certificate (TC) applicants for transport category airplanes to reduce fuel tank flammability exposure to acceptable levels. It also amends 14 CFR part 26 “Continued Airworthiness and Safety Improvements”

to require TC holders to develop FRM or IMM for many large turbine-powered transport category airplanes with high-risk fuel tanks. Finally, it amends 14 CFR parts 121, 125 and 129 to require operators of these airplanes to incorporate the approved FRM or IMM into the fleet and to keep them operational. We estimate that approximately 2,700 existing Airbus and Boeing airplanes operating in the United States as well as about 2,300 newly manufactured airplanes that enter U.S. airline passenger service will be affected. Fuel tank system designs in several pending type-certification applications, including the Boeing 787

and Airbus A350, also have to meet these requirements.

Part 26 was added to the Code of Federal Regulations to include all requirements for Continued Operational Safety. See Docket number FAA-2004-18379 for more information on this subject.

This airplane model already includes a FRM in its design that the applicant intends to show will meet today's final rule, so no additional modifications will be required.

We acknowledge that these requirements are costly and have adopted these steps only after spending several years researching the most cost-effective ways to prevent fuel tank explosions in cooperation with engineers and other experts from the affected industry. Those efforts have resulted in the development of fuel-inerting technology that is vastly cheaper than originally thought.

In contrast, the loss of a single, fully loaded large passenger airplane in flight, such as a Boeing 747 or Airbus A380, would result in death and destruction causing societal loss of at least $1.2 billion (based on costs of prior calamities). We estimate that compliance with this new rule will prevent between one and two accidents of some type (for analytical purposes we assume the accidents would involve “average” airplanes with “average” passenger loads) over 35 years.

In addition to the direct costs of such an accident, we now recognize that, in the post-9/11 aviation environment, the public could initially assume that an in-flight fuel tank explosion is the result of terrorist actions. This could cause a substantial immediate disruption of flights, similar to what occurred in Britain on August 10, 2006, due to the discovery of a terrorist plot.

This could have an immediate and substantial adverse economic effect on the aviation industry as a whole.

Although Boeing has committed to installing compliant FRM in all future production airplanes, regardless of this rule, operators could deactivate the systems unless this rulemaking is adopted. The final regulatory evaluation includes the costs and benefits of these actions for newly produced Boeing and Airbus airplanes.

Flight schedules in Britain were significantly disrupted due to flight cancellation of all flights into Heathrow Airport and 30 percent of all short-haul flights out of Heathrow Airport for one day (according to Secretary of State for Transport Douglas Alexander). The day after the event, the crowds and lines that log-jammed British airports the day before were largely gone, he said. British Airways stated that it cancelled 1,280 flights between August 10-17 due to the discovery of the terror plot and subsequent security measures. EasyJet said it was forced to cancel 469 flights because of the disruption caused by the terror alert. Ryanair said it cancelled a total of 265 flights.

The FAA's safety philosophy is to address aviation safety threats whenever practicable solutions are found, especially when dealing with intractable and catastrophic risks like fuel tank explosions that are virtually certain to

occur. Thus, now that solutions are reasonably cost effective, we have determined that it is necessary for safety and in the public's best interest to adopt these requirements.

II. Background

A. Summary of the NPRM

On November 23, 2005, the FAA published in the

Federal Register

the Notice of Proposed Rulemaking (NPRM) entitled “Reduction of Fuel Tank Flammability in Transport Category Airplanes” (70 FR 70922). This NPRM is the basis for this final rule.

In the NPRM, we proposed steps to be taken by manufacturers and operators of transport category airplanes to significantly reduce the chances of a catastrophic fuel tank explosion. The proposal followed seven years of intensive research by the FAA and industry into technologies designed to make fuel tanks effectively inert. Inerting reduces the amount of oxygen in the fuel tank vapor space so that combustion cannot take place if there is an ignition source. Although the NPRM did not specifically direct the adoption of inerting technology, it did propose a performance-based set of requirements for reducing fuel tank flammability to an acceptably safe level.

We proposed regulatory changes to require manufacturers and operators to reduce the average fuel tank flammability exposure in affected fleets. The main premise of the proposal was that a balanced approach to fuel tank safety was needed that provides both prevention of ignition sources and reduction of flammability of the fuel tanks. While the focus of the NPRM was on airplanes used in passenger operations, we requested comments on whether the new requirements should also be applied to all-cargo airplanes.

We also proposed changes to expand the coverage of part 25 by making manufacturers generally responsible for the development of service information and safety improvements (including design changes) where needed to ensure the continued airworthiness of previously certificated airplanes. This change was proposed to ensure that operators would be able to obtain service instructions for making necessary safety improvements in a timely manner.

As to fuel tank flammability specifically, we proposed to require manufacturers, including holders of certain airplane TCs and of auxiliary fuel tank supplemental type certificates (STCs), to conduct a flammability exposure analysis of their fuel tanks. We proposed a new Appendix L (now Appendix N) to part 25 that provides a method for calculating overall and warm day fuel tank flammability exposure. Where the required analyses indicated that the fuel tank has an average flammability exposure below 7 percent, we anticipate no changes would be required. However, for the other fuel tanks, manufacturers would be required to develop design modifications to support a retrofit of the airplane fuel tanks. Under the NPRM, the average flammability exposure of any affected wing tank would have to be reduced to no more than 7 percent. In addition, for any normally emptied fuel tank (including auxiliary fuel tanks) located in whole or in part in the fuselage, flammability exposure was to be reduced to 3 percent, both for the overall fleet average and for operations on warm days.

We also proposed to set more stringent safety levels for certain critically located fuel tanks in most new type designs, while maintaining the current, general standard under § 25.981 for all other fuel tanks. The expectation was that the design of most normally emptied and auxiliary tanks located in whole or in part in the fuselage of transport category airplanes would need to incorporate some form of FRM or IMM.

In Appendix M to part 25, we proposed to adopt detailed specifications for all FRM, if they were used to meet the flammability exposure limitations. These additional requirements were designed to ensure the effectiveness and reliability of FRM, mandate reporting of performance metrics, and provide warnings of possible hazards in and around fuel tanks.

We also proposed that TC holders for specific airplane models with high flammability exposure fuel tanks be required to develop design changes and service instructions to facilitate operators' installation of IMM or FRM. Manufacturers of these airplanes would also have to incorporate these design changes in airplanes produced in the future. In addition, design approval holders (TC and STC holders) and applicants would have to develop airworthiness limitations to ensure that maintenance actions and future modifications do not increase flammability exposure above the limits specified in the proposal. These design approval holders would have to submit binding compliance plans by a specified date, and these plans would be closely monitored by the design approval holders' FAA Oversight Offices to ensure timely compliance.

Lastly, the proposal would require affected operators to incorporate FRM or IMM for high-risk fuel tanks in their existing fleet of affected airplane models. The proposal would have applied to operators of airplanes under parts 91, 125, 121, and 129. Operators would also have to revise their maintenance and inspection programs to incorporate the airworthiness limitations developed under the NPRM. We also proposed strict retrofit deadlines, which were premised on prompt compliance by manufacturers with their compliance plans.

The NPRM contains the background and rationale for this rulemaking and, except where we have made revisions in this final rule, should be referred to for that information.

B. Related Activities

On November 28, 2005, the FAA published a Notice of Availability of Proposed Advisory Circular (AC) 25.981-2A, Fuel Tank Flammability, and request for comments in the

Federal Register

(70 FR 71365). The notice announced the availability of a proposed AC that would set forth an acceptable means, but not the only means, of demonstrating compliance with the provisions of the airworthiness standards set forth in the NPRM. On March 21, 2006, the FAA published a notice that extended the comment period as a result of an extension of the NPRM's comment period to May 8, 2006 (71 FR 14281).

C. Differences Between the NPRM and the Final Rule

As a result of the comments received and our own continued review of the proposals in the NPRM, we have made several changes to the proposed regulatory text. The majority of these changes will be discussed in the “Discussion of the Final Rule” section below. The following is a summary of the main differences between the NPRM and this final rule.

Design Approval Holders

. The design approval holder (DAH) requirements proposed in the NPRM as subpart I of part 25 are now contained in new part 26. This was done to harmonize with the regulatory structure of other international airworthiness authorities. We also revised the applicability for the retrofit requirement so the DAH requirements do not apply to airplanes manufactured before 1992. The effect of this change is that DAHs will not have to develop FRM or IMM for many older airplane models that do not have significant remaining useful life in passenger operations. We revised the compliance times for DAHs to

develop and make available service instructions for FRM or IMM by replacing specific compliance dates with a compliance time of 24 months after the effective date of this rule for all affected airplane models. We have also made some changes, discussed later, to the compliance planning sections of the DAH requirements.

Auxiliary Fuel Tanks

. We have learned that few auxiliary fuel tanks installed under STCs and field approvals remain in service, and we need to obtain additional information to decide whether the risks from these tanks justify retrofit requirements. Therefore, we have removed the requirements for an FRM or IMM retrofit for these tanks.

Impact Assessments

. We limited the requirement for impact assessments for auxiliary fuel tanks to airplanes with high flammability tanks for which an FRM is required (i.e., Heated Center Wing Tank airplanes).

All-Cargo Airplanes

. We retained the proposal to exclude all-cargo airplanes from the requirement to retrofit high flammability tanks with FRM or IMM. However, we added a requirement that when any airplane that has an FRM or IMM is converted from passenger use to all-cargo use, these safety features must remain operational. We also added a requirement that newly manufactured all-cargo airplanes must meet the same requirements as newly manufactured passenger airplanes. We revised § 25.981 to remove the exclusion of all-cargo airplanes so that any newly certificated transport category airplane, regardless of the type of operation, must meet the same safety standards.

Part 91 Operators

. The proposed rule would have applied to operators under part 91, which is limited to private use operations. However, the final rule does not include part 91 requirements.

Retrofit Requirements for Operators

. We have added a provision for air carrier operators that allows a one year extension in the compliance time to retrofit of their affected fleets if they revise their operations specifications and manuals to use ground conditioned air

when it is available. Instead of requiring retrofit for all airplanes with high flammability fuel tanks, we revised the operating rules to prohibit operation of these airplanes in passenger service after 2016 unless an FRM or IMM is installed. This approach gives operators the option of converting these airplanes to all-cargo service. We also prohibit the operation of airplanes with high flammability fuel tanks produced after 2009 unless they are equipped with FRM or IMM. This requirement parallels the proposed production cut-in requirement, but also applies to foreign manufactured airplanes. Finally, instead of requiring retrofit of high flammability auxiliary fuel tanks, we prohibit installation of auxiliary fuel tanks after 2016 unless they comply with the new requirements of § 25.981.

“Ground conditioned air” is temperature controlled air used to ventilate the airplane cabin while the airplane is parked between flights.

III. Discussion of the Final Rule

A. Summary of Comments

The FAA received over 100 comment letters to the proposed rule and guidance material. These letters covered a wide spectrum of topics and range of responses to the rulemaking package, which will be discussed more fully below. While there was much support for the general intent of the rule changes and the guidance material, there were several requests for changes and for clarification.

B. Necessity of Rule

1. Estimates/Conclusions Supporting Need for Rule

In the NPRM and its supporting documents, we noted several estimates and conclusions that we used to determine the necessity and content of this rule. We received comments on the following assumptions:

• The historical accident rate for heated center wing tank (HCWT) airplanes is 1 accident per 60 million hours of flight (before implementing corrective actions following TWA 800).

• That SFAR 88 and other corrective actions would prevent 50 percent of future fuel tank explosions.

• That Boeing and Airbus airplanes have an equal risk of an explosion.

• That a HCWT, depending upon the airplane model and its mode of operation, is explosive 12 to 24 percent of the time.

• That the rate of accidents directly correlates to flammability exposure.

Based on the comments received, we have changed the historical accident rate estimate to 1 accident per 100 million hours. This change does not affect our conclusion that the historical accident rate for HCWT airplanes supports the need for this rule. As for the other estimates and conclusions, we have not changed these in the final rule.

a. Historical (pre-TWA 800) Accident Rate

Airbus, the Air Transport Association (ATA), Alaska Airlines (Alaska), the Association of Asia Pacific Airlines (AAPA), the Association of European Airlines (AEA), Boeing, Cathay Pacific Airways (Cathay), Delta Air Lines (Delta) and FedEx stated that the historical accident rate of 1 accident every 60 million fleet operating hours was too high. Most of these commenters recommended a rate of 1 accident per 140 million hours. Their proposed rate is based on the number of accidents and the total fleet hours for heated center wing tank (HCWT) airplanes through 2005 (3 accidents over 430 million hours). Several of these commenters also noted that this rate is closer to the conservative estimate in the MITRE Corporation's assessment of the FAA's accident prediction/avoidance model (1 accident every 160 million hours).

The Mitre assessment of the FAA accident prediction methodology is included as Appendix H of the Initial Regulatory Evaluation and is available in the docket for this rulemaking (Document Number FAA-2005-22997-3).

Boeing proposed a rate of 1 accident every 100 million hours. Boeing's analysis also started with the number of accidents and the total fleet hours for HCWT airplanes through 2005. However, Boeing recognized that some of the improvement since 2001 may be attributable to the FAA/industry focus on ignition prevention and concluded that the rate of 1 accident every 100 million hours more accurately represents the pre-TWA 800 rate.

FedEx stated that, from a historical basis, 140 million hours would be a correct mean time between accidents. However, FedEx noted that a more conservative estimate closer to 100 million hours would still be acceptable.

In a related comment, ATA questioned our use of flight hours as the measure of exposure to risk. ATA noted that two of the historical accidents did not occur in flight. Therefore, flight hours may understate exposure and overstate risk. ATA concluded that these accidents support the use of block hours or some other measure that accounts for time on the ground (and would lower the accident rate by about 16 percent).

We agree that the accident rate used in the NPRM was too high and needs adjustment. While the rate of 1 accident every 140 million hours is correct if you only use the total fleet hours for HCWT airplanes through 2005, it fails to consider the beneficial effects of FAA/industry action following the TWA 800 accident. Since that accident, we have issued many ADs to address specific findings of unsafe conditions that could produce fuel tank ignition sources. In addition, the Fuel Tank Safety Rule, of which SFAR 88 was a part, was issued in 2001 to establish a systematic process for identifying and eliminating ignition

sources. Many of the improvements resulting from these actions have been implemented in the transport airplane fleet, and the improved safety record since TWA 800 is largely attributable to them. While the commenters acknowledge that these actions have been effective at preventing future accidents, most of them failed to reduce their proposed historical rate accordingly to address these benefits. In contrast, Boeing's recommended rate considers the benefits of these actions (which we calculate covers about 170 million hours).

We believe that an accident rate of 1 per 100 million hours is an accurate calculation of the historical accident rate before implementation of post-TWA 800 ignition prevention actions. Therefore, we used this rate in developing this final rule and its supporting documents. However, this change does not affect our conclusion that the historical accident rate for HCWT airplanes supports the need for this rule. We continue to believe that the risk of an accident is too high.

Several commenters referred to the rate in the MITRE Corporation's report (1 accident every 160 million hours). This rate includes operations of airplanes without HCWT. Recommendations resulting from MITRE's review included a suggestion that only fleet hours from airplanes with HCWT be used in the accident prediction model. We agreed with this recommendation and have adjusted the accident rate accordingly.

Finally, we do not agree with ATA's conclusion that the use of flight hours to predict future accidents results in an overstated risk. Both the past accident rate and the future predicted number of accidents were based upon the number of flight hours of airplanes with high flammability fuel tanks, and in both cases the number of flight hours does not include ground time. The ratio of flight time to ground time is unlikely to change significantly in the future because the average flight length and the amount of time spent on the ground before and after each flight are unlikely to change significantly. Therefore, whether past and future accident rates are stated in terms of flight time only or flight time plus ground time, the projected future accident rates would predict the same number of accidents over any given time period.

b. SFAR 88 Effectiveness Rate

In the NPRM and its supporting documents, we estimated that SFAR 88 would prevent 50 percent of future fuel tank explosions (although we also conducted a sensitivity analysis using effectiveness rates of 25 and 75 percent). ATA stated that the 50 percent effectiveness rate was without basis or explanation and recommended a rate of 90 percent. Airbus recommended an effectiveness rate in the range of 75 to 90 percent. If these higher rates are used, ATA and Airbus noted the safety benefits of the proposed rule are insufficient to justify the costs, and they requested that we withdraw the NPRM.

Predicting the effectiveness of ignition prevention actions is challenging, since many ignition sources are the result of human error, which cannot be precisely predicted or quantitatively evaluated. Despite extensive efforts by the FAA and industry to prevent ignition sources, we continue to learn of new ignition sources. Some of these ignition sources are attributable to failures on the part of engineering organizations to identify potential ignition sources and provide design changes to prevent them. Others are attributable to actions by production, maintenance, and other operational personnel, who inadvertently compromise wiring and equipment producing ignition sources. Regardless of the causes, we believe that ignition prevention actions, while necessary, are insufficient to eliminate ignition sources.

Based on the recently discovered ignition sources discussed earlier, we continue to believe that an assumed effectiveness rate of 50 percent is reasonable and appropriate. In its study on SFAR 88 effectiveness, Sandia National Laboratories concluded that our estimate of 50 percent was reasonable, and the value of 75 percent effectiveness assumed in the initial Aviation Rulemaking Advisory Committee (ARAC) report was overly optimistic. While the report of the ARAC Fuel Tank Inerting Harmonization Working Group

initially assumed an effectiveness of 75 percent, the report was later amended to use a range of effectiveness between 25 to 75 percent because of the uncertainty in predicting the effectiveness.

Document Number FAA-22997-6 in the docket for this rulemaking.

Finally, since ATA did not submit any data to substantiate that a higher effectiveness rate is more reasonable, we believe the post-SFAR 88 service experience supports the use of a range of effectiveness between 25 to 75 percent and a median value of 50 percent.

c. Boeing and Airbus Airplanes Have an Equal Risk of an Explosion

We concluded that all airplanes with HCWT had similar levels of fuel tank flammability and the associated increase in the likelihood of a fuel tank explosion. We based the SFAR 88 effectiveness estimates on the HCWT fleet as a whole. We did not differentiate among airplane models based upon design differences that could affect the likelihood of an ignition source forming.

AEA, Airbus, Frontier Airlines (Frontier), the Air Safety Group UK, Singapore Airlines (Singapore), BAE Systems (BAE), TDG Aerospace (TDG) disagreed with this proposal and argued that the risk of an explosion is lower for Airbus airplanes. These commenters noted that fuel tank designs for those airplanes that experienced a fuel tank explosion are at least a decade older than Airbus' designs. Airbus argued that its airplanes use newer technology and design philosophies that have incorporated the lessons learned from prior designs. BAE and two individuals suggested that we address fuel tank flammability by issuing ADs to address specific design shortfalls in the two airplane types that have experienced fuel tank explosions (i.e., the Boeing 737 and 747 series airplanes).

While we did note differences between the designs and technologies used by Boeing and Airbus, we concluded that the risk of an explosion was equal for Boeing and Airbus airplanes based on similarities in their fuel tank designs and service history. We found that both manufacturers have similar problematic fuel tank design features. For example, air conditioning equipment is located below the center wing tank in both manufacturers' designs (and HCWT have flammability exposure well above that of a conventional unheated aluminum wing tank). Likewise both manufacturers locate fuel gauging systems with capacitance measuring probes inside the fuel tank, and associated wiring to the probes enters the fuel tank from outside. These wires are co-routed with high-energy wiring to other airplane systems that have sufficient energy to cause an ignition source inside the fuel tanks. Finally, high-energy electrical fuel pumps are located within the fuel tanks and are fuel-cooled and manufactured by the same component suppliers. Arcing of the pump could cause a spark inside the fuel tank or could create a hole at the pump connector, causing a fuel leak and an uncontrolled fire outside of the tank.

As for the service history and design reviews of Airbus airplanes, we found numerous situations that indicate a risk of an explosion similar to those aboard Boeing airplanes, including:

• The electrical bonding straps used on Airbus airplanes have been reported

to degrade due to corrosion; the bonding jumpers used by Boeing are made of a different material that does not corrode.

• All fuel pumps on Boeing airplanes are being modified to incorporate ground fault power interrupters, whereas only pumps that can arc directly into the fuel tank ullage are being modified to incorporate ground fault power interrupters on Airbus airplanes.

• The safety assessments conducted by both manufacturers resulted in very similar numbers of ignition sources that required modifications to their airplanes.

• After the SFAR 88 assessments were completed, we learned that fuel quantity indicating probes within the fuel tanks of Airbus A320 airplanes could be an ignition source due to sparks that could be created following a lightning strike. This resulted in the issuance of AD 2006-06-14.

• After the SFAR 88 assessments were completed, we learned that the improper installation of a screw inside the fuel pumps of Airbus A320 airplanes could result in the screw loosening and falling into the pump electrical windings. This could create a spark and ignite vapors in the pump that could exit the fuel pump housing into the fuel tank through the hole created when the screw fell out of the housing. This resulted in the issuance of AD 2006-12-02.

The recent discovery of the ignition sources in Airbus A320 airplanes is evidence that unforeseen failures will occur in the future that can result in ignition sources on Airbus airplanes. The Airbus fleet has significantly fewer flight hours than Boeing airplanes and, as the Airbus airplanes age, we expect to see more unforeseen failures. Therefore, based on design similarities and service history, we see no reason to differentiate between Airbus and Boeing airplanes. This rule requires all affected manufacturers to determine the fuel tank flammability exposure of their airplanes by assessing them against performance-based requirements that specify a flammability exposure that we have determined provides an acceptable level of safety. Additional action is only required for those airplanes that do not meet the required level of fuel tank flammability safety.

d. ARAC Flammability Exposure Data

Airbus and AEA both commented that the ARAC flammability exposure data cited in the NPRM are incorrect and need to be reduced based on updated data developed by both Boeing and Airbus. They said this reduction is important since the lower data reduce the level of safety improvement that can be achieved by this rule from the FAA's intended “order of magnitude” (factor of 10) to a safety improvement in the range of only a factor of 7.7 to 2.7, depending on the model used. Airbus also objected to our conclusion that a HCWT, depending upon the airplane model and its mode of operation, is explosive 12 to 24 percent of the time. Airbus requested that this be corrected to reflect the latest industry estimates for Airbus products (i.e., 8 to 12 percent) and 16 to 18 percent for other manufacturers.

We acknowledge that the flammability exposure data cited in the NPRM may not reflect current values. However, Boeing and Airbus submitted those data to us as part of the SFAR 88 reviews. While we agree with Airbus that more recent information has indicated lower flammability for HCWTs, we do not agree that the more recent values should be used since the manufacturers have not submitted a validated analysis using the revised flammability assessment techniques (as defined in § 25.981) to support its figures. Changes to the method for calculating fuel tank flammability, such as airplane ground times used in the Monte Carlo analysis required by Appendix N may result in additional variations in flammability calculations. Since flammability reduction was first considered by the aviation industry, the flammability values quoted by airplane manufacturers have varied considerably. These variations were the result of the method used to calculate the flammability of the fuel tanks and more accurate fuel tank temperature data based upon flight tests. For example, the first ARAC determined values ranged from 10 to 50 percent for generic airplanes equipped with HCWT. After the conclusion of this activity, Airbus was quoted in

Air Safety Week

as stating the A310 HCWT having a flammability exposure of 4 percent. In 2001, as part of the SFAR 88 compliance, Airbus submitted flammability values to the European Aviation Safety Agency (EASA) and to us that ranged between 12 and 23 percent.

We recognize that as methods for measuring fuel tank flammability are refined, it is likely that calculated flammability exposure will also change. These refinements also apply to the conventional unheated aluminum wing tanks that ARAC used as the baseline for determining an acceptable exposure. We now know that the exposure of these tanks is considerably lower than originally estimated by ARAC. However, none of this new information changes the findings of ARAC that HCWTs have significantly higher risk of fuel tank explosions, or that the reduction in flammability exposure would be on the order of a factor of 10. Therefore, we do not believe that these refinements change the overall conclusion that certain fuel tanks that are affected by this rule have significantly higher flammability exposure than conventional unheated aluminum wing tanks. No change has been made to the final rule as a result of these comments.

e. Accidents Directly Correlate to Flammability Exposure

Airbus did not agree with the assumption that the rate of accidents directly correlates to flammability exposure. Airbus contended that the risk of ignition source development must also be considered when evaluating the benefits of flammability reduction.

We agree with Airbus that the overall risk of a fuel tank explosion includes both the potential for an ignition source and the likelihood that the fuel tank will be flammable when an ignition source occurs. There may be differences in the likelihood of an ignition source occurring between different airplane types, but these differences would be very difficult to quantify. We have no statistically significant, validated data that could be used to establish rates of development of ignition sources for different airplane types. As discussed in the Sandia report, there is a wide variation in the predicted rate of ignition sources developing in fuel tanks and there is no industry agreement on the rate that should be used for individual airplane designs. In addition, recent service history shows there have been a number of ignition sources that have developed following the TWA 800 accident in both Airbus and Boeing airplane models.

Given this lack of data and consensus on ignition source risks, we continue to believe that correlating accident rates with flammability exposure is the most appropriate analytical approach.

2. Additional Research Needed

Airbus, AAPA, AEA, EASA, Iberia Maintenance and Engineering (Iberia), Singapore and Virgin Atlantic Airways (Virgin) stated that this rulemaking is premature because the risks of additional fuel tank explosions are not adequately defined. These commenters argued that additional research is necessary to better understand flammability, SFAR 88 effectiveness and the risks of additional explosions. In a related comment, the International Federation Victims of Aviation Accident (IFVAA) stated that additional research should be performed to identify

technology that would completely eliminate, not just reduce, fuel tank flammability.

We think it would be a mistake to delay this rule to conduct additional research. Service history and the recent occurrences of ignition sources described earlier demonstrate that the risk of future explosions remains significant. In addition, we believe that additional research would not provide any useful information that would change our finding that flammability reduction, in combination with the SFAR 88 measures, is needed to prevent such explosions. As for IFVAA's comment, we consider existing flammability reduction means highly effective and sufficient to reduce the risk of fuel tank explosions to an acceptable level. While further research might identify even better solutions, the resulting delay would deprive the public of the benefits of these currently available safety improvements.

3. Consistent Safety Level With Other Systems

Airbus commented that SFAR 88 improvements, together with the current rate of occurrence, put fuel tank safety on the order of one accident for every billion flight hours (i.e. 10

−9

accidents per flight hour) which is consistent with safety objectives of other critical airplane systems.

Airbus argued that this rule requires fuel tanks to go to a higher level of safety than other critical systems and that this is inconsistent with the overall risk.

This is the quantitative probability measure (one in one billion) of an event that is “extremely improbable” as that term is used in § 25.1309 and other part 25 airworthiness standards. See AC 25.1309.

Application of existing safety standards to prevent ignition sources that are similar to those applied to other systems has not resulted in an acceptable level of safety, and we have determined that limiting fuel tank flammability is also needed. Fuel tank explosions are unacceptably occurring at a rate greater than 10

−9

per flight hour and the recent events described above show that unanticipated failures continue to result in ignition sources within airplane fuel tanks. To protect the flying public, we have developed a “fail safe” policy for fuel tank safety that includes both ignition prevention and flammability reduction to reduce fuel tank explosion risk to an acceptable level.

4. Human Errors

AEA stated that human errors are not new and should not be used to justify this rule. AEA pointed out that TC holders are obliged to consider human error during airplane design to mitigate errors. In addition, continuing airworthiness instructions (e.g., maintenance manuals) highlight safety considerations where necessary. AEA also contended that, in the 17 accidents cited by the FAA in the NPRM, there is no evidence that any were caused by the introduction of an ignition source through human error. Finally, AEA noted that human errors will always be a factor in aviation safety, particularly when introducing added complexity such as an inerting system.

We agree with AEA that human errors are not a new phenomenon and that the introduction of new systems on airplanes can have unintended consequences resulting from human error. We also believe the safety benefits of FRM or IMM is warranted. Service history shows the current regulations do not provide an adequate mitigation of human errors for fuel tank systems. Ignition sources continue to occur even though designers have conducted analyses that concluded ignition sources would not occur. Earlier in this document, we discussed numerous ignition sources that have recently developed in airplanes that had previously been shown by safety assessments to have features that would prevent ignition sources from developing. These ignition sources were caused by errors in defining assumptions in safety assessments, as well as in the design, manufacture and maintenance of these airplanes. These events show that an additional layer of protection (in the form of FRM or IMM) is needed to prevent future fuel tank explosions.

5. Explosion Risk Analysis

American Trans Air commented that the assumptions made in the explosion risk analysis were erroneous and not within the range of reasonable values. American Trans Air recommended that a completely new analysis of the fuel tank explosion risk be undertaken. This new analysis should utilize widely accepted assumptions, including taking into account:

• The history of particular type designs.

• The actual ignition risk potential (i.e., potential ignition sources not in the ullage are either exempted, or substantially discounted in the analysis).

• Actual ignition energies, applying these energies to the potential ignition sources.

• The definitions and assumptions of fuel-air vapor mixtures that have been further derived and applied on an individual type design basis.

We agree with the commenter that the assumed fuel air vapor mixture should be based upon the individual fuel tank design, and we included variations in the pressure and temperature of the fuel when developing the fuel tank flammability model. This factor is already accounted for in the Monte Carlo method defined in Appendix N. As for the other assumptions offered by American Trans Air, they cannot be used in an analysis, because there is a wide variation in the possible values.

6. Special Certification Review Process vs. Rulemaking

American Trans Air commented that if an analysis identifies type designs still found to have unacceptable risk after all SFAR 88 alterations have been executed, an appropriate response to address the remaining at-risk type designs may be the use of the special certification review process. American Trans Air noted that there appears to be wide variability in the risk between type designs, and concluded that generalized rulemaking is inappropriate at this time.

We do not agree that we should address each type design with unacceptable flammability risk by special certification review and then by an appropriate AD. Through careful study, we have determined that the flammability risk on many airplanes is too high. To address this risk, we have created an objective design standard by which all airplanes can be measured. If airplanes currently meet this design standard, no action will be required. The TC holder for those airplanes that do not meet it will have to make only those changes that bring that airplane model into compliance. We have determined that the uncertainty involved in the elimination of ignition sources requires reduced flammability to acceptably reduced tank explosion risk, and the most effective and efficient way to address this issue is through the rulemaking process.

7. Flammability Reduction Means (FRM) Effectiveness

In the NPRM, we said lowering the flammability exposure of the affected fuel tanks in the existing fleet and limiting the permissible level of flammability on new production airplanes would result in an overall reduction in the flammability potential of these airplanes of approximately 95 percent. Airbus and AEA commented that we overstated the potential benefits of flammability reduction measures by a factor between 4 and 7. They said we used a factor of 20 (95 percent) for the

reduction in flammability exposure achieved by reducing the flammability of HCWT to 3 percent or less. They said the subsequent reduction in flammability will be in the order of a factor of three to five and not a factor of 20. Therefore, the number of accidents prevented would consequentially be less than projected by the FAA. Airbus also said the FAA appears not to have considered the effectiveness of the FRM itself, which it said is in the order of 67 to 87 percent by latest industry estimates. Therefore, Airbus suggests that the Initial Regulatory Evaluation (IRE) is incomplete and should be revised to include this key parameter.

The 95 percent value used in the NPRM was not based on the ratio of fuel tank fleet average flammability exposure before and after implementing the requirements of this rule. It was derived by qualitatively evaluating the effectiveness of an FRM in preventing fuel tank explosions that would not be prevented by ignition prevention measures.

When an FRM is installed on a fuel tank, it must meet both the 3 percent fleet average flammability exposure and also the 3 percent warm day (specific risk) flammability exposure requirements.

For the warm day requirement, the flammability exposure must be below 3 percent during ground and takeoff/climb conditions for those days above 80 degrees F when the FRM is operational. These are the conditions when fuel tanks tend to have the highest flammability exposure and when the accidents discussed earlier occurred.

The overall time the fuel tank is flammable cannot exceed 3 percent of the Flammability Exposure Evaluation Time (FEET), which is the total time, including both ground and flight time, considered in the flammability assessment defined in proposed Appendix N. As a portion of this 3 percent, if flammability reduction means (FRM) are used, each of the following time periods cannot exceed 1.8 percent of the FEET: (1) When any FRM is operational but the fuel tank is not inert and the tank is flammable; and (2) when any FRM is inoperative and the tank is flammable.

The combination of the warm day requirement and the fleet average flammability requirement results in an FRM with overall flammability reduction benefits that are significantly higher than those estimated by the commenters. Since the NPRM was issued, we have reviewed and approved FRM designs and have found the performance exceeds the certification limits. When the FRM is operating, the fuel tanks are rarely flammable. So, the major risk of fuel tank flammability occurs when the system is inoperative and this time is limited to a maximum of 1.8 percent of the Flammability Exposure Evaluation Time (FEET). Historically, designers provide a safety margin in the design so that the design limits are never exceeded, so we would expect the flammability to be below this level.

Another consideration in using a 95 percent effectiveness measure is the safety improvement noted during warm days. Without any FRM, a HCWT is flammable about 50 percent of the time during climb. Meeting both the 3 percent warm day requirement and the 3 percent reliability requirement results in a flammability exposure of the tank of less than half of one percent during climb. For an airplane with an initial warm day flammability of 50 percent, this is a 99 percent reduction in the flammability during climb. We, therefore, used the 95 percent effectiveness for flammability reduction in the risk model for the final regulatory evaluation.

C. Applicability

1. Airplanes With Fewer Than 30 Seats

The proposed DAH requirements would apply (with some exclusions) to transport category turbine-powered airplanes approved for a passenger capacity of 30 or more persons or a maximum payload capacity of 7,500 pounds or more. The UK Air Safety Group disagreed with the proposed rule's limited applicability because the design of fuel tank systems is similar for both large and small airplanes. Therefore, it argued that the potential explosion hazard is equal. The commenter also noted that EASA's CS-25 regulation for Fuel Tank Ignition Prevention does not make any distinction based on the number of passenger seats.

We did not include smaller part 25 airplanes in the DAH requirements of this final rule because those airplanes generally do not have high flammability tanks. While some parts of their fuel tank system designs are similar to those of larger airplanes, we do not agree that the overall architecture and the risk of a fuel tank explosion are equal. Data submitted by manufacturers of smaller part 25 airplanes as part of the SFAR 88 analysis show that their airplanes typically do not have fuel tanks located within the fuselage contour, and would not be considered high flammability fuel tanks. In most cases, cool fuel from the wing tanks is drawn into the center wing box, so the overall flammability is low. In addition, these tanks are not normally emptied, reducing the amount of ullage.

Based on these facts, the benefits of including these smaller airplanes in all of the requirements of this rule are minimal and do not warrant the cost. However, we do agree that the part 25 requirements applicable to new type designs should be the same for all transport category airplanes, regardless of size. The cost to design and produce a new airplane to meet the flammability requirements is significantly less than that for existing airplanes since the designers can optimize the performance of the FRM or IMM and integrate it into the airplane design to minimize costs. Therefore, § 25.981 of this rule applies to all transport category airplanes regardless of size.

2. Part 91 and 125 Operators

The NPRM proposed that operators under parts 91, 121, 125, and 129 incorporate FRM or IMM and keep it operational on their affected airplanes. The AEA and Airbus asked that parts 91 and 125 operations be excluded and cited corporate use airplanes as an example of operations where the cost would far exceed the benefit. According to AEA and Airbus, the cost/benefit analysis for these airplanes, when operated under part 91 or part 125, would produce results similar to those for all-cargo airplanes (which are excluded from the retrofit requirements of this rule).

We recognize a distinction between part 91 and part 125 operations, in that part 91 does not allow commercial operations for compensation or hire, while part 125 does allow such operations, as long as the operator does not “hold out” to the public that they are available for such operations (in which case they would be required to operate as an air carrier). For example, many business jets are operated under part 91 if the operator does not receive compensation for transporting passengers (e.g., a corporate jet transporting the corporation's employees). On the other hand, charter companies frequently operate under part 125 to transport sports teams and other groups for compensation.

While we recognize that private owners and operators may choose to assume the risk of possible fuel tank explosions, we see no reason why persons flying on commercial charter flights should be exposed to a greater risk of a fuel tank explosion than passengers flying on airplanes operated under parts 121 and 129. Commercial charter passengers are in no better position to recognize and accept the risk of a fuel tank explosion than are air carrier passengers. Additionally, the risk and likelihood of a fuel tank explosion are potentially commensurate with that of the same airplane model operated

under parts 121 and 129. Therefore, the final rule has been revised to exclude part 91 operations, but does not exclude part 125 operations. However, because of the significant safety benefits of this rule, we encourage part 91 operators to install FRM on their airplanes, and not to remove it if it is already installed.

3. All-Cargo Airplanes

In response to our request for comments on the proposed exclusion of all-cargo airplanes from this rulemaking, we received numerous comments both supporting and opposing the exclusion. Airbus, the Cargo Airline Association (CAA), FedEx, ATA, ABX Air (ABX), United Parcel Service (UPS), and National Air Carrier Association (NACA) agreed that all-cargo airplanes should be excluded from this rulemaking. The CAA argued that the risks are lower for cargo carriers due to several factors:

a. Cargo operations are predominately night operations with lower outside ambient temperatures (making fuel tanks less likely to be flammable).

b. Cargo operators do not typically run air conditioning packs prior to takeoff as many passenger operators do.

c. The CAA members typically operate one to two round trips each day, which is a lower utilization rate than most passenger airplanes.

The CAA stated that costs to various airline industry segments should be considered when proposing any new regulation. The CAA supported establishing a safety baseline which allows different operations to meet the baseline in different ways. Based on the factors articulated above, the CAA maintained the cost/benefit analysis does not justify its application to cargo airplanes.

FedEx commented that there is a finite amount of safety dollars and it is important to use them effectively. As the cost/benefit analysis does not justify inclusion of all-cargo airplanes, FedEx claimed it is not permissible to include them under FAA rulemaking authority. ATA stated that the proposed rule should not apply to all-cargo airplanes, other than the design rules proposed to prevent modifications that could increase the flammability exposure of a fuel tank. ABX agreed with ATA, and noted that the ignition prevention measures of SFAR 88 provide an acceptable level of safety for these airplanes. Finally, Airbus and UPS based their support for our proposal to exclude cargo airplanes on the reasons stated in the NPRM.

On the other hand, the National Transportation Safety Board (NTSB), the Independent Pilots Association (IPA), the Air Line Pilots Association (ALPA), the EASA, the Coalition of Airline Pilots Association (CAPA), Singapore and the National Air Traffic Controllers Association (NATCA) do not agree that all-cargo airplanes should be excluded from this rulemaking. While the NTSB, IPA and NATCA acknowledged that cargo airplanes typically carry fewer people, they pointed out that these airplanes regularly use airports in densely populated areas where an accident could have a catastrophic effect for people on the ground. The NTSB and IPA also cited a recent DC-8 cargo fire accident where an inerting system might have prevented or substantially reduced the magnitude of the fire, and a C-5A accident at Dover Air Force Base where the presence of an inerting system may have been the reason many lives were saved.

The IPA also stated that there should be one level of safety for all part 25 airplanes, and noted that all-cargo airplanes are typically older (which makes them more susceptible to ignition sources within the tank). In addition, ADs are being issued on even the newer models to restrict operations for flammability/ignition concerns.

ALPA commented that all-cargo airplanes should not be excluded from critical safety improvements simply because there are fewer fatalities in a typical crash. ALPA recommended that we apply a firm deadline for the manufacturers to complete a flammability analysis on all-cargo airplanes compared to the passenger versions of the same airplane model.

EASA did not agree with introducing a new distinction among part 25 products. In EASA's view, the justification for excluding all-cargo airplanes has yet to be substantiated. CAPA thought the logic of excluding all-cargo airplanes could be extended to each individual operator or to all airplanes with differing passenger capacities. For example, CAPA questioned whether, if operator “A” had many more Boeing 737 airplanes than operator “B”, would we require Operator “A” to use FRM while Operator “B” would not have to. CAPA stated that this same type of flawed logic is being applied to all-cargo airplanes. In its opinion, the value of pilot lives should not depend on what is in the back of the airplane. Finally, NATCA commented that confidence in flying would be diminished if there were a cargo airplane accident, and we should not set a precedent that sets a different safety standard based on the intended operation of the airplane.

Boeing stated that its safety philosophy is to not differentiate between passenger and cargo airplanes in managing fleet-wide airplane risk and therefore, did not exclude airplanes designed solely for cargo operations in their proposed revision to § 25.981(b).

After reviewing these comments, we have decided that we will not require existing all-cargo airplanes to meet the retrofit requirements in this final rule. We did not receive any data on the costs, benefits or risks for all-cargo airplanes in response to our request in the NPRM, and we do not have any new data to justify requiring retrofit of FRM or IMM on the current fleet of all-cargo airplanes. We will continue to gather additional data regarding these factors and may initiate further rulemaking action if the flammability of these airplanes is found to be excessive.

However, we will require compliance with the requirements of this final rule for (i) future designs; (ii) the conversion of any passenger airplane with an FRM or IMM to all-cargo use; and (iii) future production of all-cargo airplanes. We agree with NATCA and other commenters with respect to removing the exclusion from § 25.981 of airplanes designed solely for all-cargo operations. The airworthiness standards of part 25 do not impose different requirements depending on the intended use of the airplane. 49 U.S.C. 44701 requires that we adopt such minimum airworthiness standards as are necessary, and historically we have recognized that those minimum standards should be the same for all transport category airplanes, regardless of their intended use. There are practical reasons for this approach, since the intended use can change quickly based on business considerations unrelated to safety. Therefore, we agree that the proposed new design standards in part 25 should not distinguish between all-cargo and passenger airplanes.

The rationale for including a production cut-in for all-cargo airplanes is based upon the long-term goal of fleet-wide reduction in flammability exposure to eliminate the likelihood of fuel tank explosions. In addition to the immediate effects of an accident, we believe a fuel tank explosion on an all-cargo airplane could have a significant impact on the aviation industry due to public sensitivity to terrorist actions. The cost of installing FRM in new production airplanes is less than the cost of to retrofit airplanes, because the installation can be efficiently integrated into the production process. In most cases, this integration will be done for the passenger version of the same airplane, so additional engineering work will be minimal. The benefits of production cut-in are also higher than

for retrofit since the new airplane has a longer life and reduced flammability will provide safety benefits for the life of the airplane.

As for conversion airplanes, when older airplanes can no longer be operated competitively in passenger service, it is common for them to be converted to all-cargo service. Since many passenger airplanes will have FRM or IMM already installed as a result of this rule, operators may be inclined to deactivate or remove the FRM or IMM to reduce operational costs, if these airplanes are converted to all-cargo airplanes in the future. We do not believe it would be in the public interest to allow previously installed systems to be deactivated because the capital cost to install the systems would already have been incurred, and the safety benefits of retaining the system would outweigh any cost savings that might result from deactivating them. Accordingly, we have revised the operational rules to prohibit deactivation or removal of FRM or IMM under this scenario.

The regulatory evaluation for this final rule has been revised to address these factors and concludes that imposing these requirements on all-cargo airplanes is cost effective for new designs and newly produced all-cargo airplanes. Prohibiting deactivation of FRM or IMM on converted airplanes is also cost effective.

4. Specific Airplane Models

Proposed § 25.1815(j) listed specific airplane models that would be excluded from the requirements of proposed § 25.1815 (now § 26.33). These are airplane models that, because of their advanced age and small numbers, would likely make compliance economically impractical. In the NPRM, we asked for comments on other airplane models that may present unique compliance challenges and should be excluded from the requirements of this rule. In response to this request, we received several comments requesting that additional specific airplane models be excluded from this rule. Given the number of models identified, we have decided it makes more sense to “grandfather” all models manufactured before a certain date. Based on these comments, we have changed the applicability of the design approval holder requirements in proposed § 25.1815(a) (now § 26.33(a)) from those airplanes type certificated after January 1, 1958 to those airplanes produced on or after January 1, 1992.

a. Out-of-Production/Low Service Life Remaining Models

Boeing and Airbus recommended that the rule only apply to airplane models and auxiliary tanks currently in production, or recently out-of-production, that have significant numbers in service and will continue in service well beyond the date when 100 percent compliance is achieved. Based on this standard, Boeing submitted a list of airplane models and auxiliary tanks to add to the excluded models in proposed § 25.1815(j), including the DC-8, DC-9, DC-10, MD-80, MD-90, MD-11, Boeing 707, 720, 727, 737-100/-200, 747-100/-200/-300 and associated derivatives, and 737-300/-400/-500 (auxiliary tanks only). Airbus requested that the Airbus A300/A310 series airplanes be added to the list based on this standard.

We acknowledge that there is no reason to require design approval holders (DAHs) to develop design changes for airplanes that will be retired before FRM or IMM installation is required by this rule. Conducting the flammability assessments and developing design modifications for those airplanes would require significant engineering resources. More importantly, these airplanes would not benefit from the development of FRM or IMM, since they would be retired or converted to cargo operations before the installation of these systems is required. Therefore, we have limited the applicability of the DAH requirements in the final rule (proposed § 25.1815(a), now § 26.33(a)) to airplanes produced on or after January 1, 1992.

The youngest of the airplanes produced before then would be more than 25 years old by the time operators would be required to modify them. We agree with the commenters that the vast majority of these airplanes would either be retired or converted to cargo service before they reach that age. This is consistent with current practice. This limitation has the effect of excluding the Boeing 707, 727, 737-100/200 and 747-100/200/300; the McDonnell Douglas DC-8, DC-9, DC-10, and KC-10/KDC-10; and the Lockheed L-1011. Airplanes of the other models that Boeing, Airbus and ATA requested be excluded have been produced on or after January 1, 1992. For airplanes produced on or after January 1, 1992, the remaining life and likelihood of their continued operation in passenger service is sufficient to require compliance with the requirements of this rule.

To clearly differentiate between airplanes produced before and after this date, we changed proposed § 25.1815(a) (now § 26.33(a)) to refer to the date when “the State of Manufacture issued the original certificate of airworthiness or export airworthiness approval.” This information is readily available to the TC holders who applied for these approvals. We also added a provision to proposed § 25.1815(d) (now § 26.33(d)) to require the service information describing FRM or IMM to identify the airplanes that must be modified under this rule. This will make it readily apparent to operators which of their airplanes are subject to the retrofit requirements.

For airplanes with high flammability tanks produced before 1992, instead of requiring operators to retrofit these airplanes, we have added a provision in the operational rules prohibiting passenger operations of these airplanes after the date by which an operator's airplanes that are subject to the retrofit requirement must be retrofitted.

This enables operators to convert these airplanes to cargo service rather than to retrofit them. If operators of these airplanes choose to operate them in passenger service past this date, they could contract with the DAH or a STC vendor to develop an FRM or IMM to meet the safety requirements of this rule. Without this provision, the exclusion of airplanes produced before 1992 could have the unintended consequence of encouraging operators to continue to operate these airplanes with high flammability tanks in passenger service, since the retrofit and operating costs of FRM or IMM would not have to be incurred.

As discussed later, we are also adding a provision that allows operators under parts 121 and 129 to extend the compliance date by one year based on use of ground conditioned air. Operators using this extension will be able to operate these pre-1992 airplanes in passenger service until they are required to have all of their post-1991 airplanes retrofitted.

These changes to the DAH and operational rules have the effect of making the applicability of these requirements different. The DAH requirements now only apply to airplanes produced on or after January 1, 1992, but the operational rules still apply to all airplanes meeting the applicability criteria proposed in the NPRM.

Therefore, we have revised the applicability provisions of the operational rule sections to incorporate these criteria, rather than referencing the applicability of the DAH rules.

With certain listed exceptions, transport category turbine-powered airplanes type certificated after January 1, 1958, with a maximum passenger capacity of 30 or more or a maximum payload capacity of 7,500 pounds or more.

As for Boeing's request to exempt certain auxiliary fuel tanks, as discussed

later in more detail, we have retained the requirement to conduct flammability assessments and impact assessments for auxiliary fuel tanks. However, we have delayed any action to require retrofit of IMM or FRM for auxiliary fuel tanks installed under STCs and field approvals until additional information can be gathered. We agree with Boeing that any auxiliary fuel tank installed in pre-1992 airplane models should also be excluded from the need to conduct flammability assessments, since we have determined we would not take action against any tank in these airplane models due to their advanced age.

b. Limited U.S. Inventory Models

Airbus requested that airplanes having a limited U.S. inventory be excluded from this rule, because the operators of these airplanes would shoulder a disproportionate impact of non-recurring engineering expenses needed to design and develop FRM systems. Under this standard, Airbus asked that the A330-200 (only 11 N-registered airplanes) and the A340 (no N-registered airplanes) be added to proposed § 25.1818(j). We cannot agree with the Airbus suggested approach. We have no way to predict future market conditions in the United States for the A330-200 and A340 model airplanes. Airbus continues to sell these models and lessors continue to offer them for lease. Based on market conditions, U.S. operators may add these models to their fleets in larger numbers and we see no reason why persons flying on these airplanes should be exposed to a greater risk of a fuel tank explosion. Therefore, we are not excluding these airplane models from the requirements of this final rule.

c. Airbus A321

Airbus and ATA suggested the A321 should be excluded because this model does not have fuel pumps in the center wing tank, reducing the risk of a fuel tank explosion. The lack of fuel pumps does not adequately mitigate the risk of an explosion. There are numerous potential ignition sources inside fuel tanks that can result from failure of various components, including the fuel quantity indication system, motor driven valves, fuel level sensors, and electrical bonds. In addition, heating of the fuel tank walls by external heat sources introduces a concern that the hot surface could ignite the vapors in the tank. The justification provided for excluding this model (because the center tank does not have motor driven pumps located in the tank) does not address the overall fuel tank safety issue and would only have merit if fuel pump failures were the only potential ignition sources. Therefore, we are not excluding this airplane model from the requirements of this final rule.

d. Airplanes With Low Flammability Tanks

The proposed retrofit limit for an acceptable fleet-wide average flammability exposure was 7 percent. We determined that fuel tanks having a flammability exposure greater than 7 percent are high flammability tanks that present a greater risk for fuel tank explosion. American Trans Air commented that, we stated in the NPRM that some airplanes have center tanks with a fleet average flammability exposure that does not exceed 7 percent, including “the Lockheed L-1011, and Boeing MD-11, DC10, MD80, and Boeing 727, and Fokker F28 MK100.” American Trans Air stated that this implies that we have information in our possession indicating that these airplane models already meet the proposed flammability limits, and asked that we add these models to the list of excluded airplanes in proposed § 25.1815(j) (now § 26.33).

As we discussed above, we have limited the applicability of the DAH requirements in § 26.33 to airplane models produced on or after January 1, 1992. This date excludes the Boeing Model 727, DC-10 and the Lockheed L-1011. The other airplane models mentioned by the commenter have airplanes produced after 1991 and would be covered by this rule.

The statement quoted by American Trans Air from the NPRM was based on previous flammability assessments provided to us for SFAR 88 compliance. These assessments were based upon simplified assessment methods. For airplanes produced after January 1, 1992, we have retained the requirement to conduct flammability assessments on these airplanes to ensure that the earlier assessments are correct and that design changes for these tanks are not necessary. Once the assessment has been made, a manufacturer or operator may not need to make any change to the airplane. This is because the flammability risk assessment may disclose a level of risk below the threshold required for modification. As discussed earlier, we are allowing a qualitative assessment for conventional unheated aluminum wing tanks, which will substantially reduce the burden for completing the flammability assessments.

5. Wing Tanks

a. General

Proposed § 25.981 does not apply the same flammability standard to all fuel tanks, and requires lower flammability limits for “fuel tanks that are normally emptied and located within the fuselage contour.” The NTSB expressed concern that wing fuel tanks have exploded, and noted that its safety recommendations were not limited to:

(1) Certain types of fuel tanks,

(2) Tanks with specific types of exposure, or

(3) Tanks with explosive risks that vary or lessen over time.

The NTSB stated that we should take action to prevent all tanks from having flammable fuel-air mixtures in the ullage. The NATCA agreed, and stated that, to achieve an acceptable level of safety, the requirements of § 25.981 that apply to new airplanes should establish the same flammability standard for all fuel tanks regardless of location. The NATCA supported this suggestion by referencing the ARAC accident summaries that showed 8 out of 17 fuel tank explosions have involved wing tanks. The ALPA also expressed concern that certain wing designs and system installations may result in internal heating of the wing structure and ultimately the wing fuel tanks. The ALPA stated that we must insist that those specific installations fall under the requirements of this rule and that no unsafe flammability exposure exist in those wing tanks.

In contrast, Embraer, Bombardier Aerospace (Bombardier), and American Trans Air opposed incorporation of new flammability standards for conventional wing tanks. Embraer stated the benefits would be negligible and would not justify the costs. Embraer maintained that service history provides ample evidence that conventionally designed wing tanks inherently provide sufficient protection from fuel tank ignition when conventional fuels are used and that the current requirements are adequate. American Trans Air commented that many twin engine airplane type designs utilize a common fuel system operational concept that results in low exposure to high energy ignition sources in the main wing tanks. This exposure is further reduced in airplanes operated in extended-range twin-engine operations (ETOPS) service, due to the increased fuel reserves required in these operations.

The service history of conventional unheated aluminum wing tanks that contain Jet A fuel indicates that there would be little safety benefit by further limiting the flammability of these tanks. While NATCA and the NTSB expressed concern because accidents have occurred in wing fuel tanks, they did not differentiate service experience based on fuel type used (JP-4 versus Jet

A). Our review of the nine

wing tank ignition events shows that 5 of the 9 airplanes were using JP-4 fuel and this type fuel is no longer used except on an emergency basis in the U.S. Three of the remaining four events were caused by external heating of the wing by engine fires, and the remaining event occurred on the ground during maintenance. To date, there have been no fuel tank explosions in conventional unheated aluminum wing tanks fueled with Jet A fuel that have resulted in any fatalities. The flammability characteristics of JP-4 fuel results in the fuel tanks being flammable a significant portion of the time when an airplane is in flight. This is not the case for wing tanks containing Jet A fuel. Therefore, a conventional unheated aluminum wing tank (that quickly cools in an airplane model approved for Jet A fuel) would not require FRM or IMM.

As discussed previously, on May 6, 2006, a ninth wing tank ignition event occurred.

As proposed, § 25.981(b) maintained the intended flammability standards for wing tanks that were introduced in 2001, as part of Amendment 25-102 to part 25.

The proposed text clarified the existing term “means to minimize the development of flammable vapors” by including references to a conventional unheated aluminum wing tank, or 3 percent average flammability. Therefore, no new flammability standards are introduced for conventional wing tanks. Fuel tanks manufactured from materials other than aluminum, or that have unique features that would not allow cooling of the fuel tank (such as a small surface area exposed to the air stream) or that are heated (such as by having warm fuel transferred from another tank) may need FRM to comply with the previously issued requirements.

As discussed in the NPRM, Amendment 25-102 revised § 25.981 to require that fuel tank flammability exposure be “minimized.” As explained in the preamble to that final rule, the objective of this requirement is to reduce the flammability exposure to that of an unheated aluminum wing tank.

b. Use of Composite Materials

Airbus pointed to the industry trend towards the use of composite materials, which tend to have a lower heat transfer coefficient than aluminum. These materials act as insulators, slowing down any heating or cooling effects. Therefore, new TC designs using composite structures will have a natural flammability exposure greater than an equivalent conventional unheated aluminum wing tank, and designers will be forced to implement FRM. The NATCA noted that, with increased use of composites in wing designs, the assumption that wing tanks cool adequately may be incorrect.

We agree that composite materials may act as an insulator that will not allow fuel tank cooling, resulting in increased flammability. Limiting fuel tank flammability using FRM may be needed to meet the flammability exposure of a “conventional unheated aluminum wing tank” that is required by § 25.981. Airbus's suggestion that it is impractical for the rule to mandate the use of inerting for wing fuel tanks on airplanes with composite fuel tanks is not supported by recent events. While this rule is performance based and means other than inerting could be used, inerting has been found to be one means that is both technically feasible and economically viable. For example, the Boeing 787 will have wing fuel tanks constructed of composites, and FRM using nitrogen has been incorporated into the design to reduce the fuel tank flammability below that of a conventional aluminum wing tank.

6. Auxiliary Fuel Tanks

a. Definition

In the NPRM, we described auxiliary fuel tanks as tanks that are installed to permit airplanes to fly for longer periods of time by increasing the amount of available fuel. The proposed rule defined an auxiliary fuel tank as one that is normally emptied and has been installed pursuant to an STC or field approval to make additional fuel available. We also stated that auxiliary fuel tanks are “aftermarket” installations not contemplated by the original manufacturer of the airplane.

Airbus and AEA suggested the definition of auxiliary fuel tank should be clarified. They recommended that we use the generally accepted definition that is in AC 25.981-2. Boeing also requested that the definition of an auxiliary fuel tank be revised to more generally state that it is a fuel tank added to an airplane to increase range instead of referencing it as one installed pursuant to an STC or field approval. Boeing noted that an airplane might be delivered with an Original Equipment Manufacturer designed, manufactured and type certified auxiliary fuel tank.

Changes to the regulatory text in proposed subpart I (now part 26) resulted in eliminating the need for this definition in the final rule. Therefore, we have deleted the definition of auxiliary fuel tank from proposed § 25.1803(a) (now § 26.31(a)) and will maintain the definition in AC 25.981-2.

b. Existing Auxiliary Tanks

Boeing, Airbus, AEA, and ATA commented that older auxiliary fuel tanks should be exempt from the requirements of this rule since the benefits would be small compared to the cost of the retrofits. Boeing stated by the year 2016, most of the airplanes with auxiliary tanks installed during production would be over 30 years old. Future service life is generally thought to be minimal for these older airplanes. Boeing also commented, based upon feedback received from some operators, that these operators would deactivate their auxiliary fuel tanks rather than install FRM or IMM. The ATA added that the favorable service history (no operational accidents caused by auxiliary tank overpressures or explosions), operating environment (minimal exposure to flammable conditions), and proximity to retirement for many of these tanks makes it unnecessary to include auxiliary tanks in the applicability of this rule. Finally, Embraer commented that only auxiliary fuel tanks located close to heat sources and lacking free stream cooling require the special attention that the rule proposes.

As discussed previously, we changed the language in proposed § 25.1815 (now § 26.33), which applies to TC holders, to limit its applicability to airplanes produced on or after January 1, 1992, and this would include any auxiliary fuel tanks installed by the original TC holder. Since § 26.35 (formerly § 25.1817) applies only to design changes to airplanes subject to § 26.33, this change from the NPRM has the effect of excluding most of the older auxiliary tank designs installed by STC or field approval, which were approved for installation on airplanes no longer subject to this rule.

For those auxiliary tanks approved under STCs or field approvals (if any) that are still covered under the rule, we believe that most of these tanks transfer fuel by pressurizing the tank with cabin air. The increased pressure results in reduced flammability that could be considered an FRM if the minimum flammability performance requirements are met. However, we have limited data on the number of these tanks currently in operation and their age. We currently do not have adequate information on the flammability exposure or the number and the type of auxiliary fuel tanks installed under STCs or field approvals to determine whether to subject them to the requirements of this final rule. Based upon these limited data, we cannot predict the number of high flammability auxiliary fuel tanks that

will be in service in 2016 or the number of airplanes with auxiliary fuel tanks installed by STC or field approvals that could still be operational for some period of time past the year 2016.

While no conclusive evidence has been presented, the commenters have raised issues worthy of further study. To prevent delaying the safety benefits of compliance with this rule, we have elected to defer the portion of this rulemaking that would have required development and installation of an FRM or IMM for auxiliary fuel tanks installed by STC or field approvals for further study. We have removed these proposed requirements from both the DAH and operational rules.

To assess the possible safety benefits and costs more accurately, we are requesting further comments regarding information needed to determine if future action should be taken to address auxiliary fuel tanks installed by STC or field approvals. The rule retains the requirements for STC holders to conduct a flammability assessment of auxiliary fuel tank designs, to conduct an impact assessment of the auxiliary tank on any FRM or IMM, and to develop the modifications for any adverse impact that is found. These requirements are still necessary both to assess the need for further rulemaking and to prevent increasing the flammability exposure of tanks into which the auxiliary tanks feed fuel. This could potentially defeat the purpose of requiring reduced flammability for these tanks. To limit the scope and cost of the requirement to perform impact assessments, this requirement only applies to auxiliary tanks approved for installation on Boeing and Airbus airplanes that we currently are aware will be required to have FRM or IMM installed.

c. Future Installation of Auxiliary Tanks

While we are foregoing action to require retrofit of existing auxiliary fuel tanks, we recognize that this decision could allow installation of currently approved auxiliary fuel tanks indefinitely, even if their flammability exposure exceeds those allowed under this rule. Therefore, we have added a new paragraph to the operational rule sections

in this final rule to prohibit installation of any auxiliary tank after the retrofit compliance date (nine years after the effective date) unless we have certified that the tank complies with § 25.981, as amended by this rule.

§§ 121.1117(n), 125.509(n), and 129.117(n).

d. Request for Comments

As discussed previously, we have concluded that additional information is needed before we can determine whether it would be cost effective to apply the requirements of this final rule to auxiliary fuel tanks installed under STCs or field approvals. The FAA, therefore, requests additional comments addressing the following specific questions:

1. Which airplanes produced on or after January 1, 1992, with 30 passengers or more or a payload of 7500 pounds, have auxiliary fuel tanks installed by STC or field approval?

2. What are the U.S. registration tail numbers of the airplanes with the tanks installed?

3. How many of these tanks are installed in airplanes used in all-cargo operations?

4. What is the STC holder's name and what are the STC numbers for these tanks?

5. How many of these tanks are installed under the Form 337 field approval process?

6. Are the tanks operational or deactivated?

7. How many engineering hours would be required to develop an FRM or IMM for these tanks?

8. How much would the parts cost for an FRM or IMM for these tanks?

9. What would the labor costs be for installing an FRM or IMM in these tanks?

10. How many days would it take to install an FRM or IMM in the affected airplane?

11. If the FAA required operators to install FRM or IMM, would those operators modify those tanks accordingly, or would they comply by simply deactivating those tanks? Please be model-specific for both passenger and all-cargo airplanes, if possible.

12. What would be the economic consequences to the operator of deactivating an auxiliary fuel tank?

Comments should be submitted to Docket No. FAA-2005-22997 by January 20, 2009. Comments may be submitted to the docket using any of the means listed in the

Addresses

section later in the document.

7. Existing Horizontal Stabilizer Fuel Tanks

In the NPRM, we stated that horizontal stabilizer fuel tanks are fuel tanks that may be required to be retrofitted with FRM or IMM. We understood that these tanks may not cool rapidly, since a large portion of the fuel tank surface is located within the fuselage contour. Airbus stated that they do not believe the rule should apply to horizontal stabilizer fuel tanks, because these types of fuel tanks are low flammability and, if these tanks are treated as high flammability, the rule would impose significant additional costs to install FRM or IMM for these tanks. Therefore, Airbus concluded that we should either review these additional engineering complications and associated costs (particularly with respect to retrofit) or apply the same requirements to these tanks as those proposed for wing tanks not in the fuselage contour.

The retrofit requirement of this rule only applies to fuel tanks that have an average flammability exposure above 7 percent. To the extent the risk analysis indicates a particular fuel tank actually is a low risk tank, no further requirements would apply. Some horizontal stabilizers, including those made by Airbus, are manufactured from composite material that acts as an insulator. These tanks may also be used to maintain airplane center of gravity, so warmer fuel may be transferred into them during flight. These features may result in flammability exposure that exceeds the 7 percent limit that is used to establish whether retrofit of an FRM or IMM is required. Tanks constructed of composites may also exceed the flammability exposure established for new designs in § 25.981(b).

The analysis required by this rule will establish the flammability exposure and determine the need for an FRM or IMM in horizontal stabilizer fuel tanks. If fuel tanks located within the horizontal stabilizer are not high flammability tanks, then no FRM or IMM would be needed and no additional cost would be incurred for retrofit. However, if an FRM or IMM is required because the tank is determined to be high flammability, it should be possible, using standard design methods, to address the technical issues. For example, the pressure drop mentioned by Airbus can be addressed by using a properly sized and designed FRM so that adequate nitrogen can be supplied to any affected tank. This can be done using available technology and with costs that are consistent with those for other tanks considered in the regulatory evaluation. Airbus provided no technical justification for its assertion to the contrary.

8. Foreign Persons/Air Carriers Operating U.S. Registered Airplanes

Airbus, EASA, and the UK Civil Aviation Authority (UKCAA) requested a change to the wording of proposed § 129.117(a). This change would clarify that the applicability of this rule is

limited to foreign persons and foreign air carriers operating U.S. registered transport category, turbine powered airplanes for which development of an IMM, FRM or Flammability Impact Mitigation Means (FIMM) is required under proposed §§ 25.1815, 25.1817 or 25.1819 (now §§ 26.33, 26.35, and 26.37). Their understanding is that the paragraph is not intended to apply to airplanes registered outside of the United States.

As provided in §§ 129.1(b) and 129.101(a), the commenters are correct that § 129.117 would not apply to aircraft registered outside the United States. To clarify our intent, we have revised § 129.117(a) to include the words “U.S. registered.”

9. Airplanes Operated Under § 121.153

In the proposed rule, the FAA requested comments on whether categories of airplane operations other than all-cargo operations should be excluded. In response to our request, AEA and Airbus noted that § 121.153 permits the operation, by U.S. airlines, of airplanes registered in another International Civil Aviation Organization (ICAO) member states under specified circumstances. They said that, while history shows that the use of the § 121.153 provisions is relatively rare, it can provide important flexibility when unusual circumstances dictate the urgent need of replacement airplanes for U.S. carriers. Given the small effect of excluding airplanes leased under the provisions of § 121.153 from any requirements of the proposed rule, the commenters recommend that they be excluded from applicability provisions of the proposed rule. Otherwise, they said, if compliance with the proposed retrofit requirements are applied as proposed, § 121.153 would preclude this practice for airplanes that have not been retrofitted with FRM. These commenters argued that this result would present a burden to both U.S. operators (who would lose the flexibility provided by § 121.153) and non-U.S. operators (for whom the value of their unmodified airplanes would be reduced).

Section 121.153(c) does not relate to a “category of operation,” such as all-cargo operations. Rather, it permits certificate holders to operate foreign registered airplanes for any type of operation, as long as the airplanes meet all applicable regulations. Allowing the operation of foreign registered airplanes that do not comply with this rule would be contrary to the intent of both § 121.153(c) and this rulemaking. It would also subject a certificate holder's passengers to differing levels of safety based on the registry of the airplane. This is not acceptable and we did not make the change proposed by the commenters in the final rule. However, as discussed later in more detail, we are working with foreign authorities to establish harmonized flammability reduction standards. If we achieve that objective, the “burdens” suggested by the commenters would disappear.

10. International Aspects of Production Requirements

The AEA and Airbus disagreed with the proposed requirement to incorporate FRM or IMM into all new production airplanes. They stated that existing procedures for exporting airplanes from the United States allow the importing country to accept specific non-compliances on the export certificate of airworthiness. The AEA also asked for clarification of the discussion of FAA authority over airplanes produced outside the United States. Likewise, Embraer asked that the requirement to incorporate FRM or IMM into all new production airplanes be dropped from the proposal. Embraer pointed out that foreign regulatory authorities do not currently have certification standards for FRM or IMM, so Embraer is unclear how airplanes with such systems would be approved by the importing country. The ATA questioned the FAA contention (by context) that the proposed rulemaking has no international (ICAO) implications. It asked for the proposal to be reviewed by relevant international law experts for compatibility with the principles of sovereignty and authority in ICAO International Standards and Recommended Practices, Annex 8 to the Convention on International Civil Aviation, Airworthiness of Aircraft.

As discussed in the NPRM, we intend for the proposed new production requirements to apply to any manufacturer over which the FAA has jurisdiction under ICAO Annex 8. For this reason, we used the same language as Annex 8 to define the applicability of those requirements. Under that annex (and under this rule), we have jurisdiction over organizations to which we issue production approvals, including production certificates. This may include organizations that accomplish final assembly outside the United States. While no affected U.S. production certificate holders currently accomplish final assembly outside the United States, it is possible that they might in the future. For example, if Boeing were to perform final assembly of a future version of the Boeing 737 in another country, those airplanes would still be subject to the production cut-in requirements of this final rule as long as Boeing produces them under Boeing's U.S. production certificate.

Regarding the comment that current procedures allow the importing country to accept specific non-compliances on the export certificate of airworthiness, the commenters are referring to the waiver provisions of § 21.327(e)(4). The non-compliances referenced in that section relate to the requirements for issuance of an export airworthiness approval.

The production cut-in requirement of this rule is unrelated to those requirements. Rather, it requires that affected airplanes produced under U.S. production approvals must conform to an approved type design that meets the fuel tank flammability requirements of this rule. Therefore, while a foreign authority may be able to waive the requirements for issuing airworthiness approvals, it does not have the authority under ICAO Annex 8 to override our requirements, imposed as the State of Manufacture, for our production approval holders.

For example, § 21.327(e)(4) references § 21.329, which in turn references § 21.183 for the requirements for a standard U.S. airworthiness certificate. For new airplanes, § 21.183 requires that the product conform to its approved type design and is in condition for safe operation.

Finally, in addition to meeting the requirements of this rule, any airplane produced for export would also have to meet all other requirements applicable to the production certificate holder (such as the requirement to maintain its quality control system in accordance with its FAA approval). These requirements cannot be waived under the provisions of § 21.327(e)(4). Therefore, we are not aware of any basis for a foreign authority to object to our requirement for production cut-in. Of course, once the airplane is placed into operation by a foreign operator, the operator would have to comply with the requirements of its authority for operation and maintenance of the airplane, which may or may not include requirements relating to fuel tank flammability. As discussed later in more detail, we are currently working with foreign authorities to harmonize our requirements with theirs.

D. Requirements for Manufacturers and Holders of Type Certificates, Supplemental Type Certificates and Field Approvals

1. General Comments About Design Approval Holder (DAH) Requirements

We received a number of general comments responding to the concept of DAH requirements rather than to the DAH requirements in this specific

rulemaking. We responded to these types of comments in the comment disposition document accompanying our policy statement titled “Safety—A Shared Responsibility—New Direction for Addressing Airworthiness Issues for Transport Airplanes.” Both were published in the

Federal Register

on July 12, 2005 (70 FR 40168 AND 70 FR 40166, respectively). We received similar comments on our NPRM on Enhanced Airworthiness Program for Airplane Systems (70 FR 58508, October 6, 2005, RIN 2120-AI31). As a result, we will not respond to such comments again here.

2. Flammability Exposure Requirements for New Airplane Designs

As proposed, the rule requires those airplanes incorporating FRM to limit the fleet average flammability exposure to 3 percent, and to limit warm day exposure to 3 percent, for all normally emptied fuel tanks located, in whole or in part, in the fuselage. All other fuel tanks can either meet the 3 percent average flammability exposure limitation or have a flammability exposure that is not higher than the exposure in a conventional unheated aluminum wing tank that is cooled by exposure to ambient temperatures during flight.

a. General Comments About Applicability to New Production Airplanes

The NACA and its member airlines fully support the requirement for incorporation of either an FRM or IMM to provide fuel tank inerting for all new production airplanes, including those that already have an approved TC or STC. Airbus, AEA, AAPA, and EASA also commented that installation of FRM during an airplane manufacturing process may be appropriate. The EASA expressed its support for production cut-in and plans to amend its rules to a harmonized approach that requires production incorporation.

As we stated in the NPRM, “The safety objective of these proposed rules is to have the required modifications installed and operational at the earliest opportunity.”

For U.S.-manufactured airplanes, we proposed to meet this objective by requiring affected production approval holders to incorporate these changes by the compliance date for developing FRM or IMM service information. Recognizing that we do not have similar authority over affected foreign manufacturers, we did not propose a similar requirement for them. However, as noted by the commenters, our safety objective still applies to those airplanes, and it is equally feasible for FRM or IMM to be incorporated on new foreign-manufactured airplanes after the necessary design changes are developed. Further, as stated by EASA, it has agreed to harmonize requirements for new production airplanes. Including FRM or IMM in production is more efficient and less costly than retrofitting these airplanes, which is also required under the NPRM.

70 FR at 70940.

Based on these factors, we had assumed that FRM or IMM would be incorporated on all airplanes produced by both domestic and foreign manufacturers after designs were developed within two years after the effective date of this final rule. Given the reluctance of foreign manufacturers to commit to developing these design changes within the prescribed period (as discussed later), we now recognize that an operational requirement is needed to effectuate our intent. Accordingly, operators may not operate affected airplanes produced after September 20, 2010 unless they are equipped with FRM or IMM. Because we had intended that all airplanes delivered after these design changes had been developed would include these safety improvements, this requirement is a logical outgrowth of the NPRM.

b. Flammability Analysis Using the Monte Carlo Method

For all fuel tanks, an analysis must be performed to determine whether the fuel tank, as originally designed, meets the fleet average flammability exposure limits discussed above. To determine the flammability exposure of fuel tanks, the ARAC used a specific methodology incorporating a Monte Carlo analysis.

As proposed, any analysis of a fuel tank must be performed in accordance with this methodology (as detailed in proposed appendix L, now appendix N, and in the draft FAA document, Fuel Tank Flammability Assessment Method User's Manual).

We considered approving alternative methodologies in lieu of Appendix N, but we found that no other alternative considered all factors that influence fuel tank flammability exposure (which is the safety objective of this rule).

This methodology determines the fuel tank flammability exposure for numerous simulated airplane flights during which various parameters such as ambient temperature, flight length, fuel flash point are randomly selected. The results of these simulations are averaged together to determine the fleet average fuel tank flammability exposure.

As indicated in the proposed Appendix L (now Appendix N), we are incorporating the User's Manual by reference into the final rule. This was incorporated by reference in the final rule by creating a new § 25.5.

The ATA proposed upgrading the Monte Carlo method or developing a similar method that would be used to evaluate airplane risk of a fuel tank explosion. The method proposed by ATA would include not only fuel tank flammability, but also the risk of ignition sources developing in a fuel tank based upon the specific airplane design.

The Monte Carlo method is intended to be used to determine fuel tank flammability alone, not the overall likelihood of a fuel tank explosion. While the ATA's suggestion is intriguing, we do not believe there is presently a method of accurately predicting the risk of an ignition source developing in a fuel tank. With this final rule, we are implementing a balanced approach to prevent fuel tank explosions: By addressing both ignition prevention (as defined in the requirements of § 25.981(a) and SFAR 88) and flammability reduction (as defined in this rule). Compliance with both standards ensures that fuel tank explosion risk is acceptable.

The EASA also expressed concerns about the proposed methodology since it is complex and allows variations in fuel tank flammability to be introduced by variations in the input parameters used in the analysis. Although EASA welcomed the improvements to the Monte Carlo method proposed in the NPRM that set the majority of the input parameters, EASA expressed concern that the method does not adequately address heat transfer and the assumptions retained do not allow proper quantification of the exposure.

We share the concern expressed by EASA that, unless properly controlled, variation in the DAH input parameters used in the flammability assessment could result in significant differences between various DAHs. Fuel tank thermal modeling, including heat transfer, is the one major variable parameter provided by the user. Appendix N25.3(e) requires that substantiating data for the fuel tank thermal model, along with other input parameters, be submitted with the analysis. Therefore, we believe that Appendix N does adequately address heat transfer and provides a method that allows for proper quantification of flammability exposure.

Finally, Parker Hannifin Corporation noted an error in the Monte Carlo computer code that mistakenly added the time prior to flight and utilized the flight time constants rather than ground time constants in certain calculations. This error could produce two counter-

acting effects. In some circumstances, it could produce higher flammability exposure when the tank-full time constant is used longer than actually required. In other circumstances, it tends to reduce the flammability exposure by using the tank empty-time constant earlier than actually warranted. Overall this has the net effect of slightly underestimating the actual fuel tank flammability exposure so assessments using the revised computer code would produce slightly higher flammability values. We addressed this error in the final rule and the computer code is now correct.

c. Definition of “Normally Emptied Tank”

As defined in proposed § 25.1803(d) (now § 26.31(b)), “normally emptied tank” refers to a fuel tank that is emptied of fuel during the course of a flight and, therefore, can contain a substantial vapor space during a significant portion of the airplane operating time. Boeing requested that the definition for “normally emptied” be removed. Boeing based this request on the fact that heat input to the tank and the heat rejection rate (i.e., the rate of heat transfer from the tank) play more of a factor in a tank's flammability than whether it is normally emptied.

While we acknowledge that the heat input to the fuel tank and heat rejection from the tank are major factors in fuel tank flammability, the reason we are concerned about tanks that are normally emptied is not related to their flammability. As stated in the preamble to the NPRM, normally emptied fuel tanks can contain a substantial fuel vapor space that could expose potential ignition sources to the fuel vapor for an extended period of time. Fuel in tanks that are not normally emptied covers potential ignition sources more often than fuel in normally emptied tanks. This prevents ignition sources from igniting fuel vapors in the tank. Therefore, normally emptied fuel tanks have a higher likelihood of exposing flammable vapor to ignition sources than tanks that are not normally emptied. This rule specifically differentiates between fuel tanks that are normally emptied and other fuel tanks by requiring reduced fuel tank flammability because of the increased risk of an explosion in normally emptied tanks.

d. Fixed Numerical Standard

For new airplane designs, we requested comments on whether the reference to a conventional unheated aluminum wing tank or a fixed numerical standard for the requirements of § 25.981(b) would be more workable and effective. The safety objective of a “conventional unheated aluminum wing tank” is consistent with the ARAC recommendation and § 25.981(c) (amendment 102). However, it does not provide a numerical standard to apply in future type certification programs. In certain cases, the compliance demonstration would be simplified if a fixed numerical standard were provided in the regulation, because there would be no analysis needed to establish the flammability exposure of a conventional unheated aluminum wing tank that is the alternative flammability exposure. We believe this approach has implementation advantages and should achieve the safety level intended by the ARAC recommendation and the current approach in § 25.981(c) (amendment 102).

Transport Canada, Boeing, Airbus, and ATA agreed that including a fixed numerical standard was preferred. Several of them suggested that we needed to provide further justification for the selection of a 3 percent fixed value and proposed different numerical values. These commenters did not agree with the inclusion of a variable standard of equivalence to a conventional unheated aluminum wing tank.

Airbus stated that a numerical value within the level recommended by ARAC (i.e., 7 percent) would be more practical and potentially safer than a flammability equivalency to a hypothetical wing fuel tank. While the 3 percent limit should be considered an acceptable goal if FRM is used, Airbus suggested that for fuel tanks that have a base flammability exposure less than 7 percent, there should not be a requirement to use FRM. The existing minimization of heat sources, as required by EASA, should be adequate. Airbus concluded that establishing a standard of 7 percent for fuel tank flammability exposure would ensure that FRM would provide a significant benefit (at least a 50 percent reduction in flammability) and remove the potential to actually reduce the overall safety as a result of increased ignition risk potential due to hazards associated with adding new FRM or IMM to the airplanes.

These commenters did not provide any compelling reasons to change the proposed 3 percent average flammability exposure or to eliminate the provision for showing equivalence to a conventional unheated aluminum wing tank. The reason for including the fixed 3 percent flammability exposure is to simplify the compliance demonstration. The reason for allowing for equivalence to a conventional unheated aluminum wing tank is to give flexibility to designers who are willing to perform the required evaluations. The proposal from Airbus and other commenters to increase the flammability exposure value to 7 percent would allow a significant increase in fuel tank flammability over that permitted by § 25.981. The fleet of airplanes that ARAC determined had achieved an acceptable level of safety was made up of airplanes with conventional unheated aluminum wing tanks with flammability exposures that varied from very low levels of around 1.5 percent for outboard wing fuel tanks to the highest values below 6 percent for some larger inboard wing tanks. These numerical values would all be lower if calculated today, consistent with the lower values now calculated by manufacturers for HCWTs.

Therefore, in this final rule, we adopted a flammability standard that includes showing a fuel tank is equivalent to a conventional unheated aluminum wing tank or 3 percent, whichever is greater. For purposes of this final rule, a conventional unheated aluminum wing tank is a conventional aluminum structure, integral tank of a subsonic transport airplane wing, with minimal heating from airplane systems or other fuel tanks and cooled by ambient airflow during flight. Heat sources that have the potential for significantly increasing the flammability exposure of a fuel tank would preclude the tank from being considered “unheated.” Examples of such heat sources that may have this effect are heat exchangers, adjacent heated fuel tanks, transfer of fuel from a warmer tank, and adjacent air conditioning equipment. Thermal anti-ice systems and thermal anti-ice blankets typically do not significantly increase flammability of fuel tanks.

e. Tanks Located Within the Fuselage Contour

Boeing disagreed with the distinction in proposed § 25.981 between tanks located within the fuselage contour that are normally emptied and other tanks. Boeing suggested that main tanks and tanks not partially within the fuselage do not represent all the tanks with low flammability exposure and acceptable safety records. Boeing stated that on the other hand it is possible to design a main or wing tank with exceptional heat sources and/or minimal cooling. It is also possible to design a normally emptied tank that is partially within the contour of the fuselage which is low flammability (3 percent or less).

Bombardier did not understand the justification for introducing a maximum

3 percent fuel tank flammability exposure for wing tanks with a portion of the tank located within the fuselage. Bombardier stated that there is an inconsistency in requiring wing tanks to have flammability exposure of between 2 percent and 5 percent, while requiring fuselage tanks to be below 3 percent. Bombardier concluded that keeping all tanks below a 7 percent flammability exposure level should be considered acceptable, and recommended that tanks with less than 7 percent flammability exposure not be required to have FRM.

The distinction in flammability exposures in the rule between tanks located within the fuselage contour that are normally emptied and other tanks was made because the former generally have an increased risk of explosion. The location within the fuselage typically results in little or no cooling of the tank and, in some cases, actually heats the tank. Tanks that are normally emptied operate much of the time empty. Therefore, components that could be potential ignition sources are exposed to the tank ullage. We agree with Boeing on the possibility that fuel tanks located in the wing can be high flammability if the tank is heated or does not cool due to tank design features. However, the rule limits fuel tank flammability in these tanks to 3 percent or equivalent to a conventional unheated aluminum wing tank, addressing that risk.

For fuel tanks located outside the fuselage contour, § 25.981, as amended by this final rule, retains the flammability limits 3 percent or equivalent to a conventional unheated aluminum wing tank. Only if any portion of the fuel tank is located within the fuselage contour, and if the tank is normally emptied, is it required to meet the 3 percent average and 3 percent warm day requirement. If an applicant chooses to locate a portion of a main fuel tank inside the fuselage, the rule requires that the fuel tank meet the same standard as a main fuel tank located solely outside of the fuselage contour (i.e., 3 percent or equivalent to a conventional unheated aluminum wing tank wing).

Since existing airplane types with main fuel tanks that go from the wing into the fuselage are not normally emptied, FRM or IMM is required for these tanks only if the tank flammability exposure exceeds 7 percent (proposed § 25.1815 (now § 26.33)). For future designs using similar architecture, these types of designs would need to show that the main tank that extends into the fuselage meets the standard of equivalent to a conventional unheated aluminum wing tank or 3 percent.

f. Compliance Demonstration

Boeing, Airbus, and BAE requested that applicants be allowed to use design review to determine that an aluminum fuel tank is equivalent to the low flammability standard fuel tank as defined by ARAC. This would be in lieu of a detailed Monte Carlo based flammability analysis. The BAE stated that performing a cumbersome and expensive Monte Carlo analysis for metallic wing tanks of conventional design is unnecessary and adds no value. For other types of tanks, or wing tanks with a substantial heat input, BAE believes the use of alternative analytical methods may be appropriate and suggested a qualitative assessment of the design and the installation should be adequate to determine whether a given tank has a low flammability exposure. Finally, BAE recommended a simple set of objective criteria be allowed for establishing fuel tank flammability in these tanks.

Boeing requested that we:

• Revise proposed § 25.981(b) to allow a simplified flammability analysis for fuel tanks shown by design review to be a Conventional Unheated Aluminum Wing Tank.

• Delete proposed § 25.981(b)(1) and (b)(2), which reference Appendixes N and M for the flammability analysis methodology and flammability exposure criteria, respectively.

• Revise the definition of conventional unheated aluminum wing tanks to consider allowing some minimal heat sources (i.e., hydraulic systems) and significant cooling which results in low flammability exposure and a satisfactory level of safety.

We agree with the commenters' assertion that a simplified qualitative flammability analysis for conventional unheated aluminum wing tanks is appropriate and have modified Appendix N to permit this. Our intent is to limit the quantitative analysis for aluminum wing tanks with unique or unconventional designs that are heated or designed such that minimal cooling occurs. For example, a quantitative flammability analysis would be necessary for a wing tank that has a relatively small surface area, thereby minimizing surface cooling effects, a composite tank or a tank that has equipment inducing heat into the fuel tank greater than a small amount.

We have also added guidance to AC 25.981-2 that describes how to conduct a qualitative analysis to establish equivalency to a conventional unheated aluminum wing tank. This guidance provides examples of allowable heat sources and cooling characteristics for a fuel tank to be considered a “conventional unheated aluminum wing tank,” so that the safety standard established by the ARAC definition for a conventional unheated aluminum wing tank is maintained. For compliance with § 25.981(d), the guidance also includes a discussion of how Critical Design Configuration Control Limitations (CDCCL) would need to be developed to define any critical features of the fuel tank design needed to limit the flammability to that of a conventional unheated aluminum wing tank.

As for Boeing's specific changes to § 25.981, we do not agree that § 25.981(b)(1) and (b)(2) should be deleted because Appendix N provides necessary definitions and methods for establishing Fleet Average Flammability Exposure and Appendix M establishes performance standards for FRM. These appendices, and the references to them in § 25.981(b)(1) and (b)(2), are necessary to achieve the safety objectives of this rulemaking. We have not adopted Boeing's suggestion to modify the definition of “Equivalent Conventional Unheated Aluminum Wing.” However, we do agree with the comment to allow some minimal heating of tanks such as that from a hydraulic heat exchanger that does minimal heating. We have revised the term “Conventional Unheated Aluminum Wing” used in § 25.981 to “Conventional Unheated Aluminum Wing Tank” to clarify that the flammability of the fuel tank is the standard. Since some minimal degree of heating typically occurs in many of these tanks, this change recognizes that such minimal heating is permissible.

g. Heat Sources Located in or Near Fuel Tanks

Transport Canada and the UK Air Safety Group suggested we prohibit the placement of heat sources within or near fuel tanks. Transport Canada questioned why we would allow such an undesirable design practice to continue. The UK Air Safety Group contended the NPRM failed to address the contribution of high fuel tank temperature to fuel tank explosions. The commenter noted that the Boeing 737 and 747 have air conditioning units that raise the fuel tanks' temperature well above the outside ambient temperature because these units are located beneath the center fuel tanks.

We agree with the commenters' underlying concern about controlling fuel tank temperature. While locating heat sources in or near fuel tanks increases the tanks' flammability, specifically prohibiting this design

practice may not be the most efficient and effective way to address the problem. This rule is performance-based and is seeking innovative design solutions which could permit locating heat sources near or in fuel tanks. For example, designers may wish to develop an FRM based upon managing the fuel tank temperature by transferring heat between tanks. These designs may provide flammability exposures well below that of a tank that complied with the proposal made by the commenters. Risk is directly proportionate to the flammability exposure of a tank. Therefore, we have developed a flammability performance standard that is independent of the design details of a tank installation.

h. Effects of Systems Failures on Flammability

The CAPA requested that we ensure the effects of any system failures that might increase the fuel tank flammability above the acceptable limit be considered and properly evaluated prior to issuing the final rule.

The flammability analysis required by § 25.981 includes a requirement to show that flammability exposure does not exceed minimum levels. It also requires that the overall flammability exposure analysis includes consideration of system failures when demonstrating that the FRM meets the reliability requirements of this rule. In addition, the analysis required by § 25.981(d) that determines the CDCCL and airworthiness limitations includes consideration of possible critical design features that must be maintained and may not be altered to assure the flammability limits are achieved. We have provided additional guidance and clarification in AC 25.981-2 regarding reliability assessments and establishing CDCCL and airworthiness limitations for FRM and IMM. Accordingly, we believe the commenter's concerns are already addressed by the proposed language, and no change was made to the final rule.

i. Move Flammability Exposure Method to Advisory Circular

The EASA, Transport Canada, Boeing, and Bombardier commented that the Monte Carlo method should not be defined in the rule as the method for determining fuel tank flammability. Instead, it would be more appropriately included in advisory material.

We do not agree with these commenters. The Monte Carlo method is specified in the rule to ensure standardization of the methodology for determining fuel tank flammability across all airplane models so a uniform level of safety is achieved. Advisory circulars (ACs) provide guidance for methods, procedures, or practices that are acceptable to us for complying with regulations. ACs are only one means of demonstrating compliance, and we cannot require their use. Specifying Monte Carlo analysis in an AC could result in numerous methodologies and input parameters being used to determine flammability exposure, and we believe that this could result in differing flammability exposures in the fleet that may allow some fuel tanks to have greater flammability than intended by the rule. To ensure that all DAHs reach comparable conclusions from their assessments, it is necessary to require that they use the same methodology. This can only be accomplished through the rulemaking process.

However, to accommodate minor revisions that would not appreciably affect analytical results, we have included a provision in Appendix N25.1(c) permitting use of alternative methods if approved by the FAA. This is similar to the flexibility provided in § 25.853 for alternative test methods to those defined in Appendix F of part 25.

3. Flammability Exposure Requirements for Current Airplane Designs

Proposed § 25.1821 (now § 26.39) contains the fuel tank flammability safety requirements for newly produced airplanes. Paragraph (b) sets forth the criteria that, when met by any fuel tank, requires that fuel tank to have an FRM or IMM meeting the new requirements of § 25.981. Paragraph (c) contains the requirements for all other fuel tanks that exceed a Fleet Average Flammability Exposure of 7 percent.

a. Same Standards for New and Current Airplane Designs

Boeing asked that we revise proposed § 25.1821(b) to state “any fuel tank not shown by design review to be a Conventional Unheated Aluminum Wing Tank, must meet the requirements of § 25.981 in effect on [effective date of final rule].” In conjunction with this change, paragraph (c) would be deleted. Boeing stated that new production airplanes should meet the same requirements as new airplane designs, since the criteria for tanks at risk should be a function of heating and cooling, not whether the fuel tank is normally emptied and located partially within the fuselage.

We do not agree with Boeing. As discussed earlier, tanks that are normally emptied and located at least partially within the fuselage are generally more susceptible to explosion because of both increased ullage and operating at higher temperatures. We have determined that the 7 percent flammability exposure limit recommended by ARAC is an adequate standard to determine which fuel tanks in newly produced airplanes need an FRM or IMM. If the fleet average flammability exposure is above 7 percent for fuel tanks normally emptied and located within the fuselage contour, these fuel tanks will be required to be flammable no more than 3 percent on average and 3 percent for warm day operations. We expect that the vast majority of large transport category airplanes will have a fleet average flammability exposure above 7 percent for these specific fuel tanks and will be required to comply with § 25.981 for production airplanes affected by the DAH requirement.

Other tanks on newly produced airplanes also may not exceed the 7 percent flammability exposure limit, but the final rule would allow reduction to that level by various methods of FRM described in AC 25.981-2 that would not necessarily require the added complexity and cost of a nitrogen inerting based FRM. We believe this requirement is sufficient to provide an acceptable level of safety for current production airplanes because these tanks have significantly lower risk of fuel tank explosions, as demonstrated by their service history. Therefore, we do not believe the safety improvements from redesign of these tanks to meet the new requirements of § 25.981 are sufficient to justify the resulting costs.

b. 7 Percent Exposure Flammability Questioned

In the NPRM, we stated that fuel tanks that have a flammability exposure higher than 7 percent are unduly dangerous. American Trans Air commented that this statement is arbitrary, based on flawed analysis, and cannot be supported. Bombardier expressed its opinion that the NPRM and its supporting data did not adequately substantiate the declared 7 percent exposure. Although Bombardier considered that achieving 7 percent exposure is feasible with reasonable design precautions, Bombardier stated that this is not an acceptable reason for creating a standard. Bombardier also quoted information shared among the airline industry and authorities that heated tanks may vary between 8 percent to as high as 40 percent in flammability exposure.

Boeing did not agree with the proposed flammability requirements for newly produced airplanes, because fuel tanks other than those located within

the fuselage contour that are normally emptied would be allowed to have flammability of up to 7 percent. Boeing commented that this flammability is more than twice that of what is allowed for similar tanks in new designs. Boeing noted that the first ARAC determination that 7 percent flammability exposure is acceptable was based on the original coarse ARAC flammability analysis which determined that unheated tanks had a flammability level of approximately 5 percent. Two percent was added for potential variation resulting in the 7 percent proposal. Boeing pointed out that the Monte Carlo analysis has been significantly refined since the first ARAC report, and the estimated flammability exposure of 5 percent (7 percent with potential variation) has been reduced to be in the range of 3 percent (4 percent with potential variation) or less for the same fuel tanks.

We have determined that the 7 percent or less fleet average flammability exposure recommended by ARAC is an adequate value that can be used to identify those airplane models that need to be retrofitted with an FRM or IMM. The fuel tank flammability limits established for newly produced airplanes (subject to the production cut-in requirements) are the same as those for retrofit of the existing fleet (proposed § 25.1815 (now § 26.33)). We determined this flammability exposure achieves the desired safety benefits, since currently produced airplanes generally have conventional unheated aluminum wing tanks, the tanks ARAC determined to have adequate safety level, with flammability exposures below 7 percent.

We agree with Boeing that newly produced airplanes should not be allowed to have fuel tank flammability that is twice that of new designs, and this is not what we intended. The intent of this rule is to apply its safety improvements to the fuel tanks that have been shown to have an increased risk of explosion, not to require modifications to conventional unheated aluminum wing tanks, or other fuel tanks that have significantly lower flammability. Data we have available for currently produced airplanes indicate the flammability of tanks located outside the fuselage contour have flammability below 7 percent and further reduction in flammability exposure as recommended by Boeing would add significant cost to the rule, since a number of fuel tanks would be required to have an FRM or IMM to meet the suggested flammability values of 3 to 4 percent.

Recognizing that, based on the applicability criteria of proposed § 25.1821(a) (now § 26.39), this section only applies to current production Boeing models. We have revised paragraph (a) to specifically identify those models. As discussed previously, we have also added a requirement to the operational rules that operators must meet these requirements for any airplane subject to this rule that is produced more than two years after the effective date.

4. Continued Airworthiness and Safety Improvements

a. 7 Percent Standard Should Apply to All Tanks

Boeing requested that § 25.1815(c)(1) be modified to state that, for fuel tanks with flammability exposure exceeding 7 percent that require an FRM, “a means must be provided to reduce the fuel tank flammability exposure to meet the criteria of Appendix M of this part.” In addition, Boeing recommended that we delete § 25.1815(c)(1)(i) and (ii). Boeing stated that any fuel tank that has significant heat loads, regardless of the location on the airplane, should meet the requirements of Appendix M if an FRM is selected as the design modification.

We do not concur with Boeing's comment that the flammability requirements of Appendix M should apply to any fuel tank that exceeds 7 percent average flammability. As discussed previously, the reason we are adopting more stringent requirements for fuel tanks that are normally emptied and located within the fuselage contour is that those tanks both have higher flammability exposure and are more likely to have ullage exposed to ignition sources. For other fuel tanks where the fleet average flammability exposure exceeds 7 percent, the requirements of Appendix M apply with the exception that the flammability requirements of M25.1(a) and (b) are replaced by the requirement that fleet average flammability exposure must not exceed 7 percent. We believe this is acceptable for these tanks on existing airplanes. Since most of these tanks are not “normally emptied,” the risk that flammable vapors will be exposed to ignition sources is generally much lower.

b. Compliance Planning

Airbus requested that the compliance planning requirements contained in § 25.1815 be removed because they are unnecessary. Airbus believes the only important compliance date is the final date for DAHs to submit the data and documents necessary to support operator compliance. Airbus commented that the compliance plan requirements in §§ 25.1815(g), (h) and (i) add constraints on the manufacturer with no safety benefit. Airbus stated these documents should not be subject to a requirement with respect to the DAH documentation delivery date. However, if the delivery dates for these documents are mandated, Airbus requested that they be expressed in the format of a duration tied to the date of approval of the previous submittal.

Boeing recommended we remove the § 25.1815(g)(3) requirement to identify deviations to methods of compliance identified in FAA advisory material, because the proposed means of compliance should not be compared to other means. Instead, they should be evaluated on their own merits.

While we understand the commenters' concerns, these documents will provide assurance that the required flammability exposure analyses and, if applicable, proposed design changes, are being addressed in a timely fashion. As stated in the NPRM, the resolution of fuel tank safety issues needs to be handled in a “uniform and expeditious” manner. Providing compliance times based on the dates of our previous approvals would result in various compliance times, depending upon whether DAHs' submissions are acceptable. It would have the undesirable effect of providing more time for those manufacturers submitting deficient documents.

Compliance planning will promote communication between the affected manufacturer and us. It will also provide sufficient time to discuss any concerns with respect to how the affected manufacturer proposes to analyze fleet average flammability exposure or certify design changes. Compliance planning will also help to ensure that the affected manufacturer is able to meet the required compliance times of the rule for accomplishing the submittal of the flammability exposure analysis, design changes, and service instructions, if applicable (proposed § 25.1815 (now § 26.33) and proposed § 25.1817 (now § 26.35)). We intend to closely monitor compliance status and take appropriate action, if necessary.

However, we do acknowledge that some provisions of proposed § 25.1815(g), (h) and (i) could be removed without adversely affecting our ability to facilitate TC holder compliance. Specifically, proposed paragraph (g)(3) would require TC holders to identify intended means of compliance that differ from those described in FAA advisory materials.

While this is still a desirable element of any compliance plan, we now believe that an explicit requirement is unnecessary and it is not included in the final rule. As with normal type certification planning, we expect that TC holders will identify differences and fully discuss them with the FAA Oversight Office early in the compliance period to ensure that these differences will ultimately not jeopardize full and timely compliance. Because we believe that timely review and approval is beneficial and will save both DAH and FAA resources, the advisory material will recommend that if the DAH proposes a compliance means differing from that described in the advisory material, the DAH should provide a detailed explanation of how it will demonstrate compliance with this section. The FAA Oversight Office will evaluate these differences on their merits, and not by comparison with FAA advisory material.

Similarly, proposed § 25.1815(i) contains provisions that would have authorized the FAA Oversight Office to identify deficiencies in a compliance plan, or the TC holder's implementation of the plan, and require specified corrective actions to remedy those deficiencies. While we anticipate that this process will still occur in the event of potential non-compliance, we have concluded that it is unnecessary to adopt explicit requirements to correct deficiencies and have removed them from the final rule. Ultimately, TC holders are responsible for submitting compliant FRM or IMM by the date specified. This section retains the requirements to submit a compliance plan and to implement the approved plan. If the FAA Oversight Office determines that the TC holder is at risk of not submitting compliant FRM or IMM by the compliance date because of deficiencies in either the compliance plan or the TC holder's implementation of the plan, the FAA Oversight Office will document the deficiencies and request TC holder corrective action. Failure to implement proper corrective action under these circumstances, while not constituting a separate violation, will be considered in determining appropriate enforcement action if the TC holder ultimately fails to meet the requirements of this section.

Finally, we realized that the rule text could more clearly state our intent to allow DAHs flexibility to modify their approved plan if necessary. Accordingly, we changed proposed § 25.1815 (now § 26.33(i)) to read: “Each affected type certificate holder must implement the compliance plans, or later revisions, * * *”

c. Changes to Type Certificates Affecting Flammability

Proposed § 25.1817 (now § 26.35) addressed changes to TCs that could affect fuel tank flammability. This section proposed to require that a flammability exposure analysis be accomplished in accordance with Appendix N for all affected fuel tanks installed under an STC, amended TC, or field approval within 12 months after the effective date of the final rule. An impact assessment that identifies any features of the design change that compromise any CDCCL applicable to any airplane with high flammability tanks for which CDCCL are required must also be submitted to the FAA Oversight Office. This section also proposed a requirement to develop service instructions to correct designs that compromise airworthiness limitations, defined by the TC holder under proposed § 25.1815 (now § 26.33), within 48 months after the final rule's effective date.

Airbus proposed we restrict the application of any proposed changes to § 25.981 to new TCs and significant design changes (i.e., new fuel tanks). For minor design changes such as relocating a fuel level sensor or a small increase in tank capacity, the TC holder should only be required to show no degradation in the flammability under the criteria proposed by § 25.1815. Airbus stated that the cross-reference between what is in the preamble and § 25.1815, and what is required by § 25.1817, is misleading.

We agree with Airbus, and have revised proposed § 25.1817 (now § 26.35) to require compliance with the new § 25.981 only for new fuel tanks. Other design changes that increase capacity of existing fuel tanks must comply with § 26.33. Design changes that affect the flammability exposure of existing tanks equipped with FRM or IMM must comply with CDCCLs for those tanks. This will ensure that these design changes do not degrade the level of safety required by this rule.

d. Combine §§ 25.1815 and 25.1817

Boeing requested that we combine proposed §§ 25.1815 and 25.1817 into one section. We do not agree with this suggestion, since it would not achieve the goals of this rulemaking. As proposed, §§ 25.1815 (now § 26.33) and 25.1817 (now § 26.35) would apply to different entities. Section 25.1815 (now § 26.33) would apply to TC holders of transport category airplanes, and § 25.1817 (now § 26.35) to auxiliary tank STC holders and future applicants for design changes. The STC holders have distinctly different compliance dates because information such as CDCCL developed by the DAHs under proposed § 25.1815 (now § 26.33) is needed before the STC holders can comply with proposed § 25.1817 (now § 26.35). Separate sections provide a clear statement of the requirements for each situation so affected persons can more easily understand what is needed to comply with the rules applicable to them. Therefore, the final rule retains the language as proposed with no change.

e. Pending Type Certification Projects

Proposed § 25.1819 contains the requirements for pending TC projects. As proposed, this section contains different requirements for those transport category airplanes based on whether the application was made before or on/after June 6, 2001 (the effective date of Amendment 25-102). Boeing requested that this section be deleted because it saw no reason to differentiate among designs based on the date of application.

We partially agree with Boeing and have revised this section. In the final rule, any pending certification projects that have not received type certification by the effective date of this rule will be required to meet the requirements of § 25.981, as amended by this rule. Since there are no longer any ongoing TC projects where the application was received prior to June 6, 2001, there is no reason for this distinction and we have removed proposed § 25.1819(c). However, we have received applications for type certification projects after June 6, 2001, that are still pending (e.g., the Boeing 787 and Airbus A350), and we have determined that a specific requirement in § 25.1819 is needed to address these projects. We do not believe this section should be completely deleted, as requested, because these projects (and future design changes to these airplanes), would not otherwise be required to comply with § 25.981, as amended by this final rule. The change to the rule will maintain the requirement that pending projects meet the same flammability standards as required for new type certificates and that applicants develop CDCCL as proposed in the NPRM.

f. Type Certificates Applied for on or After June 6, 2001

Proposed § 25.1819(d) (now § 26.37(b)) requires that if an application for type certification was made on or after June 6, 2001, the requirements of § 25.981 of this rule apply. Section 25.981 requires, in part, that the fleet average flammability exposure of a fuel

tank not exceed 3 percent or that of a conventional unheated aluminum wing tank.

Airbus objected to the setting of a 3 percent flammability limit for all fuel tanks for a pending type certification, if the application was made on or after June 6, 2001. Airbus agreed that a 3 percent flammability limit could be considered as an acceptable goal when FRM is used. However, for fuel tanks that have a base flammability exposure less than 7 percent, there should not be a requirement to impose FRM, and the existing minimization of heat sources should be considered adequate. If initial flammability is between 3 and 7 percent, the safety benefit to reduce it to 3 percent through the use of FRM is not justified, when considering the introduction of new failure conditions, and operational and ownership costs of an FRM.

Airbus apparently misunderstood the effect of the proposed requirements of § 25.1819 (now § 26.37) for TCs for which application was made on or after June 6, 2001. The following is provided to clarify the requirements of the rule and address the concern expressed by Airbus. The flammability requirements for an airplane for which application was made on or after June 6, 2001, would include § 25.981 at Amendment 25-102 for all tanks except normally emptied tanks located within the fuselage contour. As stated earlier in this preamble, the rule text has been changed to clarify that the flammability exposure is equivalent to a conventional unheated aluminum wing tank or 3 percent, at the applicant's option. This flammability exposure is unchanged from Amendment 25-102, which would not have permitted a flammability exposure of 7 percent. This rule adds a new requirement for fuel tanks located within the fuselage contour that are normally emptied. Normally emptied tanks located within the fuselage must meet the 3 percent average and the 3 percent warm day flammability limits defined in Appendix M, which is the same flammability requirement being applied to these types of fuel tanks on existing airplanes.

g. Design Change to Add a Normally Emptied or Auxiliary Fuel Tank

As proposed, § 25.1819(e) would require that any future design change to a TC for which the application is pending when this rule is adopted and that—

• Adds an auxiliary fuel tank, or

• Adds a fuel tank designed to be normally emptied, or

• Increases fuel tank capacity, or

• May increase the flammability exposure of an existing fuel tank must meet the requirements of § 25.981, as amended by this rule. Boeing asked that this paragraph be deleted because it is specifically for “pending” type certification projects and, by definition, there is no existing type certificate to change. If the intent of proposed § 25.1819 (now § 26.37) is to define requirements for projects in work at the time of the final rule, then Boeing suggested there is no need for this section. Any change after the new production compliance date would have to meet the new production requirements (§ 25.1821).

Proposed § 25.1819(e) specifically targets potential future changes to certain long-term, pending type certification programs. Under proposed § 25.1819(c), these programs would not be required to comply with § 25.981, as amended by this rule. Our intent was that, although the original TC would not have to comply with the current requirements, any later changes would have to comply. Since we issued the NPRM, all of these projects have been certified, so there are no pending projects for which this paragraph is needed. Therefore, we have removed it from the final rule.

E. Flammability Exposure Requirements for Airplane Operators

The proposed operating rules would prohibit the operation of certain transport category airplanes operated under parts 91, 121, 125, and 129 beyond specified compliance dates, unless the operator of those airplanes has incorporated approved IMM, FRM or FIMM modifications and associated airworthiness limitations for the affected fuel tanks. The proposed rules would not apply to airplanes used only in all-cargo or part 135 operations. Finally, the proposed operating rules would also create new subparts that pertain to the support of continued airworthiness and safety improvements.

1. General Comments About Applicability to Existing Airplanes

Airbus, AEA and AAPA believe the retrofit requirement is not cost effective. Our analysis showed that the benefit/cost ratio of the production cut-in and retrofit requirements are similar. This was our rationale for adopting the combined approach of production cut-in and retrofit. However, these commenters believe the 7 percent discount rate used in our cost/benefit analysis is too high and is responsible for the determination that cost/benefit ratios are similar between the production cut-in and retrofit. We infer from their comments that they believe that 3 percent is a more realistic number and supports their contention that retrofit is not justified. The commenters note that an EASA analysis concluded that the retrofit was not justified. A major concern was that the bulk of the retrofit costs (present value terms) will be incurred in about 1/3 of the time (7 years) required for the forward fit costs (22 years). They believe that the cash outlay to retrofit in such a short time, coupled with the small safety benefit, is not justified whe

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.