2.2 Confined-Space Entry, Fuel-Tank Safety & CDCCL Control
Key Takeaways
Fuel-tank entry is a controlled confined-space task requiring an authorised plan, atmosphere testing, ventilation, communications, standby support, and a practicable rescue arrangement.
Atmospheric acceptance limits and test frequency come from the applicable entry procedure; a single initial reading does not control a changing atmosphere.
Ignition sources must be controlled through approved lighting, tools, bonding, equipment positioning, and hot-work restrictions.
CDCCLs preserve fuel-tank ignition-prevention features and may not be changed without the approved design process.
The standby attendant monitors and summons the planned rescue response rather than improvising an unprotected entry.
2.2 Confined-Space Entry, Fuel-Tank Safety & CDCCL Control
An aircraft fuel tank combines restricted access, difficult escape, residues and vapours, oxygen variation, conductive structure, and potential ignition sources. Entry is therefore managed as a confined-space task under the organisation's authorised procedure and the aircraft maintenance data. The controls are a system: removing fuel does not by itself make a tank safe, and a satisfactory atmosphere reading at one moment does not guarantee the next.
Planning and authorisation
The work package should identify the tank, access points, previous contents, isolation boundaries, ventilation method, required atmosphere tests, communications, lighting and tools, entrant and attendant roles, rescue arrangements, and stopping criteria. Fuel transfer, refuel or defuel, cross-feed, pumps, valves, electrical sources, hydraulic movement, and nearby work must be coordinated so another team cannot reintroduce a hazard.
The tank is drained and prepared by the approved method. Opening, purging, ventilation, and waste handling must control both vapour release and environmental exposure. Maintenance personnel do not invent a purging medium or use oxygen to improve the atmosphere. The specified ventilation equipment remains positioned so it does not introduce exhaust, static, or other ignition hazards.
Atmosphere testing
A suitable, in-date instrument is function-checked or bump-tested as required. Testing normally considers oxygen concentration, flammable vapour relative to the lower explosive limit, and any substance-specific toxic exposure identified by the risk assessment. Samples are taken at the locations and levels specified because vapour concentration may not be uniform.
Entry limits, alarm points, and retest frequency are established by the applicable confined-space procedure and local law. Published training values can help explain the concepts, but they are not a substitute for the authorised permit. Continuous or periodic monitoring is maintained as required. A ventilation failure, alarm, unexpected odour, illness, spill, or conflicting maintenance activity is a reason to leave the tank and reassess.
People, communication, and rescue
The entrant must be trained for the task and medically fit where the procedure requires it. Clothing and PPE are selected for fuel, solvent, skin, eye, respiratory, and mechanical exposure. Loose items are controlled, and movement routes are considered before entry.
A dedicated attendant remains outside, maintains the specified communication, tracks entrants, observes ventilation and instruments, prevents unauthorised entry, and initiates the rescue plan. The attendant does not make an impulsive, unprotected entry. Many confined-space fatalities involve would-be rescuers entering the same atmosphere without protection. Rescue equipment, competent responders, access clearance, and emergency communications must be workable before the first entrant goes inside.
Ignition-source control
Fuel-vapour ignition can result from electrical arcs, static discharge, unsuitable lamps or tools, hot surfaces, grinding, welding, or equipment operating near an opening. Only equipment authorised for the environment is used. Cables, lamps, ventilation units, and communication equipment are inspected and placed as the procedure directs. Aircraft bonding or earthing provisions are installed where specified; generic resistance values must not replace the approved limit and test method.
Hot work near a tank requires its own authorisation and aircraft-specific precautions. Even cold work can create heat or sparks if a tool slips, a fastener is drilled, or an electrical item fails. Work scope changes require reassessment.
CDCCLs and fuel-tank safety features
Critical Design Configuration Control Limitations identify design features necessary to prevent ignition. Examples may include wiring separation, routing, shielding, bonding, connector configuration, transient suppression, component qualification, or structural features. The controlling instructions state what must be preserved and how compliance is recorded.
A CDCCL is not a convenient recommendation. If maintenance discovers that a configuration cannot be restored exactly, work stops and approved engineering or design-authority instructions are obtained. Substituting wire, changing a route, omitting a clamp, altering a bond, or installing a different component can defeat an ignition-prevention assumption even when the system appears to operate normally.
Close-up and return to service
Before closing the tank, personnel and tools are accounted for, loose articles and cleaning materials are removed, work and independent inspections are completed, seals and access panels are installed to approved data, and all disturbed CDCCL features are verified. Ventilation and access controls are removed only in the planned order. Required leak checks, functional tests, records, and release actions are then completed.
The exam principle is straightforward: safe fuel-tank work depends on an authorised entry system, changing conditions are monitored, the rescue plan is ready before entry, ignition sources are controlled, and CDCCLs are restored exactly to approved design data.
Entry-Control Summary
| Phase | Evidence before continuing |
|---|---|
| Authorise | Applicable entry permit, task data, isolations, entrant and attendant roles |
| Prepare | Tank drained or prepared as directed, ventilation operating, rescue arrangement ready |
| Test | Instruments checked and atmosphere within the procedure limits at required locations |
| Work | Communication and monitoring maintained; ignition sources and scope changes controlled |
| Close | People, tools and materials accounted for; CDCCLs, access and tests restored and recorded |
What makes an aircraft fuel-tank atmosphere acceptable for entry?
A fuel quantity indication of zero
The absence of a noticeable fuel odour
Test results within the authorised procedure limits, with required ventilation and ongoing monitoring
An open access panel for at least ten minutes
What is the standby attendant’s primary role during fuel-tank entry?
Remain outside, maintain communication and monitoring, prevent unauthorised entry, and initiate the planned rescue response
Enter immediately if the entrant stops responding
Perform unrelated maintenance while listening for a call
Control the tank atmosphere by smell
Why must a CDCCL be restored exactly as approved?
It exists mainly to standardise cosmetic appearance
It applies only during aircraft manufacture
It can be changed whenever a functional test passes
It preserves a design feature needed to prevent fuel-tank ignition
Sections you finish are checked off in the contents.