[Federal Register Volume 59, Number 57 (Thursday, March 24, 1994)]
[Unknown Section]
[Page 0]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 94-6960]


[[Page Unknown]]

[Federal Register: March 24, 1994]


-----------------------------------------------------------------------


DEPARTMENT OF TRANSPORTATION
14 CFR Part 25

[Docket No. NM-91; Special Conditions No. 25-ANM-82]

 

Special Conditions: SAAB Model 2000 Airplane; Interaction of 
Systems and Structures

AGENCY: Federal Aviation Administration, DOT.

action: Final special conditions.

-----------------------------------------------------------------------

SUMMARY: These special conditions are issued for the SAAB Model 2000 
airplane. This airplane will utilize certain fully hydraulically 
powered electronically controlled flight control systems which are 
design features that are novel and unusual when compared to the state 
of technology envisioned in the airworthiness standards of part 25 of 
the Federal Aviation Regulations (FAR). These special conditions 
provide the additional safety standards which the Administrator 
considers necessary to establish a level of safety equivalent to that 
provided by the airworthiness standards of part 25 of the FAR.

EFFECTIVE DATE: April 25, 1994.

FOR FURTHER INFORMATION CONTACT:
Mark I. Quam, FAA, Standardization Branch, ANM-113, Transport Airplane 
Directorate, Aircraft Certification Service, 1601 Lind Avenue SW., 
Renton, Washington 98055-4056; telephone (206) 227-2145.

SUPPLEMENTARY INFORMATION:

Background

    On April 28, 1989, SAAB Aircraft AB of Sweden applied for an FAA 
Type Certification through the Swedish Luftfartsverket (LFV) to the 
FAA, AEU-100, for the SAAB Model 2000 airplane. (The application for 
FAA Type Certificate was dated June 9, 1989.)
    The SAAB Model 2000 is a twin-engined, low-wing, pressurized 
turboprop aircraft that is configured for approximately 50 passengers 
and is intended for short to medium haul (100 nm to 1,000 nm). The 
airplane will have two new Allison GMA-2100 engines rated at 3650 shp. 
The propeller is a new 6 bladed Dowty Rotol swept shaped propeller. A 
single lever controls each prop/engine combination. An Auxiliary Power 
Unit (APU) will be installed in the tail. The fuselage cross-section 
will be the same as the SAAB Model 340. The fuselage skin will be 
thicker to handle greater pressures. The wing and empennage are new and 
larger in all dimensions and the fuselage is longer when compared to 
the SAAB Model SF-340B. The new cockpit will be a 5 or 6 screen CRT 
display with new Collins systems. There will be provisions for a 
Microwave Landing System (MLS), Global Positioning System (GPS), 
Selective Calling (SELCAL), Engine Indicating and Crew Alerting System 
(EICAS), and Traffic Collision and Avoidance System (TCAS). The landing 
gear system will be new. The airplane will have provisions for two 
pilots, an observer, two flight attendants, overhead bins, a toilet, 
and provisions for the installation of a galley. There will be a 
forward and aft stowage compartment and an aft cargo compartment. The 
airplane will have a maximum operating altitude of 31,000 feet.
    The SAAB Model 2000 will have a fully hydraulically powered 
electronically controlled rudder for initial certification and will 
have fully hydraulically powered electronically controlled elevators as 
a follow-on design modification.
    The rudder is hydraulically powered and electronically positioned 
without manual reversion modes. Pilots position the rudder by pedal 
position transducers connected to the rudder pedals. The transducers 
supply rudder pedal position to two electronic rudder control units 
which have two channels each. The rudder control units position two 
rudder servos which control two actuators that drive the rudder. 
Parallel and cross channel signals provide redundancy. The rudder 
limiting function is built into the rudder control units. The rudder 
system is checked by a preflight built in test system (PBIT) and a 
continuous built in test system (CBIT). One pedal force cam unit 
(spring and cam) generates artificial pedal forces. The pedal force cam 
unit is controlled by the trim actuator which in turn is controlled by 
a relay connected to manual trim or automatic trim from the autopilot.
    The rudders two hydraulic actuators are supplied by two hydraulic 
circuits and each circuit is driven by an engine driven pump. To 
protect against common failures including engine burst, fire and tire/
wheel failures, two back-up pumps, two emergency shut-off valves, 
together with a transfer valve, have been added aft of the debris 
zones. The back-up pumps are driven by a common motor with shear out 
features. Accumulators aft on both hydraulic circuits provide further 
reserves against hydraulic power loss and loss of damping.
    The rudder system is electrically supported by two redundant system 
sides, a left hand (LH) and a right hand (RH) side. The electrical 
system is normally powered by two AC generators, each driven by a 
propeller gear box. An APU equipped with a standby generator is 
optional. Each system side includes a DC system with a Transformer 
Rectifier Unit (TRU). When only one TRU unit is working, the LH and RH 
buses are tied together with power being received from the remaining 
TRU. Two DC feeders in addition to two AC feeders provide power aft of 
the debris zone. The DC feeders are supplied by battery or a TRU unit. 
The LH is routed through the ceiling and the RH side is routed through 
the floor.
    The proposed elevator system, to be introduced for follow-on 
certification, is in many respects similar to the rudder design. 
Control columns, connected to Linear Variable Differential Transducers 
(LVDT), provide signals to two Powered Elevator Control Units (PECU). 
The PECUs are connected to the Flight Control Computer, Air Data 
Computers and servo actuators. Each PECU has built in test circuitry 
and two channels for direct control and crossmonitoring.

Type Certification Basis

    The applicable requirements for U.S. type certification must be 
established in accordance with Secs. 21.16, 21.17, 21.19, 21.29, and 
21.101 of the Federal Aviation Regulations (FAR). Accordingly, based on 
the application date of June 9, 1989, the TC basis for the SAAB Model 
2000 airplane is as follows:
    Part 25 as amended by Amendments 25-1 through 25-66, except where 
superseded by the following:

Sec. 25.963(e) as amended by Amendment 25-69, Design Standards for Fuel 
Tank Access Covers.
Sec. 25.1423 as amended by Amendment 25-70, Independent Power Sources 
for the Public Address System.

    Part 25 as amended by Amendment 25-71.

Sec. 25.365, Pressurized Compartment Loads.

    Part 25, the following sections as amended by Amendment 25-72:

Sec. 25.361  Engine torque.
Sec. 25.365  Pressurized compartment loads.
Sec. 25.571  Damage tolerance and fatigue evaluation of structure.
Sec. 25.772  Pilot compartment doors.
Sec. 25.773  Pilot compartment view.
Sec. 25.783(g)  Doors.
Sec. 25.905(d)  Propellers.
Sec. 25.933  Reversing systems.

    Part 25, the following sections as amended by Amendment 25-73:

Sec. 25.903(a)  Engines.
Sec. 25.951(d)  Fuel System--General.

    Part 34, as amended on the date of issuance of the type 
certificate.
    Part 36, as amended on the date of issuance of the type 
certificate.
    Special Conditions No. ANM-25-66, dated 1/12/93, for Lightning and 
HIRF Protection.
    Special conditions, as appropriate, are issued in accordance with 
Sec. 11.49 of the FAR after public notice, as required by Secs. 11.28 
and 11.29(b), and become part of the type certification basis in 
accordance with Sec. 21.101(b)(2).

Discussion

Effect of Flight Control Systems on Structure

    The SAAB Model 2000 incorporates certain fly-by-wire (FBW) 
electronic flight control systems (EFCS). The rudder system includes a 
yaw damper, rudder limiter, and an auto-trim function which can affect 
loads. The follow-on design for the elevators has many similar 
features. System failures can lead to design load conditions not 
envisioned by the certification rules for transport airplanes. These 
special conditions are issued to ensure the same level of safety by 
providing comprehensive criteria in which the structural design safety 
margins are dependent on systems reliability.

Discussion of Comments

    Notice of Proposed Special Conditions No. SC-93-7-NM for the SAAB 
Model 2000 airplane was published in the Federal Register on December 
9, 1993 (58 FR 64700). One commenter (an organization representing 
professional pilots) responded.
    ``Our comments are fundamentally in support of the proposed special 
conditions. However, one commenter is concerned regarding the 
reliability of providing hydraulic power by the two back-up pumps 
mentioned in the `Background' information. This apprehension stems from 
the fact that both back-up pumps are powered from a common motor with 
shear out features. The commenter questioned this system as redundant 
or a single point where the `system' could break down and not provide 
the required hydraulic power necessary to operate the rudder. The 
commenter's concern extends to the elevators if a similar design is 
used.''
    The commenter's concern is addressed in the SAAB 2000 design. The 
SAAB 2000 can be flown without hydraulic power to the rudder for most 
hydraulic failure conditions. However, if during takeoff, one engine 
fails, hydraulic power is necessary to maintain control of the 
airplane. With this in mind, the SAAB design provides the rudder's two 
hydraulic actuators with power from two independent hydraulic circuits. 
One actuator with one functioning circuit is capable of driving the 
rudder if the other hydraulic circuit is lost.
    Each hydraulic circuit is supplied by an engine driven pump, and 
for a short duration, power can also be supplied by accumulators. Each 
circuit is isolated fore and aft by fuses in case the circuits are 
severed by engine debris. Each circuit, aft of the fuse, has a back-up 
pump and an accumulator. The back-up pumps, driven by a common electric 
motor, are activated by low hydraulic pressure in either hydraulic 
circuit. To protect the independence of the two hydraulic circuits and 
to eliminate the single point where the ``system'' could break down, as 
expressed by the commenter, a shear out feature is provided between 
each back-up pump and the common electric motor. As a further 
precaution, the AC motor is automatically started (tested) as part of 
the preflight reliability check.
    Regarding the commenter's concern for the elevator system, that 
system will have three hydraulic systems which have many of the same 
features provided for the hydraulic systems supporting the rudder.

Conclusion

    This action affects only certain unusual or novel design features 
on one model of airplane. It is not a rule of general applicability and 
affects only the manufacturer who applied to the FAA for approval of 
these features on the airplane.

List of Subjects in 14 CFR Part 25

    Air transportation, Aircraft, Aviation safety, Safety.

    The authority citation for these special conditions is as follows:

    Authority: 49 U.S.C. 1344, 1348(c), 1352, 1354(a), 1355, 1421 
through 1431, 1502, 1651(b)(2), 42 U.S.C. 1857f-10, 4321 et seq.; 
E.O. 11514; and 49 U.S.C. 106(g).

Final Special Conditions

    Accordingly, the following special conditions are issued as part of 
the type certification basis for the SAAB Model 2000 airplane:

1. Interaction of Systems and Structures

    (a) General. For an airplane equipped with certain fully 
hydraulically powered electronically controlled flight control systems, 
which directly, or as a result of a failure or malfunction, affect its 
structural performance, the influence of these systems and their 
failure conditions shall be taken into account in showing compliance 
with subparts C and D of part 25 of the Federal Aviation Regulations 
(FAR).
    (b) System fully operative. With the system fully operative, the 
following apply: (1) Limit loads must be derived in all normal 
operating configurations of the systems from all the deterministic 
limit conditions specified in subpart C, taking into account any 
special behavior of such systems or associated functions or any effect 
on the structural performance of the airplane which may occur up to the 
limit loads. In particular, any significant nonlinearity (rate of 
displacement of control surface, thresholds or any other system non-
linearities) must be accounted for in a realistic or conservative way 
when deriving limit loads from limit conditions.
    (2) The airplane must meet the strength requirements of part 25 
(static strength, residual strength), using the specified factors to 
derive ultimate loads from the limit loads defined above. The effect of 
nonlinearities must be investigated beyond limit conditions to ensure 
the behavior of the systems presents no anomaly compared to the 
behavior below limit conditions. However, conditions beyond limit 
conditions need not be considered when it can be shown that the 
airplane has design features that make it impossible to exceed those 
limit conditions.
    (3) The airplane must meet the aeroelastic stability requirements 
of Sec. 25.629.
    (c) System in the failure condition. For any system failure 
condition not shown to be extremely improbable, the following apply:
    (1) At the time of occurrence. Starting from 1-g level flight 
conditions, a realistic scenario, including pilot corrective actions, 
must be established to determine the loads occurring at the time of 
failure and immediately after failure. The airplane must be able to 
withstand these loads, multiplied by an appropriate factor of safety, 
related to the probability of occurrence of the failure. These loads 
should be considered as ultimate loads for this evaluation. The factor 
of safety is defined as follows:

BILLING CODE 4910-13-M

                   Factor of Safety at Time of Occurrence

TR24MR94.004


                    Probability of occurrence (per hour)
BILLING CODE 4910-13-C

    (i) The loads must also be used in the damage tolerance evaluation 
required by Sec. 25.571(b) if the failure condition is probable. The 
loads may be considered as ultimate loads for the damage tolerance 
evaluation.
    (ii) Freedom from flutter and divergence must be shown at speeds up 
to VD, or 1.15 VC, whichever is greater. However, at 
altitudes where the speed is limited by Mach number, compliance need be 
shown only up to MD, as defined by Sec. 25.335(b). For failure 
conditions which result in speed increases beyond VC/MC, 
freedom from flutter and divergency must be shown at increased speeds, 
so that the above margins are maintained.
    (iii) Notwithstanding subparagraph (1) of this paragraph, failures 
of the system which result in forced structural vibrations (oscillatory 
failures) must not produce peak loads that could result in permanent 
deformation of primary structure.
    (2) For the continuation of the flight. For the airplane, in the 
failed configuration and considering any appropriate flight 
limitations, the following apply: (i) Static and residual strength must 
be determined for loads induced by the failure condition if the loads 
could continue to the end of the flight. These loads must be combined 
with the deterministic limit load conditions specified in subpart C.
    (ii) For static strength substantiation, each part of the structure 
must be able to withstand the loads in subparagraph (2)(i) of this 
paragraph multiplied by a safety factor depending on the probability of 
being in this failure state. The factor of safety is defined as 
follows:

BILLING CODE 4910-13-M

                 Factor of Safety for Continuation of Flight

TR24MR94.005


              Qj--Probability of being in failure state j

BILLING CODE 4910-13-C

Qj=Tj*Pj where:
Tj=Average time spent in failure condition
Pj=Probability of occurrence of failure mode

    Note: If Pj is greater than 10-3, per flight hour then 
a safety factor of 1.5 must be used.

    (iii) For residual strength substantiation as defined in 
Sec. 25.571(b), for structures also affected by failure of the system 
and with damage in combination with the system failure, a reduction 
factor may be applied to the residual strength loads of Sec. 25.571(b). 
However, the residual strength level must not be less than the 1-g 
flight load combined with the loads introduced by the failure condition 
plus two-thirds of the load increments of the conditions specified in 
Sec. 25.571(b) in both positive and negative directions (if 
appropriate). The reduction factor is defined as follows:

BILLING CODE 4910-13-M

                     Residual Strength Reduction Factor

TR24MR94.006


BILLING CODE 4910-13-C

Qj=Tj*Pj where:
Tj=Average time spent in failure condition
Pj=Probability of occurrence of failure mode

    Note: If Pj is greater than 10-3, per flight hour then 
a safety factor of 1.0 must be used.

    (iv) Freedom from flutter and divergence must be shown up to a 
speed determined by the following figure:

BILLING CODE 4910-13-M

                           Flutter Clearance Speed

TR24MR94.007

BILLING CODE 4910-13-C

V1=VD or 1.15 VC whichever is greater.
V2=Flutter clearance speed required for normal (unfailed) 
conditions by Sec. 25.629.
Qj=Tj*Pj where:
    Tj=Average time spent in failure condition
    Pj=Probability of occurrence of failure mode

    Note: If Pj is greater than 10-3, then the flutter 
clearance speed must not be less than V2.

    (v) Freedom from flutter and divergence must also be shown up to 
V1 in the above figure, for any probable system failure condition 
combined with any damage required or selected for investigation by 
Sec. 25.571(b).
    (vi) If the time likely to be spent in the failure condition is not 
small compared to the damage propagation period, or if the loads 
induced by the failure condition may have a significant influence on 
the damage propagation, then the effects of the particular failure 
condition must be addressed and the corresponding inspection intervals 
adjusted to adequately cover this situation.
    (vii) If the mission analysis method is used to account for 
continuous turbulence, all the systems failure conditions associated 
with their probability must be accounted for in a rational or 
conservative manner in order to ensure that the probability of 
exceeding the limit load is not higher than the prescribed value of the 
current requirement.
    (d) Warning considerations. For system failure detection and 
warning, the following apply: (1) Before flight, the system must be 
checked for failure conditions, not extremely improbable, that degrade 
the structural capability below the level as intended in paragraph (b) 
of this special condition. The crew must be made aware of these 
failures, if they exist, before flight.
    (2) An evaluation must be made of the necessity to signal, during 
the flight, the existence of any failure condition which could 
significantly affect the structural capability of the airplane and for 
which the associated reduction in airworthiness can be minimized by 
suitable flight limitations. The assessment of the need for such 
signals must be carried out in a manner consistent with the approved 
general warning philosophy for the airplane.
    (3) During flight, any failure condition, not shown to be extremely 
improbable, in which the safety factor existing between the airplane 
strength capability and loads induced by the deterministic limit 
conditions of Subpart C of part 25 is reduced to 1.3 or less must be 
signaled to the crew if appropriate procedures and limitations can be 
provided so that the crew can take action to minimize the associated 
reduction in airworthiness during the remainder of the flight.
    (e) Dispatch with failure conditions. If the airplane is to be 
knowingly dispatched in a system failure condition that reduces the 
structural performance, then operational limitations must be provided 
whose effects combined with those of the failure condition allow the 
airplane to meet the structural requirements as described in paragraph 
(b) of this special condition. Subsequent system failures must also be 
considered.
    Discussion: This special condition is intended to be applicable to 
certain fully hydraulically powered electronically controlled flight 
controls. The criteria provided by the special condition only address 
the direct structural consequences of the systems responses and 
performances and therefore cannot be considered in isolation but should 
be included into the overall safety evaluation of the airplane. The 
presentation of these criteria may in some instances duplicate 
standards already established for this evaluation. The criteria are 
applicable to structure, the failure of which could prevent continued 
safe flight and landing.
    The following definitions are applicable to this special condition:

1. Structural performance: Capability of the airplane to meet the 
requirements of part 25.
2. Flight limitations: Limitations which can be applied to the airplane 
flight conditions following an inflight occurrence and which are 
included in the flight manual (e.g., speed limitations, avoidance of 
severe weather conditions, etc.).
3. Operational limitations: Limitations, including flight limitations, 
which can be applied to the airplane operating conditions before 
dispatch (e.g., payload limitations).
4. Probabilistic terms: The probabilistic terms (probable, improbable, 
extremely improbable) used in this special condition should be 
understood as defined in AC 25.1309-1.
5. Failure condition: The term failure condition is defined in AC 
25.1309-1, however this special condition applies only to system 
failure conditions which have a direct impact on the structural 
performance of the airplane (e.g., failure conditions which induce 
loads or change the response of the airplane to inputs such as gusts or 
pilot actions).

    Issued in Renton, Washington, on March 11, 1994.
Darrell M. Pederson,
Acting Manager, Transport Airplane Directorate, Aircraft Certification 
Service, ANM-100.
[FR Doc. 94-6960 Filed 3-23-94; 8:45 am]
BILLING CODE 4910-13-M