Special Conditions: Boeing Model 737-900ER series airplanes; Interaction of Systems and Structures, 14035-14040 [E7-5508]

Download as PDF 14035 Rules and Regulations Federal Register Vol. 72, No. 57 Monday, March 26, 2007 This section of the FEDERAL REGISTER contains regulatory documents having general applicability and legal effect, most of which are keyed to and codified in the Code of Federal Regulations, which is published under 50 titles pursuant to 44 U.S.C. 1510. The Code of Federal Regulations is sold by the Superintendent of Documents. Prices of new books are listed in the first FEDERAL REGISTER issue of each week. DEPARTMENT OF TRANSPORTATION Federal Aviation Administration 14 CFR Part 25 [Docket No. NM357; Special Conditions No. 25–347–SC] Special Conditions: Boeing Model 737– 900ER series airplanes; Interaction of Systems and Structures Federal Aviation Administration (FAA), DOT. ACTION: Final special conditions. AGENCY: cprice-sewell on PROD1PC66 with RULES SUMMARY: This special condition is issued for the Boeing Model 737–900ER airplane. This airplane will have a novel or unusual design feature(s) associated with the interaction of systems and structures. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for this design feature. This special condition contains the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards. DATES: Effective Date: March 19, 2007. FOR FURTHER INFORMATION CONTACT: Todd Martin, Aerospace Engineer, Airframe/Cabin Safety Branch, ANM– 115, Transport Airplane Directorate, Aircraft Certification Service, 1601 Lind Avenue SW., Renton, Washington 98057–3356; telephone (425) 227–1178; facsimile (425) 227–1232; electronic mail Todd.Martin@faa.gov. SUPPLEMENTARY INFORMATION: Background On June 5, 2002, The Boeing Company, PO Box 3707, Seattle, Washington 98124, applied for an amendment to Type Certificate No. A16WE, to include the new Model 737– 900ER. The Model 737–900ER, which is a derivative of the Model 737–900 currently approved under A16WE, is a VerDate Aug<31>2005 15:28 Mar 23, 2007 Jkt 211001 large transport airplane with two flight crew and the capacity to carry 215 passengers. The airplane is powered by two CFMI CFM56–7 series turbofan engines. Type Certification Basis Under the provisions of § 21.101, Boeing must show that the Model 737– 900ER meets the applicable provisions of 14 CFR part 25, as amended by Amendments 25–1 through 25–108, except for earlier amendments as agreed upon by the FAA. These regulations will be incorporated into the Type Certificate No. A16WE after type certification approval of the 737–900ER. In addition, the certification basis includes other regulations, special conditions and exemptions that are not relevant to this proposed special condition. Refer to Type Certificate No. A16WE for a complete description of the certification basis for this model airplane. If the Administrator finds that the applicable airworthiness regulations (i.e., 14 CFR part 25) do not contain adequate or appropriate safety standards for the Model 737–900ER because of a novel or unusual design feature, special conditions are prescribed under the provisions of § 21.16. In addition to the applicable airworthiness regulations and special conditions, the Model 737–900ER must comply with the fuel vent and exhaust emission requirements of 14 CFR part 34 and the noise certification requirements of 14 CFR part 36. The FAA issues special conditions, as defined in § 11.19, they are published for comment under § 11.38, and they become part of the type certification basis under § 21.101. Special conditions are initially applicable to the model for which they are issued. Should the type certificate for that model be amended later to include any other model that incorporates the same or similar novel or unusual design feature, or should any other model already included on the same type certificate be modified to incorporate the same or similar novel or unusual design feature, the special conditions would also apply to the other model under § 21.101. Novel or Unusual Design Features The Model 737–900ER airplane will incorporate novel or unusual design features. This special condition PO 00000 Frm 00001 Fmt 4700 Sfmt 4700 addresses equipment that may affect the airplane’s structural performance, either directly or as a result of failure or malfunction. This proposed special condition is identical or nearly identical to those previously required for type certification of other Boeing airplane models. The special condition was derived initially from standardized requirements developed by the Aviation Rulemaking Advisory Committee (ARAC), comprised of representatives of the FAA, Europe’s Joint Aviation Authorities (now replaced by the European Aviation Safety Agency), and industry. Discussion In addition to the requirements of part 25, subparts C and D, the following special condition applies: Interaction of Systems and Structures The Boeing Model 737–900ER is equipped with systems that may affect the airplane’s structural performance either directly or as a result of failure or malfunction. The effects of these systems on structural performance must be considered in the certification analysis. This analysis must include consideration of normal operation and of failure conditions with required structural strength levels related to the probability of occurrence. Discussion of Comments Notice of proposed special conditions No. 25–06–11–SC for Boeing Model 737–900ER airplanes was published in the Federal Register on October 31, 2006 (71 FR 63718). A combined set of comments was received from the United States Air Force and the United States Navy. As noted previously, special conditions are prescribed under the provisions of § 21.16 when current regulations ‘‘do not contain adequate or appropriate safety standards * * * because of a novel or unusual design feature.’’ For several decades, transport category airplanes have employed automatic and electronic flight control systems, including load alleviation systems, flutter suppression systems, and stability augmentation systems. Failures in any of these systems may affect how the airplane will respond to maneuver, gust, and high speed conditions. That is, the loads introduced E:\FR\FM\26MRR1.SGM 26MRR1 cprice-sewell on PROD1PC66 with RULES 14036 Federal Register / Vol. 72, No. 57 / Monday, March 26, 2007 / Rules and Regulations to the airplane may increase as a result of failures in these systems, or the flutter capability of the airplane may be reduced. Since current regulations do not specify design loads criteria, including a safety factor for system failures, a special condition is needed to address such failures. To address the effects of system failures on the structural and flutter capability of the airplane, the FAA developed a special condition, which has been applied in essentially the same form since 1989, and which is proposed for the Boeing Model 737– 900ER. Comment 1: The commenters recommended that the proposed special condition not be implemented as a general rule. FAA response: At this time we are not implementing the proposed special condition as a general rule. The ‘‘Conclusion’’ section of the proposed special condition (No. 25–06–11–SC) states that ‘‘This action affects only certain novel or unusual design features on one model of airplane. It is not a rule of general applicability.’’ We are considering rulemaking to incorporate this special condition into 14 CFR part 25. If we do propose changes to 14 CFR part 25 the public will have the opportunity to comment on that rulemaking action. We have not changed this special condition as a result of this comment. Comment 2: The commenters recommended that systems failures be addressed individually and that exceptions to existing standards and rules be reviewed on a case-by-case basis. FAA response: We do not agree with this recommendation. Although the proposed special condition allows the use of safety factors of less than 1.5, we do not regard this as an exception to the current regulation. The current CFR regulation does not specify design loads criteria, including a safety factor, for system failures. This is why special conditions are needed. We have not changed this special condition as a result of this comment. Comment 3: The commenters noted that Figure 1 in the proposed special condition, which is a plot of safety factor versus failure probability, shows that for failure occurrences more frequent than 10–5 per flight hour, the factor of safety is equal to 1.5 and cannot be reduced. However, the text of the proposed rule indicates in several places that this probability threshold is 10–3. FAA response: We infer that the commenters are suggesting there are errors in the proposed special condition VerDate Aug<31>2005 15:28 Mar 23, 2007 Jkt 211001 and that the text should be revised to change the 10–3 references to 10–5. We do not agree that the references to 10–3 in the text are errors. The three references to 10–3 in the text of the proposed special condition do not apply to Figure 1. The first two references to the 10–3 probability threshold are notes that apply only to Figures 2 and 3 of the proposed special condition. The third reference to 10–3 applies to subsequent failures following dispatch with a known failure. We have not changed this special condition as a result of this comment. Comment 4: The commenters are concerned that the definition of the term ‘‘Qj = Probability of being in a failure condition,’’ is too vague and that the probability of being in a failure mode has to be more clearly defined to avoid potential loopholes. The term appears in the proposed special condition as follows: ‘‘Qj = Probability of being in a failure condition, which is defined as Pj = Probability of failure occurrence multiplied by Tj = Average time spent in failure condition.’’ The concern is that an artificially low value of Tj would result in an inappropriate value of Qj. As an example, for a spoiler failure on landing approach, the Qj variable would be very small since you only spend a few minutes in that condition. FAA response: We believe that the definitions of probability and exposure time are sufficiently clear, and that their use is appropriate in this special condition. The term Tj applies to ‘‘continuation of flight’’ failures, and thereby accounts for the maximum possible exposure period of the failure. If a failure is not detected, then Tj equals the average latency period for that failure mode. This results in a high value of Tj (potentially hundreds of hours), a high value of Qj, and little or no reduction of the safety factor. If the failure was detected, then its exposure would be limited and its effects mitigated by pilot actions. In this case, a reduced value of Qj and a corresponding reduced safety factor is appropriate. Comment 5: The commenters stated that the net effect of the proposed special condition would be a reduction in reliability when compared to the current practice for defining failure condition safety factors. The commenters also stated that the current practice has a historical track record of success. The commenters also noted that the allowed reduction of the safety factor is not analytically nor empirically justified. FAA response: We do not believe that this special condition reduces reliability or structural integrity when compared to PO 00000 Frm 00002 Fmt 4700 Sfmt 4700 the current practice for defining failure condition safety factors. The current regulation does not specify design loads criteria, including a safety factor, for system failures. Special conditions are needed to define these criteria. Also, the intent of this special condition has been applied for over ten years. Prior to this special condition we outlined similar criteria in Advisory Circular 25.672–1, Active Flight Controls, dated November 15, 1983. While not analytically precise, we believe that reduced safety factors for low probability events are justified. Safety factors provide an additional margin above limit load capability. For low probability events, less margin is needed because these events will occur less often. For high probability events, more margin is needed, therefore, the full 1.5 safety factor is required. The relationship between the probability and the severity of a failure condition is similar to that used in a system safety assessment: High probability events must only have minor consequences, whereas low probability events may have major or hazardous consequences. In all cases, the objective is that no failure or combination of failures may be catastrophic. Comment 6: The commenters recommended that the process to be used to determine the reliability of a system be defined. The commenters also recommended that for each airplane model, the airframe manufacturer document all of the systems and structure subject to the proposed special conditions. FAA response: We believe that the process for determining the reliability of a system is well defined in this special condition because the special condition states that the failure condition and probabilistic terms are the same as those defined in § 25.1309, Equipment, systems, and installations. That regulation’s advisory material, Advisory Circular 25.1309–1A, System Design and Analysis, dated June 21, 1988, provides an acceptable process for determining the reliability of systems (that is, their probability of failure). We also note that as part of the certification process, airframe manufacturers are required to document the systems and structures subject to this special condition. Comment 7: The commenters stated that in Figure 3 of the proposed special condition, it is not clear how the flutter clearance speed should be determined when the probability of being in a failure condition, Qj, is between 1 and 10–5. FAA response: Figure 3 of this special condition shows that when the E:\FR\FM\26MRR1.SGM 26MRR1 Federal Register / Vol. 72, No. 57 / Monday, March 26, 2007 / Rules and Regulations cprice-sewell on PROD1PC66 with RULES probability of being in the failure condition, Qj, is equal to one, the flutter clearance speed is V″, which is the speed as defined by § 25.629(b)(1). (This is the same as the clearance speed with no failures.) When Qj = 10–5, the clearance speed is V′, which is the clearance speed with failures, as defined by § 25.629(b)(2). If Qj is between 1 and 10–5, then the clearance speed varies linearly between V″ and V′. This can be calculated as V = V″ + 0.2(logQj)(V″–V′). Comment 8: The commenters noted that the United States Air Force threshold for allowing a reduced clearance speed is 10–7 per flight hour. A note accompanying Figure 3 in the proposed special conditions indicates that the flutter clearance speed may not be less than V″ if Pj is greater than 10–3 per flight hour. V″ is the clearance speed with no failures, which includes a 15% margin on the design dive speed, VD/ MD. The commenters suggested that the 10–7 per flight hour threshold is more appropriate than the 10–3 per flight hour threshold because the flutter analysis may inaccurately predict a critical flutter mechanism under a failed condition. The commenters also pointed out that failure conditions are not typically flutter tested in flight. FAA response: We believe that the flutter clearance speeds for failures are adequate as defined. Flutter clearance speeds for failure cases are defined in both § 25.629 and in these special conditions. The flutter clearance speed for failure cases defined in § 25.629 has not changed significantly since Amendment 25–0, issued in 1965. The service history on products certificated to Amendment 25–0, or later, has been acceptable regarding the effects of failures on flutter. The flutter clearance speed defined in these special conditions exceeds that defined in § 25.629 (and is therefore more conservative) for all failure conditions whose probability is greater than 10–5. No changes were made to these special conditions as a result of these comments. The special conditions are adopted as proposed. Applicability As discussed above, this special condition is applicable to the Boeing Model 737–900ER. Should Boeing apply at a later date for a change to the type certificate to include another model incorporating the same novel or unusual design feature, this special condition would apply to that model as well. Effective Upon Issuance Under standard practice, the effective date of final special conditions would be 30 days after the date of publication VerDate Aug<31>2005 15:28 Mar 23, 2007 Jkt 211001 in the Federal Register; however, as the certification date for the Boeing Model 737–900ER is imminent, the FAA finds that good cause exists to make this special condition effective upon issuance. Conclusion This action affects only certain novel or unusual design features on one model of airplane. It is not a rule of general applicability. List of Subjects in 14 CFR Part 25 Aircraft, Aviation safety, Reporting and recordkeeping requirements. The authority citation for these special conditions is as follows: Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704. The Special Condition Accordingly, pursuant to the authority delegated to me by the Administrator, the following special conditions are issued as part of the type certification basis for Boeing Model 737–900ER airplanes. I Interaction of Systems and Structures In addition to the requirements of part 25, subparts C and D, the following proposed special condition would apply: a. For airplanes equipped with systems that affect structural performance—either directly or as a result of a failure or malfunction—the influence of these systems and their failure conditions must be taken into account when showing compliance with the requirements of part 25, subparts C and D. Paragraph b, below, must be used to evaluate the structural performance of airplanes equipped with these systems. b. Interaction of Systems and Structures. (1) General: The following criteria must be used for showing compliance with this special condition for interaction of systems and structures and with § 25.629 for airplanes equipped with flight control systems, autopilots, stability augmentation systems, load alleviation systems, flutter control systems, and fuel management systems. (a) The criteria defined herein address only the direct structural consequences of the system responses and performances. They cannot be considered in isolation but should be included in the overall safety evaluation of the airplane. These criteria may, in some instances, duplicate standards already established for this evaluation. These criteria are applicable only to structures whose failure could prevent PO 00000 Frm 00003 Fmt 4700 Sfmt 4700 14037 continued safe flight and landing. Specific criteria that define acceptable limits on handling characteristics or stability requirements when operating in the system degraded or inoperative modes are not provided in this special condition. (b) Depending upon the specific characteristics of the airplane, additional studies may be required that go beyond the criteria provided in this special condition in order to demonstrate the capability of the airplane to meet other realistic conditions, such as alternative gust or maneuver descriptions for an airplane equipped with a load alleviation system. (c) The following definitions are applicable to this paragraph. Structural performance: Capability of the airplane to meet the structural requirements of part 25. Flight limitations: Limitations that can be applied to the airplane flight conditions following an in-flight occurrence and that are included in the flight manual (e.g., speed limitations and avoidance of severe weather conditions). Operational limitations: Limitations, including flight limitations, that can be applied to the airplane operating conditions before dispatch (e.g., fuel, payload, and Master Minimum Equipment List limitations). Probabilistic terms: The probabilistic terms (probable, improbable, and extremely improbable) used in this special conditions are the same as those used in § 25.1309. Failure condition: The term failure condition is the same as that used in § 25.1309. However, this special condition applies only to system failure conditions that affect the structural performance of the airplane (e.g., system failure conditions that induce loads, change the response of the airplane to inputs such as gusts or pilot actions, or lower flutter margins). (2) Effects of Systems on Structures. (a) General. The following criteria will be used in determining the influence of a system and its failure conditions on the airplane structure. (b) System fully operative. With the system fully operative, the following apply: (1) Limit loads must be derived in all normal operating configurations of the system from all the limit conditions specified in subpart C (or used in lieu of those specified in subpart C), taking into account any special behavior of such a system or associated functions or any effect on the structural performance of the airplane that may occur up to the limit loads. In particular, any significant non-linearity (rate of displacement of E:\FR\FM\26MRR1.SGM 26MRR1 14038 Federal Register / Vol. 72, No. 57 / Monday, March 26, 2007 / Rules and Regulations behavior below limit conditions. However, conditions beyond limit conditions need not be considered, when it can be shown that the airplane has design features that will not allow it to exceed those limit conditions. (3) The airplane must meet the aeroelastic stability requirements of § 25.629. (c) System in the failure condition. For any system failure condition not shown to be extremely improbable, the following apply: (1) At the time of occurrence. Starting from 1g level flight conditions, a realistic scenario, including pilot corrective actions, must be established to determine the loads occurring at the time of failure and immediately after failure. (i) For static strength substantiation, these loads multiplied by an appropriate factor of safety that is related to the probability of occurrence of the failure are ultimate loads to be considered for design. The factor of safety (FS) is defined in Figure 1. (ii) For residual strength substantiation, the airplane must be able to withstand two thirds of the ultimate loads defined in paragraph (c)(1)(i) of this section. For pressurized cabins, these loads must be combined with the normal operating differential pressure. (iii) Freedom from aeroelastic instability must be shown up to the speeds defined in § 25.629(b)(2). For failure conditions that result in speed increases beyond VC/MC, freedom from aeroelastic instability must be shown to those increased speeds, so that the margins intended by § 25.629(b)(2) are maintained. (iv) Failures of the system that result in forced structural vibrations (oscillatory failures) must not produce loads that could result in detrimental deformation of primary structure. (2) For the continuation of the flight. For the airplane in the system failed state and considering any appropriate reconfiguration and flight limitations, the following apply: (i) The loads derived from the following conditions (or used in lieu of the following conditions) at speeds up to VC/MC or the speed limitation prescribed for the remainder of the flight must be determined: (A) the limit symmetrical maneuvering conditions specified in §§ 25.331 and in 25.345. (B) the limit gust and turbulence conditions specified in §§ 25.341 and in 25.345. (C) the limit rolling conditions specified in § 25.349 and the limit unsymmetrical conditions specified in §§ 25.367 and 25.427(b) and (c). (D) the limit yaw maneuvering conditions specified in § 25.351. (E) the limit ground loading conditions specified in §§ 25.473 and 25.491. (ii) For static strength substantiation, each part of the structure must be able to withstand the loads in paragraph (c)(2)(i) of this special condition multiplied by a factor of safety, depending on the probability of being in this failure state. The factor of safety is defined in Figure 2. VerDate Aug<31>2005 15:28 Mar 23, 2007 Jkt 211001 PO 00000 Frm 00004 Fmt 4700 Sfmt 4700 E:\FR\FM\26MRR1.SGM 26MRR1 ER26MR07.000</GPH> cprice-sewell on PROD1PC66 with RULES control surface, thresholds or any other system non-linearities) must be accounted for in a realistic or conservative way when deriving limit loads from limit conditions. (2) The airplane must meet the strength requirements of part 25 (static strength, residual strength), using the specified factors to derive ultimate loads from the limit loads defined above. The effect of non-linearities must be investigated beyond limit conditions to ensure that the behavior of the system presents no anomaly compared to the Federal Register / Vol. 72, No. 57 / Monday, March 26, 2007 / Rules and Regulations Tj = Average time spent in failure condition j (in hours) Pj = Probability of occurrence of failure mode j (per hour) cprice-sewell on PROD1PC66 with RULES Note: If Pj is greater than 10¥3 per flight hour, then a 1.5 factor of safety must be applied to all limit load conditions specified in subpart C. VerDate Aug<31>2005 15:28 Mar 23, 2007 Jkt 211001 (iii) For residual strength substantiation, the airplane must be able to withstand two thirds of the ultimate loads defined in paragraph (c)(2)(ii). For pressurized cabins, these loads must be defined combined with the normal operating differential pressure. (iv) If the loads induced by the failure condition have a significant effect on PO 00000 Frm 00005 Fmt 4700 Sfmt 4700 fatigue or damage tolerance, then their effects must be taken into account. (v) Freedom from aeroelastic instability must be shown up to a speed determined from Figure 3. Flutter clearance speeds V′ and V″ may be based on the speed limitation specified for the remainder of the flight, using the margins defined by § 25.629(b). E:\FR\FM\26MRR1.SGM 26MRR1 ER26MR07.001</GPH> Qj = (Tj)(Pj) where: 14039 Federal Register / Vol. 72, No. 57 / Monday, March 26, 2007 / Rules and Regulations V′ = Clearance speed as defined by § 25.629(b)(2). V″ = Clearance speed as defined by § 25.629(b)(1). Qj = (Tj)(Pj) where: Tj = Average time spent in failure condition j (in hours) Pj = Probability of occurrence of failure mode j (per hour) cprice-sewell on PROD1PC66 with RULES Note: If Pj is greater than 10¥3 per flight hour, then the flutter clearance speed must not be less than V″. (vi) Freedom from aeroelastic instability must also be shown up to V′ in Figure 3 above for any probable system failure condition combined with any damage required or selected for investigation by § 25.571(b). (3) Consideration of certain failure conditions may be required by other sections of this Part, regardless of calculated system reliability. Where analysis shows the probability of these failure conditions to be less than 10¥9, criteria other than those specified in this paragraph may be used for structural substantiation to show continued safe flight and landing. (d) Warning considerations. For system failure detection and warning, the following apply: (1) The system must be checked for failure conditions, not extremely improbable, that degrade the structural capability below the level required by part 25 or significantly reduce the reliability of the remaining system. As far as reasonably practicable, the flightcrew must be made aware of these VerDate Aug<31>2005 15:28 Mar 23, 2007 Jkt 211001 failures before flight. Certain elements of the control system, such as mechanical and hydraulic components, may use special periodic inspections, and electronic components may use daily checks in lieu of warning systems to achieve the objective of this requirement. These certification maintenance requirements must be limited to components the failures of which are not readily detectable by normal warning systems and where service history shows that inspections will provide an adequate level of safety. (2) The existence of any failure condition, not extremely improbable, during flight that could significantly affect the structural capability of the airplane and for which the associated reduction in airworthiness can be minimized by suitable flight limitations must be signaled to the flightcrew. For example, failure conditions that result in a factor of safety between the airplane strength and the loads of part 25, subpart C, below 1.25 or flutter margins below V″ must be signaled to the crew during flight. (e) Dispatch with known failure conditions. If the airplane is to be dispatched in a known system failure condition that affects structural performance or affects the reliability of the remaining system to maintain structural performance, then the provisions of this Special Condition must be met, including the provisions of paragraph (b), for the dispatched condition and paragraph (c) for PO 00000 Frm 00006 Fmt 4700 Sfmt 4700 subsequent failures. Expected operational limitations may be taken into account in establishing Pj as the probability of failure occurrence for determining the safety margin in Figure 1. Flight limitations and expected operational limitations may be taken into account in establishing Qj as the combined probability of being in the dispatched failure condition and the subsequent failure condition for the safety margins in Figures 2 and 3. These limitations must be such that the probability of being in this combined failure state and then subsequently encountering limit load conditions is extremely improbable. No reduction in these safety margins is allowed, if the subsequent system failure rate is greater than 1E–3 per flight hour. Issued in Renton, Washington, on March 19, 2007. Ali Bahrami, Manager, Transport Airplane Directorate, Aircraft Certification Service. [FR Doc. E7–5508 Filed 3–23–07; 8:45 am] BILLING CODE 4910–13–C E:\FR\FM\26MRR1.SGM 26MRR1 ER26MR07.002</GPH> 14040

Agencies

[Federal Register Volume 72, Number 57 (Monday, March 26, 2007)]
[Rules and Regulations]
[Pages 14035-14040]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E7-5508]



========================================================================
Rules and Regulations
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains regulatory documents 
having general applicability and legal effect, most of which are keyed 
to and codified in the Code of Federal Regulations, which is published 
under 50 titles pursuant to 44 U.S.C. 1510.

The Code of Federal Regulations is sold by the Superintendent of Documents. 
Prices of new books are listed in the first FEDERAL REGISTER issue of each 
week.

========================================================================


Federal Register / Vol. 72, No. 57 / Monday, March 26, 2007 / Rules 
and Regulations

[[Page 14035]]


-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 25

[Docket No. NM357; Special Conditions No. 25-347-SC]


Special Conditions: Boeing Model 737-900ER series airplanes; 
Interaction of Systems and Structures

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Final special conditions.

-----------------------------------------------------------------------

SUMMARY: This special condition is issued for the Boeing Model 737-
900ER airplane. This airplane will have a novel or unusual design 
feature(s) associated with the interaction of systems and structures. 
The applicable airworthiness regulations do not contain adequate or 
appropriate safety standards for this design feature. This special 
condition contains the additional safety standards that the 
Administrator considers necessary to establish a level of safety 
equivalent to that established by the existing airworthiness standards.

DATES: Effective Date: March 19, 2007.

FOR FURTHER INFORMATION CONTACT: Todd Martin, Aerospace Engineer, 
Airframe/Cabin Safety Branch, ANM-115, Transport Airplane Directorate, 
Aircraft Certification Service, 1601 Lind Avenue SW., Renton, 
Washington 98057-3356; telephone (425) 227-1178; facsimile (425) 227-
1232; electronic mail Todd.Martin@faa.gov.

SUPPLEMENTARY INFORMATION: 

Background

    On June 5, 2002, The Boeing Company, PO Box 3707, Seattle, 
Washington 98124, applied for an amendment to Type Certificate No. 
A16WE, to include the new Model 737-900ER. The Model 737-900ER, which 
is a derivative of the Model 737-900 currently approved under A16WE, is 
a large transport airplane with two flight crew and the capacity to 
carry 215 passengers. The airplane is powered by two CFMI CFM56-7 
series turbofan engines.

Type Certification Basis

    Under the provisions of Sec.  21.101, Boeing must show that the 
Model 737-900ER meets the applicable provisions of 14 CFR part 25, as 
amended by Amendments 25-1 through 25-108, except for earlier 
amendments as agreed upon by the FAA. These regulations will be 
incorporated into the Type Certificate No. A16WE after type 
certification approval of the 737-900ER.
    In addition, the certification basis includes other regulations, 
special conditions and exemptions that are not relevant to this 
proposed special condition. Refer to Type Certificate No. A16WE for a 
complete description of the certification basis for this model 
airplane.
    If the Administrator finds that the applicable airworthiness 
regulations (i.e., 14 CFR part 25) do not contain adequate or 
appropriate safety standards for the Model 737-900ER because of a novel 
or unusual design feature, special conditions are prescribed under the 
provisions of Sec.  21.16.
    In addition to the applicable airworthiness regulations and special 
conditions, the Model 737-900ER must comply with the fuel vent and 
exhaust emission requirements of 14 CFR part 34 and the noise 
certification requirements of 14 CFR part 36.
    The FAA issues special conditions, as defined in Sec.  11.19, they 
are published for comment under Sec.  11.38, and they become part of 
the type certification basis under Sec.  21.101.
    Special conditions are initially applicable to the model for which 
they are issued. Should the type certificate for that model be amended 
later to include any other model that incorporates the same or similar 
novel or unusual design feature, or should any other model already 
included on the same type certificate be modified to incorporate the 
same or similar novel or unusual design feature, the special conditions 
would also apply to the other model under Sec.  21.101.

Novel or Unusual Design Features

    The Model 737-900ER airplane will incorporate novel or unusual 
design features. This special condition addresses equipment that may 
affect the airplane's structural performance, either directly or as a 
result of failure or malfunction.
    This proposed special condition is identical or nearly identical to 
those previously required for type certification of other Boeing 
airplane models. The special condition was derived initially from 
standardized requirements developed by the Aviation Rulemaking Advisory 
Committee (ARAC), comprised of representatives of the FAA, Europe's 
Joint Aviation Authorities (now replaced by the European Aviation 
Safety Agency), and industry.

Discussion

    In addition to the requirements of part 25, subparts C and D, the 
following special condition applies:

Interaction of Systems and Structures

    The Boeing Model 737-900ER is equipped with systems that may affect 
the airplane's structural performance either directly or as a result of 
failure or malfunction. The effects of these systems on structural 
performance must be considered in the certification analysis. This 
analysis must include consideration of normal operation and of failure 
conditions with required structural strength levels related to the 
probability of occurrence.

Discussion of Comments

    Notice of proposed special conditions No. 25-06-11-SC for Boeing 
Model 737-900ER airplanes was published in the Federal Register on 
October 31, 2006 (71 FR 63718). A combined set of comments was received 
from the United States Air Force and the United States Navy.
    As noted previously, special conditions are prescribed under the 
provisions of Sec.  21.16 when current regulations ``do not contain 
adequate or appropriate safety standards * * * because of a novel or 
unusual design feature.''
    For several decades, transport category airplanes have employed 
automatic and electronic flight control systems, including load 
alleviation systems, flutter suppression systems, and stability 
augmentation systems. Failures in any of these systems may affect how 
the airplane will respond to maneuver, gust, and high speed conditions. 
That is, the loads introduced

[[Page 14036]]

to the airplane may increase as a result of failures in these systems, 
or the flutter capability of the airplane may be reduced.
    Since current regulations do not specify design loads criteria, 
including a safety factor for system failures, a special condition is 
needed to address such failures. To address the effects of system 
failures on the structural and flutter capability of the airplane, the 
FAA developed a special condition, which has been applied in 
essentially the same form since 1989, and which is proposed for the 
Boeing Model 737-900ER.
    Comment 1: The commenters recommended that the proposed special 
condition not be implemented as a general rule.
    FAA response: At this time we are not implementing the proposed 
special condition as a general rule. The ``Conclusion'' section of the 
proposed special condition (No. 25-06-11-SC) states that ``This action 
affects only certain novel or unusual design features on one model of 
airplane. It is not a rule of general applicability.'' We are 
considering rulemaking to incorporate this special condition into 14 
CFR part 25. If we do propose changes to 14 CFR part 25 the public will 
have the opportunity to comment on that rulemaking action. We have not 
changed this special condition as a result of this comment.
    Comment 2: The commenters recommended that systems failures be 
addressed individually and that exceptions to existing standards and 
rules be reviewed on a case-by-case basis.
    FAA response: We do not agree with this recommendation. Although 
the proposed special condition allows the use of safety factors of less 
than 1.5, we do not regard this as an exception to the current 
regulation. The current CFR regulation does not specify design loads 
criteria, including a safety factor, for system failures. This is why 
special conditions are needed. We have not changed this special 
condition as a result of this comment.
    Comment 3: The commenters noted that Figure 1 in the proposed 
special condition, which is a plot of safety factor versus failure 
probability, shows that for failure occurrences more frequent than 
10-5 per flight hour, the factor of safety is equal to 1.5 
and cannot be reduced. However, the text of the proposed rule indicates 
in several places that this probability threshold is 10-3.
    FAA response: We infer that the commenters are suggesting there are 
errors in the proposed special condition and that the text should be 
revised to change the 10-3 references to 10-5. We 
do not agree that the references to 10-3 in the text are 
errors. The three references to 10-3 in the text of the 
proposed special condition do not apply to Figure 1. The first two 
references to the 10-3 probability threshold are notes that 
apply only to Figures 2 and 3 of the proposed special condition. The 
third reference to 10-3 applies to subsequent failures 
following dispatch with a known failure. We have not changed this 
special condition as a result of this comment.
    Comment 4: The commenters are concerned that the definition of the 
term ``Qj = Probability of being in a failure condition,'' 
is too vague and that the probability of being in a failure mode has to 
be more clearly defined to avoid potential loopholes. The term appears 
in the proposed special condition as follows: ``Qj = 
Probability of being in a failure condition, which is defined as 
Pj = Probability of failure occurrence multiplied by 
Tj = Average time spent in failure condition.'' The concern 
is that an artificially low value of Tj would result in an 
inappropriate value of Qj. As an example, for a spoiler 
failure on landing approach, the Qj variable would be very 
small since you only spend a few minutes in that condition.
    FAA response: We believe that the definitions of probability and 
exposure time are sufficiently clear, and that their use is appropriate 
in this special condition. The term Tj applies to 
``continuation of flight'' failures, and thereby accounts for the 
maximum possible exposure period of the failure. If a failure is not 
detected, then Tj equals the average latency period for that 
failure mode. This results in a high value of Tj 
(potentially hundreds of hours), a high value of Qj, and 
little or no reduction of the safety factor. If the failure was 
detected, then its exposure would be limited and its effects mitigated 
by pilot actions. In this case, a reduced value of Qj and a 
corresponding reduced safety factor is appropriate.
    Comment 5: The commenters stated that the net effect of the 
proposed special condition would be a reduction in reliability when 
compared to the current practice for defining failure condition safety 
factors. The commenters also stated that the current practice has a 
historical track record of success. The commenters also noted that the 
allowed reduction of the safety factor is not analytically nor 
empirically justified.
    FAA response: We do not believe that this special condition reduces 
reliability or structural integrity when compared to the current 
practice for defining failure condition safety factors. The current 
regulation does not specify design loads criteria, including a safety 
factor, for system failures. Special conditions are needed to define 
these criteria. Also, the intent of this special condition has been 
applied for over ten years. Prior to this special condition we outlined 
similar criteria in Advisory Circular 25.672-1, Active Flight Controls, 
dated November 15, 1983.
    While not analytically precise, we believe that reduced safety 
factors for low probability events are justified. Safety factors 
provide an additional margin above limit load capability. For low 
probability events, less margin is needed because these events will 
occur less often. For high probability events, more margin is needed, 
therefore, the full 1.5 safety factor is required. The relationship 
between the probability and the severity of a failure condition is 
similar to that used in a system safety assessment: High probability 
events must only have minor consequences, whereas low probability 
events may have major or hazardous consequences. In all cases, the 
objective is that no failure or combination of failures may be 
catastrophic.
    Comment 6: The commenters recommended that the process to be used 
to determine the reliability of a system be defined. The commenters 
also recommended that for each airplane model, the airframe 
manufacturer document all of the systems and structure subject to the 
proposed special conditions.
    FAA response: We believe that the process for determining the 
reliability of a system is well defined in this special condition 
because the special condition states that the failure condition and 
probabilistic terms are the same as those defined in Sec.  25.1309, 
Equipment, systems, and installations. That regulation's advisory 
material, Advisory Circular 25.1309-1A, System Design and Analysis, 
dated June 21, 1988, provides an acceptable process for determining the 
reliability of systems (that is, their probability of failure).
    We also note that as part of the certification process, airframe 
manufacturers are required to document the systems and structures 
subject to this special condition.
    Comment 7: The commenters stated that in Figure 3 of the proposed 
special condition, it is not clear how the flutter clearance speed 
should be determined when the probability of being in a failure 
condition, Qj, is between 1 and 10-5.
    FAA response: Figure 3 of this special condition shows that when 
the

[[Page 14037]]

probability of being in the failure condition, Qj, is equal 
to one, the flutter clearance speed is V'', which is the speed as 
defined by Sec.  25.629(b)(1). (This is the same as the clearance speed 
with no failures.) When Qj = 10-5, the clearance 
speed is V', which is the clearance speed with failures, as defined by 
Sec.  25.629(b)(2). If Qj is between 1 and 10-5, 
then the clearance speed varies linearly between V'' and V'. This can 
be calculated as V = V'' + 0.2(logQj)(V''-V').
    Comment 8: The commenters noted that the United States Air Force 
threshold for allowing a reduced clearance speed is 10-7 per 
flight hour. A note accompanying Figure 3 in the proposed special 
conditions indicates that the flutter clearance speed may not be less 
than V'' if Pj is greater than 10-3 per flight 
hour. V'' is the clearance speed with no failures, which includes a 15% 
margin on the design dive speed, VD/MD. The 
commenters suggested that the 10-7 per flight hour threshold 
is more appropriate than the 10-3 per flight hour threshold 
because the flutter analysis may inaccurately predict a critical 
flutter mechanism under a failed condition. The commenters also pointed 
out that failure conditions are not typically flutter tested in flight.
    FAA response: We believe that the flutter clearance speeds for 
failures are adequate as defined. Flutter clearance speeds for failure 
cases are defined in both Sec.  25.629 and in these special conditions. 
The flutter clearance speed for failure cases defined in Sec.  25.629 
has not changed significantly since Amendment 25-0, issued in 1965. The 
service history on products certificated to Amendment 25-0, or later, 
has been acceptable regarding the effects of failures on flutter. The 
flutter clearance speed defined in these special conditions exceeds 
that defined in Sec.  25.629 (and is therefore more conservative) for 
all failure conditions whose probability is greater than 
10-5.
    No changes were made to these special conditions as a result of 
these comments. The special conditions are adopted as proposed.

Applicability

    As discussed above, this special condition is applicable to the 
Boeing Model 737-900ER. Should Boeing apply at a later date for a 
change to the type certificate to include another model incorporating 
the same novel or unusual design feature, this special condition would 
apply to that model as well.

Effective Upon Issuance

    Under standard practice, the effective date of final special 
conditions would be 30 days after the date of publication in the 
Federal Register; however, as the certification date for the Boeing 
Model 737-900ER is imminent, the FAA finds that good cause exists to 
make this special condition effective upon issuance.

Conclusion

    This action affects only certain novel or unusual design features 
on one model of airplane. It is not a rule of general applicability.

List of Subjects in 14 CFR Part 25

    Aircraft, Aviation safety, Reporting and recordkeeping 
requirements.

    The authority citation for these special conditions is as follows:

    Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.

The Special Condition

0
Accordingly, pursuant to the authority delegated to me by the 
Administrator, the following special conditions are issued as part of 
the type certification basis for Boeing Model 737-900ER airplanes.

Interaction of Systems and Structures

    In addition to the requirements of part 25, subparts C and D, the 
following proposed special condition would apply:
    a. For airplanes equipped with systems that affect structural 
performance--either directly or as a result of a failure or 
malfunction--the influence of these systems and their failure 
conditions must be taken into account when showing compliance with the 
requirements of part 25, subparts C and D. Paragraph b, below, must be 
used to evaluate the structural performance of airplanes equipped with 
these systems.
    b. Interaction of Systems and Structures.
    (1) General: The following criteria must be used for showing 
compliance with this special condition for interaction of systems and 
structures and with Sec.  25.629 for airplanes equipped with flight 
control systems, autopilots, stability augmentation systems, load 
alleviation systems, flutter control systems, and fuel management 
systems.
    (a) The criteria defined herein address only the direct structural 
consequences of the system responses and performances. They cannot be 
considered in isolation but should be included in the overall safety 
evaluation of the airplane. These criteria may, in some instances, 
duplicate standards already established for this evaluation. These 
criteria are applicable only to structures whose failure could prevent 
continued safe flight and landing. Specific criteria that define 
acceptable limits on handling characteristics or stability requirements 
when operating in the system degraded or inoperative modes are not 
provided in this special condition.
    (b) Depending upon the specific characteristics of the airplane, 
additional studies may be required that go beyond the criteria provided 
in this special condition in order to demonstrate the capability of the 
airplane to meet other realistic conditions, such as alternative gust 
or maneuver descriptions for an airplane equipped with a load 
alleviation system.
    (c) The following definitions are applicable to this paragraph.
    Structural performance: Capability of the airplane to meet the 
structural requirements of part 25.
    Flight limitations: Limitations that can be applied to the airplane 
flight conditions following an in-flight occurrence and that are 
included in the flight manual (e.g., speed limitations and avoidance of 
severe weather conditions).
    Operational limitations: Limitations, including flight limitations, 
that can be applied to the airplane operating conditions before 
dispatch (e.g., fuel, payload, and Master Minimum Equipment List 
limitations).
    Probabilistic terms: The probabilistic terms (probable, improbable, 
and extremely improbable) used in this special conditions are the same 
as those used in Sec.  25.1309.
    Failure condition: The term failure condition is the same as that 
used in Sec.  25.1309. However, this special condition applies only to 
system failure conditions that affect the structural performance of the 
airplane (e.g., system failure conditions that induce loads, change the 
response of the airplane to inputs such as gusts or pilot actions, or 
lower flutter margins).
    (2) Effects of Systems on Structures.
    (a) General. The following criteria will be used in determining the 
influence of a system and its failure conditions on the airplane 
structure.
    (b) System fully operative. With the system fully operative, the 
following apply:
    (1) Limit loads must be derived in all normal operating 
configurations of the system from all the limit conditions specified in 
subpart C (or used in lieu of those specified in subpart C), taking 
into account any special behavior of such a system or associated 
functions or any effect on the structural performance of the airplane 
that may occur up to the limit loads. In particular, any significant 
non-linearity (rate of displacement of

[[Page 14038]]

control surface, thresholds or any other system non-linearities) must 
be accounted for in a realistic or conservative way when deriving limit 
loads from limit conditions.
    (2) The airplane must meet the strength requirements of part 25 
(static strength, residual strength), using the specified factors to 
derive ultimate loads from the limit loads defined above. The effect of 
non-linearities must be investigated beyond limit conditions to ensure 
that the behavior of the system presents no anomaly compared to the 
behavior below limit conditions. However, conditions beyond limit 
conditions need not be considered, when it can be shown that the 
airplane has design features that will not allow it to exceed those 
limit conditions.
    (3) The airplane must meet the aeroelastic stability requirements 
of Sec.  25.629.
    (c) System in the failure condition. For any system failure 
condition not shown to be extremely improbable, the following apply:
    (1) At the time of occurrence. Starting from 1g level flight 
conditions, a realistic scenario, including pilot corrective actions, 
must be established to determine the loads occurring at the time of 
failure and immediately after failure.
    (i) For static strength substantiation, these loads multiplied by 
an appropriate factor of safety that is related to the probability of 
occurrence of the failure are ultimate loads to be considered for 
design. The factor of safety (FS) is defined in Figure 1.
[GRAPHIC] [TIFF OMITTED] TR26MR07.000

    (ii) For residual strength substantiation, the airplane must be 
able to withstand two thirds of the ultimate loads defined in paragraph 
(c)(1)(i) of this section. For pressurized cabins, these loads must be 
combined with the normal operating differential pressure.
    (iii) Freedom from aeroelastic instability must be shown up to the 
speeds defined in Sec.  25.629(b)(2). For failure conditions that 
result in speed increases beyond VC/MC, freedom 
from aeroelastic instability must be shown to those increased speeds, 
so that the margins intended by Sec.  25.629(b)(2) are maintained.
    (iv) Failures of the system that result in forced structural 
vibrations (oscillatory failures) must not produce loads that could 
result in detrimental deformation of primary structure.
    (2) For the continuation of the flight. For the airplane in the 
system failed state and considering any appropriate reconfiguration and 
flight limitations, the following apply:
    (i) The loads derived from the following conditions (or used in 
lieu of the following conditions) at speeds up to VC/
MC or the speed limitation prescribed for the remainder of 
the flight must be determined:
    (A) the limit symmetrical maneuvering conditions specified in 
Sec. Sec.  25.331 and in 25.345.
    (B) the limit gust and turbulence conditions specified in 
Sec. Sec.  25.341 and in 25.345.
    (C) the limit rolling conditions specified in Sec.  25.349 and the 
limit unsymmetrical conditions specified in Sec. Sec.  25.367 and 
25.427(b) and (c).
    (D) the limit yaw maneuvering conditions specified in Sec.  25.351.
    (E) the limit ground loading conditions specified in Sec. Sec.  
25.473 and 25.491.
    (ii) For static strength substantiation, each part of the structure 
must be able to withstand the loads in paragraph (c)(2)(i) of this 
special condition multiplied by a factor of safety, depending on the 
probability of being in this failure state. The factor of safety is 
defined in Figure 2.

[[Page 14039]]

[GRAPHIC] [TIFF OMITTED] TR26MR07.001

Qj = (Tj)(Pj) where:

Tj = Average time spent in failure condition j (in hours)
Pj = Probability of occurrence of failure mode j (per 
hour)

    Note: If Pj is greater than 10-3 per 
flight hour, then a 1.5 factor of safety must be applied to all 
limit load conditions specified in subpart C.

    (iii) For residual strength substantiation, the airplane must be 
able to withstand two thirds of the ultimate loads defined in paragraph 
(c)(2)(ii). For pressurized cabins, these loads must be defined 
combined with the normal operating differential pressure.
    (iv) If the loads induced by the failure condition have a 
significant effect on fatigue or damage tolerance, then their effects 
must be taken into account.
    (v) Freedom from aeroelastic instability must be shown up to a 
speed determined from Figure 3. Flutter clearance speeds V' and V'' may 
be based on the speed limitation specified for the remainder of the 
flight, using the margins defined by Sec.  25.629(b).

[[Page 14040]]

[GRAPHIC] [TIFF OMITTED] TR26MR07.002

V' = Clearance speed as defined by Sec.  25.629(b)(2).
V'' = Clearance speed as defined by Sec.  25.629(b)(1).
Qj = (Tj)(Pj) where:

Tj = Average time spent in failure condition j (in hours)
Pj = Probability of occurrence of failure mode j (per 
hour)

    Note: If Pj is greater than 10-3 per 
flight hour, then the flutter clearance speed must not be less than 
V''.

    (vi) Freedom from aeroelastic instability must also be shown up to 
V' in Figure 3 above for any probable system failure condition combined 
with any damage required or selected for investigation by Sec.  
25.571(b).
    (3) Consideration of certain failure conditions may be required by 
other sections of this Part, regardless of calculated system 
reliability. Where analysis shows the probability of these failure 
conditions to be less than 10-9, criteria other than those 
specified in this paragraph may be used for structural substantiation 
to show continued safe flight and landing.
    (d) Warning considerations. For system failure detection and 
warning, the following apply:
    (1) The system must be checked for failure conditions, not 
extremely improbable, that degrade the structural capability below the 
level required by part 25 or significantly reduce the reliability of 
the remaining system. As far as reasonably practicable, the flightcrew 
must be made aware of these failures before flight. Certain elements of 
the control system, such as mechanical and hydraulic components, may 
use special periodic inspections, and electronic components may use 
daily checks in lieu of warning systems to achieve the objective of 
this requirement. These certification maintenance requirements must be 
limited to components the failures of which are not readily detectable 
by normal warning systems and where service history shows that 
inspections will provide an adequate level of safety.
    (2) The existence of any failure condition, not extremely 
improbable, during flight that could significantly affect the 
structural capability of the airplane and for which the associated 
reduction in airworthiness can be minimized by suitable flight 
limitations must be signaled to the flightcrew. For example, failure 
conditions that result in a factor of safety between the airplane 
strength and the loads of part 25, subpart C, below 1.25 or flutter 
margins below V'' must be signaled to the crew during flight.
    (e) Dispatch with known failure conditions. If the airplane is to 
be dispatched in a known system failure condition that affects 
structural performance or affects the reliability of the remaining 
system to maintain structural performance, then the provisions of this 
Special Condition must be met, including the provisions of paragraph 
(b), for the dispatched condition and paragraph (c) for subsequent 
failures. Expected operational limitations may be taken into account in 
establishing Pj as the probability of failure occurrence for 
determining the safety margin in Figure 1. Flight limitations and 
expected operational limitations may be taken into account in 
establishing Qj as the combined probability of being in the 
dispatched failure condition and the subsequent failure condition for 
the safety margins in Figures 2 and 3. These limitations must be such 
that the probability of being in this combined failure state and then 
subsequently encountering limit load conditions is extremely 
improbable. No reduction in these safety margins is allowed, if the 
subsequent system failure rate is greater than 1E-3 per flight hour.

    Issued in Renton, Washington, on March 19, 2007.
Ali Bahrami,
Manager, Transport Airplane Directorate, Aircraft Certification 
Service.
 [FR Doc. E7-5508 Filed 3-23-07; 8:45 am]
BILLING CODE 4910-13-C