[Federal Register Volume 59, Number 57 (Thursday, March 24, 1994)]
[Unknown Section]
[Page 0]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 94-6960]
[[Page Unknown]]
[Federal Register: March 24, 1994]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
14 CFR Part 25
[Docket No. NM-91; Special Conditions No. 25-ANM-82]
Special Conditions: SAAB Model 2000 Airplane; Interaction of
Systems and Structures
AGENCY: Federal Aviation Administration, DOT.
action: Final special conditions.
-----------------------------------------------------------------------
SUMMARY: These special conditions are issued for the SAAB Model 2000
airplane. This airplane will utilize certain fully hydraulically
powered electronically controlled flight control systems which are
design features that are novel and unusual when compared to the state
of technology envisioned in the airworthiness standards of part 25 of
the Federal Aviation Regulations (FAR). These special conditions
provide the additional safety standards which the Administrator
considers necessary to establish a level of safety equivalent to that
provided by the airworthiness standards of part 25 of the FAR.
EFFECTIVE DATE: April 25, 1994.
FOR FURTHER INFORMATION CONTACT:
Mark I. Quam, FAA, Standardization Branch, ANM-113, Transport Airplane
Directorate, Aircraft Certification Service, 1601 Lind Avenue SW.,
Renton, Washington 98055-4056; telephone (206) 227-2145.
SUPPLEMENTARY INFORMATION:
Background
On April 28, 1989, SAAB Aircraft AB of Sweden applied for an FAA
Type Certification through the Swedish Luftfartsverket (LFV) to the
FAA, AEU-100, for the SAAB Model 2000 airplane. (The application for
FAA Type Certificate was dated June 9, 1989.)
The SAAB Model 2000 is a twin-engined, low-wing, pressurized
turboprop aircraft that is configured for approximately 50 passengers
and is intended for short to medium haul (100 nm to 1,000 nm). The
airplane will have two new Allison GMA-2100 engines rated at 3650 shp.
The propeller is a new 6 bladed Dowty Rotol swept shaped propeller. A
single lever controls each prop/engine combination. An Auxiliary Power
Unit (APU) will be installed in the tail. The fuselage cross-section
will be the same as the SAAB Model 340. The fuselage skin will be
thicker to handle greater pressures. The wing and empennage are new and
larger in all dimensions and the fuselage is longer when compared to
the SAAB Model SF-340B. The new cockpit will be a 5 or 6 screen CRT
display with new Collins systems. There will be provisions for a
Microwave Landing System (MLS), Global Positioning System (GPS),
Selective Calling (SELCAL), Engine Indicating and Crew Alerting System
(EICAS), and Traffic Collision and Avoidance System (TCAS). The landing
gear system will be new. The airplane will have provisions for two
pilots, an observer, two flight attendants, overhead bins, a toilet,
and provisions for the installation of a galley. There will be a
forward and aft stowage compartment and an aft cargo compartment. The
airplane will have a maximum operating altitude of 31,000 feet.
The SAAB Model 2000 will have a fully hydraulically powered
electronically controlled rudder for initial certification and will
have fully hydraulically powered electronically controlled elevators as
a follow-on design modification.
The rudder is hydraulically powered and electronically positioned
without manual reversion modes. Pilots position the rudder by pedal
position transducers connected to the rudder pedals. The transducers
supply rudder pedal position to two electronic rudder control units
which have two channels each. The rudder control units position two
rudder servos which control two actuators that drive the rudder.
Parallel and cross channel signals provide redundancy. The rudder
limiting function is built into the rudder control units. The rudder
system is checked by a preflight built in test system (PBIT) and a
continuous built in test system (CBIT). One pedal force cam unit
(spring and cam) generates artificial pedal forces. The pedal force cam
unit is controlled by the trim actuator which in turn is controlled by
a relay connected to manual trim or automatic trim from the autopilot.
The rudders two hydraulic actuators are supplied by two hydraulic
circuits and each circuit is driven by an engine driven pump. To
protect against common failures including engine burst, fire and tire/
wheel failures, two back-up pumps, two emergency shut-off valves,
together with a transfer valve, have been added aft of the debris
zones. The back-up pumps are driven by a common motor with shear out
features. Accumulators aft on both hydraulic circuits provide further
reserves against hydraulic power loss and loss of damping.
The rudder system is electrically supported by two redundant system
sides, a left hand (LH) and a right hand (RH) side. The electrical
system is normally powered by two AC generators, each driven by a
propeller gear box. An APU equipped with a standby generator is
optional. Each system side includes a DC system with a Transformer
Rectifier Unit (TRU). When only one TRU unit is working, the LH and RH
buses are tied together with power being received from the remaining
TRU. Two DC feeders in addition to two AC feeders provide power aft of
the debris zone. The DC feeders are supplied by battery or a TRU unit.
The LH is routed through the ceiling and the RH side is routed through
the floor.
The proposed elevator system, to be introduced for follow-on
certification, is in many respects similar to the rudder design.
Control columns, connected to Linear Variable Differential Transducers
(LVDT), provide signals to two Powered Elevator Control Units (PECU).
The PECUs are connected to the Flight Control Computer, Air Data
Computers and servo actuators. Each PECU has built in test circuitry
and two channels for direct control and crossmonitoring.
Type Certification Basis
The applicable requirements for U.S. type certification must be
established in accordance with Secs. 21.16, 21.17, 21.19, 21.29, and
21.101 of the Federal Aviation Regulations (FAR). Accordingly, based on
the application date of June 9, 1989, the TC basis for the SAAB Model
2000 airplane is as follows:
Part 25 as amended by Amendments 25-1 through 25-66, except where
superseded by the following:
Sec. 25.963(e) as amended by Amendment 25-69, Design Standards for Fuel
Tank Access Covers.
Sec. 25.1423 as amended by Amendment 25-70, Independent Power Sources
for the Public Address System.
Part 25 as amended by Amendment 25-71.
Sec. 25.365, Pressurized Compartment Loads.
Part 25, the following sections as amended by Amendment 25-72:
Sec. 25.361 Engine torque.
Sec. 25.365 Pressurized compartment loads.
Sec. 25.571 Damage tolerance and fatigue evaluation of structure.
Sec. 25.772 Pilot compartment doors.
Sec. 25.773 Pilot compartment view.
Sec. 25.783(g) Doors.
Sec. 25.905(d) Propellers.
Sec. 25.933 Reversing systems.
Part 25, the following sections as amended by Amendment 25-73:
Sec. 25.903(a) Engines.
Sec. 25.951(d) Fuel System--General.
Part 34, as amended on the date of issuance of the type
certificate.
Part 36, as amended on the date of issuance of the type
certificate.
Special Conditions No. ANM-25-66, dated 1/12/93, for Lightning and
HIRF Protection.
Special conditions, as appropriate, are issued in accordance with
Sec. 11.49 of the FAR after public notice, as required by Secs. 11.28
and 11.29(b), and become part of the type certification basis in
accordance with Sec. 21.101(b)(2).
Discussion
Effect of Flight Control Systems on Structure
The SAAB Model 2000 incorporates certain fly-by-wire (FBW)
electronic flight control systems (EFCS). The rudder system includes a
yaw damper, rudder limiter, and an auto-trim function which can affect
loads. The follow-on design for the elevators has many similar
features. System failures can lead to design load conditions not
envisioned by the certification rules for transport airplanes. These
special conditions are issued to ensure the same level of safety by
providing comprehensive criteria in which the structural design safety
margins are dependent on systems reliability.
Discussion of Comments
Notice of Proposed Special Conditions No. SC-93-7-NM for the SAAB
Model 2000 airplane was published in the Federal Register on December
9, 1993 (58 FR 64700). One commenter (an organization representing
professional pilots) responded.
``Our comments are fundamentally in support of the proposed special
conditions. However, one commenter is concerned regarding the
reliability of providing hydraulic power by the two back-up pumps
mentioned in the `Background' information. This apprehension stems from
the fact that both back-up pumps are powered from a common motor with
shear out features. The commenter questioned this system as redundant
or a single point where the `system' could break down and not provide
the required hydraulic power necessary to operate the rudder. The
commenter's concern extends to the elevators if a similar design is
used.''
The commenter's concern is addressed in the SAAB 2000 design. The
SAAB 2000 can be flown without hydraulic power to the rudder for most
hydraulic failure conditions. However, if during takeoff, one engine
fails, hydraulic power is necessary to maintain control of the
airplane. With this in mind, the SAAB design provides the rudder's two
hydraulic actuators with power from two independent hydraulic circuits.
One actuator with one functioning circuit is capable of driving the
rudder if the other hydraulic circuit is lost.
Each hydraulic circuit is supplied by an engine driven pump, and
for a short duration, power can also be supplied by accumulators. Each
circuit is isolated fore and aft by fuses in case the circuits are
severed by engine debris. Each circuit, aft of the fuse, has a back-up
pump and an accumulator. The back-up pumps, driven by a common electric
motor, are activated by low hydraulic pressure in either hydraulic
circuit. To protect the independence of the two hydraulic circuits and
to eliminate the single point where the ``system'' could break down, as
expressed by the commenter, a shear out feature is provided between
each back-up pump and the common electric motor. As a further
precaution, the AC motor is automatically started (tested) as part of
the preflight reliability check.
Regarding the commenter's concern for the elevator system, that
system will have three hydraulic systems which have many of the same
features provided for the hydraulic systems supporting the rudder.
Conclusion
This action affects only certain unusual or novel design features
on one model of airplane. It is not a rule of general applicability and
affects only the manufacturer who applied to the FAA for approval of
these features on the airplane.
List of Subjects in 14 CFR Part 25
Air transportation, Aircraft, Aviation safety, Safety.
The authority citation for these special conditions is as follows:
Authority: 49 U.S.C. 1344, 1348(c), 1352, 1354(a), 1355, 1421
through 1431, 1502, 1651(b)(2), 42 U.S.C. 1857f-10, 4321 et seq.;
E.O. 11514; and 49 U.S.C. 106(g).
Final Special Conditions
Accordingly, the following special conditions are issued as part of
the type certification basis for the SAAB Model 2000 airplane:
1. Interaction of Systems and Structures
(a) General. For an airplane equipped with certain fully
hydraulically powered electronically controlled flight control systems,
which directly, or as a result of a failure or malfunction, affect its
structural performance, the influence of these systems and their
failure conditions shall be taken into account in showing compliance
with subparts C and D of part 25 of the Federal Aviation Regulations
(FAR).
(b) System fully operative. With the system fully operative, the
following apply: (1) Limit loads must be derived in all normal
operating configurations of the systems from all the deterministic
limit conditions specified in subpart C, taking into account any
special behavior of such systems or associated functions or any effect
on the structural performance of the airplane which may occur up to the
limit loads. In particular, any significant nonlinearity (rate of
displacement of control surface, thresholds or any other system non-
linearities) must be accounted for in a realistic or conservative way
when deriving limit loads from limit conditions.
(2) The airplane must meet the strength requirements of part 25
(static strength, residual strength), using the specified factors to
derive ultimate loads from the limit loads defined above. The effect of
nonlinearities must be investigated beyond limit conditions to ensure
the behavior of the systems presents no anomaly compared to the
behavior below limit conditions. However, conditions beyond limit
conditions need not be considered when it can be shown that the
airplane has design features that make it impossible to exceed those
limit conditions.
(3) The airplane must meet the aeroelastic stability requirements
of Sec. 25.629.
(c) System in the failure condition. For any system failure
condition not shown to be extremely improbable, the following apply:
(1) At the time of occurrence. Starting from 1-g level flight
conditions, a realistic scenario, including pilot corrective actions,
must be established to determine the loads occurring at the time of
failure and immediately after failure. The airplane must be able to
withstand these loads, multiplied by an appropriate factor of safety,
related to the probability of occurrence of the failure. These loads
should be considered as ultimate loads for this evaluation. The factor
of safety is defined as follows:
BILLING CODE 4910-13-M
Factor of Safety at Time of Occurrence
TR24MR94.004
Probability of occurrence (per hour)
BILLING CODE 4910-13-C
(i) The loads must also be used in the damage tolerance evaluation
required by Sec. 25.571(b) if the failure condition is probable. The
loads may be considered as ultimate loads for the damage tolerance
evaluation.
(ii) Freedom from flutter and divergence must be shown at speeds up
to VD, or 1.15 VC, whichever is greater. However, at
altitudes where the speed is limited by Mach number, compliance need be
shown only up to MD, as defined by Sec. 25.335(b). For failure
conditions which result in speed increases beyond VC/MC,
freedom from flutter and divergency must be shown at increased speeds,
so that the above margins are maintained.
(iii) Notwithstanding subparagraph (1) of this paragraph, failures
of the system which result in forced structural vibrations (oscillatory
failures) must not produce peak loads that could result in permanent
deformation of primary structure.
(2) For the continuation of the flight. For the airplane, in the
failed configuration and considering any appropriate flight
limitations, the following apply: (i) Static and residual strength must
be determined for loads induced by the failure condition if the loads
could continue to the end of the flight. These loads must be combined
with the deterministic limit load conditions specified in subpart C.
(ii) For static strength substantiation, each part of the structure
must be able to withstand the loads in subparagraph (2)(i) of this
paragraph multiplied by a safety factor depending on the probability of
being in this failure state. The factor of safety is defined as
follows:
BILLING CODE 4910-13-M
Factor of Safety for Continuation of Flight
TR24MR94.005
Qj--Probability of being in failure state j
BILLING CODE 4910-13-C
Qj=Tj*Pj where:
Tj=Average time spent in failure condition
Pj=Probability of occurrence of failure mode
Note: If Pj is greater than 10-3, per flight hour then
a safety factor of 1.5 must be used.
(iii) For residual strength substantiation as defined in
Sec. 25.571(b), for structures also affected by failure of the system
and with damage in combination with the system failure, a reduction
factor may be applied to the residual strength loads of Sec. 25.571(b).
However, the residual strength level must not be less than the 1-g
flight load combined with the loads introduced by the failure condition
plus two-thirds of the load increments of the conditions specified in
Sec. 25.571(b) in both positive and negative directions (if
appropriate). The reduction factor is defined as follows:
BILLING CODE 4910-13-M
Residual Strength Reduction Factor
TR24MR94.006
BILLING CODE 4910-13-C
Qj=Tj*Pj where:
Tj=Average time spent in failure condition
Pj=Probability of occurrence of failure mode
Note: If Pj is greater than 10-3, per flight hour then
a safety factor of 1.0 must be used.
(iv) Freedom from flutter and divergence must be shown up to a
speed determined by the following figure:
BILLING CODE 4910-13-M
Flutter Clearance Speed
TR24MR94.007
BILLING CODE 4910-13-C
V1=VD or 1.15 VC whichever is greater.
V2=Flutter clearance speed required for normal (unfailed)
conditions by Sec. 25.629.
Qj=Tj*Pj where:
Tj=Average time spent in failure condition
Pj=Probability of occurrence of failure mode
Note: If Pj is greater than 10-3, then the flutter
clearance speed must not be less than V2.
(v) Freedom from flutter and divergence must also be shown up to
V1 in the above figure, for any probable system failure condition
combined with any damage required or selected for investigation by
Sec. 25.571(b).
(vi) If the time likely to be spent in the failure condition is not
small compared to the damage propagation period, or if the loads
induced by the failure condition may have a significant influence on
the damage propagation, then the effects of the particular failure
condition must be addressed and the corresponding inspection intervals
adjusted to adequately cover this situation.
(vii) If the mission analysis method is used to account for
continuous turbulence, all the systems failure conditions associated
with their probability must be accounted for in a rational or
conservative manner in order to ensure that the probability of
exceeding the limit load is not higher than the prescribed value of the
current requirement.
(d) Warning considerations. For system failure detection and
warning, the following apply: (1) Before flight, the system must be
checked for failure conditions, not extremely improbable, that degrade
the structural capability below the level as intended in paragraph (b)
of this special condition. The crew must be made aware of these
failures, if they exist, before flight.
(2) An evaluation must be made of the necessity to signal, during
the flight, the existence of any failure condition which could
significantly affect the structural capability of the airplane and for
which the associated reduction in airworthiness can be minimized by
suitable flight limitations. The assessment of the need for such
signals must be carried out in a manner consistent with the approved
general warning philosophy for the airplane.
(3) During flight, any failure condition, not shown to be extremely
improbable, in which the safety factor existing between the airplane
strength capability and loads induced by the deterministic limit
conditions of Subpart C of part 25 is reduced to 1.3 or less must be
signaled to the crew if appropriate procedures and limitations can be
provided so that the crew can take action to minimize the associated
reduction in airworthiness during the remainder of the flight.
(e) Dispatch with failure conditions. If the airplane is to be
knowingly dispatched in a system failure condition that reduces the
structural performance, then operational limitations must be provided
whose effects combined with those of the failure condition allow the
airplane to meet the structural requirements as described in paragraph
(b) of this special condition. Subsequent system failures must also be
considered.
Discussion: This special condition is intended to be applicable to
certain fully hydraulically powered electronically controlled flight
controls. The criteria provided by the special condition only address
the direct structural consequences of the systems responses and
performances and therefore cannot be considered in isolation but should
be included into the overall safety evaluation of the airplane. The
presentation of these criteria may in some instances duplicate
standards already established for this evaluation. The criteria are
applicable to structure, the failure of which could prevent continued
safe flight and landing.
The following definitions are applicable to this special condition:
1. Structural performance: Capability of the airplane to meet the
requirements of part 25.
2. Flight limitations: Limitations which can be applied to the airplane
flight conditions following an inflight occurrence and which are
included in the flight manual (e.g., speed limitations, avoidance of
severe weather conditions, etc.).
3. Operational limitations: Limitations, including flight limitations,
which can be applied to the airplane operating conditions before
dispatch (e.g., payload limitations).
4. Probabilistic terms: The probabilistic terms (probable, improbable,
extremely improbable) used in this special condition should be
understood as defined in AC 25.1309-1.
5. Failure condition: The term failure condition is defined in AC
25.1309-1, however this special condition applies only to system
failure conditions which have a direct impact on the structural
performance of the airplane (e.g., failure conditions which induce
loads or change the response of the airplane to inputs such as gusts or
pilot actions).
Issued in Renton, Washington, on March 11, 1994.
Darrell M. Pederson,
Acting Manager, Transport Airplane Directorate, Aircraft Certification
Service, ANM-100.
[FR Doc. 94-6960 Filed 3-23-94; 8:45 am]
BILLING CODE 4910-13-M
