CDCCL vs ALI: The Two “Design Laws” That Keep Fuel Tanks Safe
A Critical Design Configuration Control Limitation (CDCCL) is a feature of an aircraft’s design that must never be altered. It is not a task, and it has no interval. It might be a specific wire routing or separation distance, a bonding feature, a particular gap, a sealant type, or an exact part number — and the reason it is locked is that changing it could reintroduce an ignition source into a fuel tank.
That is the whole idea, and it is also what makes a CDCCL so easy to get wrong. The other limitation you meet in the same manuals — the Airworthiness Limitation Item (ALI) — works in exactly the opposite way: it is a task on a clock. Engineers routinely treat the two as the same thing, a limitation to comply with. They are not the same thing, and confusing them is exactly the kind of error that fails an audit or, quietly, defeats a safety feature the aircraft was certified to have.
What a CDCCL looks like in practice
A CDCCL has no interval, because it is not something you do — it is something you must not undo. On the aircraft it reaches you as a callout in the maintenance data: a line in the AMM, IPC or SRM telling you that a particular configuration is critical and must be left exactly as designed.
If you can point at it on a work card and say “this must stay exactly as it is,” you are looking at a CDCCL. If you can say “this is done every so many flight hours or months,” you are looking at an ALI.
How a CDCCL gets defeated
The danger is subtle: most CDCCL erosion does not come from a missed inspection. It comes from a modification, a repair, or an “equivalent” part substitution that looked harmless and quietly defeated the protection. That is why a CDCCL is a design lock rather than a maintenance task — and why it is protected by the design-change process rather than by the schedule.
Why CDCCLs exist at all
CDCCLs, and the ALIs alongside them, come from a single turning point. When TWA Flight 800 was lost in 1996 to a centre-wing-tank explosion, the investigation exposed an uncomfortable truth: the fuel system’s protections could be silently eroded in service — by wiring degradation, contamination, or a well-meant repair. The regulatory response was to make manufacturers re-analyse fuel tank systems for ignition sources and define the maintenance needed to keep those protections intact. In the EASA world the certification requirement lives at CS 25.981 (the consolidated texts are available through the EASA Easy Access Rules library), and the output of that analysis reaches you as two very different kinds of instruction: CDCCLs and ALIs.
ALI — the other limitation, and how it differs
An Airworthiness Limitation Item (ALI) is a task. It is a scheduled inspection or test that must be done at a fixed interval — a hard-time limit. Think of it as a clock: the interval is set, it is mandatory, and it cannot be escalated or extended without direct approval from the authority. An ALI protects the tank by making sure a specific check happens on time, every time.
So the two protect the same tank by opposite means. An ALI is defeated by letting a date slip. A CDCCL is defeated by changing something that should never have been changed.
CDCCL vs ALI at a glance
| CDCCL | ALI | |
|---|---|---|
| What it is | A configuration that must be preserved | A scheduled task / inspection |
| Has an interval? | No — it is permanent | Yes — a fixed hard-time limit |
| How it’s defeated | A modification, repair or part substitution | Missing or deferring the task |
| Can it be escalated? | It is not a time limit — it must not be altered | Only with authority approval |
| Your job | Recognise it and leave it intact | Do it on time |
How you protect them in practice
The two limitations demand two different habits. For CDCCLs, the discipline is recognition — spotting the CDCCL callouts buried in the AMM, IPC and SRM, flagging affected areas on the work card, and screening every modification and repair against them before it happens. For ALIs, the discipline is scheduling: they are locked in the maintenance programme at their fixed intervals and never quietly slipped.
That recognition is a trained skill, not common sense – a CDCCL warning in a manual can be a single line easy to read straight past. Learning to find and interpret them in real Airbus and Boeing documentation is one of the core competencies covered in Phase 2 fuel tank safety training, which is precisely why detailed training is mandatory for the staff who plan, perform and certify this work rather than optional. (If you are not sure whether your people need that detailed level or only awareness training, our companion guide on Phase 1 vs Phase 2 walks through the split, including where it sits in the Part-145 and Part-M rules of Regulation (EU) No 1321/2014.)
The bottom line
A CDCCL is a configuration you must never disturb; an ALI is a task you must do on time. One is protected by the design-change process, the other by the schedule — and the CDCCL is the one most likely to be lost through a routine repair that nobody flagged. Treat them as two different jobs, because that is exactly what they are.
Recognising CDCCLs in live Airbus and Boeing documentation, and knowing which of your staff must be trained to do it, is covered end to end in Raven’s EASA fuel tank safety training (Phase 1 and Phase 2) — a single self-paced course covering awareness, the detailed examined level, and the 24-month recurrent requirement.
Responses