Exemption No. 10174

UNITED STATES OF AMERICA

DEPARTMENT OF TRANSPORTATION

FEDERAL AVIATION ADMINISTRATION RENTON, WASHINGTON 98057-3356

In the matter of the petition of

The Boeing Company

for an exemption from § 25.981(a)(3) at Amendment 25-102 of Title 14, Code of Federal Regulations Regulatory Docket No. FAA-2009-1058

GRANT OF EXEMPTION

By letter dated November 4, 2009, Mr. Ronald J. Hin derberger, Lead Administrator, The Boeing Company, P.O. Box 3707 MC 67-LR, Seattle, WA, 98124 -2207, petitioned for an exemption from the fuel-tank safety provisions of § 25.981(a) (3), as amended by Amendment 25-102, of Title 14, Code of Federal Regulations (14 CFR) as i t relates to the structural lightning protection of wing fasteners. If granted, the exemption would permit type certification of Boeing Model 747-8/8F airplanes.

The petitioner requires relief from the following r egulation:

Section 25.981(a)(3) as amended by Amendment 25-102 :

(a) No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignit ion of fuel or vapors. This must be shown by:

(3) Demonstrating that an ignition source could not result from each single failure, from each single failure in combination with each latent failure condition not shown to be extremely remote, and from all combinations of fail ures not shown to be extremely improbable. The effects of manufacturing variabilit y, aging, wear, corrosion, and likely damage must be considered.

The petitioner supports its request with the follow ing information:

This section presents the relevant information from the petitioner’s request. Complete petition information is available at the Department of Trans portation’s Federal Docket Management System, on the Internet, at http://www.regulations. gov, in docket no. FAA-2009-1058.2

Introduction

The FAA has issued Policy Memorandum ANM-112-08-002 to address the impracticality of compliance to 14 CFR25.981 (a)(3) amt 102 with r egards to structural lightning protection. 14 CFR 25.981(a)(3) at amendment 25-102 requires:

(a) No ignition source may be present at each point in the fuel tank or fuel tank system where catastrophic failure could occur due to ignit ion of fuel or vapors. This must be shown by:

(3) Demonstrating that an ignition source could not result from each single failure, from each single failure in combination with each latent failure condition not shown to be extremely remote, and from all combinations of fail ures not shown to be extremely improbable. The effects of manufacturing variabilit y, aging, wear, corrosion, and likely damage must be considered.

Boeing is petitioning for an exemption to 14 CFR 25 .981(a)(3) for fuel tank structural lightning protection. The ANM-112-08-002 FAA policy memorandum provides the following alternate requirements:

1. Instead of compliance with the requirements of § 25 .981 (a)(3), the applicant must show that the design includes at least two independ ent, effective, and reliable lightning protection features (or sets of features) such that fault tolerance to prevent lightning-related ignition sources is provi ded for each area of the structural design area proposed to be exempt from t he requirements of that regulation. Fault tolerance is not required for any specific design feature if:

a. providing fault tolerance is shown to be impractica l for that feature, and

b. fuel tank vapor ignition because of that feature an d all other non-faulttolerant features, when their fuel tank vapor ignit ion event probabilities are summed, is shown to be extremely improbable.

2. The applicant must perform an analysis to show that the design, manufacturing processes, and airworthiness limitations section of the instructions for continued airworthiness include all practical measures to pre vent, and detect and correct, failures of structural lightning protection feature s because of manufacturing variability, aging, wear, corrosion, and likely dam age.

Discussion

Boeing has concluded that compliance to 14 CFR 25.9 81(a)(3) for fuel tank structuralfastener lightning protection would require three i ndependent layers of protection. For fuel tank fasteners, there are no practical means i n current technology to obtain triple redundant means of protection in all locations. Ano ther option would be to apply [an] inspection interval which monitors the health of ea ch fastener that penetrates the fuel tanks. With thousands of fasteners on the wing of t he 747-8/8F, this option is impractical. Increasing the number of in-tank inspection interva ls could also have a potential unintended consequence of damaging the lightning pr otective features or other components inside the fuel tanks.3

Proposed Risk Mitigation

As discussed in the FAA Policy Memo, Boeing will su bmit detailed Proprietary

information to the FAA about the measures taken in the 747-8 design to provide practical structural lightning protection. In general, the 74 7-8/8F, lightning protection features are based on state-of-the-art industry design practices for aluminum wing structure including inherently conductive low resistance current paths that have been used in existing inservice designs. Further, Boeing proposes to enhanc e the lightning protection by incorporating additional fault tolerant protection for fasteners in areas of potential swept lightning attachment (referred to as Zone 2) by cap sealing the fasteners to contain a possible spark in the event that the primary protec tive features fail, thereby increasing the level of fuel-tank safety. Boeing will demonstrate that the structure in Zone 3 (and Zone 2) is capable of providing fault-tolerant protectio n to conducted currents, which is the only Zone 3 requirement.

For pre-Amendment 25-125 airplanes, Boeing will com ply with FAR 26.35 and FAR 26.33. A flammability exposure analysis will be pro vided similar to the analysis provided for the 747-400 showing that the main wing tanks of the 747-8 are either equivalent to the conventional unheated aluminum wing tank (reserve a nd surge tanks) or are below 7% fleetwide flammability exposure (inboard and outboa rd main tanks) per 26.33(c). The center tank of the 747-8 utilizes an inerting syste m to meet the flammability exposure criteria of Part 25 Appendix M. Performance will be demonstrated and documentation of compliance will be submitted for approval per CP 42 88.

Boeing will show that the structural fastener desig n for the majority of the model 747-8/8F wing will have two reliable and effective features for lightning protection. Testing will show that the fastener installation wi ll be safe for applicable lightning zone requirements and will not produce any sparks inside the fuel tanks. Additionally, Boeing will show by test that a cap seal, as a second laye r of protection, will contain a spark

should one occur from a failed fastener. For the li mited areas in which a single failure of a fastener could result in loss of both protection features, or any other area where a single layer of protection is all that can practically be provided, a safety assessment will be done to show that the probability of a lightning related fuel tank ignition event is extremely improbable. The systems supporting structure will a lso be analyzed as part of the fault tree assessment to ensure that they meet the requir ements in the policy memo. Additionally, Boeing will utilize production proced ures in order to minimize the risk of mis-installed protective measures, and to identify and repair errors in such a way that the lightning protection features will be maintained. T he instructions for continued airworthiness and repair procedures will also be pr ovided to ensure the protection features are maintained throughout the life of the airplane.

Boeing has utilized all practical measures to meet the requirements of 14CFR 25.981(a)(3) for fuel tank structural lightning pro tection. Boeing has designed the 747-8

fuel tank structure to be fault tolerant for all bu t two failure modes as discussed later in this section. A detailed FMEA will be provided as p art of the compliance documentation. A test program to demonstrate fault tolerance has b een developed as a part of the compliance demonstration. The test plan has been su bmitted, and the test results will be documented for compliance.4

As described in reference (c), the 747-8 design uti lizes properly installed structural fasteners and cap sealing to provide fault tolerant structural lightning protection. Boeing considered additional design features to the fuel t ank structure to achieve dual fault tolerance for compliance to 14CFR 25.981(a)(3), but these were found either impractical to implement or insufficient to provide any additio nal lightning protection.

Examples of design considerations were:

• Conductive steel fasteners – Widespread use results in higher weight, fuel burn and associated emissions, and higher risk of corros ion. Design with all steel

fasteners is still not dual fault tolerant.

• Additional sealant – Reduces structural inspectabil ity for cracks and corrosion, potentially reducing overall fleet safety. Would re sult in additional weight, fuel

burn and emissions.

• Composite skin protection methods – Not applicable to aluminum design. Note the majority of these methods are intended to incre ase conductivity of the outer

tank surface in the area local to the fastener head s, which aluminum structure provides inherently.

• Fuel tank bladders or double walled fuel tanks – Wo uld result in a new enclosed fuel vapor space, which would pose an additional va por ignition threat during a lightning attachment and thus does not increase saf ety. This would also increase weight which increases fuel burn and emissions, plu s reduces usable fuel tank volume which reduces range. The bladders also inhib it structural inspectability

inside the tank.

• Spot Bonds – Spot bond is a local bond in which the primer is removed at the

internal fastener interface with structure. Removin g primer increases corrosion risk, detracting from any benefit of increased cond uctivity offered by the spot bond. The spot bonds would still be subject to faul ts and does not result in a dual fault tolerant design.

• Fastener Free Wing Structure – Structure that does not have any fasteners would not be susceptible to lightning protection faults a ssociated with fasteners but is not necessarily dual fault tolerant. It is not possible to produce raw materials large enough to create monolithic wing panels or spars in dimensions that the 747-8 requires and monolithic designs would reduce struct ural crack tolerance. Using adhesives instead of fasteners to bond major compon ents represents a radical departure from established metallic wing primary st ructure experience.

These types of designs were determined to be imprac tical due [to] lack of safety benefit, increased weight, increased fuel burn, increased em issions, and reduced inspectability during maintenance.

Boeing will provide a System Safety Assessment (SSA ) as part of compliance for the 747-8/8F programs. A fault tree analysis will be in cluded in the SSA which will quantify the single failures, and demonstrate that the proba bility of a fuel-vapor ignition in the life of the 747-8 fleet is extremely improbable.5

The only faults identified, for which the design is not fault tolerant, are the potential for a

latent crack in structure or a bolt failure which a lso causes the fastener nut (or collar) to

release with sufficient force to tear free the asso ciated cap seal. Note that both of these failure modes are identified in the FAA Policy Memo , as typical situations where applicants have been unable to identify practical m eans for fault tolerance. In each of these cases, sparking due to these failures would o nly occur if there was a direct attachment to the local area of the failure. Boeing will demonstrate sparking does not occur due to these failures during conducted curren t tests. For both of these failure modes, Boeing has been unable to identify a practic al alternative to provide a protection

to the failure mode for direct attachment. A numeri cal assessment will be provided demonstrating the probability of a fuel vapor ignit ion due to these failures is extremely improbable (and thus unlikely to occur in the life of the fleet). Service experience on the

747-400 shows each of these failures to be rare. Th e failure rate for fasteners will be established using in-service data for fasteners on Boeing airplanes. The expected rate of occurrence of structural cracking will be conservat ively based on Boeing’s structural fatigue methodology. This methodology is based on t est and service experience, and ensures that the presence of fatigue cracks is mini mized during the life of the airplane.

Boeing has implemented in the design all practical measures for structural [lightning] protection. Boeing is currently reviewing the manuf acturing processes to ensure the lightning protection features are implemented as in tended on the drawings and are maintained. The repair procedures will be reviewed to ensure the lightning protection features will be maintained throughout the life of the airplane. Instructions for Continued Airworthiness will be developed and included in the certification documentation. A complete analysis of the manufacturing process and repair procedure will be part of the System Safety Assessment and submitted for complian ce per CP 3308 deliverable

number 62.

Issue of Public Interest

Boeing is working to improve the efficiency of the 747 model by a redesign. The 747-8/8F has additional capability and capacity ove r the 747-400 model. For lightning protection, the 747-8/8F has additional features to enhance safety and protect the fuel tanks from sparking due to a lightning event. All p ractical measures have been utilized. Additional features to directly meet the rule are i mpractical (as the FAA Policy Memo notes) and would potentially add significant cost, weight, and maintenance to the airplane without a measurable safety benefit. Further, addit ional lightning protection features could inhibit the ability to inspect the structure (reducing safety).

Requiring the 747-8/8F to attempt to directly compl y with this rule would significantly inhibit Boeing’s ability to design and certify the airplane on a competitive schedule. It

would also render the 747-8/8F to be of lesser valu e to the public interest with no commensurate increase in safety. Many Boeing custom ers are depending on the 747-8/8F

to meet their business needs. New 747-8/8F aircraft will typically replace older, less-fuelefficient models, reducing the public expense for f uel consumed in air travel and freight delivery. Therefore, Boeing believes that it is in the public interest for the FAA to grant this exemption.6

Effect of Exemption on Safety

With current design practices for lightning protect ion, Boeing aircraft designs have

accumulated in excess of 600 million revenue-servic e flight hours with no lightningrelated events. Prior to these designs and service hours, there were two commercial-jettransport hull-loss events which are believed to ha ve been caused by lightning strikes (reference ARAC Report: 1998 ARAC Fuel tank Harmoni zation Working Group report, Task Group 1 Service History / Fuel Tank Safety Lev el Assessment). The first was in 1963, which led to the development of lightning-pro tection standards for fuel tanks. The

second and last event was in 1976 and also resulted in improvements in fuel tank lightning protection. In addition, both events util ized JP-4, which is a wide cut, higher volatility fuel rarely used today. The 747-8/8F air planes will not be certified for use with

JP-4 or other wide-cut fuels. The hours accumulated since the last event represent over 6 times the hours accumulated with earlier designs th rough 1976. The accident-free fleet history since 1976 shows current Boeing wing design s have sufficient protection against lightning-induced fuel-tank ignition events.

This safety record, for the fuel system designs upo n which the enhanced Boeing 747-8/8F design is based, indicates that the proposed fuel-t ank lightning protection design of the

model 747-8/8F will be safe.

Conclusion

Boeing is petitioning for an exemption from 14 CFR 25.981(a)(3) at amendment 102 for fuel-tank structural lightning protection. The Boei ng model 747-8/8F is nearing the end of its design and initial build cycle. Granting thi s exemption will allow Boeing to complete its design and certify the 747-8/8F for de livery. The proposed design for the 747-8/8F will provide an appropriate level of safet y against lightning-induced fuel-tank ignition, and will be shown to comply with the alte rnative requirements provided in the FAA policy memo ANM-112-08-002.

Federal Register publication

A summary of this petition was published in the Federal Register on January 20, 2010. The FAA

received no comments.

The FAA’s analysis

In May 2001, the FAA issued the “Transport Airplane Fuel Tank System Design Review, Flammability Reduction, and Maintenance & Inspectio n Requirements” final rule (Docket FAA-1999-6411, effective June 6, 2001) that was ado pted as Amendment 25-102. This amendment added specific ignition-prevention requir ements and a new flammability-minimization requirement to § 25.981.

The amended ignition-prevention requirements in § 2 5.981(a)(3) require consideration of factors such as aging, wear, and maintenance errors, as wel l as the existence of single failures, combinations of failures, and latent failures that may be the cause of ignition sources in fuel

tanks.

Section 25.981, as amended by Amendment 25-102, req uires that airplane designs be protected, from the effects of structural lightning, with feat ures that are failure tolerant. Prior to this7

amendment, only § 25.954 had been applied to lightn ing protection of fuel tanks. That provision requires only that the airplane design prevents ign ition of vapors in the tank with no consideration for anticipated design failures, agin g, and wear, or maintenance errors.

Systems with potentially catastrophic failure modes would typically meet the requirements of § 25.981(a)(3) by providing at least triple redunda ncy in their protective features with periodic inspections, or dual-redundant features with contin uous system monitoring to reduce the latency period. Dual-redundant design schemes could only co mply with § 25.981(a)(3) when combined with either regular inspections at very short inter vals or a monitoring device to verify the functionality of the protective features. Inspectio n of the various design features may be difficult or impossible if the feature is internal to the fue l tank and part of the wing structure.

When § 25.981 was applied to the structural lightni ng aspects of new airplane designs, applicants found it was impractical to meet the standard and i ncorporate additional protective features. The FAA issued two exemptions and developed new policy. The two exemptions were for the Dassault Falcon 7X, issued on April 20, 2007, and t he other was for the Hawker 4000, issued on August 28, 2008. On May 26, 2009, following a publi c-comment period, we adopted new policy that defined criteria that we would consider regard ing granting of exemptions and issuance of special conditions for structural lightning protect ion. Boeing provided substantiation in their exemption request that meets the criteria of this p olicy.

As it applies to fuel-tank lightning protection for basic airframe structure (airplane skins, joints, ribs, spars, stringers, and associated fasteners, b rackets, and coatings), the petitioner argues that both the addition of a third, independent, ignition -source protective feature, and providing sufficient monitoring to detect latent failures in a dual-protective feature, are impractical for certain areas of metallic airplane-wing structure. As discussed in the policy memo, the petitioner evaluated possible means of providing additional pr otective features as a condition of this exemption and found it was impractical to incorpora te those features into the Boeing 747-8/8F. Boeing also identified two features through lightni ng tests and analysis that are not fault tolerant. These are the potential for a latent crack in struc ture, or a bolt failure which also causes the fastener nut (or collar) to release with sufficient force to tear free the associated cap seal. Boeing showed that the probability of fuel-vapor ignition, due to these non-fault-tolerant features, was extremely improbable, which satisfies the criteria in the policy memo.

We agree with the petitioner that compliance with p aragraph (a)(3) would require a combination of redundant protective features, and a high level of reliability of those features, that is excessively expensive to produce and maintain using available technology. Lightning energy can be transferred to fuel tanks installed in wings thr ough the many fasteners and other structural elements. It is impractical to provide either conti nuous monitoring of the “health” of the protective features for these structures, or to ins pect them frequently enough to detect latent failures. These features are typically integral to the fuel-tank structure, or internal to the fuel tanks, requiring access into the tank to verify the integrity of the feature. Inspections of airplane structure requiring fuel-tank entry may be schedule d only once or twice during the life of the airplane.

As discussed in the preamble to Amendment 25-102, c onventional, unheated, aluminum wing tanks minimize fuel-tank flammability exposure, as required by § 25.981(c). Even if a latent failure of a protective feature occurred for such a tank, the risk of lightning-induced fuel-tank explosions is relatively low when the tank is fuele d with low-volatility fuels such as Jet A, as8

demonstrated by the service experience of these tan ks. Because of the impracticality of full compliance with § 25.981(a)(3) for lightning protec tion and the reduced flammability exposure of these tanks, we believe granting an exemption is in the public interest if applicants can show that their design provides practical dual-protectiv e features for fuel-tank structural lightning protection that are both independent and robust, an d show the probability of fuel-tank ignition to be extremely improbable for any non-fault-tolerant features.

The Boeing petition states that Boeing will comply with §§ 26.33 and 26.35, proposing acceptable flammability-exposure analysis and inert ing systems. The wing fuel tanks on the 747-8/8F are constructed of aluminum and by inspect ion would meet this fuel-tank flammability requirement. Boeing has also prohibited use of JP-4 and other wide-cut fuels to limit flammability exposure. The center wing fuel tank on the 747-8/8F has a nitrogen inerting system that also must meet this flammability requirement. Therefore, the 747-8/8F will satisfy the flammability criteria defined in § 25.981(b) and th e policy memo.

For the wing-skin fasteners of the tanks in Zone 2 (as illustrated in AC 20-53B), Boeing must demonstrate that at least two independent and effec tive means of lightning protection are provided and reliably maintained. Boeing proposes l ightning-protection features for the 747-8/8F based on state-of-the-art, industry-design practice s for aluminum wing structures including inherently conductive, low-resistance current paths that have been used in existing in-service designs. Boeing is enhancing lightning-protection features by incorporating additional faulttolerant protection for fasteners in areas of poten tial swept-lightning attachment (referred to as Zone 2) by cap-sealing the fasteners to contain a p ossible spark in the event that the primary protective features fail, thereby increasing the le vel of fuel-tank safety. Boeing will also demonstrate that the structure in Zone 3 (and Zone 2) is capable of providing fault-tolerant protection to conducted currents, which is the only Zone 3 requirement.

To substantiate the effectiveness of lightning-prot ection features, Boeing must provide analysis and test data. Boeing has agreed to this as part of their petition request.

In addition to validating independent and effective design means of lightning protection for certification on new production airplanes, § 25.981 (b) requires establishing critical design configuration control limitations (CDCCLs), inspect ions, and other procedures to prevent the development of ignition sources within the fuel-tan k system as the airplanes progress through their service life. These limitations, inspections, and procedures must be included in the

Airworthiness Limitations Section of the Instructio ns for Continued Airworthiness required by § 25.1529. Boeing states that they will provide mai ntenance information, which will be included

in the Instructions for Continued Airworthiness.

Boeing has identified maintenance-inspection tasks with appropriate inspection intervals to ensure the needed reliability of proper wing-fasten er installation and sealant coverage. These actions should maintain the lightning-protection ch aracteristics of these two independent protective features. Boeing has identified maintena nce-manual procedures that restore the protective features to the same level and with the same products and techniques as the original design specifications.

The FAA considers the petitioner’s request to be in the public interest because the Boeing Model 747-8/8F airplane design provides an acceptable lev el of safety, and full compliance to § 25.981(a)(3)is impractical. Full compliance would require significant modifications to the fuel-9

tank design; introduce additional complexity into t he manufacturing and quality process, as well as into maintenance procedures that have not been s hown to be completely effective; and add significant cost and schedule impact to the Boeing Model 747-8/8F airplane program. The 747-8/8F meets later safety standards, providing im proved safety over that of airplanes it is replacing in the fleet. In addition, new 747-8/8F a ircraft typically will replace older, less-fuelefficient models, reducing the public expense for f uel consumed in air travel and freight delivery. In addition, the Boeing Model 747-8/8F airplane typ e-certification program is near completion. Without this exemption, Boeing would not receive de sign approval for the aircraft in a timely manner, delaying upgrading of the fleet safety-and- efficiency improvements. Delay would also cause disruption to several major corporations in t he US and the world that are anticipating the imminent delivery of the Boeing Model 747-8/8F airp lane to meet their business needs.

The FAA has considered the information provided by the petitioner and has determined that it has sufficient merit to warrant a grant of exemptio n. Note that the outcome of the conditions associated with the granting of this exemption may affect the regulatory compliance of the 747-8/8F if analysis, test data, and maintenance in formation is not provided as stated by the petitioner.

The FAA’s decision

In consideration of the foregoing, I find that a gr ant of exemption is in the public interest. Therefore, pursuant to the authority contained in 4 9 U.S.C. §§ 40113 and 44701, delegated to me by the Administrator, The Boeing Company is hereby granted an exemption from the requirements of 14 CFR § 25.981(a)(3) as it relates to 747-8/8F fuel-tank structural lightning protection with the following provisions:

1. Instead of compliance with the requirements of § 25 .981(a)(3), Boeing must show that the design includes at least two independent, effec tive, and reliable lightning-protection features (or sets of features) such that fault tole rance to prevent lightning-related ignition sources is provided for the structural-fastener des ign and systems-supporting structure of the wing. Fault tolerance is not required for a la tent crack in structure, or a bolt failure that also causes the fastener nut (or collar) to re lease with sufficient force to tear free the associated cap seal, if:

a. Boeing shows that providing fault tolerance is impr actical, and

b. Boeing shows that fuel-tank vapor ignition, because of each of these features and all other non-fault-tolerant features, when their f uel-tank vapor-ignition event probabilities are summed, is extremely improbable.10

2. Boeing must perform an analysis to show that the de sign, manufacturing processes, and

airworthiness-limitations section of the instructio ns for continued airworthiness include all practical measures to prevent, and detect and c orrect, failures of structural lightningprotection features because of manufacturing variab ility, aging, wear, corrosion, and likely damage.

Issued in Renton, Washington, on December 14, 2010.

/s/ Ali Bahrami

Ali Bahrami Manager, Transport Airplane Directorate

Aircraft Certification Service