3-2 consequences of propeller failures should only be based on assumptions for a typical propeller, engine, or aircraft combination.
3.1.2.2 Propeller Installations. Due to possible installation differences, airplane level requirements for individual failure conditions may be more severe than propeller requirements. Therefore, propeller and airplane manufacturers should coordinate propeller installations with each other and the appropriate ACO Branch to ensure the installation is acceptable to the FAA for airplane certification. Applicants should be aware that a propeller certified for a given airplane, may not be eligible for operation and installation on a different airplane.
3.1.3 Hazardous Propeller Effects.
The hazardous propeller effects are defined in § 35.15(g)(1). Section 35.15 defines the propeller failure conditions and the probability of failure for hazardous propeller effects as extremely remote (probability of occurrence of 10-7 or less per propeller flight hour). Since aircraft requirements for individual failure conditions may be more severe than propeller requirements, the propeller manufacturer, engine manufacturer and aircraft manufacturer should coordinate early to ensure propeller, engine, and aircraft compatibility. Guidance for hazardous propeller effects is as follows:
3.1.3.1 Propeller failures resulting in excessive drag or significant thrust in the direction opposite to that commanded by the pilot could, depending on the flight phase, result in a loss of control of the airplane. These include unwanted low or reverse propeller pitch in-flight and high forward thrust, when reverse thrust is commanded. In addition to causing high drag, unwanted low or reverse propeller pitch in-flight may result in severe overspeed of the propeller or disruption of the airflow over the wing potentially leading to increased airplane stall speed.
3.1.3.2 Propeller failures resulting in a release of the propeller, blades, hubs, counterweights, erosion shields, or other similar large rotating components with sufficient energy to penetrate a fuselage could result in a hazardous condition. These objects could damage the airplane structure, systems, or cause injury or fatality.
3.1.3.3 Propeller failures resulting in excessive unbalance could result in a hazardous condition related to the aircraft and cause engine damage.
These include release of a blade or major portion of a blade, release of counterweights, or an unwanted pitch change of individual blades.
3.1.3.4 Although each of the defined propeller hazardous effects represents a compromise of safety, the propeller may have mitigating features, such as counterweights that drive the propeller to a failsafe condition or the propeller may be feathered to reduce an unbalance.
3-3 Note: Showing that a failure condition is an extremely remote occurrence cannot be used to substitute or eliminate, the need to comply with any other part 35 requirements.
3.1.4 Major Propeller Effects.
Section 35.15(g)(2) defines major propeller effects, not the probability of failure for major propeller effects. A defined maximum failure rate may be too severe for some simple fail-safe control systems on single reciprocating engine airplanes and not severe enough for transport category airplanes. The FAA recommends that the probability of failure for major propeller effects to be at a minimum consistent with the intended airplane. For propellers installed on multiple turbine engine applications, major propeller effects would be defined as remote (probability of occurrence of 10-5 or less per propeller flight hour). Guidance for major propeller effects is as follows:
3.1.4.1 Feathering propellers should be able to reach the established feather angle.
The rate of pitch change should not be substantially lower than the normal operating system to reach the feather angle.
3.1.4.2 Variable pitch propellers are considered unable to change pitch when the rate of pitch change is substantially lower than the normal operating system to reach the feather angle.
3.1.4.3 A significant uncommanded change in pitch (change in thrust of more than 10 percent of the typical climb thrust) would require pilot corrective action or would significantly degrade aircraft performance. A final determination of the installation requirement based on aircraft controllability requirements should be evaluated during aircraft certification.
3.1.4.4 A significant uncontrollable torque or speed fluctuation (loss of the capability to modulate rotational speed or torque within 3 percent of reference torque or speed at all normal operating conditions) would require pilot corrective action or would significantly degrade aircraft performance.
3.1.5 Safety Analysis Discussion.
The propeller is defined by the components declared in the type design. The propeller system consists of the propeller and all other components required to operate the propeller on a typical installation. Some components may not be included in the propeller type design. These components may include hydraulic controls, electronic controls, overspeed governors, spinners, de-icing boots, and de-icing components.
When components are not included in propeller type design, they are not under the design control of the propeller TC holder, but are controlled by the aircraft or engine TC holders. Although these components are not within the scope of the propeller type design, the safety analysis should assume representative components to assess the system safety.
3-4
3.1.5.1 Typical Installation. The phrase typical installation does not imply that the aircraft-level effects are known. It implies that assumptions of typical aircraft or engine devices, such as governors or annunciation devices are stated in the analysis. A typical installation may be the initial aircraft installation or one that requires a higher level of safety, if the initial aircraft installation requires a lower level of safety than other potential aircraft applications. Title 14 CFR part 23 and 14 CFR part 25 provide requirements for aircraft-level devices.
3.1.5.2 Integration with 14 CFR 35.23 Requirements. Applicants should integrate the specific requirements of § 35.23, if applicable, into their propeller safety analysis. We recommend, however, that applicants are careful to ensure that critical elements of the analysis are not left out during incorporation.
3.1.6 Probability of Failures.
The applicant must summarize the probability of failures that could result in major propeller or hazardous propeller effects and estimate the probability of occurrence to demonstrate compliance to § 35.15(a)(2). Applicants may use many sources to estimate the component failure probability, such as experience and failure data on similar products operating in a similar environment; industry reliability specifications;
testing; analysis; and engineering judgment (when other options are not practical).
When calculating the estimated probability of each failure condition, a margin may be necessary to account for uncertainty. Probabilistic calculations of failure rates should include the possible dormancy period of failures. A margin is not normally required for analysis from proven data, operational experience, and tests.
Note: The failure summary may be formatted as a list or a table.
3.1.6.1 Hazardous Propeller Effects Occurrence Rate. The occurrence rate of hazardous propeller effects applies to each individual effect. The defined probability rate of 10-7or less per propeller flight hour for each hazardous propeller effect applies to the sum of the probabilities arising from individual and combinations of failures, excluding critical component failures. For example, if the fatigue failure of a connector and pump could lead to a reverse pitch in-flight, then the total failure probability is the connector failure probability multiplied by the pump failure probability.
This total probability of failure cannot exceed 10-7. If each individual failure is less than 10-8 per engine flight hour, summation is not required.
Some failure probability rates may not be well understood. For example, the pump failure rate may be known from past reliability data, but the individual connector failure rate, due to fatigue, may not be known. In this case, applicants should use engineering judgment or analysis to estimate connector failure probability. Some aircraft may require a rate of occurrence of reverse pitch in-flight that does not exceed 10-9.
3-5
3.1.6.2 Propeller Critical Parts. Propeller critical parts are identified in § 35.15(c).
When considering primary failures of certain single propeller elements, for example, blades and other single load path critical structural components, the numerical failure rate cannot be sensibly estimated. When the failure of such elements is likely to result in hazardous propeller effects, those elements must be identified as propeller critical parts, meet the prescribed integrity specifications of § 35.16, and be stated in the safety analysis.
The regulation does not require that applicants include the estimated primary failure rates of single propeller elements in the failure summary for each hazardous effect due to the difficulty of producing and substantiating estimates. These single propeller elements include blades, hubs and other critical components with very low failure rates that may not be easily estimated. Other single propeller elements with failures that result in less than a major or hazardous propeller effect require documentation of failure probability estimates. These failure rates may rely on engineering judgment and service history of similar components.
3.1.7 Verification of Assumptions.
Predicting the likely progression of some propeller failures may rely on engineering judgment. When the validity of engineering judgment is questionable, applicants should substantiate their judgment with additional testing or other validation methods.
Additional substantiation may consist of previous relevant service experience, engineering analysis, material, component, and a rig or propeller test.
3.1.8 Additional Considerations.
When the safety analysis depends on the elements listed in § 35.15(e), applicants should include general statements in their analysis summary. General statements in the analysis summary should refer to regular maintenance in a shop and maintenance on the line, as applicable. The analysis should specify when specific failure rates rely on special or unique maintenance check. Applicants should consider the following when demonstrating compliance to part 35:
3.1.8.1 Propeller maintenance manual, overhaul manual, or other service related documents that may provide the appropriate documentation for maintenance actions.
3.1.8.2 Mandatory replacement times, inspection intervals, and related procedures required for propeller type certification in the airworthiness limitations section of the ICA.
3.1.8.3 Improper maintenance may contribute to hazardous or catastrophic effects at the aircraft level. Therefore, for some maintenance practices, applicants may consider requiring a two-man quality assurance check of major repairs or alterations or avoiding maintenance of both propellers on twin installations at the same time.
3-6
3.1.8.4 Mitigating the effects of improper operation or providing operating instructions that reduce the likelihood of improper operation that have resulted in hazardous or catastrophic effects at the aircraft level. These effects would have been less serious, if constrained at the propeller level.
3.1.8.5 Parts designed to minimize the risk of incorrect assembly, if the incorrect assembly could result in hazardous propeller effects. If this is not practical, applicants should consider indicating that these parts should be permanently marked to indicate their correct position when assembled.
3.1.9 Analytical Techniques.
Variations or combinations of analytical techniques for performing a safety analysis are acceptable. For derivative propellers, the scope of the analysis may be limited to modified components or operating conditions and their effects on the rest of the propeller. The applicant and project manager from the ACO Branch that manage the original propeller TC should agree on the scope of the analysis and the methods of assessment early in the propeller certification program.
3.1.10 Assessment Methods. Common assessment methods include FHA, FMEA, and FTA.
3.1.10.1 FHA is a systematic, comprehensive examination of the propeller system to identify potential major and hazardous propeller effects that may arise, not only as a result of malfunctions or failure to function, but also as a result of normal responses to unusual or abnormal external factors. FHA is concerned with the operational vulnerabilities of systems, instead of a detailed analysis of the actual implementation. It is an engineering tool that may be used early in the design process and updated as necessary.
3.1.10.2 FMEA is a structured, inductive, bottom-up analysis that evaluates the effects of each possible element or component failure on the propeller system. When properly formatted, the FMEA aids in identifying dormant failures and the possible causes of each failure mode.
3.1.10.3 FTA or dependence diagram (reliability block diagram) analyses are structured, deductive, top-down analyses that identify the conditions, failures, and events that cause each defined failure condition. They are graphical methods of identifying the logical relationship between each particular failure condition and the primary element or component failures, other events, or combinations that can cause the failure condition. FTA is failure oriented and is conducted from the perspective of which failures must occur to cause a defined failure condition. It may be used to determine the probability of failure for structures with crack arrest features or multiple load paths, but is not appropriate for single element structures.
A dependence diagram analysis is success oriented and conducted from the perspective of which failures must not occur to preclude a defined failure condition.
3-7
3.2 Section 35.16, Propeller critical parts.
See AC 35.16-1 for the definition and identification of propeller critical parts, and the engineering, manufacturing, and maintenance processes of propeller critical parts.
3.3 Section 35.17, Materials and manufacturing methods.
3.3.1 Metallic Materials and Processes for Propellers.
The metallic materials used and processes employed in propeller production in fabrication should be based on experience and/or tests. The FAA recommends applicants use the following guidelines:
3.3.1.1 Material Selection. Selected materials should be suitable for their intended mechanical and/or physical function and be resistant to degradation by atmospheric corrosion and the chemical environment encountered in the specific application. When the use of inherently resistant materials is not practical, consider the use of adequate coating systems. Avoid alloy-temper combinations that are susceptible to stress corrosion cracking. Coatings may delay, but not prevent, the onset of stress corrosion cracking. As much as possible, avoid designs that involve active galvanic coupling of dissimilar metals or alloys. When such coupling becomes the logical design choice, consider the use of coatings, films, or sealants.
3.3.1.2 Material Specifications. Materials should be procured to adequately detailed specifications related to the criticality of the application.
Specifications should be acceptable to the Administrator.
3.3.1.3 Design Values. The assumed design values of material properties should be related to the minimum (conservative) properties stated in the material specification or some other recognized document.
3.3.1.4 Process Specifications. Manufacturing processes should be performed according to detailed process specifications related to the criticality of the application. Specifications should be acceptable to the Administrator.
3.3.1.5 Special Manufacturing Methods. Casting, forging, welding, brazing, and additive manufacturing are examples of custom manufacturing methods requiring precautions not ordinarily applicable to the manufacture from mill products (bar, sheet, plate, and the like). The following are typical steps manufacturing methods taken to ensure quality:
3.3.1.5.1 Classification. Classify materials requiring special manufacturing methods according to their functional criticality. This classification becomes the basis for establishing the non-destructive inspection and testing requirements listed on the drawing.
3-8
3.3.1.5.2 Testing. Materials requiring special manufacturing methods should have provisions for testing the material. The applicant should develop a reasonable plan for testing these materials to verify their properties.
3.3.1.5.3 Inspection. Materials requiring special manufacturing methods should be subjected to a suitable non-destructive and destructive inspection process at an appropriate stage with an appropriate sampling rate.
3.3.1.6 Supplier Selection. The use of suppliers in fabricating parts must be carefully controlled during the metallic material manufacturing process.
The applicant should establish procedures for controlling and qualifying suppliers.
3.3.2 Composite Materials and Processes for Propellers.
To show compliance, the applicant should establish a composite material procurement, qualification, manufacturing, and quality program using the guidance provided in AC 20-107, CMH-17, PS-ACE 100-2002-006, or other internal or industry guidance material. The program should include the following:
3.3.2.1 Fabricating Parts Suppliers. Suppliers used in fabricating parts from the composite manufacturing process must be carefully controlled. The applicant should establish procedures for controlling and qualifying suppliers.
3.3.2.2 Material Specifications. Specifications for all constituent composite materials used for the propeller and suppliers should be identified. This includes, but is not limited to, fiber, cloth, core, resin, adhesives, paint, and any other important material forms.
3.3.2.3 Control Procedures. Procedures to be used to control and re-qualify constituent composite materials associated with changes to suppliers, specifications, manufacturing processes, and any fabrication steps.
3.3.2.4 Qualification Test Specimens. Specifications for the manufacture of composite qualification test specimens to be used for the establishment of base material properties, requalification, and storage of life-limited materials, as needed.
3.3.2.5 Process Specifications. Process specifications for the manufacture of the part should be defined to include the buildup of a part for assembly, such as a blade.
3.3.2.6 Base Material Properties Establishment or Verification. Test materials will be fabricated taking into account the manufacturing process specifications. Properties to be evaluated include tensile, compressive, shear strengths and moduli, out-of-plane or interlaminar fracture toughness, fatigue resistance, test specimen definitions, sample sizes,
3-9 testing, and analytical methods. The extent of testing and sample size may vary based on the use of existing accepted material qualifications, new materials, or the amount and type of full scale testing used.
3.3.2.7 Base Material Variability Quantification. Quantification of base material variability; including fiber orientation, fiber volume, resin distribution, acceptable void size and distribution, cure time and temperature, and any other material or processing characteristic.
3.3.2.8 Environmental Design Properties. Establishing environmental design properties, including the effects of humidity and temperature on materials that may be exposed.
3.3.2.9 Composite Structure Protection. Establishing composite structure protection suitability from the effects of weathering, abrasion, erosion, ultraviolet radiation, and chemical environment (glycol, hydraulic fluid, fuel, cleaning agents, etc.) that may cause deterioration in a composite structure.
3.4 Section 35.19, Durability.
The design and construction of propeller parts must minimize the development of unsafe conditions in between propeller overhaul periods. Propeller durability assessments should take into account the operating environment, ability to resist deteriorating wear, and environmental effects. Durability may be established by the evaluation of the propeller, component tests, and service history on similar propellers and components. Additional tests may be needed when the requirements of this part do not encompass the complete operating environment, such as a pusher propeller operating environment assessment as noted in paragraph 2.1.7.
3.5 Section 35.21, Variable and reversible pitch propellers.
3.5.1 Single Failures.
The propeller system consists of the propeller, plus all the components necessary for its functioning, but not necessarily included in the propeller type design. In the evaluation of failures, no single failure or malfunction in the propeller system (propeller and required components) will result in unintended travel of the propeller blades to a position below the in-flight low-pitch position. Failures of structural elements need not be considered, if the occurrence of such a failure is shown to be extremely remote under § 35.15.
3.5.1.1 A structural element is a part that is shown to fail under static or fatigue loads. Parts like the piston, cylinder, and pitch stop would most likely be considered a structural part.
3.5.1.2 A non-structural element is a part that fails by wear or jamming. Parts like o-rings and beta valves would most likely be considered a non-structural part. These parts need to have a back-up part to comply with the rule.
3-10
3.5.2 Unintended Travel.
Under § 35.15, the unintended travel of the propeller blades to a position below the inflight low-pitch position can result in a hazardous propeller effect. Therefore, structural elements that result in this failure mode are classified as critical parts. The integrity of critical parts identified in the safety analysis is managed by § 35.16. Compliance is shown by documenting only those structural elements that have been identified in the failure analysis report. The applicant does not have control over structural elements that were not included in the propeller type design.
3.5.3 Intended Travel.
The extent of any intended travel must account for backlash, tolerances, secondary stops, and in-service wear. For example, a hydraulic failure of a dual acting propeller system with pitch lock operating at the in-flight low-pitch positions may permit a small decrease in blade angle due to system backlash. The pitch lock may require a small blade angle change before it engages. This value is documented in the instructions for propeller installation and operation. To facilitate propeller system design and certification in the absence of an application specific definition, the maximum backlash should not be greater than three degrees. This prevents excessive loss of thrust or propeller overspeed. However, the final determination of the installation requirement should be evaluated during the aircraft certification process based on aircraft controllability requirements.
3.6 Section 35.22, Feathering propellers.
3.6.1 Feathering and Unfeathering Characteristics.
Propeller feathering and unfeathering characteristics and limitations may include parameters, such as feather angle, rate of pitch change, rotational speed where start locks engage or disengage, and airspeed limits above the rpm in which a propeller may not feather completely or may feather at a slower rate. Such data should be made available to aircraft TC holders, as necessary. Typically, a counterweighted propeller needs additional force from a spring or from oil pressure to feather the propeller.
A propeller windmilling at the high pitch angle provided by the counterweight would not be a feathered propeller.
3.6.2 Minimum Temperature.
An evaluation at the minimum declared outside temperature may be conducted in a cold chamber or by flight test. The applicant may use the maximum diversion time as the required time for stabilization to a steady state temperature, if a maximum diversion time has been established for the airplane installation. There is no requirement to define a minimum unfeathering rate.
3.7 Section 35.23, Propeller control system.
See AC 35.23-1 for definitions and guidance on propeller control system requirements.
3.8 Section 35.24, Strength.
3-11
3.8.1 Documentation.
Compliance with the current rule may be summarized in a report that documents the information directly or references other reports, documents, or processes that contain this information. This may include certification reports used to show compliance with other requirements, bookkeeping records, and documentation with no additional design calculations or tests. The FAA requires applicants to show that the propeller maximum stresses do not exceed acceptable values.
3.8.2 Content.
Applicants may show compliance with § 35.24 by an auditable part of the design process, provided the following information can be found in the propeller TC holders design documentation.
3.8.2.1 Design definitions, such as basic summary of the design, diameter, design power and rpm, construction description, and control system type that can reference § 35.5. Major components and drawing numbers that can reference the report used for compliance with § 35.2.
3.8.2.2 Design requirements, such as a description of the intended application, aircraft type, engine type, or other applicable design requirements.
3.8.2.3 Design loads, such as a description of the internal engineering records system that retain the key load cases used to size the design.
3.8.2.4 Stress analysis, such as a description of the internal engineering records system used to retain the key stress analysis cases to establish the design.
References to any standard design manuals or procedures used to size routine hardware, such as bolt torque and pre-load is applicable.
3.8.2.5 Tests and test results, such as strength related tests, lists of all major tests, and other reference reports used for certification, such as §§ 35.35, 35.36,
35.37, and 35.43.
3.8.2.6 Material specifications that can reference the report used for compliance with § 35.17.
3.8.2.7 Component tests and/or analyses verification that represents the type design. This references the certification test plans and reports listed under test and test results. This can also reference conformity procedures used in concert with the Manufacturing Inspection District Office.
3.8.2.8 Process review requirement for each design change process that references the engineering change process documents.
4-1 4 GUIDANCE FOR SUBPART C – TYPE SUBSTANTIATION
4.1 Section 35.33, General.
Applicants may run some tests without automatic controls or safety systems when it is impossible, or not required because of the nature of the test, as accepted by the Administrator. For example, a primary system may have to be disabled to test a backup system or a governing function may need to be disabled to test an overspeed condition.
4.2 Section 35.34, Inspection, adjustments, and repairs.
[Reserved]
4.3 Section 35.35, Centrifugal load tests.
4.3.1 Hub, Blade Retention, and Counterweight.
4.3.1.1 The maximum centrifugal load that the propeller may be subject to during load testing is based on the maximum rated rotational speed and limitations established for the propeller that is stated in the TCDS.
Overspeed limits and overspeeds that would occur at the overspeed governor setting are not considered normal and do not constitute the maximum rpm to be used for test conditions.
4.3.1.2 Applicants should test the hub, blade retention, and counterweights as an assembled component by whirl testing to twice the centrifugal load, or by applying twice the centrifugal load to simulate the centrifugal load, as appropriate.
4.3.1.3 The blade retention is that area of the blade that transmits blade centrifugal and bending loads to the hub. Included in the retention are bearing races and other associated components used for the transmission of loads to the hub.
4.3.1.4 The load test does not need to include the complete blade. Stub blades with weights applied during whirl tests can be used to establish the correct centrifugal loading. The stub blade retention must have the same blade retention so that similarities to the full blade retention are maintained.
4.3.2 Blade Features.
Blade features, such as those associated with transitions from a composite blade to a metallic retention can be tested during the hub and retention test or with a separate component test. However, other applicable configurations may exist, such as the transition associated with a configuration where the blade of any material construction is bonded, or otherwise attached, to the portion of the blade retained in the hub.
4-2
4.3.3 Propeller Components.
Propeller components that do not require twice the centrifugal load tests should be subjected to tests or analyses equal to the centrifugal load generated at 159 percent of the maximum centrifugal load the component would be subjected to during operation at the maximum rated rotational speed for a 30-minute duration. These components may also show an acceptable method of compliance by demonstrating similarity to existing components with applicable service history. Testing can involve whirl testing or static testing with the assembly or on a component or sub-component level. The component test, such as a peel test, need not be 30-minutes in duration. These supporting tests may be combined with analyses to show that the components will be acceptable for 30- minutes duration, if a full scale test were to be conducted. Analysis methods used should be acceptable to the Administrator.
4.4 Section 35.36, Bird impact.
Applicants may demonstrate compliance to § 35.36 based on design similarity and service history to existing propeller installations, bird impact testing, or analysis combined with similarity and testing. Both static and rotating tests are acceptable.
4.4.1 Critical Operating Conditions Selection.
The selection of critical operating conditions is based on an evaluation of the intended use of the propeller, the operating conditions when the propeller will most likely encounter bird populations, and the impact geometry of the propeller. Typically, this condition occurs at takeoff and landing.
4.4.2 Blade and Spinner Impact Site Selection.
Applicants should select the blade impact site that produces maximum blade retention loads. This site should show that the entire blade will not separate and, at the same time, should test for local structural integrity to show any local or tip blade damage.
The spinner impact site that produces maximum loads should be selected. The site should show that the entire spinner would not separate.
4.4.3 Bird Selection.
Natural or artificial birds may be used in bird impact testing or analysis.
4.4.4 Static or Rotating Testing.
Static or rotating testing is acceptable; the objective is to simulate a bird strike in a controlled manner to assess blade response and damage. When appropriate, include blade hub, retention, and pitch change hardware as part of the static test set-up for assessment of the effect of bird strike on these components.
4.4.5 Damage Evaluation.
Visually inspect and evaluate the blades, including composite blades, after impact testing. Typical tests and inspections to evaluate include frequency response tests, blade tap tests for delamination evaluation of composite components, ultrasonic