A change in a 787 safety system prompts regulatory whiplash

By Dominic Gates / The Seattle Times

Last spring, Federal Aviation Administration managers approved removing a key feature of the 787 Dreamliner wing that aimed to protect it in the event of a lightning strike.

Boeing’s design change, which reduces costs for the company and its airline customers, sped through despite objections raised by the agency’s own technical experts, who saw an increased risk of an explosion in the fuel tank inside the wing.

FAA scrutiny of Boeing has been an intense focus since two crashes and the grounding of the Renton-built 737 Max model. But until now comparatively little has emerged about how well the agency is overseeing Boeing’s other airplane models, all built in Everett, including the 787, which is also assembled in North Charleston, South Carolina.

Lightning protection on an airplane like the 787, which is fabricated largely from carbon composites, is more elaborate than on a metal aircraft. When Boeing developed the Dreamliner, it included special measures to protect the wing fuel tank. It sealed each metal fastener in the wing with an insulating cap and embedded copper foil in strips across the carbon wing skin to disperse the current from any lightning strike.

Five years ago, Boeing quietly stopped adding the insulating fastener caps. Its own engineers approved the change with minimal input from the FAA.

Then, in March, it stopped adding the copper foil. The entire wing surface of any 787 delivered since then now lacks both protections.

The FAA initially rejected the removal of the foil from the wing on Feb. 22, when its certification office ruled that Boeing had not shown, as regulations required, that the ignition of fuel tank vapor by a lightning strike would be “extremely improbable,” defined in this case as likely to occur no more than three times in a billion flight hours.

By then Boeing had already built about 40 sets of wings without the foil.

Facing the prospect of not being able to deliver those airplanes, Boeing immediately appealed. FAA managers reversed the ruling exactly a week later.

In June, a senior FAA safety engineer, Thomas Thorson, formally objected, concerned that the agency was hurriedly approving Boeing’s desired changes so it could deliver planes it had already built.

“I do not agree that delivery schedules should influence our safety decisions and areas of safety critical findings, nor is this consistent with our safety principles,” Thorson wrote.

FAA management has faced heavy criticism for the way it took scrutiny of the now-grounded 737 Max’s certification away from its own technical staff and delegated most of the approval process to Boeing itself.

The 787 decision, which came as Boeing was pushing to reduce the cost and complexity of manufacturing the jet, raises similar concern.

Boeing says the changes were introduced as its understanding of lightning protection evolved, both in terms of what works well in practice and in what’s needed to meet the FAA requirements.

In a statement, Boeing said the 787 has “several other layers of protection from lightning strikes” and that each design change “was properly considered and addressed by Boeing, thoroughly reviewed with and approved by the FAA.”

Thorson, propulsion technical project manager at the FAA, wrote that the agency’s technical experts discovered errors in the way Boeing summed up the various risks of the lightning protection features and that with the removal of the foil “the fuel tank ignition threat … cannot be shown extremely improbable.”

Thorson estimated that if the math were corrected, the ignition risk “would be classified as potentially unsafe.”

He recommended that the FAA reject Boeing’s assertion that it complied with regulations “due to the amount of risk that the FAA would be accepting for fuel tank ignition due to lightning.”

Thorson also objected to the FAA delegating to Boeing itself a system safety assessment of the design change that was specific to the largest Dreamliner model, the South Carolina-built 787-10, because of different details inside the wing.

He wrote that the rationale provided for this delegation of oversight was the FAA’s inability “to support the airplane delivery schedule.” The FAA’s approval of the design change for that specific model on June 28 allowed Boeing to go ahead the next day and deliver a 787-10 to Dutch airline KLM.

The 787 lightning protection changes were first raised last month in a letter to the FAA from Rep. Peter DeFazio, D-Oregon, chair of the House Committee on Transportation and Infrastructure, and Rep Rick Larsen, D-Everett, chair of the Aviation subcommittee. The committee provided Thorson’s letter and other supporting documents after a request by The Seattle Times.

FAA Administrator Steve Dickson wrote to the committee on Friday insisting that “the design change had no unsafe features” and that the 787s produced since the removal of the copper foil from the wing skin are “currently safe to operate.”

Still, in October, perhaps in response to the mounting criticism of its oversight role, the FAA seemed to take a step back.

In a letter to Boeing, the agency’s airplane certification unit said the “cumulative effect of multiple issues” affecting the 787’s lightning protection — including the deliberate design changes, a sequence of Boeing manufacturing errors and the discovery that some lightning protection features proved inadequate in practice — raised concerns that the risk from a lightning strike is greater than the regulations allow.

As a result, eight years after the FAA gave its original approval to the 787, and months after approving the removal of the foil from the wing, it asked Boeing to conduct a formal re-assessment of the risk of a fuel tank explosion in the 787 wing.

Redrawn lightning strike zones

Each passenger airplane, on average, gets hit by lightning about once a year, with more strikes recorded in certain regions. The impact on a plane with a traditional metal airframe is often minimal because the current passes along the skin from the front to the back, then exits to the ground.

A carbon skin is much less conductive and requires careful protection to avoid having all the power of a lightning strike concentrated in the small area that’s hit.

A British Airways 787 struck by lightning two years ago shortly after it departed London’s Heathrow airport sustained more than 40 holes in the fuselage from the strike, damage that was discovered only after it landed in India.

Beneath its carbon skin, and specifically inside the wing fuel tank, the 787 has metal fittings and structures. These must all be grounded and linked so that if current reaches them, it’s distributed safely away.

The danger is that a small crack in the metal, or two metal fittings close together but not linked, might cause the current to jump the gap, creating a spark that could ignite fuel vapor. The metal fasteners in the jet’s wing skin and the metal ribs, wires, tubes and fittings in the interior of the fuel tank must all be protected against such a possibility.

The original 787 wing design certified by the FAA gave most wing fasteners triple protection: an insulating sealant cap on the exterior head, the copper foil to disperse the current and a collar that compressed to create a secure, tight fit when the fastener was inserted. This made them fault-tolerant: if one layer failed, there were two other layers of protection.

Boeing stopped installing the insulating caps on the fasteners in 2014 because the sealant cap tended to crack quickly in service, and maintaining tens of thousands of such fastener heads was an expensive headache for the airlines.

On the minority of fasteners that didn’t have the collar creating the tight fit, Boeing put insulating cap seals on the inside of the tank instead.

The copper foil just under the skin was another headache. It added weight and cost for Boeing to install and, if it was struck by lightning, was expensive for the airline to repair.

SAE International, a global engineering association that sets industry standards, classifies the different areas of an airframe for lightning strike purposes as Zone 1 — areas likely to get a direct hit. Zone 2 consists of areas aft of the direct hit that are vulnerable to a strike sweeping back as the airplane moves forward. And Zone 3 is comprised of areas unlikely to get a lightning strike.

Boeing decided to remove the foil from Zone 3.

In December 2018, SAE revised the zones based on data from reports of more than 1,000 lightning strikes on aircraft. It found that the area aft of the engines — designated Zone 2 when the 787 was certified — was rarely hit, and so it changed the classification to Zone 3.

Now all of the wing except for the wingtip — almost the entire fuel tank — is classified with the lowest vulnerability, Zone 3.

The basis for much of Thorson’s objection in June was that now tens of thousands of wing fasteners were no longer fault-tolerant. With no copper foil and few fasteners with in-tank cap seals — approximately 10%, one FAA engineer told The Seattle Times — that left each of the remaining 90% of wing fasteners as a potential single point of failure, a potential ignition source, in the event of a lightning strike.

During initial certification of the 787, the FAA told Boeing that in assessing the probability of a fuel tank explosion, it didn’t need to sum up all the features in Zone 3 that were not fault-tolerant, since the risk was very low. The overall probability of a fuel tank explosion, Boeing calculated then, met the “three in a billion” threshold.

In turning down Boeing’s proposal in February, the FAA’s technical staff argued that Boeing’s design changes left many more features that aren’t fault tolerant and that this calculation needs to be done anew to assess the risk properly.

In an internal email to Thorson, another FAA safety engineer referred to the pending 787-10 delivery to KLM, writing that “this is clearly a contentious issue and Boeing is rushing the certification so they can deliver airplanes.”

Boeing rejected the opinion of the FAA technical specialists and persuaded FAA management that it was still in compliance with safety regulations.

In a statement, the agency said that decision was made “by managers who were qualified safety experts with technical backgrounds.”

In written answers provided to The Seattle Times, Boeing said the 787 design provides “the necessary safety and protection redundancy” and meets “all regulatory and design requirements.”

Boeing also noted that other 787 lightning protection measures remain.

In addition to the various measures taken to reduce the chance of a spark, the 787 wing fuel tank has a nitrogen-generating system that reduces flammable vapor by filling the space above the fuel with inert gas.

This is a highly reliable way to prevent an explosion. The one weakness in the system is that, if it’s inoperative for any reason, airlines are still allowed to fly the aircraft for a limited time.

A new risk assessment

Boeing is currently conducting the new risk assessment ordered by the FAA in October.

In addition to the removal of insulating caps from metal fasteners and copper foil from the carbon wing skin, the FAA has asked Boeing to consider multiple other changes it’s made to details inside the fuel tank.

In the system that measures how much fuel is in the tank, Boeing dropped a feature designed to prevent wires rubbing together. It removed sealant from certain areas judged to no longer be vulnerable to sparking. It removed clamps designed to ensure hydraulic tubing didn’t come loose inside the tank.

Most of the design changes reduce complexity, cost and weight. Boeing has steadily reduced the cost of building the 787, a vital part of its drive to recoup the $22 billion in still-outstanding 787 production costs deferred into the future.

The FAA said it also wants Boeing to assess the risk from discoveries since the plane entered service.

For example, a primer used to coat surfaces inside the tank before sealant was added was found not to adhere as well as expected and was prone to degrading, leaving the sealant loose.

Boeing must also factor into its assessment a series of manufacturing errors that have slipped through in the production process at different times, so that various 787s in service around the world have details within the wings that don’t conform to the design.

The FAA letter cited 11 examples of such manufacturing concerns, such as “fastener washers installed backwards with a sharp edge against the primer,” causing it to crack. Each specific issue affects only the jets built during the period before that mistake was corrected.

The assessment needs to address all the configurations of Dreamliners that have been produced with the various design differences and known production quality errors, the FAA said.

Boeing, in its written response to questions, said it “has assessed all of the configurations in-service” and is “confident that the aircraft all meet the federal safety requirements.”

Appearing before DeFazio’s committee Wednesday, FAA chief Dickson was pressed to defend his agency’s independence from industry and the integrity of its oversight.

His written response to the committee insisted that Boeing’s decision to delete copper foil from the 787 wing skin complied with all FAA requirements and that the reassessment now underway of the jet’s lightning protection was not driven by that change.

And he denied there’s any “concern that a short-term or urgent safety issue exists.”

The FAA engineer who spoke to The Seattle Times said he found these were conflicting assertions. On the one hand, the FAA says the 787 is safe. On the other, it’s ordered Boeing to recheck that it’s safe.

If Boeing’s re-assessment confirms that the 787 remains within regulations, the jetmaker’s next new airplane will follow the same path. The massive carbon composite wing of the 777X will be built according to the latest 787 wing specifications: without the copper foil or the insulating cap seals.