Fuel Tank Safety (FTS) /

Airworthiness Limitation (AWL) /

Critical Design Configuration Control
Limitation (CDCCL)

AIRWORTHINESS MANAGEMENT - AVIONICS

BACKGROUND
TWA B747-131 Fligth-800 accident, involving Centre Wing
Tank (CWT) explosions
Investigations revealed penetration of 115 Vac electrical
energy into the center fuel tank due to chaffed Fuel Quantity
Indicating System (FQIS) wiring
Together, with the inadequate electrical bonding of fuel
system Components, separation of fuel system wiring, and
fuel vapors, resulted in loss of the passenger lives and the
airplane.
Fuel tank explosions can only occur when an ignition
source is in contact with flammable fuel vapor.

10/14/15

AIRWORTHINESS MANAGEMENT - AVIONICS

10/14/15

AIRWORTHINESS MANAGEMENT - AVIONICS

FUEL TANK EXPOLSION INCIDENT

March 2001, Thai Airways 737

CWT fuel pumps left running on when dry. Electrical ARC
/ fault resulted in Centre Tank explosion
airplane was being prepared for a departure to Chiang
Mai
149 passengers were waiting to board
The fire erupted into the cabin, killing one cabin crew
member and injuring 6 others
The fire was put out in 60 minutes
The airplane was destroyed

10/14/15

AIRWORTHINESS MANAGEMENT - AVIONICS

10/14/15

AIRWORTHINESS MANAGEMENT - AVIONICS

FUEL TANK EXPOLSION INCIDENTS

China Air 737-800
While retracting slats during taxi, one loosened slat
fairing bolt penetrated into the CWT resulting CWT
explosion.

10/14/15

AIRWORTHINESS MANAGEMENT - AVIONICS

FUEL TANK EXPOLSION INCIDENTS

Philippines Airlines B737 1990
CWT explosion during push back

10/14/15

AIRWORTHINESS MANAGEMENT - AVIONICS

COMMON FEATURES OF SIGNIFICANT

ACCIDENTS/INCIDENT
1990 - B-737-300 Manila,
Philippines
Almost new airplane

1996 - B-747, TWA 800,

JFK,USA
25 year old airplane

Air Conditioning Packs running Air Conditioning Packs running

during Ground Operations
during Ground Operations
Empty CWT explosion
during
pushback from gate
CWT pumps operating at time
Of Explosion
8 fatalities

Empty CWT explosion

During climb
CWT pumps operating at
time of Explosion
230 fatalities

2001 - B-737-400 Bangkok,

Thailand
10 year old airplane
Air Conditioning Packs running
during Ground Operations
Empty CWT explosion
minutes after refueling
CWT pumps operating at time of
explosion
1 fatality

Jet-A fuel, approx. 95 degree F Jet-A fuel, approx. 120 degree Jet-A1 fuel, approx. 97 degree F
ambient temp.(35C)
F tank temp.(49C)
ambient temp.(36C)
NO IGNITION SOURCE
NO IGNITION SOURCE
NO IGNITION SOURCE
IDENTIFIED
IDENTIFIED
IDENTIFIED
10/14/15

AIRWORTHINESS MANAGEMENT - AVIONICS

THE FIRE TRIANGLE

Fire is a chemical process requires
three things:
OXYGEN,
HEAT and
FUEL
Without one of these elements,
a fire cannot start or continue.
The process in a fire is called oxidation.
A fire hazard can be minimized by
eliminating any one side of the fire triangle

10/14/15

AIRWORTHINESS MANAGEMENT - AVIONICS

REGULATORY ACTION/
REQUIREMENTS
Special Federal Aviation Regulation 88 (SFAR 88),
advising airplane manufacturers to carry out a design
review of fuel tank system to avoid entry of any ignition
source into the fuel tanks in compliance of FAR 25-901 &
25.981 (a) and (b).
National Aviation Authorities (NAA) using NT/POL/25/12,
JAR 25.901 / 25.1309 & Technical Guidance Leaflet
(TGL) 47.

10/14/15

10

AIRWORTHINESS MANAGEMENT - AVIONICS

SFAR No. 88--Fuel Tank System Fault Tolerance

Evaluation Requirements
Applicability
the holders of type certificates, and supplemental type certificates
that may affect the airplane fuel tank system, for turbine-powered
transport category airplanes, provided the type certificate was
issued after January 1, 1958, and the airplane has either a
maximum type certificated passenger capacity of 30 or more, or a
maximum type certificated payload capacity of 7,500 pounds or
more.
This SFAR also applies to applicants for type certificates,
amendments to a type certificate, and supplemental type certificates
affecting the fuel tank systems for those airplanes identified above, if
the application was filed before June 6, 2001, the effective date of
this SFAR, and the certificate was not issued before June 6, 2001.

10/14/15

11

AIRWORTHINESS MANAGEMENT - AVIONICS

SFAR No. 88--Fuel Tank System Fault Tolerance

Evaluation Requirements
Compliance
(a) Conduct a safety review of the airplane fuel
tank system to determine that the design
meets the requirements of 25.901 and
25.981(a) and (b).
(b) Develop all maintenance and inspection
instructions
(c) Submit a report for approval to the FAA
Airplane Certification Office (ACO)
10/14/15

12

AIRWORTHINESS MANAGEMENT - AVIONICS

FAR 25.981 Fuel tank ignition prevention

a.

No ignition source may be present at each point in the fuel tank

or fuel tank system where catastrophic failure could occur due to
ignition of fuel or vapors.

b.

Critical Design Configuration Control Limitations (CDCCL),

inspections, or other procedures must be established, as
necessary, to prevent development of ignition sources within the
fuel tank system and must be included in the Airworthiness
Limitations section of the Instructions for Continued Airworthiness.

c.
The fuel tank installation must include either:
(1) Means to minimize the development of flammable vapors in the fuel
tanks (in the context of this rule, minimize'' means to incorporate
practicable design methods to reduce the likelihood of flammable
vapors); or
(2) Means to mitigate the effects of an ignition of fuel vapors within fuel
tanks such that no damage caused by an ignition will prevent
continued safe flight and landing.
10/14/15

13

AIRWORTHINESS MANAGEMENT - AVIONICS

THE CONCEPT OF IGNITION SOURCE

PREVENTION
Fuel tank explosions can only occur when an ignition
source is in contact with flammable fuel vapor.
Fuel vapors become flammable when they are mixed in
certain proportions with oxygen, and are under specific
temperature and pressure conditions.
some fuel tanks have a significantly higher exposure to
flammable vapors than other tanks.

10/14/15

14

AIRWORTHINESS MANAGEMENT - AVIONICS

THE CONCEPT OF IGNITION SOURCE

PREVENTION
First Line of Defense to prevent recurrence of such events,
Airplane manufacturers reviewed the airplane fuel system designs
to meet the above requirements.
a number of service Bulletins (SBs) /Production Modifications
(Production Revision Record: PRR) have been introduced for
incorporation on Production and In-Service airplanes, trying to
build the airplane fuel system design immune to such occurrences.
FAA legislation requires that airplane types that have fuel tanks,
which exceed the average flammability exposure level (> 7%),
specified in the rule shall be fitted with either a Flammability
Reduction System (FRS), or an Ignition Mitigation Means (IMM).

10/14/15

15

AIRWORTHINESS MANAGEMENT - AVIONICS

THE CONCEPT OF IGNITION SOURCE

PREVENTION
EASA has issued a Safety Information Bulletin (SIB 2010-10)
which mandates the installation of a FRS on production airplane
subject to high flammability exposure and manufactured after
31st December 2011.
EASA will publish a Notice of Proposed Amendment (NPA) by
mid 2011 to address the in- service airplane retrofit.

10/14/15

16

AIRWORTHINESS MANAGEMENT - AVIONICS

THE CONCEPT OF IGNITION SOURCE

PREVENTION
Compliance Target
In relation to the affected airplane, fifty percent (50%) of each operator's
fleet of airplane are to be completed within 4 years of release of the
Service Bulletins i.e. by 2014. One hundred percent (100%) of each
operator's fleet of airplane are to be completed within 7 years after the
release of the Service Bulletins i.e. by 2017.
NOTE: Portable gas detectors are used to monitor Oxygen and flammable
vapor concentrations within the fuel tanks. Oxygen concentrations
should be between 19.5 and 23.5 percent. Level below 19.5 percent is
considered Oxygen deficient, while levels above 23.5 percent will
significantly increase the risk of fire and/or explosion. Monitoring these
figures is critical to the safety of the maintenance crew.

10/14/15

17

AIRWORTHINESS MANAGEMENT - AVIONICS

A Flammability Reduction System (FRS)

FRS is a system that is designed to prevent fuel vapors from
being in a flammable condition
A practical Flammability Reduction System (FRS) will
reduce fuel tank oxygen content to below the level that will
support combustion (approach being adopted by Airbus).
Boeing has developed Nitrogen Generation System (NGS)
to satisfy FRS requirement.

10/14/15

18

AIRWORTHINESS MANAGEMENT - AVIONICS

An Ignition Mitigation Means (IMM)

IMM is a system that detects an ignition source and releases
a fire suppressant to prevent the development of a fire.
Such a technology is used on small military airplane but is not
considered sufficiently robust for use in large commercial
airplane and as such is not being pursued by Airbus or
Boeing.

10/14/15

19

AIRWORTHINESS MANAGEMENT - AVIONICS

CHANGES TO INSTRUCTIONS FOR

CONTINUING AIRWORTHINESS (ICA)
Second Line of Defense of the FTS regulations account for this
situation and requires updating of Instructions for Continued
Airworthiness (ICA) / Airplane Maintenance Program for all the type
certificated airplane to avoid any likelihood of compromise / violation
of the fuel system design criteria during any scheduled and / or
unscheduled maintenance.
This requirement ensures proper documentation of any
maintenance action performed on the airplane and / or its
components for safety, reliability and maintainability.
AWL / CDCCL tasks were introduced by airplane manufacturers in
Maintenance Planning Documents AND have already been
incorporated into the PIAs fleet maintenance program.

10/14/15

20

AIRWORTHINESS MANAGEMENT - AVIONICS

CHANGES TO INSTRUCTIONS FOR

CONTINUING AIRWORTHINESS (ICA)
Boeing MPD section-9 is related to Airworthiness Limitations
(AWL) which describes the Fuel Airworthiness Limitation Items
(ALIs) and the associated CDCCL tasks.
Airbus / ATR publishes Airworthiness Limitations (ALS) section
-5 which is related to Fuel Airworthiness Limitations (FAL). These
requirements, together with the Life Limits / Monitored Parts,
structural Airworthiness Limitation Items (ALI) and systems
Certification Maintenance Requirements (CMR) comprise the
Airworthiness Limitation Section which satisfies the regulatory
requirements.

10/14/15

21

AIRWORTHINESS MANAGEMENT - AVIONICS

Airworthiness Limitation Items (ALIs)

ALIs identify inspection tasks related to fuel tank ignition source
prevention which must be done to maintain the design level of
safety for the operational life of the airplane.
These ALIs are mandatory and cannot be changed or deleted
without the approval of applicable regulatory agency.
Strict adherence to methods, techniques and practices as
prescribed is required to ensure the ALI is complied with.
Any use of methods, techniques or practices not contained in
these ALIs must be approved by the applicable regulatory agency.

10/14/15

22

AIRWORTHINESS MANAGEMENT - AVIONICS

Critical Design Configuration Control

Limitations (CDCCLs)
CDCCLs are a means of identifying certain design configuration
features intended to preclude a fuel tank ignition source for the
operational life of the airplane.
CDCCLs are mandatory and cannot be changed or deleted
without the approval of the applicable regulatory agency.
A critical fuel tank ignition source prevention feature may exist in
the fuel system and its related installation or in systems that, if a
failure condition were to develop, could interact with the fuel
system in such a way that an unsafe condition would develop
without this limitation.

10/14/15

23

AIRWORTHINESS MANAGEMENT - AVIONICS

Critical Design Configuration Control

Limitations (CDCCLs)
Strict adherence to configuration, methods, techniques, and
practices as prescribed is required to ensure compliance with the
CDCCL.
Any use of parts, ,methods, techniques or practices not
contained in the applicable CDCCL must be approved by the
FAA office that is responsible for the airplane model Type
Certificate, or applicable regulatory agency.

10/14/15

24

AIRWORTHINESS MANAGEMENT - AVIONICS

Certification Maintenance Requirements

(CMRs)
A CMR is a required periodic task, established during the
design certification of the airplane as an operating limitation
of the type certificate.
CMRs usually result from a formal, numerical analysis
conducted to show compliance with catastrophic and
hazardous failure conditions.

10/14/15

25

AIRWORTHINESS MANAGEMENT - AVIONICS

Sample of AWL / FAL for B777

10/14/15

26

AIRWORTHINESS MANAGEMENT - AVIONICS

Sample of AWL / FAL for A310

CDCCL

Requirement

Reference

Applicability

Air gap between a fuel

quantity indicating
probes and the
airplane structure.

Critical to prevent spark

generation
during lightning strike conditions
and must not be compromised
The gap stated in the relevant
maintenance procedure in the
AMM
must be achieved during
installation of a fuel quantity
probe.

AMM
28-42-31 pb 401
28-42-32 pb 401
28-42-33 pb 401

ALL
ALL
ALL

Separation of fuel
quantity and level
indicating system
wiring from other
wiring.

To prevent cross coupling of high

voltage transients and thereby
keep
unsafe ignition energies from
inside the tank it is required that
operators obey the wire routing
and separation standards given in
the Electrical
Standard Practices Manual
(ESPM).

ESPM
20-10-00
20-33-20
20-33-21
20-33-22

ALL
ALL
ALL
ALL

10/14/15

27

AIRWORTHINESS MANAGEMENT - AVIONICS

Sample of AWL / FAL for A310

3

CDCCL

Requirement

Reference

Applicability

Direct bonding on
items of equipment
inside a fuel tank.

Direct bonding is critical to prevent

spark generation during
component
failure and lightning strike
conditions and must not be
compromised Direct bonding in
fuel tanks must be carried out
during component installation to
the appropriate bonding method
and standard stated within the
installation procedure in the AMM.

AMM
28-00-00 pb 401
28-11-21 pb 401
28-11-22 pb 401
28-11-24 pb 401
28-11-32 pb 401
28-12-21 pb 401
28-12-33 pb 401
28-12-34 pb 401
28-21-13 pb 401
28-21-21 pb 401
28-24-31 pb 401
28-25-15 pb 401
28-27-12 pb 401
28-43-21 pb 401
28-46-21 pb 401

ALL
ALL
ALL
ALL
A310-300
ALL
A310-300
A310-300
ALL
ALL
ALL
ALL
A310-300
ALL
ALL

10/14/15

28

AIRWORTHINESS MANAGEMENT - AVIONICS

Sample of AWL / FAL for A310

4

CDCCL

Requirement

Reference

Applicability

Safety critical
features of fuel
pumps

These features must be maintained

throughout the full life of the fuel
pump to avoid the possibility of
generation of an ignition source by
overheating or sparks caused by
arcing, friction etc.
Repair and overhaul of fuel pumps
must be carried out in accordance
with the equipment manufacturers
maintenance instructions or other
maintenance instructions
acceptable to the certifying
authority.

CMM
28 09 01
28 24 11

ALL
ALL

10/14/15

29

AIRWORTHINESS MANAGEMENT - AVIONICS

MANAGEMENT / CONTROL OF CDCCL

Refer Doc ref # PIA/CDCCL/SFAR88 for detailed procedure
for the Management & Control of CDCCL in PIA.
It is the responsibility of certifying staff / maintenance
personnel to ensure that the above stated CDCCL
configurations are maintained to reduce the risk of any
ignition source penetration into the fuel tank (s).
If any of these CDCCL is compromised, this may lead to wire
chaffing, fault current (short circuit), or overheating of the
CWT fuel pumps.
This in turn may result in fuel tank explosion.

10/14/15

30

AIRWORTHINESS MANAGEMENT - AVIONICS

MANAGEMENT / CONTROL OF CDCCL

Dry running of the fuel pumps should not be allowed as it
has already resulted in catastrophic incidents.
This requirement has been addressed both by Airbus &
Boeing by introduction of new logic circuitry to avoid dry
running on CWT fuel pumps.
Introduction of Ground Fault Interrupter (GFI) relays also
ensures NO overheating / fault current in the fuel pump
circuitry.

10/14/15

31

AIRWORTHINESS MANAGEMENT - AVIONICS

MANAGEMENT / CONTROL OF CDCCL

10/14/15

32

AIRWORTHINESS MANAGEMENT - AVIONICS

OVERHAUL SHOP CONTROL FOR

CDCCL
Fuel pumps CMM have also been revised in compliance of
CDCCL requirements and provides specific instructions /
procedures.
Tools, kits, jigs, materials, test equipment required for
servicing, repair or overhauling of a fuel system component
should be used accordingly.

10/14/15

33

AIRWORTHINESS MANAGEMENT - AVIONICS

10/14/15

34

AIRWORTHINESS MANAGEMENT - AVIONICS

AD/ SB Control for CDCCL

AD/SB evaluation check list was updated to include a clause
to check whether the literature under evaluation affects
CDCCL or not.
Certifying staff / maintenance personnel should assess the
affect of the current activity on any of the AWL/CDCCL, and if,
it is confirmed that a CDCCL / AWL is directly or indirectly
affected, work instructions provided by the AD / SB or task
card should be revised / corrected in coordination with
Airworthiness Management Division to preclude any chance
of CDCCL violation.
A data base will be updated to have a record of all the ADs,
SBs, and ECO which have an effect on any of the CDCCL
requirements.
10/14/15

35

AIRWORTHINESS MANAGEMENT - AVIONICS

AD/ SB Control for CDCCL

Scheduled / unscheduled repair schemes control
Any scheduled /un-scheduled locally prepared repair
scheme should be examined for effect on any of the CDCCL
item(s).
Same level of understanding is required by shop personnel
involved in the servicing / repair / overhaul of Fuel pumps,
FQI Tank unit, Fuel Quantity Indicating Computer (FQIC),
Fuel Quantity Processor Unit (FQPU), harnesses.

10/14/15

36

AIRWORTHINESS MANAGEMENT - AVIONICS

AD/ SB Control for CDCCL

Maintenance Program Control for CDCCL
Inspections/ tasks introduced through Locally generated
task cards as per requirements of an AD, inspection SB, or
any other local operational /maintenance requirement also
requires assessment whether it affects the CDCCL or not.
PIA fleet Maintenance program should be scrutinized on a
regular basis upon receipt of MPD revision, to sort out the
newly introduced tasks for having an impact on the CDCCL.
This exercise should be continued in future as well.

10/14/15

37

AIRWORTHINESS MANAGEMENT - AVIONICS

MAINTENANCE DATA - MANUAL

CONSULTATION
Use of updated / latest maintenance data is of utmost
importance for maintaining FTS design criteria / CDCCL.
Air Transport Association of America (ATA) Chapter 47 has
been assigned for FRS / NGS in concerned airplanes
Airplane Maintenance Manuals (AMM).
CDCCL warning notes have also been introduced in AMM
and Components Maintenance Manuals (CMM).
All certifying staff / maintenance personnel are required to
consult concerned AMM /CMM (as applicable).

10/14/15

38

AIRWORTHINESS MANAGEMENT - AVIONICS

10/14/15

39

AIRWORTHINESS MANAGEMENT - AVIONICS

10/14/15

40

AIRWORTHINESS MANAGEMENT - AVIONICS

10/14/15

41