E9-24652. Special Conditions: Boeing Model 787-8 Airplane; Lightning Protection of Fuel Tank Structure To Prevent Fuel Tank Vapor Ignition

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Notice of proposed special conditions.

SUMMARY:

This action proposes special conditions for the Boeing Model 787-8 airplane. This airplane will have novel or unusual design features when compared to the state of technology envisioned in the airworthiness standards for transport category airplanes. The Boeing Model 787-8 airplane will incorporate a fuel tank nitrogen generation system (NGS) that actively reduces flammability exposure within the main fuel tanks significantly below that required by the fuel tank flammability regulations. Among other benefits, this significantly reduces the potential for fuel vapor ignition caused by lightning strikes. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for this design feature. These proposed special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards.

DATES:

We must receive your comments by November 30, 2009.

ADDRESSES:

You must mail two copies of your comments to: Federal Aviation Administration, Transport Airplane Directorate, Attention: Rules Docket (ANM-113), Docket No. NM415, 1601 Lind Avenue, SW., Renton, Washington 98057-3356. You may deliver two copies to the Transport Airplane Directorate at the above address. You must mark your comments: Docket No. NM415. You may inspect comments in the Rules Docket weekdays, except Federal holidays, between 7:30 a.m. and 4 p.m.

FOR FURTHER INFORMATION CONTACT:

Mike Dostert, FAA, ANM-112, Transport Airplane Directorate, Aircraft Certification Service, 1601 Lind Avenue, SW., Renton, Washington 98057-3356; telephone [phone]; facsimile [phone].

SUPPLEMENTARY INFORMATION:

Comments Invited

We invite interested persons to take part in this rulemaking by sending written comments, data, or views. The most helpful comments reference a specific portion of the special conditions, explain the reason for any recommended change, and include supporting data. We ask that you send us two copies of written comments.

We will file in the docket all comments we receive as well as a report summarizing each substantive public contact with FAA personnel concerning these proposed special conditions. You may inspect the docket before and after the comment closing date. If you wish to review the docket in person, go to the address in the ADDRESSES section of this notice between 7:30 a.m. and 4 p.m., Monday through Friday, except Federal holidays.

We will consider all comments we receive by the closing date for comments. We will consider comments filed late if it is possible to do so without incurring expense or delay. We may change the proposed special conditions based on comments we receive.

If you want the FAA to acknowledge receipt of your comments on this proposal, include with your comments a pre-addressed, stamped postcard on which the docket number appears. We will stamp the date on the postcard and mail it back to you.

Background

On March 28, 2003, The Boeing Company applied for an FAA type certificate for its new Boeing Model 787-8 passenger airplane. The Boeing Model 787-8 airplane will be a new design, two-engine turbo-jet transport category airplane with a two-aisle cabin configuration. The maximum takeoff weight will be 484,000 pounds, and it will carry a maximum of 381 passengers.

Type Certification Basis

Under provisions of 14 CFR 21.17, Boeing must show that Boeing Model 787-8 airplanes (hereafter referred to as “the 787”) meet the applicable provisions of 14 CFR part 25, as amended by Amendments 25-1 through 25-117, with three exceptions. Sections 25.809(a) and 25.812 will remain as amended by Amendment 25-115, and § 25.981, which will be as amended by Amendment 25-125 in accordance with 14 CFR 26.37.

If the Administrator finds that the applicable airworthiness regulations (i.e., part 25) do not contain adequate or appropriate safety standards for the 787 because of novel or unusual design features, special conditions are prescribed under provisions of 14 CFR 21.16.

In addition to the applicable airworthiness regulations and special conditions, the 787 must comply with the fuel vent and exhaust emission requirements of 14 CFR part 34 and the noise certification requirements of 14 CFR part 36. Finally, the FAA must also issue a finding of regulatory adequacy under § 611 of Public Law 92-574, the “Noise Control Act of 1972.”

Special conditions, as defined in 14 CFR 11.19, are issued in accordance with § 11.38 and become part of the type certification basis in accordance with § 21.17(a)(2).

Special conditions are initially applicable to the model for which they are issued. Should the type certificate for that model be amended later to include any other model that incorporates the same or similar novel or unusual design features, the special conditions would also apply to the other model under § 21.101.

Novel or Unusual Design Features

The proposed 787 will have a fuel tank NGS that is intended to control fuel tank flammability. This NGS is designed to provide a level of performance that will reduce the warm day fleet average wing fuel tank flammability significantly below the maximum wing fuel tank flammability limits set in § 25.981(b), as amended by Amendment 25-125. This high level of wing fuel tank NGS performance is an unusual design feature not envisioned at the time the regulations in the proposed 787 certification basis were promulgated.

Existing Regulations

The certification basis of the 787 includes § 25.981, as amended by Amendment 25-125, as required by § 26.37. This amendment includes the ignition prevention requirements in § 25.981(a), as amended by Amendment 25-102, and it includes specific limitations on fuel tank flammability in § 25.981(b) as amended by Amendment 25-125. (Section 25.981(c) contains an alternative to meeting paragraph (b)—vapor ignition mitigation—that is not applicable to the proposed 787 design.)

Ignition Source Prevention

Section 25.981(a)(3) requires applicants to show that an ignition source in the fuel tank system could not result from any single failure, from any single failure in combination with any latent failure condition not shown to be extremely remote, or from any combination of failures not shown to be extremely improbable. This requirement was originally adopted in Amendment 25-102 and was based on the assumption that fuel tanks are always flammable. This requirement defines three types of scenarios that must be addressed in order to show compliance with § 25.981(a)(3). The first scenario is that any single failure, regardless of the probability of occurrence of the failure, must not cause an ignition source. The second scenario is that any single failure, regardless of the probability of occurrence, in combination with any latent failure condition not shown to be at least extremely remote, must not cause an ignition source. The third scenario is that any combination of failures not shown to be extremely improbable must not cause an ignition source. Demonstration of compliance with this requirement would typically require a structured, quantitative safety analysis. Design areas that have any latent failure conditions typically would be driven by these requirements to have multiple fault tolerance, or “triple redundancy.” This means that ignition sources are still prevented even after two independent failures.

Flammability Limits

Section 25.981(b) states that no fuel tank fleet average flammability exposure may exceed 3 percent of the flammability exposure evaluation time calculated using the method in part 25, Appendix N, or the fleet average flammability of a fuel tank within the wing of the airplane being evaluated, whichever is greater. If the wing is not a conventional unheated aluminum wing, the analysis must be based on an assumed equivalent construction conventional unheated aluminum wing. In addition, for fuel tanks that are normally emptied during operation and that have any part of the tank located within the fuselage contour, the fleet average flammability for warm days (above 80°F) must be limited to 3 percent as calculated using the method in part 25, Appendix M.

Application of Existing Regulations Inappropriate Due to Impracticality

Since the promulgation of § 25.981(a)(3), as amended by Amendment 25-102, the FAA has conducted certification projects in which applicants found it impractical to meet the requirements of that regulation for some areas of lightning protection for fuel tank structure. Partial exemptions were issued for these projects. These same difficulties exist for the 787 project.

The difficulty of designing multiple-fault-tolerant structure, and the difficulty of detecting failures of hidden structural design features in general, makes compliance with § 25.981(a)(3) uniquely challenging and impractical for certain aspects of the electrical bonding of structural elements. Such bonding is needed to prevent occurrence of fuel tank ignition sources from lightning strikes. The effectiveness and fault tolerance of electrical bonding features for structural joints and fasteners is partially dependent on design features that cannot be effectively inspected or tested after assembly without damaging the structure, joint, or fastener. Examples of such features include a required interference fit between the shank of a fastener and the hole in which the fastener is installed, metal foil or mesh imbedded in composite material, a required clamping force provided by a fastener to pull two structural parts together, and a required faying surface bond between the flush surfaces of adjacent pieces of structural material such as in a wing skin joint or a mounting bracket installation. In addition, other features that can be physically inspected or tested may be located within the fuel tanks, therefore, it is not practical to inspect for failures of those features at short intervals. Examples of such failures include separation or loosening of cap seals over fastener ends and actual structural failures of internal fasteners. This inability to practically detect failures of structural design features critical to lightning protection results in any such failures that occur remaining in place for a very long time, and possibly for the remaining life of the airplane, prior to detection.

Accounting for such long failure latency periods in the system safety analysis required by § 25.981(a)(3) would require multiple fault tolerance in the structural lightning protection design. As part of the design development activity for the 787, Boeing has examined possible design provisions to provide multiple fault tolerance in the structural design to prevent ignition sources from occurring in the event of lightning attachment to the airplane in critical locations. Boeing has concluded from this examination that providing multiple fault tolerance for some structural elements is not practical. Boeing has also identified some areas of the proposed 787 design where it is impractical to provide even single fault tolerance in the structural design to prevent ignition sources from occurring in the event of lightning attachment after a single failure. The FAA has reviewed this examination with Boeing in detail and has agreed that providing fault tolerance beyond that in the proposed 787 design for these areas would be impractical.

As a result of the 787 and other certifications projects, the FAA has now determined that compliance with § 25.981(a)(3) is impractical for some areas of lightning protection for fuel tank structure, and that application of § 25.981(a)(3) to those design areas is therefore inappropriate. The FAA plans further rulemaking to revise § 25.981(a)(3). The FAA plans to issue special conditions or exemptions, when appropriate, for certification projects in the interim. This is discussed in FAA Memorandum ANM-112-08-002, Policy on Issuance of Special Conditions and Exemptions Related to Lightning Protection of Fuel Tank Structure, dated May 26, 2009.^[1]

Application of Existing Regulations Inappropriate Due to Compensating Feature That Provides Equivalent Level of Safety

Section 25.981(b) sets specific standards for fuel tank flammability as discussed above under “Flammability Limits.” Under that regulation, the fleet average flammability exposure of wing main tanks on the 787 may not exceed 3 percent of the flammability exposure evaluation time calculated using the method in part 25, Appendix N, or the fleet average flammability of a wing main tank within an equivalent construction conventional unheated aluminum wing fuel tank, whichever is greater. If it is assumed that a 787 equivalent conventional unheated aluminum wing fuel tank would not exceed a fleet average flammability time of 3 percent, the actual composite airplane wing fuel tank design would be required to comply with the 3 percent fleet average flammability standard. However, the proposed 787 design includes a wing tank NGS that will also be shown to meet the additional, more stringent warm day average flammability standard in part 25, Appendix M, which is only required for normally emptied fuel tanks with some part of the tank within the fuselage contour.

Since the proposed wing tank NGS on the 787 provides performance that meets part 25, Appendix M, the FAA has determined that the risk reduction provided by this additional performance will provide compensation for some relief from the ignition prevention requirements of § 25.981(a)(3).

In determining the appropriate amount of relief from the ignition prevention requirements of § 25.981(a), the FAA considered the original overall intent of Amendment 25-102, which was to ensure the prevention of catastrophic events due to fuel tank vapor explosion. The proposed special conditions are intended to achieve that objective through a prescriptive requirement that fault tolerance (with respect to the creation of an ignition source) be provided for all structural lightning protection design features where providing such fault tolerance is practical, and through a performance-based standard for the risk due to any single failure vulnerability that exists in the design. In addition, for any structural lightning protection design features for which Boeing shows that providing fault tolerance is impractical, the proposed special conditions would require Boeing to show that a fuel tank vapor ignition event due to the summed risk of all non-fault-tolerant design features is extremely improbable. Boeing would be required to show that this safety objective is met by the proposed design using a structured system safety assessment similar to that currently used for demonstrating compliance with §§ 25.901 and 25.1309.

Discussion of the Proposed Requirements

Given these novel design features, and the compliance challenges noted earlier in this document, the FAA has determined that application of § 25.981(a)(3) is inappropriate in that it is neither practical nor necessary to apply the ignition source prevention provisions of § 25.981(a)(3) to the specific fuel tank structural lightning protection features of the 787. However, without the § 25.981(a)(3) provisions, the remaining applicable regulations in the 787 certification basis would be inadequate to set an appropriate standard for fuel tank ignition prevention. Therefore, in accordance with provisions of § 21.16, the FAA is proposing that, instead of § 25.981(a)(3), alternative fuel tank structural lighting protection requirements be applied to fuel tank lightning protection features that are integral to the airframe structure of the 787. These alternative requirements are intended to provide the level of safety intended by § 25.981(a)(3), based on our recognition, as discussed above, that a highly effective NGS for the fuel tanks makes it unnecessary to assume that the fuel tank is always flammable. As discussed previously, the assumption that the fuel tank is always flammable was part of the basis for the ignition prevention requirements of § 25.981(a)(3).

One resulting difference between these proposed special conditions and the § 25.981(a)(3) provisions they are meant to replace is the outcome being prevented—fuel vapor ignition versus an ignition source. These proposed special conditions acknowledge that the application of fuel tank flammability performance standards will reduce fuel tank flammability to an extent that it is appropriate to consider the beneficial effects of flammability reduction when considering design areas where it is impractical to comply with § 25.981(a)(3).

One of the core requirements of the proposed special conditions is a prescriptive requirement that structural lightning protection design features must be fault tolerant. (An exception wherein Boeing can show that providing fault tolerance is impractical, and associated requirements, is discussed below.) The other core requirement is that Boeing must show that the design, manufacturing processes, and airworthiness limitations section of the instructions for continued airworthiness include all practical measures to prevent, and detect and correct, failures of structural lightning protection features due to manufacturing variability, aging, wear, corrosion, and likely damage. The FAA has determined that, if these core requirements are met, a fuel tank vapor ignition event due to lightning is not anticipated to occur in the life of the airplane fleet. This conclusion is based on the fact that a critical lightning strike to any given airplane is itself a remote event, and on the fact that fuel tanks must be shown to be flammable for only a relatively small portion of the fleet operational life.

For any non-fault-tolerant features proposed in the design, Boeing must show that eliminating these features or making them fault tolerant is impractical. The requirements and considerations for showing it is impractical to provide fault tolerance are described in FAA Memorandum ANM-112-08-002. This requirement is intended to minimize the number of non-fault tolerant features in the design.

For areas of the design where Boeing shows that providing fault tolerant structural lighting protection features is impractical, non-fault-tolerant features will be allowed provided Boeing can show that a fuel tank vapor ignition event due to the non-fault-tolerant features is extremely improbable when the sum of probabilities of those events due to all non-fault-tolerant features is considered. Boeing will be required to submit a structured, quantitative assessment of fleet average risk for a fuel tank vapor ignition event due to all non-fault-tolerant design features included in the design. This will require determination of the number of non-fault tolerant design features, estimates of the probability of the failure of each non-fault-tolerant design feature, and estimates of the exposure time for those failures. This analysis must include failures due to manufacturing variability, aging, wear, corrosion, and likely damage.

It is acceptable to consider the probability of fuel tank flammability, the probability of a lightning strike to the airplane, the probability of a lightning strike to specific zones of the airplane (for example, Zone 2 behind the nacelle, but not a specific location or feature), and a distribution of lightning strike amplitude in performing the assessment provided the associated assumptions are acceptable to the FAA. The analysis must account for any dependencies among these factors, if they are used. The assessment must also account for operation with inoperative features and systems, including any proposed or anticipated dispatch relief. This risk assessment requirement is intended to ensure that an acceptable level of safety is provided given the non-fault-tolerant features in the proposed design.

Part 25, Appendix N, as adopted in Amendment 25-125, in conjunction with these proposed special conditions, constitutes the standard for how to determine flammability probability. In performing the safety analysis required by these proposed special conditions, relevant § 25.981(a)(3) compliance guidance is still applicable. Appropriate credit for the conditional probability of environmental or operational conditions occurring is normally limited to those provisions involving multiple failures, and this type of credit is not normally allowed in evaluation of single failures. However, these proposed special conditions would allow consideration of the probability of occurrence of lightning attachment and flammable conditions when assessing the probability of structural failures resulting in a fuel tank vapor ignition event.

The FAA understands that lightning protection safety for airplane structure is inherently different from lightning protection for systems. We intend to apply these special conditions only to structural lightning protection features of fuel systems. We do not intend to apply the alternative standards used under these special conditions to other areas of the airplane design evaluation.

Proposed Requirements Provide Equivalent Level of Safety

In recognition of the unusual design feature discussed above, and the impracticality of requiring multiple fault tolerance for lightning protection of certain aspects of fuel tank structure, the FAA has determined that an equivalent level of safety to direct compliance with § 25.981(a)(3) will be achieved for the 787 by applying these proposed requirements. The FAA considers that, instead of only concentrating on fault tolerance for ignition source prevention, significantly reducing fuel tank flammability exposure in addition to preventing ignition sources is a better approach to lightning protection for the fuel tank. In addition, the level of average fuel tank flammability achieved by compliance with these special conditions is low enough that it is not appropriate or accurate to assume in a safety analysis that the fuel tanks may always be flammable.

Section 25.981(b), as amended by Amendment 25-125, sets limits on the allowable fuel tank flammability for the 787. Paragraph 2(a) of these proposed special conditions applies the more stringent standard for warm day flammability performance applicable to normally emptied tanks within the fuselage contour from § 25.981(b) and part 25, Appendix M, to the wing tanks of the 787.

Because of the more stringent fuel tank flammability requirements in these special conditions, and because the flammability state of a fuel tank is independent of the various failures of structural elements that could lead to an ignition source in the event of lightning attachment, the FAA has agreed that it is appropriate in this case to allow treatment of flammability as an independent factor in the safety analysis. The positive control of flammability and the lower flammability that is required by these special conditions exceeds the minimum requirements of § 25.981(b). This offsets a reduction of the stringent standard for ignition source prevention in § 25.981(a)(3), which assumes that the fuel tank is flammable at all times.

Given the stringent requirements for fuel tank flammability, the fuel vapor ignition prevention and the ignition source prevention requirements in these special conditions will prevent “* * * catastrophic failure * * * due to ignition of fuel or vapors.”, as stated in § 25.981(a). Thus, the overall level of safety achieved by these special conditions is considered equivalent to that which would be required by compliance with § 25.981(a)(3) and (b).

Applicability

These proposed special conditions are applicable to the 787-8. Should Boeing apply at a later date for a change to the type certificate to include another model incorporating the same novel or unusual design features, these proposed special conditions would apply to that model as well.

Conclusion

This action affects only certain novel or unusual design features of the 787. It is not a rule of general applicability.

List of Subjects in 14 CFR Part 25

• Aircraft
• Aviation safety
• Reporting and recordkeeping requirements

The authority citation for these special conditions is as follows:

Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.

The Proposed Special Conditions

Accordingly, the Federal Aviation Administration (FAA) proposes the following special conditions as part of the type certification basis for The Boeing Model 787-8 airplane.

1. Definitions

Most of the terms used in Special Condition No. 2, Alternative Fuel Tank Structural Lightning Protection Requirements, either have the common dictionary meaning or are defined in AC 25.1309-1A, System Design and Analysis, dated June 21, 1988.

The following definitions are the only terms intended to have a specialized meaning when used in Special Condition No. 2.:

(a) Basic Airframe Structure. Includes design elements such as structural members, structural joint features, and fastener systems including airplane skins, ribs, spars, stringers, etc., and associated fasteners, joints, coatings, and sealant. Basic airframe structure may also include those structural elements that are expected to be removed for maintenance, such as exterior fuel tank access panels and fairing attachment features, provided maintenance errors that could compromise associated lightning protection features would be evident upon an exterior preflight inspection of the airplane and would be corrected prior to flight.

(b) Permanent Systems Supporting Structure. Includes static, permanently attached structural parts (such as brackets) that are used to support system elements. It does not include any part intended to be removed, or any joint intended to be separated, to maintain or replace system elements or other parts, unless that part removal or joint separation is accepted by the FAA as being extremely remote.

(c) Manufacturing Variability. Includes tolerances and variability allowed by the design and production specifications as well as anticipated errors or escapes from the manufacturing and inspection processes.

(d) Extremely Remote. Conditions that are not anticipated to occur to each airplane during its total life, but which may occur a few times when considering the total operational life of all airplanes of one type. Extremely remote conditions are those having an average probability per flight hour on the order of 1 × 10⁻⁷ or less, but greater than on the or der of 1 × 10⁻⁹.

(e) Extremely Improbable. Conditions that are so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. Extremely improbable conditions are those having an average probability per flight hour of the order of 1 × 10⁻⁹ or less.

2. Alternative Fuel Tank Structural Lightning Protection Requirements

For lightning protection features that are integral to fuel tank basic airframe structure or permanent systems supporting structure, as defined in Special Condition No. 1, Definitions, for which the Boeing Company shows and the FAA finds compliance with § 25.981(a)(3) to be impractical, the following requirements may be applied in lieu of the requirements of § 25.981(a)(3):

(a) The Boeing Company must show that the airplane design meets the requirements of part 25, Appendix M, as amended by Amendment 25-125, for all fuel tanks installed on the airplane.

(b) The Boeing Company must show that the design includes at least two independent, effective, and reliable lightning protection features (or sets of features) such that fault tolerance to prevent lightning-related ignition sources is provided for each area of the structural design proposed to be shown compliant with these special conditions in lieu of compliance with the requirements of § 25.981(a)(3). Fault tolerance is not required for any specific design feature if:

(1) for that feature, providing fault tolerance is shown to be impractical, and

(2) fuel tank vapor ignition due to that feature and all other non-fault-tolerant features, when their fuel tank vapor ignition event probabilities are summed, is shown to be extremely improbable.

(c) The applicant must perform an analysis to show that the design, manufacturing processes, and airworthiness limitations section of the instructions for continued airworthiness include all practical measures to prevent, and detect and correct, failures of structural lightning protection features due to manufacturing variability, aging, wear, corrosion, and likely damage.

Issued in Renton, Washington, on September 24, 2009.

Ali Bahrami,

Manager, Transport Airplane Directorate, Aircraft Certification Service.

Footnotes

1.  The memorandum may be viewed at: http://www.airweb.faa.gov/​Regulatory_​and_​Guidance_​Library/​rgPolicy.nsf/​0/​12350AE62D393B7A862575C300709CA3?​OpenDocument&​Highlight=​anm-112-08-002.