UNITED STATES OF AMERICA 

DEPARTMENT OF TRANSPORTATION 

FEDERAL AVIATION ADMINISTRATION 

RENTON, WASHINGTON 98057-3356 

In the matter of the petition of 

The Boeing Company 

Exemption No. 14593 

Regulatory Docket No. FAA-2015-3086 

for an exemption from§§ 25.90l(c) and 

25.98l(a)(3) ofTitle 14, Code of Federal 

Regulations 

GRANT OF EXEMPTION 

By letter no. CP-L4L-1 5-00233, dated June 22, 2015, Mr. Tim Hendrix, Manager, Certification 

& Airworthiness, The Boeing Company, Boeing Commercial Airplanes, Southern California 

Engineering Design Center, 2401 E. Wardlow Road, Mail Code D800-0022, Long Beach, CA 

90807-5309, petitioned the Federal Aviation Administration (FAA) for an exemption from the 

requirements of§§ 25.90l(c) and 25.981(a)(3) ofTitle 14, Code of Federal Regulations (14 

CFR). This exemption, if granted would allow planned changes to the 767-200/300 (freighters 

only) and 767-300F center-wing-tank (CWT) fuel-quantity indication system (FQIS) and fueloverfill-shutoff surge tank fuselage-wiring installation. 

The petitioner requests relief from the following regulation(s ): 

Section 25.901(c) at Amendment 25-126- Installation. 

For each powerplant and auxiliary power unit installation, it must be established that no 

single failure or malfunction or probable combination of fai lures will jeopardize the safe 

operation of the airplane except that the failure of structural elements need not be 

considered if the probability of such fai lure is extremely remote. 

Section 25.98l(a)(3)- Fuel tank ignition prevention. 

(a) No ignition source may be present at each point in the fuel tank or fuel tank system 

where catastrophic failure could occur due to ignition of fuel or vapors. This must be 

shown by: 

(3) Demonstrating that an ignition source could not result from each single failure, from 

each single fai lure in combination with each latent failure condition not shown to be 

extremely remote, and from all combinations of failures not shown to be extremely 
improbable. The effects of manufacturing variability, aging, wear, corrosion, and likely 

damage must be considered. 

Related sections of 14 CFR: 

Section 25.1309- Equipment, systems, and installations, states that required 

equipment, systems, and installations be designed to ensure that they perform their 

intended functions under any foreseeable operating condition, and that the occurrence of 

any failure condition that would prevent the continued safe flight and landing of the 

airplane be extremely improbable. 

The petitioner supports its request with the following information: 

This section quotes the relevant information from the petitioner's request, with minor edits for 

clarity. The complete petition is available at the Department of Transportation's Federal Docket 

Management System, on the Internet at http://regulations.gov, in docket no. FAA-2015-3086. 

Background: 

The FAA is planning to issue a NPRM for the 767 similar to the 757 NPRM 2011-NM094-AD [a proposed airworthiness directive (AD)], which proposes to require modifying 

the FQIS wiring or fuel tank systems to prevent development of an ignition source inside 

the center fuel tank. Paragraph (h)(2) states: "Within 72 months after the effective date of 

this AD, modify the airplane by separating FQIS wiring that runs between the FQIS 

processor and the center fuel tank, including any circuits that might pass through a main 

fuel tank, from other airplane wiring that is not intrinsically safe." 

Boeing is proposing to accomplish the FAA's planned AD-mandated changes to separate 

the FQIS CWT wiring between the FQIS processor and the center fuel tank, as well as 

using the FQIS Built-In Test Equipment (BITE) check. In addition, changes to separate 

the Fuel Overfill Shutoff Surge Tank wiring from the Fuel Level Sensor Control 

assembly to the center fuel tank, along with its wiring integrity checks, will be done. The 

BITE service bulletin 767-28-0118, which includes the instructions to ensure tank circuitwiring integrity, is already approved by the FAA. The CWT FQIS wiring separation is 

being prepared with guidance from the FAA's approved standard for retrofit wire 

separation from FQIS wiring. But the combination of BITE and wire separation will not 

result in the FQIS system being compliant to 25.901 (c) [25-126] and§ 25.981 (a)(3) [25-

125]. Since the wiring changes are a change to type design, but will not be compliant, an 

exemption is being petitioned. The FAA's response to a 757 NPRM comment suggests 

that FAA will accept petitions for exemption for the "latent-plus-one" requirements of 

sections 25.901 (c) and 25.981 (a)(3) of the Federal Aviation Regulations, and there has 

also been FAA communication that this acceptance applies to the 767. 

This petition for an exemption is being made since full compliance to these rules for the 

767 would require extensive system design/installation changes, but do not substantially 

improve the safety of the current airplane design, and are economically prohibitive given 

that the retrofit 767 freighter fleet is limited (with some freighters delivered with NGS), 

and so extensive system changes are not in the public's interest. 

2 
The FQIS system was previously shown compliant to§§ 25.1309 and 25.901(c) for TC 

[type certificate] and ATC [amended type certificate]; however, both§ 25.901(c) [25-

126] and§ 25.98 1(a)(3) [25-125] have additional failure-combination requirements. For 

systems that may cause a catastrophic hazard, § 25.1309 requires no single failure and no 

combination of failures greater than extremely improbable;§ 25.901(c) (25-126] requires 

no single failure or probable combination of failures; and § 25.981 (a)(3) [25-125] 

requires no single failure, no single plus latent (greater than extremely remote), and no 

multiple combination greater than extremely improbable. 

This exemption is being sought for the no single plus latent (greater than extremely 

remote) [failure condition], as is stated in§ 25.981(a)(3) and interpreted by the FAA for 

§ 25.901(c). An exemption is also being sought for the non-environmental aspects of 

§ 25.901(c) provided by FAA interpretation, and the explicit § 25.981(a)(3) requirements 

of manufacturing variability, aging, wear, corrosion, and likely damage, as these 

considerations are already covered by airline maintenance of the type design of the 

airplane. 

Statement of Public Interest: 

Without exemption relief for the FQIS & [Fuel Level Sensor System] FLSS CWT wiring 

changes, the intent of the NPRM and the FAA's previous communication of intent for 

airplane design improvement for the CWT FQIS, to address those 767 freighters that do 

not have Nitrogen Generating System (NOS), cannot be met. For compliance, airplane 

changes to the entire FQIS (all tanks) and FLSS (all tanks are affected) would be required 

for fleet retrofit such as: 

FQIS: 

• New system architecture to redesign the FQPU [Fuel Quantity Processing Unit] to 

function as a Hot Short Protector (HSP1

) Line-Replaceable Unit (LRU) and 

relocate the FQPU to enable wire separation. Other architectures could be used 

such as providing a HSP LRU closer to the tank, but it would be a more extensive 

and new architecture. 

• Extensive airplane wiring changes to ensure adequate wire separation throughout 

the FQIS. 

• In-tank component changes (new brackets, potential need for shorter probes, 

revised in-tank wire harness and retention means). 

• Software changes related to Fuel Tank Gauging Function and safety function if 

shorter probes are required. 

FLSS: 

• New system architecture to move the Fuel Level Sensor Control assembly into a 

new relocated card file. 

1 A HSP is an LRU that is also designed to have the function to protect the tank circuit wiring from electrical-powersource threats that could affect the airplane circuit wiring of the LRU (FQPU). 

3 
• The Fuel Level Sensor Control assembly has not been evaluated to function as a 

HSP, but due to similarity of design to the 747-8 FLSS Single Point Sensor Card 

that has been shown to be a HSP, it also may meet the requirements for its part in 

the system, but it also may not be shown to be a HSP due to the circuit 

differences. 

• Extensive changes for the new card file and the wiring changes in all 3 tanks to 

ensure adequate wire separation throughout the fuel-level sensing system. 

• In-tank component changes (new brackets, new probes, revised in-tank wire 

harness and retention means). 

The current FQIS system and FLSS [have] been thoroughly evaluated for safety aspects 

as was required per SF AR 88 for the FQIS, however, the FAA determined there were 

safety issues identified with FQIS wiring connected into a high-flammability tank, for the 

767 it is the CWT. The time needed to successfully design and implement system 

changes beyond the proposed CWT FQIS wiring separation design changes, to comply 

with the rules, would further impact the availability of the wiring change on this out-ofproduction fleet of 767 airplanes. These new, complete, FQIS and FLSS design changes 

would not provide any economic benefit to the operators and do not provide any 

significant benefit or increased level of safety. The Boeing Company considers that the 

granting of this exemption would negate the need for [the] FAA to evaluate the additional 

data required to support compliance with these regulations. Therefore, granting this 

exemption would reduce the burden on FAA resources and consequently public 

expenditure. 

Granting this exemption is in the public interest for the aforementioned reasons and will: 

• Enhance the safety of the 767 fleet (as has been determined by the FAA) for those 

airplanes not installing NGS by adding wiring changes for the CWT FQIS. 

• Enhance the safety of the 767 fleet by also including FQIS BITE for the CWT and 

FLSS circuit interval tests, so that when done in addition with the CWT FQIS and 

FLSS wiring separation, the airplane addresses the single-plus-latent failure 

modes for the FQIS, which was the probable failure combination indicated by the 

NTSB report. 

Statement of No Adverse Effect on Safety: 

The addition of the FQIS CWT wiring changes, along with a BITE interval check, and 

with the FLSS wiring changes and circuit interval tests, in lieu of (a) a fully compliant 

(all tanks) FQIS (which would have a HSP FQPU LRU, wire separation for the tank 

circuit wiring (both outside and inside the tank), and a fault detecting BITE that is 

annunciated); and (b) a fully compliant FLSS, which most likely will need a redesigned 

Fuel Level Sensor Control assembly, a new card file, and wire separation inside and 

outside the tank with new probes, does not have an adverse effect on safety. 

In the proposed CWT FQIS and FLSS wire-separation design change, the ignition-source 

threat from other airplane systems is reduced since the wiring will have increased 

separation. There are also Instructions for Continued Airworthiness (ICA) that ensure that 

4 
any other system changes will continue to maintain the separation provided by this 

proposed design change, which will now clearly be visually identified as FQIS wiring. 

Together, this improves the wiring failure modes, and improves the system probability 

relative to fuel-tank ignition. With the addition of the FQIS BITE interval checks for the 

CWT and FLSS circuit interval tests, the probability is better since the exposure of wiring 

failures will be further reduced. 

For the CWT FQIS, where the changes to the FQIS and FLSS are being done instead of 

the installation ofNGS as determined by the FAA to be an acceptable substitute safety 

improvement, the combination of the separation, the ICA, and the BITE/circuit test 

addresses no single failures in combination with latent failures with an acceptable level of 

safety by ensuring the continued integrity of protection features from threats to the tank 

circuit wiring. 

A: The fault modes of the in-tank wiring have reduced exposure to 750 hours due 

to the BITE check and FLSS circuit test. Wiring inside the tank is well protected, 

and has a very low failure probability, which is improved by the lower exposure. 

Bl: The FQPU/FLSS is a HSP up to 28V. If a low-probability, higher-voltage 

power source short were to occur on the airplane side of the FQPU/FLSS Fuel 

Level Sensor Control assembly or within the FQPU/FLSS Fuel Level Sensor 

Control assembly, it most likely would, but for specific failures may not stop it 

from propagating through to the tank circuits, but the failure would at least be 

detectable when the BITE interval check was done, and in most cases sooner, as it 

would most likely affect indication. 

B2: The wiring from the FQPU/FLSS Fuel Level Sensor Control assembly (card 

file) to the tank will have separation provided by the AD-mandated service 

bulletin. This wiring has low probability failure modes which also have reduced 

exposure provided by the 750 hour interval BITE check. 

Whether the failure is A, orB I, or B2, there is no single failure. For the combination of 

failures, A and B I, or A and B2, the BITE has reduced the exposure and the latency 

interval for each protection-design feature (wiring has less than extremely remote failure 

rates), and so the probability for each fai lure mode is better than remote. This also 

addresses the single-plus-latent failure requirement, with an acceptable level of safety, as 

the probability of either failure on the flight before the next interval check would both be 

better than remote. 

The 767 FQIS/FLSS was found to be compliant to § 25.901(c) during airplane type 

certification for the FQIS change in 1992. Since then, Boeing has completed the SF AR 

88 safety assessment and has increased the airplane fuel-system safety with installation of 

a HSP LRU for the densitometer. 

Following the SF AR 88 system-safety assessments, Boeing assessment was that the risks 

for the 767 FQIS installation were extremely improbable, which is the typical industry 

and CFR § 25.1309 standard for an acceptable safety for systems. 

The Boeing approach to incorporate design changes to add center wing-tank FQIS wire 

separation with visual identification, a CWT FQIS 750-hour BITE check, along with ICA 

that ensures that added systems wiring will maintain the separation for the life of the 

5 
airplane, and the densitometer tank-circuit HSP provided by Boeing SB 767-28A0094, 

will provide for an enhanced safety margin over the existing, approved FQIS on the inservice fleet. 

Request to Waive Publication and Comment: 

Since the NPRM 20 11-NM-094-AD for the 757 is closely related to this change as the 

767 issue is the same, and the NPRM makes mention of a 757 petition for exemption, and 

has already gone through public-commenting process, Boeing respectfully requests that 

the FAA waive the "publication and comment" step in the process for making a fmal 

decision on this exemption. 

Additionally, given that the FAA has granted a similar exemption for the 767 production 

airplanes that [are] dependent on completing the submittal by December 2015 of the 

retrofit type-design change, and the FAA and Boeing have made a rapid schedule for this 

project; and so due to the schedule-sensitive nature of this request for exemption, Boeing 

respectfully requests that the FAA waive the "publication and comment" step in the 

process for making a final decision on this exemption. In addition to the timeliness 

concern, it is the Boeing position that the safety-associated aspects related to this system 

have been fully vetted in the public forum as part of the SF AR 88 project. 

Privileges of the Exemption Outside the United States: 

Per 14 CFR 11.81 (h), Boeing requests that the privileges of this exemption be extended 

outside the United States. This extension of privileges is necessary for operations based 

within foreign countries having bilateral agreements with the United States accepting 

FAA 14 CFR part 25 as their airworthiness standards for transport category aircraft. 

Conclusion: 

In accordance to the requirements of 14 CFR § 11.81 (e), the Boeing company has 

provided a means of compliance to the FAA to establish an acceptable level of safety to 

that provided by the rules 14 CFR § 25.90l(c) and 14 CFR § 25.981(a)(3) by separating 

the FQIS wiring from other airplane power wires that will meet the minimum separation 

requirements for most of the wire runs. For the areas [in which] minimum separation [is] 

not achievable due to space limitation, other positive separation means, such as clamps, 

spacers and sleeveing will be used for the CWT FQIS and also including FQIS BITE 

interval checks for the CWT. The FLSS will include the same type of wiring changes· 

and include the circuit test. These design changes address the single-plus-latent failure 

modes for the FQIS, which was the probable failure combination indicated by the NTSB 

report. Therefore, granting this exemption would, in turn, reduce the burden on FAA 

resources and consequently public expenditure. 

Federal Register publication 

Although the petitioner requested that action on its petition not be delayed for publication in the 

Federal Register, the FAA found that the petition, if granted, would set a precedent. Therefore, 

to allow an opportunity for the public to comment on the petition, a summary of it was published 

in the Federal Register on August 20, 2015 (80 FR 50709). Comments were received from the 

6 
National Air Traffic Control Association (NA TCA) National Safety Committee. The following 

quotes the NA TCA comments. 

NATCA recommends that the FAA deny the petition for exemption published for public 

comments on August 20,2015 in Docket Item No. FAA-2015-3086. 

This petition requests an exemption "from 14 CFR 25.90l(c) Amendment 25-126 and 14 

CFR 25.98l(a)(3) Amendment 25-125 pertaining to planned changes for the 767-200/300 

(freighters only) and 767-300F Center Wing Tank (CWT) Fuel Quantity Indication 

System (FQIS) Fuselage Wiring Installation." In the Background it also states "An 

exemption is also being sought for the nonenvironmental aspects of §25.901 (c) provided 

by FAA interpretation, and the explicit §25.981 (a)(3) requirements of manufacturing 

variability, aging, wear, corrosion, and likely damage, as these considerations are already 

covered by airline maintenance of the type design of the airplane." The petition also 

states the following: 

The FAA is planning to issue a NPRM for the 767 similar to the 757 NPRM 

2011 -NM- 094-AD which proposes to require modifying the FQIS wiring or fuel 

tank systems to prevent development of an ignition source inside the center fuel 

tank. Paragraph (h)(2) states: "Within 72 months after the effective date of this 

AD, modify the airplane by separating FQIS wiring that runs between the FQIS 

processor and the center fuel tank, including any circuits that might pass through a 

main fuel tank, from other airplane wiring that is not intrinsically safe." 

The 757 Supplemental NPRM (SNPRM) was published as the result of unsafe conditions 

identified in design reviews perfom1ed by Design Approval Holders that were required 

by 14 CFR part 21 Special Federal Airworthiness Regulation No. 88 (SF AR 88) that was 

issued by the FAA in 2001. However, the action proposed in the SNPRM and in this 

petition for exemption would not eliminate the known unsafe condition resulting from 

ignition sources caused by shorts within wiring and fuel gauging equipment on the 

subject airplane models. The National Transportation Safety Board identified this ignition 

source as the most likely cause of the catastrophic loss of all lives on the TWA Flight 800 

airplane. This known fuel tank ignition source is required to be eliminated in all fuel 

tanks of airplane models affected by SFAR 88 and the FAA's own SFAR 88 Policy, 

published as Mandatory Corrective Action criteria in FAA Policy Statement No. 2003-

112-15. 

Comment 1: SFAR 88 Exemption Required 

Section 2.(a) of SFAR 88 requires the affected Design Approval Holders: 

Conduct a safety review of the airplane fuel tank system to detem1ine that the 

design meets the requirements ofSecs. 25.901 and 25.981(a) and (b) of this 

chapter. If the current design does not meet these requirements, develop all design 

changes to the fuel tank system that are necessary to meet these requirements. 

Therefore, all design changes required to comply with SF AR 88 must comply with Title 

14 Code of Federal Regulations section 25.901 at Amendment 25-46 and section 25.981 

at Amendment 25-102 (the amendment levels in effect on the effective date of SF AR 88). 

The petition for exemption did not include a request for an exemption from this 

7 
requirement of SF AR 88, and this requirement of SF AR 88 still requires the design 

change comply with the above sections. 

NATCA submitted comments to the 757 SNPRM that recommended the means of 

compliance for paragraph (b) clearly state in the final rule that the FQIS design changes 

must include all fuel tanks and modifications must comply with the fail safe requirements 

of 14 CFR 25.901, Amendment 25-46, and 14 CFR 25.981(a) and (b), Amendment 25-

102. Compliance with those regulations is clearly required by SF AR 88 for all design 

changes required by SF AR 88. The same applies to the Model 767 and this petition for 

exemption. 

Comment 2: Lack of Public Interest 

During NATCA's review of the petition we believe that the petition does not meet the 

requirements for granting an exemption in 14 CFR 11.81 (e) and is not in the public 

interest. Section 11.8l(e) requires the petition for exemption include "The reasons why 

granting the exemption would not adversely affect safety, or how the exemption would 

provide a level of safety at least equal to that provided by the rule from which you seek 

the exemption." The petitioner's justification for granting an exemption is based 

primarily on the cost of developing a compliant design and a statement of no adverse 

effect on safety because of features required by separate regulations. This argument of 

cost avoidance and no adverse effect on safety does not meet either of these two 

regulatory requirements for the FAA to grant an exemption. 

The petitioner also justifies the exemption by stating: 

Granting of this exemption would negate the need for FAA to evaluate the 

additional data required to support compliance with these regulations. Therefore, 

granting this exemption would reduce the burden on FAA resources and 

consequently public expenditure. 

The costs associated with compliance are not a consideration for meeting the conditions 

in §I 1.81(e) for granting an exemption. Under the regulatory requirements for the FAA 

to adopt a rule, costs for a design approval holder to demonstrate compliance to the 

regulations was evaluated by the FAA when the subject regulations were adopted. The 

rulemaking for both the subject regulations and SF AR 88 public records show that the 

FAA determined the safety benefits outweigh the costs of complying with these 

regulations. 

The statement in the petition for exemption of no adverse effect on public safety is not 

supported by safety standards established by the FAA in rulernaking. Following the TWA 

800 accident resulting from a fuel tank explosion, the FAA amended§ 25.981 to include 

requirements that address precluding creation of ignition sources as well as separate 

requirements to limit fuel tank flammability. All manufacturers are required to 

incorporate flammability reduction systems into airplanes operating in passenger service, 

including the 757, by the FAA's separate and subsequent 2008 Fuel Tank Flammability 

Reduction rulemaking. However, they are not required to provide flammability reduction 

systems for the center wing tank in cargo airplanes. In addition, the FAA determined that 

a lack of separation between wiring that enters the fuel tanks and wiring carrying high 

power could result in ignition sources inside the fuel tanks. 

8 
The exemption would clearly have "an adverse effect on public safety" compared to a 

design that complies with the minimum safety standard established by the subject Federal 

Airworthiness Regulations, including the requirements of SFAR 88 and it's the policy 

published by the FAA for determining mandatory corrective action ("unsafe conditions). 

See our Comment No. 5 for further discussion on the requirements of SF AR 88 and its 

policy as it relates to this petition for exemption. 

Granting the petition for exemption would not "provide a level of safety at least equal to 

that provided by the rule from which you seek the exemption" since, as the petition 

states, 14 CFR 25.981 ( a)(3) at Amendment 25-125 requires: 

(a) No ignition source may be present at each point in the fuel tank or fuel tank 

system where catastrophic failure could occur due to ignition of fuel or vapors. 

This must be shown by: 

(3) Demonstrating that an ignition source could not result from each single 

failure, from each single failure in combination with each latent failure condition 

not shown to be extremely remote, and from all combinations of failures not 

shown to be extremely improbable. The effects of manufacturing variability, 

aging, wear, corrosion, and likely damage must be considered. 

As stated by the petitioner, full compliance with § 25.901(c), which is in the original 

certification basis of the 767, and §25.98 1 (a)(3) at Amendment 25-102 or later, would 

result in redesign of the FQPU, wire separation inside and outside of all 3 fuel tanks. The 

petitioner's proposal to only separate wiring tor a portion of the wiring outside of one 

fuel tank, the center wing fuel tank, is a significant reduction in the safety level provided 

by full separation for the wiring of all fuel tanks. The petitioners claim that proposed 

maintenance checks of airplane wiring will be effective as a way to detect damaged 

wiring has not been proven. Isolating faults in airplane wiring, which are commonly 

intermittent, is very difficult. This has been shown when airplane wiring faults were 

found to be common, but were only detected when new fuel gauging system indicators 

were retrofitted into existing in service airplanes. 

NATCA does not believe that granting the amendment to allow only partial wire 

separation for one of the three fuel tanks (the center wing fuel tank), and a periodic BITE 

check of the center wing fuel tank, is an overall safety improvement relative to a 

compliant design that would be required to have wire separation for all fuel tanks 

together with separation of circuits in the FQIS processor. The petition states the 

proposed design for the CWT would not meet the subject requirements and does not offer 

a design that provides a level of safety at least equal to that provided by the rule from 

which the petitioner seeks the exemption, which is required by section 11.8l(e). In 

addition, no design changes are proposed to the FQIS for the two main fuel tanks, which 

SF AR 88 also requires comply with the regulations that are the subject of the petition for 

exemption. The petitioner's argument of cost avoidance and no adverse effect on safety 

should not be a consideration in the FAA analysis of the exemption request. 

The following additional comments are provided on the justifications in the petition for 

exemption from the Title 14 Code ofFederal Regulations §14 CFR 25.90l(c) 

Amendment 25-126 and 14 CFR 25.981 (a)(3) Amendment 25-125 pertaining to planned 

changes for the 767-200/300 (freighters only) and 767-300F Center Wing Tank (CWT) 

9 
Fuel Quantity Indication System (FQJS) Fuselage Wiring Installation, Docket No. FAA2015-3086. The Petitioner states the planned changes are to support a 767 AD that will be 

based on the 757 SNPRM. Therefore, some of these comments relate to the 757 SNPRM, 

as the petitioner states that the FAA has said it will apply to the 767. 

Comment 3. 

The FQIS system was previously shown compliant to§§ 25.1309 and 25.901 (c) for TC 

and ATC; however, both§§ 25.901(c) [25-126] and 25.981(a)(3) [25-125] have 

additional failure combination requirements. 

NA TCA Comment: 

The FAA Type Certificate Data Sheet A2NM states that the original certification basis 

for the Model767 airplanes includes§ 25.90l(c) Amendment 25-40. The amendments to 

§ 25.901 since Amendment 25-40 have not changed requirements of§ 25.90 l(c) trom the 

requirements of Amendment 25-40. As stated in the preamble discussion to SF AR 88, 

lessons learned from the safety reviews conducted following the TWA 800 accident 

resulted in the discovery of failure modes that had not been foreseen at the time of earlier 

type design approvals. Co-routing of high power airplane wiring with FQIS wiring 

without consideration of the possibility of a latent arc gap in the system components in 

the fuel tank was identified as one of the erroneous approvals and as an unsafe condition 

resulting in AD actions. Therefore, the claim of the petitioner that the design was 

previously found compliant does not support their statement granting the exemption 

would provide an adequate level of safety. Based upon the FAA rulemaking actions, the 

767 FQIS was not properly shown to be compliant to§§ 25.901(c) and 25.1309 and 

should be redesigned to properly show compliance to the original certification basis of 

the Model 767. 

Comment4. 

This exemption is being sought for the no single-plus-latent failure (greater than 

extremely remote) as is stated in§ 25.981 (a)(3) and interpreted by the FAA for 

§ 25.90l(c). An exemption is also being sought for the non-environmental aspects of§ 

25.901(c) provided by FAA interpretation, and the explicit §25.98l(a)(3) requirements of 

manufacturing variability, aging, wear, corrosion, and likely damage, as these 

considerations are already covered by airline maintenance of the type design of the 

airplane. 

NA TCA Comment: 

Section 2.(a) ofSFAR 88 requires the affected Design Approval Holders "Conduct a 

safety review of the airplane fuel tank system to determine that the design meets the 

requirements ofSecs. 25.901 and 25.98l(a) and (b) of this chapter. If the current design 

does not meet these requirements, develop all design changes to the fuel tank system that 

are necessary to meet these requirements." 

Therefore, all design changes required to comply with SF AR 88 must comply with Title 

14 Code of Federal Regulations section 25.901 at Amendment 25-46 and section 25.981 

at Amendment 25-1 02 (the amendment levels in effect on the effective date of SF AR 88). 

10 
The petition for exemption did not include a request for an exemption from this 

requirement of SF AR 88, so this requirement of SF AR still requires the design change 

comply with the above sections even if the FAA were to grant the requested petition for 

exemption. 

CommentS. 

The petition states that the request is related to the FAA Supplemental Notice of 

Proposed Rulemaking (SNPRM) 2011-NM-094-AD, as the FAA has told the petitioner it 

will be applied to the 767. NATCA submitted comments to the SNPRM that are 

identified as FAA Docket No. FAA-2012-0187-0027. NATCA Recommendation No.1 

to the SNPRM equally applies to the petition for exemption and we have repeated that 

here as NATCA Comment 5 to the petition for exemption. 

NATCA Comment: 

NATCA recommends this means of compliance for paragraph (b) of the proposed AD 

(SNPRM) clearly state in the final rule that the FQIS design changes must include all fuel 

tanks and modifications must comply with the fail safe requirements of 14 CFR 25.901 , 

Amendment 25-46, and 14 CFR 25.981 (a) and (b), Amendment 25-102. Compliance with 

those regulations is clearly required by SF AR 88 for all design changes required by 

SFAR 88. 

Require Design Changes for All Fuel Tanks: 

Paragraph (h) of the proposed AD, "Optional Actions for Cargo Airplanes," provides the 

following options as alternatives from the requirements of paragraph (g) for airplanes 

used exclusively for cargo operations: 

(1) Within 6 months after the effective date ofthis AD, record the existing fault 

codes stored in the FQIS processor and then do a BITE check (check of built-in 

test equipment) of the FQIS, in accordance with the Accomplishment Instructions 

of Boeing Service Bulletin 757-28-0136, dated June 5, 2014. If any fault codes 

are recorded prior to the BITE check or as a result of the BITE check, before 

further flight, do all applicable repairs and repeat the BITE check until a 

successful test is performed with no faults found, in accordance with Boeing 

Service Bulletin 757-28-01 36, dated June 5, 2014. Repeat these actions thereafter 

at intervals not to exceed 750 flight hours, and 

(2) Within 72 months after the effective date of this AD, modify the airplane by 

separating FQIS wiring that runs between the FQIS processor and the center fuel 

tank, including any circuits that might pass through a main fuel tank, from other 

airplane wiring that is not intrinsically safe. 

Neither of these alternate actions would bring the FQIS for the center tank or the main 

fuel tanks into compliance with the fail safe requirements of 14 CFR 25.901 , Amendment 

25-45, and 14 CFR 25.98 l(a) and (b), Amendment 25-1 02, as required by SFAR 88 and 

the SF AR 88 Policy published by the FAA as Mandatory Corrective Action criteria in 

FAA Policy Statement No. 2003-112-15. 

The SNPRM references analyses perfonned by the FAA using the FAA Transport 

Airplane Risk Assessment Methodology (T ARAM) Handbook, an attachment to FAA 

II 
Policy Statement No. PSANM-25-05, Risk Assessment Methodology for Transport 

Category Airplanes. However, the T ARAM Handbook requires following specific policy 

for higher level regulations if they exist, and lists SFAR 88 as an example of regulations 

with specific higher level policy. 

Therefore, T ARAM requires that the FAA follow the higher level SF AR 88 policy 

published by the FAA as Policy Statement No. 2003-112- 15. As stated in the Policy 

Statement: 

The purpose of this memorandum is to provide standardized policy for 

determining the need for mandatory action relative to the findings from the fuel 

system safety review required by Special Federal Aviation Regulation Number 88 

(SFAR 88). 

The combination of failures identified in the proposed 757 AD clearly meets the criteria 

for an unsafe condition requiring corrective action mandated by AD in Element 2.a of the 

SF AR 88 memorandum. Element 2.a defines "known combinations" of failures as 

failures that "must be addressed by corrective action" for low-flammability exposure fuel 

tanks: 

Element 2. Combination of failures 

a) Fuel tanks with low flammability exposure time 

For fuel tanks with low flammability exposure time, known combinations of 

failures are considered an unsafe condition and must be addressed by corrective 

action (i.e. AD). 

Known combinations of failures includes combinations of failures which have 

occurred in-service and are likely to occur on other products of similar type 

design (i.e. products with a similar design of the fuel system), and combinations 

of failures which have been subject to mandatory corrective actions, 

following in-service fmdings, on products with similar fuel system designs. 

N A TCA is concerned that our comment to the 20 12 NPRM was not correctly understood 

because the FAA response provided in the SNPRM did not address our concern. Our 

comment to the 2012 NPRM was that the FAA was not following Element 2.a of FAA 

SF AR 88 Policy Statement No. 2003-112-15. Instead of responding to Element 2.a, the 

FAA response in the SNPRM focused on Element 2.b of the SF AR 88 policy. The 

proposed action in the SNPRM is still not following the policy in Element 2.a ofF AA 

SF AR 88 Policy Statement No. 2003-112-15. The failure mode that is the subject of the 

2012 NPRM and this 2014 SNPRM is a known combination of fai lures that was first 

subject to mandatory corrective action by the FAA over fifteen years ago when, on 

September 30, 1998, the FAA published an AD to correct this same unsafe design feature 

for all fuel tanks on certain "classic" model Boeing 747 airplanes.2 The unsafe condition 

was described in the preamble to the 1997 NPRM for the 747 AD: 

In support of the subsequent accident investigation, the FAA participated in 

testing of the fuel quantity indication system (FQIS). Results of that testing 

2 AD 98-20-40, Federal Register Vol. 63, No. 189, page 52147, September 30, 1998. Boeing Model 747-100, - 200, 

- 300, SP, and SR series airplanes 

12 
revealed that excessive energy could be induced by high transient voltage levels 

in the electrical wiring and probes of the fuel system. These excessive levels 

occurred when the wiring of the FQIS was subjected to electrical transient testing. 

These electrical transients may be caused in the airplane when switching electrical 

loads in the wiring adjacent to the FQIS wiring. 

The FQIS was tested to determine its performance in accordance with airplane 

electromagnetic interference (EMI) requirements. In this test, conductive debris, 

such as steel wool and lockwire, was used to bridge the FQIS probes to simulate 

debris that has been found during inspections of transport category airplanes. 

Results of this test indicated that transient voltage levels induced in the FQIS 

wiring and probes could be in excess of 800 volts, and the resulting energy levels 

in the FQIS wiring and probes could be greater than the energy required to ignite 

fuel vapor inside a fuel tank. 

In addition, recent inspections of the fuel probe wiring in Model 747 fuel tanks 

revealed damaged wiring insulation, which exposed the conductors inside the fuel 

tank. This condition, together with the introduction of induced transients or short 

circuit conditions, increases the likelihood for potential ignition sources in the fuel 

tank. 

The conditions described above, if not corrected, could result in excessive levels 

of energy in the FQIS wiring and a consequent potential source of ignition in the 

fuel tank. 

The FAA SNPRM disposition ofNATCA comments says: 

The FQIS latent-plus-one vulnerability for Model 757 airplanes was classified as 

a theoretical vulnerability and not as a condition known to have occurred, the 

SF AR 88 corrective action policy does not require corrective action for that 

condition in low-flammability fuel tanks. The installation of an FRM 

[Flammability Reduction Means, such as a nitrogen inerting system] causes the 

center fuel tank to meet the criteria for classification as a low-flammability fuel 

tank, and therefore FRM installation was considered to be acceptable mitigating 

action. 

However, under "Unsafe Condition," in the AD proposed by the SNPRM, the FAA 

states: 

This AD was prompted by fuel system reviews conducted by the manufacturer. 

We are issuing this AD to prevent development of an ignition source inside the 

center fuel tank caused by a latent in-tank failure combined with electrical energy 

transmitted into the center fuel tank via the fuel quantity indicating system (FQIS) 

wiring due to a single out-tank failure. 

The Unsafe Condition in the AD proposed by the SNPRM describes the same failure 

mode that is described in the 1997 NPRM for the 1998 Model 747 AD that required 

design changes to eliminate the failure mode in all fuel tanks; low flammability exposure 

time and high flammability exposure time. 

Therefore, the unsafe condition described in the SNPRM is a "Known Combination of 

Failures" as defined in Criteria 2.a as: 

13 
... combinations of failures which have been subject to mandatory corrective 

actions, following in-service findings, on products with a similar fuel system 

designs. 

Comment6: 

The petition makes statements that indicate that the FAA may have had ex parte 

communications with the petitioner. For example, in the Background the petition states: 

The FAA is planning to issue a NPRM for the 767 similar to the 757 NPRM 

2011-NM-094-AD which proposes to require modifying the FQIS wiring or fuel 

tank systems to prevent development of an ignition source inside the center fuel 

tank. Paragraph (h)(2) states: 

Within 72 months after the effective date of this AD, modify the airplane 

by separating FQIS wiring that runs between the FQIS processor and the 

center fuel tank, including any circuits that might pass through a main 

fuel tank, from other airplane wiring that is not intrinsically safe. 

Since the FAA has not published the final rule AD for that SNPRM, such 

communications from the FAA of its decision would be ex parte communications. The 

petition also states: 

Without exemption relief for the FQIS & FLSS CWT wiring changes, the intent 

ofthe NPRM and the FAA's previous communication of intent for airplane 

design improvement for the CWT FQIS to address those 767 freighters that do not 

have Nitrogen Generating System (NOS) cannot be met. 

NATCA Comment: 

NA TCA recommends the FAA document all ex parte communications with the 

petitioner in the public docket for this petition for exemption as required by 

Appendix I to 14 CFR Part 11 , titled, "Oral Communications With the Public 

During Rulemaking." The preamble to Amendment 11-46, Eff. 9/20/2000, which 

adopted the appendix, clearly states such communication is ex parte, and if ex 

parte communications do occur, they must be documented and published in the 

public docket. 

The FAA's analysis 

We agree with the petitioner's justification that granting the petition is in the public interest, with 

two exceptions. 

For clarity, we do not agree with the petitioner's public-interest statements that "The time needed 

to successfully design and implement system changes beyond the proposed CWT FQIS wiring 

separation design changes, to comply with the rules, would further impact the availability of the 

wiring change on this out-of-production fleet of767 aircraft." The AD worksheet for correcting 

this unsafe condition was issued in 2004. Boeing has not provided service instructions since that 

time. The time needed to develop a compliant design is minimal when compared to the 

petitioner's delay in providing the service instructions. We did not consider this argument in our 

determination that granting the exemption is in the public interest. 

14 
We also do not agree with the petitioner's public interest statement that " ... the granting of this 

exemption would negate the need for [the] FAA to evaluate the additional data required to 

support compliance with these regulations. Therefore, granting this exemption would reduce the 

burden on FAA resources and consequently public expenditure." FAA resources needed to 

review design changes that are needed for full compliance would be minimal, and these 

resources are available to address unsafe conditions. There would be no savings in public 

expenditure and no public interest by not providing a compliant design, and we did not consider 

this argument in our determination that granting the exemption is in the public interest. 

Modification of existing in-service 767 airplanes to provide a compliant design would be costprohibitive because extensive changes, including modifying the fuel-quantity processor, 

separating airplane wiring from other high-power wiring, or providing electrical isolating devices 

to prevent electrical energy from entering the fuel tanks, would be required for this limited 

number of 767 freighter airplanes. This exemption will allow approval of service instructions 

needed to address an unsafe condition on the 767 center wing tank FQIS wiring for freighter 

airplanes that do not incorporate flammability-reduction systems. We received comments on the 

proposed exemption from NA TCA. 

Regarding NA TCA comments 1 and 4: 

Section 2.(a) of SF AR 88 requires that the affected Design Approval Holders "Conduct a 

safety review of the airplane fuel tank system to determine that the design meets the 

requirements of Sees. 25.901 and 25.981 (a) and (b) of this chapter. If the current design 

does not meet these requirements, develop all design changes to the fuel tank system that 

are necessary to meet these requirements." 

Therefore, all design changes required to comply with SF AR 88 must comply with Title 

14, Code ofFederal Regulations 25.901 at Amendment 25-46, and 25.981 at Amendment 

25-102 (the amendment levels in effect on the effective date of SF AR 88). The petition 

for exemption did not include a request for an exemption from this requirement of SF AR 

88, so this requirement ofSFAR still requires the design change comply with the above 

sections even if the FAA were to grant the requested petition for exemption. 

We agree with the NATCA comment that SFAR 88 requires the type-design-approval holder to 

develop all design changes to the fuel-tank system that are necessary to meet the requirements of 

§§ 25.901 and 25.981. The petitioner did not specifically request exemption from this 

requirement. However they did request an exemption from§§ 25.901 and 25.981. Granting the 

exemption to these sections results in granting an exemption to the same ignition-source 

prevention requirements of SF AR 88. Therefore, we have added clarification in the exemption 

that states that exemption from SF AR 88 for the service instruction is also included in this 

exemption. 

Regarding NATCA comments 2, 3, and 5: 

NA TCA comment 3 pointed out that the petitioner had stated that the 767 FQIS design had 

previously been shown to be compliant with§§ 25.901, 25.981, and 25.1309 as justification for 

the safety of the design. N A TCA stated: 

... the FQIS [design] must not have been properly shown to be compliant to§§ 25.90 1(c) 

and 25.1309, and should be redesigned to properly show compliance to the original 

certification basis of the Model 757. 

15 
NATCA further stated, in comments 2 and 5, that granting the exemption would not be in the 

public interest, and that the action proposed in the SNPRM and in this petition for exemption 

would not eliminate the known unsafe condition resulting from ignition sources caused by shorts 

within wiring and fuel-gauging equipment on the subject airplane models. NA TCA stated that 

the National Transportation Safety Board identified this ignition source as the most likely cause 

of the catastrophic loss of all lives on the TWA Flight 800 airplane. NA TCA believes that this 

known fuel-tank ignition source is required to be eliminated in all fuel tanks of airplane models 

affected by SFAR 88, and the FAA's own SFAR 88 Policy, published as Mandatory Corrective 

Action criteria in FAA Policy Statement No. 2003-112-15. NATCA does not believe that 

granting the exemption to allow only partial wire separation for one of the three fuel tanks (the 

center wing fuel tank) is an overall safety improvement, relative to a compliant design, that 

would be required to have wire separation for all fuel tanks together, with separation of circuits 

in the FQIS processor. 

The FAA disagrees with the request to deny the exemption request and require modification of 

the FQIS in all fuel tanks. We agree that the Model 767 airplane FQIS has the same high-level 

system architecture and operating principles as those of the Model 747 airplane FQIS, resulting 

in vulnerability to the same theoretical latent-plus-one failure scenario. There are, however, 

significant differences in the details of the Model 767 airplane FQIS design that reduce the 

likelihood of the individual contributing failures. Those differences include the following: 

• Improved FQIS probe-terminal connector-block design. 

• The use of wiring that is not silver plated and therefore does not create silver sulfide 

deposits on the terminal blocks. 

• The use of improved wire types and wiring installation practices outside of the fuel tanks. 

• The use of a system processor that significantly isolates the tank-probe circuits from the 

FQIS indication and power circuits. 

We therefore did not consider that the FQIS designs for Model 747 and Model 767 airplanes 

were so similar that the Model 767 airplane FQIS design should be considered to have a 

"known" latent-plus-one-failure condition vulnerability as defined in the policy memorandum. 

Service history of conventional, unheated, aluminum wing tanks that contain Jet A fuel indicates 

little safety benefit is gained by further limiting the flammability of the these tanks. Our review 

of nine wing-tank ignition events shows that 5 of the 9 airplanes were using JP-4 fuel, which is 

no longer used except on an emergency basis in the U.S. External heating of the wing due to 

engine fires caused three of the remaining fou r events, and the fourth event occurred on the 

ground during maintenance. To date, ignitions in conventional, unheated, aluminum wing tanks 

fueled with Jet A fuel have not resulted in fatalities. The flammability characteristics of JP-4 fuel 

result in the fuel tanks being flammable a significant portion of the time when an airplane is in 

flight. This is not the case for wing tanks containing Jet A fuel? We do not consider it to be an 

unsafe condition for the FQIS wiring entering these tanks to be co-routed in wire bundles with 

wires carrying high electrical energies. 

3 See "Reduction of fuel Tank Flammability in Transport Category Airplanes; Final Rule", Federal Register, 

Volume 73, No 140, Monday July 21 , 2008, page 42456. 

16 
In summary, the FAA does not agree with the NA TCA comment that changes to the fuelquantity system proposed by Boeing will not address the unsafe condition, and that granting the 

exemption is not in the public interest. The FAA has determined that the proposed modifications 

represent a reasonable, cost-effective method to achieve a meaningful reduction in the risk due to 

potential FQIS fuel-tank-ignition sources. The FAA's current fuel-tank-safety airworthiness 

standards rely upon a balanced approach of limiting fuel-tank-flammability exposure time and 

precluding ignition sources that could form in the fuel tanks. For this reason,§ 25.981 includes 

separate and distinct requirements for limiting fuel-tank flammability and preventing ignition 

sources in the fuel tanks. The wing and center wing tank safety are addressed by considering 

flammability and ignition-source mitigations. The wing tanks are exposed to outside air, are 

unheated, naturally cool, and are considered low flammability. We do not consider it to be an 

unsafe condition for the FQIS wiring entering these tanks to be co-routed in wire bundles with 

wires carrying high electrical energies. Because the center wing tank is heated and is considered 

a high-flammability tank, additional ignition-source mitigations are provided. The modifications 

to separate a portion of the wiring for the center wing tank FQIS significantly reduces the 

likelihood of a failure that could introduce high power onto the FQIS wiring. In addition, 

mandatory maintenance checks for the center tank FQIS wiring will be required as part of the 

petitioner's design approval. This will significantly reduce the likelihood of a latent failure in the 

FQIS wiring resulting in an ignition source in the fuel tanks. Granting this exemption allows 

FAA approval of service instructions needed to address the unsafe condition and, therefore, 

results in a safety improvement that is in the public interest. 

NATCA comment 6 requested that records of ex parle communications between the FAA and 

the petitioner, regarding Model 767 airplane airworthiness directive (AD) activity or the 

exemption time-limit extension, be included in the docket fi le. The items NATCA noted 

regarding the petitioner's request concern a planned AD. Any contact that occurs during AD 

rulemaking is documented in the docket as an ex parte contact. Note that the FAA communicates 

with the design-approval holder, in advance of AD rulemaking, in part to receive necessary 

service information. This type of contact is not ex parle in that it occurs prior to the AD 

rulemaking. 

17 
The FAA's decision 

In consideration of the foregoing, I find that a grant of exemption is in the public interest. 

Therefore, pursuant to the authority contained in 49 U.S.C. 40113 and 44701 delegated to me by 

the Administrator, The Boeing Company, is hereby granted an exemption from SFAR 88, and 

§§ 25.90l(c) and 25.981(a)(3), as they pertain to fuel-tank-ignition prevention associated with 

the fuel-quantity indication system and fuel-overfill-shutoff surge tank wiring installation, 

limited to in-service 767-200 (freighter only), 767-300 (freighter only), and 767-300F airplanes. 

Issued in Renton Washington, on JAN 2 5 2016 

~~ 

Michael Kaszycki 

Acting Manager, Transport Airplane Directorate 

Aircraft Certification Service 

18