05-16728. Special Conditions: Embraer Model ERJ 190 Series Airplanes; Sudden Engine Stoppage, Interaction of Systems and Structures, Operation Without Normal Electrical Power, Electronic Flight Control Systems, Automatic Takeoff Thrust Control ...

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Final special conditions.

SUMMARY:

These special conditions are issued for the Embraer Model ERJ 190 series airplane. This airplane will have novel or unusual design features when compared to the state of technology envisioned in the airworthiness standards for transport category airplanes. These design features are associated with (1) engine size and torque load which affect sudden engine stoppage, (2) electrical and electronic systems which perform critical functions, and (3) an Automatic Takeoff thrust Control Systems (ATTCS). These special conditions also pertain to the effects of such novel or unusual design features, such as their effects on the structural performance of the airplane. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for these design features. These special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards.

DATES:

Effective August 23, 2005.

FOR FURTHER INFORMATION CONTACT:

Tom Groves, FAA, International Branch, ANM-116, Transport Airplane Directorate, Aircraft Certification Service, 1601 Lind Avenue SW., Renton, Washington 98055-4056; telephone [phone]; facsimile [phone].

SUPPLEMENTARY INFORMATION:

Background

Embraer made the original application for certification of the ERJ 190 on May 20, 1999. The Embraer application includes six different models, the initial variant being designated as the ERJ 190-100. The application was submitted concurrently with that for the ERJ 170-100, which received an FAA Type Certificate (TC) on February 20, 2004. Although the applications were submitted as two distinct type certificates, the airplanes share the same conceptual design and general configuration. On July 2, 2003, Embraer submitted a request for an extension of its original application for the ERJ 190 series, with a new proposed reference date of May 30, 2001, for establishing the type certification basis. The FAA certification basis was adjusted to reflect this new reference date. In addition Embraer has elected to voluntarily comply with certain 14 CFR part 25 amendments introduced after the May 30, 2001 reference date.

The Embraer ERJ 190-100 is a low wing, transport-category aircraft powered by two wing-mounted General Electric CF34-10E turbofan engines. The airplane is a 108 passenger regional jet with a maximum take off weight of 51,800 kilograms (114,200 pounds). The maximum operating altitude and speed are 41,000 feet and 320 knots calibrated air speed (KCAS)/0.82 MACH, respectively.

Type Certification Basis

Based on the May 30, 2001 reference date of application, and under the provisions of 14 CFR 21.17, Embraer must show that the Model ERJ 190 airplane meets the applicable provisions of 14 CFR part 25, as amended by Amendments 25-1 through 25-101. If the Administrator finds that the applicable airworthiness regulations do not contain adequate or appropriate safety standards for the Embraer ERJ 190-100 airplane because of novel or unusual design features, special conditions are prescribed under the provisions of 14 CFR 21.16.

Embraer has proposed to voluntarily adopt several 14 CFR part 25 amendments that became effective after the requested new reference date of May 30, 2001, specifically Amendment 25-102, except paragraph 25.981(c); Amendments 25-103 through 25-105 in their entirety; Amendment 25-107, except paragraph 25.735(h); Amendment 25-108 through 25-110 in their entirety; and Amendments 25-112 through 25-114 in their entirety.

In addition to the applicable airworthiness regulations and special conditions, the Embraer Model ERJ 190 series airplane must comply with the fuel vent and exhaust emission requirements of 14 CFR part 34 and the noise certification requirements of 14 CFR part 36, and the FAA must issue a finding of regulatory adequacy pursuant to section 611 of Public Law 93-574, the “Noise Control Act of 1972.”

Special conditions, as defined in § 11.19, are issued in accordance with § 11.38 and become part of the type certification basis in accordance with § 21.17(a)(2).

Special conditions are initially applicable to the model for which they are issued. Should the type certificate for that model be amended later to include any other model that incorporates the same novel or unusual design features, the special conditions would also apply to the other model under the provisions of § 21.101.

Discussion of Novel or Unusual Design Features

The Embraer ERJ 190 series airplanes will incorporate a number of novel or unusual design features. Because of rapid improvements in airplane technology, the applicable airworthiness regulations do not contain adequate or appropriate safety standards for these design features. The special conditions proposed for the Embraer ERJ 190 series airplanes contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards. These special conditions are the same as those required for the Embraer Model ERJ 170.

The Embraer ERJ 190 series airplanes will incorporate the novel or unusual design features described below.

Engine Size and Torque Load

Since 1957, § 25.361(b)(1) has required that engine mounts and supporting structures must be designed to withstand the limit engine torque load which is posed by sudden engine stoppage due to malfunction or structural failure, such as compressor jamming. Design torque loads associated with typical failure scenarios were estimated by the engine manufacturer and provided to the airframe manufacturer as limit loads. These limit loads were considered simple, pure static torque loads. However, the size, configuration, and failure modes of jet engines have changed considerably from those envisioned when the engine seizure requirement of § 25.361(b) was first adopted. Current engines are much larger and are now designed with large bypass fans capable of producing much larger torque, if they become jammed.

Relative to the engine configurations that existed when the rule was developed in 1957, the present generation of engines is sufficiently different and novel to justify issuance of special conditions to establish appropriate design standards. The latest generation of jet engines is capable of producing, during failure, transient loads that are significantly higher and more complex than those produced by the generation of engines in existence when the current regulation was developed.

In order to maintain the level of safety envisioned in § 25.361(b), more comprehensive criteria are needed for the new generation of high bypass engines. The proposed special condition would distinguish between the more common failure events involving transient deceleration conditions with temporary loss of thrust capability and those rare events resulting from structural failures. Associated with these events, the proposed criteria establish design limit and ultimate load conditions.

Interaction of Systems and Structures

The Embraer Model 190 series airplane has fly-by-wire flight control systems and other power-operated systems that could affect the structural performance of the airplane, either directly or as a result of a failure or malfunction. These systems can alleviate loads in the airframe and, when in a failure state, can impose loads to the airframe. Currently, part 25 does not adequately account for the direct effects of these systems or for the effects of failure of these systems on structural performance of the airplane. The proposed special conditions provide the criteria to be used in assessing these effects.

Electrical and Electronic Systems Which Perform Critical Functions

The Embraer Model 190 series airplane will have electrical and electronic systems which perform critical functions. The electronic flight control system installations establish the criticality of the electrical power generation and distribution systems, since the loss of all electrical power may be catastrophic to the airplane. The current airworthiness standards of part 25 do not contain adequate or appropriate standards for the protection of the Electronic Flight Control System from the adverse effects of operations without normal electrical power. Accordingly, this system is considered to be a novel or unusual design feature, and special conditions are proposed to retain the level of safety envisioned by § 25.1351(d).

Section 25.1351(d), “Operation without normal electrical power,” requires safe operation in visual flight rule (VFR) conditions for at least five minutes without normal power. This rule was structured around a traditional design utilizing mechanical control cables for flight control surfaces and the pilot controls. Such traditional designs enable the flightcrew to maintain control of the airplane, while providing time to sort out the electrical failure, start engines if necessary, and re-establish some of the electrical power generation capability.

The Embraer Model 190 series airplane, however, will utilize an Electronic Flight Control System for the pitch and yaw control (elevator, stabilizer, and rudder). There is no mechanical linkage between the pilot controls and these flight control surfaces. Pilot control inputs are converted to electrical signals, which are processed and then transmitted via wires to the control surface actuators. At the control surface actuators, the electrical signals are converted to an actuator command to move the control surface.

In order to maintain the same level of safety as an airplane with conventional flight controls, an airplane with electronic flight controls—such as the Embraer Model 190 series—must not be time limited in its operation, including being without the normal source of electrical power generated by the engine or the Auxiliary Power Unit (APU) generators.

Service experience has shown that the loss of all electrical power generated by the airplane's engine generators or APU is not extremely improbable. Thus, it must be demonstrated that the airplane can continue safe flight and landing (including steering and braking on ground for airplanes using steer/brake-by-wire) after total loss of normal electrical power with the use of its emergency electrical power systems. These emergency electrical power systems must be able to power loads that are essential for continued safe flight and landing.

Electronic Flight Control System

In airplanes with Electronic Flight Control Systems, there may not always be a direct correlation between pilot control position and the associated airplane control surface position. Under certain circumstances, a commanded maneuver that does not require a large control input may require a large control surface movement, possibly encroaching on a control surface or actuation system limit without the flightcrew's knowledge. This situation can arise in either manually piloted or autopilot flight and may be further exacerbated on airplanes where the pilot controls are not back-driven during autopilot system operation. Unless the flightcrew is made aware of excessive deflection or impending control surface limiting, control of the airplane by the pilot or autoflight system may be inadvertently continued so as to cause loss of control of the airplane or other unsafe characteristics of stability or performance.

Given these possibilities, a special condition for Embraer Model ERJ 190 series airplanes addresses control surface position awareness. This special condition requires that suitable display or annunciation of flight control position be provided to the flightcrew when near full surface authority (not crew-commanded) is being used, unless other existing indications are found adequate or sufficient to prompt any required crew actions. Suitability of such a display or annunciation must take into account that some piloted maneuvers may demand the airplane's maximum performance capability, possibly associated with a full control surface deflection. Therefore, simple display systems—that would function in both intended and unexpected control-limiting situations—must be properly balanced between providing needed crew awareness and minimizing nuisance alerts.

Automatic Takeoff Thrust Control System

The Embraer Model ERJ 190 series airplane will incorporate an Automatic Takeoff Thrust Control System (ATTCS) in the engine's Full Authority Digital Electronic Control (FADEC) system architecture. The manufacturer requested that the FAA issue special conditions to allow performance credit to be taken for use of this function during go-around to show compliance with the requirement of § 25.121(d) regarding the approach climb gradient.

Section 25.904 and Appendix I refer to operation of ATTCS only during takeoff. Model ERJ 190 series airplanes have this feature for go-around also. The ATTCS will automatically increase thrust to the maximum go-around thrust available under the ambient conditions in the following circumstances:

• If an engine failure occurs during an all-engines-operating go-around, or
• If an engine has failed or been shut down earlier in the flight.

This maximum go-around thrust is the same as that used to show compliance with the approach-climb-gradient requirement of § 25.121(d). If the ATTCS is not operating, selection of go-around thrust will result in a lower thrust level.

The part 25 standards for ATTCS, contained in § 25.904 [Automatic takeoff thrust control system (ATTCS) and Appendix I], specifically restrict performance credit for ATTCS to takeoff. Expanding the scope of the standards to include other phases of flight, such as go-around, was considered when the standards were issued but was not accepted because of the effect on the flightcrew's workload. As stated in the preamble to Amendment 25-62:

In regard to ATTCS credit for approach climb and go-around maneuvers, current regulations preclude a higher thrust for the approach climb [§ 25.121(d)] than for the landing climb [§ 25.119]. The workload required for the flightcrew to monitor and select from multiple in-flight thrust settings in the event of an engine failure during a critical point in the approach, landing, or go-around operations is excessive. Therefore, the FAA does not agree that the scope of the amendment should be changed to include the use of ATTCS for anything except the takeoff phase. (Refer to 52 FR 43153, November 9, 1987.)

The ATTCS incorporated on Embraer Model ERJ 190 series airplanes allows the pilot to use the same power setting procedure during a go-around, regardless of whether or not an engine fails. In either case, the pilot obtains go-around power by moving the throttles into the forward (takeoff/go-around) throttle detent. Since the ATTCS is permanently armed for the go-around phase, it will function automatically following an engine failure and advance the remaining engine to the ATTCS thrust level. This design adequately addresses the concerns about pilot workload which were discussed in the preamble to Amendment 25-62.

The system design allows the pilot to enable or disable the ATTCS function for takeoff. If the pilot enables ATTCS, a white “ATTCS” icon will be displayed on the Engine Indication and Crew Alerting System (EICAS) beneath the thrust mode indication on the display. This white icon indicates to the pilot that the ATTCS function is enabled. When the throttle lever is put in the TO/GA (takeoff/go-around) detent position, the white icon turns green, indicating to the pilot that the ATTCS is armed. If the pilot disables the ATTCS function for takeoff, no indication appears on the EICAS.

Regardless of whether the ATTCS is enabled for takeoff, it is automatically enabled when the airplane reaches the end of the take-off phase (that is, the thrust lever is below the TO/GA position and the altitude is greater than 1,700 feet above the ground, 5 minutes have elapsed since lift-off, or the airplane speed is greater than 140 knots).

During climb, cruise, and descent, when the throttle is not in the TO/GA position, the ATTCS indication is inhibited. During descent and approach to land, until the thrust management system go-around mode is enabled—either by crew action or automatically when the landing gear are down and locked and flaps are extended—the ATTCS indication remains inhibited.

When the go-around thrust mode is enabled, unless the ATTCS system has failed, the white “ATTCS” icon will again be shown on the EICAS, indicating to the pilot that the system is enabled and in an operative condition in the event a go-around is necessary. If the thrust lever is subsequently placed in the TO/GA position, the ATTCS icon turns green, indicating that the system is armed and ready to operate.

If an engine fails during the go-around or during a one-engine-inoperative go-around in which an engine had been shut down or otherwise made inoperative earlier in the flight, the EICAS indication will be GA RSV (go-around reserve) when the thrust levers are placed in the TO/GA position. The GA RSV indication means that the maximum go-around thrust under the ambient conditions has been commanded.

The propulsive thrust used to determine compliance with the approach climb requirements of § 25.121(d) is limited to the lesser of (i) the thrust provided by the ATTCS system, or (ii) 111 percent of the thrust resulting from the initial thrust setting with the ATTCS system failing to perform its uptrim function and without action by the crew to reset thrust. This requirement limits the adverse performance effects of a failure of the ATTCS and ensures adequate all-engines-operating go-around performance.

These special conditions require a showing of compliance with the provisions of § 25.904 and Appendix I applicable to the approach climb and go-around maneuvers.

The definition of a critical time interval for the approach climb case is of primary importance. During this time, it must be extremely improbable to violate a flight path derived from the gradient requirement of § 25.121(d). That gradient requirement implies a minimum one-engine-inoperative flight path with the airplane in the approach configuration. The engine may have been inoperative before initiating the go-around, or it may become inoperative during the go-around. The definition of the critical time interval must consider both possibilities.

Protection From Effects of HIRF

As noted earlier, Embraer Model ERJ 190 series airplanes will include an Electronic Flight Control System as well as advanced avionics for the display and control of critical airplane functions. These systems may be vulnerable to high-intensity radiated fields (HIRF) external to the airplane. The current airworthiness standards of part 25 do not contain adequate or appropriate safety standards that address the protection of this equipment from the adverse effects of HIRF. Accordingly, these systems are considered to be novel or unusual design features.

There is no specific regulation that addresses protection requirements for electrical and electronic systems from HIRF. Increased power levels from ground-based radio transmitters and the growing use of sensitive avionics/electronics and electrical systems to command and control airplanes have made it necessary to provide adequate protection.

To ensure that a level of safety is achieved that is equivalent to that intended by the applicable regulations, special conditions are needed for the Embraer Model ERJ 190 series airplanes. These special conditions require that avionics/electronics and electrical systems that perform critical functions be designed and installed to preclude component damage and interruption of function due to both the direct and indirect effects of HIRF.

With the trend toward increased power levels from ground-based transmitters and the advent of space and satellite communications coupled with electronic command and control of the airplane, the immunity of critical avionics/electronics and electrical systems to HIRF must be established.

It is not possible to precisely define the HIRF to which the airplane will be exposed in service. There is also uncertainty concerning the effectiveness of airframe shielding for HIRF. Furthermore, coupling of electromagnetic energy to cockpit-installed equipment through the cockpit window apertures is undefined. Based on surveys and analysis of existing HIRF emitters, an adequate level of protection exists when compliance with the HIRF protection special condition is shown in accordance with either paragraph 1 or 2 below:

1. A minimum threat of 100 volts rms (root-mean-square) per meter electric field strength from 10 KHz to 18 GHz.

a. The threat must be applied to the system elements and their associated wiring harnesses without the benefit of airframe shielding.

b. Demonstration of this level of protection is established through system tests and analysis.

2. A threat external to the airframe of the field strengths indicated in the table below for the frequency ranges indicated. Both peak and average field strength components from the table are to be demonstrated.

Frequency	Field strength (volts per meter)
	Peak	Average
10 kHz-100 kHz	50	50
100 kHz-500 kHz	50	50
500 kHz-2 MHz	50	50
2 MHz-30 MHz	100	100
30 MHz-70 MHz	50	50
70 MHz-100 MHz	50	50
100 MHz-200 MHz	100	100
200 MHz-400 MHz	100	100
400 MHz-700 MHz	700	50
700 MHz-1 GHz	700	100
1 GHz-2 GHz	2000	200
2 GHz-4 GHz	3000	200
4 GHz-6 GHz	3000	200
6 GHz-8 GHz	1000	200
8 GHz-12 GHz	3000	300
12 GHz-18 GHz	2000	200
18 GHz-40 GHz	600	200

The field strengths are expressed in terms of peak of the root-mean-square (rms) over the complete modulation period.

The threat levels identified above are the result of an FAA review of existing studies on the subject of HIRF, in light of the ongoing work of the Electromagnetic Effects Harmonization Working Group of the Aviation Rulemaking Advisory Committee.

Discussion of Comments

Notice of Proposed Special Conditions No. 25-05-05-SC for the Embraer Model ERJ 190 series airplane was published in the Federal Register dated May 25, 2005 (70 FR 30020). Two comments indicating minor errors in the proposed special conditions were received from Embraer.

One comment points out an error in the table on page 30023 of the Notice of Proposed Special Conditions. The average level for 1 GHz-2 GHz is shown as 2000 rather than as 200 volts per meter. The FAA has determined that the correct value should be 200 volts per meter and, accordingly, has corrected the table in these final special conditions.

The second comment indicates an error on page 30025. The first sentence of Paragraph 2.c.(1)(i) says “For static strength substantiation, these loads multiplied by an appropriate factor of safety that is related to the probability of occurrence of the failure of the ultimate loads to be considered for design.”

That sentence should say “For static strength substantiation, these loads multiplied by an appropriate factor of safety that is related to the probability of occurrence of the failure are ultimate loads to be considered for design.” The FAA has determined that the proposed wording was incorrect and has corrected it in these final special conditions. (We also corrected a typographical error in the following sentence by removing the letter “I.”)

Applicability

As discussed above, these special conditions are applicable to the Embraer ERJ 190 series airplane. Should Embraer apply at a later date for a change to the type certificate to include another model incorporating the same novel or unusual design features, these special conditions would apply to that model as well under the provisions of § 21.101.

Conclusion

This action affects only certain novel or unusual design features of the Embraer ERJ 190 series airplane. This is not a rule of general applicability.

List of Subjects in 14 CFR Part 25

• Aircraft
• Aviation safety
• Reporting and recordkeeping requirements

The authority citation for these special conditions is as follows:

Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.

The Special Conditions

Accordingly, pursuant to the authority delegated to me by the Administrator, the Federal Aviation Administration (FAA) issues the following special conditions as part of the type certification basis for the Embraer ERJ 190 series airplane.

Sudden Engine Stoppage

In lieu of compliance with § 25.361(b) the following special condition applies:

1. For turbine engine installations, the engine mounts, pylons and adjacent supporting airframe structure must be designed to withstand 1g level flight loads acting simultaneously with the maximum limit torque loads imposed by each of the following:

a. Sudden engine deceleration due to a malfunction which could result in a temporary loss of power or thrust; and

b. The maximum acceleration of the engine.

2. For auxiliary power unit installations, the power unit mounts and adjacent supporting airframe structure must be designed to withstand 1g level flight loads acting simultaneously with the maximum limit torque loads imposed by each of the following:

a. Sudden auxiliary power unit deceleration due to malfunction or structural failure; and

b. The maximum acceleration of the power unit.

3. For engine supporting structures, an ultimate loading condition must be considered that combines 1g flight loads with the transient dynamic loads resulting from:

a. The loss of any fan, compressor, or turbine blade; and

b. Separately, where applicable to a specific engine design, any other engine structural failure that results in higher loads.

4. The ultimate loads developed from the conditions specified in paragraphs 3.a. and 3.b. above are to be multiplied by a factor of 1.0 when applied to engine mounts and pylons and multiplied by a factor of 1.25 when applied to adjacent supporting airframe structure.

Interaction of Systems and Structures

In addition to the requirements of part 25, subparts C and D, the following special condition applies:

1. General. For airplanes equipped with systems that affect structural performance, either directly or as a result of a failure or malfunction, the influence of these systems and their failure conditions must be taken into account when showing compliance with the requirements of 14 CFR part 25, subparts C and D. The following criteria must be used to evaluate the structural performance of airplanes equipped with flight control systems, autopilots, stability augmentation systems, load alleviation systems, “flutter” control systems, and fuel management systems. If these criteria are used for other systems, it may be necessary to adapt the criteria to the specific system.

a. The criteria defined herein address only the direct structural consequences of the system responses and performances and cannot be considered in isolation but should be included in the overall safety evaluation of the airplane. These criteria may in some instances duplicate standards already established for this evaluation. These criteria are applicable only to structures whose failure could prevent continued safe flight and landing. Specific criteria that define acceptable limits on handling characteristics or stability requirements when operating in the system degraded or inoperative mode are not provided in this special condition.

b. Depending upon the specific characteristics of the airplane, additional studies that go beyond the criteria provided in this special condition may be required in order to demonstrate the capability of the airplane to meet other realistic conditions, such as alternative gust or maneuver descriptions for an airplane equipped with a load alleviation system.

c. The following definitions are applicable to this special condition:

Structural performance: Capability of the airplane to meet the structural requirements of 14 CFR part 25.

Flight limitations: Limitations that can be applied to the airplane flight conditions following an in-flight occurrence and that are included in the flight manual (e.g., speed limitations, avoidance of severe weather conditions, etc.).

Operational limitations: Limitations, including flight limitations, that can be applied to the airplane operating conditions before dispatch (e.g., fuel and payload limitations).

Probabilistic terms: The probabilistic terms (probable, improbable, extremely improbable) used in this special condition are the same as those used in 14 CFR 25.1309.

Failure condition: The term failure condition is the same as that used in 14 CFR 25.1309; however, this special condition applies only to system failure conditions that affect the structural performance of the airplane (e.g., failure conditions that induce loads, lower flutter margins, or change the response of the airplane to inputs, such as gusts or pilot actions).

2. Effects of Systems on Structures.

a. General. The following criteria will be used in determining the influence of a system and its failure conditions on the airplane structure.

b. System fully operative. With the system fully operative, the following apply:

(1) Limit loads must be derived in all normal operating configurations of the system from all the limit conditions specified in 14 CFR part 25, Subpart C, taking into account any special behavior of such a system or associated functions or any effect on the structural performance of the airplane that may occur up to the limit loads. In particular, any significant nonlinearity (rate of displacement of control surface, thresholds, or any other system nonlinearities) must be accounted for in a realistic or conservative way when deriving limit loads from limit conditions.

(2) The airplane must meet the strength requirements of 14 CFR part 25 (static strength, residual strength) using the specified factors to derive ultimate loads from the limit loads defined above. The effect of nonlinearities must be investigated beyond limit conditions to ensure the behavior of the system presents no anomaly compared to the behavior below limit conditions. However, conditions beyond limit conditions need not be considered when it can be shown that the airplane has design features that will not allow it to exceed those limit conditions.

(3) The airplane must meet the aeroelastic stability requirements of 14 CFR 25.629.

c. System in the failure condition. For any system failure condition not shown to be extremely improbable, the following apply:

(1) At the time of occurrence. Starting from l-g level flight conditions, a realistic scenario, including pilot corrective actions, must be established to determine the loads occurring at the time of failure and immediately after failure.

(i) For static strength substantiation, these loads multiplied by an appropriate factor of safety that is related to the probability of occurrence of the failure are ultimate loads to be considered for design. The factor of safety (FS) is defined in figure 1.

(ii) For residual strength substantiation, the airplane must be able to withstand two-thirds of the ultimate loads defined in subparagraph (c)(1)(i).

(iii) Freedom from aeroelastic instability must be shown up to the speeds defined in 14 CFR 25.629(b)(2). For failure conditions that result in speed increases beyond V_c/M_c, freedom from aeroelastic instability must be shown to increased speeds, so that the margins intended by 14 CFR 25.629(b)(2) are maintained.

(iv) Failures of the system that result in forced structural vibrations (oscillatory failures) must not produce loads that could result in detrimental deformation of primary structure.

(2) For the continuation of the flight. For the airplane, in the system-failed state and considering any appropriate reconfiguration and flight limitations, the following apply:

(i) The loads derived from the following conditions at speeds up to V_c or the speed limitation prescribed for the remainder of the flight must be determined:

(A) The limit symmetrical maneuvering conditions specified in 14 CFR 25.331 and 25.345.

(B) The limit gust and turbulent conditions specified in 14 CFR 25.341 and 25.345.

(C) The limit rolling conditions specified in 14 CFR 25.349 and the limit unsymmetrical conditions specified in 14 CFR 25.367 and 25.427(b) and (c).

(D) The limit yaw maneuvering conditions specified in 14 CFR 25.351.

(E) The limit ground loading conditions specified in 14 CFR 25.473 and 25.491.

(ii) For static strength substantiation, each part of the structure must be able to withstand the loads specified in paragraph (2)(i) above multiplied by a factor of safety depending on the probability of being in this failure state. The factor of safety is defined in figure 2.

Qj = (Tj)(Pj) where:

Tj = Average time spent in failure condition j (in hours)

Pj = Probability of occurrence of failure mode j (per hour)

Note:

If Pj is greater than 10^-3 per flight hour, then a 1.5 factor of safety must be applied to all limit load conditions specified in 14 CFR 25, Subpart C.

(iii) For residual strength substantiation, the airplane must be able to withstand two-thirds of the ultimate loads defined in paragraph (c)(2)(ii) above.

(iv) If the loads induced by the failure condition have a significant effect on fatigue or damage tolerance then their effects must be taken into account.

(v) Freedom from aeroelastic instability must be shown up to a speed determined from figure 3. Flutter clearance speeds V′ and V″ may be based on the speed limitation specified for the remainder of the flight using the margins defined by 14 CFR 25.629(b).

V′ = Clearance speed as defined by 14 CFR 25.629(b)(2)

V″ = Clearance speed as defined by 14 CFR 25.629(b)(1)

Qj = (Tj)(Pj) where:

Tj = Average time spent in failure condition j (in hours)

Pj = Probability of occurrence of failure mode j (per hour)

Note:

If Pj is greater than 10^-3 per flight hour, then the flutter clearance speed must not be less than V″.

(vi) Freedom from aeroelastic instability must also be shown up to V′ in figure 3 above for any probable system failure condition combined with any damage required or selected for investigation by 14 CFR 25.571(b).

(3) Consideration of certain failure conditions may be required by other sections of 14 CFR 25, regardless of calculated system reliability. Where analysis shows the probability of these failure conditions to be less than 10⁻⁹, criteria other than those specified in this paragraph may be used for structural substantiation to show continued safe flight and landing.

d. Warning considerations. For system failure detection and warning, the following apply:

(1) The system must be checked for failure conditions, not extremely improbable, that degrade the structural capability below the level required by 14 CFR part 25 or significantly reduce the reliability of the remaining system. The flight crew must be made aware of these failures before flight. Certain elements of the control system, such as mechanical and hydraulic components, may use special periodic inspections, and electronic components may use daily checks in lieu of warning systems to achieve the objective of this requirement. These certification maintenance requirements must be limited to component failures that are not readily detectable by normal warning systems and where service history shows that inspections will provide an adequate level of safety.

(2) The existence of any failure condition not extremely improbable during flight—that could significantly affect the structural capability of the airplane and for which the associated reduction in airworthiness can be minimized by suitable flight limitations—must be signaled to the flight crew. For example, failure conditions that result in a factor of safety between the airplane strength and the loads of 14 CFR part 25, subpart C below 1.25 or flutter margins below V” must be signaled to the crew during flight.

e. Dispatch with known failure conditions. If the airplane is to be dispatched in a known system failure condition that affects structural performance or affects the reliability of the remaining system to maintain structural performance, then the provisions of this special condition must be met for the dispatched condition and for subsequent failures. Flight limitations and expected operational limitations may be taken into account in establishing Qj as the combined probability of being in the dispatched failure condition and the subsequent failure condition for the safety margins in figures 2 and 3. These limitations must be such that the probability of being in this combined failure state and then subsequently encountering limit load conditions is extremely improbable. No reduction in these safety margins is allowed if the subsequent system failure rate is greater than 10^-3 per flight hour.

Operation Without Normal Electrical Power

In lieu of compliance with 14 CFR 25.1351(d), the following special condition applies:

It must be demonstrated by test or by a combination of test and analysis that the airplane can continue safe flight and landing with inoperative normal engine and APU generator electrical power (in other words without electrical power from any source, except the battery and any other standby electrical sources). The airplane operation should be considered at the critical phase of flight and include the ability to restart the engines and maintain flight for the maximum diversion time capability being certified.

Electronic Flight Control System

In addition to compliance with §§ 25.143, 25.671 and 25.672, when a flight condition exists where, without being commanded by the crew, control surfaces are coming so close to their limits that return to the normal flight envelope and (or) continuation of safe flight requires a specific crew action, a suitable flight control position annunciation shall be provided to the crew, unless other existing indications are found adequate or sufficient to prompt that action.

Note:

The term suitable also indicates an appropriate balance between nuisance and necessary operation.

Automatic Takeoff Thrust Control System (ATTCS)

To use the thrust provided by the ATTCS to determine the approach climb performance limitations, the Embraer Model ERJ 190 series airplane must comply with the requirements of § 25.904 and Appendix I, including the following requirements pertaining to the go-around phase of flight:

1. Definitions

a. TOGA—(Take Off/Go-Around). Throttle lever in takeoff or go-around position.

b. Automatic Takeoff Thrust Control System—(ATTCS). The Embraer Model ERJ-190 series ATTCS is defined as the entire automatic system available in takeoff when selected by the pilot and always in go-around mode, including all devices, both mechanical and electrical, that sense engine failure, transmit signals, and actuate fuel controls or power levers or increase engine power by other means on operating engines to achieve scheduled thrust or power increases and to furnish cockpit information on system operation.

c. Critical Time Interval. The definition of the Critical Time Interval in Appendix I, § I25.2(b) is expanded to include the following:

(1) When conducting an approach for landing using ATTCS, the critical time interval is defined as 120 seconds. A shorter time interval may be used if justified by a rational analysis. An accepted analysis that has been used on past aircraft certification programs is as follows:

(i) The critical time interval begins at a point on a 2.5 degree approach glide path from which, assuming a simultaneous engine and ATTCS failure, the resulting approach climb flight path intersects a flight path originating at a later point on the same approach path corresponding to the part 25 one-engine-inoperative approach climb gradient. The period of time from the point of simultaneous engine and ATTCS failure to the intersection of these flight paths must be no shorter than the time interval used in evaluating the critical time interval for takeoff, beginning from the point of simultaneous engine and ATTCS failure and ending upon reaching a height of 400 feet.

(ii) The critical time interval ends at the point on a minimum performance, all-engines-operating go-around flight path from which, assuming a simultaneous engine and ATTCS failure, the resulting minimum approach climb flight path intersects a flight path corresponding to the part 25 minimum one-engine-inoperative approach-climb-gradient. The all-engines-operating go-around flight path and the part 25 one-engine-inoperative, approach-climb-gradient flight path originate from a common point on a 2.5 degree approach path. The period of time from the point of simultaneous engine and ATTCS failure to the intersection of these flight paths must be no shorter than the time interval used in evaluating the critical time interval for the takeoff, beginning from the point of simultaneous engine and ATTCS failure and ending upon reaching a height of 400 feet.

(2) The critical time interval must be determined at the altitude resulting in the longest critical time interval for which one-engine-inoperative approach climb performance data are presented in the Airplane Flight Manual (AFM).

(3) The critical time interval is illustrated in the following figure:

The engine and ATTCS failed time interval must be no shorter than the time interval from the point of simultaneous engine and ATTCS failure to a height of 400 feet used to comply with I25.2(b) for ATTCS use during takeoff.

2. Performance and System Reliability Requirements

The applicant must comply with the following performance and ATTCS reliability requirements:

a. An ATTCS failure or combination of failures in the ATTCS during the critical time interval:

(1) Shall not prevent the insertion of the maximum approved go-around thrust or power or must be shown to be an improbable event.

(2) Shall not result in a significant loss or reduction in thrust or power or must be shown to be an extremely improbable event.

b. The concurrent existence of an ATTCS failure and an engine failure during the critical time interval must be shown to be extremely improbable.

c. All applicable performance requirements of part 25 must be met with an engine failure occurring at the most critical point during go-around with the ATTCS system functioning.

d. The probability analysis must include consideration of ATTCS failure occurring after the time at which the flightcrew last verifies that the ATTCS is in a condition to operate until the beginning of the critical time interval.

e. The propulsive thrust obtained from the operating engine after failure of the critical engine during a go-around used to show compliance with the one-engine-inoperative climb requirements of § 25.121(d) may not be greater than the lesser of:

(i) The actual propulsive thrust resulting from the initial setting of power or thrust controls with the ATTCS functioning; or

(ii) 111 percent of the propulsive thrust resulting from the initial setting of power or thrust controls with the ATTCS failing to reset thrust or power and without any action by the crew to reset thrust or power.

3. Thrust Setting

a. The initial go-around thrust setting on each engine at the beginning of the go-around phase may not be less than any of the following:

(1) That required to permit normal operation of all safety-related systems and equipment dependent upon engine thrust or power lever position; or

(2) That shown to be free of hazardous engine response characteristics when thrust or power is advanced from the initial go-around position to the maximum approved power setting.

b. For approval of an ATTCS for go-around, the thrust setting procedure must be the same for go-arounds initiated with all engines operating as for go-arounds initiated with one engine inoperative.

4. Powerplant Controls

a. In addition to the requirements of § 25.1141, no single failure or malfunction or probable combination thereof of the ATTCS, including associated systems, may cause the failure of any powerplant function necessary for safety.

b. The ATTCS must be designed to accomplish the following:

(1) Apply thrust or power on the operating engine(s), following any single engine failure during go around, to achieve the maximum approved go-around thrust without exceeding the engine operating limits;

(2) Permit manual decrease or increase in thrust or power up to the maximum go-around thrust approved for the airplane under existing conditions through the use of the power lever. For airplanes equipped with limiters that automatically prevent the engine operating limits from being exceeded under existing ambient conditions, other means may be used to increase the thrust in the event of an ATTCS failure, provided that the means meet the following criteria:

• Are located on or forward of the power levers;
• Are easily identified and operated under all operating conditions by a single action of either pilot with the hand that is normally used to actuate the power levers, and
• Meet the requirements of § 25.777 (a), (b), and (c);

(3) Provide a means for the flightcrew to verify before beginning an approach for landing that the ATTCS is in a condition to operate (unless it can be demonstrated that an ATTCS failure combined with an engine failure during an entire flight is extremely improbable); and

(4) Provide a means for the flightcrew to deactivate the automatic function. This means must be designed to prevent inadvertent deactivation.

5. Powerplant Instruments

In addition to the requirements of § 25.1305, the following requirements must be met:

a. A means must be provided to indicate when the ATTCS is in the armed or ready condition; and

b. If the inherent flight characteristics of the airplane do not provide adequate warning that an engine has failed, a warning system that is independent of the ATTCS must be provided to give the pilot a clear warning of any engine failure during go-around.

Protection From Effects of HIRF

Each electrical and electronic system that performs critical functions must be designed and installed to ensure that the operation and operational capability of these systems to perform critical functions are not adversely affected when the airplane is exposed to high-intensity radiated fields external to the airplane.

For the purpose of this special condition, the following definition applies:

Critical Functions: Functions whose failure would contribute to or cause a failure condition that would prevent the continued safe flight and landing of the airplane.

Issued in Renton, Washington, on August 12, 2005.

Ali Bahrami,

Manager, Transport Airplane Directorate, Aircraft Certification Service.