03-28676. Special Conditions: Hamilton Sundstrand, Model 54H60-77E Propeller

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Final special conditions; request for comments.

SUMMARY:

The FAA is issuing special conditions for the Hamilton Sundstrand model 54H60-77E constant speed propeller. This four-bladed propeller will have a dual acting digital electro-hydraulic propeller control system, which is a novel or unusual design feature. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for this design feature. These special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards.

DATES:

The effective date of these special conditions is December 1, 2003. The FAA must receive comments on or before January 30, 2004.

ADDRESSES:

Mail or deliver comments on these special conditions to: Federal Aviation Administration, Office of the Assistant Chief Counsel, Attention: Rules Docket NE125, 12 New England Executive Park, Burlington, Massachusetts, 01803-5299. You must identify the docket number NE125 at the beginning of your comments, and you should submit two copies of your comments. You may review the public docket containing comments to these special conditions in person at the Office of the Regional Counsel between 8 a.m. and 4:30 p.m., Monday through Friday, except Federal holidays.

FOR FURTHER INFORMATION CONTACT:

Jay Turnberg, FAA, Engine and Propeller Standards Staff, Engine and Propeller Directorate, Aircraft Certification Service, ANE-110, 12 New England Executive Park, Burlington, Massachusetts, 01803-5229; telephone [phone]; fax [phone]; e-mail: [e-mail].

SUPPLEMENTARY INFORMATION:

The FAA has determined that notice and opportunity for prior public comment hereon are impracticable because these procedures would significantly delay issuance of the approval design and thus delivery of the affected aircraft. In addition, the substance of these special conditions has previously been subject to the public comment process with no substantive comments received. The FAA therefore finds that good cause exists for making these special conditions effective on December 1, 2003.

Comments Invited

The FAA has determined that good cause exists for making these special conditions effective December 1, 2003; however; the FAA invites interested parties to submit comments on the special conditions. You must identify the docket number NE125 at the beginning of your comments, and you should submit two copies of your comments. The FAA will consider all comments received by the closing date. The FAA may change these special conditions in light of the comments received. All comments submitted will be available in the Rules Docket for examination by interested persons, both before and after the closing date for comments. The docket will contain a report summarizing each substantive public contact with FAA personnel concerning this proposal. Commenters wishing the FAA to acknowledge receipt of their comments submitted in response to this notice must include a self-addressed, stamped postcard on which the following statement is made: “Comments to Docket No. NE125.” The postcard will be dated-stamped and returned to the commenter.

Background

On February 24, 2003, Hamilton Sundstrand applied for an amendment to Type Certificate No. P906 to include the new 54H60-77E propeller. The model 54H60-77E, which is a derivative of the model 54H currently approved under Type Certificate P906, uses a dual acting digital electro-hydraulic propeller control system (EPCS).

Digital electronic control introduces potential failures associated with electrical power, software commands, data, and environmental effects that can result in hazardous propeller effects. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for these design features. These special conditions address the following airworthiness issues for the Hamilton Sundstrand 54H60-77E propeller:

1. Safety assessment.

2. Propeller control system.

These special conditions contain the additional safety standards necessary to establish a level of safety equivalent to that established by the existing airworthiness standards.

Type Certification Basis

Under the provisions of 14 CFR 21.101, Hamilton Sundstrand must show that the 54H60-77E meets the applicable provisions of the regulations incorporated by reference in Type Certificate No. P906 or the applicable regulations in effect on the date of application for the change to the model 54H. The regulations incorporated by reference in the type certificate are commonly referred to as the “original type certification basis.” The regulations incorporated by reference in P906 are Civil Air Regulation (CAR) part 14, as amended in December 15, 1959.

In addition, if the regulations incorporated by reference do not provide adequate standards with respect to the change, the applicant must comply with certain regulations in effect on the date of application for the change. Hamilton Sundstrand has elected to show compliance with part 35, as amended through Amendment 7, dated December 28, 1995, for the 54H60-77E.

If the Administrator finds that the applicable airworthiness regulations (i.e., 14 CFR part 35) do not contain adequate or appropriate safety standards for the 54H60-77E because of a novel or unusual design feature, special conditions are prescribed under the provisions of 14 CFR 21.16.

As appropriate, special conditions, as defined in § 11.19, are issued in accordance with § 11.38 and become part of the type certification basis in accordance with 14 CFR 21.101(b)(2).

Special conditions are initially applicable to the model for which they are issued. Should the type certificate for that model be amended later to include any other model that incorporates the same novel or unusual design feature, or should any other model already included on the same type certificate be modified to incorporate the same novel or unusual design feature, the special conditions would also apply to the other model under the provisions of 14 CFR 21.101(a)(1).

Novel or Unusual Design Features

The 54H60-77E will incorporate the following novel or unusual design features: dual acting digital electro-hydraulic propeller control system. Digital electronic control introduces potential failures associated with electrical power, software commands, data, and environmental effects that can result in hazardous propeller effects. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for these design features. These special conditions address the following airworthiness issues for the Hamilton Sundstrand 54H60-77E propeller:

1. Safety assessment.

2. Propeller control system.

These special conditions contain the additional safety standards necessary to establish a level of safety equivalent to that established by the existing airworthiness standards.

The existing type certified Hamilton Sundstrand 54H model propeller as described in FAA Type Certification Data Sheet P906, amendment 7, uses a mechanical governor in the propeller control system. This mechanical control system senses propeller speed and adjusts the pitch by directing hydraulic oil to the propeller actuator to increase or decrease pitch to maintain the propeller at the correct RPM and to absorb the engine power.

The Hamilton Sundstrand EPCS replaces the current mechanical control system with a digital electronic governor in the propeller control. The digital electronic governor is designed to operate a hydro-mechanical interface to direct hydraulic oil to the propeller actuator to increase or decrease pitch. The digital electronic control logic commands speed governing, synchrophasing, and failure monitoring and provides beta scheduling. Digital electronic control introduces potential failures associated with electrical power, software commands, data, and environmental effects that can result in hazardous propeller effects.

Safety Assessment

The special conditions require the applicant to conduct a safety assessment of the propeller in conjunction with the requirements for evaluating the digital electro-hydraulic control system. A safety assessment is necessary due to the increased complexity of these propeller designs and related control systems. The ultimate objective of the safety assessment requirement is to ensure that the collective risk from all propeller failure conditions is acceptably low. The basis is the concept that an acceptable total propeller design risk is achievable by managing the individual risks to acceptable levels. This concept emphasizes reducing the risk of an event proportionally with the severity of the hazard it represents.

The special conditions are written at the propeller level for a typical aircraft. The typical aircraft may be the aircraft intended for installation of the propeller. It is advised that the propeller applicant have an understanding of the intended aircraft, not to show compliance with this requirement, but to design a propeller that will be acceptable for the intended aircraft. For example, a part 25 aircraft may require different failure effects and probability of failure than a part 23 aircraft. Showing compliance with the requirement without consideration of the intended aircraft may result in a propeller that cannot be installed on the intended aircraft.

Propeller Control System

Currently, part 35 does not adequately address propellers with combined mechanical, hydraulic, digital, and electronic control systems. Propeller mechanical control systems certified under the existing requirements incorporate a mechanical governor that senses propeller speed and adjusts the pitch to absorb the engine power to maintain the propeller at the selected rotational speed. Propellers with digital electronic control components perform the same basic function but use software, electronic circuitry, and electro-hydraulic actuators. The electronic control systems may also incorporate additional functions such as failure monitoring, synchrophasing, and beta scheduling. This addition of electronics to the control system may introduce new failure modes that can result in hazardous propeller effects.

Applicability

As discussed above, these special conditions apply to the model 54H60-77E propeller. Should Hamilton Sundstrand apply at a later date for a change to the type certificate to include another model incorporating the same novel or unusual design feature, the special conditions would apply to that model as well under the provisions of 14 CFR § 21.101(a)(1).

Conclusion

This action affects only certain novel or unusual design features on one model of propellers. It is not a rule of general applicability, and it affects only the applicant who applied to the FAA for approval of these features on the propeller.

The substance of these special conditions has previously been subjected to the notice and comment period and has been derived without substantive change from those previously issued. The FAA has determined that prior public notice and comment are unnecessary and that good cause exists for adopting these special conditions immediately. Therefore, these special conditions are being made effective December 1, 2003. The FAA is, however, requesting comments to allow interested parties to submit views that may not have been submitted in response to the prior opportunity for comment described above.

List of Subjects in 14 CFR Part 35

• Air transportation
• Aircraft
• Aviation safety
• Safety

The authority citation for these special conditions is as follows:

Authority: 49 U.S.C. 106(g), 40113, 44701-44702, 44704.

The Special Conditions

Accordingly, pursuant to the authority delegated to me by the Administrator, the following special conditions are issued as part of the type certification basis for the Hamilton Sundstrand model 54H60-77E propeller.

In addition to the requirements of part 35, the following requirements apply to the propeller.

(a) Definitions. Unless otherwise approved by the Administrator and documented in the appropriate manuals and certification documents, for the purpose of these special conditions the following definitions apply to the propeller:

(1) Propeller. The propeller is defined by the components listed in the type design.

(2) Propeller system. The propeller system consists of the propeller plus all the components necessary for its functioning, but not necessarily included in the propeller type design.

(3) Hazardous propeller effects. The following are regarded as hazardous propeller effects:

(i) A significant overspeed of the propeller.

(ii) The development of excessive drag.

(iii) Thrust in the opposite direction to that commanded by the pilot.

(iv) A release of the propeller or any major portion of the propeller.

(v) A failure that results in excessive unbalance.

(vi) The unintended movement of the propeller blades below the established minimum in-flight low pitch position.

(4) Major propeller effects. The following are regarded as major propeller effects.

(i) An inability to feather.

(ii) An inability to command a change in propeller pitch.

(iii) A significant uncommanded change in pitch.

(iv) A significant uncontrollable torque or speed fluctuation.

(b) Safety analysis.

(1)(i) Perform an analysis of the propeller system to assess the likely consequence of all failures that can reasonably be expected to occur. This analysis must consider the following:

(A) The propeller system in a typical installation. When the analysis depends on representative components, assumed interfaces, or assumed installed conditions, the analysis must state the assumptions.

(B) Consequential secondary failures and latent failures.

(C) Multiple failures referred to in paragraph (b)(4) of these special conditions or that result in hazardous propeller effects.

(ii) Summarize those failures that could result in major propeller effects or hazardous propeller effects, together with an estimate of the probability of occurrence of those effects.

(iii) Show that hazardous propeller effects are not predicted to occur at a rate in excess of that defined as extremely remote (probability of 10⁻⁷ or less per propeller flight hour). As the estimated probability for individual failures may be insufficiently precise to enable the applicant to assess the total rate for hazardous propeller effects, compliance may be shown by demonstrating that the probability of a hazardous propeller effect arising from any individual failure can be predicted to be not greater than 10⁻⁸ per propeller flight hour. Probabilities of this low order of magnitude may be demonstrated through reliance on engineering judgment and previous experience combined with sound design and test philosophies.

(2) The Administrator may, if significant doubt exists, require testing to verify any assumption as to the effects of failures or likely combination of failures.

(3) If the primary failure of certain single elements (for example, blades) cannot be sensibly estimated in numerical terms, and if the failure of such elements is likely to result in hazardous propeller effects, then compliance may be shown by meeting the prescribed integrity requirements of part 35 and these special conditions. The safety analysis must state these instances.

(4) If reliance is placed on a system or device, such as safety devices, feathering and overspeed systems, instrumentation, early warning devices, maintenance checks, and similar equipment or procedures, to prevent a failure from progressing to hazardous propeller effects, the analysis must include the possibility of a safety system failure in combination with a basic propeller failure. If items of a safety system are outside the control of the propeller manufacturer, the safety analysis must state assumptions with respect to the reliability of these parts, and the installation and operation instructions required under § 35.3 must identify these assumptions.

(5) If the safety analysis depends on one or more of the following items, the analysis must state and appropriately substantiate those items.

(i) Performance of mandatory maintenance actions at stated intervals required for certification and other maintenance actions. This includes verifying the serviceability of items that could fail in a latent manner. These maintenance intervals must be published in the appropriate propeller manuals. Additionally, if errors in maintenance of the propeller system could lead to hazardous propeller effects, the appropriate procedures must be published in the appropriate propeller manuals.

(ii) Verification of the satisfactory functioning of safety or other devices at pre-flight or other stated periods. The details of this satisfactory functioning must be published in the appropriate propeller manuals.

(iii) The provisions of specific instrumentation not otherwise required.

(iv) A fatigue assessment.

(6) If applicable, the safety analysis must include the assessment of indicating equipment, manual and automatic controls, governors and propeller control systems, synchrophasers, synchronizers, and propeller thrust reversal systems.

(c) Propeller control system. The requirements of this section apply to any system or component that controls, limits, or monitors propeller functions.

(1) Design, construct, and validate the propeller control system to show that:

(i) The propeller control system, operating in normal and alternative operating modes and transition between operating modes, performs the intended functions throughout the declared operating conditions and flight envelope.

(ii) The propeller control system functionality is not adversely affected by the declared environmental conditions, including temperature, electromagnetic interference (EMI), high intensity radiated fields (HIRF) and lightning. Document the environmental limits to which the system has been satisfactorily validated in the appropriate propeller manuals.

(iii) A method is provided to indicate that an operating mode change has occurred if flight crew action is required. In such an event, provide operating instructions in the appropriate manuals.

(2) Design and construct the propeller control system so that, in addition to compliance with paragraph (b) of these special conditions, Safety analysis:

(i) A level of integrity consistent with the intended aircraft is achieved.

(ii) A single failure or malfunction of electrical or electronic components in the control system does not cause a hazardous propeller effect.

(iii) Failures or malfunctions directly affecting the propeller control system in a typical aircraft, such as structural failures of attachments to the control, fire, or overheat, do not lead to a hazardous propeller effect.

(iv) The loss of normal propeller pitch control does not cause a hazardous propeller effect under the intended operating conditions.

(v) The failure or corruption of data or signals shared across propellers does not cause a major or hazardous propeller effect.

(3) Design and implement electronic propeller control system imbedded software by a method approved by the Administrator that is consistent with the criticality of the performed functions and minimizes the existence of software errors.

(4) Design and construct the propeller control system so that the failure or corruption of aircraft-supplied does not result in hazardous propeller effects.

(5) Design and construct the propeller control system so that the loss, interruption, or abnormal characteristic of aircraft-supplied electrical power does not result in hazardous propeller effects. Describe the power quality requirements in the appropriate manuals.

(6) Specify the propeller control system description, characteristics, and authority, in both normal operation and failure conditions, and the range of control of other controlled functions, in the appropriate propeller manuals.

Issued in Burlington, Massachusetts, on November 10, 2003.

Francis A. Favara,

Acting Manager, Engine and Propeller Directorate, Aircraft Certification Service.