May 31, 2010. 

GCF-0583/2010 – 1/16 

NKK 

Embraer

Empresa Brasileira 

de Aeronáutica S.A.

Av. Brigadeiro Faria Lima, 2.170 

12227-901 - S.J. dos Campos - SP 

Brazil 

Phone: (55 12) 3927-2565 

Fax: (55 12) 3927-1184 

PC: 179 Mr. 

Robert Jones 

Acting Manager, Propulsion/Mechanical Systems, ANM-112 

Transport Standards Staff / Transport Airplane Directorate / Aircraft Certification Service 

Federal Aviation Administration 

Northwest Mountain Region 

1601 Lind Avenue S.W. 

Renton, Washington 98057-3356 

Subject: EMB-135 BJ with DCA 0145-000-00020-2008/FAA (Legacy 650) 

Petition for Exemption §25.981(a)(3) 

Reference: 1. Embraer letter No GCF-1957/2009 for relief of §25.981(a)(3), 

reference FAA Docket No 2009-1206 

2. FAA letter issued on April 14, 2010 in reply to Embraer letter (GCF1957/2009) for relief of §25.981(a)(3) 

Dear Mr. Robert Jones: 

As required by FAA letter issued on April 14 for relief of §25.981(a)(3), Embraer submits 

the requested information of the fault tolerance analysis performed for EMB-135 BJ 

model with enhanced performance, which included Amdt 25-102 in its certification basis 

as explained in Embraer letter No GCF-1957/2009. 

Embraer performed lightning tests of fuel tanks representative structural joints located in 

lightning zones 2A and 3. These determined which are the Fault Tolerant and Non Fault 

Tolerant Features. 

Therefore, Non Fault tolerant features were analyzed by a Numerical Probability 

Assessment in order to verify if fuel vapor ignition due to these features is extremely 

improbable to occur. 

Manufacturing Process was analyzed considering typical failure modes during the whole 

process of the fuel tanks production. 

Maintenance was reviewed considering specific tasks to check typical failure modes 

during repair or maintenance of the fuel tanks through CDCCL instructions. Non fault 

tolerant features are considered too. 

Information above are detailed below and organized by the items described in FAA 

letter. 
GCF-0583/2010 – 2/16

Question 1:

“1 The petitioner should show that all practical measures have been taken to 

meet the requirements of § 25.981(a)(3) for the fuel-tank structure. For the 

design features for which an exemption is sought, the petitioner should show 

what potentially compliant design changes were examined, and what design 

changes were ruled out based on impracticality.” 

IMPRACTICALITY OF 25.981(a)(3) STRUCTURAL THIRD PROTECTIVE FEATURE 

EMB-135BJ Enhanced model has included FAA Amendment 25-102 to its certification 

basis as a result of a major change, where an external ventral fuel tank was added to 

the aircraft. 

Requirement §25.981(a)(3) for structural lightning protection leads to the use of three 

highly reliable, independent and redundant protective features to prevent ignition 

sources. For EMB-135BJ Enhanced, modifications proposed for the fuel tanks structure 

followed the same design criteria required prior to Amendment 25-102. However, they 

are not sufficient to comply with all scenarios of §25.981(a)(3). 

During design review process, fuel tank structure has been analyzed in order to 

determine if it would be possible to include one more protective feature, besides the 

other existent ones. Below is the list of alternatives searched for the third protective 

feature: 

• Anti static fuel bladder; 

• Machined structural element with insert; 

• Protective cover for the structural joint (besides sealant); 

• One more skin layer (metal or composites); 

• Sealant application over the skin surface; and 

• Adhesive bonded structural elements. 

Incorporation of alternatives above would involve considerable design changes on the 

whole structure of the fuel tanks. This would affect considerably: 

• Fuel volume: lower capacity due to accommodation of the third protective feature; 

• Maintenance: increased workload due to more parts (bladder, bonded parts, 

another skin layer) added inside fuel tanks; 

• Repair: in the case of fuel bladder, removal and installation of a new bladder 

would be required prior to dispatch of the aircraft; and 

• Structural Analysis: novel design. 
GCF-0583/2010 – 3/16

Therefore, addition of a third protective feature to comply with §25.981(a)(3) is 

impractical since it would demand a new design of the fuel tanks with aircraft lower flight 

performance and greater maintenance and repair workload from the design envisioned 

for EMB-135BJ Enhanced model, what would make the development of this aircraft 

unviable, provided it would not be competitive when compared to the existent aircraft in 

the market. 

For EMB-135BJ Enhanced, compliance demonstration will be based on the following 

conditions: 

- FAA/ANAC/EASA §25.581, §25.899, and §25.954 are already complied through 

EMB-135BJ certification basis. 

- FAA/ANAC §25.981(a)(3) for structural lightning protection: petition for exemption 

with execution of DEL tests and analysis according to ANM-112-08-002. 

Policy Guidance developed by SAE AE-2 and EUROCAE WG-31 lightning committees 

regarding to FAA Policy Memo ANM 112-08-002 was used as reference for definition of 

DEL tests and fault tolerance analysis for compliance of structural lightning protection 

according to §25.981(a)(3). 

In the next section, it will be described the process for determination of structural joints 

to be tested and analyzed for fault tolerance. Lightning tests and analysis results are 

presented subsequently. 

FAILURE CONDITIONS ASSESSMENT 

For clarification purposes, all external fuel tanks are made of aluminum. 

A list of all structural joints in fuel tanks was generated after design review analysis, 

covering any type of structural present in the fuel tanks. 

All parts existent in each structural joint were analyzed and they were reviewed 

according to their lightning zone (2A or 3). 

Sealing was analyzed in the structural joints, especially on the fasteners heads, in each 

fuel tank. 
GCF-0583/2010 – 4/16

Based on the assumptions above, structural joints were represented in specimens for 

lightning tests. Typical failure modes were added to the specimens. In order to check if 

the lightning protective features are independent, reliable and effective, they were 

adequately disabled in the specimens and tested for lightning. 

TEST RESULTS 

Fault Tolerant Features 

Lightning tests were performed and it was verified that access door required to be 

modified in order to have two lightning fault tolerant features. Additional tests were 

performed and the access door passed with modification to a bonded dome nut. There 

were two configurations of bonded dome nut that passed the test. 

The new dome nuts will be incorporated to the production line of EMB-135BJ Enhanced 

for compliance of this exemption which requires two fault tolerant features. 

Non Fault Tolerant Features 

In this case, analysis was performed, as described in the next question. 
GCF-0583/2010 – 5/16

Question 2:

“2 Instead of compliance with the requirements of § 25.981(a)(3), the 

applicant must show that the design includes at least two independent, 

effective, and reliable lightning-protection features (or sets of features) 

such that fault tolerance to prevent lightning-related ignition sources is 

provided for each area of the structural design proposed to be exempt 

from the requirements of that regulation. Fault tolerance is not required 

for any specific design feature if: 

a. providing fault tolerance is shown to be impractical for that 

feature, and 

b. fuel-tank vapor ignition because of that feature and all other nonfault tolerant features, when their fuel-tank vapor ignition event 

probabilities are summed, is shown to be extremely improbable.” 

NUMERICAL PROBABILITY ASSESSMENT 

It was verified, through lightning tests and analysis presented above that there are two 

non fault tolerant features, as described below: 

1. Structural element fatigue cracking 

2. Fastener fatigue cracking 

In this case, it is impractical to provide fault tolerance of the structural element itself, 

since fatigue cracking will disable any type of additional protection feature implemented 

for the structural element. 

Following Policy Memo ANM 112-08-002 recommendations, a probability analysis was 

performed, as illustrated by the flow chart in figure 1, which is in accordance to Policy 

Guidance developed by the lightning committees SAE AE-2 and EUROCAE WG-31. 

The calculation method is based on three main probability parameters, as described 

below: 

1. RL-CRITICAL: Rate of critical lightning attachment. This probability is related to the 

following parameters: 

a. RLIGHTNING: Lightning strike rate 

b. FATTACH: General attachment area factor 

c. FSPARK: Spark threshold factor 

2. PSTRUCT-n: Probability of structural failure 

3. PFLAM: Fleet flammability exposure 
GCF-0583/2010 – 6/16

By multiplying the main three parameters, the ignition rate for one failure is obtained. 

Total Fuel tank ignition rate is the sum of all single failures. 

FIGURE 1: FLOW CHART FOR PROBABILITY ANALYSIS 

Analysis was performed and below are the results found for each fuel tank: 

Wing Tank Ignition Rate: 8,54 x 10-11 

Underbelly Tank Ignition Rate: 9,79 x 10-10 

Ventral Tank Ignition Rate: 1,55 x 10-10 

The Wing and Ventral fuel tanks provided probability failures lower than 1x10-9, which 

indicates that fuel vapor ignition would be extremely improbable to occur. 

In the case of Underbelly fuel tank, it was provided a probability failure of 0,98 x 10-09, 

being a marginal value next to the scale of 1x10-09. 

This value is linked to the low quantity of FH accumulated for this fuel tank compared to 

the other ones. 
GCF-0583/2010 – 7/16

On the other hand, it shall be noted that all external fuel tanks have adopted the same 

structural design philosophies. Similarly, lightning protection of the fuel tanks have the 

same approach, by providing the same type of fault tolerant protection features on 

them. 

Therefore, the probability failure obtained for the underbelly fuel tank is acceptable, 

based on the analysis detailed above, and can be considered as extremely improbable, 

too. 
GCF-0583/2010 – 8/16

Question 3:

“3 The applicant must perform an analysis to show that the design, 

manufacturing processes, and airworthiness limitations section of the 

instructions for continued airworthiness include all practical measures to 

prevent, and detect and correct, failures of structural lightning protection 

features because of manufacturing variability, aging, wear, corrosion, and 

likely damage.” 

“With regard to item 3, above, your petition discusses manufacturing controls 

but it does not specifically address inspection of non-fault-tolerant design 

features. We request confirmation that any non-fault-tolerant design 

features will receive 100 percent inspection to validate that the features 

are present at the time of manufacture. We also request confirmation that 

the Critical Design Configuration Control Limitations (CDCCLs) 

discussed in your petition will include periodic, in-service inspection of all 

ignition-prevention features, as well as non-fault-tolerant features.” 

MANUFACTURING PROCESS 

Fuel tank structure assembly is manufactured based on the following SAE standards: 

1. AS9100C “Quality Management Systems – Requirements for Aviation, Space 

and Defense Organizations” 

2. AS9003 “Inspection and Test Quality System” 

3. AS9102A “Aerospace First Article Inspection” 

It will be presented the whole production process of the fuel tanks, in order to 

comprehend the existent control for mitigation of typical failures modes which would 

produce quality escapes. Every Fault Tolerant and Non Fault Tolerant Feature drilling, 

assembly and sealing is inspected as will be described below. 

Quality Management System 

Quality Management System covers all stages of development and production, to 

achieve quality specifications and product safety, as illustrated in figure 2. The needs 

and opportunities for improvement and correction are flagged by the feedback and 

independent assessment of compliance with the procedures and results are verified and 

guaranteed by the Quality Audit. 

All actions occur in an environment created by the quality system and processes related 

to this system. 
GCF-0583/2010 – 9/16

Integrated

Development

Process

Audit

Qualification

people

Non Conformity

Management

Corrective

and Preventive Action

Quality

Product

Records

Quality

Product

Indicators

Verification

Manufacturing

operations, assembly 

and inspection

Supplier

Supplier

First Article Inspection

Conformity

Elaboration of the

roadmap

Operations

Production

and Inspection

Integrated

Development

Process

Audit

Qualification

people

Non Conformity

Management

Corrective

and Preventive Action

Quality

Product

Records

Quality

Product

Indicators

Quality

Product

Records

Quality

Product

Indicators

Verification

Manufacturing

operations, assembly 

and inspection

Supplier

Supplier

First Article Inspection

Conformity

Elaboration of the

roadmap

Operations

Production

and Inspection

FIGURE 2: QUALITY MANAGEMENT SYSTEM 

Management qualification system keeps the records in the system of the company 

following process steps, as: establish processes, define the requirements, train those 

involved. 

Requirements for Qualification: to be qualified in a given process, employee must meet 

the requirements for OJT (On the job training) and theoretical requirements. 

Requirements of Theoretical Knowledge: carry theoretical training defined for a process. 

Requirements for Practical Knowledge (OJT): 

The coach must record the attendance requirements for OJT for the operators under 

their responsibility. 

The supervisor must verify and record the attendance requirements for qualification of 

personnel under their responsibility 

In the case of special procedures, the personnel must be checked and certified by 

Quality Leadership in the area. At their discretion, the Quality Leadership can apply 
GCF-0583/2010 – 10/16

theoretical examinations, practical examinations or other form of verification before 

certifying an employee. 

Employees certified in special processes, or critical processes will receive individualized 

stamps from quality department. 

Human resources training can be divided in parts as illustrated in figure 3. Each part is 

associated to a specific type of work and a set of training courses which will guarantee 

adequate assembly of the fuel tanks. 

FIGURE 3: HUMAN RESOURCES TRAINING REQUIREMENTS 

Control of Records 

The following records and evidence of qualification shall be kept for each qualified 

employee: 

- Name plate and the employee; 

- Identification of the process in which the employee is qualified; 

- Identification of the specific procedure; 

- Number stamp, if applicable; 

- Date of qualification and validity; 

- Date of commencement and completion of OJT; 

Drilling Countersinking Riveting 

Sealing 

Special 

Structural Assembly – OJT Sealing 

Torque, Locking and Seal 

SPC for assembler 

Drawing Reading & Interpretation 

Blind Fasteners installation 

120o Solid Rivet Installation 

Solid Rivet Installation 

Threaded Pin Installation 

Basic Measurement Instruments 

Reamers 

Edge and Pitch Distance 

Production / Inspection Documentation 

FOE / FOD 

Pneumatic Jackhammer and Drill Pistol 

Quality Commitment 

Drilling Manual 

Interface Sealing 

Sealing – Wet / Pressurized Regions

Sealing – Subassembly 

Test – Leakage 

Sealing / Bonding – Aerodynamic 
GCF-0583/2010 – 11/16

- Employee experience in the process on the date of qualification, including the period 

of OJT (years and months); 

- Identification of the coach responsible for OJT; 

- Identification of the immediate superior; 

- Identification of quality leadership in the area (only for special cases); 

- Records and other evidence required by the special procedure. 

- The records and evidence should be kept in the company system. 

Records are kept to demonstrate compliance with specific requirements and effective 

operation of the management system applied in the operational units of the 

manufacturer. 

Sheet Compliance – FIC

It is a printed document, which allows recording of values, signatures and seal 

impressions, for evidence of production process operations. When all related 

documentation is closed, it is filed to preserve data traceability. 

Rework Order

Conformity end of the document is executed by members of the Product Quality. 

Production Process Verification 

SAE AS9102A is the reference document for initial production of any new product or 

modification proposed for EMB-135BJ Enhanced. 

FAI - First Article Inspection

Inspection process complete physical and functional, independent and documented to 

verify that prescribed production methods produce an acceptable item, as specified by 

engineering drawings, planning, purchase order, engineering specifications and / or 

other relevant documents. 

FAI is a process that composes actions regarding "Approval of Initial Production 

Process", in order to confirm the adequacy of the process to produce conforming items 

or detect deficiencies to be remedied before the start of serial production. 

Application to items manufactured at EMBRAER

FAI should be applied in 100% of standard items manufactured and assembled 

internally. 
GCF-0583/2010 – 12/16

Reapplication of the FAI for validation of design, process and tooling changes

Reapplication of the FAI should be analyzed under the following conditions: 

1. Modification of the sources of manufacturing processes, inspection methods, 

location of manufacturing, tooling or material with the potential to affect 

assembly, form, function and producibility. 

2. Changes in the numerical control program or transition to other media with the 

potential to affect assembly, form or function. 

3. Natural occurrence or event caused by human interference that may adversely 

affect the manufacturing process. 

4. Stop production for two years or as specified by the customer. 

Control of Production 

Preparation for drilling (SETUP)

Measurement values of the holes are recorded in a specimen, before the start of drilling, 

for verification and validation of the tool. 

Items to check in the production instructions

1. Deburr holes after final drilling. 

2. Holes for pins, as specific diameter (checked at determined intervals during 

drilling execution), roughness, and step away from the edge. 

3. Installation of the pins, as: correct grasp, settling of the head (head, collar, 

washer and nut) and protection of the collar. 

4. Verify countersink for conventional rivets and pins, as the diameter of the 

countersunk, depth, radius of agreement (settlement) and finishing. 

5. Holes for rivets as to: specific diameter, edge distance, distance between holes 

and finishing. 

6. Rivets, as to: snap rivet head, conformation of the head (height x diameter), 

cracks and marks 

To avoid misalignment of the holes, during drilling process a device is used to keep the 

tool at 90 degrees. 

Sealing

Before sealing, employee makes a visual inspection so that installation is clean and 

there are no foreign objects in the region. Then, sealing process is initiated and 

performed by another employee (sealant specialist). This specialist will perform another 

visual inspection to ensure that no particle or foreign object remained in the area. 
GCF-0583/2010 – 13/16

Sealant application is verified for: 

• Uniformity of the layer (interface) 

• Heals 

• Bubbles 

• Retraction 

Special qualification is required for sealing. 

As detailed above in this section, typical modes of failures that could become quality 

escapes are adequately mitigated. When this type of non conformity is found, corrective 

actions are generated, as detailed in the next section, which eliminates the possibility to 

have latent failures in the fuel tank. 

Corrective and Preventive Actions 

There is a system which implements corrective and preventive actions, with emphasis 

on the production process, including at the stage of development in order to eliminate 

the root causes of nonconformities identified on the product or process, and preventing 

its recurrence (or occurrence). 

CAT (Corrective Action Team)

Team of corrective and preventive action, under the coordination of quality, composed 

of representatives of different areas of the company, responsible for root cause analysis 

and definition of plans for corrective and preventive actions relating to the production 

process. 

Stages of Process of Preventive and Corrective Actions

Definition

Describe the nonconformance, providing in detail the necessary information for the 

characterization of the problem. 

Analysis

Record and analysis of the data for identifying the root cause of the problem (Ishikawa, 

correlation analysis, hypothesis testing, Kepner Tregoe, etc). Highlight the root cause. 

Containment and Action Plan:
GCF-0583/2010 – 14/16

Containment: blocking action of non-compliance to avoid or minimize the impact of a 

new occurrence and facilitate the continuity of the production process until the 

completion of corrective action. 

Research: actions that will assist in the identification or confirmation of the root cause of 

the problem. 

Plan of Action: actions set for elimination of the root cause of the problem. 

Similarity Analysis: to verify if non-conformity affects pieces or similar processes. 

Verification of effectiveness: actions of verification of effectiveness of problem 

elimination, or improve of process; with their evidences. 

In order to guarantee that correction was performed, representative information can be 

used as evidence, for example: aircraft or sequence of operations observed during a 

representative period of time. 

Supplier 

Supplier Development

The management strategy for the development of material and supplier based on the 

application of different management actions, in type, intensity and frequency, depending 

on the classification of material and supplier that is established from the criticality of the 

product versus risk of the supplier. 

Performance Management and Corrective Action / Preventive of Suppliers

There is a documentation which formalizes and sends corrective or preventive action to 

non-conformities detected in all phases of the product manufacturing. 

Corrective Action: Action to eliminate the cause of non-compliance identified. 

Preventive action: Action to eliminate the cause of a potential non-conformity. 

Audit 

Internal Audit
GCF-0583/2010 – 15/16

Audit quality is carried out by the Corporate Quality (Auditing of Quality Management 

System) and the Product Quality Audit (Quality Auditing Product) as applicable to each 

Operating Unit and strategically defined by EMBRAER. 

The audits of the various methods are conducted as appropriate, depending on 

definitions of strategic implementation of management systems in Operational Units. 

The audits may be planned and implemented in an integrated manner, considering all 

Management Systems applicable to Operational Units.

Audit of Quality System in Supplier

There is a systematic, independent and documented audit process to obtain objective 

evaluation of the evidence of the Quality System implemented by the suppliers in 

relation to the requirements specified in the procedures. 

MAINTENANCE 

Embraer ensures that all practical measures to prevent, detect and correct failures of 

structural lightning protection features due to manufacturing variability, aging, wear, 

corrosion and possible damage are adopted based on the Structural Inspection 

Requirements (Section 4) , Corrosion and Prevention Control Program – CPCP (Section 

5) and Zonal Inspection Requirements (Section 6) of the MPG-1483/SMRD-1533, 

developed under Air Transportation Association’s Maintenance Program Development 

Document MSG-3 Rev. 2002.1. This process assures 100% accountability for all 

Structural Significant Items (SSIs). The aircraft maintenance manual presents internal 

general visual inspections for wing tanks, forward tanks, and ventral tank to comply with 

the aforementioned MPG-1483/SMRD-1533 requirements.

Embraer also ensures that all the CDCCLs generated during this analysis will be 

included in the second Appendix of MPG-1483/SMRD-1533 as an airworthiness 

limitation as well as in all the procedures related to any appropriate inspection to assure 

the reliability of the applicable lightning protection features, checking any fault tolerant 

and non fault tolerant features. Additionally, a new procedure in the AMM (AMM 51-12-

00/601) requiring the inspection of structural elements (for loose or missing structural 

items, nicks, cracks, dents, erosion, corrosion, deformation, deteriorated protective 

treatment, foreign object, and integrity of the sealant) has been developed and will be 

referred to in the procedures for integral fuel tank access panel removal/installation to 

be carried out whenever an integral fuel tank access panel is open. This Structural 

Lightning Protection inspection must be done in the associated integral fuel tank access 

panel removed from the internal area.