[Federal Register: July 21, 2008 (Volume 73, Number 140)]
[Rules and Regulations]
[Page 42443-42504]
[DOCID:fr21jy08-12]

-----------------------------------------------------------------------

Part III

Department of Transportation

-----------------------------------------------------------------------

Federal Aviation Administration

14 CFR Parts 25, 26, 121 et al.

Reduction of Fuel Tank Flammability in Transport Category Airplanes;
Final Rule

-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Parts 25, 26, 121, 125, and 129

[Docket No. FAA-2005-22997; Amendment Nos. 25-125, 26-2, 121-340, 125-
55, and 129-46]
RIN 2120-AI23

Reduction of Fuel Tank Flammability in Transport Category
Airplanes

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Final rule, request for comments.

-----------------------------------------------------------------------

SUMMARY: This final rule amends FAA regulations that require operators
and manufacturers of transport category airplanes to take steps that,
in combination with other required actions, should greatly reduce the
chances of a catastrophic fuel tank explosion. The final rule does not
direct the adoption of specific inerting technology either by
manufacturers or operators, but establishes a performance-based set of
requirements that set acceptable flammability exposure values in tanks
most prone to explosion or require the installation of an ignition
mitigation means in an affected fuel tank. Technology now provides a
variety of commercially feasible methods to accomplish these vital
safety objectives.

DATES: These amendments become September 19, 2008. Send your comments
by January 20, 2009. The incorporation by reference of the document
listed in the rule is approved by the Director of the Federal Register
as of September 19, 2008.

FOR FURTHER INFORMATION CONTACT: If you have technical questions about
this action, contact Michael E. Dostert, FAA, Propulsion/Mechanical
Systems Branch, ANM-112, Transport Airplane Directorate, Aircraft
Certification Service, 1601 Lind Avenue, SW., Renton, Washington 98057-
3356; telephone<PHONE_NUMBER>, facsimile<PHONE_NUMBER>; e-mail:
<EMAIL_ADDRESS>Direct any legal questions to Doug Anderson, ANM-
7, FAA, Office of Regional Counsel, 1601 Lind Avenue, SW, Renton, WA
98057-3356; telephone<PHONE_NUMBER>; facsimile<PHONE_NUMBER>, e-mail
<EMAIL_ADDRESS>
SUPPLEMENTARY INFORMATION: Later in this preamble under the ADDITIONAL
INFORMATION section, we discuss how you can comment on a certain
portion of this final rule and how we will handle your comments.
Included in this discussion is related information about the docket,
privacy, and the handling of proprietary or confidential business
information. We also discuss how you can get a copy of this final rule
and related rulemaking documents.

Authority for Rulemaking

    The FAA's authority to issue rules regarding aviation safety is
found in Title 49 of the United States Code. Subtitle I, Section 106
describes the authority of the FAA Administrator. Subtitle VII,
Aviation Programs, describes in more detail the scope of the agency's
authority.
    This rulemaking is promulgated under the authority described in
Subtitle VII, Part A, Subpart III, Section 44701, ``General
requirements.'' Under that section, the FAA is charged with promoting
safe flight of civil aircraft in air commerce by prescribing minimum
standards required in the interest of safety for the design and
performance of aircraft; regulations and minimum standards in the
interest of aviation safety for inspecting, servicing, and overhauling
aircraft; and regulations for other practices, methods, and procedures
the Administrator finds necessary for safety in air commerce. This
regulation is within the scope of that authority because it prescribes
     New safety standards for the design of transport category
airplanes, and
     New requirements necessary for safety for the design,
production, operation and maintenance of those airplanes, and for other
practices, methods, and procedures related to those airplanes.

Table of Contents

I. Executive Summary
    A. Statement of the Problem
    B. Reducing the Chance of Ignition
    C. Reducing the Likelihood of an Explosion After Ignition
II. Background
    A. Summary of the NPRM
    B. Related Activities
    C. Differences Between the NPRM and the Final Rule
III. Discussion of the Final Rule
    A. Summary of Comments
    B. Necessity of Rule
    1. Estimates/Conclusions Supporting Need for Rule
    2. Additional Research Needed
    3. Consistent Safety Level With Other Systems
    4. Human Errors
    5. Explosion Risk Analysis
    6. Special Certification Review Process vs. Rulemaking
    7. Flammability Reduction Means (FRM) Effectiveness
    C. Applicability
    1. Airplanes With Fewer Than 30 Seats
    2. Part 91 and 125 Operators
    3. All-Cargo Airplanes
    4. Specific Airplane Models
    5. Wing Tanks
    6. Auxiliary Fuel Tanks
    7. Existing Horizontal Stabilizer Fuel Tanks
    8. Foreign Persons/Air Carriers Operating U.S. Registered
Airplanes
    9. Airplanes Operated Under Sec.  121.153
    10. International Aspects of Production Requirements
    D. Requirements for Manufacturers and Holders of Type
Certificates, Supplemental Type Certificates and Field Approvals
    1. General Comments About Design Approval Holder (DAH)
Requirements
    2. Flammability Exposure Level Requirements for New Airplane
Designs
    3. Flammability Exposure Requirements for Current Airplane
Designs
    4. Continued Airworthiness and Safety Improvements
    E. Flammability Exposure Requirements for Airplane Operators
    1. General Comments About Applicability to Existing Airplanes
    2. Authority to Operate With an Inoperative FRM, IMM or FIMM
    3. Availability of Spare Parts
    4. Requirement That Center Fuel Tank be Inert Before First
Flight of the Day
    F. Appendix M--FRM Specifications
    1. Fleet Average Flammability Exposure Levels
    2. Inclusion of Ground and Takeoff/Climb Phases of Flight
    3. Clarification of Sea Level Ground Ambient Temperature
    4. Deletion of Proposed Paragraph M25.2 (Showing Compliance)
    5. Deletion of ``Fuel Type'' From List of Requirements in
Proposed Paragraph M25.2(b)
    6. Latent Failures
    7. Identification of Airworthiness Limitations
    8. Catastrophic Failure Modes
    9. Reliability Reporting
    G. Appendix N--Fuel Tank Flammability Exposure and Reliability
Analysis
    1. General
    2. Definitions
    3. Input Parameters
    4. Verification of ``Flash Point Temperature''
    H. Critical Design Configuration Control Limitations (CDCCL)
    1. Remove Requirement
    2. Clarification on Responsibility for Later Modifications
    3. Limit CDCCL's to Fuel Tanks That Require FRM or IMM
    4. STC Holders May Not Have Data to Comply
    I. Methods of Mitigating the Likelihood of a Fuel Tank Explosion
    1. Alternatives to Inerting
    2. Inerting Systems Could Create Ignition Sources
    3. Instruments to Monitor Inerting Systems
    4. Risk of Nitrogen Asphyxiation
    5. Warning Placards
    6. Definition of ``Inert''
    7. Use of Carbon Dioxide
    8. Environmental Impact of FRM
    9. Current FRMs Fail to Meet Requirements

    10. FRM Based on Immature Technology
    J. Compliance Dates
    1. Part 26 Design Approval Holder Compliance Dates
    2. Operator Fleet Retrofit Compliance Dates
    K. Cost/Benefit Analysis
    1. Security Benefits
    2. Likelihood of Future Explosions in Flight
    3. Costs to Society of Future Accidents
    4. Value of a Prevented Fatality
    5. Cost Savings if Transient Suppression Units (TSUs) are not
Required
    6. Corrections About Boeing Statements
    7. 757 Size Category
    8. Number of Future Older In-Service Airplanes Overestimated
    9. Revisions to the FRM Kit Costs
    10. Revisions to the Labor Time to Retrofit FRM Components
    11. Retrofitting Costs per Airplane
    12. Percentage of Retrofits Completed During a Heavy Check
    13. Number of Additional Days of Out-of-Service Time to Complete
a Retrofit
    14. Economic Losses From an Out-of-Service Day
    15. Updated FRM Weight Data
    16. Updated Fuel Consumption Data
    17. Updated Fuel Cost Data
    18. Cost of Inspections
    19. Inspection and Maintenance Labor Hours
    20. Daily Check
    21. Spare Parts Costs
    22. Air Separation Model (ASM) Replacement
    L. Miscellaneous
    1. Harmonization
    2. Part 25 Safety Targets
IV. Regulatory Notices and Analyses
V. The Amendment

I. Executive Summary

A. Statement of the Problem

    Fuel tank explosions have been a constant threat with serious
aviation safety implications for many years. Since 1960, 18 airplanes
have been damaged or destroyed as the result of a fuel tank explosion.
Two of the more recent explosions--one involving a Boeing 747 (Trans
World Airways (TWA) Flight 800) off Long Island, New York in 1996 and
the other, a Boeing 727 terrorist-initiated explosion (Avianca Flight
203) in Bogot[aacute], Columbia in 1989 \1\--occurred during flight and
led to catastrophic losses (including the deaths of 337 individuals).
Two other recent explosions on airplanes operated by Philippine
Airlines and Thai Airlines occurred on the ground (resulting in nine
fatalities).\2\ While the accident investigations of the TWA,
Philippine Airlines and Thai Airlines accidents failed to identify the
ignition source that caused the explosion, the investigations found
several similarities. In each instance:
---------------------------------------------------------------------------

    \1\ Although it was determined that a terrorist's bomb had
caused the explosion of the center tank in the Bogot[aacute]
accident, the NTSB determined the ``bomb explosion did not
compromise the structural integrity of the airplane; however, the
explosion punctured the [center wing tank] and ignited the fuel-air
vapors in the ullage, resulting in destruction of the airplane.''
    \2\ Philippine Airlines Boeing 737 accidnet in Manila in 1990,
and a Thai Airlines Boeing 737 accident in Bangkok in 2001.
---------------------------------------------------------------------------

    1. The weather was warm, with an outside air temperature over 80
[deg]F;
    2. The explosion occurred on the ground or soon after takeoff; and
    3. The explosion involved empty or nearly empty tanks that
contained residual fuel from the previous fueling.
    Additionally, investigators were able to conclude that the center
wing fuel tank in all three airplanes contained flammable vapors in the
ullage (that portion of the fuel tank not occupied by liquid fuel) when
the fuel tanks exploded. This was also the case with the Avianca
airplane.
    A system designed to reduce the likelihood of a fuel tank fire, or
mitigate the effects of a fire should one occur, would have prevented
these four fuel tank explosions.
    A statistical evaluation of these accidents has led the FAA to
project that, unless remedial measures are taken, four more United
States (U.S.) registered transport category airplanes will likely be
destroyed by a fuel tank explosion in the next 35 years. Although we
cannot forecast precisely when these accidents will occur, computer
modeling that has been an accurate predictor in the past indicates
these events are virtually certain to occur. We believe at least three
of these explosions are preventable by the adoption of a comprehensive
safety regime to reduce both the incidence of ignition sources
developing and the likelihood of the fuel tank containing flammable
fuel vapors.

B. Reducing the Chance of Ignition

    To address the first part of this comprehensive safety regime, we
have taken several steps to reduce the chances of ignition. Since 1996,
we have imposed numerous airworthiness requirements (including
airworthiness directives or ``ADs'') directed at the elimination of
fuel tank ignition sources. Special Federal Aviation Regulation No. 88
of 14 Code of Federal Regulations (CFR) part 21 (SFAR 88; 66 FR 23086,
May 7, 2001) requires the detection and correction of potential system
failures that can cause ignition. Although these measures should
prevent some of the four forecast explosions, our review of the current
transport category airplane designs of all major manufacturers has
shown that unanticipated failures and maintenance errors will continue
to generate unexpected ignition sources. Since manufacturers completed
their SFAR 88 ignition prevention reviews, we have had reports of
potential ignition sources (including unsafe conditions) that were not
identified in the SFAR 88 reviews. For example:
     We issued AD 2006-06-14 to require the inspection of fuel
quantity indicating probes within the fuel tanks of Airbus A320
airplanes to prevent an ignition source due to sparks that could be
created following a lightning strike. This failure mode was not
identified as a possible ignition source in the SFAR 88 analysis
presented to the FAA.
     We issued AD 2006-12-02 following a report of an
improperly installed screw inside the fuel pump housings of A320
airplanes that could loosen and fall into the pump's electrical
windings. This could create a spark and ignite fuel vapors in the pump.
The ignited vapors could then exit the fuel pump housing, enter the
fuel tank through the hole created when the screw fell out of the
housing, and cause a fuel tank explosion. This failure mode was not
identified as a possible ignition source in the SFAR 88 analysis
presented to the FAA.
     We received an in-service report on a Boeing 777 that was
operated for over 30 days with an open vent hole between the center
wing fuel tank and the wheel well of the airplane. During maintenance,
a vent hole cover used to facilitate venting of the tank was
inadvertently left off. This was not discovered until a flight occurred
where the tank was fueled to a level where the fuel spilled from the
tank into the wheel well during pitching up of the airplane for
takeoff. Since the airplane brakes routinely exceed temperatures that
could ignite fuel vapors and the wheels are retracted into the wheel
well, the open vent port could have allowed ignition of fuel vapors in
the center tank and a fuel tank explosion. This type of maintenance
error was also not identified as providing a possible ignition source
during the SFAR 88 safety reviews.
     On May 5, 2006, an explosion occurred in the wing fuel
tank of a Boeing 727 in Bangalore, India, while the airplane was on the
ground. This event occurred after a modification to include special
Teflon sleeving and recurring inspections had been implemented to
prevent possible arcing of the fuel pump wires to metallic conduits
located in the fuel tank. Initial information indicates that the
identified

AD action was inadequate to prevent the formation of an ignition source
in the fuel tank and that the change intended to improve safety caused
premature wear of the sleeving and an unsafe condition. Premature wear
of Teflon sleeving on the Boeing 737 has also been reported, resulting
in AD action to modify the design and replace the existing sleeving.
This failure mode was not identified as a possible ignition source in
the SFAR 88 analysis presented to the FAA.
     We also received a report that during a recent
certification program test, an ignition source developed in the fuel
pumps causing pump failure. These pumps had been designed to meet the
most stringent requirements of SFAR 88 and Amendment 25-102 to 14 CFR
25.981 (issued concurrently with SFAR 88), yet the pump failed in a
manner that allowed a capacitor to arc to the pump enclosure and create
an ignition source. The applicant has since conducted a design review
that has resulted in numerous modifications to the pump's design.
     Following the TWA 800 accident, the risk of uncontrolled
fire adjacent to the fuel tanks causing a fuel tank explosion was
identified as an unsafe condition. In 2006, we issued a MD-80 AD (AD
2006-15-15) to prevent worn insulation on wires from arcing at the
auxiliary hydraulic pump, which could result in a fire in the wheel
well of the airplane. The AD required inspections to validate the pump
wire integrity as well as incorporating sleeving on portions of the
wires. In April 2008, we received reports of improper means of
compliance being used regarding the requirements of AD 2006-15-15.
Human error in completing the procedures required by the AD resulted in
airplanes being operated without the needed safety improvements.
    Based on the above examples, we have concluded that we are unlikely
to identify and eradicate all possible sources of ignition.

C. Reducing the Likelihood of an Explosion After Ignition

    To ensure safety, therefore, we must also focus on the environment
that permits combustion to occur in the first place. Many transport
category airplanes are designed with heated center wing tanks in which
the fuel vapors are flammable for significant portions of their
operating time. This final rule addresses the risk of a fuel tank
explosion by reducing the likelihood that fuel tank vapors will explode
when an ignition source is introduced into the tank.
    Technology now exists that can prevent ignition of flammable fuel
vapors by reducing their oxygen concentration below the level that will
support combustion. By making the vapors ``inert,'' we can
significantly reduce the likelihood of an explosion when a fire source
is introduced to the fuel tank. FAA-developed prototype onboard fuel
tank inerting systems have been successfully flight tested on Airbus
A320 and Boeing 747 and 737 airplanes. We have also approved inerting
systems for the Boeing 747 and 737 airplanes, and two airplanes of each
model type have performed as expected during airline in-service
evaluations. Boeing plans to install these systems on all new
production airplanes.
    Given that ignition sources will develop, the chances of a fuel
tank explosion naturally correlate with the exposure of the tank to
flammable vapors. The requirements in this final rule mitigate the
effects of such flammability exposure and limit it to acceptable levels
by mandating the installation of either a Flammability Reduction Means
(FRM) or an Ignition Mitigation Means (IMM).\3\ In either case, the
technology has to adhere to performance and reliability standards that
are set by us and contained in Appendices M and N to Title 14 Code of
Federal Regulations (CFR) part 25.
---------------------------------------------------------------------------

    \3\ FRM consist of systems or features installed to reduce or
control fuel tank flammability to acceptable levels. IMM is based
upon mitigating the effects of a fuel vapor ignition in a fuel tank
so that an explosion does not occur. Polyurethane foam installed in
a fuel tank is one form of an IMM. See AC 25.981-2 for additional
information.
---------------------------------------------------------------------------

    This final rule amends the existing airworthiness standards
contained in 14 CFR 25.981 to require all future type certificate (TC)
applicants for transport category airplanes to reduce fuel tank
flammability exposure to acceptable levels. It also amends 14 CFR part
26 ``Continued Airworthiness and Safety Improvements'' \4\ to require
TC holders to develop FRM or IMM for many large turbine-powered
transport category airplanes with high-risk fuel tanks. Finally, it
amends 14 CFR parts 121, 125 and 129 to require operators of these
airplanes to incorporate the approved FRM or IMM into the fleet and to
keep them operational. We estimate that approximately 2,700 existing
Airbus and Boeing airplanes operating in the United States as well as
about 2,300 newly manufactured airplanes that enter U.S. airline
passenger service will be affected. Fuel tank system designs in several
pending type-certification applications, including the Boeing 787 \5\
and Airbus A350, also have to meet these requirements.
---------------------------------------------------------------------------

    \4\ Part 26 was added to the Code of Federal Regulations to
include all requirements for Continued Operational Safety. See
Docket number FAA-2004-18379 for more information on this subject.
    \5\ This airplane model already includes a FRM in its design
that the applicant intends to show will meet today's final rule, so
no additional modifications will be required.
---------------------------------------------------------------------------

    We acknowledge that these requirements are costly and have adopted
these steps only after spending several years researching the most
cost-effective ways to prevent fuel tank explosions in cooperation with
engineers and other experts from the affected industry. Those efforts
have resulted in the development of fuel-inerting technology that is
vastly cheaper than originally thought.
    In contrast, the loss of a single, fully loaded large passenger
airplane in flight, such as a Boeing 747 or Airbus A380, would result
in death and destruction causing societal loss of at least $1.2 billion
(based on costs of prior calamities). We estimate that compliance with
this new rule will prevent between one and two accidents of some type
(for analytical purposes we assume the accidents would involve
``average'' airplanes with ``average'' passenger loads) over 35
years.\6\ In addition to the direct costs of such an accident, we now
recognize that, in the post-9/11 aviation environment, the public could
initially assume that an in-flight fuel tank explosion is the result of
terrorist actions. This could cause a substantial immediate disruption
of flights, similar to what occurred in Britain on August 10, 2006, due
to the discovery of a terrorist plot.\7\ This could have an immediate
and substantial adverse economic effect on the aviation industry as a
whole.
---------------------------------------------------------------------------

    \6\ Although Boeing has committed to installing compliant FRM in
all future production airplanes, regardless of this rule, operators
could deactivate the systems unless this rulemaking is adopted. The
final regulatory evaluation includes the costs and benefits of these
actions for newly produced Boeing and Airbus airplanes.
    \7\ Flight schedules in Britain were significantly disrupted due
to flight cancellation of all flights into Heathrow Airport and 30
percent of all short-haul flights out of Heathrow Airport for one
day (according to Secretary of State for Transport Douglas
Alexander). The day after the event, the crowds and lines that log-
jammed British airports the day before were largely gone, he said.
British Airways stated that it cancelled 1,280 flights between
August 10-17 due to the discovery of the terror plot and subsequent
security measures. EasyJet said it was forced to cancel 469 flights
because of the disruption caused by the terror alert. Ryanair said
it cancelled a total of 265 flights.
---------------------------------------------------------------------------

    The FAA's safety philosophy is to address aviation safety threats
whenever practicable solutions are found, especially when dealing with
intractable and catastrophic risks like fuel tank explosions that are
virtually certain to

occur. Thus, now that solutions are reasonably cost effective, we have
determined that it is necessary for safety and in the public's best
interest to adopt these requirements.

II. Background

A. Summary of the NPRM

    On November 23, 2005, the FAA published in the Federal Register the
Notice of Proposed Rulemaking (NPRM) entitled ``Reduction of Fuel Tank
Flammability in Transport Category Airplanes'' (70 FR 70922). This NPRM
is the basis for this final rule.
    In the NPRM, we proposed steps to be taken by manufacturers and
operators of transport category airplanes to significantly reduce the
chances of a catastrophic fuel tank explosion. The proposal followed
seven years of intensive research by the FAA and industry into
technologies designed to make fuel tanks effectively inert. Inerting
reduces the amount of oxygen in the fuel tank vapor space so that
combustion cannot take place if there is an ignition source. Although
the NPRM did not specifically direct the adoption of inerting
technology, it did propose a performance-based set of requirements for
reducing fuel tank flammability to an acceptably safe level.
    We proposed regulatory changes to require manufacturers and
operators to reduce the average fuel tank flammability exposure in
affected fleets. The main premise of the proposal was that a balanced
approach to fuel tank safety was needed that provides both prevention
of ignition sources and reduction of flammability of the fuel tanks.
While the focus of the NPRM was on airplanes used in passenger
operations, we requested comments on whether the new requirements
should also be applied to all-cargo airplanes.
    We also proposed changes to expand the coverage of part 25 by
making manufacturers generally responsible for the development of
service information and safety improvements (including design changes)
where needed to ensure the continued airworthiness of previously
certificated airplanes. This change was proposed to ensure that
operators would be able to obtain service instructions for making
necessary safety improvements in a timely manner.
    As to fuel tank flammability specifically, we proposed to require
manufacturers, including holders of certain airplane TCs and of
auxiliary fuel tank supplemental type certificates (STCs), to conduct a
flammability exposure analysis of their fuel tanks. We proposed a new
Appendix L (now Appendix N) to part 25 that provides a method for
calculating overall and warm day fuel tank flammability exposure. Where
the required analyses indicated that the fuel tank has an average
flammability exposure below 7 percent, we anticipate no changes would
be required. However, for the other fuel tanks, manufacturers would be
required to develop design modifications to support a retrofit of the
airplane fuel tanks. Under the NPRM, the average flammability exposure
of any affected wing tank would have to be reduced to no more than 7
percent. In addition, for any normally emptied fuel tank (including
auxiliary fuel tanks) located in whole or in part in the fuselage,
flammability exposure was to be reduced to 3 percent, both for the
overall fleet average and for operations on warm days.
    We also proposed to set more stringent safety levels for certain
critically located fuel tanks in most new type designs, while
maintaining the current, general standard under Sec.  25.981 for all
other fuel tanks. The expectation was that the design of most normally
emptied and auxiliary tanks located in whole or in part in the fuselage
of transport category airplanes would need to incorporate some form of
FRM or IMM.
    In Appendix M to part 25, we proposed to adopt detailed
specifications for all FRM, if they were used to meet the flammability
exposure limitations. These additional requirements were designed to
ensure the effectiveness and reliability of FRM, mandate reporting of
performance metrics, and provide warnings of possible hazards in and
around fuel tanks.
    We also proposed that TC holders for specific airplane models with
high flammability exposure fuel tanks be required to develop design
changes and service instructions to facilitate operators' installation
of IMM or FRM. Manufacturers of these airplanes would also have to
incorporate these design changes in airplanes produced in the future.
In addition, design approval holders (TC and STC holders) and
applicants would have to develop airworthiness limitations to ensure
that maintenance actions and future modifications do not increase
flammability exposure above the limits specified in the proposal. These
design approval holders would have to submit binding compliance plans
by a specified date, and these plans would be closely monitored by the
design approval holders' FAA Oversight Offices to ensure timely
compliance.
    Lastly, the proposal would require affected operators to
incorporate FRM or IMM for high-risk fuel tanks in their existing fleet
of affected airplane models. The proposal would have applied to
operators of airplanes under parts 91, 125, 121, and 129. Operators
would also have to revise their maintenance and inspection programs to
incorporate the airworthiness limitations developed under the NPRM. We
also proposed strict retrofit deadlines, which were premised on prompt
compliance by manufacturers with their compliance plans.
    The NPRM contains the background and rationale for this rulemaking
and, except where we have made revisions in this final rule, should be
referred to for that information.

B. Related Activities

    On November 28, 2005, the FAA published a Notice of Availability of
Proposed Advisory Circular (AC) 25.981-2A, Fuel Tank Flammability, and
request for comments in the Federal Register (70 FR 71365). The notice
announced the availability of a proposed AC that would set forth an
acceptable means, but not the only means, of demonstrating compliance
with the provisions of the airworthiness standards set forth in the
NPRM. On March 21, 2006, the FAA published a notice that extended the
comment period as a result of an extension of the NPRM's comment period
to May 8, 2006 (71 FR 14281).

C. Differences Between the NPRM and the Final Rule

    As a result of the comments received and our own continued review
of the proposals in the NPRM, we have made several changes to the
proposed regulatory text. The majority of these changes will be
discussed in the ``Discussion of the Final Rule'' section below. The
following is a summary of the main differences between the NPRM and
this final rule.
    1. Design Approval Holders. The design approval holder (DAH)
requirements proposed in the NPRM as subpart I of part 25 are now
contained in new part 26. This was done to harmonize with the
regulatory structure of other international airworthiness authorities.
We also revised the applicability for the retrofit requirement so the
DAH requirements do not apply to airplanes manufactured before 1992.
The effect of this change is that DAHs will not have to develop FRM or
IMM for many older airplane models that do not have significant
remaining useful life in passenger operations. We revised the
compliance times for DAHs to

develop and make available service instructions for FRM or IMM by
replacing specific compliance dates with a compliance time of 24 months
after the effective date of this rule for all affected airplane models.
We have also made some changes, discussed later, to the compliance
planning sections of the DAH requirements.
    2. Auxiliary Fuel Tanks. We have learned that few auxiliary fuel
tanks installed under STCs and field approvals remain in service, and
we need to obtain additional information to decide whether the risks
from these tanks justify retrofit requirements. Therefore, we have
removed the requirements for an FRM or IMM retrofit for these tanks.
    3. Impact Assessments. We limited the requirement for impact
assessments for auxiliary fuel tanks to airplanes with high
flammability tanks for which an FRM is required (i.e., Heated Center
Wing Tank airplanes).
    4. All-Cargo Airplanes. We retained the proposal to exclude all-
cargo airplanes from the requirement to retrofit high flammability
tanks with FRM or IMM. However, we added a requirement that when any
airplane that has an FRM or IMM is converted from passenger use to all-
cargo use, these safety features must remain operational. We also added
a requirement that newly manufactured all-cargo airplanes must meet the
same requirements as newly manufactured passenger airplanes. We revised
Sec.  25.981 to remove the exclusion of all-cargo airplanes so that any
newly certificated transport category airplane, regardless of the type
of operation, must meet the same safety standards.
    5. Part 91 Operators. The proposed rule would have applied to
operators under part 91, which is limited to private use operations.
However, the final rule does not include part 91 requirements.
    6. Retrofit Requirements for Operators. We have added a provision
for air carrier operators that allows a one year extension in the
compliance time to retrofit of their affected fleets if they revise
their operations specifications and manuals to use ground conditioned
air \8\ when it is available. Instead of requiring retrofit for all
airplanes with high flammability fuel tanks, we revised the operating
rules to prohibit operation of these airplanes in passenger service
after 2016 unless an FRM or IMM is installed. This approach gives
operators the option of converting these airplanes to all-cargo
service. We also prohibit the operation of airplanes with high
flammability fuel tanks produced after 2009 unless they are equipped
with FRM or IMM. This requirement parallels the proposed production
cut-in requirement, but also applies to foreign manufactured airplanes.
Finally, instead of requiring retrofit of high flammability auxiliary
fuel tanks, we prohibit installation of auxiliary fuel tanks after 2016
unless they comply with the new requirements of Sec.  25.981.
---------------------------------------------------------------------------

    \8\ ``Ground conditioned air'' is temperature controlled air
used to ventilate the airplane cabin while the airplane is parked
between flights.
---------------------------------------------------------------------------

III. Discussion of the Final Rule

A. Summary of Comments

    The FAA received over 100 comment letters to the proposed rule and
guidance material. These letters covered a wide spectrum of topics and
range of responses to the rulemaking package, which will be discussed
more fully below. While there was much support for the general intent
of the rule changes and the guidance material, there were several
requests for changes and for clarification.

B. Necessity of Rule

1. Estimates/Conclusions Supporting Need for Rule
    In the NPRM and its supporting documents, we noted several
estimates and conclusions that we used to determine the necessity and
content of this rule. We received comments on the following
assumptions:
     The historical accident rate for heated center wing tank
(HCWT) airplanes is 1 accident per 60 million hours of flight (before
implementing corrective actions following TWA 800).
     That SFAR 88 and other corrective actions would prevent 50
percent of future fuel tank explosions.
     That Boeing and Airbus airplanes have an equal risk of an
explosion.
     That a HCWT, depending upon the airplane model and its
mode of operation, is explosive 12 to 24 percent of the time.
     That the rate of accidents directly correlates to
flammability exposure.
    Based on the comments received, we have changed the historical
accident rate estimate to 1 accident per 100 million hours. This change
does not affect our conclusion that the historical accident rate for
HCWT airplanes supports the need for this rule. As for the other
estimates and conclusions, we have not changed these in the final rule.
a. Historical (pre-TWA 800) Accident Rate
    Airbus, the Air Transport Association (ATA), Alaska Airlines
(Alaska), the Association of Asia Pacific Airlines (AAPA), the
Association of European Airlines (AEA), Boeing, Cathay Pacific Airways
(Cathay), Delta Air Lines (Delta) and FedEx stated that the historical
accident rate of 1 accident every 60 million fleet operating hours was
too high. Most of these commenters recommended a rate of 1 accident per
140 million hours. Their proposed rate is based on the number of
accidents and the total fleet hours for heated center wing tank (HCWT)
airplanes through 2005 (3 accidents over 430 million hours). Several of
these commenters also noted that this rate is closer to the
conservative estimate in the MITRE Corporation's assessment of the
FAA's accident prediction/avoidance model (1 accident every 160 million
hours).\9\
---------------------------------------------------------------------------

    \9\ The Mitre assessment of the FAA accident prediction
methodology is included as Appendix H of the Initial Regulatory
Evaluation and is available in the docket for this rulemaking
(Document Number FAA-2005-22997-3).
---------------------------------------------------------------------------

    Boeing proposed a rate of 1 accident every 100 million hours.
Boeing's analysis also started with the number of accidents and the
total fleet hours for HCWT airplanes through 2005. However, Boeing
recognized that some of the improvement since 2001 may be attributable
to the FAA/industry focus on ignition prevention and concluded that the
rate of 1 accident every 100 million hours more accurately represents
the pre-TWA 800 rate.
    FedEx stated that, from a historical basis, 140 million hours would
be a correct mean time between accidents. However, FedEx noted that a
more conservative estimate closer to 100 million hours would still be
acceptable.
    In a related comment, ATA questioned our use of flight hours as the
measure of exposure to risk. ATA noted that two of the historical
accidents did not occur in flight. Therefore, flight hours may
understate exposure and overstate risk. ATA concluded that these
accidents support the use of block hours or some other measure that
accounts for time on the ground (and would lower the accident rate by
about 16 percent).
    We agree that the accident rate used in the NPRM was too high and
needs adjustment. While the rate of 1 accident every 140 million hours
is correct if you only use the total fleet hours for HCWT airplanes
through 2005, it fails to consider the beneficial effects of FAA/
industry action following the TWA 800 accident. Since that accident, we
have issued many ADs to address specific findings of unsafe conditions
that could produce fuel tank ignition sources. In addition, the Fuel
Tank Safety Rule, of which SFAR 88 was a part, was issued in 2001 to
establish a systematic process for identifying and eliminating ignition

sources. Many of the improvements resulting from these actions have
been implemented in the transport airplane fleet, and the improved
safety record since TWA 800 is largely attributable to them. While the
commenters acknowledge that these actions have been effective at
preventing future accidents, most of them failed to reduce their
proposed historical rate accordingly to address these benefits. In
contrast, Boeing's recommended rate considers the benefits of these
actions (which we calculate covers about 170 million hours).
    We believe that an accident rate of 1 per 100 million hours is an
accurate calculation of the historical accident rate before
implementation of post-TWA 800 ignition prevention actions. Therefore,
we used this rate in developing this final rule and its supporting
documents. However, this change does not affect our conclusion that the
historical accident rate for HCWT airplanes supports the need for this
rule. We continue to believe that the risk of an accident is too high.
    Several commenters referred to the rate in the MITRE Corporation's
report (1 accident every 160 million hours). This rate includes
operations of airplanes without HCWT. Recommendations resulting from
MITRE's review included a suggestion that only fleet hours from
airplanes with HCWT be used in the accident prediction model. We agreed
with this recommendation and have adjusted the accident rate
accordingly.
    Finally, we do not agree with ATA's conclusion that the use of
flight hours to predict future accidents results in an overstated risk.
Both the past accident rate and the future predicted number of
accidents were based upon the number of flight hours of airplanes with
high flammability fuel tanks, and in both cases the number of flight
hours does not include ground time. The ratio of flight time to ground
time is unlikely to change significantly in the future because the
average flight length and the amount of time spent on the ground before
and after each flight are unlikely to change significantly. Therefore,
whether past and future accident rates are stated in terms of flight
time only or flight time plus ground time, the projected future
accident rates would predict the same number of accidents over any
given time period.
b. SFAR 88 Effectiveness Rate
    In the NPRM and its supporting documents, we estimated that SFAR 88
would prevent 50 percent of future fuel tank explosions (although we
also conducted a sensitivity analysis using effectiveness rates of 25
and 75 percent). ATA stated that the 50 percent effectiveness rate was
without basis or explanation and recommended a rate of 90 percent.
Airbus recommended an effectiveness rate in the range of 75 to 90
percent. If these higher rates are used, ATA and Airbus noted the
safety benefits of the proposed rule are insufficient to justify the
costs, and they requested that we withdraw the NPRM.
    Predicting the effectiveness of ignition prevention actions is
challenging, since many ignition sources are the result of human error,
which cannot be precisely predicted or quantitatively evaluated.
Despite extensive efforts by the FAA and industry to prevent ignition
sources, we continue to learn of new ignition sources. Some of these
ignition sources are attributable to failures on the part of
engineering organizations to identify potential ignition sources and
provide design changes to prevent them. Others are attributable to
actions by production, maintenance, and other operational personnel,
who inadvertently compromise wiring and equipment producing ignition
sources. Regardless of the causes, we believe that ignition prevention
actions, while necessary, are insufficient to eliminate ignition
sources.
    Based on the recently discovered ignition sources discussed
earlier, we continue to believe that an assumed effectiveness rate of
50 percent is reasonable and appropriate. In its study on SFAR 88
effectiveness, Sandia National Laboratories concluded that our estimate
of 50 percent was reasonable, and the value of 75 percent effectiveness
assumed in the initial Aviation Rulemaking Advisory Committee (ARAC)
report was overly optimistic. While the report of the ARAC Fuel Tank
Inerting Harmonization Working Group \10\ initially assumed an
effectiveness of 75 percent, the report was later amended to use a
range of effectiveness between 25 to 75 percent because of the
uncertainty in predicting the effectiveness.
---------------------------------------------------------------------------

    \10\ Document Number FAA-22997-6 in the docket for this
rulemaking.
---------------------------------------------------------------------------

    Finally, since ATA did not submit any data to substantiate that a
higher effectiveness rate is more reasonable, we believe the post-SFAR
88 service experience supports the use of a range of effectiveness
between 25 to 75 percent and a median value of 50 percent.
c. Boeing and Airbus Airplanes Have an Equal Risk of an Explosion
    We concluded that all airplanes with HCWT had similar levels of
fuel tank flammability and the associated increase in the likelihood of
a fuel tank explosion. We based the SFAR 88 effectiveness estimates on
the HCWT fleet as a whole. We did not differentiate among airplane
models based upon design differences that could affect the likelihood
of an ignition source forming.
    AEA, Airbus, Frontier Airlines (Frontier), the Air Safety Group UK,
Singapore Airlines (Singapore), BAE Systems (BAE), TDG Aerospace (TDG)
disagreed with this proposal and argued that the risk of an explosion
is lower for Airbus airplanes. These commenters noted that fuel tank
designs for those airplanes that experienced a fuel tank explosion are
at least a decade older than Airbus' designs. Airbus argued that its
airplanes use newer technology and design philosophies that have
incorporated the lessons learned from prior designs. BAE and two
individuals suggested that we address fuel tank flammability by issuing
ADs to address specific design shortfalls in the two airplane types
that have experienced fuel tank explosions (i.e., the Boeing 737 and
747 series airplanes).
    While we did note differences between the designs and technologies
used by Boeing and Airbus, we concluded that the risk of an explosion
was equal for Boeing and Airbus airplanes based on similarities in
their fuel tank designs and service history. We found that both
manufacturers have similar problematic fuel tank design features. For
example, air conditioning equipment is located below the center wing
tank in both manufacturers' designs (and HCWT have flammability
exposure well above that of a conventional unheated aluminum wing
tank). Likewise both manufacturers locate fuel gauging systems with
capacitance measuring probes inside the fuel tank, and associated
wiring to the probes enters the fuel tank from outside. These wires are
co-routed with high-energy wiring to other airplane systems that have
sufficient energy to cause an ignition source inside the fuel tanks.
Finally, high-energy electrical fuel pumps are located within the fuel
tanks and are fuel-cooled and manufactured by the same component
suppliers. Arcing of the pump could cause a spark inside the fuel tank
or could create a hole at the pump connector, causing a fuel leak and
an uncontrolled fire outside of the tank.
    As for the service history and design reviews of Airbus airplanes,
we found numerous situations that indicate a risk of an explosion
similar to those aboard Boeing airplanes, including:
     The electrical bonding straps used on Airbus airplanes
have been reported

to degrade due to corrosion; the bonding jumpers used by Boeing are
made of a different material that does not corrode.
     All fuel pumps on Boeing airplanes are being modified to
incorporate ground fault power interrupters, whereas only pumps that
can arc directly into the fuel tank ullage are being modified to
incorporate ground fault power interrupters on Airbus airplanes.
     The safety assessments conducted by both manufacturers
resulted in very similar numbers of ignition sources that required
modifications to their airplanes.
     After the SFAR 88 assessments were completed, we learned
that fuel quantity indicating probes within the fuel tanks of Airbus
A320 airplanes could be an ignition source due to sparks that could be
created following a lightning strike. This resulted in the issuance of
AD 2006-06-14.
     After the SFAR 88 assessments were completed, we learned
that the improper installation of a screw inside the fuel pumps of
Airbus A320 airplanes could result in the screw loosening and falling
into the pump electrical windings. This could create a spark and ignite
vapors in the pump that could exit the fuel pump housing into the fuel
tank through the hole created when the screw fell out of the housing.
This resulted in the issuance of AD 2006-12-02.
    The recent discovery of the ignition sources in Airbus A320
airplanes is evidence that unforeseen failures will occur in the future
that can result in ignition sources on Airbus airplanes. The Airbus
fleet has significantly fewer flight hours than Boeing airplanes and,
as the Airbus airplanes age, we expect to see more unforeseen failures.
Therefore, based on design similarities and service history, we see no
reason to differentiate between Airbus and Boeing airplanes. This rule
requires all affected manufacturers to determine the fuel tank
flammability exposure of their airplanes by assessing them against
performance-based requirements that specify a flammability exposure
that we have determined provides an acceptable level of safety.
Additional action is only required for those airplanes that do not meet
the required level of fuel tank flammability safety.
d. ARAC Flammability Exposure Data
    Airbus and AEA both commented that the ARAC flammability exposure
data cited in the NPRM are incorrect and need to be reduced based on
updated data developed by both Boeing and Airbus. They said this
reduction is important since the lower data reduce the level of safety
improvement that can be achieved by this rule from the FAA's intended
``order of magnitude'' (factor of 10) to a safety improvement in the
range of only a factor of 7.7 to 2.7, depending on the model used.
Airbus also objected to our conclusion that a HCWT, depending upon the
airplane model and its mode of operation, is explosive 12 to 24 percent
of the time. Airbus requested that this be corrected to reflect the
latest industry estimates for Airbus products (i.e., 8 to 12 percent)
and 16 to 18 percent for other manufacturers.
    We acknowledge that the flammability exposure data cited in the
NPRM may not reflect current values. However, Boeing and Airbus
submitted those data to us as part of the SFAR 88 reviews. While we
agree with Airbus that more recent information has indicated lower
flammability for HCWTs, we do not agree that the more recent values
should be used since the manufacturers have not submitted a validated
analysis using the revised flammability assessment techniques (as
defined in Sec.  25.981) to support its figures. Changes to the method
for calculating fuel tank flammability, such as airplane ground times
used in the Monte Carlo analysis required by Appendix N may result in
additional variations in flammability calculations. Since flammability
reduction was first considered by the aviation industry, the
flammability values quoted by airplane manufacturers have varied
considerably. These variations were the result of the method used to
calculate the flammability of the fuel tanks and more accurate fuel
tank temperature data based upon flight tests. For example, the first
ARAC determined values ranged from 10 to 50 percent for generic
airplanes equipped with HCWT. After the conclusion of this activity,
Airbus was quoted in Air Safety Week as stating the A310 HCWT having a
flammability exposure of 4 percent. In 2001, as part of the SFAR 88
compliance, Airbus submitted flammability values to the European
Aviation Safety Agency (EASA) and to us that ranged between 12 and 23
percent.
    We recognize that as methods for measuring fuel tank flammability
are refined, it is likely that calculated flammability exposure will
also change. These refinements also apply to the conventional unheated
aluminum wing tanks that ARAC used as the baseline for determining an
acceptable exposure. We now know that the exposure of these tanks is
considerably lower than originally estimated by ARAC. However, none of
this new information changes the findings of ARAC that HCWTs have
significantly higher risk of fuel tank explosions, or that the
reduction in flammability exposure would be on the order of a factor of
10. Therefore, we do not believe that these refinements change the
overall conclusion that certain fuel tanks that are affected by this
rule have significantly higher flammability exposure than conventional
unheated aluminum wing tanks. No change has been made to the final rule
as a result of these comments.
e. Accidents Directly Correlate to Flammability Exposure
    Airbus did not agree with the assumption that the rate of accidents
directly correlates to flammability exposure. Airbus contended that the
risk of ignition source development must also be considered when
evaluating the benefits of flammability reduction.
    We agree with Airbus that the overall risk of a fuel tank explosion
includes both the potential for an ignition source and the likelihood
that the fuel tank will be flammable when an ignition source occurs.
There may be differences in the likelihood of an ignition source
occurring between different airplane types, but these differences would
be very difficult to quantify. We have no statistically significant,
validated data that could be used to establish rates of development of
ignition sources for different airplane types. As discussed in the
Sandia report, there is a wide variation in the predicted rate of
ignition sources developing in fuel tanks and there is no industry
agreement on the rate that should be used for individual airplane
designs. In addition, recent service history shows there have been a
number of ignition sources that have developed following the TWA 800
accident in both Airbus and Boeing airplane models.
    Given this lack of data and consensus on ignition source risks, we
continue to believe that correlating accident rates with flammability
exposure is the most appropriate analytical approach.
2. Additional Research Needed
    Airbus, AAPA, AEA, EASA, Iberia Maintenance and Engineering
(Iberia), Singapore and Virgin Atlantic Airways (Virgin) stated that
this rulemaking is premature because the risks of additional fuel tank
explosions are not adequately defined. These commenters argued that
additional research is necessary to better understand flammability,
SFAR 88 effectiveness and the risks of additional explosions. In a
related comment, the International Federation Victims of Aviation
Accident (IFVAA) stated that additional research should be performed to
identify

technology that would completely eliminate, not just reduce, fuel tank
flammability.
    We think it would be a mistake to delay this rule to conduct
additional research. Service history and the recent occurrences of
ignition sources described earlier demonstrate that the risk of future
explosions remains significant. In addition, we believe that additional
research would not provide any useful information that would change our
finding that flammability reduction, in combination with the SFAR 88
measures, is needed to prevent such explosions. As for IFVAA's comment,
we consider existing flammability reduction means highly effective and
sufficient to reduce the risk of fuel tank explosions to an acceptable
level. While further research might identify even better solutions, the
resulting delay would deprive the public of the benefits of these
currently available safety improvements.
3. Consistent Safety Level With Other Systems
    Airbus commented that SFAR 88 improvements, together with the
current rate of occurrence, put fuel tank safety on the order of one
accident for every billion flight hours (i.e. 10-9 accidents
per flight hour) which is consistent with safety objectives of other
critical airplane systems.\11\ Airbus argued that this rule requires
fuel tanks to go to a higher level of safety than other critical
systems and that this is inconsistent with the overall risk.
---------------------------------------------------------------------------

    \11\ This is the quantitative probability measure (one in one
billion) of an event that is ``extremely improbable'' as that term
is used in Sec.  25.1309 and other part 25 airworthiness standards.
See AC 25.1309.
---------------------------------------------------------------------------

    Application of existing safety standards to prevent ignition
sources that are similar to those applied to other systems has not
resulted in an acceptable level of safety, and we have determined that
limiting fuel tank flammability is also needed. Fuel tank explosions
are unacceptably occurring at a rate greater than 10-9 per
flight hour and the recent events described above show that
unanticipated failures continue to result in ignition sources within
airplane fuel tanks. To protect the flying public, we have developed a
``fail safe'' policy for fuel tank safety that includes both ignition
prevention and flammability reduction to reduce fuel tank explosion
risk to an acceptable level.
4. Human Errors
    AEA stated that human errors are not new and should not be used to
justify this rule. AEA pointed out that TC holders are obliged to
consider human error during airplane design to mitigate errors. In
addition, continuing airworthiness instructions (e.g., maintenance
manuals) highlight safety considerations where necessary. AEA also
contended that, in the 17 accidents cited by the FAA in the NPRM, there
is no evidence that any were caused by the introduction of an ignition
source through human error. Finally, AEA noted that human errors will
always be a factor in aviation safety, particularly when introducing
added complexity such as an inerting system.
    We agree with AEA that human errors are not a new phenomenon and
that the introduction of new systems on airplanes can have unintended
consequences resulting from human error. We also believe the safety
benefits of FRM or IMM is warranted. Service history shows the current
regulations do not provide an adequate mitigation of human errors for
fuel tank systems. Ignition sources continue to occur even though
designers have conducted analyses that concluded ignition sources would
not occur. Earlier in this document, we discussed numerous ignition
sources that have recently developed in airplanes that had previously
been shown by safety assessments to have features that would prevent
ignition sources from developing. These ignition sources were caused by
errors in defining assumptions in safety assessments, as well as in the
design, manufacture and maintenance of these airplanes. These events
show that an additional layer of protection (in the form of FRM or IMM)
is needed to prevent future fuel tank explosions.
5. Explosion Risk Analysis
    American Trans Air commented that the assumptions made in the
explosion risk analysis were erroneous and not within the range of
reasonable values. American Trans Air recommended that a completely new
analysis of the fuel tank explosion risk be undertaken. This new
analysis should utilize widely accepted assumptions, including taking
into account:
     The history of particular type designs.
     The actual ignition risk potential (i.e., potential
ignition sources not in the ullage are either exempted, or
substantially discounted in the analysis).
     Actual ignition energies, applying these energies to the
potential ignition sources.
     The definitions and assumptions of fuel-air vapor mixtures
that have been further derived and applied on an individual type design
basis.
    We agree with the commenter that the assumed fuel air vapor mixture
should be based upon the individual fuel tank design, and we included
variations in the pressure and temperature of the fuel when developing
the fuel tank flammability model. This factor is already accounted for
in the Monte Carlo method defined in Appendix N. As for the other
assumptions offered by American Trans Air, they cannot be used in an
analysis, because there is a wide variation in the possible values.
6. Special Certification Review Process vs. Rulemaking
    American Trans Air commented that if an analysis identifies type
designs still found to have unacceptable risk after all SFAR 88
alterations have been executed, an appropriate response to address the
remaining at-risk type designs may be the use of the special
certification review process. American Trans Air noted that there
appears to be wide variability in the risk between type designs, and
concluded that generalized rulemaking is inappropriate at this time.
    We do not agree that we should address each type design with
unacceptable flammability risk by special certification review and then
by an appropriate AD. Through careful study, we have determined that
the flammability risk on many airplanes is too high. To address this
risk, we have created an objective design standard by which all
airplanes can be measured. If airplanes currently meet this design
standard, no action will be required. The TC holder for those airplanes
that do not meet it will have to make only those changes that bring
that airplane model into compliance. We have determined that the
uncertainty involved in the elimination of ignition sources requires
reduced flammability to acceptably reduced tank explosion risk, and the
most effective and efficient way to address this issue is through the
rulemaking process.
7. Flammability Reduction Means (FRM) Effectiveness
    In the NPRM, we said lowering the flammability exposure of the
affected fuel tanks in the existing fleet and limiting the permissible
level of flammability on new production airplanes would result in an
overall reduction in the flammability potential of these airplanes of
approximately 95 percent. Airbus and AEA commented that we overstated
the potential benefits of flammability reduction measures by a factor
between 4 and 7. They said we used a factor of 20 (95 percent) for the

reduction in flammability exposure achieved by reducing the
flammability of HCWT to 3 percent or less. They said the subsequent
reduction in flammability will be in the order of a factor of three to
five and not a factor of 20. Therefore, the number of accidents
prevented would consequentially be less than projected by the FAA.
Airbus also said the FAA appears not to have considered the
effectiveness of the FRM itself, which it said is in the order of 67 to
87 percent by latest industry estimates. Therefore, Airbus suggests
that the Initial Regulatory Evaluation (IRE) is incomplete and should
be revised to include this key parameter.
    The 95 percent value used in the NPRM was not based on the ratio of
fuel tank fleet average flammability exposure before and after
implementing the requirements of this rule. It was derived by
qualitatively evaluating the effectiveness of an FRM in preventing fuel
tank explosions that would not be prevented by ignition prevention
measures.
    When an FRM is installed on a fuel tank, it must meet both the 3
percent fleet average flammability exposure and also the 3 percent warm
day (specific risk) flammability exposure requirements.\12\ For the
warm day requirement, the flammability exposure must be below 3 percent
during ground and takeoff/climb conditions for those days above 80
degrees F when the FRM is operational. These are the conditions when
fuel tanks tend to have the highest flammability exposure and when the
accidents discussed earlier occurred.
---------------------------------------------------------------------------

    \12\ The overall time the fuel tank is flammable cannot exceed 3
percent of the Flammability Exposure Evaluation Time (FEET), which
is the total time, including both ground and flight time, considered
in the flammability assessment defined in proposed Appendix N. As a
portion of this 3 percent, if flammability reduction means (FRM) are
used, each of the following time periods cannot exceed 1.8 percent
of the FEET: (1) When any FRM is operational but the fuel tank is
not inert and the tank is flammable; and (2) when any FRM is
inoperative and the tank is flammable.
---------------------------------------------------------------------------

    The combination of the warm day requirement and the fleet average
flammability requirement results in an FRM with overall flammability
reduction benefits that are significantly higher than those estimated
by the commenters. Since the NPRM was issued, we have reviewed and
approved FRM designs and have found the performance exceeds the
certification limits. When the FRM is operating, the fuel tanks are
rarely flammable. So, the major risk of fuel tank flammability occurs
when the system is inoperative and this time is limited to a maximum of
1.8 percent of the Flammability Exposure Evaluation Time (FEET).
Historically, designers provide a safety margin in the design so that
the design limits are never exceeded, so we would expect the
flammability to be below this level.
    Another consideration in using a 95 percent effectiveness measure
is the safety improvement noted during warm days. Without any FRM, a
HCWT is flammable about 50 percent of the time during climb. Meeting
both the 3 percent warm day requirement and the 3 percent reliability
requirement results in a flammability exposure of the tank of less than
half of one percent during climb. For an airplane with an initial warm
day flammability of 50 percent, this is a 99 percent reduction in the
flammability during climb. We, therefore, used the 95 percent
effectiveness for flammability reduction in the risk model for the
final regulatory evaluation.

C. Applicability

1. Airplanes With Fewer Than 30 Seats
    The proposed DAH requirements would apply (with some exclusions) to
transport category turbine-powered airplanes approved for a passenger
capacity of 30 or more persons or a maximum payload capacity of 7,500
pounds or more. The UK Air Safety Group disagreed with the proposed
rule's limited applicability because the design of fuel tank systems is
similar for both large and small airplanes. Therefore, it argued that
the potential explosion hazard is equal. The commenter also noted that
EASA's CS-25 regulation for Fuel Tank Ignition Prevention does not make
any distinction based on the number of passenger seats.
    We did not include smaller part 25 airplanes in the DAH
requirements of this final rule because those airplanes generally do
not have high flammability tanks. While some parts of their fuel tank
system designs are similar to those of larger airplanes, we do not
agree that the overall architecture and the risk of a fuel tank
explosion are equal. Data submitted by manufacturers of smaller part 25
airplanes as part of the SFAR 88 analysis show that their airplanes
typically do not have fuel tanks located within the fuselage contour,
and would not be considered high flammability fuel tanks. In most
cases, cool fuel from the wing tanks is drawn into the center wing box,
so the overall flammability is low. In addition, these tanks are not
normally emptied, reducing the amount of ullage.
    Based on these facts, the benefits of including these smaller
airplanes in all of the requirements of this rule are minimal and do
not warrant the cost. However, we do agree that the part 25
requirements applicable to new type designs should be the same for all
transport category airplanes, regardless of size. The cost to design
and produce a new airplane to meet the flammability requirements is
significantly less than that for existing airplanes since the designers
can optimize the performance of the FRM or IMM and integrate it into
the airplane design to minimize costs. Therefore, Sec.  25.981 of this
rule applies to all transport category airplanes regardless of size.
2. Part 91 and 125 Operators
    The NPRM proposed that operators under parts 91, 121, 125, and 129
incorporate FRM or IMM and keep it operational on their affected
airplanes. The AEA and Airbus asked that parts 91 and 125 operations be
excluded and cited corporate use airplanes as an example of operations
where the cost would far exceed the benefit. According to AEA and
Airbus, the cost/benefit analysis for these airplanes, when operated
under part 91 or part 125, would produce results similar to those for
all-cargo airplanes (which are excluded from the retrofit requirements
of this rule).
    We recognize a distinction between part 91 and part 125 operations,
in that part 91 does not allow commercial operations for compensation
or hire, while part 125 does allow such operations, as long as the
operator does not ``hold out'' to the public that they are available
for such operations (in which case they would be required to operate as
an air carrier). For example, many business jets are operated under
part 91 if the operator does not receive compensation for transporting
passengers (e.g., a corporate jet transporting the corporation's
employees). On the other hand, charter companies frequently operate
under part 125 to transport sports teams and other groups for
compensation.
    While we recognize that private owners and operators may choose to
assume the risk of possible fuel tank explosions, we see no reason why
persons flying on commercial charter flights should be exposed to a
greater risk of a fuel tank explosion than passengers flying on
airplanes operated under parts 121 and 129. Commercial charter
passengers are in no better position to recognize and accept the risk
of a fuel tank explosion than are air carrier passengers. Additionally,
the risk and likelihood of a fuel tank explosion are potentially
commensurate with that of the same airplane model operated

under parts 121 and 129. Therefore, the final rule has been revised to
exclude part 91 operations, but does not exclude part 125 operations.
However, because of the significant safety benefits of this rule, we
encourage part 91 operators to install FRM on their airplanes, and not
to remove it if it is already installed.
3. All-Cargo Airplanes
    In response to our request for comments on the proposed exclusion
of all-cargo airplanes from this rulemaking, we received numerous
comments both supporting and opposing the exclusion. Airbus, the Cargo
Airline Association (CAA), FedEx, ATA, ABX Air (ABX), United Parcel
Service (UPS), and National Air Carrier Association (NACA) agreed that
all-cargo airplanes should be excluded from this rulemaking. The CAA
argued that the risks are lower for cargo carriers due to several
factors:
    a. Cargo operations are predominately night operations with lower
outside ambient temperatures (making fuel tanks less likely to be
flammable).
    b. Cargo operators do not typically run air conditioning packs
prior to takeoff as many passenger operators do.
    c. The CAA members typically operate one to two round trips each
day, which is a lower utilization rate than most passenger airplanes.
    The CAA stated that costs to various airline industry segments
should be considered when proposing any new regulation. The CAA
supported establishing a safety baseline which allows different
operations to meet the baseline in different ways. Based on the factors
articulated above, the CAA maintained the cost/benefit analysis does
not justify its application to cargo airplanes.
    FedEx commented that there is a finite amount of safety dollars and
it is important to use them effectively. As the cost/benefit analysis
does not justify inclusion of all-cargo airplanes, FedEx claimed it is
not permissible to include them under FAA rulemaking authority. ATA
stated that the proposed rule should not apply to all-cargo airplanes,
other than the design rules proposed to prevent modifications that
could increase the flammability exposure of a fuel tank. ABX agreed
with ATA, and noted that the ignition prevention measures of SFAR 88
provide an acceptable level of safety for these airplanes. Finally,
Airbus and UPS based their support for our proposal to exclude cargo
airplanes on the reasons stated in the NPRM.
    On the other hand, the National Transportation Safety Board (NTSB),
the Independent Pilots Association (IPA), the Air Line Pilots
Association (ALPA), the EASA, the Coalition of Airline Pilots
Association (CAPA), Singapore and the National Air Traffic Controllers
Association (NATCA) do not agree that all-cargo airplanes should be
excluded from this rulemaking. While the NTSB, IPA and NATCA
acknowledged that cargo airplanes typically carry fewer people, they
pointed out that these airplanes regularly use airports in densely
populated areas where an accident could have a catastrophic effect for
people on the ground. The NTSB and IPA also cited a recent DC-8 cargo
fire accident where an inerting system might have prevented or
substantially reduced the magnitude of the fire, and a C-5A accident at
Dover Air Force Base where the presence of an inerting system may have
been the reason many lives were saved.
    The IPA also stated that there should be one level of safety for
all part 25 airplanes, and noted that all-cargo airplanes are typically
older (which makes them more susceptible to ignition sources within the
tank). In addition, ADs are being issued on even the newer models to
restrict operations for flammability/ignition concerns.
    ALPA commented that all-cargo airplanes should not be excluded from
critical safety improvements simply because there are fewer fatalities
in a typical crash. ALPA recommended that we apply a firm deadline for
the manufacturers to complete a flammability analysis on all-cargo
airplanes compared to the passenger versions of the same airplane
model.
    EASA did not agree with introducing a new distinction among part 25
products. In EASA's view, the justification for excluding all-cargo
airplanes has yet to be substantiated. CAPA thought the logic of
excluding all-cargo airplanes could be extended to each individual
operator or to all airplanes with differing passenger capacities. For
example, CAPA questioned whether, if operator ``A'' had many more
Boeing 737 airplanes than operator ``B'', would we require Operator
``A'' to use FRM while Operator ``B'' would not have to. CAPA stated
that this same type of flawed logic is being applied to all-cargo
airplanes. In its opinion, the value of pilot lives should not depend
on what is in the back of the airplane. Finally, NATCA commented that
confidence in flying would be diminished if there were a cargo airplane
accident, and we should not set a precedent that sets a different
safety standard based on the intended operation of the airplane.
    Boeing stated that its safety philosophy is to not differentiate
between passenger and cargo airplanes in managing fleet-wide airplane
risk and therefore, did not exclude airplanes designed solely for cargo
operations in their proposed revision to Sec.  25.981(b).
    After reviewing these comments, we have decided that we will not
require existing all-cargo airplanes to meet the retrofit requirements
in this final rule. We did not receive any data on the costs, benefits
or risks for all-cargo airplanes in response to our request in the
NPRM, and we do not have any new data to justify requiring retrofit of
FRM or IMM on the current fleet of all-cargo airplanes. We will
continue to gather additional data regarding these factors and may
initiate further rulemaking action if the flammability of these
airplanes is found to be excessive.
    However, we will require compliance with the requirements of this
final rule for (i) future designs; (ii) the conversion of any passenger
airplane with an FRM or IMM to all-cargo use; and (iii) future
production of all-cargo airplanes. We agree with NATCA and other
commenters with respect to removing the exclusion from Sec.  25.981 of
airplanes designed solely for all-cargo operations. The airworthiness
standards of part 25 do not impose different requirements depending on
the intended use of the airplane. 49 U.S.C. 44701 requires that we
adopt such minimum airworthiness standards as are necessary, and
historically we have recognized that those minimum standards should be
the same for all transport category airplanes, regardless of their
intended use. There are practical reasons for this approach, since the
intended use can change quickly based on business considerations
unrelated to safety. Therefore, we agree that the proposed new design
standards in part 25 should not distinguish between all-cargo and
passenger airplanes.
    The rationale for including a production cut-in for all-cargo
airplanes is based upon the long-term goal of fleet-wide reduction in
flammability exposure to eliminate the likelihood of fuel tank
explosions. In addition to the immediate effects of an accident, we
believe a fuel tank explosion on an all-cargo airplane could have a
significant impact on the aviation industry due to public sensitivity
to terrorist actions. The cost of installing FRM in new production
airplanes is less than the cost of to retrofit airplanes, because the
installation can be efficiently integrated into the production process.
In most cases, this integration will be done for the passenger version
of the same airplane, so additional engineering work will be minimal.
The benefits of production cut-in are also higher than

for retrofit since the new airplane has a longer life and reduced
flammability will provide safety benefits for the life of the airplane.
    As for conversion airplanes, when older airplanes can no longer be
operated competitively in passenger service, it is common for them to
be converted to all-cargo service. Since many passenger airplanes will
have FRM or IMM already installed as a result of this rule, operators
may be inclined to deactivate or remove the FRM or IMM to reduce
operational costs, if these airplanes are converted to all-cargo
airplanes in the future. We do not believe it would be in the public
interest to allow previously installed systems to be deactivated
because the capital cost to install the systems would already have been
incurred, and the safety benefits of retaining the system would
outweigh any cost savings that might result from deactivating them.
Accordingly, we have revised the operational rules to prohibit
deactivation or removal of FRM or IMM under this scenario.
    The regulatory evaluation for this final rule has been revised to
address these factors and concludes that imposing these requirements on
all-cargo airplanes is cost effective for new designs and newly
produced all-cargo airplanes. Prohibiting deactivation of FRM or IMM on
converted airplanes is also cost effective.
4. Specific Airplane Models
    Proposed Sec.  25.1815(j) listed specific airplane models that
would be excluded from the requirements of proposed Sec.  25.1815 (now
Sec.  26.33). These are airplane models that, because of their advanced
age and small numbers, would likely make compliance economically
impractical. In the NPRM, we asked for comments on other airplane
models that may present unique compliance challenges and should be
excluded from the requirements of this rule. In response to this
request, we received several comments requesting that additional
specific airplane models be excluded from this rule. Given the number
of models identified, we have decided it makes more sense to
``grandfather'' all models manufactured before a certain date. Based on
these comments, we have changed the applicability of the design
approval holder requirements in proposed Sec.  25.1815(a) (now Sec.
26.33(a)) from those airplanes type certificated after January 1, 1958
to those airplanes produced on or after January 1, 1992.
a. Out-of-Production/Low Service Life Remaining Models
    Boeing and Airbus recommended that the rule only apply to airplane
models and auxiliary tanks currently in production, or recently out-of-
production, that have significant numbers in service and will continue
in service well beyond the date when 100 percent compliance is
achieved. Based on this standard, Boeing submitted a list of airplane
models and auxiliary tanks to add to the excluded models in proposed
Sec.  25.1815(j), including the DC-8, DC-9, DC-10, MD-80, MD-90, MD-11,
Boeing 707, 720, 727, 737-100/-200, 747-100/-200/-300 and associated
derivatives, and 737-300/-400/-500 (auxiliary tanks only). Airbus
requested that the Airbus A300/A310 series airplanes be added to the
list based on this standard.
    We acknowledge that there is no reason to require design approval
holders (DAHs) to develop design changes for airplanes that will be
retired before FRM or IMM installation is required by this rule.
Conducting the flammability assessments and developing design
modifications for those airplanes would require significant engineering
resources. More importantly, these airplanes would not benefit from the
development of FRM or IMM, since they would be retired or converted to
cargo operations before the installation of these systems is required.
Therefore, we have limited the applicability of the DAH requirements in
the final rule (proposed Sec.  25.1815(a), now Sec.  26.33(a)) to
airplanes produced on or after January 1, 1992.
    The youngest of the airplanes produced before then would be more
than 25 years old by the time operators would be required to modify
them. We agree with the commenters that the vast majority of these
airplanes would either be retired or converted to cargo service before
they reach that age. This is consistent with current practice. This
limitation has the effect of excluding the Boeing 707, 727, 737-100/200
and 747-100/200/300; the McDonnell Douglas DC-8, DC-9, DC-10, and KC-
10/KDC-10; and the Lockheed L-1011. Airplanes of the other models that
Boeing, Airbus and ATA requested be excluded have been produced on or
after January 1, 1992. For airplanes produced on or after January 1,
1992, the remaining life and likelihood of their continued operation in
passenger service is sufficient to require compliance with the
requirements of this rule.
    To clearly differentiate between airplanes produced before and
after this date, we changed proposed Sec.  25.1815(a) (now Sec.
26.33(a)) to refer to the date when ``the State of Manufacture issued
the original certificate of airworthiness or export airworthiness
approval.'' This information is readily available to the TC holders who
applied for these approvals. We also added a provision to proposed
Sec.  25.1815(d) (now Sec.  26.33(d)) to require the service
information describing FRM or IMM to identify the airplanes that must
be modified under this rule. This will make it readily apparent to
operators which of their airplanes are subject to the retrofit
requirements.
    For airplanes with high flammability tanks produced before 1992,
instead of requiring operators to retrofit these airplanes, we have
added a provision in the operational rules prohibiting passenger
operations of these airplanes after the date by which an operator's
airplanes that are subject to the retrofit requirement must be
retrofitted.\13\ This enables operators to convert these airplanes to
cargo service rather than to retrofit them. If operators of these
airplanes choose to operate them in passenger service past this date,
they could contract with the DAH or a STC vendor to develop an FRM or
IMM to meet the safety requirements of this rule. Without this
provision, the exclusion of airplanes produced before 1992 could have
the unintended consequence of encouraging operators to continue to
operate these airplanes with high flammability tanks in passenger
service, since the retrofit and operating costs of FRM or IMM would not
have to be incurred.
---------------------------------------------------------------------------

    \13\ As discussed later, we are also adding a provision that
allows operators under parts 121 and 129 to extend the compliance
date by one year based on use of ground conditioned air. Operators
using this extension will be able to operate these pre-1992
airplanes in passenger service until they are required to have all
of their post-1991 airplanes retrofitted.
---------------------------------------------------------------------------

    These changes to the DAH and operational rules have the effect of
making the applicability of these requirements different. The DAH
requirements now only apply to airplanes produced on or after January
1, 1992, but the operational rules still apply to all airplanes meeting
the applicability criteria proposed in the NPRM.\14\ Therefore, we have
revised the applicability provisions of the operational rule sections
to incorporate these criteria, rather than referencing the
applicability of the DAH rules.
---------------------------------------------------------------------------

    \14\ With certain listed exceptions, transport category turbine-
powered airplanes type certificated after January 1, 1958, with a
maximum passenger capacity of 30 or more or a maximum payload
capacity of 7,500 pounds or more.
---------------------------------------------------------------------------

    As for Boeing's request to exempt certain auxiliary fuel tanks, as
discussed

later in more detail, we have retained the requirement to conduct
flammability assessments and impact assessments for auxiliary fuel
tanks. However, we have delayed any action to require retrofit of IMM
or FRM for auxiliary fuel tanks installed under STCs and field
approvals until additional information can be gathered. We agree with
Boeing that any auxiliary fuel tank installed in pre-1992 airplane
models should also be excluded from the need to conduct flammability
assessments, since we have determined we would not take action against
any tank in these airplane models due to their advanced age.
b. Limited U.S. Inventory Models
    Airbus requested that airplanes having a limited U.S. inventory be
excluded from this rule, because the operators of these airplanes would
shoulder a disproportionate impact of non-recurring engineering
expenses needed to design and develop FRM systems. Under this standard,
Airbus asked that the A330-200 (only 11 N-registered airplanes) and the
A340 (no N-registered airplanes) be added to proposed Sec.  25.1818(j).
We cannot agree with the Airbus suggested approach. We have no way to
predict future market conditions in the United States for the A330-200
and A340 model airplanes. Airbus continues to sell these models and
lessors continue to offer them for lease. Based on market conditions,
U.S. operators may add these models to their fleets in larger numbers
and we see no reason why persons flying on these airplanes should be
exposed to a greater risk of a fuel tank explosion. Therefore, we are
not excluding these airplane models from the requirements of this final
rule.
c. Airbus A321
    Airbus and ATA suggested the A321 should be excluded because this
model does not have fuel pumps in the center wing tank, reducing the
risk of a fuel tank explosion. The lack of fuel pumps does not
adequately mitigate the risk of an explosion. There are numerous
potential ignition sources inside fuel tanks that can result from
failure of various components, including the fuel quantity indication
system, motor driven valves, fuel level sensors, and electrical bonds.
In addition, heating of the fuel tank walls by external heat sources
introduces a concern that the hot surface could ignite the vapors in
the tank. The justification provided for excluding this model (because
the center tank does not have motor driven pumps located in the tank)
does not address the overall fuel tank safety issue and would only have
merit if fuel pump failures were the only potential ignition sources.
Therefore, we are not excluding this airplane model from the
requirements of this final rule.
d. Airplanes With Low Flammability Tanks
    The proposed retrofit limit for an acceptable fleet-wide average
flammability exposure was 7 percent. We determined that fuel tanks
having a flammability exposure greater than 7 percent are high
flammability tanks that present a greater risk for fuel tank explosion.
American Trans Air commented that, we stated in the NPRM that some
airplanes have center tanks with a fleet average flammability exposure
that does not exceed 7 percent, including ``the Lockheed L-1011, and
Boeing MD-11, DC10, MD80, and Boeing 727, and Fokker F28 MK100.''
American Trans Air stated that this implies that we have information in
our possession indicating that these airplane models already meet the
proposed flammability limits, and asked that we add these models to the
list of excluded airplanes in proposed Sec.  25.1815(j) (now Sec.
26.33).\15\
---------------------------------------------------------------------------

    \15\ As we discussed above, we have limited the applicability of
the DAH requirements in Sec.  26.33 to airplane models produced on
or after January 1, 1992. This date excludes the Boeing Model 727,
DC-10 and the Lockheed L-1011. The other airplane models mentioned
by the commenter have airplanes produced after 1991 and would be
covered by this rule.
---------------------------------------------------------------------------

    The statement quoted by American Trans Air from the NPRM was based
on previous flammability assessments provided to us for SFAR 88
compliance. These assessments were based upon simplified assessment
methods. For airplanes produced after January 1, 1992, we have retained
the requirement to conduct flammability assessments on these airplanes
to ensure that the earlier assessments are correct and that design
changes for these tanks are not necessary. Once the assessment has been
made, a manufacturer or operator may not need to make any change to the
airplane. This is because the flammability risk assessment may disclose
a level of risk below the threshold required for modification. As
discussed earlier, we are allowing a qualitative assessment for
conventional unheated aluminum wing tanks, which will substantially
reduce the burden for completing the flammability assessments.
5. Wing Tanks
a. General
    Proposed Sec.  25.981 does not apply the same flammability standard
to all fuel tanks, and requires lower flammability limits for ``fuel
tanks that are normally emptied and located within the fuselage
contour.'' The NTSB expressed concern that wing fuel tanks have
exploded, and noted that its safety recommendations were not limited
to:
    (1) Certain types of fuel tanks,
    (2) Tanks with specific types of exposure, or
    (3) Tanks with explosive risks that vary or lessen over time.
    The NTSB stated that we should take action to prevent all tanks
from having flammable fuel-air mixtures in the ullage. The NATCA
agreed, and stated that, to achieve an acceptable level of safety, the
requirements of Sec.  25.981 that apply to new airplanes should
establish the same flammability standard for all fuel tanks regardless
of location. The NATCA supported this suggestion by referencing the
ARAC accident summaries that showed 8 out of 17 fuel tank explosions
have involved wing tanks. The ALPA also expressed concern that certain
wing designs and system installations may result in internal heating of
the wing structure and ultimately the wing fuel tanks. The ALPA stated
that we must insist that those specific installations fall under the
requirements of this rule and that no unsafe flammability exposure
exist in those wing tanks.
    In contrast, Embraer, Bombardier Aerospace (Bombardier), and
American Trans Air opposed incorporation of new flammability standards
for conventional wing tanks. Embraer stated the benefits would be
negligible and would not justify the costs. Embraer maintained that
service history provides ample evidence that conventionally designed
wing tanks inherently provide sufficient protection from fuel tank
ignition when conventional fuels are used and that the current
requirements are adequate. American Trans Air commented that many twin
engine airplane type designs utilize a common fuel system operational
concept that results in low exposure to high energy ignition sources in
the main wing tanks. This exposure is further reduced in airplanes
operated in extended-range twin-engine operations (ETOPS) service, due
to the increased fuel reserves required in these operations.
    The service history of conventional unheated aluminum wing tanks
that contain Jet A fuel indicates that there would be little safety
benefit by further limiting the flammability of these tanks. While
NATCA and the NTSB expressed concern because accidents have occurred in
wing fuel tanks, they did not differentiate service experience based on
fuel type used (JP-4 versus Jet

A). Our review of the nine \16\ wing tank ignition events shows that 5
of the 9 airplanes were using JP-4 fuel and this type fuel is no longer
used except on an emergency basis in the U.S. Three of the remaining
four events were caused by external heating of the wing by engine
fires, and the remaining event occurred on the ground during
maintenance. To date, there have been no fuel tank explosions in
conventional unheated aluminum wing tanks fueled with Jet A fuel that
have resulted in any fatalities. The flammability characteristics of
JP-4 fuel results in the fuel tanks being flammable a significant
portion of the time when an airplane is in flight. This is not the case
for wing tanks containing Jet A fuel. Therefore, a conventional
unheated aluminum wing tank (that quickly cools in an airplane model
approved for Jet A fuel) would not require FRM or IMM.
---------------------------------------------------------------------------

    \16\ As discussed previously, on May 6, 2006, a ninth wing tank
ignition event occurred.
---------------------------------------------------------------------------

    As proposed, Sec.  25.981(b) maintained the intended flammability
standards for wing tanks that were introduced in 2001, as part of
Amendment 25-102 to part 25.\17\ The proposed text clarified the
existing term ``means to minimize the development of flammable vapors''
by including references to a conventional unheated aluminum wing tank,
or 3 percent average flammability. Therefore, no new flammability
standards are introduced for conventional wing tanks. Fuel tanks
manufactured from materials other than aluminum, or that have unique
features that would not allow cooling of the fuel tank (such as a small
surface area exposed to the air stream) or that are heated (such as by
having warm fuel transferred from another tank) may need FRM to comply
with the previously issued requirements.
---------------------------------------------------------------------------

    \17\ As discussed in the NPRM, Amendment 25-102 revised Sec.
25.981 to require that fuel tank flammability exposure be
``minimized.'' As explained in the preamble to that final rule, the
objective of this requirement is to reduce the flammability exposure
to that of an unheated aluminum wing tank.
---------------------------------------------------------------------------

b. Use of Composite Materials
    Airbus pointed to the industry trend towards the use of composite
materials, which tend to have a lower heat transfer coefficient than
aluminum. These materials act as insulators, slowing down any heating
or cooling effects. Therefore, new TC designs using composite
structures will have a natural flammability exposure greater than an
equivalent conventional unheated aluminum wing tank, and designers will
be forced to implement FRM. The NATCA noted that, with increased use of
composites in wing designs, the assumption that wing tanks cool
adequately may be incorrect.
    We agree that composite materials may act as an insulator that will
not allow fuel tank cooling, resulting in increased flammability.
Limiting fuel tank flammability using FRM may be needed to meet the
flammability exposure of a ``conventional unheated aluminum wing tank''
that is required by Sec.  25.981. Airbus's suggestion that it is
impractical for the rule to mandate the use of inerting for wing fuel
tanks on airplanes with composite fuel tanks is not supported by recent
events. While this rule is performance based and means other than
inerting could be used, inerting has been found to be one means that is
both technically feasible and economically viable. For example, the
Boeing 787 will have wing fuel tanks constructed of composites, and FRM
using nitrogen has been incorporated into the design to reduce the fuel
tank flammability below that of a conventional aluminum wing tank.
6. Auxiliary Fuel Tanks
a. Definition
    In the NPRM, we described auxiliary fuel tanks as tanks that are
installed to permit airplanes to fly for longer periods of time by
increasing the amount of available fuel. The proposed rule defined an
auxiliary fuel tank as one that is normally emptied and has been
installed pursuant to an STC or field approval to make additional fuel
available. We also stated that auxiliary fuel tanks are ``aftermarket''
installations not contemplated by the original manufacturer of the
airplane.
    Airbus and AEA suggested the definition of auxiliary fuel tank
should be clarified. They recommended that we use the generally
accepted definition that is in AC 25.981-2. Boeing also requested that
the definition of an auxiliary fuel tank be revised to more generally
state that it is a fuel tank added to an airplane to increase range
instead of referencing it as one installed pursuant to an STC or field
approval. Boeing noted that an airplane might be delivered with an
Original Equipment Manufacturer designed, manufactured and type
certified auxiliary fuel tank.
    Changes to the regulatory text in proposed subpart I (now part 26)
resulted in eliminating the need for this definition in the final rule.
Therefore, we have deleted the definition of auxiliary fuel tank from
proposed Sec.  25.1803(a) (now Sec.  26.31(a)) and will maintain the
definition in AC 25.981-2.
b. Existing Auxiliary Tanks
    Boeing, Airbus, AEA, and ATA commented that older auxiliary fuel
tanks should be exempt from the requirements of this rule since the
benefits would be small compared to the cost of the retrofits. Boeing
stated by the year 2016, most of the airplanes with auxiliary tanks
installed during production would be over 30 years old. Future service
life is generally thought to be minimal for these older airplanes.
Boeing also commented, based upon feedback received from some
operators, that these operators would deactivate their auxiliary fuel
tanks rather than install FRM or IMM. The ATA added that the favorable
service history (no operational accidents caused by auxiliary tank
overpressures or explosions), operating environment (minimal exposure
to flammable conditions), and proximity to retirement for many of these
tanks makes it unnecessary to include auxiliary tanks in the
applicability of this rule. Finally, Embraer commented that only
auxiliary fuel tanks located close to heat sources and lacking free
stream cooling require the special attention that the rule proposes.
    As discussed previously, we changed the language in proposed Sec.
25.1815 (now Sec.  26.33), which applies to TC holders, to limit its
applicability to airplanes produced on or after January 1, 1992, and
this would include any auxiliary fuel tanks installed by the original
TC holder. Since Sec.  26.35 (formerly Sec.  25.1817) applies only to
design changes to airplanes subject to Sec.  26.33, this change from
the NPRM has the effect of excluding most of the older auxiliary tank
designs installed by STC or field approval, which were approved for
installation on airplanes no longer subject to this rule.
    For those auxiliary tanks approved under STCs or field approvals
(if any) that are still covered under the rule, we believe that most of
these tanks transfer fuel by pressurizing the tank with cabin air. The
increased pressure results in reduced flammability that could be
considered an FRM if the minimum flammability performance requirements
are met. However, we have limited data on the number of these tanks
currently in operation and their age. We currently do not have adequate
information on the flammability exposure or the number and the type of
auxiliary fuel tanks installed under STCs or field approvals to
determine whether to subject them to the requirements of this final
rule. Based upon these limited data, we cannot predict the number of
high flammability auxiliary fuel tanks that

will be in service in 2016 or the number of airplanes with auxiliary
fuel tanks installed by STC or field approvals that could still be
operational for some period of time past the year 2016.
    While no conclusive evidence has been presented, the commenters
have raised issues worthy of further study. To prevent delaying the
safety benefits of compliance with this rule, we have elected to defer
the portion of this rulemaking that would have required development and
installation of an FRM or IMM for auxiliary fuel tanks installed by STC
or field approvals for further study. We have removed these proposed
requirements from both the DAH and operational rules.
    To assess the possible safety benefits and costs more accurately,
we are requesting further comments regarding information needed to
determine if future action should be taken to address auxiliary fuel
tanks installed by STC or field approvals. The rule retains the
requirements for STC holders to conduct a flammability assessment of
auxiliary fuel tank designs, to conduct an impact assessment of the
auxiliary tank on any FRM or IMM, and to develop the modifications for
any adverse impact that is found. These requirements are still
necessary both to assess the need for further rulemaking and to prevent
increasing the flammability exposure of tanks into which the auxiliary
tanks feed fuel. This could potentially defeat the purpose of requiring
reduced flammability for these tanks. To limit the scope and cost of
the requirement to perform impact assessments, this requirement only
applies to auxiliary tanks approved for installation on Boeing and
Airbus airplanes that we currently are aware will be required to have
FRM or IMM installed.
c. Future Installation of Auxiliary Tanks
    While we are foregoing action to require retrofit of existing
auxiliary fuel tanks, we recognize that this decision could allow
installation of currently approved auxiliary fuel tanks indefinitely,
even if their flammability exposure exceeds those allowed under this
rule. Therefore, we have added a new paragraph to the operational rule
sections \18\ in this final rule to prohibit installation of any
auxiliary tank after the retrofit compliance date (nine years after the
effective date) unless we have certified that the tank complies with
Sec.  25.981, as amended by this rule.
---------------------------------------------------------------------------

    \18\ Sec. Sec.  121.1117(n), 125.509(n), and 129.117(n).
---------------------------------------------------------------------------

d. Request for Comments
    As discussed previously, we have concluded that additional
information is needed before we can determine whether it would be cost
effective to apply the requirements of this final rule to auxiliary
fuel tanks installed under STCs or field approvals. The FAA, therefore,
requests additional comments addressing the following specific
questions:
    1. Which airplanes produced on or after January 1, 1992, with 30
passengers or more or a payload of 7500 pounds, have auxiliary fuel
tanks installed by STC or field approval?
    2. What are the U.S. registration tail numbers of the airplanes
with the tanks installed?
    3. How many of these tanks are installed in airplanes used in all-
cargo operations?
    4. What is the STC holder's name and what are the STC numbers for
these tanks?
    5. How many of these tanks are installed under the Form 337 field
approval process?
    6. Are the tanks operational or deactivated?
    7. How many engineering hours would be required to develop an FRM
or IMM for these tanks?
    8. How much would the parts cost for an FRM or IMM for these tanks?
    9. What would the labor costs be for installing an FRM or IMM in
these tanks?
    10. How many days would it take to install an FRM or IMM in the
affected airplane?
    11. If the FAA required operators to install FRM or IMM, would
those operators modify those tanks accordingly, or would they comply by
simply deactivating those tanks? Please be model-specific for both
passenger and all-cargo airplanes, if possible.
    12. What would be the economic consequences to the operator of
deactivating an auxiliary fuel tank?
    Comments should be submitted to Docket No. FAA-2005-22997 by
January 20, 2009. Comments may be submitted to the docket using any of
the means listed in the Addresses section later in the document.
7. Existing Horizontal Stabilizer Fuel Tanks
    In the NPRM, we stated that horizontal stabilizer fuel tanks are
fuel tanks that may be required to be retrofitted with FRM or IMM. We
understood that these tanks may not cool rapidly, since a large portion
of the fuel tank surface is located within the fuselage contour. Airbus
stated that they do not believe the rule should apply to horizontal
stabilizer fuel tanks, because these types of fuel tanks are low
flammability and, if these tanks are treated as high flammability, the
rule would impose significant additional costs to install FRM or IMM
for these tanks. Therefore, Airbus concluded that we should either
review these additional engineering complications and associated costs
(particularly with respect to retrofit) or apply the same requirements
to these tanks as those proposed for wing tanks not in the fuselage
contour.
    The retrofit requirement of this rule only applies to fuel tanks
that have an average flammability exposure above 7 percent. To the
extent the risk analysis indicates a particular fuel tank actually is a
low risk tank, no further requirements would apply. Some horizontal
stabilizers, including those made by Airbus, are manufactured from
composite material that acts as an insulator. These tanks may also be
used to maintain airplane center of gravity, so warmer fuel may be
transferred into them during flight. These features may result in
flammability exposure that exceeds the 7 percent limit that is used to
establish whether retrofit of an FRM or IMM is required. Tanks
constructed of composites may also exceed the flammability exposure
established for new designs in Sec.  25.981(b).
    The analysis required by this rule will establish the flammability
exposure and determine the need for an FRM or IMM in horizontal
stabilizer fuel tanks. If fuel tanks located within the horizontal
stabilizer are not high flammability tanks, then no FRM or IMM would be
needed and no additional cost would be incurred for retrofit. However,
if an FRM or IMM is required because the tank is determined to be high
flammability, it should be possible, using standard design methods, to
address the technical issues. For example, the pressure drop mentioned
by Airbus can be addressed by using a properly sized and designed FRM
so that adequate nitrogen can be supplied to any affected tank. This
can be done using available technology and with costs that are
consistent with those for other tanks considered in the regulatory
evaluation. Airbus provided no technical justification for its
assertion to the contrary.
8. Foreign Persons/Air Carriers Operating U.S. Registered Airplanes
    Airbus, EASA, and the UK Civil Aviation Authority (UKCAA) requested
a change to the wording of proposed Sec.  129.117(a). This change would
clarify that the applicability of this rule is

limited to foreign persons and foreign air carriers operating U.S.
registered transport category, turbine powered airplanes for which
development of an IMM, FRM or Flammability Impact Mitigation Means
(FIMM) is required under proposed Sec. Sec.  25.1815, 25.1817 or
25.1819 (now Sec. Sec.  26.33, 26.35, and 26.37). Their understanding
is that the paragraph is not intended to apply to airplanes registered
outside of the United States.
    As provided in Sec. Sec.  129.1(b) and 129.101(a), the commenters
are correct that Sec.  129.117 would not apply to aircraft registered
outside the United States. To clarify our intent, we have revised Sec.
129.117(a) to include the words ``U.S. registered.''
9. Airplanes Operated Under Sec.  121.153
    In the proposed rule, the FAA requested comments on whether
categories of airplane operations other than all-cargo operations
should be excluded. In response to our request, AEA and Airbus noted
that Sec.  121.153 permits the operation, by U.S. airlines, of
airplanes registered in another International Civil Aviation
Organization (ICAO) member states under specified circumstances. They
said that, while history shows that the use of the Sec.  121.153
provisions is relatively rare, it can provide important flexibility
when unusual circumstances dictate the urgent need of replacement
airplanes for U.S. carriers. Given the small effect of excluding
airplanes leased under the provisions of Sec.  121.153 from any
requirements of the proposed rule, the commenters recommend that they
be excluded from applicability provisions of the proposed rule.
Otherwise, they said, if compliance with the proposed retrofit
requirements are applied as proposed, Sec.  121.153 would preclude this
practice for airplanes that have not been retrofitted with FRM. These
commenters argued that this result would present a burden to both U.S.
operators (who would lose the flexibility provided by Sec.  121.153)
and non-U.S. operators (for whom the value of their unmodified
airplanes would be reduced).
    Section 121.153(c) does not relate to a ``category of operation,''
such as all-cargo operations. Rather, it permits certificate holders to
operate foreign registered airplanes for any type of operation, as long
as the airplanes meet all applicable regulations. Allowing the
operation of foreign registered airplanes that do not comply with this
rule would be contrary to the intent of both Sec.  121.153(c) and this
rulemaking. It would also subject a certificate holder's passengers to
differing levels of safety based on the registry of the airplane. This
is not acceptable and we did not make the change proposed by the
commenters in the final rule. However, as discussed later in more
detail, we are working with foreign authorities to establish harmonized
flammability reduction standards. If we achieve that objective, the
``burdens'' suggested by the commenters would disappear.
10. International Aspects of Production Requirements
    The AEA and Airbus disagreed with the proposed requirement to
incorporate FRM or IMM into all new production airplanes. They stated
that existing procedures for exporting airplanes from the United States
allow the importing country to accept specific non-compliances on the
export certificate of airworthiness. The AEA also asked for
clarification of the discussion of FAA authority over airplanes
produced outside the United States. Likewise, Embraer asked that the
requirement to incorporate FRM or IMM into all new production airplanes
be dropped from the proposal. Embraer pointed out that foreign
regulatory authorities do not currently have certification standards
for FRM or IMM, so Embraer is unclear how airplanes with such systems
would be approved by the importing country. The ATA questioned the FAA
contention (by context) that the proposed rulemaking has no
international (ICAO) implications. It asked for the proposal to be
reviewed by relevant international law experts for compatibility with
the principles of sovereignty and authority in ICAO International
Standards and Recommended Practices, Annex 8 to the Convention on
International Civil Aviation, Airworthiness of Aircraft.
    As discussed in the NPRM, we intend for the proposed new production
requirements to apply to any manufacturer over which the FAA has
jurisdiction under ICAO Annex 8. For this reason, we used the same
language as Annex 8 to define the applicability of those requirements.
Under that annex (and under this rule), we have jurisdiction over
organizations to which we issue production approvals, including
production certificates. This may include organizations that accomplish
final assembly outside the United States. While no affected U.S.
production certificate holders currently accomplish final assembly
outside the United States, it is possible that they might in the
future. For example, if Boeing were to perform final assembly of a
future version of the Boeing 737 in another country, those airplanes
would still be subject to the production cut-in requirements of this
final rule as long as Boeing produces them under Boeing's U.S.
production certificate.
    Regarding the comment that current procedures allow the importing
country to accept specific non-compliances on the export certificate of
airworthiness, the commenters are referring to the waiver provisions of
Sec.  21.327(e)(4). The non-compliances referenced in that section
relate to the requirements for issuance of an export airworthiness
approval.\19\ The production cut-in requirement of this rule is
unrelated to those requirements. Rather, it requires that affected
airplanes produced under U.S. production approvals must conform to an
approved type design that meets the fuel tank flammability requirements
of this rule. Therefore, while a foreign authority may be able to waive
the requirements for issuing airworthiness approvals, it does not have
the authority under ICAO Annex 8 to override our requirements, imposed
as the State of Manufacture, for our production approval holders.
---------------------------------------------------------------------------

    \19\ For example, Sec.  21.327(e)(4) references Sec.  21.329,
which in turn references Sec.  21.183 for the requirements for a
standard U.S. airworthiness certificate. For new airplanes, Sec.
21.183 requires that the product conform to its approved type design
and is in condition for safe operation.
---------------------------------------------------------------------------

    Finally, in addition to meeting the requirements of this rule, any
airplane produced for export would also have to meet all other
requirements applicable to the production certificate holder (such as
the requirement to maintain its quality control system in accordance
with its FAA approval). These requirements cannot be waived under the
provisions of Sec.  21.327(e)(4). Therefore, we are not aware of any
basis for a foreign authority to object to our requirement for
production cut-in. Of course, once the airplane is placed into
operation by a foreign operator, the operator would have to comply with
the requirements of its authority for operation and maintenance of the
airplane, which may or may not include requirements relating to fuel
tank flammability. As discussed later in more detail, we are currently
working with foreign authorities to harmonize our requirements with
theirs.

D. Requirements for Manufacturers and Holders of Type Certificates,
Supplemental Type Certificates and Field Approvals

1. General Comments About Design Approval Holder (DAH) Requirements
    We received a number of general comments responding to the concept
of DAH requirements rather than to the DAH requirements in this
specific

rulemaking. We responded to these types of comments in the comment
disposition document accompanying our policy statement titled
``Safety--A Shared Responsibility--New Direction for Addressing
Airworthiness Issues for Transport Airplanes.'' Both were published in
the Federal Register on July 12, 2005 (70 FR 40168 AND 70 FR 40166,
respectively). We received similar comments on our NPRM on Enhanced
Airworthiness Program for Airplane Systems (70 FR 58508, October 6,
2005, RIN 2120-AI31). As a result, we will not respond to such comments
again here.
2. Flammability Exposure Requirements for New Airplane Designs
    As proposed, the rule requires those airplanes incorporating FRM to
limit the fleet average flammability exposure to 3 percent, and to
limit warm day exposure to 3 percent, for all normally emptied fuel
tanks located, in whole or in part, in the fuselage. All other fuel
tanks can either meet the 3 percent average flammability exposure
limitation or have a flammability exposure that is not higher than the
exposure in a conventional unheated aluminum wing tank that is cooled
by exposure to ambient temperatures during flight.
a. General Comments About Applicability to New Production Airplanes
    The NACA and its member airlines fully support the requirement for
incorporation of either an FRM or IMM to provide fuel tank inerting for
all new production airplanes, including those that already have an
approved TC or STC. Airbus, AEA, AAPA, and EASA also commented that
installation of FRM during an airplane manufacturing process may be
appropriate. The EASA expressed its support for production cut-in and
plans to amend its rules to a harmonized approach that requires
production incorporation.
    As we stated in the NPRM, ``The safety objective of these proposed
rules is to have the required modifications installed and operational
at the earliest opportunity.'' \20\ For U.S.-manufactured airplanes, we
proposed to meet this objective by requiring affected production
approval holders to incorporate these changes by the compliance date
for developing FRM or IMM service information. Recognizing that we do
not have similar authority over affected foreign manufacturers, we did
not propose a similar requirement for them. However, as noted by the
commenters, our safety objective still applies to those airplanes, and
it is equally feasible for FRM or IMM to be incorporated on new
foreign-manufactured airplanes after the necessary design changes are
developed. Further, as stated by EASA, it has agreed to harmonize
requirements for new production airplanes. Including FRM or IMM in
production is more efficient and less costly than retrofitting these
airplanes, which is also required under the NPRM.
---------------------------------------------------------------------------

    \20\ 70 FR at 70940.
---------------------------------------------------------------------------

    Based on these factors, we had assumed that FRM or IMM would be
incorporated on all airplanes produced by both domestic and foreign
manufacturers after designs were developed within two years after the
effective date of this final rule. Given the reluctance of foreign
manufacturers to commit to developing these design changes within the
prescribed period (as discussed later), we now recognize that an
operational requirement is needed to effectuate our intent.
Accordingly, operators may not operate affected airplanes produced
after September 20, 2010 unless they are equipped with FRM or IMM.
Because we had intended that all airplanes delivered after these design
changes had been developed would include these safety improvements,
this requirement is a logical outgrowth of the NPRM.
b. Flammability Analysis Using the Monte Carlo Method
    For all fuel tanks, an analysis must be performed to determine
whether the fuel tank, as originally designed, meets the fleet average
flammability exposure limits discussed above. To determine the
flammability exposure of fuel tanks, the ARAC used a specific
methodology incorporating a Monte Carlo analysis.\21\ As proposed, any
analysis of a fuel tank must be performed in accordance with this
methodology (as detailed in proposed appendix L, now appendix N, and in
the draft FAA document, Fuel Tank Flammability Assessment Method User's
Manual).\22\ We considered approving alternative methodologies in lieu
of Appendix N, but we found that no other alternative considered all
factors that influence fuel tank flammability exposure (which is the
safety objective of this rule).
---------------------------------------------------------------------------

    \21\ This methodology determines the fuel tank flammability
exposure for numerous simulated airplane flights during which
various parameters such as ambient temperature, flight length, fuel
flash point are randomly selected. The results of these simulations
are averaged together to determine the fleet average fuel tank
flammability exposure.
    \22\ As indicated in the proposed Appendix L (now Appendix N),
we are incorporating the User's Manual by reference into the final
rule. This was incorporated by reference in the final rule by
creating a new Sec.  25.5.
---------------------------------------------------------------------------

    The ATA proposed upgrading the Monte Carlo method or developing a
similar method that would be used to evaluate airplane risk of a fuel
tank explosion. The method proposed by ATA would include not only fuel
tank flammability, but also the risk of ignition sources developing in
a fuel tank based upon the specific airplane design.
    The Monte Carlo method is intended to be used to determine fuel
tank flammability alone, not the overall likelihood of a fuel tank
explosion. While the ATA's suggestion is intriguing, we do not believe
there is presently a method of accurately predicting the risk of an
ignition source developing in a fuel tank. With this final rule, we are
implementing a balanced approach to prevent fuel tank explosions: By
addressing both ignition prevention (as defined in the requirements of
Sec.  25.981(a) and SFAR 88) and flammability reduction (as defined in
this rule). Compliance with both standards ensures that fuel tank
explosion risk is acceptable.
    The EASA also expressed concerns about the proposed methodology
since it is complex and allows variations in fuel tank flammability to
be introduced by variations in the input parameters used in the
analysis. Although EASA welcomed the improvements to the Monte Carlo
method proposed in the NPRM that set the majority of the input
parameters, EASA expressed concern that the method does not adequately
address heat transfer and the assumptions retained do not allow proper
quantification of the exposure.
    We share the concern expressed by EASA that, unless properly
controlled, variation in the DAH input parameters used in the
flammability assessment could result in significant differences between
various DAHs. Fuel tank thermal modeling, including heat transfer, is
the one major variable parameter provided by the user. Appendix
N25.3(e) requires that substantiating data for the fuel tank thermal
model, along with other input parameters, be submitted with the
analysis. Therefore, we believe that Appendix N does adequately address
heat transfer and provides a method that allows for proper
quantification of flammability exposure.
    Finally, Parker Hannifin Corporation noted an error in the Monte
Carlo computer code that mistakenly added the time prior to flight and
utilized the flight time constants rather than ground time constants in
certain calculations. This error could produce two counter-

acting effects. In some circumstances, it could produce higher
flammability exposure when the tank-full time constant is used longer
than actually required. In other circumstances, it tends to reduce the
flammability exposure by using the tank empty-time constant earlier
than actually warranted. Overall this has the net effect of slightly
underestimating the actual fuel tank flammability exposure so
assessments using the revised computer code would produce slightly
higher flammability values. We addressed this error in the final rule
and the computer code is now correct.
c. Definition of ``Normally Emptied Tank''
    As defined in proposed Sec.  25.1803(d) (now Sec.  26.31(b)),
``normally emptied tank'' refers to a fuel tank that is emptied of fuel
during the course of a flight and, therefore, can contain a substantial
vapor space during a significant portion of the airplane operating
time. Boeing requested that the definition for ``normally emptied'' be
removed. Boeing based this request on the fact that heat input to the
tank and the heat rejection rate (i.e., the rate of heat transfer from
the tank) play more of a factor in a tank's flammability than whether
it is normally emptied.
    While we acknowledge that the heat input to the fuel tank and heat
rejection from the tank are major factors in fuel tank flammability,
the reason we are concerned about tanks that are normally emptied is
not related to their flammability. As stated in the preamble to the
NPRM, normally emptied fuel tanks can contain a substantial fuel vapor
space that could expose potential ignition sources to the fuel vapor
for an extended period of time. Fuel in tanks that are not normally
emptied covers potential ignition sources more often than fuel in
normally emptied tanks. This prevents ignition sources from igniting
fuel vapors in the tank. Therefore, normally emptied fuel tanks have a
higher likelihood of exposing flammable vapor to ignition sources than
tanks that are not normally emptied. This rule specifically
differentiates between fuel tanks that are normally emptied and other
fuel tanks by requiring reduced fuel tank flammability because of the
increased risk of an explosion in normally emptied tanks.
d. Fixed Numerical Standard
    For new airplane designs, we requested comments on whether the
reference to a conventional unheated aluminum wing tank or a fixed
numerical standard for the requirements of Sec.  25.981(b) would be
more workable and effective. The safety objective of a ``conventional
unheated aluminum wing tank'' is consistent with the ARAC
recommendation and Sec.  25.981(c) (amendment 102). However, it does
not provide a numerical standard to apply in future type certification
programs. In certain cases, the compliance demonstration would be
simplified if a fixed numerical standard were provided in the
regulation, because there would be no analysis needed to establish the
flammability exposure of a conventional unheated aluminum wing tank
that is the alternative flammability exposure. We believe this approach
has implementation advantages and should achieve the safety level
intended by the ARAC recommendation and the current approach in Sec.
25.981(c) (amendment 102).
    Transport Canada, Boeing, Airbus, and ATA agreed that including a
fixed numerical standard was preferred. Several of them suggested that
we needed to provide further justification for the selection of a 3
percent fixed value and proposed different numerical values. These
commenters did not agree with the inclusion of a variable standard of
equivalence to a conventional unheated aluminum wing tank.
    Airbus stated that a numerical value within the level recommended
by ARAC (i.e., 7 percent) would be more practical and potentially safer
than a flammability equivalency to a hypothetical wing fuel tank. While
the 3 percent limit should be considered an acceptable goal if FRM is
used, Airbus suggested that for fuel tanks that have a base
flammability exposure less than 7 percent, there should not be a
requirement to use FRM. The existing minimization of heat sources, as
required by EASA, should be adequate. Airbus concluded that
establishing a standard of 7 percent for fuel tank flammability
exposure would ensure that FRM would provide a significant benefit (at
least a 50 percent reduction in flammability) and remove the potential
to actually reduce the overall safety as a result of increased ignition
risk potential due to hazards associated with adding new FRM or IMM to
the airplanes.
    These commenters did not provide any compelling reasons to change
the proposed 3 percent average flammability exposure or to eliminate
the provision for showing equivalence to a conventional unheated
aluminum wing tank. The reason for including the fixed 3 percent
flammability exposure is to simplify the compliance demonstration. The
reason for allowing for equivalence to a conventional unheated aluminum
wing tank is to give flexibility to designers who are willing to
perform the required evaluations. The proposal from Airbus and other
commenters to increase the flammability exposure value to 7 percent
would allow a significant increase in fuel tank flammability over that
permitted by Sec.  25.981. The fleet of airplanes that ARAC determined
had achieved an acceptable level of safety was made up of airplanes
with conventional unheated aluminum wing tanks with flammability
exposures that varied from very low levels of around 1.5 percent for
outboard wing fuel tanks to the highest values below 6 percent for some
larger inboard wing tanks. These numerical values would all be lower if
calculated today, consistent with the lower values now calculated by
manufacturers for HCWTs.
    Therefore, in this final rule, we adopted a flammability standard