CDCCL Presentation

Fuel Tank Safety (FTS) /

Airworthiness Limitation (AWL) /

Critical Design Configuration Control Limitation (CDCCL)

04/17/23 2

AIRWORTHINESS MANAGEMENT - AVIONICS

BACKGROUND TWA B747-131 Fligth-800 accident, involving Centre Wing

Tank (CWT) explosions Investigations revealed penetration of 115 Vac electrical

energy into the center fuel tank due to chaffed Fuel Quantity Indicating System (FQIS) wiring

Together, with the inadequate electrical bonding of fuel system Components, separation of fuel system wiring, and fuel vapors, resulted in loss of the passenger lives and the airplane.

Fuel tank explosions can only occur when an ignition source is in contact with flammable fuel vapor.

04/17/23 3


04/17/23 4


FUEL TANK EXPOLSION INCIDENTMarch 2001, Thai Airways 737

CWT fuel pumps left running on when dry. Electrical ARC / fault resulted in Centre Tank explosion

airplane was being prepared for a departure to Chiang Mai

149 passengers were waiting to board The fire erupted into the cabin, killing one cabin crew

member and injuring 6 others The fire was put out in 60 minutes The airplane was destroyed

04/17/23 5


04/17/23 6


FUEL TANK EXPOLSION INCIDENTSChina Air 737-800

While retracting slats during taxi, one loosened slat fairing bolt penetrated into the CWT resulting CWT explosion.

04/17/23 7


FUEL TANK EXPOLSION INCIDENTSPhilippines Airlines B737 1990

CWT explosion during push back

04/17/23 8


COMMON FEATURES OF SIGNIFICANT ACCIDENTS/INCIDENT

NO IGNITION SOURCE IDENTIFIED



Jet-A1 fuel, approx. 97 degree Fambient temp.(36’C)

Jet-A fuel, approx. 120 degree F tank temp.(49’C)

Jet-A fuel, approx. 95 degree Fambient temp.(35’C)

1 fatality230 fatalities8 fatalities

CWT pumps operating at time ofexplosion

CWT pumps operating at time of Explosion

CWT pumps operating at time Of Explosion

Empty CWT explosion minutes after refueling

Empty CWT explosion During climb

Empty CWT explosion during

pushback from gate

Air Conditioning Packs runningduring Ground Operations

Air Conditioning Packs runningduring Ground Operations

Air Conditioning Packs running during Ground Operations

10 year old airplane25 year old airplaneAlmost new airplane

2001 - B-737-400 Bangkok,Thailand

1996 - B-747, TWA 800,JFK,USA

1990 - B-737-300 Manila,Philippines

04/17/23 9


THE “FIRE” TRIANGLEFire is a chemical process requires three things: OXYGEN, HEAT and FUELWithout one of these elements, a fire cannot start or continue. The process in a fire is called oxidation. A fire hazard can be minimized byeliminating any one side of the fire triangle

04/17/23 10


REGULATORY ACTION/ REQUIREMENTS

Special Federal Aviation Regulation 88 (SFAR 88), advising airplane manufacturers to carry out a design review of fuel tank system to avoid entry of any ignition source into the fuel tanks in compliance of FAR 25-901 & 25.981 (a) and (b).

National Aviation Authorities (NAA) using NT/POL/25/12, JAR 25.901 / 25.1309 & Technical Guidance Leaflet (TGL) 47.

04/17/23 11


SFAR No. 88--Fuel Tank System Fault Tolerance Evaluation Requirements

Applicability the holders of type certificates, and supplemental type certificates

that may affect the airplane fuel tank system, for turbine-powered transport category airplanes, provided the type certificate was issued after January 1, 1958, and the airplane has either a maximum type certificated passenger capacity of 30 or more, or a maximum type certificated payload capacity of 7,500 pounds or more.

This SFAR also applies to applicants for type certificates, amendments to a type certificate, and supplemental type certificates affecting the fuel tank systems for those airplanes identified above, if the application was filed before June 6, 2001, the effective date of this SFAR, and the certificate was not issued before June 6, 2001.

04/17/23 12


SFAR No. 88--Fuel Tank System Fault Tolerance Evaluation Requirements

Compliance(a) Conduct a safety review of the airplane fuel

tank system to determine that the design meets the requirements of §§ 25.901 and 25.981(a) and (b).

(b) Develop all maintenance and inspection instructions

(c) Submit a report for approval to the FAA Airplane Certification Office (ACO)

04/17/23 13


FAR §25.981 Fuel tank ignition preventiona. “No ignition source may be present at each point in the fuel tank

or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapors.”

b. Critical Design Configuration Control Limitations (CDCCL), inspections, or other procedures must be established, as necessary, to prevent development of ignition sources within the fuel tank system and must be included in the Airworthiness Limitations section of the Instructions for Continued Airworthiness.

c. The fuel tank installation must include either:(1) Means to minimize the development of flammable vapors in the fuel

tanks (in the context of this rule, “minimize'' means to incorporate practicable design methods to reduce the likelihood of flammable vapors); or

(2) Means to mitigate the effects of an ignition of fuel vapors within fuel tanks such that no damage caused by an ignition will prevent continued safe flight and landing.”

04/17/23 14


THE CONCEPT OF IGNITION SOURCE PREVENTION

Fuel tank explosions can only occur when an ignition source is in contact with flammable fuel vapor.

Fuel vapors become flammable when they are mixed in certain proportions with oxygen, and are under specific temperature and pressure conditions.

some fuel tanks have a significantly higher exposure to flammable vapors than other tanks.

04/17/23 15



First Line of Defense to prevent recurrence of such events, Airplane manufacturer’s reviewed the airplane fuel system designs to meet the above requirements.

a number of service Bulletins (SBs) /Production Modifications (Production Revision Record: PRR) have been introduced for incorporation on Production and In-Service airplanes, trying to build the airplane fuel system design immune to such occurrences.

FAA legislation requires that airplane types that have fuel tanks, which exceed the average flammability exposure level (> 7%), specified in the rule shall be fitted with either a Flammability Reduction System (FRS), or an Ignition Mitigation Means (IMM).

04/17/23 16



EASA has issued a Safety Information Bulletin (SIB 2010-10) which mandates the installation of a FRS on production airplane subject to high flammability exposure and manufactured after 31st December 2011.

EASA will publish a Notice of Proposed Amendment (NPA) by mid 2011 to address the in- service airplane retrofit.

04/17/23 17



Compliance Target In relation to the affected airplane, fifty percent (50%) of each operator's

fleet of airplane are to be completed within 4 years of release of the Service Bulletins i.e. by 2014. One hundred percent (100%) of each operator's fleet of airplane are to be completed within 7 years after the release of the Service Bulletins i.e. by 2017.

NOTE: Portable gas detectors are used to monitor Oxygen and flammable vapor concentrations within the fuel tanks. Oxygen concentrations should be between 19.5 and 23.5 percent. Level below 19.5 percent is considered Oxygen deficient, while levels above 23.5 percent will significantly increase the risk of fire and/or explosion. Monitoring these figures is critical to the safety of the maintenance crew.

04/17/23 18


A Flammability Reduction System (FRS)

FRS is a system that is designed to prevent fuel vapors from being in a flammable condition

A practical Flammability Reduction System (FRS) will reduce fuel tank oxygen content to below the level that will support combustion (approach being adopted by Airbus).

Boeing has developed Nitrogen Generation System (NGS) to satisfy FRS requirement.

04/17/23 19


An Ignition Mitigation Means (IMM)

IMM is a system that detects an ignition source and releases a fire suppressant to prevent the development of a fire.

Such a technology is used on small military airplane but is not considered sufficiently robust for use in large commercial airplane and as such is not being pursued by Airbus or Boeing.

04/17/23 20


CHANGES TO “INSTRUCTIONS FOR CONTINUING AIRWORTHINESS” (ICA)

Second Line of Defense of the FTS regulations account for this situation and requires updating of Instructions for Continued Airworthiness (ICA) / Airplane Maintenance Program for all the type certificated airplane to avoid any likelihood of compromise / violation of the fuel system design criteria during any scheduled and / or unscheduled maintenance.

This requirement ensures proper documentation of any maintenance action performed on the airplane and / or its components for safety, reliability and maintainability.

AWL / CDCCL tasks were introduced by airplane manufacturers in Maintenance Planning Documents AND have already been incorporated into the PIA’s fleet maintenance program.

04/17/23 21


CHANGES TO “INSTRUCTIONS FOR CONTINUING AIRWORTHINESS” (ICA)

Boeing MPD section-9 is related to Airworthiness Limitations (AWL) which describes the Fuel Airworthiness Limitation Items (ALIs) and the associated CDCCL tasks.

Airbus / ATR publishes “Airworthiness Limitations” (ALS) section -5 which is related to Fuel Airworthiness Limitations (FAL). These requirements, together with the Life Limits / Monitored Parts, structural Airworthiness Limitation Items (ALI) and systems Certification Maintenance Requirements (CMR) comprise the Airworthiness Limitation Section which satisfies the regulatory requirements.

04/17/23 22


Airworthiness Limitation Items (ALIs) ALIs identify inspection tasks related to fuel tank ignition source

prevention which must be done to maintain the design level of safety for the operational life of the airplane.

These ALIs are mandatory and cannot be changed or deleted without the approval of applicable regulatory agency.

Strict adherence to methods, techniques and practices as prescribed is required to ensure the ALI is complied with.

Any use of methods, techniques or practices not contained in these ALIs must be approved by the applicable regulatory agency.

04/17/23 23


Critical Design Configuration Control Limitations (CDCCLs)

CDCCLs are a means of identifying certain design configuration features intended to preclude a fuel tank ignition source for the operational life of the airplane.

CDCCLs are mandatory and cannot be changed or deleted without the approval of the applicable regulatory agency.

“A critical fuel tank ignition source prevention feature may exist in the fuel system and its related installation or in systems that, if a failure condition were to develop, could interact with the fuel system in such a way that an unsafe condition would develop without this limitation.”

04/17/23 24


Critical Design Configuration Control Limitations (CDCCLs)

Strict adherence to configuration, methods, techniques, and practices as prescribed is required to ensure compliance with the CDCCL.

Any use of parts, ,methods, techniques or practices not contained in the applicable CDCCL must be approved by the FAA office that is responsible for the airplane model Type Certificate, or applicable regulatory agency.

04/17/23 25


Certification Maintenance Requirements (CMRs)

A CMR is a required periodic task, established during the design certification of the airplane as an operating limitation of the type certificate.

CMRs usually result from a formal, numerical analysis conducted to show compliance with catastrophic and hazardous failure conditions.

04/17/23 26


Sample of AWL / FAL for B777

04/17/23 27


Sample of AWL / FAL for A310 CDCCL Requirement Reference Applicability

1 Air gap between a fuelquantity indicatingprobes and theairplane structure.

Critical to prevent spark generationduring lightning strike conditions and must not be compromisedThe gap stated in the relevantmaintenance procedure in the AMMmust be achieved during installation of a fuel quantity probe.

AMM28-42-31 pb 40128-42-32 pb 40128-42-33 pb 401

ALLALLALL

2 Separation of fuelquantity and levelindicating systemwiring from otherwiring.

To prevent cross coupling of highvoltage transients and thereby keepunsafe ignition energies from inside the tank it is required that operators obey the wire routing and separation standards given in the ElectricalStandard Practices Manual (ESPM).

ESPM20-10-0020-33-2020-33-2120-33-22

ALLALLALLALL

04/17/23 28


Sample of AWL / FAL for A310 CDCCL Requirement Reference Applicability

3 Direct bonding onitems of equipmentinside a fuel tank.

Direct bonding is critical to preventspark generation during componentfailure and lightning strike conditions and must not be compromised Direct bonding in fuel tanks must be carried out during component installation to the appropriate bonding method and standard stated within the installation procedure in the AMM.

AMM28-00-00 pb 40128-11-21 pb 40128-11-22 pb 40128-11-24 pb 40128-11-32 pb 40128-12-21 pb 40128-12-33 pb 40128-12-34 pb 40128-21-13 pb 40128-21-21 pb 40128-24-31 pb 40128-25-15 pb 40128-27-12 pb 40128-43-21 pb 40128-46-21 pb 401

ALLALLALLALLA310-300ALLA310-300A310-300ALLALLALLALLA310-300ALLALL

04/17/23 29


Sample of AWL / FAL for A310CDCCL Requirement Reference Applicability

4 Safety criticalfeatures of fuelpumps

These features must be maintainedthroughout the full life of the fuel pump to avoid the possibility of generation of an ignition source by overheating or sparks caused by arcing, friction etc.Repair and overhaul of fuel pumps must be carried out in accordance with the equipment manufacturer’s maintenance instructions or other maintenance instructions acceptable to the certifying authority.

CMM28 09 0128 24 11

ALLALL

04/17/23 30


MANAGEMENT / CONTROL OF CDCCL Refer Doc ref # PIA/CDCCL/SFAR88 for detailed procedure

for the Management & Control of CDCCL in PIA. It is the responsibility of certifying staff / maintenance

personnel to ensure that the above stated CDCCL configurations are maintained to reduce the risk of any ignition source penetration into the fuel tank (s).

If any of these CDCCL is compromised, this may lead to wire chaffing, fault current (short circuit), or overheating of the CWT fuel pumps.

This in turn may result in fuel tank explosion.

04/17/23 31


MANAGEMENT / CONTROL OF CDCCL Dry running of the fuel pumps should not be allowed as it

has already resulted in catastrophic incidents. This requirement has been addressed both by Airbus &

Boeing by introduction of new logic circuitry to avoid dry running on CWT fuel pumps.

Introduction of Ground Fault Interrupter (GFI) relays also ensures NO overheating / fault current in the fuel pump circuitry.

04/17/23 32


MANAGEMENT / CONTROL OF CDCCL

04/17/23 33


OVERHAUL SHOP CONTROL FOR CDCCL

Fuel pumps CMM have also been revised in compliance of CDCCL requirements and provides specific instructions / procedures.

Tools, kits, jigs, materials, test equipment required for servicing, repair or overhauling of a fuel system component should be used accordingly.

04/17/23 34


04/17/23 35


AD/ SB Control for CDCCL AD/SB evaluation check list was updated to include a clause

to check whether the literature under evaluation affects CDCCL or not.

Certifying staff / maintenance personnel should assess the affect of the current activity on any of the AWL/CDCCL, and if, it is confirmed that a CDCCL / AWL is directly or indirectly affected, work instructions provided by the AD / SB or task card should be revised / corrected in coordination with Airworthiness Management Division to preclude any chance of CDCCL violation.

A data base will be updated to have a record of all the ADs, SBs, and ECO which have an effect on any of the CDCCL requirements.

04/17/23 36


AD/ SB Control for CDCCLScheduled / unscheduled repair schemes control

Any scheduled /un-scheduled locally prepared repair scheme should be examined for effect on any of the CDCCL item(s).

Same level of understanding is required by shop personnel involved in the servicing / repair / overhaul of Fuel pumps, FQI Tank unit, Fuel Quantity Indicating Computer (FQIC), Fuel Quantity Processor Unit (FQPU), harnesses.

04/17/23 37


AD/ SB Control for CDCCLMaintenance Program Control for CDCCL

Inspections/ tasks introduced through Locally generated task cards as per requirements of an AD, inspection SB, or any other local operational /maintenance requirement also requires assessment whether it affects the CDCCL or not.

PIA fleet Maintenance program should be scrutinized on a regular basis upon receipt of MPD revision, to sort out the newly introduced tasks for having an impact on the CDCCL.

This exercise should be continued in future as well.

04/17/23 38


MAINTENANCE DATA - MANUAL CONSULTATION

Use of updated / latest maintenance data is of utmost importance for maintaining FTS design criteria / CDCCL.

Air Transport Association of America (ATA) Chapter 47 has been assigned for FRS / NGS in concerned airplanes Airplane Maintenance Manuals (AMM).

CDCCL warning notes have also been introduced in AMM and Components Maintenance Manuals (CMM).

All certifying staff / maintenance personnel are required to consult concerned AMM /CMM (as applicable).

04/17/23 39


04/17/23 40


04/17/23 41


CDCCL Presentation

Documents

Transcript of CDCCL Presentation