00-17242. Special Conditions: Hamilton Sundstrand, Model NP2000 Propeller

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Final special conditions.

SUMMARY:

These special conditions are issued for the Hamilton Sundstrand model NP2000 constant speed propeller. This eight-bladed propeller uses a dual acting digital electro-hydraulic propeller control system and has blades constructed of composite materials. These design features are novel and unusual. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for these design features. These special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards.

DATES:

Effective date August 9, 2000.

FOR FURTHER INFORMATION CONTACT:

Jay Turnberg, FAA, Engine and Propeller Standards Staff, Engine and Propeller Directorate, Aircraft Certification Service, ANE-110, 12 New England Executive Park, Burlington, Massachusetts, 01803-5229; telephone [phone]; fax [phone].

SUPPLEMENTARY INFORMATION:

Background

On February 9, 1999, Hamilton Sundstrand applied for type certification for a new model NP2000 propeller. The NP2000 propeller uses a digital electro-hydraulic control system and blades that are constructed of composite material.

Conventional propellers on turboprop aircraft use a mechanical governor in the propeller control system that senses propeller speed and adjusts the pitch by directing hydraulic oil to the propeller actuator to increase or decrease pitch to maintain the propeller at the correct revolutions per minute (RPM). When the mechanical governor fails, the propeller pitch is controlled by a backup mechanical overspeed governor.

The Hamilton Sundstrand model NP2000 propeller uses a digital electronic governor in the propeller control system. The digital electronic governor is designed to operate a hydro-mechanical interface to direct hydraulic oil to the propeller actuator to increase or decrease pitch. The digital electronic governor logic commands speed governing, synchrophasing, failure monitoring and provides beta scheduling. The digital electronic governor introduces potential failures associated with electrical power, software commands, data, and environmental effects that can result in hazardous propeller effects. In addition to these features, the system has a backup mechanical overspeed governor.

The special conditions address the following airworthiness issues for the Hamilton Sundstrand model NP2000 propeller:

1. Safety assessment;

2. Propeller control system;

3. Centrifugal load tests;

4. Fatigue limits and evaluation;

5. Bird impact; and

6. Lightning strike.

The Hamilton Sundstrand model NP2000 propeller incorporates propeller blades constructed of composite material. This material has fibers that are woven or aligned in specific directions to give the material directional strength properties. These properties depend on the type of fiber, the orientation and concentration of fiber, and the resin matrix material that binds the fibers together. Composite materials introduce fatigue characteristics and failure modes that differ from metallic materials.

The requirements of part 35 were established to address the airworthiness considerations associated with metal propeller blades. Propeller blades constructed using composite material may be subject to damage due to the high impact forces associated with a bird strike. Thus, composite propellers must demonstrate propeller integrity following a bird strike.

Part 35 does not require a demonstration of propeller integrity following a lightning strike. Composite blades may not safely conduct or dissipate the electrical current from a lightning strike. Severe damage can result if the propellers are not properly protected. Therefore, composite blades must demonstrate propeller integrity following a lightning strike.

The existing certification requirements only address structural and fatigue evaluation of metal propeller blades or hubs, and those metal components of non-metallic blade assemblies. Allowable design stress limits for composite blades must consider the deteriorating effects of the environment and in-service use, particularly those effects from temperature, moisture, erosion and chemical attack. Composite blades also present new and different considerations for retention of the blades in the propeller hub.

The applicable airworthiness requirements do not contain adequate or appropriate safety standards for these novel and unusual design features.

Type Certification Basis

Under § 21.17, Hamilton Sundstrand must show that the model NP2000 propeller meets the applicable provisions of § 21.21 and part 35.

If the Administrator finds that the applicable airworthiness regulations (i.e. part 35), do not contain adequate or appropriate safety standards for the model NP2000 propeller because of a novel or unusual design feature, special conditions are prescribed under the provisions of § 21.16.

Special conditions, as appropriate, are issued in accordance with § 11.49 after public notice, as required by §§ 11.28 and 11.29(b), and become part of the type certification basis in accordance with § 21.17(a)(2).

Special conditions are initially applicable to the model for which they are issued. Should the type certificate for that model be amended later to include any other model that incorporates the same novel or unusual design features, the special conditions would also apply to the other model under the provisions of § 21.101(a)(1).

Novel or Unusual Design Features

The NP2000 propeller will incorporate the following novel and unusual design features: dual acting digital electro-hydraulic propeller control system and blades constructed of composite materials. Special conditions for a safety assessment, the propeller control system, centrifugal load tests, fatigue limits and evaluation, bird impact, and lightning strike address the novel and unusual design features. The special conditions are discussed below.

Safety Assessment

The special conditions require the applicant to conduct a safety assessment of the propeller in conjunction with the requirements for evaluating the digital electro-hydraulic control system. A safety assessment is necessary due to the increased complexity of these propeller designs and related control systems. The ultimate objective of the safety assessment requirement is to ensure that the collective risk from all propeller failure conditions is acceptably low. The basis is the concept that an acceptable total propeller design risk is achievable by managing the individual risks to acceptable levels. This concept emphasizes reducing the risk of an event proportionally with the severity of the hazard it represents.

The special conditions are written at the propeller level for a typical aircraft. The typical aircraft may be the aircraft intended for installation of the propeller. It is advised that the propeller applicant have an understanding of the intended aircraft, not to show compliance with this requirement, but to design a propeller that will be acceptable for the intended aircraft. For example, a part 25 aircraft may require different failure effects and probability of failure than a part 23 aircraft. Showing compliance with the requirement without consideration of the intended aircraft may result in a propeller that cannot be installed on the intended aircraft.

Propeller Control System

Currently, part 35 does not adequately address propellers with combined mechanical, hydraulic, digital, and electronic control systems. Propeller mechanical control systems certified under the existing requirements incorporate a mechanical governor that senses propeller speed and adjusts the pitch to absorb the engine power to maintain the propeller at the selected rotational speed. Propellers with digital electronic control components perform the same basic function but use software, electronic circuitry, and electro-hydraulic actuators. The electronic control systems may also incorporate additional functions such as failure monitoring, synchrophasing and beta scheduling. This addition of electronics to the control system may introduce new failure modes that can result in hazardous propeller effects.

Centrifugal Load Tests

Section 35.35 currently requires that the hub and blade retention arrangement of propellers with detachable blades be tested to a centrifugal load of twice the maximum centrifugal force to which the propeller would be subjected during operation. This requirement is limited to the blade and hub retention capacity and does not address composite materials and composite construction of the propeller assembly or changes in materials due to service degradation and environmental factors.

Fatigue Limits and Evaluation

The current requirement does not adequately address composite materials and is limited to metallic hubs and blades and primary load-carrying metal components of non-metallic blades. The special conditions expand the requirements to include all materials and components whose failure would cause a hazardous propeller effect and to take into account material degradation expected in service, material property variations, manufacturing variations, and environmental effects. The special conditions clarify that the fatigue limits may be determined by tests or analysis based on tests. The components whose failure may cause a hazardous propeller effect include control system components, when applicable.

The special conditions require the applicant to conduct fatigue evaluation on a typical aircraft or on an aircraft used during aircraft certification to conduct the vibration tests and evaluation required by either §§ 23.907 or 25.907. The typical aircraft may be one used to develop design criteria for the propeller or another appropriate aircraft.

Bird Impact

Currently there are no bird impact requirements in part 35. The existing requirements only address the airworthiness considerations associated with propellers that use wood and metal blades. Propeller blades of this type have demonstrated good service experience following a bird strike. Propeller blade and spinner construction now use composite materials that have a higher potential for damage from bird impact.

The need for bird impact requirements was recognized when composite blades were introduced in the 1970's; the safety issue has been addressed by special tests and special conditions for composite blade certifications. These special conditions were unique for each propeller and effectively stated that the propeller will withstand a four-pound bird impact without contributing to a hazardous propeller effect. These special tests and special conditions have been effective for over four million flight hours. There have not been any accidents attributed to bird impact on composite propellers. The selection of a four-pound bird has been substantiated by the extensive service history of blades that have been designed using the four-pound bird criteria.

Lightning Strike

Currently there are no lightning strike requirements in part 35. The need for lightning strike requirements was recognized when composite blades were first introduced in the 1970's; the safety issue has been addressed by special tests and special conditions for each design using composite blades. The special tests and special conditions, which were unique for each propeller, effectively stated that the propeller must be able to withstand a lightning strike without contributing to a hazardous propeller effect. These special tests and special conditions have been effective for over four million flight hours. There have not been any accidents attributed to a lightning strike on composite propellers.

Discussion of Comments

Interested persons have been afforded the opportunity to participate in the making of these special conditions. No comments were received on the special conditions as proposed. After careful review of the available data, the FAA has determined that air safety and the public interest require the adoption of the special conditions without change.

Applicability

As discussed above, these special conditions are applicable to the Hamilton Sundstrand model NP2000 propeller. Should Hamilton Sundstrand apply at a later date for a change to the type certificate to include another model incorporating the same or novel or unusual design features, the special conditions would apply to that model as well under the provisions of § 21.101(a)(1).

Conclusion

This action affects only certain novel or unusual design features on one model of propellers. It is not a rule of general applicability, and it affects only the applicant who applied to the FAA for approval of these features on the propeller.

List of Subjects in 14 CFR Part 35

• Air transportation
• Aircraft
• Aviation safety
• Safety

The authority citations for these special conditions are as follows:

Authority: 49 U.S.C. 106(g), 40113, 44701-44702, 44704.

The Special Conditions

Accordingly, pursuant to the authority delegated to me by the Administrator, the following special conditions are issued as part of the type certification basis for Hamilton Sundstrand model NP2000 propellers.

In addition to the requirements of part 35, the following requirements apply to the propeller.

(a) Definitions. Unless otherwise approved by the Administrator and documented in the appropriate manuals and certification documents, for the purpose of these special conditions the following definitions apply to the propeller:

(1) Propeller. The propeller is defined by the components listed in the type design.

(2) Propeller system. The propeller system consists of the propeller plus all the components necessary for its functioning, but not necessarily included in the propeller type design.

(3) Hazardous propeller effects. The following are regarded as hazardous propeller effects:

(i) A significant overspeed of the propeller.

(ii) The development of excessive drag.

(iii) Thrust in the opposite direction to that commanded by the pilot.

(iv) A release of the propeller or any major portion of the propeller.

(v) A failure that results in excessive unbalance.

(vi) The unintended movement of the propeller blades below the established minimum in-flight low pitch position.

(4) Major propeller effects. The following are regarded as major propeller effects:

(i) An inability to feather.

(ii) An inability to command a change in propeller pitch.

(iii) A significant uncommanded change in pitch.

(iv) A significant uncontrollable torque or speed fluctuation.

(b) Safety analysis.

(1)(i) An analysis of the propeller system must be carried out to assess the likely consequence of all failures that can reasonably be expected to occur. This analysis must consider the following:

(A) The propeller system in a typical installation. When the analysis depends on representative components, assumed interfaces, or assumed installed conditions, the assumptions must be stated in the analysis.

(B) Consequential secondary failures and latent failures.

(C) Multiple failures referred to in paragraph (b)(4) or that result in hazardous propeller effects.

(ii) A summary must be made of those failures that could result in major propeller effects or hazardous propeller effects, together with an estimate of the probability of occurrence of those effects.

(iii) It must be shown that hazardous propeller effects are not predicted to occur at a rate in excess of that defined as extremely remote (probability of 10−⁷ or less per propeller flight hour). The estimated probability for individual failures may be insufficiently precise to enable the total rate for hazardous propeller effects to be assessed. For propeller certification, it is acceptable to consider that the intent of this paragraph has been achieved if the probability of a hazardous propeller effect arising from an individual failure can be predicted to be not greater than 10−⁸ per propeller flight hour. It will also be accepted that, in dealing with probabilities of this low order of magnitude, absolute proof is not possible and reliance must be placed on engineering judgment and previous experience combined with sound design and test philosophies.

(iv) It must be shown that major propeller effects are not predicted to occur at a rate in excess of that defined as remote (probability of 10−⁵ or less per propeller flight hour).

(2) If significant doubt exists as to the effects of failures or likely combination of failures, any assumption of the effect may be required to be verified by test.

(3) It is recognized that the probability of primary failures of certain single elements (for example, blades) cannot be sensibly estimated in numerical terms. If the failure of such elements is likely to result in hazardous propeller effects, reliance must be placed on meeting the prescribed integrity requirements of part 35 and these special conditions. These instances must be stated in the safety analysis.

(4) If reliance is placed on a system or device, such as safety devices, feathering and overspeed systems, instrumentation, early warning devices, maintenance checks, and similar equipment or procedures, to prevent a failure from progressing to hazardous propeller effects, the possibility of a safety system failure in combination with a basic propeller failure must be covered. If items of a safety system are outside the control of the propeller manufacturer, the assumptions of the safety analysis with respect to the reliability of these parts must be clearly stated in the analysis and identified in the installation and operation instructions required under § 35.3.

(5) If the acceptability of the safety analysis is dependent on one or more of the following, it must be identified in the analysis and appropriately substantiated.

(i) Performance of mandatory maintenance actions at stated intervals required for certification and other maintenance actions. This includes the verification of the serviceability of items that could fail in a latent manner. These maintenance intervals must be published in the appropriate manuals. Additionally, if errors in maintenance of the propeller system could lead to hazardous propeller effects, the appropriate procedures must be published in the appropriate propeller manuals.

(ii) Verification of the satisfactory functioning of safety or other devices at pre-flight or other stated periods. The details of this satisfactory functioning must be published in the appropriate manuals.

(iii) The provisions of specific instrumentation not otherwise required.

(iv) A fatigue assessment.

(6) If applicable, the safety analysis must include the assessment of indicating equipment, manual and automatic controls, governors and propeller control systems, synchrophasers, synchronizers, and propeller thrust reversal systems.

(c) Propeller control system. The requirements of this section are applicable to any system or component that controls, limits or monitors propeller functions.

(1) The propeller control system must be designed, constructed and validated to show that:

(i) The propeller control system, operating in normal and alternative operating modes and transition between operating modes, performs the intended functions throughout the declared operating conditions and flight envelope.

(ii) The propeller control system functionality is not adversely affected by the declared environmental conditions, including temperature, electromagnetic interference (EMI), high intensity radiated fields (HIRF) and lightning. The environmental limits to which the system has been satisfactorily validated must be documented in the appropriate propeller manuals.

(iii) A method is provided to indicate that an operating mode change has occurred if flight crew action is required. In such an event, operating instructions must be provided in the appropriate manuals.

(2) The propeller control system must be designed and constructed so that, in addition to compliance with paragraph (b), Safety analysis:

(i) A level of integrity consistent with the intended aircraft is achieved.

(ii) A single failure or malfunction of electrical or electronic components in the control system does not cause a hazardous propeller effect.

(iii) Failures or malfunctions directly affecting the propeller control system in a typical aircraft, such as structural failures of attachments to the control, fire, or overheat, do not lead to a hazardous propeller effect.

(iv) The loss of normal propeller pitch control does not cause a hazardous propeller effect under the intended operating conditions.

(v) The failure or corruption of data or signals shared across propellers does not cause a major or hazardous propeller effect.

(3) Electronic propeller control system imbedded software must be designed and implemented by a method approved by the Administrator that is consistent with the criticality of the performed functions and minimizes the existence of software errors.

(4) The propeller control system must be designed and constructed so that the failure or corruption of aircraft-supplied data does not result in hazardous propeller effects.

(5) The propeller control system must be designed and constructed so that the loss, interruption or abnormal characteristic of aircraft-supplied electrical power does not result in hazardous propeller effects. The power quality requirements must be described in the appropriate manuals.

(6) The propeller control system description, characteristics and authority, in both normal operation and failure conditions, and the range of control of other controlled functions must be specified in the appropriate propeller manuals.

(d) Centrifugal load tests. It must be demonstrated that a propeller, accounting for environmental degradation expected in service, complies with paragraphs (d)(1), (d)(2) and (d)(3) of these special conditions without evidence of failure, malfunction, or permanent deformation that would result in a major or hazardous propeller effect. Environmental degradation may be accounted for by adjustment of the loads during the tests.

(1) The hub, blade retention system, and counterweights must be tested for a period of one hour to a load equivalent to twice the maximum centrifugal load to which the propeller would be subjected during operation at the maximum rated rotational speed.

(2) If appropriate, blade features associated with transitions to the retention system (e.g., a composite blade bonded to a metallic retention) may be tested either during the test required by paragraph (d)(1) or in a separate component test.

(3) Components used with or attached to the propeller (e.g., spinners, de-icing equipment, and blade erosion shields) must be subjected to a load equivalent to 159 percent of the maximum centrifugal load to which the component would be subjected during operation at the maximum rated rotational speed. This must be performed by either:

(i) Testing at the required load for a period of 30 minutes; or

(ii) Analysis based on test.

(e) Fatigue limits and evaluation. (1) Fatigue limits must be established by tests or analysis based on tests, for propeller:

(i) Hubs;

(ii) Blades;

(iii) Blade retention components; and

(iv) Other components that are affected by fatigue loads and that are shown under paragraph (b), Safety analysis, as having a fatigue failure mode leading to hazardous propeller effects.

(2) The fatigue limits must take the following into account:

(i) All known and reasonably foreseeable vibration and cyclic load patterns that are expected in service; and

(ii) Expected service deterioration, variations in material properties, manufacturing variations, and environmental effects.

(3) A fatigue evaluation of the propeller must be conducted to show that hazardous propeller effects due to fatigue will be avoided throughout the intended operational life of the propeller on either:

(i) The intended aircraft, by complying with §§ 23.907 or 25.907 as applicable; or

(ii) A typical aircraft.

(f) Bird impact. It must be demonstrated, by tests or analysis based on tests or experience on similar designs, that the propeller is capable of withstanding the impact of a four pound bird at the critical location(s) and critical flight condition(s) of the intended aircraft without causing a major or hazardous propeller effect.

(g) Lightning strike. It must be demonstrated, by tests or analysis based on tests or experience on similar designs, that the propeller is capable of withstanding a lightning strike without causing a major or hazardous propeller effect.

Issued in Burlington, Massachusetts on June 27, 2000.

David A. Downey,

Assistant Manager, Engine and Propeller Directorate, Aircraft Certification Service.