[Federal Register Volume 61, Number 94 (Tuesday, May 14, 1996)]
[Rules and Regulations]
[Pages 24208-24212]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 96-2086]



-----------------------------------------------------------------------


DEPARTMENT OF TRANSPORTATION
14 CFR Part 25

[Docket No. NM-121, Special Conditions No. 25-ANM-113]


Special Conditions: Cessna Aircraft Model 750 Airplanes; 
Operation With Fly-by-Wire Rudder

AGENCY: Federal Aviation Administration, DOT.

ACTION: Final special conditions.

-----------------------------------------------------------------------

SUMMARY: These special conditions are issued for the Cessna Aircraft 
Model 750 airplane. This airplane will have novel and unusual design 
features, relating to its electronic rudder flight control system, when 
compared to the state of technology envisioned in the airworthiness 
standards of part 25 of the Federal Aviation Regulations (FAR). These 
special conditions contain the additional safety standards that the 
Administrator considers necessary to establish a level of safety 
equivalent to that provided by the airworthiness standards of part 25.

EFFECTIVE DATE: May 1, 1996.

FOR FURTHER INFORMATION CONTACT:
Mark I. Quam, FAA, Standardization Branch, ANM-113, Transport Standards 
Staff, Transport Airplane Directorate, Aircraft Certification Service, 
1601 Lind Avenue SW., Renton, Washington 98055-4056; telephone (206) 
227-2145, facsimile (206) 227-1149.

SUPPLEMENTARY INFORMATION:

Background

    On October 15, 1991, Cessna Aircraft Company (Cessna), 6030 Cessna 
Blvd., P.O. Box 7704, Wichita, KS 67277-7704, applied for a new type 
certificate in the transport airplane category for the Model 750 
(Citation X) airplane. The Cessna 750 is a twin-engine, swept-wing 
business jet aircraft that is configured for approximately 8-12 
passengers. The airplane has two Allison Engine Company AE 3007C 
turbofan engines rated at 6400 pounds of sea level, static takeoff 
thrust. The airplane has a maximum operating altitude of 51,000 feet 
and a range of approximately 3300 nautical miles.

[[Page 24209]]

    The Cessna 750 has a yaw control system provided by a lower rudder 
and an upper rudder. Each rudder surface has an independent full-time 
control system, except that they share mechanical input at the rudder 
pedals. The lower surface is controlled by mechanical input to 
hydraulically-powered actuators. The upper surface is electronically 
controlled.
    The lower rudder is positioned by two identical power control units 
(PCUs) installed one above the other, in parallel, in the vertical fin. 
The PCUs are each powered by an independent hydraulic system. Both the 
pilot and co-pilot rudder pedals are connected to the PCUs through 
conventional \1/8\'' diameter stainless steel cables, bellcranks, and 
PCU input bungees. Dual mechanical load paths are provided from the 
input sector to the PCUs to ensure that no single mechanical disconnect 
can result in loss of both rudder pedal and electric trim input to the 
PCUs. Rudder pedal travel of +/- 2.9 inches provides a maximum lower 
rudder deflection of +/- 30 degrees. The lower rudder system has dual 
rudder authority limiters designed to limit deflection, depending on 
the airplane's dynamic pressure. The purpose of the rudder limiter is 
to protect the airplane structure against overload. Both rudder 
authority limiters, each controlled by an independent rudder limit 
module, operate simultaneously so that a failure of one system will not 
allow the lower rudder to deflect to an unwanted position. Dual yaw 
damper actuators are linked in series to the lower rudder system to 
provide Dutch roll damping and turn coordination.
    The upper rudder is driven electrically by the stand-alone yaw 
stability augmentation systems (YSAS) which consist of two identical 
systems. Each YSAS consists of a yaw stability augmentation computer 
(YSAC), two dual rotary variable transformer (RVT) sensors, and a servo 
motor which is a part of an electromechanical actuator (EMA). Either 
one of two YSASs continuously provides Dutch roll damping of the 
airplane, as well as tracking of the upper rudder to the mechanical 
command from the rudder pedals through electronic sensing of the rudder 
pedal torque tube position in the cockpit. The maximum upper rudder 
deflection is +/-18 degrees. Upper surface position limiting is 
accomplished by electrical and mechanical stops at the surface.
    In normal conditions, the manual yaw command from either the pilot 
or co-pilot rudder pedals is transmitted through the cable system and 
the PCU input bungees to the rudder PCUs. The PCUs then drive the lower 
rudder surface in proportion to the input command. At the same time, 
the rudder pedal command is electrically sensed at the rudder pedal 
torque tube and transmitted to the active YSAS for tracking the upper 
rudder. The position of each rudder surface may be displayed to the 
pilot along with the authority limiter position. In normal operation, 
both the lower and upper rudder systems provide yaw damper function at 
the same time. If the yaw damper function on either rudder system 
completely fails, the other system will provide adequate control to 
maintain the yaw stability of the airplane.

Type Certification Basis

    Under the provisions of Sec. 21.17 of the FAR, Cessna must show, 
except as provided in Sec. 25.2, that the Model 750 (Citation X) meets 
the applicable provisions of part 25, effective February 1, 1965, as 
amended by Amendments 25-1 through 25-74. In addition, the 
certification basis for the Model 750 includes Sec. 25.1316, System 
lightning protection, as amended by Amendment 25-80; part 34, effective 
September 10, 1990, plus any amendments in effect at the time of 
certification; and part 36, effective December 1, 1969, as amended by 
Amendment 36-1 through the amendment in effect at the time of 
certification. These special conditions form an additional part of the 
type certification basis. The certification basis also includes Special 
Conditions No. 25-ANM-99, dated 5/8/95, pertaining to protection from 
High Intensity radiated fields, and may include other special 
conditions that are not relevant to these special conditions.
    If the Administrator finds that the applicable airworthiness 
regulations (i.e., part 25, as amended) do not contain adequate or 
appropriate safety standards for the Cessna Model 750 because of a 
novel or unusual design feature, special conditions are prescribed 
under the provisions of Sec. 21.16 to establish a level of safety 
equivalent to that established in the regulations.
    Special conditions, as appropriate, are issued in accordance with 
Sec. 11.49 of the FAR after public notice, as required by Secs. 11.28 
and 11.29, and become part of the type certification basis in 
accordance with Sec. 21.17(a)(2).
    Special conditions are initially applicable to the model for which 
they are issued. Should the type certificate for that model be amended 
later to include any other model that incorporates the same novel or 
unusual design feature, the special condition would also apply to the 
other model under the provisions of Sec. 21.101(a)(1).

Discussion

    The type design of the Cessna 750 contains novel or unusual design 
features not envisioned by the applicable part 25 airworthiness 
standards and therefore special conditions are considered necessary in 
the following areas:
    1. Upper Rudder Control System Operation Without Normal Electrical 
Power. The Cessna Model 750 upper rudder control system is required in 
order to maintain safe flight. The Cessna design has four yaw dampers, 
including lower rudder dual yaw dampers that are hydraulically powered, 
and an upper rudder with dual YSASs that are electrically powered. If 
all hydraulic power is lost to the lower rudder (manual revision), then 
availability of the upper rudder yaw damper function becomes critical. 
Section 25.1351(d) of the FAR, Operation without normal electrical 
power, requires safe operation in VFR conditions for at least five 
minutes with inoperative normal power. This rule was structured around 
a traditional design utilizing mechanical control cables for flight 
control, while the crew took time to sort out the electrical failure, 
start engine(s) if necessary, and re-establish some of the electrical 
power generation capability.
    Service experience with traditional two-engine airplane designs has 
shown that the loss of electrical power generated by the airplane's 
engines is not extremely improbable. The electrical power system of the 
Cessna 750 must therefore be designed with standby or emergency 
electrical sources of sufficient reliability and capacity to power the 
upper rudder control system in the event of the loss of normally 
generated electrical power. The need for electrical power for the 
Cessna Model 750 upper rudder control system was not envisioned by part 
25 since, in traditional designs, cables and hydraulics are utilized 
for the flight control system. Therefore, Special Condition No. 1 is 
needed.
    2. Design Maneuver Requirements. In a conventional airplane, pilot 
inputs directly affect control surface movement (both rate and 
displacement) for a given flight condition. In the Cessna Model 750, 
the pilot provides only a portion of the input to the upper rudder 
control surface, and it is possible that the pilot control 
displacements specified in Sec. 25.351 of the FAR may not result in the 
maximum displacement and rates of displacement of the upper rudder. The 
intent of these noted rules may not be

[[Page 24210]]

satisfied if literally applied. Therefore, Special Condition No. 2 is 
needed.
    3. Interaction of Systems and Structures. The Cessna Model 750 has 
a full-time electronic upper rudder flight control system affecting the 
yaw axis. The current rules are inadequate for considering the affects 
of this system, and its failures, on structural performance. Therefore, 
Special Condition No. 3 is needed.
    As discussed above, these special conditions are applicable 
initially to the Cessna Model 750 (Citation X) airplane. Should Cessna 
apply at a later date for a change to the type certificate to include 
another model incorporating the same novel or unusual design feature, 
the special conditions would apply to that model as well under the 
provisions of Sec. 21.101(a)(1).

Discussion of Comments

    Notice of proposed special conditions No. SC-96-1-NM was published 
in the Federal Register on March 22, 1996 (61 FR 11779). No comments 
were received.
    Under standard practice, the effective date of final special 
conditions would be 30 days after the date of publication in the 
Federal Register. However, as the certification date for the Cessna 
Aircraft Model 750 airplane is imminent, the FAA finds that good cause 
exists for making these special conditions effective upon issuance.

Conclusion

    This action affects only certain unusual or novel design features 
on one model series of airplanes. It is not a rule of general 
applicability and affects only the manufacturer who applied to the FAA 
for approval of these features on the airplanes.

List of Subjects in 14 CFR Part 25

    Aircraft, Aviation safety, Reporting and recordkeeping 
requirements.

    The authority citation for part 25 continues to read as follows:

    Authority: 49 U.S.C. 106(g), 40113, 44701-44702, 44704.

The Special Conditions

    Accordingly, pursuant to the authority delegated to me by the 
Administrator, the following special conditions are issued as part of 
the type certification basis for the Cessna Aircraft Model 750 
airplanes.
    1. Upper Rudder Control System Operations Without Normal Electrical 
Power. In lieu of compliance with Sec. 25.1351(d), it must be 
demonstrated, by test or combination of test and analysis, that the 
upper rudder control system provides for safe flight and landing with 
inoperative normal engine electrical power (electrical power sources 
excluding the battery and any other standby electrical sources). The 
airplane operation should be considered at the critical phase of flight 
and include the ability to restart the engines and maintain flight for 
a minimum of 30 minutes in Instrument Meteorological Conditions (IMC).
    Discussion: The Cessna Model 750 fly-by-wire upper rudder control 
system requires a continuous source of electrical power in order to 
maintain yaw control. Section Sec. 25.1351(d), Operation without normal 
electrical power, requires safe operation in visual flight rules (VFR) 
conditions for at least five minutes with inoperative normal power. 
This rule was structured around a traditional design utilizing 
mechanical control cables for flight control while the crew took time 
to sort out the electrical failure and was able to re-establish some of 
the electrical power generation capability. In order to maintain the 
same level of safety associated with traditional designs, the Cessna 
750 upper rudder control system design shall be demonstrated to operate 
for at least 30 minutes without the normal source of engine-generated 
electrical power. It should be noted that service experience has shown 
that the loss of all electrical power that is generated by the 
airplane's engines is not extremely improbable.
    The emergency electrical power system must be designed to supply 
the upper rudder control system without the need for crew action 
following the loss of the normal electrical power system.
    For compliance purposes:
    1. A test demonstration of the loss of normal engine-generated 
power is to be established such that:
    a. The failure condition should be assumed to occur during night 
instrument meteorological conditions (IMC), at the most critical phase 
of flight relative to the electrical power system design and 
distribution of equipment loads on the system.
    b. The upper rudder control system can provide for continued safe 
flight and landing using emergency electrical power (batteries, etc.) 
for at least 30 minutes of operation in IMC. An engine restart should 
be included in this demonstration.
    c. Availability of APU operation should not be considered in 
establishing emergency power system adequacy.
    2. Since the availability of the emergency electrical power system 
operation is necessary for maintaining safe flight with the upper 
rudder, the emergency electrical power system must be available 
immediately prior to each flight.
    3. The emergency electrical power system must be shown to be 
satisfactorily operational in all flight regimes.
    2. Design Yaw Maneuver Requirements.
    In lieu of compliance with Sec. 25.351 of the FAR, the airplane 
must be designed for loads resulting from the yaw maneuver conditions 
specified in subparagraphs (a) through (d) of this paragraph, at speeds 
from VMC to VD. Unbalanced aerodynamic moments about the 
center of gravity must be reacted in a rational or conservative manner 
considering the airplane inertia forces. In computing the tail loads, 
the yawing velocity may be assumed to be zero.
    (a) With the airplane in unaccelerated flight at zero yaw, it is 
assumed that the cockpit rudder control is suddenly displaced to 
achieve the resulting rudder deflection, as limited by:
    (1) the control system or control surface stops; or
    (2) a limit force of 300 pounds from VMC to VA and 200 
pounds from VC/MC to VD/MD, with a linear variation 
between VA and VC/MC.
    (b) With the cockpit rudder control deflected so as always to 
maintain the maximum rudder deflection available within the limitations 
specified in subparagraph (a) of this paragraph, it is assumed that the 
airplane yaws to the overswing sideslip angle.
    (c) With the airplane yawed to the static equilibrium sideslip 
angle, it is assumed that the cockpit rudder control is held so as to 
achieve the maximum rudder deflection available within the limitations 
specified in subparagraph (a) of this paragraph.
    (d) With the airplane yawed to the static equilibrium sideslip 
angle of subparagraph (c) of this paragraph, it is assumed that the 
cockpit rudder control is suddenly returned to neutral.
    3. Interaction of Systems and Structures.
    Airplanes equipped with fly-by-wire control systems that affect 
structural performance, either directly or as a result of a failure or 
malfunction, must account for the influence of these systems and their 
failure conditions in showing compliance with the requirements of 14 
CFR part 25, Subparts C and D.
    (a) General. The following criteria will be used in determining the 
influence of the upper rudder control systems and their failure 
conditions on the airplane structure.

[[Page 24211]]

    (b) System fully operative. With the system fully operative, the 
following apply:
    (1) Limit loads must be derived in all normal operating 
configurations of the systems from all the limit conditions specified 
in 14 CFR part 25, Subpart C, taking into account any special behavior 
of such systems or associated functions or any effect on the structural 
performance of the airplane that may occur up to the limit loads. In 
particular, any significant nonlinearity (rate of displacement of 
control surface, thresholds, or any other system nonlinearities) must 
be accounted for in a realistic or conservative way when deriving limit 
loads from limit conditions.
    (2) The airplane must meet the strength requirements of 14 CFR part 
25 (Static strength, residual strength), using the specified factors to 
derive ultimate loads from the limit loads defined above. The effect of 
non linearities must be investigated beyond limit conditions to ensure 
the behavior of the system present no anomaly compared to the behavior 
below limit conditions. However, conditions beyond limit conditions 
need not be considered when it can be shown that the airplane has 
design features that make it impossible to exceed those limit 
conditions.
    (3) The airplane must meet the aeroelastic stability requirements 
of Sec. 25.629.
    (c) System in failure condition. For any failure condition in the 
system not shown to be extremely improbable, the following apply:
    (1) At the time of occurrence. Starting from 1-g level flight 
conditions, a realistic scenario, including pilot corrective actions, 
must be established to determine the loads occurring at the time of 
failure and immediately after failure. The airplane must be able to 
withstand these loads multiplied by an appropriate factor of safety 
that is related to the probability of occurrence of the failure. The 
factor of safety (F.S.) is defined in Figure 1.

[GRAPHIC] [TIFF OMITTED] TR14MY96.003


Pj--Probability of occurrence of failure mode j (per hour)

    (i) These loads must also be used in the damage tolerance 
evaluation required by Sec. 25.571(b) if the failure condition is 
probable.
    (ii) Freedom from flutter, divergence, and control reversal must be 
shown up to the speeds defined in Sec. 25.629(b)(2). For failure 
conditions which result in speed increases beyond VC/MC, 
freedom from flutter, divergence, and control reversal must be shown to 
increased speeds, so that the margins intended by Sec. 25.629(b)(2) are 
maintained.
    (iii) Notwithstanding subparagraph (1) of this paragraph, failures 
of the system that result in forced structural vibrations (oscillatory 
failures) must not produce loads that could result in catastrophic 
fatigue failure or detrimental deformation of primary structure.
    (2) For the continuation of the flight. For the airplane in the 
system failed state, and considering any appropriate reconfiguration 
and flight limitations, the following apply:
    (i) Static and residual strength must be determined for loads 
derived from the following conditions at speeds up to VC, or the 
speed limitation prescribed for the remainder of the flight:
    (A) The limit symmetrical maneuvering conditions specified in 
Secs. 25.331 and 25.325.
    (B) The limit gust conditions specified in Sec. 25.341 (but using 
the gust velocities for VC) and in Sec. 25.345.
    (C) The limit rolling conditions specified in Sec. 25.349 and the 
limit unsymmetrical conditions specified in Secs. 25.367 and 25.427(b) 
and (c).
    (D) The limit yaw maneuvering conditions specified in Special 
Condition No. 2.
    (E) The limit ground loading conditions specified in Secs. 25.473 
and 25.491.
    (ii) For static strength substantiation, each part of the structure 
must be able to withstand the loads specified in subparagraph (2)(i) of 
this paragraph, multiplied by a factor of safety depending on the 
probability of being in this failure state. The factor of safety is 
defined in Figure 2.

[GRAPHIC] [TIFF OMITTED] TR14MY96.004


Qj--Probability of being in failure condition j
Qj=(Tj)(Pj) where:
Tj=Average time spent in failure condition j (in hours)
Pj=Probability of occurrence of failure mode j (per hour)

    Note: If Pj is greater than 10-3 per flight hour, then 
a 1.5 factor of safety must be applied to all limit load conditions 
specified in Subpart C.

    (iii) For residual strength substantiation as defined in 
Sec. 25.571(b), structures affected by failure of the system and with 
damage in combination with the system failure, a reduced factor may be 
applied to the loads specified in

[[Page 24212]]

subparagraph (2)(i) of this paragraph. However, the residual strength 
level must not be less than the 1-g flight load, combined with the 
loads introduced by the failure condition, plus two-thirds of the load 
increments of the conditions specified in subparagraph (2)(i) of this 
paragraph, applied in both positive and negative directions (if 
appropriate). The residual strength factor (R.S.F.) is defined in 
Figure 3.

[GRAPHIC] [TIFF OMITTED] TR14MY96.005


Qj--Probability of being in failure condition j
Qj=(Tj)(Pj) where:
Tj=Average time spent in failure condition j (in hours)
Pj=Probability of occurrence of failure mode j (per hour)

    Note: If Pj is greater than 10-3 per flight hour, then 
a residual strength factor of 1.0 must be used.
    (iv) If the loads induced by the failure condition have a 
significant effect on fatigue or damage tolerance, then their effects 
must be taken into account.
    (v) Freedom from flutter, divergence, and control reversal must be 
shown up to a speed determined from Figure 4. Flutter clearance speeds 
V' and V'' may be based on the speed limitation specified for the 
remainder of the flight, using the margins defined by Sec. 25.629(b).
[GRAPHIC] [TIFF OMITTED] TR14MY96.006


Qj=Probability of being in failure condition j
V'=Clearance speed as defined by Sec. 25.629(b)(2).
V''=Clearance speed as defined by Sec. 25.629(b)(1).
Qj=(Tj)(Pj) where:
Tj=Average time spent in failure condition j (in hours)
Pj=Probability of occurrence of failure mode j (per hour)

    Note: If Pj is greater than 10-3 per flight hour, then 
the flutter clearance speed must not be less than V''.

    (vi) Freedom from flutter, divergence, and control reversal must 
also be shown up to V' in Figure 4 above, for any probable system 
failure condition combined with any damage required or selected for 
investigation by Sec. 25.571(b).
    (vii) If the mission analysis method is used to account for 
continuous turbulence, all the systems failure conditions associated 
with their probability must be accounted for in a rational or 
conservative manner in order to ensure that the probability of 
exceeding the limit load is not higher than the value prescribed in 
Appendix G of 14 CFR part 25.
    (3) Consideration of certain failure conditions may be required by 
other sections of 14 CFR part 25, regardless of calculated system 
reliability. Where analysis shows the probability of these failure 
conditions to be less than 10-9, criteria other than those 
specified in this paragraph may be used for structural substantiation 
to show continued safe flight and landing.
    (d) Warning considerations. For upper rudder control system failure 
detection and warning, the following apply:
    (1) The system must be checked for failure conditions, not 
extremely improbable, that degrade the structural capability below the 
level required by part 25 or significantly reduce the reliability of 
the remaining system. The crew must be made aware of these failures 
before flight. Certain elements of the control system, such as 
mechanical and hydraulic components, may use special periodic 
inspections, and electronic components may use daily checks, in lieu of 
warning systems, to achieve the objective of this requirement. These 
certification maintenance requirements must be limited to components 
that are not readily detectable by normal warning systems and where 
service history shows that inspections will provide an adequate level 
of safety.
    (2) The existence of any failure condition, not extremely 
improbable, during flight that could significantly affect the 
structural capability of the airplane, and for which the associated 
reduction in airworthiness can be minimized by suitable flight 
limitations, must be signaled to the flight crew. For example, failure 
conditions which result in a factor of safety between the airplane 
strength and the loads of 14 CFR part 25, Subpart C, below 1.25, or 
flutter margins below V'', must be signaled to the crew during the 
flight.
    (3) Dispatch with known failure conditions. If the airplane is to 
be dispatched in a known upper rudder control system failure condition 
that affects structural performance, or affects the reliability of the 
remaining system to maintain structural performance, then the 
provisions of this special condition must be met for the dispatched 
condition and for subsequent failures. Operational and flight 
limitations may be taken into account.

    Issued in Renton, Washington, on May 1, 1996.
Darrell M. Pederson,
Acting Manager, Transport Airplane Directorate, Aircraft Certification 
Service, ANM-100.
[FR Doc. 96-2086 Filed 5-13-96; 8:45 am]
BILLING CODE 4910-13-M