1 of 7 

Gulfstream Aerospace LP ¤ PO Box 1036 ¤ Airport City 70100 ¤ ISRAEL

Tel: +972-3-935-6624 ¤ Fax: +972-3-935-6750 

Petition for partial Exemption

Gulfstream Aerospace LP

Uncontrollable High Thrust Failure Conditions

Gulfstream Model G250

Relief from section 14 CFR Part 25.901(c)

 Section 25.901(c) requires in part that “no single failure or malfunction or probable combination of 

failures will jeopardize the safe operation of the airplane”. 

Gulfstream Aerospace LP respectfully requests a time limited partial exemption to Federal 

Aviation Regulation (FAR) Part 25.901(c) of Title 14, CFR, for certain extremely remote 

powerplant failures that could affect only a very limited portion of the flight envelope of the 

Gulfstream Model G250. 

This partial exemption requires Gulfstream Aerospace LP to demonstrate that the overall 

level of safety of the thrust control system of G250 model will not be less than that of the 

current transport category aircraft fleet. For this purpose, Gulfstream Aerospace LP 

analyzed the Uncontrollable High Engine Thrust failure rate data of the Honeywell AS907 

engine family and performed engineering-simulated flights per scenarios specified in CAAI 

/ FAA Issue Paper P-10. 

The exemption is required for a period of 4 years after FAA validation. During this period, 

GALP and Honeywell will develop and make available improved UHT logic which will 

mitigate the effects of an UHT event in some scenarios. The improvement will be certified 

as a product improvement prior to the expiration of the time frame specified above and will 

be implemented in all new production a/c manufactured after this date. It is not the 

intention of GALP to retrofit previously fielded aircraft (estimated 100 a/c) with the 

improved UHT logic. 

The nature of this petition for partial exemption is similar to previously granted exemptions 

for the Airbus models A340-500, A340-600, the Embraer models EMB-135BJ, EMB145XR, the Boeing model 757-300 and 777’s and the Gulfstream Models G150, G-1159, 

G-IV, GV and GV-SP. 

 Supportive Information: 

A committee consisting of representatives from the FAA, the JAA, airplane manufacturers, 

and engine manufacturers was formed in 1998 to study strategies for providing additional 

protection from thrust control malfunctions resulting in un-commanded high thrust. The 

committee found that for the existing in-service airplanes, whose propulsion systems have 

demonstrated a level of reliability on the order of one un-commanded high thrust event per 

10 million flight hours, it would not be in the public interest to mandate major and novel 

design changes in an attempt to eliminate the already small potential exposure to uncommanded high thrust malfunctions resulting from single failures. The committee’s 

recommended approach to ensure continued high levels of reliability for all presently 

certified models is to monitor in-service performance and, if any unacceptable failure 

modes are identified, to take prompt corrective action by introducing focused design 

improvements using proven technology. 
 

2 of 7 

Gulfstream Aerospace LP ¤ PO Box 1036 ¤ Airport City 70100 ¤ ISRAEL

Tel: +972-3-935-6624 ¤ Fax: +972-3-935-6750 

Full compliance with 14 CFR 25.901(c) would require introduction of complicated and 

novel design changes to the G250 Program, such as the Thrust Control Malfunction 

feature. It is recognized that experience with this feature over the past few years has 

demonstrated that such a feature can safely and reliably eliminate most of the causes of 

noncompliant UHT failures conditions. 

 At this time GALP is considering the right solution to incorporate this feature in the G250 

aircraft. 

 The petitioner intends to demonstrate that those combinations of failures that could 

jeopardize safe operation meet the intent of § 25.901(c) in that they are not “probable 

combinations1

.” Conversely, the petitioner does not always intend to demonstrate that 

those single failures which could jeopardize safe operation comply with § 25.901(c). 

Compliance with § 25.901(c) requires each identified single failure be assumed to occur 

under all anticipated combinations of airplane operating and environmental conditions. 

While the single failures themselves must be assumed to occur regardless of their 

probability2

, probability can be considered when determining what combinations of 

operating and environmental conditions are anticipated to occur in the fleet life of the 

airplane type. Single failures do not need to be assumed to occur under conditions that 

are in and of themselves not expected to occur. 

The engine control system for the G250 is a FADEC-based system and as such, future 

design changes to this control system should provide opportunities to significantly reduce 

or even eliminate the subject non-compliance. The conditions established by the FAA for 

granting this partial exemption, when applied to each proposed design change, are 

intended to take full advantage of each practicable opportunity for improvement while 

affording the petitioner all warranted flexibility to certificate non-compliant derivative 

designs.

 Issue of Public Interest

A control system that might eliminate all failure modes of concern for the Gulfstream 

Aerospace LP G250 Model (such as the Thrust Control Malfunction Unit), would require 

 1

 The term “probable,” as used in § 25.901(c) has a very different meaning than the same term as subsequently used in association with 

§ 25.1309(b) compliance. As used in §25.901(c), "probable" means “foreseeable”. In §25.1309(b) terms, this means the subject failure 

conditions are "anticipated to occur” (i.e. aren't "extremely improbable”). 

2

 While probability has been an acceptable means of supporting a finding that a particular "combination" of failures are not "probable", 

any single failure where the physics of the failure can be identified is typically "anticipated to occur" unless that occurrence within the 

relevant exposure can be clearly and acceptably ruled out, as is the case for those structural failures specifically excepted by the rule itself. 
 

3 of 7 

Gulfstream Aerospace LP ¤ PO Box 1036 ¤ Airport City 70100 ¤ ISRAEL

Tel: +972-3-935-6624 ¤ Fax: +972-3-935-6750 

significant modifications to the current engine control system. A redesign of previously 

approved engine control system architecture would impact the schedule of the Gulfstream 

Aerospace LP G250 Model program. 

Since this feature is still in development, requiring the G250 Model to fully comply with this 

rule would prevent Gulfstream Aerospace LP from certifying the aircraft on a timely and 

competitive schedule, putting it in an unfair disadvantage to its competitors in Europe and 

with other foreign aircraft manufacturers. This could result in economic disadvantage to 

the company, its employees and communities who are dependent upon this commerce. 

Additionally, Gulfstream Aerospace LP is a highly reputable supplier of transport aircraft 

that serve vital commercial and governmental entities throughout the world. These 

operators depend on the improved technology in new Gulfstream Aerospace LP models to 

effectively and safely meet the needs of national and international commerce, governance 

and charitable missions throughout the world. 

 Effect of the Exemption on Safety

As stated above, Gulfstream Aerospace LP will demonstrate that the risks due to 

uncontrollable high thrust failure conditions on G250 will not exceed those currently known 

and accepted for comparable existing transport category airplanes. This means that 

granting partial exemption should not adversely affect and, in fact, should improve the 

average per flight hour risk within the current transport airplane fleet. 

For those existing transport airplanes re-evaluated to date, the conditions under which an 

uncontrollable high thrust failure may jeopardize the safe operation of the airplane are 

limited to specific aborted takeoff scenarios. Given that these scenarios occur, there is still 

a low probability that any serious injury will develop. This limited exposure, in conjunction 

with the low probability of occurrence, means that an Uncontrolled High Thrust event is a 

relatively low per flight hour risk. This assessment is supported by the fact that the 1997 

Saudi Arabian Airlines Boeing 737-200 accident is the only one attributed to these types of 

failures and there were no serious injuries in that accident. 

It is the spectra of this low per-flight-hour risk accumulating indefinitely on many, if not 

most, existing and future transport airplanes that are the primary concern driving 

development of the FAA’s “Thrust Control Malfunction Airworthiness Program.” To date, 

corrective actions under 14 CFR part 39 have only been deemed warranted when the 

uncorrected risks for a particular type design were considered significantly greater than 

those required by the conditions and limitations of this petition for partial exemption. 

Gulfstream Aerosapce LP agrees to demonstrate that all practicable actions have been 

taken to minimize the adverse effect on safety associated with granting of the exemption 

from 14CFR 25.901(c) for the G250 Model aircraft. 

Furthermore, Gulfstream Aerospace LP would like to emphasize the following: 
 

4 of 7 

Gulfstream Aerospace LP ¤ PO Box 1036 ¤ Airport City 70100 ¤ ISRAEL

Tel: +972-3-935-6624 ¤ Fax: +972-3-935-6750 

 The G250 aft fuselage mounted engine design (i.e. relative close proximity to A/C 

centerline) mitigates much of the adverse yaw condition that may be generated during a 

single engine uncontrollable high thrust event on other designs. 

 The G250 incorporates a Thrust Compensator feature that compensates the thrust 

asymmetry by rudder movement. This feature is automatically actuated when thrust 

asymmetry occurs and it augments the aircraft controllability when UHT is encountered 

(as demonstrated in the engineering simulation). 

 The controllability assessment during Uncontrolled High Thrust was evaluated by 

conservative Engineering simulations and will be verified in a full Level D airplane 

simulator as soon as it is available. 

 It was found that the G250 Model complies with 14CFR 25.901(c) for any foreseeable 

uncontrollable high thrust failure conditions, except for very limited window(refer to 

Flight Simulator test report, doc number: 30P011/071452) : 

 RTO scenarios where the malfunction occurs below 50kts, as was demonstrated in 

simulation flights. This scenario is included in the request for exemption since 

the Nose Wheel Steering, which is essential for controlling the A/C on ground at 

low speeds was not available on the simulator. 

 The frequency of occurrence of uncontrollable high thrust failure condition on the G250 

was calculated to be ~2 E-8 which is less than the known average industry value of 

one per ten million airplane operating hours. 

 Thrust Control Malfunction unit is in development and will be incorporated in the G250. 

Gulfstream Aerospace LP has verified that the G250 Model exposures and failure rates 

are such that this airplane should not exceed the known average per flight-hour risks of 

comparable existing transport airplanes. Making this statement a condition of this 

exemption, in combination with the condition to minimize that risk, means that granting this 

exemption should not adversely affect and in fact, should improve the average per flight 

hour risk within the current transport airplane fleet. 

In support of this exemption and prior to customer delivery of any G250 aircraft, 

Gulfstream Aerospace LP will develop and obtain CAAI / FAA acceptance of the 

instructions for continued airworthiness. Further, the Uncontrollable High Engine Thrust 

failures shall be considered mandatory reportable to the CAAI/FAA under 14 CFR Part 

21.3, for any airplane certificated under this exemption. 

The limited exposure, in conjunction with the historically low occurrence rates throughout 

the industry, makes this a relatively low per flight hour risk. This assessment is further 

supported by the fact that the 1997 Saudi Arabian Airlines Boeing 737-200 accident is the 

only event attributed to these types of failures and there were no serious injuries in that 

accident. 
 

5 of 7 

Gulfstream Aerospace LP ¤ PO Box 1036 ¤ Airport City 70100 ¤ ISRAEL

Tel: +972-3-935-6624 ¤ Fax: +972-3-935-6750 

 Waiver of Notice and Public Procedure

Gulfstream Aerospace LP respectfully requests that, and believes that good cause exists 

why, action on this petition should not be delayed by publication and comment procedures. 

Gulfstream Aerospace LP feels this request is supported by the following reasons: 

1. The petitioner’s request does not set a precedent because the relief requested herein 

is identical to exemptions granted previously. 

2. A delay in acting on the petition caused by publication could have an adverse effect on 

Gulfstream Aerospace LP and the operators of the G250 airplanes who have made 

substantial commitments and plans for the introduction of the airplanes into the fleet to 

meet mission needs. 

 Conclusion

Gulfstream Aerospace LP believes that the above arguments favor a time limited 

exemption from 14 CFR 25.901(c) for the aft fuselage mounted installation of the 

Honeywell FADEC controlled engines onto the GULFSTREAM AEROSPACE LP G250 

aircraft. Additionally, Gulfstream Aerospace LP believes that any risks due to an 

Uncontrollable High Thrust failure condition on G250 will not exceed those currently known 

and accepted for comparable existing transport category airplanes and that an exemption 

is in the public interest. Gulfstream Aerospace LP requests that the privileges of this 

exemption would apply outside the United States due to the transoceanic capability of the 

G250 aircraft and the character of mission for many of our operators. 
 

6 of 7 

Gulfstream Aerospace LP ¤ PO Box 1036 ¤ Airport City 70100 ¤ ISRAEL

Tel: +972-3-935-6624 ¤ Fax: +972-3-935-6750 

 APPENDIX A 

 ENGINE CONTROL SYSTEM OVERVIEW. 

 The G250 is equipped with two Honeywell AS907-2 turbofan engines of 4.2 to 1 bypass ratio, enclosed by nacelles 

and mounted to pylons extending laterally outward from the aft fuselage section. 

 A throttle control assembly (TQA) is installed in the flight compartment with all controls on the pedestal accessible 

to both pilot and copilot. The engine thrust is controlled by the pilot with the throttle lever by means of Full Authority 

Digital Electronic Control (FADEC) which is electrically monitoring the thrust lever position (thrust by wire). Each of 

the engine power controls consist of a throttle lever, thrust reverser lever, AT (Autothrottle) Engage/Disengage switch, 

AT Quick Disconnect switch, and Takeoff/Go- Around switch. A single APR switch is located forward of the TQA. If 

the APR switch is selected, an engine will engage APR mode if the respective throttle lever is moved into the takeoff 

range. A RUN/STOP switch is provided to shutdown each engine. 

 G250 Engine control system –

 Uncontrolled engine overspeed safety features.

1. N2 Overspeed Shutdown 

 The N2 overspeed system protects against overspeed of both rotor systems (N1 and N2) driven 

by control system failures. These failures may include software errors and electrical malfunctions 

of the FADEC or HMU mechanical malfunctions that result in uncommanded acceleration or over 

fueling of the engine. The N2 overspeed protection system is implemented through dedicated 

circuits within the engine FADEC controller. These circuits operate independently of the CPU and 

software that control engine operation. 

 Each ECU contains two N2 overspeed detection circuits. One circuit monitors the PMA N2 signal, 

while the other monitors the gearbox mounted N2 monopole signal. When both circuits detect an 

overspeed condition (defined as N2>103 percent ±0.5 percent), the shutoff solenoid is energized. 

In addition, the run coil (used by software to enable fuel flow on start) is disabled by overspeed 

detection circuit and not the software. The shutdown coil is maintained energized and the run coil 

disabled until 35 percent speed, when the overspeed circuits unlatch. During the 

flameout/deceleration from overspeed to 35 percent, software attempts to de-power the run 

solenoid and igniters, also closing the main MV to positively latch the shutdown. Either engine 

FADEC controller can detect an overspeed condition and thus shut down the engine, even if that 

channel is not the controlling channel. The N2 overspeed system is checked on each start and 

each shutdown.

2. Broken Low Pressure Shaft (N1) Overspeed Shutdown 

 The N1 broken shaft system provides protection against LPT overspeed driven by LPT shaft 

breakage. In order to obtain the rapid response needed for this function, the system is 

implemented through dedicated circuits within the ECU, and independent of the CPU. Note that N1 

overspeed protection is implemented via the N2 overspeed protection system. A power turbine 

position detector, mounted behind the final 

 LPT stage, senses LPT position and signals the N1 OSSO circuit, if LPT position shifts rearward 

enough to indicate a severed LPT shaft. The N1 OSSO circuit then initiates an engine shutdown 

using the same OSSOV as the N2 OSSO system. The power turbine position detector is a device 

that breaks an electrical link, or circuit, to indicate rearward motion of the LPT. Redundant wiring to 

the link ensures that open circuit failures of connectors or harnesses do not result in false broken 

shaft detection. Each engine FADEC contains two identical but independent N1 OSSO detection 

circuits that monitor the link. A broken shaft is detected when both N1 OSSO detection circuits 

simultaneously detect a broken link with continuity on all other detector lines continuously for 1.0 to 

1.5 milliseconds. When a broken shaft is detected, the circuit energizes the overspeed shutoff coil. 
 

7 of 7 

Gulfstream Aerospace LP ¤ PO Box 1036 ¤ Airport City 70100 ¤ ISRAEL

Tel: +972-3-935-6624 ¤ Fax: +972-3-935-6750 

The circuitry simultaneously shorts out the run coil to remove this opposing force. FADEC ensures 

that the coil voltage collapses quickly to remove any opposing force. 

 Within a few hundred milliseconds of the detected event, software also initiates a normal 

shutdown, disabling ignition, deenergizing the run coil, and closing the MV latching in the 

shutdown. The event is stored in NVM, and software will not allow another engine start until proper 

maintenance action is taken. 

 The N1 broken shaft protection system is checked on each startup and shutdown.