UNITED STATES OF AMERICA 

DEPARTMENT OF TRANSPORTATION 

FEDERAL AVIATION ADMINISTRATION 

RENTON, WASHINGTON 98057-3356 

In the matter of the petition of 

Exemption No. 17021 

The Boeing Company Regulatory Docket No. FAA-2014-1042 

for an exemption from§ 25.981(a)(3) of 

Title 14, Code ofFederal Regulations 

GRANT OF EXEMPTION 

By letter dated December 12,2014, Mr. Douglas M. Lane, Director of Commercial Airplanes, 

The Boeing Company, P.O. Box 3707, MC 03-56, Seattle, Washington, 98124-2207, petitioned 

the Federal Aviation Administration (FAA) for an exemption from the requirements of 

§ 25.981(a)(3) ofTitle 14, Code ofFederal Regulations (14 CFR). This exemption, if granted, 

would allow Boeing to use the requirements ofF AA Policy Statement PS-ANM -25.981-02, 

Policy on Issuance of Special Conditions and Exemptions Related to Lightning Protection of 

Fuel Tank Structure and Systems, for fuel tank structural lightning protection for the Model 

737-7, 737-8, and 737-9 airplanes (737 MAX) as an alternative to full compliance to 

§ 25.981(a)(3). 

The petitioner requests relief from the following regulation: 

Section 25.981(a)(3), at Amendment 25-125, states that no ignition source may be 

present at each point in the fuel tank or fuel tank system where catastrophic failure could 

occur due to ignition of fuel or vapors. This must be shown by demonstrating that an 

ignition source could not result from each single failure, from each single failure in 

combination with each latent failure condition not shown to be extremely remote, and 

from all combinations of failures not shown to be extremely improbable. The effects of 

manufacturing variability, aging, wear, corrosion, and likely damage must be considered. 

The petitioner supports its request with the following information: 

This section quotes the relevant information from the petitioner's request, with minor edits for 

clarity. The complete petition is available at the Department of Transportation's Federal Docket 

Management System, on the Internet at http://regulations.gov, in Docket No. FAA-2014-1042. 
Description of Issue 

Boeing is petitioning for an exemption to 14 CFR 25.981(a)(3) for fuel tank structural 

lightning protection for the 737-8 (Project Number PS 12-0038). The petition is also 

requested for the 737-7 (Project Number PS12-0037) and 737-9 (Project Number PS12-

003 9). The references to the 73 7 MAX in this document refer to the 73 7-7, 73 7-8, and 

737-9 models. The subject regulation section is unchanged between Amendment level 

102 and 125. The FAA Policy Statement PS-ANM-25.981-02 provides the following 

alternate requirements: 

1) The fuel tank structure and systems must be designed and installed to prevent 

catastrophic fuel vapor ignition due to lightning. 

2) The fuel tank structure and systems lightning protection design must be fault tolerant 

for failures that result in lightning-related ignition sources. 

3) Fault tolerance is not required for any specific design feature if: 

a) Fault tolerance is shown to be impractical for that feature; and 

b) Fuel tan."'<: vapor ignition because of that feature and all other non-fault-tolerant 

features, when their fuel tank vapor ignition event probabilities are combined, is 

shown to be extremely improbable. 

Note: FAA Policy Statement PS-ANM-25.981-02 defines "Practicality" as a balance of 

available means, economic viability, and proportional benefit to safety. 

4) Inspections or other procedures must be established to prevent development of 

lightning-related ignition sources within the fuel tank structure and systems, for 

example: 

a) Identifying as airworthiness limitations, mandatory maintenance actions (i.e., 

inspections), or critical design configuration control limitations (CDCCL), 

necessary to preclude the development of unsafe conditions due to non-faulttolerant lightning protection features; 

b) Including sampling programs, maintenance, and/or inspections for fault-tolerant 

lightning protection features in the manufacturer's recommended airplane 

maintenance program; 

Note: If inspections from non-mandatory programs such as Baseline Zonal inspection 

program, Corrosion Prevention and Control Program (CPCP), etc., are going to be used to 

support the robustness of the overall inspection program, these programs must become 

mandatory and must be included in the Airworthiness Limitations section of the 

airplane's Instructions for Continued Airworthiness. 

2 
c) Incorporating into applicable airplane maintenance documents, including the 

manufacturer's structural repair manual, caution information that identifies the 

lightning protection features of the fuel system design to minimize the potential 

for inadvertent damage or disruption of these features. 

5) An analysis must be performed to show that the airplane's design, its manufacturing 

processes, and the Airworthiness Limitations section of its Instructions for Continued 

Airworthiness include all practical measures to prevent, and detect and correct, 

failures of fuel tank structure and systems lightning protection features because of 

manufacturing variability, aging, wear, corrosion, and likely damage. 

Discussion 

Boeing has concluded that there are no practical means utilizing current technology to 

obtain triple redundant means of fuel tank structural fastener lightning protection in all 

locations. For example, one impractical option would be to apply an inspection interval 

which monitors the health of each fastener that penetrates the fuel tanks. With thousands 

of fasteners on the wing of the 73 7 MAX, and the inability to visually inspect most means 

of protection, this option is impractical. Increasing the number of in-tank inspection 

intervals could also have a potential unintended consequence of damaging the ignition 

protective features or other components inside the fuel tanks. 

Examples of additional design considerations, found to be impractical, were: 

• Conductive steel fasteners: Widespread use results in higher weight, fuel burn 

and associated emissions, and higher risk of corrosion. Design with all steel 

fasteners is still not dual fault tolerant. 

• Additional sealant on bolt locations already sealed: Reduces structural 

inspectability for cracks and corrosion, potentially reducing overall fleet safety. 

Would result in additional weight, fuel burn and emissions. 

• Composite skin protection methods: Not applicable to aluminum design. Note 

the majority of these methods are intended to increase conductivity of the outer 

tank surface in the area local to the fastener heads, which aluminum structure 

provides inherently. 

• Fuel tank bladders or double walled fuel tanks: Would result in a new enclosed 

fuel vapor space, which would pose an additional vapor ignition threat during a 

lightning attachment and thus does not increase safety. This would also increase 

weight which increases fuel burn and emissions, plus reduces usable fuel tank 

volume which reduces range. The bladders also inhibit structural inspectability 

inside the tank. 

• Spot bonds: Spot bond is a local bond in which the primer is removed at the 

internal fastener interface with structure. Removing primer increases corrosion 

risk, detracting from any benefit of increased conductivity offered by the spot 

3 
bond. The spot bonds would still be subject to faults and do not result in a dual 

fault tolerant design. 

• Fastener Free Wing Structure: Structure that does not have any fasteners would 

not be susceptible to lightning protection faults associated with fasteners but is not 

necessarily dual fault tolerant. It is not possible to produce raw materials large 

enough to create monolithic wing panels or spars in dimensions that the 73 7 MAX 

requires. Also, monolithic designs would reduce structural crack tolerance. 

Using adhesives instead of fasteners to bond major components represents a 

radical departure from established metallic wing primary structure experience. 

These types of designs were determined to be impractical because some are not possible 

within the current state of the art; others introduce more risk than mitigated, and because 

the design is safe without them. 

In addition, adding sealant over 1!4 inch and larger rivets was determined to be impractical 

due to lack of proportional safety benefit, increased weight, increased fuel bum, increased 

emissions, and reduced inspectability during maintenance. Boeing has assessed the 

likelihood oflightning attachment to a faulted rivet during flammable tank conditions, 

and concluded this combination is not expected to occur in the life of the fleet. 

Regardless of this probabilistic conclusion, Boeing has performed development testing 

(will repeat for compliance) of rivet installations representative of the 737 design and 

demonstrated that even with faults present, the installations will not cause an ignition 

source during severe direct lightning attachments. Since the design is already safe during 

this combination of conditions that are unlikely to occur in the life of the fleet, Boeing 

concluded that further mitigation (i.e., covering 1!4 inch and larger rivets with sealant) 

would not provide a commensurate safety benefit to the public considering the significant 

weight and associated fuel costs, plus carbon emissions, aircraft production costs, and 

operator maintenance cost impacts. Additional detailed proprietary information has been 

provided to the FAA via Boeing letter RA-14-05275. 

The only faults currently identified for which the design is not fault tolerant are: 

1. The potential for a crack in structure, or 

2. A bolt failure that also causes the fastener nut (or collar) to release with sufficient 

force to tear free the associated cap seal. 

Both of these failure modes are identified in the FAA Policy Statement as typical 

situations where applicants have been unable to identifY practical means for fault 

tolerance. In each of these cases, sparking due to these failures would only occur if there 

was a direct attachment to the local area of the failure. An assessment will be provided 

demonstrating that the risk of a fuel vapor ignition due to the sum of these failures is not 

anticipated in the life of the fleet. 

4 
Proposed Risk Mitigation 

As discussed in FAA Policy Statement PS-ANM-25.981-02, Boeing will submit detailed 

proprietary information to the FAA about the measures taken in the 73 7 MAX design to 

provide practical structural lightning protection. In general, the 73 7 MAX lightning 

protection features are based on state of the art industry design practices for aluminum 

wing structure including inherent current paths that have been used in existing in-service 

designs. Further, Boeing proposes to enhance the lightning protection by incorporating 

fault tolerant protection means where practical, thereby increasing the level of fuel tank 

safety. 

Boeing will comply with 14 CFR 25.981(b) at Amendment 25-125. A flammability 

exposure assessment will be provided showing that the 73 7 MAX main tanks are low 

flammability exposure tanks equivalent to a conventional unheated aluminum main wing. 

In addition, the center wing tank of the 73 7 MAX will utilize an inerting system designed 

to meet the flammability exposure criteria of appendix M to part 25. The aspects ofNGS 

[nitrogen generation system] performance with respect to compliance to 14 CFR 25.981 

are covered in the 737 MAX Fuel System Installation Certification Plan. 

Boeing will provide the following with respect to each of the five policy requirements: 

Policy Requirement 1 - Prevent catastrophic fuel vapor ignition due to 

lightning: 

In summary, Boeing will implement in the design all practical measures for fault 

tolerant structural lightning protection. Boeing will utilize manufacturing 

processes to minimize the risk of errors in aircraft manufacturing which could 

affect the lightning protection features. Structural repair manual procedures will 

be provided to retain the lightning protection features throughout the life of the 

airplane. Instructions for Continued Airworthiness, including CDCCLs, will be 

developed and included in the certification documentation. A complete analysis 

of the manufacturing process and repair procedure will be part of the Fuel System 

Lightning Protection System Safety Assessment. 

Policy Requirement 2 - Provide fault tolerant lightning protection: 

Boeing will show that where practical the structural fastener and joint designs for 

the Model 73 7 MAX wing will provide fault tolerant lightning protection. A 

detailed failure mode and effects analysis (FMEA), including a qualitative 

assessment of all known and hypothetical failure modes, will be provided as part 

of the compliance documentation. Analysis, design review, and use of existing 

test data will be the primary means to demonstrate fault tolerance for both direct 

and conducted current lightning threats. Where analysis is insufficient or test data 

is not available, additional testing will be performed. The systems supporting 

structure will also be analyzed as part of the safety assessment to ensure that they 

meet the requirement of the policy statement. 

5 
Testing will show that the fastener installations will not produce any sparks inside 

the fuel tanks during exposure to threats for the applicable lightning zone 

requirements. For example, during previous programs Boeing has shown by test 

that most structural joints and some fasteners provide inherent fault tolerant 

protection. In addition, Boeing has shown by test that a cap seal, as a second layer 

of protection, will contain sparking where a fastener or joint cannot demonstrate 

inherent fault tolerant protection. 

Policy Requirement 3 - Demonstrate safety of limited non fault tolerant 

conditions: 

For the limited areas in which a single or cascading failure could result in a loss of 

all protection features, a safety assessment will be done to show that the summed 

risk on all non-fault-tolerant lightning related fuel tank ignition threats is not 

anticipated to occur during the entire operational life of all 73 7 MAX airplanes. 

Service experience on the existing Boeing aircraft commercial fleet (including the 

737 fleet) shows each of these failures to be rare. This assessment is similar to the 

assessment for the 747-8 aircraft (reference Exemption 10174), where analysis 

demonstrated that the probability of a lightning related fuel tank ignition is 

extremely improbable (and thus unlikely to occur in the life of the fleet). The 737 

MAX wing is a conventional aluminum wing, much smaller in size relative to 

747-8/8F and uses the fastener types and installation procedures and design 

standards common to Boeing airplanes. A failure rate based on in-service data for 

fasteners on Boeing airplanes will be used. The expected rate of occurrence of 

structural cracking will be conservatively based on Boeing's structural fatigue 

methodology. This methodology is based on test and service experience, and 

ensures that the presence of fatigue cracks is minimized during the life of the 

airplane. 

Currently, Boeing has identified two non-fault-tolerant failure modes (broken 

bolts and structural cracks); however, analysis and/or testing is not complete thus 

additional non-fault-tolerant installations may be identified which may also be 

impractical to preclude. All areas where fault tolerance is impractical will be 

identified in the Fuel System Lightning Protection System Safety Assessment. 

Policy Requirement 4 - Provide lightning protection maintenance 

information: 

Non-fault-tolerant features: No ALI [airworthiness limitation item] or mandatory 

inspections for structural lightning protection related to non-fault-tolerant features 

(e.g., broken bolts and cracks) are anticipated. However, assessment is not 

complete; they will be included if necessary. Existing mandatory structural 

inspections are adequate to ensure related failures will not exceed failure rates 

used in risk analyses. 

6 
Fault tolerant features: As recently added to the 737 AWLs [airworthiness 

limitations], a CDCCL will require an inspection of sealant per an airplane 

maintenance manual fuel tank closure procedure any time the tank area is exited 

after maintenance or alteration. No additional maintenance or inspections for 

structural lightning protection are anticipated. However, assessment is not 

complete; additional maintenance requirements will be included if necessary. 

Repairs: The structural repair manual (SRM) will include instructions to 

minimize the risk that alterations (repairs) will affect lightning protection. The 

SRM will include CDCCL references (equivalent to cautions). Also note that as 

discussed above, CDCCL will identify an airplane maintenance manual procedure 

to perform a visual sealant inspection before exiting any tank area where 

maintenance, inspection, or repair has been performed. 

Policy Requirement 5 - Analysis of design, manufacturing, and maintenance 

procedures: 

Boeing has implemented in the design all practical measures for structural 

lightning protection. The manufacturing processes will include practical means to 

minimize the risk that lightning protection features are not implemented as 

intended on the drawings. As noted for requirement 4, the continued 

airworthiness program will include appropriate CDCCL and the SRM repair 

procedures will be established to retain the lightning protection features 

throughout the life of the airplane. A complete analysis of the manufacturing 

process and repair procedure will be part of the fuel system lightning protection 

system safety assessment. Additional detailed proprietary information has been 

·provided to the FAA via Boeing letter RA-14-05275. 

Statement of Public Interest 

Boeing states that it is working to improve the efficiency of the 737 model by a redesign. 

The 73 7 MAX has an all new engine for improved fuel bum and reduced community 

noise over the 737-800 model. For lightning protection, the 737 MAX has additional 

features to enhance safety and protect the fuel tanks from potential ignition sources due to 

a lightning event. All practical measures have been utilized. All features to directly meet 

the rule are impractical and would potentially add significant cost, weight, increased 

emissions, and maintenance to the airplane without a proportional safety benefit. Further, 

additional lightning protection features could inhibit the ability to inspect the structure 

(reducing safety). 

Requiring the 73 7 MAX to attempt to directly comply with this rule would significantly 

inhibit Boeing's ability to design and certify the airplane on a competitive schedule. It 

would also render the 737 MAX to be oflesser value to the public interest with no 

commensurate increase in safety. Many Boeing customers are depending on the 737 

MAX to meet their business needs. The new 737 MAX airplane will typically replace 

older, less fuel efficient models, reducing the public expense for fuel consumed in air 

7 
travel and freight delivery. Therefore, Boeing believes that it is in the public interest for 

the FAA to grant this exemption. 

Statement of No Adverse Effect on Safety 

With current design practices for lightning protection, Boeing aircraft designs have 

accumulated in excess of 800 million revenue service flight hours with no lightning 

related events. Prior to these designs and service hours, there were two commercial jet 

transport hull loss events which are believed to have been caused by lightning strikes 

(reference Aviation Rulemaking Advisory Committee (ARAC) Report: 1998 ARAC 

Fuel Tank Harmonization Working Group report, Task Group 1 Service History I Fuel 

Tank Safety Level Assessment). The first was in 1963, which led to the development of 

lightning protection standards for fuel tanks. The second and last event was in 1976 and 

also resulted in improvements in fuel tank lightning protection. The hours accumulated 

since the last event represent over eight times the hours accumulated with earlier designs 

through 1976. The accident-free fleet history since 1976 shows current Boeing wing 

designs have sufficient protection against lightning induced fuel tank ignition events. 

This safety record for the fuel system designs upon which the enhanced Boeing 73 7 MAX 

design is based, indicates that the proposed fuel tank lightning protection design of the 

model 73 7 MAX will be safe. 

Request to Waive Publication and Comment 

Boeing requests to waive the requirement for publication and comment. Boeing believes 

there is good cause to be granted a waiver due to the fact that the FAA previously found a 

grant of exemption was in the public interest for the same fuel tank lightning protection 

compliance to 14 CFR 25.981(a)(3) issue on the 747-8/8F (BDCO Project No. PS05-

0212 and PS05-0211) (Exemption No. 10174 was granted). 

Privileges of the Exemption Outside the United States 

Per 14 CFR 11.81(h), Boeing requests that the privileges of this exemption be extended 

outside the United States. This extension of privileges is necessary for operations based 

within foreign countries having bilateral agreements with the United States accepting 

FAA 14 CFR part 25 as their airworthiness standards for transport category aircraft. The 

737 MAX is intended for the global market place. 

Federal Register publication 

Although the petitioner requested that action on its petition not be delayed for publication in the 

Federal Register, the FAA found that the petition, if granted, would set a precedent. Therefore, 

to allow an opportunity for the public to comment on the petition, a summary of it was published 

in the Federal Register on July 6, 2015 (80 FR 38505). No comments were received. 

8 
The FAA's Analysis 

Fuel Tank Structure 

In May 2001, the FAA issued the "Transport Airplane Fuel Tank System Design Review, 

Flammability Reduction, and Maintenance & Inspection Requirements" final rule (Docket No. 

FAA-1999-6411, effective June 6, 2001) that was adopted as Amendment 25-102. This 

amendment added specific ignition-prevention requirements and a new flammabilityminimization requirement to§ 25.981. 

The amended ignition-prevention requirements in§ 25.981(a)(3) require consideration of factors 

such as aging, wear, and maintenance errors, as well as the existence of single failures, 

combinations of failures, and latent failures that may be the cause of ignition sources in fuel 

tanks. Although Boeing is requesting relief from§ 25.981(a)(3) at Amendment 25-125, that 

section is unchanged from Amendment 25-1 02. 

Section 25.981, as amended by Amendment 25-102, requires that the structural aspects of 

airplane designs be protected from the effects of lightning with features that are failure tolerant. 

Prior to this amendment, only§ 25.954 had been applied to lightning protection of fuel tanks. 

That provision requires only that the airplane design prevents ignition of vapors in the tank with 

no consideration for anticipated design failures, aging, wear, or maintenance errors. 

Systems aspects of the fuel tank system with potentially catastrophic failure modes would 

typically meet the requirements of§ 25.981(a)(3) by providing at least triple redundancy in their 

protective features with periodic inspections, or dual-redundant features with continuous system 

monitoring to reduce the latency period. Dual-redundant design schemes could only comply with 

§ 25.981(a)(3) when combined with either regular inspections at very short intervals or a 

monitoring device to verifY the functionality of the protective features. Inspection of the various 

design features may be difficult or impossible if the feature is internal to the fuel tank and part of 

the wing structure. 

When§ 25.981 became applicable to the structural lightning protection aspects of new airplane 

designs (Amendment 25-102), applicants found that it was impractical to meet the standard and 

to incorporate the additional protective features. The FAA agreed that it can be impractical to 

meet the specific requirements of§ 25.981(a)(3) for certain areas of structural design. As a 

result, the FAA issued two exemptions and developed a new policy related to lightning 

protection of fuel tank structure. One exemption was for the Dassault Falcon 7X (Exemption 

No. 9148, issued April20, 2007) and the other was for the Hawker Beechcraft Model4000 

(Exemption No. 8761A, issued August 28, 2008). On May 26, 2009, following a publiccomment period, the FAA issued a policy (ANM-112-08-002) that defined criteria for the 

granting of exemptions and issuance of special conditions for structural lightning protection. The 

FAA issued additional special conditions and exemptions based upon that policy from 2009. 

In 2014, the FAA superseded Policy No. ANM-112-08-002 with Policy No. PS-ANM-25.981-02, 

Policy on Issuance of Special Conditions and Exemptions Related to Lightning Protection of 

Fuel Tank Structure and Systems (issued June 24, 2014). This new policy provides a standard 

9 
approach to applying alternatives to direct compliance with§ 25.981(a)(3). It contains the 

criteria the FAA will consider when applicants need to request an exemption to § 25.981(a)(3) 

because they find it impractical to directly comply with the ignition-prevention requirements 

relating to lightning protection of structure and systems. The primary differences between the 

latest policy statement and the previous one are: 

(1) The additional applicability of the policy to fuel tank systems in addition to structure for 

areas of systems design where the applicant shows that compliance with§ 25.981(a)(3) is 

impractical; 

(2) Additional criteria for evaluating the practicality of direct compliance to§ 25.981(a)(3); 

(3) Additional criteria for establishing inspection requirements for structural failures that 

could result in an ignition source. 

As it applies to fuel tank lightning protection for basic airframe structure (airplane skins, joints, 

ribs, spars, stringers, and associated fasteners, brackets, and coatings), Boeing contends that both 

the addition of a third, independent, ignition-source protective feature, and providing sufficient 

monitoring to detect latent failures in a dual-protective feature, are impractical for certain areas 

of metallic airplane-wing structure. Boeing evaluated possible means of providing additional 

protective features as a condition of this exemption, as discussed in the policy statement, and 

found it was impractical to incorporate those features into the Boeing 737 MAX. Boeing also 

identified two features through lightning tests and analyses that are not fault tolerant. They are 

1) the potential for a latent crack in structure and 2) a bolt failure that also causes the fastener nut 

(or collar) to release with significant force to tear the associated cap seal away from the 

surrounding structure. Boeing will show that the probability of fuel-vapor ignition, due to these 

non-fault-tolerant features, is extremely improbable, which satisfies the criteria in the policy 

statement. 

The FAA agrees with Boeing that compliance with§ 25.981(a)(3) for fuel tank structure would 

require a combination of redundant protective features, and a high level of reliability of those 

features, that are excessively expensive to produce and maintain using available technology. 

Lightning energy can be transferred to fuel tanks installed in wings through the many fasteners 

and other structural elements. It is impractical to provide either continuous monitoring of the 

"health" of the protective features for these structures or to inspect them frequently enough to 

detect latent failures. These features are typically integral to the fuel tank structure or internal to 

the fuel tank, requiring access into the tank to verify the integrity of the feature. Inspections of 

airplane structure requiring fuel tank entry may be scheduled only once or twice during the life of 

the airplane. 

As discussed in the preamble to Amendment 25-102, conventional, unheated, aluminum wing 

tanks minimize fuel tank flammability exposure, as required by § 25.981 (c). Even if a latent 

failure of a protective feature occurred for such a tank, the risk of lightning-induced fuel tank 

explosions is relatively low when the tank is fueled with low-volatility fuels such as Jet A, as 

demonstrated by the service experience of these tanks. Due to the impracticality of full 

compliance with§ 25.981(a)(3) for lightning protection and the reduced flammability exposure 

10 
of these tanks, the FAA believes granting an exemption is in the public interest if applicants can 

show that their design provides practical dual-protective features for fuel tank structural lightning 

protection that are both independent and robust, and show the probability of fuel tank ignition to 

be extremely improbable for any non-fault-tolerant features. 

The Boeing petition states that the company will comply with§ 25.981(b) at Amendment 25-125 

and that it will provide a flammability exposure assessment showing that the 73 7 MAX main 

tanks are low flammability exposure tanks equivalent to a conventional unheated aluminum main 

wing. In addition, the center wing tank of the 737 MAX will utilize an inerting system designed 

to meet the flammability exposure criteria of appendix M to part 25. The aspects of the inerting 

system performance with respect to compliance with§ 25.981 are covered in the Boeing 737 

MAX Fuel System Installation Certification Plan. Therefore, the 73 7 MAX will satisfy the 

flammability criteria defined in § 25.981 (b) and the policy statement. 

The Model 73 7 MAX design does not have any fuel tanks or vent system features in lightning 

strike Zone 1. For the wing-skin fasteners ofthe tanks in Zone 2 (as illustrated in Advisory 

Circular 20-53B, Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Caused by 

Lightning), Boeing must demonstrate that at least two independent and effective means of 

lightning protection are provided and reliably maintained. Boeing proposes lightning-protection 

features for the 737 MAX based on state-of-the-art, industry-design practices for aluminum wing 

structures including inherently conductive, low-resistance current paths that have been used in 

existing in-service designs. Boeing is enhancing lightning-protection features of the previous 

737 design by incorporating additional fault-tolerant protection for fasteners in certain locations. 

To substantiate the effectiveness oflightning-protection features, Boeing must provide analysis 

and test data. Boeing has agreed to this as part of its petition request. 

In addition to validating independent and effective design means of lightning protection for 

certification on new production airplanes,§ 25.98l(b) requires establishing critical design 

configuration control limitations (CDCCLs), inspections, and other procedures to prevent the 

development of ignition sources within the fuel tank system as the airplanes progress through 

their service life. These limitations, inspections, and procedures must be included in the 

Airworthiness Limitations section of the Instructions for Continued Airworthiness required by 

§ 25.1529. Boeing states that it will provide maintenance information, which will be included in 

the Instructions for Continued Airworthiness. 

Boeing will identify maintenance-inspection tasks with appropriate inspection intervals to ensure 

the needed reliability of proper wing-fastener installation and sealant coverage. These actions 

should maintain the lightning-protection characteristics of these two independent protective 

features. Boeing has identified maintenance manual procedures that restore the protective 

features to the same level and with the same products and techniques as the original design 

specifications. 

Fuel Tank Systems 

With regard to fuel tank systems on the 73 7 MAX, Boeing did not request relief from the 

requirements of§ 25.981(a)(3) for lightning protection of systems elements in its petition for 

11 
exemption. However, the FAA became aware that Boeing intends to include consideration ofthe 

probability of a lightning strike when assessing compliance for fuel tank systems and this 

approach is not consistent with the requirements of§ 25.981 and previously published means of 

compliance. Advisory Circular (AC) 25.981-1C, Fuel Tank Ignition Source Prevention 

Guidelines, dated September 19, 2008, states: 

The severity of the external environmental conditions that should be considered when 

demonstrating compliance with§ 25.981 are those established by certification regulations 

and advisory material (e.g., HIRF, lightning) regardless of the associated probability of 

exposure to any external environment. For example, the probability oflightning 

encounter should be assumed to be [equal to] one. 

Including the probability of lightning in a numerical probability analysis when assessing 

compliance of the 737 MAX fuel tank systems is not acceptable under the means of compliance 

described in the AC. Furthermore, the FAA's intent to require the probability of environmental 

conditions (including lightning) to be equal to one was also stated in the preamble to the notice 

of proposed rulemaking for Amendment 25-102 to§ 25.981 as follows: 

The severity of the external environmental conditions that should be considered when 

demonstrating compliance with this proposed rule are those established by certification 

regulations and special conditions (e.g., HIRF), regardless of the as.sociated probability. 

The above statement means that environmental conditions in which the airplane is approved to 

operate should be assumed to exist at all times when performing numerical system safety 

analyses for the purpose of showing compliance with§ 25.981(a)(3). 

Policy Statement PS-ANM-25.981-02 states that direct compliance for systems has been found to 

be practical in previously approved designs. However, it acknowledges that some of the 

resulting multiple-redundant system design details, particularly in the area of systems mounting 

features and electrical bonding features, were excessively complex and costly with little 

additional safety benefit when the expected failure modes of those features are considered. 

Considering the cost-versus-benefit for those features, it is arguable that many such features 

should be considered impractical. The policy statement therefore allows for exemption 

conditions providing relief from the requirements of§ 25.981(a)(3) for systems elements where 

the applicant can show that direct compliance for those elements is impractical. The FAA 

determined that it is more appropriate to also grant relief from the requirements of§ 25.981(a)(3) 

for fuel tank systems on the 73 7 MAX, in addition to fuel tank structure, rather than allow 

Boeing to consider the probability of lightning in a compliance analysis that conflicts with the 

means of compliance policy contained in AC 25.981-1 C. The FAA has therefore included in its 

decision, a provision and conditions for exemption from§ 25.981(a)(3) for systems elements 

where Boeing shows direct compliance to be impractical. 

Conclusion 

The FAA considers Boeing's request to be in the public interest because the Boeing Model 737 

MAX design provides an acceptable level of safety, and full compliance to§ 25.981(a)(3) is 

12 
impractical. Full compliance would require significant modifications to the fuel tank design; 

introduce additional complexity into the manufacturing and quality process, as well as into 

maintenance procedures that have not been shown to be completely effective; and add significant 

cost and schedule impact to the Boeing Model 737 MAX airplane program. The 737 MAX 

meets later safety standards, providing improved safety over that of airplanes it is replacing in the 

fleet. In addition, new 737 MAX airplanes typically will replace older, less fuel efficient models, 

reducing the public expense for fuel consumed in air travel and freight delivery. 

Boeing states in its petition that the company will follow the current policy related to lightning 

protection of fuel tank structure and systems (PS-ANM-25.981-02) for the certification of the 

737 MAX. The company will provide fault tolerant structural lightning protection features for 

the fuel tank structure, except for two identified failure modes and any subsequently-identified 

failure modes where Boeing can show that compliance is impractical. Boeing will also show that 

systems-related lightning protection features are compliant with§ 25.981(a)(3) except in areas 

where Boeing can show compliance is impractical. In those areas, it will meet the conditions 

stated in the grant of exemption. The outcome of the conditions associated with the granting of 

this exemption may affect the regulatory compliance of the 73 7 MAX if analysis, test data, and 

maintenance information is not provided to the FAA as assured by Boeing. 

Condition 4 of this Exemption requires that Boeing prevent development oflightning-related 

ignition sources within the fuel tank structure and systems, by establishing inspections or other 

procedures. Such prevention may necessitate one or more of the following actions, or others: 

a) The identification of airworthiness limitations, mandatory maintenance actions 

(i.e., inspections), or CDCCLs necessary to preclude the development of unsafe 

conditions due to non-fault-tolerant lightning protection features; 

b) The inclusion of sampling programs, maintenance, or inspections for fault-tolerant 

lightning protection features in Boeing's recommended airplane maintenance 

program; 

Note: If inspections from non-mandatory programs such as Baseline Zonal 

inspection program, Corrosion Prevention and Control Program (CPCP), etc., are 

going to be used to support the robustness of the overall inspection program, these 

programs must become mandatory and be included in the Airworthiness 

Limitations section of the airplane's Instructions for Continued Airworthiness. 

c) The incorporation into applicable airplane maintenance documents, including the 

structural repair manual, of caution information that identifies the lightning 

protection features of the fuel system design to minimize the potential for 

inadvertent damage or disruption of these features. 

The FAA's decision 

In consideration of the foregoing, I find that a grant of exemption is in the public interest. 

Therefore, pursuant to the authority contained in 49 U.S.C. 40113 and 44701 delegated to me by 

the Administrator, I grant The Boeing Company an exemption from 14 CFR 25.981(a)(3) as it 

13 
relates to the 73 7-7, 73 7-8, 73 7-9 (73 7 MAX) fuel tank structural lightning protection, and as it 

relates to systems lightning protection features where Boeing shows that compliance with 

§ 25.981(a)(3) is impractical for that feature. This grant of exemption and the following 

conditions are consistent with the alternatives to direct compliance as set forth in Policy 

Statement PS-ANM-25.981-02. 

This exemption is subject to the following conditions: 

(1) The fuel tank structure and systems must be designed and installed to prevent catastrophic 

fuel vapor ignition due to lightning. 

(2) The fuel tank structure and systems lightning protection design must be fault-tolerant for 

failures that result in lightning-related ignition sources. 

(3) Fault-tolerance is not required for any specific design feature if: 

a) Boeing provides substantiating documentation showing fault-tolerance is 

impractical for that feature; and 

b) Boeing shows that fuel tank vapor ignition is extremely improbable (i.e., so 

unlikely that it is not anticipated to occur during the entire operational life of all 

737 MAX airplanes) when the airplane's fuel tank vapor ignition event 

probabilities are combined with that feature and other non-fault-tolerant features. 

(4) Boeing must establish inspections or other procedures to prevent development of 

lightning-related ignition sources within the fuel tank structure and systems. 

(5) Boeing must perform an analysis showing that the airplane's design, manufacturing 

processes, and the Airworthiness Limitations section of the Instructions for Continued 

Airworthiness include all practical measures to prevent, detect, and correct failures of the 

lightning protection features of fuel tank structure and systems due to manufacturing 

variability, aging, wear, corrosion, and likely damage. 

Issued in Renton, Washington, on 

JUL 0 7 2016 

~~ Michael Kaszycki 

Assistant Manager, Transport Airplane Directorate 

Aircraft Certification Service 

14