http://www.aviationweek.com/aw/blogs/mro/index.jsp?plckController=Blog&plckBlogPage=BlogViewPost&newspaperUserId=388668c6-b459-4ea7-941e-a0a2206d415f&plckPostId=Blog%3a388668c6-b459-4ea7-941e-a0a2206d415fPost%3a24c70b37-f928-4bb1-b343-6418e0a64496&plckScript=blogScript&plckElementId=blogDest
[Federal Register: October 14, 2009 (Volume 74, Number 197)]
[Proposed Rules]
[Page 52698-52702]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID-21]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Part 25
[Docket No. NM415; Notice No. 25-09-11-SC]
Special Conditions: Boeing Model 787-8 Airplane; Lightning
Protection of Fuel Tank Structure To Prevent Fuel Tank Vapor Ignition
AGENCY: Federal Aviation Administration (FAA), DOT.
ACTION: Notice of proposed special conditions.
-----------------------------------------------------------------------
SUMMARY: This action proposes special conditions for the Boeing Model
787-8 airplane. This airplane will have novel or unusual design
features when compared to the state of technology envisioned in the
airworthiness standards for transport category airplanes. The Boeing
Model 787-8 airplane will incorporate a fuel tank nitrogen generation
system (NGS) that actively reduces flammability exposure within the
main fuel tanks significantly below that required by the fuel tank
flammability regulations. Among other benefits, this significantly
reduces the potential for fuel vapor ignition caused by lightning
strikes. The applicable airworthiness regulations do not contain
adequate or appropriate safety standards for this design feature. These
proposed special conditions contain the additional safety standards
that the Administrator considers necessary to establish a level of
safety equivalent to that established by the existing airworthiness
standards.
DATES: We must receive your comments by November 30, 2009.
ADDRESSES: You must mail two copies of your comments to: Federal
Aviation Administration, Transport Airplane Directorate, Attention:
Rules Docket (ANM-113), Docket No. NM415, 1601 Lind Avenue, SW.,
Renton, Washington 98057-3356. You may deliver two copies to the
Transport Airplane Directorate at the above address. You must mark your
comments: Docket No. NM415. You may inspect comments in the Rules
Docket weekdays, except Federal holidays, between 7:30 a.m. and 4 p.m.
FOR FURTHER INFORMATION CONTACT: Mike Dostert, FAA, ANM-112, Transport
Airplane Directorate, Aircraft Certification Service, 1601 Lind Avenue,
SW., Renton, Washington 98057-3356; telephone (425) 227-2132; facsimile
(425) 227-1149.
SUPPLEMENTARY INFORMATION:
Comments Invited
We invite interested persons to take part in this rulemaking by
sending written comments, data, or views. The most helpful comments
reference a specific portion of the special conditions, explain the
reason for any recommended change, and include supporting data. We ask
that you send us two copies of written comments.
We will file in the docket all comments we receive as well as a
report summarizing each substantive public contact with FAA personnel
concerning these proposed special conditions. You may inspect the
docket before and after the comment closing date. If you wish to review
the docket in person, go to the address in the ADDRESSES section of
this notice between 7:30 a.m. and 4 p.m., Monday through Friday, except
Federal holidays.
We will consider all comments we receive by the closing date for
comments. We will consider comments filed late if it is possible to do
so without incurring expense or delay. We may change the proposed
special conditions based on comments we receive.
If you want the FAA to acknowledge receipt of your comments on this
proposal, include with your comments a pre-addressed, stamped postcard
on which the docket number appears. We will stamp the date on the
postcard and mail it back to you.
Background
On March 28, 2003, The Boeing Company applied for an FAA type
certificate for its new Boeing Model 787-8 passenger airplane. The
Boeing Model 787-8 airplane will be a new design, two-engine turbo-jet
transport category airplane with a two-aisle cabin configuration. The
maximum takeoff weight will be 484,000 pounds, and it will carry a
maximum of 381 passengers.
Type Certification Basis
Under provisions of 14 CFR 21.17, Boeing must show that Boeing
Model 787-8 airplanes (hereafter referred to as ``the 787'') meet the
applicable provisions of 14 CFR part 25, as amended by Amendments 25-1
through 25-117, with three exceptions. Sections 25.809(a) and 25.812
will remain as amended by Amendment 25-115, and Sec. 25.981, which
will be as amended by Amendment 25-125 in accordance with 14 CFR 26.37.
If the Administrator finds that the applicable airworthiness
regulations (i.e., part 25) do not contain adequate or appropriate
safety standards for the 787 because of novel or unusual design
features, special conditions are prescribed under provisions of 14 CFR
21.16.
In addition to the applicable airworthiness regulations and special
conditions, the 787 must comply with the fuel vent and exhaust emission
requirements of 14 CFR part 34 and the noise certification requirements
of 14 CFR part 36. Finally, the FAA must also issue a finding of
regulatory adequacy under Sec. 611 of Public Law 92-574, the ``Noise
Control Act of 1972.''
Special conditions, as defined in 14 CFR 11.19, are issued in
accordance with Sec. 11.38 and become part of the type certification
basis in accordance with Sec. 21.17(a)(2).
Special conditions are initially applicable to the model for which
they are issued. Should the type certificate for that model be amended
later to include any other model that incorporates the same or similar
novel or unusual design features, the special conditions would also
apply to the other model under Sec. 21.101.
Novel or Unusual Design Features
The proposed 787 will have a fuel tank NGS that is intended to
control fuel tank flammability. This NGS is designed to provide a level
of performance that will reduce the warm day fleet average wing fuel
tank flammability significantly below the maximum wing fuel tank
flammability limits set in Sec. 25.981(b), as amended by Amendment 25-
125. This high level of wing fuel tank NGS performance is an unusual
design feature not envisioned at the
[[Page 52699]]
time the regulations in the proposed 787 certification basis were
promulgated.
Existing Regulations
The certification basis of the 787 includes Sec. 25.981, as
amended by Amendment 25-125, as required by Sec. 26.37. This amendment
includes the ignition prevention requirements in Sec. 25.981(a), as
amended by Amendment 25-102, and it includes specific limitations on
fuel tank flammability in Sec. 25.981(b) as amended by Amendment 25-
125. (Section 25.981(c) contains an alternative to meeting paragraph
(b)--vapor ignition mitigation--that is not applicable to the proposed
787 design.)
Ignition Source Prevention
Section 25.981(a)(3) requires applicants to show that an ignition
source in the fuel tank system could not result from any single
failure, from any single failure in combination with any latent failure
condition not shown to be extremely remote, or from any combination of
failures not shown to be extremely improbable. This requirement was
originally adopted in Amendment 25-102 and was based on the assumption
that fuel tanks are always flammable. This requirement defines three
types of scenarios that must be addressed in order to show compliance
with Sec. 25.981(a)(3). The first scenario is that any single failure,
regardless of the probability of occurrence of the failure, must not
cause an ignition source. The second scenario is that any single
failure, regardless of the probability of occurrence, in combination
with any latent failure condition not shown to be at least extremely
remote, must not cause an ignition source. The third scenario is that
any combination of failures not shown to be extremely improbable must
not cause an ignition source. Demonstration of compliance with this
requirement would typically require a structured, quantitative safety
analysis. Design areas that have any latent failure conditions
typically would be driven by these requirements to have multiple fault
tolerance, or ``triple redundancy.'' This means that ignition sources
are still prevented even after two independent failures.
Flammability Limits
Section 25.981(b) states that no fuel tank fleet average
flammability exposure may exceed 3 percent of the flammability exposure
evaluation time calculated using the method in part 25, Appendix N, or
the fleet average flammability of a fuel tank within the wing of the
airplane being evaluated, whichever is greater. If the wing is not a
conventional unheated aluminum wing, the analysis must be based on an
assumed equivalent construction conventional unheated aluminum wing. In
addition, for fuel tanks that are normally emptied during operation and
that have any part of the tank located within the fuselage contour, the
fleet average flammability for warm days (above 80[deg]F) must be
limited to 3 percent as calculated using the method in part 25,
Appendix M.
Application of Existing Regulations Inappropriate Due to Impracticality
Since the promulgation of Sec. 25.981(a)(3), as amended by
Amendment 25-102, the FAA has conducted certification projects in which
applicants found it impractical to meet the requirements of that
regulation for some areas of lightning protection for fuel tank
structure. Partial exemptions were issued for these projects. These
same difficulties exist for the 787 project.
The difficulty of designing multiple-fault-tolerant structure, and
the difficulty of detecting failures of hidden structural design
features in general, makes compliance with Sec. 25.981(a)(3) uniquely
challenging and impractical for certain aspects of the electrical
bonding of structural elements. Such bonding is needed to prevent
occurrence of fuel tank ignition sources from lightning strikes. The
effectiveness and fault tolerance of electrical bonding features for
structural joints and fasteners is partially dependent on design
features that cannot be effectively inspected or tested after assembly
without damaging the structure, joint, or fastener. Examples of such
features include a required interference fit between the shank of a
fastener and the hole in which the fastener is installed, metal foil or
mesh imbedded in composite material, a required clamping force provided
by a fastener to pull two structural parts together, and a required
faying surface bond between the flush surfaces of adjacent pieces of
structural material such as in a wing skin joint or a mounting bracket
installation. In addition, other features that can be physically
inspected or tested may be located within the fuel tanks, therefore, it
is not practical to inspect for failures of those features at short
intervals. Examples of such failures include separation or loosening of
cap seals over fastener ends and actual structural failures of internal
fasteners. This inability to practically detect failures of structural
design features critical to lightning protection results in any such
failures that occur remaining in place for a very long time, and
possibly for the remaining life of the airplane, prior to detection.
Accounting for such long failure latency periods in the system
safety analysis required by Sec. 25.981(a)(3) would require multiple
fault tolerance in the structural lightning protection design. As part
of the design development activity for the 787, Boeing has examined
possible design provisions to provide multiple fault tolerance in the
structural design to prevent ignition sources from occurring in the
event of lightning attachment to the airplane in critical locations.
Boeing has concluded from this examination that providing multiple
fault tolerance for some structural elements is not practical. Boeing
has also identified some areas of the proposed 787 design where it is
impractical to provide even single fault tolerance in the structural
design to prevent ignition sources from occurring in the event of
lightning attachment after a single failure. The FAA has reviewed this
examination with Boeing in detail and has agreed that providing fault
tolerance beyond that in the proposed 787 design for these areas would
be impractical.
As a result of the 787 and other certifications projects, the FAA
has now determined that compliance with Sec. 25.981(a)(3) is
impractical for some areas of lightning protection for fuel tank
structure, and that application of Sec. 25.981(a)(3) to those design
areas is therefore inappropriate. The FAA plans further rulemaking to
revise Sec. 25.981(a)(3). The FAA plans to issue special conditions or
exemptions, when appropriate, for certification projects in the
interim. This is discussed in FAA Memorandum ANM-112-08-002, Policy on
Issuance of Special Conditions and Exemptions Related to Lightning
Protection of Fuel Tank Structure, dated May 26, 2009.\\1\\
---------------------------------------------------------------------------
\\1\\ The memorandum may be viewed at: http://www.airweb.faa.gov/
Regulatory_and_Guidance_Library/rgPolicy.nsf/0/
12350AE62D393B7A862575C300709CA3?OpenDocument&Highlight=anm-112-08-
002.
---------------------------------------------------------------------------
Application of Existing Regulations Inappropriate Due to Compensating
Feature That Provides Equivalent Level of Safety
Section 25.981(b) sets specific standards for fuel tank
flammability as discussed above under ``Flammability Limits.'' Under
that regulation, the fleet average flammability exposure of wing main
tanks on the 787 may not exceed 3 percent of the flammability exposure
evaluation time calculated using the method in part 25, Appendix N, or
the fleet average flammability of a wing main tank within an equivalent
[[Page 52700]]
construction conventional unheated aluminum wing fuel tank, whichever
is greater. If it is assumed that a 787 equivalent conventional
unheated aluminum wing fuel tank would not exceed a fleet average
flammability time of 3 percent, the actual composite airplane wing fuel
tank design would be required to comply with the 3 percent fleet
average flammability standard. However, the proposed 787 design
includes a wing tank NGS that will also be shown to meet the
additional, more stringent warm day average flammability standard in
part 25, Appendix M, which is only required for normally emptied fuel
tanks with some part of the tank within the fuselage contour.
Since the proposed wing tank NGS on the 787 provides performance
that meets part 25, Appendix M, the FAA has determined that the risk
reduction provided by this additional performance will provide
compensation for some relief from the ignition prevention requirements
of Sec. 25.981(a)(3).
In determining the appropriate amount of relief from the ignition
prevention requirements of Sec. 25.981(a), the FAA considered the
original overall intent of Amendment 25-102, which was to ensure the
prevention of catastrophic events due to fuel tank vapor explosion. The
proposed special conditions are intended to achieve that objective
through a prescriptive requirement that fault tolerance (with respect
to the creation of an ignition source) be provided for all structural
lightning protection design features where providing such fault
tolerance is practical, and through a performance-based standard for
the risk due to any single failure vulnerability that exists in the
design. In addition, for any structural lightning protection design
features for which Boeing shows that providing fault tolerance is
impractical, the proposed special conditions would require Boeing to
show that a fuel tank vapor ignition event due to the summed risk of
all non-fault-tolerant design features is extremely improbable. Boeing
would be required to show that this safety objective is met by the
proposed design using a structured system safety assessment similar to
that currently used for demonstrating compliance with Sec. Sec. 25.901
and 25.1309.
Discussion of the Proposed Requirements
Given these novel design features, and the compliance challenges
noted earlier in this document, the FAA has determined that application
of Sec. 25.981(a)(3) is inappropriate in that it is neither practical
nor necessary to apply the ignition source prevention provisions of
Sec. 25.981(a)(3) to the specific fuel tank structural lightning
protection features of the 787. However, without the Sec. 25.981(a)(3)
provisions, the remaining applicable regulations in the 787
certification basis would be inadequate to set an appropriate standard
for fuel tank ignition prevention. Therefore, in accordance with
provisions of Sec. 21.16, the FAA is proposing that, instead of Sec.
25.981(a)(3), alternative fuel tank structural lighting protection
requirements be applied to fuel tank lightning protection features that
are integral to the airframe structure of the 787. These alternative
requirements are intended to provide the level of safety intended by
Sec. 25.981(a)(3), based on our recognition, as discussed above, that
a highly effective NGS for the fuel tanks makes it unnecessary to
assume that the fuel tank is always flammable. As discussed previously,
the assumption that the fuel tank is always flammable was part of the
basis for the ignition prevention requirements of Sec. 25.981(a)(3).
One resulting difference between these proposed special conditions
and the Sec. 25.981(a)(3) provisions they are meant to replace is the
outcome being prevented--fuel vapor ignition versus an ignition source.
These proposed special conditions acknowledge that the application of
fuel tank flammability performance standards will reduce fuel tank
flammability to an extent that it is appropriate to consider the
beneficial effects of flammability reduction when considering design
areas where it is impractical to comply with Sec. 25.981(a)(3).
One of the core requirements of the proposed special conditions is
a prescriptive requirement that structural lightning protection design
features must be fault tolerant. (An exception wherein Boeing can show
that providing fault tolerance is impractical, and associated
requirements, is discussed below.) The other core requirement is that
Boeing must show that the design, manufacturing processes, and
airworthiness limitations section of the instructions for continued
airworthiness include all practical measures to prevent, and detect and
correct, failures of structural lightning protection features due to
manufacturing variability, aging, wear, corrosion, and likely damage.
The FAA has determined that, if these core requirements are met, a fuel
tank vapor ignition event due to lightning is not anticipated to occur
in the life of the airplane fleet. This conclusion is based on the fact
that a critical lightning strike to any given airplane is itself a
remote event, and on the fact that fuel tanks must be shown to be
flammable for only a relatively small portion of the fleet operational
life.
For any non-fault-tolerant features proposed in the design, Boeing
must show that eliminating these features or making them fault tolerant
is impractical. The requirements and considerations for showing it is
impractical to provide fault tolerance are described in FAA Memorandum
ANM-112-08-002. This requirement is intended to minimize the number of
non-fault tolerant features in the design.
For areas of the design where Boeing shows that providing fault
tolerant structural lighting protection features is impractical, non-
fault-tolerant features will be allowed provided Boeing can show that a
fuel tank vapor ignition event due to the non-fault-tolerant features
is extremely improbable when the sum of probabilities of those events
due to all non-fault-tolerant features is considered. Boeing will be
required to submit a structured, quantitative assessment of fleet
average risk for a fuel tank vapor ignition event due to all non-fault-
tolerant design features included in the design. This will require
determination of the number of non-fault tolerant design features,
estimates of the probability of the failure of each non-fault-tolerant
design feature, and estimates of the exposure time for those failures.
This analysis must include failures due to manufacturing variability,
aging, wear, corrosion, and likely damage.
It is acceptable to consider the probability of fuel tank
flammability, the probability of a lightning strike to the airplane,
the probability of a lightning strike to specific zones of the airplane
(for example, Zone 2 behind the nacelle, but not a specific location or
feature), and a distribution of lightning strike amplitude in
performing the assessment provided the associated assumptions are
acceptable to the FAA. The analysis must account for any dependencies
among these factors, if they are used. The assessment must also account
for operation with inoperative features and systems, including any
proposed or anticipated dispatch relief. This risk assessment
requirement is intended to ensure that an acceptable level of safety is
provided given the non-fault-tolerant features in the proposed design.
Part 25, Appendix N, as adopted in Amendment 25-125, in conjunction
with these proposed special conditions, constitutes the standard for
how to determine flammability probability. In performing the safety
analysis required by these proposed special conditions,
[[Page 52701]]
relevant Sec. 25.981(a)(3) compliance guidance is still applicable.
Appropriate credit for the conditional probability of environmental or
operational conditions occurring is normally limited to those
provisions involving multiple failures, and this type of credit is not
normally allowed in evaluation of single failures. However, these
proposed special conditions would allow consideration of the
probability of occurrence of lightning attachment and flammable
conditions when assessing the probability of structural failures
resulting in a fuel tank vapor ignition event.
The FAA understands that lightning protection safety for airplane
structure is inherently different from lightning protection for
systems. We intend to apply these special conditions only to structural
lightning protection features of fuel systems. We do not intend to
apply the alternative standards used under these special conditions to
other areas of the airplane design evaluation.
Proposed Requirements Provide Equivalent Level of Safety
In recognition of the unusual design feature discussed above, and
the impracticality of requiring multiple fault tolerance for lightning
protection of certain aspects of fuel tank structure, the FAA has
determined that an equivalent level of safety to direct compliance with
Sec. 25.981(a)(3) will be achieved for the 787 by applying these
proposed requirements. The FAA considers that, instead of only
concentrating on fault tolerance for ignition source prevention,
significantly reducing fuel tank flammability exposure in addition to
preventing ignition sources is a better approach to lightning
protection for the fuel tank. In addition, the level of average fuel
tank flammability achieved by compliance with these special conditions
is low enough that it is not appropriate or accurate to assume in a
safety analysis that the fuel tanks may always be flammable.
Section 25.981(b), as amended by Amendment 25-125, sets limits on
the allowable fuel tank flammability for the 787. Paragraph 2(a) of
these proposed special conditions applies the more stringent standard
for warm day flammability performance applicable to normally emptied
tanks within the fuselage contour from Sec. 25.981(b) and part 25,
Appendix M, to the wing tanks of the 787.
Because of the more stringent fuel tank flammability requirements
in these special conditions, and because the flammability state of a
fuel tank is independent of the various failures of structural elements
that could lead to an ignition source in the event of lightning
attachment, the FAA has agreed that it is appropriate in this case to
allow treatment of flammability as an independent factor in the safety
analysis. The positive control of flammability and the lower
flammability that is required by these special conditions exceeds the
minimum requirements of Sec. 25.981(b). This offsets a reduction of
the stringent standard for ignition source prevention in Sec.
25.981(a)(3), which assumes that the fuel tank is flammable at all
times.
Given the stringent requirements for fuel tank flammability, the
fuel vapor ignition prevention and the ignition source prevention
requirements in these special conditions will prevent ``* * *
catastrophic failure * * * due to ignition of fuel or vapors.'', as
stated in Sec. 25.981(a). Thus, the overall level of safety achieved
by these special conditions is considered equivalent to that which
would be required by compliance with Sec. 25.981(a)(3) and (b).
Applicability
These proposed special conditions are applicable to the 787-8.
Should Boeing apply at a later date for a change to the type
certificate to include another model incorporating the same novel or
unusual design features, these proposed special conditions would apply
to that model as well.
Conclusion
This action affects only certain novel or unusual design features
of the 787. It is not a rule of general applicability.
List of Subjects in 14 CFR Part 25
Aircraft, Aviation safety, Reporting and recordkeeping
requirements.
The authority citation for these special conditions is as follows:
Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.
The Proposed Special Conditions
Accordingly, the Federal Aviation Administration (FAA) proposes the
following special conditions as part of the type certification basis
for The Boeing Model 787-8 airplane.
1. Definitions
Most of the terms used in Special Condition No. 2, Alternative Fuel
Tank Structural Lightning Protection Requirements, either have the
common dictionary meaning or are defined in AC 25.1309-1A, System
Design and Analysis, dated June 21, 1988.
The following definitions are the only terms intended to have a
specialized meaning when used in Special Condition No. 2.:
(a) Basic Airframe Structure. Includes design elements such as
structural members, structural joint features, and fastener systems
including airplane skins, ribs, spars, stringers, etc., and associated
fasteners, joints, coatings, and sealant. Basic airframe structure may
also include those structural elements that are expected to be removed
for maintenance, such as exterior fuel tank access panels and fairing
attachment features, provided maintenance errors that could compromise
associated lightning protection features would be evident upon an
exterior preflight inspection of the airplane and would be corrected
prior to flight.
(b) Permanent Systems Supporting Structure. Includes static,
permanently attached structural parts (such as brackets) that are used
to support system elements. It does not include any part intended to be
removed, or any joint intended to be separated, to maintain or replace
system elements or other parts, unless that part removal or joint
separation is accepted by the FAA as being extremely remote.
(c) Manufacturing Variability. Includes tolerances and variability
allowed by the design and production specifications as well as
anticipated errors or escapes from the manufacturing and inspection
processes.
(d) Extremely Remote. Conditions that are not anticipated to occur
to each airplane during its total life, but which may occur a few times
when considering the total operational life of all airplanes of one
type. Extremely remote conditions are those having an average
probability per flight hour on the order of 1 x 10-7 or
less, but greater than on the order of 1 x 10-9.
(e) Extremely Improbable. Conditions that are so unlikely that they
are not anticipated to occur during the entire operational life of all
airplanes of one type. Extremely improbable conditions are those having
an average probability per flight hour of the order of 1 x
10-9 or less.
2. Alternative Fuel Tank Structural Lightning Protection Requirements
For lightning protection features that are integral to fuel tank
basic airframe structure or permanent systems supporting structure, as
defined in Special Condition No. 1, Definitions, for which the Boeing
Company shows and the FAA finds compliance with Sec. 25.981(a)(3) to
be impractical, the following requirements may be applied
[[Page 52702]]
in lieu of the requirements of Sec. 25.981(a)(3):
(a) The Boeing Company must show that the airplane design meets the
requirements of part 25, Appendix M, as amended by Amendment 25-125,
for all fuel tanks installed on the airplane.
(b) The Boeing Company must show that the design includes at least
two independent, effective, and reliable lightning protection features
(or sets of features) such that fault tolerance to prevent lightning-
related ignition sources is provided for each area of the structural
design proposed to be shown compliant with these special conditions in
lieu of compliance with the requirements of Sec. 25.981(a)(3). Fault
tolerance is not required for any specific design feature if:
(1) for that feature, providing fault tolerance is shown to be
impractical, and
(2) fuel tank vapor ignition due to that feature and all other non-
fault-tolerant features, when their fuel tank vapor ignition event
probabilities are summed, is shown to be extremely improbable.
(c) The applicant must perform an analysis to show that the design,
manufacturing processes, and airworthiness limitations section of the
instructions for continued airworthiness include all practical measures
to prevent, and detect and correct, failures of structural lightning
protection features due to manufacturing variability, aging, wear,
corrosion, and likely damage.
Issued in Renton, Washington, on September 24, 2009.
Ali Bahrami,
Manager, Transport Airplane Directorate, Aircraft Certification
Service.
[FR Doc. E9-24652 Filed 10-13-09; 8 am]
BILLING CODE 4910-13-P