[Federal Register Volume 61, Number 94 (Tuesday, May 14, 1996)]
[Rules and Regulations]
[Pages 24208-24212]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 96-2086]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
14 CFR Part 25
[Docket No. NM-121, Special Conditions No. 25-ANM-113]
Special Conditions: Cessna Aircraft Model 750 Airplanes;
Operation With Fly-by-Wire Rudder
AGENCY: Federal Aviation Administration, DOT.
ACTION: Final special conditions.
-----------------------------------------------------------------------
SUMMARY: These special conditions are issued for the Cessna Aircraft
Model 750 airplane. This airplane will have novel and unusual design
features, relating to its electronic rudder flight control system, when
compared to the state of technology envisioned in the airworthiness
standards of part 25 of the Federal Aviation Regulations (FAR). These
special conditions contain the additional safety standards that the
Administrator considers necessary to establish a level of safety
equivalent to that provided by the airworthiness standards of part 25.
EFFECTIVE DATE: May 1, 1996.
FOR FURTHER INFORMATION CONTACT:
Mark I. Quam, FAA, Standardization Branch, ANM-113, Transport Standards
Staff, Transport Airplane Directorate, Aircraft Certification Service,
1601 Lind Avenue SW., Renton, Washington 98055-4056; telephone (206)
227-2145, facsimile (206) 227-1149.
SUPPLEMENTARY INFORMATION:
Background
On October 15, 1991, Cessna Aircraft Company (Cessna), 6030 Cessna
Blvd., P.O. Box 7704, Wichita, KS 67277-7704, applied for a new type
certificate in the transport airplane category for the Model 750
(Citation X) airplane. The Cessna 750 is a twin-engine, swept-wing
business jet aircraft that is configured for approximately 8-12
passengers. The airplane has two Allison Engine Company AE 3007C
turbofan engines rated at 6400 pounds of sea level, static takeoff
thrust. The airplane has a maximum operating altitude of 51,000 feet
and a range of approximately 3300 nautical miles.
[[Page 24209]]
The Cessna 750 has a yaw control system provided by a lower rudder
and an upper rudder. Each rudder surface has an independent full-time
control system, except that they share mechanical input at the rudder
pedals. The lower surface is controlled by mechanical input to
hydraulically-powered actuators. The upper surface is electronically
controlled.
The lower rudder is positioned by two identical power control units
(PCUs) installed one above the other, in parallel, in the vertical fin.
The PCUs are each powered by an independent hydraulic system. Both the
pilot and co-pilot rudder pedals are connected to the PCUs through
conventional \1/8\'' diameter stainless steel cables, bellcranks, and
PCU input bungees. Dual mechanical load paths are provided from the
input sector to the PCUs to ensure that no single mechanical disconnect
can result in loss of both rudder pedal and electric trim input to the
PCUs. Rudder pedal travel of +/- 2.9 inches provides a maximum lower
rudder deflection of +/- 30 degrees. The lower rudder system has dual
rudder authority limiters designed to limit deflection, depending on
the airplane's dynamic pressure. The purpose of the rudder limiter is
to protect the airplane structure against overload. Both rudder
authority limiters, each controlled by an independent rudder limit
module, operate simultaneously so that a failure of one system will not
allow the lower rudder to deflect to an unwanted position. Dual yaw
damper actuators are linked in series to the lower rudder system to
provide Dutch roll damping and turn coordination.
The upper rudder is driven electrically by the stand-alone yaw
stability augmentation systems (YSAS) which consist of two identical
systems. Each YSAS consists of a yaw stability augmentation computer
(YSAC), two dual rotary variable transformer (RVT) sensors, and a servo
motor which is a part of an electromechanical actuator (EMA). Either
one of two YSASs continuously provides Dutch roll damping of the
airplane, as well as tracking of the upper rudder to the mechanical
command from the rudder pedals through electronic sensing of the rudder
pedal torque tube position in the cockpit. The maximum upper rudder
deflection is +/-18 degrees. Upper surface position limiting is
accomplished by electrical and mechanical stops at the surface.
In normal conditions, the manual yaw command from either the pilot
or co-pilot rudder pedals is transmitted through the cable system and
the PCU input bungees to the rudder PCUs. The PCUs then drive the lower
rudder surface in proportion to the input command. At the same time,
the rudder pedal command is electrically sensed at the rudder pedal
torque tube and transmitted to the active YSAS for tracking the upper
rudder. The position of each rudder surface may be displayed to the
pilot along with the authority limiter position. In normal operation,
both the lower and upper rudder systems provide yaw damper function at
the same time. If the yaw damper function on either rudder system
completely fails, the other system will provide adequate control to
maintain the yaw stability of the airplane.
Type Certification Basis
Under the provisions of Sec. 21.17 of the FAR, Cessna must show,
except as provided in Sec. 25.2, that the Model 750 (Citation X) meets
the applicable provisions of part 25, effective February 1, 1965, as
amended by Amendments 25-1 through 25-74. In addition, the
certification basis for the Model 750 includes Sec. 25.1316, System
lightning protection, as amended by Amendment 25-80; part 34, effective
September 10, 1990, plus any amendments in effect at the time of
certification; and part 36, effective December 1, 1969, as amended by
Amendment 36-1 through the amendment in effect at the time of
certification. These special conditions form an additional part of the
type certification basis. The certification basis also includes Special
Conditions No. 25-ANM-99, dated 5/8/95, pertaining to protection from
High Intensity radiated fields, and may include other special
conditions that are not relevant to these special conditions.
If the Administrator finds that the applicable airworthiness
regulations (i.e., part 25, as amended) do not contain adequate or
appropriate safety standards for the Cessna Model 750 because of a
novel or unusual design feature, special conditions are prescribed
under the provisions of Sec. 21.16 to establish a level of safety
equivalent to that established in the regulations.
Special conditions, as appropriate, are issued in accordance with
Sec. 11.49 of the FAR after public notice, as required by Secs. 11.28
and 11.29, and become part of the type certification basis in
accordance with Sec. 21.17(a)(2).
Special conditions are initially applicable to the model for which
they are issued. Should the type certificate for that model be amended
later to include any other model that incorporates the same novel or
unusual design feature, the special condition would also apply to the
other model under the provisions of Sec. 21.101(a)(1).
Discussion
The type design of the Cessna 750 contains novel or unusual design
features not envisioned by the applicable part 25 airworthiness
standards and therefore special conditions are considered necessary in
the following areas:
1. Upper Rudder Control System Operation Without Normal Electrical
Power. The Cessna Model 750 upper rudder control system is required in
order to maintain safe flight. The Cessna design has four yaw dampers,
including lower rudder dual yaw dampers that are hydraulically powered,
and an upper rudder with dual YSASs that are electrically powered. If
all hydraulic power is lost to the lower rudder (manual revision), then
availability of the upper rudder yaw damper function becomes critical.
Section 25.1351(d) of the FAR, Operation without normal electrical
power, requires safe operation in VFR conditions for at least five
minutes with inoperative normal power. This rule was structured around
a traditional design utilizing mechanical control cables for flight
control, while the crew took time to sort out the electrical failure,
start engine(s) if necessary, and re-establish some of the electrical
power generation capability.
Service experience with traditional two-engine airplane designs has
shown that the loss of electrical power generated by the airplane's
engines is not extremely improbable. The electrical power system of the
Cessna 750 must therefore be designed with standby or emergency
electrical sources of sufficient reliability and capacity to power the
upper rudder control system in the event of the loss of normally
generated electrical power. The need for electrical power for the
Cessna Model 750 upper rudder control system was not envisioned by part
25 since, in traditional designs, cables and hydraulics are utilized
for the flight control system. Therefore, Special Condition No. 1 is
needed.
2. Design Maneuver Requirements. In a conventional airplane, pilot
inputs directly affect control surface movement (both rate and
displacement) for a given flight condition. In the Cessna Model 750,
the pilot provides only a portion of the input to the upper rudder
control surface, and it is possible that the pilot control
displacements specified in Sec. 25.351 of the FAR may not result in the
maximum displacement and rates of displacement of the upper rudder. The
intent of these noted rules may not be
[[Page 24210]]
satisfied if literally applied. Therefore, Special Condition No. 2 is
needed.
3. Interaction of Systems and Structures. The Cessna Model 750 has
a full-time electronic upper rudder flight control system affecting the
yaw axis. The current rules are inadequate for considering the affects
of this system, and its failures, on structural performance. Therefore,
Special Condition No. 3 is needed.
As discussed above, these special conditions are applicable
initially to the Cessna Model 750 (Citation X) airplane. Should Cessna
apply at a later date for a change to the type certificate to include
another model incorporating the same novel or unusual design feature,
the special conditions would apply to that model as well under the
provisions of Sec. 21.101(a)(1).
Discussion of Comments
Notice of proposed special conditions No. SC-96-1-NM was published
in the Federal Register on March 22, 1996 (61 FR 11779). No comments
were received.
Under standard practice, the effective date of final special
conditions would be 30 days after the date of publication in the
Federal Register. However, as the certification date for the Cessna
Aircraft Model 750 airplane is imminent, the FAA finds that good cause
exists for making these special conditions effective upon issuance.
Conclusion
This action affects only certain unusual or novel design features
on one model series of airplanes. It is not a rule of general
applicability and affects only the manufacturer who applied to the FAA
for approval of these features on the airplanes.
List of Subjects in 14 CFR Part 25
Aircraft, Aviation safety, Reporting and recordkeeping
requirements.
The authority citation for part 25 continues to read as follows:
Authority: 49 U.S.C. 106(g), 40113, 44701-44702, 44704.
The Special Conditions
Accordingly, pursuant to the authority delegated to me by the
Administrator, the following special conditions are issued as part of
the type certification basis for the Cessna Aircraft Model 750
airplanes.
1. Upper Rudder Control System Operations Without Normal Electrical
Power. In lieu of compliance with Sec. 25.1351(d), it must be
demonstrated, by test or combination of test and analysis, that the
upper rudder control system provides for safe flight and landing with
inoperative normal engine electrical power (electrical power sources
excluding the battery and any other standby electrical sources). The
airplane operation should be considered at the critical phase of flight
and include the ability to restart the engines and maintain flight for
a minimum of 30 minutes in Instrument Meteorological Conditions (IMC).
Discussion: The Cessna Model 750 fly-by-wire upper rudder control
system requires a continuous source of electrical power in order to
maintain yaw control. Section Sec. 25.1351(d), Operation without normal
electrical power, requires safe operation in visual flight rules (VFR)
conditions for at least five minutes with inoperative normal power.
This rule was structured around a traditional design utilizing
mechanical control cables for flight control while the crew took time
to sort out the electrical failure and was able to re-establish some of
the electrical power generation capability. In order to maintain the
same level of safety associated with traditional designs, the Cessna
750 upper rudder control system design shall be demonstrated to operate
for at least 30 minutes without the normal source of engine-generated
electrical power. It should be noted that service experience has shown
that the loss of all electrical power that is generated by the
airplane's engines is not extremely improbable.
The emergency electrical power system must be designed to supply
the upper rudder control system without the need for crew action
following the loss of the normal electrical power system.
For compliance purposes:
1. A test demonstration of the loss of normal engine-generated
power is to be established such that:
a. The failure condition should be assumed to occur during night
instrument meteorological conditions (IMC), at the most critical phase
of flight relative to the electrical power system design and
distribution of equipment loads on the system.
b. The upper rudder control system can provide for continued safe
flight and landing using emergency electrical power (batteries, etc.)
for at least 30 minutes of operation in IMC. An engine restart should
be included in this demonstration.
c. Availability of APU operation should not be considered in
establishing emergency power system adequacy.
2. Since the availability of the emergency electrical power system
operation is necessary for maintaining safe flight with the upper
rudder, the emergency electrical power system must be available
immediately prior to each flight.
3. The emergency electrical power system must be shown to be
satisfactorily operational in all flight regimes.
2. Design Yaw Maneuver Requirements.
In lieu of compliance with Sec. 25.351 of the FAR, the airplane
must be designed for loads resulting from the yaw maneuver conditions
specified in subparagraphs (a) through (d) of this paragraph, at speeds
from VMC to VD. Unbalanced aerodynamic moments about the
center of gravity must be reacted in a rational or conservative manner
considering the airplane inertia forces. In computing the tail loads,
the yawing velocity may be assumed to be zero.
(a) With the airplane in unaccelerated flight at zero yaw, it is
assumed that the cockpit rudder control is suddenly displaced to
achieve the resulting rudder deflection, as limited by:
(1) the control system or control surface stops; or
(2) a limit force of 300 pounds from VMC to VA and 200
pounds from VC/MC to VD/MD, with a linear variation
between VA and VC/MC.
(b) With the cockpit rudder control deflected so as always to
maintain the maximum rudder deflection available within the limitations
specified in subparagraph (a) of this paragraph, it is assumed that the
airplane yaws to the overswing sideslip angle.
(c) With the airplane yawed to the static equilibrium sideslip
angle, it is assumed that the cockpit rudder control is held so as to
achieve the maximum rudder deflection available within the limitations
specified in subparagraph (a) of this paragraph.
(d) With the airplane yawed to the static equilibrium sideslip
angle of subparagraph (c) of this paragraph, it is assumed that the
cockpit rudder control is suddenly returned to neutral.
3. Interaction of Systems and Structures.
Airplanes equipped with fly-by-wire control systems that affect
structural performance, either directly or as a result of a failure or
malfunction, must account for the influence of these systems and their
failure conditions in showing compliance with the requirements of 14
CFR part 25, Subparts C and D.
(a) General. The following criteria will be used in determining the
influence of the upper rudder control systems and their failure
conditions on the airplane structure.
[[Page 24211]]
(b) System fully operative. With the system fully operative, the
following apply:
(1) Limit loads must be derived in all normal operating
configurations of the systems from all the limit conditions specified
in 14 CFR part 25, Subpart C, taking into account any special behavior
of such systems or associated functions or any effect on the structural
performance of the airplane that may occur up to the limit loads. In
particular, any significant nonlinearity (rate of displacement of
control surface, thresholds, or any other system nonlinearities) must
be accounted for in a realistic or conservative way when deriving limit
loads from limit conditions.
(2) The airplane must meet the strength requirements of 14 CFR part
25 (Static strength, residual strength), using the specified factors to
derive ultimate loads from the limit loads defined above. The effect of
non linearities must be investigated beyond limit conditions to ensure
the behavior of the system present no anomaly compared to the behavior
below limit conditions. However, conditions beyond limit conditions
need not be considered when it can be shown that the airplane has
design features that make it impossible to exceed those limit
conditions.
(3) The airplane must meet the aeroelastic stability requirements
of Sec. 25.629.
(c) System in failure condition. For any failure condition in the
system not shown to be extremely improbable, the following apply:
(1) At the time of occurrence. Starting from 1-g level flight
conditions, a realistic scenario, including pilot corrective actions,
must be established to determine the loads occurring at the time of
failure and immediately after failure. The airplane must be able to
withstand these loads multiplied by an appropriate factor of safety
that is related to the probability of occurrence of the failure. The
factor of safety (F.S.) is defined in Figure 1.
[GRAPHIC] [TIFF OMITTED] TR14MY96.003
Pj--Probability of occurrence of failure mode j (per hour)
(i) These loads must also be used in the damage tolerance
evaluation required by Sec. 25.571(b) if the failure condition is
probable.
(ii) Freedom from flutter, divergence, and control reversal must be
shown up to the speeds defined in Sec. 25.629(b)(2). For failure
conditions which result in speed increases beyond VC/MC,
freedom from flutter, divergence, and control reversal must be shown to
increased speeds, so that the margins intended by Sec. 25.629(b)(2) are
maintained.
(iii) Notwithstanding subparagraph (1) of this paragraph, failures
of the system that result in forced structural vibrations (oscillatory
failures) must not produce loads that could result in catastrophic
fatigue failure or detrimental deformation of primary structure.
(2) For the continuation of the flight. For the airplane in the
system failed state, and considering any appropriate reconfiguration
and flight limitations, the following apply:
(i) Static and residual strength must be determined for loads
derived from the following conditions at speeds up to VC, or the
speed limitation prescribed for the remainder of the flight:
(A) The limit symmetrical maneuvering conditions specified in
Secs. 25.331 and 25.325.
(B) The limit gust conditions specified in Sec. 25.341 (but using
the gust velocities for VC) and in Sec. 25.345.
(C) The limit rolling conditions specified in Sec. 25.349 and the
limit unsymmetrical conditions specified in Secs. 25.367 and 25.427(b)
and (c).
(D) The limit yaw maneuvering conditions specified in Special
Condition No. 2.
(E) The limit ground loading conditions specified in Secs. 25.473
and 25.491.
(ii) For static strength substantiation, each part of the structure
must be able to withstand the loads specified in subparagraph (2)(i) of
this paragraph, multiplied by a factor of safety depending on the
probability of being in this failure state. The factor of safety is
defined in Figure 2.
[GRAPHIC] [TIFF OMITTED] TR14MY96.004
Qj--Probability of being in failure condition j
Qj=(Tj)(Pj) where:
Tj=Average time spent in failure condition j (in hours)
Pj=Probability of occurrence of failure mode j (per hour)
Note: If Pj is greater than 10-3 per flight hour, then
a 1.5 factor of safety must be applied to all limit load conditions
specified in Subpart C.
(iii) For residual strength substantiation as defined in
Sec. 25.571(b), structures affected by failure of the system and with
damage in combination with the system failure, a reduced factor may be
applied to the loads specified in
[[Page 24212]]
subparagraph (2)(i) of this paragraph. However, the residual strength
level must not be less than the 1-g flight load, combined with the
loads introduced by the failure condition, plus two-thirds of the load
increments of the conditions specified in subparagraph (2)(i) of this
paragraph, applied in both positive and negative directions (if
appropriate). The residual strength factor (R.S.F.) is defined in
Figure 3.
[GRAPHIC] [TIFF OMITTED] TR14MY96.005
Qj--Probability of being in failure condition j
Qj=(Tj)(Pj) where:
Tj=Average time spent in failure condition j (in hours)
Pj=Probability of occurrence of failure mode j (per hour)
Note: If Pj is greater than 10-3 per flight hour, then
a residual strength factor of 1.0 must be used.
(iv) If the loads induced by the failure condition have a
significant effect on fatigue or damage tolerance, then their effects
must be taken into account.
(v) Freedom from flutter, divergence, and control reversal must be
shown up to a speed determined from Figure 4. Flutter clearance speeds
V' and V'' may be based on the speed limitation specified for the
remainder of the flight, using the margins defined by Sec. 25.629(b).
[GRAPHIC] [TIFF OMITTED] TR14MY96.006
Qj=Probability of being in failure condition j
V'=Clearance speed as defined by Sec. 25.629(b)(2).
V''=Clearance speed as defined by Sec. 25.629(b)(1).
Qj=(Tj)(Pj) where:
Tj=Average time spent in failure condition j (in hours)
Pj=Probability of occurrence of failure mode j (per hour)
Note: If Pj is greater than 10-3 per flight hour, then
the flutter clearance speed must not be less than V''.
(vi) Freedom from flutter, divergence, and control reversal must
also be shown up to V' in Figure 4 above, for any probable system
failure condition combined with any damage required or selected for
investigation by Sec. 25.571(b).
(vii) If the mission analysis method is used to account for
continuous turbulence, all the systems failure conditions associated
with their probability must be accounted for in a rational or
conservative manner in order to ensure that the probability of
exceeding the limit load is not higher than the value prescribed in
Appendix G of 14 CFR part 25.
(3) Consideration of certain failure conditions may be required by
other sections of 14 CFR part 25, regardless of calculated system
reliability. Where analysis shows the probability of these failure
conditions to be less than 10-9, criteria other than those
specified in this paragraph may be used for structural substantiation
to show continued safe flight and landing.
(d) Warning considerations. For upper rudder control system failure
detection and warning, the following apply:
(1) The system must be checked for failure conditions, not
extremely improbable, that degrade the structural capability below the
level required by part 25 or significantly reduce the reliability of
the remaining system. The crew must be made aware of these failures
before flight. Certain elements of the control system, such as
mechanical and hydraulic components, may use special periodic
inspections, and electronic components may use daily checks, in lieu of
warning systems, to achieve the objective of this requirement. These
certification maintenance requirements must be limited to components
that are not readily detectable by normal warning systems and where
service history shows that inspections will provide an adequate level
of safety.
(2) The existence of any failure condition, not extremely
improbable, during flight that could significantly affect the
structural capability of the airplane, and for which the associated
reduction in airworthiness can be minimized by suitable flight
limitations, must be signaled to the flight crew. For example, failure
conditions which result in a factor of safety between the airplane
strength and the loads of 14 CFR part 25, Subpart C, below 1.25, or
flutter margins below V'', must be signaled to the crew during the
flight.
(3) Dispatch with known failure conditions. If the airplane is to
be dispatched in a known upper rudder control system failure condition
that affects structural performance, or affects the reliability of the
remaining system to maintain structural performance, then the
provisions of this special condition must be met for the dispatched
condition and for subsequent failures. Operational and flight
limitations may be taken into account.
Issued in Renton, Washington, on May 1, 1996.
Darrell M. Pederson,
Acting Manager, Transport Airplane Directorate, Aircraft Certification
Service, ANM-100.
[FR Doc. 96-2086 Filed 5-13-96; 8:45 am]
BILLING CODE 4910-13-M
