Special Conditions: Airbus Model A350-900 Airplane; Lightning Protection of Fuel-Tank Structure To Prevent Fuel-Tank Vapor Ignition, 53129-53133 [2014-21245]
Download as PDF
<![CDATA[
Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations
The digital systems architecture for
the Airbus Model A350–900 airplane is
composed of several connected
networks. This network architecture is
used for a diverse set of functions,
providing data connectivity between
systems, including:
1. Airplane control, communication,
display, monitoring and navigation
systems,
2. Operator business and
administrative support systems,
3. Passenger entertainment systems,
and
4. Access by systems external to the
airplane.
rmajette on DSK2TPTVN1PROD with RULES
Discussion
The Airbus Model A350–900 airplane
network architecture and configuration
may allow increased connectivity to,
and access from, external network
sources, and operator operations and
maintenance networks to the airplane
control domain and operatorinformation-services domain. The
airplane-control domain and operatorinformation-services domain perform
functions required for the safe operation
and maintenance of the airplane.
Previously, these domains had very
limited connectivity with external
network sources. The network
architecture and configuration may
allow the exploitation of networksecurity vulnerabilities resulting in
intentional or unintentional destruction,
disruption, degradation, or exploitation
of data, systems, and networks critical
to the safety and maintenance of the
airplane.
The existing regulations and guidance
material did not anticipate these types
of airplane system architectures.
Furthermore, 14 CFR regulations and
current system-safety assessment policy
and techniques do not address potential
security vulnerabilities, which could be
exploited by unauthorized access to
airplane networks, data buses, and
servers. Therefore, these special
conditions are to ensure that
unauthorized wired or wireless
electronic connections do not
compromise the security (i.e.,
confidentiality, integrity, and
availability) of airplane systems.
These special conditions contain the
additional safety standards that the
Administrator considers necessary to
establish a level of safety equivalent to
that established by the existing
airworthiness standards.
Discussion of Comments
Notice of proposed special conditions
No. 25–13–17–SC for the Airbus Model
A350–900 airplane was published in the
VerDate Mar<15>2010
15:13 Sep 05, 2014
Jkt 232001
Federal Register on December 17, 2013
(78 FR 76251)
Comment From Airbus
Airbus had one comment about the
following wording of the first paragraph
of the Proposed Special Conditions:
The applicant must ensure airplane
electronic system security protection
from access to or by unauthorized
sources external to the airplane,
including those possibly caused by
maintenance activity.
Airbus considers that the wording ‘‘to
or by’’ is incorrect. The protection must
prevent access from unauthorized
sources external to the airplane only.
The requirement of protection to
unauthorized sources external to the
airplane, is not relevant.
Therefore, Airbus suggests that the
wording be modified as follows:
The applicant must ensure airplane
electronic system security protection
from access by unauthorized sources
external to the airplane, including those
possibly caused by maintenance
activity.
53129
external to the airplane, including those
possibly caused by maintenance
activity.
2. The applicant must ensure that
electronic system-security threats are
identified and assessed, and that
effective electronic system-security
protection strategies are implemented to
protect the airplane from all adverse
impacts on safety, functionality, and
continued airworthiness.
3. The applicant must establish
appropriate procedures to allow the
operator to ensure that continued
airworthiness of the airplane is
maintained, including all post-typecertification modifications that may
have an impact on the approved
electronic system-security safeguards.
Issued in Renton, Washington, on August
15, 2014.
Jeffrey E. Duven,
Manager, Transport Airplane Directorate,
Aircraft Certification Service.
[FR Doc. 2014–21243 Filed 9–5–14; 8:45 am]
BILLING CODE 4910–13–P
FAA Response
The FAA agrees with Airbus and has
changed the special conditions
accordingly.
DEPARTMENT OF TRANSPORTATION
Applicability
As discussed above, these special
conditions apply to Airbus Model
A350–900 series airplanes. Should
Airbus apply later for a change to the
type certificate to include another
model incorporating the same novel or
unusual design feature, the special
conditions would apply to that model as
well.
[Docket No. FAA–2013–1002; Special
Conditions No. 25–530–SC]
Conclusion
This action affects only certain novel
or unusual design features on the Airbus
Model A350–900 series airplanes. It is
not a rule of general applicability.
List of Subjects in 14 CFR Part 25
Aircraft, Aviation safety, Reporting
and recordkeeping requirements.
The authority citation for these
special conditions is as follows:
Authority: 49 U.S.C. 106(g), 40113, 44701,
44702, 44704.
The Special Conditions
Accordingly, pursuant to the authority
delegated to me by the Administrator,
the following special conditions are
issued as part of the type-certification
basis for Airbus Model A350–900 series
airplanes.
1. The applicant must ensure airplane
electronic system-security protection
from access by unauthorized sources
■
PO 00000
Frm 00003
Fmt 4700
Sfmt 4700
Federal Aviation Administration
14 CFR Part 25
Special Conditions: Airbus Model
A350–900 Airplane; Lightning
Protection of Fuel-Tank Structure To
Prevent Fuel-Tank Vapor Ignition
Federal Aviation
Administration (FAA), DOT.
ACTION: Final special conditions.
AGENCY:
These special conditions are
issued for Airbus Model A350–900
airplanes.
These airplanes will have a novel or
unusual design feature that will
incorporate a nitrogen generation
system (NGS) for all fuel tanks, to
actively reduce flammability exposure
within the fuel tanks significantly below
that required by the fuel-tank
flammability regulations. Among other
benefits, the NGS significantly reduces
the potential for fuel-vapor ignition
caused by lightning strikes. The
applicable airworthiness regulations do
not contain adequate or appropriate
safety standards for this design feature.
These special conditions contain the
additional safety standards that the
Administrator considers necessary to
establish a level of safety equivalent to
that established by the existing
airworthiness standards.
DATES: Effective Date: October 8, 2014.
SUMMARY:
E:\FR\FM\08SER1.SGM
08SER1
53130
Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations
FOR FURTHER INFORMATION CONTACT:
Doug Bryant, Propulsion/Mechanical
Systems, ANM–112, Transport Airplane
Directorate, Aircraft Certification
Service, 1601 Lind Avenue SW.,
Renton, Washington 98057–3356;
telephone (425) 227–2384; facsimile
(425) 227–1320.
SUPPLEMENTARY INFORMATION:
Background
On August 25, 2008, Airbus applied
for a type certificate for their new Model
A350–900 airplane. Later, Airbus
requested, and the FAA approved, an
extension to the application for FAA
type certification to November 15, 2009.
The Model A350–900 airplane has a
conventional layout with twin wingmounted Rolls-Royce Trent XWB
engines. It features a twin-aisle, 9abreast, economy-class layout, and
accommodates side-by-side placement
of LD–3 containers in the cargo
compartment. The basic Model A350–
900 airplane configuration
accommodates 315 passengers in a
standard two-class arrangement. The
design cruise speed is Mach 0.85 with
a maximum take-off weight of 602,000
lbs. The Model A350–900 series
airplane has a composite wing and fueltank structure constructed of carbonfiber-reinforced plastic materials.
rmajette on DSK2TPTVN1PROD with RULES
Type Certification Basis
Under Title 14, Code of Federal
Regulations (14 CFR) 21.17, Airbus must
show that the Model A350–900 airplane
meets the applicable provisions of 14
CFR part 25, as amended by
Amendments 25–1 through 25–129.
If the Administrator finds that the
applicable airworthiness regulations
(i.e., 14 CFR part 25) do not contain
adequate or appropriate safety standards
for the Model A350–900 airplane
because of a novel or unusual design
feature, special conditions are
prescribed under § 21.16.
Special conditions are initially
applicable to the model for which they
are issued. Should the type certificate
for that model be amended later to
include any other model that
incorporates the same novel or unusual
design feature, the special conditions
would also apply to the other model
under § 21.101.
In addition to the applicable
airworthiness regulations and special
conditions, the Model A350–900
airplane must comply with the fuel-vent
and exhaust-emission requirements of
14 CFR part 34, and the noisecertification requirements of 14 CFR
part 36. The FAA must issue a finding
of regulatory adequacy under § 611 of
VerDate Mar<15>2010
15:13 Sep 05, 2014
Jkt 232001
Public Law 92–574, the ‘‘Noise Control
Act of 1972.’’
The FAA issues special conditions, as
defined in 14 CFR 11.19, under § 11.38,
and they become part of the typecertification basis under § 21.17(a)(2).
Novel or Unusual Design Features
The Airbus Model A350–900 airplane
will incorporate the following novel or
unusual design features: Fuel-tank NGS
that is intended to control fuel-tank
flammability for all fuel tanks. This NGS
is designed to provide a level of
performance that applies the more
stringent standard for warm-day
flammability performance applicable to
normally emptied tanks within the
fuselage contour from § 25.981(b), and
14 CFR part 25 appendix M, to all fuel
tanks of the Model A350–900 airplane.
This high level of NGS performance for
all fuel tanks is a novel or unusual
design feature not envisioned at the
time the regulations applying to the
Model A350–900 airplane certification
basis were issued.
Discussion
The certification basis of the Airbus
Model A350–900 airplane includes
§ 25.981, as amended by Amendment
25–125, as required by 14 CFR 26.37.
This amendment includes the ignitionprevention requirements in § 25.981(a),
as amended by Amendment 25–102. It
includes revised flammability limits for
all fuel tanks, and new specific
limitations on flammability for all fuel
tanks as defined in § 25.981(b), as
amended by Amendment 25–125.
Ignition Source Prevention
Section 25.981(a)(3) requires
applicants to show that an ignition
source in the fuel-tank system could not
result from any single failure, from any
single failure in combination with any
latent failure condition not shown to be
extremely remote, or from any
combination of failures not shown to be
extremely improbable. This requirement
was originally adopted in Amendment
25–102, and it requires the assumption
that the fuel tanks are always flammable
when showing that the probability of an
ignition source being present is
extremely remote. (Amendment 25–102
included § 25.981(c), which required
minimizing fuel-tank flammability, and
this was defined in the preamble as
being equivalent to unheated aluminum
fuel tanks located in the wing.) This
requirement defines three types of
scenarios that must be addressed to
show compliance with § 25.981(a)(3).
The first scenario is that any single
failure, regardless of the probability of
occurrence of the failure, must not cause
PO 00000
Frm 00004
Fmt 4700
Sfmt 4700
an ignition source. The second scenario
is that any single failure, regardless of
the probability of occurrence, in
combination with any latent failure
condition not shown to be at least
extremely remote, must not cause an
ignition source. The third scenario is
that any combination of failures not
shown to be extremely improbable must
not cause an ignition source.
Demonstration of compliance with this
requirement would typically require a
structured, quantitative safety analysis.
Design areas that have latent failure
conditions typically would be driven by
these requirements to have multiple
fault tolerance, or ‘‘triple redundancy.’’
This means that ignition sources are still
prevented even after two independent
failures.
Flammability Limits
Section 25.981(b) states that no fueltank fleet-average flammability exposure
may exceed 3 percent of the
flammability-exposure evaluation time
calculated using the method in part 25,
Appendix N, or the fleet-average
flammability of a fuel tank within the
wing of the airplane being evaluated,
whichever is greater. If the wing is not
a conventional, unheated aluminum
wing, the analysis must be based on an
assumed equivalent, conventional
construction, unheated, aluminum
wing. In addition, for fuel tanks that are
normally emptied during operation and
that have any part of the tank located
within the fuselage contour, the fleetaverage flammability for warm days
(above 80 °F) must be limited to 3
percent, as calculated using the method
in part 25, Appendix M.
Application of Existing Regulations
Inappropriate Due to Impracticality
Since the issuance of § 25.981(a)(3), as
amended by Amendment 25–102, the
FAA has conducted certification
projects in which applicants found it
impractical to meet the requirements of
that regulation for some areas of
lightning protection for fuel tank
structure. Partial exemptions were
issued for these projects. These same
difficulties exist for the Airbus Model
A350–900 airplane project.
The difficulty of designing multiplefault-tolerant structure, and the
difficulty of detecting failures of hidden
structural-design features in general,
makes compliance with § 25.981(a)(3)
uniquely challenging and impractical
for certain aspects of the electrical
bonding of structural elements. Such
bonding is needed to prevent
occurrence of fuel-tank ignition sources
from lightning strikes. The effectiveness
and fault tolerance of electrical-bonding
E:\FR\FM\08SER1.SGM
08SER1
rmajette on DSK2TPTVN1PROD with RULES
Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations
features for structural joints and
fasteners is partially dependent on
design features that cannot be
effectively inspected or tested after
assembly without damaging the
structure, joint, or fastener. Examples of
such features include a required
interference fit between the shank of a
fastener and the hole in which the
fastener is installed; metal foil or mesh
imbedded in composite material; a
required clamping force provided by a
fastener to pull two structural parts
together; and a required faying surface
bond between the flush surfaces of
adjacent pieces of structural material,
such as in a wing-skin joint, or a
mounting-bracket installation. In
addition, other features that physically
can be inspected or tested may be
located within the fuel tanks. Therefore,
it is not practical to inspect for failures
of those features at short intervals.
Examples of such failures include
separation or loosening of cap seals over
fastener ends, and actual structural
failures of internal fasteners. This
inability to practically detect
manufacturing errors and failures of
structural-design features critical to
lightning protection results in degraded
conditions that occur and remain in
place for a very long time, possibly for
the remaining life of the airplane. The
complex construction techniques
associated with composite structure can
make these aspects particularly
challenging.
Accounting for such long failurelatency periods in the system safety
analysis, required by § 25.981(a)(3),
would require multiple fault tolerance
in the structural lightning-protection
design. As part of the designdevelopment activity for the Model
A350–900 airplane, Airbus has
examined possible design provisions to
provide multiple fault tolerance in the
structural design to prevent ignition
sources from occurring in the event of
lightning attachment to the airplane in
critical locations. Airbus has concluded
from this examination that providing
multiple fault tolerance for some
structural elements is not practical.
Airbus has also identified some areas of
the Model A350–900 airplane design
where it is impractical to provide even
single-fault tolerance in the structural
design to prevent ignition sources from
occurring in the event of lightning
attachment after a single failure. The
FAA has reviewed this examination
with Airbus in detail and has agreed
that providing fault tolerance beyond
that in the Model A350–900 airplane
design for these areas would be
impractical.
VerDate Mar<15>2010
15:13 Sep 05, 2014
Jkt 232001
As a result of the Airbus Model A350–
900 airplane and other certification
projects, the FAA has now determined
that compliance with § 25.981(a)(3) is
impractical for some areas of lightning
protection for fuel-tank structure, and
that application of § 25.981(a)(3) to
those design areas is therefore
inappropriate. The FAA plans further
rulemaking to revise § 25.981(a)(3). As
appropriate, the FAA plans to issue
special conditions or exemptions for
certification projects progressing before
the revision is complete. This is
discussed in FAA Memorandum ANM–
112–08–002, Policy on Issuance of
Special Conditions and Exemptions
Related to Lightning Protection of Fuel
Tank Structure, dated May 26, 2009.1
Application of Existing Regulations
Inappropriate Due to Compensating
Feature That Provides Equivalent Level
of Safety
Section 25.981(b) sets specific
standards for fuel-tank flammability as
discussed above under ‘‘Flammability
Limits.’’ Under that regulation, the fleetaverage flammability exposure of all
fuel tanks on the Model A350–900
airplane may not exceed 3 percent of the
flammability-exposure evaluation time
calculated using the method in part 25,
Appendix N, or the fleet-average
flammability of a wing main tank within
an equivalent construction,
conventional, unheated, aluminum
wing fuel tank, whichever is greater.
The typical fleet-average fuel-tank
flammability of fuel tanks located in the
wing ranges between 1 and 5 percent. If
it is assumed that a Model A350–900
airplane equivalent, conventional,
unheated, aluminum wing fuel tank
would not exceed a fleet-average
flammability time of 3 percent, the
actual composite Model A350–900
airplane wing-fuel-tank design would be
required to comply with the 3 percent
fleet average flammability standard, and
therefore a means to reduce the
flammability to 3 percent would be
required. However, the Model A350–
900 airplane design includes NGS for all
fuel tanks that will also be shown to
meet the additional, more-stringent
warm-day average flammability
standard in part 25, Appendix M, which
is only required for normally emptied
fuel tanks with some part of the tank
within the fuselage contour. Fuel tanks
that meet this requirement typically
have average fuel-tank flammability
1 The memorandum may be viewed at: https://
www.airweb.faa.gov/Regulatory_and_Guidance_
Library/rgPolicy.nsf/0/12350AE62D
393B7A862575C300709CA3?OpenDocument
&Highlight=anm-112-08-002
PO 00000
Frm 00005
Fmt 4700
Sfmt 4700
53131
levels well below the required 3
percent.
Since the NGS for all fuel tanks on the
Model A350–900 airplane provides
performance that meets part 25,
Appendix M, the FAA has determined
that the risk reduction provided by this
additional performance will provide
compensation for some relief from the
ignition-prevention requirements of
§ 25.981(a)(3) while still establishing a
level of safety equivalent to that
established in the regulations.
In determining the appropriate
amount of relief from the ignitionprevention requirements of § 25.981(a),
the FAA considered the original overall
intent of Amendment 25–102, which
was to ensure the prevention of
catastrophic events due to fuel-tank
vapor explosion. These special
conditions are intended to achieve that
objective through a prescriptive
requirement that fault tolerance (with
respect to the creation of an ignition
source) be provided for all structural
lightning protection design features
where providing such fault tolerance is
practical, and through a performancebased standard for the risk due to any
single-failure vulnerability that exists in
the design. In addition, for any
structural lightning-protection design
features for which Airbus shows that
providing fault tolerance is impractical,
these special conditions require Airbus
to show that a fuel-tank vapor-ignition
event, due to the summed risk of all
non-fault-tolerant design features, is
extremely improbable. Airbus would be
required to show that the design meets
this safety objective using a structured
system-safety assessment similar to that
currently used for demonstrating
compliance with §§ 25.901 and 25.1309.
Given these novel or unusual design
features, and the compliance challenges
noted earlier in this document, the FAA
has determined that application of
§ 25.981(a)(3) is inappropriate in that it
is neither practical nor necessary to
apply the ignition-source-prevention
provisions of § 25.981(a)(3) to the
specific fuel-tank structural lightningprotection features of the Airbus Model
A350–900 airplane. However, without
the § 25.981(a)(3) provisions, the
remaining applicable regulations in the
Model A350–900 airplane certification
basis would be inadequate to set an
appropriate standard for fuel-tank
ignition prevention. Therefore, in
accordance with provisions of § 21.16,
the FAA has determined that, instead of
§ 25.981(a)(3), alternative fuel-tank
structural lighting-protection
requirements be applied to fuel-tank
lightning-protection features that are
integral to the airframe structure of the
E:\FR\FM\08SER1.SGM
08SER1
rmajette on DSK2TPTVN1PROD with RULES
53132
Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations
Model A350–900 airplane. These
alternative requirements are intended to
provide the level of safety intended by
§ 25.981(a)(3), based on our recognition,
as discussed above, that a highly
effective NGS for the fuel tanks makes
it unnecessary to assume that the fuel
tank is always flammable. As discussed
previously, the assumption that the fuel
tanks are always flammable was
required when demonstrating
compliance to the ignition-prevention
requirements of § 25.981(a)(3).
One resulting difference between
these special conditions and the
§ 25.981(a)(3) provisions they are meant
to replace is the outcome being
prevented—fuel-vapor ignition versus
an ignition source. These special
conditions acknowledge that the
application of fuel-tank-flammability
performance standards will reduce fueltank flammability to an extent that it is
appropriate to consider the beneficial
effects of flammability reduction when
considering design areas where it is
impractical to comply with
§ 25.981(a)(3).
One of the core requirements of these
special conditions is a prescriptive
requirement that structural lightningprotection design features must be fault
tolerant. (An exception, wherein Airbus
can show that providing fault tolerance
is impractical, and associated
requirements, is discussed below.) The
other core requirement is that Airbus
must show that the design,
manufacturing processes, and
Airworthiness Limitations section of the
Instructions for Continued
Airworthiness include all practical
measures to prevent, and detect and
correct, failures of structural-lightning
protection features due to
manufacturing variability, aging, wear,
corrosion, and likely damage. The FAA
has determined that, if these core
requirements are met, a fuel-tank vaporignition event, due to lightning, is not
anticipated to occur in the life of the
airplane fleet. This conclusion is based
on the fact that a critical lightning strike
to any given airplane is itself a remote
event, and on the fact that fuel tanks
must be shown to be flammable only for
a relatively small portion of the fleet
operational life.
For any non-fault-tolerant features in
the design, Airbus must show that
eliminating these features or making
them fault tolerant is impractical. The
requirements and considerations for
showing it is impractical to provide
fault tolerance are described in FAA
Memorandum ANM–112–08–002. This
requirement is intended to minimize the
number of non-fault-tolerant features in
the design.
VerDate Mar<15>2010
15:13 Sep 05, 2014
Jkt 232001
For areas of the design where Airbus
shows that providing fault-tolerant
structural lighting-protection features is
impractical, non-fault-tolerant features
will be allowed, provided Airbus can
show that a fuel-tank vapor-ignition
event, due to the non-fault-tolerant
features, is extremely improbable when
the sum of probabilities of those events,
due to all non-fault-tolerant features, is
considered. Airbus will be required to
submit a structured, quantitative
assessment of fleet-average risk for a
fuel-tank vapor-ignition event due to all
non-fault-tolerant design features
included in the design. This will require
determination of the number of nonfault-tolerant design features, estimates
of the probability of the failure of each
non-fault-tolerant design feature, and
estimates of the exposure time for those
failures. This analysis must include
failures due to manufacturing
variability, aging, wear, corrosion, and
likely damage.
It is acceptable to consider the
probability of fuel-tank flammability,
the probability of a lightning strike to
the airplane, the probability of a
lightning strike to specific zones of the
airplane (for example, Zone 2 behind
the nacelle, but not a specific location
or feature), and a distribution of
lightning-strike amplitude in performing
the assessment, provided the associated
assumptions are acceptable to the FAA.
The analysis must account for any
dependencies among these factors, if
they are used. The assessment must also
account for operation with inoperative
features and systems, including any
proposed or anticipated dispatch relief.
This risk-assessment requirement is
intended to ensure that an acceptable
level of safety is provided given the
non-fault-tolerant features in the design.
Part 25, Appendix N, as adopted in
Amendment 25–125, in conjunction
with these special conditions,
constitutes the standard for how to
determine flammability probability. In
performing the safety analysis required
by these special conditions, relevant
§ 25.981(a)(3) compliance guidance is
still applicable. Appropriate credit for
the conditional probability of
environmental or operational conditions
occurring is normally limited to those
provisions involving multiple failures,
and this type of credit is not normally
allowed in evaluation of single failures.
However, these special conditions
would allow consideration of the
probability of occurrence of lightning
attachment and flammable conditions
when assessing the probability of
structural failures resulting in a fueltank vapor-ignition event.
PO 00000
Frm 00006
Fmt 4700
Sfmt 4700
The FAA understands that lightningprotection safety for airplane structure
is inherently different from lightning
protection for systems. We intend to
apply these special conditions only to
structural lightning-protection features
of fuel systems. We do not intend to
apply the alternative standards used
under these special conditions to other
areas of the airplane-design evaluation.
Requirements Provide Equivalent Level
of Safety
In recognition of the unusual design
feature discussed above, and the
impracticality of requiring multiple
fault tolerance for lightning protection
of certain aspects of fuel-tank structure,
the FAA has determined that a level of
safety equivalent to direct compliance
with § 25.981(a)(3) will be achieved for
the Model A350–900 airplane by
applying these requirements. The FAA
considers that, instead of only
concentrating on fault tolerance for
ignition-source prevention, significantly
reducing fuel-tank flammability
exposure, in addition to preventing
ignition sources, is a better approach to
lightning protection for the fuel tanks.
In addition, the level of average fueltank flammability achieved by
compliance with these special
conditions is low enough that it is not
appropriate or accurate to assume, in a
safety analysis, that the fuel tanks may
always be flammable.
Section 25.981(b), as amended by
Amendment 25–125, sets limits on the
allowable fuel-tank flammability for the
Model A350–900 airplane. Condition
2(a) of these special conditions applies
the more-stringent standard, for warmday flammability performance
applicable to normally emptied tanks
within the fuselage contour, from
§ 25.981(b) and part 25, Appendix M, to
all of the fuel tanks of the Model A350–
900 airplane.
Because of the more-stringent fueltank flammability requirements in these
special conditions, and because the
flammability state of a fuel tank is
independent of the various failures of
structural elements that could lead to an
ignition source in the event of lightning
attachment, the FAA has agreed that it
is appropriate in this case to allow
treatment of flammability as an
independent factor in the safety
analysis. The positive control of
flammability, and the lower
flammability that is required by these
special conditions, exceed the minimum
requirements of § 25.981(b). This offsets
a reduction of the stringent standard for
ignition-source prevention in
§ 25.981(a)(3), which assumes that the
fuel tank is flammable at all times.
E:\FR\FM\08SER1.SGM
08SER1
Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations
Given the stringent requirements for
fuel-tank flammability, the fuel-vapor
ignition prevention, and the ignitionsource prevention requirements in these
special conditions will prevent ‘‘. . .
catastrophic failure . . . due to ignition
of fuel or vapors,’’ as stated in
§ 25.981(a). Thus, the overall level of
safety achieved by these special
conditions is considered equivalent to
that which would be required by
compliance with § 25.981(a)(3) and (b).
These special conditions contain the
additional safety standards that the
Administrator considers necessary to
establish a level of safety equivalent to
that established by the existing
airworthiness standards.
Discussion of Comments
Notice of proposed special conditions
No. 25–13–36–SC for Airbus Model
A350–900 series airplanes was
published in the Federal Register on
December 19, 2013 (78 FR 76775). No
comments were received, and the
special conditions are adopted as
proposed.
Applicability
As discussed above, these special
conditions apply to Airbus Model
A350–900 series airplanes. Should
Airbus apply later for a change to the
type certificate to include another
model incorporating the same novel or
unusual design feature, the special
conditions would apply to that model as
well.
Conclusion
This action affects only certain novel
or unusual design features on the Airbus
Model A350–900 series airplanes. It is
not a rule of general applicability.
List of Subjects in 14 CFR Part 25
Aircraft, Aviation safety, Reporting
and recordkeeping requirements.
The authority citation for these
special conditions is as follows:
Authority: 49 U.S.C. 106(g), 40113, 44701,
44702, 44704.
The Special Conditions
Accordingly, pursuant to the authority
delegated to me by the Administrator,
the following special conditions are
issued as part of the type-certification
basis for Airbus Model A350–900 series
airplanes.
rmajette on DSK2TPTVN1PROD with RULES
■
1. Definitions
Most of the terms used in the special
conditions described in Alternative Fuel
Tank Structural Lightning Protection
Requirements either have the common
dictionary meaning or are defined in
Advisory Circular 25.1309–1A, System
VerDate Mar<15>2010
15:13 Sep 05, 2014
Jkt 232001
Design and Analysis, dated June 21,
1988.
The following definitions are the only
terms intended to have a specialized
meaning when used in these special
conditions:
(a) Basic Airframe Structure. Includes
design elements such as structural
members, structural joint features, and
fastener systems including airplane
skins, ribs, spars, stringers, etc., and
associated fasteners, joints, coatings,
and sealant. Basic airframe structure
may also include those structural
elements that are expected to be
removed for maintenance, such as
exterior fuel-tank access panels and
fairing-attachment features, provided
maintenance errors that could
compromise associated lightningprotection features would be evident
upon an exterior, preflight inspection of
the airplane and would be corrected
prior to flight.
(b) Permanent System-Supporting
Structure. Includes static, permanently
attached structural parts (such as
brackets) that are used to support
system elements. It does not include any
part intended to be removed, or any
joint intended to be separated, to
maintain or replace system elements or
other parts, unless that part removal or
joint separation is accepted by the FAA
as being extremely remote.
(c) Manufacturing Variability.
Includes tolerances and variability that
the design and production
specifications allow, as well as
anticipated errors or escapes from the
manufacturing and inspection
processes.
(d) Extremely Remote. Conditions that
are not anticipated to occur to each
airplane during its total life, but which
may occur a few times when
considering the total operational life of
all airplanes of one type. Extremely
remote conditions are those having an
average probability per flight hour on
the order of 1 × 10¥7 or less, but greater
than on the order of 1 × 10¥9.
(e) Extremely Improbable. Conditions
that are so unlikely that they are not
anticipated to occur during the entire
operational life of all airplanes of one
type. Extremely improbable conditions
are those having an average probability
per flight hour of the order of 1 × 10¥9
or less.
2. Alternative Fuel-Tank Structural
Lightning-Protection Requirements
For lightning-protection features that
are integral to fuel-tank basic airframe
structure or permanent systemsupporting structure, as defined in this
these special conditions Definitions, for
which Airbus shows and the FAA finds
PO 00000
Frm 00007
Fmt 4700
Sfmt 4700
53133
compliance with § 25.981(a)(3) to be
impractical, the following requirements
may be applied in lieu of the
requirements of § 25.981(a)(3):
(a) Airbus must show that the airplane
design meets the requirements of part
25, Appendix M, as amended by
Amendment 25–125, for all fuel tanks
installed on the airplane.
(b) Airbus must show that the design
includes at least two independent,
effective, and reliable lightningprotection features (or sets of features)
such that fault tolerance to prevent
lightning-related ignition sources is
provided for each area of the structural
design to be shown compliant with
these special conditions in lieu of
compliance with the requirements of
§ 25.981(a)(3). Fault tolerance is not
required for any specific design feature
if:
(1) For that feature, providing fault
tolerance is shown to be impractical,
and
(2) Fuel-tank vapor ignition due to
that feature and all other non-faulttolerant features, when their fuel-tank
vapor-ignition event probabilities are
summed, is shown to be extremely
improbable.
(c) Airbus must perform an analysis to
show that the design, manufacturing
processes, and airworthiness limitations
section of the instructions for continued
airworthiness include all practical
measures to prevent, and detect and
correct, failures of structural lightningprotection features due to
manufacturing variability, aging, wear,
corrosion, and likely damage.
Issued in Renton, Washington, on August
15, 2014.
Jeffrey E. Duven,
Transport Airplane Directorate, Aircraft
Certification Service.
[FR Doc. 2014–21245 Filed 9–5–14; 8:45 am]
BILLING CODE 4910–13–P
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Food and Drug Administration
21 CFR Parts 310, 314, 329, and 600
[Docket No. FDA–2008–N–0334]
RIN 0910–AF96
Postmarketing Safety Reports for
Human Drug and Biological Products;
Electronic Submission Requirements;
Correction
AGENCY:
Food and Drug Administration,
HHS.
ACTION:
E:\FR\FM\08SER1.SGM
Final rule; correction.
08SER1
]]>Agencies
[Federal Register Volume 79, Number 173 (Monday, September 8, 2014)]
[Rules and Regulations]
[Pages 53129-53133]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2014-21245]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Part 25
[Docket No. FAA-2013-1002; Special Conditions No. 25-530-SC]
Special Conditions: Airbus Model A350-900 Airplane; Lightning
Protection of Fuel-Tank Structure To Prevent Fuel-Tank Vapor Ignition
AGENCY: Federal Aviation Administration (FAA), DOT.
ACTION: Final special conditions.
-----------------------------------------------------------------------
SUMMARY: These special conditions are issued for Airbus Model A350-900
airplanes.
These airplanes will have a novel or unusual design feature that
will incorporate a nitrogen generation system (NGS) for all fuel tanks,
to actively reduce flammability exposure within the fuel tanks
significantly below that required by the fuel-tank flammability
regulations. Among other benefits, the NGS significantly reduces the
potential for fuel-vapor ignition caused by lightning strikes. The
applicable airworthiness regulations do not contain adequate or
appropriate safety standards for this design feature. These special
conditions contain the additional safety standards that the
Administrator considers necessary to establish a level of safety
equivalent to that established by the existing airworthiness standards.
DATES: Effective Date: October 8, 2014.
[[Page 53130]]
FOR FURTHER INFORMATION CONTACT: Doug Bryant, Propulsion/Mechanical
Systems, ANM-112, Transport Airplane Directorate, Aircraft
Certification Service, 1601 Lind Avenue SW., Renton, Washington 98057-
3356; telephone (425) 227-2384; facsimile (425) 227-1320.
SUPPLEMENTARY INFORMATION:
Background
On August 25, 2008, Airbus applied for a type certificate for their
new Model A350-900 airplane. Later, Airbus requested, and the FAA
approved, an extension to the application for FAA type certification to
November 15, 2009. The Model A350-900 airplane has a conventional
layout with twin wing-mounted Rolls-Royce Trent XWB engines. It
features a twin-aisle, 9-abreast, economy-class layout, and
accommodates side-by-side placement of LD-3 containers in the cargo
compartment. The basic Model A350-900 airplane configuration
accommodates 315 passengers in a standard two-class arrangement. The
design cruise speed is Mach 0.85 with a maximum take-off weight of
602,000 lbs. The Model A350-900 series airplane has a composite wing
and fuel-tank structure constructed of carbon-fiber-reinforced plastic
materials.
Type Certification Basis
Under Title 14, Code of Federal Regulations (14 CFR) 21.17, Airbus
must show that the Model A350-900 airplane meets the applicable
provisions of 14 CFR part 25, as amended by Amendments 25-1 through 25-
129.
If the Administrator finds that the applicable airworthiness
regulations (i.e., 14 CFR part 25) do not contain adequate or
appropriate safety standards for the Model A350-900 airplane because of
a novel or unusual design feature, special conditions are prescribed
under Sec. 21.16.
Special conditions are initially applicable to the model for which
they are issued. Should the type certificate for that model be amended
later to include any other model that incorporates the same novel or
unusual design feature, the special conditions would also apply to the
other model under Sec. 21.101.
In addition to the applicable airworthiness regulations and special
conditions, the Model A350-900 airplane must comply with the fuel-vent
and exhaust-emission requirements of 14 CFR part 34, and the noise-
certification requirements of 14 CFR part 36. The FAA must issue a
finding of regulatory adequacy under Sec. 611 of Public Law 92-574,
the ``Noise Control Act of 1972.''
The FAA issues special conditions, as defined in 14 CFR 11.19,
under Sec. 11.38, and they become part of the type-certification basis
under Sec. 21.17(a)(2).
Novel or Unusual Design Features
The Airbus Model A350-900 airplane will incorporate the following
novel or unusual design features: Fuel-tank NGS that is intended to
control fuel-tank flammability for all fuel tanks. This NGS is designed
to provide a level of performance that applies the more stringent
standard for warm-day flammability performance applicable to normally
emptied tanks within the fuselage contour from Sec. 25.981(b), and 14
CFR part 25 appendix M, to all fuel tanks of the Model A350-900
airplane. This high level of NGS performance for all fuel tanks is a
novel or unusual design feature not envisioned at the time the
regulations applying to the Model A350-900 airplane certification basis
were issued.
Discussion
The certification basis of the Airbus Model A350-900 airplane
includes Sec. 25.981, as amended by Amendment 25-125, as required by
14 CFR 26.37. This amendment includes the ignition-prevention
requirements in Sec. 25.981(a), as amended by Amendment 25-102. It
includes revised flammability limits for all fuel tanks, and new
specific limitations on flammability for all fuel tanks as defined in
Sec. 25.981(b), as amended by Amendment 25-125.
Ignition Source Prevention
Section 25.981(a)(3) requires applicants to show that an ignition
source in the fuel-tank system could not result from any single
failure, from any single failure in combination with any latent failure
condition not shown to be extremely remote, or from any combination of
failures not shown to be extremely improbable. This requirement was
originally adopted in Amendment 25-102, and it requires the assumption
that the fuel tanks are always flammable when showing that the
probability of an ignition source being present is extremely remote.
(Amendment 25-102 included Sec. 25.981(c), which required minimizing
fuel-tank flammability, and this was defined in the preamble as being
equivalent to unheated aluminum fuel tanks located in the wing.) This
requirement defines three types of scenarios that must be addressed to
show compliance with Sec. 25.981(a)(3). The first scenario is that any
single failure, regardless of the probability of occurrence of the
failure, must not cause an ignition source. The second scenario is that
any single failure, regardless of the probability of occurrence, in
combination with any latent failure condition not shown to be at least
extremely remote, must not cause an ignition source. The third scenario
is that any combination of failures not shown to be extremely
improbable must not cause an ignition source. Demonstration of
compliance with this requirement would typically require a structured,
quantitative safety analysis. Design areas that have latent failure
conditions typically would be driven by these requirements to have
multiple fault tolerance, or ``triple redundancy.'' This means that
ignition sources are still prevented even after two independent
failures.
Flammability Limits
Section 25.981(b) states that no fuel-tank fleet-average
flammability exposure may exceed 3 percent of the flammability-exposure
evaluation time calculated using the method in part 25, Appendix N, or
the fleet-average flammability of a fuel tank within the wing of the
airplane being evaluated, whichever is greater. If the wing is not a
conventional, unheated aluminum wing, the analysis must be based on an
assumed equivalent, conventional construction, unheated, aluminum wing.
In addition, for fuel tanks that are normally emptied during operation
and that have any part of the tank located within the fuselage contour,
the fleet-average flammability for warm days (above 80 [deg]F) must be
limited to 3 percent, as calculated using the method in part 25,
Appendix M.
Application of Existing Regulations Inappropriate Due to Impracticality
Since the issuance of Sec. 25.981(a)(3), as amended by Amendment
25-102, the FAA has conducted certification projects in which
applicants found it impractical to meet the requirements of that
regulation for some areas of lightning protection for fuel tank
structure. Partial exemptions were issued for these projects. These
same difficulties exist for the Airbus Model A350-900 airplane project.
The difficulty of designing multiple-fault-tolerant structure, and
the difficulty of detecting failures of hidden structural-design
features in general, makes compliance with Sec. 25.981(a)(3) uniquely
challenging and impractical for certain aspects of the electrical
bonding of structural elements. Such bonding is needed to prevent
occurrence of fuel-tank ignition sources from lightning strikes. The
effectiveness and fault tolerance of electrical-bonding
[[Page 53131]]
features for structural joints and fasteners is partially dependent on
design features that cannot be effectively inspected or tested after
assembly without damaging the structure, joint, or fastener. Examples
of such features include a required interference fit between the shank
of a fastener and the hole in which the fastener is installed; metal
foil or mesh imbedded in composite material; a required clamping force
provided by a fastener to pull two structural parts together; and a
required faying surface bond between the flush surfaces of adjacent
pieces of structural material, such as in a wing-skin joint, or a
mounting-bracket installation. In addition, other features that
physically can be inspected or tested may be located within the fuel
tanks. Therefore, it is not practical to inspect for failures of those
features at short intervals. Examples of such failures include
separation or loosening of cap seals over fastener ends, and actual
structural failures of internal fasteners. This inability to
practically detect manufacturing errors and failures of structural-
design features critical to lightning protection results in degraded
conditions that occur and remain in place for a very long time,
possibly for the remaining life of the airplane. The complex
construction techniques associated with composite structure can make
these aspects particularly challenging.
Accounting for such long failure-latency periods in the system
safety analysis, required by Sec. 25.981(a)(3), would require multiple
fault tolerance in the structural lightning-protection design. As part
of the design-development activity for the Model A350-900 airplane,
Airbus has examined possible design provisions to provide multiple
fault tolerance in the structural design to prevent ignition sources
from occurring in the event of lightning attachment to the airplane in
critical locations. Airbus has concluded from this examination that
providing multiple fault tolerance for some structural elements is not
practical. Airbus has also identified some areas of the Model A350-900
airplane design where it is impractical to provide even single-fault
tolerance in the structural design to prevent ignition sources from
occurring in the event of lightning attachment after a single failure.
The FAA has reviewed this examination with Airbus in detail and has
agreed that providing fault tolerance beyond that in the Model A350-900
airplane design for these areas would be impractical.
As a result of the Airbus Model A350-900 airplane and other
certification projects, the FAA has now determined that compliance with
Sec. 25.981(a)(3) is impractical for some areas of lightning
protection for fuel-tank structure, and that application of Sec.
25.981(a)(3) to those design areas is therefore inappropriate. The FAA
plans further rulemaking to revise Sec. 25.981(a)(3). As appropriate,
the FAA plans to issue special conditions or exemptions for
certification projects progressing before the revision is complete.
This is discussed in FAA Memorandum ANM-112-08-002, Policy on Issuance
of Special Conditions and Exemptions Related to Lightning Protection of
Fuel Tank Structure, dated May 26, 2009.\1\
---------------------------------------------------------------------------
\1\ The memorandum may be viewed at: https://www.airweb.faa.gov/
RegulatoryandGuidanceLibrary/
rgPolicy.nsf/0/
12350AE62D393B7A862575C300709CA3?OpenDocument&Highlight=anm-112-08-
002
---------------------------------------------------------------------------
Application of Existing Regulations Inappropriate Due to Compensating
Feature That Provides Equivalent Level of Safety
Section 25.981(b) sets specific standards for fuel-tank
flammability as discussed above under ``Flammability Limits.'' Under
that regulation, the fleet-average flammability exposure of all fuel
tanks on the Model A350-900 airplane may not exceed 3 percent of the
flammability-exposure evaluation time calculated using the method in
part 25, Appendix N, or the fleet-average flammability of a wing main
tank within an equivalent construction, conventional, unheated,
aluminum wing fuel tank, whichever is greater. The typical fleet-
average fuel-tank flammability of fuel tanks located in the wing ranges
between 1 and 5 percent. If it is assumed that a Model A350-900
airplane equivalent, conventional, unheated, aluminum wing fuel tank
would not exceed a fleet-average flammability time of 3 percent, the
actual composite Model A350-900 airplane wing-fuel-tank design would be
required to comply with the 3 percent fleet average flammability
standard, and therefore a means to reduce the flammability to 3 percent
would be required. However, the Model A350-900 airplane design includes
NGS for all fuel tanks that will also be shown to meet the additional,
more-stringent warm-day average flammability standard in part 25,
Appendix M, which is only required for normally emptied fuel tanks with
some part of the tank within the fuselage contour. Fuel tanks that meet
this requirement typically have average fuel-tank flammability levels
well below the required 3 percent.
Since the NGS for all fuel tanks on the Model A350-900 airplane
provides performance that meets part 25, Appendix M, the FAA has
determined that the risk reduction provided by this additional
performance will provide compensation for some relief from the
ignition-prevention requirements of Sec. 25.981(a)(3) while still
establishing a level of safety equivalent to that established in the
regulations.
In determining the appropriate amount of relief from the ignition-
prevention requirements of Sec. 25.981(a), the FAA considered the
original overall intent of Amendment 25-102, which was to ensure the
prevention of catastrophic events due to fuel-tank vapor explosion.
These special conditions are intended to achieve that objective through
a prescriptive requirement that fault tolerance (with respect to the
creation of an ignition source) be provided for all structural
lightning protection design features where providing such fault
tolerance is practical, and through a performance-based standard for
the risk due to any single-failure vulnerability that exists in the
design. In addition, for any structural lightning-protection design
features for which Airbus shows that providing fault tolerance is
impractical, these special conditions require Airbus to show that a
fuel-tank vapor-ignition event, due to the summed risk of all non-
fault-tolerant design features, is extremely improbable. Airbus would
be required to show that the design meets this safety objective using a
structured system-safety assessment similar to that currently used for
demonstrating compliance with Sec. Sec. 25.901 and 25.1309.
Given these novel or unusual design features, and the compliance
challenges noted earlier in this document, the FAA has determined that
application of Sec. 25.981(a)(3) is inappropriate in that it is
neither practical nor necessary to apply the ignition-source-prevention
provisions of Sec. 25.981(a)(3) to the specific fuel-tank structural
lightning-protection features of the Airbus Model A350-900 airplane.
However, without the Sec. 25.981(a)(3) provisions, the remaining
applicable regulations in the Model A350-900 airplane certification
basis would be inadequate to set an appropriate standard for fuel-tank
ignition prevention. Therefore, in accordance with provisions of Sec.
21.16, the FAA has determined that, instead of Sec. 25.981(a)(3),
alternative fuel-tank structural lighting-protection requirements be
applied to fuel-tank lightning-protection features that are integral to
the airframe structure of the
[[Page 53132]]
Model A350-900 airplane. These alternative requirements are intended to
provide the level of safety intended by Sec. 25.981(a)(3), based on
our recognition, as discussed above, that a highly effective NGS for
the fuel tanks makes it unnecessary to assume that the fuel tank is
always flammable. As discussed previously, the assumption that the fuel
tanks are always flammable was required when demonstrating compliance
to the ignition-prevention requirements of Sec. 25.981(a)(3).
One resulting difference between these special conditions and the
Sec. 25.981(a)(3) provisions they are meant to replace is the outcome
being prevented--fuel-vapor ignition versus an ignition source. These
special conditions acknowledge that the application of fuel-tank-
flammability performance standards will reduce fuel-tank flammability
to an extent that it is appropriate to consider the beneficial effects
of flammability reduction when considering design areas where it is
impractical to comply with Sec. 25.981(a)(3).
One of the core requirements of these special conditions is a
prescriptive requirement that structural lightning-protection design
features must be fault tolerant. (An exception, wherein Airbus can show
that providing fault tolerance is impractical, and associated
requirements, is discussed below.) The other core requirement is that
Airbus must show that the design, manufacturing processes, and
Airworthiness Limitations section of the Instructions for Continued
Airworthiness include all practical measures to prevent, and detect and
correct, failures of structural-lightning protection features due to
manufacturing variability, aging, wear, corrosion, and likely damage.
The FAA has determined that, if these core requirements are met, a
fuel-tank vapor-ignition event, due to lightning, is not anticipated to
occur in the life of the airplane fleet. This conclusion is based on
the fact that a critical lightning strike to any given airplane is
itself a remote event, and on the fact that fuel tanks must be shown to
be flammable only for a relatively small portion of the fleet
operational life.
For any non-fault-tolerant features in the design, Airbus must show
that eliminating these features or making them fault tolerant is
impractical. The requirements and considerations for showing it is
impractical to provide fault tolerance are described in FAA Memorandum
ANM-112-08-002. This requirement is intended to minimize the number of
non-fault-tolerant features in the design.
For areas of the design where Airbus shows that providing fault-
tolerant structural lighting-protection features is impractical, non-
fault-tolerant features will be allowed, provided Airbus can show that
a fuel-tank vapor-ignition event, due to the non-fault-tolerant
features, is extremely improbable when the sum of probabilities of
those events, due to all non-fault-tolerant features, is considered.
Airbus will be required to submit a structured, quantitative assessment
of fleet-average risk for a fuel-tank vapor-ignition event due to all
non-fault-tolerant design features included in the design. This will
require determination of the number of non-fault-tolerant design
features, estimates of the probability of the failure of each non-
fault-tolerant design feature, and estimates of the exposure time for
those failures. This analysis must include failures due to
manufacturing variability, aging, wear, corrosion, and likely damage.
It is acceptable to consider the probability of fuel-tank
flammability, the probability of a lightning strike to the airplane,
the probability of a lightning strike to specific zones of the airplane
(for example, Zone 2 behind the nacelle, but not a specific location or
feature), and a distribution of lightning-strike amplitude in
performing the assessment, provided the associated assumptions are
acceptable to the FAA. The analysis must account for any dependencies
among these factors, if they are used. The assessment must also account
for operation with inoperative features and systems, including any
proposed or anticipated dispatch relief. This risk-assessment
requirement is intended to ensure that an acceptable level of safety is
provided given the non-fault-tolerant features in the design.
Part 25, Appendix N, as adopted in Amendment 25-125, in conjunction
with these special conditions, constitutes the standard for how to
determine flammability probability. In performing the safety analysis
required by these special conditions, relevant Sec. 25.981(a)(3)
compliance guidance is still applicable. Appropriate credit for the
conditional probability of environmental or operational conditions
occurring is normally limited to those provisions involving multiple
failures, and this type of credit is not normally allowed in evaluation
of single failures. However, these special conditions would allow
consideration of the probability of occurrence of lightning attachment
and flammable conditions when assessing the probability of structural
failures resulting in a fuel-tank vapor-ignition event.
The FAA understands that lightning-protection safety for airplane
structure is inherently different from lightning protection for
systems. We intend to apply these special conditions only to structural
lightning-protection features of fuel systems. We do not intend to
apply the alternative standards used under these special conditions to
other areas of the airplane-design evaluation.
Requirements Provide Equivalent Level of Safety
In recognition of the unusual design feature discussed above, and
the impracticality of requiring multiple fault tolerance for lightning
protection of certain aspects of fuel-tank structure, the FAA has
determined that a level of safety equivalent to direct compliance with
Sec. 25.981(a)(3) will be achieved for the Model A350-900 airplane by
applying these requirements. The FAA considers that, instead of only
concentrating on fault tolerance for ignition-source prevention,
significantly reducing fuel-tank flammability exposure, in addition to
preventing ignition sources, is a better approach to lightning
protection for the fuel tanks. In addition, the level of average fuel-
tank flammability achieved by compliance with these special conditions
is low enough that it is not appropriate or accurate to assume, in a
safety analysis, that the fuel tanks may always be flammable.
Section 25.981(b), as amended by Amendment 25-125, sets limits on
the allowable fuel-tank flammability for the Model A350-900 airplane.
Condition 2(a) of these special conditions applies the more-stringent
standard, for warm-day flammability performance applicable to normally
emptied tanks within the fuselage contour, from Sec. 25.981(b) and
part 25, Appendix M, to all of the fuel tanks of the Model A350-900
airplane.
Because of the more-stringent fuel-tank flammability requirements
in these special conditions, and because the flammability state of a
fuel tank is independent of the various failures of structural elements
that could lead to an ignition source in the event of lightning
attachment, the FAA has agreed that it is appropriate in this case to
allow treatment of flammability as an independent factor in the safety
analysis. The positive control of flammability, and the lower
flammability that is required by these special conditions, exceed the
minimum requirements of Sec. 25.981(b). This offsets a reduction of
the stringent standard for ignition-source prevention in Sec.
25.981(a)(3), which assumes that the fuel tank is flammable at all
times.
[[Page 53133]]
Given the stringent requirements for fuel-tank flammability, the
fuel-vapor ignition prevention, and the ignition-source prevention
requirements in these special conditions will prevent ``. . .
catastrophic failure . . . due to ignition of fuel or vapors,'' as
stated in Sec. 25.981(a). Thus, the overall level of safety achieved
by these special conditions is considered equivalent to that which
would be required by compliance with Sec. 25.981(a)(3) and (b).
These special conditions contain the additional safety standards
that the Administrator considers necessary to establish a level of
safety equivalent to that established by the existing airworthiness
standards.
Discussion of Comments
Notice of proposed special conditions No. 25-13-36-SC for Airbus
Model A350-900 series airplanes was published in the Federal Register
on December 19, 2013 (78 FR 76775). No comments were received, and the
special conditions are adopted as proposed.
Applicability
As discussed above, these special conditions apply to Airbus Model
A350-900 series airplanes. Should Airbus apply later for a change to
the type certificate to include another model incorporating the same
novel or unusual design feature, the special conditions would apply to
that model as well.
Conclusion
This action affects only certain novel or unusual design features
on the Airbus Model A350-900 series airplanes. It is not a rule of
general applicability.
List of Subjects in 14 CFR Part 25
Aircraft, Aviation safety, Reporting and recordkeeping
requirements.
The authority citation for these special conditions is as follows:
Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.
The Special Conditions
0
Accordingly, pursuant to the authority delegated to me by the
Administrator, the following special conditions are issued as part of
the type-certification basis for Airbus Model A350-900 series
airplanes.
1. Definitions
Most of the terms used in the special conditions described in
Alternative Fuel Tank Structural Lightning Protection Requirements
either have the common dictionary meaning or are defined in Advisory
Circular 25.1309-1A, System Design and Analysis, dated June 21, 1988.
The following definitions are the only terms intended to have a
specialized meaning when used in these special conditions:
(a) Basic Airframe Structure. Includes design elements such as
structural members, structural joint features, and fastener systems
including airplane skins, ribs, spars, stringers, etc., and associated
fasteners, joints, coatings, and sealant. Basic airframe structure may
also include those structural elements that are expected to be removed
for maintenance, such as exterior fuel-tank access panels and fairing-
attachment features, provided maintenance errors that could compromise
associated lightning-protection features would be evident upon an
exterior, preflight inspection of the airplane and would be corrected
prior to flight.
(b) Permanent System-Supporting Structure. Includes static,
permanently attached structural parts (such as brackets) that are used
to support system elements. It does not include any part intended to be
removed, or any joint intended to be separated, to maintain or replace
system elements or other parts, unless that part removal or joint
separation is accepted by the FAA as being extremely remote.
(c) Manufacturing Variability. Includes tolerances and variability
that the design and production specifications allow, as well as
anticipated errors or escapes from the manufacturing and inspection
processes.
(d) Extremely Remote. Conditions that are not anticipated to occur
to each airplane during its total life, but which may occur a few times
when considering the total operational life of all airplanes of one
type. Extremely remote conditions are those having an average
probability per flight hour on the order of 1 x 10-\7\ or
less, but greater than on the order of 1 x 10-\9\.
(e) Extremely Improbable. Conditions that are so unlikely that they
are not anticipated to occur during the entire operational life of all
airplanes of one type. Extremely improbable conditions are those having
an average probability per flight hour of the order of 1 x
10-\9\ or less.
2. Alternative Fuel-Tank Structural Lightning-Protection Requirements
For lightning-protection features that are integral to fuel-tank
basic airframe structure or permanent system-supporting structure, as
defined in this these special conditions Definitions, for which Airbus
shows and the FAA finds compliance with Sec. 25.981(a)(3) to be
impractical, the following requirements may be applied in lieu of the
requirements of Sec. 25.981(a)(3):
(a) Airbus must show that the airplane design meets the
requirements of part 25, Appendix M, as amended by Amendment 25-125,
for all fuel tanks installed on the airplane.
(b) Airbus must show that the design includes at least two
independent, effective, and reliable lightning-protection features (or
sets of features) such that fault tolerance to prevent lightning-
related ignition sources is provided for each area of the structural
design to be shown compliant with these special conditions in lieu of
compliance with the requirements of Sec. 25.981(a)(3). Fault tolerance
is not required for any specific design feature if:
(1) For that feature, providing fault tolerance is shown to be
impractical, and
(2) Fuel-tank vapor ignition due to that feature and all other non-
fault-tolerant features, when their fuel-tank vapor-ignition event
probabilities are summed, is shown to be extremely improbable.
(c) Airbus must perform an analysis to show that the design,
manufacturing processes, and airworthiness limitations section of the
instructions for continued airworthiness include all practical measures
to prevent, and detect and correct, failures of structural lightning-
protection features due to manufacturing variability, aging, wear,
corrosion, and likely damage.
Issued in Renton, Washington, on August 15, 2014.
Jeffrey E. Duven,
Transport Airplane Directorate, Aircraft Certification Service.
[FR Doc. 2014-21245 Filed 9-5-14; 8:45 am]
BILLING CODE 4910-13-P
