[Federal Register Volume 65, Number 132 (Monday, July 10, 2000)]
[Rules and Regulations]
[Pages 42278-42281]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 00-17242]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 35

[Docket No. NE-120; Special Conditions No. 35-001-SC]


Special Conditions: Hamilton Sundstrand, Model NP2000 Propeller

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Final special conditions.

-----------------------------------------------------------------------

SUMMARY: These special conditions are issued for the Hamilton 
Sundstrand model NP2000 constant speed propeller. This eight-bladed 
propeller uses a dual acting digital electro-hydraulic propeller 
control system and has blades constructed of composite materials. These 
design features are novel and unusual. The applicable airworthiness 
regulations do not contain adequate or appropriate safety standards for 
these design features. These special conditions contain the additional 
safety standards that the Administrator considers necessary to 
establish a level of safety equivalent to that established by the 
existing airworthiness standards.

DATES: Effective date August 9, 2000.

FOR FURTHER INFORMATION CONTACT: Jay Turnberg, FAA, Engine and 
Propeller Standards Staff, Engine and Propeller Directorate, Aircraft 
Certification Service, ANE-110, 12 New England Executive Park, 
Burlington, Massachusetts, 01803-5229; telephone (781) 238-7116; fax 
(781) 238-7199.

SUPPLEMENTARY INFORMATION:

Background

    On February 9, 1999, Hamilton Sundstrand applied for type 
certification for a new model NP2000 propeller. The NP2000 propeller 
uses a digital electro-hydraulic control system and blades that are 
constructed of composite material.
    Conventional propellers on turboprop aircraft use a mechanical 
governor in the propeller control system that senses propeller speed 
and adjusts the pitch by directing hydraulic oil to the propeller 
actuator to increase or decrease pitch to maintain the propeller at the 
correct revolutions per minute (RPM). When the mechanical governor 
fails, the propeller pitch is controlled by a backup mechanical 
overspeed governor.
    The Hamilton Sundstrand model NP2000 propeller uses a digital 
electronic governor in the propeller control system. The digital 
electronic governor is designed to operate a hydro-mechanical interface 
to direct hydraulic oil to the propeller actuator to increase or 
decrease pitch. The digital electronic governor logic commands speed 
governing, synchrophasing, failure monitoring and provides beta 
scheduling. The digital electronic governor introduces potential 
failures associated with electrical power, software commands, data, and 
environmental effects that can result in hazardous propeller effects. 
In addition to these features, the system has a backup mechanical 
overspeed governor.
    The special conditions address the following airworthiness issues 
for the Hamilton Sundstrand model NP2000 propeller:
    1. Safety assessment;
    2. Propeller control system;
    3. Centrifugal load tests;
    4. Fatigue limits and evaluation;
    5. Bird impact; and
    6. Lightning strike.
    The Hamilton Sundstrand model NP2000 propeller incorporates 
propeller blades constructed of composite material. This material has 
fibers that are woven or aligned in specific directions to give the 
material directional strength properties. These properties depend on 
the type of fiber, the orientation and concentration of fiber, and the 
resin matrix material that binds the fibers together. Composite 
materials introduce fatigue characteristics and failure modes that 
differ from metallic materials.
    The requirements of part 35 were established to address the 
airworthiness considerations associated with metal propeller blades. 
Propeller blades constructed using composite material may be subject to 
damage due to the high impact forces associated with a bird strike. 
Thus, composite propellers must demonstrate propeller integrity 
following a bird strike.
    Part 35 does not require a demonstration of propeller integrity 
following a lightning strike. Composite blades may not safely conduct 
or dissipate the electrical current from a lightning strike. Severe 
damage can result if the propellers are not properly protected. 
Therefore, composite blades must demonstrate propeller integrity 
following a lightning strike.
    The existing certification requirements only address structural and 
fatigue evaluation of metal propeller blades or hubs, and those metal 
components of non-metallic blade assemblies. Allowable design stress 
limits for composite blades must consider the deteriorating effects of 
the environment and in-service use, particularly those effects from 
temperature, moisture, erosion and chemical attack. Composite blades 
also present new and different considerations for retention of the 
blades in the propeller hub.
    The applicable airworthiness requirements do not contain adequate 
or appropriate safety standards for these novel and unusual design 
features.

Type Certification Basis

    Under Sec. 21.17, Hamilton Sundstrand must show that the model 
NP2000 propeller meets the applicable provisions of Sec. 21.21 and part 
35.
    If the Administrator finds that the applicable airworthiness 
regulations (i.e. part 35), do not contain adequate or appropriate 
safety standards for the model NP2000 propeller because of a novel or 
unusual design feature, special conditions are prescribed under the 
provisions of Sec. 21.16.
    Special conditions, as appropriate, are issued in accordance with 
Sec. 11.49 after public notice, as required by Secs. 11.28 and 
11.29(b), and become part of the type certification basis in accordance 
with Sec. 21.17(a)(2).
    Special conditions are initially applicable to the model for which 
they are issued. Should the type certificate for that model be amended 
later to include any other model that incorporates the same novel or 
unusual design features, the special conditions

[[Page 42279]]

would also apply to the other model under the provisions of 
Sec. 21.101(a)(1).

Novel or Unusual Design Features

    The NP2000 propeller will incorporate the following novel and 
unusual design features: dual acting digital electro-hydraulic 
propeller control system and blades constructed of composite materials. 
Special conditions for a safety assessment, the propeller control 
system, centrifugal load tests, fatigue limits and evaluation, bird 
impact, and lightning strike address the novel and unusual design 
features. The special conditions are discussed below.

Safety Assessment

    The special conditions require the applicant to conduct a safety 
assessment of the propeller in conjunction with the requirements for 
evaluating the digital electro-hydraulic control system. A safety 
assessment is necessary due to the increased complexity of these 
propeller designs and related control systems. The ultimate objective 
of the safety assessment requirement is to ensure that the collective 
risk from all propeller failure conditions is acceptably low. The basis 
is the concept that an acceptable total propeller design risk is 
achievable by managing the individual risks to acceptable levels. This 
concept emphasizes reducing the risk of an event proportionally with 
the severity of the hazard it represents.
    The special conditions are written at the propeller level for a 
typical aircraft. The typical aircraft may be the aircraft intended for 
installation of the propeller. It is advised that the propeller 
applicant have an understanding of the intended aircraft, not to show 
compliance with this requirement, but to design a propeller that will 
be acceptable for the intended aircraft. For example, a part 25 
aircraft may require different failure effects and probability of 
failure than a part 23 aircraft. Showing compliance with the 
requirement without consideration of the intended aircraft may result 
in a propeller that cannot be installed on the intended aircraft.

Propeller Control System

    Currently, part 35 does not adequately address propellers with 
combined mechanical, hydraulic, digital, and electronic control 
systems. Propeller mechanical control systems certified under the 
existing requirements incorporate a mechanical governor that senses 
propeller speed and adjusts the pitch to absorb the engine power to 
maintain the propeller at the selected rotational speed. Propellers 
with digital electronic control components perform the same basic 
function but use software, electronic circuitry, and electro-hydraulic 
actuators. The electronic control systems may also incorporate 
additional functions such as failure monitoring, synchrophasing and 
beta scheduling. This addition of electronics to the control system may 
introduce new failure modes that can result in hazardous propeller 
effects.

Centrifugal Load Tests

    Section 35.35 currently requires that the hub and blade retention 
arrangement of propellers with detachable blades be tested to a 
centrifugal load of twice the maximum centrifugal force to which the 
propeller would be subjected during operation. This requirement is 
limited to the blade and hub retention capacity and does not address 
composite materials and composite construction of the propeller 
assembly or changes in materials due to service degradation and 
environmental factors.

Fatigue Limits and Evaluation

    The current requirement does not adequately address composite 
materials and is limited to metallic hubs and blades and primary load-
carrying metal components of non-metallic blades. The special 
conditions expand the requirements to include all materials and 
components whose failure would cause a hazardous propeller effect and 
to take into account material degradation expected in service, material 
property variations, manufacturing variations, and environmental 
effects. The special conditions clarify that the fatigue limits may be 
determined by tests or analysis based on tests. The components whose 
failure may cause a hazardous propeller effect include control system 
components, when applicable.
    The special conditions require the applicant to conduct fatigue 
evaluation on a typical aircraft or on an aircraft used during aircraft 
certification to conduct the vibration tests and evaluation required by 
either Secs. 23.907 or 25.907. The typical aircraft may be one used to 
develop design criteria for the propeller or another appropriate 
aircraft.

Bird Impact

    Currently there are no bird impact requirements in part 35. The 
existing requirements only address the airworthiness considerations 
associated with propellers that use wood and metal blades. Propeller 
blades of this type have demonstrated good service experience following 
a bird strike. Propeller blade and spinner construction now use 
composite materials that have a higher potential for damage from bird 
impact.
    The need for bird impact requirements was recognized when composite 
blades were introduced in the 1970's; the safety issue has been 
addressed by special tests and special conditions for composite blade 
certifications. These special conditions were unique for each propeller 
and effectively stated that the propeller will withstand a four-pound 
bird impact without contributing to a hazardous propeller effect. These 
special tests and special conditions have been effective for over four 
million flight hours. There have not been any accidents attributed to 
bird impact on composite propellers. The selection of a four-pound bird 
has been substantiated by the extensive service history of blades that 
have been designed using the four-pound bird criteria.

Lightning Strike

    Currently there are no lightning strike requirements in part 35. 
The need for lightning strike requirements was recognized when 
composite blades were first introduced in the 1970's; the safety issue 
has been addressed by special tests and special conditions for each 
design using composite blades. The special tests and special 
conditions, which were unique for each propeller, effectively stated 
that the propeller must be able to withstand a lightning strike without 
contributing to a hazardous propeller effect. These special tests and 
special conditions have been effective for over four million flight 
hours. There have not been any accidents attributed to a lightning 
strike on composite propellers.

Discussion of Comments

    Interested persons have been afforded the opportunity to 
participate in the making of these special conditions. No comments were 
received on the special conditions as proposed. After careful review of 
the available data, the FAA has determined that air safety and the 
public interest require the adoption of the special conditions without 
change.

Applicability

    As discussed above, these special conditions are applicable to the 
Hamilton Sundstrand model NP2000 propeller. Should Hamilton Sundstrand 
apply at a later date for a change to the type certificate to include 
another model incorporating the same or novel or unusual design 
features, the special conditions would apply to that model as

[[Page 42280]]

well under the provisions of Sec. 21.101(a)(1).

Conclusion

    This action affects only certain novel or unusual design features 
on one model of propellers. It is not a rule of general applicability, 
and it affects only the applicant who applied to the FAA for approval 
of these features on the propeller.

List of Subjects in 14 CFR Part 35

    Air transportation, Aircraft, Aviation safety, Safety.
    The authority citations for these special conditions are as 
follows:

    Authority: 49 U.S.C. 106(g), 40113, 44701-44702, 44704.

The Special Conditions

    Accordingly, pursuant to the authority delegated to me by the 
Administrator, the following special conditions are issued as part of 
the type certification basis for Hamilton Sundstrand model NP2000 
propellers.
    In addition to the requirements of part 35, the following 
requirements apply to the propeller.
    (a) Definitions. Unless otherwise approved by the Administrator and 
documented in the appropriate manuals and certification documents, for 
the purpose of these special conditions the following definitions apply 
to the propeller:
    (1) Propeller. The propeller is defined by the components listed in 
the type design.
    (2) Propeller system. The propeller system consists of the 
propeller plus all the components necessary for its functioning, but 
not necessarily included in the propeller type design.
    (3) Hazardous propeller effects. The following are regarded as 
hazardous propeller effects:
    (i) A significant overspeed of the propeller.
    (ii) The development of excessive drag.
    (iii) Thrust in the opposite direction to that commanded by the 
pilot.
    (iv) A release of the propeller or any major portion of the 
propeller.
    (v) A failure that results in excessive unbalance.
    (vi) The unintended movement of the propeller blades below the 
established minimum in-flight low pitch position.
    (4) Major propeller effects. The following are regarded as major 
propeller effects:
    (i) An inability to feather.
    (ii) An inability to command a change in propeller pitch.
    (iii) A significant uncommanded change in pitch.
    (iv) A significant uncontrollable torque or speed fluctuation.
    (b) Safety analysis.
    (1)(i) An analysis of the propeller system must be carried out to 
assess the likely consequence of all failures that can reasonably be 
expected to occur. This analysis must consider the following:
    (A) The propeller system in a typical installation. When the 
analysis depends on representative components, assumed interfaces, or 
assumed installed conditions, the assumptions must be stated in the 
analysis.
    (B) Consequential secondary failures and latent failures.
    (C) Multiple failures referred to in paragraph (b)(4) or that 
result in hazardous propeller effects.
    (ii) A summary must be made of those failures that could result in 
major propeller effects or hazardous propeller effects, together with 
an estimate of the probability of occurrence of those effects.
    (iii) It must be shown that hazardous propeller effects are not 
predicted to occur at a rate in excess of that defined as extremely 
remote (probability of 10-\7\ or less per propeller flight 
hour). The estimated probability for individual failures may be 
insufficiently precise to enable the total rate for hazardous propeller 
effects to be assessed. For propeller certification, it is acceptable 
to consider that the intent of this paragraph has been achieved if the 
probability of a hazardous propeller effect arising from an individual 
failure can be predicted to be not greater than 10-\8\ per 
propeller flight hour. It will also be accepted that, in dealing with 
probabilities of this low order of magnitude, absolute proof is not 
possible and reliance must be placed on engineering judgment and 
previous experience combined with sound design and test philosophies.
    (iv) It must be shown that major propeller effects are not 
predicted to occur at a rate in excess of that defined as remote 
(probability of 10-\5\ or less per propeller flight hour).
    (2) If significant doubt exists as to the effects of failures or 
likely combination of failures, any assumption of the effect may be 
required to be verified by test.
    (3) It is recognized that the probability of primary failures of 
certain single elements (for example, blades) cannot be sensibly 
estimated in numerical terms. If the failure of such elements is likely 
to result in hazardous propeller effects, reliance must be placed on 
meeting the prescribed integrity requirements of part 35 and these 
special conditions. These instances must be stated in the safety 
analysis.
    (4) If reliance is placed on a system or device, such as safety 
devices, feathering and overspeed systems, instrumentation, early 
warning devices, maintenance checks, and similar equipment or 
procedures, to prevent a failure from progressing to hazardous 
propeller effects, the possibility of a safety system failure in 
combination with a basic propeller failure must be covered. If items of 
a safety system are outside the control of the propeller manufacturer, 
the assumptions of the safety analysis with respect to the reliability 
of these parts must be clearly stated in the analysis and identified in 
the installation and operation instructions required under Sec. 35.3.
    (5) If the acceptability of the safety analysis is dependent on one 
or more of the following, it must be identified in the analysis and 
appropriately substantiated.
    (i) Performance of mandatory maintenance actions at stated 
intervals required for certification and other maintenance actions. 
This includes the verification of the serviceability of items that 
could fail in a latent manner. These maintenance intervals must be 
published in the appropriate manuals. Additionally, if errors in 
maintenance of the propeller system could lead to hazardous propeller 
effects, the appropriate procedures must be published in the 
appropriate propeller manuals.
    (ii) Verification of the satisfactory functioning of safety or 
other devices at pre-flight or other stated periods. The details of 
this satisfactory functioning must be published in the appropriate 
manuals.
    (iii) The provisions of specific instrumentation not otherwise 
required.
    (iv) A fatigue assessment.
    (6) If applicable, the safety analysis must include the assessment 
of indicating equipment, manual and automatic controls, governors and 
propeller control systems, synchrophasers, synchronizers, and propeller 
thrust reversal systems.
    (c) Propeller control system. The requirements of this section are 
applicable to any system or component that controls, limits or monitors 
propeller functions.
    (1) The propeller control system must be designed, constructed and 
validated to show that:
    (i) The propeller control system, operating in normal and 
alternative operating modes and transition between operating modes, 
performs the intended functions throughout the declared operating 
conditions and flight envelope.

[[Page 42281]]

    (ii) The propeller control system functionality is not adversely 
affected by the declared environmental conditions, including 
temperature, electromagnetic interference (EMI), high intensity 
radiated fields (HIRF) and lightning. The environmental limits to which 
the system has been satisfactorily validated must be documented in the 
appropriate propeller manuals.
    (iii) A method is provided to indicate that an operating mode 
change has occurred if flight crew action is required. In such an 
event, operating instructions must be provided in the appropriate 
manuals.
    (2) The propeller control system must be designed and constructed 
so that, in addition to compliance with paragraph (b), Safety analysis:
    (i) A level of integrity consistent with the intended aircraft is 
achieved.
    (ii) A single failure or malfunction of electrical or electronic 
components in the control system does not cause a hazardous propeller 
effect.
    (iii) Failures or malfunctions directly affecting the propeller 
control system in a typical aircraft, such as structural failures of 
attachments to the control, fire, or overheat, do not lead to a 
hazardous propeller effect.
    (iv) The loss of normal propeller pitch control does not cause a 
hazardous propeller effect under the intended operating conditions.
    (v) The failure or corruption of data or signals shared across 
propellers does not cause a major or hazardous propeller effect.
    (3) Electronic propeller control system imbedded software must be 
designed and implemented by a method approved by the Administrator that 
is consistent with the criticality of the performed functions and 
minimizes the existence of software errors.
    (4) The propeller control system must be designed and constructed 
so that the failure or corruption of aircraft-supplied data does not 
result in hazardous propeller effects.
    (5) The propeller control system must be designed and constructed 
so that the loss, interruption or abnormal characteristic of aircraft-
supplied electrical power does not result in hazardous propeller 
effects. The power quality requirements must be described in the 
appropriate manuals.
    (6) The propeller control system description, characteristics and 
authority, in both normal operation and failure conditions, and the 
range of control of other controlled functions must be specified in the 
appropriate propeller manuals.
    (d) Centrifugal load tests. It must be demonstrated that a 
propeller, accounting for environmental degradation expected in 
service, complies with paragraphs (d)(1), (d)(2) and (d)(3) of these 
special conditions without evidence of failure, malfunction, or 
permanent deformation that would result in a major or hazardous 
propeller effect. Environmental degradation may be accounted for by 
adjustment of the loads during the tests.
    (1) The hub, blade retention system, and counterweights must be 
tested for a period of one hour to a load equivalent to twice the 
maximum centrifugal load to which the propeller would be subjected 
during operation at the maximum rated rotational speed.
    (2) If appropriate, blade features associated with transitions to 
the retention system (e.g., a composite blade bonded to a metallic 
retention) may be tested either during the test required by paragraph 
(d)(1) or in a separate component test.
    (3) Components used with or attached to the propeller (e.g., 
spinners, de-icing equipment, and blade erosion shields) must be 
subjected to a load equivalent to 159 percent of the maximum 
centrifugal load to which the component would be subjected during 
operation at the maximum rated rotational speed. This must be performed 
by either:
    (i) Testing at the required load for a period of 30 minutes; or
    (ii) Analysis based on test.
    (e) Fatigue limits and evaluation. (1) Fatigue limits must be 
established by tests or analysis based on tests, for propeller:
    (i) Hubs;
    (ii) Blades;
    (iii) Blade retention components; and
    (iv) Other components that are affected by fatigue loads and that 
are shown under paragraph (b), Safety analysis, as having a fatigue 
failure mode leading to hazardous propeller effects.
    (2) The fatigue limits must take the following into account:
    (i) All known and reasonably foreseeable vibration and cyclic load 
patterns that are expected in service; and
    (ii) Expected service deterioration, variations in material 
properties, manufacturing variations, and environmental effects.
    (3) A fatigue evaluation of the propeller must be conducted to show 
that hazardous propeller effects due to fatigue will be avoided 
throughout the intended operational life of the propeller on either:
    (i) The intended aircraft, by complying with Secs. 23.907 or 25.907 
as applicable; or
    (ii) A typical aircraft.
    (f) Bird impact. It must be demonstrated, by tests or analysis 
based on tests or experience on similar designs, that the propeller is 
capable of withstanding the impact of a four pound bird at the critical 
location(s) and critical flight condition(s) of the intended aircraft 
without causing a major or hazardous propeller effect.
    (g) Lightning strike. It must be demonstrated, by tests or analysis 
based on tests or experience on similar designs, that the propeller is 
capable of withstanding a lightning strike without causing a major or 
hazardous propeller effect.

    Issued in Burlington, Massachusetts on June 27, 2000.
David A. Downey,
Assistant Manager, Engine and Propeller Directorate, Aircraft 
Certification Service.
[FR Doc. 00-17242 Filed 7-7-00; 8:45 am]
BILLING CODE 4910-13-P