Exemption No. 10174

UNITED STATES OF AMERICA 

 DEPARTMENT OF TRANSPORTATION 

 FEDERAL AVIATION ADMINISTRATION 

 RENTON, WASHINGTON 98057-3356

In the matter of the petition of 

The Boeing Company 

for an exemption from § 25.981(a)(3) at 

Amendment 25-102 of Title 14, Code of 

Federal Regulations 

 Regulatory Docket No. FAA-2009-1058

GRANT OF EXEMPTION 

By letter dated November 4, 2009, Mr. Ronald J. Hinderberger, Lead Administrator, The Boeing 

Company, P.O. Box 3707 MC 67-LR, Seattle, WA, 98124-2207, petitioned for an exemption 

from the fuel-tank safety provisions of § 25.981(a)(3), as amended by Amendment 25-102, of 

Title 14, Code of Federal Regulations (14 CFR) as it relates to the structural lightning protection 

of wing fasteners. If granted, the exemption would permit type certification of Boeing Model 

747-8/8F airplanes. 

The petitioner requires relief from the following regulation: 

Section 25.981(a)(3) as amended by Amendment 25-102: 

(a) No ignition source may be present at each point in the fuel tank or fuel tank system 

where catastrophic failure could occur due to ignition of fuel or vapors. This must be 

shown by: 

(3) Demonstrating that an ignition source could not result from each single failure, from 

each single failure in combination with each latent failure condition not shown to be 

extremely remote, and from all combinations of failures not shown to be extremely 

improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely 

damage must be considered. 

The petitioner supports its request with the following information: 

This section presents the relevant information from the petitioner’s request. Complete petition 

information is available at the Department of Transportation’s Federal Docket Management 

System, on the Internet, at http://www.regulations.gov, in docket no. FAA-2009-1058. 
2 

Introduction 

The FAA has issued Policy Memorandum ANM-112-08-002 to address the impracticality 

of compliance to 14 CFR25.981 (a)(3) amt 102 with regards to structural lightning 

protection. 14 CFR 25.981(a)(3) at amendment 25-102 requires: 

(a) No ignition source may be present at each point in the fuel tank or fuel tank system 

where catastrophic failure could occur due to ignition of fuel or vapors. This must be 

shown by: 

(3) Demonstrating that an ignition source could not result from each single failure, from 

each single failure in combination with each latent failure condition not shown to be 

extremely remote, and from all combinations of failures not shown to be extremely 

improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely 

damage must be considered. 

Boeing is petitioning for an exemption to 14 CFR 25.981(a)(3) for fuel tank structural 

lightning protection. The ANM-112-08-002 FAA policy memorandum provides the 

following alternate requirements: 

1. Instead of compliance with the requirements of § 25.981 (a)(3), the applicant must 

show that the design includes at least two independent, effective, and reliable 

lightning protection features (or sets of features) such that fault tolerance to 

prevent lightning-related ignition sources is provided for each area of the 

structural design area proposed to be exempt from the requirements of that 

regulation. Fault tolerance is not required for any specific design feature if: 

a. providing fault tolerance is shown to be impractical for that feature, and 

b. fuel tank vapor ignition because of that feature and all other non-faulttolerant features, when their fuel tank vapor ignition event probabilities 

are summed, is shown to be extremely improbable. 

2. The applicant must perform an analysis to show that the design, manufacturing 

processes, and airworthiness limitations section of the instructions for continued 

airworthiness include all practical measures to prevent, and detect and correct, 

failures of structural lightning protection features because of manufacturing 

variability, aging, wear, corrosion, and likely damage. 

Discussion 

Boeing has concluded that compliance to 14 CFR 25.981(a)(3) for fuel tank structuralfastener lightning protection would require three independent layers of protection. For 

fuel tank fasteners, there are no practical means in current technology to obtain triple 

redundant means of protection in all locations. Another option would be to apply [an] 

inspection interval which monitors the health of each fastener that penetrates the fuel 

tanks. With thousands of fasteners on the wing of the 747-8/8F, this option is impractical. 

Increasing the number of in-tank inspection intervals could also have a potential 

unintended consequence of damaging the lightning protective features or other 

components inside the fuel tanks. 
3 

Proposed Risk Mitigation 

As discussed in the FAA Policy Memo, Boeing will submit detailed Proprietary 

information to the FAA about the measures taken in the 747-8 design to provide practical 

structural lightning protection. In general, the 747-8/8F, lightning protection features are 

based on state-of-the-art industry design practices for aluminum wing structure including 

inherently conductive low resistance current paths that have been used in existing inservice designs. Further, Boeing proposes to enhance the lightning protection by 

incorporating additional fault tolerant protection for fasteners in areas of potential swept 

lightning attachment (referred to as Zone 2) by cap sealing the fasteners to contain a 

possible spark in the event that the primary protective features fail, thereby increasing the 

level of fuel-tank safety. Boeing will demonstrate that the structure in Zone 3 (and Zone 

2) is capable of providing fault-tolerant protection to conducted currents, which is the 

only Zone 3 requirement. 

For pre-Amendment 25-125 airplanes, Boeing will comply with FAR 26.35 and FAR 

26.33. A flammability exposure analysis will be provided similar to the analysis provided 

for the 747-400 showing that the main wing tanks of the 747-8 are either equivalent to the 

conventional unheated aluminum wing tank (reserve and surge tanks) or are below 7% 

fleetwide flammability exposure (inboard and outboard main tanks) per 26.33(c). The 

center tank of the 747-8 utilizes an inerting system to meet the flammability exposure 

criteria of Part 25 Appendix M. Performance will be demonstrated and documentation of 

compliance will be submitted for approval per CP 4288. 

Boeing will show that the structural fastener design for the majority of the model 

747-8/8F wing will have two reliable and effective features for lightning protection. 

Testing will show that the fastener installation will be safe for applicable lightning zone 

requirements and will not produce any sparks inside the fuel tanks. Additionally, Boeing 

will show by test that a cap seal, as a second layer of protection, will contain a spark 

should one occur from a failed fastener. For the limited areas in which a single failure of 

a fastener could result in loss of both protection features, or any other area where a single 

layer of protection is all that can practically be provided, a safety assessment will be done 

to show that the probability of a lightning related fuel tank ignition event is extremely 

improbable. The systems supporting structure will also be analyzed as part of the fault 

tree assessment to ensure that they meet the requirements in the policy memo. 

Additionally, Boeing will utilize production procedures in order to minimize the risk of 

mis-installed protective measures, and to identify and repair errors in such a way that the 

lightning protection features will be maintained. The instructions for continued 

airworthiness and repair procedures will also be provided to ensure the protection 

features are maintained throughout the life of the airplane. 

Boeing has utilized all practical measures to meet the requirements of 14CFR 

25.981(a)(3) for fuel tank structural lightning protection. Boeing has designed the 747-8 

fuel tank structure to be fault tolerant for all but two failure modes as discussed later in 

this section. A detailed FMEA will be provided as part of the compliance documentation. 

A test program to demonstrate fault tolerance has been developed as a part of the 

compliance demonstration. The test plan has been submitted, and the test results will be 

documented for compliance. 
4 

As described in reference (c), the 747-8 design utilizes properly installed structural 

fasteners and cap sealing to provide fault tolerant structural lightning protection. Boeing 

considered additional design features to the fuel tank structure to achieve dual fault 

tolerance for compliance to 14CFR 25.981(a)(3), but these were found either impractical 

to implement or insufficient to provide any additional lightning protection. 

Examples of design considerations were: 

• Conductive steel fasteners – Widespread use results in higher weight, fuel burn 

and associated emissions, and higher risk of corrosion. Design with all steel 

fasteners is still not dual fault tolerant. 

• Additional sealant – Reduces structural inspectability for cracks and corrosion, 

potentially reducing overall fleet safety. Would result in additional weight, fuel 

burn and emissions. 

• Composite skin protection methods – Not applicable to aluminum design. Note 

the majority of these methods are intended to increase conductivity of the outer 

tank surface in the area local to the fastener heads, which aluminum structure 

provides inherently. 

• Fuel tank bladders or double walled fuel tanks – Would result in a new enclosed 

fuel vapor space, which would pose an additional vapor ignition threat during a 

lightning attachment and thus does not increase safety. This would also increase 

weight which increases fuel burn and emissions, plus reduces usable fuel tank 

volume which reduces range. The bladders also inhibit structural inspectability 

inside the tank. 

• Spot Bonds – Spot bond is a local bond in which the primer is removed at the 

internal fastener interface with structure. Removing primer increases corrosion 

risk, detracting from any benefit of increased conductivity offered by the spot 

bond. The spot bonds would still be subject to faults and does not result in a dual 

fault tolerant design. 

• Fastener Free Wing Structure – Structure that does not have any fasteners would 

not be susceptible to lightning protection faults associated with fasteners but is not 

necessarily dual fault tolerant. It is not possible to produce raw materials large 

enough to create monolithic wing panels or spars in dimensions that the 747-8 

requires and monolithic designs would reduce structural crack tolerance. Using 

adhesives instead of fasteners to bond major components represents a radical 

departure from established metallic wing primary structure experience. 

These types of designs were determined to be impractical due [to] lack of safety benefit, 

increased weight, increased fuel burn, increased emissions, and reduced inspectability 

during maintenance. 

Boeing will provide a System Safety Assessment (SSA) as part of compliance for the 

747-8/8F programs. A fault tree analysis will be included in the SSA which will quantify 

the single failures, and demonstrate that the probability of a fuel-vapor ignition in the life 

of the 747-8 fleet is extremely improbable. 
5 

The only faults identified, for which the design is not fault tolerant, are the potential for a 

latent crack in structure or a bolt failure which also causes the fastener nut (or collar) to 

release with sufficient force to tear free the associated cap seal. Note that both of these 

failure modes are identified in the FAA Policy Memo, as typical situations where 

applicants have been unable to identify practical means for fault tolerance. In each of 

these cases, sparking due to these failures would only occur if there was a direct 

attachment to the local area of the failure. Boeing will demonstrate sparking does not 

occur due to these failures during conducted current tests. For both of these failure 

modes, Boeing has been unable to identify a practical alternative to provide a protection 

to the failure mode for direct attachment. A numerical assessment will be provided 

demonstrating the probability of a fuel vapor ignition due to these failures is extremely 

improbable (and thus unlikely to occur in the life of the fleet). Service experience on the 

747-400 shows each of these failures to be rare. The failure rate for fasteners will be 

established using in-service data for fasteners on Boeing airplanes. The expected rate of 

occurrence of structural cracking will be conservatively based on Boeing’s structural 

fatigue methodology. This methodology is based on test and service experience, and 

ensures that the presence of fatigue cracks is minimized during the life of the airplane. 

Boeing has implemented in the design all practical measures for structural [lightning] 

protection. Boeing is currently reviewing the manufacturing processes to ensure the 

lightning protection features are implemented as intended on the drawings and are 

maintained. The repair procedures will be reviewed to ensure the lightning protection 

features will be maintained throughout the life of the airplane. Instructions for Continued 

Airworthiness will be developed and included in the certification documentation. A 

complete analysis of the manufacturing process and repair procedure will be part of the 

System Safety Assessment and submitted for compliance per CP 3308 deliverable 

number 62. 

Issue of Public Interest 

Boeing is working to improve the efficiency of the 747 model by a redesign. The 

747-8/8F has additional capability and capacity over the 747-400 model. For lightning 

protection, the 747-8/8F has additional features to enhance safety and protect the fuel 

tanks from sparking due to a lightning event. All practical measures have been utilized. 

Additional features to directly meet the rule are impractical (as the FAA Policy Memo 

notes) and would potentially add significant cost, weight, and maintenance to the airplane 

without a measurable safety benefit. Further, additional lightning protection features 

could inhibit the ability to inspect the structure (reducing safety). 

Requiring the 747-8/8F to attempt to directly comply with this rule would significantly 

inhibit Boeing’s ability to design and certify the airplane on a competitive schedule. It 

would also render the 747-8/8F to be of lesser value to the public interest with no 

commensurate increase in safety. Many Boeing customers are depending on the 747-8/8F 

to meet their business needs. New 747-8/8F aircraft will typically replace older, less-fuelefficient models, reducing the public expense for fuel consumed in air travel and freight 

delivery. Therefore, Boeing believes that it is in the public interest for the FAA to grant 

this exemption. 
6 

Effect of Exemption on Safety 

With current design practices for lightning protection, Boeing aircraft designs have 

accumulated in excess of 600 million revenue-service flight hours with no lightningrelated events. Prior to these designs and service hours, there were two commercial-jettransport hull-loss events which are believed to have been caused by lightning strikes 

(reference ARAC Report: 1998 ARAC Fuel tank Harmonization Working Group report, 

Task Group 1 Service History / Fuel Tank Safety Level Assessment). The first was in 

1963, which led to the development of lightning-protection standards for fuel tanks. The 

second and last event was in 1976 and also resulted in improvements in fuel tank 

lightning protection. In addition, both events utilized JP-4, which is a wide cut, higher 

volatility fuel rarely used today. The 747-8/8F airplanes will not be certified for use with 

JP-4 or other wide-cut fuels. The hours accumulated since the last event represent over 6 

times the hours accumulated with earlier designs through 1976. The accident-free fleet 

history since 1976 shows current Boeing wing designs have sufficient protection against 

lightning-induced fuel-tank ignition events. 

This safety record, for the fuel system designs upon which the enhanced Boeing 747-8/8F 

design is based, indicates that the proposed fuel-tank lightning protection design of the 

model 747-8/8F will be safe. 

Conclusion 

Boeing is petitioning for an exemption from 14 CFR 25.981(a)(3) at amendment 102 for 

fuel-tank structural lightning protection. The Boeing model 747-8/8F is nearing the end 

of its design and initial build cycle. Granting this exemption will allow Boeing to 

complete its design and certify the 747-8/8F for delivery. The proposed design for the 

747-8/8F will provide an appropriate level of safety against lightning-induced fuel-tank 

ignition, and will be shown to comply with the alternative requirements provided in the 

FAA policy memo ANM-112-08-002.

Federal Register publication 

A summary of this petition was published in the Federal Register on January 20, 2010. The FAA 

received no comments. 

The FAA’s analysis 

In May 2001, the FAA issued the “Transport Airplane Fuel Tank System Design Review, 

Flammability Reduction, and Maintenance & Inspection Requirements” final rule (Docket 

FAA-1999-6411, effective June 6, 2001) that was adopted as Amendment 25-102. This 

amendment added specific ignition-prevention requirements and a new 

flammability-minimization requirement to § 25.981. 

The amended ignition-prevention requirements in § 25.981(a)(3) require consideration of factors 

such as aging, wear, and maintenance errors, as well as the existence of single failures, 

combinations of failures, and latent failures that may be the cause of ignition sources in fuel 

tanks. 

Section 25.981, as amended by Amendment 25-102, requires that airplane designs be protected, 

from the effects of structural lightning, with features that are failure tolerant. Prior to this 
7 

amendment, only § 25.954 had been applied to lightning protection of fuel tanks. That provision 

requires only that the airplane design prevents ignition of vapors in the tank with no 

consideration for anticipated design failures, aging, and wear, or maintenance errors. 

Systems with potentially catastrophic failure modes would typically meet the requirements of 

§ 25.981(a)(3) by providing at least triple redundancy in their protective features with periodic 

inspections, or dual-redundant features with continuous system monitoring to reduce the latency 

period. Dual-redundant design schemes could only comply with § 25.981(a)(3) when combined 

with either regular inspections at very short intervals or a monitoring device to verify the 

functionality of the protective features. Inspection of the various design features may be difficult 

or impossible if the feature is internal to the fuel tank and part of the wing structure. 

When § 25.981 was applied to the structural lightning aspects of new airplane designs, applicants 

found it was impractical to meet the standard and incorporate additional protective features. The 

FAA issued two exemptions and developed new policy. The two exemptions were for the 

Dassault Falcon 7X, issued on April 20, 2007, and the other was for the Hawker 4000, issued on 

August 28, 2008. On May 26, 2009, following a public-comment period, we adopted new policy 

that defined criteria that we would consider regarding granting of exemptions and issuance of 

special conditions for structural lightning protection. Boeing provided substantiation in their 

exemption request that meets the criteria of this policy. 

As it applies to fuel-tank lightning protection for basic airframe structure (airplane skins, joints, 

ribs, spars, stringers, and associated fasteners, brackets, and coatings), the petitioner argues that 

both the addition of a third, independent, ignition-source protective feature, and providing 

sufficient monitoring to detect latent failures in a dual-protective feature, are impractical for 

certain areas of metallic airplane-wing structure. As discussed in the policy memo, the petitioner 

evaluated possible means of providing additional protective features as a condition of this 

exemption and found it was impractical to incorporate those features into the Boeing 747-8/8F. 

Boeing also identified two features through lightning tests and analysis that are not fault tolerant. 

These are the potential for a latent crack in structure, or a bolt failure which also causes the 

fastener nut (or collar) to release with sufficient force to tear free the associated cap seal. Boeing

showed that the probability of fuel-vapor ignition, due to these non-fault-tolerant features, was 

extremely improbable, which satisfies the criteria in the policy memo. 

We agree with the petitioner that compliance with paragraph (a)(3) would require a combination 

of redundant protective features, and a high level of reliability of those features, that is 

excessively expensive to produce and maintain using available technology. Lightning energy can 

be transferred to fuel tanks installed in wings through the many fasteners and other structural 

elements. It is impractical to provide either continuous monitoring of the “health” of the 

protective features for these structures, or to inspect them frequently enough to detect latent 

failures. These features are typically integral to the fuel-tank structure, or internal to the fuel 

tanks, requiring access into the tank to verify the integrity of the feature. Inspections of airplane 

structure requiring fuel-tank entry may be scheduled only once or twice during the life of the 

airplane. 

As discussed in the preamble to Amendment 25-102, conventional, unheated, aluminum wing 

tanks minimize fuel-tank flammability exposure, as required by § 25.981(c). Even if a latent 

failure of a protective feature occurred for such a tank, the risk of lightning-induced fuel-tank 

explosions is relatively low when the tank is fueled with low-volatility fuels such as Jet A, as 
8 

demonstrated by the service experience of these tanks. Because of the impracticality of full 

compliance with § 25.981(a)(3) for lightning protection and the reduced flammability exposure 

of these tanks, we believe granting an exemption is in the public interest if applicants can show 

that their design provides practical dual-protective features for fuel-tank structural lightning 

protection that are both independent and robust, and show the probability of fuel-tank ignition to 

be extremely improbable for any non-fault-tolerant features. 

The Boeing petition states that Boeing will comply with §§ 26.33 and 26.35, proposing 

acceptable flammability-exposure analysis and inerting systems. The wing fuel tanks on the 

747-8/8F are constructed of aluminum and by inspection would meet this fuel-tank flammability 

requirement. Boeing has also prohibited use of JP-4 and other wide-cut fuels to limit 

flammability exposure. The center wing fuel tank on the 747-8/8F has a nitrogen inerting system 

that also must meet this flammability requirement. Therefore, the 747-8/8F will satisfy the 

flammability criteria defined in § 25.981(b) and the policy memo. 

For the wing-skin fasteners of the tanks in Zone 2 (as illustrated in AC 20-53B), Boeing must 

demonstrate that at least two independent and effective means of lightning protection are 

provided and reliably maintained. Boeing proposes lightning-protection features for the 747-8/8F 

based on state-of-the-art, industry-design practices for aluminum wing structures including 

inherently conductive, low-resistance current paths that have been used in existing in-service 

designs. Boeing is enhancing lightning-protection features by incorporating additional faulttolerant protection for fasteners in areas of potential swept-lightning attachment (referred to as 

Zone 2) by cap-sealing the fasteners to contain a possible spark in the event that the primary 

protective features fail, thereby increasing the level of fuel-tank safety. Boeing will also 

demonstrate that the structure in Zone 3 (and Zone 2) is capable of providing fault-tolerant 

protection to conducted currents, which is the only Zone 3 requirement. 

To substantiate the effectiveness of lightning-protection features, Boeing must provide analysis 

and test data. Boeing has agreed to this as part of their petition request. 

In addition to validating independent and effective design means of lightning protection for 

certification on new production airplanes, § 25.981(b) requires establishing critical design 

configuration control limitations (CDCCLs), inspections, and other procedures to prevent the 

development of ignition sources within the fuel-tank system as the airplanes progress through 

their service life. These limitations, inspections, and procedures must be included in the 

Airworthiness Limitations Section of the Instructions for Continued Airworthiness required by 

§ 25.1529. Boeing states that they will provide maintenance information, which will be included 

in the Instructions for Continued Airworthiness. 

Boeing has identified maintenance-inspection tasks with appropriate inspection intervals to 

ensure the needed reliability of proper wing-fastener installation and sealant coverage. These 

actions should maintain the lightning-protection characteristics of these two independent 

protective features. Boeing has identified maintenance-manual procedures that restore the 

protective features to the same level and with the same products and techniques as the original 

design specifications. 

The FAA considers the petitioner’s request to be in the public interest because the Boeing Model 

747-8/8F airplane design provides an acceptable level of safety, and full compliance to 

§ 25.981(a)(3)is impractical. Full compliance would require significant modifications to the fuel-
9 

tank design; introduce additional complexity into the manufacturing and quality process, as well 

as into maintenance procedures that have not been shown to be completely effective; and add 

significant cost and schedule impact to the Boeing Model 747-8/8F airplane program. The 

747-8/8F meets later safety standards, providing improved safety over that of airplanes it is 

replacing in the fleet. In addition, new 747-8/8F aircraft typically will replace older, less-fuelefficient models, reducing the public expense for fuel consumed in air travel and freight delivery. 

In addition, the Boeing Model 747-8/8F airplane type-certification program is near completion. 

Without this exemption, Boeing would not receive design approval for the aircraft in a timely 

manner, delaying upgrading of the fleet safety-and-efficiency improvements. Delay would also 

cause disruption to several major corporations in the US and the world that are anticipating the 

imminent delivery of the Boeing Model 747-8/8F airplane to meet their business needs. 

The FAA has considered the information provided by the petitioner and has determined that it 

has sufficient merit to warrant a grant of exemption. Note that the outcome of the conditions 

associated with the granting of this exemption may affect the regulatory compliance of the 

747-8/8F if analysis, test data, and maintenance information is not provided as stated by the 

petitioner. 

The FAA’s decision 

In consideration of the foregoing, I find that a grant of exemption is in the public interest. 

Therefore, pursuant to the authority contained in 49 U.S.C. §§ 40113 and 44701, delegated to me 

by the Administrator, The Boeing Company is hereby granted an exemption from the 

requirements of 14 CFR § 25.981(a)(3) as it relates to 747-8/8F fuel-tank structural lightning 

protection with the following provisions: 

1. Instead of compliance with the requirements of § 25.981(a)(3), Boeing must show that 

the design includes at least two independent, effective, and reliable lightning-protection 

features (or sets of features) such that fault tolerance to prevent lightning-related ignition 

sources is provided for the structural-fastener design and systems-supporting structure of 

the wing. Fault tolerance is not required for a latent crack in structure, or a bolt failure 

that also causes the fastener nut (or collar) to release with sufficient force to tear free the 

associated cap seal, if: 

a. Boeing shows that providing fault tolerance is impractical, and 

b. Boeing shows that fuel-tank vapor ignition, because of each of these features and 

all other non-fault-tolerant features, when their fuel-tank vapor-ignition event 

probabilities are summed, is extremely improbable. 
10 

2. Boeing must perform an analysis to show that the design, manufacturing processes, and 

airworthiness-limitations section of the instructions for continued airworthiness include 

all practical measures to prevent, and detect and correct, failures of structural lightningprotection features because of manufacturing variability, aging, wear, corrosion, and 

likely damage. 

Issued in Renton, Washington, on December 14, 2010.

 /s/ Ali Bahrami 

Ali Bahrami 

Manager, Transport Airplane Directorate 

Aircraft Certification Service