1 ezi--ao.EING The Boeing Company 2401 E. Wardlow Road June 22, 2015 CP-L4L-15-00233 Long Beach, CA 90807-5309 ,..__,= U.S. Department of Transportation Docket Operations M-30 ._,..,C..**~** ;:_!_**;_.~~ ~** ·-·:. :,-.;.- 1200 New Jersey Avenue, SE**r--:~.3.** :;_J Room W12-140, West Bldg. Ground Floor Washington DC 20590-0001 Ulu**;~~;?.~~ =:-:----::~** 

Attention: Applicant: Subject: References: FAA Transport Airplane Directorate The Boeing Company Boeing Commercial Airplanes Southern California Engineering Design Center 2401 E. Wardlow Road, Mail Code D800-0022 Long Beach, CA 90807-5309 Contact: Mr. Thomas A. Enyart Email: Thomas. a. Enyart@boeing.com Phone: (562) 797-8956 Seal Beach, CA 90740-1515**.-:.--~ ~--** **=-~-;_--:~=-; r-~** ,,-.. -=---·--"" :::--· Y:J.t= 4':- ·r Petition for Exemption from 14 CFR 25.901(c) Amendment 25-126 and14 CFR 25.981(a)(3) Amendment 25-125 pertaining to planned changes for

the 767-300 (Freighters Only}, 767-200/300 BCF Center Wing Tank (CWT) Fuel Quantity Indication System (FQIS) Fuselage Wiring Installation.a) Exemption No. 10767A, Regulatory Docket No. FAA-2012-1132, issued May 4, 2015 b) NTSB report TWA 800 AAR-00-03 c) Service Bulletin 767-28-0118, FUEL- Fuel Quantity Indicating System (FQIS)- Built-In Test Equipment (BITE) Procedure Test and Fuel Overfill Shutoff Surge Tank Sensor Circuit Test, dated July 15, 2014 Certification Item No: 48144 The Boeing Company respectfully submits the enclosed Petition for Exemption from the Title 14 Code of Federal Regulations §14 CFR 25.901(c) Amendment 25-126 and 14 CFR 25.981(a)(3) Amendment 25-125 pertaining to planned changes for the 767-300 (Freighters Only), 767-200/300 BCF Center Wing Tank (CWT) Fuel Quantity Indication System (FQIS) and Fuel Overfill Shutoff Surge Tank Fuselage Wiring Installation. The Extent of Relief Sought and Reason(s): 14 CFR 25.901 (c)at Amendment 25-126 requires: (c) For each power plant and auxiliary power unit installation, it must be established that no single failure or malfunction or probable combination of failures will jeopardize the safe operation ofthe airplane except that the failure ofPage 2of7 CP-L4L-15-00233 structural elements need notbe considered ifthe probability of such failure is extremely remote. 14 CFR 25.901 (c) Amendment 25-126 Boeing relief is necessary because: Direct compliance would require excessive design changes and retrofit of in-service airplanes. Changes include the following: Further redesign ofthe Airplane Wiring System to ensure FQIS wire separation for numerous airplane configurations. Make new tank penetrations and procure new in-tank wiring harnesses. Modify the Fuel Quantity Processor Unit (FQPU) and associated connectors. The solution would require a FQIS architecture change to relocate the FQPU and consider Remote Data Connectors (RDCs). In-tank component changes (new brackets, potential need for shorter probes,

revised in-tank wire harness and retention means). Software changes related to Fuel Tank Gauging Function (to account for capacitance changes if shorter in-tank probes

are required).14 CFR 25.981(a)(3) at Amendment 25-125 requires: (a)No ignition source may be present at each point inthe fuel tank orfuel tank system where catastrophic failure could occur dueto ignition offuelor vapors. This must be shown by:(3) Demonstrating that an ignition source could not result from each single failure, from each single failure in combination with each latent failure condition not shown tobe extremely remote, and from all combinations of failures not shown tobe extremely improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered. 14 CFR 25.981(a)(3) Amendment 25-125 Boeing relief is necessary because: Same as above BackgroundThe FAAis planning to issue a NPRM forthe 767 similar tothe 757 NPRM 2011-NM094-AD which proposes to require modifying the FQIS wiring orfuel tank systems to prevent development ofan ignition source inside the center fuel tank. Paragraph (h)(2) states: "Within 72 months after the effective date ofthis AD, modify the airplane by separating FQIS wiring that runs between the FQIS processor and the center fuel tank,

including any circuits that might pass through a main fuel tank, from other airplane wiring thatisnot intrinsically safe." Boeing is proposing to accomplish the FAA's planned AD mandated changes to separate the FQIS CWT wiring between the FQIS processor and the center fuel tank, as well as using the FQIS Builtin Test Equipment (BITE) check. In addition, changes to . separate the Fuel Overfill Shutoff Surge Tank wiring from the Fuel Level Sensor Control PC Assy tothe center fuel tank along with its wiring integrity checks willbe done. The reference c) BITE service bulletin 767-28-0118, which includes the instructions to ensure tank circuit wiring integrity, is already approved bythe FAA. The CWT FQIS

wiring separation is being prepared with guidance from the FAA's approved standard for retrofit wire separation from FQIS wiring. But the combination of BITE and wire separation will not result inthe FQIS system being compliant to 25.901 (c) [25-126] and 25.981 (a)(3) [25-125]. Since the wiring changes area change to type design, but will notbe compliant, an exemption is being petitioned. The FAA's response toa757 NPRM comment suggests that FAA will accept petitions for exemption forthe "latentplus-one" requirements of sections 25.901 (c) and 25.981 (a)(3) ofthe Federal AviationPage 3of7 CP-L4L-15-00233 Regulations, and there has also been FAA communication that this acceptance applies tothe 767. This petition foran exemption is being made since full compliance to these rules for the 767 would require extensive system design/installation changes, butdo not substantially improve the safety ofthe current airplane design, and are economically prohibitive given that the retrofit 767 freighter fleet is limited (with some freighters delivered with NGS), and so extensive system changes are notinthe public's interest. The FQIS system was previously shown compliant to §25.1309 and 25.901 (c)for TC and ATC; however, both §25.901(c) [25-126] and §25.981(a)(3) [25-125] have additional failure combination requirements. For systems that may cause a catastrophic hazard, §25.1309 requires no single failure and no combination of failures greater than extremely improbable; §25.901 (c) [25-126] requires no single failure or probable combination of failures; and §25.981(a)(3) [25-125] requires no single failure, no single plus latent (greater than · extremely remote), and no multiple combination greater than extremely improbable. This exemption is being sought for theno single plus latent (greater than extremely remote) asis stated in §25.981 (a)(3) and interpreted bythe FAA for §25.901 (c). An exemption isalso being sought for the non-environmental aspects of §25.901 (c)

provided by FAA interpretation, and the explicit §25.981 (a)(3) requirements of manufacturing variability, aging, wear, corrosion, and likely damage, as these considerations are already covered by airline maintenance ofthe type design ofthe airplane. Statement of Public Interest:

Without exemption relief for the FQIS & FLSS CWT wiring changes, the intent ofthe

NPRM and the FAA's previous communication of intent for airplane design improvement for the CWT FQIS to address those 767 freighters that do not have Nitrogen Generating System (NGS) cannot be met. For compliance, airplane changes tothe entire Fuel Quantity Indication System (FQIS) (all tanks) and Fuel Level Sensor System (FLSS) (all tanks are affected) would be required for fleet retrofit such as: FQIS:·• New system architecture to redesign the FQPU to function asaHot Short Protector (HSP*) Line Replaceable Unit (LRU) and relocate the FQPU to enable wire separation. Other architectures could be used such as providing aHSP LRU closer tothe tank, butit would bea more extensive and new architecture. • Extensive airplane wiring changes to ensure adequate wire separation throughout the fuel quantity indication system. • In-tank component changes (new brackets, potential need for shorter probes, revised in-:_tank wire harness and retention means). • Software changes related to Fuel Tank Gauging Function and Safety function if shorter probes are required. *A HSP isan LRU thatisalso designed to have the function to protect the tank circuit wiring from Electrical Power Source threats that could affect the airplane circuit wiring ofthe LRU (FQPU).Page 4of7 CP-L4L-15-00233 FLSS:• New system architecture to move the Fuel Level Sensor Control PC Assy intoanew relocated card file. • The PC Assy has not been evaluated to function asaHSP, but due to similarity of design tothe 747-8 FLSS Single Point Sensor Card that has been shown tobeaHSP,itisalso may meet the requirements forits partinthe system, butitmay also may notbe shown

tobeaHSP due tothe circuit differences. • Extensive changes for the new Card File and the wiring changes inall3 tanks to ensure adequate wire separation throughout the fuel level sensing system. • In-tank component changes (new brackets, new probes, revised in-tank wire harness and retention means). The current FQIS system and FLSS has been thoroughly evaluated for safety aspects

as was required per SFAR88 forthe Fuel Quantity Indicating System, however the FAA determined there were safety issues identified with FQIS wiring connected intoahigh flammability tank, forthe 767itisthe CWT. The time needed to successfully design and

implement system changes beyond the proposed CWT FQIS wiring separation design

changes to_ comply with the rules would further impact the availability ofthe wiring

change on this out-of-production fleet of767 airplanes These new complete FQIS and

FLSS design changes would not provide any economic benefit tothe operators and do not provide any significant benefit or increased level of safety. The Boeing Company considers that the granting ofthis exemption would negate the need for FAA to evaluate the additional data required to support compliance with these regulations. Therefore, granting this exemption would reduce the burden on FAA resources and consequently public expenditure.Granting this exemption isinthe public interest forthe aforementioned reasons and will: 1. Enhance the safety ofthe 767 fleet (as has been determined bythe FAA) for those airplanes not installing NGS by adding wiring changes forthe CWT FQIS. 2. Enhance the safety ofthe 767 fleet, by also including FQIS BITE forthe CWT and FLSS circuit interval tests, so that when done in addition with the CWT FQIS and FLSS wiring separation, the airplane addresses the single plus latent failure modes forthe FQIS which was the probable failure combination indicated bythe reference b) NTSB report. Statement ofNo Adverse Effect on Safety. The addition ofthe FQIS CWT wiring changes along witha BITE interval check along with the FLSS wiring changes and circuit interval tests, inlieuofa)afully compliant (all tanks) FQIS (which would have aHSP FQPU LRU, wire separation forthe tank circuit wiring (both outside and inside the tank), and.afault detecting BITE thatis annunciated) andb)afully compliant FLSS which most likely will need a redesigned PC Assy, anew card file, and wire separation inside and outside the tank with new probes, does not have an adverse effect on safety. Inthe proposed CWT FQIS and FLSS wire separation design change, the ignition source threat from other airplane systems is reduced since the wiring will have increased separation. There isalso Instructions for Continued Airworthiness (ICA) that

ensures that any other system changes will continue to maintain the separation provided bythis proposed design change which willbe now clearly be visually identifiedPage 5of7 CP-L4L-15-00233 / as FQIS wiring. Together, this improves the wiring failure modes, and improves the system probability relative tofuel tank ignition. With the addition ofthe FQIS BITE interval checks forthe CWT and FLSS circuit interval tests, the probability is better since the exposure of wiring failures willbe further reduced.

For the CWT FQIS, where the changes tothe FQIS and FLSS are being done instead

ofthe installation of NGS as determined bythe FAA tobean acceptable substitute safety improvement, the combination ofthe separation, the ICA, and the BITE/circuit test addresses no single failures in combination with latent failures with an acceptable level of safety by ensuring the continued integrity of protection features from threats to

the tank circuit wiring. • A- The fault modes ofthein tank wiring have reduced exposure to750 hours duetothe BITE check and FLSS circuit test. Wiring inside the tank iswell protected and hasavery low failure probability which is improved bythe lower exposure. • Bl- The FQPU/FLSS isaHSP upto 28V. Ifalow probability higher voltage power source short were to occur onthe airplane side ofthe FQPU/FLSS PCor within the FQPU/ FLSS PC,it most likely would, but for specific failures may not stopit from propagating through tothe tank circuits, but the failure would atthe least be detectable when the BITE interval check was done, andin most cases sooner, asit wquld most likely affect indication. •B2 -The wiring from the FQPU/FLSS PC Assy (Card File) tothe tank will have separation provided bythe AD mandated SB. This wiring has low probability failure modes which also have reduced exposure provided bythe 750 hour interval BITE check. Whether the failure isA,orBl,orB2, there isno single failure. For the combination of failures, A and Bl,orAand B2, the BITE has reduced the exposure and the latency interval for each protection design feature (wiring has less than extremely remote failure rates) andsothe probability for each failure mode is better than remote. This also addresses the single plus latent failure requirement with an acceptable level of safety asthe probability of either failure onthe

flight before the next interval check would both be better than remote. The 767 FQIS/FLSS was found tobe compliant to §25.901 (c) during airplane type certification and forthe FQIS change in 1992. Since then Boeing has completed the SFAR88 safety assessment and has increased the airplane fuel system safety with installation ofaHot Short Protector (HSP) LRU forthe densitometer. .

Following the SFAR88 system safety assessments, Boeing assessment was that the risks forthe 767 FQIS installation were extremely improbable, which isthe typical industry and CFR §25.1309 standard foran acceptable safety for systems. The Boeing approach to incorporate design changes toadd center wing tank FQIS wire separation with visual identification, a CWT FQIS 750 hour BITE check, along with ICA that ensures that added systems wiring will maintain the separation forthe lifeofthe airplane, and the densitometer tank circuit HSP provided by Boeing SB 767-28A0094, will provide foran enhanced safety margin over the existing, approved FQIS ontheinservice fleet.Request to Waive Publication and Comment:

Since the NPRM 2011-NM-094-AD forthe 757is closely related tothis change asthe

767 issue isthe same, and the NPRM makes mention ofa757 petition for exemption, and has already gone through public commenting process, Boeing respectfully requestsPage 6 of7 CP-L4L-15-00233that the FAA waive the "publication and comment" step inthe process for making afinal decision on this exemption. Additionally, given that the FAA has granted a similar exemption for the 767 production airplanes, reference a), thatis dependent on completing the submittal by December 2015 ofthe retrofit type design change, and the FAA and Boeing have made a rapid schedule for this project, and so duetothe schedule-sensitive nature ofthis request for exemption, Boeing respectfully requests that the FAA waive the "publication and

comment" step inthe process for making afinal decision on this exemption. In addition tothe timeliness concern, itisthe Boeing position that the safety-associated aspects related tothis system have been fully vetted inthe public forum as part ofthe SFAR88 project. Privileges ofthe Exemption Outside the United States: Per 14 CFR 11.81 (h), Boeing requests that the privileges ofthis exemption be extended outside the United States. This extension of privileges is necessary for operations

based within foreign countries having bilateral agreements with the United States accepting FAA 14 CFR part 25as their airworthiness standards for transport category aircraft. Justification for Exemption: In accordance tothe requirements of14 CFR §11.81 (e), the Boeing company has provided a means of compliance tothe FAA to establish an acceptable level of safety to that provided bythe rules 14 CFR §25.901 (c) and 14 CFR §25.981 (a)(3) by separating the FQIS wiring from other airplane power wires that will meet the minimum separation requirements for most ofthe wire runs. For the areas that minimum separation are not achievable dueto space limitation, other positive separation means, such as clamps, spacers and sleeveing willbe used for the CWT FQIS and also including FQIS BITE interval checks for the CWT. The FLSS will include the same type of wiring changes· and include the circuit test. These design changes address the single plus latent failure modes for the FQIS which was the probable failure combination indicated bythe NTSB report, reference b). Therefore, granting this exemption would, in turn, reduce the burden on FAA resources and consequently public expenditure. Conclusion: Boeing is petitioning foran exemption from the provisions of14 CFR 25.901(c)[25-126] and 14 CFR 25.981 (a)(3)[25-125] atthe system level as they apply tothe FQIS/FLSS installed onthe 767-300 (Freighters Only), 767-200/300 BCF airplanes for the FQIS/FLSS wiring changes described above. Sincerely, Q,.i {c£tf:..,. Tim HendrixManager, Certification & Airworthiness Southern California Engineering Design Center Boeing Commercial Airplanes

(562) 593-7074, MC 0800-0022££zoo-g**~**-lvl-d8 LJOLe6ed