Special Conditions: Airbus Model A350-900 Airplane; Lightning Protection of Fuel-Tank Structure To Prevent Fuel-Tank Vapor Ignition, 53129-53133 [2014-21245]

Download as PDF Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations The digital systems architecture for the Airbus Model A350–900 airplane is composed of several connected networks. This network architecture is used for a diverse set of functions, providing data connectivity between systems, including: 1. Airplane control, communication, display, monitoring and navigation systems, 2. Operator business and administrative support systems, 3. Passenger entertainment systems, and 4. Access by systems external to the airplane. rmajette on DSK2TPTVN1PROD with RULES Discussion The Airbus Model A350–900 airplane network architecture and configuration may allow increased connectivity to, and access from, external network sources, and operator operations and maintenance networks to the airplane control domain and operatorinformation-services domain. The airplane-control domain and operatorinformation-services domain perform functions required for the safe operation and maintenance of the airplane. Previously, these domains had very limited connectivity with external network sources. The network architecture and configuration may allow the exploitation of networksecurity vulnerabilities resulting in intentional or unintentional destruction, disruption, degradation, or exploitation of data, systems, and networks critical to the safety and maintenance of the airplane. The existing regulations and guidance material did not anticipate these types of airplane system architectures. Furthermore, 14 CFR regulations and current system-safety assessment policy and techniques do not address potential security vulnerabilities, which could be exploited by unauthorized access to airplane networks, data buses, and servers. Therefore, these special conditions are to ensure that unauthorized wired or wireless electronic connections do not compromise the security (i.e., confidentiality, integrity, and availability) of airplane systems. These special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards. Discussion of Comments Notice of proposed special conditions No. 25–13–17–SC for the Airbus Model A350–900 airplane was published in the VerDate Mar<15>2010 15:13 Sep 05, 2014 Jkt 232001 Federal Register on December 17, 2013 (78 FR 76251) Comment From Airbus Airbus had one comment about the following wording of the first paragraph of the Proposed Special Conditions: The applicant must ensure airplane electronic system security protection from access to or by unauthorized sources external to the airplane, including those possibly caused by maintenance activity. Airbus considers that the wording ‘‘to or by’’ is incorrect. The protection must prevent access from unauthorized sources external to the airplane only. The requirement of protection to unauthorized sources external to the airplane, is not relevant. Therefore, Airbus suggests that the wording be modified as follows: The applicant must ensure airplane electronic system security protection from access by unauthorized sources external to the airplane, including those possibly caused by maintenance activity. 53129 external to the airplane, including those possibly caused by maintenance activity. 2. The applicant must ensure that electronic system-security threats are identified and assessed, and that effective electronic system-security protection strategies are implemented to protect the airplane from all adverse impacts on safety, functionality, and continued airworthiness. 3. The applicant must establish appropriate procedures to allow the operator to ensure that continued airworthiness of the airplane is maintained, including all post-typecertification modifications that may have an impact on the approved electronic system-security safeguards. Issued in Renton, Washington, on August 15, 2014. Jeffrey E. Duven, Manager, Transport Airplane Directorate, Aircraft Certification Service. [FR Doc. 2014–21243 Filed 9–5–14; 8:45 am] BILLING CODE 4910–13–P FAA Response The FAA agrees with Airbus and has changed the special conditions accordingly. DEPARTMENT OF TRANSPORTATION Applicability As discussed above, these special conditions apply to Airbus Model A350–900 series airplanes. Should Airbus apply later for a change to the type certificate to include another model incorporating the same novel or unusual design feature, the special conditions would apply to that model as well. [Docket No. FAA–2013–1002; Special Conditions No. 25–530–SC] Conclusion This action affects only certain novel or unusual design features on the Airbus Model A350–900 series airplanes. It is not a rule of general applicability. List of Subjects in 14 CFR Part 25 Aircraft, Aviation safety, Reporting and recordkeeping requirements. The authority citation for these special conditions is as follows: Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704. The Special Conditions Accordingly, pursuant to the authority delegated to me by the Administrator, the following special conditions are issued as part of the type-certification basis for Airbus Model A350–900 series airplanes. 1. The applicant must ensure airplane electronic system-security protection from access by unauthorized sources ■ PO 00000 Frm 00003 Fmt 4700 Sfmt 4700 Federal Aviation Administration 14 CFR Part 25 Special Conditions: Airbus Model A350–900 Airplane; Lightning Protection of Fuel-Tank Structure To Prevent Fuel-Tank Vapor Ignition Federal Aviation Administration (FAA), DOT. ACTION: Final special conditions. AGENCY: These special conditions are issued for Airbus Model A350–900 airplanes. These airplanes will have a novel or unusual design feature that will incorporate a nitrogen generation system (NGS) for all fuel tanks, to actively reduce flammability exposure within the fuel tanks significantly below that required by the fuel-tank flammability regulations. Among other benefits, the NGS significantly reduces the potential for fuel-vapor ignition caused by lightning strikes. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for this design feature. These special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards. DATES: Effective Date: October 8, 2014. SUMMARY: E:\FR\FM\08SER1.SGM 08SER1 53130 Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations FOR FURTHER INFORMATION CONTACT: Doug Bryant, Propulsion/Mechanical Systems, ANM–112, Transport Airplane Directorate, Aircraft Certification Service, 1601 Lind Avenue SW., Renton, Washington 98057–3356; telephone (425) 227–2384; facsimile (425) 227–1320. SUPPLEMENTARY INFORMATION: Background On August 25, 2008, Airbus applied for a type certificate for their new Model A350–900 airplane. Later, Airbus requested, and the FAA approved, an extension to the application for FAA type certification to November 15, 2009. The Model A350–900 airplane has a conventional layout with twin wingmounted Rolls-Royce Trent XWB engines. It features a twin-aisle, 9abreast, economy-class layout, and accommodates side-by-side placement of LD–3 containers in the cargo compartment. The basic Model A350– 900 airplane configuration accommodates 315 passengers in a standard two-class arrangement. The design cruise speed is Mach 0.85 with a maximum take-off weight of 602,000 lbs. The Model A350–900 series airplane has a composite wing and fueltank structure constructed of carbonfiber-reinforced plastic materials. rmajette on DSK2TPTVN1PROD with RULES Type Certification Basis Under Title 14, Code of Federal Regulations (14 CFR) 21.17, Airbus must show that the Model A350–900 airplane meets the applicable provisions of 14 CFR part 25, as amended by Amendments 25–1 through 25–129. If the Administrator finds that the applicable airworthiness regulations (i.e., 14 CFR part 25) do not contain adequate or appropriate safety standards for the Model A350–900 airplane because of a novel or unusual design feature, special conditions are prescribed under § 21.16. Special conditions are initially applicable to the model for which they are issued. Should the type certificate for that model be amended later to include any other model that incorporates the same novel or unusual design feature, the special conditions would also apply to the other model under § 21.101. In addition to the applicable airworthiness regulations and special conditions, the Model A350–900 airplane must comply with the fuel-vent and exhaust-emission requirements of 14 CFR part 34, and the noisecertification requirements of 14 CFR part 36. The FAA must issue a finding of regulatory adequacy under § 611 of VerDate Mar<15>2010 15:13 Sep 05, 2014 Jkt 232001 Public Law 92–574, the ‘‘Noise Control Act of 1972.’’ The FAA issues special conditions, as defined in 14 CFR 11.19, under § 11.38, and they become part of the typecertification basis under § 21.17(a)(2). Novel or Unusual Design Features The Airbus Model A350–900 airplane will incorporate the following novel or unusual design features: Fuel-tank NGS that is intended to control fuel-tank flammability for all fuel tanks. This NGS is designed to provide a level of performance that applies the more stringent standard for warm-day flammability performance applicable to normally emptied tanks within the fuselage contour from § 25.981(b), and 14 CFR part 25 appendix M, to all fuel tanks of the Model A350–900 airplane. This high level of NGS performance for all fuel tanks is a novel or unusual design feature not envisioned at the time the regulations applying to the Model A350–900 airplane certification basis were issued. Discussion The certification basis of the Airbus Model A350–900 airplane includes § 25.981, as amended by Amendment 25–125, as required by 14 CFR 26.37. This amendment includes the ignitionprevention requirements in § 25.981(a), as amended by Amendment 25–102. It includes revised flammability limits for all fuel tanks, and new specific limitations on flammability for all fuel tanks as defined in § 25.981(b), as amended by Amendment 25–125. Ignition Source Prevention Section 25.981(a)(3) requires applicants to show that an ignition source in the fuel-tank system could not result from any single failure, from any single failure in combination with any latent failure condition not shown to be extremely remote, or from any combination of failures not shown to be extremely improbable. This requirement was originally adopted in Amendment 25–102, and it requires the assumption that the fuel tanks are always flammable when showing that the probability of an ignition source being present is extremely remote. (Amendment 25–102 included § 25.981(c), which required minimizing fuel-tank flammability, and this was defined in the preamble as being equivalent to unheated aluminum fuel tanks located in the wing.) This requirement defines three types of scenarios that must be addressed to show compliance with § 25.981(a)(3). The first scenario is that any single failure, regardless of the probability of occurrence of the failure, must not cause PO 00000 Frm 00004 Fmt 4700 Sfmt 4700 an ignition source. The second scenario is that any single failure, regardless of the probability of occurrence, in combination with any latent failure condition not shown to be at least extremely remote, must not cause an ignition source. The third scenario is that any combination of failures not shown to be extremely improbable must not cause an ignition source. Demonstration of compliance with this requirement would typically require a structured, quantitative safety analysis. Design areas that have latent failure conditions typically would be driven by these requirements to have multiple fault tolerance, or ‘‘triple redundancy.’’ This means that ignition sources are still prevented even after two independent failures. Flammability Limits Section 25.981(b) states that no fueltank fleet-average flammability exposure may exceed 3 percent of the flammability-exposure evaluation time calculated using the method in part 25, Appendix N, or the fleet-average flammability of a fuel tank within the wing of the airplane being evaluated, whichever is greater. If the wing is not a conventional, unheated aluminum wing, the analysis must be based on an assumed equivalent, conventional construction, unheated, aluminum wing. In addition, for fuel tanks that are normally emptied during operation and that have any part of the tank located within the fuselage contour, the fleetaverage flammability for warm days (above 80 °F) must be limited to 3 percent, as calculated using the method in part 25, Appendix M. Application of Existing Regulations Inappropriate Due to Impracticality Since the issuance of § 25.981(a)(3), as amended by Amendment 25–102, the FAA has conducted certification projects in which applicants found it impractical to meet the requirements of that regulation for some areas of lightning protection for fuel tank structure. Partial exemptions were issued for these projects. These same difficulties exist for the Airbus Model A350–900 airplane project. The difficulty of designing multiplefault-tolerant structure, and the difficulty of detecting failures of hidden structural-design features in general, makes compliance with § 25.981(a)(3) uniquely challenging and impractical for certain aspects of the electrical bonding of structural elements. Such bonding is needed to prevent occurrence of fuel-tank ignition sources from lightning strikes. The effectiveness and fault tolerance of electrical-bonding E:\FR\FM\08SER1.SGM 08SER1 rmajette on DSK2TPTVN1PROD with RULES Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations features for structural joints and fasteners is partially dependent on design features that cannot be effectively inspected or tested after assembly without damaging the structure, joint, or fastener. Examples of such features include a required interference fit between the shank of a fastener and the hole in which the fastener is installed; metal foil or mesh imbedded in composite material; a required clamping force provided by a fastener to pull two structural parts together; and a required faying surface bond between the flush surfaces of adjacent pieces of structural material, such as in a wing-skin joint, or a mounting-bracket installation. In addition, other features that physically can be inspected or tested may be located within the fuel tanks. Therefore, it is not practical to inspect for failures of those features at short intervals. Examples of such failures include separation or loosening of cap seals over fastener ends, and actual structural failures of internal fasteners. This inability to practically detect manufacturing errors and failures of structural-design features critical to lightning protection results in degraded conditions that occur and remain in place for a very long time, possibly for the remaining life of the airplane. The complex construction techniques associated with composite structure can make these aspects particularly challenging. Accounting for such long failurelatency periods in the system safety analysis, required by § 25.981(a)(3), would require multiple fault tolerance in the structural lightning-protection design. As part of the designdevelopment activity for the Model A350–900 airplane, Airbus has examined possible design provisions to provide multiple fault tolerance in the structural design to prevent ignition sources from occurring in the event of lightning attachment to the airplane in critical locations. Airbus has concluded from this examination that providing multiple fault tolerance for some structural elements is not practical. Airbus has also identified some areas of the Model A350–900 airplane design where it is impractical to provide even single-fault tolerance in the structural design to prevent ignition sources from occurring in the event of lightning attachment after a single failure. The FAA has reviewed this examination with Airbus in detail and has agreed that providing fault tolerance beyond that in the Model A350–900 airplane design for these areas would be impractical. VerDate Mar<15>2010 15:13 Sep 05, 2014 Jkt 232001 As a result of the Airbus Model A350– 900 airplane and other certification projects, the FAA has now determined that compliance with § 25.981(a)(3) is impractical for some areas of lightning protection for fuel-tank structure, and that application of § 25.981(a)(3) to those design areas is therefore inappropriate. The FAA plans further rulemaking to revise § 25.981(a)(3). As appropriate, the FAA plans to issue special conditions or exemptions for certification projects progressing before the revision is complete. This is discussed in FAA Memorandum ANM– 112–08–002, Policy on Issuance of Special Conditions and Exemptions Related to Lightning Protection of Fuel Tank Structure, dated May 26, 2009.1 Application of Existing Regulations Inappropriate Due to Compensating Feature That Provides Equivalent Level of Safety Section 25.981(b) sets specific standards for fuel-tank flammability as discussed above under ‘‘Flammability Limits.’’ Under that regulation, the fleetaverage flammability exposure of all fuel tanks on the Model A350–900 airplane may not exceed 3 percent of the flammability-exposure evaluation time calculated using the method in part 25, Appendix N, or the fleet-average flammability of a wing main tank within an equivalent construction, conventional, unheated, aluminum wing fuel tank, whichever is greater. The typical fleet-average fuel-tank flammability of fuel tanks located in the wing ranges between 1 and 5 percent. If it is assumed that a Model A350–900 airplane equivalent, conventional, unheated, aluminum wing fuel tank would not exceed a fleet-average flammability time of 3 percent, the actual composite Model A350–900 airplane wing-fuel-tank design would be required to comply with the 3 percent fleet average flammability standard, and therefore a means to reduce the flammability to 3 percent would be required. However, the Model A350– 900 airplane design includes NGS for all fuel tanks that will also be shown to meet the additional, more-stringent warm-day average flammability standard in part 25, Appendix M, which is only required for normally emptied fuel tanks with some part of the tank within the fuselage contour. Fuel tanks that meet this requirement typically have average fuel-tank flammability 1 The memorandum may be viewed at: http:// www.airweb.faa.gov/Regulatory_and_Guidance_ Library/rgPolicy.nsf/0/12350AE62D 393B7A862575C300709CA3?OpenDocument &Highlight=anm-112-08-002 PO 00000 Frm 00005 Fmt 4700 Sfmt 4700 53131 levels well below the required 3 percent. Since the NGS for all fuel tanks on the Model A350–900 airplane provides performance that meets part 25, Appendix M, the FAA has determined that the risk reduction provided by this additional performance will provide compensation for some relief from the ignition-prevention requirements of § 25.981(a)(3) while still establishing a level of safety equivalent to that established in the regulations. In determining the appropriate amount of relief from the ignitionprevention requirements of § 25.981(a), the FAA considered the original overall intent of Amendment 25–102, which was to ensure the prevention of catastrophic events due to fuel-tank vapor explosion. These special conditions are intended to achieve that objective through a prescriptive requirement that fault tolerance (with respect to the creation of an ignition source) be provided for all structural lightning protection design features where providing such fault tolerance is practical, and through a performancebased standard for the risk due to any single-failure vulnerability that exists in the design. In addition, for any structural lightning-protection design features for which Airbus shows that providing fault tolerance is impractical, these special conditions require Airbus to show that a fuel-tank vapor-ignition event, due to the summed risk of all non-fault-tolerant design features, is extremely improbable. Airbus would be required to show that the design meets this safety objective using a structured system-safety assessment similar to that currently used for demonstrating compliance with §§ 25.901 and 25.1309. Given these novel or unusual design features, and the compliance challenges noted earlier in this document, the FAA has determined that application of § 25.981(a)(3) is inappropriate in that it is neither practical nor necessary to apply the ignition-source-prevention provisions of § 25.981(a)(3) to the specific fuel-tank structural lightningprotection features of the Airbus Model A350–900 airplane. However, without the § 25.981(a)(3) provisions, the remaining applicable regulations in the Model A350–900 airplane certification basis would be inadequate to set an appropriate standard for fuel-tank ignition prevention. Therefore, in accordance with provisions of § 21.16, the FAA has determined that, instead of § 25.981(a)(3), alternative fuel-tank structural lighting-protection requirements be applied to fuel-tank lightning-protection features that are integral to the airframe structure of the E:\FR\FM\08SER1.SGM 08SER1 rmajette on DSK2TPTVN1PROD with RULES 53132 Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations Model A350–900 airplane. These alternative requirements are intended to provide the level of safety intended by § 25.981(a)(3), based on our recognition, as discussed above, that a highly effective NGS for the fuel tanks makes it unnecessary to assume that the fuel tank is always flammable. As discussed previously, the assumption that the fuel tanks are always flammable was required when demonstrating compliance to the ignition-prevention requirements of § 25.981(a)(3). One resulting difference between these special conditions and the § 25.981(a)(3) provisions they are meant to replace is the outcome being prevented—fuel-vapor ignition versus an ignition source. These special conditions acknowledge that the application of fuel-tank-flammability performance standards will reduce fueltank flammability to an extent that it is appropriate to consider the beneficial effects of flammability reduction when considering design areas where it is impractical to comply with § 25.981(a)(3). One of the core requirements of these special conditions is a prescriptive requirement that structural lightningprotection design features must be fault tolerant. (An exception, wherein Airbus can show that providing fault tolerance is impractical, and associated requirements, is discussed below.) The other core requirement is that Airbus must show that the design, manufacturing processes, and Airworthiness Limitations section of the Instructions for Continued Airworthiness include all practical measures to prevent, and detect and correct, failures of structural-lightning protection features due to manufacturing variability, aging, wear, corrosion, and likely damage. The FAA has determined that, if these core requirements are met, a fuel-tank vaporignition event, due to lightning, is not anticipated to occur in the life of the airplane fleet. This conclusion is based on the fact that a critical lightning strike to any given airplane is itself a remote event, and on the fact that fuel tanks must be shown to be flammable only for a relatively small portion of the fleet operational life. For any non-fault-tolerant features in the design, Airbus must show that eliminating these features or making them fault tolerant is impractical. The requirements and considerations for showing it is impractical to provide fault tolerance are described in FAA Memorandum ANM–112–08–002. This requirement is intended to minimize the number of non-fault-tolerant features in the design. VerDate Mar<15>2010 15:13 Sep 05, 2014 Jkt 232001 For areas of the design where Airbus shows that providing fault-tolerant structural lighting-protection features is impractical, non-fault-tolerant features will be allowed, provided Airbus can show that a fuel-tank vapor-ignition event, due to the non-fault-tolerant features, is extremely improbable when the sum of probabilities of those events, due to all non-fault-tolerant features, is considered. Airbus will be required to submit a structured, quantitative assessment of fleet-average risk for a fuel-tank vapor-ignition event due to all non-fault-tolerant design features included in the design. This will require determination of the number of nonfault-tolerant design features, estimates of the probability of the failure of each non-fault-tolerant design feature, and estimates of the exposure time for those failures. This analysis must include failures due to manufacturing variability, aging, wear, corrosion, and likely damage. It is acceptable to consider the probability of fuel-tank flammability, the probability of a lightning strike to the airplane, the probability of a lightning strike to specific zones of the airplane (for example, Zone 2 behind the nacelle, but not a specific location or feature), and a distribution of lightning-strike amplitude in performing the assessment, provided the associated assumptions are acceptable to the FAA. The analysis must account for any dependencies among these factors, if they are used. The assessment must also account for operation with inoperative features and systems, including any proposed or anticipated dispatch relief. This risk-assessment requirement is intended to ensure that an acceptable level of safety is provided given the non-fault-tolerant features in the design. Part 25, Appendix N, as adopted in Amendment 25–125, in conjunction with these special conditions, constitutes the standard for how to determine flammability probability. In performing the safety analysis required by these special conditions, relevant § 25.981(a)(3) compliance guidance is still applicable. Appropriate credit for the conditional probability of environmental or operational conditions occurring is normally limited to those provisions involving multiple failures, and this type of credit is not normally allowed in evaluation of single failures. However, these special conditions would allow consideration of the probability of occurrence of lightning attachment and flammable conditions when assessing the probability of structural failures resulting in a fueltank vapor-ignition event. PO 00000 Frm 00006 Fmt 4700 Sfmt 4700 The FAA understands that lightningprotection safety for airplane structure is inherently different from lightning protection for systems. We intend to apply these special conditions only to structural lightning-protection features of fuel systems. We do not intend to apply the alternative standards used under these special conditions to other areas of the airplane-design evaluation. Requirements Provide Equivalent Level of Safety In recognition of the unusual design feature discussed above, and the impracticality of requiring multiple fault tolerance for lightning protection of certain aspects of fuel-tank structure, the FAA has determined that a level of safety equivalent to direct compliance with § 25.981(a)(3) will be achieved for the Model A350–900 airplane by applying these requirements. The FAA considers that, instead of only concentrating on fault tolerance for ignition-source prevention, significantly reducing fuel-tank flammability exposure, in addition to preventing ignition sources, is a better approach to lightning protection for the fuel tanks. In addition, the level of average fueltank flammability achieved by compliance with these special conditions is low enough that it is not appropriate or accurate to assume, in a safety analysis, that the fuel tanks may always be flammable. Section 25.981(b), as amended by Amendment 25–125, sets limits on the allowable fuel-tank flammability for the Model A350–900 airplane. Condition 2(a) of these special conditions applies the more-stringent standard, for warmday flammability performance applicable to normally emptied tanks within the fuselage contour, from § 25.981(b) and part 25, Appendix M, to all of the fuel tanks of the Model A350– 900 airplane. Because of the more-stringent fueltank flammability requirements in these special conditions, and because the flammability state of a fuel tank is independent of the various failures of structural elements that could lead to an ignition source in the event of lightning attachment, the FAA has agreed that it is appropriate in this case to allow treatment of flammability as an independent factor in the safety analysis. The positive control of flammability, and the lower flammability that is required by these special conditions, exceed the minimum requirements of § 25.981(b). This offsets a reduction of the stringent standard for ignition-source prevention in § 25.981(a)(3), which assumes that the fuel tank is flammable at all times. E:\FR\FM\08SER1.SGM 08SER1 Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations Given the stringent requirements for fuel-tank flammability, the fuel-vapor ignition prevention, and the ignitionsource prevention requirements in these special conditions will prevent ‘‘. . . catastrophic failure . . . due to ignition of fuel or vapors,’’ as stated in § 25.981(a). Thus, the overall level of safety achieved by these special conditions is considered equivalent to that which would be required by compliance with § 25.981(a)(3) and (b). These special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards. Discussion of Comments Notice of proposed special conditions No. 25–13–36–SC for Airbus Model A350–900 series airplanes was published in the Federal Register on December 19, 2013 (78 FR 76775). No comments were received, and the special conditions are adopted as proposed. Applicability As discussed above, these special conditions apply to Airbus Model A350–900 series airplanes. Should Airbus apply later for a change to the type certificate to include another model incorporating the same novel or unusual design feature, the special conditions would apply to that model as well. Conclusion This action affects only certain novel or unusual design features on the Airbus Model A350–900 series airplanes. It is not a rule of general applicability. List of Subjects in 14 CFR Part 25 Aircraft, Aviation safety, Reporting and recordkeeping requirements. The authority citation for these special conditions is as follows: Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704. The Special Conditions Accordingly, pursuant to the authority delegated to me by the Administrator, the following special conditions are issued as part of the type-certification basis for Airbus Model A350–900 series airplanes. rmajette on DSK2TPTVN1PROD with RULES ■ 1. Definitions Most of the terms used in the special conditions described in Alternative Fuel Tank Structural Lightning Protection Requirements either have the common dictionary meaning or are defined in Advisory Circular 25.1309–1A, System VerDate Mar<15>2010 15:13 Sep 05, 2014 Jkt 232001 Design and Analysis, dated June 21, 1988. The following definitions are the only terms intended to have a specialized meaning when used in these special conditions: (a) Basic Airframe Structure. Includes design elements such as structural members, structural joint features, and fastener systems including airplane skins, ribs, spars, stringers, etc., and associated fasteners, joints, coatings, and sealant. Basic airframe structure may also include those structural elements that are expected to be removed for maintenance, such as exterior fuel-tank access panels and fairing-attachment features, provided maintenance errors that could compromise associated lightningprotection features would be evident upon an exterior, preflight inspection of the airplane and would be corrected prior to flight. (b) Permanent System-Supporting Structure. Includes static, permanently attached structural parts (such as brackets) that are used to support system elements. It does not include any part intended to be removed, or any joint intended to be separated, to maintain or replace system elements or other parts, unless that part removal or joint separation is accepted by the FAA as being extremely remote. (c) Manufacturing Variability. Includes tolerances and variability that the design and production specifications allow, as well as anticipated errors or escapes from the manufacturing and inspection processes. (d) Extremely Remote. Conditions that are not anticipated to occur to each airplane during its total life, but which may occur a few times when considering the total operational life of all airplanes of one type. Extremely remote conditions are those having an average probability per flight hour on the order of 1 × 10¥7 or less, but greater than on the order of 1 × 10¥9. (e) Extremely Improbable. Conditions that are so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. Extremely improbable conditions are those having an average probability per flight hour of the order of 1 × 10¥9 or less. 2. Alternative Fuel-Tank Structural Lightning-Protection Requirements For lightning-protection features that are integral to fuel-tank basic airframe structure or permanent systemsupporting structure, as defined in this these special conditions Definitions, for which Airbus shows and the FAA finds PO 00000 Frm 00007 Fmt 4700 Sfmt 4700 53133 compliance with § 25.981(a)(3) to be impractical, the following requirements may be applied in lieu of the requirements of § 25.981(a)(3): (a) Airbus must show that the airplane design meets the requirements of part 25, Appendix M, as amended by Amendment 25–125, for all fuel tanks installed on the airplane. (b) Airbus must show that the design includes at least two independent, effective, and reliable lightningprotection features (or sets of features) such that fault tolerance to prevent lightning-related ignition sources is provided for each area of the structural design to be shown compliant with these special conditions in lieu of compliance with the requirements of § 25.981(a)(3). Fault tolerance is not required for any specific design feature if: (1) For that feature, providing fault tolerance is shown to be impractical, and (2) Fuel-tank vapor ignition due to that feature and all other non-faulttolerant features, when their fuel-tank vapor-ignition event probabilities are summed, is shown to be extremely improbable. (c) Airbus must perform an analysis to show that the design, manufacturing processes, and airworthiness limitations section of the instructions for continued airworthiness include all practical measures to prevent, and detect and correct, failures of structural lightningprotection features due to manufacturing variability, aging, wear, corrosion, and likely damage. Issued in Renton, Washington, on August 15, 2014. Jeffrey E. Duven, Transport Airplane Directorate, Aircraft Certification Service. [FR Doc. 2014–21245 Filed 9–5–14; 8:45 am] BILLING CODE 4910–13–P DEPARTMENT OF HEALTH AND HUMAN SERVICES Food and Drug Administration 21 CFR Parts 310, 314, 329, and 600 [Docket No. FDA–2008–N–0334] RIN 0910–AF96 Postmarketing Safety Reports for Human Drug and Biological Products; Electronic Submission Requirements; Correction AGENCY: Food and Drug Administration, HHS. ACTION: E:\FR\FM\08SER1.SGM Final rule; correction. 08SER1

Agencies

[Federal Register Volume 79, Number 173 (Monday, September 8, 2014)]
[Rules and Regulations]
[Pages 53129-53133]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2014-21245]


-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 25

[Docket No. FAA-2013-1002; Special Conditions No. 25-530-SC]


Special Conditions: Airbus Model A350-900 Airplane; Lightning 
Protection of Fuel-Tank Structure To Prevent Fuel-Tank Vapor Ignition

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Final special conditions.

-----------------------------------------------------------------------

SUMMARY: These special conditions are issued for Airbus Model A350-900 
airplanes.
    These airplanes will have a novel or unusual design feature that 
will incorporate a nitrogen generation system (NGS) for all fuel tanks, 
to actively reduce flammability exposure within the fuel tanks 
significantly below that required by the fuel-tank flammability 
regulations. Among other benefits, the NGS significantly reduces the 
potential for fuel-vapor ignition caused by lightning strikes. The 
applicable airworthiness regulations do not contain adequate or 
appropriate safety standards for this design feature. These special 
conditions contain the additional safety standards that the 
Administrator considers necessary to establish a level of safety 
equivalent to that established by the existing airworthiness standards.

DATES:  Effective Date: October 8, 2014.

[[Page 53130]]


FOR FURTHER INFORMATION CONTACT: Doug Bryant, Propulsion/Mechanical 
Systems, ANM-112, Transport Airplane Directorate, Aircraft 
Certification Service, 1601 Lind Avenue SW., Renton, Washington 98057-
3356; telephone (425) 227-2384; facsimile (425) 227-1320.

SUPPLEMENTARY INFORMATION: 

Background

    On August 25, 2008, Airbus applied for a type certificate for their 
new Model A350-900 airplane. Later, Airbus requested, and the FAA 
approved, an extension to the application for FAA type certification to 
November 15, 2009. The Model A350-900 airplane has a conventional 
layout with twin wing-mounted Rolls-Royce Trent XWB engines. It 
features a twin-aisle, 9-abreast, economy-class layout, and 
accommodates side-by-side placement of LD-3 containers in the cargo 
compartment. The basic Model A350-900 airplane configuration 
accommodates 315 passengers in a standard two-class arrangement. The 
design cruise speed is Mach 0.85 with a maximum take-off weight of 
602,000 lbs. The Model A350-900 series airplane has a composite wing 
and fuel-tank structure constructed of carbon-fiber-reinforced plastic 
materials.

Type Certification Basis

    Under Title 14, Code of Federal Regulations (14 CFR) 21.17, Airbus 
must show that the Model A350-900 airplane meets the applicable 
provisions of 14 CFR part 25, as amended by Amendments 25-1 through 25-
129.
    If the Administrator finds that the applicable airworthiness 
regulations (i.e., 14 CFR part 25) do not contain adequate or 
appropriate safety standards for the Model A350-900 airplane because of 
a novel or unusual design feature, special conditions are prescribed 
under Sec.  21.16.
    Special conditions are initially applicable to the model for which 
they are issued. Should the type certificate for that model be amended 
later to include any other model that incorporates the same novel or 
unusual design feature, the special conditions would also apply to the 
other model under Sec.  21.101.
    In addition to the applicable airworthiness regulations and special 
conditions, the Model A350-900 airplane must comply with the fuel-vent 
and exhaust-emission requirements of 14 CFR part 34, and the noise-
certification requirements of 14 CFR part 36. The FAA must issue a 
finding of regulatory adequacy under Sec.  611 of Public Law 92-574, 
the ``Noise Control Act of 1972.''
    The FAA issues special conditions, as defined in 14 CFR 11.19, 
under Sec.  11.38, and they become part of the type-certification basis 
under Sec.  21.17(a)(2).

Novel or Unusual Design Features

    The Airbus Model A350-900 airplane will incorporate the following 
novel or unusual design features: Fuel-tank NGS that is intended to 
control fuel-tank flammability for all fuel tanks. This NGS is designed 
to provide a level of performance that applies the more stringent 
standard for warm-day flammability performance applicable to normally 
emptied tanks within the fuselage contour from Sec.  25.981(b), and 14 
CFR part 25 appendix M, to all fuel tanks of the Model A350-900 
airplane. This high level of NGS performance for all fuel tanks is a 
novel or unusual design feature not envisioned at the time the 
regulations applying to the Model A350-900 airplane certification basis 
were issued.

Discussion

    The certification basis of the Airbus Model A350-900 airplane 
includes Sec.  25.981, as amended by Amendment 25-125, as required by 
14 CFR 26.37. This amendment includes the ignition-prevention 
requirements in Sec.  25.981(a), as amended by Amendment 25-102. It 
includes revised flammability limits for all fuel tanks, and new 
specific limitations on flammability for all fuel tanks as defined in 
Sec.  25.981(b), as amended by Amendment 25-125.

Ignition Source Prevention

    Section 25.981(a)(3) requires applicants to show that an ignition 
source in the fuel-tank system could not result from any single 
failure, from any single failure in combination with any latent failure 
condition not shown to be extremely remote, or from any combination of 
failures not shown to be extremely improbable. This requirement was 
originally adopted in Amendment 25-102, and it requires the assumption 
that the fuel tanks are always flammable when showing that the 
probability of an ignition source being present is extremely remote. 
(Amendment 25-102 included Sec.  25.981(c), which required minimizing 
fuel-tank flammability, and this was defined in the preamble as being 
equivalent to unheated aluminum fuel tanks located in the wing.) This 
requirement defines three types of scenarios that must be addressed to 
show compliance with Sec.  25.981(a)(3). The first scenario is that any 
single failure, regardless of the probability of occurrence of the 
failure, must not cause an ignition source. The second scenario is that 
any single failure, regardless of the probability of occurrence, in 
combination with any latent failure condition not shown to be at least 
extremely remote, must not cause an ignition source. The third scenario 
is that any combination of failures not shown to be extremely 
improbable must not cause an ignition source. Demonstration of 
compliance with this requirement would typically require a structured, 
quantitative safety analysis. Design areas that have latent failure 
conditions typically would be driven by these requirements to have 
multiple fault tolerance, or ``triple redundancy.'' This means that 
ignition sources are still prevented even after two independent 
failures.

Flammability Limits

    Section 25.981(b) states that no fuel-tank fleet-average 
flammability exposure may exceed 3 percent of the flammability-exposure 
evaluation time calculated using the method in part 25, Appendix N, or 
the fleet-average flammability of a fuel tank within the wing of the 
airplane being evaluated, whichever is greater. If the wing is not a 
conventional, unheated aluminum wing, the analysis must be based on an 
assumed equivalent, conventional construction, unheated, aluminum wing. 
In addition, for fuel tanks that are normally emptied during operation 
and that have any part of the tank located within the fuselage contour, 
the fleet-average flammability for warm days (above 80 [deg]F) must be 
limited to 3 percent, as calculated using the method in part 25, 
Appendix M.

Application of Existing Regulations Inappropriate Due to Impracticality

    Since the issuance of Sec.  25.981(a)(3), as amended by Amendment 
25-102, the FAA has conducted certification projects in which 
applicants found it impractical to meet the requirements of that 
regulation for some areas of lightning protection for fuel tank 
structure. Partial exemptions were issued for these projects. These 
same difficulties exist for the Airbus Model A350-900 airplane project.
    The difficulty of designing multiple-fault-tolerant structure, and 
the difficulty of detecting failures of hidden structural-design 
features in general, makes compliance with Sec.  25.981(a)(3) uniquely 
challenging and impractical for certain aspects of the electrical 
bonding of structural elements. Such bonding is needed to prevent 
occurrence of fuel-tank ignition sources from lightning strikes. The 
effectiveness and fault tolerance of electrical-bonding

[[Page 53131]]

features for structural joints and fasteners is partially dependent on 
design features that cannot be effectively inspected or tested after 
assembly without damaging the structure, joint, or fastener. Examples 
of such features include a required interference fit between the shank 
of a fastener and the hole in which the fastener is installed; metal 
foil or mesh imbedded in composite material; a required clamping force 
provided by a fastener to pull two structural parts together; and a 
required faying surface bond between the flush surfaces of adjacent 
pieces of structural material, such as in a wing-skin joint, or a 
mounting-bracket installation. In addition, other features that 
physically can be inspected or tested may be located within the fuel 
tanks. Therefore, it is not practical to inspect for failures of those 
features at short intervals. Examples of such failures include 
separation or loosening of cap seals over fastener ends, and actual 
structural failures of internal fasteners. This inability to 
practically detect manufacturing errors and failures of structural-
design features critical to lightning protection results in degraded 
conditions that occur and remain in place for a very long time, 
possibly for the remaining life of the airplane. The complex 
construction techniques associated with composite structure can make 
these aspects particularly challenging.
    Accounting for such long failure-latency periods in the system 
safety analysis, required by Sec.  25.981(a)(3), would require multiple 
fault tolerance in the structural lightning-protection design. As part 
of the design-development activity for the Model A350-900 airplane, 
Airbus has examined possible design provisions to provide multiple 
fault tolerance in the structural design to prevent ignition sources 
from occurring in the event of lightning attachment to the airplane in 
critical locations. Airbus has concluded from this examination that 
providing multiple fault tolerance for some structural elements is not 
practical. Airbus has also identified some areas of the Model A350-900 
airplane design where it is impractical to provide even single-fault 
tolerance in the structural design to prevent ignition sources from 
occurring in the event of lightning attachment after a single failure. 
The FAA has reviewed this examination with Airbus in detail and has 
agreed that providing fault tolerance beyond that in the Model A350-900 
airplane design for these areas would be impractical.
    As a result of the Airbus Model A350-900 airplane and other 
certification projects, the FAA has now determined that compliance with 
Sec.  25.981(a)(3) is impractical for some areas of lightning 
protection for fuel-tank structure, and that application of Sec.  
25.981(a)(3) to those design areas is therefore inappropriate. The FAA 
plans further rulemaking to revise Sec.  25.981(a)(3). As appropriate, 
the FAA plans to issue special conditions or exemptions for 
certification projects progressing before the revision is complete. 
This is discussed in FAA Memorandum ANM-112-08-002, Policy on Issuance 
of Special Conditions and Exemptions Related to Lightning Protection of 
Fuel Tank Structure, dated May 26, 2009.\1\
---------------------------------------------------------------------------

    \1\ The memorandum may be viewed at: http://www.airweb.faa.gov/
RegulatoryandGuidanceLibrary/
rgPolicy.nsf/0/
12350AE62D393B7A862575C300709CA3?OpenDocument&Highlight=anm-112-08-
002
---------------------------------------------------------------------------

Application of Existing Regulations Inappropriate Due to Compensating 
Feature That Provides Equivalent Level of Safety

    Section 25.981(b) sets specific standards for fuel-tank 
flammability as discussed above under ``Flammability Limits.'' Under 
that regulation, the fleet-average flammability exposure of all fuel 
tanks on the Model A350-900 airplane may not exceed 3 percent of the 
flammability-exposure evaluation time calculated using the method in 
part 25, Appendix N, or the fleet-average flammability of a wing main 
tank within an equivalent construction, conventional, unheated, 
aluminum wing fuel tank, whichever is greater. The typical fleet-
average fuel-tank flammability of fuel tanks located in the wing ranges 
between 1 and 5 percent. If it is assumed that a Model A350-900 
airplane equivalent, conventional, unheated, aluminum wing fuel tank 
would not exceed a fleet-average flammability time of 3 percent, the 
actual composite Model A350-900 airplane wing-fuel-tank design would be 
required to comply with the 3 percent fleet average flammability 
standard, and therefore a means to reduce the flammability to 3 percent 
would be required. However, the Model A350-900 airplane design includes 
NGS for all fuel tanks that will also be shown to meet the additional, 
more-stringent warm-day average flammability standard in part 25, 
Appendix M, which is only required for normally emptied fuel tanks with 
some part of the tank within the fuselage contour. Fuel tanks that meet 
this requirement typically have average fuel-tank flammability levels 
well below the required 3 percent.
    Since the NGS for all fuel tanks on the Model A350-900 airplane 
provides performance that meets part 25, Appendix M, the FAA has 
determined that the risk reduction provided by this additional 
performance will provide compensation for some relief from the 
ignition-prevention requirements of Sec.  25.981(a)(3) while still 
establishing a level of safety equivalent to that established in the 
regulations.
    In determining the appropriate amount of relief from the ignition-
prevention requirements of Sec.  25.981(a), the FAA considered the 
original overall intent of Amendment 25-102, which was to ensure the 
prevention of catastrophic events due to fuel-tank vapor explosion. 
These special conditions are intended to achieve that objective through 
a prescriptive requirement that fault tolerance (with respect to the 
creation of an ignition source) be provided for all structural 
lightning protection design features where providing such fault 
tolerance is practical, and through a performance-based standard for 
the risk due to any single-failure vulnerability that exists in the 
design. In addition, for any structural lightning-protection design 
features for which Airbus shows that providing fault tolerance is 
impractical, these special conditions require Airbus to show that a 
fuel-tank vapor-ignition event, due to the summed risk of all non-
fault-tolerant design features, is extremely improbable. Airbus would 
be required to show that the design meets this safety objective using a 
structured system-safety assessment similar to that currently used for 
demonstrating compliance with Sec. Sec.  25.901 and 25.1309.
    Given these novel or unusual design features, and the compliance 
challenges noted earlier in this document, the FAA has determined that 
application of Sec.  25.981(a)(3) is inappropriate in that it is 
neither practical nor necessary to apply the ignition-source-prevention 
provisions of Sec.  25.981(a)(3) to the specific fuel-tank structural 
lightning-protection features of the Airbus Model A350-900 airplane. 
However, without the Sec.  25.981(a)(3) provisions, the remaining 
applicable regulations in the Model A350-900 airplane certification 
basis would be inadequate to set an appropriate standard for fuel-tank 
ignition prevention. Therefore, in accordance with provisions of Sec.  
21.16, the FAA has determined that, instead of Sec.  25.981(a)(3), 
alternative fuel-tank structural lighting-protection requirements be 
applied to fuel-tank lightning-protection features that are integral to 
the airframe structure of the

[[Page 53132]]

Model A350-900 airplane. These alternative requirements are intended to 
provide the level of safety intended by Sec.  25.981(a)(3), based on 
our recognition, as discussed above, that a highly effective NGS for 
the fuel tanks makes it unnecessary to assume that the fuel tank is 
always flammable. As discussed previously, the assumption that the fuel 
tanks are always flammable was required when demonstrating compliance 
to the ignition-prevention requirements of Sec.  25.981(a)(3).
    One resulting difference between these special conditions and the 
Sec.  25.981(a)(3) provisions they are meant to replace is the outcome 
being prevented--fuel-vapor ignition versus an ignition source. These 
special conditions acknowledge that the application of fuel-tank-
flammability performance standards will reduce fuel-tank flammability 
to an extent that it is appropriate to consider the beneficial effects 
of flammability reduction when considering design areas where it is 
impractical to comply with Sec.  25.981(a)(3).
    One of the core requirements of these special conditions is a 
prescriptive requirement that structural lightning-protection design 
features must be fault tolerant. (An exception, wherein Airbus can show 
that providing fault tolerance is impractical, and associated 
requirements, is discussed below.) The other core requirement is that 
Airbus must show that the design, manufacturing processes, and 
Airworthiness Limitations section of the Instructions for Continued 
Airworthiness include all practical measures to prevent, and detect and 
correct, failures of structural-lightning protection features due to 
manufacturing variability, aging, wear, corrosion, and likely damage. 
The FAA has determined that, if these core requirements are met, a 
fuel-tank vapor-ignition event, due to lightning, is not anticipated to 
occur in the life of the airplane fleet. This conclusion is based on 
the fact that a critical lightning strike to any given airplane is 
itself a remote event, and on the fact that fuel tanks must be shown to 
be flammable only for a relatively small portion of the fleet 
operational life.
    For any non-fault-tolerant features in the design, Airbus must show 
that eliminating these features or making them fault tolerant is 
impractical. The requirements and considerations for showing it is 
impractical to provide fault tolerance are described in FAA Memorandum 
ANM-112-08-002. This requirement is intended to minimize the number of 
non-fault-tolerant features in the design.
    For areas of the design where Airbus shows that providing fault-
tolerant structural lighting-protection features is impractical, non-
fault-tolerant features will be allowed, provided Airbus can show that 
a fuel-tank vapor-ignition event, due to the non-fault-tolerant 
features, is extremely improbable when the sum of probabilities of 
those events, due to all non-fault-tolerant features, is considered. 
Airbus will be required to submit a structured, quantitative assessment 
of fleet-average risk for a fuel-tank vapor-ignition event due to all 
non-fault-tolerant design features included in the design. This will 
require determination of the number of non-fault-tolerant design 
features, estimates of the probability of the failure of each non-
fault-tolerant design feature, and estimates of the exposure time for 
those failures. This analysis must include failures due to 
manufacturing variability, aging, wear, corrosion, and likely damage.
    It is acceptable to consider the probability of fuel-tank 
flammability, the probability of a lightning strike to the airplane, 
the probability of a lightning strike to specific zones of the airplane 
(for example, Zone 2 behind the nacelle, but not a specific location or 
feature), and a distribution of lightning-strike amplitude in 
performing the assessment, provided the associated assumptions are 
acceptable to the FAA. The analysis must account for any dependencies 
among these factors, if they are used. The assessment must also account 
for operation with inoperative features and systems, including any 
proposed or anticipated dispatch relief. This risk-assessment 
requirement is intended to ensure that an acceptable level of safety is 
provided given the non-fault-tolerant features in the design.
    Part 25, Appendix N, as adopted in Amendment 25-125, in conjunction 
with these special conditions, constitutes the standard for how to 
determine flammability probability. In performing the safety analysis 
required by these special conditions, relevant Sec.  25.981(a)(3) 
compliance guidance is still applicable. Appropriate credit for the 
conditional probability of environmental or operational conditions 
occurring is normally limited to those provisions involving multiple 
failures, and this type of credit is not normally allowed in evaluation 
of single failures. However, these special conditions would allow 
consideration of the probability of occurrence of lightning attachment 
and flammable conditions when assessing the probability of structural 
failures resulting in a fuel-tank vapor-ignition event.
    The FAA understands that lightning-protection safety for airplane 
structure is inherently different from lightning protection for 
systems. We intend to apply these special conditions only to structural 
lightning-protection features of fuel systems. We do not intend to 
apply the alternative standards used under these special conditions to 
other areas of the airplane-design evaluation.

Requirements Provide Equivalent Level of Safety

    In recognition of the unusual design feature discussed above, and 
the impracticality of requiring multiple fault tolerance for lightning 
protection of certain aspects of fuel-tank structure, the FAA has 
determined that a level of safety equivalent to direct compliance with 
Sec.  25.981(a)(3) will be achieved for the Model A350-900 airplane by 
applying these requirements. The FAA considers that, instead of only 
concentrating on fault tolerance for ignition-source prevention, 
significantly reducing fuel-tank flammability exposure, in addition to 
preventing ignition sources, is a better approach to lightning 
protection for the fuel tanks. In addition, the level of average fuel-
tank flammability achieved by compliance with these special conditions 
is low enough that it is not appropriate or accurate to assume, in a 
safety analysis, that the fuel tanks may always be flammable.
    Section 25.981(b), as amended by Amendment 25-125, sets limits on 
the allowable fuel-tank flammability for the Model A350-900 airplane. 
Condition 2(a) of these special conditions applies the more-stringent 
standard, for warm-day flammability performance applicable to normally 
emptied tanks within the fuselage contour, from Sec.  25.981(b) and 
part 25, Appendix M, to all of the fuel tanks of the Model A350-900 
airplane.
    Because of the more-stringent fuel-tank flammability requirements 
in these special conditions, and because the flammability state of a 
fuel tank is independent of the various failures of structural elements 
that could lead to an ignition source in the event of lightning 
attachment, the FAA has agreed that it is appropriate in this case to 
allow treatment of flammability as an independent factor in the safety 
analysis. The positive control of flammability, and the lower 
flammability that is required by these special conditions, exceed the 
minimum requirements of Sec.  25.981(b). This offsets a reduction of 
the stringent standard for ignition-source prevention in Sec.  
25.981(a)(3), which assumes that the fuel tank is flammable at all 
times.

[[Page 53133]]

    Given the stringent requirements for fuel-tank flammability, the 
fuel-vapor ignition prevention, and the ignition-source prevention 
requirements in these special conditions will prevent ``. . . 
catastrophic failure . . . due to ignition of fuel or vapors,'' as 
stated in Sec.  25.981(a). Thus, the overall level of safety achieved 
by these special conditions is considered equivalent to that which 
would be required by compliance with Sec.  25.981(a)(3) and (b).
    These special conditions contain the additional safety standards 
that the Administrator considers necessary to establish a level of 
safety equivalent to that established by the existing airworthiness 
standards.

Discussion of Comments

    Notice of proposed special conditions No. 25-13-36-SC for Airbus 
Model A350-900 series airplanes was published in the Federal Register 
on December 19, 2013 (78 FR 76775). No comments were received, and the 
special conditions are adopted as proposed.

Applicability

    As discussed above, these special conditions apply to Airbus Model 
A350-900 series airplanes. Should Airbus apply later for a change to 
the type certificate to include another model incorporating the same 
novel or unusual design feature, the special conditions would apply to 
that model as well.

Conclusion

    This action affects only certain novel or unusual design features 
on the Airbus Model A350-900 series airplanes. It is not a rule of 
general applicability.

List of Subjects in 14 CFR Part 25

    Aircraft, Aviation safety, Reporting and recordkeeping 
requirements.

    The authority citation for these special conditions is as follows:

    Authority:  49 U.S.C. 106(g), 40113, 44701, 44702, 44704.

The Special Conditions

0
Accordingly, pursuant to the authority delegated to me by the 
Administrator, the following special conditions are issued as part of 
the type-certification basis for Airbus Model A350-900 series 
airplanes.

1. Definitions

    Most of the terms used in the special conditions described in 
Alternative Fuel Tank Structural Lightning Protection Requirements 
either have the common dictionary meaning or are defined in Advisory 
Circular 25.1309-1A, System Design and Analysis, dated June 21, 1988.
    The following definitions are the only terms intended to have a 
specialized meaning when used in these special conditions:
    (a) Basic Airframe Structure. Includes design elements such as 
structural members, structural joint features, and fastener systems 
including airplane skins, ribs, spars, stringers, etc., and associated 
fasteners, joints, coatings, and sealant. Basic airframe structure may 
also include those structural elements that are expected to be removed 
for maintenance, such as exterior fuel-tank access panels and fairing-
attachment features, provided maintenance errors that could compromise 
associated lightning-protection features would be evident upon an 
exterior, preflight inspection of the airplane and would be corrected 
prior to flight.
    (b) Permanent System-Supporting Structure. Includes static, 
permanently attached structural parts (such as brackets) that are used 
to support system elements. It does not include any part intended to be 
removed, or any joint intended to be separated, to maintain or replace 
system elements or other parts, unless that part removal or joint 
separation is accepted by the FAA as being extremely remote.
    (c) Manufacturing Variability. Includes tolerances and variability 
that the design and production specifications allow, as well as 
anticipated errors or escapes from the manufacturing and inspection 
processes.
    (d) Extremely Remote. Conditions that are not anticipated to occur 
to each airplane during its total life, but which may occur a few times 
when considering the total operational life of all airplanes of one 
type. Extremely remote conditions are those having an average 
probability per flight hour on the order of 1 x 10-\7\ or 
less, but greater than on the order of 1 x 10-\9\.
    (e) Extremely Improbable. Conditions that are so unlikely that they 
are not anticipated to occur during the entire operational life of all 
airplanes of one type. Extremely improbable conditions are those having 
an average probability per flight hour of the order of 1 x 
10-\9\ or less.

2. Alternative Fuel-Tank Structural Lightning-Protection Requirements

    For lightning-protection features that are integral to fuel-tank 
basic airframe structure or permanent system-supporting structure, as 
defined in this these special conditions Definitions, for which Airbus 
shows and the FAA finds compliance with Sec.  25.981(a)(3) to be 
impractical, the following requirements may be applied in lieu of the 
requirements of Sec.  25.981(a)(3):
    (a) Airbus must show that the airplane design meets the 
requirements of part 25, Appendix M, as amended by Amendment 25-125, 
for all fuel tanks installed on the airplane.
    (b) Airbus must show that the design includes at least two 
independent, effective, and reliable lightning-protection features (or 
sets of features) such that fault tolerance to prevent lightning-
related ignition sources is provided for each area of the structural 
design to be shown compliant with these special conditions in lieu of 
compliance with the requirements of Sec.  25.981(a)(3). Fault tolerance 
is not required for any specific design feature if:
    (1) For that feature, providing fault tolerance is shown to be 
impractical, and
    (2) Fuel-tank vapor ignition due to that feature and all other non-
fault-tolerant features, when their fuel-tank vapor-ignition event 
probabilities are summed, is shown to be extremely improbable.
    (c) Airbus must perform an analysis to show that the design, 
manufacturing processes, and airworthiness limitations section of the 
instructions for continued airworthiness include all practical measures 
to prevent, and detect and correct, failures of structural lightning-
protection features due to manufacturing variability, aging, wear, 
corrosion, and likely damage.

    Issued in Renton, Washington, on August 15, 2014.
Jeffrey E. Duven,
Transport Airplane Directorate, Aircraft Certification Service.
[FR Doc. 2014-21245 Filed 9-5-14; 8:45 am]
BILLING CODE 4910-13-P