1 

ezi--ao.EING 

The Boeing Company 

2401 E. Wardlow Road 

June 22, 2015 

CP-L4L-15-00233 

Long Beach, CA 90807-5309 

,..__, 

= 

U.S. Department of Transportation Docket 

Operations M-30 

._,.., 

C .. 

~ 

;:_!_ 

;_.~~ ~ ·-· :. 

:,-.;.-

1200 New Jersey Avenue, SE r--:~.3. :;_J 

Room W12-140, West Bldg. Ground Floor 

Washington DC 20590-0001 

Ul 

u ;~~;?.~~ =:-:----::~ 

Attention: 

Applicant: 

Subject: 

References: 

FAA Transport Airplane Directorate 

The Boeing Company 

Boeing Commercial Airplanes 

Southern California Engineering Design Center 

2401 E. Wardlow Road, Mail Code D800-0022 

Long Beach, CA 90807-5309 

Contact: Mr. Thomas A. Enyart 

Email: Thomas. a. Enyart@boeing.com 

Phone: (562) 797-8956 

Seal Beach, CA 90740-1515 

.-:.--~ ~--

=-~-;_--:~=-; r-~ ,, -.. Y:J -=---·--"" :::--· 

.t= 4':-

·r 

Petition for Exemption from 14 CFR 25.901(c) Amendment 25-126 and 14 

CFR 25.981(a)(3) Amendment 25-125 pertaining to planned changes for 

the 767-300 (Freighters Only}, 767-200/300 BCF Center Wing Tank 

(CWT) Fuel Quantity Indication System (FQIS) Fuselage Wiring 

Installation. 

a) Exemption No. 10767A, Regulatory Docket No. FAA-2012-1132, 

issued May 4, 2015 

b) NTSB report TWA 800 AAR-00-03 

c) Service Bulletin 767-28-0118, FUEL- Fuel Quantity Indicating System 

(FQIS)- Built-In Test Equipment (BITE) Procedure Test and Fuel Overfill 

Shutoff Surge Tank Sensor Circuit Test, dated July 15, 2014 

Certification Item No: 48144 

The Boeing Company respectfully submits the enclosed Petition for Exemption from the 

Title 14 Code of Federal Regulations §14 CFR 25.901(c) Amendment 25-126 and 14 

CFR 25.981(a)(3) Amendment 25-125 pertaining to planned changes for the 767-300 

(Freighters Only), 767-200/300 BCF Center Wing Tank (CWT) Fuel Quantity Indication 

System (FQIS) and Fuel Overfill Shutoff Surge Tank Fuselage Wiring Installation. 

The Extent of Relief Sought and Reason(s): 

14 CFR 25.901 (c) at Amendment 25-126 requires: 

(c) For each power plant and auxiliary power unit installation, it must be 

established that no single failure or malfunction or probable combination of 

failures will jeopardize the safe operation of the airplane except that the failure of 
Page 2 of7 

CP-L4L-15-00233 

structural elements need not be considered if the probability of such failure is 

extremely remote. 

14 CFR 25.901 (c) Amendment 25-126 Boeing relief is necessary because: Direct 

compliance would require excessive design changes and retrofit of in-service airplanes. 

Changes include the following: Further redesign of the Airplane Wiring System to 

ensure FQIS wire separation for numerous airplane configurations. Make new tank 

penetrations and procure new in-tank wiring harnesses. Modify the Fuel Quantity 

Processor Unit (FQPU) and associated connectors. The solution would require a FQIS 

architecture change to relocate the FQPU and consider Remote Data Connectors 

(RDCs). In-tank component changes (new brackets, potential need for shorter probes, 

revised in-tank wire harness and retention means). Software changes related to Fuel 

Tank Gauging Function (to account for capacitance changes if shorter in-tank probes 

are required). 

14 CFR 25.981(a)(3) at Amendment 25-125 requires: 

(a) No ignition source may be present at each point in the fuel tank or fuel tank 

system where catastrophic failure could occur due to ignition of fuel or vapors. 

This must be shown by: (3) Demonstrating that an ignition source could not result 

from each single failure, from each single failure in combination with each latent 

failure condition not shown to be extremely remote, and from all combinations of 

failures not shown to be extremely improbable. The effects of manufacturing 

variability, aging, wear, corrosion, and likely damage must be considered. 

14 CFR 25.981(a)(3) Amendment 25-125 Boeing relief is necessary because: Same as 

above 

Background 

The FAA is planning to issue a NPRM for the 767 similar to the 757 NPRM 2011-NM094-AD which proposes to require modifying the FQIS wiring or fuel tank systems to 

prevent development of an ignition source inside the center fuel tank. Paragraph (h)(2) 

states: "Within 72 months after the effective date of this AD, modify the airplane by 

separating FQIS wiring that runs between the FQIS processor and the center fuel tank, 

including any circuits that might pass through a main fuel tank, from other airplane 

wiring that is not intrinsically safe." 

Boeing is proposing to accomplish the FAA's planned AD mandated changes to 

separate the FQIS CWT wiring between the FQIS processor and the center fuel tank, as 

well as using the FQIS Built in Test Equipment (BITE) check. In addition, changes to 

. separate the Fuel Overfill Shutoff Surge Tank wiring from the Fuel Level Sensor Control 

PC Assy to the center fuel tank along with its wiring integrity checks will be done. The 

reference c) BITE service bulletin 767-28-0118, which includes the instructions to 

ensure tank circuit wiring integrity, is already approved by the FAA. The CWT FQIS 

wiring separation is being prepared with guidance from the FAA's approved standard for 

retrofit wire separation from FQIS wiring. But the combination of BITE and wire 

separation will not result in the FQIS system being compliant to 25.901 (c) [25-126] and 

25.981 (a)(3) [25-125]. Since the wiring changes are a change to type design, but will 

not be compliant, an exemption is being petitioned. The FAA's response to a 757 

NPRM comment suggests that FAA will accept petitions for exemption for the "latentplus-one" requirements of sections 25.901 (c) and 25.981 (a)(3) of the Federal Aviation 
Page 3 of 7 

CP-L4L-15-00233 

Regulations, and there has also been FAA communication that this acceptance applies 

to the 767. 

This petition for an exemption is being made since full compliance to these rules for the 

767 would require extensive system design/installation changes, but do not substantially 

improve the safety of the current airplane design, and are economically prohibitive given 

that the retrofit 767 freighter fleet is limited (with some freighters delivered with NGS), 

and so extensive system changes are not in the public's interest. The FQIS system was 

previously shown compliant to §25.1309 and 25.901 (c) for TC and ATC; however, both 

§25.901(c) [25-126] and §25.981(a)(3) [25-125] have additional failure combination 

requirements. For systems that may cause a catastrophic hazard, §25.1309 requires no 

single failure and no combination of failures greater than extremely improbable; 

§25.901 (c) [25-126] requires no single failure or probable combination of failures; and 

§25.981(a)(3) [25-125] requires no single failure, no single plus latent (greater than · 

extremely remote), and no multiple combination greater than extremely improbable. 

This exemption is being sought for the no single plus latent (greater than extremely 

remote) as is stated in §25.981 (a)(3) and interpreted by the FAA for §25.901 (c). An 

exemption is also being sought for the non-environmental aspects of §25.901 (c) 

provided by FAA interpretation, and the explicit §25.981 (a)(3) requirements of 

manufacturing variability, aging, wear, corrosion, and likely damage, as these 

considerations are already covered by airline maintenance of the type design of the 

airplane. 

Statement of Public Interest: 

Without exemption relief for the FQIS & FLSS CWT wiring changes, the intent of the 

NPRM and the FAA's previous communication of intent for airplane design improvement 

for the CWT FQIS to address those 767 freighters that do not have Nitrogen Generating 

System (NGS) cannot be met. For compliance, airplane changes to the entire Fuel 

Quantity Indication System (FQIS) (all tanks) and Fuel Level Sensor System (FLSS) (all 

tanks are affected) would be required for fleet retrofit such as: 

FQIS: 

·• New system architecture to redesign the FQPU to function as a Hot Short Protector 

(HSP*) Line Replaceable Unit (LRU) and relocate the FQPU to enable wire separation. 

Other architectures could be used such as providing a HSP LRU closer to the tank, but it 

would be a more extensive and new architecture. 

• Extensive airplane wiring changes to ensure adequate wire separation throughout the 

fuel quantity indication system. 

• In-tank component changes (new brackets, potential need for shorter probes, revised 

in-:_tank wire harness and retention means). 

• Software changes related to Fuel Tank Gauging Function and Safety function if shorter 

probes are required. 

* A HSP is an LRU that is also designed to have the function to protect the tank circuit wiring 

from Electrical Power Source threats that could affect the airplane circuit wiring of the LRU 

(FQPU). 
Page 4 of 7 

CP-L4L-15-00233 

FLSS: 

• New system architecture to move the Fuel Level Sensor Control PC Assy into a new 

relocated card file. 

• The PC Assy has not been evaluated to function as a HSP, but due to similarity of design 

to the 747-8 FLSS Single Point Sensor Card that has been shown to be a HSP, it is also 

may meet the requirements for its part in the system, but it may also may not be shown 

to be a HSP due to the circuit differences. 

• Extensive changes for the new Card File and the wiring changes in all 3 tanks to ensure 

adequate wire separation throughout the fuel level sensing system. 

• In-tank component changes (new brackets, new probes, revised in-tank wire harness 

and retention means). 

The current FQIS system and FLSS has been thoroughly evaluated for safety aspects 

as was required per SFAR88 for the Fuel Quantity Indicating System, however the FAA 

determined there were safety issues identified with FQIS wiring connected into a high 

flammability tank, for the 767 it is the CWT. The time needed to successfully design and 

implement system changes beyond the proposed CWT FQIS wiring separation design 

changes to_ comply with the rules would further impact the availability of the wiring 

change on this out-of-production fleet of 767 airplanes These new complete FQIS and 

FLSS design changes would not provide any economic benefit to the operators and do 

not provide any significant benefit or increased level of safety. The Boeing Company 

considers that the granting of this exemption would negate the need for FAA to evaluate 

the additional data required to support compliance with these regulations. Therefore, 

granting this exemption would reduce the burden on FAA resources and consequently 

public expenditure. 

Granting this exemption is in the public interest for the aforementioned reasons and will: 

1. Enhance the safety of the 767 fleet (as has been determined by the FAA) for those 

airplanes not installing NGS by adding wiring changes for the CWT FQIS. 

2. Enhance the safety of the 767 fleet, by also including FQIS BITE for the CWT and 

FLSS circuit interval tests, so that when done in addition with the CWT FQIS and FLSS 

wiring separation, the airplane addresses the single plus latent failure modes for the 

FQIS which was the probable failure combination indicated by the reference b) NTSB 

report. 

Statement of No Adverse Effect on Safety. 

The addition of the FQIS CWT wiring changes along with a BITE interval check along 

with the FLSS wiring changes and circuit interval tests, in lieu of a) a fully compliant (all 

tanks) FQIS (which would have a HSP FQPU LRU, wire separation for the tank circuit 

wiring (both outside and inside the tank), and. a fault detecting BITE that is annunciated) 

and b) a fully compliant FLSS which most likely will need a redesigned PC Assy, a new 

card file, and wire separation inside and outside the tank with new probes, does not 

have an adverse effect on safety. 

In the proposed CWT FQIS and FLSS wire separation design change, the ignition 

source threat from other airplane systems is reduced since the wiring will have 

increased separation. There is also Instructions for Continued Airworthiness (ICA) that 

ensures that any other system changes will continue to maintain the separation 

provided by this proposed design change which will be now clearly be visually identified 
Page 5 of 7 

CP-L4L-15-00233 

/ 

as FQIS wiring. Together, this improves the wiring failure modes, and improves the 

system probability relative to fuel tank ignition. With the addition of the FQIS BITE 

interval checks for the CWT and FLSS circuit interval tests, the probability is better 

since the exposure of wiring failures will be further reduced. 

For the CWT FQIS, where the changes to the FQIS and FLSS are being done instead 

of the installation of NGS as determined by the FAA to be an acceptable substitute 

safety improvement, the combination of the separation, the ICA, and the BITE/circuit 

test addresses no single failures in combination with latent failures with an acceptable 

level of safety by ensuring the continued integrity of protection features from threats to 

the tank circuit wiring. 

• A- The fault modes of the in tank wiring have reduced exposure to 750 hours due to the BITE 

check and FLSS circuit test. Wiring inside the tank is well protected and has a very low failure 

probability which is improved by the lower exposure. 

• Bl- The FQPU/FLSS is a HSP up to 28V. If a low probability higher voltage power source short 

were to occur on the airplane side of the FQPU/FLSS PC or within the FQPU/ FLSS PC, it most 

likely would, but for specific failures may not stop it from propagating through to the tank 

circuits, but the failure would at the least be detectable when the BITE interval check was done, 

and in most cases sooner, as it wquld most likely affect indication. 

• B2 -The wiring from the FQPU/FLSS PC Assy (Card File) to the tank will have separation provided 

by the AD mandated SB. This wiring has low probability failure modes which also have reduced 

exposure provided by the 750 hour interval BITE check. 

Whether the failure is A, or Bl, or B2, there is no single failure. For the combination of failures, A 

and Bl, or A and B2, the BITE has reduced the exposure and the latency interval for each 

protection design feature (wiring has less than extremely remote failure rates) and so the 

probability for each failure mode is better than remote. This also addresses the single plus latent 

failure requirement with an acceptable level of safety as the probability of either failure on the 

flight before the next interval check would both be better than remote. 

The 767 FQIS/FLSS was found to be compliant to §25.901 (c) during airplane type 

certification and for the FQIS change in 1992. Since then Boeing has completed the 

SFAR88 safety assessment and has increased the airplane fuel system safety with 

installation of a Hot Short Protector (HSP) LRU for the densitometer. . 

Following the SFAR88 system safety assessments, Boeing assessment was that the 

risks for the 767 FQIS installation were extremely improbable, which is the typical 

industry and CFR §25.1309 standard for an acceptable safety for systems. 

The Boeing approach to incorporate design changes to add center wing tank FQIS wire 

separation with visual identification, a CWT FQIS 750 hour BITE check, along with ICA 

that ensures that added systems wiring will maintain the separation for the life of the 

airplane, and the densitometer tank circuit HSP provided by Boeing SB 767-28A0094, 

will provide for an enhanced safety margin over the existing, approved FQIS on the inservice fleet. 

Request to Waive Publication and Comment: 

Since the NPRM 2011-NM-094-AD for the 757 is closely related to this change as the 

767 issue is the same, and the NPRM makes mention of a 757 petition for exemption, 

and has already gone through public commenting process, Boeing respectfully requests 
Page 6 of7 

CP-L4L-15-00233 

that the FAA waive the "publication and comment" step in the process for making a final 

decision on this exemption. 

Additionally, given that the FAA has granted a similar exemption for the 767 production 

airplanes, reference a), that is dependent on completing the submittal by December 

2015 of the retrofit type design change, and the FAA and Boeing have made a rapid 

schedule for this project, and so due to the schedule-sensitive nature of this request for 

exemption, Boeing respectfully requests that the FAA waive the "publication and 

comment" step in the process for making a final decision on this exemption. In addition 

to the timeliness concern, it is the Boeing position that the safety-associated aspects 

related to this system have been fully vetted in the public forum as part of the SFAR88 

project. 

Privileges of the Exemption Outside the United States: 

Per 14 CFR 11.81 (h), Boeing requests that the privileges of this exemption be extended 

outside the United States. This extension of privileges is necessary for operations 

based within foreign countries having bilateral agreements with the United States 

accepting FAA 14 CFR part 25 as their airworthiness standards for transport category 

aircraft. 

Justification for Exemption: 

In accordance to the requirements of 14 CFR §11.81 (e), the Boeing company has 

provided a means of compliance to the FAA to establish an acceptable level of safety to 

that provided by the rules 14 CFR §25.901 (c) and 14 CFR §25.981 (a)(3) by separating 

the FQIS wiring from other airplane power wires that will meet the minimum separation 

requirements for most of the wire runs. For the areas that minimum separation are not 

achievable due to space limitation, other positive separation means, such as clamps, 

spacers and sleeveing will be used for the CWT FQIS and also including FQIS BITE 

interval checks for the CWT. The FLSS will include the same type of wiring changes· 

and include the circuit test. These design changes address the single plus latent failure 

modes for the FQIS which was the probable failure combination indicated by the NTSB 

report, reference b). Therefore, granting this exemption would, in turn, reduce the 

burden on FAA resources and consequently public expenditure. 

Conclusion: 

Boeing is petitioning for an exemption from the provisions of 14 CFR 25.901(c)[25-126] 

and 14 CFR 25.981 (a)(3)[25-125] at the system level as they apply to the FQIS/FLSS 

installed on the 767-300 (Freighters Only), 767-200/300 BCF airplanes for the FQIS/FLSS 

wiring changes described above. 

Sincerely, 

Q,.i {c£tf:..,. 

Tim Hendrix 

Manager, Certification & Airworthiness 

Southern California Engineering Design Center 

Boeing Commercial Airplanes 

(562) 593-7074, MC 0800-0022 
-lvl-d8 ~ ££zoo-g 

e6ed L JO L