Special Conditions: Embraer Model ERJ 190 Series Airplanes; Sudden Engine Stoppage, Interaction of Systems and Structures, Operation Without Normal Electrical Power, Electronic Flight Control Systems, Automatic Takeoff Thrust Control System (ATTCS), and Protection From Effects of High Intensity Radiated Fields (HIRF), 49155-49164 [05-16728]

Agencies

• Federal Aviation Administration
• DEPARTMENT OF TRANSPORTATION

[Federal Register Volume 70, Number 162 (Tuesday, August 23, 2005)]
[Rules and Regulations]
[Pages 49155-49164]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 05-16728]


-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 25

[Docket No. NM307; Special Conditions No. 25-296-SC]


Special Conditions: Embraer Model ERJ 190 Series Airplanes; 
Sudden Engine Stoppage, Interaction of Systems and Structures, 
Operation Without Normal Electrical Power, Electronic Flight Control 
Systems, Automatic Takeoff Thrust Control System (ATTCS), and 
Protection From Effects of High Intensity Radiated Fields (HIRF)

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Final special conditions.

-----------------------------------------------------------------------

[[Page 49156]]

SUMMARY: These special conditions are issued for the Embraer Model ERJ 
190 series airplane. This airplane will have novel or unusual design 
features when compared to the state of technology envisioned in the 
airworthiness standards for transport category airplanes. These design 
features are associated with (1) engine size and torque load which 
affect sudden engine stoppage, (2) electrical and electronic systems 
which perform critical functions, and (3) an Automatic Takeoff thrust 
Control Systems (ATTCS). These special conditions also pertain to the 
effects of such novel or unusual design features, such as their effects 
on the structural performance of the airplane. The applicable 
airworthiness regulations do not contain adequate or appropriate safety 
standards for these design features. These special conditions contain 
the additional safety standards that the Administrator considers 
necessary to establish a level of safety equivalent to that established 
by the existing airworthiness standards.

DATES: Effective August 23, 2005.

FOR FURTHER INFORMATION CONTACT: Tom Groves, FAA, International Branch, 
ANM-116, Transport Airplane Directorate, Aircraft Certification 
Service, 1601 Lind Avenue SW., Renton, Washington 98055-4056; telephone 
(425) 227-1503; facsimile (425) 227-1149.

SUPPLEMENTARY INFORMATION:

Background

    Embraer made the original application for certification of the ERJ 
190 on May 20, 1999. The Embraer application includes six different 
models, the initial variant being designated as the ERJ 190-100. The 
application was submitted concurrently with that for the ERJ 170-100, 
which received an FAA Type Certificate (TC) on February 20, 2004. 
Although the applications were submitted as two distinct type 
certificates, the airplanes share the same conceptual design and 
general configuration. On July 2, 2003, Embraer submitted a request for 
an extension of its original application for the ERJ 190 series, with a 
new proposed reference date of May 30, 2001, for establishing the type 
certification basis. The FAA certification basis was adjusted to 
reflect this new reference date. In addition Embraer has elected to 
voluntarily comply with certain 14 CFR part 25 amendments introduced 
after the May 30, 2001 reference date.
    The Embraer ERJ 190-100 is a low wing, transport-category aircraft 
powered by two wing-mounted General Electric CF34-10E turbofan engines. 
The airplane is a 108 passenger regional jet with a maximum take off 
weight of 51,800 kilograms (114,200 pounds). The maximum operating 
altitude and speed are 41,000 feet and 320 knots calibrated air speed 
(KCAS)/0.82 MACH, respectively.

Type Certification Basis

    Based on the May 30, 2001 reference date of application, and under 
the provisions of 14 CFR 21.17, Embraer must show that the Model ERJ 
190 airplane meets the applicable provisions of 14 CFR part 25, as 
amended by Amendments 25-1 through 25-101. If the Administrator finds 
that the applicable airworthiness regulations do not contain adequate 
or appropriate safety standards for the Embraer ERJ 190-100 airplane 
because of novel or unusual design features, special conditions are 
prescribed under the provisions of 14 CFR 21.16.
    Embraer has proposed to voluntarily adopt several 14 CFR part 25 
amendments that became effective after the requested new reference date 
of May 30, 2001, specifically Amendment 25-102, except paragraph 
25.981(c); Amendments 25-103 through 25-105 in their entirety; 
Amendment 25-107, except paragraph 25.735(h); Amendment 25-108 through 
25-110 in their entirety; and Amendments 25-112 through 25-114 in their 
entirety.
    In addition to the applicable airworthiness regulations and special 
conditions, the Embraer Model ERJ 190 series airplane must comply with 
the fuel vent and exhaust emission requirements of 14 CFR part 34 and 
the noise certification requirements of 14 CFR part 36, and the FAA 
must issue a finding of regulatory adequacy pursuant to section 611 of 
Public Law 93-574, the ``Noise Control Act of 1972.''
    Special conditions, as defined in Sec.  11.19, are issued in 
accordance with Sec.  11.38 and become part of the type certification 
basis in accordance with Sec.  21.17(a)(2).
    Special conditions are initially applicable to the model for which 
they are issued. Should the type certificate for that model be amended 
later to include any other model that incorporates the same novel or 
unusual design features, the special conditions would also apply to the 
other model under the provisions of Sec.  21.101.

Discussion of Novel or Unusual Design Features

    The Embraer ERJ 190 series airplanes will incorporate a number of 
novel or unusual design features. Because of rapid improvements in 
airplane technology, the applicable airworthiness regulations do not 
contain adequate or appropriate safety standards for these design 
features. The special conditions proposed for the Embraer ERJ 190 
series airplanes contain the additional safety standards that the 
Administrator considers necessary to establish a level of safety 
equivalent to that established by the existing airworthiness standards. 
These special conditions are the same as those required for the Embraer 
Model ERJ 170.
    The Embraer ERJ 190 series airplanes will incorporate the novel or 
unusual design features described below.

Engine Size and Torque Load

    Since 1957, Sec.  25.361(b)(1) has required that engine mounts and 
supporting structures must be designed to withstand the limit engine 
torque load which is posed by sudden engine stoppage due to malfunction 
or structural failure, such as compressor jamming. Design torque loads 
associated with typical failure scenarios were estimated by the engine 
manufacturer and provided to the airframe manufacturer as limit loads. 
These limit loads were considered simple, pure static torque loads. 
However, the size, configuration, and failure modes of jet engines have 
changed considerably from those envisioned when the engine seizure 
requirement of Sec.  25.361(b) was first adopted. Current engines are 
much larger and are now designed with large bypass fans capable of 
producing much larger torque, if they become jammed.
    Relative to the engine configurations that existed when the rule 
was developed in 1957, the present generation of engines is 
sufficiently different and novel to justify issuance of special 
conditions to establish appropriate design standards. The latest 
generation of jet engines is capable of producing, during failure, 
transient loads that are significantly higher and more complex than 
those produced by the generation of engines in existence when the 
current regulation was developed.
    In order to maintain the level of safety envisioned in Sec.  
25.361(b), more comprehensive criteria are needed for the new 
generation of high bypass engines. The proposed special condition would 
distinguish between the more common failure events involving transient 
deceleration conditions with temporary loss of thrust capability and 
those rare events resulting from structural failures. Associated with 
these events, the proposed criteria establish design limit and ultimate 
load conditions.

[[Page 49157]]

Interaction of Systems and Structures

    The Embraer Model 190 series airplane has fly-by-wire flight 
control systems and other power-operated systems that could affect the 
structural performance of the airplane, either directly or as a result 
of a failure or malfunction. These systems can alleviate loads in the 
airframe and, when in a failure state, can impose loads to the 
airframe. Currently, part 25 does not adequately account for the direct 
effects of these systems or for the effects of failure of these systems 
on structural performance of the airplane. The proposed special 
conditions provide the criteria to be used in assessing these effects.

Electrical and Electronic Systems Which Perform Critical Functions

    The Embraer Model 190 series airplane will have electrical and 
electronic systems which perform critical functions. The electronic 
flight control system installations establish the criticality of the 
electrical power generation and distribution systems, since the loss of 
all electrical power may be catastrophic to the airplane. The current 
airworthiness standards of part 25 do not contain adequate or 
appropriate standards for the protection of the Electronic Flight 
Control System from the adverse effects of operations without normal 
electrical power. Accordingly, this system is considered to be a novel 
or unusual design feature, and special conditions are proposed to 
retain the level of safety envisioned by Sec.  25.1351(d).
    Section 25.1351(d), ``Operation without normal electrical power,'' 
requires safe operation in visual flight rule (VFR) conditions for at 
least five minutes without normal power. This rule was structured 
around a traditional design utilizing mechanical control cables for 
flight control surfaces and the pilot controls. Such traditional 
designs enable the flightcrew to maintain control of the airplane, 
while providing time to sort out the electrical failure, start engines 
if necessary, and re-establish some of the electrical power generation 
capability.
    The Embraer Model 190 series airplane, however, will utilize an 
Electronic Flight Control System for the pitch and yaw control 
(elevator, stabilizer, and rudder). There is no mechanical linkage 
between the pilot controls and these flight control surfaces. Pilot 
control inputs are converted to electrical signals, which are processed 
and then transmitted via wires to the control surface actuators. At the 
control surface actuators, the electrical signals are converted to an 
actuator command to move the control surface.
    In order to maintain the same level of safety as an airplane with 
conventional flight controls, an airplane with electronic flight 
controls--such as the Embraer Model 190 series--must not be time 
limited in its operation, including being without the normal source of 
electrical power generated by the engine or the Auxiliary Power Unit 
(APU) generators.
    Service experience has shown that the loss of all electrical power 
generated by the airplane's engine generators or APU is not extremely 
improbable. Thus, it must be demonstrated that the airplane can 
continue safe flight and landing (including steering and braking on 
ground for airplanes using steer/brake-by-wire) after total loss of 
normal electrical power with the use of its emergency electrical power 
systems. These emergency electrical power systems must be able to power 
loads that are essential for continued safe flight and landing.

Electronic Flight Control System

    In airplanes with Electronic Flight Control Systems, there may not 
always be a direct correlation between pilot control position and the 
associated airplane control surface position. Under certain 
circumstances, a commanded maneuver that does not require a large 
control input may require a large control surface movement, possibly 
encroaching on a control surface or actuation system limit without the 
flightcrew's knowledge. This situation can arise in either manually 
piloted or autopilot flight and may be further exacerbated on airplanes 
where the pilot controls are not back-driven during autopilot system 
operation. Unless the flightcrew is made aware of excessive deflection 
or impending control surface limiting, control of the airplane by the 
pilot or autoflight system may be inadvertently continued so as to 
cause loss of control of the airplane or other unsafe characteristics 
of stability or performance.
    Given these possibilities, a special condition for Embraer Model 
ERJ 190 series airplanes addresses control surface position awareness. 
This special condition requires that suitable display or annunciation 
of flight control position be provided to the flightcrew when near full 
surface authority (not crew-commanded) is being used, unless other 
existing indications are found adequate or sufficient to prompt any 
required crew actions. Suitability of such a display or annunciation 
must take into account that some piloted maneuvers may demand the 
airplane's maximum performance capability, possibly associated with a 
full control surface deflection. Therefore, simple display systems--
that would function in both intended and unexpected control-limiting 
situations--must be properly balanced between providing needed crew 
awareness and minimizing nuisance alerts.

Automatic Takeoff Thrust Control System

    The Embraer Model ERJ 190 series airplane will incorporate an 
Automatic Takeoff Thrust Control System (ATTCS) in the engine's Full 
Authority Digital Electronic Control (FADEC) system architecture. The 
manufacturer requested that the FAA issue special conditions to allow 
performance credit to be taken for use of this function during go-
around to show compliance with the requirement of Sec.  25.121(d) 
regarding the approach climb gradient.
    Section 25.904 and Appendix I refer to operation of ATTCS only 
during takeoff. Model ERJ 190 series airplanes have this feature for 
go-around also. The ATTCS will automatically increase thrust to the 
maximum go-around thrust available under the ambient conditions in the 
following circumstances:
     If an engine failure occurs during an all-engines-
operating go-around, or
     If an engine has failed or been shut down earlier in the 
flight.
    This maximum go-around thrust is the same as that used to show 
compliance with the approach-climb-gradient requirement of Sec.  
25.121(d). If the ATTCS is not operating, selection of go-around thrust 
will result in a lower thrust level.
    The part 25 standards for ATTCS, contained in Sec.  25.904 
[Automatic takeoff thrust control system (ATTCS) and Appendix I], 
specifically restrict performance credit for ATTCS to takeoff. 
Expanding the scope of the standards to include other phases of flight, 
such as go-around, was considered when the standards were issued but 
was not accepted because of the effect on the flightcrew's workload. As 
stated in the preamble to Amendment 25-62:
    In regard to ATTCS credit for approach climb and go-around 
maneuvers, current regulations preclude a higher thrust for the 
approach climb [Sec.  25.121(d)] than for the landing climb [Sec.  
25.119]. The workload required for the flightcrew to monitor and select 
from multiple in-flight thrust settings in the event of an engine 
failure during a critical point in the approach, landing, or go-around 
operations is excessive. Therefore, the FAA does not agree that

[[Page 49158]]

the scope of the amendment should be changed to include the use of 
ATTCS for anything except the takeoff phase. (Refer to 52 FR 43153, 
November 9, 1987.)
    The ATTCS incorporated on Embraer Model ERJ 190 series airplanes 
allows the pilot to use the same power setting procedure during a go-
around, regardless of whether or not an engine fails. In either case, 
the pilot obtains go-around power by moving the throttles into the 
forward (takeoff/go-around) throttle detent. Since the ATTCS is 
permanently armed for the go-around phase, it will function 
automatically following an engine failure and advance the remaining 
engine to the ATTCS thrust level. This design adequately addresses the 
concerns about pilot workload which were discussed in the preamble to 
Amendment 25-62.
    The system design allows the pilot to enable or disable the ATTCS 
function for takeoff. If the pilot enables ATTCS, a white ``ATTCS'' 
icon will be displayed on the Engine Indication and Crew Alerting 
System (EICAS) beneath the thrust mode indication on the display. This 
white icon indicates to the pilot that the ATTCS function is enabled. 
When the throttle lever is put in the TO/GA (takeoff/go-around) detent 
position, the white icon turns green, indicating to the pilot that the 
ATTCS is armed. If the pilot disables the ATTCS function for takeoff, 
no indication appears on the EICAS.
    Regardless of whether the ATTCS is enabled for takeoff, it is 
automatically enabled when the airplane reaches the end of the take-off 
phase (that is, the thrust lever is below the TO/GA position and the 
altitude is greater than 1,700 feet above the ground, 5 minutes have 
elapsed since lift-off, or the airplane speed is greater than 140 
knots).
    During climb, cruise, and descent, when the throttle is not in the 
TO/GA position, the ATTCS indication is inhibited. During descent and 
approach to land, until the thrust management system go-around mode is 
enabled--either by crew action or automatically when the landing gear 
are down and locked and flaps are extended--the ATTCS indication 
remains inhibited.
    When the go-around thrust mode is enabled, unless the ATTCS system 
has failed, the white ``ATTCS'' icon will again be shown on the EICAS, 
indicating to the pilot that the system is enabled and in an operative 
condition in the event a go-around is necessary. If the thrust lever is 
subsequently placed in the TO/GA position, the ATTCS icon turns green, 
indicating that the system is armed and ready to operate.
    If an engine fails during the go-around or during a one-engine-
inoperative go-around in which an engine had been shut down or 
otherwise made inoperative earlier in the flight, the EICAS indication 
will be GA RSV (go-around reserve) when the thrust levers are placed in 
the TO/GA position. The GA RSV indication means that the maximum go-
around thrust under the ambient conditions has been commanded.
    The propulsive thrust used to determine compliance with the 
approach climb requirements of Sec.  25.121(d) is limited to the lesser 
of (i) the thrust provided by the ATTCS system, or (ii) 111 percent of 
the thrust resulting from the initial thrust setting with the ATTCS 
system failing to perform its uptrim function and without action by the 
crew to reset thrust. This requirement limits the adverse performance 
effects of a failure of the ATTCS and ensures adequate all-engines-
operating go-around performance.
    These special conditions require a showing of compliance with the 
provisions of Sec.  25.904 and Appendix I applicable to the approach 
climb and go-around maneuvers.
    The definition of a critical time interval for the approach climb 
case is of primary importance. During this time, it must be extremely 
improbable to violate a flight path derived from the gradient 
requirement of Sec.  25.121(d). That gradient requirement implies a 
minimum one-engine-inoperative flight path with the airplane in the 
approach configuration. The engine may have been inoperative before 
initiating the go-around, or it may become inoperative during the go-
around. The definition of the critical time interval must consider both 
possibilities.

Protection From Effects of HIRF

    As noted earlier, Embraer Model ERJ 190 series airplanes will 
include an Electronic Flight Control System as well as advanced 
avionics for the display and control of critical airplane functions. 
These systems may be vulnerable to high-intensity radiated fields 
(HIRF) external to the airplane. The current airworthiness standards of 
part 25 do not contain adequate or appropriate safety standards that 
address the protection of this equipment from the adverse effects of 
HIRF. Accordingly, these systems are considered to be novel or unusual 
design features.
    There is no specific regulation that addresses protection 
requirements for electrical and electronic systems from HIRF. Increased 
power levels from ground-based radio transmitters and the growing use 
of sensitive avionics/electronics and electrical systems to command and 
control airplanes have made it necessary to provide adequate 
protection.
    To ensure that a level of safety is achieved that is equivalent to 
that intended by the applicable regulations, special conditions are 
needed for the Embraer Model ERJ 190 series airplanes. These special 
conditions require that avionics/electronics and electrical systems 
that perform critical functions be designed and installed to preclude 
component damage and interruption of function due to both the direct 
and indirect effects of HIRF.
    With the trend toward increased power levels from ground-based 
transmitters and the advent of space and satellite communications 
coupled with electronic command and control of the airplane, the 
immunity of critical avionics/electronics and electrical systems to 
HIRF must be established.
    It is not possible to precisely define the HIRF to which the 
airplane will be exposed in service. There is also uncertainty 
concerning the effectiveness of airframe shielding for HIRF. 
Furthermore, coupling of electromagnetic energy to cockpit-installed 
equipment through the cockpit window apertures is undefined. Based on 
surveys and analysis of existing HIRF emitters, an adequate level of 
protection exists when compliance with the HIRF protection special 
condition is shown in accordance with either paragraph 1 or 2 below:
    1. A minimum threat of 100 volts rms (root-mean-square) per meter 
electric field strength from 10 KHz to 18 GHz.
    a. The threat must be applied to the system elements and their 
associated wiring harnesses without the benefit of airframe shielding.
    b. Demonstration of this level of protection is established through 
system tests and analysis.
    2. A threat external to the airframe of the field strengths 
indicated in the table below for the frequency ranges indicated. Both 
peak and average field strength components from the table are to be 
demonstrated.

------------------------------------------------------------------------
                                                       Field strength
                                                      (volts per meter)
                     Frequency                     ---------------------
                                                       Peak     Average
------------------------------------------------------------------------
10 kHz-100 kHz....................................         50         50
100 kHz-500 kHz...................................         50         50
500 kHz-2 MHz.....................................         50         50
2 MHz-30 MHz......................................        100        100
30 MHz-70 MHz.....................................         50         50
70 MHz-100 MHz....................................         50         50
100 MHz-200 MHz...................................        100        100
200 MHz-400 MHz...................................        100        100

[[Page 49159]]

 
400 MHz-700 MHz...................................        700         50
700 MHz-1 GHz.....................................        700        100
1 GHz-2 GHz.......................................       2000        200
2 GHz-4 GHz.......................................       3000        200
4 GHz-6 GHz.......................................       3000        200
6 GHz-8 GHz.......................................       1000        200
8 GHz-12 GHz......................................       3000        300
12 GHz-18 GHz.....................................       2000        200
18 GHz-40 GHz.....................................        600        200
------------------------------------------------------------------------

    The field strengths are expressed in terms of peak of the root-
mean-square (rms) over the complete modulation period.
    The threat levels identified above are the result of an FAA review 
of existing studies on the subject of HIRF, in light of the ongoing 
work of the Electromagnetic Effects Harmonization Working Group of the 
Aviation Rulemaking Advisory Committee.

Discussion of Comments

    Notice of Proposed Special Conditions No. 25-05-05-SC for the 
Embraer Model ERJ 190 series airplane was published in the Federal 
Register dated May 25, 2005 (70 FR 30020). Two comments indicating 
minor errors in the proposed special conditions were received from 
Embraer.
    One comment points out an error in the table on page 30023 of the 
Notice of Proposed Special Conditions. The average level for 1 GHz-2 
GHz is shown as 2000 rather than as 200 volts per meter. The FAA has 
determined that the correct value should be 200 volts per meter and, 
accordingly, has corrected the table in these final special conditions.
    The second comment indicates an error on page 30025. The first 
sentence of Paragraph 2.c.(1)(i) says ``For static strength 
substantiation, these loads multiplied by an appropriate factor of 
safety that is related to the probability of occurrence of the failure 
of the ultimate loads to be considered for design.''
    That sentence should say ``For static strength substantiation, 
these loads multiplied by an appropriate factor of safety that is 
related to the probability of occurrence of the failure are ultimate 
loads to be considered for design.'' The FAA has determined that the 
proposed wording was incorrect and has corrected it in these final 
special conditions. (We also corrected a typographical error in the 
following sentence by removing the letter ``I.'')

Applicability

    As discussed above, these special conditions are applicable to the 
Embraer ERJ 190 series airplane. Should Embraer apply at a later date 
for a change to the type certificate to include another model 
incorporating the same novel or unusual design features, these special 
conditions would apply to that model as well under the provisions of 
Sec.  21.101.

Conclusion

    This action affects only certain novel or unusual design features 
of the Embraer ERJ 190 series airplane. This is not a rule of general 
applicability.

List of Subjects in 14 CFR Part 25

    Aircraft, Aviation safety, Reporting and recordkeeping 
requirements.

    The authority citation for these special conditions is as follows:

    Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.

The Special Conditions

    Accordingly, pursuant to the authority delegated to me by the 
Administrator, the Federal Aviation Administration (FAA) issues the 
following special conditions as part of the type certification basis 
for the Embraer ERJ 190 series airplane.

Sudden Engine Stoppage

    In lieu of compliance with Sec.  25.361(b) the following special 
condition applies:
    1. For turbine engine installations, the engine mounts, pylons and 
adjacent supporting airframe structure must be designed to withstand 1g 
level flight loads acting simultaneously with the maximum limit torque 
loads imposed by each of the following:
    a. Sudden engine deceleration due to a malfunction which could 
result in a temporary loss of power or thrust; and
    b. The maximum acceleration of the engine.
    2. For auxiliary power unit installations, the power unit mounts 
and adjacent supporting airframe structure must be designed to 
withstand 1g level flight loads acting simultaneously with the maximum 
limit torque loads imposed by each of the following:
    a. Sudden auxiliary power unit deceleration due to malfunction or 
structural failure; and
    b. The maximum acceleration of the power unit.
    3. For engine supporting structures, an ultimate loading condition 
must be considered that combines 1g flight loads with the transient 
dynamic loads resulting from:
    a. The loss of any fan, compressor, or turbine blade; and
    b. Separately, where applicable to a specific engine design, any 
other engine structural failure that results in higher loads.
    4. The ultimate loads developed from the conditions specified in 
paragraphs 3.a. and 3.b. above are to be multiplied by a factor of 1.0 
when applied to engine mounts and pylons and multiplied by a factor of 
1.25 when applied to adjacent supporting airframe structure.

Interaction of Systems and Structures

    In addition to the requirements of part 25, subparts C and D, the 
following special condition applies:
    1. General. For airplanes equipped with systems that affect 
structural performance, either directly or as a result of a failure or 
malfunction, the influence of these systems and their failure 
conditions must be taken into account when showing compliance with the 
requirements of 14 CFR part 25, subparts C and D. The following 
criteria must be used to evaluate the structural performance of 
airplanes equipped with flight control systems, autopilots, stability 
augmentation systems, load alleviation systems, ``flutter'' control 
systems, and fuel management systems. If these criteria are used for 
other systems, it may be necessary to adapt the criteria to the 
specific system.
    a. The criteria defined herein address only the direct structural 
consequences of the system responses and performances and cannot be 
considered in isolation but should be included in the overall safety 
evaluation of the airplane. These criteria may in some instances 
duplicate standards already established for this evaluation. These 
criteria are applicable only to structures whose failure could prevent 
continued safe flight and landing. Specific criteria that define 
acceptable limits on handling characteristics or stability requirements 
when operating in the system degraded or inoperative mode are not 
provided in this special condition.
    b. Depending upon the specific characteristics of the airplane, 
additional studies that go beyond the criteria provided in this special 
condition may be required in order to demonstrate the capability of the 
airplane to meet other realistic conditions, such as alternative gust 
or maneuver descriptions for an airplane equipped with a load 
alleviation system.
    c. The following definitions are applicable to this special 
condition:
    Structural performance: Capability of the airplane to meet the 
structural requirements of 14 CFR part 25.
    Flight limitations: Limitations that can be applied to the airplane 
flight conditions following an in-flight

[[Page 49160]]

occurrence and that are included in the flight manual (e.g., speed 
limitations, avoidance of severe weather conditions, etc.).
    Operational limitations: Limitations, including flight limitations, 
that can be applied to the airplane operating conditions before 
dispatch (e.g., fuel and payload limitations).
    Probabilistic terms: The probabilistic terms (probable, improbable, 
extremely improbable) used in this special condition are the same as 
those used in 14 CFR 25.1309.
    Failure condition: The term failure condition is the same as that 
used in 14 CFR 25.1309; however, this special condition applies only to 
system failure conditions that affect the structural performance of the 
airplane (e.g., failure conditions that induce loads, lower flutter 
margins, or change the response of the airplane to inputs, such as 
gusts or pilot actions).
    2. Effects of Systems on Structures.
    a. General. The following criteria will be used in determining the 
influence of a system and its failure conditions on the airplane 
structure.
    b. System fully operative. With the system fully operative, the 
following apply:
    (1) Limit loads must be derived in all normal operating 
configurations of the system from all the limit conditions specified in 
14 CFR part 25, Subpart C, taking into account any special behavior of 
such a system or associated functions or any effect on the structural 
performance of the airplane that may occur up to the limit loads. In 
particular, any significant nonlinearity (rate of displacement of 
control surface, thresholds, or any other system nonlinearities) must 
be accounted for in a realistic or conservative way when deriving limit 
loads from limit conditions.
    (2) The airplane must meet the strength requirements of 14 CFR part 
25 (static strength, residual strength) using the specified factors to 
derive ultimate loads from the limit loads defined above. The effect of 
nonlinearities must be investigated beyond limit conditions to ensure 
the behavior of the system presents no anomaly compared to the behavior 
below limit conditions. However, conditions beyond limit conditions 
need not be considered when it can be shown that the airplane has 
design features that will not allow it to exceed those limit 
conditions.
    (3) The airplane must meet the aeroelastic stability requirements 
of 14 CFR 25.629.
    c. System in the failure condition. For any system failure 
condition not shown to be extremely improbable, the following apply:
    (1) At the time of occurrence. Starting from l-g level flight 
conditions, a realistic scenario, including pilot corrective actions, 
must be established to determine the loads occurring at the time of 
failure and immediately after failure.
    (i) For static strength substantiation, these loads multiplied by 
an appropriate factor of safety that is related to the probability of 
occurrence of the failure are ultimate loads to be considered for 
design. The factor of safety (FS) is defined in figure 1.
[GRAPHIC] [TIFF OMITTED] TR23AU05.023

    (ii) For residual strength substantiation, the airplane must be 
able to withstand two-thirds of the ultimate loads defined in 
subparagraph (c)(1)(i).
    (iii) Freedom from aeroelastic instability must be shown up to the 
speeds defined in 14 CFR 25.629(b)(2). For failure conditions that 
result in speed increases beyond Vc/Mc, freedom 
from aeroelastic instability must be shown to increased speeds, so that 
the margins intended by 14 CFR 25.629(b)(2) are maintained.
    (iv) Failures of the system that result in forced structural 
vibrations (oscillatory failures) must not produce loads that could 
result in detrimental deformation of primary structure.
    (2) For the continuation of the flight. For the airplane, in the 
system-failed state and considering any appropriate reconfiguration and 
flight limitations, the following apply:
    (i) The loads derived from the following conditions at speeds up to 
Vc or the speed limitation prescribed for the remainder of 
the flight must be determined:
    (A) The limit symmetrical maneuvering conditions specified in 14 
CFR 25.331 and 25.345.
    (B) The limit gust and turbulent conditions specified in 14 CFR 
25.341 and 25.345.
    (C) The limit rolling conditions specified in 14 CFR 25.349 and the 
limit unsymmetrical conditions specified in 14 CFR 25.367 and 25.427(b) 
and (c).
    (D) The limit yaw maneuvering conditions specified in 14 CFR 
25.351.
    (E) The limit ground loading conditions specified in 14 CFR 25.473 
and 25.491.
    (ii) For static strength substantiation, each part of the structure 
must be able to withstand the loads specified in paragraph (2)(i) above 
multiplied by a factor of safety depending on the probability of being 
in this failure state. The factor of safety is defined in figure 2.

[[Page 49161]]

[GRAPHIC] [TIFF OMITTED] TR23AU05.024

Qj = (Tj)(Pj) where:
Tj = Average time spent in failure condition j (in hours)
Pj = Probability of occurrence of failure mode j (per hour)


    Note: If Pj is greater than 10-3 per flight hour, 
then a 1.5 factor of safety must be applied to all limit load 
conditions specified in 14 CFR 25, Subpart C.


    (iii) For residual strength substantiation, the airplane must be 
able to withstand two-thirds of the ultimate loads defined in paragraph 
(c)(2)(ii) above.
    (iv) If the loads induced by the failure condition have a 
significant effect on fatigue or damage tolerance then their effects 
must be taken into account.
    (v) Freedom from aeroelastic instability must be shown up to a 
speed determined from figure 3. Flutter clearance speeds V' and V'' may 
be based on the speed limitation specified for the remainder of the 
flight using the margins defined by 14 CFR 25.629(b).
[GRAPHIC] [TIFF OMITTED] TR23AU05.025

V' = Clearance speed as defined by 14 CFR 25.629(b)(2)
V'' = Clearance speed as defined by 14 CFR 25.629(b)(1)
Qj = (Tj)(Pj) where:
Tj = Average time spent in failure condition j (in hours)
Pj = Probability of occurrence of failure mode j (per hour)


    Note: If Pj is greater than 10-3 per flight hour, 
then the flutter clearance speed must not be less than V''.


    (vi) Freedom from aeroelastic instability must also be shown up to 
V' in figure 3 above for any probable system failure condition combined 
with any damage required or selected for investigation by 14 CFR 
25.571(b).
    (3) Consideration of certain failure conditions may be required by 
other sections of 14 CFR 25, regardless of calculated system 
reliability. Where analysis shows the probability of these failure 
conditions to be less than 10-\9\, criteria other than those 
specified in this paragraph may be used for structural substantiation 
to show continued safe flight and landing.
    d. Warning considerations. For system failure detection and 
warning, the following apply:
    (1) The system must be checked for failure conditions, not 
extremely improbable, that degrade the structural capability below the 
level required by 14 CFR part 25 or significantly reduce the 
reliability of the remaining system. The flight crew must be made aware 
of these failures before flight. Certain elements of the control 
system, such as mechanical and hydraulic components, may use special 
periodic inspections, and electronic components may use daily checks in 
lieu of warning systems to achieve the objective of this requirement. 
These certification maintenance requirements must be limited to 
component failures that are not readily detectable by normal warning 
systems and where service history shows that inspections will provide 
an adequate level of safety.
    (2) The existence of any failure condition not extremely improbable 
during flight--that could significantly affect the structural 
capability of the airplane and for which the associated reduction in 
airworthiness can be minimized by suitable flight limitations--must be 
signaled to the

[[Page 49162]]

flight crew. For example, failure conditions that result in a factor of 
safety between the airplane strength and the loads of 14 CFR part 25, 
subpart C below 1.25 or flutter margins below V'' must be signaled to 
the crew during flight.
    e. Dispatch with known failure conditions. If the airplane is to be 
dispatched in a known system failure condition that affects structural 
performance or affects the reliability of the remaining system to 
maintain structural performance, then the provisions of this special 
condition must be met for the dispatched condition and for subsequent 
failures. Flight limitations and expected operational limitations may 
be taken into account in establishing Qj as the combined probability of 
being in the dispatched failure condition and the subsequent failure 
condition for the safety margins in figures 2 and 3. These limitations 
must be such that the probability of being in this combined failure 
state and then subsequently encountering limit load conditions is 
extremely improbable. No reduction in these safety margins is allowed 
if the subsequent system failure rate is greater than 10-3 
per flight hour.

Operation Without Normal Electrical Power

    In lieu of compliance with 14 CFR 25.1351(d), the following special 
condition applies:
    It must be demonstrated by test or by a combination of test and 
analysis that the airplane can continue safe flight and landing with 
inoperative normal engine and APU generator electrical power (in other 
words without electrical power from any source, except the battery and 
any other standby electrical sources). The airplane operation should be 
considered at the critical phase of flight and include the ability to 
restart the engines and maintain flight for the maximum diversion time 
capability being certified.

Electronic Flight Control System

    In addition to compliance with Sec. Sec.  25.143, 25.671 and 
25.672, when a flight condition exists where, without being commanded 
by the crew, control surfaces are coming so close to their limits that 
return to the normal flight envelope and (or) continuation of safe 
flight requires a specific crew action, a suitable flight control 
position annunciation shall be provided to the crew, unless other 
existing indications are found adequate or sufficient to prompt that 
action.


    Note: The term suitable also indicates an appropriate balance 
between nuisance and necessary operation.

Automatic Takeoff Thrust Control System (ATTCS)

    To use the thrust provided by the ATTCS to determine the approach 
climb performance limitations, the Embraer Model ERJ 190 series 
airplane must comply with the requirements of Sec.  25.904 and Appendix 
I, including the following requirements pertaining to the go-around 
phase of flight:
1. Definitions
    a. TOGA--(Take Off/Go-Around). Throttle lever in takeoff or go-
around position.
    b. Automatic Takeoff Thrust Control System--(ATTCS). The Embraer 
Model ERJ-190 series ATTCS is defined as the entire automatic system 
available in takeoff when selected by the pilot and always in go-around 
mode, including all devices, both mechanical and electrical, that sense 
engine failure, transmit signals, and actuate fuel controls or power 
levers or increase engine power by other means on operating engines to 
achieve scheduled thrust or power increases and to furnish cockpit 
information on system operation.
    c. Critical Time Interval. The definition of the Critical Time 
Interval in Appendix I, Sec.  I25.2(b) is expanded to include the 
following:
    (1) When conducting an approach for landing using ATTCS, the 
critical time interval is defined as 120 seconds. A shorter time 
interval may be used if justified by a rational analysis. An accepted 
analysis that has been used on past aircraft certification programs is 
as follows:
    (i) The critical time interval begins at a point on a 2.5 degree 
approach glide path from which, assuming a simultaneous engine and 
ATTCS failure, the resulting approach climb flight path intersects a 
flight path originating at a later point on the same approach path 
corresponding to the part 25 one-engine-inoperative approach climb 
gradient. The period of time from the point of simultaneous engine and 
ATTCS failure to the intersection of these flight paths must be no 
shorter than the time interval used in evaluating the critical time 
interval for takeoff, beginning from the point of simultaneous engine 
and ATTCS failure and ending upon reaching a height of 400 feet.
    (ii) The critical time interval ends at the point on a minimum 
performance, all-engines-operating go-around flight path from which, 
assuming a simultaneous engine and ATTCS failure, the resulting minimum 
approach climb flight path intersects a flight path corresponding to 
the part 25 minimum one-engine-inoperative approach-climb-gradient. The 
all-engines-operating go-around flight path and the part 25 one-engine-
inoperative, approach-climb-gradient flight path originate from a 
common point on a 2.5 degree approach path. The period of time from the 
point of simultaneous engine and ATTCS failure to the intersection of 
these flight paths must be no shorter than the time interval used in 
evaluating the critical time interval for the takeoff, beginning from 
the point of simultaneous engine and ATTCS failure and ending upon 
reaching a height of 400 feet.
    (2) The critical time interval must be determined at the altitude 
resulting in the longest critical time interval for which one-engine-
inoperative approach climb performance data are presented in the 
Airplane Flight Manual (AFM).
    (3) The critical time interval is illustrated in the following 
figure:

[[Page 49163]]

[GRAPHIC] [TIFF OMITTED] TR23AU05.026

    The engine and ATTCS failed time interval must be no shorter than 
the time interval from the point of simultaneous engine and ATTCS 
failure to a height of 400 feet used to comply with I25.2(b) for ATTCS 
use during takeoff.
2. Performance and System Reliability Requirements
    The applicant must comply with the following performance and ATTCS 
reliability requirements:
    a. An ATTCS failure or combination of failures in the ATTCS during 
the critical time interval:
    (1) Shall not prevent the insertion of the maximum approved go-
around thrust or power or must be shown to be an improbable event.
    (2) Shall not result in a significant loss or reduction in thrust 
or power or must be shown to be an extremely improbable event.
    b. The concurrent existence of an ATTCS failure and an engine 
failure during the critical time interval must be shown to be extremely 
improbable.
    c. All applicable performance requirements of part 25 must be met 
with an engine failure occurring at the most critical point during go-
around with the ATTCS system functioning.
    d. The probability analysis must include consideration of ATTCS 
failure occurring after the time at which the flightcrew last verifies 
that the ATTCS is in a condition to operate until the beginning of the 
critical time interval.
    e. The propulsive thrust obtained from the operating engine after 
failure of the critical engine during a go-around used to show 
compliance with the one-engine-inoperative climb requirements of Sec.  
25.121(d) may not be greater than the lesser of:
    (i) The actual propulsive thrust resulting from the initial setting 
of power or thrust controls with the ATTCS functioning; or
    (ii) 111 percent of the propulsive thrust resulting from the 
initial setting of power or thrust controls with the ATTCS failing to 
reset thrust or power and without any action by the crew to reset 
thrust or power.
3. Thrust Setting
    a. The initial go-around thrust setting on each engine at the 
beginning of the go-around phase may not be less than any of the 
following:
    (1) That required to permit normal operation of all safety-related 
systems and equipment dependent upon engine thrust or power lever 
position; or
    (2) That shown to be free of hazardous engine response 
characteristics when thrust or power is advanced from the initial go-
around position to the maximum approved power setting.
    b. For approval of an ATTCS for go-around, the thrust setting 
procedure must be the same for go-arounds initiated with all engines 
operating as for go-arounds initiated with one engine inoperative.
4. Powerplant Controls
    a. In addition to the requirements of Sec.  25.1141, no single 
failure or malfunction or probable combination thereof of the ATTCS, 
including associated systems, may cause the failure of any powerplant 
function necessary for safety.
    b. The ATTCS must be designed to accomplish the following:
    (1) Apply thrust or power on the operating engine(s), following any 
single engine failure during go around, to achieve the maximum approved 
go-around thrust without exceeding the engine operating limits;
    (2) Permit manual decrease or increase in thrust or power up to the 
maximum go-around thrust approved for the airplane under existing 
conditions through the use of the power lever. For airplanes equipped 
with limiters that automatically prevent the engine operating limits 
from being exceeded under existing ambient conditions, other means may 
be used to increase the thrust in the event of an ATTCS failure, 
provided that the means meet the following criteria:
     Are located on or forward of the power levers;
     Are easily identified and operated under all operating 
conditions by a single action of either pilot with the hand that is 
normally used to actuate the power levers, and
     Meet the requirements of Sec.  25.777 (a), (b), and (c);
    (3) Provide a means for the flightcrew to verify before beginning 
an approach for landing that the ATTCS is in a condition to operate 
(unless it can be demonstrated that an ATTCS failure combined with an 
engine failure during an entire flight is extremely improbable); and
    (4) Provide a means for the flightcrew to deactivate the automatic 
function. This means must be designed to prevent inadvertent 
deactivation.
5. Powerplant Instruments
    In addition to the requirements of Sec.  25.1305, the following 
requirements must be met:
    a. A means must be provided to indicate when the ATTCS is in the 
armed or ready condition; and
    b. If the inherent flight characteristics of the airplane do not 
provide adequate

[[Page 49164]]

warning that an engine has failed, a warning system that is independent 
of the ATTCS must be provided to give the pilot a clear warning of any 
engine failure during go-around.

Protection From Effects of HIRF

    Each electrical and electronic system that performs critical 
functions must be designed and installed to ensure that the operation 
and operational capability of these systems to perform critical 
functions are not adversely affected when the airplane is exposed to 
high-intensity radiated fields external to the airplane.
    For the purpose of this special condition, the following definition 
applies:
    Critical Functions: Functions whose failure would contribute to or 
cause a failure condition that would prevent the continued safe flight 
and landing of the airplane.

    Issued in Renton, Washington, on August 12, 2005.
Ali Bahrami,
Manager, Transport Airplane Directorate, Aircraft Certification 
Service.
[FR Doc. 05-16728 Filed 8-22-05; 8:45 am]
BILLING CODE 4910-13-P