Bjorn’s Corner: The challenges of airliner development. Part 8. Transport category rulings.

By Bjorn Fehrm, Henry Tam, and Andrew Telesca

June 18, 2021, ©. Leeham News: We continue our discussion about the Transport Category (FAA Part 25) certification rules.

Last week we talked about how much tougher the birdstrike protection is for Part 25. Now we look at the fuel tanks and the inherent explosion risk in these.

Figure 1. The Boeing 747-100 N93119 that flew TWA flight 800. Source: Wikipedia.

Amended rules for tank safety

For 14 CFR Part 25 Transport Category aircraft, one example of the tougher rules for certification is 14 CFR Part 25.981 “fuel tank explosion prevention”. It all emanated from a very high-profile accident 25 years ago.

The TWA 800 accident

The rule came after the dramatic accident of TWA flight 800, Figure 1. It was the third-largest aircraft accident in the history of the US.

The Boeing 747-100 with 230 passengers crashed 12 minutes after takeoff from JFK outside Long Island on its way to Paris. Eyewitnesses saw the aircraft tumbling down in burning pieces, Figure 2.

Figure 2. The simulated breakup of TWA flight 800 by the CIA after the crash. Source: Wikipedia.

The initial thought was of a terrorist bomb or missile attack, and the FBI led the investigation with NTSB doing a parallel crash investigation.

Gradually, NTSB found a history of fuel metering system problems for the aircraft. It also found evidence of a short circuit of the fuel metering system wiring with other wires on the aircraft just before the crash (the cockpit voice recorder had the Captain complaining about crazy readings from the fuel system minutes before the crash).

NTSB deduced an event chain, where a short circuit in the cockpit created enough energy for the fuel metering system to initiate an explosion of flammable fuel-air vapor formed on top of residue fuel in the center wing tank, Figure 3.

Figure 3. The Center-Wing Tank (CWT) of a 747-100. Source: Wikipedia.

The Center Wing Tank (CWT) was an extra tank in the 747-100 and not filled for the flight. It was on top of the ECS system (aircraft air-conditioning), which heated the fuel, encouraging evaporation from the fuel residues in the tank.

The result was a gradual development of an explosive fuel-air mixture. At 12 minutes after departure, the critical fuel vapor and oxygen levels were reached, and the tank exploded, breaking the 747 in two (Figure 2).

Fuel inerting or not?

The accident had wide public visibility and created long debates about the need for an air inerting system on airliners or not (to bring the oxygen level in the tank air below the critical 12%, from normal 21%).

There had been tank explosions before TWA 800, and FAA had resisted tank inerting system over 30 years as impractical. Its rules had focused on avoiding the ignition sources for tank vapor. There were electrical energy levels necessary for ignition to occur, and if there was no wiring, there was no electrical energy. For any present wiring, its energy level was prescribed to be very low.

Boeing could avoid wiring in tanks but for the center tank fuel metering system for the 747-100. The system used such low voltages and currents that there shouldn’t be the energy to initiate an explosion from any fuel vapor.

But this didn’t exclude other systems injecting enough energy into the fuel metering wiring through short circuits. NTSB found evidence this happened before the explosion and concluded in its final report, August 2000:

The probable cause of the TWA 800 accident was:…[An] explosion of the center wing fuel tank (CWT), resulting from ignition of the flammable fuel/air mixture in the tank. The source of ignition energy for the explosion could not be determined with certainty, but, of the sources evaluated by the investigation, the most likely was a short circuit outside of the CWT (Center Wing Tank) that allowed excessive voltage to enter it through electrical wiring associated with the fuel quantity indication system.

As contributing factors to the accident, the report listed:

The design and certification concept that fuel tank explosions could be prevented solely by precluding all ignition sources.

The certification of the Boeing 747 with heat sources located beneath the CWT with no means to reduce the heat transferred into the CWT or to render the fuel tank vapor non-combustible.

The ensuing FAA ruling

The FAA proposed a rule in November 2005 in response to the NTSB investigation and recommendations. The final FAA ruling, Part 25.981, came into effect on 21 July 2008.

It demands a significant additional protection layer to prevent vapor ignition, often including both additional robustness against potential ignition sources and elimination of flammable vapor by an inert gas system that pumps non-flammable gas into the headspace of fuel tanks. Complex analysis is also needed to show that the preventative measures are effective. We will not quote the entire rule as it is over 500 words long.

It was a significant change in rules, however. The FAA estimated industry compliance costs at the time of its release in 2008 at $800m. It affected 3,200 Airbus and Boeing aircraft with center wing fuel tanks with ECS systems below that could heat residual fuel. Cargo aircraft were exempted from the retrofit, as were regional and commuter planes.


The above is a good example of how certification rules are emanating from tragic events. It also exemplifies what we said in Part 4, safety is relative and considers the consequences of non-safety. Aircraft with high passenger capacity are affected by the rules, others are not.

20 Comments on “Bjorn’s Corner: The challenges of airliner development. Part 8. Transport category rulings.

  1. So, you want the plane to crash before you put inert gas in?

  2. The usual solution to the problem of preventing inadvertent electrical ignition by instrumentation in industry where there are flammable fuels, gases and solvents is the use of ‘intrinsically safe barriers’. These have a Zener diode to clamp the voltage to some value such as 7.6V and resistors to limit current so that the voltage/current is always below the LEL (Low Explosion Limit) or UEL (Upper Explosion Limit). A fuse in the circuit prevents extreme voltages overwhelming the Zener and resistor by blowing if so subjected. Its enough to operate a switch or simple instrument.

    The problem is that if the intrinsically safe barriers (they look like terminal blocks) are placed to far from the explosion risk there is a danger of the safe side wiring becoming damaged and contacting non safe wiring. What is supposed to prevent this is that the wiring is meant to be in strong and separate cables routed in different ducts.

    So was this bad engineering, a bad build or a bad repair?

    Putting the tank near the air conditioning was not the cause but probably a factor.

    Were there even UL or similar certified barriers. Some WW2 Soviet fighters had an inerting system that used engine exhaust.

  3. Re: “Cargo aircraft were exempted, as were regional and commuter planes.”

    For clarity, the relief does not apply to new type designs.

    For example, not long before the Learjet 85 business jet was cancelled, the on-boarding of a fuel tank inerting system supplier was announced by Bombardier. It is presumed the 5 year window from application to type certification (something that will be discussed in future articles I’m sure), was going to be exceeded and the certification basis had to be updated to include FAR 25.981 Amdt 25-125.

  4. Hopefully not taken off topic. I like the FAA conservative approach on what is being called a possible latent failure no picked up for the MAX. I know that was a driver during tests though low possible that Boeing had to re-do.

    That gets into some pretty tech computer aspects and I don’t have a working knowledge of it. It will be interesting to see if there is some auto detect routine that is implemented at some point.

  5. Presumably the new Rear Centre Tank of the A321XLR, which is a structural tank, will be inerted. As far as I can tell its placement is such that in a wheels up belly landing, even in the unlikely event of the engines being detached, it would never touch the ground since the contact point will be the underslung wing box and the tail.

    • Nevertheless, BA is trying to allege that the design is unsafe…which many analysts construe as a cheap attempt to delay (US) certification of the A321XLR so as to cut some slack for BA’s (lack of) market position in this segment.

      Christian Scherer (Airbus) called this BA allegation “slightly provocative and outdated”.

      Is there such a thing as pure certification without political intrigue and subterfuge?

      • Not from the US.
        Not weaponizing such things is a lost opportunity.
        Guess why FAA ETOPS was a new introduction
        versus building on the ICAO extended over water ops.

        Boeing’s design failures are invariably cloaked in stringent extra demands on all types. level the table ( strongly to US advantage ) is my name.

      • Perhaps Boeing may find that an structural rear centre tank could substantially increase the range of say the B737 MAX 9. Would solve a few problems for them.

        • Not really . The Max 10 is the same passenger numbers as the A321 give or take half a row ( took their time doing that) so they a more direct competitor, its surprisingly good range is up there with A321LR when you have the cargo tanks as well. The takeoff is an issue and the XLR has a max weight bump as well.
          What really surprised me was the Swissair gets more cargo and a full passenger load with its A220s than the A320/A321
          A321 2.8 tonnes -same for neo
          A320 2.4 tonnes “” “”
          A220-300 5 tonnes

          • Boeing 737 MAX 7 has a range of 3,850 nautical miles (7,130 km).
            Boeing 737 MAX 8 has a range of 3,550 nautical miles (6,570 km).
            Boeing 737 MAX 9 has a range of 3,550 nautical miles (6,570 km) with an extra fuel tank.
            Boeing 737 MAX 10 has a range of 3,300 nautical miles (6,110 km) with an extra fuel tank.

            Well short of A320LR (4000NM) and 320XLR (4700NM) and I doubt the difference in reserve fuel rules would make enough difference for the ranges of the MAX-9/MAX-10 to be equivalent to the A321LR.

            The reason I suggested the MAX-9 with a structural rear center tank because it might accept the heavier gear of the MAX-10 to get the increased MTOW.

            I’m not surprised the A220-300 performs so well given its much lower wing loading and likely MTOW issues due to field length. I would argue that we are not necessarily comparing apples with apples. The A320 cargo may be nett cargo weight minus the LD3/45 containers?

            Also when the optimized single slotted flap is developed for the A321XLR it may find its way onto the A321LR, A321neo and A320neo.

        • It’s just uniformed speculation quite likely with a negative PR campaign behind it. Airbus would have considered this before launching XLR. They will meet performance safety requirements by putting in a firewalls.

          • I was wondering about that. And in particular the “cold feet” comment. Is it in EASA’s prevue to worry about passengers “cold feet”? That seems more like somethings airlines may worry about. Plus if the tank is used first the effect will be short lived.

          • Target audience:
            Half assed “investors”.
            You can pressure any company cheaply
            via “guiding” their “investors”.

            IMU the core reason why a lot of “strange” press articles see the daylight.

        • On the basis of my camination of pictures of the many pictures of the RCT
          1 The RCT is a physically separate fuel tank with its own tank skin and internal and external structure. Just like a normal ACT It does not use the skin of the fuselage or floor.
          2 The RCT will be fitted inside the fuselage. The difference between the RCT and ACT is that the structure of the RCT will reinforce the structure of the fuselage whereas the ACT is supported by it. Furthermore the RCT cross section confirms closely to the semicircular section of the lower half of the fuselage and extends to near the floor so it’s physically closer.

          The cold from the fuel in the tank will need to pass through the tank skin, air and structure, floor, rubber and carpet and whatever insulation or firewall is added in parts to get to the passengers feet. Obviously there are ways of insulating the tank and it’s mounting points itself.

          One concern is that an external pool fire from say the wing tanks could heat the RCT as it’s closer to the aircaft skin measures will be taken there to provide firewalls to stop that.

          • What I described above is not accurate.
            The photos of the tank seem to show it is in two sections.
            Section 1. looks like a fuselage section with the curved fuselage skin forming the tank but much of it has external ribbing perpendicular to the airflow indicating it is inside the underslung wing box cover. No part of the wall of the tank is directly exposed to the surface of the aircraft and there is room of above the tank for lagging to insulate it above.
            Section 2. The tank is of square cross section but follows the curve of the bottom half of the fuselage. It is hard to tell if this section of tank uses the aircraft skin or has an inner wall.

  6. Bloomberg: “Latest FAA Reform Gives Workers New Way to Report Safety Flaws”

    “(Bloomberg) — Thousands of federal engineers, inspectors and other aviation workers have a new channel through which to report safety concerns without fear of retaliation in an action spurred by the two fatal crashes on the Boeing Co. 737 Max.

    The U.S. Federal Aviation Administration on Monday unveiled what it calls the Voluntary Safety Reporting Program. The 7,400 people working at FAA’s Aviation Safety division can make reports through their unions or individually, and the information will be analyzed for safety trends.

    “We can never be satisfied with the status quo when it comes to safety, and the free exchange of vital information is a cornerstone of safety and continual improvement,” FAA Administrator Steve Dickson said in a news release. “We want our employees to know that when they speak up, they can be sure someone is listening.”

    The FAA’s action means its own safety inspectors are receiving the same encouragement to bring concerns to the surface that others in the aviation industry, such as airline pilots, have had for decades. It also addresses a requirement contained in a sweeping aviation safety law passed by Congress in December.”

    I wonder will any FAA staff voice concerns about the recently discussed “latent failure” in the MAX’s flight control systems, which the FAA evidently considers to be an acceptable risk. One can opine that someone at the FAA has calculated the expected crash rate due to this issue, and that it fell “within parameters”. However, one is concurrently reminded that an original calculation of the MCAS-associated crash rate turned out to be grossly overly optimistic.
    And, of course, the main question: if such (or other) concerns are raised, will anything meaningful be done with them, or will they be swept under the carpet?

Leave a Reply

Your email address will not be published. Required fields are marked *