The FAA notes that numerous commenters expressed concern with the
proposed requirement that the airplane must be capable of continued
safe flight and landing under any available reversing system setting.
The FAA recognizes this language did not account for many airplane
designs that do not incorporate a system that detects when the airplane
is on the ground, which can be used to lockout or prevent manual
inflight reversal. Additionally, the FAA recognizes the proposed rule
did not provide a basic performance requirement to ensure safe
operation of the reverser system under normal operating conditions, and
the airplane is capable of continued safe flight and landing after
failures of the reversing system.
    As explained in the NPRM, proposed Sec.  23.920 (now Sec.  23.2420)
was intended to capture the safety intent of former Sec.  23.933(a) and
(b). Therefore, given the variety of the commenters' concerns, the FAA
revises proposed Sec.  23.920 based on former Sec.  23.933 to address
the comments. The FAA intends Sec.  23.2420 to address the requirements
for propeller, turbojet, and turbofan reversing systems specified in
former Sec.  23.933. Section 23.2420 now requires each reversing system
to be designed so that the airplane is capable of continued safe flight
and landing after any single failure, likely combination of failures,
or malfunction of the reversing system. This rule accounts for existing
reversing system designs that use a mechanical throttle gate to prevent
inadvertent in-flight reversing system operation that could result in
an unsafe condition. For turbofan or turbojet engine reversing systems
intended for ground use only, the FAA notes that a reverser lock out
system for flight is not specifically required by the rule. However,
the FAA expects that in the event of an inflight reverser deployment,
the engine will revert to idle thrust, and the reverser can be restowed
as required by former Sec.  23.933(a)(1). The FAA also notes that Sec.
23.2420 should result in the inclusion of these features in airplane
designs, as the FAA finds they are currently the only likely means to
prevent the occurrence of an unsafe condition and permit continued safe
flight and landing after a failure resulting in a reverser deployment
in flight. In addition to basing the revisions to the proposed rule on
former Sec.  23.933(a)(1) and (b) for ground use only reversing
systems, the

FAA has included in Sec.  23.2420(a) the requirement from former Sec.
23.933(a)(2) for reversing systems intended for use in-flight that no
unsafe condition result during normal operation. The FAA finds this
action responds to commenters' concerns and will readily permit future
approval of systems intended for use in-flight, which incorporate new
technology.
    Regarding Textron's recommendation that the FAA adopt requirements
for reversing systems proposed by EASA in CS 23.505, proposed CS 23.505
combines requirements for reverser systems, thrust augmentation
systems, and automatic power controls in a single regulation. For the
reasons discussed in responding to this comment in the context of Sec.
23.2405, the FAA determines the requirements for a reversing system
should remain separate from those for thrust augmentation or automatic
power or thrust control systems (referred to as automatic power reserve
systems in former regulations), and that the basic performance
requirements for these systems are significantly different.
    Additionally, Sec.  23.2405, ``Automatic power or thrust control
systems,'' applies to future systems that may automatically adjust
thrust to manage airplane control and stability. Such a system might
operate upon a single command from the flightcrew and automatically
manage multiple powerplants to perform a requested action. For this
type of system, in-flight reversing of a particular propulsion unit may
occur (as commanded by a flight management system) even though the
flightcrew may not have specifically requested application of reverse
thrust. For certification of this type of system as part of an
airplane's design, the FAA envisions the requirements of both
Sec. Sec.  23.2420 and 23.2405 will apply.
    Both Embraer and Garmin expressed concern the proposed requirement
would not permit the use of a system safety approach for a reverser
system under certain conditions that may prevent continued safe flight
and landing, as long as those conditions are shown to be extremely
improbable. Embraer recommended replacing the phrase ``under any
available reversing system setting'' in proposed Sec.  23.920 with the
phrase ``at normal operating conditions and the failures not shown to
be extremely improbable.'' Garmin recommended revising the proposed
rule to permit the use of a safety analysis to demonstrate that certain
conditions, which would potentially prevent safe flight and landing,
are extremely improbable.
    In response to Garmin's and Embraer's concern, the FAA notes that
Sec.  23.2420, as revised, permits the use of a system safety approach
for certification of an airplane with a reverser system.
    NJASAP believed a thrust reverser must have an override or the
ability to emergency stow in the unlikely event of inflight deployment.
    The FAA notes NJASAP's recommendation to reintroduce the
requirement to stow reversers after inadvertent deployment; however,
specifically requiring a system to have the capability to restow a
reverser in-flight may limit or prevent the certification of certain
acceptable reversing system designs. As noted in Garmin's comment, for
a reverser system that cannot be shown to result in safe flight and
landing of the airplane after an in-flight deployment, an applicant may
include a robust control and monitoring system in its design that could
be shown to make an in-flight deployment extremely improbable and not
resulting from any single failures. Including this capability could
prevent the system from complying with the requirement that no single
failure prevent continued safe flight and landing.
f. Powerplant Operational Characteristics (Proposed Sec.  23.925/Now
Sec.  23.2425)
    In the NPRM, proposed Sec.  23.925 (now Sec.  23.2425) would have
required the powerplant to operate at any negative acceleration that
may occur during normal and emergency operation within the airplane
operating limitations. Proposed Sec.  23.925 would have required the
pilot to have the capability to stop and restart the powerplant in
flight. Proposed Sec.  23.925 would have also required the airplane to
have an independent power source for restarting each powerplant
following an in-flight shutdown.
    Embraer commented that although the preamble indicated that
proposed Sec.  23.925 intended to address the requirements of former
Sec.  23.939(a) and (b), proposed Sec.  23.925 did not appear to
require evaluation of traditional operational characteristics and did
not address the adverse effects evaluation of air inlet distortion,
powerplant handling, operating characteristics, and other adverse
effects of an installed engine or power unit. Textron and ANAC had
similar concerns. Embraer recommended the FAA revise proposed Sec.
23.925(a) to require the powerplant handling and operating
characteristics to be investigated in flight to determine that no
adverse characteristics are present, to a hazardous degree, during
normal and emergency operation within the range of operating
limitations of the airplane and of the aircraft power unit. Textron
also noted the intent of former Sec.  23.939 was to require
demonstration of proper operation of the powerplant, as installed.
Textron stated it was inappropriate to claim that the tests necessary
to meet part 33 requirements will demonstrate proper operation of the
powerplant as installed, which the NPRM preamble seemed to imply.
Textron also suggested engine vibration requirements be incorporated
into Sec.  23.2425.
    Additionally, ANAC stated that proposed Sec.  23.910 addressed
hazard mitigation in powerplant failure conditions and proposed Sec.
23.900 addressed ``likely hazards in operation.'' ANAC noted the term
``hazards in operation'' might be construed to mean external threats to
the engine from foreign object ingestion or a crosswind, causing
confusion for applicants seeking to meet the proposed requirements and
making it difficult to accurately interpret proposed Sec.  23.925. To
remedy this concern, ANAC recommended that proposed Sec.  23.925
include a requirement for an applicant to demonstrate the proper
functioning of the powerplant in normal operation within the range of
operating limits of the power unit.
    In light of these comments, the FAA revises proposed Sec.
23.925(a) (now Sec.  23.2425(a)) to require the installed powerplant to
operate without any hazardous characteristics during normal and
emergency operation within the range of operating limitations for the
airplane and the engine. The FAA finds this change from what was
proposed indicates that evaluation of all traditional operational
characteristics required by former regulations is also required by
Sec.  23.2425(a). The FAA has added the term ``installed'' before
``powerplant,'' in response to Textron, to clarify that Sec.
23.2425(a) applies to the operation of the powerplant, as installed.
The FAA notes if the installation of powerplant components do not
remain within established limits, Sec.  23.2400 requires any deviation
from the component limitations or installation instructions must be
shown to not create a hazard. Additionally, the requirement to evaluate
the powerplant installation for vibration and fatigue characteristics
is contained in Sec.  23.2400.
    Textron also recommended the FAA revise proposed Sec.  23.925(a) to
require the powerplant to operate at any condition, including negative
acceleration. The Associations suggested the FAA remove the term

``negative acceleration'' from paragraph (a) and replace it with
``acceleration or deceleration.''
    In response to Textron and the Associations, the FAA has removed
the term ``negative acceleration'' from the regulation because the more
general reference to ``normal and emergency operation'' in the revised
language includes ``negative acceleration.'' Additionally, the FAA
notes that Sec.  23.2400(c) requires an applicant to construct and
arrange each powerplant installation to account for likely operating
conditions and likely hazards in operation. This requirement addresses
all components and systems that comprise the powerplant installation,
such as the oil and fuel systems, and establishes a requirement for the
applicant to address all likely conditions and hazards, which may not
be specifically encountered in the approved operating envelope. The
original intent of former Sec.  23.943 was to ensure no hazardous
condition resulted when a powerplant or APU is exposed to negative
accelerations expected in flight. The FAA finds that Sec.  23.2425(a),
together with Sec.  23.2400(c), adequately address this need.
    The Associations also submitted comments regarding proposed Sec.
23.925(c), which would have required an airplane have an independent
power source for restarting the engine after an in-flight shutdown.
These commenters contended the FAA's intent in drafting Sec.  23.925(c)
was to ensure that engines can be reliably restarted in flight
following an in-flight shutdown. However, these commenters noted while
an independent power source may be an adequate solution for some
designs, there are many designs for which an independent power source
would be inappropriate. For example, the Associations stated that
electric propulsion systems may include a single power source that
manages many cells, which start and stop in flight, but will not have
independent sources of power to restart them. As written, the
commenters suggested proposed Sec.  23.925(c) could be interpreted to
require that a two[hyphen]engine airplane needs three batteries for
restarting (one main and an independent source for each powerplant). To
address these concerns, the commenters recommended the FAA require the
airplane to have a ``reliable'' power source, rather than an
``independent'' power source.
    Textron, Garmin, and an individual commenter had similar concerns
regarding proposed Sec.  23.925(c). Garmin recommended either
withdrawing proposed Sec.  23.925(c) or clarifying its intent. Textron
commented that proposedSec.  23.925(c) was ``too high level'' and did
not provide adequate performance-based requirements for an applicant to
demonstrate compliance. Textron recommended the FAA revise proposed
Sec.  23.925(c) based upon language contained in appendix E of the
ARC's final report.'' The individual commenter noted that proposed
Sec.  23.925(c) would appear to require multiengine airplanes to have
multiple and possibly duplicate electronic distribution systems for in-
flight restarts by battery power. The commenter suspected this was an
unintended expansion of the requirements of former Sec. Sec.  23.903(g)
and (or alternatively) Sec.  23.1165. The commenter stated this
unintended consequence would impose cost and weight penalties beyond
former part 23 requirements, which the commenter maintained were not
addressed in the regulatory analysis or the preamble to proposed Sec.
23.925(c), or otherwise justified by service experience. The individual
commenter recommended the FAA either withdraw proposed Sec.  23.925(c)
or clarify its intent.
    In response to the significant number of comments the FAA received
regarding the proposed requirement that each airplane have an
independent power source for restarting the engine after an in-flight
shutdown, the FAA withdraws Sec.  23.925(c). The FAA's intent in
drafting proposed Sec.  23.925(c) was to ensure a power source,
independent from any power generated by a particular engine shutdown in
flight, be available for restarting the powerplant. This requirement
was originally adopted as former Sec.  23.903 to address ignition
systems on turbine engines and to ensure a source of ignition energy
for in-flight engine restarting exists in the event of a loss of
combustion in all engines during flight. The requirement in Sec.
23.2425(b), which requires the pilot have the capability to stop the
powerplant in flight and restart the powerplant within an established
operational envelope, establishes the performance-based requirement the
prescriptive requirements of proposed Sec.  23.925(c) were intended to
address. The FAA's intent was not to require redundant electrical
power; rather, the intent was to require power independent from that of
the engine-driven electrical power generating system to be available if
insufficient power was available at the minimum windmilling restart
speed. If an engine power generating system is capable of providing
sufficient power to operate all required systems at the minimum
windmilling restart speed, or in a normal shutdown state, an
independent power source would not be required.
    In recognition that an aircraft engine may not be able to be
restarted within an airplane's entire flight envelope, the FAA revises
proposed Sec.  23.925(b) (now Sec.  23.2425(b)) to require restart
capability within an established operational envelope, which in
accordance with Sec.  23.2620 (proposed as Sec.  23.1510), must be
documented in the AFM.
g. Fuel Systems (Proposed Sec.  23.930/Now Sec.  23.2430)
    In the NPRM, proposed Sec.  23.930 (now Sec.  23.2430) would have
required that each fuel system provide an independent fuel supply to
each powerplant in at least one configuration and avoid ignition from
unplanned sources. It would have required that each fuel system provide
the fuel required to achieve maximum power or thrust plus a margin for
likely variables in all temperature conditions within the operating
envelope of the airplane and provide a means to remove the fuel from
the airplane. Finally, proposed Sec.  23.930 would have required each
fuel system to be capable of retaining fuel when subject to inertia
loads under expected operating conditions and prevent hazardous
contamination of the fuel supply.
    The Associations asserted that proposed Sec.  23.930 does not
permit the certification of electric propulsion systems. These
commenters recommended the FAA delete the word ``fuel'' from the title
of proposed Sec.  23.930 and adopt the provisions of proposed CS
23.530. Additionally, the commenters suggested replacing ``fuel'' with
``energy'' to clarify the requirements of this regulation are
applicable to all energy sources and not just traditional petroleum-
based fuels.
    EASA, while recognizing that the term ``fuel'' covered other energy
sources, stated it believed a more independent set of design
requirements would be needed to address all energy systems, rather than
those that are more appropriate for propulsion systems and APUs.
Additionally, EASA specifically recommended adoption of its set of
requirements for energy supply systems, set forth in A-NPA 2015-06,
which provided useful requirements for a variety of systems, including
fuel, electric, and hybrid systems. EASA also noted that its A-NPA
2015-06 created several new subparagraphs to address particular
functions of an energy system.
    The FAA did not intend to preclude the certification of electric
propulsion systems or other non-fossil-fuel-based propulsion systems in
part 23. The FAA

agrees the use of the term ``fuel'' rather than the term ``energy''
could lead individuals to reach this conclusion. However, the FAA is
concerned that adoption of the term ``energy'' in this rule, and
throughout this subpart, could lead to confusion, because the term
``energy'' is used in numerous regulations and in guidance material to
address requirements for other systems and components (i.e., braking
systems and rotating machinery) and also to describe environmental
conditions (i.e., those involving lightning). Therefore, the FAA
retains the term ``fuel'' in the regulation, but notes the term
``fuel'' in this subpart includes any form of energy used by an engine
or powerplant installation, such as provided by carbon-based fuels or
electrical potential. Fuel systems will also include the means of
energy storage for the power provided (i.e., batteries that provide
power to an electric motor) or devices that generate power for
propulsion (i.e., solar panels or fuel cells). Furthermore, while the
FAA agrees with many of the provisions proposed by EASA, the FAA is
electing to retain the requirements for energy systems under a single
section, titled ``Fuel system.'' While Sec.  23.2430 and EASA's
proposed language may not be identical, the FAA finds Sec.  23.2430
harmonizes with the intent of EASA's requirements.
    The FAA notes EASA's recommendation to adopt EASA's proposed
language to address powerplant support systems to replace its current
regulatory requirements for induction and exhaust section systems. The
FAA has decided to retain a specific section to address powerplant
induction and exhaust systems. The FAA will address future energy
systems that incorporate systems such as converters or battery cooling
as part of the powerplant installation. The FAA notes the requirements
for those future systems will be adequately addressed in Sec. Sec.
23.2400, 23.2410, and 23.2430.
    ANAC stated that proposed Sec.  23.930 does not address the
requirements of former Sec.  23.951(d), which required fuel systems for
turbine engine airplanes to meet the fuel venting requirements of part
34. ANAC stated the former requirement applied to airplanes and not
engines, and should therefore be specifically included in the rule.
ANAC also recommended the reference in the former rule to part 34,
which prevents intentional fuel venting, be included in the new rule.
    The FAA notes part 23 historically provided only a reference to
part 34, and those requirements continue to remain applicable to the
certification of any airplane. Sections 21.17 and 21.101 require part
34 to be always included in the certification basis of airplanes.
Requirements such as fuel venting will therefore continue to apply to
the certification of these airplanes.
    Textron suggested deleting the term ``avoid'' and inserting the
phrase ``prevent hazardous'' in proposed Sec.  23.930(a)(2), which
addressed the avoidance of ignition from unplanned sources. Textron
noted that using the term ``prevent'' would be consistent with the use
of the term in other sections of part 23.
    An individual commenter also raised concerns about the undefined
term ``avoid'', and questioned whether the term was an absolute,
probability, or minimize requirement, or whether it covers single or
multiple failures. Presuming the proposed requirement covered fuel
ignition by lightning strikes addressed in former Sec.  23.954, the
commenter requested the proposed rule not be more stringent than the
former rule, which imposes an absolute requirement to prevent ignition
hazards but only for certain types of strikes and strike locations. The
commenter noted the FAA did not discuss the rationale, interpretation,
or intent of this requirement in the NPRM preamble. The commenter also
noted that the draft ASTM standard was identical to former Sec.
23.954, and remarked that it was unclear why proposed Sec.  23.910 did
not address this requirement. The commenter agreed with Textron and
recommended inserting the term ``hazardous'' before ``ignition'' in
paragraph (a)(2) to better clarify the proposed requirement.
    Embraer and other commenters raised concerns about use of the term
``unplanned sources'' in proposed Sec.  23.930(a)(2). Embraer noted
there are no ``planned'' ignition sources, making compliance with the
rule impossible. Embraer proposed revising the requirement to account
for ignition sources not shown to be extremely improbable, and proposed
the rule require that each fuel system be demonstrated that it is
designed and arranged to prevent catastrophic ignition from sources not
shown to be extremely improbable; taking into account flammability,
critical lightning strikes, and failures within the fuel system.
Textron noted the NPRM preamble discussion for ``unplanned sources'' or
``unknown sources'' was impossible to design for because it was too
vague.
    The FAA agrees the proposed requirement for unplanned sources was
vague and could result in numerous interpretations. Section
23.2430(a)(2) is intended to prevent catastrophic effects resulting
from ignition of an airplane's fuel source due to lightning, or from
corona or streamering at fuel vent outlets, as former Sec.  23.954
required. It is not intended to impose additional requirements to
protect the fuel system from other ignition sources. The FAA revises
Sec.  23.2430(a)(2) based upon former Sec.  23.954 to more accurately
convey this requirement and to ensure its application to any fuel used
to power an airplane. This revision also addresses the commenters'
concerns regarding the meaning of ``avoid'' and ``unplanned sources''
by using the phrase ``prevent ignition'' and by enumerating the
specific ignition sources that must be addressed.
    Embraer also stated the phrase ``margin for likely variables'' in
proposed Sec.  23.930(a)(3) could generate confusion as to what margins
must be observed when providing the fuel required to provide maximum
power or thrust. The commenter explained that ``margin'' is usually
used to define a rate higher than what is required for an engine's
proper operation in the expected envelope and for the expected life of
operation, but stated the meaning of the term ``likely variables'' is
not clear. The commenter noted that the former rule considered a
determination of the worst fuel rate for proper operation. Embraer
suggested using text similar to that found in former Sec.  23.951(a).
    The FAA agrees with Embraer's comment that proposed Sec.
23.930(a)(3) could generate confusion as to what margins must be
observed when providing the fuel required to provide maximum power or
thrust. Therefore, the FAA revises paragraph (a)(3) to require the fuel
system provide fuel necessary to ensure proper operation of each
powerplant and APU, in all likely operating conditions. This
requirement ensures adequate fuel can be provided for proper operation
of any powerplant or APU. The FAA notes an applicant's means of
compliance with this requirement should consider the worst case
conditions for fuel flow, including any additional demand due to
expected efficiency losses, consumption by other systems, or secondary
requirements such as engine cooling.
    Embraer stated that it understood proposed Sec.  23.930(a)(4)
required a means to remove fuel and referred to fuel storage.
Therefore, Embraer suggested the FAA move the requirement in proposed
paragraph (a)(4) to Sec.  23.930(b), which addressed fuel storage
systems. Embraer suggested that the cross-reference table be updated

accordingly for former Sec.  23.971 and Sec.  23.999.
    An individual commenter requested the proposed regulations include
a requirement for determining or indicating usable or unusable fuel or
energy quantities, as was formerly required. This commenter noted that
because fuel starvation is ``always'' cited as one of the top reasons
for off-field landings in general aviation accidents, it should be
adequately addressed by a specific performance requirement in part 23.
    The FAA agrees with the recommendation to add a requirement to the
final rule to ensure the flightcrew is provided with information on the
total useable fuel available. The FAA adds this requirement as Sec.
23.2430(a)(4), corresponding to the requirement in former Sec.
23.1337(b), which required a means to indicate to the flightcrew
members the quantity of usable fuel in each tank. The intent of this
revision is to require applicants to both determine the usable quantity
of fuel that can be stored and provide information to the flightcrew
regarding the remaining useable fuel in the airplane.
    The FAA has decided not to move proposed paragraph (a)(4) as
Embraer suggested. Since different types of fuel systems could be
certificated under the rule, the FAA has added the term ``isolate'' in
Sec.  23.2430(a)(5). The FAA recognizes that certain fuel sources may
not be removable from the system, and that isolating the fuel from the
system will provide the appropriate minimum level of safety.
    Additionally, the FAA clarifies Sec.  23.2430(a)(5) to require the
fuel system be designed to retain fuel under all likely operating
conditions and minimize hazards to the occupants during any survivable
emergency landing. The FAA also includes a requirement in Sec.
23.2430(a)(6) that these failures be taken into account, consistent
with former Sec.  23.967. For the certification of level 4 airplanes,
the paragraph also provides that any failure due to an overload of the
landing system is taken into account in airplanes equivalent to those
currently certificated in the commuter category, consistent with former
Sec.  23.721.
    An individual commenter asked the FAA to revise proposed Sec.
23.930(a)(6), which would require the fuel system prevent hazardous
contamination of the fuel supply, to specify that the requirement was
intended to prevent hazardous contamination of fuel delivered to
engines. The commenter noted this revision was necessary if, as the
preamble indicated, this requirement replaces former Sec.  23.997. The
proposed requirement could be interpreted to require prevention of
contamination of fuel within the fuel tank, which would be more
stringent than the former rule and of questionable practicality. The
former rules only required removal of contamination from the fuel being
provided to the engine, and not necessarily from the fuel in the tank.
    The FAA agrees with the commenter and revises Sec.  23.2430 to
require removal of hazardous contamination from the fuel supplied to
each powerplant and APU. This requirement is now in new Sec.
23.2430(a)(7).
    Embraer recommended the FAA revise proposed Sec.  23.930(b)(1) to
require fuel storage systems to also withstand without failure, the
vibration, inertial loads, and pressures under expected operating
conditions.
    The FAA agrees with Embraer that fuel storage systems must be able
to withstand loads and pressures under expected operating conditions
without failure and has added the term ``without failure'' to paragraph
(b)(1). However, the FAA does not add specific references to vibration,
inertia, fluid, and structural loads as the FAA believes the use of
``loads under likely operating conditions'' addresses all applicable
loads, including those resulting from vibration and other sources.
    The FAA revises Sec.  23.2430(b)(2) to require the fuel storage
system be isolated from personnel compartments and protected from
hazards due to unintended temperature influences. The FAA recognizes
that it did not adequately address these requirements in the NPRM. This
revision addresses the requirements of former Sec.  23.967(c) and (d),
which restricted installation of fuel tanks around engine compartments
and firewalls, and required fuel systems to be isolated from personnel
compartments. It is also consistent with the provisions of CS
23.2465(b)(2), which requires each energy storage and supply system to
be installed in such a way to be protected against hazards due to
unintended temperature influence.
    Air Tractor requested adding the term ``significant'' after
``prevent'' in proposed Sec.  23.930(b)(2). Embraer concurred with this
revision because it would allow for small amounts of fuel loss through
vent lines, such as when the tanks are full and there is normal
``sloshing'' during taxi or takeoff, or when fuel expands as it warms.
An individual commenter also requested revising proposed Sec.
23.930(b)(2) to specify the fuel storage system must prevent hazardous
fuel loss during maneuvers. The commenter believed the proposal would
require the prevention of even minor fuel loss from vents, which is
more stringent than the former standard. The commenter believed the
more stringent standard was of questionable utility and practicality,
and noted it was not justified in the preamble.
    An individual commenter requested the FAA delete proposed Sec.
23.930(b)(3), which would require each fuel storage system to prevent
discharge when transferring fuel, because other proposed regulations
would address any potential hazards associated with fuel transfer. The
commenter further stated it was unclear if the proposed requirement
would apply to fuel returned from the engine to other than the
specified tank. This commenter explained that some multiengine
airplanes feature fuel-transfer cross feeding, which can result in a
fuel discharge if the receiving tank is full. This approach has both
advantages and disadvantages, but should not be prohibited by
regulation. The commenter also noted this proposal was not justified in
the preamble or addressed in the Regulatory Analysis, was more
stringent than the former rule, and would require additional hardware
or revised architecture for some designs.
    The FAA agrees with the recommendation to delete the requirement in
proposed paragraph (b)(3) that each fuel storage system prevent
discharge when transferring fuel. The FAA recognizes it has approved
the design of certain fuel systems under former regulations that may
result in a non-hazardous discharge of small amounts fuel when fuel is
transferred between fuel tanks or fed from a specific fuel tank and
returned to another tank under certain conditions. To ensure the
continued acceptability of these systems under the new rule, the FAA
has combined proposed paragraph (b)(2) and (b)(3) into paragraph (b)(3)
in this final rule. Paragraph (b)(3) now requires the fuel system to be
designed to prevent significant loss of stored fuel from any vent
system due to fuel transfer between storage or supply systems under
likely operating conditions.
    One commenter stated the proposed rule did not specifically address
the potential of water in the airplane's fuel system, and the commenter
proposed it should contain a requirement to include fuel tank water
sensors. The commenter noted that water accumulates in fuel tanks in a
number of ways, such as when temperature changes or when air enters a
tank from which fuel has been consumed.
    The FAA notes the specific hazard associated with water in
petroleum-based fuels is addressed generally in

Sec.  23.2430(a)(7), which requires the prevention of hazardous
contamination of the fuel supplied to the powerplant. Additionally, the
FAA notes that a compound such as water may not necessarily be
considered a contaminant or hazard in certain future fuel systems. The
commenter's proposal would introduce specific language that may not be
appropriate for future fuel systems and has therefore not been adopted.
    Finally, the FAA revises Sec.  23.2430(c) to remove the restrictive
language applicable only to pressure refueling systems. The rule now
applies to fuel storage refilling and recharging systems. This revision
will establish more appropriate requirements to accommodate the
introduction of new propulsion systems such as electric motors.
Accordingly, the FAA adopts performance-based requirements that will
require prevention of improper refilling or recharging, prevention of
stored fuel contamination during likely operating conditions, and the
prevention of the occurrence of any hazard to the airplane or to
persons during refilling or recharging.
h. Powerplant Induction and Exhaust Systems (Proposed Sec.  23.935/Now
Sec.  23.2435)
    In the NPRM, proposed Sec.  23.935 (now Sec.  23.2435) would have
required the air induction system to supply air needed for each power
unit and its accessories under expected operating conditions, and
provide a means to discharge potential harmful material.
    EASA recommended removal of the design-specific requirements in
proposed Sec.  23.935 because those requirements should be addressed as
a means of compliance. Textron requested a complete rewrite of proposed
Sec.  23.935, stating the section was ``too high level'' and did not
provide adequate performance-based requirements for an applicant to be
able to demonstrate compliance. Textron asked the FAA to derive the
language for proposed Sec.  23.935 from appendix E of the final Part 23
ARC Report.
    The FAA notes EASA's recommendation to remove Sec.  23.935 based on
its contention the section appears to be a means of compliance instead
of a performance-based requirement. However, the FAA finds the
provisions of the rule set forth performance-based requirements for
induction and exhaust systems that are appropriate for inclusion in
this rule. Rather than stipulating a specific means of compliance,
these requirements serve as high-level performance-based requirements
for which a number of alternative means of compliance could be
developed by applicants.
    The FAA partially agrees with Textron's comment that the rule is
``too high level.'' Accordingly, the FAA revises Sec.  23.2435 based on
the requirements for powerplant induction and exhaust systems contained
in former Sec. Sec.  23.1091, 23.1121, 23.1123, 23.1125, and the final
Part 23 ARC Report. Section 23.2435 now sets forth performance-based
requirements that encompass these prescriptive regulations and the Part
23 ARC's proposed requirements. The FAA notes while it is adding all of
the ARC's proposed requirements for exhaust and induction systems in
this rule, not all of its recommendations for revisions to this section
were appropriate. Some of the ARC's recommendations are more
appropriately addressed by other sections of this rule. For example,
the ARC's proposed requirement for the system that supplies air to the
cabin to prevent hazardous quantities of toxic gas from entering the
cabin is addressed by Sec.  23.2400(d) while the engine accessory
component cooling requirements are addressed by Sec.  23.2400(e), which
requires powerplant components to comply with their limitations and
installation instructions, or be shown not to create a hazard.
    Embraer requested the FAA revise proposed Sec.  23.935 to clarify
the design and induction system must prevent distortion as described in
former Sec.  23.939(c). Embraer also recommended the FAA revise the
proposal to include a requirement that the air induction system for
each power unit and its accessories must not, as a result of airflow
distortion during normal operation, cause vibration harmful to the
power unit.
    The FAA notes that former Sec.  23.939(c) addressed distortion as a
cause of vibration and required the air inlet not, as a result of
distortion during normal operation, cause vibration harmful to the
engine. Embraer's general concerns are addressed by Sec.
23.2435(a)(1), which requires the air induction system for each
powerplant or auxiliary power unit and its accessories to supply the
air required under likely operating conditions. Embraer's specific
concern that the air induction system not cause ``vibration harmful to
the power unit'' is addressed by the powerplant installation
requirements contained in Sec.  23.2400(c)(4), which requires the
applicant to ``construct and arrange each powerplant installation to
account for . . . vibration and fatigue,'' which occur as a result of
distortion.
    Air Tractor and ANAC raised concerns about whether proposed Sec.
23.935(b) was intended to address exhaust systems or air induction
systems. Air Tractor stated it did not believe the FAA intended
proposed Sec.  23.935(b) to mandate the use of an inertial bypass
particle separator (as proposed Sec.  23.935(b) could have been
interpreted to require), and recommended the FAA clarify proposed Sec.
23.935(b) to indicate the requirement applies only to exhaust systems.
ANAC commented that proposed Sec.  23.935(b) should require the exhaust
system to ensure safe disposal of exhaust gases, as the former rule
required.
    The FAA agrees with Air Tractor and ANAC's concern that proposed
Sec.  23.935(b) is unclear because it only appears to discuss induction
systems (whereas the title of proposed Sec.  23.935 includes exhaust
systems). Accordingly, the FAA has modified Sec.  23.2435 to clearly
indicate the requirements of paragraph (a) apply to induction systems
and the requirements of paragraph (b) apply to exhaust systems. This
makes it clear the rule does not require use of an inertial bypass
particle separator as a means for the induction system to discharge
potential harmful material.
    If a complete rewrite of proposed Sec.  23.935 is not adopted,
Textron requested clarification as to whether the proposed requirements
were intended to address the cooling air requirements for powerplant
accessories in former Sec. Sec.  23.1041 through 23.1047, and the
intent of former Sec.  23.1091. If proposed Sec.  23.935 was intended
to match the provisions of former Sec.  23.1091, Textron commented that
the proposed section was adequate. However, if proposed Sec.  23.2435
was intended to address Sec. Sec.  23.1091 and 23.1041 through 23.1047,
Textron asked for clarification of the proposed section's requirements.
Textron also specifically recommended revising the regulatory text to
clarify the intent of the proposed requirements were ``to ensure proper
operation within established limitations'' of the air induction system
for each power unit and its accessories.
    The FAA notes the engine cooling requirements are not specifically
addressed in Sec.  23.2435, other than in a requirement that the
induction system be designed to supply the air required by each
powerplant or auxiliary power unit and its accessories under likely
operating conditions. However, the powerplant cooling requirements are
addressed more directly by Sec.  23.2400(e), which requires powerplant
components to comply with their limitations and installation
instructions, or be shown not to create a hazard. This requirement

ensures an applicant addresses engine cooling.
    Additionally, the FAA revises proposed Sec.  23.2435(b) to
specifically indicate exhaust systems include exhaust heat exchangers
for each powerplant or APU. Specifically referencing these systems as
part of the airplane exhaust system continues the FAA's practice of
applying exhaust system requirements to exhaust heat exchangers. The
FAA also revises requirements for exhaust systems by adding paragraph
(b)(2) to ensure these systems are designed to prevent likely hazards
from heat, corrosion, or blockage. These requirements address the
specific requirements of former Sec.  23.1121(a) and (h) and Sec.
23.1123(a).
i. Powerplant Ice Protection (Proposed Sec.  23.940/Now Sec.  23.2415)
    In the NPRM, proposed Sec.  23.940 (now Sec.  23.2415) would have
required the airplane design to prevent foreseeable accumulation of ice
or snow that would adversely affect powerplant operation. Proposed
Sec.  23.940 would have also required the powerplant design to prevent
any accumulation of ice or snow that would adversely affect powerplant
operation, in those icing conditions for which certification is
requested.
    Textron recommended withdrawing proposed Sec.  23. 940, as it
believed the requirement to protect engines could be adequately
addressed in proposed Sec.  23.910 by including language that would
ensure safe powerplant operation under all likely operating conditions
or enable satisfactory powerplant functioning in icing conditions.
Alternatively, Textron proposed consolidating the requirements of
proposed Sec.  23.940 by removing paragraph (b) and revising paragraph
(a) to require the airplane design prevent ``any accumulation''--rather
than ``foreseeable accumulation''--of ice or snow that adversely
affects powerplant operation in those icing conditions for which
certification is requested.
    The FAA does not agrees that eliminating proposed Sec.  23.940 (now
Sec.  23.2415) and adding a requirement to proposed Sec.  23.910 (now
Sec.  23.2410) would result in designs that would prevent the
accumulation of ice or snow that could adversely affect powerplant
operations. Including Textron's proposed regulatory language in Sec.
23.2410 as part of the powerplant installation hazard assessment could
permit designs that only address ice accretion as part of a powerplant
installation assessment, and not airframe ice accretion that may pose
an ice shed hazard. Additionally, Textron's proposal could be
interpreted to only require the powerplant's performance be evaluated
for the environmental icing conditions for which certification is
requested, and not for other conditions that may be conducive to ice
accretion in reciprocating engine induction systems. In contrast, the
FAA finds Sec.  23.2415 establishes specific requirements that will
apply to all airplane designs, to include those for which certification
in icing conditions was not requested, and adds requirements that will
apply to powerplant designs for airplanes intended for certification
for flight in icing conditions.
    The FAA also finds Textron's recommendation to revise proposed
Sec.  23.940(a) and withdraw paragraph (b) would specifically eliminate
the applicability of the requirement to the powerplant design. By only
setting forth a requirement for the airplane design and not the
powerplant design, Textron's proposed revision would neither ensure an
independent assessment of the adequacy of the engine design for icing
conditions, nor require an evaluation of the engine's tolerance for ice
ingestion. Additionally, it would not apply to propellers, which are
considered powerplant components. The FAA's intent in paragraph (b) is
to require an applicant to assess the adequacy of the engine's
certification basis for installation in an airplane, the engine's
service history of ice ingestion, and propeller design.
    The FAA expects that an acceptable means of compliance would
specify an evaluation of the engine's tolerance for ice ingestion that
would not be limited to the conditions specified in part 25, appendix
C, and that such an evaluation would show that it meets, or exceeds,
those standards prescribed in former Sec.  23.903(a)(2).
    Textron also commented that proposed Sec.  23.940 does not address
ice accretion that could affect the performance of cooling air inlets
for the engine and its accessories.
    In light of Textron's comment, the FAA is adding the term
``installation'' to proposed Sec.  23.940(b) to clarify the regulation,
like former Sec.  23.929, applies to ``other components of complete
engine installations,'' which include cooling air inlets. Accordingly,
Sec.  23.2415(b) now requires the ``powerplant installation design'' to
prevent any accumulation of ice or snow that adversely affects
powerplant operation, in those icing conditions for which certification
is requested. This change from what was proposed is consistent with the
NPRM, which explained that powerplant design in proposed Sec.
23.940(b) refers to the engine, propeller, and other powerplant
components such as cooling inlets.
    Additionally, the FAA is inserting the phrase ``including the
induction and inlet system'' after ``airplane design'' to clarify that
Sec.  23.2415(a) is intended to address the engine induction ice
protection requirements found in former part 23. This change from what
was proposed is consistent with the NPRM, which explained that the
airplane design in proposed Sec.  23.940(a) refers to the engine
induction system and airframe components on which accumulated ice may
shed into the powerplant. The FAA also reiterates that paragraph (a)
applies to all airplanes regardless of whether certification for flight
in icing conditions is sought, and requires applicants to address ice
accretion anywhere on the airplane that may pose a threat to the
powerplant if that ice is shed. ``Foreseeable'' accumulation of ice and
snow, rather than ``any'' accumulation as recommended by Textron, is
used in paragraph (a). The icing and snow conditions to be evaluated
are not simply the icing conditions for which the airplane is to be
certified, as in paragraph (b). For example, on non-icing certified
airplanes, conditions to be evaluated range from carburetor icing on
reciprocating powered airplanes to part 25, Appendix C icing on turbine
powered airplanes.
j. Powerplant Fire Protection (Proposed Sec.  23.1000/Now Sec.
23.2440)
    In the NPRM, proposed Sec.  23.1000 (now Sec.  23.2440) would have
required a powerplant be installed in a designated fire zone and would
have required an applicant to install a fire detection system in each
designated fire zone for levels 3 and 4 airplanes. Proposed Sec.
23.1000 would have also required an applicant to install a fire
extinguishing system for levels 2, 3, and 4 airplanes with a powerplant
located outside the pilot's view that uses combustible fuel.
    Additionally, proposed Sec.  23.1000 would have required each
component, line, and fitting carrying flammable fluids, gases, or air
subject to fire conditions to be fire resistant, except components
storing concentrated flammable material would have to be fireproof or
enclosed by a fireproof shield. Proposed Sec.  23.1000 would have also
required an applicant to provide a means to shut off fuel or flammable
material for each powerplant, while not restricting fuel to remaining
units, and prevent inadvertent operation.
    EASA noted the proposed regulation contained too many design
details,

which are better addressed as means of compliance. EASA contended that
the sole objective of proposed Sec.  23.1000 should be to require a
means to isolate and mitigate hazards to the airplane in the event of a
powerplant system fire or overheat in operation.
    Although the FAA concedes that some of the proposed requirements
are prescriptive in nature, the FAA has determined that inclusion of
these requirements for fire protection are critical to safety and
should be retained to prevent any potential degradation of safety.
Fire, while not a common occurrence, greatly reduces the likelihood of
survival when occurring in flight. Detection, isolation, and
extinguishing have historically provided an acceptable means for
mitigating hazards from powerplant-related fires. Accordingly, the
final rule retains what the FAA considers to be sufficient prescriptive
requirements to ensure the existing level of fire protection. In
response to EASA's comment, as discussed in more detail later, the FAA
has added a requirement in Sec.  23.2440(b), requiring each designated
fire zone provide a means to isolate and mitigate hazards to the
airplane in the event of a powerplant system fire or overheat.
    Zee questioned whether the requirement in proposed Sec.  23.1000(a)
for all powerplants to be installed in a designated fire zone is
appropriate. The commenter noted electric propulsion systems can be
designed and installed with no flammable liquids or materials, thus
eliminating the need for fire protection. Zee requested the FAA revise
proposed paragraph (a) to indicate installation in a fire zone is not
required if not applicable. The Associations also recognized the same
issue and proposed revising the requirement to only apply to flammable
powerplant components. Embraer recommended the FAA delete proposed
Sec.  23.1000(a).
    ANAC observed that the intent to define ``designated fire zones''
in the proposal is to identify areas of the airplane in which a high
degree of safety precautions must be taken, recognizing that fire will
occur in these regions because of the presence of both ignition sources
and flammable fluid. ANAC contended proposed Sec.  23.1000 could be
interpreted as the region where a powerplant is to be installed must
first be evaluated for ignition sources and flammable fluids. ANAC
noted the proposed requirement could also be interpreted as the
powerplant can only be installed in regions that already contain
ignition sources and flammable fluids. Embraer contended that former
Sec.  23.1181 defined the ``hot'' parts of an engine installation as
ignition sources, and considering that there are fuel, oil, and
hydraulic fluids being carried around such areas, they should be
considered fire zones. Thus the term ``designated'' would apply,
obviating further analysis.
    The FAA has considered the comments regarding the requirement to
install all powerplants in proposed Sec.  23.1000(a) (now Sec.
23.2440(a)) in a designated fire zone. The FAA notes that while
virtually every kind of powerplant (to include electric motors) may
present a potential fire hazard, some types of powerplants may not
present a likely fire hazard or require installation in a designated
fire zone. Accordingly, the FAA revises Sec.  23.2440(a) to require a
powerplant be installed in a designated fire zone only if it includes a
flammable fluid and an ignition source for that fluid. The term
``flammable fluid'' includes any flammable substance such as liquids,
gases, or gels that are capable of flowing. This change is intended to
alleviate the need to install powerplants that do not present a likely
fire hazard in a designated fire zone. The FAA also adds the term
``combustion heater'' to Sec.  23.2440(a), which are required to be
located in designated fire zones under former Sec.  23.1181. The
devices were inadvertently omitted from consideration under the fire
and high-energy protection requirements of proposed subpart D.
    ANAC noted the NPRM preamble discussion indicated that fire must be
evaluated in the powerplant installation hazard assessment required
under proposed Sec.  23.910. ANAC expressed concern the dedicated
requirement for powerplant fire protection in proposed Sec.  23.1000
could be interpreted to require evaluation of fire hazards beyond the
scope of proposed Sec.  23.910. ANAC recommended the FAA include a
requirement for a firewall that ensures a fire originating in any fire
zone will not be a hazard to the airplane.
    The FAA did not intend to require the use of a hazard assessment
process in proposed Sec.  23.1000 (now Sec.  23.2440). The FAA notes
the purpose of the firewall discussion in proposed Sec.  23.1000 is to
determine if a particular component or system would need to be placed
in a designated fire zone. If a component is required to be located in
a fire zone by a rule other than Sec.  23.2410, such as Sec.
23.2440(a), that requirement must be complied with regardless of the
results of any hazard assessment. The FAA revises Sec.  23.2440(a) to
require that a powerplant, APU or combustion heater, that includes a
flammable fluid and an ignition source for that fluid, be installed in
a designated fire zone. In response to ANAC's recommendation to add a
requirement for a firewall that ensures a fire originating in any fire
zone will not be a hazard to the airplane, the FAA notes Sec.
23.2440(b) requires each designated fire zone provide a means to
isolate and mitigate hazards to the airplane in the event of a
powerplant system fire or overheat. Isolation of a designated fire zone
is typically accomplished by use of a firewall or other equivalent
means.
    An individual commenter raised concerns that proposed Sec.
23.1000(b) fails to address critical fire protection requirements and
only requires components carrying flammable liquid to be fire
resistant. Specifically, the commenter noted that former Sec.
23.1141(f) required powerplant controls required to operate in the
event of a fire to be fire resistant, former Sec.  23.1189 required
shutoff valves to be outside the fire zone, former Sec.  23.1203
required certain fire detector components to be fire resistant, and
former Sec.  23.1201 required fire extinguisher components in the fire
zone to be fireproof. To resolve this, the commenter recommended
implementation of basic system performance requirements for fire
protection, preserving the former fire protection standards, but not
compromising future designs. Another commenter noted the proposed rule
did not capture some of the specific fire protection requirements for
items such as powerplant controls, shutoff valves, fire detectors and
extinguishers.
    The FAA agrees the proposed language was not sufficiently
comprehensive to establish clear requirements necessary for the
prevention of hazards resulting from fire. The FAA revises proposed
Sec.  23.1000(b) and renumbers it as Sec.  23.2440(c) to ensure
adequate fire protection is maintained for those noted components,
along with any other components determined critical to safety. The FAA
adds paragraph (c)(1) to ensure the design of components and the
placement within the airplane not only prevent fire hazards but also
account for the effects of fire in adjacent fire zones. This
requirement addresses the requirements in former Sec.  23.1183(a) to
ensure flammable fluid-carrying components be shielded, or located to
safeguard against the ignition of flammable fluid. These requirements
are also consistent with the provisions of former Sec.  23.1182.
    Embraer recommended the FAA revise proposed Sec.  23.1000(c) to
allow for the flow of quantities of fuel that are

small enough not to be hazardous to enter into the powerplant. Textron
similarly asserted proposed Sec.  23.1000(c) was unnecessary and could
be addressed by proposed Sec.  23.910. Textron recommended the FAA
revise its proposal to conform with CS 23.510(e), or Sec.  23.906(i) in
appendix E of the Part 23 ARC Report.\49\ Alternatively, Textron
recommended revisions to proposed Sec.  23.1000(c), (d), and (e).
---------------------------------------------------------------------------

    \49\ In each area or component where flammable fluids or vapors
might escape by leakage of a fluid system, there must be means to
minimize the probability of ignition of the fluids and vapors, and
the resultant hazard if ignition does occur and prevent the
introduction of hazardous toxic gases into the cabin.
---------------------------------------------------------------------------

    The FAA agrees with Embraer's comment that small amounts of fuel
may still enter a powerplant after a shutoff means has been activated.
The FAA revises paragraph (c) and paragraph (d) to require that the
applicant provide a means to prevent hazardous quantities of flammable
fluid from flowing into the designated fire zone. Accordingly, this
revision will permit the flow of small amounts of residual flammable
fluid if it is shown not to present a hazard, after activation of any
shutoff means.
    With respect to Textron's comment, the FAA finds the requirements
for a means to shut off fuel or flammable material for each powerplant
necessary. The FAA has determined Sec.  23.2410 does not adequately
address this requirement because Sec.  23.2410 sets forth the
requirements for a powerplant hazard assessment in which an applicant
could feasibly conclude that a means to shut off fuel flow for each
powerplant would not be necessary to comply with the stated
requirement. At this time, the FAA does not intend to permit the
certification of airplanes without a means to shut off fuel to their
powerplants.
    The FAA also considered Textron's recommendation to revise proposed
Sec.  23.1000 to conform to CS 23.510(e) or the Part 23 ARC's proposed
Sec.  23.906(i). The FAA finds the hazard minimization requirements
contained in these provisions do not specifically preclude the
certification of an airplane without a means to shut off fuel flow to
each powerplant, a requirement the FAA considers essential for hazard
mitigation. Accordingly the FAA does not adopt that recommendation, and
considers such action to be outside the scope of this rulemaking
effort.
    Textron recommended the FAA revise the introductory text of
proposed paragraph (c) to require the applicant to provide a means to
shut off both fuel and flammable material for each powerplant. Textron
recommended changing ``or'' to ``and''; otherwise, the language would
suggest there is no requirement to shut off other flammable fluid flow.
Textron also requested the FAA to clarify that the applicant must only
demonstrate that the means of shut off, and not each powerplant, meets
the requirements of proposed paragraphs (c)(1) and (c)(2).
    The FAA agrees with Textron's concern that proposed Sec.  23.1000
could be interpreted to require shutoff of either fuel or flammable
material, which could permit a design that does not shutoff all
flammable materials to the fire zone. Therefore, the FAA removes the
term ``fuel'' from the requirement. Section 23.2440(d) now requires
prevention of all hazardous quantities of flammable fluid from entering
a fire zone. This is consistent with former Sec.  23.1189(a)(1). During
review of the existing shutoff requirements, the FAA also determined a
critical flammable fluid shutoff valve fire performance requirement was
not included in the proposed rule. Therefore, the requirement of former
Sec.  23.1189(a)(4) is included in the final rule as Sec.
23.2440(d)(3).
    The FAA notes that proposed Sec.  23.1000(d) included a qualifier
that required only powerplants that use a combustible fuel to have a
fire extinguishing system. Based on the commenter's concerns, the FAA
removes this specific requirement and revises Sec.  23.2440(a) to
require any powerplant or APU that includes a flammable fluid source
and an ignition source for that fluid be located in a fire zone. This
regulatory approach is consistent with former requirements for
designated fire zones that contain a flammable fuel and an ignition
source where any leakage of flammable fluid would likely result in a
fire. Concerns relating to possible electrical engine fires are noted,
but not considered likely such that they would require installation in
a designated fire zone. Electric motors are commonly used on airplanes,
although not for propulsion, and have not required the protection of a
designated fire zone.
    Additionally, the FAA adds paragraph (d)(3) to the final rule. The
revision requires the applicant to provide a means to prevent hazardous
quantities of flammable fluids from flowing into, within, or through
each designated fire zone located outside the fire zone unless an equal
degree of safety is provided with a means inside the fire zone. This
revision is based on the provisions of former Sec.  23.1189(a)(4) and
intends to ensure the specific requirements of that section are met by
an applicant.
    Textron also reiterated the concept that fire protection actually
applied to all systems and recommended removing proposed Sec.
23.1000(c)(2) and broadening its applicability to all systems by
placing the requirement in proposed Sec.  23.1305.
    While the FAA understands Textron's comment that fire protection
applies to all systems, the FAA notes the fire protection for areas
outside of fire zones are addressed by Sec.  23.2325 of the final rule.
The requirements for fire protection in fire zones are more extensive
than those for other areas of the airplane. The FAA requires designated
fire zones, and their corresponding extensive fire protection
requirements, for those areas where both nominal ignition sources and
flammable fluids must be co-located such that a single failure is
likely to result in a fire. Zones of the airplane that are outside a
fire zone should not contain both nominal ignition sources and
flammable fluids. Because there is a lower likelihood of fire in these
areas, they have correspondingly less extensive requirements.
    Textron also recommended revising proposed Sec.  23.1000(d) because
it believed the proposal would limit the applicability of the
requirement for a fire extinguishing system to those powerplants
``outside the pilot's view'' and those powerplants that use
``combustible fuels.'' The commenter believed the intent of the
proposal was not clear, and recommended the FAA consider the need for
extinguishing systems in hybrid electric configurations where fire
extinguishing systems may be needed to address an electrical fire.
Textron also did not believe the rule's requirement should be limited
to level 3 and 4 airplanes. Textron recommended the FAA retain the
provisions of former Sec.  23.1195, which required extinguishing
systems for ``all airplanes with engine(s) embedded in the fuselage or
in pylons on the aft fuselage.'' Textron also recommended the FAA
incorporate additional provisions from the Part 23 ARC Report, which
recommended requiring that fire extinguishing systems be installed in
all airplanes with engines embedded in the aft fuselage or in pylons on
the aft fuselage, and for an APU, if installed. The systems must not
cause a hazard to the rest of the airplane.
    Textron asserted that fire detection systems should not be
mandatory for all level 3 and 4 airplanes as proposed in Sec.
23.1000(e), but rather should be required based upon the type and
location of engines used in the airplane. The commenter recommended
using the

proposed requirements from the Part 23 ARC Report, which describes the
top level safety requirements and then would allow the industry
standard to provide more specifics as to what engine types and
configurations would require a fire detection system. Textron further
commented that proposed Sec.  23.1000(e) should be revised to only
require fire detection systems for those airplanes that have the
characteristics specified in former Sec.  23.1203(a).
    An individual commenter also noted that proposed Sec.  23.1000(d)
and (e) were inconsistent with the requirements of the former rule and,
in some cases, would impose more stringent requirements without
providing justification. Specifically, the commenter stated that, as
proposed, a level 1 or 2 airplane with the engine located outside the
view of the pilot could be required to have a fire extinguisher, but
not a fire detector. The commenter also noted a single-engine level 3
or level 4 airplane, such as a Cessna 208 or Pilatus PC-12, was not
required to have a fire detection system under the former rule, but
would be required to have such a system under the proposed rule. The
commenter further noted that the requirements of former Sec.  23.1203
were based on designs determined to be at greater risk for fire (e.g.,
multiengine turbines and reciprocating engines with turbochargers),
which justified inclusion of a fire detection system. The commenter
also noted the former rule addressed other designs and required fire
extinguishing systems for all commuter category airplanes, whereas the
proposed rule lacks these specific requirements. The commenter
recommended the FAA revise proposed Sec.  23.1000(d) and (e) to ensure
no additional burden would be placed on future designs unless justified
and to ensure the former level of fire protection would be retained.
    The FAA agrees with the commenters that proposed Sec.  23.1000(d)
and (e) were confusing and inconsistent with former fire extinguishing
and detection requirements. The FAA revises those paragraphs, now
located in Sec.  23.2440(e) and (f), to be consistent with former
requirements by removing the language limiting the applicability of the
requirements to only level 3 and level 4 airplanes, and basing the need
for a fire extinguishing system on the location of a fire zone instead
of on the location of the powerplant. However, the FAA retains the
specific requirement for a means to extinguish fires within fire zones
on level 4 airplanes, because these airplanes are functionally
equivalent to airplanes currently certificated in the commuter
category. These changes make Sec.  23.2440(e) and (d) consistent with
the requirements of former Sec. Sec.  23.1195, ``Fire extinguishing
systems,'' and 23.1203, ``Fire detector system.''
    Finally, Air Tractor also recommended adding ``if installed'' after
``fire detection system'' in proposed Sec.  23.1000(f) and (g) to avoid
the perception a fire detection system is a requirement.
    The FAA notes that, if a particular system is not required and not
installed on the airplane, any specific requirements related to that
system will not be applicable. Therefore, the FAA does not add the text
proposed by Air Tractor to the final rule.
7. Subpart F--Equipment
a. General Discussion
    The FAA proposed substantial changes to former subpart F. The
thirty-seven former system sections were consolidated into eight
sections. An effort was made to maintain the safety intent of the rules
while removing the prescriptive nature of these rules which were based
on technology available at the time the rule was introduced. This was
intended to increase future flexibility to facilitate the installation
of systems that enhance safety as new technology becomes available.
    EASA recommended the FAA add an additional requirement to proposed
subpart F that describes what system and equipment information should
be determined. EASA further suggested subpart G cover how this
information is displayed.
    The FAA finds EASA's recommendation to add a new requirement for
system and equipment information unnecessary because this information
is already addressed in several requirements, including proposed Sec.
23.1305 (now Sec.  23.2505), Function and installation; proposed Sec.
23.1400 (now Sec.  23.2540), Safety Equipment; proposed Sec.  23.1505
(now Sec.  23.2605), Installation and operation; proposed Sec.  23.1310
(now Sec.  23.2615), Flight, navigation and powerplant instruments; and
proposed Sec.  23.1515 (now Sec.  23.1529), Instructions for continued
airworthiness. The FAA agrees, however, that subpart G should address
how the information is presented.
b. Airplane Level Systems Requirements (Proposed Sec.  23.1300/Now
Sec.  23.2500)
    In the NPRM, proposed Sec.  23.1300 (now Sec.  23.2500) would have
required equipment and systems required for an airplane to operate--
     Safely in the kinds of operations for which certification
is requested;
     Be designed and installed to meet the level of safety
applicable to the certification and performance levels of the airplane;
and
     Perform their intended function throughout the operating
and environmental limits specified by an applicant.
    Proposed Sec.  23.1300 would have also mandated that
non[hyphen]required airplane equipment and systems, considered
separately and in relation to other systems, be designed and installed
so their operation or failure would not have an adverse effect on the
airplane or its occupants.
    NATCA observed the requirements of proposed Sec.  23.1300 and Sec.
23.1305 (now Sec.  23.2505) appeared similar and requested the FAA
combine the two sections.
    While the FAA agrees there is some similarity between Sec.  23.2500
and Sec.  23.2505, the requirements of Sec.  23.2500 are at the
airplane level and create a distinction between ``required'' and ``non-
required'' equipment and systems. In contrast, the requirements of
Sec.  23.2505 are at the system level and apply to all installed
equipment, regardless of whether it is required.
    Garmin asked the FAA to clarify whether proposed Sec. Sec.  23.1300
and 23.1305 are of general applicability and do not supersede other
specific part 23 requirements. Garmin noted that CS 23.600(a) includes
such clarifying language concerning CS 23.600 and CS 23.605, and that
the FAA's decision to omit similar wording from proposed Sec.  23.1300
makes it unclear whether the FAA agrees with EASA in this respect or
not.
    In light of Garmin's comment, the FAA revises proposed Sec. Sec.
23.1300 and 23.1305 to clarify the requirements of these sections apply
generally to installed equipment and systems. However, the requirements
do not apply if another section of part 23 imposes specific
requirements on a particular piece of installed equipment or systems.
The FAA finds this revision is consistent with the NPRM. The FAA
intended proposed Sec. Sec.  23.1300 and 23.1305 to capture the safety
intent of former Sec.  23.1309. Former Sec.  23.1309 was a regulation
of general requirements that did not supersede any requirements
contained in other part 23 sections. Sections 23.2500 and 23.2505 are
harmonized with CS 23.600 and CS 23.605.
    Air Tractor stated proposed Sec.  23.1300(a)(l) failed to define a
standard for the required level of safety for systems.

    The FAA is construing Air Tractor's comment as referring to the
qualitative levels of safety for systems, which were previously
contained in former Sec.  23.1309(c). These qualitative levels of
safety are now contained in Sec.  23.2510 (proposed as Sec.  23.1315),
which provides system-level requirements. The FAA notes Sec.
23.2500(a)(1) provides airplane-level requirements, and does not
specify the level of safety because the acceptable level of safety
varies depending on the certification level of the airplane. Former
part 23 is one acceptable means of compliance for the new part 23.
Therefore, applicants may use as a means of compliance the levels of
safety defined in figure 2 of AC 23.1309-1E, ``System Safety Analysis
and Assessments for Part 23 Airplanes'', which were a means of
compliance to former Sec.  23.1309 and varied depending on the
certification class of airplane. Alternatively, applicants--individuals
or organizations--may assist in the development of industry-consensus
standards, or propose their own means of compliance to Sec.
23.2500(a)(1).
    ANAC commented the phrase ``operating and environmental conditions
specified by the applicant'' in proposed Sec.  23.1300(a)(2) could lead
to misinterpretation. ANAC asserted these conditions may not be
adequate or achieve the minimum requirements for certification. ANAC
suggested using the phrase ``conditions for which the airplane is
certified.''
    The FAA agrees with ANAC and revises the proposed rule language for
clarity. Accordingly, Sec.  23.2500(a)(2) now requires the equipment
and systems required for an airplane to operate safely, in the kinds of
operations for which certification is requested, to be designed and
installed to perform their intended function throughout the operating
and environmental limits ``for which the airplane is certificated.''
    Several commenters commented on the use of the phrase ``non-
required'' in proposed Sec.  23.1300(b). EASA stated that the proposed
provisions of Sec.  23.1300(a) and (b) raised ambiguity regarding what
systems and equipment are ``required.'' EASA recommended clarifying the
distinction between ``required'' and ``non-required'' in paragraphs (a)
and (b), respectively, by revising the proposed rule language in
paragraph (b) to make clear ``non-required'' systems and equipment are
those not covered by paragraph (a). The Associations recommended the
FAA clarify what non-required systems and equipment include and offered
rule language similar to that proposed by EASA. Lastly, ANAC
recommended replacing ``non-required'' with ``each'' in proposed Sec.
23.1300(b) because the requirements should apply to all systems and
equipment.
    The FAA agrees the distinction between proposed Sec.  23.1300(a)
and proposed Sec.  23.1300(b), which would have applied to ``non-
required'' equipment, was unclear. The FAA adopting EASA's recommended
rule language, which clarifies the distinction between the two
requirements by linking them together. Accordingly, Sec.  23.2500(b)
(proposed as Sec.  23.1300(b)), now requires the systems and equipment
not covered by Sec.  23.2500 (a) to be designed and installed so their
operation does not have an adverse effect on the airplane or its
occupants.
    While the FAA agrees with ANAC that both ``required'' and ``non-
required'' equipment and systems must be designed and installed so
their operation does not have an adverse effect on the airplane or its
occupants, the FAA finds it unnecessary to apply new Sec.  23.2500(b)
to ``required'' equipment, because Sec.  23.2500(a) (proposed as Sec.
23.1300(a)) already covers this requirement. Required equipment and
systems that are designed and installed to meet the level of safety
applicable to the certification and performance level of the airplane,
in accordance with Sec.  23.2500(a)(1), and that perform their intended
function, in accordance with Sec.  23.2500(a)(2), will not have an
adverse effect on the airplane or its occupants. Furthermore, the FAA
is intentionally making a distinction between ``required'' and ``non-
required'' equipment in Sec.  23.2500(a) and (b) because ``non-
required'' equipment and systems should not always be required to
perform their intended function throughout the entire operating and
environmental limits of the airplane.
    Air Tractor suggested the FAA compare former Sec.  23.1309 and
proposed Sec.  23.1300(b). They noted the proposed rule may make it
easier to certify non-required equipment; however, the proposed rule
still seemed to require a Functional Hazard Assessment (FHA) and System
Safety Assessment (SSA). Air Tractor suggested the FAA relieve the
undue burden associated with the required system safety analysis for
non-required equipment and systems.
    The FAA has determined some method of assessment is necessary to
ensure that equipment and systems installed on an airplane meet an
acceptable safety level. The safety assessment must show that a logical
and acceptable inverse relationship exists between the average
probability per flight hour and the severity of failure conditions
effects. The depth and scope of the safety assessment will depend on
the types of functions performed by the systems, the severity of
failure conditions, and whether the system is complex. For simple and
conventional systems with well-established designs, the safety
assessment may be satisfied by a qualitative assessment such as the
single-failure concept and experience based on service-proven designs
and engineering judgment. Former guidance for complex systems relied on
industry standards such as ARP 4761, ``Guidelines and Methods for
conducting the Safety Assessment Process on Civil Airborne Systems and
Equipment,'' and ARP 4754A, ``Guidelines for Development of Civil
Aircraft and Systems,'' as well as AC 23.1309-1E, to define an
acceptable means of compliance. As explained in the NPRM, former part
23 and associated guidance may be used as one means of compliance with
the new part 23. Alternatively, applicants may rely on industry
consensus standards, or develop their own methods of compliance
appropriate to the various airworthiness certification levels.
    Garmin stated it was unclear what the phrase ``or failure does not
have an adverse affect'' in proposed Sec.  23.1300(b) means and that
failures would be covered under proposed Sec.  23.1315. Garmin implied
that proposed Sec.  23.1300(b) was redundant with proposed Sec.
23.1315, which already addressed the failure of a non-required system
as it would have provided the basis for assessing the implications of
any failure for installed equipment. The commenter requested that the
FAA delete ``or failure'' from the proposed rule.
    The FAA agrees with Garmin and deletes the words ``or failure''
from the proposed rule language. Section 23.2510 (proposed as Sec.
23.1315) addresses failure conditions of all equipment. Therefore,
proposed Sec. Sec.  23.1300 and 23.1315 would have been redundant by
requiring the same showing of compliance. Additionally, the phrase
``failure does not have an adverse effect on the airplane or its
occupants'' could have been misinterpreted as requiring the failure to
have no effect on the airplane. For example, if the equipment was
installed to provide a benefit, although not required, it could have
been wrongly interpreted that the failure of that benefit would have an
``adverse effect'' on the airplane.
c. Function and Installation (Proposed Sec.  23.1305/Now Sec.  23.2505)
    In the NPRM, proposed Sec.  23.1305 (now Sec.  23.2505) would have
required each item of installed equipment to

perform its intended function, be installed according to limitations
specified for that equipment, and the equipment be labeled, if
applicable, as to its identification, function, or operation
limitations, or any combination of these factors. Proposed Sec.
23.1305 would have required a discernable means of providing system
operating parameters required to operate the airplane, including
warnings, cautions, and normal indications to the responsible flight
crewmember. Proposed Sec.  23.1305 would have also required information
concerning an unsafe operating condition be provided in a clear and
timely manner to the crewmember responsible for taking corrective
action.
    In light of comments received, the FAA revises proposed Sec.
23.1305 to withdraw paragraph (a)(2), merge paragraph (a) and (a)(1)
into new paragraph (a), and relocate paragraphs (a)(3) through (c) to
new Sec.  23.2605 in subpart G. This section discusses these changes in
more detail.
    The Associations, Textron, and ANAC commented on proposed Sec.
23.1305(a)(1). Textron commented that proposed Sec.  23.1305(a) appears
to be redundant with proposed Sec.  23.1300(a) and asked the FAA to
clarify whether proposed Sec.  23.1305(a)(1) would apply to the non-
required equipment addressed in proposed Sec.  23.1300(b).
    ANAC recommended that the FAA remove proposed Sec.  23.1305(a)(1)
because the requirement is adequately addressed in Sec.  23.1300(a)(2)
for required equipment. ANAC explained that proposed Sec.
23.1305(a)(1) would contradict the requirement for non-required
equipment in proposed Sec.  23.1300(b). The Associations, noted that
one of the reasons for distinguishing ``required'' and ``non-required''
equipment in proposed Sec.  23.1300 was to alleviate the issues with
requiring non-required equipment to prove their intended function. The
commenters contended the rule should only require non-required
equipment and systems (which are not required for safe flight) to
verify their operation or failure does not interfere with required
equipment. The commenters recommended confining the proposed
requirement of Sec.  23.1305(a) to ``required'' systems and equipment.
    The FAA considered the comments to proposed Sec.  23.1305(a)(1) and
recognizes the confusion between Sec. Sec.  23.1300 (now Sec.  25.2500)
and 23.1305. The FAA notes Sec.  23.2505 applies to both required and
non-required equipment. All equipment, when installed, should function
as intended to maintain a minimum level of safety. The requirement of
Sec.  23.2505 is not addressed by Sec.  23.2500(a)(2) as Sec.  23.2505
applies to both required and non-required equipment when the equipment
is installed on the airplane. Section 23.2500(a)(2) applies only to
required equipment in operation. The FAA finds Sec.  23.2505(a) does
not contradict the requirement of Sec.  23.2500(b), which applies to
non-required equipment during airplane operations once in service. As
explained in the NPRM, Sec.  23.2500(b) would not require non-required
equipment and systems to function properly during all airplane
operations once in service, provided all potential failure conditions
do not affect safe operation of the airplane. However, the non-required
equipment or system would have to function in the manner expected by
the manufacturer's operating manual for the equipment or system when
installed. To clarify the FAA's intent and better harmonize with EASA,
the FAA is merging proposed paragraph (a) with (a)(1) to revise Sec.
23.2505 to require each item of equipment, when installed, to function
as intended.
    The Associations also maintained that proposed Sec.  23.1305(a)(2)
and (3) were unnecessary because installed equipment needs to operate
safely despite any markings.\50\ The commenters recommended the FAA not
adopt paragraphs (a)(2) and (a)(3). Alternatively, EASA recommended
moving the pilot interface issues of proposed Sec.  23.1305(a)(3)
through (c) to subpart G, which covers flightcrew interface. Textron
recommended the FAA move the labeling requirement to proposed Sec.
23.1300(a)(3). Transport Canada recommended clarifying proposed Sec.
23.1305(a)(3) to provide the criteria to determine the applicability of
the labeling requirement.
---------------------------------------------------------------------------

    \50\ The commenters actually stated they believe proposed Sec.
23.1305(a)(1) and (2) were unnecessary. However, based on the rest
of their comments and the recommendation to delete paragraphs (a)(2)
and(a)(3) (and retain (a)(1)), the FAA assumes the commenters meant
to state that Sec.  23.1305(a)(2) and (3) are unnecessary.
---------------------------------------------------------------------------

    The FAA withdraws proposed Sec.  23.1305(a)(2) as it is redundant
of paragraph (a)(1). In order to function as intended, the equipment
would have to meet its limitations. As previously noted, the FAA has
revised proposed Sec.  23.1305 by merging paragraph (a) with (a)(1).
The FAA agrees with EASA's recommendation to move certain flightcrew
interface requirements to subpart G and is relocating the requirement
of proposed Sec.  23.1305(a)(3) to subpart G, Sec.  23.2605(a) in this
rule. The commenters are correct that while a system needs to operate
safely despite any markings, markings related to identification,
function, and limitations are necessary to aid the aircrew and other
personnel to safely operate the systems. The requirement for equipment
to be labeled, if applicable, dates back to CAR 3.652 effective
December 7, 1949. If further criteria to determine the applicability of
the labeling requirement are found to be necessary, additional guidance
will be developed either by the FAA or in an industry consensus
standard.
    After further analysis, the FAA finds the proposed requirements to
provide system operating parameters, including warnings and cautions,
were not adequately covered in proposed subpart G. Based on this and
EASA's comments, the FAA relocates the pilot interface requirements of
proposed Sec.  23.1305(b) and (c) to new Sec.  23.2605 in subpart G to
adequately address these issues.
    Garmin, Textron, and ANAC commented on the second sentence of
proposed Sec.  23.1305(c). Garmin recommended the FAA delete the phrase
``presentation of'', as it could be interpreted as requiring a light or
other visual alert. Textron recommended the FAA replace the phrase
``clear enough to avoid likely crewmember errors'' with the phrase
``designed to minimize crewmember errors.'' ANAC contended the term
``likely'' is ambiguous and recommended the FAA replace the phrase ``to
avoid likely crewmember errors'' with the phrase ``to minimize
crewmember errors, which could create additional hazards.''
    The FAA agrees with the commenters as the FAA did not intend to
limit the presentation to visual displays only. Warning information can
include visual, aural, tactile, or any combination. The FAA deletes
``presentation of'' in the proposed Sec.  23.1305(c). Although both
``minimize'' and ``likely'' may be ambiguous, as was the concern from
ANAC, the term ``minimize''--associated with the mitigation of hazards
in the rule language--can be traced back to CAR 3, effective December
7, 1949. Although using a new term such as ``likely'' may be
interpreted as a new requirement or standard for the minimization of
errors, this was not the FAA's intent. Therefore, the FAA replaces the
term ``minimize flightcrew errors'' in place of ``avoid likely
crewmember errors'' in Sec.  23.2600(b).
    Embraer noted that the cross-reference table in the proposal stated
that the intent of former Sec.  23.1023 is addressed in proposed Sec.
23.935(b)(1); however, there is no Sec.  23.935(b)(1) in the proposed
rule. To address this mistake, Embraer suggested including a similar

requirement from former Sec.  23.1023 in proposed Sec.  23.1305, which
would apply to any equipment. Specifically, Embraer recommended an
addition to proposed Sec.  23.1305(a)(4) stating equipment be able to
withstand without failure, the vibration, inertia and loads (including
fluid pressure loads) to which it would be subjected in operation.
    Embraer stated that it understood that part 33 would not address
all the concerns if the radiator is installed by the airframer, and
noted that its same comment applies to former Sec. Sec.  23.1013 and
23.1015.
    The FAA has corrected and updated the table to accurately reference
the relationship between the former rule and the final rule. Also, the
FAA does not adopt Embraer's recommendation to add a requirement to
Sec.  23.2505 to address specific environmental conditions equipment
must be able to withstand. The FAA notes Embraer was describing a
specific failure mode, which is covered by Sec. Sec.  23.2500(a)(2) and
23.2510.
d. Flight, Navigation, and Powerplant Instruments (Proposed Sec.
23.1310/Now Sec.  23.2615)
    In the NPRM, proposed Sec.  23.1310 (now Sec.  23.2615) would have
required installed systems to provide the flightcrew member who sets or
monitors flight parameters for the flight, navigation, and powerplant
information necessary to do so during each phase of flight. Proposed
Sec.  23.1310 would have required this information include parameters
and trends, as needed for normal, abnormal, and emergency operation,
and limitations, unless an applicant showed the limitation would not be
exceeded in all intended operations. Proposed Sec.  23.1310 would have
prohibited indication systems that integrate the display of flight or
powerplant parameters to operate the airplane or are required by the
operating rules of this chapter, from inhibiting the primary display of
flight or powerplant parameters needed by any flightcrew member in any
normal mode of operation. Proposed Sec.  23.1310 would have required
these indication systems be designed and installed so information
essential for continued safe flight and landing would be available to
the flightcrew in a timely manner after any single failure or probable
combination of failures.
    In light of comments received, the FAA renumbers Sec.  23.1310 to
Sec.  23.2615, and moves this section to Subpart G. The section for
Sec.  23.2615 in Subpart G discusses these changes in more detail.
e. Equipment, Systems, and Installation (Proposed Sec.  23.1315/Now
Sec.  23.2510)
    In the NPRM, proposed Sec.  23.1315 (now Sec.  23.2510) would have
required an applicant--
     To examine the design and installation of airplane systems
and equipment, separately and in relation to other airplane systems and
equipment, for any airplane system or equipment whose failure or
abnormal operation was not specifically addressed by another
requirement in this part;
     To determine if a failure of these systems and equipment
would prevent continued safe flight and landing, and if any other
failure would significantly reduce the capability of the airplane or
the ability of the flightcrew to cope with adverse operating
conditions; and
     To design and install these systems and equipment,
examined separately and in relation to other airplane systems and
equipment, such that each catastrophic failure condition is extremely
improbable, each hazardous failure condition is extremely remote, and
each major failure condition was remote.
    In light of comments received, the FAA revises proposed Sec.
23.1315 (now Sec.  23.2510) by withdrawing paragraph (a), merging
paragraph (b) into the introductory sentence, and renaming paragraphs
(b)(1), (b)(2) and (b)(3) as Sec.  23.2510(a), (b) and (c),
respectively. This section discusses these changes in more detail.
    Garmin commented that proposed Sec.  23.1315 should be located with
the other general rules applicable to all systems and equipment.
    The FAA agrees with Garmin's comment and is placing the regulation
with the other general rules at the beginning of subpart F.
    Textron commented the intent of proposed Sec.  23.1315 is not as
clearly written as CS 23.600 and 23.605 and an AC will be needed to
determine the meaning of the proposed rule. The commenter recommended
using the wording of CS 23.600 and 23.605. In contrast, The
Associations preferred the FAA's proposed Sec.  23.1315 to the EASA's
A-NPA language, which they stated may unduly tie means of compliance to
an objective-based rule. EASA suggested that proposed Sec.  23.1315
show the inverse relationship between probability and severity in an
illustration.
    To clarify the intent of the rule, the FAA revises the proposed
rule language to require each system and equipment to be designed and
installed such that ``there is a logical and acceptable inverse
relationship between the average probability and the severity of
failure condition.'' This change is consistent with the NPRM, which
explained that proposed Sec.  23.1315 (now Sec.  23.2510) would require
an engineering safety analysis to identify possible failures,
interactions, and consequences, and require an inverse relationship
between the probability of failures and the severity of consequences.
The logical inverse relationship should be proportionate and flexible
with respect to risk levels. The FAA notes that if the FAA provided
more detail and graphics in the rule, future interpretation of the rule
may be more restrictive than intended. The FAA finds the additional
information provided in EASA's A-NPA is more suitable for guidance
similar to AC 23.1309-1E and is not adding this to the rule.
    The Associations recommended the FAA add a new paragraph to
proposed Sec.  23.1315 that would allow the FAA to accept a higher
failure probability for functionality that enhances the safety of the
airplane beyond the required minimum functionality. The commenters
noted such a provision would allow for safety-enhanced equipment to be
treated in a less stringent manner that accounts for the significant
benefits it could have. The commenters explained this would ensure the
lowest cost of this equipment without sacrificing the safety-enhancing
benefits. Garmin similarly noted that system safety analysis and design
assurance are focused on system and equipment failures rather than the
safety benefit such systems and equipment can provide. For example,
TSO-C151, ``Terrain Awareness and Warning System (TAWS),'' equipment
specifies a major failure classification, but no credit is given for
the offsetting safety benefit provided for installation of TAWS with
its corresponding reduction in Controlled Flight into Terrain (CFIT)
accidents. Garmin asked the FAA to consider adopting a requirement that
allows for design assurance certitude for systems that provide an
increased safety benefit.
    The FAA has determined adding a new requirement to proposed Sec.
23.1315 (now Sec.  23.2510) would create a special class of equipment
in the rule, which is contrary to the FAA's intent. The objective of
this rulemaking is to provide clear safety objectives without
prescribing design solutions. The objective of proposed Sec.  23.1315
is to require each system and equipment to be designed and installed
such that there is a logical and acceptable inverse relationship
between the average probability and the severity of failure conditions.
This applies to all

equipment whether required or non-required, safety-enhancing or not.
The rule does not specify a required numeric probability of failure.
The rule is written to allow a proportionate and flexible numerical
value to the probabilities regarding risk levels of the equipment and
airplane. System safety assessment standards will be relied on to
provide a suitable approach for the different risk levels, similar to
what is currently found in AC 23.1309-1E for the various classes of
airplanes. Section 23.2510 provides a proportionate and flexible
structure for future technology implementation.
    Garmin and the Associations recommended the FAA use the term
``failure condition'' rather than ``failure'' to ensure the rule
addresses the broader impacts of failures, rather than just those that
occur within the equipment that may have failed. Garmin explained that
by using ``failure condition,'' the rule would address combinations of
failures in the system and equipment and other systems and equipment.
ANAC stated the use of ``failure'' in paragraph (a) and use of
``failure condition'' in paragraph (b) may add confusion.
    The FAA agrees with the commenters and revises proposed Sec.
23.1315 (now Sec.  23.2510) to use ``failure condition'' throughout the
section.
    Textron noted some simple systems were exempt from former Sec.
23.1309. Textron asked if there was a list of systems exempt from
proposed Sec.  23.1315 (now Sec.  23.2510), or if the FAA intended to
apply the regulation to all systems. Textron specifically asked for
confirmation that propulsion, fuel systems, fire protection systems,
exits, landing gear, flight navigation, powerplant instruments, system
power generation, storage, and distribution and flight controls were
exempt from proposed Sec.  23.1315 (now Sec.  23.2510), since they each
have their own rules dealing with failures.
    This final rule does not contain a list of systems exempt from
proposed Sec.  23.2510 (proposed as Sec.  23.1315). Consistent with
former Sec.  23.1309, proposed Sec.  23.1315 (now Sec.  23.2510)
applies generally to installed equipment and systems, except that Sec.
23.2510 does not apply if another section of part 23 imposes
requirements for specific equipment or systems. The FAA is not
providing a list of systems exempt from the rule, as Textron requested,
because such a list would be based on today's technology and would be
overly prescriptive and inflexible over time. This would conflict with
the goal of allowing coverage for future unforeseen technological
advancements.
    Textron asked the FAA to clarify the intent of the safety
requirements in proposed Sec.  23.1315. In particular, Textron noted
that paragraph (a) simply stated ``determine'', while paragraph (b)
stated ``design and install'' to achieve safety goals that have no
connection with those stated in paragraph (a). Textron asked for
clarification of the relationship between the two paragraphs, as well
as the overall intent of the rule. Textron recommended using the
language in CS 23.605(a), which would have required each equipment and
system to be designed and installed so there is a logical and
acceptable inverse relationship between the average probability and the
severity of failure condition effects. ANAC similarly noted that no
clear safety objective was stated in proposed Sec.  23.1315(a); rather,
an applicant needed only determine if conditions (1) and (2) were
examined. Embraer suggested the FAA remove proposed Sec.  23.1315(a),
asserting that the intent of proposed Sec.  23.1315(b) would be
sufficient to meet compliance.
    EASA asserted the terminology in proposed Sec.  23.1315(a) may be
confusing. Phrases such as ``continued safe flight and landing'' and
``significantly reduce the capacity of the airplane'' or ``the ability
of the flightcrew to cope with adverse operating conditions,'' are not
as clear as terms ``catastrophic,'' ``hazardous,'' and ``major'' in
describing the failure condition.
    In light of these comments, the FAA withdraws proposed paragraph
(a). Proposed Sec.  23.1315(a) could have been interpreted as an
element of the means of compliance to paragraph (b) in that the
determinations of the potential consequences of failures is necessary
to establish whether the probability of their occurrence is acceptable.
Additionally, the FAA adopts Textron's recommendation and revises the
proposed rule language to require each system and equipment to be
designed and installed so there is a logical and acceptable inverse
relationship between the average probability and the severity of
failure condition effects. To comply with Sec.  23.2510(a), applicants
must account for airplane systems and equipment, separately and in
relation to other airplane systems and equipment.
    Textron indicated that the terms used in proposed Sec.  23.1315(b)
were not defined in the regulations.
    The FAA did not define the terms ``catastrophic failure
condition,'' ``hazardous failure condition,'' and ``major failure
condition'' in the regulations because the terms are better addressed
in guidance. These terms are currently defined in AC 23.1309-1E.
Furthermore, the rule language is consistent with the historical rule
language of former Sec.  23.1309.\51\
---------------------------------------------------------------------------

    \51\ See 55 FR 43306, October 26, 1990.
---------------------------------------------------------------------------

    ANAC commented that proposed Sec.  23.1315(b) implied specific
classification and probability terms that may be considered
prescriptive. The commenter noted that, as written, this may prevent an
applicant from using a means of compliance that employs different
hazard categories or terminology.
    The FAA notes the terms used in proposed Sec.  23.1315 (now Sec.
23.2510) are already defined in guidance (i.e., AC 23.1309-1E) and
originated from former Sec.  23.1309, and should not prevent an
applicant from using a means of compliance that employs different
hazard categories or terminology. The FAA may accept a means of
compliance standard that uses different hazard categories or
terminology, if they align with the failure condition effects in
paragraphs (a) through (c) so the requirements of proposed Sec.
23.1315 (now Sec.  23.2510) are met.
    Rockwell Collins noted that former Sec.  23.1309(c)(1) required
each catastrophic failure condition to be extremely improbable and not
result from a single failure. However, proposed Sec.  23.1315(b)(1),
which was intended to capture the safety intent of former Sec.
23.1309, would have required only that each catastrophic failure
condition be extremely improbable. It would not have prohibited single-
point catastrophic failures. Rockwell Collins asked the FAA to retain
the phrase ``and not result from a single failure'' in the regulation,
because the commenter believed the FAA's intent was not to propose
changes with regard to single-point catastrophic failures.
    The FAA notes the ARC recommended the FAA require systems and
equipment to be designed and installed so there is a logical acceptable
inverse relationship between the average probability and the severity
of failure condition effects whether the result of a single failure or
multiple failures. With the advancement of technology and increased
integration of systems, it is virtually impossible to eliminate all
theoretical potential single-points of failure. The rule will allow in
some cases, as is true today with some portions of the airplane, to
have the potential of single-point failures if the risk and probability
of such failure is acceptable. The FAA adopts the rule language as
proposed in Sec.  23.1315(b)(1).
    Noting that key pieces of FAA guidance are critical to design and
certification, Kestrel asked whether AC

23.1309 would remain the primary guidance for SSA. If not, Kestrel
asked what the recommended guidance would be.
    Guidance for proposed Sec.  23.1315 may consist of existing FAA
guidance, such as AC 23.1309, future FAA-generated guidance, and FAA-
accepted industry standards.
    Textron noted the NPRM stated applicants who use the means of
compliance described in the existing special conditions would be able
to use data developed for compliance with proposed Sec.  23.1315.
Textron recommended the FAA revise the statement to clarify the FAA was
referring to special conditions for part 25 airplanes.
    The statement in the NPRM is correct. Applicants who use the means
of compliance described in the existing special conditions for parts
23, 25, 27, or 29 may use data developed for compliance with Sec.
23.2510.
f. Electrical and Electronic System Lightning Protection (Proposed
Sec.  23.1320/Now Sec.  23.2515)
    In the NPRM, proposed Sec.  23.1320(a) would have required, for an
airplane approved for IFR operations, that each electrical or
electronic system that performs a function, the failure of which would
prevent the continued safe flight and landing of the airplane, be
designed and installed such that--
     The airplane system level function continues to perform
during and after the time the airplane is exposed to lightning; and
     The system automatically recovers normal operation of that
function in a timely manner after the airplane is exposed to lightning,
unless the system's recovery conflicts with other operational or
functional requirements of the system.
    Proposed Sec.  23.1320(b) would have required each electrical and
electronic system that performed a function, the failure of which would
reduce the capability of the airplane or the ability of the flightcrew
to respond to an adverse operation condition, to be designed and
installed such that the function recovers normal operation in a timely
manner after the airplane is exposed to lightning.
    Several commenters raised concerns with the term ``system'' in
proposed Sec.  23.1320(a)(1). BendixKing explained that the proposed
phrase ``airplane system level function'' may lead to multiple
interpretations of the regulation. BendixKing asked the FAA to delete
``system'' from the proposed rule language because the rule addresses
failure at the airplane level. The Associations recommended the FAA
require the function, rather than the airplane system level function,
to comply with the requirement in paragraph (a)(1).
    Garmin stated that there has been much discussion in the GAMA HIRF
(High-Intensity Radiated Fields) ad-hoc meetings regarding the
interpretation of the term ``system.'' Garmin explained the rule
language could be interpreted as requiring all redundant systems, which
perform the same function, to meet the lightning requirements. Garmin
explained that not all redundant systems should be required to meet the
catastrophic requirements to prevent potentially catastrophic failure;
proposed Sec.  23.1320(a) should apply to the function level only.
Garmin recommended alternative regulatory language would prevent
catastrophic, major, or hazardous failure conditions at the airplane
level.
    The FAA agrees proposed Sec.  23.1320(a)(1) (now Sec.
23.2515(a)(1)) could have been misinterpreted due to the confusion
surrounding the phrase ``airplane system level function.'' The FAA
intended to require the function at the airplane level to meet the
requirements of paragraph (a)(1), consistent with proposed Sec.
23.1325(a)(1) (now Sec.  23.2520). Thus, the FAA intended proposed
Sec.  23.1320(a)(1) to require the function at the airplane level not
to be adversely affected during and after the time the airplane is
exposed to lightning. This means if multiple systems perform the same
function, only one of those systems is required to provide the function
under Sec.  23.2515(a)(1). Therefore, not all redundant systems are
required to meet the requirements of Sec.  23.2515(a)(1). The FAA
deletes the term ``system'' from the phrase ``airplane system level
function,'' as several commenters recommended to ensure the FAA's
intent is clear. The FAA revises the rule language to make clear that
the requirements of proposed Sec.  23.1320(a)(1) (now Sec.
23.2515(a)(1)) apply to the function at the airplane level.
    Garmin noted that the proposed Sec.  23.1320 rule language was
essentially the same as former Sec.  23.1306, which was overly
burdensome for low-end part 23 airplanes. Garmin stated that proposed
Sec.  23.1320 is contrary to the goal of the part 23 reorganization and
explained the objective should be to prevent catastrophic, hazardous,
and major failure conditions for the airplane. Garmin suggested
revising proposed Sec.  23.1320 to be more general and to allow the
ASTM standards to provide the necessary means of compliance, which
should consist of a tiered compliance approach for different airplane
certification levels.
    The FAA does not agree to make Sec.  23.2515 more general. Section
23.2515 is intended to address catastrophic, hazardous, and major
failure condition at the airplane level due to the effects of lightning
on systems. Critical functions that would prevent continued safe flight
and landing (catastrophic) should remain available to the crew
throughout a lightning exposure. How to maintain the function, whether
with redundant systems or non-susceptible systems, is a means of
compliance and is not specified. Likewise, systems that perform a
function, the failure of which would significantly reduce the
capability of the airplane (hazardous), must recover normal operation
of that function. A means of compliance is not specified and could
include redundancy. The FAA has revised the rule to state more clearly
that the concern for catastrophic failure conditions is at the airplane
level. Furthermore, the rule already allows a tiered compliance
approach based on the environment the airplane is likely to see.
    Several commenters raised concerns with applying proposed Sec.
23.1320 to airplanes approved for IFR operations. The Associations
noted the FAA has recently approved required equipment for use in IFR
airplanes, without the need for lightning testing based on the history
of lightning strikes in the general aviation fleet. However, these
commenters indicated the proposed rule would have prohibited airplanes
with a low probability of lightning strikes from benefiting from such
an approach. These commenters asked the FAA to revise the proposed rule
language to ensure the rule does not apply to airplanes with a low
probability of lightning strike.
    Garmin noted that former Sec.  23.1306 required both VFR and IFR
airplanes to meet lightning requirements for systems with catastrophic
failure conditions. However, while proposed Sec.  23.1320 would have
removed the requirement for VFR airplanes, the burden for industry is
primarily IFR airplanes as there are very few VFR airplanes, if any,
that have systems with catastrophic failure conditions. Garmin
recommended revising the proposed rule language by removing the
language that would have made proposed Sec.  23.1320 applicable to
airplanes approved for IFR operations.
    EASA also asked the FAA to remove the language that would have made
proposed Sec.  23.1320 applicable to airplanes approved for IFR
operations. EASA explained that this revision

would permit credit for reliable systems that allow for avoidance of
thunderstorms, as these systems would make exposure to lightning
unlikely.
    In light of these comments, the FAA recognizes the proposed rule
language would not have adequately relieved the burden of former Sec.
23.1306, which required all airplanes regardless of their design or
operational limitations meet the same requirements for lightning
regardless of the potential threat. As explained in the NPRM, the FAA
intended to relieve this burden by applying the lightning requirements
to airplanes with the greatest threat of lightning. The FAA proposed to
meet this objective by making the rule applicable to airplanes approved
for IFR operations. Because airplanes approved for IFR operations may
also have a low probability of lightning exposure, the proposed rule
language did not meet the FAA's objective. Accordingly, the FAA adds an
exception to the rule language for applicants who can show that
exposure to lightning is unlikely. This change from what was proposed
is more consistent with the FAA's intent as it relieves an airplane
approved for IFR operations from complying with Sec.  23.2515 if it is
shown the airplane has a low probability of lighting exposure. The
method of compliance is not specified in the rule and could be system,
operational, or environment based.
    Garmin and the Associations recommended the FAA revise proposed
Sec.  23.1320(b) to make the requirement only applicable to levels 3
and 4 airplanes approved for IFR operations.
    The FAA disagrees. Section 23.2520(b) is a general safety objective
with compliance tailored to the specific design intent. Exposure to
lightning is an environmental threat not directly associated with
airplane certification levels and therefore could apply to all
airplanes. The intent is to set requirements appropriately to the
design. Therefore, the FAA adds an exception to the rule language for
applicants who can show that exposure to lightning is unlikely.
    Daher, Textron, and the Associations suggested the FAA, in proposed
Sec.  23.1320(a)(1) (now Sec.  23.2515(a)(1)), require the function to
not be ``adversely affected'' during and after the time the airplane is
exposed to lightning, but require the function to ``continue to
perform.'' Daher and Textron explained that requiring the function to
not be ``adversely affected'' would be more consistent with the
language of proposed Sec.  23.1325 (now Sec.  23.2520). The
Associations asserted that this revision would permit equipment
installations that may be affected by lightning, provided the loss of
equipment does not result in catastrophic events. Textron further noted
this revision would ensure harmony with EASA's proposed CS 23.620.
    In response to these comments, the FAA revises the proposed rule
language to require the function at the airplane level to not be
``adversely affected'' during and after the time the airplane is
exposed to lighting. As explained in the NPRM, the FAA intended
proposed Sec.  23.1320(a)(1) (now Sec.  23.2515(a)(1)) to capture the
safety intent of former Sec.  23.1306. Former Sec.  23.1306(a)(1)
required the function to not be ``adversely affected'' during and after
the time the airplane is exposed to lightning. Because the proposed
language could be interpreted as an increase in burden, which would not
meet the intent of former Sec.  23.1306, the FAA is reverting back to
the former rule language. It should be noted that ``adversely
affected'' was not previously limited to catastrophic events as
suggested by the commenters, but included hazardous and major failure
conditions as well.
    Textron questioned if crew action could be involved in the recovery
of the function or must recovery be automatic. Textron asked the FAA to
clarify whether proposed Sec.  23.1320(a)(2) would permit crew action
in recovery of the function. Garmin recommended the FAA not adopt
proposed Sec.  23.1320(a)(2).
    Based on Textron's comment, the FAA clarifies paragraph (a)(2) by
removing the term ``automatic'' from the proposed rule to allow either
flightcrew action or automatic recovery. One of the goals of the
proposal was to remove prescriptive design solution for the
airworthiness standards and replace them with performance-based rules.
Automatic reset of a system is a design solution, while the safety
objective is the function be usable to the flightcrew in a timely
manner such that the intermittent loss or malfunction does not have an
adverse effect on the safety of the flight. Therefore, the recovery of
the function may be automatic or manual. While Garmin recommended that
the FAA not adopt proposed Sec.  23.1320(b) (now Sec.  23.2515(b)), the
FAA believes the safety intent of former Sec.  23.1306, which addressed
catastrophic and hazardous failure condition due to the effects of
lightning on systems, must be retained.
    Transport Canada noted that proposed Sec.  23.1320(a)(2) would
benefit from inclusion of a specific safety objective. The commenter
suggested revising the proposed rule language to require the system to
automatically recover normal operation of the function in such time as
to allow a safety objective to be achieved.
    The FAA notes the safety objective of paragraph (a)(2) is ``the
timely recovery of the system's function.'' Additionally, the rule
language existed in former Sec.  23.1306(a)(2). Based on this, the FAA
does not adopt the change proposed by Transport Canada in the final
rule.
    Textron requested the FAA insert ``significantly'' before
``reduce'' in proposed Sec.  23.1320(b), because any reduction in
capacity would trigger this rule.
    The FAA agrees with Textron and revises the language in proposed
Sec.  23.1320(b) (now Sec.  23.2515(b)) accordingly. This change is
consistent with former Sec.  23.1306, which used the phrase
``significantly reduce.'' Also, this change is necessary because
without the term ``significantly'', the language could be interpreted
as imposing requirements on each electrical and electronic system that
performs a function, the failure of which would reduce--no matter how
minimal--the capability of the airplane or the ability of the
flightcrew to respond to an adverse operating condition. This would
increase the burden from former part 23, which was not the FAA's
intent.
g. High-Intensity Radiated Fields (HIRF) Protection (Proposed Sec.
23.1325/Now Sec.  23.2520)
    In the NPRM, proposed Sec.  23.1325 (now Sec.  23.2520) would have
required electrical and electronic systems that perform a function
whose failure would prevent the continued safe flight and landing of
the airplane, to be designed and installed such that--the airplane
system level function is not adversely affected during and after the
time the airplane is exposed to the HIRF environment. Proposed Sec.
23.1325 would have also required these systems automatically recover
normal operation of that function in a timely manner after the airplane
is exposed to the HIRF environment, unless the system's recovery
conflicts with other operational or functional requirements of the
system.
    For airplanes approved for IFR operations, proposed Sec.
23.1325(b) would have required the applicant to design and install each
electrical and electronic system that performs a function--the failure
of which would reduce the capability of the airplane or the ability to
the flightcrew to respond to an adverse operating condition--so the
function recovers normal operation in a timely manner after the
airplane is exposed to the HIRF environment.

    Several commenters raised concerns about the term ``system'' in
proposed Sec.  23.1325(a)(1). Textron stated the phrase ``airplane
system level'' \52\ could be interpreted to mean that if multiple
systems provide a redundant function, each system needs to work through
the threat although only one is required. Textron asked the FAA to
clarify if proposed Sec.  23.1325(a)(1) was intended to require a means
to provide the airplane level function for continued safe flight and
landing. BendixKing similarly commented that the failure being
addressed in proposed Sec.  23.1325(a)(1) is at the airplane level, but
the proposed phrase ``airplane system level function'' would lead to
multiple interpretations of the regulation. Textron and BendixKing
suggested deleting the term ``system'' from proposed Sec.
23.1325(a)(1) to clarify the requirement applies to the airplane level.
---------------------------------------------------------------------------

    \52\ Safety requirements exist at the airplane, system, and item
level. SAE International, ARP 475A Guidelines for Development of
Civil Aircraft Systems, 4.1.3 Introduction to Hierarchical Safety
Requirements Generated from Safety Analyses (2010).
---------------------------------------------------------------------------

    Garmin noted there has been much discussion in the GAMA HIRF ad-hoc
meetings regarding the definition of a ``system.'' Garmin asked the FAA
whether ``system'' means each individual redundant system or all
redundant systems. Garmin explained that proposed Sec.  23.1325(a)(2)
could be interpreted to impose additional requirements to the extent
that all redundant systems must meet the catastrophic failure
requirements of paragraph (a). Garmin suggested that not all redundant
systems should be required to meet the catastrophic requirements and
proposed Sec.  23.1325(a) should apply only to the function level.
Garmin recommended alternative regulatory language that reflected its
comments.
    The FAA agrees that proposed Sec.  23.1325(a)(1) (now Sec.
23.2520(a)(1)) could be misinterpreted due to the confusion surrounding
the phrase ``airplane system level function.'' As explained in the
NPRM, the FAA intended the proposed rule language to clarify the
failure consequence of interest is at the airplane level. Thus, the FAA
intended paragraph (a)(1) to require the function at the airplane level
not to be adversely affected during and after the time the airplane is
exposed to the HIRF environment. This means if multiple systems perform
the same function, only one of those systems is required to provide the
function under paragraph (a)(1). Therefore, in response to Garmin's
comment, the FAA notes not all redundant systems are required to meet
the requirements of paragraph (a)(1). To clearly reflect the intent of
proposed Sec.  23.1325(a)(1) (now Sec.  23.2520(a)(1)), the FAA deletes
the term ``system'' from the phrase ``airplane system level function,''
as recommended by Textron and BendixKing, and revises the proposed rule
language to clarify that the requirements of paragraph (a)(1) apply to
the function at the airplane level.
    Furthermore, in light of Garmin's comment, the FAA revises the
proposed rule language in Sec.  23.1325(a) (now Sec.  23.2520(a)) to
clarify that ``each'' electric and electronic system that performs a
function--the failure of which would prevent the continued safe flight
and landing of the airplane--must be designed and installed such that
the requirements of Sec.  23.2520(a)(1) and Sec.  23.2520(a)(2) of this
section are met.
    Garmin recommended the FAA delete proposed Sec.  23.1325(a)(2) and
explained that proposed Sec.  23.1325(a)(2) is unnecessary because
proposed Sec.  23.1325(a)(1) already prohibits systems from preventing
safe flight and landing after a HIRF event. The commenter maintained
paragraph (a)(1) would be sufficient to ensure a tiered means of
compliance could be developed based on the criticality of the HIRF
event. Garmin stated that proposed Sec.  23.1325(a)(2) contains design
information, which is contrary to the goal of the part 23
reorganization, and explained the objective should be to prevent
catastrophic, hazardous, and major failure conditions for the airplane.
Garmin suggested revising proposed Sec.  23.1325 to be more general and
allow the ASTM standards to provide the necessary means of compliance.
    The FAA disagrees with the commenter's recommendation to delete
proposed Sec.  23.1325(a)(2) and to make paragraph (a) more general.
The FAA agrees with a tiered means of compliance approach for hazardous
and major failure conditions, which are addressed in Sec.  23.2520(b).
However, for catastrophic failure conditions addressed in Sec.
23.2520(a), the FAA finds it necessary to require each system that
performs a function, the failure of which would prevent the continued
safe flight and landing of the airplane, to be able to recover normal
operation of the function. Paragraph Sec.  23.2520(a)(2) is not design
specific; it captures the safety intent of former Sec.  23.1308(a) at a
high level, allowing for means of compliance other than appendix J to
part 23--``HIRF Environments and Equipment HIRF Test Levels''.
    Textron asked the FAA to clarify whether proposed Sec.
23.1325(a)(2) would permit flightcrew action in recovery of the
function.
    The FAA is removing the term ``automatically'' from the proposed
rule language to clarify that flightcrew action is permitted in
recovering the normal operation of the system's function. The FAA
intended proposed Sec.  23.1325 to capture the safety intent of former
Sec.  23.1308, which required the system to ``automatically'' recover
normal operation of the function in a timely manner. Automatic reset of
a system is a design solution. The safety objective of former Sec.
23.1308(a) is that the function be usable to the flightcrew in a timely
manner such that the intermittent loss or malfunction does not have an
adverse effect on the safety of the flight. The FAA finds that
permitting the flightcrew to manually recover normal operation of the
system's function in a timely manner would maintain the level of safety
found in former Sec.  23.1308(a). Therefore, the recovery of the
function may be automatic or manual under Sec.  23.2520(a)(2).
    The Associations commented that current policy and guidance may
apply HIRF requirements differently to part 23 products than in other
areas and suggested that the IFR discriminator in paragraph (b) may not
be as valid as using airworthiness level. The commenters recommended
the FAA restrict paragraph (b) to level 3 and 4 airplanes that are
approved for IFR operations.
    Mooney International (Mooney) questioned the intent of including
IFR-related HIRF requirements in paragraph (b). Mooney contended that
HIRF is related to environments from ground-based transmission of RF
energy from radars, radios, etc., which is unrelated to IFR
environmental operations.
    The FAA has considered the comments on inconsistent application of
HIRF requirements, but notes the hazardous and major failure conditions
of paragraph (b) should apply to airplanes certificated for IFR
operations regardless of airworthiness level. The different types of
operations an airplane may be certificated for are Day VFR, Night VFR,
and IFR. Airplanes certified for only VFR operations are restricted
from operating under IFR, which includes flight into IMC. IFR-certified
airplanes, however, are not prohibited from flight into IMC. The
severity of a HIRF event is greater in IMC. Therefore, the FAA finds it
necessary to apply the hazardous and major failure conditions to all
airplanes certified for IFR operations. Furthermore, while the FAA is
not restricting the application of paragraph (b) to only level 3 and 4
airplanes, paragraph (b) allows for a

tiered means of compliance approach based on airworthiness level and
the associated risk. The FAA replaced the prescriptive requirements,
which were further defined in former appendix J to part 23, with the
wording ``exposed to the HIRF environment.'' The intent is to allow for
the exposure environment to match the risk associated with each
airplane level. Therefore, the threat will be appropriately scaled to
the airworthiness level as the data and risk supports.
    Garmin suggested revising the proposed rule language of paragraph
(b) to require each electrical and electronic system to be designed and
installed, rather than requiring the applicant to design and install
each system.
    The FAA adopts Garmin's recommendation, which makes the language of
paragraph (b) parallel the language of paragraph (a).
    Embraer suggested the FAA adopt the same HIRF environments and test
levels that are described in former appendix J to part 23, which were
associated with former Sec.  23.1308.
    The FAA finds the prescriptive environments and test levels found
in former appendix J to part 23 are more appropriately addressed as a
means of compliance to proposed Sec.  23.1325 (now Sec.  23.2520). This
allows the test levels to change as the environment changes without new
regulatory action. Additionally, one prescriptive level for all
airplanes does not allow for a tiered compliance approach, which was an
objective of this rule.
h. System Power Generation, Storage, and Distribution (Proposed Sec.
23.1330/Now Sec.  23.2525)
    In the NPRM, proposed Sec.  23.1330 (now Sec.  23.2525) would have
required the power generation, storage, and distribution for any system
be designed and installed to supply the power required for operation of
connected loads during all likely operating conditions. Proposed Sec.
23.1330 would have required the design installation ensure no single
failure or malfunction would prevent the system from supplying the
essential loads required for continued safe flight and landing.
Finally, proposed Sec.  23.1330 would have required the design and
installation have enough capacity to supply essential loads, should the
primary power source fail, (for at least 30 minutes for airplanes