UNITED STATES OF AMERICA DEPARTMENT OF TRANSPORTATION FEDERAL AVIATION ADMINISTRATION RENTON, WASHINGTON 98057-3356

In the matter ofthe petition of Exemption No. 17021

The Boeing Company Regulatory Docket No. FAA-2014-1042

for an exemption from§ 25.981(a)(3) of Title 14, Code ofFederal Regulations

GRANT OF EXEMPTION
By letter dated December 12,2014, Mr. Douglas M. Lane, Director ofCommercial Airplanes, The Boeing Company, P.O. Box 3707, MC 03-56, Seattle, Washington, 98124-2207, petitioned the Federal Aviation Administration (FAA) for an exemption from the requirements of § 25.981(a)(3) ofTitle 14, Code ofFederal Regulations (14 CFR). This exemption, ifgranted, would allow Boeing to use therequirements ofF AA Policy Statement PS-ANM-25.981-02, Policy on Issuance of Special Conditions andExemptions Relatedto LightningProtection of Fuel TankStructure andSystems, for fuel tank structural lightning protection for the Model 737-7, 737-8, and 737-9 airplanes (737 MAX) as an alternative to full compliance to § 25.981(a)(3).

The petitioner requests relieffrom the following regulation: Section 25.981(a)(3), at Amendment 25-125, states that no ignition source may be present at each point inthe fuel tank orfuel tank system where catastrophic failure could
occur due to ignition offuel or vapors. This must be shown by demonstrating that an ignition source could not result from each single failure, from each single failure in combination with each latent failure condition not shownto be extremelyremote, and from all combinations offailures not shownto be extremely improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely damage must be considered.
The petitioner supports its request with the following information: This section quotes the relevant information from the petitioner's request, with minor edits for clarity. The complete petition is available at the Department ofTransportation's Federal Docket Management System, onthe Internet at http://regulations.gov, in DocketNo. FAA-2014-1042.Description ofIssue Boeing is petitioning for an exemptionto 14 CFR 25.981(a)(3) for fuel tank structural lightning protection for the 737-8 (ProjectNumberPS 12-0038). The petition is also requested for the 737-7 (ProjectNumber PS12-0037) and 737-9 (ProjectNumber PS12- 0039). The references to the 737 MAX in this document refer to the 737-7, 737-8, and 737-9 models. The subjectregulation section is unchanged between Amendment level 102 and 125. The FAA Policy StatementPS-ANM-25.981-02 provides the following alternate requirements: 1) The fuel tank structure and systems mustbe designed and installed to prevent catastrophic fuel vapor ignition due to lightning. 2) The fuel tank structure and systems lightning protection design mustbe fault tolerant for failures thatresult in lightning-related ignition sources. 3) Fault tolerance is notrequired for any specific design feature if: a) Fault tolerance is shownto be impractical for that feature; and b) Fuel tan."'<: vapor ignition because ofthat feature and all othernon-fault-tolerant features, whentheir fuel tankvapor ignition event probabilities are combined, is shown to be extremely improbable.
Note: FAA Policy Statement PS-ANM-25.981-02 defines "Practicality" as a balance of available means, economic viability, and proportional benefitto safety. 4) Inspections or other procedures mustbe established to prevent development of lightning-related ignition sources within the fuel tank structure and systems, for example: a) Identifying as airworthiness limitations, mandatory maintenance actions (i.e., inspections), or critical design configuration control limitations (CDCCL), necessary to preclude the development ofunsafe conditions due to non-faulttolerant lightningprotection features; b) Including sampling programs, maintenance, and/or inspections for fault-tolerant lightning protection features inthe manufacturer's recommended airplane maintenance program;
Note: Ifinspections from non-mandatoryprograms such as Baseline Zonal inspection program, Corrosion Prevention and Control Program (CPCP), etc., are going to be used to supportthe robustness ofthe overall inspectionprogram, these programs must become mandatory and mustbe included inthe Airworthiness Limitations section ofthe airplane's Instructions for Continued Airworthiness.

2c) Incorporating into applicable airplane maintenance documents, including the manufacturer's structural repair manual, caution information that identifies the lightning protection features ofthe fuel system design to minimizethe potential for inadvertent damage or disruption ofthese features. 5) An analysis must be performed to showthat the airplane's design, its manufacturing processes, and the Airworthiness Limitations section ofits Instructions for Continued Airworthiness include all practical measures to prevent, and detect and correct, failures offuel tank structure and systems lightning protection features because of manufacturing variability, aging, wear, corrosion, and likely damage.
Discussion Boeing has concludedthat there are no practical means utilizing current technology to obtain triple redundant means offuel tank structural fastener lightning protection in all locations. For example, one impractical option would be to apply an inspection interval which monitors the health ofeach fastener thatpenetrates the fuel tanks. Withthousands offasteners onthe wing ofthe 737 MAX, and the inability to visually inspect most means ofprotection, this option is impractical. Increasing the number ofin-tank inspection intervals could also have a potential unintended consequence ofdamaging the ignition protective features or other components inside the fuel tanks. Examples ofadditional design considerations, found to be impractical, were:

• Conductive steel fasteners: Widespread use results inhigher weight, fuel burn and associated emissions, and higher risk ofcorrosion. Design with all steel fasteners is still not dual fault tolerant.

• Additional sealant on bolt locations already sealed: Reduces structural inspectability for cracks and corrosion, potentially reducing overall fleet safety. Would result in additional weight, fuel burn and emissions.

• Composite skinprotection methods: Not applicable to aluminum design. Note the majority ofthese methods are intendedto increase conductivity ofthe outer tank surface inthe area local to the fastener heads, which aluminum structure provides inherently.

• Fuel tank bladders or double walled fuel tanks: Would result in a new enclosed fuel vapor space, which would pose an additional vapor ignition threat during a lightning attachment and thus does not increase safety. This would also increase weight which increases fuel burn and emissions, plus reduces usable fuel tank volume whichreduces range. The bladders also inhibit structural inspectability inside the tank.

• Spot bonds: Spot bond is a local bond in which the primer is removed at the internal fastener interface with structure. Removing primer increases corrosion risk, detracting from any benefit ofincreased conductivity offered by the spot 3bond. The spot bonds would still be subjectto faults and do not result in a dual fault tolerant design.

• Fastener Free Wing Structure: Structure that does not have any fasteners would not be susceptible to lightningprotection faults associated with fasteners but is not necessarily dual fault tolerant. Itis notpossible to produce rawmaterials large enoughto create monolithic wing panels or spars in dimensions that the 737 MAX requires. Also, monolithic designs wouldreduce structural cracktolerance. Using adhesives instead offasteners to bond major components represents a radical departure from established metallic wing primary structure experience.
These types ofdesigns were determined to be impractical because some are not possible withinthe current state ofthe art; others introduce more riskthanmitigated, and because the design is safe withoutthem.

In addition, adding sealant over 1!4 inch and largerrivets was determined to be impractical due to lack ofproportional safetybenefit, increased weight, increased fuel bum, increased emissions, and reduced inspectability during maintenance. Boeinghas assessed the likelihood oflightning attachment to a faulted rivet during flammable tank conditions, and concluded this combination is not expected to occur inthe life ofthe fleet. Regardless ofthis probabilistic conclusion, Boeinghas performed development testing (will repeat for compliance) ofrivet installations representative ofthe 737 design and demonstratedthat evenwith faults present, the installations will not cause an ignition
source during severe direct lightning attachments. Since the design is already safe during this combination ofconditions that are unlikely to occur inthe life ofthe fleet, Boeing concludedthat further mitigation (i.e., covering 1!4 inch and larger rivets with sealant) would notprovide a commensurate safety benefitto the public considering the significant weight and associated fuel costs, plus carbon emissions, aircraft production costs, and operator maintenance cost impacts. Additional detailed proprietary informationhas been provided to the FAAviaBoeing letter RA-14-05275.
The only faults currently identified for whichthe design is not fault tolerant are:
1. The potential for a crack in structure, or
2. A bolt failure that also causes the fastener nut (or collar) to release with sufficient force to tear free the associated cap seal.
Both ofthese failure modes are identified inthe FAA Policy Statement as typical situations where applicants have been unable to identifY practical means for fault tolerance. In each ofthese cases, sparking due to these failures would only occur ifthere
was a direct attachmentto the local area ofthe failure. An assessment will be provided demonstrating thatthe risk ofa fuel vapor ignition due to the sum ofthese failures is not anticipated inthe life ofthe fleet.

4Proposed Risk Mitigation As discussed in FAA Policy Statement PS-ANM-25.981-02, Boeing will submit detailed proprietary information to the FAA about the measures taken in the 737 MAX design to provide practical structural lightning protection. In general, the 737 MAX lightning protection features are based on state ofthe art industry design practices for aluminum wing structure including inherent currentpaths that have beenused in existing in-service designs. Further, Boeing proposes to enhance the lightning protectionby incorporating fault tolerant protection means where practical, thereby increasing the level offuel tank safety. Boeing will comply with 14 CFR25.981(b) at Amendment 25-125. A flammability exposure assessment will be provided showing that the 737 MAXmaintanks are low flammability exposure tanks equivalentto a conventional unheated aluminum main wing. In addition, the center wing tank ofthe 737 MAX will utilize an inerting system designed to meet the flammability exposure criteria ofappendix M to part 25. The aspects ofNGS [nitrogen generation system] performance with respect to compliance to 14 CFR 25.981
are covered inthe 737 MAX Fuel System Installation CertificationPlan. Boeing will provide the following withrespect to each ofthe five policy requirements: Policy Requirement 1 - Prevent catastrophic fuel vapor ignition due to lightning:
In summary, Boeing will implement inthe design all practical measures for fault tolerant structural lightning protection. Boeing will utilize manufacturing processes to minimize the risk oferrors in aircraft manufacturing which could affect the lightning protection features. Structural repair manual procedures will beprovided to retain the lightning protection features throughoutthe life ofthe airplane. Instructions for Continued Airworthiness, including CDCCLs, will be developed and included in the certification documentation. A complete analysis ofthe manufacturing process and repair procedure will be part ofthe Fuel System Lightning Protection System Safety Assessment. Policy Requirement 2 - Provide fault tolerant lightning protection: Boeing will showthat where practical the structural fastener andjointdesigns for the Model 737 MAX wing will provide fault tolerant lightning protection. A detailed failure mode and effects analysis (FMEA), including a qualitative assessment ofall known and hypothetical failure modes, will be provided as part ofthe compliance documentation. Analysis, design review, and use ofexisting test data will be the primary means to demonstrate fault tolerance for both direct and conducted current lightning threats. Where analysis is insufficient ortest data is not available, additional testing will be performed. The systems supporting structure will also be analyzed as part ofthe safety assessmentto ensure that they meet the requirement ofthe policy statement.

5Testing will showthat the fastener installations will not produce any sparks inside the fuel tanks during exposure to threats for the applicable lightning zone requirements. For example, during previous programs Boeing has shownby test that most structuraljoints and some fasteners provide inherent fault tolerant protection. In addition, Boeing has shownby test that a cap seal, as a second layer ofprotection, will contain sparking where a fastener orjointcannot demonstrate inherent fault tolerant protection. Policy Requirement 3 - Demonstrate safety oflimited non fault tolerant conditions:
For the limited areas inwhich a single or cascading failure could result in a loss of all protection features, a safety assessment will be done to showthatthe summed risk on all non-fault-tolerant lightning related fuel tank ignitionthreats is not anticipated to occur during the entire operational life ofall 737 MAX airplanes. Service experience on the existing Boeing aircraft commercial fleet (including the 737 fleet) shows each ofthese failures to be rare. This assessment is similarto the assessment for the 747-8 aircraft (reference Exemption 10174), where analysis demonstrated that the probability ofa lightning related fuel tank ignition is extremely improbable (and thus unlikely to occur inthe life ofthe fleet). The 737 MAX wing is a conventional aluminum wing, much smaller in size relative to 747-8/8F and uses the fastener types and installationprocedures and design standards commonto Boeing airplanes. A failure rate based onin-service data for fasteners on Boeing airplanes will be used. The expected rate ofoccurrence of structural cracking will be conservativelybased onBoeing's structural fatigue methodology. This methodology is based ontest and service experience, and
ensures that the presence offatigue cracks is minimized during the life ofthe airplane. Currently, Boeing has identifiedtwo non-fault-tolerant failure modes (broken bolts and structural cracks); however, analysis and/or testing is not complete thus additional non-fault-tolerant installations maybe identified whichmay also be impractical to preclude. All areas where fault tolerance is impractical will be identified in the Fuel System Lightning Protection System Safety Assessment. Policy Requirement 4 - Provide lightning protection maintenance information:
Non-fault-tolerant features: No ALI [airworthiness limitation item] ormandatory inspections for structural lightning protection related to non-fault-tolerant features (e.g., brokenbolts and cracks) are anticipated. However, assessment is not complete; they will be included ifnecessary. Existing mandatory structural inspections are adequate to ensure related failures will not exceed failure rates used in risk analyses.

6Fault tolerant features: As recently added to the 737 AWLs [airworthiness limitations], 

### a CDCCL will require an inspection ofsealantper an airplane maintenance manual fuel tank closure procedure any time the tank areais exited after maintenance or alteration. No additional maintenance or inspections for structural lightning protection are anticipated. However, assessment is not complete; additional maintenance requirements will be included ifnecessary. Repairs: The structural repair manual (SRM) will include instructions to minimize the risk that alterations (repairs) will affect lightning protection. The SRM will include CDCCL references (equivalent to cautions). Also note that as discussed above, CDCCL will identify an airplane maintenance manual procedure to perform a visual sealant inspection before exiting any tank area where maintenance, inspection, or repair has beenperformed. Policy Requirement 5 - Analysis ofdesign, manufacturing, and maintenance procedures: Boeing has implemented inthe design all practical measures for structural lightningprotection. The manufacturing processes will include practical means to minimize the risk that lightningprotection features are not implemented as intended onthe drawings. As noted for requirement 4, the continued airworthiness program will include appropriate CDCCL and the SRM repair procedures will be established to retain the lightning protection features throughoutthe life ofthe airplane. A complete analysis ofthe manufacturing process and repair procedure will be part ofthe fuel system lightning protection system safety assessment. Additional detailed proprietary information has been ·providedto the FAA via Boeing letter RA-14-05275.

Statement ofPublic Interest Boeing states that it is working to improve the efficiency ofthe 737 model by a redesign. The 737 MAXhas an all new engine for improved fuel bum and reduced community noise overthe 737-800 model. For lightning protection, the 737 MAXhas additional features to enhance safety and protect the fuel tanks from potential ignition sources due to a lightning event. All practical measures have beenutilized. All features to directly meet the rule are impractical and would potentially add significant cost, weight, increased emissions, and maintenance to the airplane without a proportional safety benefit. Further, additional lightning protection features could inhibitthe ability to inspectthe structure (reducing safety). Requiring the 737 MAXto attempt to directly comply with this rule would significantly inhibit Boeing's ability to design and certifythe airplane on a competitive schedule. It would also render the 737 MAX to be oflesservalue to the public interest with no commensurate increase in safety. Many Boeing customers are depending onthe 737 MAXto meet their business needs. The new 737 MAX airplane will typically replace older, less fuel efficient models, reducing the public expense for fuel consumed in air 

### 7travel and freight delivery. Therefore, Boeing believes that it is inthe public interest for the FAAto grant this exemption. Statement ofNo Adverse Effect on Safety With current design practices for lightning protection, Boeing aircraft designs have accumulated in excess of800 millionrevenue service flight hours with no lightning related events. Priorto these designs and service hours, there were two commercialjet transport hull loss events which are believedto have been caused by lightning strikes (reference Aviation Rulemaking Advisory Committee (ARAC) Report: 1998 ARAC Fuel Tank Harmonization Working Group report, Task Group 1 Service History 

### I Fuel Tank Safety Level Assessment). The first was in 1963, which led to the development of lightning protection standards for fuel tanks. The second and last event was in 1976 and also resulted in improvements in fuel tank lightning protection. The hours accumulated since the last eventrepresent over eighttimes the hours accumulated with earlier designs through 1976. The accident-free fleet history since 1976 shows current Boeing wing designs have sufficientprotection against lightning induced fuel tank ignition events.
This safety record for the fuel system designs upon which the enhanced Boeing 737 MAX design is based, indicates that the proposed fuel tank lightning protection design ofthe model 737 MAX will be safe. Request to Waive Publication and Comment Boeing requests to waive the requirement for publication and comment. Boeing believes there is good cause to be granted a waiver due to the fact thatthe FAApreviously found a grant ofexemption was in the public interest for the same fuel tank lightning protection compliance to 14 CFR 25.981(a)(3) issue onthe 747-8/8F (BDCO ProjectNo. PS05- 0212 and PS05-0211) (ExemptionNo. 10174 was granted). Privileges ofthe Exemption Outside the United States Per 14 CFR 11.81(h), Boeing requests that the privileges ofthis exemptionbe extended outside the United States. This extension ofprivileges is necessary for operations based within foreign countries having bilateral agreements withthe United States accepting FAA 14 CFRpart 25 as their airworthiness standards for transport category aircraft. The 737 MAX is intended for the global market place.

Federal Register publication Althoughthe petitioner requested that action on its petition notbe delayed for publication in the Federal Register, the FAA found that the petition, ifgranted, would set a precedent. Therefore, to allow an opportunityfor the public to comment onthe petition, a summary ofit was published inthe Federal Register onJuly 6, 2015 (80 FR 38505). No comments were received.

8The FAA's Analysis Fuel TankStructure

InMay 2001, the FAA issued the "Transport Airplane Fuel Tank System Design Review, Flammability Reduction, and Maintenance & Inspection Requirements" final rule (DocketNo. FAA-1999-6411, effective June 6, 2001) that was adopted as Amendment 25-102. This amendment added specific ignition-preventionrequirements and a new flammabilityminimizationrequirement to§ 25.981.
The amended ignition-preventionrequirements in§ 25.981(a)(3) require consideration offactors such as aging, wear, and maintenance errors, as well as the existence ofsingle failures, combinations offailures, and latent failures that may be the cause ofignition sources in fuel tanks. Although Boeing is requesting relieffrom§ 25.981(a)(3) at Amendment 25-125, that section is unchanged from Amendment 25-102.
Section 25.981, as amended by Amendment 25-102, requires that the structural aspects of airplane designs be protected from the effects oflightning with features that are failure tolerant. Priorto this amendment, only§ 25.954 hadbeen applied to lightning protection offuel tanks. Thatprovisionrequires only thatthe airplane design prevents ignition ofvapors in the tank with
no consideration for anticipated design failures, aging, wear, or maintenance errors. Systems aspects ofthe fuel tank system with potentially catastrophic failure modes would typically meet the requirements of§ 25.981(a)(3) by providing at leasttriple redundancy intheir protective features withperiodic inspections, or dual-redundant features with continuous system monitoring to reduce the latencyperiod. Dual-redundant design schemes could only comply with § 25.981(a)(3) when combined with eitherregular inspections at very short intervals or a monitoring device to verifY the functionality ofthe protective features. Inspection ofthe various design features may be difficult orimpossible ifthe feature is internal to the fuel tank and part of the wing structure. When§ 25.981 became applicable to the structural lightning protection aspects ofnew airplane designs (Amendment 25-102), applicants found that it was impractical to meetthe standard and to incorporate the additional protective features. The FAA agreed that it can be impractical to meet the specific requirements of§ 25.981(a)(3) for certain areas ofstructural design. As a result, the FAA issued two exemptions and developed a newpolicy related to lightning protection offuel tank structure. One exemption was for the Dassault Falcon 7X (Exemption No. 9148, issued April20, 2007) and the other was for the Hawker BeechcraftModel4000 (ExemptionNo. 8761A, issued August 28, 2008). On May 26, 2009, following a publiccommentperiod, the FAA issued a policy (ANM-112-08-002) that defined criteria for the granting ofexemptions and issuance ofspecial conditions for structural lightningprotection. The FAAissued additional special conditions and exemptions based uponthat policy from 2009.
In 2014, the FAA superseded PolicyNo. ANM-112-08-002 with PolicyNo. PS-ANM-25.981-02, Policy on Issuance of Special Conditions andExemptions Relatedto LightningProtection of Fuel TankStructure andSystems (issued June 24, 2014). This newpolicy provides a standard

9approach to applying alternatives to direct compliance with§ 25.981(a)(3). It contains the criteriathe FAA will consider when applicants need to request an exemptionto § 25.981(a)(3) because they find it impractical to directly comply withthe ignition-preventionrequirements relating to lightning protection ofstructure and systems. The primary differences betweenthe latest policy statement and the previous one are: (1) The additional applicability ofthe policyto fuel tank systems in addition to structure for
areas ofsystems design where the applicant shows that compliance with§ 25.981(a)(3) is impractical; (2) Additional criteriafor evaluating the practicality ofdirect compliance to§ 25.981(a)(3); (3) Additional criteriafor establishing inspectionrequirements for structural failures that could result in an ignition source.
As it applies to fuel tank lightning protection for basic airframe structure (airplane skins,joints, ribs, spars, stringers, and associated fasteners, brackets, and coatings), Boeing contends that both the addition ofa third, independent, ignition-source protective feature, andproviding sufficient monitoring to detect latent failures in a dual-protective feature, are impractical for certain areas ofmetallic airplane-wing structure. Boeing evaluated possible means ofproviding additional protective features as a condition ofthis exemption, as discussed inthe policy statement, and found itwas impractical to incorporate those features into the Boeing 737 MAX. Boeing also identifiedtwo features through lightning tests and analyses that are not fault tolerant. They are 1) the potential for a latent crack in structure and 2) a bolt failure that also causes the fastener nut (or collar) to release with significant force to tearthe associated cap seal away from the surrounding structure. Boeing will showthatthe probability offuel-vapor ignition, due to these non-fault-tolerant features, is extremely improbable, which satisfies the criteria inthe policy statement.
The FAA agrees with Boeing that compliance with§ 25.981(a)(3) for fuel tank structure would require a combination ofredundant protective features, and a high level ofreliability ofthose features, that are excessively expensive to produce and maintainusing available technology. Lightning energy canbe transferred to fuel tanks installed in wings through the many fasteners and other structural elements. It is impractical to provide either continuous monitoring ofthe "health" ofthe protective features for these structures orto inspect them frequently enoughto detect latent failures. These features are typically integral to the fuel tank structure or internal to the fuel tank, requiring access into the tank to verify the integrity ofthe feature. Inspections of airplane structure requiring fuel tank entry may be scheduled only once or twice during the life of the airplane.
As discussed in the preamble to Amendment 25-102, conventional, unheated, aluminum wing tanks minimize fuel tank flammability exposure, as required by § 25.981(c). Even ifa latent failure ofa protective feature occurred for such a tank, the risk oflightning-induced fuel tank explosions is relatively lowwhenthe tank is fueled with low-volatility fuels such as Jet A, as demonstrated by the service experience ofthese tanks. Due to the impracticality offull compliance with§ 25.981(a)(3) for lightning protection and the reduced flammability exposure 10ofthese tanks, the FAAbelieves granting an exemption is in the public interest ifapplicants can showthattheir designprovides practical dual-protective features for fuel tank structural lightning protectionthat are both independent and robust, and showthe probability offuel tank ignitionto be extremely improbable for any non-fault-tolerant features.
The Boeingpetition states that the company will complywith§ 25.981(b) at Amendment 25-125 and that it will provide a flammability exposure assessment showing that the 737 MAX main tanks are low flammability exposure tanks equivalentto a conventional unheated aluminum main wing. In addition, the center wing tank ofthe 737 MAX will utilize an inerting system designed to meet the flammability exposure criteria ofappendix M to part 25. The aspects ofthe inerting system performance with respect to compliance with§ 25.981 are covered in the Boeing 737 MAX Fuel System Installation Certification Plan. Therefore, the 737 MAX will satisfy the flammability criteria defined in § 25.981(b) and the policy statement.
The Model 737 MAX design does not have any fuel tanks or vent system features in lightning strike Zone 1. For the wing-skin fasteners ofthetanks inZone 2 (as illustrated inAdvisory Circular 20-53B, Protection of AircraftFuel SystemsAgainstFuel Vapor Ignition Causedby Lightning), Boeing must demonstrate that at leasttwo independent and effective means of lightning protection are provided and reliably maintained. Boeing proposes lightning-protection features for the 737 MAXbased on state-of-the-art, industry-designpractices for aluminum wing structures including inherently conductive, low-resistance current paths that have beenused in existing in-service designs. Boeing is enhancing lightning-protection features ofthe previous 737 design by incorporating additional fault-tolerant protection for fasteners in certain locations. To substantiate the effectiveness oflightning-protectionfeatures, Boeing mustprovide analysis and test data. Boeing has agreed to this as part ofits petition request.
In additionto validating independent and effective design means oflightning protection for certification on newproduction airplanes,§ 25.98l(b) requires establishing critical design configuration control limitations (CDCCLs), inspections, and otherprocedures to prevent the development ofignition sources within the fuel tank system as the airplanes progress through their service life. These limitations, inspections, andprocedures must be included inthe Airworthiness Limitations section ofthe Instructions for ContinuedAirworthiness required by § 25.1529. Boeing states that it will provide maintenance information, which will be included in the Instructions for Continued Airworthiness. Boeing will identify maintenance-inspectiontasks with appropriate inspection intervals to ensure the needed reliability ofproper wing-fastener installation and sealant coverage. These actions should maintainthe lightning-protection characteristics ofthese two independentprotective features. Boeinghas identified maintenance manual procedures that restore the protective features to the same level and withthe same products and techniques as the original design specifications.
Fuel TankSystems
With regard to fuel tank systems onthe 737 MAX, Boeing did notrequest relieffrom the requirements of§ 25.981(a)(3) for lightning protection ofsystems elements in its petition for 11exemption. However, the FAAbecame aware that Boeing intends to include consideration ofthe probability ofa lightning strike when assessing compliance for fuel tank systems and this approach is not consistent withthe requirements of§ 25.981 and previouslypublished means of compliance. Advisory Circular (AC) 25.981-1C, Fuel TankIgnition Source Prevention Guidelines, dated September 19, 2008, states:
The severity ofthe external environmental conditions that should be considered when demonstrating compliance with§ 25.981 are those establishedby certificationregulations and advisory material (e.g., HIRF, lightning) regardless ofthe associated probability of exposure to any external environment. For example, the probability oflightning encounter should be assumed to be [equal to] one. Including the probability oflightning in a numerical probability analysis when assessing compliance ofthe 737 MAX fuel tank systems is not acceptable under the means ofcompliance described inthe AC. Furthermore, the FAA's intent to require the probability ofenvironmental conditions (including lightning) to be equal to one was also stated inthe preamble to the notice ofproposed rulemaking for Amendment 25-102 to§ 25.981 as follows:
The severity ofthe external environmental conditions that should be considered when demonstrating compliance with this proposed rule are those established by certification regulations and special conditions (e.g., HIRF), regardless ofthe as.sociated probability.
The above statement means that environmental conditions in whichthe airplane is approved to operate should be assumed to exist at all times when performing numerical system safety analyses for the purpose ofshowing compliance with§ 25.981(a)(3). Policy StatementPS-ANM-25.981-02 states that direct compliance for systems has been found to be practical inpreviously approved designs. However, it acknowledges that some ofthe resulting multiple-redundant system design details, particularly inthe area ofsystems mounting features and electrical bonding features, were excessively complex and costly with little additional safety benefit when the expected failure modes ofthose features are considered. Considering the cost-versus-benefit for those features, it is arguable that many such features should be considered impractical. The policy statement therefore allows for exemption conditions providing relieffrom the requirements of§ 25.981(a)(3) for systems elements where the applicant can showthat direct compliance for those elements is impractical. The FAA determined that it is more appropriate to also grant relieffrom the requirements of§ 25.981(a)(3) for fuel tank systems onthe 737 MAX, in addition to fuel tank structure, rather than allow Boeing to considerthe probability oflightning in a compliance analysis that conflicts with the
means ofcompliance policy contained inAC 25.981-1C. The FAA has therefore included in its decision, a provision and conditions for exemption from§ 25.981(a)(3) for systems elements where Boeing shows direct compliance to be impractical.
Conclusion
The FAA considers Boeing'srequest to be inthe public interest because the Boeing Model 737 MAX design provides an acceptable level ofsafety, and full compliance to§ 25.981(a)(3) is
12impractical. Full compliance would require significant modifications to the fuel tank design; introduce additional complexity into the manufacturing and quality process, as well as into maintenance procedures that have notbeen shownto be completely effective; and add significant cost and schedule impactto the Boeing Model 737 MAX airplane program. The 737 MAX meets later safety standards, providing improved safety overthat ofairplanes it is replacing inthe fleet. In addition, new 737 MAX airplanes typically will replace older, less fuel efficient models, reducing the public expense for fuel consumed in air travel and freight delivery. Boeing states in its petitionthatthe companywill follow the currentpolicyrelated to lightning protection offuel tank structure and systems (PS-ANM-25.981-02) for the certification ofthe 737 MAX. The company will provide fault tolerant structural lightning protection features for the fuel tank structure, except for two identified failure modes and any subsequently-identified failure modes where Boeing can showthat compliance is impractical. Boeing will also showthat systems-related lightningprotection features are compliant with§ 25.981(a)(3) except in areas where Boeing can show compliance is impractical. In those areas, it will meetthe conditions stated inthe grant ofexemption. The outcome ofthe conditions associated withthe granting of this exemption may affect the regulatory compliance ofthe 737 MAX ifanalysis, test data, and maintenance information is notprovided to the FAA as assured byBoeing.
Condition 4 ofthis Exemption requires that Boeingprevent development oflightning-related ignition sources withinthe fuel tank structure and systems, byestablishing inspections or other procedures. Such prevention may necessitate one or more ofthe following actions, or others: a) The identification ofairworthiness limitations, mandatorymaintenance actions (i.e., inspections), or CDCCLs necessary to preclude the development ofunsafe conditions due to non-fault-tolerant lightning protection features; b) The inclusion ofsamplingprograms, maintenance, orinspections for fault-tolerant lightning protection features in Boeing's recommended airplane maintenance program; Note: Ifinspections from non-mandatoryprograms such as Baseline Zonal inspectionprogram, Corrosion Prevention and Control Program (CPCP), etc., are going to be used to support the robustness ofthe overall inspectionprogram, these programs mustbecome mandatory and be included inthe Airworthiness Limitations section ofthe airplane's Instructions for Continued Airworthiness. c) The incorporation into applicable airplane maintenance documents, including the structural repair manual, ofcaution informationthat identifies the lightning protection features ofthe fuel system design to minimize the potential for inadvertent damage or disruption ofthese features.

The FAA's decision

In consideration ofthe foregoing, I find that a grant ofexemptionis inthe public interest. Therefore, pursuantto the authority contained in49 U.S.C. 40113 and 44701 delegated to me by the Administrator, I grant The Boeing Company an exemption from 14 CFR 25.981(a)(3) as it 13relates to the 737-7, 737-8, 737-9 (737 MAX) fuel tank structural lightning protection, and as it relates to systems lightning protection features where Boeing shows that compliance with § 25.981(a)(3) is impractical for that feature. This grant ofexemption andthe following conditions are consistent with the alternatives to direct compliance as set forth in Policy Statement PS-ANM-25.981-02.

This exemption is subjectto the following conditions:
(1) The fuel tank structure and systems mustbe designed and installed to prevent catastrophic fuel vapor ignition due to lightning.
(2) The fuel tank structure and systems lightning protection design must be fault-tolerant for failures that result inlightning-related ignition sources. (3) Fault-tolerance is notrequired for any specific design feature if:
a) Boeingprovides substantiating documentation showing fault-tolerance is impractical for that feature; and
b) Boeing shows that fuel tank vapor ignition is extremely improbable (i.e., so unlikely that it is not anticipated to occur during the entire operational life ofall 737 MAX airplanes) whenthe airplane's fuel tank vapor ignition event probabilities are combined withthat feature and othernon-fault-tolerant features.
(4) Boeing must establish inspections or otherprocedures to prevent development of lightning-related ignition sources withinthe fuel tank structure and systems.
(5) Boeing mustperform an analysis showing that the airplane's design, manufacturing processes, and the Airworthiness Limitations section ofthe Instructions for Continued Airworthiness include all practical measures to prevent, detect, and correct failures ofthe lightningprotection features offuel tank structure and systems due to manufacturing variability, aging, wear, corrosion, and likely damage.

Issued inRenton, Washington, on 

## JUL 

## 072016

# ~~ Michael Kaszycki Assistant Manager, Transport Airplane Directorate Aircraft Certification Service

14