Enclosure to BDCO-10-03095 Page 1 of 4



# Additional Information to Support Exemption Petition from 14 CFR 25.981(a)(3) for Fuel Tank Structural Lightning

Protection

References:

(a) ANM 112-08-002 Policy on Issuance of Special Condition and Exemptions Related to Lightning Protection of Fuel Tank Structure, 5-26-2009 (b) FAA ANM-112 letter, dated February 26, 2010, c oncerning Boeing request for exemption from 14 CFR 25.981(a)(3) (c) Boeing Letter BDCO-09-05261, “Petition for Ex emption from 14 CFR 25.981(a)(3) Fuel Tank Structural Lightning Protection, dated November 4, 2009



### Discussion:

Boeing is requesting an exemption from 14 CFR 25. 981 for Structural Lightning Protection per the requirements in reference (a) FAA policy memo. Pe r reference (b) FAA letter, the FAA has requested additional information in order to substantiate Boeing’s request for exemption.



### FAA comment 1):

1) For pre-Amendment 25-125 airplanes, the fuel tank flammability standards for the design change will be those required under §§ 26.33 and 26.35 as adopted in Amendment 26-2. No data was provided with your petition.

Boeing response to 1):

Boeing will comply with FAR 26.35 and FAR 26.33. A flammability exposure analysis will be provided similar to the analysis provided for the 747-400 showing that the main wing tanks of the 747-8 are either equivalent to the conventional unheated alumi num wing tank (reserve and surge tanks) or are below 7% fleetwide flammability exposure (inboard and outboard main tanks) per 26.33(c). The center tank of the 747-8 utilizes an inerting system to m eet the flammability exposure criteria of Part 25 Appendix M. Performance will be demonstrated and documentation of compliance will be submitted for approval per CP 4288.



### FAA Comment 2):

2) The petitioner should show that all practical m easures have been taken to meet the requirements of §§ 25.981(a)(3) for the fuel tank structure. For the design features for which an exemption is sought, the petitioner should show what potentially co mpliant design changes were examined, and what design changes were ruled out based on impracticality. Please provide practi cality analysis to support your exemption request.

Boeing Response to 2):

Boeing has utilized all practical measures to meet the requirements of 14CFR 25.981(a)(3) for fuel tank structural lightning protecti on. Boeing has designed the 747-8 f uel tank structure to be fault

tolerant for all but two failure modes as discu ssed in FAA comment 4). A detailed FMEA will be provided as part of the compliance documentation. A test program to demonstr ate fault tolerance hasEnclosure to BDCO-10-03095 Page 2 of 4

been developed as a part of the compliance demonstrat ion. The test plan has been submitted, and the test results will be documented for compliance.

As described in reference (c), the 747-8 design utilizes properly installed structural fasteners and cap sealing to provide fault tolerant structural li ghtning protection. Boeing considered additional design

features to the fuel tank structure to achi eve dual fault tolerance for compliance to 14CFR 25.981(a)(3), but these were found either impractica l to implement or insufficient to provide any additional lightning protection.

Examples of design considerations were:

o Conductive steel fasteners - widespread use resu lts in higher weight, fuel burn and associated emissions, and higher risk of corrosion. Design wi th all steel fasteners is still not dual fault

tolerant.

o Additional sealant – Reduces structural in spectability for cracks and corrosion, potentially reducing overall fleet safety. Would result in additional weight, fuel burn and emissions.

o Composite skin protection methods – Not applicable to aluminum design. Note the majority of

these methods are intended to increas e conductivity of the outer tank surface in the area local to the fastener heads, which aluminum structure provides inherently.

o Fuel tank bladders or double walled fuel tanks – Would result in a new enclosed fuel vapor space, which would pose an additional vapor igni tion threat during a lightning attachment and thus does not increase safety. This would also increase weight which increases fuel burn and emissions, plus reduces usable fuel tank volume which reduces range. The bladders also inhibit structural inspectability inside the tank.

o Spot Bonds – Spot bond is a local bond in which the primer is removed at the internal fastener interface with structure. Removing primer in creases corrosion risk, det racting from any benefit of increased conductivity offered by the spot bond. The spot bonds would still be subject to faults and does not result in a dual fault tolerant design.

o Fastener Free Wing Structure - Structure t hat does not have any fasteners would not be susceptible to lightning protection faults associ ated with fasteners but is not necessarily dual fault tolerant. It is not possible to produce raw materials large enough to create monolithic wing panels or spars in dimensions that the 747- 8 requires and monolithic designs would reduce structural crack tolerance. Using adhesiv es instead of fasteners to bond major components represents a radical departure from established metallic wing primary structure experience.

These types of designs were determined to be impr actical due lack of safety benefit, increased weight, increased fuel burn, increased emissions, and reduced inspectability during maintenance

.



### FAA Comment 3):

3) The policy memo addresses both direct and indirect effects of lightning. The statements in the petition included discussion of features in lightning zone 2. Please pr ovide discussion in your petition regarding lightning protection f eatures in lightning zone 3.

Boeing Response to 3):

Boeing will demonstrate that the stru cture in Zone 3 (and Zone 2) is capable of providing fault tolerantEnclosure to BDCO-10-03095 Page 3 of 4

protection to conducted currents, whic h is the only Zone 3 requirement.



### FAA Comment 4):

4) Instead of compliance with the requirements of § 25.981(a)(3), the applicant must show that the design includes at least two independent, effective, and re liable lightning protection features (or sets of features) such that fault tolerance to prevent li ghtning related ignition sources is provided for each area of the structural design area proposed to be exem pt from the requirements of that regulation. Fault tolerance is not required for any specific design feature if:

a. providing fault tolerance is shown to be impractical for that feature, and

b. fuel tank vapor ignition because of that feat ure and all other non-fault tolerant features, when their fuel tank vapor ignition event probabilit ies are summed, is shown to be extremely improbable.

Please provide the number and location of possible failu res that could cause an ignition source. While submittal of the complete quantitative analysis to support the exemption is not required until the type certification date, qualitative review of these features should be prov ided with the practicality review, noted in #2 above, to support your petition.

Boeing Response to 4)

As discussed in response 2 above, Boeing will provi de a System Safety Assessment (SSA) as part of compliance for the747-8/8F programs. A fault tree analysis will be included in the SSA which will quantify the single failures, and demonstrate the probabilit y of a fuel vapor ignition in the life of the 747-8 fleet is extremely improbable.

The only faults identified for which the design is not f ault tolerant, are the potential for a latent crack in structure or a bolt failure which also causes the fastener nut (or collar) to release with sufficient force to tear free the associated cap seal. Note that both of these failure modes are identified in the FAA Policy Memo, as typical situations where applic ants have been unable to identify practical means for fault tolerance. In each of these cases sparking due to these failures would only occur if there was a

direct attachment to the local area of the failu re. Boeing will demonstrate sparking does not occur due to these failures during conducted current tests. For both of these failure modes, Boeing has been unable to identify a practical alternative to prov ide a protection to the failure mode for direct attachment. A numerical assessment will be provi ded demonstrating the probability of a fuel vapor ignition due to these failures is extremely improbable (and thus unlikely to occur in the life of the fleet). Service experience on the 747-400 shows each of thes e failures to be rare. The failure rate for fasteners will be established using in-service data for fasteners on Boeing airplanes. The expected rate of occurrence of structural cracking will be conservatively based on Boeing’s structural fatigue methodology. This methodology is based on test and service experience, and ensures that the presence of fatigue cracks is minimiz ed during the life of the airplane.



### FAA Comment 5):

5) The applicant must perform an analysis to show that the design, manufacturing processes, and

airworthiness limitations section of the instructions for continued airworthiness include all practical measures to prevent, and detect and correct, failure s of structural lightning protection features because of manufacturing variability, aging, wear , corrosion, and likely damage. Your petition provides a short discussion of the subject but does not state that a complete analysis would be conducted as required by the policy. Pleas e provide a statement to this effect.Enclosure to BDCO-10-03095 Page 4 of 4

Boeing response to 5)

Boeing has implemented in the design all practical m easures for structural li ghting protection. Boeing is currently reviewing the manufacturing processes to ensure the lightning protection features are implemented as intended on the drawings and are maintained. The repair procedures will be reviewed to ensure the lightning protection featur es will be maintained throughout the life of the airplane. Instructions for Continued Airworthi ness will be developed and included in the certification documentation. A complete analysis of the m anufacturing process and repair procedure will be part of the System Safety Assessment and submitted for compliance per CP 3308 deliverable number 62.