Last spring, Federal Aviation Administration (FAA) managers approved removing a key feature of the 787 Dreamliner wing that aimed to protect it in the event of a lightning strike.
Boeing’s design change, which reduces costs for the company and its airline customers, sped through despite firm objections raised by the agency’s own technical experts, who saw an increased risk of an explosion in the fuel tank inside the wing.
That clash will come under scrutiny Wednesday as FAA Administrator Steve Dickson appears before a House committee examining the agency’s regulatory performance in the wake of the two Boeing 737 MAX crashes.
Lightning protection on an airplane like the 787 that’s fabricated largely from carbon composites is more elaborate than on a metal aircraft. When Boeing developed the Dreamliner, it included special measures to protect the wing fuel tank. It sealed each metal fastener in the wing with an insulating cap and embedded copper foil in strips across the carbon wing skin to disperse the current from any lightning strike.
Five years ago, Boeing quietly stopped adding the insulating fastener caps. Its own engineers approved the change with minimal input from the FAA.
Then, in March, it stopped adding the copper foil. The entire wing surface of any 787 delivered since then now lacks both protections.
The FAA initially rejected the removal of the foil from the wing on February 22, when its certification office ruled that Boeing had not shown, as regulations required, that the ignition of fuel tank vapor by a lightning strike would be “extremely improbable,” defined in this case as likely to occur no more than three times in a billion flight hours.
By then Boeing had already built about 40 sets of wings without the foil.
Facing the prospect of not being able to deliver those airplanes, Boeing immediately appealed. FAA managers reversed the ruling exactly a week later — just days before the unrelated crash of the second 737 MAX.
In June, a senior FAA safety engineer, Thomas Thorson, concerned that the agency was hurriedly approving Boeing’s desired changes so it could deliver planes it had already built, formally objected.
“I do not agree that delivery schedules should influence our safety decisions and areas of safety critical findings, nor is this consistent with our safety principles,” Thorson wrote.
FAA management has faced heavy criticism for the way it took scrutiny of the MAX’s certification away from its own technical staff and delegated most of the approval process to Boeing itself.
The 787 decision, which came as Boeing was pushing to reduce the cost and complexity of manufacturing the jet, raises similar concern.
Boeing says the changes were introduced as its understanding of lightning protection evolved over time, both in terms of what works well in practice and in what’s needed to meet the FAA requirements.
In a statement, Boeing said the 787 has “several other layers of protection from lightning strikes” and that each design change “was properly considered and addressed by Boeing, thoroughly reviewed with and approved by the FAA.”
Thorson, propulsion technical project manager at the FAA, wrote that agency’s technical experts had discovered errors in the way Boeing had summed up the various risks of the lightning protection features and that with the removal of the foil “the fuel tank ignition threat ... cannot be shown extremely improbable.”
Thorson estimated that if the math were corrected, the ignition risk “would be classified as potentially unsafe.”
He recommended that the FAA reject Boeing’s assertion that it complied with regulations “due to the amount of risk that the FAA would be accepting for fuel tank ignition due to lightning.”
Thorson also objected to the FAA delegating to Boeing itself a System Safety Assessment of the design change that was specific to the largest Dreamliner model, the 787-10, because of different details inside the wing.
He wrote that the rationale provided for this delegation of oversight was the FAA’s inability “to support the airplane delivery schedule.” The FAA’s approval of the design change for that specific model on June 28 allowed Boeing to go ahead next day and deliver a 787-10 in South Carolina to Dutch airline KLM.
The 787 lightning protection changes were first raised last month in a letter to the FAA from Rep. Peter DeFazio, D-Ore., chair of the House Committee on Transportation and Infrastructure, and Rep Rick Larsen, D-Everett, chair of the Aviation subcommittee. The committee provided Thorson’s letter and other supporting documents after a request by The Seattle Times.
FAA Administrator Dickson wrote to the committee on Friday insisting that “the design change had no unsafe features” and that the 787s produced since the removal of the copper foil from the wing skin are “currently safe to operate.”
Still, in October, perhaps in response to the mounting criticism of its oversight role, the FAA seemed to take a step back.
In a letter to Boeing, the agency’s airplane certification unit said the “cumulative effect of multiple issues” affecting the 787’s lightning protection -- including the deliberate design changes, a sequence of Boeing manufacturing errors and the discovery that some lightning protection features proved inadequate in practice -- raised concerns that the risk from a lightning strike is greater than the regulations allow.
As a result, eight years after the FAA gave its original approval to the 787, and months after approving the removal of the foil from the wing, it finally asked Boeing to conduct a formal re-assessment of the risk of a fuel tank explosion in the 787 wing.
Redrawn lightning strike zones
Each passenger airplane, on average, gets hit by lightning about once a year, with more strikes recorded in certain regions. The impact on a plane with a traditional metal airframe is often minimal because the current passes along the skin from the front to the back, then exits to the ground.
A carbon skin is much less conductive, and so requires careful protection to avoid having all the power of a lightning strike concentrated in the small area that’s hit.
A British Airways 787 struck by lightning two years ago shortly after it departed London’s Heathrow airport sustained more than 40 holes in the fuselage from the strike, damage that was discovered only after it landed in India.
Beneath its carbon skin, and specifically inside the wing fuel tank, the 787 has metal fittings and structures. These must all be grounded and linked so that if current reaches them, it’s distributed safely away.
The danger is that a small crack in the metal, or two metal fittings close together but not linked, might cause the current to jump the gap, creating a spark that could ignite the fuel vapor. The metal fasteners in the jet’s wing skin and the metal ribs, wires, tubes and fittings in the interior of the fuel tank must all be protected against such a possibility.
The original 787 wing design certified by the FAA gave most wing fasteners triple protection: an insulating sealant cap on the exterior head, the copper foil to disperse the current and a collar that compressed to create a secure, tight fit when the fastener was inserted. This made them fault-tolerant: if one layer failed, there were two other layers of protection.
Boeing stopped installing the insulating caps on the fasteners in 2014 because the sealant cap tended to crack quickly in service, and maintaining tens of thousands of such fastener heads was an expensive headache for the airlines.
On the minority of fasteners that didn’t have the collar creating the tight fit, Boeing put insulating cap seals on the inside of the tank instead.
The copper foil just under the skin was another headache. It added weight and cost for Boeing to install and, if it was struck by lightning, it was expensive for the airline to repair.
SAE International, a global engineering association that sets industry standards, classifies the different areas of an airframe for lightning strike purposes as Zone 1, areas likely to get a direct hit; Zone 2, areas aft of the direct hit vulnerable to a strike sweeping back as the airplane moves forward; and Zone 3, areas unlikely to get a lightning strike.
Boeing decided to remove the foil from Zone 3.
In December 2018, SAE revised the zones based on data from reports of more than 1,000 lightning strikes on aircraft. It found that the area aft of the engines -- designated Zone 2 when the 787 was certified -- was rarely hit, and so changed its classification to Zone 3.
Now all of the wing except for the wingtip -- almost the entire fuel tank -- is classified with the lowest vulnerability, Zone 3.
The basis for much of Thorson’s objection in June was that now tens of thousands of wing fasteners were no longer fault tolerant. With no copper foil and few fasteners with in-tank cap seals -- approximately 10%, one FAA engineer told the Seattle Times -- that left each of the remaining 90% of wing fasteners a potential single point of failure, a potential ignition source, in the event of a lightning strike.
During initial certification of the 787, the FAA told Boeing that in assessing the probability of a fuel tank explosion, it didn’t need to sum up all the features in Zone 3 that were not fault tolerant since the risk was very low. The overall probability of a fuel tank explosion, Boeing calculated then, met the “three in a billion” threshold, though not with much margin to spare.
In turning down Boeing’s proposal in February, the FAA’s technical staff argued that Boeing’s design changes left many more features that aren’t fault tolerant and that this calculation needs to be done anew to assess the risk properly.
In an internal email to Thorson, another FAA safety engineer referred to the pending 787-10 delivery to KLM, writing that “this is clearly a contentious issue and Boeing is rushing the certification so they can deliver airplanes.”
