September 21, 2026 · 14 min read

14 CFR 25.857(e) / 25.858 / 25.1309ARP4761A FHA / FTA / Latent FailureAC 25-19A CMR / AD 2026-18-01

When the Suppression System Was a Valve Nobody Tested: ATR 42-500 Class E Cargo Ventilation Shut-Off (AD 2026-18-01) Through a 14 CFR 25.857(e) and ARP4761A Latent-Failure Lens

In a Class C cargo compartment, a fire is knocked down by an extinguishing agent and the ventilation control is a supporting actor. In a Class E compartment there is no agent. The airplane fights the fire by taking away its air. Which means the ventilation shut-off valve is not part of the suppression system. It is the suppression system. This airworthiness directive exists because nobody was required to check that it still closes.

Most of the ADs I write about here end in a part number. This one ends in an interval. There is no modification, no inspection for cracks, no software load, no serial-number cutoff on a defective batch. The FAA's entire corrective action is: add a task to your maintenance program, and perform it forever.

That makes it a cleaner case study than the hardware ones, because there is nothing to hide behind. The design did not degrade. The design was always like this. What changed is that somebody finally wrote down how often you have to prove it still works.

1. The public record

On September 3, 2026, the FAA published AD 2026-18-01 (Amendment 39-23456, Docket No. FAA-2026-8792, Project Identifier MCAI-2025-01180-T) at 91 FR 56584, effective September 18, 2026 (Federal Register, September 3, 2026). It applies to certain ATR-GIE Avions de Transport Régional Model ATR42-500 airplanes. It was issued as a final rule with a comment period closing October 19 — the FAA justified skipping notice-and-comment on the grounds that there are currently no domestic operators of these products.

The unsafe condition, in the FAA's own words:

The FAA is issuing this AD to address the inability to close the ventilation electrical shut-off valves in case of annunciated smoke in a Class E cargo compartment, which could allow suppressed fire to reignite and further propagate. This condition, if not addressed, could result in an uncontrolled fire in the cargo compartment.

Four things in that sentence are worth slowing down on.

"Inability to close." Not "delayed closure," not "leakage past the seat." The failure mode is a binary demand failure of an on-demand device. The valve is asked to do one thing, once, at the worst possible moment.

"In case of annunciated smoke." The detection side already worked. The crew already knew. This is not a sensing gap. The failure is downstream of annunciation, in the actuation path — the part of the loop that has no flight-deck feedback.

"Suppressed fire to reignite." Read that carefully. It concedes that the initial event may already have self-limited, and then the sustained airflow brings it back. That is an explicit statement that the only thing standing between a contained event and a hull loss is oxygen starvation.

"Ventilation electrical shut-off valves," plural, filed under ATA 21. The AD's subject line is ATA Code 05, Time Limits/Maintenance Checks; 21, Air Conditioning and Pressurization. Not ATA 26, Fire Protection. The hardware is an air-conditioning component that has been handed a fire-protection job. That organizational seam is where requirements go to die, and I will come back to it.

The mandating authority is EASA AD 2025-0135, dated June 26, 2025, which the FAA incorporated by reference. The substance lives in Temporary Revision 18.9 of the ATR42-400/-500 Time Limits Document, dated April 9, 2025, which "specifies a new airworthiness limitation for performing repetitive operational tests of the air conditioning (i.e., ventilation electrical) shut-off valves."

The FAA took two exceptions worth noting: EASA gave operators 12 months to revise the approved aircraft maintenance programme; the FAA gave them 90 days. And the initial compliance time is the later of the TR 18.9 threshold or 90 days after the effective date.

Now look at the sequence this AD sits in:

| Service document | Dated | Mandated by EASA | Adopted by FAA | |---|---|---|---| | ATR42-400/-500 TLD, Revision 18 | October 16, 2023 | AD 2024-0052 | AD 2024-19-02 (89 FR 82491) | | TLD Temporary Revision 18.1 | July 30, 2024 | AD 2025-0005 | AD 2025-25-10 (91 FR 202) | | TLD Temporary Revision 18.3 | November 22, 2024 | AD 2025-0045 | AD 2026-10-08 (91 FR 31353) | | TLD Temporary Revision 18.9 | April 9, 2025 | AD 2025-0135 | AD 2026-18-01 (91 FR 56584) |

Four mandated revisions to one Time Limits Document in under two years, each one riding its own AD. The Airworthiness Limitations Section is being patched incrementally, in public, at regulatory cadence. That is the tell. A stable ALS is a sign that the safety analysis was complete at type certification. An ALS that takes four mandated amendments in twenty-four months is a sign that the analysis is being reconstructed after the fact.

There are no affected U.S.-registered ATR 42-500s. The FAA estimates a future affected operator would spend 90 work-hours and US$7,650 revising its programme (Airways, September 5, 2026). The dollar figure is irrelevant. The lesson is not.

2. The standards lens: which clause should have caught this

14 CFR 25.857(e) defines the Class E compartment and, crucially, what it is allowed to rely on. A Class E compartment — found on all-cargo airplanes — requires a separate approved smoke or fire detector system giving warning at the pilot station, means to shut off the ventilating airflow to or within the compartment with controls accessible to the flight crew, means to exclude hazardous quantities of smoke and flames from the crew compartment, and required crew emergency exits accessible under any cargo loading condition (eCFR 25.857).

Note what is not in that list: a built-in fire extinguishing system. The built-in extinguisher requirement of 25.851(b) attaches to Class C. Class E gets detection, ventilation shut-off, and crew protection. That is the whole architecture. The valve is the mitigation, not a contributor to it.

14 CFR 25.858 is where the asymmetry becomes visible. It requires the detection system to give a visual indication to the crew within one minute of the start of a fire, to detect at a temperature significantly below that at which structural integrity is substantially decreased, and — this is the clause — means to allow the crew to check in flight the functioning of each fire detector circuit (eCFR 25.858).

The regulation mandates an in-flight functional check of the detector. It mandates nothing equivalent for the actuator. Detection is monitorable by rule. Actuation is monitorable only if a designer chose to make it so. On this airplane, apparently, nobody did — which is exactly why the failure is described as an inability to close discovered by analysis rather than an annunciated valve disagree discovered in flight.

ARP4761A is the artifact that should have priced that decision. The Functional Hazard Assessment entry writes itself: Loss of cargo compartment fire containment capability, all flight phases. Given no agent and no alternate means, the failure condition classification lands at Hazardous at best and Catastrophic if you take "uncontrolled fire" at face value — which is precisely the phrase the FAA used. Under 14 CFR 25.1309(b) and AC 25.1309-1, that means a probability budget of 1E-7 per flight hour for Hazardous and 1E-9 per flight hour for Catastrophic.

The Fault Tree then has an AND gate: fire event AND suppression failure. And the suppression-failure branch contains a latent basic event, because a valve with no position feedback and no scheduled exercise sits in an unknown state between demands. In ARP4761A terms this is a dormant failure whose contribution is governed by exposure time, and exposure time is set by exactly one thing: how often you test it.

AC 25-19A is the document that exists to keep that premise honest. It defines a Significant Latent Failure as a latent failure that, in combination with one or more specific failures or events, would result in a Hazardous or Catastrophic condition, and it establishes the Candidate CMR process so that premises made in the 25.1309 safety analyses are protected in service (AC 25-19A). The ATR ventilation shut-off valve meets the SLF definition word for word. In parallel, ATA MSG-3 Level 1 analysis asks whether the functional failure is evident to the operating crew in the performance of normal duties; a "no" routes the item to the hidden-function branch and generates a Failure Finding Task.

So there were two independent processes — one certification-side, one maintenance-side — whose explicit job was to catch this item and assign it an interval. TR 18.9 is what that assignment looks like when it arrives eighteen years late.

One more detail that engineers routinely miss: where the task was put. Placing it in the Time Limits Document as an airworthiness limitation, rather than in the MRB Report or the MPD, makes compliance mandatory under 14 CFR 91.403(c) and 91.409(e) and forbids alternative actions or intervals without approval. An operator can escalate an MPD task through its own reliability programme. It cannot escalate an ALI. The regulator chose the non-negotiable shelf on purpose.

3. A worked snippet: what the fault tree looks like with and without the interval

Here is the branch, drawn the way I would draw it in a preliminary system safety assessment. Failure rates are illustrative placeholders for the arithmetic, not ATR data — the structure is the point, not the digits.

TOP  Uncontrolled fire in Class E cargo compartment
     Classification: Catastrophic (budget 1E-9 /fh) or Hazardous (1E-7 /fh)
      |
     AND
      |
      +-- E1  Fire initiates in Class E compartment
      |       lambda_fire = 1E-6 /fh   (in-flight cargo fire initiation)
      |
      +-- G1  Suppression-by-airflow-starvation fails        [OR]
               |
               +-- E2  Smoke/fire detection fails to annunciate
               |       ACTIVE - in-flight check mandated by 25.858(d)
               |
               +-- E3  Crew fails to select VENT SHUT OFF
               |       ACTIVE - procedural, QRH smoke drill
               |
               +-- E4  Ventilation electrical shut-off valve fails to close
                       LATENT - no flight-deck indication of achieved position
                       lambda_valve = 5E-5 /fh
                       P_latent(demand) = lambda_valve * T_exposure / 2

E2 and E3 are active — a failure shows up on its own. E4 is the only basic event in the gate whose probability is a function of a maintenance decision rather than a design decision. Sweep the test interval and watch what happens:

| Operational test interval T | P(E4 latent at demand) = λ·T/2 | P(TOP) per flight hour | vs 1E-7 Hazardous | vs 1E-9 Catastrophic | |---|---|---|---|---| | None (life of aircraft, ~30,000 fh) | ≈ 1.0 (saturated) | 1.0E-6 | fail, 10× | fail, 1000× | | 12,000 fh | 0.30 | 3.0E-7 | fail, 3× | fail, 300× | | 4,000 fh | 0.10 | 1.0E-7 | at limit | fail, 100× | | 1,200 fh | 0.030 | 3.0E-8 | pass | fail, 30× | | 400 fh | 0.010 | 1.0E-8 | pass | fail, 10× | | 120 fh | 0.0030 | 3.0E-9 | pass | fail, 3× |

Two conclusions fall straight out of that table, and they are the reason I bothered to build it.

First: an interval is worth about two decades of probability, and no more. Going from untested to a 400-flight-hour test buys you a factor of 100. That is enormous. It is also finite, and it is bought at a recurring cost that never ends.

Second: if the classification is genuinely Catastrophic, no maintenance interval closes it. Look down the right-hand column. Even a 120-flight-hour test — roughly monthly on a hard-working turboprop, an interval no operator would accept for a cargo-bay valve — still misses 1E-9 by half a decade. A dormant, single, unmonitored element cannot be maintained into a Catastrophic budget. It has to be architected into one: position feedback that turns the latent failure active, or two valves in series so the single failure stops being single.

That is the honest engineering reading of AD 2026-18-01. The interval is the right immediate action and it is not a sufficient long-term answer. It converts an unbounded exposure into a bounded one. It does not convert a hidden function into an evident one.

4. Derived requirements (excerpt)

These are mine, not ATR's — this is what I would have wanted in the system requirements baseline before the first TLD revision, let alone the fourth.

CGO-FP-001 — Commanded closure, bounded. Each Class E cargo compartment ventilation electrical shut-off valve shall reach the fully closed position within 10 s of flight-crew selection of VENT SHUT OFF, under all certified electrical supply conditions and all certified differential-pressure and airflow conditions across the valve. Rationale: 25.857(e) grants credit for airflow shut-off; without a bounded actuation time the credit is unquantified. Verification: bench and on-aircraft operational test at min/max ΔP.

CGO-FP-002 — The latent failure shall be made active. Each shut-off valve shall provide a discrete achieved-position signal derived independently of the command path. A command/position disagree persisting beyond 15 s shall annunciate to the flight crew and shall be recorded as a maintenance fault. Rationale: converts basic event E4 from latent to active, removing exposure time from the fault tree entirely. Verification: fault injection on the position-sense channel.

CGO-FP-003 — Exposure time shall be a budgeted quantity, not a residue. Where CGO-FP-002 is not implemented, the valve shall be classified as a Significant Latent Failure per AC 25-19A and assigned an operational test interval T such that λ_valve · T / 2 does not exceed the exposure allocation in the applicable PSSA. T shall be published in the Airworthiness Limitations Section, not in the MPD. Rationale: 14 CFR 91.403(c) / 91.409(e) make an ALI non-escalatable by the operator. An MPD task is escalatable and therefore cannot carry a certification premise.

CGO-FP-004 — Define the de-energized state, in the safe direction. Loss of electrical power to the valve during or after a smoke annunciation shall not prevent or reverse achievement of the closed position. The valve's de-energized behaviour (fail-closed, fail-as-is, spring-return) shall be stated explicitly in the system description and substantiated by test, not by supplier datasheet. Rationale: a fail-as-is actuator on an air-conditioning duct is unremarkable; on a fire-containment boundary it is a single point of failure with a fire as its common cause.

CGO-FP-005 — Extend the 25.858(d) principle across the loop. The flight crew shall be provided a means to verify, in flight, the functional integrity of the complete smoke-response chain — detection circuit, command path, and valve actuation — not the detection circuit alone. Rationale: 25.858(d) already mandates in-flight checking of the detector. The regulation's silence on the actuator is a gap in the rule, not a licence in the design.

5. What the headline really tells us

The headline version of this story is "FAA orders new maintenance tests on a turboprop nobody in the US operates." Which is true, and is why it got four paragraphs in the trade press and nothing anywhere else.

The engineering version is that a certification credit was granted in 2007-era paperwork on the strength of a valve closing, and the obligation to keep proving that the valve closes was not written down until a Temporary Revision dated April 9, 2025. For the intervening service life, the fault tree's AND gate had one arm made of paper. The compliance finding was never wrong; it just quietly stopped being supported, one flight hour at a time, in a way no line mechanic and no flight crew could observe.

That is the recurring shape on this blog, and this time it is unusually legible because there is no defective part to point at. The missing artifact was not a design. It was a task. Specifically: a Candidate CMR that AC 25-19A's process exists to generate, a hidden-function Failure Finding Task that MSG-3 Level 1 exists to generate, and an exposure-time allocation that the PSSA was supposed to hand to both of them.

If your system has a risk control that is demanded rarely, observed never, and owned by the team that builds the thing it is bolted to rather than the team that needs it to work — go find its interval. If you cannot find the interval, you do not have a risk control. You have an assumption with a part number.

Sources

Jherrod Thomas — The Lion of Functional Safety™. Certified ISO 26262 Functional Safety Expert, ISO/SAE 21434 (TÜV SÜD), SOTIF Advanced, PMP.