Jherrod ThomasThe Lion of Functional Safety™

September 29, 2026 · 12 min read

14 CFR 25.981 / 25.1309ARP4761A FTA / ARP4754B AssumptionsEASA AD 2026-0074 / FAA-2026-8800

When the Protection Worked Too Often: The A350 EDP-06 Case-Drain Overheat Through a 14 CFR 25.981 and ARP4761A Demand-Rate Lens

Most airworthiness directives describe something that failed. This one describes something that kept succeeding. The A350's case-drain overheat protection detects the hot pump and isolates the cooling line in the fuel tank, exactly as designed. The problem is how many times it has had to do that. A barrier that is exercised far more often than the safety analysis assumed is not a healthy barrier. It is a fault tree whose inputs have moved.

I read a lot of ADs for this blog. The paragraph in EASA AD 2026-0074 that explains the reason is one of the most honest I have seen, because it names the failed artifact directly. It isn't the pump and it isn't the software. It's the quantitative safety requirement.

1. The public record

On September 9, 2026, the FAA published a notice of proposed rulemaking (Docket FAA-2026-8800) to adopt EASA AD 2026-0074 for Airbus A350-941 and A350-1041 airplanes. The FAA's summary: failures of hydraulic engine-driven pumps (EDPs) of the EDP-06 standard can cause high friction and damage that "could lead to overheating the EDP case drain." The unsafe-condition paragraph continues that "repeated overheating may result in uncontrolled heat transfer to the fuel tank, creating a potential ignition hazard," while also degrading the pump and potentially leading to loss of hydraulic function. The FAA estimates 36 U.S.-registered airplanes are affected, at up to 84 work-hours and $16,368 per airplane. Comments close October 26, 2026 [FAA NPRM].

The EASA AD behind it, issued April 8, 2026 and effective April 22, adds the design detail the FAA summary leaves out [EASA AD 2026-0074]:

This is not the first round. It is the fifth. Here is the chain as the public record shows it:

| Date | Action | What it did | |---|---|---| | Aug 2017 | EASA Emergency AD 2017-0154-E | MMEL dispatch restrictions after an EDP overheat failure mode was found [FlightGlobal; FAA 2018 NPRM] | | Oct 10, 2017 | EASA AD 2017-0200 (FAA AD 2018-19-19) | HMCA SW S4.2 to "avoid uncontrolled overheat," explicitly "still considered to be an interim action" [FAA 2018 NPRM] | | Apr 2, 2019 | FAA AD 2019-03-08 | Replace EDP P/N 53098-04 with the "improved EDP," P/N 53098-06, before Feb 6, 2020 [AD 2019-03-08] | | Feb 12, 2025 | EASA AD 2025-0035 | HMCA SW S6.0 to address EDP-06 failures and repetitive overheat events [EASA AD 2026-0074] | | Jul 16, 2025 | EASA AD 2025-0139 | Supersedes 2025-0035 because the AFM "was mistakenly not identified as an affected publication" [EASA AD 2025-0139; EASA AD 2026-0074] | | Apr 8, 2026 | EASA AD 2026-0074 | Retains S6.0 and the AFM change, adds replacement of all EDPs up to -06 with -07 [EASA AD 2026-0074] | | Sep 9, 2026 | FAA NPRM, FAA-2026-8800 | Proposes to adopt 2026-0074 for the U.S. fleet [FAA NPRM] |

Two lines in that table carry the lesson. The 2019 fix made the -06 the "improved" pump. Seven years later, the -06 is the affected part. And the 2017 wording made the hazard conditional: the overheat was dangerous "combined with an inoperative fuel tank inerting system." The 2018 NPRM describes the architecture plainly: "In the Airbus A350 design, the hydraulic fluid cooling system is located in the fuel tanks" [FAA 2018 NPRM].

2. The standards lens

14 CFR 25.981(a): ignition prevention is its own layer

Section 25.981(a) requires the applicant to set a maximum fuel-tank temperature with a safe margin below the fuel's lowest expected autoignition temperature. The applicant must show that no location where ignition is possible will exceed that value "under all probable operating, failure, and malfunction conditions" of any component that could heat the tank. It also requires showing that an ignition source could not result from any single failure, any single failure combined with a latent failure not shown to be extremely remote, or any combination of failures not shown to be extremely improbable. That showing must account for manufacturing variability, aging, wear, corrosion and likely damage.

A hydraulic cooler inside a fuel tank is a textbook 25.981(a) component. A worn pump sending hot case-drain fluid into that cooler is a wear-induced malfunction that the rule tells you to consider by name.

Section 25.981(b) is the separate flammability-exposure requirement that the A350's inerting system serves. The two paragraphs are meant to be independent layers: prevent ignition sources, and reduce the time the ullage is flammable. The 2017 reason statement shows the overheat becoming a real ignition concern only when the second layer was missing. It follows that the MMEL item for an inoperative inerting system was carrying safety weight the first layer should have carried alone. That is why the first response was a dispatch restriction rather than a design change.

14 CFR 25.1309 and ARP4761A: the number that moved

"Uncontrolled EDP CD overheat" is a failure condition with a quantitative requirement. Under 25.1309(b) and AC 25.1309-1B, a failure condition that can end in a fuel-tank ignition is catastrophic. Its budget is 1×10⁻⁹ per flight hour or less, and no single failure may cause it.

In ARP4761A terms, the system safety assessment (SSA) fault tree for that condition is a product of three things:

  1. the rate of the initiating event (EDP case-drain overheat onset),
  2. the probability that the protection (monitor plus isolation) fails on demand, and
  3. the exposure terms (tank flammable, inerting unavailable).

The protection design can be perfect and the tree still fails if term 1 is wrong. EASA's phrase "due to the repetitive nature of those overheat events" says exactly that. The field overheat rate for EDP-06 is incompatible with the rate the SSA assumed. The software did not get worse. The world it was protecting got busier.

A second-order effect makes it worse. Each successful isolation shuts off cooling for that hydraulic circuit, which moves you toward the other hazard in the FAA's unsafe-condition statement: degraded pump performance and possible loss of hydraulic function. A protection that trips repeatedly spends down your margin on both sides.

ARP4754B: assumptions are requirements with an expiry date

ARP4754B treats assumptions as things to be validated and managed, not written down once and forgotten. The initiating-event rate in a catastrophic fault tree is the most consequential assumption a system team owns, and in this case it came from a supplier's pump reliability prediction. Nothing in the public record says how that rate was tracked in service. What the record does show is a nine-year, five-directive chain in which each fix was sized for the failure then in view.

DO-178C and change impact: the AFM that nobody listed

The HMCA is airborne software, and its development assurance level is not public. If the overheat monitor is a credited barrier against a catastrophic condition, the ARP4754B allocation pushes it toward Level A unless an independent barrier justifies a lower level. The more instructive software failure, though, is the one EASA recorded in 2025: after S6.0's retrofit SB was released, "the AFM was mistakenly not identified as an affected publication." A software change altered what the crew needed to know, and the change-impact analysis stopped at the equipment boundary. It took a superseding AD to close that gap.

3. A worked snippet: the fault tree, and the budget that stopped closing

The fault tree below is my reconstruction from the public reason statements. It is not Airbus's SSA.

TOP: Fuel-tank ignition from hydraulic case-drain overheat   [CAT, budget 1E-9 /FH]
 |
 AND
 +-- IE-1  EDP case-drain overheat onset                    lambda_OH  (per FH)
 |          (EDP-06 wear -> friction -> CD fluid temperature rise)
 |
 +-- G-1   Protection fails to prevent in-tank over-temperature
 |    OR
 |    +-- BE-1.1  HMCA CD temperature monitor fails to detect    P_det
 |    +-- BE-1.2  CD cooling-line isolation valve fails to close P_iso
 |    +-- BE-1.3  Cumulative heating across repeated events      P_rep
 |                exceeds the in-tank surface margin
 |                (not modeled if events are assumed rare)
 |
 +-- G-2   Ullage flammable at the time
      OR
      +-- BE-2.1  FRM/inerting operating, residual exposure      F_frm
      +-- BE-2.2  Inerting inoperative (MMEL dispatch or failure) F_inop

BE-1.3 is the event I would bet was missing, or rated "not credible," in the original tree. If overheats are rare, each one is independent and the protection resets cleanly. If they repeat on the same pump, heat accumulates in the fuel-wetted hardware, and the per-demand success probability is no longer the full story.

Now the budget. These numbers are illustrative, chosen to show the mechanism, not taken from the A350 program:

| Term | SSA assumption | Field (illustrative) | Note | |---|---|---|---| | lambda_OH, CD overheat onset | 2×10⁻⁶ /FH | 4×10⁻⁵ /FH | 20× more frequent for a wearing EDP-06 population | | P(G-1), protection fails on demand | 1×10⁻³ | 1×10⁻³ | Monitor and valve unchanged | | P_rep contribution | 0 (not modeled) | 5×10⁻⁴ | Repeat events on the same pump | | P(G-2), ullage flammable | 0.03 | 0.03 | FRM fleet exposure; worse under MMEL | | Top event | 6×10⁻¹¹ /FH | 1.8×10⁻⁹ /FH | Budget 1×10⁻⁹: fails |

Nothing in the protection column changed. The top event went up by a factor of 30 through the demand term and one unmodeled basic event. That is the anatomy of the phrase "non-compliance to the quantitative safety requirements." You can also see why the remedy has two parts. S6.0 attacks P(G-1) and P_rep: make the protection more robust and, presumably, stop a pump from being protected over and over. The -07 pump attacks lambda_OH. Either one alone leaves the tree marginal.

4. Derived requirements (excerpt)

The IDs are stable and illustrative. The numeric values are placeholders that a real program would justify from its own SSA and fuel-temperature substantiation.

Requirement 01 is the one I would fight for, because it is the only one that would have caught this pattern early and cheaply. Requirements 02 and 03 are what a fix looks like. Requirement 01 is what stops the next fix from being sized to yesterday's failure rate.

5. What the headline really tells us

"FAA proposes A350 hydraulic pump directive" sounds like a hardware story with a software patch attached. Read EASA's reason paragraph and it's a story about an unmonitored assumption. The ignition-prevention protection was specified, built and certified. It worked each time. But the fault tree that justified it depended on the pump rarely asking for help, and the EDP-06 fleet asked often. There was no alarm in the safety process for "the barrier is being used too much," so the non-compliance showed up as a directive rather than as a trend in an assumptions register.

Two things in this record deserve credit. EASA wrote down the real reason, a quantitative requirement that no longer closes, instead of hiding behind "potential ignition hazard." And the remedy attacks both the demand and the barrier, which is the right shape. The nine-year chain is the cautionary part. In 2019, the "improved EDP" closed the finding that was open at the time. Nobody attached a field trigger to it.

The pattern isn't unique to aircraft. A PLC safety function, an infusion pump's air-in-line detector, a robot's speed-and-separation monitor: each safety case has an assumed demand rate. When the field says the barrier is working overtime, that is the first line of an incident report, not good news about the barrier.

Sources

— Jherrod Thomas, The Lion of Functional Safety™