03-25949. Special Conditions: Embraer Model ERJ-170 Series Airplanes; Electronic Flight Controls (Command Signal Integrity)

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Final special conditions.

SUMMARY:

These special conditions are issued for the Embraer Model ERJ-170 series airplanes. These airplanes will have novel or unusual design features when compared to the state of technology envisioned in the airworthiness standards for transport category airplanes. These design features are associated with electronic flight control systems. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for these design features. These special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards. Additional special conditions will be issued for this and other novel or unusual design features of Embraer Model 170 series airplanes.

EFFECTIVE DATES:

October 6, 2003.

FOR FURTHER INFORMATION CONTACT:

Tom Groves, FAA, International Branch, ANM-116, Transport Airplane Directorate, Aircraft Certification Service, 1601 Lind Avenue, SW., Renton, Washington 98055-4056; telephone [phone]; facsimile [phone]; e-mail [e-mail].

SUPPLEMENTARY INFORMATION:

Background

On May 20, 1999, Embraer applied for a type certificate for its new Model ERJ-170 airplane. Two basic versions of the Model ERJ-170 are included in the application. The ERJ-170-100 airplane is a 69-78 passenger, twin-engine regional jet with a maximum takeoff weight of 81,240 pounds. The ERJ-170-200 is a derivative with a lengthened fuselage. Passenger capacity for the ERJ-170-200 is increased to 86, and maximum takeoff weight is increased to 85,960 pounds.

Type Certification Basis

Under the provisions of 14 CFR 21.17, Embraer must show that the Model ERJ-170 series airplanes meet the applicable provisions of 14 CFR part 25, as amended by Amendments 25-1 through 25-98.

If the Administrator finds that the applicable airworthiness regulations (i.e., part 25, as amended) do not contain adequate or appropriate safety standards for Embraer Model ERJ-170 series airplanes because of novel or unusual design features, special conditions are prescribed under the provisions of § 21.16.

In addition to the applicable airworthiness regulations and special conditions, Embraer Model ERJ-170 series airplanes must comply with the fuel vent and exhaust emission requirements of 14 CFR part 34 and the noise certification requirements of 14 CFR part 36, and the FAA must issue a finding of regulatory adequacy pursuant to section 611 of Public Law 93-574, the “Noise Control Act of 1972.”

Special conditions, as defined in 14 CFR 11.19, are issued in accordance with § 11.38 and become part of the type certification basis in accordance with § 21.17(a)(2), Amendment 21-69, effective September 16, 1991.

Special conditions are initially applicable to the model for which they are issued. Should the type certificate for that model be amended later to include any other model that incorporates the same novel or unusual design feature or should any other model already included on the same type certificate be modified to incorporate the same novel or unusual design features, the special conditions would also apply to the other model under the provisions of § 21.101.

Novel or Unusual Design Features

The ERJ-170 airplane will use fly-by-wire (FBW) technology as a means of sending command and control signals to the control surface actuators of the rudder, rudder trim, elevator, spoilers, horizontal stabilizer, and auto speedbrake. The ailerons will be controlled by a traditional cable linkage to the hydraulic actuators.

The ERJ-170 FBW flight control systems provide two modes of operation, direct and normal. Direct mode provides an analog link between pilot commands and control surfaces. In direct mode, flight control transducers send signals to Actuator Control Electronics units (ACE). The ACE sends analog command and control signals to the Power Control Units (PCU), which move the control surface actuators of the rudder, rudder trim, elevator, spoilers, horizontal stabilizer, and auto speedbrake.

In normal mode, the rudder, elevator and spoiler command-to-surface gain schedules are tailored to particular flight conditions to provide improved control characteristics. These gains are calculated digitally in the Flight Control Module (FCM) and supplement the direct mode commands provided by the ACEs.

In the ERJ-170 FBW design being presented, command and control of the airplane's aerodynamic control surfaces will be achieved by electronic interfaces. These interfaces involve not only direct commands to the PCU but all the necessary feedback sensor signals. A successful demonstration of signal integrity must include all the elements which contribute to the command and control signals to the control surface closed loop system (CSCL). The CSCL may include the following:

(1) The computing components and wiring;

(2) The input components, such as column position sensors;

(3) Feedback components, such as control surface position, inertial reference, and air data sensors; and

(4) Actuation components and their structural mounting components.

A system evaluation that includes all the inputs to and elements of the CSCL in an integrated environment (including signals that could disturb the system) is necessary to ensure appropriate system robustness throughout the flight envelope.

For the purpose of this proposed special condition, the control surface closed loop system does not include pilot input to the flight control system. Pilot in the loop control inputs and the associated handling requirements are adequately covered by existing regulations, including regulations in subpart B as well as §§ 25.671 and 25.672.

The signal paths within the control surface closed loop system can be susceptible to interference from electromagnetic and electrostatic sources within the integrated systems environment of the aircraft as well as external causes, such as HIRF and lightning (not considered in this special condition), which could modify the command and control signals.

The effects of interference sources within the system may include, but are not restricted to, the following:

• Loss of data bits,
• Unwanted transients in the power supply source,
• Disruption of normal computer operations,
• Misbehavior of signals by parallel computers (e.g., redundancy management),
• Adverse effects caused by transport lag, and
• Any other cause that may alter the command and control signals.

For those reasons, special design measures and laboratory tests intended to validate these designs will be required to demonstrate the integrity of the FBW Flight Controls System to a level of safety equivalent to that which is achieved with traditional hydromechanical designs.

The regulations which primarily address hydromechanical flight control systems, (i.e., 14 CFR 25.671 and 25.672) do not specifically require that command and control signals remain unaltered from internal or external interference. Traditional designs feature steel cables and pushrods as means to move surface actuators which are hydraulically powered. These designs are not likely to be affected by spurious electromagnetic and computer induced signals, as are the FBW designs.

Similar special conditions have been issued previously for other airplanes that utilize FBW flight control systems, such as the Airbus A320 series, Airbus A330/340 series, and most recently, the Boeing 777 series.

The special conditions applied to the Boeing 777 series include a requirement for changes in mode of flight critical control systems. This requirement was intended to ensure a minimum level of availability for normal mode flight control. For the Boeing 777 series, the FAA did not consider § 25.1309(b) adequate for that purpose.

In the ERJ-170 FBW flight control system, normal mode consists of a simple analog control signal augmented by limited authority digitally computed signals. Direct mode consists of only the analog signal. The FAA believes that the existing 14 CFR 25.1309(b) provides a suitable requirement for assessing the effect and frequency of FBW flight control system mode changes or lost functionality for the ERJ-170 series, and thus the specific requirement included with the Boeing 777 series special conditions was not included in these proposed special conditions.

In addition to the specific difference noted above, a number of smaller changes were made to the Boeing 777 series special condition to create these proposed special conditions. These additional changes were made to improve readability and to define with greater precision the intended scope of some of the paragraphs through use of consistent and defined terminology.

Discussion of Comments

Notice of proposed special conditions No. 25-03-05-SC for the Embraer Model ERJ-170 series airplane was published in the Federal Register on June 16, 2003 (68 FR 35612). No comments were received, and these special conditions are adopted as proposed.

Applicability

As discussed above, these special conditions are applicable to the Embraer Model ERJ-170 series airplanes. Should Embraer apply later for a change to the type certificate to include another model incorporating the same novel or unusual design features, these special conditions would apply to that model as well under the provisions of § 21.101.

Under standard practice, the effective date of final special conditions would be 30 days after the date of publication in the Federal Register; however, as the certification date for the Embraer Model ERJ-170 series airplane is imminent, the FAA finds that good cause exists to make these special conditions effective upon issuance.

Conclusion

This action affects only certain novel or unusual design features on the Embraer Model ERJ-170 series airplanes. It is not a rule of general applicability, and it affects only the applicant who applied to the FAA for approval of these features on the airplane.

List of Subjects in 14 CFR Part 25

• Aircraft
• Aviation safety
• Reporting and recordkeeping requirements

The authority citation for these special conditions is as follows:

Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.

The Special Conditions

Accordingly, the Federal Aviation Administration (FAA) issues the following special conditions as part of the type certification basis for Embraer Model ERJ-170 series airplanes.

Electronic Flight Controls (Command Signal Integrity)

In addition to compliance with §§ 25.671 and 25.672, the following requirements must be met:

(a) It must be shown that either the FBW flight control system signals cannot be altered unintentionally or that altered signal characteristics would meet the following criteria:

(1) Stable gain and phase margins are maintained for all control surface closed loop systems. Pilot control inputs (pilot in the loop) are excluded from this requirement.

(2) Sufficient pitch, roll, and yaw control power is available to provide control for continued safe flight and landing, considering all the FBW flight control system signal malfunctions that are not extremely improbable.

(3) The effect of spurious signals on the systems which are included in the control surface loop must not result in unacceptable transients or degradation of the airplane's performance. Specifically, signals that would cause a significant uncommanded motion of a control surface actuator must be readily detected and deactivated, or the surface motion must be arrested by other means in a satisfactory manner. Small amplitude residual system oscillations may be acceptable.

(b) It must be demonstrated that the output from the control surface closed loop system does not result in uncommanded, sustained oscillations of flight control surfaces. The effects of minor instabilities may be acceptable, provided that they are thoroughly investigated, documented, and understood.

Issued in Renton, Washington, on October 6, 2003.

Ali Bahrami,

Acting Manager, Transport Airplane Directorate, Aircraft Certification Service.