[Federal Register: August 23, 2005 (Volume 70, Number 162)]
[Rules and Regulations]
[Page 49155-49164]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr23au05-2]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Part 25
[Docket No. NM307; Special Conditions No. 25-296-SC]
Special Conditions: Embraer Model ERJ 190 Series Airplanes;
Sudden Engine Stoppage, Interaction of Systems and Structures,
Operation Without Normal Electrical Power, Electronic Flight Control
Systems, Automatic Takeoff Thrust Control System (ATTCS), and
Protection From Effects of High Intensity Radiated Fields (HIRF)
AGENCY: Federal Aviation Administration (FAA), DOT.
ACTION: Final special conditions.
-----------------------------------------------------------------------
[[Page 49156]]
SUMMARY: These special conditions are issued for the Embraer Model ERJ
190 series airplane. This airplane will have novel or unusual design
features when compared to the state of technology envisioned in the
airworthiness standards for transport category airplanes. These design
features are associated with (1) engine size and torque load which
affect sudden engine stoppage, (2) electrical and electronic systems
which perform critical functions, and (3) an Automatic Takeoff thrust
Control Systems (ATTCS). These special conditions also pertain to the
effects of such novel or unusual design features, such as their effects
on the structural performance of the airplane. The applicable
airworthiness regulations do not contain adequate or appropriate safety
standards for these design features. These special conditions contain
the additional safety standards that the Administrator considers
necessary to establish a level of safety equivalent to that established
by the existing airworthiness standards.
DATES: Effective August 23, 2005.
FOR FURTHER INFORMATION CONTACT: Tom Groves, FAA, International Branch,
ANM-116, Transport Airplane Directorate, Aircraft Certification
Service, 1601 Lind Avenue SW., Renton, Washington 98055-4056; telephone
(425) 227-1503; facsimile (425) 227-1149.
SUPPLEMENTARY INFORMATION:
Background
Embraer made the original application for certification of the ERJ
190 on May 20, 1999. The Embraer application includes six different
models, the initial variant being designated as the ERJ 190-100. The
application was submitted concurrently with that for the ERJ 170-100,
which received an FAA Type Certificate (TC) on February 20, 2004.
Although the applications were submitted as two distinct type
certificates, the airplanes share the same conceptual design and
general configuration. On July 2, 2003, Embraer submitted a request for
an extension of its original application for the ERJ 190 series, with a
new proposed reference date of May 30, 2001, for establishing the type
certification basis. The FAA certification basis was adjusted to
reflect this new reference date. In addition Embraer has elected to
voluntarily comply with certain 14 CFR part 25 amendments introduced
after the May 30, 2001 reference date.
The Embraer ERJ 190-100 is a low wing, transport-category aircraft
powered by two wing-mounted General Electric CF34-10E turbofan engines.
The airplane is a 108 passenger regional jet with a maximum take off
weight of 51,800 kilograms (114,200 pounds). The maximum operating
altitude and speed are 41,000 feet and 320 knots calibrated air speed
(KCAS)/0.82 MACH, respectively.
Type Certification Basis
Based on the May 30, 2001 reference date of application, and under
the provisions of 14 CFR 21.17, Embraer must show that the Model ERJ
190 airplane meets the applicable provisions of 14 CFR part 25, as
amended by Amendments 25-1 through 25-101. If the Administrator finds
that the applicable airworthiness regulations do not contain adequate
or appropriate safety standards for the Embraer ERJ 190-100 airplane
because of novel or unusual design features, special conditions are
prescribed under the provisions of 14 CFR 21.16.
Embraer has proposed to voluntarily adopt several 14 CFR part 25
amendments that became effective after the requested new reference date
of May 30, 2001, specifically Amendment 25-102, except paragraph
25.981(c); Amendments 25-103 through 25-105 in their entirety;
Amendment 25-107, except paragraph 25.735(h); Amendment 25-108 through
25-110 in their entirety; and Amendments 25-112 through 25-114 in their
entirety.
In addition to the applicable airworthiness regulations and special
conditions, the Embraer Model ERJ 190 series airplane must comply with
the fuel vent and exhaust emission requirements of 14 CFR part 34 and
the noise certification requirements of 14 CFR part 36, and the FAA
must issue a finding of regulatory adequacy pursuant to section 611 of
Public Law 93-574, the ``Noise Control Act of 1972.''
Special conditions, as defined in Sec. 11.19, are issued in
accordance with Sec. 11.38 and become part of the type certification
basis in accordance with Sec. 21.17(a)(2).
Special conditions are initially applicable to the model for which
they are issued. Should the type certificate for that model be amended
later to include any other model that incorporates the same novel or
unusual design features, the special conditions would also apply to the
other model under the provisions of Sec. 21.101.
Discussion of Novel or Unusual Design Features
The Embraer ERJ 190 series airplanes will incorporate a number of
novel or unusual design features. Because of rapid improvements in
airplane technology, the applicable airworthiness regulations do not
contain adequate or appropriate safety standards for these design
features. The special conditions proposed for the Embraer ERJ 190
series airplanes contain the additional safety standards that the
Administrator considers necessary to establish a level of safety
equivalent to that established by the existing airworthiness standards.
These special conditions are the same as those required for the Embraer
Model ERJ 170.
The Embraer ERJ 190 series airplanes will incorporate the novel or
unusual design features described below.
Engine Size and Torque Load
Since 1957, Sec. 25.361(b)(1) has required that engine mounts and
supporting structures must be designed to withstand the limit engine
torque load which is posed by sudden engine stoppage due to malfunction
or structural failure, such as compressor jamming. Design torque loads
associated with typical failure scenarios were estimated by the engine
manufacturer and provided to the airframe manufacturer as limit loads.
These limit loads were considered simple, pure static torque loads.
However, the size, configuration, and failure modes of jet engines have
changed considerably from those envisioned when the engine seizure
requirement of Sec. 25.361(b) was first adopted. Current engines are
much larger and are now designed with large bypass fans capable of
producing much larger torque, if they become jammed.
Relative to the engine configurations that existed when the rule
was developed in 1957, the present generation of engines is
sufficiently different and novel to justify issuance of special
conditions to establish appropriate design standards. The latest
generation of jet engines is capable of producing, during failure,
transient loads that are significantly higher and more complex than
those produced by the generation of engines in existence when the
current regulation was developed.
In order to maintain the level of safety envisioned in Sec.
25.361(b), more comprehensive criteria are needed for the new
generation of high bypass engines. The proposed special condition would
distinguish between the more common failure events involving transient
deceleration conditions with temporary loss of thrust capability and
those rare events resulting from structural failures. Associated with
these events, the proposed criteria establish design limit and ultimate
load conditions.
[[Page 49157]]
Interaction of Systems and Structures
The Embraer Model 190 series airplane has fly-by-wire flight
control systems and other power-operated systems that could affect the
structural performance of the airplane, either directly or as a result
of a failure or malfunction. These systems can alleviate loads in the
airframe and, when in a failure state, can impose loads to the
airframe. Currently, part 25 does not adequately account for the direct
effects of these systems or for the effects of failure of these systems
on structural performance of the airplane. The proposed special
conditions provide the criteria to be used in assessing these effects.
Electrical and Electronic Systems Which Perform Critical Functions
The Embraer Model 190 series airplane will have electrical and
electronic systems which perform critical functions. The electronic
flight control system installations establish the criticality of the
electrical power generation and distribution systems, since the loss of
all electrical power may be catastrophic to the airplane. The current
airworthiness standards of part 25 do not contain adequate or
appropriate standards for the protection of the Electronic Flight
Control System from the adverse effects of operations without normal
electrical power. Accordingly, this system is considered to be a novel
or unusual design feature, and special conditions are proposed to
retain the level of safety envisioned by Sec. 25.1351(d).
Section 25.1351(d), ``Operation without normal electrical power,''
requires safe operation in visual flight rule (VFR) conditions for at
least five minutes without normal power. This rule was structured
around a traditional design utilizing mechanical control cables for
flight control surfaces and the pilot controls. Such traditional
designs enable the flightcrew to maintain control of the airplane,
while providing time to sort out the electrical failure, start engines
if necessary, and re-establish some of the electrical power generation
capability.
The Embraer Model 190 series airplane, however, will utilize an
Electronic Flight Control System for the pitch and yaw control
(elevator, stabilizer, and rudder). There is no mechanical linkage
between the pilot controls and these flight control surfaces. Pilot
control inputs are converted to electrical signals, which are processed
and then transmitted via wires to the control surface actuators. At the
control surface actuators, the electrical signals are converted to an
actuator command to move the control surface.
In order to maintain the same level of safety as an airplane with
conventional flight controls, an airplane with electronic flight
controls--such as the Embraer Model 190 series--must not be time
limited in its operation, including being without the normal source of
electrical power generated by the engine or the Auxiliary Power Unit
(APU) generators.
Service experience has shown that the loss of all electrical power
generated by the airplane's engine generators or APU is not extremely
improbable. Thus, it must be demonstrated that the airplane can
continue safe flight and landing (including steering and braking on
ground for airplanes using steer/brake-by-wire) after total loss of
normal electrical power with the use of its emergency electrical power
systems. These emergency electrical power systems must be able to power
loads that are essential for continued safe flight and landing.
Electronic Flight Control System
In airplanes with Electronic Flight Control Systems, there may not
always be a direct correlation between pilot control position and the
associated airplane control surface position. Under certain
circumstances, a commanded maneuver that does not require a large
control input may require a large control surface movement, possibly
encroaching on a control surface or actuation system limit without the
flightcrew's knowledge. This situation can arise in either manually
piloted or autopilot flight and may be further exacerbated on airplanes
where the pilot controls are not back-driven during autopilot system
operation. Unless the flightcrew is made aware of excessive deflection
or impending control surface limiting, control of the airplane by the
pilot or autoflight system may be inadvertently continued so as to
cause loss of control of the airplane or other unsafe characteristics
of stability or performance.
Given these possibilities, a special condition for Embraer Model
ERJ 190 series airplanes addresses control surface position awareness.
This special condition requires that suitable display or annunciation
of flight control position be provided to the flightcrew when near full
surface authority (not crew-commanded) is being used, unless other
existing indications are found adequate or sufficient to prompt any
required crew actions. Suitability of such a display or annunciation
must take into account that some piloted maneuvers may demand the
airplane's maximum performance capability, possibly associated with a
full control surface deflection. Therefore, simple display systems--
that would function in both intended and unexpected control-limiting
situations--must be properly balanced between providing needed crew
awareness and minimizing nuisance alerts.
Automatic Takeoff Thrust Control System
The Embraer Model ERJ 190 series airplane will incorporate an
Automatic Takeoff Thrust Control System (ATTCS) in the engine's Full
Authority Digital Electronic Control (FADEC) system architecture. The
manufacturer requested that the FAA issue special conditions to allow
performance credit to be taken for use of this function during go-
around to show compliance with the requirement of Sec. 25.121(d)
regarding the approach climb gradient.
Section 25.904 and Appendix I refer to operation of ATTCS only
during takeoff. Model ERJ 190 series airplanes have this feature for
go-around also. The ATTCS will automatically increase thrust to the
maximum go-around thrust available under the ambient conditions in the
following circumstances:
If an engine failure occurs during an all-engines-
operating go-around, or
If an engine has failed or been shut down earlier in the
flight.
This maximum go-around thrust is the same as that used to show
compliance with the approach-climb-gradient requirement of Sec.
25.121(d). If the ATTCS is not operating, selection of go-around thrust
will result in a lower thrust level.
The part 25 standards for ATTCS, contained in Sec. 25.904
[Automatic takeoff thrust control system (ATTCS) and Appendix I],
specifically restrict performance credit for ATTCS to takeoff.
Expanding the scope of the standards to include other phases of flight,
such as go-around, was considered when the standards were issued but
was not accepted because of the effect on the flightcrew's workload. As
stated in the preamble to Amendment 25-62:
In regard to ATTCS credit for approach climb and go-around
maneuvers, current regulations preclude a higher thrust for the
approach climb [Sec. 25.121(d)] than for the landing climb [Sec.
25.119]. The workload required for the flightcrew to monitor and select
from multiple in-flight thrust settings in the event of an engine
failure during a critical point in the approach, landing, or go-around
operations is excessive. Therefore, the FAA does not agree that
[[Page 49158]]
the scope of the amendment should be changed to include the use of
ATTCS for anything except the takeoff phase. (Refer to 52 FR 43153,
November 9, 1987.)
The ATTCS incorporated on Embraer Model ERJ 190 series airplanes
allows the pilot to use the same power setting procedure during a go-
around, regardless of whether or not an engine fails. In either case,
the pilot obtains go-around power by moving the throttles into the
forward (takeoff/go-around) throttle detent. Since the ATTCS is
permanently armed for the go-around phase, it will function
automatically following an engine failure and advance the remaining
engine to the ATTCS thrust level. This design adequately addresses the
concerns about pilot workload which were discussed in the preamble to
Amendment 25-62.
The system design allows the pilot to enable or disable the ATTCS
function for takeoff. If the pilot enables ATTCS, a white ``ATTCS''
icon will be displayed on the Engine Indication and Crew Alerting
System (EICAS) beneath the thrust mode indication on the display. This
white icon indicates to the pilot that the ATTCS function is enabled.
When the throttle lever is put in the TO/GA (takeoff/go-around) detent
position, the white icon turns green, indicating to the pilot that the
ATTCS is armed. If the pilot disables the ATTCS function for takeoff,
no indication appears on the EICAS.
Regardless of whether the ATTCS is enabled for takeoff, it is
automatically enabled when the airplane reaches the end of the take-off
phase (that is, the thrust lever is below the TO/GA position and the
altitude is greater than 1,700 feet above the ground, 5 minutes have
elapsed since lift-off, or the airplane speed is greater than 140
knots).
During climb, cruise, and descent, when the throttle is not in the
TO/GA position, the ATTCS indication is inhibited. During descent and
approach to land, until the thrust management system go-around mode is
enabled--either by crew action or automatically when the landing gear
are down and locked and flaps are extended--the ATTCS indication
remains inhibited.
When the go-around thrust mode is enabled, unless the ATTCS system
has failed, the white ``ATTCS'' icon will again be shown on the EICAS,
indicating to the pilot that the system is enabled and in an operative
condition in the event a go-around is necessary. If the thrust lever is
subsequently placed in the TO/GA position, the ATTCS icon turns green,
indicating that the system is armed and ready to operate.
If an engine fails during the go-around or during a one-engine-
inoperative go-around in which an engine had been shut down or
otherwise made inoperative earlier in the flight, the EICAS indication
will be GA RSV (go-around reserve) when the thrust levers are placed in
the TO/GA position. The GA RSV indication means that the maximum go-
around thrust under the ambient conditions has been commanded.
The propulsive thrust used to determine compliance with the
approach climb requirements of Sec. 25.121(d) is limited to the lesser
of (i) the thrust provided by the ATTCS system, or (ii) 111 percent of
the thrust resulting from the initial thrust setting with the ATTCS
system failing to perform its uptrim function and without action by the
crew to reset thrust. This requirement limits the adverse performance
effects of a failure of the ATTCS and ensures adequate all-engines-
operating go-around performance.
These special conditions require a showing of compliance with the
provisions of Sec. 25.904 and Appendix I applicable to the approach
climb and go-around maneuvers.
The definition of a critical time interval for the approach climb
case is of primary importance. During this time, it must be extremely
improbable to violate a flight path derived from the gradient
requirement of Sec. 25.121(d). That gradient requirement implies a
minimum one-engine-inoperative flight path with the airplane in the
approach configuration. The engine may have been inoperative before
initiating the go-around, or it may become inoperative during the go-
around. The definition of the critical time interval must consider both
possibilities.
Protection From Effects of HIRF
As noted earlier, Embraer Model ERJ 190 series airplanes will
include an Electronic Flight Control System as well as advanced
avionics for the display and control of critical airplane functions.
These systems may be vulnerable to high-intensity radiated fields
(HIRF) external to the airplane. The current airworthiness standards of
part 25 do not contain adequate or appropriate safety standards that
address the protection of this equipment from the adverse effects of
HIRF. Accordingly, these systems are considered to be novel or unusual
design features.
There is no specific regulation that addresses protection
requirements for electrical and electronic systems from HIRF. Increased
power levels from ground-based radio transmitters and the growing use
of sensitive avionics/electronics and electrical systems to command and
control airplanes have made it necessary to provide adequate
protection.
To ensure that a level of safety is achieved that is equivalent to
that intended by the applicable regulations, special conditions are
needed for the Embraer Model ERJ 190 series airplanes. These special
conditions require that avionics/electronics and electrical systems
that perform critical functions be designed and installed to preclude
component damage and interruption of function due to both the direct
and indirect effects of HIRF.
With the trend toward increased power levels from ground-based
transmitters and the advent of space and satellite communications
coupled with electronic command and control of the airplane, the
immunity of critical avionics/electronics and electrical systems to
HIRF must be established.
It is not possible to precisely define the HIRF to which the
airplane will be exposed in service. There is also uncertainty
concerning the effectiveness of airframe shielding for HIRF.
Furthermore, coupling of electromagnetic energy to cockpit-installed
equipment through the cockpit window apertures is undefined. Based on
surveys and analysis of existing HIRF emitters, an adequate level of
protection exists when compliance with the HIRF protection special
condition is shown in accordance with either paragraph 1 or 2 below:
1. A minimum threat of 100 volts rms (root-mean-square) per meter
electric field strength from 10 KHz to 18 GHz.
a. The threat must be applied to the system elements and their
associated wiring harnesses without the benefit of airframe shielding.
b. Demonstration of this level of protection is established through
system tests and analysis.
2. A threat external to the airframe of the field strengths
indicated in the table below for the frequency ranges indicated. Both
peak and average field strength components from the table are to be
demonstrated.
------------------------------------------------------------------------
Field strength
(volts per meter)
Frequency ---------------------
Peak Average
------------------------------------------------------------------------
10 kHz-100 kHz.................................... 50 50
100 kHz-500 kHz................................... 50 50
500 kHz-2 MHz..................................... 50 50
2 MHz-30 MHz...................................... 100 100
30 MHz-70 MHz..................................... 50 50
70 MHz-100 MHz.................................... 50 50
100 MHz-200 MHz................................... 100 100
200 MHz-400 MHz................................... 100 100
[[Page 49159]]
400 MHz-700 MHz................................... 700 50
700 MHz-1 GHz..................................... 700 100
1 GHz-2 GHz....................................... 2000 200
2 GHz-4 GHz....................................... 3000 200
4 GHz-6 GHz....................................... 3000 200
6 GHz-8 GHz....................................... 1000 200
8 GHz-12 GHz...................................... 3000 300
12 GHz-18 GHz..................................... 2000 200
18 GHz-40 GHz..................................... 600 200
------------------------------------------------------------------------
The field strengths are expressed in terms of peak of the root-
mean-square (rms) over the complete modulation period.
The threat levels identified above are the result of an FAA review
of existing studies on the subject of HIRF, in light of the ongoing
work of the Electromagnetic Effects Harmonization Working Group of the
Aviation Rulemaking Advisory Committee.
Discussion of Comments
Notice of Proposed Special Conditions No. 25-05-05-SC for the
Embraer Model ERJ 190 series airplane was published in the Federal
Register dated May 25, 2005 (70 FR 30020). Two comments indicating
minor errors in the proposed special conditions were received from
Embraer.
One comment points out an error in the table on page 30023 of the
Notice of Proposed Special Conditions. The average level for 1 GHz-2
GHz is shown as 2000 rather than as 200 volts per meter. The FAA has
determined that the correct value should be 200 volts per meter and,
accordingly, has corrected the table in these final special conditions.
The second comment indicates an error on page 30025. The first
sentence of Paragraph 2.c.(1)(i) says ``For static strength
substantiation, these loads multiplied by an appropriate factor of
safety that is related to the probability of occurrence of the failure
of the ultimate loads to be considered for design.''
That sentence should say ``For static strength substantiation,
these loads multiplied by an appropriate factor of safety that is
related to the probability of occurrence of the failure are ultimate
loads to be considered for design.'' The FAA has determined that the
proposed wording was incorrect and has corrected it in these final
special conditions. (We also corrected a typographical error in the
following sentence by removing the letter ``I.'')
Applicability
As discussed above, these special conditions are applicable to the
Embraer ERJ 190 series airplane. Should Embraer apply at a later date
for a change to the type certificate to include another model
incorporating the same novel or unusual design features, these special
conditions would apply to that model as well under the provisions of
Sec. 21.101.
Conclusion
This action affects only certain novel or unusual design features
of the Embraer ERJ 190 series airplane. This is not a rule of general
applicability.
List of Subjects in 14 CFR Part 25
Aircraft, Aviation safety, Reporting and recordkeeping
requirements.
The authority citation for these special conditions is as follows:
Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.
The Special Conditions
Accordingly, pursuant to the authority delegated to me by the
Administrator, the Federal Aviation Administration (FAA) issues the
following special conditions as part of the type certification basis
for the Embraer ERJ 190 series airplane.
Sudden Engine Stoppage
In lieu of compliance with Sec. 25.361(b) the following special
condition applies:
1. For turbine engine installations, the engine mounts, pylons and
adjacent supporting airframe structure must be designed to withstand 1g
level flight loads acting simultaneously with the maximum limit torque
loads imposed by each of the following:
a. Sudden engine deceleration due to a malfunction which could
result in a temporary loss of power or thrust; and
b. The maximum acceleration of the engine.
2. For auxiliary power unit installations, the power unit mounts
and adjacent supporting airframe structure must be designed to
withstand 1g level flight loads acting simultaneously with the maximum
limit torque loads imposed by each of the following:
a. Sudden auxiliary power unit deceleration due to malfunction or
structural failure; and
b. The maximum acceleration of the power unit.
3. For engine supporting structures, an ultimate loading condition
must be considered that combines 1g flight loads with the transient
dynamic loads resulting from:
a. The loss of any fan, compressor, or turbine blade; and
b. Separately, where applicable to a specific engine design, any
other engine structural failure that results in higher loads.
4. The ultimate loads developed from the conditions specified in
paragraphs 3.a. and 3.b. above are to be multiplied by a factor of 1.0
when applied to engine mounts and pylons and multiplied by a factor of
1.25 when applied to adjacent supporting airframe structure.
Interaction of Systems and Structures
In addition to the requirements of part 25, subparts C and D, the
following special condition applies:
1. General. For airplanes equipped with systems that affect
structural performance, either directly or as a result of a failure or
malfunction, the influence of these systems and their failure
conditions must be taken into account when showing compliance with the
requirements of 14 CFR part 25, subparts C and D. The following
criteria must be used to evaluate the structural performance of
airplanes equipped with flight control systems, autopilots, stability
augmentation systems, load alleviation systems, ``flutter'' control
systems, and fuel management systems. If these criteria are used for
other systems, it may be necessary to adapt the criteria to the
specific system.
a. The criteria defined herein address only the direct structural
consequences of the system responses and performances and cannot be
considered in isolation but should be included in the overall safety
evaluation of the airplane. These criteria may in some instances
duplicate standards already established for this evaluation. These
criteria are applicable only to structures whose failure could prevent
continued safe flight and landing. Specific criteria that define
acceptable limits on handling characteristics or stability requirements
when operating in the system degraded or inoperative mode are not
provided in this special condition.
b. Depending upon the specific characteristics of the airplane,
additional studies that go beyond the criteria provided in this special
condition may be required in order to demonstrate the capability of the
airplane to meet other realistic conditions, such as alternative gust
or maneuver descriptions for an airplane equipped with a load
alleviation system.
c. The following definitions are applicable to this special
condition:
Structural performance: Capability of the airplane to meet the
structural requirements of 14 CFR part 25.
Flight limitations: Limitations that can be applied to the airplane
flight conditions following an in-flight
[[Page 49160]]
occurrence and that are included in the flight manual (e.g., speed
limitations, avoidance of severe weather conditions, etc.).
Operational limitations: Limitations, including flight limitations,
that can be applied to the airplane operating conditions before
dispatch (e.g., fuel and payload limitations).
Probabilistic terms: The probabilistic terms (probable, improbable,
extremely improbable) used in this special condition are the same as
those used in 14 CFR 25.1309.
Failure condition: The term failure condition is the same as that
used in 14 CFR 25.1309; however, this special condition applies only to
system failure conditions that affect the structural performance of the
airplane (e.g., failure conditions that induce loads, lower flutter
margins, or change the response of the airplane to inputs, such as
gusts or pilot actions).
2. Effects of Systems on Structures.
a. General. The following criteria will be used in determining the
influence of a system and its failure conditions on the airplane
structure.
b. System fully operative. With the system fully operative, the
following apply:
(1) Limit loads must be derived in all normal operating
configurations of the system from all the limit conditions specified in
14 CFR part 25, Subpart C, taking into account any special behavior of
such a system or associated functions or any effect on the structural
performance of the airplane that may occur up to the limit loads. In
particular, any significant nonlinearity (rate of displacement of
control surface, thresholds, or any other system nonlinearities) must
be accounted for in a realistic or conservative way when deriving limit
loads from limit conditions.
(2) The airplane must meet the strength requirements of 14 CFR part
25 (static strength, residual strength) using the specified factors to
derive ultimate loads from the limit loads defined above. The effect of
nonlinearities must be investigated beyond limit conditions to ensure
the behavior of the system presents no anomaly compared to the behavior
below limit conditions. However, conditions beyond limit conditions
need not be considered when it can be shown that the airplane has
design features that will not allow it to exceed those limit
conditions.
(3) The airplane must meet the aeroelastic stability requirements
of 14 CFR 25.629.
c. System in the failure condition. For any system failure
condition not shown to be extremely improbable, the following apply:
(1) At the time of occurrence. Starting from l-g level flight
conditions, a realistic scenario, including pilot corrective actions,
must be established to determine the loads occurring at the time of
failure and immediately after failure.
(i) For static strength substantiation, these loads multiplied by
an appropriate factor of safety that is related to the probability of
occurrence of the failure are ultimate loads to be considered for
design. The factor of safety (FS) is defined in figure 1.
[GRAPHIC] [TIFF OMITTED] TR23AU05.023
(ii) For residual strength substantiation, the airplane must be
able to withstand two-thirds of the ultimate loads defined in
subparagraph (c)(1)(i).
(iii) Freedom from aeroelastic instability must be shown up to the
speeds defined in 14 CFR 25.629(b)(2). For failure conditions that
result in speed increases beyond Vc/Mc, freedom
from aeroelastic instability must be shown to increased speeds, so that
the margins intended by 14 CFR 25.629(b)(2) are maintained.
(iv) Failures of the system that result in forced structural
vibrations (oscillatory failures) must not produce loads that could
result in detrimental deformation of primary structure.
(2) For the continuation of the flight. For the airplane, in the
system-failed state and considering any appropriate reconfiguration and
flight limitations, the following apply:
(i) The loads derived from the following conditions at speeds up to
Vc or the speed limitation prescribed for the remainder of
the flight must be determined:
(A) The limit symmetrical maneuvering conditions specified in 14
CFR 25.331 and 25.345.
(B) The limit gust and turbulent conditions specified in 14 CFR
25.341 and 25.345.
(C) The limit rolling conditions specified in 14 CFR 25.349 and the
limit unsymmetrical conditions specified in 14 CFR 25.367 and 25.427(b)
and (c).
(D) The limit yaw maneuvering conditions specified in 14 CFR
25.351.
(E) The limit ground loading conditions specified in 14 CFR 25.473
and 25.491.
(ii) For static strength substantiation, each part of the structure
must be able to withstand the loads specified in paragraph (2)(i) above
multiplied by a factor of safety depending on the probability of being
in this failure state. The factor of safety is defined in figure 2.
[[Page 49161]]
[GRAPHIC] [TIFF OMITTED] TR23AU05.024
Qj = (Tj)(Pj) where:
Tj = Average time spent in failure condition j (in hours)
Pj = Probability of occurrence of failure mode j (per hour)
Note: If Pj is greater than 10-3 per flight hour,
then a 1.5 factor of safety must be applied to all limit load
conditions specified in 14 CFR 25, Subpart C.
(iii) For residual strength substantiation, the airplane must be
able to withstand two-thirds of the ultimate loads defined in paragraph
(c)(2)(ii) above.
(iv) If the loads induced by the failure condition have a
significant effect on fatigue or damage tolerance then their effects
must be taken into account.
(v) Freedom from aeroelastic instability must be shown up to a
speed determined from figure 3. Flutter clearance speeds V' and V'' may
be based on the speed limitation specified for the remainder of the
flight using the margins defined by 14 CFR 25.629(b).
[GRAPHIC] [TIFF OMITTED] TR23AU05.025
V' = Clearance speed as defined by 14 CFR 25.629(b)(2)
V'' = Clearance speed as defined by 14 CFR 25.629(b)(1)
Qj = (Tj)(Pj) where:
Tj = Average time spent in failure condition j (in hours)
Pj = Probability of occurrence of failure mode j (per hour)
Note: If Pj is greater than 10-3 per flight hour,
then the flutter clearance speed must not be less than V''.
(vi) Freedom from aeroelastic instability must also be shown up to
V' in figure 3 above for any probable system failure condition combined
with any damage required or selected for investigation by 14 CFR
25.571(b).
(3) Consideration of certain failure conditions may be required by
other sections of 14 CFR 25, regardless of calculated system
reliability. Where analysis shows the probability of these failure
conditions to be less than 10-\9\, criteria other than those
specified in this paragraph may be used for structural substantiation
to show continued safe flight and landing.
d. Warning considerations. For system failure detection and
warning, the following apply:
(1) The system must be checked for failure conditions, not
extremely improbable, that degrade the structural capability below the
level required by 14 CFR part 25 or significantly reduce the
reliability of the remaining system. The flight crew must be made aware
of these failures before flight. Certain elements of the control
system, such as mechanical and hydraulic components, may use special
periodic inspections, and electronic components may use daily checks in
lieu of warning systems to achieve the objective of this requirement.
These certification maintenance requirements must be limited to
component failures that are not readily detectable by normal warning
systems and where service history shows that inspections will provide
an adequate level of safety.
(2) The existence of any failure condition not extremely improbable
during flight--that could significantly affect the structural
capability of the airplane and for which the associated reduction in
airworthiness can be minimized by suitable flight limitations--must be
signaled to the
[[Page 49162]]
flight crew. For example, failure conditions that result in a factor of
safety between the airplane strength and the loads of 14 CFR part 25,
subpart C below 1.25 or flutter margins below V'' must be signaled to
the crew during flight.
e. Dispatch with known failure conditions. If the airplane is to be
dispatched in a known system failure condition that affects structural
performance or affects the reliability of the remaining system to
maintain structural performance, then the provisions of this special
condition must be met for the dispatched condition and for subsequent
failures. Flight limitations and expected operational limitations may
be taken into account in establishing Qj as the combined probability of
being in the dispatched failure condition and the subsequent failure
condition for the safety margins in figures 2 and 3. These limitations
must be such that the probability of being in this combined failure
state and then subsequently encountering limit load conditions is
extremely improbable. No reduction in these safety margins is allowed
if the subsequent system failure rate is greater than 10-3
per flight hour.
Operation Without Normal Electrical Power
In lieu of compliance with 14 CFR 25.1351(d), the following special
condition applies:
It must be demonstrated by test or by a combination of test and
analysis that the airplane can continue safe flight and landing with
inoperative normal engine and APU generator electrical power (in other
words without electrical power from any source, except the battery and
any other standby electrical sources). The airplane operation should be
considered at the critical phase of flight and include the ability to
restart the engines and maintain flight for the maximum diversion time
capability being certified.
Electronic Flight Control System
In addition to compliance with Sec. Sec. 25.143, 25.671 and
25.672, when a flight condition exists where, without being commanded
by the crew, control surfaces are coming so close to their limits that
return to the normal flight envelope and (or) continuation of safe
flight requires a specific crew action, a suitable flight control
position annunciation shall be provided to the crew, unless other
existing indications are found adequate or sufficient to prompt that
action.
Note: The term suitable also indicates an appropriate balance
between nuisance and necessary operation.
Automatic Takeoff Thrust Control System (ATTCS)
To use the thrust provided by the ATTCS to determine the approach
climb performance limitations, the Embraer Model ERJ 190 series
airplane must comply with the requirements of Sec. 25.904 and Appendix
I, including the following requirements pertaining to the go-around
phase of flight:
1. Definitions
a. TOGA--(Take Off/Go-Around). Throttle lever in takeoff or go-
around position.
b. Automatic Takeoff Thrust Control System--(ATTCS). The Embraer
Model ERJ-190 series ATTCS is defined as the entire automatic system
available in takeoff when selected by the pilot and always in go-around
mode, including all devices, both mechanical and electrical, that sense
engine failure, transmit signals, and actuate fuel controls or power
levers or increase engine power by other means on operating engines to
achieve scheduled thrust or power increases and to furnish cockpit
information on system operation.
c. Critical Time Interval. The definition of the Critical Time
Interval in Appendix I, Sec. I25.2(b) is expanded to include the
following:
(1) When conducting an approach for landing using ATTCS, the
critical time interval is defined as 120 seconds. A shorter time
interval may be used if justified by a rational analysis. An accepted
analysis that has been used on past aircraft certification programs is
as follows:
(i) The critical time interval begins at a point on a 2.5 degree
approach glide path from which, assuming a simultaneous engine and
ATTCS failure, the resulting approach climb flight path intersects a
flight path originating at a later point on the same approach path
corresponding to the part 25 one-engine-inoperative approach climb
gradient. The period of time from the point of simultaneous engine and
ATTCS failure to the intersection of these flight paths must be no
shorter than the time interval used in evaluating the critical time
interval for takeoff, beginning from the point of simultaneous engine
and ATTCS failure and ending upon reaching a height of 400 feet.
(ii) The critical time interval ends at the point on a minimum
performance, all-engines-operating go-around flight path from which,
assuming a simultaneous engine and ATTCS failure, the resulting minimum
approach climb flight path intersects a flight path corresponding to
the part 25 minimum one-engine-inoperative approach-climb-gradient. The
all-engines-operating go-around flight path and the part 25 one-engine-
inoperative, approach-climb-gradient flight path originate from a
common point on a 2.5 degree approach path. The period of time from the
point of simultaneous engine and ATTCS failure to the intersection of
these flight paths must be no shorter than the time interval used in
evaluating the critical time interval for the takeoff, beginning from
the point of simultaneous engine and ATTCS failure and ending upon
reaching a height of 400 feet.
(2) The critical time interval must be determined at the altitude
resulting in the longest critical time interval for which one-engine-
inoperative approach climb performance data are presented in the
Airplane Flight Manual (AFM).
(3) The critical time interval is illustrated in the following
figure:
[[Page 49163]]
[GRAPHIC] [TIFF OMITTED] TR23AU05.026
The engine and ATTCS failed time interval must be no shorter than
the time interval from the point of simultaneous engine and ATTCS
failure to a height of 400 feet used to comply with I25.2(b) for ATTCS
use during takeoff.
2. Performance and System Reliability Requirements
The applicant must comply with the following performance and ATTCS
reliability requirements:
a. An ATTCS failure or combination of failures in the ATTCS during
the critical time interval:
(1) Shall not prevent the insertion of the maximum approved go-
around thrust or power or must be shown to be an improbable event.
(2) Shall not result in a significant loss or reduction in thrust
or power or must be shown to be an extremely improbable event.
b. The concurrent existence of an ATTCS failure and an engine
failure during the critical time interval must be shown to be extremely
improbable.
c. All applicable performance requirements of part 25 must be met
with an engine failure occurring at the most critical point during go-
around with the ATTCS system functioning.
d. The probability analysis must include consideration of ATTCS
failure occurring after the time at which the flightcrew last verifies
that the ATTCS is in a condition to operate until the beginning of the
critical time interval.
e. The propulsive thrust obtained from the operating engine after
failure of the critical engine during a go-around used to show
compliance with the one-engine-inoperative climb requirements of Sec.
25.121(d) may not be greater than the lesser of:
(i) The actual propulsive thrust resulting from the initial setting
of power or thrust controls with the ATTCS functioning; or
(ii) 111 percent of the propulsive thrust resulting from the
initial setting of power or thrust controls with the ATTCS failing to
reset thrust or power and without any action by the crew to reset
thrust or power.
3. Thrust Setting
a. The initial go-around thrust setting on each engine at the
beginning of the go-around phase may not be less than any of the
following:
(1) That required to permit normal operation of all safety-related
systems and equipment dependent upon engine thrust or power lever
position; or
(2) That shown to be free of hazardous engine response
characteristics when thrust or power is advanced from the initial go-
around position to the maximum approved power setting.
b. For approval of an ATTCS for go-around, the thrust setting
procedure must be the same for go-arounds initiated with all engines
operating as for go-arounds initiated with one engine inoperative.
4. Powerplant Controls
a. In addition to the requirements of Sec. 25.1141, no single
failure or malfunction or probable combination thereof of the ATTCS,
including associated systems, may cause the failure of any powerplant
function necessary for safety.
b. The ATTCS must be designed to accomplish the following:
(1) Apply thrust or power on the operating engine(s), following any
single engine failure during go around, to achieve the maximum approved
go-around thrust without exceeding the engine operating limits;
(2) Permit manual decrease or increase in thrust or power up to the
maximum go-around thrust approved for the airplane under existing
conditions through the use of the power lever. For airplanes equipped
with limiters that automatically prevent the engine operating limits
from being exceeded under existing ambient conditions, other means may
be used to increase the thrust in the event of an ATTCS failure,
provided that the means meet the following criteria:
Are located on or forward of the power levers;
Are easily identified and operated under all operating
conditions by a single action of either pilot with the hand that is
normally used to actuate the power levers, and
Meet the requirements of Sec. 25.777 (a), (b), and (c);
(3) Provide a means for the flightcrew to verify before beginning
an approach for landing that the ATTCS is in a condition to operate
(unless it can be demonstrated that an ATTCS failure combined with an
engine failure during an entire flight is extremely improbable); and
(4) Provide a means for the flightcrew to deactivate the automatic
function. This means must be designed to prevent inadvertent
deactivation.
5. Powerplant Instruments
In addition to the requirements of Sec. 25.1305, the following
requirements must be met:
a. A means must be provided to indicate when the ATTCS is in the
armed or ready condition; and
b. If the inherent flight characteristics of the airplane do not
provide adequate
[[Page 49164]]
warning that an engine has failed, a warning system that is independent
of the ATTCS must be provided to give the pilot a clear warning of any
engine failure during go-around.
Protection From Effects of HIRF
Each electrical and electronic system that performs critical
functions must be designed and installed to ensure that the operation
and operational capability of these systems to perform critical
functions are not adversely affected when the airplane is exposed to
high-intensity radiated fields external to the airplane.
For the purpose of this special condition, the following definition
applies:
Critical Functions: Functions whose failure would contribute to or
cause a failure condition that would prevent the continued safe flight
and landing of the airplane.
Issued in Renton, Washington, on August 12, 2005.
Ali Bahrami,
Manager, Transport Airplane Directorate, Aircraft Certification
Service.
[FR Doc. 05-16728 Filed 8-22-05; 8:45 am]
BILLING CODE 4910-13-P