Exemption No. 10138 

UNITED STATES OF AMERICA 

 DEPARTMENT OF TRANSPORTATION 

 FEDERAL AVIATION ADMINISTRATION 

 RENTON, WASHINGTON 98057-3356

In the matter of the petition of 

Embraer 

for an exemption from § 25.981(a)(3) at 

Amendment 25-102 of Title 14, Code of 

Federal Regulations 

 Regulatory Docket No. FAA-2009-1206

GRANT OF EXEMPTION 

By letter dated November 17, 2009, Mr. Ricardo Lavell Hollerbach, Embraer, 12227-901, Sao 

Jose dos Campos, Brazil, petitioned for an exemption from the fuel-tank safety provisions of 

Title 14, Code of Federal Regulations (14 CFR) 25.981(a)(3), as amended by Amendment 

25-102, as it relates to the fuel tank structural lightning protection. If granted, the exemption 

would permit type certification of Embraer Model EMB-135BJ Enhanced airplanes. 

The petitioner requests relief from the following regulation: 

Section 25.981(a)(3) as amended by Amendment 25-102: 

(a) No ignition source may be present at each point in the fuel tank or fuel-tank system 

where catastrophic failure could occur due to ignition of fuel or vapors. This must be 

shown by: 

(3) Demonstrating that an ignition source could not result from each single failure, from 

each single failure in combination with each latent failure condition not shown to be 

extremely remote, and from all combinations of failures not shown to be extremely 

improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely 

damage must be considered. 

The petitioner supports its request with the following information: 

This section quotes the relevant information from the petitioner’s request with minor edits for 

clarification. The complete petition is available at the Department of Transportation’s Federal 

Docket Management System, on the Internet, at http://www.regulations.gov, in docket No. 

FAA-2009-1206. 
For clarification purposes, this petition is related to EMB-135BJ model with the 

modifications presented in the DCA 0145-000-00020-2008/FAA, herein called 

EMB-135BJ Enhanced. 

Embraer is petitioning for an exemption from 14 CFR 25.981(a)(3) for the EMB-135BJ 

Enhanced model, which included Amendment 25-102 to its certification basis. 

Section 25.981(a)(3) text: 

(a) No ignition source may be present at each point in the fuel tank or fuel tank system 

where catastrophic failure could occur due to ignition of fuel or vapors. This must be 

shown by: 

(3) Demonstrating that an ignition source could not result from each single failure, from 

each single failure in combination with each latent failure condition not shown to be 

extremely remote, and from all combinations of failures not shown to be extremely 

improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely 

damage must be considered. 

The requirement applied to the structure uses triple redundancy with independent 

lightning-protective features in the fuel-tank design. Embraer has “state-of-the-art” 

design solutions, implemented on the EMB-135BJ model, which have successfully 

demonstrated compliance with previous tests/requirements and further detailed design 

review concerning direct effects of lightning, providing an adequate level of safety. 

Description of the EMB-135BJ Enhanced design is presented below, following Federal 

Aviation Administration (FAA) Policy Memo ANM-112-08-002 instructions. 

1. Supportive Information 

1.1 Introduction 

EMB-135BJ has been certified considering amendment 1 through amendment 84 and 

several other amendments up to amendment 98. On September 18, 2008, a design change 

was applied (EMB-135BJ Enhanced) and its certification basis was proposed to be 

updated, where Amendment 25-102 was included. 

EMB-135BJ had already performed a Design Review to verify the need for modifications 

to comply with SFAR 88 requirements and the applicability of respective modifications, 

as required. Consequently, EMB-135BJ Enhanced also considers the requirements above. 

EMB-135BJ Enhanced is eligible to submit a petition for exemption of §25.981(a)(3) for 

structural lightning protection based on FAA Policy Memo ANM-112-08-002, 

considering flammability standards of 7% as per current regulation by the application 

time. 

1.1.1 Overview 

EMB-135BJ Enhanced has seven fuel tanks installed as described below: 

 External Wing Fuel Tanks - as part of the wing, there is a wing stub below the 

fuselage which is not exposed to lightning direct effects; 

 2 
 External Underbelly Fuel Tanks - below fuselage, forward of the wing; 

 External Ventral Fuel tank - below fuselage, aft of the wing; 

 Internal Rear Fuselage Fuel Tanks - inside rear-fuselage section. 

The external fuel tanks follow common design solutions for structural lightning 

protection, where “spark-free” design was adopted. Additionally, electrical bonding and 

sealing in lightning-impact areas is employed. 

The internal rear-fuselage fuel tanks are not exposed to direct effects of lightning since 

they are installed inside the fuselage. 

There is no fuel tank exposed to lightning zone 1. The wing fuel tank ends before 

lightning zones 1 and 2 in the wing tip. The wing fuel tank is exposed to lightning-impact 

zone 2 only 0.5m near the region between fuselage and wing root. 

1.2 Manufacturing Process, Quality Control and Training 

Embraer is certificated to manufacture aircraft, where manufacturing processes applied to 

the production of the tanks were established to provide a high level of conformity with 

the original design. Accuracy, repeatability and traceability of the processes are 

controlled by a set of operations applied by qualified personal, according to an internal 

quality system, which is periodically audited for compliance. 

For EMB-135BJ Enhanced, Statistical Process Control (SPC) for the drilling process is 

implemented in the production line. Data collection and immediate analysis of the data is 

performed by qualified production operators in SPC with applicable production activities, 

providing immediate feedback about the process and, if necessary, the application of the 

corrective actions. 

As with the drilling process, sealing is another important operation that is also performed 

by operators with specific qualifications, the process of which meets all controls from the 

quality-system requirements such as controlled records of type of sealant, curing time, 

and the date of sealant application. 

1.3 Maintenance Program 

1.3.1 Preventive Maintenance Tasks 

The instructions for continued airworthiness have been developed in accordance with 

AC 121-22 using Air Transport Association's Maintenance Program Development 

Document MSG-3 Rev. 2002.1. This process, approved by the FAA, ensures 100% 

accountability for all Maintenance Significant Items (MSIs) and Structural Significant 

Items (SSIs). 

The inspection intervals listed in the Maintenance Planning Guide (MPG) enable 

detecting and solving any latent defects. 

As required by AC 121-22, the second appendix of the MPG is the list of the 

airworthiness limitations. The appropriate inspections to ensure the reliability of the 

lightning-protection features that are being developed, and will be included as Critical 

 3 
Design Configuration Control Limitations (CDCCLs) in these airworthiness limitations 

in accordance with § 25.981.

1.3.2 Repairs/Restoration 

Sealing defects are repaired in accordance with the approved Structural Repair Manual 

(SRM) - ATA 51 Standard Practices (procedure 51-20-01-PR). This procedure restores 

the protections to the same level and with the same products and techniques as the 

original design specifications. 

Structural defects are repaired in accordance with the approved SRM or must be reported 

to Embraer for disposition, as per the SRM Introduction. 

In addition to the CDCCL for the fuel system, a procedure for inspection of sealing and 

structural conditions (no corrosion or spark mark, and integrity of fasteners and sealing) 

of the integral tanks (wing and fuselage tanks) is being developed and will be included in 

the Aircraft Maintenance Manual (AMM) to be performed whenever maintenance in the 

area of the integral tanks is done. 

Also, apart from the maintenance tasks, the pilot’s daily preflight check will contribute to 

detecting fuel leaks and associated fastener damage. 

1.4 Lightning Protection 

1.4.1 Design Considerations 

EMB-135BJ was designed with a “spark-free” vapor-ignition philosophy. The design has 

demonstrated compliance to lightning protection by exhaustive laboratory tests. The 

adopted solutions have also shown to be appropriate by the field service data of the whole 

fleet, which accumulated more than 16 millions flight hours. 

The need for a third leg of protection, necessary to comply with § 25.981(a)(3), would 

require a great design change of the fuel tanks and it would represent a great impact to 

the EMB-135BJ Enhanced model. In other words, the modification of the fuel tanks 

would require a design solution still not totally known, different from those actually 

existent in the market. These modifications would considerably reduce the performance 

and efficiency of the aircraft, what would make the development of this aircraft unviable, 

provided it would not be competitive when compared to the existent aircraft in the 

market. 

Therefore, complete compliance with § 25.981(a)(3) is impractical, considering the 

present aircraft-construction technology. Consequently, an exemption is being petitioned 

based on the assessment in the next sections, through tests and failure-mode identification 

in fuel-tank structure, following the recommendations from FAA policy memo 

ANM 112-08-002. 

 4 
1.4.2 Potential Failure-Mode Identification 

An analysis was performed considering structural failure modes that would occur while 

in production or during operation/maintenance of a fuel tank in the aircraft life cycle. 

These structural failures would prevent a fuel tank from being protected against lightning, 

being dependent on the lightning current level and the localization in the fuel tank. 

Identification of these failures is being performed through a Design Review of the fuel 

tanks. Analysis was performed with the objective to identify structural joints with the 

following conditions: 

 Fault-Tolerant: design solutions that are able to provide 2 independent protective 

features for structural lightning protection; 

 Non-Fault-Tolerant: design solutions that are able to provide a protective feature 

for structural lightning protection. 

In both cases, analyses were performed of the failures that would occur and these 

conditions will be tested or assessed as described in the next sections. 

1.4.3 Fault-Tolerant Joint Types 

For all the joints analyzed, the worst cases shall be tested for direct effects of lightning. 

Structural joints that have two lightning protective features are presently used in 

EMB-135BJ Enhanced fuel-tanks skins. 

1.4.3.1 Direct Effects of Lightning (DEL)Test 

In order to demonstrate that EMB-135BJ Enhanced has two independent protective 

features, a Direct Effects of Lightning Test will be performed, where the following 

conditions will be verified: 

 Testing first protective feature without sealant applied over fasteners collars and 

nearby structural joints; 

 Testing second protective feature (sealant) with failure added to the first 

protective feature. 

First Protective Feature: Fasteners and structure skin 

Fasteners used on fuel-tank skin have a countersunk head and conductive coating. 

Drilling of fuel-tank skin is done prior to installation of the fasteners. As a consequence, 

adequate electrical bonding between the fastener and fuel-tank skin is provided, since no 

nonconductive coating nor painting is applied during the crimping of the fasteners over 

the fuel-tank skin. 

Second Protective Feature: Sealant 

Sealants used in fuel tanks are implemented to retain eventual lightning spark inside fuel 

tank that would outreach the first protective feature. They are applied over fastener 

collars and around fuel-tank-skin structural joints. 

 5 
1.4.4 Non-Fault-Tolerant Joint Types 

Fatigue analysis is being performed to identify the regions that may have fatigue 

cracking. 

There are 3 areas of possible fatigue cracking: 

 Fuel-tank skin, on a region without fasteners; 

 Joint between two fuel-tank skins, with fasteners; 

 Ribs, spars, stringers, skin, and support joints, with fasteners. 

Structural design, analysis and fatigue testing have demonstrated that fastener failure due 

to high load tension is not expected during the aircraft's operational life cycle. 

1.4.4.1 Numerical Probability Assessment 

Numerical Probability Assessment will be performed considering the failure modes 

above, concerning the following data: 

 Probability of failure per flight hour; 

 Determination of ignition thresholds through tests; 

 Probability of current at joint exceeding threshold; 

 Joint Spark Probability per flight hour; 

 Probability of fuel-vapor ignition per flight hour, applying flammability data. 

All non-fault-tolerant joint types’ probability of occurrences will be calculated in order to 

demonstrate that fuel-vapor ignition is extremely improbable. 

The Numerical Probability Assessment will be provided as soon as lightning tests and 

fatigue analysis are finalized, which is estimated to be the end of January 2010. 

2. Issue of Public Interest 

Requirement § 25.981(a)(3) for structural lightning protection leads to the use of three 

highly reliable, independent, and redundant protective features to prevent ignition 

sources. For EMB-135BJ Enhanced, where Amendment 25-102 was included, the 

modifications proposed for the fuel tanks’ structure followed the same design criteria 

required prior to Amendment 25-102. However, they are not sufficient to comply with all 

scenarios of § 25.981(a)(3). 

Compliance demonstration of § 25.981(a)(3) for structural lightning protection would be 

impractical to be implemented provided it will require considerable design modifications 

of the fuel tanks and not yet totally known, considerably reducing performance and 

efficiency of the aircraft, with consequent loss of competitiveness when compared to 

existing aircraft in the market. 

EMB-135BJ Enhanced has state-of-the-art design solutions implemented on the fuel 

tanks which comply with § 25.954 and SFAR 88 requirements. Embraer considers that 

 6 
the solutions implemented on EMB-135BJ Enhanced have an adequate level of safety 

and considers a grant of exemption applicable for this aircraft. 

3. Effect of the Exemption on Safety 

EMB-135BJ Enhanced was designed considering the following mitigation means: 

 Reduction of likelihood of flammable vapors; 

 Prevention of ignition sources. 

Reduction of likelihood of flammable vapors will be complied considering flammability 

standards of 7%, as per current regulation by the application time for all fuel tanks. 

Additionally, the fuel tanks were designed to have continuous ventilation during flight 

and to be far from aircraft heat sources. 

Ignition prevention due to lightning strikes is analyzed through FAA policy memo 

ANM 112-08-002 and the possible failure modes were defined as Fault-Tolerant and 

Non-Fault-Tolerant 

For Fault-Tolerant joint types, it will be demonstrated the independence of the two 

protective features already considered in the design of EMB-135BJ Enhanced fuel tanks. 

For Non-Fault-Tolerant joint types, numerical probability assessment is being performed 

to verify probability of fuel-vapor ignition so that failure is extremely improbable. 

Embraer verified that manufacturing quality and control is adequately performed and 

maintenance procedures consider CDCCL for fuel-system and fuel-tank structure. 

Verification of the low level of flammability exposure, and the analysis and tests to be 

performed for the failure modes identified on fuel-tank structure, will show that EMB135BJ Enhanced has an adequate level of safety, even with the absence of the third leg of 

protection against lightning. Therefore, granting of exemption for EMB-135BJ Enhanced 

would be in the public interest. 

4. Summary 

EMB-135BJ Enhanced has included Amendment 25-102 due to a design change, and 

compliance with § 25.981(a)(3) is considered for the fuel system. However, for structural 

lightning protection, the compliance with § 25.981(a)(3) is not feasible. 

The following tasks are considered to substantiate the exemption: 

 Design Review for the fuel tank structure; 

 Identification of failures that could cause fuel-vapor ignition; 

 Direct Effects of Lightning Tests for Fault-Tolerant and Non-Fault-Tolerant 

structural joint types; 

 Numerical Probability Assessment for Non-Fault-Tolerant structural joint types; 

 Manufacturing and Quality Control Process; 

 7 
 Maintenance tasks including CDCCL for fuel-tank structure; and 

 Embraer participation in the Society of Automotive Engineers (SAE) international 

committee meetings regarding petitions for exemption from § 25.981(a)(3) related 

to fuel-tank structure. 

These tasks will demonstrate that EMB-135BJ Enhanced fuel tanks are assembled with 

strict control of the production process, which guarantees the correct installation of 

fasteners and application of sealant on the fuel tanks. Additionally, maintenance 

procedures adequately verify fastener installation and sealant application over aircraft 

operational life cycle. 

Fatigue cracking and fastener failures have periodic interval times to verify any sign of 

damage during aircraft operational life cycle. 

Therefore, Embraer considers EMB-135BJ Enhanced has an adequate level of safety 

considering the protections of the structure against direct effects of lightning and the 

benefits of flammability characteristics of the fuel tanks, and an exemption to 

§ 25.981(a)(3) is being petitioned. 

The following quotes the relevant information from the petitioner’s reply by letter, dated May 

31, 2010, to the FAA’s request for more information with minor edits for clarification. The 

petitioner’s complete response is available at the Department of Transportation’s Federal Docket 

Management System, on the Internet, at http://www.regulations.gov, in docket No. FAA-2009-

1206. 

FAA Statement/Inquiry 1 

The petitioner should show that all practical measures have been taken to meet the 

requirements of § 25.981(a)(3) for the fuel-tank structure. For the design features for 

which an exemption is sought, the petitioner should show what potentially compliant 

design changes were examined, and what design changes were ruled out based on 

impracticality. 

IMPRACTICALITY OF 25.981(A)(3) STRUCTURAL THIRD PROTECTIVE FEATURE 

EMB-135BJ Enhanced model has included FAA Amendment 25-102 to its certification 

basis as a result of a major change, where an external ventral fuel tank was added to the 

aircraft. 

Requirement §25.981(a)(3) for structural lightning protection leads to the use of three 

highly reliable, independent and redundant protective features to prevent ignition sources. 

For EMB-135BJ Enhanced, modifications proposed for the fuel tanks structure followed 

the same design criteria required prior to Amendment 25-102. However, they are not 

sufficient to comply with all scenarios of §25.981(a)(3). 

During design review process, fuel tank structure has been analyzed in order to determine 

if it would be possible to include one more protective feature, besides the other existent 

ones. Below is the list of alternatives searched for the third protective feature: 

 Anti static fuel bladder; 

 8 
 Machined structural element with insert; 

 Protective cover for the structural joint (besides sealant); 

 One more skin layer (metal or composites); 

 Sealant application over the skin surface; and 

 Adhesive bonded structural elements. 

Incorporation of alternatives above would involve considerable design changes on the 

whole structure of the fuel tanks. This would affect considerably: 

 Fuel volume: lower capacity due to accommodation of the third protective 

feature; 

 Maintenance: increased workload due to more parts (bladder, bonded parts, 

another skin layer) added inside fuel tanks; 

 Repair: in the case of fuel bladder, removal and installation of a new bladder 

would be required prior to dispatch of the aircraft; and 

 Structural Analysis: novel design. 

Therefore, addition of a third protective feature to comply with §25.981(a)(3) is 

impractical since it would demand a new design of the fuel tanks with aircraft lower 

flight performance and greater maintenance and repair workload from the design 

envisioned for EMB-135BJ Enhanced model, what would make the development of this 

aircraft unviable, provided it would not be competitive when compared to the existent 

aircraft in the market. 

For EMB-135BJ Enhanced, compliance demonstration will be based on the following 

conditions: 

 FAA/ANAC/EASA §25.581, §25.899, and §25.954 are already complied through 

EMB-135BJ certification basis. 

 FAA/ANAC §25.981(a)(3) for structural lightning protection: petition for 

exemption with execution of DEL tests and analysis according to ANM-112-08-

002. 

Policy Guidance developed by SAE AE-2 and EUROCAE WG-31 lightning committees 

regarding FAA Policy Memo ANM 112-08-002 was used as reference for definition of 

DEL tests and fault tolerance analysis for compliance of structural lightning protection 

according to §25.981(a)(3). 

In the next section, it will be described the process for determination of structural joints 

to be tested and analyzed for fault tolerance. Lightning tests and analysis results are 

presented subsequently. 

FAILURE CONDITIONS ASSESSMENT 

For clarification purposes, all external fuel tanks are made of aluminum. 

 9 
A list of all structural joints in fuel tanks was generated after design review analysis, 

covering any type of structural present in the fuel tanks. 

All parts existent in each structural joint were analyzed and they were reviewed 

according to their lightning zone (2A or 3). 

Sealing was analyzed in the structural joints, especially on the fasteners heads, in each 

fuel tank. 

Based on the assumptions above, structural joints were represented in specimens for 

lightning tests. Typical failure modes were added to the specimens. In order to check if 

the lightning protective features are independent, reliable and effective, they were 

adequately disabled in the specimens and tested for lightning. 

TEST RESULTS 

Fault Tolerant Features 

Lightning tests were performed and it was verified that access door required to be 

modified in order to have two lightning fault tolerant features. Additional tests were 

performed and the access door passed with modification to a bonded dome nut. There 

were two configurations of bonded dome nut that passed the test. 

The new dome nuts will be incorporated to the production line of EMB-135BJ Enhanced 

for compliance of this exemption which requires two fault tolerant features. 

Non-fault-tolerant Features 

In this case, analysis was performed, as described in the next question. 

FAA Statement/Inquiry 2 

Instead of compliance with the requirements of § 25.981(a)(3), the applicant must show 

that the design includes at least two independent, effective, and reliable lightningprotection features (or sets of features) such that fault tolerance to prevent lightningrelated ignition sources is provided for each area of the structural design proposed to be 

exempt from the requirements of that regulation. Fault tolerance is not required for any 

specific design feature if: 

a. providing fault tolerance is shown to be impractical for that feature, and 

b. fuel-tank vapor ignition because of that feature and all other nonfault tolerant 

features, when their fuel-tank vapor ignition event probabilities are summed, is shown to 

be extremely improbable. 

NUMERICAL PROBABILITY ASSESSMENT 

It was verified, through lightning tests and analysis presented above that there are two 

non-fault-tolerant features, as described below: 

1. Structural element fatigue cracking 

2. Fastener fatigue cracking 

 10 
In this case, it is impractical to provide fault tolerance of the structural element itself, 

since fatigue cracking will disable any type of additional protection feature implemented 

for the structural element. 

Following Policy Memo ANM 112-08-002 recommendations, a probability analysis was 

performed, as illustrated by the flow chart in figure 1, which is in accordance to Policy 

Guidance developed by the lightning committees SAE AE-2 and EUROCAE WG-31. 

The calculation method is based on three main probability parameters, as described 

below: 

1. RL-CRITICAL: Rate of critical lightning attachment. This probability is related to the 

following parameters: 

 a. RLIGHTNING: Lightning strike rate 

 b. FATTACH: General attachment area factor 

 c. FSPARK: Spark threshold factor 

2. PSTRUCT-n: Probability of structural failure 

3. PFLAM: Fleet flammability exposure 

By multiplying the main three parameters, the ignition rate for one failure is obtained. 

Total Fuel tank ignition rate is the sum of all single failures. 

Analysis was performed and below are the results found for each fuel tank: 

 Wing Tank Ignition Rate: 8,54 x 10-11

 11 
 Underbelly Tank Ignition Rate: 9,79 x 10-10

 Ventral Tank Ignition Rate: 1,55 x 10-10

The Wing and Ventral fuel tanks provided probability failures lower than 1x10-9, which 

indicates that fuel vapor ignition would be extremely improbable to occur. 

In the case of Underbelly fuel tank, it was provided a probability failure of 0,98 x 10-09, 

being a marginal value next to the scale of 1x10-09. 

This value is linked to the low quantity of FH accumulated for this fuel tank compared to 

the other ones. 

On the other hand, it shall be noted that all external fuel tanks have adopted the same 

structural design philosophies. Similarly, lightning protection of the fuel tanks have the 

same approach, by providing the same type of fault tolerant protection features on them. 

Therefore, the probability failure obtained for the underbelly fuel tank is acceptable, 

based on the analysis detailed above, and can be considered as extremely improbable, 

too. 

FAA Statement/Inquiry 3 

The applicant must perform an analysis to show that the design, manufacturing 

processes, and airworthiness limitations section of the instructions for continued 

airworthiness include all practical measures to prevent, and detect and correct, failures 

of structural lightning protection features because of manufacturing variability, aging, 

wear, corrosion, and likely damage.” 

With regard to item 3, above, your petition discusses manufacturing controls but it does 

not specifically address inspection of non-fault-tolerant design features. We request 

confirmation that any non-fault-tolerant design features will receive 100 percent 

inspection to validate that the features are present at the time of manufacture. We also 

request confirmation that the Critical Design Configuration Control Limitations 

(CDCCLs) discussed in your petition will include periodic, in-service inspection of all 

ignition-prevention features, as well as non-fault-tolerant features. 

MANUFACTURING PROCESS 

Fuel tank structure assembly is manufactured based on the following SAE standards: 

1. AS9100C “Quality Management Systems – Requirements for Aviation, Space and 

Defense Organizations” 

2. AS9003 “Inspection and Test Quality System” 

3. AS9102A “Aerospace First Article Inspection” 

It will be presented the whole production process of the fuel tanks, in order to 

comprehend the existent control for mitigation of typical failures modes which would 

produce quality escapes. Every Fault-Tolerant and Non-fault-tolerant Feature drilling, 

assembly and sealing is inspected as will be described below. 

 12 
Quality Management System 

Quality Management System covers all stages of development and production, to achieve 

quality specifications and product safety, as illustrated in figure 2. The needs and 

opportunities for improvement and correction are flagged by the feedback and 

independent assessment of compliance with the procedures and results are verified and 

guaranteed by the Quality Audit. 

All actions occur in an environment created by the quality system and processes related 

to this system. 

Management qualification system keeps the records in the system of the company 

following process steps, as: establish processes, define the requirements, train those 

involved. 

Requirements for Qualification: 

To be qualified in a given process, employee must meet the requirements for OJT (On the 

job training) and theoretical requirements. 

Requirements of Theoretical Knowledge: 

Carry theoretical training defined for a process. 

Requirements for Practical Knowledge (OJT): 

The coach must record the attendance requirements for OJT for the operators under their 

responsibility. 

The supervisor must verify and record the attendance requirements for qualification of 

personnel under their responsibility 

 13 
In the case of special procedures, the personnel must be checked and certified by Quality 

Leadership in the area. At their discretion, the Quality Leadership can apply theoretical 

examinations, practical examinations or other form of verification before certifying an 

employee. 

Employees certified in special processes, or critical processes will receive individualized 

stamps from quality department. 

Human resources training can be divided in parts as illustrated in figure 3. Each part is 

associated to a specific type of work and a set of training courses which will guarantee 

adequate assembly of the fuel tanks. 

Control of Records 

The following records and evidence of qualification shall be kept for each qualified 

employee: 

 Name plate and the employee; 

 Identification of the process in which the employee is qualified; 

 Identification of the specific procedure; 

 Number stamp, if applicable; 

 Date of qualification and validity; 

 Date of commencement and completion of OJT; 

 Employee experience in the process on the date of qualification, including the 

period of OJT (years and months); 

 Identification of the coach responsible for OJT; 

 14 
 Identification of the immediate superior; 

 Identification of quality leadership in the area (only for special cases); 

 Records and other evidence required by the special procedure. 

 The records and evidence should be kept in the company system. 

Records are kept to demonstrate compliance with specific requirements and effective 

operation of the management system applied in the operational units of the manufacturer. 

Sheet Compliance – FIC 

It is a printed document, which allows recording of values, signatures and seal 

impressions, for evidence of production process operations. When all related 

documentation is closed, it is filed to preserve data traceability. 

Rework Order 

Conformity end of the document is executed by members of the Product Quality. 

Production Process Verification 

SAE AS9102A is the reference document for initial production of any new product or 

modification proposed for EMB-135BJ Enhanced. 

FAI - First Article Inspection 

Inspection process complete physical and functional, independent and documented to 

verify that prescribed production methods produce an acceptable item, as specified by 

engineering drawings, planning, purchase order, engineering specifications and/or other 

relevant documents. 

FAI is a process that composes actions regarding “Approval of Initial Production 

Process,” in order to confirm the adequacy of the process to produce conforming items or 

detect deficiencies to be remedied before the start of serial production. 

Application to items manufactured at EMBRAER 

FAI should be applied in 100% of standard items manufactured and assembled internally. 

Reapplication of the FAI for validation of design, process and tooling changes 

Reapplication of the FAI should be analyzed under the following conditions: 

1. Modification of the sources of manufacturing processes, inspection methods, 

location of manufacturing, tooling or material with the potential to affect 

assembly, form, function and producibility. 

2. Changes in the numerical control program or transition to other media with the 

potential to affect assembly, form or function. 

3. Natural occurrence or event caused by human interference that may adversely 

affect the manufacturing process. 

4. Stop production for two years or as specified by the customer. 

 15 
Control of Production 

Preparation for drilling (SETUP) 

Measurement values of the holes are recorded in a specimen, before the start of drilling, 

for verification and validation of the tool. 

Items to check in the production instructions 

1. Deburr holes after final drilling. 

2. Holes for pins, as specific diameter (checked at determined intervals during 

drilling execution), roughness, and step away from the edge. 

3. Installation of the pins, as: correct grasp, settling of the head (head, collar, washer 

and nut) and protection of the collar. 

4. Verify countersink for conventional rivets and pins, as the diameter of the 

countersunk, depth, radius of agreement (settlement) and finishing. 

5. Holes for rivets as to: specific diameter, edge distance, distance between holes 

and finishing. 

6. Rivets, as to: snap rivet head, conformation of the head (height x diameter), 

cracks and marks 

To avoid misalignment of the holes, during drilling process a device is used to keep the 

tool at 90 degrees. 

Sealing 

Before sealing, employee makes a visual inspection so that installation is clean and there 

are no foreign objects in the region. Then, sealing process is initiated and performed by 

another employee (sealant specialist). This specialist will perform another visual 

inspection to ensure that no particle or foreign object remained in the area. 

Sealant application is verified for: 

 Uniformity of the layer (interface) 

 Heals 

 Bubbles 

 Retraction 

Special qualification is required for sealing. 

As detailed above in this section, typical modes of failures that could become quality 

escapes are adequately mitigated. When this type of non conformity is found, corrective 

actions are generated, as detailed in the next section, which eliminates the possibility to 

have latent failures in the fuel tank. 

 16 
Corrective and Preventive Actions 

There is a system which implements corrective and preventive actions, with emphasis on 

the production process, including at the stage of development in order to eliminate the 

root causes of nonconformities identified on the product or process, and preventing its 

recurrence (or occurrence). 

CAT (Corrective Action Team) 

Team of corrective and preventive action, under the coordination of quality, composed of 

representatives of different areas of the company, responsible for root cause analysis and 

definition of plans for corrective and preventive actions relating to the production 

process. 

Stages of Process of Preventive and Corrective Actions 

Definition 

Describe the nonconformance, providing in detail the necessary information for the 

characterization of the problem. 

Analysis 

Record and analysis of the data for identifying the root cause of the problem (Ishikawa, 

correlation analysis, hypothesis testing, Kepner Tregoe, etc). Highlight the root cause. 

Containment and Action Plan 

Containment 

Blocking action of non-compliance to avoid or minimize the impact of a new occurrence 

and facilitate the continuity of the production process until the completion of corrective 

action. 

Research 

Actions that will assist in the identification or confirmation of the root cause of the 

problem. 

Plan of Action 

Actions set for elimination of the root cause of the problem. 

Similarity Analysis 

To verify if non-conformity affects pieces or similar processes. 

Verification of effectiveness 

Actions of verification of effectiveness of problem elimination, or improve of process; 

with their evidences. 

In order to guarantee that correction was performed, representative information can be 

used as evidence, for example: aircraft or sequence of operations observed during a 

representative period of time. 

 17 
Supplier 

Supplier Development 

The management strategy for the development of material and supplier based on the 

application of different management actions, in type, intensity and frequency, depending 

on the classification of material and supplier that is established from the criticality of the 

product versus risk of the supplier. 

Performance Management and Corrective Action/Preventive of Suppliers 

There is a documentation which formalizes and sends corrective or preventive action to 

non-conformities detected in all phases of the product manufacturing. 

Corrective Action: Action to eliminate the cause of non-compliance identified. 

Preventive action: Action to eliminate the cause of a potential non-conformity. 

Audit 

Internal Audit 

Audit quality is carried out by the Corporate Quality (Auditing of Quality Management 

System) and the Product Quality Audit (Quality Auditing Product) as applicable to each 

Operating Unit and strategically defined by EMBRAER. 

The audits of the various methods are conducted as appropriate, depending on definitions 

of strategic implementation of management systems in Operational Units. 

The audits may be planned and implemented in an integrated manner, considering all 

Management Systems applicable to Operational Units. 

Audit of Quality System in Supplier 

There is a systematic, independent and documented audit process to obtain objective 

evaluation of the evidence of the Quality System implemented by the suppliers in relation 

to the requirements specified in the procedures. 

MAINTENANCE 

Embraer ensures that all practical measures to prevent, detect and correct failures of 

structural lightning protection features due to manufacturing variability, aging, wear, 

corrosion and possible damage are adopted based on the Structural Inspection 

Requirements (Section 4) , Corrosion and Prevention Control Program – CPCP (Section 

5) and Zonal Inspection Requirements (Section 6) of the MPG-1483/SMRD-1533, 

developed under Air Transportation Association’s Maintenance Program Development 

Document MSG-3 Rev. 2002.1. This process assures 100% accountability for all 

Structural Significant Items (SSIs). The aircraft maintenance manual presents internal 

general visual inspections for wing tanks, forward tanks, and ventral tank to comply with 

the aforementioned MPG-1483/SMRD-1533 requirements. 

Embraer also ensures that all the CDCCLs generated during this analysis will be included 

in the second Appendix of MPG-1483/SMRD-1533 as an airworthiness limitation as well 

as in all the procedures related to any appropriate inspection to assure the reliability of 

 18 
the applicable lightning protection features, checking any fault-tolerant and non-faulttolerant features. Additionally, a new procedure in the AMM (AMM 51-12-00/601) 

requiring the inspection of structural elements (for loose or missing structural items, 

nicks, cracks, dents, erosion, corrosion, deformation, deteriorated protective treatment, 

foreign object, and integrity of the sealant) has been developed and will be referred to in 

the procedures for integral fuel tank access panel removal/installation to be carried out 

whenever an integral fuel tank access panel is open. This Structural Lightning Protection 

inspection must be done in the associated integral fuel tank access panel removed from 

the internal area. 

FAA Statement/Inquiry 3 

Submit flammability-compliance data showing the flammability to be equivalent to an 

unheated aluminum wing tank. 

Flammability exposure values obtained from Monte Carlo’s method for each fuel tank are 

shown below (based on unheated metallic wing fuel tank): 

 Main Fuel Tank 1 = 2.63% 

 Main Fuel Tank 2 = 2.62% 

 Underbelly Fuel Tank 1 = 1.69% 

 Underbelly Fuel Tank 2 = 1.69% 

 Ventral Fuel Tank 1 = 1.78% 

 Rear Fuselage Fuel Tank 1 = 1.34% 

 Rear Fuselage Fuel Tank 2 = 1.34% 

These are the values considered for the Numerical Probability Analysis for non-faulttolerant values. 

Federal Register publication 

A summary of this petition was published in the Federal Register on January 20, 2010. The FAA 

received no comments. 

The FAA’s analysis 

In May 2001, the FAA issued the “Transport Airplane Fuel Tank System Design Review, 

Flammability Reduction, and Maintenance & Inspection Requirements” final rule (Docket 

FAA-1999-6411, effective June 6, 2001) that was adopted as Amendment 25-102. This 

amendment added specific ignition-prevention requirements and a new 

flammability-minimization requirement to § 25.981. 

The amended ignition-prevention requirements in § 25.981(a)(3) require consideration of factors 

such as aging, wear, and maintenance errors as well as the existence of single failures, 

combinations of failures, and latent failures that may be the cause of ignition sources in fuel 

tanks. 

 19 
Section 25.981, as amended by Amendment 25-102, requires that airplane designs be protected 

from the effects of structural lightning with features that are failure tolerant. Prior to this 

amendment, only § 25.954 had been applied to lightning protection of fuel tanks. That provision 

requires only that the airplane design prevents ignition of vapors in the tank with no 

consideration for anticipated design failures, aging, and wear, or maintenance errors. 

Systems with potentially catastrophic failure modes would typically meet the requirements of 

§ 25.981(a)(3) by providing at least triple redundancy in their protective features with periodic 

inspections, or dual-redundant features with continuous system monitoring to reduce the latency 

period. Dual-redundant design schemes could only comply with § 25.981(a)(3) when combined 

with either regular inspections at very short intervals or a monitoring device to verify the 

functionality of the protective features. Inspection of the various design features may be difficult 

or impossible if the feature is internal to the fuel tank and part of the wing structure. 

When § 25.981 was applied to the structural lightning aspects of new airplane designs, applicants 

found it was impractical to meet the standard and incorporate additional protective features. We 

issued two exemptions and developed new policy. The two exemptions were for the Dassault 

Falcon 7X, signed on April 20, 2007, and the other was for the Hawker 4000, signed on August 

28, 2008. On May 26, 2009, following a public-comment period, we adopted new policy that 

defined criteria that we would consider regarding granting of exemptions and issuance of special 

conditions for structural lightning protection. Embraer provided substantiation in their exemption 

request that meets the criteria of this policy. 

As it applies to fuel-tank lightning protection for basic airframe structure (airplane skins, joints, 

ribs, spars, stringers, and associated fasteners, brackets, and coatings), the petitioner argues that 

both the addition of a third, independent, ignition-source protective feature, and providing 

sufficient monitoring to detect latent failures in a dual-protective feature, are impractical for 

certain areas of metallic airplane-wing structure. As discussed in the policy memo, the petitioner 

evaluated possible means of providing additional protective features as a condition of this 

exemption and found it was impractical to incorporate those features into the EMB-135BJ 

enhanced. Embraer also identified two features through lightning tests and analysis that are not 

fault tolerant: structural-element fatigue cracking and fastener fatigue cracking. Embraer showed 

the probability of fuel-vapor ignition, due to these non-fault-tolerant features, was extremely 

improbable, which satisfies the criteria in the policy memo. 

We agree with the petitioner that compliance with subsection (a)(3) would require a combination 

of redundant protective features and a high level of reliability of those features that is excessively 

expensive to produce and maintain using available technology. Lightning energy can be 

transferred to fuel tanks installed in wings through the many fasteners and other structural 

elements. It is impractical to provide either continuous monitoring of the “health” of the 

protective features for these structures, or to inspect them frequently enough to detect latent 

failures. These features are typically integral to the fuel-tank structure, or internal to the fuel 

tanks, requiring access into the tank to verify the integrity of the feature. Inspections of airplane 

structure requiring fuel-tank entry may be scheduled only once or twice during the life of the 

airplane. 

As discussed in the preamble to Amendment 25-102, conventional, unheated, aluminum wing 

tanks minimize fuel-tank flammability exposure, as required by § 25.981(c). Even if a latent 

failure of a protective feature occurred for such a tank, the risk of lightning-induced fuel-tank 

 20 
explosions is relatively low when the tank is fueled with low-volatility fuels such as Jet A, as 

demonstrated by the service experience of these tanks. Because of the impracticality of full 

compliance with § 25.981(a)(3) for lightning protection and the reduced flammability exposure 

of these tanks, we believe granting an exemption is in the public interest if applicants can show 

that their design provides practical dual-protective features for fuel-tank structural lightning 

protection that are both independent and robust, and show the probability of fuel-tank ignition to 

be extremely remote for any non-fault-tolerant features. 

The FAA considers the petitioner’s request to be in the public interest because the EMB-135BJ 

Enhanced airplane design provides an acceptable level of safety, and full compliance to 

§ 25.981(a)(3) would require significant modifications to the fuel-tank design, introduce 

additional complexity in the manufacturing and quality process as well as maintenance 

procedures, and add significant cost and schedule impact to the EMB-135BJ Enhanced airplane 

program. The EMB-135BJ Enhanced airplane type-certification program is near completion. 

Without this exemption, Embraer would not receive design approval for the aircraft in a timely 

manner, putting it at an unfair disadvantage with its competitors. This would cause disruption to 

several major corporations in the US and the world that are anticipating the imminent delivery of 

the EMB-135BJ Enhanced airplane to meet their business needs. These Embraer customers may 

need to find alternatives for their aviation needs if this exemption is not granted. 

Embraer states in their petition that the results of their flammability analyses show that the fleet 

average flammability exposure of the fuel tanks is low and complies with § 25.981(c), adding 

that Embraer’s “‘state-of-the-art’ design solutions implemented on EMB-135BJ model ... have 

successfully demonstrated compliance with previous tests/requirements and further detailed 

design review concerning direct effects of lightning, providing an adequate level of safety” per 

FAA Policy Memo ANM-112-08-002 instructions. Embraer has also conducted risk assessments 

and has shown the probability of fuel-tank ignition to be extremely remote for the two non-faulttolerant features of their design. The FAA has verified these analyses and agrees with Embraer’s 

conclusion. 

In addition to validating independent and effective design means of lightning protection for 

certification on new production airplanes, § 25.981(b) requires establishing critical designconfiguration-control limitations (CDCCLs), inspections, and other procedures to prevent the 

development of ignition sources within the fuel-tank system as the airplanes progress through 

their service life. These limitations, inspections, and procedures must be included in the 

Airworthiness Limitations Section of the Instructions for Continued Airworthiness as required by 

§ 25.1529. 

Embraer has identified maintenance-inspection tasks with appropriate inspection intervals to 

ensure the needed reliability of structural lightning-protection features. These actions should 

maintain the lightning-protection characteristics of the protective features. The timely 

identification of fuel leaks, indicating a sealing defect(s), and subsequent timely repair to restore 

the integrity of the lightning-protection feature, are also important. Embraer has identified 

maintenance-manual procedures that restore the protective features to the same level and with 

the same products and techniques as the original design specifications. The FAA has considered 

the information the petitioner provided and has determined that there is sufficient merit to 

warrant a grant of exemption. 

 21 
 22 

The FAA’s decision 

In consideration of the foregoing, I find that a grant of exemption is in the public interest. 

Therefore, pursuant to the authority contained in 49 U.S.C. §§ 40113 and 44701, delegated to me 

by the Administrator, Embraer is hereby granted an exemption from the requirements of 

14 CFR 25.981(a)(3) as it relates to fuel-tank structural lightning protection to the extent 

necessary to permit type certification of the EMB-135BJ Enhanced airplane. 

Issued in Renton, Washington, on September 21, 2010. 

/s/ 

Ali Bahrami 

Manager, Transport Airplane Directorate 

Aircraft Certification Service