[Federal Register Volume 66, Number 88 (Monday, May 7, 2001)]
[Rules and Regulations]
[Pages 23086-23131]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 01-10129]



[[Page 23085]]

-----------------------------------------------------------------------

Part II





Department of Transportation





-----------------------------------------------------------------------



Federal Aviation Administration



-----------------------------------------------------------------------



14 CFR Part 21 et al.



Transport Airplane Fuel Tank System Design Review, Flammability 
Reduction and Maintenance and Inspection Requirements; Final Rule

  Federal Register / Vol. 66, No. 88 / Monday, May 7, 2001 / Rules and 
Regulations  

[[Page 23086]]


-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Parts 21, 25, 91, 121, 125, and 129

[Docket No. FAA-1999-6411; Amendment Nos. 21-78, 25-102, 91-266, 121-
282, 125-36, 129-30]
RIN 2120-AG62


Transport Airplane Fuel Tank System Design Review, Flammability 
Reduction, and Maintenance and Inspection Requirements

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This rule requires design approval holders of certain turbine-
powered transport category airplanes, and of any subsequent 
modifications to these airplanes, to substantiate that the design of 
the fuel tank system precludes the existence of ignition sources within 
the airplane fuel tanks. It also requires developing and implementing 
maintenance and inspection instructions to assure the safety of the 
fuel tank system. For new type designs, this rule also requires 
demonstrating that ignition sources cannot be present in fuel tanks 
when failure conditions are considered, identifying any safety-critical 
maintenance actions, and incorporating a means either to minimize 
development of flammable vapors in fuel tanks or to prevent 
catastrophic damage if ignition does occur. These actions are based on 
accident investigations and adverse service experience, which have 
shown that unforeseen failure modes and lack of specific maintenance 
procedures on certain airplane fuel tank systems may result in 
degradation of design safety features intended to preclude ignition of 
vapors within the fuel tank.

EFFECTIVE DATE: June 6, 2001.

FOR FURTHER INFORMATION CONTACT: Michael E. Dostert, FAA, Propulsion/
Mechanical Systems Branch, ANM-112, Transport Airplane Directorate, 
Aircraft Certification Service, 1601 Lind Avenue SW., Renton, 
Washington 98055-4056; telephone (425) 227-2132, facsimile (425) 227-
1320; e-mail: [email protected].

SUPPLEMENTARY INFORMATION:

Availability of Final Rules

    You can get an electronic copy using the Internet by taking the 
following steps:
    (1) Go to the search function of the Department of Transportation's 
electronic Docket Management System (DMS) Web page (http://dms.dot.gov/search).
    (2) On the search page type in the last four digits of the Docket 
number shown at the beginning of this notice. Click on ``search.''
    (3) On the next page, which contains the Docket summary information 
for the Docket you selected, click on the final rule.
    (4) To view or download the document click on either ``Scanned 
Image (TIFF)'' or ``Adobe PDF.''
    You can also get an electronic copy using the Internet through 
FAA's web page at http://www.faa.gov/avr/arm/nprm/nprm.htm or the 
Federal Register's web page at http://www.access.gpo.gov/su_docs/aces/aces140.html.
    You can also get a copy by submitting a request to the Federal 
Aviation Administration, Office of Rulemaking, ARM-1, 800 Independence 
Avenue SW., Washington, DC 20591, or by calling (202) 267-9680. Make 
sure to identify the amendment number or docket number of this final 
rule.

Small Business Regulatory Enforcement Fairness Act

    The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 
1996 requires FAA to comply with small entity requests for information 
or advice about compliance with statutes and regulations within its 
jurisdiction. Therefore, any small entity that has a question regarding 
this document may contact their local FAA official, or the person 
listed under FOR FURTHER INFORMATION CONTACT. You can find out more 
about SBREFA on the Internet at our site, http://www.gov/avr/arm/sbrefa.htm. For more information on SBREFA, e-mail us at [email protected].

Background

    On October 26, 1999, the FAA issued Notice of Proposed Rulemaking 
(NPRM) 99-18, which was published in the Federal Register on October 
29, 1999 (64 FR 58644). That notice proposed three separate 
requirements:
    First, a requirement was proposed for the design approval holders 
of certain transport category airplanes to conduct a safety review of 
the airplane fuel tank system and to develop specific fuel tank system 
maintenance and inspection instructions for any items determined to 
require repetitive inspections or maintenance.
    Second, a requirement was proposed to prohibit the operation of 
those airplanes beyond a specified time, unless the operators of those 
airplanes incorporated instructions for maintenance and inspection of 
the fuel tank system into their inspection programs.
    Third, for new designs, the proposal included a requirement for 
minimizing the flammability of fuel tanks, a requirement concerning 
detailed failure analysis to preclude the presence of ignition sources 
in the fuel tanks and including mandatory fuel system maintenance in 
the limitations section of the Instructions for Continued 
Airworthiness.

Issues Prompting This Rulemaking Activity

    On July 17, 1996, a 25-year old Boeing Model 747-100 series 
airplane was involved in an inflight breakup after takeoff from Kennedy 
International Airport in New York, resulting in 230 fatalities. The 
accident investigation conducted by the National Transportation Safety 
Board (NTSB) indicated that the center wing fuel tank exploded due to 
an unknown ignition source. The NTSB issued recommendations intended 
to:
     Reduce heating of the fuel in the center wing fuel tanks 
on the existing fleet of transport airplanes,
     Reduce or eliminate operation with flammable vapors in the 
fuel tanks of new type certificated airplanes, and
     Reevaluate the fuel system design and maintenance 
practices on the fleet of transport airplanes.
    The accident investigation focused on mechanical failure as 
providing the energy source that ignited the fuel vapors inside the 
tank.
    The NTSB announced their official findings of the TWA 800 accident 
at a public meeting held August 22-23, 2000, in Washington, DC. The 
NTSB determined that the probable cause of the explosion was ignition 
of the flammable fuel/air mixture in the center wing fuel tank. 
Although the ignition source could not be determined with certainty, 
the NTSB determined that the most likely source was a short circuit 
outside of the center wing tank that allowed excessive voltage to enter 
the tank through electrical wiring associated with the fuel quantity 
indication system (FQIS). Opening remarks at the hearing also indicated 
that:

``* * * This investigation and several others have brought to light 
some broader issues regarding aircraft certification. For example, 
there are questions about the adequacy of the risk analyses that are 
used as the basis for demonstrating compliance with many 
certification requirements.''

    This accident prompted the FAA to examine the underlying safety 
issues surrounding fuel tank explosions, the

[[Page 23087]]

adequacy of the existing regulations, the service history of airplanes 
certificated to these regulations, and existing maintenance practices 
relative to the fuel tank system.

Flammability Characteristics

    The flammability characteristics of the various fuels approved for 
use in transport airplanes results in the presence of flammable vapors 
in the vapor space of fuel tanks at various times during the operation 
of the airplane. Vapors from Jet A fuel (the typical commercial 
turbojet engine fuel) at temperatures below approximately 100 deg.F are 
too lean to be flammable at sea level; at higher altitudes the fuel 
vapors become flammable at temperatures above approximately 45 deg.F 
(at 40,000 feet altitude).
    However, the regulatory authorities and aviation industry have 
always presumed that a flammable fuel air mixture exists in the fuel 
tanks at all times and have adopted the philosophy that the best way to 
ensure airplane fuel tank safety is to preclude ignition sources within 
fuel tanks. This philosophy has been based on the application of fail-
safe design requirements to the airplane fuel tank system to preclude 
ignition sources from being present in fuel tanks when component 
failures, malfunctions, or lightning encounters occur.
    Possible ignition sources that have been considered include:
     Electrical arcs,
     Friction sparks, and
     Autoignition. (The autoignition temperature is the 
temperature at which the fuel/air mixture will spontaneously ignite due 
to heat in the absence of an ignition source.)
    Some events that could produce sufficient electrical energy to 
create an arc include:
     Lightning,
     Electrostatic charging,
     Electromagnetic interference (EMI), or
     Failures in airplane systems or wiring that introduce 
high-power electrical energy into the fuel tank system.
    Friction sparks may be caused by mechanical contact between certain 
rotating components in the fuel tank, such as a steel fuel pump 
impeller rubbing on the pump inlet check valve. Autoignition of fuel 
vapors may be caused by failure of components within the fuel tank, or 
external components or systems that cause components or tank surfaces 
to reach a high enough temperature to ignite the fuel vapors in the 
fuel tank.

Existing Regulations/Certification Methods

    The current 14 CFR part 25 regulations that are intended to require 
designs that preclude the presence of ignition sources within the 
airplane fuel tanks are as follows:
    Section 25.901 is a general requirement that applies to all 
portions of the propulsion installation, which includes the airplane 
fuel tank system. It requires, in part, that the propulsion and fuel 
tank systems be designed to ensure fail-safe operation between normal 
maintenance and inspection intervals, and that the major components be 
electrically bonded to the other parts of the airplane.
    Sections 25.901(c) and 25.1309 provide airplane system fail-safe 
requirements. Section 25.901(c) requires that ``no single failure or 
malfunction or probable combination of failures will jeopardize the 
safe operation of the airplane.'' In general, the FAA's policy has been 
to require applicants to assume the presence of foreseeable latent 
(undetected) failure conditions when demonstrating that subsequent 
single failures will not jeopardize the safe operation of the airplane.
    Certain subsystem designs must also comply with Sec. 25.1309. That 
section requires airplane systems and associated systems to be:

    ``* * * designed so that the occurrence of any failure condition 
which would prevent the continued safe flight and landing of the 
airplane is extremely improbable, and the occurrence of any other 
failure conditions which would reduce the capability of the airplane 
or the ability of the crew to cope with adverse operating conditions 
is improbable.''

    Compliance with Sec. 25.1309 requires an analysis, and testing 
where appropriate, considering possible modes of failure, including 
malfunctions and damage from external sources, the probability of 
multiple failures and undetected failures, the resulting effects on the 
airplane and occupants, considering the stage of flight and operating 
conditions, and the crew warning cues, corrective action required, and 
the capability of detecting faults.
    This provision has the effect of mandating the use of ``fail-safe'' 
design methods, which require that the effect of failures and 
combinations of failures be considered in defining a safe design. 
Detailed methods of compliance with Secs. 25.1309(b), (c), and (d) are 
described in Advisory Circular (AC) 25.1309-1A, ``System Design 
Analysis,'' and are intended as a means to evaluate the overall risk, 
on average, of an event occurring within a fleet of aircraft. The 
following guidance involving failures is offered in that AC:
     In any system or subsystem, a single failure of any 
element or connection during any one flight must be assumed without 
consideration as to its probability of failing. This single failure 
must not prevent the continued safe flight and landing of the airplane.
     Additional failures during any one flight following the 
first single failure must also be considered when the probability of 
occurrence is not shown to be extremely improbable. The probability of 
these combined failures includes the probability of occurrence of the 
first failure.
    As described in the AC, the FAA fail-safe design concept consists 
of the following design principles or techniques intended to ensure a 
safe design. The use of only one of these principles is seldom 
adequate. A combination of two or more design principles is usually 
needed to provide a fail-safe design (i.e., to ensure that catastrophic 
failure conditions are not expected to occur during the life of the 
fleet of a particular airplane model).
     Design integrity and quality, including life limits, to 
ensure intended function and prevent failures.
     Redundancy or backup systems that provide system function 
after the first failure (e.g., two or more engines, two or more 
hydraulic systems, dual flight controls, etc.)
     Isolation of systems and components so that failure of one 
element will not cause failure of the other (sometimes referred to as 
system independence).
     Detection of failures or failure indication.
     Functional verification (the capability for testing or 
checking the component's condition).
     Proven reliability and integrity to ensure that multiple 
component or system failures will not occur in the same flight.
     Damage tolerance that limits the safety impact or effect 
of the failure.
     Designed failure path that controls and directs the 
failure, by design, to limit the safety impact.
     Flightcrew procedures following the failure designed to 
assure continued safe flight by specific crew actions.
     Error tolerant design that considers probable human error 
in the operation, maintenance, and fabrication of the airplane.
     Margins of safety that allow for undefined and 
unforeseeable adverse flight conditions.
    These regulations, when applied to typical airplane fuel tank 
systems, are

[[Page 23088]]

intended to prevent ignition sources inside fuel tanks. The approval of 
the installation of mechanical and electrical components inside the 
fuel tanks was typically based on a qualitative system safety analysis 
and component testing which showed that:
     Mechanical components would not create sparks or high 
temperature surfaces in the event of any failure; and
     Electrical devices would not create arcs of sufficient 
energy to ignite a fuel-air mixture in the event of a single failure or 
probable combination of failures.
    Section 25.901(b)(2) requires that the components of the propulsion 
system be ``constructed, arranged, and installed so as to ensure their 
continued safe operation between normal inspection or overhauls.'' 
Compliance with this regulation is typically demonstrated by 
substantiating that the propulsion installation, which includes the 
fuel tank system, will safely perform its intended function between 
inspections and overhauls defined in the maintenance instructions.
    Section 25.901(b)(4) requires electrically bonding the major 
components of the propulsion system to the other parts of the airplane. 
The affected major components of the propulsion system include the fuel 
tank system. Compliance with this requirement for fuel tank systems has 
been demonstrated by showing that all major components in the fuel tank 
are electrically bonded to the airplane structure. This precludes 
accumulation of electrical charge on the components and the possible 
arcing in the fuel tank that could otherwise occur. In most cases, 
electrical bonding is accomplished by installing jumper wires from each 
major fuel tank system component to airplane structure. Advisory 
Circular 25-8, ``Auxiliary Fuel Tank Installations,'' also provides 
guidance for bonding of fuel tank system components and means of 
precluding ignition sources within transport airplane fuel tanks.
    Section 25.954 requires that the fuel tank system be designed and 
arranged to prevent the ignition of fuel vapor within the system due to 
the effects of lightning strikes. Compliance with this regulation is 
typically shown by incorporation of design features such as minimum 
fuel tank skin thickness, location of vent outlets out of likely 
lightning strike areas, and bonding of fuel tank system structure and 
components. Guidance for demonstrating compliance with this regulation 
is provided in AC 20-53A, ``Protection of Aircraft Fuel Systems Against 
Fuel Vapor Ignition Due to Lightning.''
    Section 25.981 requires that the applicant determine the highest 
temperature allowable in fuel tanks that provides a safe margin below 
the lowest expected autoignition temperature of the fuel that is 
approved for use in the fuel tanks. No temperature at any place inside 
any fuel tank where fuel ignition is possible may then exceed that 
maximum allowable temperature. This must be shown under all probable 
operating, failure, and malfunction conditions of any component whose 
operation, failure, or malfunction could increase the temperature 
inside the tank. Guidance for demonstrating compliance with this 
regulation has been provided in AC 25.981-1A, ``Guidelines For 
Substantiating Compliance With the Fuel Tank Temperature 
Requirements.'' The AC provides a listing of failure modes of fuel tank 
system components that should be considered when showing that component 
failures will not create a hot surface that exceeds the maximum 
allowable fuel tank component or tank surface temperature for the fuel 
type for which approval is being requested. Manufacturers have 
demonstrated compliance with this regulation by testing and analysis of 
components to show that design features, such as thermal fuses in fuel 
pump motors, preclude an ignition source in the fuel tank when failures 
such as a seized fuel pump rotor occur.

Airplane Maintenance Manuals and Instructions for Continued 
Airworthiness

    Historically, manufacturers have been required to provide 
maintenance-related information for fuel tank systems in the same 
manner as for other systems. Prior to 1970, most manufacturers provided 
manuals containing maintenance information for large transport category 
airplanes, but there were no standards prescribing minimum content, 
distribution, and a timeframe in which the information must be made 
available to the operator.
    Section 25.1529, as amended by Amendment 25-21 in 1970, required 
the applicant for a type certificate (TC) to provide airplane 
maintenance manuals (AMM) to owners of the airplanes. This regulation 
was amended in 1980 to require that the applicant for type 
certification provide Instructions for Continued Airworthiness (ICA) 
prepared in accordance with Appendix H to part 25. In developing the 
ICA, the applicant is required to include certain information such as a 
description of the airplane and its systems, servicing information, and 
maintenance instructions, including the frequency and extent of 
inspections necessary to provide for the continuing airworthiness of 
the airplane (including the fuel tank system). As required by Appendix 
H to part 25, the ICA must also include an FAA-approved Airworthiness 
Limitations section enumerating those mandatory inspections, inspection 
intervals, replacement times, and related procedures approved under 
Sec. 25.571, relating to structural damage tolerance. Before this 
amendment, the Airworthiness Limitations section of the ICA applied 
only to airplane structure and not to the fuel tank system.
    One method of establishing initial scheduled maintenance and 
inspection tasks is the Maintenance Steering Group (MSG) process, which 
develops a Maintenance Review Board (MRB) document for a particular 
airplane model. Operators may incorporate those provisions, along with 
other maintenance information contained in the ICA, into their 
maintenance or inspection program.
    Section 21.50 requires the holder of a design approval, including a 
TC or supplemental type certificate (STC) for an airplane, aircraft 
engine, or propeller for which application was made after January 28, 
1981, to furnish at least one set of the complete ICA to the owner of 
the product for which the application was made. The ICA for original 
type certificated products must include instructions for the fuel tank 
system. A design approval holder who has modified the fuel tank system 
must furnish a complete set of the ICA for the modification to the 
owner of the product.

Type Certificate Amendments Based on Major Change in Type Design

    Over the years, design changes have been introduced into fuel tank 
systems that may affect their safety. There are three ways in which 
major design changes can be approved:
    1. The TC holder may be granted an amendment to the type design.
    2. Any person, including the TC holder, wanting to alter a product 
by introducing a major change in the type design not great enough to 
require a new application for a TC, may be granted an STC.
    3. In some instances, a person may also make an alteration to the 
type design and receive a field approval. The field approval process is 
a method for obtaining approval of relatively simple modifications to 
airplanes. In this process, an authorized FAA Flight Standards 
Inspector can approve the alteration by use of FAA Form 337.

[[Page 23089]]

Maintenance and Inspection Program Requirements

    Airplane operators are required to have extensive maintenance or 
inspection programs that include provisions relating to fuel tank 
systems.
    Section 91.409(e), which generally applies to other than commercial 
operations, requires an operator of a large turbojet multiengine 
airplane or a turbopropeller-powered multiengined airplane to select 
one of the following four inspection programs:
    1. A continuous airworthiness inspection program that is part of a 
continuous airworthiness maintenance program currently in use by a 
person holding an air carrier operating certificate, or an operating 
certificate issued under part 119 for operations under parts 121 or 
135, and operating that make and model of airplane under those parts;
    2. An approved airplane inspection program approved under 
Sec. 135.419 and currently in use by a person holding an operating 
certificate and operations specifications issued under part 119 for 
part 135 operations;
    3. A current inspection program recommended by the manufacturer; or
    4. Any other inspection program established by the registered owner 
or operator of that airplane and approved by the Administrator.
    Section 121.367, which is applicable to those air carrier and 
commercial operations covered by part 121, requires operators to have 
an inspection program, as well as a program covering other maintenance, 
preventative maintenance, and alterations.
    Section 125.247, which is generally applicable to operation of 
large airplanes, other than air carrier operations conducted under part 
121, requires operators to inspect their airplanes in accordance with 
an inspection program approved by the Administrator.
    Section 129.14 requires a foreign air carrier and each foreign 
operator of a U.S. registered airplane in common carriage, within or 
outside the U.S., to maintain the airplane in accordance with an FAA-
approved program.
    In general, the operators rely on the TC data sheet, MRB reports, 
ICA's, the Airworthiness Limitations section of the ICA, other 
manufacturers' recommendations, and their own operating experience to 
develop the overall maintenance or inspection program for their 
airplanes.
    The intent of the rules governing the inspection and/or maintenance 
program is to ensure that the inherent level of safety that was 
originally designed into the system is maintained and that the airplane 
is in an airworthy condition.
    Historically, for fuel tank systems these required programs 
include:
     Operational checks (e.g., a task to determine if an item 
is fulfilling its intended function);
     Functional checks (e.g., a quantitative task to determine 
if functions perform within specified limits);
     Overhaul of certain components to restore them to a known 
standard; and
     General zonal visual inspections conducted concurrently 
with other maintenance actions, such as structural inspections.
    However, specific maintenance instructions to detect and correct 
conditions that degrade fail-safe capabilities have not been deemed 
necessary because it has been assumed that the original fail-safe 
capabilities would not be degraded in service.

Design and Service History Review

    The FAA has examined the service history of transport airplanes and 
performed an analysis of the history of fuel tank explosions on these 
airplanes. While there were a significant number of fuel tank fires and 
explosions that occurred during the 1960's and 1970's on several 
airplane types, in most cases, the fire or explosion was found to be 
related to design practices, maintenance actions, or improper 
modification of fuel pumps. Some of the events were apparently caused 
by lightning strikes. Extensive design reviews were conducted to 
identify possible ignition sources, and actions were taken that were 
intended to prevent similar occurrences. However, fuel tank system-
related accidents have occurred in spite of these efforts.
    On May 11, 1990, the center wing fuel tank of a Boeing Model 737-
300 exploded while the airplane was on the ground at Nimoy Aquino 
International Airport, Manila, Philippines. The airplane was less than 
one year old. In the accident, the fuel-air vapors in the center wing 
tank exploded as the airplane was being pushed back from a terminal 
gate prior to flight. The accident resulted in 8 fatalities and 
injuries to an additional 30 people. Accident investigators considered 
a plausible scenario in which damaged wiring located outside the fuel 
tank might have created a short between 115-volt airplane system wires 
and 28 volt wires to a fuel tank level switch. This, in combination 
with a possible latent defect of the fuel level float switch, was 
investigated as a possible source of ignition. However, a definitive 
ignition source was never confirmed during the accident investigation. 
This unexplained accident occurred on a newer airplane, in contrast to 
the July 17, 1996, accident that occurred on an older Boeing Model 747 
airplane that was approaching the end of its initial design life.
    The Model 747 and 737 accidents indicate that the development of an 
ignition source inside the fuel tank may be related to both the design 
and maintenance of the fuel tank systems.

National Transportation Safety Board (NTSB) Recommendations

    Since the July 17, 1996, accident, the FAA, NTSB, and aviation 
industry have been reviewing the design features and service history of 
the Boeing Model 747 and certain other transport airplane models. Based 
upon its review, the NTSB has issued the following recommendations to 
the FAA intended to reduce exposure to operation with flammable vapors 
in fuel tanks and address possible degradation of the original type 
certificated fuel tank system designs on transport airplanes.
    The following recommendations relate to ``Reduced Flammability 
Exposure'':
    ``A-96-174: Require the development of and implementation of design 
or operational changes that will preclude the operation of transport-
category airplanes with explosive fuel-air mixtures in the fuel tanks:
    LONG TERM DESIGN MODIFICATIONS:
    (a) Significant consideration should be given to the development of 
airplane design modification, such as nitrogen-inerting systems and the 
addition of insulation between heat-generating equipment and fuel 
tanks. Appropriate modifications should apply to newly certificated 
airplanes and, where feasible, to existing airplanes.''
    ``A-96-175: Require the development of and implementation of design 
or operational changes that will preclude the operation of transport-
category airplanes with explosive fuel-air mixtures in the fuel tanks:
    NEAR TERM OPERATIONAL
    (b) Pending implementation of design modifications, require 
modifications in operational procedures to reduce the potential for 
explosive fuel-air mixtures in the fuel tanks of transport-category 
aircraft. In the B-747, consideration should be given to refueling the 
center wing fuel tank (CWT) before flight whenever possible from cooler 
ground fuel tanks, proper monitoring and management of the CWT fuel 
temperature, and maintaining an appropriate minimum fuel quantity in 
the CWT.''

[[Page 23090]]

    ``A-96-176: Require that the B-747 Flight Handbooks of TWA and 
other operators of B-747s and other aircraft in which fuel tank 
temperature cannot be determined by flightcrews be immediately revised 
to reflect the increases in CWT fuel temperatures found by flight 
tests, including operational procedures to reduce the potential for 
exceeding CWT temperature limitations.''
    ``A-96-177: Require modification of the CWT of B-747 airplanes and 
the fuel tanks of other airplanes that are located near heat sources to 
incorporate temperature probes and cockpit fuel tank temperature 
displays to permit determination of the fuel tank temperatures.''
    The following recommendations relate to ``Ignition Source 
Reduction'':
    ``A-98-36: Conduct a survey of fuel quantity indication system 
probes and wires in Boeing Model 747's equipped with systems other than 
Honeywell Series 1-3 probes and compensators and in other model 
airplanes that are used in Title 14 Code of Federal Regulations Part 
121 service to determine whether potential fuel tank ignition sources 
exist that are similar to those found in the Boeing Model 747. The 
survey should include removing wires from fuel probes and examining the 
wires for damage. Repair or replacement procedures for any damaged 
wires that are found should be developed.''
    ``A-98-38: Require in Boeing Model 747 airplanes, and in other 
airplanes with fuel quantity indication system (FQIS) wire 
installations that are co-routed with wires that may be powered, the 
physical separation and electrical shielding of FQIS wires to the 
maximum extent possible.''
    ``A-98-39: Require, in all applicable transport airplane fuel 
tanks, surge protection systems to prevent electrical power surges from 
entering fuel tanks through fuel quantity indication system wires.''

Service History

    The FAA has reviewed service difficulty reports for the transport 
airplane fleet and evaluated the certification and design practices 
utilized on these previously certificated airplanes. An inspection of 
fuel tanks on Boeing Model 747 airplanes also was initiated. 
Representatives from the Air Transport Association (ATA), Association 
of European Airlines (AEA), the Association of Asia Pacific Airlines 
(AAPA), the Aerospace Industries Association of America, and the 
European Association of Aerospace Industries initiated a joint effort 
to inspect and evaluate the condition of the fuel tank system 
installations on a representative sample of airplanes within the 
transport fleet. The fuel tanks of more than 800 airplanes were 
inspected. Data from inspections conducted as part of this effort and 
shared with the FAA have assisted in establishing a basis for 
developing corrective action for airplanes within the transport fleet.
    In addition to the results from these inspections, the FAA has 
received reports of anomalies on in-service airplanes that have 
necessitated actions to preclude development of ignition sources in or 
adjacent to airplane fuel tanks.
    The following provides a summary of findings from design 
evaluations, service difficulty reports, and a review of current 
airplane maintenance practices.

Aging Airplane Related Phenomena

    Fuel tank inspections initiated as part of the Boeing Model 747 
accident investigation identified aging of fuel tank system components, 
contamination, corrosion of components and sulfide deposits on 
components as possible conditions that could contribute to development 
of ignition sources within the fuel tanks. Results of detailed 
inspection of the fuel pump wiring on several Boeing Model 747 
airplanes showed debris within the fuel tanks consisting of lockwire, 
rivets, and metal shavings. Debris was also found inside scavenge 
pumps. Corrosion and damage to insulation on FQIS probe wiring was 
found on 6 out of 8 probes removed from one in-service airplane.
    In addition, inspection of airplane fuel tank system components 
from out-of-service (retired) airplanes, initiated following the 
accident, revealed damaged wiring and corrosion buildup of conductive 
sulfide deposits on the FQIS wiring on some Boeing Model 747 airplanes. 
The conductive deposits or damaged wiring may result in a location 
where arcing could occur if high power electrical energy was 
transmitted to the FQIS wiring from adjacent wires that power other 
airplane systems.
    While the effects of corrosion on fuel tank system safety have not 
been fully evaluated, the FAA has initiated a research program to 
better understand the effects of sulfide deposits and corrosion on the 
safety of airplane fuel tank systems.
    Wear or chafing of electrical power wires routed in conduits that 
are located inside fuel tanks can result in arcing through the 
conduits. On December 23, 1996, the FAA issued Airworthiness Directive 
(AD) 96-26-06, applicable to certain Boeing Model 747 airplanes, which 
required inspection of electrical wiring routed within conduits to fuel 
pumps located in the wing fuel tanks and replacement of any damaged 
wiring. Inspection reports indicated that many instances of wear had 
occurred on Teflon sleeves installed over the wiring to protect it from 
damage and possible arcing to the conduit.
    Inspections of wiring to fuel pumps on Boeing Model 737 airplanes 
with over 35,000 flight hours have shown significant wear to the 
insulation of wires inside conduits that are located in fuel tanks. In 
nine reported cases, wear resulted in arcing to the fuel pump wire 
conduit on airplanes with greater than 50,000 flight hours. In one 
case, wear resulted in burnthrough of the conduit into the interior of 
the 737 main tank fuel cell. On May 14, 1998, the FAA issued a 
telegraphic AD, T98-11-52, which required inspection of wiring to 
Boeing Model 737 airplane fuel pumps routed within electrical conduits 
and replacement of any damaged wiring. Results of these inspections 
showed that wear of the wiring occurred in many instances, particularly 
on those airplanes with high numbers of flight cycles and operating 
hours.
    The FAA also has received reports of corrosion on bonding jumper 
wires within the fuel tanks on one in-service Airbus Model A300 
airplane. The manufacturer investigating this event did not have 
sufficient evidence to determine conclusively the level of damage and 
corrosion found on the jumper wires. Although the airplane was in long-
term storage, it does not explain why a high number of damaged/corroded 
jumper wires were found concentrated in a specific area of the wing 
tanks. Further inspections of a limited number of other Airbus models 
did not reveal similar extensive corrosion or damage to bonding jumper 
wires. However, they did reveal evidence of the accumulation of sulfide 
deposits around the outer braid of some jumper wires. Tests by the 
manufacturer have shown that these deposits did not affect the bonding 
function of the leads. Airbus has developed a one-time-inspection 
service bulletin for all its airplanes to ascertain the extent of the 
sulfide deposits and to ensure that the level of jumper wire damage 
found on the one Model A300 airplane is not widespread.
    On March 30, 1998, the FAA received reports of three recent 
instances of electrical arcing within fuel pumps installed in fuel 
tanks on Lockheed Model L-1011 airplanes. In one case, the electrical 
arc had penetrated the pump and housing and entered the fuel tank. 
Preliminary investigation indicates

[[Page 23091]]

that features incorporated into the fuel pump design that were intended 
to preclude overheating and arc-through into the fuel tank may not have 
functioned as intended due to discrepancies introduced during overhaul 
of the pumps. Emergency AD 98-08-09 was issued April 3, 1998, to 
specify a minimum quantity of fuel to be carried in the fuel tanks for 
the purpose of covering the pumps with liquid fuel and thereby 
precluding ignition of vapors within the fuel tank until such time as 
terminating corrective action could be developed.

Unforeseen Fuel Tank System Failures

    After an extensive review of the Boeing Model 747 design following 
the July 17, 1996, accident, the FAA determined that during original 
certification of the fuel tank system, the degree of tank contamination 
and the significance of certain failure modes of fuel tank system 
components had not been considered to the extent that more recent 
service experience indicates is needed. For example, in the absence of 
contamination, the FQIS had been shown to preclude creating an arc if 
FQIS wiring were to come in contact with the highest level of 
electrical voltage on the airplane. This was shown by demonstrating 
that the voltage needed to cause an arc in the fuel probes due to an 
electrical short condition was well above any voltage level available 
in the airplane systems.
    However, recent testing has shown that if contamination, such as 
conductive debris (lock wire, nuts, bolts, steel wool, corrosion, 
sulfide deposits, metal filings, etc.) is placed within gaps in the 
fuel probe, the voltage needed to cause an arc is within values that 
may occur due to a subsequent electrical short or induced current on 
the FQIS probe wiring from electromagnetic interference caused by 
adjacent wiring. These anomalies, by themselves, could not lead to an 
electrical arc within the fuel tanks without the presence of an 
additional failure. If any of these anomalies were combined with a 
subsequent failure within the electrical system that creates an 
electrical short, or if high-intensity radiated fields (HIRF) or 
electrical current flow in adjacent wiring induces EMI voltage in the 
FQIS wiring, sufficient energy could enter the fuel tank and cause an 
ignition source within the tank.
    On November 26, 1997, in Docket No. 97-NM-272-AD, the FAA proposed 
a requirement for operators of Boeing Model 747-100, -200, and -300 
series airplanes to install components for the suppression of 
electrical transients and/or the installation of shielding and 
separation of fuel quantity indicating system wiring from other 
airplane system wiring. After reviewing the comments received on the 
proposed requirements, the FAA issued AD 98-20-40 on September 23, 
1998, that requires the installation of shielding and separation of the 
electrical wiring of the fuel quantity indication system. On April 14, 
1998, the FAA proposed a similar requirement for Boeing Model 737-100, 
-200, -300, -400, and -500 series airplanes in Docket No. 98-NM-50-AD, 
which led to the FAA issuing AD 99-03-04 on January 26, 1999. The 
action required by those two airworthiness directives is intended to 
preclude high levels of electrical energy from entering the airplane 
fuel tank wiring due to electromagnetic interference or electrical 
shorts. Several manufacturers have been granted approval for the use of 
alternative methods of compliance (AMOC) with these AD's that permit 
installation of transient suppressing devices in the FQIS wiring that 
prevent unwanted electrical power from entering the fuel tank. All 
later model Boeing Model 747 and 737 FQIS's have wire separation and 
fault isolation features that may meet the intent of these AD actions. 
This rulemaking will require evaluation of these later designs and the 
designs of other transport airplanes.
    Other examples of unanticipated failure conditions include 
incidents of parts from fuel pump assemblies impacting or contacting 
the rotating fuel pump impeller. The first design anomaly was 
identified when two incidents of damage to fuel pumps were reported on 
Boeing Model 767 airplanes. In both cases objects from a fuel pump 
inlet diffuser assembly were ingested into the fuel pump, causing 
damage to the pump impeller and pump housing. The damage could have 
caused sparks or hot debris from the pump to enter the fuel tank. To 
address this unsafe condition, the FAA issued AD 97-19-15. This AD 
requires revision of the airplane flight manual to include procedures 
to switch off the fuel pumps when the center tank approaches empty. The 
intent of this interim action is to maintain liquid fuel over the pump 
inlet so that any debris generated by a failed fuel pump will not come 
in contact with fuel vapors and cause a fuel tank explosion.
    The second design anomaly was reported on Boeing Model 747-400 
series airplanes. The reports indicated that inlet adapters of the 
override/jettison pumps of the center wing fuel tank were worn. Two of 
the inlet adapters had worn down enough to cause damage to the rotating 
blades of the inducer. The inlet check valves also had significant 
damage. An operator reported damage to the inlet adapter so severe that 
contact had occurred between the steel disk of the inlet check valve 
and the steel screw that holds the inducer in place. Wear to the inlet 
adapters has been attributed to contact between the inlet check valve 
and the adapter. Such excessive wear of the inlet adapter can lead to 
contact between the inlet check valve and inducer, which could result 
in pieces of the check valve being ingested into the inducer and 
damaging the inducer and impellers. Contact between the steel disk of 
the inlet check valve and the steel rotating inducer screw can cause 
sparks. To address this unsafe condition, the FAA issued an immediately 
adopted rule, AD 98-16-19, on July 30, 1998.
    Another design anomaly was reported in 1989 when a fuel tank 
ignition event occurred in an auxiliary fuel tank during refueling of a 
Beech Model 400 airplane. The auxiliary fuel tank had been installed 
under an STC. Polyurethane foam had been installed in portions of the 
tank to minimize the potential of a fuel tank explosion if uncontained 
engine debris penetrated those portions of the tank. The accident 
investigation indicated that electrostatic charging of the foam during 
refueling resulted in ignition of fuel-air vapors in portions of the 
adjacent fuel tank system that did not contain the foam. The fuel vapor 
explosion caused distortion of the tank and fuel leakage from a failed 
fuel line. Modifications to the design, including use of more 
conductive polyurethane foam and installation of a standpipe in the 
refueling system, were incorporated to prevent reoccurrence of 
electrostatic charging and a resultant fuel tank ignition source.

Review of Fuel Tank System Maintenance Practices

    In addition to the review of the design features and service 
history of the Boeing Model 747 and other airplane models in the 
transport airplane fleet, the FAA also has reviewed the current fuel 
tank system maintenance practices for these airplanes.
    Typical transport category airplane fuel tank systems are designed 
with redundancy and fault indication features such that single 
component failures do not result in any significant reduction in 
safety. Therefore, fuel tank systems historically have not had any 
life-limited components or specific detailed inspection requirements, 
unless mandated by airworthiness directives.

[[Page 23092]]

    Most of the components are ``on condition,'' meaning that some 
test, check, or other inspection is performed to determine continued 
serviceability, and maintenance is performed only if the inspection 
identifies a condition requiring correction. Visual inspection of fuel 
tank system components is by far the predominant method of inspection 
for components such as boost pumps, fuel lines, couplings, wiring, etc. 
Typically, these inspections are conducted concurrently with zonal 
inspections or internal or external fuel tank structural inspections. 
These inspections normally do not provide information regarding the 
continued serviceability of components within the fuel tank system, 
unless the visual inspection indicates a potential problem area. For 
example, it would be difficult, if not impossible, to detect certain 
degraded fuel tank system conditions, such as worn wiring routed 
through conduit to fuel pumps, debris inside fuel pumps, corrosion to 
bonding wire interfaces, etc., without dedicated intrusive inspections 
that are much more extensive than those normally conducted.

Listing of Deficiencies

    The list provided below summarizes fuel tank system design 
deficiencies, malfunctions, failures, and maintenance-related actions 
that have been determined through service experience to result in a 
degradation of the safety features of airplane fuel tank systems. This 
list was developed from service difficulty reports and incident and 
accident reports. These anomalies occurred on in-service transport 
category airplanes despite regulations and policies in place to 
preclude the development of ignition sources within airplane fuel tank 
systems.
    1. Pumps:
     Ingestion of the pump inducer into the pump impeller and 
generation of debris into the fuel tank.
     Pump inlet case degradation, allowing the pump inlet check 
valve to contact the impeller.
     Stator winding failures during operation of the fuel pump. 
Subsequent failure of a second phase of the pump resulting in arcing 
through the fuel pump housing.
     Deactivation of thermal protective features incorporated 
into the windings of pumps due to inappropriate wrapping of the 
windings.
     Omission of cooling port tubes between the pump assembly 
and the pump motor assembly during fuel pump overhaul.
     Extended dry running of fuel pumps in empty fuel tanks, 
which was contrary to the manufacturer's recommended procedures.
     Use of steel impellers that may produce sparks if debris 
enters the pump.
     Debris lodged inside pumps.
     Arcing due to the exposure of electrical connections 
within the pump housing that have been designed with inadequate 
clearance to the pump cover.
     Thermal switches resetting over time to a higher trip 
temperature.
     Flame arrestors falling out of their respective mounting.
     Internal wires coming in contact with the pump rotating 
group, energizing the rotor and arcing at the impeller/adapter 
interface.
     Poor bonding across component interfaces.
     Insufficient ground fault current protection capability.
     Poor bonding of components to structure.
    2. Wiring to pumps in conduits located inside fuel tanks: 
     Wear of Teflon sleeving and wiring insulation allowing 
arcing from wire through metallic conduits into fuel tanks.
    3. Fuel pump connectors: 
     Electrical arcing at connections within electrical 
connectors due to bent pins or corrosion.
     Fuel leakage and subsequent fuel fire outside of the fuel 
tank caused by corrosion of electrical connectors inside the pump motor 
which lead to electrical arcing through the connector housing 
(connector was located outside the fuel tank).
     Selection of improper materials in connector design.
    4. FQIS wiring: 
     Degradation of wire insulation (cracking), corrosion and 
sulfide deposits at electrical connectors
     Unshielded FQIS wires routed in wire bundles with high 
voltage wires.
    5. FQIS probes: 
     Corrosion and sulfide deposits causing reduced breakdown 
voltage in FQIS wiring.
     Terminal block wiring clamp (strain relief) features at 
electrical connections on fuel probes causing damage to wiring 
insulation.
     Contamination in the fuel tanks causing a reduced arc path 
between FQIS probe walls (steel wool, lock wire, nuts, rivets, bolts; 
or mechanical impact damage to probes).
    6. Bonding straps: 
     Corrosion to bonding straps.
     Loose or improperly grounded attachment points.
     Static bonds on fuel tank system plumbing connections 
inside the fuel tank worn due to mechanical wear of the plumbing from 
wing movement and corrosion.
    7. Electrostatic charge: 
     Use of non-conductive reticulated polyurethane foam that 
holds electrostatic charge buildup.
     Spraying of fuel into fuel tanks through inappropriately 
designed refueling nozzles or pump cooling flow return methods.

Fuel Tank Flammability

    In addition to the review of potential fuel tank ignition, the FAA 
has undertaken a parallel effort to address the threat of fuel tank 
explosions by eliminating or significantly reducing the presence of 
explosive fuel air mixtures within the fuel tanks of new type designs, 
in-production, and the existing fleet of transport airplanes.
    On April 3, 1997, the FAA published a notice in the Federal 
Register (62 FR 16014) that requested comments concerning the 1996 NTSB 
recommendations regarding reduced flammability listed earlier in this 
notice. That notice provided significant discussion of service history, 
background, and issues relating to reducing flammability in transport 
airplane fuel tanks. Review of the comments submitted to that notice 
indicated that additional information was needed before the FAA could 
initiate rulemaking action to address the recommendations.
    On January 23, 1998, the FAA published a notice in the Federal 
Register that established and tasked an Aviation Rulemaking Advisory 
Committee (ARAC) working group, the Fuel Tank Harmonization Working 
Group (FTHWG), to provide additional information prior to rulemaking. 
The ARAC consists of interested parties, including the public, and 
provides a public process to advise the FAA concerning development of 
new regulations.


    Note: The FAA formally established ARAC in 1991 (56 FR 2190, 
January 22, 1991), to provide advice and recommendations concerning 
the full range of the FAA's safety-related rulemaking activity.


    The FTHWG evaluated numerous possible means of reducing or 
eliminating hazards associated with explosive vapors in fuel tanks. On 
July 23, 1998, the ARAC submitted its report to the FAA. The full 
report is in the docket created for this ARAC working group (Docket No. 
FAA-1998-4183). This docket can be reviewed on the U.S. Department of 
Transportation electronic Document Management System on the Internet at 
http://dms.dot.gov. The full report is also in the docket for this 
rulemaking.

[[Page 23093]]

    The report provided a recommendation for the FAA to initiate 
rulemaking action to amend Sec. 25.981, applicable to new type design 
airplanes, to include a requirement to limit the time transport 
airplane fuel tanks could operate with flammable vapors in the vapor 
space of the tank. The recommended regulatory text proposed, ``Limiting 
the development of flammable conditions in the fuel tanks, based on the 
intended fuel types, to less than 7 percent of the expected fleet 
operational time, or providing means to mitigate the effects of an 
ignition of fuel vapors within the fuel tanks such that any damage 
caused by an ignition will not prevent continued safe flight and 
landing.'' The report discussed various options of showing compliance 
with this proposal, including managing heat input to the fuel tanks, 
installation of inerting systems or polyurethane fire suppressing foam, 
and suppressing an explosion if one occurred, etc.
    The level of flammability defined in the proposal was established 
based upon comparison of the safety record of center wing fuel tanks 
that, in certain airplanes, are heated by equipment located under the 
tank, and unheated fuel tanks located in the wing. The FTHWG concluded 
that the safety record of fuel tanks located in the wings was adequate 
and that if the same level could be achieved in center wing fuel tanks, 
the overall safety objective would be achieved. Results from thermal 
analyses documented in the report indicate that center wing fuel tanks 
that are heated by air conditioning equipment located beneath them 
contain flammable vapors, on a fleet average basis, for up to 30 
percent of the fleet operating time.
    During the ARAC review it was also determined that certain airplane 
types do not locate heat sources adjacent to the fuel tanks. These 
airplanes provide significantly reduced flammability exposure, near the 
5 percent value of the wing tanks. The group therefore determined that 
it would be feasible to design new airplanes such that fuel tank 
operation in the flammable range would be limited to near that of the 
wing fuel tanks. The primary method of compliance with the requirement 
proposed by the ARAC would likely be to control heat transfer into and 
out of fuel tanks such that heating of the fuel would not occur. Design 
features such as locating the air conditioning equipment away from the 
fuel tanks, providing ventilation of the air conditioning bay to limit 
heating and cool fuel tanks, and/or insulating the tanks from heat 
sources, would be practical means of complying with the regulation 
proposed by the ARAC.
    In addition to its recommendation to revise Sec. 25.981, the ARAC 
also recommended that the FAA continue to evaluate means for minimizing 
the development of flammable vapors within the fuel tanks to determine 
whether other alternatives, such as ground based inerting of fuel 
tanks, could be shown to be cost effective.
    To address the ARAC recommendations, the FAA initiated research and 
development activity to determine the feasibility of requiring ground-
based inerting. The results of this activity are documented in report 
No. DOT/FAA/AR-00/19, ``The Cost of Implementing Ground-Based Fuel Tank 
Inerting in the Commercial Fleet.'' A copy of the report is in the 
docket for this rulemaking. In addition, on July 14, 2000 (65 FR 
43800), the FAA tasked the ARAC to conduct a technical evaluation of 
certain fuel tank inerting methods that would reduce the flammability 
of the fuel tanks on both new type designs and in-service airplanes.
    The FAA is also evaluating the potential benefits of using directed 
ventilation methods to reduce the flammability exposure of fuel tanks 
that are located near significant heat sources.

Discussion of the Final Rule

    The FAA review of the service history, design features, and 
maintenance instructions of the transport airplane fleet indicates that 
aging of fuel tank system components and unforeseen fuel tank system 
failures and malfunctions have become a safety issue for the fleet of 
turbine-powered transport category airplanes. The FAA is amending the 
current regulations in four areas.
    The first area of concern encompasses the possibility of the 
development of ignition sources within the existing transport airplane 
fleet. Many of the design practices used on airplanes in the existing 
fleet are similar. Therefore, anomalies that have developed on specific 
airplane models within the fleet could develop on other airplane 
models. As a result, the FAA considers that a one-time safety review of 
the fuel tank system for transport airplane models in the current fleet 
is needed.
    The second area of concern encompasses the need to require the 
design of future transport category airplanes to more completely 
address potential failures in the fuel tank system that could result in 
an ignition source in the fuel tank system.
    Third, certain airplane types are designed with heat sources 
adjacent to the fuel tank, which results in heating of the fuel and a 
significant increase in the formation of flammable vapors in the tank. 
The FAA considers that fuel tank safety can be enhanced by reducing the 
time fuel tanks operate with flammable vapors in the tank and is 
therefore adopting a requirement to provide means to minimize the 
development of flammable vapors in fuel tanks, or to provide means to 
prevent catastrophic damage if ignition does occur.
    Fourth, the FAA considers that it is necessary to impose 
operational requirements so that all required maintenance or inspection 
actions will be included in each operator's FAA-approved maintenance or 
inspection program.
    These regulatory initiatives are being codified as a Special 
Federal Aviation Regulation (14 CFR part 21), amendments to the 
airworthiness regulations (14 CFR part 25), and amendments to the 
operating requirements (14 CFR parts 91, 121, 125, 129)

Part 21  Special Federal Aviation Regulation (SFAR)

    Historically, the FAA works with the TC holders when safety issues 
arise to identify solutions and actions that need to be taken. Some of 
the safety issues that have been addressed by this voluntary 
cooperative process include those involving aging aircraft structure, 
thrust reversers, cargo doors, and wing icing protection. Although some 
manufacturers have aggressively completed these safety reviews, others 
have not applied the resources necessary to complete these reviews in a 
timely manner, which delayed the adoption of corrective action. 
Although these efforts have frequently been successful in achieving the 
desired safety objectives, a more uniform and expeditious response is 
considered necessary to address fuel tank safety issues.
    While maintaining the benefits of FAA-TC holder cooperation, the 
FAA considers that a Special Federal Aviation Regulation (SFAR) 
provides a means for the FAA to establish clear expectations and 
standards, as well as a timeframe within which the design approval 
holders and the public can be confident that fuel tank safety issues on 
the affected airplanes will be uniformly examined.
    This final rule is intended to ensure that the design approval 
holder completes a comprehensive assessment of the fuel tank system and 
develops any required inspections, maintenance instructions, or 
modifications.

[[Page 23094]]

Safety Review
    The SFAR requires the design approval holder to perform a safety 
review of the fuel tank system to show that fuel tank fires or 
explosions will not occur on airplanes of the approved design. In 
conducting the review, the design approval holder must demonstrate 
compliance with the new standards adopted for Sec. 25.981(a) and (b) 
(discussed below) and the existing standards of Sec. 25.901. As part of 
this review, the design approval holder must submit a report to the 
cognizant FAA Aircraft Certification Office (ACO) that substantiates 
that the fuel tank system is fail-safe.
    The FAA intends that those failure conditions identified earlier in 
this document, and any other foreseeable failures, should be assumed 
when performing the safety review needed to substantiate that the fuel 
tank system design is fail-safe. The safety review should be prepared 
considering all airplane inflight, ground, service, and maintenance 
conditions, assuming that an explosive fuel air mixture is present in 
the fuel tanks at all times, unless the fuel tank has been purged of 
fuel vapor for maintenance. The design approval holder is expected to 
develop a failure modes and effects analysis (FMEA) for all components 
in the fuel tank system. Analysis of the FMEA would then be used to 
determine whether single failures, alone or in combination with 
foreseeable latent failures, could cause an ignition source to exist in 
a fuel tank. A subsequent quantitative fault tree analysis should then 
be developed to determine whether combinations of failures expected to 
occur in the life of the affected fleet could cause an ignition source 
to exist in a fuel tank system.
    Because fuel tank systems typically have few components within the 
fuel tank, the number of possible internal sources of ignition is 
limited. The safety review required by this final rule includes all 
components or systems that could introduce a source of fuel tank 
ignition. This may require analysis of not only the fuel tank system 
components, (e.g., pumps, fuel pump power supplies, fuel valves, fuel 
quantity indication system probes, wiring, compensators, densitometers, 
fuel level sensors, etc.), but also other airplane systems that may 
affect the fuel tank system. For example, failures in airplane wiring 
or electromagnetic interference from other airplane systems that were 
not properly accounted for in the original safety assessment could 
cause an ignition source in the airplane fuel tank system under certain 
conditions and therefore would have to be included in the system safety 
analysis.
    The intent of the safety review is to assure that each fuel tank 
system design that is affected by this action will be fully assessed 
and that the design approval holder identifies any required 
modifications, added flight deck or maintenance indications, and/or 
maintenance actions necessary to meet the fail-safe criteria.
Maintenance Instructions
    The FAA anticipates that the safety review will identify critical 
areas of the fuel tank and other related systems that require 
maintenance actions to account for the affects of aging, wear, 
corrosion, and possible contamination on the fuel tank system. For 
example, service history indicates that sulfide deposits may form on 
fuel tank components, including bonding straps and FQIS components, 
which could degrade the intended design capabilities by providing a 
mechanism by which arcing could occur. Therefore, it might be necessary 
to provide maintenance instructions to identify and eliminate such 
deposits.
    The SFAR requires the design approval holder to develop any 
specific maintenance and inspection instructions necessary to maintain 
the design features required to preclude the existence or development 
of an ignition source within the fuel tank system. These instructions 
must be established to ensure that an ignition source will not develop 
throughout the remaining operational life of the airplane.

Possible Airworthiness Directives

    The safety review may also result in identification of unsafe 
conditions on certain airplane models that would require issuance of 
airworthiness directives. For example, the FAA has required or proposed 
requirements for design changes to the following airplanes:
     Boeing Models 737, 747, and 767;
     Boeing Douglas Products Division (formerly, McDonnell 
Douglas) Model DC-9 and DC-10;
     Lockheed Model L-1011;
     Bombardier (Canadair) Model CL-600;
     Airbus Models A300-600R, A319, A320, and A321;
     CASA Model C-212;
     British Aerospace (Jetstream) Model 4100; and
     Fokker Model F28.
    Design practices used on these models may be similar to those of 
other airplane types; therefore, the FAA expects that modifications to 
airplanes with similar design features may also be required.
    The number and scope of any possible AD's may vary by airplane type 
design. For example, wiring separation and shielding of FQIS wires on 
newer technology airplanes significantly reduces the likelihood of an 
electrical short causing an electrical arc in the fuel tank; many newer 
transport airplanes do not route electrical power wiring to fuel pumps 
inside the airplane fuel tanks. Therefore, some airplane models may not 
require significant modifications or additional dedicated maintenance 
procedures.
    Other models may require significant modifications or more 
maintenance. For example, the FQIS wiring on some older technology 
airplanes is routed in wire bundles with high voltage power supply 
wires. The original failure analyses conducted on these airplane types 
did not consider the possibility that the fuel quantity indication 
system may become degraded, allowing a significantly lower voltage 
level to produce a spark inside the fuel tank. Causes of degradation 
observed in service include aging, corrosion, or undetected 
contamination of the system. As previously discussed, the FAA has 
issued AD actions for certain Boeing Model 737 and 747 airplanes to 
address this condition. Modification of similar types of installations 
on other airplane models may be required to address this unsafe 
condition and to achieve a fail-safe design.
    It should be noted that any design changes might, in themselves, 
require maintenance actions. For example, transient protection devices 
typically require scheduled maintenance in order to detect latent 
failure of the suppression feature. As a part of the required safety 
review, the manufacturer is expected to define the necessary 
maintenance procedures and intervals for any required maintenance 
actions.

Applicability of the SFAR

    The requirements of the SFAR are applicable to holders of TC's, and 
STC's for modifications that affect the fuel tank systems of turbine-
powered transport category airplanes, for which the TC was issued after 
January 1, 1958, and the airplane has either a maximum type 
certificated passenger capacity of 30 or more, or a maximum type 
certificated payload capacity of 7,500 pounds or more.
    The SFAR is also applicable to applicants for type certificates, 
amendments to a type certificate, and supplemental type certificates 
affecting the fuel tank systems for those airplanes identified above, 
if the application was filed before the effective date of the

[[Page 23095]]

SFAR and the certificate was not issued before the effective date of 
the SFAR.
    The FAA has determined that turbine-powered airplanes, regardless 
of whether they are turboprops or turbojets, should be subject to the 
rule, because the potential for ignition sources in fuel tank systems 
is unrelated to the engine design. This results in the coverage of the 
large transport category airplanes where the safety benefits and public 
interest are greatest. This action affects approximately 7,000 U.S. 
registered airplanes in part 91, 121, 125, and 129 operations.
    The date January 1, 1958, was chosen so that only turbine-powered 
airplanes, except for a few 1953-1958 vintage Convair 340s and 440s 
converted from reciprocating power, will be included. No reciprocating-
powered transport category airplanes are known to be used currently in 
passenger service, and the few remaining in cargo service would be 
excluded. Compliance is not required for those older airplanes because 
their advanced age and small numbers would likely make compliance 
impractical from an economic standpoint. This is consistent with 
similar exclusions made for those airplanes from other requirements 
applicable to existing airplanes, such as the regulations adopted for 
flammability of seat cushions (49 FR 43188, October 24, 1984); 
flammability of cabin interior components (51 FR 26206, July 21, 1986); 
cargo compartment liners (54 FR 7384, February 17, 1989); access to 
passenger emergency exits (57 FR 19244, May 4, 1992); and Class D cargo 
or baggage compartments (63 FR 8032, February 17, 1998).
    In order to achieve the benefits of this rulemaking for large 
transport airplanes as quickly as possible, the FAA has decided to 
limit the applicability of the SFAR to airplanes with a maximum 
certificated passenger capacity of at least 30 or at least 7,500 pounds 
payload. Compliance is not required for smaller airplanes because it is 
not clear at this time that the possible benefits for those airplanes 
would be commensurate with the costs involved. For now, the 
applicability of the rule will remain as proposed in the notice. The 
FAA will need to conduct the economic analysis to determine if the rule 
should be applied to smaller airplanes. Should the results of the 
analysis be favorable, the FAA will develop further rulemaking to 
address the smaller transports.

Applicability of SFAR to Supplemental Type Certificate (STC) Holders

    The SFAR applies to STC holders as well, because a significant 
number of STC's effect changes to fuel tank systems, and the objectives 
of this rule would not be achieved unless these systems are also 
reviewed and their safety ensured. The service experience noted in the 
background of this rule indicates modifications to airplane fuel tank 
systems incorporated by STC's may affect the safety of the fuel tank 
system.
    Modifications that could affect the fuel tank system include those 
that could result in an ignition source in the fuel tank. Examples 
include installation of auxiliary fuel tanks and installation of, or 
modification to, other systems such as the fuel quantity indication 
system, the fuel pump system (including electrical power supply), 
airplane refueling system, any electrical wiring routed within or 
adjacent to the fuel tank, and fuel level sensors or float switches. 
Modifications to systems or components located outside the fuel tank 
system may also affect fuel tank safety. For example, installation of 
electrical wiring for other systems that was inappropriately routed 
with FQIS wiring could violate the wiring separation requirements of 
the type design. Therefore, the FAA intends that a fuel tank system 
safety review be conducted for any modification to the airplane that 
may affect the safety of the fuel tank system. The level of evaluation 
that is intended would be dependent upon the type of modification. In 
most cases a simple qualitative evaluation of the modification in 
relation to the fuel tank system, and a statement that the change has 
no effect on the fuel tank system, would be all that is necessary. In 
other cases where the initial qualitative assessment shows that the 
modification may affect the fuel tank system, a more detailed safety 
review would be required.
    Design approvals for modification of airplane fuel tank systems 
approved by STC's require the applicant to have knowledge of the 
airplane fuel tank system in which the modification is installed. The 
majority of these approvals are held by the original airframe 
manufacturers or airplane modifiers that specialize in fuel tank system 
modifications, such as installation of auxiliary fuel tanks. Therefore, 
the FAA expects that the data needed to complete the required safety 
review identified in the SFAR would be available to the STC holder.

Compliance With SFAR

    This rule provides an 18-month compliance time from the effective 
date of the final rule, or within 18 months after the issuance of a 
certificate for which application was filed before the effective date 
of this SFAR, whichever is later, for design approval holders to 
conduct the safety review and develop the compliance documentation and 
any required maintenance and inspection instructions. (Applicants whose 
applications have not been approved as of the effective date would be 
allowed 18 months after the approval to comply.) The FAA expects each 
design approval holder to work with the cognizant FAA Aircraft 
Certification Office (ACO) and Aircraft Evaluation Group (AEG) to 
develop a plan to complete the safety review and develop the required 
maintenance and inspection instructions within the 18-month period. The 
plan should include periodic reviews with the ACO and AEG of the 
ongoing safety review and the associated maintenance and inspection 
instructions.
    During the 18-month compliance period, the FAA is committed to 
working with the affected design approval holders to assist them in 
complying with the requirements of the SFAR. However, failure to comply 
within the specified time would constitute a violation of the 
requirements and may subject the violator to certificate action to 
amend, suspend, or revoke the affected certificate in accordance with 
49 U.S.C. Sec. 44709. In accordance with 49 U.S.C. Sec. 46301, it may 
also subject the violator to a civil penalty of not more than $1,100 
per day until the SFAR is complied with.

Changes to Operating Requirements

    This rule requires the affected operators to incorporate FAA-
approved fuel tank system maintenance and inspection instructions in 
their maintenance or inspection program required under the applicable 
operating rule within 36 months of the effective date of the rule. If 
the design approval holder has complied with the SFAR and developed an 
FAA-approved program, the operator can incorporate that program, 
including any revisions needed to address any modifications to the 
original type design, to meet the proposed requirement. The operator 
also has the option of developing its own program independently, and is 
ultimately responsible for having an FAA-approved program, regardless 
of the action taken by the design approval holder.
    The rule prohibits the operation of certain transport category 
airplanes operated under parts 91, 121, 125, and 129 beyond the 
specified compliance time, unless the operator of those airplanes has 
incorporated FAA-approved fuel tank maintenance and inspection 
instructions in its maintenance or inspection program, as

[[Page 23096]]

applicable. The rule requires approval of the maintenance and 
inspection instructions by the FAA ACO, or office of the Transport 
Airplane Directorate, having cognizance over the type certificate for 
the affected airplaneThe operator would need to consider the following 
five issues:
    1. The fuel tank system maintenance and inspection instructions 
that would be incorporated into the operator's existing maintenance or 
inspection program must be approved by the FAA ACO having cognizance 
over the type certificate or supplemental type certificate. If the 
operator can establish that the existing maintenance and inspection 
instructions fulfill the requirements of this rule, then the ACO may 
approve the operator's existing maintenance and inspection instructions 
without change.
    2. The means by which the FAA-approved fuel tank system maintenance 
and inspection instructions are incorporated into a certificate 
holder's FAA-approved maintenance or inspection program is subject to 
approval by the certificate holder's principal maintenance inspector 
(PMI) or other cognizant airworthiness inspector. The FAA intends that 
any escalation to the FAA-approved inspection intervals will require 
the operator to receive approval of the amended program from the 
cognizant ACO or office of the Transport Airplane Directorate. Any 
request for escalation to the FAA approved inspection intervals must 
include data to substantiate that the proposed interval will provide 
the level of safety intended by the original approval. If inspection 
results and service experience indicate that additional or more 
frequent inspections are necessary, the FAA may issue AD's to mandate 
such changes to the inspection program.
    3. This rule does not impose any new reporting requirements; 
however, normal reporting required under 14 CFR 121.703 and 125.409 
still applies.
    4. This rule does not impose any new FAA recordkeeping 
requirements. However, as with all maintenance, the current operating 
regulations (e.g., 14 CFR 121.380 and 91.417) already impose 
recordkeeping requirements that apply to the actions required by this 
rule. When incorporating the fuel tank system maintenance and 
inspection instructions into its approved maintenance or inspection 
program, each operator should address the means by which it will comply 
with these recordkeeping requirements. That means of compliance, along 
with the remainder of the program, are subject to approval by the 
cognizant PMI or other cognizant airworthiness inspector.
    5. The maintenance and inspection instructions developed by the TC 
holder under the rule generally do not apply to portions of the fuel 
tank systems modified in accordance with an STC, field approval, or 
otherwise, including any auxiliary fuel tank installations. Similarly, 
STC holders are required to provide instructions for their STC's. The 
operator, however, is still responsible for incorporating specific 
maintenance and inspection instructions applicable to the entire fuel 
tank system of each airplane that meets the requirements of this rule. 
This means that the operator must evaluate the fuel tank systems and 
any alterations to the fuel tank system not addressed by the 
instructions provided by the TC or STC holder, and then develop, 
submit, and gain FAA approval of the maintenance and inspection 
instructions to evaluate changes to the fuel tank systems.
    The FAA recognizes that operators may not have the resources to 
develop maintenance or inspection instructions for the airplane fuel 
tank system. The rule therefore requires the TC and STC holders to 
develop fuel tank system maintenance and inspection instructions that 
may be used by operators. If however, the STC holder is out of business 
or otherwise unavailable, the operator will independently have to 
acquire the FAA-approved inspection instructions. To keep the airplanes 
in service, operators, either individually or as a group, could hire 
the necessary expertise to develop and gain approval of maintenance and 
inspection instructions. Guidance on how to comply with this aspect of 
the rule will be provided in AC 25.981-1B.
    After the PMI having oversight responsibilities is satisfied that 
the operator's continued airworthiness maintenance or inspection 
program contains all of the elements of the FAA-approved fuel tank 
system maintenance and inspection instructions, the airworthiness 
inspector will approve the maintenance or inspection program revision. 
This approval has the effect of requiring compliance with the 
maintenance and inspection instructions.

Applicability of the Operating Requirements

    This rule prohibits the operation of certain transport category 
airplanes operated under 14 CFR parts 91, 121, 125, and 129 beyond the 
specified compliance time, unless the operator of those airplanes has 
incorporated FAA-approved specific maintenance and inspection 
instructions applicable to the fuel tank system in its approved 
maintenance or inspection program, as applicable. The operational 
applicability was established so that all airplane types affected by 
the SFAR, regardless of type of operation, are subject to FAA approved 
fuel tank system maintenance and inspection procedures. As discussed 
earlier, this rule includes each turbine-powered transport category 
airplane model, provided its TC was issued after January 1, 1958, and 
it has either a maximum type certificated passenger capacity of 30 or 
more, or a maximum type certificated payload capacity of 7,500 pounds 
or more.

Affect on Field Approvals

    A significant number of changes to transport category airplane fuel 
tank systems have been incorporated through field approvals issued to 
the operators of those airplanes. These changes may also significantly 
affect the safety of the fuel tank system. The operator of any airplane 
with such changes is required to develop the fuel tank system 
maintenance and inspection program instructions and submit it to the 
FAA for approval, together with the necessary substantiation of 
compliance with the safety review requirements of the SFAR.

Compliance With Operating Requirements

    This rule establishes a 36-month compliance time from the effective 
date of the rule for operators to incorporate FAA-approved, long-term, 
fuel tank system maintenance and inspection instructions into their 
approved program. The FAA expects each operator to work with the 
airplane TC holder or STC holder to develop a plan to implement the 
required maintenance and inspection instructions within the 36-month 
period. The plan should include periodic reviews with the cognizant ACO 
and AEG responsible for approval of the associated maintenance and 
inspection instructions.
    The fuel tank safety review may result in maintenance actions that 
are overdue prior to the effective date of the operational rules. The 
plan provided by the operator should include recommended timing of 
initial inspections or maintenance actions that are incorporated in the 
long term maintenance or inspection program. An analysis of and 
supporting evidence for the proposed timing of the initial action 
should be provided to the FAA. For example, it may be determined that 
an inspection of a certain component should be conducted after 50,000 
flight hours. Some airplanes within the fleet

[[Page 23097]]

may have accumulated over 50,000 flight hours. The timing of the 
initial inspection must be approved by the FAA and would be dependent 
upon an evaluation of the safety impact of the inspection. It is 
desirable to incorporate these inspections in the current heavy 
maintenance program, such as a ``C'' or ``D'' check, without taking 
airplanes out of service. However, it may be determined that more 
expeditious action is required, which may be mandated by AD.

Changes to Part 25

    Currently, Sec. 25.981 defines limits on surface temperatures 
within transport airplane fuel tank systems. In order to address future 
airplane designs, Sec. 25.981 is revised to address both prevention of 
ignition sources in fuel tanks, and reduction in the time fuel tanks 
contain flammable vapors. The first part explicitly includes a 
requirement for effectively precluding ignition sources within the fuel 
tank systems of transport category airplanes. The second part requires 
minimizing the formation of flammable vapors in the fuel tanks.

Fuel Tank Ignition Source--Section 25.981

    The title of Sec. 25.981 is changed from ``Fuel tank temperature'' 
to ``Fuel tank ignition prevention.'' The substance of existing 
paragraph (a), which requires the applicant to determine the highest 
temperature that allows a safe margin below the lowest expected auto 
ignition temperature of the fuel, is retained. Likewise, the substance 
of existing paragraph (b), which requires precluding the temperature in 
the fuel tank from exceeding the temperature determined under paragraph 
(a), is also retained. These requirements are redesignated as (a)(1) 
and (2) respectively.
    Compliance with these paragraphs requires the determination of the 
fuel flammability characteristics of the fuels approved for use. Fuels 
approved for use on transport category airplanes have differing 
flammability characteristics. The fuel with the lowest autoignition 
temperature is JET A (kerosene), which has an autoignition temperature 
of approximately 450 deg.F at sea level. The autoignition temperature 
of JP-4 is approximately 470 deg.F at sea level. Under the same 
atmospheric conditions, the autoignition temperature of gasoline is 
approximately 800 deg.F. The autoignition temperature of these fuels 
increases at increasing altitudes (lower pressures). For the purposes 
of this rule, the lowest temperature at which autoignition can occur 
for the most critical fuel approved for use should be determined. A 
temperature providing a safe margin is at least 50 deg.F below the 
lowest expected autoignition temperature of the fuel throughout the 
altitude and temperature envelopes approved for the airplane type for 
which approval is requested.
    This rulemaking also adds a new paragraph (a)(3) to require that a 
safety analysis be performed to demonstrate that the presence of an 
ignition source in the fuel tank system could not result from any 
single failure, from any single failure in combination with any latent 
failure condition not shown to be extremely remote, or from any 
combination of failures not shown to be extremely improbable.
    These new requirements define three scenarios that must be 
addressed in order to show compliance with paragraph (a)(3). The first 
scenario is that any single failure, regardless of the probability of 
occurrence of the failure, must not cause an ignition source. The 
second scenario is that any single failure, regardless of the 
probability occurrence, in combination with any latent failure 
condition not shown to be at least extremely remote (i.e., not shown to 
be extremely remote or extremely improbable), must not cause an 
ignition source. The third scenario is that any combination of failures 
not shown to be extremely improbable must not cause an ignition source.
    For the purpose of this rule, ``extremely remote'' failure 
conditions are those not anticipated to occur to each airplane during 
its total life, but which may occur a few times when considering the 
total operational life of all airplanes of the type. This definition is 
consistent with that proposed by the ARAC for a revision to FAA AC 
25.1309-1A and that currently used by the JAA in AMJ 25.1309. 
``Extremely improbable'' failure conditions are those so unlikely that 
they are not anticipated to occur during the entire operational life of 
all airplanes of one type. This definition is consistent with the 
definition provided in FAA AC 25.1309-1A and retained in the draft 
revision to AC 25.1309-1A proposed by the ARAC.
    The severity of the external environmental conditions that should 
be considered when demonstrating compliance with this rule are those 
established by certification regulations and special conditions (e.g., 
HIRF), regardless of the associated probability. The rule also requires 
that the effects of manufacturing variability, aging, wear, and likely 
damage be taken into account when demonstrating compliance.
    These requirements are consistent with the general powerplant 
installation failure analysis requirements of Sec. 25.901(c) and the 
systems failure analysis requirements of Sec. 25.1309, as they have 
been applied to powerplant installations. This additional requirement 
is needed because the general requirements of Secs. 25.901 and 25.1309 
have not been consistently applied and documented when showing that 
ignition sources are precluded from transport category airplane fuel 
tanks. Compliance with Sec. 25.981 requires an analysis of the airplane 
fuel tank system using analytical methods and documentation currently 
used by the aviation industry in demonstrating compliance with 
Secs. 25.901 and 25.1309. In order to eliminate any ambiguity as to the 
necessary methods of compliance, the rule explicitly requires that the 
existence of latent failures be assumed unless they are extremely 
remote, which is currently required under Sec. 25.901, but not under 
Sec. 25.1309. The analysis should be conducted assuming design 
deficiencies listed in the background section of this document, and any 
other failure modes identified within the fuel tank system functional 
hazard assessment.
    Based upon the evaluations required by Sec. 25.981(a), a new 
requirement is added to paragraph (b) to require that critical design 
configuration control limitations, inspections, or other procedures be 
established as necessary to prevent development of ignition sources 
within the fuel tank system, and that they be included in the 
Airworthiness Limitations section of the ICA required by Sec. 25.1529. 
This requirement is similar to that contained in Sec. 25.571 for 
airplane structure. Appendix H to part 25 is also revised to add a 
requirement to provide any mandatory fuel tank system inspections or 
maintenance actions in the Airworthiness Limitations section of the 
ICA.
    Critical design configuration control limitations include any 
information necessary to maintain those design features that have been 
defined in the original type design as needed to preclude development 
of ignition sources. This information is essential to ensure that 
maintenance, repairs, or alterations do not unintentionally violate the 
integrity of the original fuel tank system type design. An example of a 
critical design configuration control limitation for current designs 
discussed previously would be maintaining wire separation between FQIS 
wiring and other high power electrical circuits. The original design 
approval holder must define a method to ensure that this essential 
information will be evident to those that may perform and approve 
repairs and alterations. Visual means to

[[Page 23098]]

alert the maintenance crew must be placed in areas of the airplane 
where inappropriate actions may degrade the integrity of the design 
configuration. In addition, this information should be communicated by 
statements in appropriate manuals, such as Wiring Diagram Manuals.

Flammability Requirements

    The FAA agrees with the intent of the regulatory text recommended 
by the ARAC. However, due to the short timeframe that the ARAC was 
provided to complete the tasking, a sufficient detailed economic 
evaluation was not completed to determine if practical means, such as 
ground based inerting, were available to reduce the exposure below the 
specified value of 7 percent of the operational time included in the 
ARAC proposal. The FAA is adopting a more objective regulation that is 
intended to minimize exposure to operation with flammable conditions in 
the fuel tanks.
    As discussed previously, the ARAC has submitted a recommendation to 
the FAA that the FAA continue to evaluate means for minimizing the 
development of flammable vapors within the fuel tanks. Development of a 
definitive standard to address this recommendation will require 
additional effort that will likely take some time to complete. In the 
meantime, however, the FAA is aware that historically certain design 
methods have been found acceptable that, when compared to readily 
available alternative methods, increase the likelihood that flammable 
vapors will develop in the fuel tanks. For example, in some designs, 
including the Boeing Model 747, air conditioning packs have been 
located immediately below a fuel tank without provisions to reduce 
transfer of heat from the packs to the tank.
    Therefore, in order to preclude the future use of such design 
practices, Sec. 25.981 is revised to add a requirement that fuel tank 
installations be designed to minimize the development of flammable 
vapors in the fuel tanks. Alternatively, if an applicant concludes that 
such minimization is not advantageous, it may propose means to mitigate 
the effects of an ignition of fuel vapors in the fuel tanks. For 
example, such means might include installation of fire suppressing 
polyurethane foam.
    This rule is not intended to prevent the development of flammable 
vapors in fuel tanks because total prevention has currently not been 
found to be feasible. Rather, it is intended as an interim measure to 
preclude, in new designs, the use of design methods that result in a 
relatively high likelihood that flammable vapors will develop in fuel 
tanks when other practicable design methods are available that can 
reduce the likelihood of such development. For example, the rule does 
not prohibit installation of fuel tanks in the cargo compartment, 
placing heat exchangers in fuel tanks, or locating a fuel tank in the 
center wing. It does, however, require that practical means, such as 
transferring heat from the fuel tank (e.g., use of ventilation or 
cooling air), be incorporated into the airplane design if heat sources 
were placed in or near the fuel tanks that significantly increased the 
formation of flammable fuel vapors in the tank, or if the tank is 
located in an area of the airplane where little or no cooling occurs. 
The intent of the rule is to require that fuel tanks are not heated, 
and cool at a rate equivalent to that of a wing tank in the transport 
airplane being evaluated. This may require incorporating design 
features to reduce flammability, for example cooling and ventilation 
means or inerting for fuel tanks located in the center wing box, 
horizontal stabilizer, or auxiliary fuel tanks located in the cargo 
compartment. At such time as the FAA has completed the necessary 
research and identified an appropriate definitive standard to address 
this issue, new rulemaking will be considered to revise the standard 
adopted in this rulemaking.

Applicability of Part 25 Change

    The amendments to part 25 apply to all transport category airplane 
models for which an application for type certification is made after 
the effective date of the rule, regardless of passenger capacity or 
size. In addition, as currently required by the provisions of 
Sec. 21.50, applicants for any future changes to existing part 25 type 
certificated airplanes, including STC's, that could introduce an 
ignition source in the fuel tank system are required to provide any 
necessary Instructions for Continued Airworthiness, as required by 
Sec. 25.1529 and the change to the Airworthiness Limitations section, 
paragraph H25.4 of Appendix H. In cases where it is determined that the 
existing ICA are adequate for the continued airworthiness of the 
altered product, then it should be noted on the STC, PMA supplement, or 
major alteration approval.

FAA Advisory Material

    In addition to the amendments presented in this rulemaking, the FAA 
is continuing development of AC 25.981-1B, ``Fuel Tank Ignition Source 
Prevention Guidelines'' (a revision to AC 25.981-1A), and a new AC 
25.981-2, ``Fuel Tank Flammability Minimization.''
    AC 25.981-1B includes consideration of failure conditions that 
could result in sources of ignition of vapors within fuel tanks, and 
provides guidance on how to substantiate that ignition sources will not 
be present in airplane fuel tank systems following failures or 
malfunctions of airplane components or systems. This AC also includes 
guidance for developing any limitations for the ICA that may be 
generated by the fuel tank system safety review.
    AC 25.981-2 provides information and guidance concerning compliance 
with the new requirements identified in this rulemaking pertaining to 
minimizing the formation or mitigation of hazards from flammable fuel 
air mixtures within fuel tanks.

Discussion of Comments

    Thirty four commenters responded to Notice 99-18, including private 
citizens, foreign aviation authorities, manufacturers of inerting 
equipment, individual airplane manufacturers and operators (both 
foreign and domestic), an organization representing the interests of 
manufacturers of general aviation airplanes, an airline pilots 
representative, an organization representing the consolidated interests 
of the aviation industry worldwide, and the National Transportation 
Safety Board. The majority of commenters agree in principle with the 
proposals. A discussion of these comments follows, including FAA's 
response, grouped by subject matter.

Discussion of Comments on Proposed SFAR

    For ease of reference, throughout the following discussion, the 
term ``designer'' is used to refer to all persons subject to the 
requirements of the Special Federal Aviation Regulation (SFAR).

General Favorable Comments

    Several commenters, including representatives of manufacturers and 
operators, agree in principle with the safety review that would be 
required by the proposed new SFAR to part 21 and have, in fact, already 
engaged in an industry-wide initiative in this area. These commenters 
state that they believe firmly that the objective of the proposed 
safety review will enhance the level of safety that already exists in 
the transport fleet.

[[Page 23099]]

Request to Include Smaller Part 25 Airplanes, Rotorcraft, and Part 23 
Airplanes in SFAR Applicability

    Several commenters disagree with the proposal to limit 
applicability of the SFAR to larger airplanes (30 or more passengers) 
due to the time needed to conduct a thorough economic analysis and the 
possible impact it would have on small businesses. However, the 
commenters request that this evaluation be completed and that smaller 
transport airplanes be included because of the design similarities of 
the smaller airplanes to larger airplanes.
    Additionally, one commenter notes that, because the proposal 
excludes a significant portion of the fleet, the proposal is not in 
keeping with the FAA's stated goals of the ``One level of Safety'' 
initiative. This commenter also notes that the FAA stated in the notice 
that applying the proposed requirements to certain regional airliners 
would not significantly increase the expected quantitative benefits of 
the rule because there have been no in-flight fuel tank explosions on 
those airplanes. The commenter is concerned that the FAA may be using 
``faulty reasoning'' to eliminate the need for any follow-on action to 
address this segment of the fleet.
    Another commenter strongly recommends that the SFAR be extended to 
include part 23 aircraft and part 27 rotorcraft because these types of 
aircraft may be susceptible to fuel tank system problems similar to 
those addressed in the proposed rule.
    FAA's Response: The FAA agrees that, even though the fuel tank 
systems of smaller transport category airplanes may be simpler, 
similarities in the designs of the fuel systems of those airplanes may 
result in a need to apply the standard to them. As discussed in the 
notice, we plan to conduct the appropriate economic analysis to 
determine if the rule should be applied to smaller transport airplanes. 
Should the results of that analysis indicate that the SFAR requirements 
should be applied to smaller transports, we will consider developing 
further rulemaking to address those airplanes. For now, the 
applicability of the final rule will remain as proposed in the notice.
    We do not agree that the proposed SFAR should be applied to part 23 
aircraft and part 27 rotorcraft at this time. Service experience has 
not indicated that immediate action is necessary to address the fuel 
tank systems of those types of aircraft at this time. However, we may 
reconsider this action if future service experience indicates that it 
is warranted.

Request to Exclude Mitsubishi YS-11 Airplanes and Lockheed Electra 
Airplanes

    Mitsubishi Heavy Industries America, Inc., requests that the 
Mitsubishi Model YS-11 airplane be excluded from the SFAR 
applicability. The commenter's justification for this exclusion is that 
none of these airplane models is currently being operated in the U.S. 
and none are likely to be operated in the future. The commenter further 
states that there has never been a fuel tank-related incident or 
accident on any of these airplane models. The commenter refers to the 
FAA's statement in the preamble to the notice that certain older 
reciprocating engine-powered and converted turbine-powered transport 
airplanes should be excluded from the rule because:

    ``* * * the few remaining such airplanes are in cargo service 
and because their advanced age and small numbers would make 
compliance impractical from an economic standpoint.''

    The commenter asserts that the same rationale should be applicable 
to the Model YS-11 because not one such airplane is currently operating 
in the U.S. and the possibility of such airplanes ever returning to 
cargo service, much less passenger service, in the U.S. is virtually 
non-existent. Therefore, there are no benefits to be achieved by the 
design review.
    Similarly, Lockheed Martin also requests that its airplane model, 
the Lockheed Model L-188 Electra airplane, be excluded from the 
applicability of the SFAR. Like the first commenter, this commenter 
refers to the statement in the preamble to the notice that certain 
older reciprocating and turbine-powered airplanes should be excluded 
because compliance would be impractical from an economic standpoint. 
The commenter suggests that the Model L-188 Electra also falls into 
this category and should be excluded from the rule's applicability. The 
commenter further suggests that the retroactive application of the new 
requirements to any older model include provisions in the rule that 
would permit favorable service experience to be submitted instead of 
extensive failure analysis. The commenter refers to a safety study 
conducted of the Model L-188 Electra fuel system which shows that the 
fuel system service experience is excellent.
    FAA's Response: The FAA does not concur with these commenters' 
requests to revise the applicability of the SFAR. As stated in Notice 
99-18, parts 91, 121, 125, and 129 would be amended to require 
operators to incorporate FAA-approved fuel tank system maintenance and 
inspection instructions into their current maintenance or inspection 
program of transport category airplanes type-certificated after January 
1, 1958. That date was chosen so that all turbine-powered transport 
category airplanes would be included, except for a few 1947 vintage 
Grumman Mallards, and 1953-1958 vintage Convair Model 340 and 440 
airplanes converted from reciprocating to turbine power.
    We do not consider the information presented by either of the 
commenters sufficient to warrant a general exclusion of either the 
Model YS-11 or the Model L-188 Electra from the applicability of the 
SFAR. We do acknowledge, however, that the current operations of Model 
L-188 Electra airplanes to remote Aleutian points and on military 
contract flights do involve unique circumstances worthy of further 
consideration. For example, we might conclude that, while full 
compliance is not cost effective, some lesser degree of fuel tank 
system evaluation is necessary.
    While there is insufficient basis on which to exclude the Model L-
188 Electra airplanes in general, the TC holder may petition the FAA 
for an exemption from the provisions of this final rule showing that it 
would be in the public interest. Similarly, we would consider petitions 
for exemption from the SFAR for the Model YS-11 or any other airplane 
not currently operated under U.S. registry. Such requests for exemption 
would be handled outside of this rulemaking action. Even if an 
exemption were granted from the SFAR to a design approval holder, 
operators of the affected airplanes would still be subject to the 
requirements of the operating rules established by this final rule. 
Petitions for exemption by the operators would involve different 
considerations.

Request to ``Harmonize'' the Rule With European Authorities

    Several commenters, including representatives from aviation 
officials of the JAA and Transport Canada, state that the proposed SFAR 
should have been developed through the Aviation Rulemaking Advisory 
Committee (ARAC) and its harmonization process. These commenters 
contend that harmonizing the proposed rule would:
     simplify operations,
     reduce the cost of compliance without compromising safety, 
and
     extend the latest safety benefits more broadly in the 
world fleet.
    The commenters also state that issuing the rule under the 
harmonization process would have facilitated eventual delegation of the 
SFAR compliance findings between the

[[Page 23100]]

FAA and the JAA. Some commenters request that the disposition of public 
comments be handled through the ARAC process.
    FAA's Response: The FAA does not concur with the commenters. When 
this rulemaking was initiated, we faced a choice between proceeding 
unilaterally or proceeding through the harmonization process involving 
the JAA and the public through ARAC. At that time, we chose to proceed 
unilaterally in order to address the important safety need on an 
expedited basis. In a separate action, we did task ARAC with developing 
proposed regulatory text to eliminate or reduce flammability in 
airplane fuel tanks. The fundamentals of ARAC's proposal are included 
in this rule.
    With the issuance of this rule, we consider that the safety need 
has been addressed and we are now open to a harmonization effort. To 
facilitate harmonization, we have coordinated the proposal with the JAA 
and Transport Canada. Comments from the JAA and Transport Canada 
indicate their agreement in principle with our actions, and they have 
stated their intention to mandate similar fuel tank safety actions. 
While we will ensure compliance with the SFAR, the operating rules, and 
the part 25 design standards as adopted in this final rule, we will 
continue discussions with Transport Canada and the JAA concerning 
possible harmonization efforts relating to the part 25 change.
    The safety improvements provided by this rule are as urgent now as 
they were when we decided to proceed unilaterally. The comments do not 
persuade us that the policy judgments reflected in the notice were 
incorrect. Because expedited adoption of this final rule is necessary, 
and because further discussion of comments within ARAC would not change 
the FAA's policy determinations, further review of the proposed rule by 
ARAC would not be appropriate.

Request To Delegate Compliance Findings

    Several commenters request that the FAA delegate SFAR compliance 
findings to the prime certification authority in accordance with the 
approved bilateral agreement.
    FAA's Response: The FAA interprets the reference to ``prime 
certification authority'' to mean the ``state of design,'' as that term 
is used in ICAO Annex 8. Because the SFAR imposes requirements on 
existing designers, the bilateral airworthiness agreements, which 
address new certifications, do not directly apply. To the extent that 
bilateral countries choose to become involved in reviewing submissions 
for compliance with the SFAR, we will work closely with them. This 
should facilitate the harmonization efforts described previously. 
However, under the SFAR the FAA must approve the design approval 
holder's submission.

Request for Definition of Safety Review

    One commenter notes that the terms ``safety review,'' ``design 
review,'' ``safety analysis,'' and ``functional hazard assessment'' 
appear to be used interchangeably throughout the notice. However, each 
of these terms could have significantly different meanings. The 
commenter requests that, if it is the intent of the FAA to have 
different meanings for these terms, then the definitions should be 
clearly stated and the terms should be used in the appropriate context.
    The commenter offers the following definitions in an attempt to 
establish a unified understanding of the objectives:
     ``Safety Review''--a comprehensive assessment of the fuel 
tank system that meets all the requirements of the Special Federal 
Aviation Regulation.
     ``Safety Analysis''--process of ensuring that the fuel 
system is fail-safe by conducting a design review and failure modes and 
effects analysis.
     ``Design Review''--process of reviewing all relevant 
engineering design drawings to ensure that appropriate design practices 
have been used and identify failure modes.
     ``Failure Modes Analysis''--process of evaluating all 
identified failure modes resulting from the design review by conducting 
a failure modes and effects analysis (FMEA) and a fault tree analysis 
(FTA).
    The commenter requests that a similar set of definitions be 
provided in the SFAR to clarify the intentions of the regulation.
    FAA's Response: The FAA concurs that clarification is appropriate. 
The objective of the SFAR is to require designers to conduct ``safety 
reviews,'' which is the broadest term defined by the commenter. The 
term ``safety review'' is the correct term that is used in the text of 
the SFAR. For clarification sake, we have used the term ``safety 
review'' throughout the discussions in this preamble to describe the 
action required by the SFAR. No change to the final rule text is 
necessary in this regard, however.

Question on the Need for a System Safety Review

    One commenter considers that the proposed safety review required 
under the new part 21 SFAR is excessive. This commenter regards the 
proposal as essentially a requirement to re-certify the fuel systems of 
all turbine-powered commercial transports, with respect to avoiding 
fuel tank fires and explosions. The commenter points out that, while 
more than 450 million hours of service experience on these airplanes 
have identified valuable lessons learned, this same service experience 
also demonstrates the largely successful outcome of the previously 
certified designs. The extent of the safety review that the proposed 
SFAR would require goes beyond what is commensurate with the historical 
data.
    FAA's Response: The FAA does not concur with the commenter that the 
service history of the affected airplanes does not warrant the type of 
safety review proposed. Specifically, we disagree that past service has 
been ``largely successful.'' While the commenter states that the fleet 
has achieved a good safety record, we point out that, as discussed in 
detail in the preamble to the notice, there has been extensive service 
history data related to anomalies, system failures, aging-related 
problems, etc., of the fuel tanks of transport category airplanes. 
Service data show that there have been 16 fuel tank explosion events. 
Further, the fact that the FAA has issued over 40 airworthiness 
directives to correct fuel tank safety hazards affecting a large cross 
section of the transport airplane fleet indicates that extensive 
revalidation of the fuel tank systems, as proposed, is necessary.

Question on Quantitative vs. Qualitative Safety Review of Older 
Airplane Designs

    One commenter suggests that the proposed SFAR should allow aircraft 
certificated prior to Amendment 25-23 and Sec. 25.1309 reliability 
requirements to undergo a qualitative--rather than quantitative--safety 
review. Then, from the results of the review, an inspection or 
maintenance plan could be developed, and, finally, a one-time 
inspection of the entire fleet could be performed. The commenter 
supports this type of assessment for several reasons:
    1. The current version of Sec. 25.1309 requires a safety review and 
a quantitative assessment to validate that a system is fail-safe. 
However, accurate statistical reliability information needed to conduct 
the safety analysis is likely to be unavailable for fuel system 
components used nearly 30 years ago.
    2. When conducting a safety review, conservative assumptions are 
required when accurate reliability data is unavailable. These 
conservative assumptions could lead to false and

[[Page 23101]]

detrimental failure probability results. This circumstance could occur 
multiple times during the analysis, or even cause compounded error 
effects, requiring even more severe corrective actions.
    3. By the methods proposed in the proposed rule, a 
``representative'' fuel tank system would be created based on 30-year-
old drawings that would be ``fraught with unavoidable assumptions,'' 
while at the same time be required to meet the ``extremely improbable'' 
failure condition probability criteria of 1  x  10 -9. This 
would lead to unnecessary inspections, maintenance, repairs, and 
modifications.
    To meet the intent of the SFAR more effectively, the commenter 
proposes that a qualitative safety review be conducted, based on:
     The investigative efforts of the FAA and NTSB,
     AD's,
     Service bulletins,
     Lessons learned,
     Performance history of the aircraft, and
     Results of the recent industry-wide fuel tank inspection 
program.
    In addition, the labor and time costs for a qualitative analysis 
would be dramatically lower than for a quantitative analysis. A 
qualitative analysis could be conducted using the knowledge and 
experience of current in-house personnel and applying familiar methods 
of evaluation. It likely would take less time, as well.
    Several other commenters also question the practicality of 
requiring the proposed safety review if the latest standards are to be 
applied to older airplane designs. These commenters maintain that the 
proposed SFAR effectively requires recertification of older airplanes' 
fuel tanks to show compliance with the quantitative system safety 
assessment requirements introduced in Sec. 25.1309 of Amendment 25-23. 
The commenters point out that those requirements were neither developed 
nor in effect for the airplanes whose certification basis was approved 
prior to the time that Amendment 25-23 was issued in May 1970. The 
majority of the airplanes affected by the proposed SFAR fall into this 
category.
    Further, the commenters note that quantitative analysis methods for 
showing compliance with the requirements of Amendment 25-23 were not 
even developed or approved by the FAA until June 1988, when the FAA 
issued guidance on this subject in Advisory Circular 25.1309-1A. These 
methods were not necessarily applied to aircraft certified before that 
date. Thus, the certification documentation and technical archives of 
pre-amendment 25-23 aircraft may be limited in their usefulness to 
support a formalized analysis.
    These commenters also state that re-evaluation of older aircraft 
types using today's quantitative analysis methodologies, such as a 
failure modes and effects analysis (FMEA), would be impractical and 
present ``insurmountable difficulties,'' given the unavailability of 
data and the resources required. One commenter states that this type of 
safety review would be extremely labor-and resource-intensive, and 
would have both short- and long-term adverse economic effects on the 
aviation industry.
    Another commenter states that the proposal does not provide a 
simple design-assessment method that is compatible with the technical 
information available to TC and STC holders. (The commenter gave no 
examples of incompatibility, however.)
    FAA's Response: The FAA recognizes that the fuel tank systems of 
most older transport airplane designs were not evaluated during 
certification using the quantitative safety assessment methods 
associated with Sec. 25.1309. For these airplanes, the FAA agrees that 
a qualitative, rather than quantitative, approach can and should be 
used where possible for the fuel tank system safety review. The level 
of analysis required to show that ignition sources will not develop 
will depend upon the specific design features of the fuel tank system 
being evaluated. Detailed quantitative analysis should not be necessary 
if a qualitative safety assessment shows that features incorporated 
into the fuel tank system design protect against the development of 
ignition sources within the fuel tank system. For example, for wiring 
entering the fuel tanks, compliance demonstration could be shown in 
three steps.
     First, the wiring could be shown to have protective 
features such as separation, shielding, or transient suppression 
devices;
     Second, the effectiveness of those features could be 
demonstrated; and
     Third, any long-term maintenance requirements or critical 
design configuration limitations could be defined so that the 
protective features are not degraded.
    Another example would be showing that fuel pumps are installed in 
such a way that the fuel pump inlet remains covered whenever the fuel 
pump is operating throughout the airplane operating attitude envelope, 
including anticipated low fuel operations and ground conditions. This 
could be a satisfactory method of meeting the fail-safe requirement for 
the fuel pump mechanical components, although it would not necessarily 
address fuel pump motor failure modes. (Advisory Circular 25.981-1B 
provides additional guidance on the acceptability of qualitative 
assessments where fail-safe features are provided.)
    Additionally, if fail-safe features are incorporated into the 
design in such a way that the effects of other systems on the fuel tank 
system can be shown to be benign, then no additional design assessment 
and inspections would be required. Designers using this approach would 
be required to provide substantiation that the design features preclude 
the need for detailed design assessment of the system and future 
inspections. Designers considering using this approach should 
coordinate as early as possible with the cognizant ACO.
    On the other hand, the fact that a quantitative assessment and 
related data do not currently exist for some older airplane types does 
not mean that a similar safety assessment cannot be accomplished on 
these airplanes. It is feasible to use a modern safety assessment 
method on older airplanes that will recognize and evaluate potential 
failures and their effects, and will identify actions that could 
eliminate or reduce the chance of a potential failure from occurring.
    Methods for conducting a quantitative analysis of any system are 
well-established and readily available. For example, the FMEA and fault 
tree analysis methodology is widely accepted and understood. In fact, 
there currently are several software packages available commercially 
that are specifically designed for assisting in developing FMEA's; 
these have proven to be particularly useful in reducing the amount of 
time, labor, clerical support, and monetary burden that normally would 
be entailed.
    In light of this, we anticipate that all affected TC and STC 
holders will be fully capable of complying with the SFAR requirements.
    No change to the final rule is necessary with regard to these 
comments. The rule requires that applicants ``conduct a safety review'' 
of the airplane, but does not specify any particular method of review.

Question on Intent of Safety Review

    One commenter questions the FAA's intent regarding the safety 
review. This commenter notes that the proposed SFAR states, `` * * * 
single failures will not jeopardize the safe operation * * * `` and `` 
* * * latent failures have to be assumed * * *'' However, there are a

[[Page 23102]]

number of single failures identified in the SFAR that have the 
capability to create an ignition source within the fuel tank. Examples 
include:
     Various mechanical pump failure modes,
     Various electrical pump failure modes, and
     Arcing of pump power cables to the conduit.
    There are a number of single failures within the examples listed 
above that would not be acceptable to show compliance in accordance 
with the current application of Sec. 25.1309, which requires that `` * 
* * failure of any single component should be assumed * * * and not 
prevent continued safe flight * * *'' In light of this, the commenter 
asks if the FAA is expecting modifications to cover all these cases; if 
not, there is a risk that the interpretation of Sec. 25.1309 may be 
degraded.
    The commenter further states that there are a number of latent 
failures in fuel tanks that could create an ignition source within the 
fuel tank, for example:
     Loss of pump over-temperature protection, and
     Loss of bonding (electro-static and lightning protection).
    These types of latent failures are not easy to detect without a 
physical inspection inside the tank. The commenter asks how these types 
of latent failures will be considered when assessing the safety of fuel 
tanks. Clearly, frequent internal inspections of fuel tanks are not 
acceptable, and some means for agreeing to certain design practices on 
existing aircraft may be needed.
    FAA's Response: The intent of the safety review, as stated in the 
notice, is to apply current system safety assessment standards to the 
affected airplanes in the existing transport fleet. We fully expect 
that, where fail-safe features do not exist, modifications to designs 
and changes to maintenance practices will be required for a significant 
portion of the fleet to address the single and multiple failures noted 
by the commenter. If inspections to detect latent failures are 
impractical, it would be necessary to modify the design to provide 
fail-safe features or indications to eliminate latency.

Request for a Lessons Learned Approach

    Certain commenters state that the proposed safety review would be 
more useful if it were based strictly on lessons learned, and request 
that the proposal be changed accordingly. The commenters propose an 
alternative method that would be based on service experience (lessons 
learned) and regulated as a ``prescriptive-type rule.'' As an example, 
the commenters suggest that the FAA first define a comprehensive list 
of items that may not have been considered adequately in the original 
fuel system design and for which there is some service experience. The 
list could include such items as:
     Fuel pumps,
     Wiring to pumps in conduits located inside fuel tanks,
     Fuel pump connectors,
     Fuel quantity indicating system wiring and probes, and
     Component bonding.
    The FAA could then require that fuel system designs be evaluated 
against this ``checklist'' to determine if adequate consideration has 
been made regarding the potential effects of each item listed. Any 
single failures shown to cause an ignition source in the fuel tank 
would warrant a design change. A quantitative fault tree analysis could 
then be developed for combinations of failures shown to cause ignition 
sources, to determine if such failure combinations could be expected to 
occur in the remaining fleet life of the affected aircraft type.
    These commenters state that among the benefits of this prescriptive 
design review approach would be:
     A common evaluation criterion for each aircraft type, 
regardless of its certification basis.
     A more objective evaluation process that simplifies 
delegating the compliance-finding task by the FAA and ensures equal 
treatment for each manufacturer and operator.
     Faster completion of the task, submittal of the report to 
the FAA, and resolution of any deficiencies in the existing fleet.
     Development of a standardized report or checklist to ease 
the compliance-finding process.
     A far greater pool of people able to accomplish the task, 
because a prescriptive review method would not demand engineers with 
detailed expertise in fuel systems and safety assessment methodology.
    These commenters maintain that the FAA's safety review proposed in 
the SFAR would be merely an additional burden that could interfere with 
realizing the benefits of lessons learned. They consider that their 
suggested alternative approach is more practical, and equally effective 
in enhancing fuel system safety.
    FAA's Response: The FAA does not concur with these commenters' 
request. To conduct a safety review based solely on lessons learned 
would not provide the level of safety that is intended by the proposal. 
A lessons learned focus would address problems that were known to have 
occurred in the past; however, it would not necessarily address 
potential problems and risks that could occur in the future. Thus, a 
lessons learned focus is a reactive, not a proactive, approach. There 
may be unforeseen failure modes that would not necessarily be accounted 
for by only evaluating failure modes that have occurred in the past, as 
would be done with a lessons-learned approach.
    One example is in AC 25.981-1A, published originally in 1971, which 
included a list of failure modes, based upon lessons learned at that 
time, that should have been considered in showing compliance with the 
requirements of Sec. 25.981. Since that AC was published, however, 
numerous unforeseen failures have occurred, thus, resulting in a much 
longer list that is now included in the revision to that AC. While such 
a list is valuable in providing guidance for conducting a safety 
assessment, it is not all-inclusive and we do not consider it adequate 
for conducting a comprehensive safety assessment.
    On the other hand, the qualitative approach to the required safety 
review will result in consideration of, and means to address, potential 
failure modes, even if they have not yet been encountered in service. 
For example, if a qualitative assessment indicated that a particular 
design feature could result in a high voltage electrical surge into the 
fuel tank, then the assessment would conclude that measures should be 
taken to prevent such an occurrence, regardless of whether it is a 
``lesson learned'' based on past occurrences.

Request for Risk Assessment Only of Remaining Fleet Life

    One commenter suggests that the safety review methodology proposed 
by the FAA should provide a risk assessment over the remaining fleet 
life of each aircraft type. Many of the aircraft types that would be 
affected by the proposed SFAR are approaching the end of their fleet 
lives. The commenter asserts that, when determining if safety reviews 
and resulting design changes are warranted, the consideration should be 
based upon a risk assessment based on the remaining fleet life.
    FAA's Response: The FAA agrees that the remaining fleet life could 
be one consideration in establishing a basis for an exemption from the 
requirement to perform a safety review for particular models, but it is 
not a general basis for limiting the applicability of the proposal. 
While some models of airplanes have exceeded their economic design goal 
(for example the Boeing Model 727 and McDonnell Douglas

[[Page 23103]]

Model DC-9), there are individual airplanes of those models that are 
still in service, and extensive future service life is planned for 
them. Consequently, exposure to the risk of fuel tank explosions 
remains as valid for these models as for any others in service.
    Regarding whether resulting design changes are warranted, those 
changes would necessarily be mandated by separate regulatory actions 
(AD's). Therefore, whether the changes are warranted will be assessed 
in the context of those actions.

Request for Change in Compliance Time for Conducting Safety Review

    Several commenters state that the 12-month compliance time for 
completing the required actions proposed under the SFAR is unrealistic, 
and request a longer period for compliance. The reasons that these 
commenters give are as follows:
    First, industry lacks the resources to accomplish the requirements 
within the proposed timeframe. There are limited qualified personnel to 
conduct the level of safety review that the proposed SFAR would 
require. Formalized system safety analysis of the type outlined in AC 
25.1309-1A requires specialists with extensive knowledge of the system 
architecture, component details, and service history, as well as the 
analysis methodology.
    Second, the flow time necessary to perform the proposed safety 
review would exceed the proposed compliance time. The commenters point 
out that over 100 airplane models would need to be reviewed, and the 
proposed safety review methodology would require two to four years of 
effort per major model for large transport aircraft. Some major models 
of airplanes have numerous minor model variations. These minor model 
variations would add significant additional review effort. Availability 
of qualified engineers does not allow these reviews to be conducted in 
a completely parallel fashion. Assuming a 9-month flow time to 
accomplish each review and the capability to conduct up to three 
reviews simultaneously, some manufacturers would require well in excess 
of 45 months to complete the proposed reviews. In other instances, the 
resources available to some TC or STC holders may limit their 
capability to one safety review at a time. These estimates take into 
account work already accomplished by the industry over the past 4 
years.
    Third, development of the maintenance instructions could not 
possibly be accomplished within the proposed 12-month compliance time. 
As written, the proposed SFAR would require ``all maintenance and 
inspection instructions necessary'' to be submitted as part of the 
safety review report. However, the commenters assert that effective 
development of a maintenance program cannot practically start until the 
safety review is completed, and it must be developed in coordination 
with the operators and regulatory agencies. Therefore, submittal of the 
maintenance and inspection instructions as part of the safety review 
report is not feasible. The commenters request that the proposal be 
revised to allow a period of 6 to 8 months for the development of these 
instructions once the FAA has approved the safety review report.
    Fourth, necessary design changes identified as a result of the 
safety review could not be developed, evaluated, and shown to comply 
with the new requirements within the proposed compliance time. The 
commenters request that the compliance time for design change activity 
be treated separately from the SFAR review activity.
    Fifth, the FAA itself lacks resources to support timely review of 
the safety review reports required by the SFAR within the 12-month time 
proposed to complete the review. The commenters believe that the FAA 
has grossly underestimated its own flow times regarding coordination 
and approval of the SFAR-mandated safety reviews and resulting 
compliance substantiation documents. Experience has shown that the FAA 
typically takes 60 to 90 days to review and approve of documents of 
this kind. Multiplied by 100 reports or more, it would appear that the 
FAA itself would require more than the proposed 12 months compliance 
time to complete its review and approval cycle once the reports are 
submitted by the industry.
    Another commenter considers that the proposed compliance time for 
developing the maintenance and inspection program is inadequate. The 
commenter asserts that, without the insights gained through the SFAR 
design review assessment process, any attempts to accurately revise 
existing maintenance and inspection programs would be 
``counterproductive'' to the goals of the proposed rule. The commenter 
maintains that the FAA underestimates the time necessary to prepare and 
develop the maintenance program, receive approval, and implement the 
program. This commenter requests that the proposed rule be changed to 
allow more time for revising the operator's maintenance or inspection 
programs, and that this time start only after the completion of the 
design review and the manufacturers' maintenance program for each 
airplane model.
    Certain other commenters request that the proposal be changed to 
include the following text:

``Compliance time:
    (a) All design review reports must be submitted to the 
Administrator no later than 36 months after the effective date of 
this rule or within 18 months of the issuance of a certificate for 
which application was filed before [effective date of the rule], 
whichever is later.
    (b) Maintenance and inspection instructions must be submitted to 
the Administrator no later than 8 months after the FAA has approved 
the design review report for the applicable aircraft type.''

    Others request that the compliance time for completion of the 
safety review should be extended to 54 months.
    FAA's Response: The FAA has considered the reasons for the 
commenters' requests and concurs that the compliance time should be 
extended somewhat. We have revised the final rule to provide a 
compliance time of 18 months for conducting the safety reviews and 
submitting them to the FAA. Even for those designers who work closely 
with the appropriate ACO's in conducting their reviews, we acknowledge 
that, following submission, some time will be required for FAA review 
and for any necessary revisions, and we consider that 6 months should 
be adequate for those activities. We are aware that when the FAA has 
mandated maintenance program changes in the past, we have typically 
allowed operators 12 months to incorporate those changes into their 
programs. Therefore, we have revised the operating rules to require 
that operators incorporate the maintenance program changes within 36 
months after the effective date.
    Designers may allocate the 18-month compliance time between the 
safety review and the development of maintenance and inspection 
instructions as they deem appropriate. In evaluating the information 
presented by the commenters and the relevant safety concerns, we have 
determined that this revision can be made without significantly 
affecting safety.
    These revised compliance times are not as long as those requested 
by the commenters for the following reasons:
     The commenters based their estimates on the assumption 
that a quantitative assessment would be required. As discussed 
previously, in most cases a less time-consuming qualitative assessment 
will be sufficient.
     There is a substantial degree of commonality in design 
features of the affected models. Such commonality will

[[Page 23104]]

allow analysis to be conducted by similarity to previously reviewed 
designs. In light of this, we do not foresee designers needing to 
conduct a separate safety analysis ``from scratch'' for each model.
     Since the TWA 800 accident over 4 years ago, many 
manufacturers already have completed significant reviews of service 
history and analysis of fuel tank designs for many airplane types. This 
will significantly reduce the time and resources that will be needed to 
complete the requirements of the SFAR.
     We expect that industry will work closely with the 
cognizant ACO in planning the safety review, and providing feedback as 
the evaluation progresses. This should allow expedited approval by the 
local office.
    Given the additional time provided in the final rule, we are 
confident that the technical capability exists and that industry will 
expend the resources needed to address this critical safety issue in a 
timely manner.
    As for the compliance time for development of needed design 
changes, we have revised the text of the final rule to include a 
provision that would allow extensions of the compliance time on a case-
by-case basis. The final rule states that the FAA may grant an 
extension of the compliance time if:
     The safety review is completed within the compliance time, 
and
     Necessary design changes are identified within the 
compliance time, and
     Additional time can be justified.

Request for Clarification of SFAR Applicability to STC Holders

    Two commenters state that, as worded, the proposed SFAR text does 
not clearly specify that it applies to holders of STC modifications 
that may have no direct relationship to the fuel system, but could have 
an effect on fuel tank safety. The commenters are concerned that some 
readers may misconstrue the current text as referring only to STC's for 
modifications directly to the fuel tank system, and not STC's that are 
adjacent to the fuel tank and may indirectly affect them.
    One of these commenters recommends that the proposed phrase 
``supplemental type certificates affecting the airplane fuel tank 
system'' be revised to ``supplemental type certificates capable of 
affecting the airplane fuel tank system.'' The other commenter suggests 
that the phrase be revised to ``supplemental type certificates 
modifying the airplane fuel tank system.''
    The commenters consider that adding the suggested words would make 
it clear that the SFAR applies not just to fuel system STC's, but to 
all STC's that could affect the fuel system.
    FAA's Response: The FAA concurs with the commenters that a change 
in the text of the SFAR is necessary to clarify the intent. It was the 
FAA's intent that the SFAR requirements were to apply to holders of 
STC's that may affect the fuel system or result in a fuel tank ignition 
source. This was explained in detail in the preamble to the notice, and 
that discussion is repeated in this final rule under the heading, 
``Supplemental Type Certificates,'' above.
    Based on the comments, we recognize that the proposed text could be 
construed too narrowly; that is, construed to mean that the 
requirements apply only to STC modifications that actually change the 
fuel tank system. We also recognize that it may not be possible to 
determine whether a modification actually affects the safety of the 
fuel tank system without conducting at least a rudimentary qualitative 
evaluation. In order to clarify this point, we have revised the text of 
the final rule to state that the SFAR applies to all holders of type 
certificates and supplemental type certificates that ``may affect'' the 
safety of the fuel tank system.

Request for Clarification of SFAR Requirements for STC's Not Directly 
Related to Fuel Tanks

    One commenter raises concerns about the requirements of the 
proposed rule as they apply to STC approvals of modifications that are 
not specifically fuel tank system modifications. These types of 
approvals are referred to as ``non-ATA 28 STC approvals.'' (``ATA 28 
STC's'' refers to approvals that actually change the fuel tank system.) 
Specifically, the commenter questions the feasibility of conducting a 
safety review on the types of modifications whose installation(s) do 
not actually change, but could affect, the airplane fuel tank system.
    The commenter requests that the FAA consider a separate requirement 
in the SFAR for assessing the effect of these non-ATA 28 STC's on the 
fuel system. The commenter asserts that airplanes on which non-ATA 28 
STC's are installed should only be assessed qualitatively or by 
inspection, and that only two key areas need to be examined:
    1. The modification of wiring next to or near wiring that enters 
the fuel tank. These commenters suggest that the effects of these STC's 
could be assessed by a one-time inspection performed on each aircraft 
model by a specific time, such as:
     At the next heavy-maintenance inspection interval where 
the area or zone is opened and accessed, or
     In conjunction with any downtime necessitated by a 
modification program resulting from the safety review required by the 
proposed SFAR.
    The objective of the suggested inspection would be to examine 
wiring that enters the fuel tank and assess whether any STC 
modifications introduce non-conformities that may compromise the fail-
safe design concept or may be a possible fuel tank ignition source. 
(Only the wiring external to the tank would need to be inspected.) The 
nonconformity would be established based on a listing of specific 
inspection guidelines issued by either the FAA (possibly in the revised 
AC 25.981-1B) or the OEM's for each aircraft model. As with the SFAR 
safety review, any non-conformity would be identified and reported to 
the design approval holder.
    As alternatives to this one-time inspection, the commenter 
suggests:
     A qualitative design review could be conducted, if 
sufficient technical information is available regarding the 
installation of the pertinent STC's.
     Alternative methods could be conducted that ensure the 
continued airworthiness of the airplane (with respect to wiring that 
enters the fuel tank). For example, installation of a transient 
suppression device should eliminate the need to inspect or conduct 
design reviews of modifications that might otherwise affect FQIS 
wiring.
    2. The effect of modifications to the environmental control system 
(ECS) and other system modifications capable of generating autoignition 
temperature into the tank structure. The commenter states that a 
qualitative review of these systems should be conducted by reviewing 
whether the approved configuration has been altered. If it has been 
altered, the operator would identify the alteration and ``report it to 
the person responsible'' (i.e., the design approval holder of the 
design modification).
    The commenter states that a one-time inspection process, as 
described above, would need to be developed using:
     The OEM's or STC holder's list of general design practices 
and precautions obtained during their SFAR safety reviews, and
     The revised maintenance program produced from the SFAR 
safety review.
    The commenters foresee this information as providing operators with 
guidelines on what to inspect, how to inspect, and what the pass/fail 
criteria are.
    The commenter suggests that this inspection should not repeat the

[[Page 23105]]

inspections that have been performed to date by the operator. (For 
example, the operator should receive credit for any inspections 
performed because of an airworthiness directive or part of the 
industry-wide Fuel System Safety Program.)
    FAA's Response: The FAA does not concur with the commenter's 
suggestion for several reasons. Although the commenter characterizes 
its proposal as a ``qualitative review,'' it would only result in an 
inspection for ``non-conformities,'' with the inspection results 
forwarded to the design approval holder. The suggestion does not 
specify what, if any, obligation the design approval holder would have 
to address these non-conformities, which, by definition, are not part 
of the holder's approved design. It would be unreasonable to impose an 
obligation on design approval holders to conduct reviews of designs for 
which they are not responsible. In light of this commenter's adverse 
comments regarding imposing a requirement for such holders to review 
their own designs, imposing an additional obligation is inconsistent.
    In addition, the commenter's suggestion would result in a long 
delay in completion of the safety review of the fuel tank system. For 
example, the commenter suggests that the inspection take place during a 
heavy maintenance inspection; however, the heavy maintenance inspection 
intervals are typically every 4 to 5 years. Once the airplane 
configuration was determined, additional time would be needed to 
complete the assessment and to develop any necessary maintenance and 
inspection programs or design changes. The alternative process 
suggested by the commenters could effectively postpone addressing the 
effects of wiring on the fuel tank system by as much as 7 or 8 years. 
The elapsed time to complete this process would not provide the level 
of safety intended by the FAA or expected by the public.

Question on SFAR Requirements for STC's Where No Technical Data Is 
Available

    Several commenters raise a concern about the proposed SFAR 
requirements as they pertain to a safety review of pertinent STC's 
where the STC holder is out of business and the necessary technical 
data is not readily available. The commenters expect that, for these 
cases, the burden would fall on the operators to conduct the review 
required by the SFAR. The commenters are concerned that, for a large 
number of these operators, the review process for these types of STC's 
may present ``an insurmountable burden'' for the following reasons:
     A full review of modifications accomplished by the 
operators over the decades that some of the affected airplanes have 
been operated is impracticable.
     Where operators have sold aircraft to another party, it is 
possible that the current owner of the airplane may come back to the 
operator and require such an evaluation. This situation is 
unmanageable.
     Operators will have difficulty performing any type of 
quantitative analysis due to lack of intensive familiarity with these 
types of methods.
     The technical information required to perform a 
quantitative or qualitative analysis may not be available or may not 
pertain to the specific aircraft model.
     Involvement by the original equipment manufacturer (OEM) 
in providing operators with assistance is viewed by the operators as 
likely to be minimal.
    The commenters are particularly concerned that the OEM's are 
probably not familiar with many of the STC's that have been 
incorporated on the aircraft. Further, the chance of obtaining an 
assistance contract with the OEMs is slim because they will be 
stretched for manpower supporting OEM responsibilities relating to the 
proposed SFAR.
    Additionally, the commenters are concerned that technical 
assistance from the FAA's fuel system specialists cannot be ensured for 
the operators. The FAA may be prepared to work with the affected type 
certificate holders to assist them in complying with the requirements 
of the proposed SFAR, but such assistance may not be possible for 
operators in this situation due to a lack of manpower.
    FAA's Response: The FAA does not agree that the proposed rule would 
impose ``insurmountable burdens'' on operators. As with all operating 
rules, the person ultimately responsible for compliance is the 
operator. But this rulemaking is unique in the extent to which current 
designers are required to provide operators with analysis and 
documentation of maintenance programs to support operators in 
fulfilling their obligations.
    The existing operating rules generally require operators to 
maintain their aircraft in an airworthy condition. A prerequisite for 
maintaining an airplane is the ability to understand its configuration, 
at least with respect to safety critical systems. This is reflected in 
operating rules such as Sec. 121.380(a)(2)(vii), which requires a list 
of current major alterations to be retained permanently, and 
Sec. 121.380a, which requires that these records be transferred with 
the airplane.
    This rulemaking originated from the FAA's conclusion that fuel tank 
systems on current transport category airplanes may not be airworthy, 
and that the seriousness of this safety issue warrants substantial 
efforts to identify safety problems in order to prevent future 
accidents such as TWA 800. It is unacceptable for operators to claim 
not only that they are currently unable to understand the 
configurations of these systems on their airplanes, but that it is 
unreasonable to expect them to gain that understanding. The objective 
of this rulemaking would be defeated if operators of airplanes with 
configuration changes were allowed to rely solely on the instructions 
developed by TC and STC holders that may not reflect the actual 
configurations. This would allow for hazards introduced by the 
configuration changes to remain unaddressed.
    As discussed previously, this same commenter suggests a one-time 
inspection to identify certain aspects of the configuration. We concur 
that, for those operators who cannot otherwise identify their 
airplanes' configurations, a one-time inspection of the entire system 
may be an appropriate means of determining the configurations. Once the 
configuration is known, the operator can perform a safety review of 
configuration changes not included in the TC holder and relevant STC 
holder reviews. As discussed previously, this type of review may be 
qualitative and does not require a quantitative analysis. In performing 
this review, the operator can use the guidance provided in AC 25.981-1B 
and the TC and relevant STC holder maintenance and inspection programs.
    These operators could begin inspecting these airplanes immediately 
so that the differences from the TC and STC configurations can be 
documented and taken into consideration in the system safety assessment 
and any subsequent maintenance and inspection instructions. While 
operators may not have adequate engineering resources to complete the 
evaluations and may not be able to rely on TC holders for support in 
evaluating these changes, technical assistance contracts and use of 
Designated Engineering Representatives (DERs) are possible methods of 
completing the necessary work.
    While we are confident that operators are capable of complying with 
these requirements, we recognize the validity of the operators concerns 
regarding the compliance time. Because it is important that this review 
be done

[[Page 23106]]

properly, the compliance time for implementing the resulting 
maintenance and inspection programs is extended from 18 months to 36 
months. This provides the operators an additional 18 months after the 
TC and STC holders are required to complete their programs, to complete 
the safety review of any field approvals on their airplanes, develop a 
comprehensive maintenance or inspection program, and implement the FAA 
approved maintenance or inspection program. We consider this sufficient 
to address any design changes identified by the operators.

Question on Applicability of SFAR to Modifications Installed via Field 
Approvals

    One commenter points out that, in the preamble to the notice where 
changes to the operating requirements were explained, the FAA included 
a discussion of the effect of those requirements on field approvals. 
[``Field approvals'' are defined as those design changes approved by an 
authorized FAA aviation safety inspector (e.g., Principal Maintenance 
Inspector, PMI) on an FAA Form 337, ``Major Repair and Alteration,'' or 
other document (e.g., an airline engineering order).] However, the 
preamble did not include a discussion of field approvals in the context 
of the proposed SFAR. Further, the proposed text of neither the SFAR 
nor the operating requirements contains any mention of field approvals. 
Thus, the commenter questions whether the proposed rule actually 
applies to field approvals whose installations may affect the airplane 
fuel tank system. Additionally, the commenter questions whether other 
forms of repairs or modifications permitted on in-service aircraft and 
not specifically mentioned in the SFAR (for example, approvals used by 
airlines via SFAR 36 repairs) need to be considered within the context 
of the proposed rule.
    If the FAA intends that all repairs be considered under the rule's 
requirements, then the commenter requests that field approvals, 
approved repairs, and so on, be considered in the same fashion as non-
ATA 28 STC's (discussed above).
    Similarly, another commenter states that modifications approved 
under a field approval may prove to be problematic when attempting to 
comply with the safety review analysis that would be required by the 
proposed SFAR. These types of modifications were discussed in the 
preamble to the notice, but were not accounted for in the economic 
analysis. The commenter considers that more details are needed as to 
how to address them. The field approval does not have the same 
visibility as an STC, and it could be substantially more difficult to 
identify which of these types of modification could affect the fuel 
systems. Furthermore, many might have been approved by an inspector, 
without certification engineering analysis and data; this would 
certainly complicate the safety review analysis required by the SFAR. 
Such modifications are of interest even to foreign parties as they 
might have been incorporated on aircraft that are now on foreign 
registries. The commenter requests that the FAA provide more details as 
to how it intends to apply the SFAR to the modifications approved under 
a field approval.
    FAA's Response: The FAA recognizes that some clarification is 
necessary. The preamble to the notice and the Discussion of the Final 
Rule section of this preamble state that the proposed requirements are 
intended to apply to type designs, supplemental type designs, and field 
approvals.
    The FAA is aware that a significant number of changes to transport 
category airplane fuel tank systems have been incorporated through 
field approvals. These changes may significantly affect the safety of 
the fuel tank system. As discussed previously, the operator of any 
airplane with such changes would be required to identify them, complete 
a safety assessment taking into consideration the safety assessments 
completed by the TC and STC holders, and to develop applicable 
maintenance and inspection instructions and submit them to the FAA for 
approval, together with the necessary substantiation of compliance with 
the safety review requirements of the SFAR. To eliminate any 
misunderstanding, the operational final rules have been revised to 
state that the instructions for maintenance and inspection of the fuel 
tank system must address the actual configuration of each affected 
airplane.

Question on Applicability of SFAR to Repairs

    One commenter requests more details concerning how the proposed 
safety review required by the SFAR would be applicable to repairs that 
currently exist on an airplane. The commenter points out that the 
proposed SFAR text omits any mention of repairs. The commenter states 
that it would be very difficult to trace back all the repairs, and 
their supporting engineering data, so that a proper safety analysis 
could be carried out. The commenter believes that these repairs, like 
``orphan STC's,'' might render the design review by safety analysis 
approach unworkable in many cases. To help the operators, the 
manufacturers should be required to provide for an alternative to the 
safety assessment.
    FAA's Response: As discussed above, the FAA intends that the 
instructions required by the operating rules address the actual 
configurations of the airplanes. As required by 14 CFR 43.13, a repair 
must restore the airplane to its original or properly altered 
condition. Therefore, repairs should not adversely affect fuel tank 
system safety. To the extent that known repairs may have changed design 
features affecting fuel tank system safety, they should be addressed in 
the maintenance and inspection instructions. We recognize that, unlike 
records of major alterations, repair records are not required to be 
retained permanently. If operators are unaware of such repairs, this 
rule does not require that inspections be conducted solely for the 
purpose of identifying them. On the other hand, if such repairs are 
identified as a result of inspections performed to identify 
configuration changes, those repairs must be addressed in the 
instructions.

Request for Clarification on Role of the Principal Maintenance 
Inspector in SFAR Actions

    One commenter requests a clarification of the role of the principal 
maintenance inspector (PMI) in the fuel tank safety review process that 
would be required by the SFAR. The commenter states that there must be 
technical information available at the airline or PMI level to 
effectively carry out the objective of the proposed SFAR. However, the 
commenter is concerned that, even though there will be guidelines 
available in the new AC 25.981-1B, a PMI ``will not have the expertise 
to be able to evaluate whether an alternative truly satisfies the 
SFAR.''
    FAA's Response: The FAA does not intend that the PMI would evaluate 
the technical design information. As stated in the preamble to the 
notice and the Discussion of the Final Rule section of this preamble, 
the FAA would require that this information be submitted to the 
cognizant FAA Aircraft Certification Office (ACO). The maintenance and 
inspection program that is generated also would be approved by the 
cognizant ACO. The PMI would be responsible for oversight of the 
operator to verify that any mandatory maintenance or inspection actions 
are incorporated into the operators' maintenance or inspection 
programs.

[[Page 23107]]

Request for a One-Time Inspection Program

    One commenter requests a revision to the proposed rule to require 
that, prior to conducting a system safety review and analysis for each 
aircraft type, a detailed inspection should be conducted of the fuel 
tanks of several representative airplanes for each type certificated 
aircraft. The purpose of the inspection would be to determine the 
specific health of the fleet. The inspection should span both old and 
newer airplanes, and include at least two operators and at least 10 
airplanes. The commenter suggests that this should be a very aggressive 
inspection, which would involve removal and teardown of components and 
inspection of difficult-to-reach areas. The deficiencies and failures 
listed in the notice, as well as the findings of the industry-wide 
inspections of the Boeing 747 fuel tanks, could provide a starting 
point for defining the nature of the inspections. Based on findings of 
these inspections, appropriate corrective action could be determined 
and mandated. Required design changes would become apparent as a result 
of this inspection program.
    The commenter states that there are precedents to this type of 
inspection. For example, the United States Air Force conducted 
aggressive inspections of B-52 and KC-135 aircraft in the 1980's to 
establish the condition of these aircraft, and required corrective 
action for continued safe operation of these aging aircraft. These 
inspection programs, referred to as Condition Assessment/Inspection 
Programs (CA/IP), were conducted for many of the same concerns that 
were raised in the notice, although the programs covered other aircraft 
systems as well (i.e., electrical, avionic, hydraulic, pneumatic, 
etc.). The CA/IP findings resulted in numerous fuel system corrective 
actions to enhance safety, including maintenance actions and intervals, 
and design improvements.
    FAA's Response: The FAA does not concur with the suggestions of 
this commenter for several reasons:
    There already have been ample inspections, service history reviews, 
and other assessments of the transport fleet that have confirmed, 
without question, that the safety of the fuel tank systems on these 
airplanes must be improved. Most recently, the industry-led Fuel Tank 
Safety Team conducted an inspection of over 800 transport category 
airplane fuel tanks, which revealed such things as repairs and 
alterations that may result in a fuel tank system that does not meet 
the original type design; improperly installed parts; improperly routed 
wiring; etc.
    We do not consider that the commenters' suggested one-time 
inspection is necessary for airplanes for which the configuration can 
be identified by other means. Nevertheless, the development of critical 
design configuration control limitations and mandatory maintenance and 
inspection items will likely result in eventual inspection of all 
critical fuel tank system-related areas of airplanes in the transport 
fleet.

Question on Redundant vs. Single-Thread Fuel Tank Systems

    One commenter questions a statement in the preamble to the notice 
that introduced the FAA's discussion of its review of maintenance 
practices for the fuel tank system. The statement read,

    Typical transport category airplane fuel tank systems are 
designed with redundancy and fault indication features such that 
single component failures do not result in any significant reduction 
in safety.

    The commenter maintains that just the opposite is true: Current 
designs are single-thread systems. That is because there will be an 
explosive mixture in the tank on a regular basis, and there is likely 
to be debris in the tank, so any single failure, such as a hot short, 
will compromise safety. The same is true for pump insulation failures.
    FAA's Response: The FAA disagrees with this commenter's 
observations in part. Regulations applicable to airplanes affected by 
this rulemaking require that ``no single failure or likely combination 
of failures may result in a hazard.'' However, we do agree that the 
investigation of fuel tank system designs has shown certain 
installations do not meet this requirement. This is one of the purposes 
for the requirements of this rulemaking action.

Request for Clarification of Statement of Probability

    One commenter disagrees with a statement that appeared in the 
preamble to the notice, which stated:

    The proposed SFAR would require the design approval holder to 
perform a safety review of the fuel tank system to show that fuel 
tank fires or explosions will not occur on airplanes of the approved 
design.

    The commenter states that it is impossible to show that ``fuel tank 
fires or explosions will not occur,'' because the probability of such 
an event, in terms of a system safety analysis, cannot be shown to be 
equal to zero. The commenter believes that this is not what the FAA 
intended. The commenter suggests that this phrase be removed because 
the essence of the requirement of the proposed SFAR is captured in 
another passage that appeared immediately after the cited phrase in the 
preamble to the notice, which read:

    * * * In conducting the review, the design approval holder would 
be required to demonstrate compliance with the standards proposed in 
this notice for Sec. 25.981(a) and (b) * * * and the existing 
standards of Sec. 25.901.''

    The commenter points out that the standards proposed in the notice 
neither suggest nor require that the probability of the occurrence of a 
fire or explosion should be zero.
    Alternatively, the commenter suggests that the intent of the 
regulation could be clarified to require practical elimination of 
ignition sources with the intent to eliminate all sources by use of new 
technology and design architecture.
    FAA's Response: The FAA considers that some clarification is 
necessary. We agree with the commenter that it is impossible to show 
that the probability of a fuel tank explosion is equal to zero in 
numerical terms. The statement cited in the notice was intended to 
express in very general terms the objective of the proposed rule--that 
``fuel tank fires or explosions will not occur.'' The intended level of 
safety is clearly defined in the regulatory text. We concur with the 
clarification of intent provided by the commenter.

Request To Address Third Party Maintenance Activity in Safety Review

    One commenter notes that experience has shown that unauthorized 
processes and materials are sometimes used by third party repair 
businesses, possibly even unknown to the designer. This may result in 
service problems that would be unforeseen by the designer, and possibly 
a reduced level of safety. The commenter argues that it does not seem 
reasonable to expect a survey of the safety of fuel system designs to 
take into account the effect of unauthorized and, therefore, 
unforeseeable maintenance activities. There may be features of the 
design that are critical to the safe operation of the equipment, but 
not obvious to a third party. The commenter requests that the FAA 
consider revising the proposed regulation to ensure that maintenance 
action carried out by parties not cognizant of the safety consequences 
of their procedures do not jeopardize the safety of aircraft in 
service.
    FAA's Response: The FAA agrees in part with this commenter. The 
fuel tank safety review required by this rule must include failures 
that are foreseeable as well as any that have occurred in service. The 
evaluation also must

[[Page 23108]]

include consideration of susceptibility to maintenance errors. The 
requirement to develop critical design configuration control 
limitations, discussed later, is intended to provide maintenance 
personnel with precisely the type of safety critical information 
identified by the commenter.

Discussion of Comments on Sec. 25.981, Fuel Tank Ignition 
Prevention

Request for Revision to Requirement for Addressing Latent Failures

    One commenter believes that the proposed Sec. 25.981(a)(3), which 
would require demonstrating that an ignition source could not result 
from single or latent failures, is too severe. The commenter asserts 
that it presents requirements that are outside the scope of 
Sec. 25.1309 and Sec. 25.901(c); these are the same standards that the 
FAA states in the preamble to be the baseline for the proposed 
requirements relative to the ignition source prevention assessment. 
These regulations provide a defined method for assessing latent 
failures (although the regulations do not specifically address latent 
failures). The commenter favors the continued use of the fail-safe 
design concept as defined in AC 25.1309-1A. The commenter maintains 
that the new wording proposed by the FAA imposes a requirement on 
latent failure conditions that are just one part of a larger set of 
combinations leading to the hazard of ``ignition sources present in 
fuel tanks.'' It is the larger set that Sec. 25.1309 imposes a 
requirement on, thus taking into account the complete set of all 
combinations. The commenter states that the proposed wording of 
Sec. 25.981(a)(3) ``adversely penalizes'' the resulting outcome of the 
analysis, in particular the definition of maintenance intervals and the 
means for determining whether an added safety feature is required to 
mitigate or prevent the event.
    FAA's Response: The FAA disagrees with the commenter's assertion 
that current industry practice is adequate to address fuel tank safety 
issues. Paragraph 5.a.1. of AC 25.1309-1A, which the commenter 
supports, states in part:

    In any system or subsystem, the failure of any single element, 
component or connection should be assumed to occur during any one 
flight regardless of the likelihood that it would fail. Any such 
single-failure should not prevent the continued safe flight and 
landing of the airplane, nor significantly impair the ability of the 
crew to cope with the resulting conditions.

    Consequently, if ``any one flight'' is taken literally, this 
includes flights anticipated to originate with pre-existing failures. 
However, we recognize that the meaning of ``any one flight'' has been a 
contentious issue for many years, and we have agreed to work within 
ARAC to try and resolve the issue of ``specific risk'' for the more 
generally applicable rules, such as Sec. 25.901(c) and Sec. 25.1309. 
Furthermore, as noted earlier, if a more appropriate means of 
addressing this issue should result from these ARAC activities, this 
rule will be amended accordingly to retain consistency. This commitment 
to ARAC notwithstanding, the FAA is also committed to assuring that 
transport category airplane designs are acceptably fail-safe on each 
flight, not just on a typical flight of mean duration or on flights 
where the airplane initially has no failures present.
    The FAA disagrees with the commenters' assertion that the 
requirements of Sec. 25.981(a)(3) are ``outside the scope of 
Sec. 25.1309 and Sec. 25.901(c).'' As stated previously in the notice 
and in this final rule, the FAA's policy for compliance with 
Sec. 25.901(c), in general, has been to require applicants to assume 
the presence of foreseeable latent (operationally undetected) failure 
conditions when demonstrating that subsequent single failures will not 
jeopardize the safe operation of the airplane. This requirement 
(referred to as ``latent plus one'') simply provides the same single 
fault tolerance for aircraft operating with an anticipated latent 
failure as would be provided by FAA Master Minimum Equipment List 
(MMEL) policies if that failure is known to exist (i.e., not latent).
    As for Sec. 25.1309, the commenter appears to be confusing the 
objective of the rule (i.e., to prevent the occurrence of catastrophic 
failure conditions that can be anticipated) with a conditionally 
acceptable means of demonstrating compliance, as described in AC 
25.1309-1A (i.e., that catastrophic failure conditions must have an 
``average probability per flight hour'' of less than 
1 x 10-9). Since this same misconception has presented 
itself many times before, the following discussion is intended to 
clarify the intent of the term ``extremely improbable'' and the role of 
``average probability'' in demonstrating that a condition is 
``extremely improbable.''
    The term ``extremely improbable'' (or its predecessor term, 
``extremely remote'') has been used in 14 CFR part 25 for many years. 
The objective of this term has been to describe a condition (usually a 
failure condition) that has a probability of occurrence so remote that 
it is not anticipated to occur in service on any transport category 
airplane. While a rule sets a minimum standard for all the airplanes to 
which it applies, compliance determinations are necessarily limited to 
individual type designs. Consequently, all that has been required of 
applicants is a sufficiently conservative demonstration that a 
condition is not anticipated to occur in service on the type design 
being assessed.
    The means of demonstrating that the occurrence of an event is 
extremely improbable varies widely, depending on the type of system, 
component, or situation that must be assessed. There has been a 
tendency, as evidenced by the comment, to confuse the meaning of this 
term with the particular means used to demonstrate compliance in those 
various contexts. This has led to a misunderstanding that the term has 
a different meaning in different sections of part 25.
    As a rule, failure conditions arising from a single failure are not 
considered extremely improbable; thus, probability assessments normally 
involve failure conditions arising from multiple failures. Both 
qualitative and quantitative assessments are used in practice, and both 
are often necessary to some degree to support a conclusion that an 
event is extremely improbable.
    Qualitative methods are techniques used to structure a logical 
foundation for any credible assessment. While a best-estimate 
quantitative analysis is often valuable, there are many situations 
where the qualitative aspects of the assessment and engineering 
judgment must be relied on to a much greater degree. These situations 
include those where:
     There is insufficient reliability information (e.g., 
unknown operating time or conditions associated with failure data);
     Dependencies among assessment variables are subtle or 
unpredictable (e.g., independence of two circuit failures on the same 
microchip, size and shape of impact damage due to foreign objects);
     The range of an assessment variable is extreme or 
indeterminate; and
     Human factors play a significant role (e.g., safe outcome 
dependent totally upon the flightcrew immediately, accurately, and 
completely identifying and mitigating an obscure failure condition).
    Qualitative compliance guidance usually involves selecting 
combinations of failures that, based on experience and engineering 
judgment, are considered to be just short of ``extremely improbable'', 
and then demonstrating that they will not cause a catastrophe. In some 
cases,

[[Page 23109]]

examples of combinations of failures necessary for a qualitative 
assessment are directly provided in the rule. For example, Sec. 25.671 
(concerning flight controls) sets forth several examples of 
combinations of failures that are intended to help define the outermost 
boundary of events that are not ``extremely improbable.'' Judgment 
would dictate that other combinations, equally likely or more likely, 
would also be included as not ``extremely improbable.'' However, 
combinations less likely than the examples would be considered so 
remote that they are not expected to occur and are, therefore, 
considered extremely improbable. Another common qualitative compliance 
guideline is to assume that any failure condition anticipated to be 
present for more than one flight, occurring in combination with any 
other single failure, is not ``extremely improbable.'' This is the 
guideline, often used to find compliance with Sec. 25.901(c), that the 
FAA is adopting as a standard in Sec. 25.981(a)(3).
    Quantitative methods are those numerical techniques used to predict 
the frequency or the probability of the various occurrences within a 
qualitative analysis. Quantitative methods are vital for supporting the 
conclusion that a complex condition is extremely improbable. When a 
quantitative probability analysis is used, one has to accept the fact 
that the probability of zero is not attainable for the occurrence of a 
condition that is physically possible. Therefore, a probability level 
is chosen that is small enough that, when combined with a conservative 
assessment and good engineering judgment, it provides convincing 
evidence that the condition would not occur in service.
    For conditions that lend themselves to average probability 
analysis, a guideline on the order of 1 in 1 billion is commonly used 
as the maximum average probability that an ``extremely improbable'' 
condition can have during a typical flight hour. This 1 in 1 billion 
``average probability per flight hour'' criterion was originally 
derived in an effort to assure the proliferation of critical systems 
would not increase the historical accident rate. This criterion was 
based on an assumption that there would be no more than 100 
catastrophic failure conditions per airplane. This criterion was later 
adopted as guidance in AC 25.1309. The historical derivation of this 
criterion should not be misinterpreted to mean that the rule is only 
intended to limit the frequency of catastrophe to that historic 
1 x 10-7 level. The FAA conditionally accepts the use of 
this guidance only because, when combined with a conservative 
assessment and good engineering judgment, it has been an effective 
indicator that a condition is not anticipated to occur, at least not 
for the reasons identified and assessed in the analysis. Furthermore, 
decreasing this criterion to anything greater than 1 x 10-12 
would not result in substantially improved designs, only increased line 
maintenance. The FAA has concluded that the resulting increased 
exposure to maintenance error would likely counteract any benefits from 
such a change. An ARAC working group has validated these conclusions.
    When using ``averages,'' care must be taken to assure that the 
anticipated deviations around that ``average'' are not so extreme that 
the ``peak'' values are unacceptably susceptible to inherent 
uncertainties. That is to say, the risk on one flight cannot be 
extremely high simply because the risk on another flight is extremely 
low. An important example of the flaw in relying solely on 
consideration of ``average'' risk is the ``specific risk'' that results 
from operation with latent (not operationally detectable) failures. It 
is this risk that is being addressed by Sec. 25.981(a)(3), as adopted 
in this final rule. For example, latent failures have been identified 
as the primary or contributing cause of several accidents. In 1991, a 
thrust reverser deployment occurred during climb from Bangkok, 
Thailand, on a Boeing Model 767 due to a latent failure in the 
reversing system. In 1996, a thrust reverser deployment on a Fokker 
Model F-100 airplane occurred following takeoff from Sao Paulo, Brazil, 
due to a latent failure in the system. As noted earlier, the NTSB 
determined that the probable cause of the TWA 800 accident was ignition 
of fuel vapors in the center wing fuel from an ignition source:

    * * * The source of ignition energy for the explosion could not 
be determined with certainty but, of the sources evaluated by the 
investigation, the most likely was a short circuit outside of the 
center wing tank that allowed excessive voltage to enter it through 
electrical wiring associated with the fuel quantity indication 
system [FQIS].

    A latent failure or condition creating a reduced arc gap in the 
FQIS would have to be present to result in an ignition source. This 
rule is intended to require designs that prevent operation of an 
airplane with a preexisting condition or failure such as a reduced arc 
gap in the FQIS (latent failure) and a subsequent single failure 
resulting in a short circuit that causes an electrical arc inside the 
fuel tank.
    Due to variability and uncertainty in the analytical process, 
predicting an average probability of 1 in 1 billion does not 
necessarily mean that a condition is extremely improbable; it is simply 
evidence that can be used to support the conclusion that a condition is 
extremely improbable. Wherever part 25 requires that a condition be 
``extremely improbable,'' the compliance method, whether qualitative, 
quantitative, or a combination of the two, along with engineering 
judgment, must provide convincing evidence that the condition will not 
occur in service.

Request To Revise Definition of Critical Design Configuration Control 
Limitations

    One commenter requests that proposed Sec. 25.981(b) be changed to 
revise or delete the reference to ``critical design configuration 
control limitations.'' This commenter cannot agree with the definition 
stated in the notice as:

    * * * any information necessary to maintain those design 
features that have been defined in the original type design as 
needed to preclude development of ignition sources.

    The commenter raises several concerns regarding the definition and 
implications of critical design configuration control limitations:
    First, the commenter is concerned that within the definition, ``any 
information necessary'' can be interpreted as being not only the 
provision of maintenance and inspection instructions, but also the 
provision of the fuel tank design features itself. This could include 
material specifications, specific manufacturing processes, dimensions, 
etc. The commenter states that this means the type certificate holder 
would be required to list its proprietary design approach, which could 
lead to a loss of competitive edge and an infringement on proprietary 
intellectual property. The commenter objects to this requirement 
because it would allegedly sacrifice the hard earned competitive 
advantage that manufacturers derive through their expertise and 
continuing investment in research and development. As an example, the 
commenter asserts, ``if a certain pump is qualified on the airplane, 
the industry does not believe it is appropriate or necessary to list 
all of the features inherent to that pump itself that were qualified as 
part of the units approval. This approved parts list and the associated 
installation and maintenance manuals suffice for maintaining the 
airworthiness of this pump.''
    Second, the commenter is concerned that this would put an 
unprecedented liability risk on the type certificate holder if it omits 
some features, either

[[Page 23110]]

through error or because it did not realize a supplementary function 
provided by the features. (The commenter provided no further 
explanation or substantiation of this concern, however.)
    Third, the commenter states that the notion of critical design 
configuration control limitations goes beyond the notion of inspection 
and maintenance. In this regard, it does not imply the same compliance 
requirement as Sec. 25.571, which is the FAA's stated precedent for the 
proposed rule.
    Fourth, the commenter considers that critical design configuration 
control limitations go against standard industry practice regarding 
what manufacturers should provide to users.
    Fifth, the commenter states that the notion of critical design 
configuration control limitations attempts to cover deficiencies in the 
STC and the airline modification approval process by indirectly 
``implicating'' the manufacturer in changes to the certificated 
configuration that the manufacturer may not have known about or 
performed.
    For these reasons, the commenter requests that the proposed rule be 
revised to delete or change the requirement concerning critical design 
configuration control limitations.
    FAA's Response: The FAA does not concur with the commenter's 
request to revise the rule, and provides the following disposition of 
each of the commenter's concerns.
    1. Concern about release of proprietary information. The FAA has 
always required manufacturers to provide information that is necessary 
to maintain the safety of a product. For example, information that is 
contained in many maintenance manuals might be considered proprietary 
in nature, but the FAA requires each manufacturer to develop 
instructions for continued airworthiness for their products containing 
this information. Defining features of an airplane design, such as wire 
separation, explosion proof features of a fuel pump, maintenance 
intervals for transient suppression devices, minimum bonding jumper 
resistance levels, etc., is needed so that any maintenance actions or 
subsequent changes to the product made by operators or the manufacturer 
do not degrade the level of safety of the original type design. The 
definition of critical design configuration control limitations does 
not include ``all of the features inherent'' in the design; it only 
includes information that is necessary to ensure safety of fuel tank 
systems. The policy determination underlying this requirement is that 
design approval applicants subject to this requirement should be 
required to develop this information and make it available to operators 
of affected airplanes. This is consistent with the policy regarding 
airworthiness limitations required by Sec. 25.571 (``Damage-tolerance 
and fatigue evaluation of structure'').
    2. Concern about liability of type certificate holders. The FAA 
disagrees that risk of liability is an issue. If conscientiously 
implemented, this requirement will significantly reduce the risk of 
accidents from fuel tank explosions. This, in turn, will reduce the 
liability risk of design approval holders.
    3. Concern about new inspection and maintenance requirements. The 
FAA agrees in part with the commenter. While it is true that the term 
``critical design configuration control limitations'' is new and may 
result in new inspection and maintenance requirements, the very intent 
of this rule is to require mandatory maintenance and inspection for the 
fuel tank system. We agree that the compliance requirements are 
different between Sec. 25.571 and Sec. 25.981. However, these 
differences are due to the differences between structures and systems. 
For example, service experience indicates that alterations have been 
made to systems affecting fuel tank safety without consideration of the 
effects of the alterations. One purpose of critical design 
configuration control limitations is to ensure that maintenance 
personnel are informed of and address these effects. In the context of 
structures, the primary concern has been aging phenomena such as 
fatigue, and the limitations are intended to ensure that these 
phenomena are identified and addressed before they become critical. The 
result in both instances is mandatory maintenance and inspection 
requirements for both fuel tank systems and structures. We have 
determined that the fuel tank system warrants mandatory minimum 
maintenance criteria to prevent catastrophic failure. By placing these 
requirements in the Airworthiness Limitations section of the 
Instructions for Continued Airworthiness, the design approval holder 
provides consistent mandatory baseline maintenance standards for the 
fleet.
    4. Concern that the requirement goes against standard industry 
practice regarding what manufacturers should provide to users. The FAA 
agrees that the proposed rule may differ from historical industry 
practice. However, the purpose of this rule is to improve both the 
safety of the fleet and the practices within the industry. The 
information we are requiring the design approval holder to provide to 
the operator is basic information needed by the industry to operate 
airplanes safely. It will provide operators with a baseline document to 
develop a maintenance and inspection program that will enhance safety 
within the fleet. It will also aid the operator in establishing the 
configuration requirements that must be accounted for during any 
subsequent alterations to the airplane.
    5. Concern about covering deficiencies in the STC and modification 
approval process by indirectly implicating the manufacturer. The FAA 
disagrees that the definition of critical design configuration control 
limitations ``implicates'' the TC holder in configuration changes made 
by others. On the contrary, these limitations provide TC holders with 
the ability to limit the types of changes that may be made to their 
designs that could adversely affect their safety.

Request To Delete Use of Placards and Decals

    One commenter requests that Sec. 25.981(b) of the proposed rule be 
revised to delete the requirements concerning placement of placards or 
decals in the areas where ``maintenance, repairs, or alterations may 
violate the critical design configuration limitations.'' The commenter 
agrees that adequate information regarding general design practices and 
precautions must be available to those who perform and approve repairs 
and alterations to the airplane. However, the commenter argues that 
placing placards and decals on the airplane may not be practical, 
considering that they might not remain in place or be readable over 
time. The commenter suggests that a more effective way to convey fuel 
system general practices information to operators is via the standard-
practices section of the Aircraft Maintenance Manual (or a similar 
section of another appropriate manual). The commenter does agree that 
the fuel quantity indicating system (FQIS) wiring could be better 
identified, and suggests that manufacturers work with the appropriate 
agencies to develop a standardized system (similar to that for oxygen 
lines) to identify critical fuel systems wiring for future aircraft 
designs.
    FAA's Response: The FAA concurs in part with the commenter. The 
rule is meant to be a performance-based rule; therefore, the FAA's 
objective is not to mandate the use of any specific means of providing 
visual identification of critical design control limitations. Although 
the text suggests the use of

[[Page 23111]]

placards and decals, the rule allows visible means other than placards 
and decals to be used. Placards are normally used in many locations of 
transport airplanes to convey information to maintenance personnel, but 
placards are only one option of identifying critical design 
configuration limitations. The FAA also recognizes that installation 
and maintenance of placards in certain locations of the airplane may 
not be practical.
    The objective of this requirement is to provide a means to assist 
maintenance personnel in reducing maintenance errors. Adverse service 
experience demonstrates that modifications have inadvertently resulted 
in routing of high power wiring with FQIS wiring. The need to provide 
visible identification of critical design configuration control 
limitations will depend upon the particular airplane configuration.
    As an example, the FAA anticipates that the requirements of this 
rule will result in modifications either to separate FQIS wiring from 
high power sources, or to install transient suppression devices. If 
transient suppression devices are incorporated into the FQIS, the FAA 
would not consider separation of the wiring from other high power 
wiring a critical design configuration item and, therefore, would not 
require visible identification. If separation of FQIS from high power 
sources wiring is critical, the FAA will require a visible means of 
identification. One acceptable means of compliance in this case would 
be to install color-coded tape at specified intervals along critical 
wiring.
    To clarify the intent of this requirement, we have revised the 
wording within the rule to eliminate reference to placards and decals. 
The text of the final rule states only that a visible means of 
identification must be provided.

Discussion of Comments on Appendix H25.4, Instructions for 
Continued Airworthiness

Request To Mandate Certification Maintenance Requirements Instead of 
Appendix

    One commenter opposes the proposed Appendix H25.4(a)(2), which 
would require revising the Instructions for Continued Airworthiness 
(ICA) to set forth each mandatory replacement time, inspection 
interval, related inspection procedure, and all critical design 
configuration control limitations approved under Sec. 25.981 for the 
fuel tank system. The commenter considers that singling out just the 
fuel system for this requirement is not justified because all systems 
have their own criticalities that must be documented. The commenter 
asserts that this proposed requirement fails to recognize that 
equivalent systems-related tasks are already defined under 
Certification Maintenance Requirements (CMR), a process that has been 
in place since the early 1980's and formalized in 1994. [CMR's are 
maintenance requirements that identify aircraft system-related safety 
tasks for ``dormant'' (latent) failure conditions related to hazardous 
and catastrophic failure conditions.] The commenter states that CMR's 
are considered the systems equivalent of the structural airworthiness 
limitations and are part of today's certification process, even though 
CMR's are not included in part 25. The FAA Aircraft Certification 
Offices (ACO) and other prime certifying authorities regularly approve 
CMR's, and all operators' maintenance programs use these same CMR's. 
This commenter states that the proposed requirement indirectly regroups 
all maintenance tasks associated with the prevention of fuel tank 
ignition sources under the responsibility of the ACO, and this 
undermines the MRB process as well as the FAA's Aircraft Evaluation 
Groups' (AEG) responsibility in approving maintenance programs.
    In light of this, the commenter suggests that rather than regulate 
the CMR concept system-by-system as the proposed Appendix would do, the 
FAA should pursue a separate regulatory initiative that would give 
official recognition of the CMR's and make them enforceable. The 
commenter states that doing so would ``fix a long-standing regulatory 
deficiency.'' The advantage of such an alternative rulemaking approach 
is that it would:
     Keep current procedures and processes in place and avoid 
the creation of another bureaucratic approval process;
     Accomplish the FAA objective of requiring manufacturers to 
create an Airworthiness Limitations section in the Instructions for 
Continued Airworthiness similar to that approved under Sec. 25.571 for 
structure; and
     Eliminate the need to enforce mandatory inspection or 
other procedures via Sec. 25.981(b).
    Similarly, another commenter believes that the FAA should formally 
recognize the CMR concept in the proposed rule. This commenter states 
that in doing so, the concept of declaring ``critical configuration 
control limitations,'' as proposed in Sec. 25.981(b), would be 
unnecessary. The commenter recommends the rule be revised to allow use 
of the Certification Maintenance Coordination Committee (CMCC) process, 
as described in AC 25-19 (``Certification Maintenance Requirements,'' 
issued November 28, 1994), to allow operators to absorb tasks within 
the existing maintenance programs if a MSG-3 task is identified. This 
reduces costs associated with tracking additional Airworthiness 
Limitations, which would be required in accordance with the proposed 
Appendix H requirements.
    FAA's Response: The FAA does not concur that the rule should be 
revised to include the CMR process. The concept of this rule goes 
beyond the current CMR process. CMR's only address mandatory 
maintenance that is applied to the airplane at the time of original 
certification. The requirement of this rule for configuration design 
control limitations will address not only mandatory maintenance 
actions, but also design features (e.g., wire separation, pump impeller 
material specification) that cannot be altered except in accordance 
with the Instructions for Continued Airworthiness (ICA). The 
configuration design control limitations will be made part of the 
Airworthiness Limitations section of the ICA; therefore, they will be 
mandatory in accordance with Sec. 91.403(c).
    Further, the current MRB process does not provide a mandatory, 
legally enforceable means to require mandatory maintenance tasks; nor 
does it provide the critical control limitations that are needed to 
assist operators when making future repairs and alterations to an 
aircraft.
    There would be some value in changing the regulations to mandate 
either application of the CMR process to all systems or including all 
systems in the Limitations Section of the ICA. However, such action is 
beyond the scope of the current rulemaking, and would significantly 
delay action to address fuel tank safety issues. We are considering 
tasking ARAC to address this issue. If the ARAC process develops an 
improved proposal, amendment of the regulations to adopt an alternative 
to the actions required by this final rule can be made at that time.

Discussion of Comments on Operating Rules

Request To Revise Maintenance Operations Requirements

    One commenter agrees in principle with the intent of the proposed 
changes to Secs. 91.410, 121.370, and 125.248, and supports the concept 
of reviewing and revising, if necessary, the fuel tank system 
maintenance and inspection program. However, the commenter disagrees 
with the FAA's proposed

[[Page 23112]]

methodology and time frame for fulfilling this intent.
    As for the FAA's methodology, the commenter opposes mandating 
changes to maintenance programs via operations rules. Instead, the 
commenter requests that mandatory maintenance tasks be introduced using 
current industry practices, such as the use of the Maintenance Review 
Board (MRB) process and MSG guidelines. The commenter states that the 
inspection programs developed using these processes are based on a 
foundation of information derived from various sources using a defined 
process.
    Further, the commenter states that the manufacturers' recommended 
maintenance and inspection programs already serve as the basis for 
developing operators' individual maintenance and inspection programs. 
Within these established programs, safety issues are identified and 
addressed at both the type certification and continued-airworthiness 
levels. The FAA has internal processes for managing the approval of 
manufacturer-developed maintenance and inspections programs, safety 
tasks, and the final individual-operator maintenance and inspection 
programs.
    However, the commenter maintains that it appears that the proposed 
requirements will ``dissolve'' this existing process only to require 
meeting a calendar deadline. The commenter does not consider that this 
will lead to a safety enhancement.
    This commenter suggests the following alternative for implementing 
a new or revised maintenance program:
    First, the fuel tank system maintenance programs should be 
reexamined in context both with the results of the required SFAR safety 
review and with the existing MRB and other mandated programs [such as 
the Corrosion Protection Control Program (CPCP) and Supplemental 
Structural Inspection Program (SSID)].
    Second, the approval process described in AC 25-19, ``Certification 
Maintenance Requirements (CMR),'' should be used, as appropriate, to 
determine the task classification, interval, and method of task 
transmission (for example, via service bulletins or via the existing 
program update process).
    Third, the FAA should mandate via AD's the service bulletins or 
program interval changes developed as an outcome of this process. This 
way, any changes in maintenance and inspection programs can be 
communicated to operators in an approved format that is compatible with 
the aircraft certification basis.
    Based on this suggested alternative, the commenter requests that 
the rule be revised to delete the proposed Sec. Sec. 91.410, 121.370, 
and 125.248.
    FAA's Response: The FAA does not concur with this commenter. First, 
the MRB process is not a means to mandate compliance; it is a means to 
identify manufacturers' recommended minimum initial scheduled 
inspection and maintenance tasks for new aircraft. Further, in light of 
service history regarding fuel tank events, it is apparent that the MRB 
using the MSG-3 process has previously been unable to develop adequate 
maintenance procedures to address various fuel tank safety issues. 
Second, for the reasons discussed previously, the FAA does not agree 
that changing the current approach to CMR's is appropriate in this 
rulemaking. Third, while AD's are enforceable, they generally are 
limited to safety issues of specific aircraft models. As discussed in 
the preamble to the notice and previously in this final rule, there is 
no advantage in addressing this industry-wide safety issue in a 
piecemeal fashion. We anticipate that in complying with this rule both 
designers and operators will take advantage of many of the methods 
developed in existing cooperative programs noted by the commenter.

Request for Definition of ``Administrator''

    One commenter requests clarification of the term ``the 
Administrator,'' as it is used in proposed Sec. Sec. 91.410, 121.320, 
125.248, and 129.14. The commenter interprets the term 
``Administrator'' to mean ``the Federal Aviation Administration or any 
person to whom he has delegated his authority in the matter 
concerned.'' This is consistent with the definition of the term that 
appears in 14 CFR part 1 (Sec. 1.1).
    The commenter objects to the inconsistent definition that appeared 
in the proposal that identified ``the Administrator'' as ``the manager 
of the cognizant FAA Aircraft Certification Office (ACO).'' Instead, 
the commenter requests that the FAA revise the proposed rule to reflect 
the formalized, industry-recognized roles of other authority entities, 
such as the PMI and the MRB process. Specifically, the commenter 
requests the following revision:
     For approval of the development of the designer's 
maintenance and inspection program, ``the Administrator'' is the FAA 
ACO, the FAA Aircraft Evaluation Group (AEG), or the non-U.S. 
airworthiness authority (if the FAA ACO has delegated its authority via 
a bilateral agreement).
     For approval of the individual operator's maintenance 
program, ``the Administrator'' is the Principal Maintenance Inspector 
(PMI).
    FAA's Response: The FAA concurs that clarification is necessary. 
Part 1 of 14 CFR does define the Administrator to include those 
delegated the authority to act on her behalf. However, in the case of 
this rule, we have determined that the cognizant ACO is the appropriate 
entity that can address the myriad of technical and practical issues 
faced by implementing and enforcing compliance with this rule. As 
discussed elsewhere, neither the PMI nor the MRB process is authorized 
to perform these duties. The final rule has been revised to 
specifically reference the cognizant ACO, or office of the Transport 
Airplane Directorate, as the appropriate official for approving the 
initial and any revisions of the instructions for maintenance and 
inspection of the fuel tank systems required by the rule.

Request for Extension of Compliance Time

    Several commenters request that the proposed compliance time for 
the required actions of Sec. Sec. 91.410, 121.320, 125.248, and 129.14 
be extended. These commenters state that incorporating the new 
instructions into maintenance and inspection programs cannot possibly 
be accomplished within 18 months as would be provided by the proposal. 
These commenters request a minimum compliance time of 54 months.
    FAA's Response: The FAA concurs that the compliance time can be 
extended somewhat. As discussed previously in this preamble, we have 
revised the compliance time to 36 months.

Request To Issue Airworthiness Directives To Change Maintenance 
Programs Instead of Operating Rules

    One commenter disagrees with the proposed requirement to change 
operators' maintenance programs through changes to the operating 
requirements. The commenter suggests that the FAA mandate such 
maintenance actions via Airworthiness Directives specific to each model 
type, rather than by modifying the operational rules. The AD's will 
allow both the FAA and the industry to:
     Assess the actual impact of the maintenance program (cost 
versus benefit);
     Ensure that the appropriate compliance time scale is 
mandated versus the effective date of the rule and the resources 
available; and
     Ensure that foreign authorities and operators are notified 
of the mandatory

[[Page 23113]]

continuing-airworthiness information via a recognized document (ICAO 
obligation, Annex 8, paragraph 4.2.2).
    Similarly, another commenter states that the proposed operating 
rule changes are not needed. This commenter asserts that, if the 
instructions for maintenance and inspections are developed through the 
MSG-3 process, there is no need to include them in the Airworthiness 
Limitation section, as would be required by the proposed rule. If they 
should be mandatory, then the FAA should mandate them by AD's.
    FAA's Response: The FAA does not concur with either of these 
commenters. As discussed in the notice and elsewhere in this final 
rule, we will issue AD's to mandate any design changes identified as 
needed as a result of the design review required by the SFAR 
established by this final rule. However, the FAA considers it 
inappropriate to delay requiring implementation of the maintenance 
programs developed as a result of the SFAR. It is evident that existing 
maintenance programs are generally inadequate to ensure the safety of 
fuel tanks systems and that program improvements are necessary. As 
reflected in the regulatory evaluation prepared for this rulemaking, 
this approach has been found to be cost effective.
    As discussed previously, we have carefully considered the first 
commenters' concerns regarding compliance times, and have extended the 
times to address those concerns. Finally, foreign authorities have been 
fully informed of the FAA's activities, and we will continue to include 
foreign authorities in future discussions of these issues.
    Unlike AD's, the operating rule changes adopted by this final rule 
do not require the adoption of particular programs developed by design 
approval holders. Rather, the rules require adoption of programs that 
meet the objective of providing an acceptable level of safety for fuel 
tank systems. While the programs developed by design approval holders 
will provide a foundation for operators' programs, the individual 
operator is responsible to ensure that its programs address the actual 
configurations of its fuel tank systems.
    In the preamble of the notice, we also discussed use of a SFAR and 
changes to the operating rules, instead of AD's, as the primary means 
of achieving the regulatory objective. As we stated, we consider that 
an SFAR provides a means for the FAA to establish clear expectations 
and standards, as well as a timeframe within which the design approval 
holders and the public can be confident that fuel tank safety issues on 
the affected airplanes will be uniformly examined.
    This rule ensures that the designer completes a comprehensive 
assessment of the fuel tank system and develops any required 
inspections, maintenance instructions, and modifications, if needed. As 
such, the requirements of this final rule are intended to provide 
maintenance requirements that will prevent unsafe conditions from 
developing. This proactive approach provides predictability and 
efficiency.

Discussion of Comments on Flammability Minimization--Sec. 25.981(c)

General Agreement With Reducing Flammability

    All comments received support the overall goal of reducing fuel 
tank flammability. Several commenters strongly support the FAA's 
position that, despite compliance with the proposed flammability 
reduction portion of the rule, the applicant must ensure compliance 
with the ignition source prevention requirements.
    Other commenters support the proposed rule, but suggest other 
alternatives. For example, one commenter asks the FAA to consider 
increasing the scope of the proposal to minimize fuel tank flammability 
to totally preventing operation of fuel tanks with flammable vapors. 
Similarly, another commenter requests that the applicability of the 
proposal be increased so that the flammability of vapors in certain in-
service airplanes would be reduced. Other commenters suggest the FAA 
mandate the installation of means to mitigate the effects of fuel tank 
ignition, such as metal foils or polyurethane foam should be mandated. 
Each of these proposals is discussed below.

Request To Retain Assumption of Flammable Ullage

    Several commenters recognize that fuel system design has been based 
on the assumption that the ullage fuel/air mixture is always flammable. 
However, these commenters express concern that the proposal to require 
minimization of fuel tank flammability could result in a relaxation of 
the requirements for precluding ignition sources within the fuel tanks. 
One commenter asserts that the FAA has retained this assumption for 
now, but ``seems to indicate a willingness to eventually entertain 
designs that would rely more on flammability minimization and 
mitigation, potentially allowing designers to assume the absence of a 
flammable ullage under certain conditions.'' This commenter considers 
that that affordable technology is remote and, therefore, it should be 
made clear that the design philosophy behind the proposed Sec. 25.981 
has firmly retained the assumption of flammable ullage.
    FAA's Response: As noted by the commenter, we affirmed that we are 
not considering a change to the current philosophy of assuming a 
flammable ullage. However, if technological changes are developed, such 
as full-time fuel tank inerting, and prove to be a superior method of 
eliminating the risk of fuel tank ignition, the FAA could consider a 
change in this philosophy in future rulemaking.

Request To Mandate Means to Preventing Flammable Vapors--Inerting

    Several commenters suggest that flammable vapors in the fuel tank 
should be prevented and that practical technologies currently exist 
that should be mandated. One commenter suggests that even with 
Sec. 25.981(c) in place, circumstances might occur operationally in 
which even an unheated wing tank has a flammable ullage with a 
relatively low ignition energy threshold, and that these conditions may 
warrant attention through amending the rule to further reduce 
flammability in the future.
    FAA's Response: The FAA does not concur that mandating fuel tank 
inerting technology has been shown to be feasible at this time. This 
was discussed in detail in the preamble to the notice. We are 
continuing to evaluate further safety improvements, and are conducting 
research and development to investigate the feasibility of 
incorporating nitrogen inerting on both in-service and new type design 
airplanes. As noted previously in this preamble, we tasked the ARAC on 
July 14, 2000 (65 FR 43800), to evaluate both on-board and ground-based 
fuel tank inerting systems. If further improvement is found to be 
practicable, we may consider initiating further rulemaking to address 
such improvements. In the meantime, this final rule requires a means to 
minimize flammability or a means to mitigate the effects of ignition. 
As a performance-based regulation, this allows the use of any 
effective, approved means, but does not require the use of any one 
particular means.

Request To Revise Proposed Flammability Standard

    One commenter believes that the ARAC report referenced in the 
preamble to the notice is flawed in its logic,

[[Page 23114]]

which arrived at a suggested exposure time to explosive conditions not 
to exceed ``7 percent'' of fleet operating time. This recommendation 
was based on comparison of the incident rate of fuel tank explosions 
and ignition events for center tanks to that for wing tanks. The 
commenter states that, due to operating procedures, the wing tanks are 
seldom empty and are not located near any heat sources. While wing tank 
vapors may be explosive when taxiing on a hot runway for extended 
periods, they are never as explosive as are those that often exist in 
empty center tanks. The most serious situation for wing fuel tanks 
would be when the airplane lands on a hot runway with nearly empty 
tanks. However, taxi time at landing is usually short. At takeoff, even 
with a long taxi, the wing tanks will be nearly full with relatively 
cool fuel. The commenter concludes that to have comparable safety 
margins for center tanks as for wing tanks, the degree of explosiveness 
would have to be equivalent.
    Another commenter asserts that the proposed flammability 
requirement is not sufficiently detailed to ensure that compliance can 
be achieved without having to resort to external guidance, not 
published in the rule. The commenter is concerned that the proposed 
rule text is sufficiently vague to promote lack of standardization in 
findings of compliance with the regulation. Although relevant material 
is available in the associated AC 25.981-2, the commenter is aware that 
guidance in the AC is not mandatory and is concerned that the wording 
of the rule essentially requires an interpretation of ``minimize 
flammability'' from the relevant AC.
    FAA's Response: The FAA considers that additional clarification is 
necessary.
    As for the first comment, the ARAC recommendation of a 7 percent 
flammability standard did not provide an equivalent level of 
flammability to that of the wing (main) tanks, which the ARAC 
determined were the tanks with an acceptable level of fuel tank safety 
in relation to ignition or explosion events. The ARAC calculated a 
range of 3 to 5 percent for wing tanks. We considered this concern when 
developing the regulatory text for this rule, and this is why the 
proposal requires flammability to be ``minimized'' rather than 
accepting the ARAC recommendation of 7 percent.
    In response to the second commenter, we consider it appropriate to 
further clarify the intent of the rule by incorporating a definition of 
the term ``minimize'' in the text of Sec. 25.981(c), as follows:

    In the context of this rule, 'minimize' means to incorporate 
practicable design methods to reduce the likelihood of flammable 
vapors.

    ``Practicable design methods'' are feasible means, such as 
transferring heat from the fuel tank (e.g., use of ventilation or 
cooling air). We have provided further guidance in AC 25.981-2, which 
describes how demonstrating that the flammability of the fuel tank is 
equivalent to that of an unheated wing fuel tank would be one 
acceptable means of showing compliance. As with all new performance 
based standards, it will be necessary for the Transport Airplane 
Directorate to participate in the review of proposed means of 
compliance to ensure standardization.

Request That Rule Based on Flammability Be Delayed Until Standard Is 
Established

    One commenter representing manufacturers and operators agrees in 
principle with the FAA's overall intent to enhance the fuel system 
safety of future aircraft designs through measures to reduce fuel tank 
flammability exposure. The commenter agrees that action should be 
taken, as identified by the ARAC Fuel Tank Harmonization Working Group, 
``to address flammability mitigation as a new layer of protection to 
the fuel system.'' However, the commenter disagrees with the proposed 
Sec. 25.981(c) that would require minimization of fuel tank 
flammability, because ``there is not an agreed-to definitive industry 
standard for assessing flammability of aircraft fuel tanks.''
    In light of this, the commenter requests that a rule based on 
flammability be delayed until a standard is defined. In its place, the 
commenter recommends a new rule that would accomplish some degree of 
flammability reduction, even though a definitive flammability standard 
does not exist. The commenter suggests that the new rule should require 
practical measures to reduce heat transfer from adjacent heat sources 
into fuel tanks, and proposes the following text for the rule:

    Sec. 25.981(c):
    If systems adjacent to fuel tanks could cause significant heat 
transfer to the tanks:
    (1) Means to reduce heating of fuel tanks by adjacent systems 
shall be provided; or (2) Equivalent flammability reduction means 
shall be provided to offset flammability increases that would 
otherwise result from heating; or
    (3) Means to mitigate the effects of an ignition of fuel vapors 
within fuel tanks shall be provided such that no damage caused by an 
ignition will prevent continued safe flight and landing.

    FAA's Response: The FAA does not agree with either the commenter's 
proposal to delay the rule relating to fuel tank flammability or the 
commenter's proposed regulatory text. The proposal offered by the 
commenter would require only that a ``means to reduce heating of fuel 
tanks by adjacent systems shall be provided * * *'' The proposed text 
suggested by the comment does not require any measurable reduction in 
flammability, which is the objective of this rulemaking. For example, 
under the commenter's suggested standard, if a fuel tank initially 
contains a flammable fuel-air mixture, a ``means to reduce heating of 
the tank'' may reduce the temperature of the fuel, but not necessarily 
to the extent that the temperature would remain below the flammable 
range for the duration of the flight.
    The commenter asserts that there is no standard for assessing 
flammability of airplane fuel tanks. However, industry members 
represented by the commenter were members of the ARAC group that 
recommended that the regulatory text mandate a maximum fuel tank 
flammability of 7 percent of the operating time. The ARAC report 
provides numerous calculations of fuel tank flammability that were 
conducted by industry representatives. We are confident that industry 
is capable of assessing fuel tank flammability, and we have provided 
guidance in AC 25.981-2, which defines methods of demonstrating 
compliance with the flammability requirements of the rule. One method 
described in the AC for showing compliance is to demonstrate that the 
flammability of the tank is equal to or less than that of an unheated 
wing tank on the airplane type. As discussed previously, Sec. 25.981(c) 
has been clarified by adding a definition of ``minimize.'' For 
applicants who are unable to demonstrate equivalent flammability to an 
unheated wing tank, the use of ``practicable design methods,'' such as 
transferring heat from the fuel tank, will be required. The final rule 
is adopted with the change noted.

Request Not To Mandate Fuel Tank Flammability to the Level Proposed

    The commenter does not agree with the FAA's statement in the 
preamble to the notice that read:

    ``* * * the intent of the proposal is to require that fuel tanks 
are not heated, and cool at a rate equivalent to that of a wing tank 
in the transport airplane being evaluated.''

    For example, directed ventilation systems may reduce heating of 
adjacent fuel tanks, but they do not eliminate heating. Furthermore, 
the commenter

[[Page 23115]]

asserts that there should not be a requirement to ``cool at a rate 
equivalent to that of a wing tank.'' The studies conducted by the ARAC 
Fuel Tank Harmonization Working Group did not conclude that such a 
requirement was necessary or achievable. The commenter requests that 
the FAA not mandate minimizing fuel tank flammability to the level 
proposed in the notice, because it would not be practical to cool tanks 
within the fuselage to the same level as tanks located in the wing.
    FAA's Response: The FAA disagrees. The rule only affects new type 
designs. Therefore, possible design considerations to comply with the 
rule would include:
     Locating heat sources away from fuel tanks;
     Introduction of cool air from outside sources into air 
gaps between heat sources and fuel tanks to transfer heat from tanks 
while inflight; and
     Introducing cool air from ground or airplane sources 
during ground operations.
    Some of these features are already incorporated into certain models 
of the transport fleet. These methods are technically feasible and 
could provide an equivalent level of exposure to operation with 
flammable vapors to that of unheated wing fuel tanks--the fuel tanks 
with a safety level that the ARAC defined as an acceptable standard. 
The commenter provided no data to support the assertion that ``it would 
not be practical to cool tanks within the fuselage to the same level as 
tanks located in the wing.''

Request To Provide Alternatives to Minimizing Flammability

    Two commenters request that alternative regulatory text be included 
in the proposed rule concerning the requirement to minimize 
flammability.
    The first commenter believes that the FAA's intent, as stated in 
the preamble to the notice and restated in draft AC 25.981-2X, is ``to 
require that the exposure to formation or presence of flammable vapors 
is equivalent to that of an unheated wing tank in the transport 
airplane being evaluated.'' The commenter considers this a reasonable 
objective. The commenter recommends that the FAA reword the proposed 
rule text to clearly frame the intent within the rule itself, and 
believes that the wording would be more specific and less prone to 
misinterpretation if it contained the following statement:

    A means must be provided to ensure that the net heat balance 
within any tank will be equivalent to that of an unheated wing fuel 
tank during any portion of the passenger carrying operation.

    The commenter adds that, if an unheated wing fuel tank does not 
exist on a particular design, then one could be modeled and used as the 
reference standard for all tanks on that design.
    The second commenter recommends that the FAA consider an 
alternative to have the applicant determine an acceptable heat transfer 
rate at a critical fuel load, rather than determining if a temperature 
limitation is exceeded, given that the tank ullage is considered 
flammable. This would alleviate the difficulties of working with a high 
number of parameters inherent in the numerous aircraft types and 
conditions (including the effects of pumping, vibration, altitude, fuel 
load, etc.) by considering a generic installation.
    FAA's Response: The FAA does not agree with either commenter. 
Minimizing flammability is the ultimate objective of the rule. We 
considered many options when establishing the regulatory text, and 
determined that a performance-based rule is most appropriate because it 
allows the designer to control fuel tank flammability by using any 
number of methods. It also allows the use of new technology designs 
that may be developed in the future. On the other hand, the commenters' 
proposals focus only on heat balance and heat transfer, rather than 
flammability. Their proposals would not allow the designer the 
flexibility to introduce other means of reducing flammability, other 
than controlling heating/cooling of the tank, such as with nitrogen 
inerting. Further, the commenters' proposals would not significantly 
simplify the compliance demonstration over that of the options 
described in AC 25.981-2X. In light of this, the commenters' proposals 
are not accepted.

Request To Require Retroactive Reduction in Flammability

    One commenter states that the designs of some in-service airplanes 
have shown undesirable characteristics. Because the proposed 
flammability requirements would only affect new airplane type designs, 
this commenter seeks insurance from the FAA that older and current 
designs also will be assessed, and suggests a case-by-case approach.
    FAA's Response: The FAA agrees that some in-service airplanes have 
undesirable levels of fuel tank flammability. To address this issue, we 
tasked the ARAC in 1998 to provide advice and recommendations on 
methods that could eliminate or significantly reduce the exposure of 
transport airplane fuel tanks to flammable vapors. Our review of the 
ARAC report indicates that additional time is needed to perform the in-
depth research and economic evaluations necessary to determine if 
certain technologies that could reduce or eliminate fuel tank 
flammability would be practical for use on the existing fleet of 
transport airplanes. As noted previously, we also are studying concepts 
such as ventilating spaces adjacent to fuel tanks, and recently tasked 
the ARAC to evaluate inerting systems for possible retrofit into the 
existing transport fleet. We will consider initiating additional 
rulemaking if further improvements are found to be effective and 
practicable.

Request To Ban Use of Low Flash Point Fuels

    Several commenters suggest that the use of lower flash point fuels, 
such as JP-4 or Jet B, should be disallowed because these fuels cause a 
much greater exposure to flammable vapors. One commenter notes that 
while it appears that these fuels are no longer commonly used, they may 
still exist as approved alternative fuels for several transport 
aircraft. If any operators routinely use Jet B or JP-4 type fuel, then 
their risk would be much greater than the risk for operators using Jet 
A.
    FAA's Response: The FAA agrees that use of lower flash point fuels 
increases the exposure to operation with flammable fuels in the fuel 
tank. In fact, this rule does require consideration of fuel type. The 
limited use of these fuels on a temporary basis to allow operation from 
remote airports is discussed in AC 25.981-2. The FAA does not agree 
that use of these fuels should be banned for in-service airplanes. Data 
available indicates that these fuels are not routinely used in U.S. 
operations. However, in some cases, airplanes may divert into locations 
where JP-4 fuel is the only fuel available. Use of this fuel on a 
temporary basis allows continuation of the flight without requiring 
tankering of Jet A fuel to a remote alternate airport and the 
associated delays and inconvenience to the flying public. If use of 
lower flash point fuels increases due to market conditions, the FAA 
will consider rulemaking to limit their use.

Request To Require Use of Means To Prevent Fire Within Fuel Tank

    Several commenters request that the FAA revise Sec. 25.981(c)(2) to 
require the use of specific means to address the requirement to 
mitigate the effect of an ignition of fuel vapors within the fuel 
tanks. Some of the commenters' suggestions include flame quenching 
metallic foils and polyurethane foam. These commenters state that such

[[Page 23116]]

technologies as these are available and consider them effective in 
preventing propagation of flame or explosion within the fuel tanks
    FAA's Response: The FAA does not agree that a change to the 
proposed rule is necessary. As stated previously, the final rule is a 
performance-based regulation. As such, it may permit the use of such 
means as those suggested by commenters, but the rule does not require 
the use of any one particular means. AC 25.981-2 provides guidance on 
use of these means.

Discussion of Comments Concerning Cost of the Rule

    The detailed responses and the impacts of the comments on the costs 
of the rule are contained in the Final Regulatory Evaluation, which is 
available in the docket. The quantitative effects of the comments on 
the assumptions and the cost estimates are summarized in the Economic 
Evaluation discussion later in this final rule. The following 
discussion is a more general disposition of the comments concerning the 
cost of the rule.

Number of Airplanes, TC's, and STC's Affected

    One commenter notes that the FAA assumed that a U.S. fleet size of 
6,006 airplanes would be affected by the proposed rule. While this 
number may have been appropriate in 1996, the commenter states that by 
the time the final rule is issued, there likely will be more than 7,000 
affected airplanes.
    Additionally, the commenter notes that the number of affected type 
certificates counted by the FAA did not include the Fokker Model F27 
Mark 50 or the Boeing Model 717. Further, the FAA's listing of fuel 
system STC's was incomplete; for example, there were no fuel tank 
system STC's listed for any Airbus, Fokker, Bombardier, or Aerospatiale 
airplanes.
    Finally, the commenter states that the FAA's cost estimate should 
take into account the worldwide impact that the proposed rule will 
have, as other regulatory authorities adopt identical or similar rules. 
Thus, the true cost of this activity will far exceed the cost 
associated with only the U.S. fleet.
    FAA's Response: The FAA concurs with the commenter that the number 
of airplanes in the U.S. fleet has increased since the data set used in 
the notice was collected. As a result, we now estimate that 7,875 U.S.-
registered airplanes will undergo the fuel tank system inspections 
beginning in the year 2004. The economic analysis has been modified 
accordingly.
    We agree with the commenter that our analysis had not included any 
Fokker Model F27 Mark 50 or Boeing Model 717 airplanes in the fleet. 
The reason was that the fleet data set that we used contained no U.S.-
registered Model F27 Mark 50 airplanes. The more recent data set we 
used for the final regulatory evaluation also contains no U.S.-
registered Model F27 Mark 50 airplanes; thus, those airplanes are not 
included in the analysis. We did not include any Model 717 airplanes 
because that fleet data was based on a 1996 listing when no Model 717 
airplanes had yet been manufactured. The airplane data set that we used 
in the final regulatory evaluation is based on 1999 data and contains 
Model 717 airplanes. We also note that even though the 1999 fleet data 
set reported no U.S. registered Airbus Model A321, A330, or A340 
airplanes, we assumed that these models will enter the U.S. fleet 
eventually and, therefore, the costs to review these fuel tank systems 
were included in the analysis.
    We agree with the commenter that the analysis had not included all 
of the fuel tank system STC's. After further research, we discovered 
one fuel tank system STC for an Airbus airplane model, one fuel tank 
system STC for a Bombardier airplane model, and no fuel tank system 
STC's for Fokker or Aerospatiale airplane models. The economic analysis 
has been adjusted accordingly.
    We do not agree with the commenter regarding consideration of 
worldwide impact of this rulemaking. The FAA is not required to account 
for costs to foreign operators not operating in the U.S. because those 
operators are not subject to these rules.

Cost of Evaluating Non-Fuel System-Related STC's

    One commenter agrees with the FAA that only a small number of non-
fuel-system STC's will require a system assessment. However, the 
commenter asserts that the FAA's analysis does not account for the 
significant effort and associated cost that would be required to 
determine whether or not these non-fuel system-related STC's affect the 
fuel system and thus merit further attention. Such a determination 
would be required under the proposed SFAR requirements.
    FAA's Response: The FAA agrees that the costs to determine which 
STC's affect the fuel tank system should be included in the economic 
analysis. However, we have determined that 90 percent of the non-fuel 
tank system STC's will need only a minimal degree of engineering effort 
(with a resultant minimal cost) for a qualitative evaluation of their 
effects on the fuel tank system. We also have determined that 325 non-
fuel tank system STC holders will each need to conduct a more detailed 
engineering review that will involve an average of 75 hours of 
engineering time. The economic analysis has been revised accordingly.

Cost of Use of Proprietary Data

    One commenter raises concerns regarding the costs associated with 
STC holders obtaining data from the type approval holder. The commenter 
points out that, in the ``Regulatory Evaluation'' section of the 
notice, the FAA stated:

    Many STC holders would be able to incorporate a large portion of 
a TC holder's fuel tank system assessment into its assessment.

    The commenter states that, in practice, the release of such 
proprietary information to a third party would need to occur under a 
technical assistance contract. Therefore, the cost of this transaction 
should be added to the FAA's cost analysis.
    FAA's Response: The FAA disagrees with this commenter. While a 
technical assistance contract may be needed to obtain this information, 
the overall cost to the aviation industry is not affected because the 
payment to the data holder will offset some of the engineering costs 
associated with the fuel tank system design review. As a result, the 
overall cost of the rule is not affected by these contracts, although 
the distribution of a part of these costs will shift from certain TC 
holders to certain STC holders.

Cost of Fuel Tank System Safety Review Required by SFAR

    One commenter disagrees with the FAA's estimate of $14.4 million 
for the costs of completing the fuel tank system reviews required by 
the proposed SFAR. The commenter points out that the FAA estimated that 
the review would require 0.5 to 2 engineering years per airplane model. 
However, the commenter calculates the actual level of effort required 
will be more like 2 to 4 engineering years for each major model. Minor 
model variation will add additional effort that is difficult to 
quantify, but could easily increase the total effort by 30 to 50 
percent. In addition, the commenter states that systems do evolve with 
time, leading to additional permutations that must be considered.
    In light of this, the commenter believes that the basic safety 
reviews will require two to three times more effort and cost than 
identified by the FAA. Accordingly, the cost of the basic design review 
may be in the range of

[[Page 23117]]

$28 million to $52 million, plus an additional $14 million to account 
for the variations within models.
    FAA's Response: The FAA agrees that the number of engineering hours 
to review the fuel tank systems should be increased but disagrees about 
the amount of the increase. As discussed later in more detail in the 
Economic Evaluation section of this preamble, we determined that there 
were two types of fuel tank system reviews:
     The first, which is referred to as the ``full-scale'' 
review, is the first fuel tank review done for a model that has several 
series.
     The second, which is referred to as the ``derivative'' 
review, are the reviews of the other series in that model.
    Using the Boeing Model 737-300/-400/-500 as an example, we 
determined that this model will involve one ``full-scale'' review and 
two ``derivative'' reviews. In addition, the fuel tank system reviews 
performed for all ``extended range'' series and freighter series are 
evaluated as ``derivative'' reviews. On that basis, we determined that, 
depending upon the model, it will take 6 months to 4 years of 
engineering time to perform a ``full-scale'' fuel tank system review. 
The FAA also determined that it will take 6 months to 1 year of 
engineering time to perform a ``derivative'' fuel tank system review. 
(See the commonality of design discussion presented earlier in this 
preamble for an engineering explanation why the review of a model's 
series after the first review will take less time than the first 
review.)
    The FAA agrees that the number of fuel tank system reviews needs to 
be increased, but disagrees about the extent of the increase. The FAA 
determined that the rule will require 46 ``full-scale'' reviews and 52 
``derivative'' reviews. The impact on the total cost of these reviews 
is provided in the Economic Evaluation section of this preamble.

Cost of Safety Review of Older Type Designs

    One commenter, Lockheed Martin, considers that the FAA clearly 
underestimated the costs to conduct the safety review required under 
the new SFAR on older airplanes, such as the Lockheed Model L-188 
Electra. The commenter notes that the FAA's economic analysis of the 
cost of the design review proposed in the notice is based on a fleet-
wide consideration. This approach results in a per-aircraft-cost basis 
that does not appear unreasonable. However, the expense to perform the 
design reviews and prepare service documents will be the same for 
Lockheed as for other manufacturers that have twenty or thirty 
operators and hundreds of operating aircraft. (They commenter reports 
that there are only 13 Model L-188 Electras currently operating in the 
U.S.)
    The commenter requests that the FAA take into consideration the 
following information when finalizing the economic analysis of the 
proposed rule:
    1. The FAA's cost benefit analysis identifies an engineering effort 
to perform the SFAR safety review and preparation of documents as 
taking from three-quarters to three person years to perform. However, 
because the Model L-188 Electra was certified prior to the issuance of 
Sec. 25.901 and Sec. 25.1309, the SFAR safety review will require all 
new analysis and possibly testing to prove that the design meets the 
requirement for all operating conditions. The effort to do this will 
likely exceed the maximum FAA estimate of three person years.
    2. Then, the time to familiarize a new staff with the design, to 
locate pertinent files, to relate those files to the long history of 
the aircraft, and to develop test and compliance documents for new 
regulations are time-consuming tasks that will add significant time and 
costs to the FAA's estimates.
    3. If the analysis shows that the design does not meet the newly 
imposed requirements, redesign will be necessary. Such redesign would 
increase the expense by a factor of 3 to 5, depending on the detail. It 
would also increase considerably the expense to the operator of 
installing the new design.
    FAA's Response: The FAA agrees that additional time and costs will 
be required to review the designs on some airplane types where design 
information is not readily available. However, the FAA does not agree 
that all of the work identified by the commenter is necessarily 
required. As discussed previously in this preamble, the FAA extended 
the compliance time for conducting the actions required by the SFAR, 
which addresses the commenter's concern about the needed time. Further, 
the FAA increased the number of engineering years to complete a Model 
L-188 fuel tank system design review to 4 years. Additionally, as noted 
in the earlier disposition of the comment relating to the applicability 
of the SFAR, the FAA will consider the merits of exemptions to the 
requirements of the SFAR based upon the number of airplanes in service 
and the safety benefits that could be achieved by a safety review.

Cost of Safety Review of STC's on Older Airplanes

    While commenters generally agree that the design review should 
apply to STC's and field modifications, several commenters express 
concern that the design review will be difficult to conduct on older 
airplanes. In particular, reviewing non-fuel tank related STC's and 
field approvals could be unmanageable for airplanes with a long service 
life and with multiple owners. The commenters note that the FAA did not 
make any accounting in the notice for the cost of addressing these 
modifications.
    One commenter proposes an alternative approach: A one-time 
inspection to determine the configuration of the airplane and to verify 
that wiring entering the fuel tank, and systems capable of generating 
auto-ignition temperature into fuel tank structure, have not been 
compromised by STC modifications. The commenter asserts that such an 
inspection would require about 50 to 100 labor hours to perform. The 
resultant inspection labor costs alone could amount to $28 million to 
$52 million, depending upon the number of airplanes to be inspected 
(for example, 7,000 airplanes  x  100 hours per airplane  x  $70 per 
labor-hour). This estimate does not include the cost of the downtime 
(and resultant revenue loss) required to accomplish such an inspection; 
yet the proposed compliance time of 12 months would require airplanes 
to be pulled from revenue service for special inspection. In the 
notice, the FAA had estimated that an annual increase in out-of-service 
time of 11.5 hours to 32 hours would occur, depending upon the model, 
and that this would result in lost net revenues of $6.4 million for a 
12-month period. The commenter maintains that the one-time inspection 
alternative would also require this much downtime.
    FAA's Response: The FAA agrees that the costs associated with 
reviewing non-fuel tank-related STC's and field approvals needs to be 
addressed. However, we disagree with the commenter as to the direction 
and magnitude of the effort that will be needed to evaluate these 
factors. Specifically, we agree that a ``paper review'' of the 
airplane's service history will be needed for compliance. We disagree 
that this review will necessitate an airplane inspection that is 
separate from the initial fuel tank system inspection and that the 
labor hours for any such airplane inspection have been included in the 
labor hours to complete the initial fuel tank inspection. We agree that 
the amount of effort to complete

[[Page 23118]]

this ``paper review'' will vary across individual airplanes. Airplanes 
that have been in near-continuous operation by major, national, and 
regional airlines (the majority of the airplanes affected by the rule) 
should possess well-documented service history records such that those 
operators will need a minimal amount of time to complete the paper 
reviews for those airplanes. However, we realize that there will be 
smaller operators that will spend more time to trace their airplanes' 
service histories--particularly if the airplane has had multiple 
operators and owners. As a result, we have determined that it will take 
an average of one engineering day (a cost of $880 per airplane) for an 
operator to complete this paper review for every airplane.

Cost of Design Changes

    Several commenters raise concerns about accounting for the costs of 
new design changes that could be required under the proposed SFAR 
requirements. One commenter representing manufacturers and operators 
agrees, in general, that any design changes resulting from the safety 
review should be handled outside the scope of the SFAR. However, there 
would be additional costs associated with developing the necessary 
design changes identified by the SFAR safety reviews. The commenter 
points out that, in the notice, the FAA stated:

    * * * the design review may identify conditions that would be 
addressed by specific service bulletins or unsafe conditions that 
would result in FAA issuance of an airworthiness directive (AD). 
However, those future costs would be the result of compliance with 
the service bulletin or the AD and are not costs of compliance with 
the proposed rulemaking. Those costs would be estimated for each 
individual AD, when proposed.

    This commenter does not consider it appropriate for the FAA to 
assert that none of these costs are attributable to the proposed 
rulemaking. In those instances where new rules are created that go 
beyond existing rules--essentially raising the current level of 
safety--the cost of any design change driven by these new rules should 
be considered as part of the total cost of the rule.
    The commenter points to Sec. 25.981(a)(3) as such a rule that 
proposes new, more-stringent requirements associated with evaluating 
the effects of latent failures. Should compliance with this specific 
rule require design changes broadly across the fleet, the costs would 
be substantial. For example, if this rule were to affect half the U.S. 
fleet (about 3,500 airplanes), and new design change costs averaged 
$40,000 per airplane, the total cost would be $140 million.
    The commenter acknowledges that it is not possible to predict what 
effect the proposed rule would actually have on the fleet, but the 
potential obviously exists for costs that range between $100 million 
and $200 million, or more.
    FAA's Response: The FAA disagrees that the cost of new design 
change requirements should be included in the cost analysis for this 
rule. As discussed in the notice, new design change requirements will 
be implemented through the AD process, during which the FAA will fully 
analyze the costs and the public will have an opportunity to comment on 
the FAA's estimates.

Cost of Developing Maintenance and Inspection Instructions

    One commenter disagrees with the FAA's assumption that the 
development of maintenance and inspection instructions would simply be 
part of the required SFAR safety review. On the contrary, this 
commenter states that this work, in fact, must be done after completion 
of the safety review. However, the commenter states that, if one 
assumes that this effort represents 20 to 30 percent of the effort 
associated with the basic safety review, then the cost could be on the 
order of $10 million.
    FAA's Response: The FAA partially disagrees that the costs of 
developing the maintenance instructions were not included in the cost 
analysis of the rule. The estimated labor hours required for the design 
review specifically included an estimate of 0.15 year to one year of 
engineering time for the TC holders, and 0.1 year to 0.25 year for the 
fuel tank system STC holders, to develop the inspection and maintenance 
recommendations. Further, we had assumed that the design approval 
holder recommendations would have been completed after the fuel tank 
system review. Nevertheless, as the proposed compliance time was 1 
year, the fact that developing the recommendations after completing the 
fuel tank system review had no effect on the present value of the 
estimated costs because all of the expenditures would have occurred in 
the first year. This is not the case for the 18-month compliance time 
provided in the final rule. We have determined that all of the 
engineering costs to develop the recommendations will occur during the 
second year after the effective date of the rule. We have included 
those costs in the final economic analysis.

Cost To Comply With the SFAR

    One commenter asserts that the combined cost of the safety review 
and development of instructions may well be $180 to $330 million, 
rather than the $16 million estimated by the FAA.
    FAA's Response: The FAA disagrees with the underlying assumptions 
made by the commenter to develop this estimate. The commenter's first 
assumption is that $100 million to $200 million of these costs are 
based on the commenter's argument that, ``Should compliance with this 
specific rule require design changes broadly across the fleet, the 
costs would be substantial. For example, if [emphasis FAA] this rule 
were to impact half the U.S. fleet (about 3,500 airplanes) and 
modification costs averaged $40,000 per airplane, the total cost would 
be $140 million. It is not possible to predict what effect this new 
rule would actually have on the fleet, but the potential obviously 
exists for costs that range between $100 million and $200 million, or 
more.'' [The commenter is referring to the requirements of 
Sec. 25.981(a)(3) of the rule, which involve evaluating the effects of 
latent failures.]
    This argument assumes that the cost of the potential future AD's 
should be attributed to this rule. As stated earlier, we maintain that 
the cost of complying with potential future AD's is attributed 
specifically to those individual AD's when they are issued. As a 
result, we have determined that there are no compliance costs 
attributable to this rule for any future design changes that will be 
accomplished through an AD.
    The commenter's second assumption is that the fuel tank system 
review costs will be two to three times the $16 million estimated by 
the FAA, plus there will be an additional $14 million to review the 
fuel tanks for the variations within models. As noted earlier, we 
disagree with the amount of engineering time assumed by the commenter, 
as well as the number of fuel tank reviews that will be performed. We 
have recalculated the estimated compliance cost and determined that it 
will be about $30 million.
    Finally, the commenter assumes that each airplane will need a one-
time inspection to verify that previous airplane modifications have not 
compromised the wiring entering the fuel tank and entering the systems 
capable of generating autoignition temperatures into fuel tank 
structure. The commenter estimates this will cost $28 million to $52 
million for labor, and $6.4 million for lost net revenue due to out-of-
service time. As noted earlier, we

[[Page 23119]]

agree that an individual airplane review will be needed, but we 
disagree in that the labor hours have been included as part of the 
labor hours to perform the initial fuel tank system inspection. We 
have, however, calculated a $5.5 million cost for a ``paper review'' of 
every airplane's service history.
    Based on these figures, we conclude that the costs to comply with 
the SFAR will be $35.5 million. (More details concerning these costs 
are explained later in this preamble.)

Cost of Operating Rule Changes

    One commenter agrees with the statement in the notice that read:

    The FAA intends that any additional fuel tank system inspection 
and maintenance actions resulting from the SFAR review would occur 
during an airplane's regularly scheduled major maintenance checks. 
From a safety standpoint, repeated entry increases the risk of 
damage to the airplane. Thus, the proposal would not require air 
carriers to alter their maintenance schedules, and the FAA 
anticipates that few or no airplanes would be taken out of service 
solely to comply with the proposal unless an immediate safety 
concern is identified.

    This commenter strongly recommends that the FAA ensure that the 
final rule does not penalize the industry by requiring inspection 
intervals more frequent than truly necessary, or lead to unnecessary 
hard-timing of (placing life-limits on) components.
    FAA's Response: The FAA responds to this commenter by reiterating 
that the intent is to have the maintenance and inspections generated by 
this rule be developed so that the tasks can be performed during 
regularly scheduled maintenance.

Cost of Inspections

    One commenter disagrees with the number of hours that the FAA 
estimated would be required to conduct the added inspections required 
by the rule. The commenter calculates that the metric will be 300 to 
500 labor hours per airplane every 9 to 11 years, plus any parts 
replacement costs yet to be defined by the manufacturer.
    Another commenter suggests that the cost analysis needs to be 
adjusted to address in-tank inspections. The commenter asserts that the 
FAA assumes that much of the in-tank inspection work will be 
accomplished during heavy maintenance checks when the tanks are open 
and purged. However, for some aircraft, the tanks are opened only once 
every eight years for scheduled maintenance. Therefore, if in-tank 
inspections are mandated, some aircraft will have to be removed from 
scheduled service and the costs associated with this should be 
considered in the rule. Also, the costs of preparing tanks for entry 
should be considered.
    FAA's Response: The FAA agrees with the first commenter. Assuming 
the commenter's airplanes were manufactured between 1960 and 1980, we 
calculated that the initial fuel tank system inspection, plus the two 
reinspections that will occur during a 12-year period, will result in a 
total number of 330 labor hours per airplane.
    We disagree with the second commenter. The commenter states that 60 
percent of the initial fuel tank system inspections will be performed 
during a ``C'' check , which will require that the fuel tank be opened, 
drained, and vented. We included these costs in the number of labor 
hours for the initial inspection, which are twice the number of labor 
hours for the later reinspections that will be performed during ``D'' 
checks. Further, we included a value for the lost net revenue to the 
aviation system as a result of the additional number of out-of-service 
days (from one to three days) for the initial fuel tank system 
inspections performed during the ``C'' check.

Cost of Complying With New Method of Addressing Latent Failures

    One commenter states that the new treatment of latent failures (to 
maintain the probability of occurrence of a given latent failure to 
less than 1 x 10-\7\), as would be required by 
Sec. 25.981(a)(3), will lead to enormous costs with no attendant 
benefit. As an example, a component with a latent failure rate of 1  x  
10-\9\ per flight-hour would have to be inspected (or hard-
timed) every 100 hours (or 200 hours, if an average exposure time is 
assumed to be T/2) to keep the probability of failure under 
1 x 10-\7\. A component failure rate of 
1 x 10-\8\ per flight-hour would require inspection every 
day (10 hours). The commenter asserts that the benefit derived from 
performing such inspections or hard-timing is nil, and the implications 
of such a rule are self-evident.
    Further, this commenter points out that the FAA's cost estimate for 
the operational rule changes is $154 million over 10 years, and that is 
based upon the assumption that the required maintenance and inspection 
programs will coincide with an airplane's regularly scheduled major 
maintenance checks. However, the commenter states that the situation 
described above would result in numerous inspections that would not 
align with these regularly scheduled checks. In addition, it could lead 
to widespread hard-timing of components (e.g., pumps). The commenter 
notes that the FAA did not consider either of these possibilities in 
the cost analysis; however, the magnitude of the cost impact could 
extend into the billions of dollars.
    FAA's Response: The FAA does not concur. The conclusion of this 
commenter that the costs of compliance with Sec. 25.981(a)(3) ``could 
extend into the billions of dollars'' is based upon an assumption 
concerning the impact of the requirement. The example provided by the 
commenter, which assumes that the requirement limits the probability of 
latent failure to less than 1 x 10-\7\, indicates a 
misinterpretation of the requirement. The rule does not allow a single 
failure to hazard the airplane, regardless of the probability of its 
occurrence. The FAA expects that designs that have single failures that 
can result in an ignition source will be modified to include fail-safe 
features. Modifications may also be necessary to address combinations 
of failures. If a fuel tank system is designed such that the safety 
level is heavily dominated by one of the components or features in the 
combinations of failures, then added inspections, hard-timing, or 
installation of annunciation features to eliminate latency are exactly 
what was intended by the regulation. The need for inspections and hard-
timing can be limited by providing redundancy and fail-safe features 
and/or by eliminating latency. Therefore, inspection or replacement of 
components at the rate noted by the commenter would not be required.
    The FAA position is supported by another commenter who provided 
information regarding transient suppression units (TSU) developed for 
the Boeing Model 737 and 747 airplanes. The commenter states, ``The TSU 
eliminates the need to inspect harnesses, probe terminations, etc. The 
TSU itself would be subject to periodic (25,000 hours) inspections.'' 
It should be noted that heavy maintenance checks typically occur on 
transport airplane models prior to accumulating 25,000 hours time in 
service; therefore, the cost of inspections for the TSU units would be 
low.
    The speculation by the commenter that ``the magnitude of the cost 
impact could extend into the billions of dollars'' is based on a 
misunderstanding of the final rule and, therefore, was not considered 
in the final economic analysis.

Costs of New Modifications

    One commenter expresses concern that the cost analysis is ``greatly 
flawed'' because it did not consider all the costs

[[Page 23120]]

that will result from the requirements of the SFAR, such as high cost 
items like aircraft modifications and ``hard timing'' of components. 
The cost analysis takes credit for the benefits that will result from 
these modifications; however, the commenter considers that the costs 
should be included as well.
    As an example of the potential costs of modifications, this 
commenter provided the following specific information concerning how 
the proposal would affect its fleet of airplanes: The commenter owns 
approximately 160 Boeing Model 727 airplanes. As a result of the 
proposed SFAR safety review, some of the modifications that might be 
mandated for these airplanes are:
     Replacement of the analog FQIS with a digital FQIS;
     Installation of current suppression devices;
     Installation of flame arrestors; and
     Possibly, replacement of fuel boost pumps.
    The cost of these modifications alone, based on data received from 
the equipment manufacturers, is approximately $125,000 per airplane. 
Since some of the commenter's airplanes already have a FQIS installed, 
the cost to modify the commenter's fleet would be approximately 
$17,000,000. This figure does not include other modifications that 
might be mandated for the airplanes. The commenter points out that this 
is the modification cost for only one aircraft type for one airline. If 
all costs for all U.S. registered aircraft were to be included, the 
result would be far greater than the total indicated in FAA's cost 
analysis presented in the notice.
    FAA's Response: The FAA does not agree that the cost analysis 
concerning possible modifications was flawed. Section 25.901(b)(2) 
requires that the ``Components of the installation must be constructed, 
arranged and installed so as to ensure their continued safe operation 
between normal inspections and or overhauls.'' As stated in the notice, 
``Typical transport category airplane fuel tank systems are designed 
with redundancy and fault indications features such that single 
component failures do not result in any significant reduction in 
safety. Therefore, fuel tank systems historically have not had any 
life-limited components or specific detailed inspection requirements 
unless mandated by AD.'' We agree that some past design practices have 
been deficient and that adding the specific requirement in 
Sec. 25.981(a)(3) to address latent failures may require new design 
features for existing airplanes. We also agree with the commenter that 
modifications to the FQIS and/or any other wiring entering the fuel 
tank system may be required (such as separation and shielding of FQIS 
wiring or, for older airplanes, installation of transient suppression 
devices). We do not agree that the rule would mandate replacement of 
analog FQIS with digital systems, although this may be one method used 
on certain portions of the fleet. However, because correcting those 
design deficiencies will be accomplished through the AD process, those 
compliance costs will be estimated when the relevant AD is proposed.
    The SFAR does not require installation of flame arrestors in fuel 
tank vents. We have initiated tasking an ARAC group to provide 
recommendations addressing both a part 25 amendment and retroactive 
operational requirement for installation of flame arrestors in fuel 
tank vent outlets. If any rulemaking is subsequently proposed based on 
the recommendations, the FAA will conduct separate economic analyses 
for those proposals.

Cost of Changes to Part 25 on Future Designs

    One commenter disagrees with the FAA's cost analysis regarding the 
affects of changes to part 25 requiring ``minimizing flammability.'' 
This commenter points to a statement in the notice that read:

    The FAA anticipates that the proposed part 25 change would have 
minimal effect on the cost of future type certificated airplanes 
because compliance with the proposed change would be done during the 
design phase of the airplane model before any new airplanes would be 
manufactured.

    The commenter considers that the FAA's assumption is incorrect. 
Proposed Sec. 25.981(c)(1) would require that the fuel tank 
installation include ``a means to minimize the development of flammable 
vapors in the fuel tanks.'' Moreover, the FAA states that it intends 
that the body tanks ``cool at a rate equivalent to that of a wing 
tank.''
    The commenter asserts that, based on this requirement, the cost 
impact to future airplane designs could be substantial. As an example, 
the commenter presents a preliminary cost assessment of a directed 
ventilation system, below. The commenter derived the cost estimates 
from a report prepared by an ARAC working group (Fuel Tank 
Harmonization Working Group). These fuel tank cooling cost estimates 
are divided into the categories indicated. The analysis considers the 
costs associated with small, medium, and large airplane designs. (It 
should be noted that directed ventilation systems of the type evaluated 
would not cool a center wing tank at a rate equivalent to that of a 
wing tank.)

1. Development costs per airplane design = $2.8 million.
2. Installation costs per production airplane = $21,200.
3. Additional airplane operational costs per airplane per year:
     Small airplane = $30,408.
     Medium airplane = $39,295.
     Large airplane = $50,518.

    Using these numbers, a simple calculation may be performed to 
estimate the recurring costs associated with such a system over a 10-
year period. These costs would consist of the installation costs per 
production airplane and the additional operational costs per airplane 
per year, applied to a fleet of a new airplane design with an assumed 
production rate. The following table presents the results of this 
simple estimate for a 10-year period (ignoring inflation, cost of 
capital, and so on):

----------------------------------------------------------------------------------------------------------------
                                                   Annual                         Operational
                    Size                      production rate  Production cost        cost          Total cost
----------------------------------------------------------------------------------------------------------------
Small.......................................              180      $38,160,000     $301,039,200     $339,199,200
Medium......................................               72       15,264,000      155,608,200      170,872,200
Large.......................................               60       15,264,000      129,673,500      144,937,500
----------------------------------------------------------------------------------------------------------------

    Although the above example is simplistic in nature, the commenter 
maintains that the conclusion may be drawn that the overall potential 
costs are indeed substantial, even if the initial developmental costs 
are not.
    FAA's Response: The FAA disagrees with the commenter. The 
requirements of the final rule should result in very little increased 
production costs. Certain airplane models in production today locate 
sources of heat away from the

[[Page 23121]]

center wing fuel tanks. Other models locate the air conditioning packs 
below the center wing fuel tank, but incorporate air gaps that are 
ventilated such that heat transfer into the center wing tank is 
significantly reduced. Other airplane models incorporate directed 
ventilation means for areas below the heated center wing tanks.
    The FAA does not agree with the cost assessment provided by the 
commenter. The cost estimate referenced by the commenter is stated to 
apply to ``present airplane designs.'' It assumes that the 
environmental control system (ECS) packs will be located adjacent to 
the center wing tank, and that heat shields and ventilation air would 
be used to remove heat from the center wing fuel tank. This approach 
results in added weight and drag penalties. New designs allow the 
designer numerous options to achieve an optimized design. Air 
conditioning equipment can, and has been, located away from fuel tanks. 
Cooling air is available from the ECS system, ground sources and 
outside air in flight. Incorporation of these features in the initial 
design would result in little added cost over that of features noted in 
the preceding paragraph on many airplane designs.
    The ARAC report, from which the commenter has gathered data for its 
cost estimates, includes a discussion to ``locate significant heat 
sources away from fuel tanks.'' The report states that, ``* * * 
quantifying the impact of this method would only be possible for 
specific new designs,'' and the report provides little data regarding 
the costs for locating packs away from fuel tanks. We agree with the 
commenter that cooling air may be needed to meet the requirements of 
this regulation and this can result in additional operating costs 
during certain flight operations. However, these costs are airplane 
model design-specific and could not be estimated without input from the 
industry. Nevertheless, in the absence of specific industry design and 
cost data, we maintain that these additional operating costs will be 
minimal. Further, these costs will occur on airplanes that will be 
manufactured many years in the future and, as a result, the present 
value of those operating costs will be even less.

Paperwork Reduction Act

    There are no new requirements for information collection associated 
with this amendment that would require approval from the Office of 
Management and Budget pursuant to the Paperwork Reduction Act of 1995 
(44 U.S.C. 3507(d)).

International Compatibility

    In keeping with U.S. obligations under the Convention on 
International Civil Aviation, it is FAA policy to comply with 
International Civil Aviation Organization (ICAO) Standards and 
Recommended Practices to the maximum extent practicable. The FAA 
determined that there are no ICAO Standards and Recommended Practices 
that correspond to these regulations.

Economic Evaluation, Regulatory Flexibility Determination, Trade Impact 
Assessment, and Unfunded Mandates Assessment

    Changes to Federal regulations must undergo several economic 
analyses. First, Executive Order 12866 directs each Federal agency to 
propose or adopt a regulation only if the agency makes a reasoned 
determination that the benefits of the intended regulation justify its 
costs. Second, the Regulatory Flexibility Act of 1980 requires agencies 
to analyze the economic impact of regulatory changes on small entities. 
Third, the Trade Agreements Act (19 U.S.C. section 2531-2533) prohibits 
agencies from setting standards that create unnecessary obstacles to 
the foreign commerce of the United States. In developing U.S. 
standards, this Trade Act requires agencies to consider international 
standards. Where appropriate, agencies are directed to use those 
international standards as the basis of U.S. standards. Fourth, the 
Unfunded Mandates Reform Act of 1995 requires agencies to prepare a 
written assessment of the costs, benefits, and other effects of 
proposed or final rules. This requirement applies only to rules that 
include a Federal mandate on State, local, or tribal governments, 
likely to result in a total expenditure of $100 million or more in any 
one year (adjusted for inflation).
    In conducting these analyses, the FAA has determined that this 
rule: (1) Has benefits which justify its costs and is a ``significant 
regulatory action;'' (2) will have a significant impact on a 
substantial number of small entities; (3) has minimal effects on 
international trade; and (4) does not impose an unfunded mandate on 
state, local or tribal governments or the private sector. The FAA has 
placed these analyses in the docket and summarizes them as follows.

Data Sources

     The principal data sources used for this analysis are:
     The public comments submitted to the notice for this 
rulemaking action;
     The World Jet Inventory at Year-End 1999;
     Back Aviation Solutions (Fleet PC, Version 4.0);
     Information from service bulletins; and
     FAA discussions with industry engineers.
Affected Airplanes and Aviation Sectors
    In the notice, the FAA, using 1996 data, estimated that the 
proposal would have affected 6,006 airplanes. Of this number:
     5,700 airplanes were operated by 114 air carriers under 
part 121 service,
     193 airplanes were operated by 7 carriers that operated 
under both part 121 and part 135,
     22 airplanes were operated by 10 carriers under part 125 
service, and
     91 airplanes were operated by 23 carriers operating U.S.-
registered airplanes under part 129.
    At that time, the FAA did not have information on airplanes 
operating under part 91 that would have been affected by the proposal; 
however, the FAA had stated its belief that very few airplanes 
operating under part 91 would have been affected by the proposal.
    The FAA also estimated that the proposed rule would have affected:
     12 manufacturers holding 35 part 25 type certificates 
(TC's);
     26 manufacturers, airlines, and repair stations holding 
168 supplemental type certificates (STC's) for part 25 fuel tank 
systems, of which 69 were for different modifications;
     Manufacturers of future, new part 25 type certificated 
airplane models; and
     Holders of future, new part 25 STC's for new fuel tank 
systems.
    At that time, the FAA was unable to predict the number of new 
airplane TC's but, based on the average of the previous 10 years, the 
FAA had anticipated that 17 new fuel tank system STC's would be granted 
annually. The FAA had requested comments on these estimates.
    In order to update the aviation industry data, the FAA used a 
different database for this final rule from what it used for the 
analysis of the proposed rule. However, as this more current database 
does not report the same information as that reported in the previous 
database, an exact comparison between the two databases is not 
possible. Consequently, using 1999 data, the FAA determined that the 
final rule affects 6,971 airplanes, of which 6,252 are turbojets and 
719 are turboprops. Of these 6,971 airplanes:
     6,485 (5,802 turbojets and 683 turboprops) are operated by 
143 scheduled and non-scheduled air carriers,

[[Page 23122]]

     117 are operated by 76 private operators (primarily 
corporations), and
     369 are currently held by 112 manufacturers and brokers 
and leasing companies.
    The FAA also determined that the final rule affects:
     13 manufacturers holding 37 part 25 type certificates 
(TC's);
     46 manufacturers, airlines, and repair stations holding 
173 supplemental type certificates (STC's) for part 25 fuel tank 
systems, of which 79 are for different fuel tank system modifications;
     325 non-fuel tank system STC holders that will need to 
evaluate their STC's to determine their impacts on fuel tank systems;
     Manufacturers of future, new part 25 type certificated 
airplane models; and
     Holders of future, new part 25 STC's for new fuel tank 
systems.
    Based on the previous 10 years, the FAA projects that there will be 
between two and four new part 25 TC airplane models during the next 10 
years. Using the same methodology, the FAA projects that there will be 
three to four new fuel tank system STC's annually granted during the 
next 10 years.
Benefits
    In the notice, the FAA had assumed that the potential U.S. fuel 
tank explosion rate due to an unknown internal fuel tank ignition was 
the same as that rate for the worldwide fleet over the years 1989 
through 1998. On that basis, the FAA had estimated that, if no 
preventative actions were to be taken, then between one and two (the 
statistically expected value was 1.25) fuel tank explosions would be 
projected to occur during the next 10 years (2000 through 2009) in U.S. 
operations. The FAA also determined that the probability that such an 
accident would have occurred prior to 2006 was equal to the probability 
that it would have occurred after 2006.
    In order to quantify the potential benefits from preventing a 
``representative'' commercial aviation mid-air explosion, the FAA had 
used:
     A value of $2.7 million to prevent a fatality,
     An average of 130 passengers and crew on a commercial 
flight,
     A value of $20 million for a destroyed airplane, and
     A cost of $30 million for an investigation of a mid-air 
explosion accident.
    Thus, a total loss would be $401 million.
    In the notice, the FAA had assumed that compliance with the 
proposal would prevent between 75 percent and 90 percent of the future 
fuel tank explosions. The basis for this prevention is derived 
primarily from the incorporation of design changes to enhance fail-safe 
features of design and enhanced fuel tank system inspections that will 
discover conditions that could result in an ignition source before 
ignition of flammable fuel vapors could occur. The fuel tank system 
review, by itself, will have little direct effect on preventing these 
future accidents, unless it uncovers an immediately hazardous condition 
that results in an AD being issued. As stated earlier, the FAA has 
initiated 40 AD's to address unsafe fuel tank system features on 
numerous airplane types within the current fleet. While the FAA expects 
these actions will significantly improve safety, an in-depth analysis 
of all airplane models required by this rule has not been completed and 
it would be difficult to predict the overall effect on the accident 
rate. Therefore, the cost/benefit analysis assumes that the accident 
rate for fuel tank explosions will remain constant until the reviews 
are complete.
    With the proposed 18-month compliance time, the FAA estimated the 
benefits based on these inspections starting in 2001. The resulting 
probability analysis indicated that the first such accident would occur 
in 2006 and the second accident (if a second one would occur) in 2009. 
On that basis, the estimated present value of the expected benefits 
discounted over 10 years to 1999 at 7 percent would have been:
     $260 million for one prevented accident and
     $520 million for two prevented accidents.
    For the final rule, the FAA revised these earlier estimates to 
include the effect that lengthening the compliance time from 18 months 
to 36 months has on the potential benefits. As a result, the 3-year 
compliance time indicates that, with the exception noted in the 
previous paragraph, the first benefits from improved fuel tank system 
inspections will not occur until 2004.
    The FAA also revised the earlier estimates to substitute more 
current fleet and operations data into the calculations. The FAA also 
noted that 2 years without a mid-air explosion have passed since the 
analysis of the proposal, which makes the years 1989 through 2000 
(rather than 1989 through 1998) the appropriate timeframe for 
calculating the historical accident rate. On that basis, the FAA 
calculated that, if no preventative actions were taken, between one and 
two (the expected value is 1.09) fuel tank explosions would be expected 
to occur during the 10-year time period of 2004 through 2013. Further, 
the FAA determined that the probability that the first accident would 
occur on or before the year 2008 is the same as the probability that it 
would occur after 2008.
    Thus, based on a loss of $401 million for a ``representative'' 
accident, the FAA calculated that the present values of the losses from 
future mid-air explosions that would occur between 2004 and 2013 are:
     $233.7 million for one prevented accident and
     $400.4 million for two prevented accidents

(The statistically expected value is $248.9 million for the 1.09 
accidents.)
    For this final rule analysis, the FAA reviewed the public comments 
and its previous analysis for the notice, and determined that the data 
are insufficient to permit a credible estimate of the percentage of 
future mid-air explosion accidents that the final rule would prevent. 
The uncertainty of the causes of the two accidents and the uncertainty 
of the effects of the 40 AD's on preventing future explosions does not 
allow a quantitative estimate of the potential effectiveness of the 
final rule. Thus, although the FAA believes that the rule will 
significantly reduce the risk of a future accident, the FAA does not 
calculate quantified benefits resulting from the final rule.
Sources of Compliance Costs for the Proposal and the Final Rule
    The costs to comply with the SFAR derive from the engineering time 
to comprehensively review fuel tank system designs by the design 
approval holders (i.e., part 25 TC holders, part 25 fuel tank system 
STC holders, and certain part 25 non-fuel tank system STC holders). 
There also are costs to operators that derive from the engineering time 
to conduct the design review for any field approvals on their airplanes 
and to develop any necessary fuel tank system inspections and 
maintenance recommendations for operators and repair stations.
    These reviews may also identify conditions that will subsequently 
need to be addressed by specific service bulletins, or unsafe 
conditions that would subsequently require the FAA to issue AD's. 
However, those future costs are not the costs of compliance with this 
SFAR; rather, they are costs to conform to the service bulletin or to 
comply with the AD, and would be estimated for each individual service 
bulletin or AD when it is issued or proposed.
    The costs to comply with the operational rule changes of this final

[[Page 23123]]

rule derive from the requirements that operators incorporate these 
recommendations into their maintenance manuals and then inspect and 
maintain the fuel tank systems accordingly. As a result, additional 
airplane mechanic labor time will be needed during an airplane 
inspection to perform an enhanced inspection of the fuel tank system 
and components. However, the costs to repair and replace equipment and 
wiring that the inspection identifies as needing repair or replacement 
is not a cost of compliance with the operational rules changes. 
Although these costs can be substantial, they are attributable to 
existing FAA regulations that require such repairs and replacements to 
be made in order to assure the airplane's continued airworthiness.
    Finally, the part 25 revisions of this final rule may require some 
future TC and STC's to employ designs of fuel tank systems and other 
aviation systems that would not have been used were it not for these 
revised certification requirements.
Estimated Total Compliance Costs for the Proposal
    As seen in Table 1, the FAA had estimated in the notice that the 
present value in 1999 of the compliance costs with the proposal during 
the time period 2000-2011 would have been about $170 million ($9.5 
million for TC holders, $4.9 million for STC holders, and $153 million 
for operators). The following sections briefly summarize the 
discussions in the notice about these various cost estimates.

   Table 1.--Present Value in 1999 of the Costs of Compliance With the
                              Proposed Rule
         [As estimated in the preliminary regulatory evaluation]
------------------------------------------------------------------------
                                                           Present value
                                                          in 1999 of the
                                                            compliance
                     Source of cost                         costs  (in
                                                              1998  $
                                                             millions)
------------------------------------------------------------------------
Fuel Tank Review (Total)................................            14.4
  [For TC Holders: 9.5]
  [For STC Holders: 4.9]
Maintenance and Inspection..............................           100.0
Lost Net Revenue........................................            35.6
Additional Recordkeeping................................            17.4
                                                         ---------------
    Total...............................................           167.4
------------------------------------------------------------------------

Proposed Costs of Fuel Tank System Design Review
    By way of explanation, for the purpose of this analysis, an 
airplane ``model'' is defined to refer to a type certificate airplane 
(for example, a Model 737); whereas, an airplane ``series'' is defined 
to refer to a version (often under an Amended TC) of a model (for 
example, a Model 737-300).
    In the notice, the FAA had estimated that 35 TC's and 68 fuel tank 
system STC's would have needed a fuel tank system design review. 
Depending upon the airplane model, the FAA had estimated that a fuel 
tank system design review would have taken between 0.5 to 2.0 engineer 
years for a TC holder, and an average of 0.25 engineer year for a fuel 
tank system STC holder. The FAA had also estimated that developing 
manual revisions and service bulletins would have taken between 0.25 to 
1.0 engineer years for a TC holder, and an average of 0.1 engineer year 
for a fuel tank system STC holder.
    Using a total engineer compensation rate (salary and fringe 
benefits, plus a mark-up for hours spent by management, legal, etc. on 
the review) of $100 an hour, the FAA had estimated that the one-time 
fuel tank system design review would have cost TC holders $9.5 million, 
and it would have cost STC holders $4.9 million.
Proposed Costs of Fuel Tank System Inspections--Operational Rule 
Changes
    The costs to operators of complying with the proposed operational 
requirements would have been the additional airplane mechanic labor 
hours and the lost net revenue from the airplane's additional time out-
of-service in order to complete the fuel tank system inspections and 
maintenance. The FAA had assumed that the design approval holders' 
recommendations would have required fuel tank systems to be inspected 
only during the regularly scheduled major maintenance checks. As a 
result, the FAA had expected that no airplanes would have been taken 
out of service solely to inspect the fuel tank system unless the fuel 
tank system review would have identified an immediate safety concern. 
In that case, the corrective action would have been mandated by an AD.
    On that basis, the FAA had determined that operators would have 
needed to take four actions to comply with the proposal that would have 
either required an expenditure of resources or lost revenue:
     The first action involves the labor time to incorporate 
the design approval holders' recommendations into the maintenance 
manuals.
     The second action involves the labor time to perform the 
enhanced fuel tank system inspections, which includes testing of fuel 
tank system equipment and wiring.
     The third action involves the lost net revenue from an 
airplane's increased out-of-service time due to the enhanced fuel tank 
system inspection.
     The fourth action involves the labor time to provide the 
increased documentation, recording, and reporting the results from the 
fuel tank system inspections and tests.
    The FAA had assumed that each operator has one maintenance manual 
for each airplane model in its fleet. The FAA then determined that 
there were 290 individual airplane model/operator combinations. The FAA 
estimated that it would have taken 5 engineer days (at a cost of $4,000 
per manual) to incorporate these recommendations into the various 
maintenance manuals. On that basis, the FAA had calculated that this 
total cost would have been $1.16 million. As these expenses would have 
occurred in the second year, the present value of these costs was 
$1.084 million.
    With respect to the costs of fuel tank system inspections, the FAA 
had estimated that it would have taken between 60 and 330 additional 
labor hours per airplane to complete the initial fuel tank system 
inspection, and it would have taken between 30 and 180 additional labor 
hours per airplane for later fuel tank system reinspections. All of the 
initial inspections would have been completed during the first 3 years 
after the maintenance manual changes had been approved by the FAA 
(i.e., during the years 2002 through 2004). Each airplane would have 
been reinspected every 3 years after the initial fuel tank system 
inspection. Using a total compensation rate (wages and fringe benefits, 
plus a mark-up for time spent by supervisors, management, etc. on the 
inspections) of $70 an hour for airplane mechanics, the FAA had 
estimated that the initial fuel tank system inspection would have cost 
between $4,200 and $23,100 per airplane and fuel tank system 
reinspections would have cost between $2,100 and $12,600 per airplane. 
The present value of the total fuel tank system inspection costs, 
discounted at 7 percent over the period 2002 through 2011, would have 
been $99 million.
    In the notice, the FAA had assumed that the initial fuel tank 
system inspection would have been performed during a ``C'' or a ``D'' 
check. On that basis, the FAA had estimated that the additional out-of-
service time would have been between 36 hours and 96 hours per airplane 
for each airplane inspected during a ``C'' check, and would have been 
zero hours for each airplane inspected during a ``D'' check. Similarly, 
the FAA had estimated that the additional out-of-service time would

[[Page 23124]]

have been between 24 hours and 72 hours for each airplane fuel tank 
system reinspection that would have occurred during a ``C'' check, and 
would have been zero hours if the reinspection would have occurred 
during a ``D'' check.
    The economic cost of out-of-service time is the lost net revenue to 
the aviation system. Most of the passengers who would have flown on an 
airplane that has been taken out of service will take another flight. 
As a result, most of the lost revenue for that out-of-service airplane 
is actually captured by other airplane flights. The cost of the rule is 
the loss to the aviation system--not to the individual airplane 
operator. On that basis, the FAA computed the lost revenue to the 
aviation system by using the Office of Management and Budget (OMB) 
determination that the average annual risk-free productive rate of 
return on capital is 7 percent of the average value of the airplane 
model. Thus, the FAA had calculated that the out-of-service lost 
aviation net revenue per fuel tank system inspection would have ranged 
from $50 to $9,750 per airplane per day. The present value of this 
total lost aviation net revenue, discounted at 7 percent over 10 years, 
would have been $35.6 million.
    The FAA had determined that the increased annual documentation and 
reporting time would have been 1 hour of recordkeeping for every 8 
hours of labor time for the initial fuel tank system inspection, and 
would have been 1 hour of recordkeeping for every 10 hours of labor 
time for the reinspections. Thus, the per airplane documentation cost 
would have been between $450 and $2,550 for the initial fuel tank 
system inspection and $300 to $1,620 for a fuel tank system 
reinspection. The present value of the total recordkeeping cost 
discounted at 7 percent for 10 years would have been $17.4 million.
Proposed Costs of Future Fuel Tank System Design Changes--Revised Part 
25
    The FAA had determined that the part 25 changes would have a 
minimal effect on the cost of future type certificated airplanes 
because compliance with the proposed changes would be done during the 
design phase of the airplane model before any new airplanes would be 
manufactured. In addition, the FAA had determined that the part 25 
changes would have a minimal impact on future fuel tank system STC's 
because current industry design practices could be adapted to allow 
compliance with the requirement.
Differences in Assumptions and Values Between the Notice and the Final 
Rule
    The most significant difference between the proposal and the final 
rule is that the proposal allowed only 12 months for design approval 
holders to complete their fuel tank system reviews and recommendations. 
The proposal also allowed operators only 6 months to incorporate these 
recommendations into their maintenance manuals. The final rule allows 
design approval holders 18 months to be in compliance and also allows 
operators 18 months after that to incorporate the recommendations into 
their maintenance manuals.
    Table 2 lists the most significant differences in the assumptions 
made, data used, and the different requirements between the proposal 
and the final rule. Although there are other differences that have 
altered the calculated costs, the differences listed in Table 2 are the 
significant ones.

 Table 2.--Significant Differences in Assumptions and Values Between the
  Preliminary Regulatory Evaluation and the Final Regulatory Evaluation
------------------------------------------------------------------------
                                      Preliminary
       Assumption or value            regulatory       Final regulatory
                                       analysis            analysis
------------------------------------------------------------------------
Number of Airplanes.............  6,006 (in 1996)...  6,971 (in 1999).
Timeframe for Analysis..........  2000-2011.........  2001-2013
Net Rate of Fleet Growth........  4.3 percent.......  3.0 percent.
Hourly Compensation per:          $100; $70.........  $110; $75.
 Engineer; Mechanic.
Number of Fuel Tank System TC     35................  98 (46 ``full-
 Reviews.                                              scale'' and 52
                                                       ``derivative'').
Number of Engineering Years for   0.5 to 2..........  0.5 to 3.
 TC Review.
Number of Fuel Tank System STC    68................  74
 Reviews.
Number of Engineering Years for   0.35..............  0.15
 Fuel Tank System STC Review.
Number of Non-Fuel tank system    None (Asked for     325
 STC Reviews.                      Comments).
Number of Engineering Years for   None (Asked for     0.0375
 Non-Fuel tank system STC Review.  Comments).
Operator Paper Review of          None..............  1 engineer day per
 Airplane Fuel Tank System-Field                       existing
 Approvals/STC's.                                      airplane.
Number Months to Compete Safety   12................  18
 Review Fuel Tanks.
Number Months to Revise           6.................  18
 Maintenance Manual (After
 Review).
Number Years to Complete Initial  3 years (Completed  2 years (Completed
 Inspection (After Manual          between 2002 and    during 2004 and
 Revision).                        2004).              2005).
Determinants of Number            Airplane Model....  Airplane Model
 Inspection Hours.                                     plus Year
                                                       Manufactured.
Time before Initial Inspections   18 months.........  36 months.
 Begin.
Number Years to Complete Initial  3 years...........  2 years.
 Inspection.
Number Labor Hours for Initial    50 to 198.........  49 to 218.
 Inspection.
Number Days Out-of-Service for    0 to 4 (40 percent  0 to 4 (60 percent
 Initial Inspection.               inspections done    of inspections
                                   at ``C'' checks).   done at ``C''
                                                       checks).
Year Reinspections Start........  2004 (immediately   2008 (2 years
                                   after initial       after initial
                                   inspections).       inspections).
Reinspection Frequency..........  Every 3 years       Every 5 years (All
                                   (Some done during   done during ``D''
                                   ``C'' checks).      checks).
Number Hours for Reinspection...  40 to 160.........  25 to 87.
Reduced Inspection Hours Due to   All Model 747       No adjustment.
 AD's Already Issued.              hours not
                                   included; 50
                                   hours for Mode
                                   737's not
                                   included.
Number Days Out-of-Service for    0 to 3 (40 percent  0 (All
 Reinspection.                     of reinspections    reinspections
                                   done at ``C''       done at ``D''
                                   checks).            checks).
------------------------------------------------------------------------


[[Page 23125]]

Cost of Compliance With the Final Rule
    As seen in Table 3, based on the public comments and the changes in 
assumptions and values listed in Table 2, the FAA has determined that 
the present value of the costs of compliance with the rule over the 
time period 2001--2013 are $165.1 million. This figure includes:
     $27.1 million for TC holders,
     $2.8 million for fuel tank system STC holders,
     $2.6 million for non-fuel tank system STC holders, and
     $132.5 million for operators.
    The following sections summarize the results in the Final 
Regulatory Evaluation.

 Table 3.--Present Value of the Costs of Compliance With the Final Rule
------------------------------------------------------------------------
                                                           Present value
                                                          in 2001 of the
                                                            compliance
                     Source of cost                         costs  (in
                                                              2000  $
                                                             millions)
------------------------------------------------------------------------
Part 25 Fuel Tank Design................................           0.315
  (For TC Airplanes: Minimal)...........................
  (For Fuel Tank STC Holders: 0.315)....................
Fuel Tank Review (Total)................................          38.157
  (For TC Holders: 27.107)..............................
  (For Fuel Tank STC Holders: 2.522)....................
  (For Non-Fuel-Tank STC Holders: 2.594)................
  (For Operators: 5.934)................................
Maintenance and Inspection..............................          92.043
Lost Net Revenue........................................          24.224
Additional Recordkeeping................................          10.338
                                                         ---------------
    Total...............................................         165.077
------------------------------------------------------------------------

Costs of Fuel Tank System Design Review
    In the Final Regulatory Evaluation, the FAA has determined that 
existing TC holders will need to complete 46 ``full-scale'' fuel tank 
system reviews for the individual airplane models, and 52 
``derivative'' fuel tank system reviews for the separate series in the 
models. Using the Model 737-300/400/500 family of airplanes as an 
illustration, the FAA determined that Boeing will need to complete one 
``full-scale'' review and two ``derivative'' reviews for this family of 
airplanes. In addition, each airplane series that has an extended range 
modification or a freighter modification will require a ``derivative'' 
fuel tank system review.
    Depending upon the airplane model and the date it was first 
manufactured, the FAA determined the following average numbers of 
engineer years for the ``full-scale'' fuel tank system design review:
     3 years for large turbojets (1969-1980),
     2 years for large turbojets (1980-1988),
     1 year for large turbojets (post-1988),
     0.5 to 0.75 year for regional jets,
     0.5 to 0.75 year for large turboprops, and
     0.5 year for small turbojets and turboprops.
    With respect to the ``derivative'' fuel tank system design reviews, 
the FAA determined that these will take between 0.5 year and one year 
for large turbojets, and 0.5 year for regional turbojets and for 
turboprops.
    The FAA determined that the amount of engineering time to develop 
the recommendations for the maintenance manuals will be 20 percent of 
the amount of time to complete the fuel tank system review.
    Using a total engineer compensation rate of $110 an hour, the FAA 
calculated that the one-time fuel tank system design review will cost 
between $200,000 and $1.525 million per airplane model, with most of 
the individual costs in the range of $500,000 to $800,000. These costs 
will be about $125,000 to $150,000 for turboprops.
    As the TC holder will have 18 months to comply with the final rule, 
the FAA determined that one-half of the review costs will occur in the 
first year (2002) and one-half will occur in the second year (2003), 
and all of the costs to develop recommendations will occur in the 
second year (2003). On that basis, the present value of the total one-
time cost of compliance to TC holders will be $27.1 million, of which 
$22.7 million will be for the fuel tank system review and $4.390 
million will be to develop recommendations for the maintenance manuals.
    For part 25 fuel tank system STC holders, the FAA determined that 
there are 74 fuel tank system STC's that will need to undergo a review. 
The FAA also determined that it will take an average of 0.15 
engineering year to complete the review because the STC holder had to 
complete a substantial amount of engineering work to obtain FAA 
approval of the STC, and many of the STC's affect only a part of the 
fuel tank system. On that basis, the FAA determined that the average 
cost for a fuel tank system STC review will be $33,000.
    As the fuel tank system STC holder will have 18 months to comply 
with the final rule, the FAA determined that one-half of the review 
costs will occur in the first year (2002) and one-half will occur in 
the second year (2003), while all of the time to develop 
recommendations will occur in the second year (2003). On that basis, 
the present value of the total one-time cost of compliance will be $2.5 
million.
    Certain part 25 non-fuel tank system STC holders will also need to 
complete more than a cursory review of their modifications for the 
potential impact on the fuel tank system. The FAA determined that there 
are 325 non-fuel tank system STC's that will need to undergo a review. 
The FAA also determined that this review will take one quarter of the 
engineer time to complete a fuel tank system STC review (or 0.375 
engineer year). On that basis, the FAA determined that the average cost 
for a non-fuel tank system STC review will be $8,250.
    As the non-fuel tank system STC holder will have 18 months to 
comply with the final rule, the FAA determined that one-half of the 
review costs will occur in the first year (2002) and one-half will 
occur in the second year (2003), while all of the time to develop 
recommendations will occur in the second year (2003). On that basis, 
the present value of the total one-time cost of compliance will be $2.6 
million.
    Finally, based on the comments, the FAA determined that each 
operator will perform a paper review of each airplane to determine the 
modifications (including field approvals) that have been made on the 
airplane. Although the vast majority of these airplanes have been 
purchased by major, national, and regional airlines that should possess 
well-documented maintenance history records, a significant minority of 
these airplanes have had multiple owners or lessors and the maintenance 
records may not be quite as complete. Thus, the FAA determined that, on 
average, this paper review will take one day per airplane. On that 
basis, the average cost per airplane will be $880.
    In order to meet the 36-month compliance date, operators will need 
to discover if their airplanes have any ``orphan'' STC's or if there 
are any field approvals that affect the fuel tank system. Completing 
these paper reviews will then give the operators 18 months, after the 
TC and STC holders complete their required reviews, to complete any 
additional fuel tank system engineering reviews and to make the 
resultant changes to their maintenance manuals. Therefore, the FAA 
determined that one-half of the review costs will occur in the first 
year (2002) and one-half will occur in the second year (2003). On that 
basis, the present value of the total one-

[[Page 23126]]

time cost of compliance will be $5.9 million.
    There is also the potential that this ``paper review'' will reveal 
a field approval or an ``orphan'' STC that affects the safety of the 
fuel tank system. In that case, the operator would be responsible for 
the engineering review and for developing inspection and maintenance 
procedures for the maintenance manual. The FAA did not receive any data 
on this factor, but maintains that it is likely to infrequently occur 
and, further, the amount of engineering needed would be relatively 
minor.
Costs of Fuel Tank System Inspections--Operational Rule Changes
    As was true for the analysis in the notice, the costs to operators 
of complying with the final rule's operational requirements do not 
include the costs of corrective actions undertaken to repair 
deficiencies in the fuel tank system that were found because of a fuel 
tank system inspection, because the airplanes are required to be 
maintained as airworthy.
    On that basis, the FAA determined that operators will take four 
actions that will generate costs or lost revenue to comply with the 
final rule.
     The first action involves the labor time to incorporate 
the design approval holders' recommendations into the maintenance 
manuals.
     The second action involves the labor time to perform the 
enhanced fuel tank system inspections, which includes testing of fuel 
tank system equipment and wiring.
     The third action involves the lost net revenue from an 
airplane's increased out-of-service time due to the enhanced fuel tank 
system inspection.
     The fourth action involves the labor time to provide the 
increased documentation, recording, and reporting the results from the 
fuel tank system inspections and tests.
    In calculating the compliance costs for maintenance manual 
revisions due to TC holder recommendations, the FAA revised its 
assumption made in the notice that each operator has one maintenance 
manual for each model in its fleet. However, the FAA determined that 
its assumption of 5 days of engineer time to modify a maintenance 
manual is valid. Since the issuance of the notice, the FAA has been 
informed that nearly all airlines with fewer than 20 airplanes contract 
their major maintenance checks to third party (or other operators') 
repair stations. The FAA determined that 49 airlines (each with 20 or 
more airplanes) perform their own maintenance. For those 49 airlines, 
there are 165 airplane model/operator combinations, which produces a 
cost of $726,400. As these manual changes will not be made until the 
year 2003, the present value of these compliance costs is $635,000.
    The FAA also determined that 15 repair stations will perform these 
fuel tank system inspections for the smaller operators and, on average, 
each repair station will perform these inspections for 10 different 
airplane models. The compliance costs for these repair stations will be 
$660,000, which will be passed on to the operators. However, as these 
manual changes will not be made until the year 2003, the present value 
of these compliance costs is $576,475.
    The FAA determined that it will take, on average, one engineer day 
(or $880) for each maintenance manual to incorporate the 
recommendations from a fuel tank system STC holder. The FAA also 
determined that each of the 79 fuel tank system STC's will produce 
inspection and maintenance recommendations that will affect, on 
average, two maintenance manuals. On that basis, the compliance costs 
will be $139,000. However, as these manual changes will not be made 
until the year 2003, the present value of these compliance costs is 
$121,450.
    The FAA anticipates that implementation of the final rule will 
result in the initial fuel tank system inspection to be performed at 
the first major maintenance check after the maintenance manual 
modifications have been approved by the FAA. As the FAA defines a ``C'' 
check (or its equivalents) as a major maintenance check, the FAA 
determined that all of the affected airplanes will receive an initial 
fuel tank system inspection by 2 years after the maintenance manuals 
have been modified. Thus, the FAA determined that all of the initial 
fuel tank system inspections will be performed in either 2004 or 2005.
    The FAA made four adjustments to the number of airplane mechanic 
hours for an initial fuel tank system inspection as estimated in the 
notice:
    The first adjustment is that the FAA added 20 labor hours across 
the board in order to account for any unanticipated inspection 
recommendations from the product approval holders.
    The second adjustment is that the FAA varied the number of labor 
hours not only by certification date but also by manufactured date of 
the airplane. Older airplanes of an airplane model will require, on 
average, more labor hours to complete an initial fuel tank system 
inspection than will newer airplanes. As a result, the FAA separated 
airplanes into 3 categories based on the date the airplane was 
manufactured.
     For the 1960-1980 group, the number of labor hours 
estimated in the notice plus 20 hours was used.
     Airplanes manufactured between 1981 and 1995 require 20 
percent fewer labor hours than those for the 1960-1980 group.
     Airplanes manufactured between 1995 and 2003 will require 
30 percent fewer labor hours than those for the 1960-1980 group.
    The third adjustment is that the number of labor hours to reinspect 
fuel tank systems will be one-half of the number of labor hours needed 
for the initial fuel tank system inspection, based on the last year 
that the airplane model was manufactured.
    The fourth adjustment is that the number of labor hours for the 
first inspection of a future manufactured airplane's fuel tank system 
will be the same as for later reinspections, and is the same number as 
that to reinspect the newest airplane category.
    Using those adjustments and the changes listed in Table 2, the FAA 
determined that it will take between 49 and 218 labor hours to complete 
an initial fuel tank system inspection, and it will take between 25 and 
108 labor hours to complete a fuel tank system reinspection. Using a 
total compensation rate (wages plus fringe benefits) of $75 an hour for 
airplane mechanics, the FAA estimated that the initial fuel tank system 
inspection will cost between $3,625 and $16,350 per airplane, and fuel 
tank system reinspections will cost between $1,875 and $8,100 per 
airplane. The present value of the total labor cost discounted at 7 
percent for the period 2004 through 2013 is $92.043 million.
    As stated earlier, the FAA had determined that the initial fuel 
tank system inspection will be performed during a ``C'' or a ``D'' 
check. The duration and process of major inspections varies by airline 
and airplane type. Some airlines choose to conduct these checks during 
one time block of typically 7 to 10 days for a ``C'' check and 20 to 25 
days for a ``D'' check. Other airlines conduct segmented checks where 
the airplane is taken out of service for several shorter time intervals 
that allow the overall task to be completed. The FAA has determined 
that an airplane undergoing a segmented ``C'' check is, on average, 
out-of-service for two days, whereas a segmented ``D'' check takes an 
airplane out of service for 14 to 21 days. The FAA determined that two 
mechanics can simultaneously work on a fuel tank system inspection. On 
that basis, the FAA determined that

[[Page 23127]]

no additional out-of-service days will occur for 1 to 48 additional 
labor hours. Each additional 48 labor hours after the first 48 labor 
hours will add one day to the out-of-service time. On that basis, the 
initial fuel tank system inspection will produce between 0 and 4 
additional out-of-service days.
    The economic cost of out-of-service time is the lost services from 
a capital asset, which is computed by multiplying the airplane value by 
the number of days out of service and by 7 percent (the OMB risk-free 
rate of return). The average residual value of the turbojet models is 
based on the AVITAS 2nd Half 1999 Jet Aircraft Values, and the average 
value of the turboprop models is based on the AVITAS 2nd Half 1997 
Turboprop Aircraft Values. Thus, the FAA calculated that the out-of-
service lost capital services from the initial fuel tank system 
inspection will be between $200 and $86,000 per airplane per day.
    As noted earlier, the FAA determined that one-half of the airplanes 
will undergo an initial fuel tank system inspection in 2004 and one-
half will undergo an initial fuel tank system inspection in 2005. 
However, 20 percent of these airplanes each year will receive this 
inspection during a ``D'' check, in which there are no additional out-
of-service days due to the fuel tank system inspection. As a result, 
the FAA calculated that the present value of the total lost net revenue 
from the additional out-of-service days is $24.224 million.
    For the final rule, the FAA determined that its original estimate 
that every 8 hours of airplane mechanic labor for the initial fuel tank 
system inspection will produce one hour of documentation and 
recordkeeping labor hours is valid. However, the FAA determined that it 
had overestimated the amount of recordkeeping for reinspections, and 
used the ratio of 12 hours of reinspection airplane mechanic labor time 
for 1 hour of documentation and recordkeeping. On that basis, the 
present value of the recordkeeping cost is $10.338 million.
Costs of Future Fuel Tank System Design Changes--Revised Part 25
    The FAA had determined that the part 25 change will have a minimal 
effect on the cost of future type certificated airplanes because 
compliance with the proposed change would be done during the design 
phase of the airplane model before any new airplanes would be 
manufactured. In addition, the FAA determined that the part 25 changes 
will have a minimal impact on future fuel tank system STC's because 
current industry design practices could be adapted to allow compliance 
with the requirement.
Benefit-Cost Comparison
    As noted, the FAA has not quantified the potential benefits from 
this final rule because there is uncertainty about the actual ignition 
sources in the two fuel tanks. However, using a ``representative'' 
commercial airplane, the FAA calculated that the losses from a mid-air 
explosion would be $401.6 million. In addition, the FAA determined that 
the present value of the compliance costs is $165.1 million.
    If the final rule would prevent one such accident by the year 2014, 
the present value of the prevented losses would be greater than the 
present value of the compliance costs.
    Therefore, based on these factors and analysis, the FAA considers 
the final rule to be cost-beneficial.

Regulatory Flexibility Act

    The Regulatory Flexibility Act of 1980 (RFA) establishes ``as a 
principle of regulatory issuance that agencies shall endeavor, 
consistent with the objective of the rule and of applicable statutes, 
to fit regulatory and informational requirements to the scale of the 
business, organizations, and governmental jurisdictions subject to 
regulation.'' To achieve that principle, the RFA requires agencies to 
solicit and consider flexible regulatory proposals and to explain the 
rationale for their actions. The RFA covers a wide range of small 
entities, including small businesses, not-for-profit organizations, and 
small governmental jurisdictions.
    Agencies must perform a review to determine whether a proposed or 
final rule will have a significant economic impact on a substantial 
number of small entities. If the determination finds that it will, the 
agency must prepare a Regulatory Flexibility Analysis as described in 
the RFA.
    However, if an agency determines that a proposed or final rule is 
not expected to have a significant economic impact on a substantial 
number of small entities, section 605(b) of the 1980 act provides that 
the head of the agency may so certify, and a Regulatory Flexibility 
Analysis is not required. The certification must include a statement 
providing the factual basis for this determination, and the reasoning 
should be clear.
    For the proposed rule, the FAA had conducted an Initial Regulatory 
Flexibility Analysis, which established that it would have a 
significant impact on a substantial number of small entities. As a 
result, the FAA had specifically requested public comment on the 
potential impact of the proposed rule on small entities.
Need for and Objectives of the Rule
    The final rule is being issued in order to reduce the risk of a 
mid-air airplane fuel tank explosion with the resultant loss of life 
(as evidenced by TWA Flight 800). Existing fuel tank system inspections 
have not provided comprehensive, systematic prevention and control of 
ignition sources in airplane fuel tanks, thereby allowing a small, but 
unacceptable risk of a fuel tank explosion.
    The objective of the final rule is to ensure the continuing 
airworthiness of airplanes certificated for 30 or more passengers or 
with a payload of more than 7,500 pounds. Design approval holders 
(including TC holders, fuel tank system STC holders, and holders of 
certain non-fuel tank system STC's) will be required to complete a fuel 
tank system design review and to provide recommendations and 
instructions to operators and repair stations concerning fuel tank 
system inspections and equipment and wiring testing. This review may 
result in the development of service bulletins and AD's. All operators 
covered by Title 14, Code of Federal Regulations (CFR) parts 91, 121, 
and 125, and all U.S.-registered airplanes used in scheduled operations 
under part 129, will be required to incorporate these recommendations 
into their maintenance manuals and to perform the inspections and tests 
as required. In addition, repair stations that are contracted to 
perform maintenance are also required to comply with these 
requirements.
Summary of Comments Made in Response to the Initial Regulatory 
Flexibility Analysis
    There were two commenters that indirectly discussed issues of 
concern in the Initial Regulatory Flexibility Analysis:
    The General Aviation Manufacturing Association (GAMA) supported the 
FAA's decision to exclude airplanes certificated for 30 passengers or 
fewer from the final rule. Although they did not address the small 
business aspect of this decision, nearly every operator of these 
excluded airplanes is a small entity. However, GAMA opposed the 
proposed part 25 future design requirements as not appropriate for 
business jets and stated that these airplanes should be excluded from 
the part 25 requirements. The FAA disagreed with this comment because a 
future business jet that has a 7,500 pound payload is a large airplane 
and

[[Page 23128]]

its fuel tank system faces the same potential for explosion as other 
large transport category airplanes.
    The Regional Airline Association (RAA) supported the FAA's decision 
to exclude airplanes certificated for 30 passengers or fewer from the 
final rule. They, too, did not directly address the small business 
aspect of this decision. However, they opposed the FAA's decision to 
include airplanes certificated for fewer than 60 passengers or for less 
than a 15,000 pound payload. Their primary argument in favor of this 
exclusion is that these airplanes do not have a history of these types 
of accidents. The FAA disagreed with this comment because, by itself, 
the accident histories of specific types and classes of airplanes are 
insufficient to demonstrate that their fuel tank systems attain the 
required level of safety. An important consideration in these accident 
histories is that these airplanes have not accumulated the number of 
flight hours as those of the larger transport category airplanes. As 
fuel tank explosions are rare events, there is the possibility that 
such an accident has not occurred in these airplanes because not enough 
hours have been flown. In addition, it may be that the fuel tank system 
design review will reveal that these systems do not have the same risk 
as the risk associated with larger transport category airplanes. In 
that case, the impact of the rule on operators of these airplanes will 
be much less than estimated by the FAA. However, until the fuel tank 
system design review is completed, the FAA does not know what the 
potential is for these airplanes to have a mid-air explosion and, as 
the FAA cannot rule out the possibility, the FAA cannot exclude these 
airplanes from coverage under the final rule.
Description and Estimate of the Number of Small Entities Affected by 
the Final Rule
    The FAA determined that there are a total of 143 U.S. airlines, 76 
private operators (primarily corporations with corporate jets), and 112 
manufacturers, airplane brokers, and airplane leasing companies 
affected by the final rule. Of the 143 U.S. airlines, 107 are small 
airlines. Nearly all of the 76 private operators are large corporations 
that can afford to operate and maintain a corporate jet airplane. Most 
of the airplane brokers and airplane leasing companies are privately 
held corporations or partnerships, and the FAA was unable to establish 
whether or not most of them are small entities.
Reporting and Recordkeeping Requirements
    The final rule requires that operators maintain a record of the 
results of the fuel tank system inspections and maintenance done on the 
airplane. For the small operators that contract their maintenance to 
third party repair stations (nearly all of the small airlines and other 
operators), they will be required to keep a copy of the report that the 
repair station will give them. Small entities will not need to acquire 
additional professional skills to prepare these reports.
Description of the Alternatives Evaluated
    In the Initial Regulatory Flexibility Analysis, the FAA had 
evaluated three alternatives to the proposed rule:
     The first alternative was to require all airplanes with 10 
or more seats be covered by the proposed rule.
     The second alternative was to require all airplanes with 
30 or more seats and all airplanes with 10 or more seats in commercial 
service be covered by the proposal.
     The third alternative was to require only turbojet 
airplanes in commercial service be covered by the proposal.
    There were no comments from the public in support of these 
alternatives. A complete discussion of these alternatives is available 
in the public docket for this rulemaking.
Differences Between the Proposed Rule and the Final Rule Requirements
    The primary change from the proposed rule is that the final rule 
allows operators 36 months to comply whereas the proposed rule had 
required compliance within 18 months. In addition, the FAA determined 
that fewer fuel tank reinspections will be needed than the FAA had 
estimated in the Preliminary Regulatory Evaluation. As a result, the 
present value of the costs to operators will be approximately 20 
percent less per airplane under the final rule than they would have 
been under the proposed rule.
Conclusion
    Both the proposed and final rule will have a significant impact on 
a substantial number of small entities. Consistent with SBA guidance, 
the FAA conducted an initial regulatory flexibility analysis (IRFA) and 
a final regulatory flexibility analysis (FRFA). The initial regulatory 
flexibility analysis provided a detailed analysis of the impact on 
small entities. The FRFA directly addresses five requirements. While no 
comments specifically addressed the IRFA, the FAA addresses comments 
related to small entities.
    As published in the notice, the FAA did not require fuel tank 
inspections for aircraft with a payload under 7,500 pounds. The primary 
difference between the proposed rule and the final rule is that the FAA 
extended operator compliance time from 18 to 36 months. In addition, 
the FAA determined that fewer fuel tank reinspections will be needed 
than originally estimated in the NPRM.
    As a result of these changes, about 140 airplanes that would have 
been required to undergo a fuel tank inspection under the proposed rule 
will not be required to undergo a fuel tank inspection under the final 
rule because they will have been retired during the additional 18 
months allowed for compliance. In addition, all of the inspections and 
reinspections would have had to be completed 18 months earlier under 
the proposed rule than under the final rule, resulting in a higher 
present value of the compliance costs. Consequently, recalculating (due 
to the greater number of airplanes and other values) the present value 
of the costs to operators to comply with the proposed rule would result 
in a cost of $172.2 million, which is approximately 36 percent more 
than the $126.6 million costs to operators to comply with the final 
rule.

Trade Impact Assessment

    The Trade Agreement Act of 1979 prohibits Federal agencies from 
engaging in any standards or related activities that create unnecessary 
obstacles to the foreign commerce of the United States. Legitimate 
domestic objectives, such as safety, are not considered unnecessary 
obstacles. The statute also requires consideration of international 
standards and, where appropriate, that they be the basis for U.S. 
standards. In addition, consistent with the Administration's belief in 
the general superiority and desirability of free trade, it is the 
policy of the Administration to remove or diminish to the extent 
feasible, barriers to international trade, including both barriers 
affecting the export of American goods and services to foreign 
countries, and barriers affecting the import of foreign goods and 
services into the United States.
    In accordance with the above statute and policy, the FAA assessed 
the potential effect of this final rule and determined that it will 
have only a domestic impact and, therefore, a minimal effect on any 
trade-sensitive activity.

[[Page 23129]]

Unfunded Mandates Assessment

    The Unfunded Mandates Reform Act of 1995 (the Act), enacted as Pub. 
L. 104-4 on March 22, 1995, is intended, among other things, to curb 
the practice of imposing unfunded Federal mandates on State, local, and 
tribal governments.
    Title II of the Act requires each Federal agency to prepare a 
written statement assessing the effects of any Federal mandate in a 
proposed or final agency rule that may result in a $100 million or more 
expenditure (adjusted annually for inflation) in any one year by State, 
local, and tribal governments, in the aggregate, or by the private 
sector; such a mandate is deemed to be a ``significant regulatory 
action.''
    As seen in Table IV-13 in the Final Regulatory Evaluation 
(contained in the docket to this rule), this final rule does not 
contain such a mandate. Therefore, the requirements of Title II of the 
Unfunded Mandates Reform Act of 1995 do not apply.

Executive Order 3132, Federalism

    The FAA has analyzed this final rule under the principles and 
criteria of Executive Order 13132, Federalism. We determined that this 
action will not have a substantial direct effect on the States, or the 
relationship between the national Government and the States, or on the 
distribution of power and responsibilities among the various levels of 
government. Therefore, we determined that this final rule does not have 
federalism implications.

Environmental Analysis

    FAA Order 1050.1D defines FAA actions that may be categorically 
excluded from preparation of a National Environmental Policy Act (NEPA) 
environmental impact statement. In accordance with FAA Order 1050.1D, 
appendix 4, paragraph 4(j), this rulemaking action qualifies for a 
categorical exclusion.

Energy Impact

    The energy impact of this final rule has been assessed in 
accordance with the Energy Policy and Conservation Act (EPCA) Public 
Law 94-163, as amended (42 U.S.C. 6362) and FAA Order 1053.1. It has 
been determined that the final rule is not a major regulatory action 
under the provisions of the EPCA.

Regulations Affecting Intrastate Aviation in Alaska

    Section 1205 of the FAA Reauthorization Act of 1996 (110 Stat. 
3213) requires the Administrator, when modifying regulations in Title 
14 of the CFR in a manner affecting intrastate aviation in Alaska, to 
consider the extent to which Alaska is not served by transportation 
modes other than aviation, and to establish such regulatory 
distinctions as she considers appropriate. The FAA, therefore, 
specifically requested comments on whether there is justification for 
applying the proposed rule differently to intrastate operations in 
Alaska. Although one commenter expressed a concern related to a 
particular Alaskan intrastate operation involving Lockheed Model L-188 
Electra airplanes, no comments were received concerning such 
justification in general. Since no comments in that regard were 
received, and since the FAA is not aware of any justification for such 
regulatory distinction, the final rule is not applied differently to 
intrastate operations in Alaska.

List of Subjects

14 CFR Parts 21, 25, 91, and 125

    Aircraft, Aviation safety, Reporting and recordkeeping 
requirements.

14 CFR Part 121

    Air carriers, Aircraft, Aviation safety, Reporting and 
recordkeeping requirements, Safety, Transportation.

14 CFR Part 129

    Air carriers, Aircraft, Aviation safety, Reporting and 
recordkeeping requirements.

The Amendment

    In consideration of the foregoing, the Federal Aviation 
Administration amends parts 21, 25, 91, 121, 125, and 129 of Title 14, 
Code of Federal Regulations, as follows:

PART 21--CERTIFICATION PROCEDURES FOR PRODUCTS AND PARTS

    1. The authority citation for Part 21 continues to read as follows:

    Authority: 42 U.S.C. 7572; 40105; 40113; 44701-44702, 44707, 
44709, 44711, 44713, 44715, 45303.

    2. In part 21, add SFAR No. 88 in numerical order at the beginning 
of the part to read as follows:
* * * * *

SFAR No. 88--Fuel Tank System Fault Tolerance Evaluation 
Requirements

    1. Applicability. This SFAR applies to the holders of type 
certificates, and supplemental type certificates that may affect the 
airplane fuel tank system, for turbine-powered transport category 
airplanes, provided the type certificate was issued after January 1, 
1958, and the airplane has either a maximum type certificated 
passenger capacity of 30 or more, or a maximum type certificated 
payload capacity of 7,500 pounds or more. This SFAR also applies to 
applicants for type certificates, amendments to a type certificate, 
and supplemental type certificates affecting the fuel tank systems 
for those airplanes identified above, if the application was filed 
before June 6, 2001, the effective date of this SFAR, and the 
certificate was not issued before June 6, 2001.
    2. Compliance: No later than December 6, 2002, or within 18 
months after the issuance of a certificate for which application was 
filed before June 6, 2001, whichever is later, each type certificate 
holder, or supplemental type certificate holder of a modification 
affecting the airplane fuel tank system, must accomplish the 
following:
    (a) Conduct a safety review of the airplane fuel tank system to 
determine that the design meets the requirements of Secs. 25.901 and 
25.981(a) and (b) of this chapter. If the current design does not 
meet these requirements, develop all design changes to the fuel tank 
system that are necessary to meet these requirements. The FAA 
(Aircraft Certification Office (ACO), or office of the Transport 
Airplane Directorate, having cognizance over the type certificate 
for the affected airplane) may grant an extension of the 18-month 
compliance time for development of design changes if:
    (1) The safety review is completed within the compliance time;
    (2) Necessary design changes are identified within the 
compliance time; and
    (3) Additional time can be justified, based on the holder's 
demonstrated aggressiveness in performing the safety review, the 
complexity of the necessary design changes, the availability of 
interim actions to provide an acceptable level of safety, and the 
resulting level of safety.
    (b) Develop all maintenance and inspection instructions 
necessary to maintain the design features required to preclude the 
existence or development of an ignition source within the fuel tank 
system of the airplane.
    (c) Submit a report for approval to the FAA Aircraft 
Certification Office (ACO), or office of the Transport Airplane 
Directorate, having cognizance over the type certificate for the 
affected airplane, that:
    (1) Provides substantiation that the airplane fuel tank system 
design, including all necessary design changes, meets the 
requirements of Secs. 25.901 and 25.981(a) and (b) of this chapter; 
and
    (2) Contains all maintenance and inspection instructions 
necessary to maintain the design features required to preclude the 
existence or development of an ignition source within the fuel tank 
system throughout the operational life of the airplane.

PART 25--AIRWORTHINESS STANDARDS: TRANSPORT CATEGORY AIRPLANES

    3. The authority citation for part 25 continues to read:

    Authority: 49 U.S.C. 106(g), 40113, 44701-44702, and 44704.


    4. Section 25.981 is revised to read as follows:

[[Page 23130]]

Sec. 25.981  Fuel tank ignition prevention.

    (a) No ignition source may be present at each point in the fuel 
tank or fuel tank system where catastrophic failure could occur due to 
ignition of fuel or vapors. This must be shown by:
    (1) Determining the highest temperature allowing a safe margin 
below the lowest expected autoignition temperature of the fuel in the 
fuel tanks.
    (2) Demonstrating that no temperature at each place inside each 
fuel tank where fuel ignition is possible will exceed the temperature 
determined under paragraph (a)(1) of this section. This must be 
verified under all probable operating, failure, and malfunction 
conditions of each component whose operation, failure, or malfunction 
could increase the temperature inside the tank.
    (3) Demonstrating that an ignition source could not result from 
each single failure, from each single failure in combination with each 
latent failure condition not shown to be extremely remote, and from all 
combinations of failures not shown to be extremely improbable. The 
effects of manufacturing variability, aging, wear, corrosion, and 
likely damage must be considered.
    (b) Based on the evaluations required by this section, critical 
design configuration control limitations, inspections, or other 
procedures must be established, as necessary, to prevent development of 
ignition sources within the fuel tank system and must be included in 
the Airworthiness Limitations section of the Instructions for Continued 
Airworthiness required by Sec. 25.1529. Visible means to identify 
critical features of the design must be placed in areas of the airplane 
where maintenance actions, repairs, or alterations may be apt to 
violate the critical design configuration limitations (e.g., color-
coding of wire to identify separation limitation).
    (c) The fuel tank installation must include either--
    (1) Means to minimize the development of flammable vapors in the 
fuel tanks (in the context of this rule, ``minimize'' means to 
incorporate practicable design methods to reduce the likelihood of 
flammable vapors); or
    (2) Means to mitigate the effects of an ignition of fuel vapors 
within fuel tanks such that no damage caused by an ignition will 
prevent continued safe flight and landing.

    5. Paragraph H25.4 of Appendix H to part 25 is revised to read as 
follows:

Appendix H to Part 25--Instructions for Continued Airworthiness

* * * * *
    H25.4  Airworthiness Limitations section.
    (a) The Instructions for Continued Airworthiness must contain a 
section titled Airworthiness Limitations that is segregated and 
clearly distinguishable from the rest of the document. This section 
must set forth--
    (1) Each mandatory replacement time, structural inspection 
interval, and related structural inspection procedures approved 
under Sec. 25.571; and
    (2) Each mandatory replacement time, inspection interval, 
related inspection procedure, and all critical design configuration 
control limitations approved under Sec. 25.981 for the fuel tank 
system.
    (b) If the Instructions for Continued Airworthiness consist of 
multiple documents, the section required by this paragraph must be 
included in the principal manual. This section must contain a 
legible statement in a prominent location that reads: ``The 
Airworthiness Limitations section is FAA-approved and specifies 
maintenance required under Sec. Sec. 43.16 and 91.403 of the Federal 
Aviation Regulations, unless an alternative program has been FAA 
approved.''

PART 91--GENERAL OPERATING AND FLIGHT RULES

    6. The authority citation for part 91 continues to read:

    Authority: 49 U.S.C. 1301(7), 1303, 1344, 1348, 1352 through 
1355, 1401, 1421 through 1431, 1471, 1472, 1502, 1510, 1522, and 
2121 through 2125; Articles 12, 29, 31, and 32(a) of the Convention 
on International Civil Aviation (61 Stat 1180); 42 U.S.C. 4321 et 
seq.; E.O. 11514; 49 U.S.C. 106(g) (Revised Pub. L. 97-449, January 
21, 1983).

    7. Amend Sec. 91.410 by revising the section heading; redesignating 
the introductory text, paragraphs (a) introductory text, (a)(1), (a)(2) 
and (a)(3), and paragraphs (b) through (l) as paragraph (a) 
introductory text, paragraphs (a)(l) introductory text, (a)(1)(i), 
(a)(1)(ii), and (a)(1)(iii), and paragraphs (a)(2) through (a)(12); and 
adding a new paragraph (b) to read as follows:


Sec. 91.410  Special maintenance program requirements.

* * * * *
    (b) After June 7, 2004, no person may operate a turbine-powered 
transport category airplane with a type certificate issued after 
January 1, 1958, and either a maximum type certificated passenger 
capacity of 30 or more, or a maximum type certificated payload capacity 
of 7,500 pounds or more, unless instructions for maintenance and 
inspection of the fuel tank system are incorporated into its inspection 
program. These instructions must address the actual configuration of 
the fuel tank systems of each affected airplane, and must be approved 
by the FAA Aircraft Certification Office (ACO), or office of the 
Transport Airplane Directorate, having cognizance over the type 
certificate for the affected airplane. Operators must submit their 
request through the cognizant Flight Standards District Office, who may 
add comments and then send it to the manager of the appropriate office. 
Thereafter, the approved instructions can be revised only with the 
approval of the FAA Aircraft Certification Office (ACO), or office of 
the Transport Airplane Directorate, having cognizance over the type 
certificate for the affected airplane. Operators must submit their 
request for revisions through the cognizant Flight Standards District 
Office, who may add comments and then send it to the manager of the 
appropriate office.

PART 121--OPERATING REQUIREMENTS: DOMESTIC, FLAG, AND SUPPLEMENTAL 
OPERATIONS

    8. The authority citation for part 121 continues to read:

    Authority: 49 U.S.C. 106(g), 40113, 40119, 44101, 44701-44702, 
44705, 44709-44711, 44713, 44716-44717, 44722, 44901, 44903-44904, 
44912, 46105.

    9. Amend Sec. 121.370 by revising the section heading; 
redesignating the introductory text, paragraphs (a) introductory text, 
(a)(1), (a)(2) and (a)(3), and paragraphs (b) through (l) as paragraph 
(a) introductory text, paragraphs (a)(l) introductory text, (a)(1)(i), 
(a)(1)(ii), and (a) (1)(iii), and paragraphs (a)(2) through (a)(12); 
and adding a new paragraph (b) to read as follows:


Sec. 121.370  Special maintenance program requirements.

* * * * *
    (b) After June 7, 2004, no certificate holder may operate a 
turbine-powered transport category airplane with a type certificate 
issued after January 1, 1958, and either a maximum type certificated 
passenger capacity of 30 or more, or a maximum type certificated 
payload capacity of 7,500 pounds or more, unless instructions for 
maintenance and inspection of the fuel tank system are incorporated in 
its maintenance program. These instructions must address the actual 
configuration of the fuel tank systems of each affected airplane and 
must be approved by the FAA Aircraft Certification Office (ACO), or 
office of the Transport Airplane Directorate, having cognizance over 
the type certificate for the affected airplane. Operators must submit 
their request through an appropriate FAA Principal Maintenance 
Inspector, who may add comments and then send it to the manager of the 
appropriate office.

[[Page 23131]]

Thereafter, the approved instructions can be revised only with the 
approval of the FAA Aircraft Certification Office (ACO), or office of 
the Transport Airplane Directorate, having cognizance over the type 
certificate for the affected airplane. Operators must submit their 
requests for revisions through an appropriate FAA Principal Maintenance 
Inspector, who may add comments and then send it to the manager of the 
appropriate office.

PART 125--CERTIFICATION AND OPERATIONS: AIRPLANES HAVING A SEATING 
CAPACITY OF 20 OR MORE PASSENGERS OR A MAXIMUM PAYLOAD CAPACITY OF 
6,000 POUNDS OR MORE; AND RULES GOVERNING PERSONS ON BOARD SUCH 
AIRCRAFT

    10. The authority citation for part 125 continues to read:

    Authority: 49 U.S.C. 106(g), 40113, 44701-44702, 44705, 44710-
44711, 44713, 44716-44717, 44722.

    11. Amend Sec. 125.248 by revising the section heading; 
redesignating the introductory text, paragraphs (a) introductory text, 
(a)(1), (a)(2) and (a)(3), and paragraphs (b) through (l) as paragraph 
(a) introductory text, paragraphs (a)(l) introductory text, (a)(1)(i), 
(a)(1)(ii), and (a) (1)(iii), and paragraphs (a)(2) through (a)(12); 
and adding a new paragraph (b) to read as follows:


Sec. 125.248  Special maintenance program requirements.

* * * * *
    (b) After June 7, 2004, no certificate holder may operate a 
turbine-powered transport category airplane with a type certificate 
issued after January 1, 1958, and either a maximum type certificated 
passenger capacity of 30 or more, or a maximum type certificated 
payload capacity of 7,500 pounds or more unless instructions for 
maintenance and inspection of the fuel tank system are incorporated in 
its inspection program. These instructions must address the actual 
configuration of the fuel tank systems of each affected airplane and 
must be approved by the FAA Aircraft Certification Office (ACO), or 
office of the Transport Airplane Directorate, having cognizance over 
the type certificate for the affected airplane. Operators must submit 
their request through an appropriate FAA Principal Maintenance 
Inspector, who may add comments and then send it to the manager of the 
appropriate office. Thereafter, the approved instructions can be 
revised only with the approval of the FAA Aircraft Certification Office 
(ACO), or office of the Transport Airplane Directorate, having 
cognizance over the type certificate for the affected airplane. 
Operators must submit their requests for revisions through an 
appropriate FAA Principal Maintenance Inspector, who may add comments 
and then send it to the manager of the appropriate office.

PART 129--OPERATIONS: FOREIGN AIR CARRIERS AND FOREIGN OPERATORS OF 
U.S.-REGISTERED AIRCRAFT ENGAGED IN COMMON CARRIAGE

    12. The authority citation for part 129 continues to read:

    Authority: 49 U.S.C. 106(g), 40104-40105, 40113, 40119, 44701-
44702, 44712, 44716-44717, 44722, 44901-44904, 44906.

    13. Amend Sec. 129.32 by revising the section heading; 
redesignating the introductory text, paragraphs (a) introductory text, 
(a)(1), (a)(2) and (a)(3), and paragraphs (b) through (l) as paragraph 
(a) introductory text, paragraphs (a)(l) introductory text, (a)(1)(i), 
(a)(1)(ii), and (a) (1)(iii), and paragraphs (a)(2) through (a)(12); 
and adding a new paragraph (b) to read as follows:


Sec. 129.32  Special maintenance program requirements.

* * * * *
    (b) For turbine-powered transport category airplanes with a type 
certificate issued after January 1, 1958, and either a maximum type 
certificated passenger capacity of 30 or more, or a maximum type 
certificated payload capacity of 7,500 pounds or more, no later than 
June 7, 2004, the program required by paragraph (a) of this section 
must include instructions for maintenance and inspection of the fuel 
tank systems. These instructions must address the actual configuration 
of the fuel tank systems of each affected airplane and must be approved 
by the FAA Aircraft Certification Office (ACO), or office of the 
Transport Airplane Directorate, having cognizance over the type 
certificate for the affected airplane. Operators must submit their 
request through an appropriate FAA Principal Maintenance Inspector, who 
may add comments and then send it to the manager of the appropriate 
office. Thereafter the approved instructions can be revised only with 
the approval of the FAA Aircraft Certification Office (ACO), or office 
of the Transport Airplane Directorate, having cognizance over the type 
certificate for the affected airplane. Operators must submit their 
requests for revisions through an appropriate FAA Principal Maintenance 
Inspector, who may add comments and then send it to the manager of the 
appropriate office.

    Issued in Washington, DC, on April 19, 2001.
Jane F. Garvey,
Administrator.
[FR Doc. 01-10129 Filed 5-4-01; 8:45 am]
BILLING CODE 4910-13-P