Special Conditions: Embraer Model ERJ 190 Series Airplanes; Sudden Engine Stoppage, Interaction of Systems and Structures, Operation Without Normal Electrical Power, Electronic Flight Control Systems, Automatic Takeoff Thrust Control System (ATTCS), and Protection From Effects of High Intensity Radiated Fields (HIRF), 30020-30028 [05-10367]

Agencies

• Federal Aviation Administration
• DEPARTMENT OF TRANSPORTATION

[Federal Register Volume 70, Number 100 (Wednesday, May 25, 2005)]
[Proposed Rules]
[Pages 30020-30028]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 05-10367]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 25

[Docket No. NM307; Notice No. 25-05-05-SC]


Special Conditions: Embraer Model ERJ 190 Series Airplanes; 
Sudden Engine Stoppage, Interaction of Systems and Structures, 
Operation Without Normal Electrical Power, Electronic Flight Control 
Systems, Automatic Takeoff Thrust Control System (ATTCS), and 
Protection From Effects of High Intensity Radiated Fields (HIRF)

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Notice of proposed special conditions.

-----------------------------------------------------------------------

SUMMARY: This notice proposes special conditions for the Embraer Model 
ERJ 190 series airplane. This airplane will have novel or unusual 
design features when compared to the state of technology envisioned in 
the airworthiness standards for transport category airplanes. These 
design features are associated with (1) engine size and torque load 
which affect sudden engine stoppage, (2) electrical and electronic 
systems which perform critical functions, and (3) an Automatic Takeoff 
Thrust Control Systems (ATTCS). These proposed special conditions also 
pertain to the effects of such novel or unusual design features, such 
as their effects on the structural performance of the airplane. The 
applicable airworthiness regulations do not contain adequate or 
appropriate safety standards for these design features. These proposed 
special conditions contain the additional safety standards that the 
Administrator considers necessary to establish a level of safety 
equivalent to that established by the existing airworthiness standards.

DATES: Comments must be received on or before June 24, 2005.

ADDRESSES: Comments on this proposal may be mailed in duplicate to: 
Federal Aviation Administration, Transport Airplane Directorate, 
Attention: Rules Docket (ANM-113), Docket No. NM307, 1601 Lind Avenue, 
SW., Renton, Washington 98055-4056; or delivered in duplicate to the 
Transport Airplane Directorate at the above address. All comments must 
be marked: Docket No. NM307. Comments may be inspected in the Rules 
Docket weekdays, except Federal holidays, between 7:30 a.m. and 4 p.m.

FOR FURTHER INFORMATION CONTACT: Tom Groves, FAA, International Branch, 
ANM-116, Transport Airplane Directorate, Aircraft Certification 
Service, 1601 Lind Avenue, SW., Renton, Washington 98055-4056; 
telephone (425) 227-1503; facsimile (425) 227-1149.

SUPPLEMENTARY INFORMATION:

Comments Invited

    The FAA invites interested persons to participate in this 
rulemaking by submitting written comments, data, or views. The most 
helpful comments reference a specific portion of the special 
conditions, explain the reason for any recommended change, and include 
supporting data. We ask that you send us two copies of written 
comments.
    We will file in the docket all comments we receive as well as a 
report summarizing each substantive public contact with FAA personnel 
concerning these proposed special conditions. The docket is available 
for public inspection

[[Page 30021]]

before and after the comment closing date. If you wish to review the 
docket in person, go to the address in the ADDRESSES section of this 
notice between 7:30 a.m. and 4 p.m., Monday through Friday, except 
Federal holidays.
    We will consider all comments we receive on or before the closing 
date for comments. We will consider comments filed late, if it is 
possible to do so without incurring expense or delay. We may change the 
proposed special conditions in light of the comments we receive.
    If you want the FAA to acknowledge receipt of your comments on this 
proposal, include with your comments a pre-addressed, stamped postcard 
on which the docket number appears. We will stamp the date on the 
postcard and mail it back to you.

Background

    Embraer made the original application for certification of the ERJ 
190 on May 20, 1999. The Embraer application includes six different 
models, the initial variant being designated as the ERJ 190-100. The 
application was submitted concurrently with that for the ERJ 170-100, 
which received an FAA Type Certificate (TC) on February 20, 2004. 
Although the applications were submitted as two distinct type 
certificates, the airplanes share the same conceptual design and 
general configuration. On July 2, 2003, Embraer submitted a request for 
an extension of its original application for the ERJ 190 series, with a 
new proposed reference date of May 30, 2001, for establishing the type 
certification basis. The FAA certification basis was adjusted to 
reflect this new reference date. In addition Embraer has elected to 
voluntarily comply with certain 14 CFR part 25 amendments introduced 
after the May 30, 2001 reference date.
    The Embraer ERJ 190-100 is a low wing, transport-category aircraft 
powered by two wing-mounted General Electric CF34-10E turbofan engines. 
The airplane is a 108 passenger regional jet with a maximum take off 
weight of 51,800 kilograms (114,200 pounds). The maximum operating 
altitude and speed are 41,000 feet and 320 knots calibrated air speed 
(KCAS)/0.82 MACH, respectively.

Type Certification Basis

    Based on the May 30, 2001 reference date of application, and under 
the provisions of 14 CFR 21.17, Embraer must show that the Model ERJ 
190 airplane meets the applicable provisions of 14 CFR part 25, as 
amended by Amendments 25-1 through 25-101. If the Administrator finds 
that the applicable airworthiness regulations do not contain adequate 
or appropriate safety standards for the Embraer ERJ 190-100 airplane 
because of novel or unusual design features, special conditions are 
prescribed under the provisions of 14 CFR 21.16.
    Embraer has proposed to voluntarily adopt several 14 CFR part 25 
amendments that became effective after the requested new reference date 
of May 30, 2001, specifically Amendment 25-102, except paragraph 
25.981(c); Amendments 25-103 through 25-105 in their entirety; 
Amendment 25-107, except paragraph 25.735(h); Amendment 25-108 through 
25-110 in their entirety; and Amendments 25-112 through 25-114 in their 
entirety.
    In addition to the applicable airworthiness regulations and special 
conditions, the Embraer Model ERJ 190 series airplane must comply with 
the fuel vent and exhaust emission requirements of 14 CFR part 34 and 
the noise certification requirements of 14 CFR part 36, and the FAA 
must issue a finding of regulatory adequacy pursuant to section 611 of 
Public Law 93-574, the ``Noise Control Act of 1972.''
    Special conditions, as defined in Sec.  11.19, are issued in 
accordance with Sec.  11.38 and become part of the type certification 
basis in accordance with Sec.  21.17(a)(2).
    Special conditions are initially applicable to the model for which 
they are issued. Should the type certificate for that model be amended 
later to include any other model that incorporates the same novel or 
unusual design features, the special conditions would also apply to the 
other model under the provisions of Sec.  21.101.

Discussion of Novel or Unusual Design Features

    The Embraer ERJ 190 series airplanes will incorporate a number of 
novel or unusual design features. Because of rapid improvements in 
airplane technology, the applicable airworthiness regulations do not 
contain adequate or appropriate safety standards for these design 
features. The special conditions proposed for the Embraer ERJ 190 
series airplanes contain the additional safety standards that the 
Administrator considers necessary to establish a level of safety 
equivalent to that established by the existing airworthiness standards. 
These special conditions are the same as those required for the Embraer 
Model ERJ 170.
    The Embraer ERJ 190 series airplanes will incorporate the novel or 
unusual design features described below.

Engine Size and Torque Load

    Since 1957, Sec.  25.361(b)(1) has required that engine mounts and 
supporting structures must be designed to withstand the limit engine 
torque load which is posed by sudden engine stoppage due to malfunction 
or structural failure, such as compressor jamming. Design torque loads 
associated with typical failure scenarios were estimated by the engine 
manufacturer and provided to the airframe manufacturer as limit loads. 
These limit loads were considered simple, pure static torque loads. 
However, the size, configuration, and failure modes of jet engines have 
changed considerably from those envisioned when the engine seizure 
requirement of Sec.  25.361(b) was first adopted. Current engines are 
much larger and are now designed with large bypass fans capable of 
producing much larger torque, if they become jammed.
    Relative to the engine configurations that existed when the rule 
was developed in 1957, the present generation of engines is 
sufficiently different and novel to justify issuance of special 
conditions to establish appropriate design standards. The latest 
generation of jet engines is capable of producing, during failure, 
transient loads that are significantly higher and more complex than 
those produced by the generation of engines in existence when the 
current regulation was developed.
    In order to maintain the level of safety envisioned in 14 CFR 
25.361(b), more comprehensive criteria are needed for the new 
generation of high bypass engines. The proposed special condition would 
distinguish between the more common failure events involving transient 
deceleration conditions with temporary loss of thrust capability and 
those rare events resulting from structural failures. Associated with 
these events, the proposed criteria establish design limit and ultimate 
load conditions.

Interaction of Systems and Structures

    The Embraer Model 190 series airplane has fly-by-wire flight 
control systems and other power-operated systems that could affect the 
structural performance of the airplane, either directly or as a result 
of a failure or malfunction. These systems can alleviate loads in the 
airframe and, when in a failure state, can impose loads to the 
airframe. Currently, 14 CFR part 25 does not adequately account for the 
direct effects of these systems or for the effects of failure of these 
systems on structural performance of the airplane. The proposed special 
conditions

[[Page 30022]]

provide the criteria to be used in assessing these effects.

Electrical and Electronic Systems Which Perform Critical Functions

    The Embraer Model 190 series airplane will have electrical and 
electronic systems which perform critical functions. The electronic 
flight control system installations establish the criticality of the 
electrical power generation and distribution systems, since the loss of 
all electrical power may be catastrophic to the airplane. The current 
airworthiness standards of part 25 do not contain adequate or 
appropriate standards for the protection of the Electronic Flight 
Control System from the adverse effects of operations without normal 
electrical power. Accordingly, this system is considered to be a novel 
or unusual design feature, and special conditions are proposed to 
retain the level of safety envisioned by 14 CFR 25.1351(d).
    Section 25.1351(d), ``Operation without normal electrical power,'' 
requires safe operation in visual flight rule (VFR) conditions for at 
least five minutes with inoperative normal power. This rule was 
structured around a traditional design utilizing mechanical control 
cables for flight control surfaces and the pilot controls. Such 
traditional designs enable the flightcrew to maintain control of the 
airplane, while providing time to sort out the electrical failure, 
start engines if necessary, and re-establish some of the electrical 
power generation capability.
    The Embraer Model 190 series airplane, however, will utilize an 
Electronic Flight Control System for the pitch and yaw control 
(elevator, stabilizer, and rudder). There is no mechanical linkage 
between the pilot controls and these flight control surfaces. Pilot 
control inputs are converted to electrical signals, which are processed 
and then transmitted via wires to the control surface actuators. At the 
control surface actuators, the electrical signals are converted to an 
actuator command, which moves the control surface.
    In order to maintain the same level of safety as an airplane with 
conventional flight controls, an airplane with electronic flight 
controls--such as the Embraer Model 190 series--must not be time 
limited in its operation, including being without the normal source of 
electrical power generated by the engine or the Auxiliary Power Unit 
(APU) generators.
    Service experience has shown that the loss of all electrical power 
generated by the airplane's engine generators or APU is not extremely 
improbable. Thus, it must be demonstrated that the airplane can 
continue safe flight and landing (including steering and braking on 
ground for airplanes using steer/brake-by-wire) after total loss of 
normal electrical power with the use of its emergency electrical power 
systems. These emergency electrical power systems must be able to power 
loads that are essential for continued safe flight and landing.

Electronic Flight Control System

    In airplanes with Electronic Flight Control Systems, there may not 
always be a direct correlation between pilot control position and the 
associated airplane control surface position. Under certain 
circumstances, a commanded maneuver that does not require a large 
control input may require a large control surface movement, possibly 
encroaching on a control surface or actuation system limit without the 
flightcrew's knowledge. This situation can arise in either manually 
piloted or autopilot flight and may be further exacerbated on airplanes 
where the pilot controls are not back-driven during autopilot system 
operation. Unless the flightcrew is made aware of excessive deflection 
or impending control surface limiting, control of the airplane by the 
pilot or autoflight system may be inadvertently continued so as to 
cause loss of control of the airplane or other unsafe characteristics 
of stability or performance.
    Given these possibilities, a special condition for Embraer Model 
ERJ 190 series airplanes addresses control surface position awareness. 
This special condition requires that suitable display or annunciation 
of flight control position be provided to the flightcrew when near full 
surface authority (not crew-commanded) is being used, unless other 
existing indications are found adequate or sufficient to prompt any 
required crew actions. Suitability of such a display or annunciation 
must take into account that some piloted maneuvers may demand the 
airplane's maximum performance capability, possibly associated with a 
full control surface deflection. Therefore, simple display systems--
that would function in both intended and unexpected control-limiting 
situations--must be properly balanced to provide needed crew awareness 
and minimize nuisance alerts.

Automatic Takeoff Thrust Control System

    The Embraer Model ERJ 190 series airplane will incorporate an 
Automatic Takeoff Thrust Control System (ATTCS) in the engine's Full 
Authority Digital Electronic Control (FADEC) system architecture. The 
manufacturer requested that the FAA issue special conditions to allow 
performance credit to be taken for use of this function during go-
around to show compliance with the requirement of Sec.  25.121(d) 
regarding the approach climb gradient.
    Section 25.904 and Appendix I refer to operation of ATTCS only 
during takeoff. Model ERJ 190 series airplanes have this feature for 
go-around also. The ATTCS will automatically increase thrust to the 
maximum go-around thrust available under the ambient conditions in the 
following circumstances:
     If an engine failure occurs during an all-engines-
operating go-around, or
     If an engine has failed or been shut down earlier in the 
flight.
    This maximum go-around thrust is the same as that used to show 
compliance with the approach-climb-gradient requirement of Sec.  
25.121(d). If the ATTCS is not operating, selection of go-around thrust 
will result in a lower thrust level.
    The part 25 standards for ATTCS, contained in Sec.  25.904 
[Automatic takeoff thrust control system (ATTCS) and Appendix I], 
specifically restrict performance credit for ATTCS to takeoff. 
Expanding the scope of the standards to include other phases of flight, 
such as go-around, was considered when the standards were issued but 
was not accepted because of the effect on the flightcrew's workload. As 
stated in the preamble to amendment 25-62:

In regard to ATTCS credit for approach climb and go-around 
maneuvers, current regulations preclude a higher thrust for the 
approach climb [Sec.  25.121(d)] than for the landing climb [Sec.  
25.119]. The workload required for the flightcrew to monitor and 
select from multiple in-flight thrust settings in the event of an 
engine failure during a critical point in the approach, landing, or 
go-around operations is excessive. Therefore, the FAA does not agree 
that the scope of the amendment should be changed to include the use 
of ATTCS for anything except the takeoff phase. (Refer to 52 FR 
43153, November 9, 1987.)

    The ATTCS incorporated on Embraer Model ERJ 190 series airplanes 
allows the pilot to use the same power setting procedure during a go-
around, regardless of whether or not an engine fails. In either case, 
the pilot obtains go-around power by moving the throttles into the 
forward (takeoff/go-around) throttle detent. Since the ATTCS is 
permanently armed for the go-around phase, it will function 
automatically following an engine failure and advance the remaining 
engine to the ATTCS thrust level. This design adequately

[[Page 30023]]

addresses the concerns about pilot workload which were discussed in the 
preamble to Amendment 25-62.
    The system design allows the pilot to enable or disable the ATTCS 
function for takeoff. If the pilot enables ATTCS, a white ``ATTCS'' 
icon will be displayed on the Engine Indication and Crew Alerting 
System (EICAS) beneath the thrust mode indication on the display. This 
white icon indicates to the pilot that the ATTCS function is enabled. 
When the throttle lever is put in the TO/GA (takeoff/go-around) detent 
position, the white icon turns green, indicating to the pilot that the 
ATTCS is armed. If the pilot disables the ATTCS function for takeoff, 
no indication appears on the EICAS.
    Regardless of whether the ATTCS is enabled for takeoff, it is 
automatically enabled when the airplane reaches the end of the take-off 
phase (that is, the thrust lever is below the TO/GA position and the 
altitude is greater than 1,700 feet above the ground, 5 minutes have 
elapsed since lift-off, or the airplane speed is greater than 140 
knots).
    During climb, cruise, and descent, when the throttle is not in the 
TO/GA position, the ATTCS indication is inhibited. During descent and 
approach to land, until the thrust management system go-around mode is 
enabled--either by crew action or automatically when the landing gear 
are down and locked and flaps are extended--the ATTCS indication 
remains inhibited.
    When the go-around thrust mode is enabled, unless the ATTCS system 
has failed, the white ``ATTCS'' icon will again be shown on the EICAS, 
indicating to the pilot that the system is enabled and in an operative 
condition in the event a go-around is necessary. If the thrust lever is 
subsequently placed in the TO/GA position, the ATTCS icon turns green, 
indicating that the system is armed and ready to operate.
    If an engine fails during the go-around or during a one-engine-
inoperative go-around in which an engine had been shut down or 
otherwise made inoperative earlier in the flight, the EICAS indication 
will be GA RSV (go-around reserve) when the thrust levers are placed in 
the TO/GA position. The GA RSV indication means that the maximum go-
around thrust under the ambient conditions has been commanded.
    The propulsive thrust used to determine compliance with the 
approach climb requirements of Sec.  25.121(d) is limited to the lesser 
of (i) the thrust provided by the ATTCS system, or (ii) 111 percent of 
the thrust resulting from the initial thrust setting with the ATTCS 
system failing to perform its uptrim function and without action by the 
crew to reset thrust. This requirement limits the adverse performance 
effects of a failure of the ATTCS and ensures adequate all-engines-
operating go-around performance.
    These special conditions require a showing of compliance with the 
provisions of Sec.  25.904 and Appendix I applicable to the approach 
climb and go-around maneuvers.
    The definition of a critical time interval for the approach climb 
case is of primary importance. During this time, it must be extremely 
improbable to violate a flight path derived from the gradient 
requirement of Sec.  25.121(d). That gradient requirement implies a 
minimum one-engine-inoperative flight path with the airplane in the 
approach configuration. The engine may have been inoperative before 
initiating the go-around, or it may become inoperative during the go-
around. The definition of the critical time interval must consider both 
possibilities.

Protection From Effects of HIRF

    As noted earlier, Embraer Model ERJ 190 series airplanes will 
include an Electronic Flight Control System as well as advanced 
avionics for the display and control of critical airplane functions. 
These systems may be vulnerable to high-intensity radiated fields 
(HIRF) external to the airplane. The current airworthiness standards of 
part 25 do not contain adequate or appropriate safety standards that 
address the protection of this equipment from the adverse effects of 
HIRF. Accordingly, these systems are considered to be novel or unusual 
design features.
    There is no specific regulation that addresses protection 
requirements for electrical and electronic systems from HIRF. Increased 
power levels from ground-based radio transmitters and the growing use 
of sensitive avionics/electronics and electrical systems to command and 
control airplanes have made it necessary to provide adequate 
protection.
    To ensure that a level of safety is achieved that is equivalent to 
that intended by the applicable regulations, special conditions are 
needed for the Embraer Model ERJ 190 series airplanes. These special 
conditions require that avionics/electronics and electrical systems 
that perform critical functions be designed and installed to preclude 
component damage and interruption of function due to both the direct 
and indirect effects of HIRF.
    With the trend toward increased power levels from ground-based 
transmitters and the advent of space and satellite communications 
coupled with electronic command and control of the airplane, the 
immunity of critical avionics/electronics and electrical systems to 
HIRF must be established.
    It is not possible to precisely define the HIRF to which the 
airplane will be exposed in service. There is also uncertainty 
concerning the effectiveness of airframe shielding for HIRF. 
Furthermore, coupling of electromagnetic energy to cockpit-installed 
equipment through the cockpit window apertures is undefined. Based on 
surveys and analysis of existing HIRF emitters, an adequate level of 
protection exists when compliance with the HIRF protection special 
condition is shown in accordance with either paragraph 1 or 2 below:
    1. A minimum threat of 100 volts rms (root-mean-square) per meter 
electric field strength from 10 KHz to 18 GHz.
    a. The threat must be applied to the system elements and their 
associated wiring harnesses without the benefit of airframe shielding.
    b. Demonstration of this level of protection is established through 
system tests and analysis.
    2. A threat external to the airframe of the field strengths 
indicated in the table below for the frequency ranges indicated. Both 
peak and average field strength components from the table are to be 
demonstrated.

------------------------------------------------------------------------
                                                       Field strength
                                                      (volts per meter)
                     Frequency                     ---------------------
                                                       Peak     Average
------------------------------------------------------------------------
10 kHz-100 kHz....................................         50         50
100 kHz-500 kHz...................................         50         50
500 kHz-2 MHz.....................................         50         50
2 MHz-30 MHz......................................        100        100
30 MHz-70 MHz.....................................         50         50
70 MHz-100 MHz....................................         50         50
100 MHz-200 MHz...................................        100        100
200 MHz-400 MHz...................................        100        100
400 MHz-700 MHz...................................        700         50
700 MHz-1 GHz.....................................        700        100
1 GHz-2 GHz.......................................       2000       2000
2 GHz-4 GHz.......................................       3000        200
4 GHz-6 GHz.......................................       3000        200
6 GHz-8 GHz.......................................       1000        200
8 GHz-12 GHz......................................       3000        300
12 GHz-18 GHz.....................................       2000        200
18 GHz-40 GHz.....................................        600        200
------------------------------------------------------------------------

    The field strengths are expressed in terms of peak of the root-
mean-square (rms) over the complete modulation period.
    The threat levels identified above are the result of an FAA review 
of existing studies on the subject of HIRF, in light of the ongoing 
work of the Electromagnetic Effects Harmonization Working Group of the 
Aviation Rulemaking Advisory Committee.

[[Page 30024]]

Applicability

    As discussed above, these special conditions are applicable to the 
Embraer ERJ 190 series airplane. Should Embraer apply at a later date 
for a change to the type certificate to include another model 
incorporating the same novel or unusual design features, these special 
conditions would apply to that model as well under the provisions of 
Sec.  21.101.

Conclusion

    This action affects only certain novel or unusual design features 
of the Embraer ERJ 190 series airplane. This is not a rule of general 
applicability.

List of Subjects in 14 CFR Part 25

    Aircraft, Aviation safety, Reporting and recordkeeping 
requirements.

    The authority citation for these special conditions is as follows:

    Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.

The Proposed Special Conditions

    Accordingly, pursuant to the authority delegated to me by the 
Administrator, the Federal Aviation Administration (FAA) proposes the 
following special conditions as part of the type certification basis 
for the Embraer ERJ 190 series airplane.

Sudden Engine Stoppage

    In lieu of compliance with Sec.  25.361(b) the following special 
condition applies:
    1. For turbine engine installations, the engine mounts, pylons and 
adjacent supporting airframe structure must be designed to withstand 1g 
level flight loads acting simultaneously with the maximum limit torque 
loads imposed by each of the following:
    a. Sudden engine deceleration due to a malfunction which could 
result in a temporary loss of power or thrust; and
    b. The maximum acceleration of the engine.
    2. For auxiliary power unit installations, the power unit mounts 
and adjacent supporting airframe structure must be designed to 
withstand 1g level flight loads acting simultaneously with the maximum 
limit torque loads imposed by each of the following:
    a. Sudden auxiliary power unit deceleration due to malfunction or 
structural failure; and
    b. The maximum acceleration of the power unit.
    3. For engine supporting structures, an ultimate loading condition 
must be considered that combines 1g flight loads with the transient 
dynamic loads resulting from:
    a. The loss of any fan, compressor, or turbine blade; and
    b. Separately, where applicable to a specific engine design, any 
other engine structural failure that results in higher loads.
    4. The ultimate loads developed from the conditions specified in 
paragraphs 3.a. and 3.b. above are to be multiplied by a factor of 1.0 
when applied to engine mounts and pylons and multiplied by a factor of 
1.25 when applied to adjacent supporting airframe structure.

Interaction of Systems and Structures

    In addition to the requirements of part 25, subparts C and D, the 
following special condition applies:
    1. General. For airplanes equipped with systems that affect 
structural performance, either directly or as a result of a failure or 
malfunction, the influence of these systems and their failure 
conditions must be taken into account when showing compliance with the 
requirements of 14 CFR part 25, subparts C and D. The following 
criteria must be used to evaluate the structural performance of 
airplanes equipped with flight control systems, autopilots, stability 
augmentation systems, load alleviation systems, ``flutter'' control 
systems, and fuel management systems. If these criteria are used for 
other systems, it may be necessary to adapt the criteria to the 
specific system.
    a. The criteria defined herein address only the direct structural 
consequences of the system responses and performances and cannot be 
considered in isolation but should be included in the overall safety 
evaluation of the airplane. These criteria may in some instances 
duplicate standards already established for this evaluation. These 
criteria are applicable only to structures whose failure could prevent 
continued safe flight and landing. Specific criteria that define 
acceptable limits on handling characteristics or stability requirements 
when operating in the system degraded or inoperative mode are not 
provided in this special condition.
    b. Depending upon the specific characteristics of the airplane, 
additional studies that go beyond the criteria provided in this special 
condition may be required in order to demonstrate the capability of the 
airplane to meet other realistic conditions, such as alternative gust 
or maneuver descriptions for an airplane equipped with a load 
alleviation system.
    c. The following definitions are applicable to this special 
condition:
    Structural performance: Capability of the airplane to meet the 
structural requirements of 14 CFR part 25.
    Flight limitations: Limitations that can be applied to the airplane 
flight conditions following an in-flight occurrence and that are 
included in the flight manual (e.g., speed limitations, avoidance of 
severe weather conditions, etc.).
    Operational limitations: Limitations, including flight limitations, 
that can be applied to the airplane operating conditions before 
dispatch (e.g., fuel and payload limitations).
    Probabilistic terms: The probabilistic terms (probable, improbable, 
extremely improbable) used in this special condition are the same as 
those used in 14 CFR 25.1309.
    Failure condition: The term failure condition is the same as that 
used in 14 CFR 25.1309; however, this special condition applies only to 
system failure conditions that affect the structural performance of the 
airplane (e.g., failure conditions that induce loads, lower flutter 
margins, or change the response of the airplane to inputs, such as 
gusts or pilot actions).
    2. Effects of Systems on Structures.
    a. General. The following criteria will be used in determining the 
influence of a system and its failure conditions on the airplane 
structure.
    b. System fully operative. With the system fully operative, the 
following apply:
    (1) Limit loads must be derived in all normal operating 
configurations of the system from all the limit conditions specified in 
14 CFR part 25, Subpart C, taking into account any special behavior of 
such a system or associated functions or any effect on the structural 
performance of the airplane that may occur up to the limit loads. In 
particular, any significant nonlinearity (rate of displacement of 
control surface, thresholds, or any other system nonlinearities) must 
be accounted for in a realistic or conservative way when deriving limit 
loads from limit conditions.
    (2) The airplane must meet the strength requirements of 14 CFR part 
25 (static strength, residual strength) using the specified factors to 
derive ultimate loads from the limit loads defined above. The effect of 
nonlinearities must be investigated beyond limit conditions to ensure 
the behavior of the system presents no anomaly compared to the behavior 
below limit conditions. However, conditions beyond limit conditions 
need not be considered when it can be shown that the airplane has 
design features that will not allow it to exceed those limit 
conditions.
    (3) The airplane must meet the aeroelastic stability requirements 
of 14 CFR 25.629.

[[Page 30025]]

    c. System in the failure condition. For any system failure 
condition not shown to be extremely improbable, the following apply:
    (1) At the time of occurrence. Starting from l-g level flight 
conditions, a realistic scenario, including pilot corrective actions, 
must be established to determine the loads occurring at the time of 
failure and immediately after failure.
    (i) For static strength substantiation, these loads multiplied by 
an appropriate factor of safety that is related to the probability of 
occurrence of the failure of the ultimate loads to be considered for 
design. The factor of safety I (FS) is defined in figure 1.
[GRAPHIC] [TIFF OMITTED] TP25MY05.040

    (ii) For residual strength substantiation, the airplane must be 
able to withstand two-thirds of the ultimate loads defined in 
subparagraph (c)(1)(i).
    (iii) Freedom from aeroelastic instability must be shown up to the 
speeds defined in 14 CFR 25.629(b)(2). For failure conditions that 
result in speed increases beyond Vc/Mc, freedom 
from aeroelastic instability must be shown to increased speeds, so that 
the margins intended by 14 CFR 25.629(b)(2) are maintained.
    (iv) Failures of the system that result in forced structural 
vibrations (oscillatory failures) must not produce loads that could 
result in detrimental deformation of primary structure.
    (2) For the continuation of the flight. For the airplane, in the 
system-failed state and considering any appropriate reconfiguration and 
flight limitations, the following apply:
    (i) The loads derived from the following conditions at speeds up to 
Vc or the speed limitation prescribed for the remainder of 
the flight must be determined:
    (A) The limit symmetrical maneuvering conditions specified in 14 
CFR 25.331 and 25.345.
    (B) The limit gust and turbulent conditions specified in 14 CFR 
25.341 and 25.345.
    (C) The limit rolling conditions specified in 14 CFR 25.349 and the 
limit unsymmetrical conditions specified in 14 CFR 25.367 and 25.427(b) 
and (c).
    (D) The limit yaw maneuvering conditions specified in 14 CFR 
25.351.
    (E) The limit ground loading conditions specified in 14 CFR 25.473 
and 25.491.
    (ii) For static strength substantiation, each part of the structure 
must be able to withstand the loads specified in paragraph (2)(i) above 
multiplied by a factor of safety depending on the probability of being 
in this failure state. The factor of safety is defined in figure 2.
[GRAPHIC] [TIFF OMITTED] TP25MY05.041

Qj = (Tj)(Pj) where:
Tj = Average time spent in failure condition j (in hours)
Pj = Probability of occurrence of failure mode j (per hour)


[[Page 30026]]


    Note: If Pj is greater than 10 -3 per flight hour, 
then a 1.5 factor of safety must be applied to all limit load 
conditions specified in 14 CFR 25, Subpart C.

    (iii) For residual strength substantiation, the airplane must be 
able to withstand two-thirds of the ultimate loads defined in paragraph 
(c)(2)(ii) above.
    (iv) If the loads induced by the failure condition have a 
significant effect on fatigue or damage tolerance then their effects 
must be taken into account.
    (v) Freedom from aeroelastic instability must be shown up to a 
speed determined from figure 3. Flutter clearance speeds V' and V'' may 
be based on the speed limitation specified for the remainder of the 
flight using the margins defined by 14 CFR 25.629(b).

[GRAPHIC] [TIFF OMITTED] TP25MY05.042

V' = Clearance speed as defined by 14 CFR 25.629(b)(2)
V'' = Clearance speed as defined by 14 CFR 25.629(b)(1)
Qj = (Tj)(Pj) where:
Tj = Average time spent in failure condition j (in hours)
Pj = Probability of occurrence of failure mode j (per hour)

    Note: If Pj is greater than 10 -3 per flight hour, 
then the flutter clearance speed must not be less than V''.

    (vi) Freedom from aeroelastic instability must also be shown up to 
V' in figure 3 above for any probable system failure condition combined 
with any damage required or selected for investigation by 14 CFR 
25.571(b).
    (3) Consideration of certain failure conditions may be required by 
other sections of 14 CFR 25, regardless of calculated system 
reliability. Where analysis shows the probability of these failure 
conditions to be less than 10-9, criteria other than those 
specified in this paragraph may be used for structural substantiation 
to show continued safe flight and landing.
    d. Warning considerations. For system failure detection and 
warning, the following apply:
    (1) The system must be checked for failure conditions, not 
extremely improbable, that degrade the structural capability below the 
level required by 14 CFR part 25 or significantly reduce the 
reliability of the remaining system. The flight crew must be made aware 
of these failures before flight. Certain elements of the control 
system, such as mechanical and hydraulic components, may use special 
periodic inspections, and electronic components may use daily checks in 
lieu of warning systems to achieve the objective of this requirement. 
These certification maintenance requirements must be limited to 
component failures that are not readily detectable by normal warning 
systems and where service history shows that inspections will provide 
an adequate level of safety.
    (2) The existence of any failure condition not extremely improbable 
during flight--that could significantly affect the structural 
capability of the airplane and for which the associated reduction in 
airworthiness can be minimized by suitable flight limitations--must be 
signaled to the flight crew. For example, failure conditions that 
result in a factor of safety between the airplane strength and the 
loads of 14 CFR part 25, subpart C below 1.25 or flutter margins below 
V'' must be signaled to the crew during flight.
    e. Dispatch with known failure conditions. If the airplane is to be 
dispatched in a known system failure condition that affects structural 
performance or affects the reliability of the remaining system to 
maintain structural performance, then the provisions of this special 
condition must be met for the dispatched condition and for subsequent 
failures. Flight limitations and expected operational limitations may 
be taken into account in establishing Qj as the combined probability of 
being in the dispatched failure condition and the subsequent failure 
condition for the safety margins in figures 2 and 3. These limitations 
must be such that the probability of being in this combined failure 
state and then subsequently encountering limit load conditions is 
extremely improbable. No reduction in these safety margins is allowed 
if the subsequent system failure rate is greater than 10 -3 
per flight hour.

Operation Without Normal Electrical Power

    In lieu of compliance with 14 CFR 25.1351(d), the following special 
condition applies:
    It must be demonstrated by test or by a combination of test and 
analysis that the airplane can continue safe flight and landing with 
inoperative normal engine and APU generator electrical power (in other 
words without electrical power from any source, except the battery and 
any other standby electrical sources). The airplane operation should be 
considered at the critical phase of flight and include the ability to 
restart the engines and maintain flight for the maximum diversion time 
capability being certified.

Electronic Flight Control System

    In addition to compliance with Sec. Sec.  25.143, 25.671 and 
25.672, when a flight condition exists where, without being commanded 
by the crew, control surfaces are coming so close to their limits that 
return to the normal flight envelope and (or) continuation of safe 
flight requires a specific crew action, a suitable flight control 
position

[[Page 30027]]

annunciation shall be provided to the crew, unless other existing 
indications are found adequate or sufficient to prompt that action.

    Note: The term suitable also indicates an appropriate balance 
between nuisance and necessary operation.

Automatic Takeoff Thrust Control System (ATTCS)

    To use the thrust provided by the ATTCS to determine the approach 
climb performance limitations, the Embraer Model ERJ 190 series 
airplane must comply with the requirements of Sec.  25.904 and Appendix 
I, including the following requirements pertaining to the go-around 
phase of flight:
    1. Definitions.
    a. TOGA--(Take Off/Go-Around). Throttle lever in takeoff or go-
around position.
    b. Automatic Takeoff Thrust Control System--(ATTCS). The Embraer 
Model ERJ-190 series ATTCS is defined as the entire automatic system 
available in takeoff when selected by the pilot and always in go-around 
mode, including all devices, both mechanical and electrical, that sense 
engine failure, transmit signals, and actuate fuel controls or power 
levers or increase engine power by other means on operating engines to 
achieve scheduled thrust or power increases and to furnish cockpit 
information on system operation.
    c. Critical Time Interval. The definition of the Critical Time 
Interval in Appendix I, Sec.  I25.2(b) is expanded to include the 
following:
    (1) When conducting an approach for landing using ATTCS, the 
critical time interval is defined as 120 seconds. A shorter time 
interval may be used if justified by a rational analysis. An accepted 
analysis that has been used on past aircraft certification programs is 
as follows:
    (i) The critical time interval begins at a point on a 2.5 degree 
approach glide path from which, assuming a simultaneous engine and 
ATTCS failure, the resulting approach climb flight path intersects a 
flight path originating at a later point on the same approach path 
corresponding to the part 25 one-engine-inoperative approach climb 
gradient. The period of time from the point of simultaneous engine and 
ATTCS failure to the intersection of these flight paths must be no 
shorter than the time interval used in evaluating the critical time 
interval for takeoff, beginning from the point of simultaneous engine 
and ATTCS failure and ending upon reaching a height of 400 feet.
    (ii) The critical time interval ends at the point on a minimum 
performance, all-engines-operating go-around flight path from which, 
assuming a simultaneous engine and ATTCS failure, the resulting minimum 
approach climb flight path intersects a flight path corresponding to 
the part 25 minimum one-engine-inoperative approach-climb-gradient. The 
all-engines-operating go-around flight path and the part 25 one-engine-
inoperative, approach-climb-gradient flight path originate from a 
common point on a 2.5 degree approach path. The period of time from the 
point of simultaneous engine and ATTCS failure to the intersection of 
these flight paths must be no shorter than the time interval used in 
evaluating the critical time interval for the takeoff, beginning from 
the point of simultaneous engine and ATTCS failure and ending upon 
reaching a height of 400 feet.
    (2) The critical time interval must be determined at the altitude 
resulting in the longest critical time interval for which one-engine-
inoperative approach climb performance data are presented in the 
Airplane Flight Manual (AFM).
    (3) The critical time interval is illustrated in the following 
figure:
[GRAPHIC] [TIFF OMITTED] TP25MY05.043

    The engine and ATTCS failed time interval must be no shorter than 
the time interval from the point of simultaneous engine and ATTCS 
failure to a height of 400 feet used to comply with I25.2(b) for ATTCS 
use during takeoff.
    2. Performance and System Reliability Requirements. The applicant 
must comply with the following performance and ATTCS reliability 
requirements:
    a. An ATTCS failure or combination of failures in the ATTCS during 
the critical time interval:
    (1) Shall not prevent the insertion of the maximum approved go-
around thrust or power or must be shown to be an improbable event.
    (2) Shall not result in a significant loss or reduction in thrust 
or power or must be shown to be an extremely improbable event.
    b. The concurrent existence of an ATTCS failure and an engine 
failure during the critical time interval must be shown to be extremely 
improbable.
    c. All applicable performance requirements of part 25 must be met

[[Page 30028]]

with an engine failure occurring at the most critical point during go-
around with the ATTCS system functioning.
    d. The probability analysis must include consideration of ATTCS 
failure occurring after the time at which the flightcrew last verifies 
that the ATTCS is in a condition to operate until the beginning of the 
critical time interval.
    e. The propulsive thrust obtained from the operating engine after 
failure of the critical engine during a go-around used to show 
compliance with the one-engine-inoperative climb requirements of Sec.  
25.121(d) may not be greater than the lesser of:
    (i) The actual propulsive thrust resulting from the initial setting 
of power or thrust controls with the ATTCS functioning; or
    (ii) 111 percent of the propulsive thrust resulting from the 
initial setting of power or thrust controls with the ATTCS failing to 
reset thrust or power and without any action by the crew to reset 
thrust or power.
    3. Thrust Setting.
    a. The initial go-around thrust setting on each engine at the 
beginning of the go-around phase may not be less than any of the 
following:
    (1) That required to permit normal operation of all safety-related 
systems and equipment dependent upon engine thrust or power lever 
position; or
    (2) That shown to be free of hazardous engine response 
characteristics when thrust or power is advanced from the initial go-
around position to the maximum approved power setting.
    b. For approval of an ATTCS for go-around, the thrust setting 
procedure must be the same for go-arounds initiated with all engines 
operating as for go-arounds initiated with one engine inoperative.
    4. Powerplant Controls.
    a. In addition to the requirements of Sec.  25.1141, no single 
failure or malfunction or probable combination thereof of the ATTCS, 
including associated systems, may cause the failure of any powerplant 
function necessary for safety.
    b. The ATTCS must be designed to accomplish the following:
    (1) Apply thrust or power on the operating engine(s), following any 
single engine failure during go around, to achieve the maximum approved 
go-around thrust without exceeding the engine operating limits;
    (2) Permit manual decrease or increase in thrust or power up to the 
maximum go-around thrust approved for the airplane under existing 
conditions through the use of the power lever. For airplanes equipped 
with limiters that automatically prevent the engine operating limits 
from being exceeded under existing ambient conditions, other means may 
be used to increase the thrust in the event of an ATTCS failure, 
provided that the means meet the following criteria:
     Are located on or forward of the power levers;
     Are easily identified and operated under all operating 
conditions by a single action of either pilot with the hand that is 
normally used to actuate the power levers, and
     Meet the requirements of Sec.  25.777 (a), (b), and (c);
    (3) Provide a means for the flightcrew to verify before beginning 
an approach for landing that the ATTCS is in a condition to operate 
(unless it can be demonstrated that an ATTCS failure combined with an 
engine failure during an entire flight is extremely improbable); and
    (4) Provide a means for the flightcrew to deactivate the automatic 
function. This means must be designed to prevent inadvertent 
deactivation.
    5. Powerplant Instruments. In addition to the requirements of Sec.  
25.1305, the following requirements must be met:
    a. A means must be provided to indicate when the ATTCS is in the 
armed or ready condition; and
    b. If the inherent flight characteristics of the airplane do not 
provide adequate warning that an engine has failed, a warning system 
that is independent of the ATTCS must be provided to give the pilot a 
clear warning of any engine failure during go-around.

Protection From Effects of HIRF

    Each electrical and electronic system that performs critical 
functions must be designed and installed to ensure that the operation 
and operational capability of these systems to perform critical 
functions are not adversely affected when the airplane is exposed to 
high-intensity radiated fields external to the airplane.
    For the purpose of this special condition, the following definition 
applies:
    Critical Functions: Functions whose failure would contribute to or 
cause a failure condition that would prevent the continued safe flight 
and landing of the airplane.

    Issued in Renton, Washington, on May 13, 2005.
Jeffrey Duven,
Acting Manager, Transport Airplane Directorate, Aircraft Certification 
Service.
[FR Doc. 05-10367 Filed 5-24-05; 8:45 am]
BILLING CODE 4910-13-P