If a burner is used to provide the lifting means, the system must be designed and installed so as not to create a fire hazard.

There must be shielding to protect parts adjacent to the burner flame, and the occupants, from heat effects.

There must be controls, instruments, or other equipment essential to the safe control and operation of the heater. They must be shown to be able to perform their intended functions during normal and emergency operation.

The burner system (including the burner unit, controls, fuel lines, fuel cells, regulators, control valves, and other related elements) must be substantiated by an endurance test of at least 40 hours. Each element of the system must be installed and tested to simulate actual balloon installation and use.

The test program for the main blast valve operation of the burner must include:

Five hours at the maximum fuel pressure for which approval is sought, with a burn time for each one minute cycle of three to ten seconds. The burn time must be established so that each burner is subjected to the maximum thermal shock for temperature affected elements;

Seven and one-half hours at an intermediate fuel pressure, with a burn time for each one minute cycle of three to ten seconds. An intermediate fuel pressure is 40 to 60 percent of the range between the maximum fuel pressure referenced in paragraph (d)(1)(i) of this section and minimum fuel pressure referenced in paragraph (d)(1)(iii);

Six hours and fifteen minutes at the minimum fuel pressure for which approval is sought, with a burn time for each one minute cycle of three to ten seconds;

Fifteen minutes of operation on vapor, with a burn time for each one minute cycle of at least 30 seconds; and

Fifteen hours of normal flight operation.

The test program for the secondary or backup operation of the burner must include six hours of operation with a burn time for each five minute cycle of one minute at an intermediate fuel pressure.

The test must also include at least three flameouts and restarts.

Each element of the system must be serviceable at the end of the test.