No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignition of fuel or vapors. This must be shown by:

Determining the highest temperature allowing a safe margin below the lowest expected autoignition temperature of the fuel in the fuel tanks.

Demonstrating that no temperature at each place inside each fuel tank where fuel ignition is possible will exceed the temperature determined under paragraph (a)(1) of this section. This must be verified under all probable operating, failure, and malfunction conditions of each component whose operation, failure, or malfunction could increase the temperature inside the tank.

Except for ignition sources due to lightning addressed by § 25.954, demonstrating that an ignition source could not result from each single failure, from each single failure in combination with each latent failure condition not shown to be extremely remote, and from all combinations of failures not shown to be extremely improbable, taking into account the effects of manufacturing variability, aging, wear, corrosion, and likely damage.

Except as provided in paragraphs (b)(2) and (c) of this section, no fuel tank Fleet Average Flammability Exposure on an airplane may exceed three percent of the Flammability Exposure Evaluation Time (FEET) as defined in Appendix N of this part, or that of a fuel tank within the wing of the airplane model being evaluated, whichever is greater. If the wing is not a conventional unheated aluminum wing, the analysis must be based on an assumed Equivalent Conventional Unheated Aluminum Wing Tank.

Fleet Average Flammability Exposure is determined in accordance with Appendix N of this part. The assessment must be done in accordance with the methods and procedures set forth in the Fuel Tank Flammability Assessment Method User's Manual, dated May 2008, document number DOT/FAA/AR-05/8 (incorporated by reference, see § 25.5).

Any fuel tank other than a main fuel tank on an airplane must meet the flammability exposure criteria of Appendix M to this part if any portion of the tank is located within the fuselage contour.

As used in this paragraph,

Equivalent Conventional Unheated Aluminum Wing Tank is an integral tank in an unheated semi-monocoque aluminum wing of a subsonic airplane that is equivalent in aerodynamic performance, structural capability, fuel tank capacity and tank configuration to the designed wing.

Fleet Average Flammability Exposure is defined in Appendix N to this part and means the percentage of time each fuel tank ullage is flammable for a fleet of an airplane type operating over the range of flight lengths.

Main Fuel Tank means a fuel tank that feeds fuel directly into one or more engines and holds required fuel reserves continually throughout each flight.

Paragraph (b) of this section does not apply to a fuel tank if means are provided to mitigate the effects of an ignition of fuel vapors within that fuel tank such that no damage caused by an ignition will prevent continued safe flight and landing.

To protect design features that prevent catastrophic ignition sources within the fuel tank or fuel tank system according to paragraph (a) of this section, and to prevent increasing the flammability exposure of the tanks above that permitted in paragraph (b) of this section, the type design must include critical design configuration control limitations (CDCCLs) identifying those features and providing instructions on how to protect them. To ensure the continued effectiveness of those features, and prevent degradation of the performance and reliability of any means provided according to paragraphs (a), (b), or (c) of this section, the type design must also include necessary inspection and test procedures, intervals between repetitive inspections and tests, and mandatory replacement times for those features. The applicant must include information required by this paragraph in the Airworthiness Limitations section of the Instructions for Continued Airworthiness required by § 25.1529. The type design must also include visible means of identifying critical features of the design in areas of the airplane where foreseeable maintenance actions, repairs, or alterations may compromise the CDCCLs.