UNITED STATES OF AMERICA DEPARTMENT OF TRANSPORTATION FEDERAL AVIATION ADMINISTRATION RENTON, WASHINGTON 98057-3356

In the matter ofthe petition of Exemption No. 16780

Bombardier Aerospace Regulatory Docket No. FAA-2016-2750
for an exemption from§ 25.901(c) of Title 14, Code ofFederal Regulations

GRANT OF EXEMPTION By letters dated January 13, 2016, and April4, 2016, Mr. Glenn Baxter, C Series Airworthiness Manager, Bombardier Aerospace, 400 Cote-Vertu Road West, Dorval, Quebec, H4S 1Y9, Canada, petitioned the Federal Aviation Administration (FAA) for an exemption from the requirements of§ 25.901(c) ofTitle 14, Code ofFederal Regulations (14 CFR). This exemption, ifgranted, would permitrelieffrom full compliance with the regulation for Model BD-500-1A10 and BD-500-1A11 airplanes. The petitioner requests relieffrom the following regulation: Section 25.90l(c)- For each powerplant and auxiliary power unit installation, it must be established that no single failure or malfunction orprobable combination offailures will jeopardize the safe operation ofthe airplane exceptthat the failure ofstructural elements need not be considered ifthe probability ofsuch failure is extremely remote. The petitioner supports its request with the following information:
This section quotes the relevant information from the petitioner'srequest, with minor edits for clarity. The complete petition is available at the Department ofTransportation's Federal Docket Management System, on the Internet at http://regulations.gov, in DocketNo

.FAA-2016-2750. Description ofReliefSought BombardierAerospace (Bombardier) respectfullyrequests a permanent exemption from 14 CFR 25.901(c) for a certain extremely improbable throttle quadrant assembly (TQA) failure that could contribute, under specific simultaneously converging conditions, to an engine uncontrolled high thrust (UHT) event under very limited and specific takeoffandlanding scenarios on the BD-500-1A10 and BD-500-1A11 airplanes (C Series CS100 and C Series CS300, respectively). This exemption is requested for a permanent period after FAAtype validation. Due to the small (single) number offailures withinthe TQA, the limited window ofexposure, and the practicality ofredesigning the TQA (which currently meets the industry norms), Bombardierbelieves permanent relieffrom§ 25.901(c), relative to the TQA, is appropriate. Furthermore, Bombardier understands precedent exists with the FAAfor this relief, most recently with FAA Exemption No. 10614. Justification Bombardierhas shown in the position to FAAIssue PaperP-25 that the overall level of safety ofthe thrust control system ofthe C Series CS 100 and CS300 airplanes will notbe less than that ofthe current Bombardiertransport category aircraft fleet. The Bombardier fleet offull authority digital electronic control (FADEC) equipped aircraft have more than 16 million aircraft flight hours. This fleet has neverhad a TQA failure leading to a UHT event. Full compliance with§ 25.901(c) would require the introduction ofnovel design features to the BD-500-1A10 and BD-500-1A11 airplanes.
It is recognized that experience overthe past few years has demonstrated that some design solutions can safely and reliably eliminate the possibility ofa single failure or combination offailures leading to a UHT event. Bombardierhas introduced a thrust control malfunction accommodation feature into the engine electronic control to address engine failures that may lead to a UHT event and will eliminate all noncompliant, uncontrollable, high-thrust failures, except for a very specific case related to the drive train failure ofthe TQA under a high-speed rejected takeoff(RTO) operation. Introducing a more complex design into the TQA assembly with the intent ofeliminating the single failure will introduce more components to the assembly, increasing the probability offailure and being counterproductive to both Bombardier's and the FAA's goal ofcontinuous improvement in overall aircraft reliability and safety. Suchdesign changes may minimize drive train failures but would not eliminate the more likely events ofajammed control(s) due to foreign objects, both within the control and externally from items on the flight deck. Issue ofPublic Interest A thrust control system design change that would keep the aircraft controllable for all UHT single system failures would require modifications to the current TQA. Implementing this redesign would prevent Bombardierfrom certifying the C Series CS 100 and CS300 design in a timely and competitive schedule, putting it in anunfair disadvantage to its competitors and directly affecting its customers in the United States.

2Additionally, requiring the BD-500-1A10 and BD-500-1A11 models to fully comply with this rule would adversely affect United States companies involved in the design and production ofthe aircraft. Effect ofthe Exemption on Safety As stated above and as previously demonstrated to the FAAby analysis, the risks due to UHT failure conditions on the BD-500-1A10 and BD-500-1A11 aircraft will not exceed those ofthe current Bombardier transport category aircraft fleet, nor the currently known and comparable existing transport category airplanes. The conditions under which a UHT failure mayjeopardize the safe operation ofthe airplane are limited to specific conditions during takeoffand landing scenarios. The majority ofthese scenarios are addressed by the engine thrust control malfunction accommodation feature. A UHT event due to a single failure in the TQA has a very low risk per flight hour, many orders ofmagnitude less than that accepted as extremely improbable. The BombardierTQAs have never had a disconnect ofthe drive train between the control lever and the throttle position resolvers. Such a failure will be less than extremelyremote. The Bombardier assessment is that the TQA failure would only become a hazard when associated with a high speed RTO. The Bombardier assessment shows that an RTO is an independent event from the TQA failure. A high speed RTO not associated with another aircraft failure is remote (i.e., due to birds or aircraft failure to clear an active runway < 1 E-05). Additionally, in the event ofan occurrence, there is limited risk that any serious injury will result. Conclusion & Request to Extend Privilege ofExemption Outside the United States Bombardierbelieves that the above arguments favor a permanent exemption from § 25.901(c) for the TQA on the BD-500-1A10 and BD-500-1A11 (C Series 100 and C Series 300) airplanes. Additionally, Bombardierbelieves that any risks due to a UHT failure condition generated by the TQA single failure case on the subject airplanes will not exceed that ofcomparable existing transport category airplanes and that an exemption is in the public interest. Bombardierrequests that the privileges ofthis exemption would apply outside the United States due to the transoceanic capability ofthe subject airplanes and the character ofmission for many ofour operators. Federal Register publication Although the petitionerrequested that action on its petition not be delayed for publication in the Federal Register, the FAA found that the petition, ifgranted, would set a precedent. Therefore, to allow an opportunity for the public to comment onthe petition, a summary ofit was published in the Federal Register onApril 27, 2016 (81 FR 24933). No comments were received.

3The FAA's analysis Introduction
Bombardieris requesting an exemptionfrom the requirements of§ 25.901(c) as it applies to the "no single failure" provision for the throttle quadrant assembly (TQA). Bombardier acknowledges that there are single failures ofthe TQA that could result in UHT under certain conditions. They also state that the TQAs on other Bombardier airplanes are ofsimilar design methodology and have nothad a failure thatresulted in UHT. Bombardiercontends that a redesign to eliminate the TQA drive train failure would add complexity and result in a lessreliable design. Bombardierhas provided design details to the FAA demonstrating that they have taken all practical measures to eliminate single failures that could result in UHT. Those measures include provisions to minimize the potential for internal and external debris as well as eliminating all single failures withinthe TQA, except for a failure ofthe drive train gears resulting in a disconnect with the throttle and potentially causing a UHTevent.
Additional UHT Consideration
The FAArecently identified a condition in which transport airplanes could become uncontrollable during flare about 10 seconds before touchdown ifthere is a sufficiently strong crosswind in combination with a UHT failure and that this condition is endemic to the transport airplane fleet. Bombardierhas demonstrated that the Model BD-500-1A10 and BD-500-1A11 airplanes remain controllable and comply with 25.901(c) in crosswinds up to 15 knots. Since Bombardier did not include crosswinds in excess of 15 knots in their assessment and the "no single failure" requirement of25.901(c) requires applicants to consider operational and environmental factors that could intensify a failure, the FAAhas determined that this scenario should also be included in this grant ofexemption. As a result, this exemption also applies to UHT landing scenarios that when combined with crosswinds in excess of 15 knots, would jeopardize the safe operation ofthe airplane.
Public Interest and Effecton Safety According to § 11.81, Bombardiermust showthat granting this request is in the public interest and will not adversely affect safety. Ifthe FAA were to deny this petition, it would substantially delay delivery ofthese airplanes and put considerable schedule pressure onthe development and certification ofadditional design changes which would not necessarilyprove to be more reliable and would not have the service history that supports a substantially low failure rate. This would not only have adverse economic and logistical impacts for Bombardier, butwould also affect United States companies involved in the design and production ofthe airplanes. Therefore, we conclude that granting this petitionwould be in the public interest.
Bombardier acknowledges in the petitionthat the Model BD-500-1A10 and BD-500-1Al1 airplane type design currentlyproposed for certification will not fully comply with the "no single failure" provision of§ 25.901(c) as itrelates to certain UHTfailure conditions. The investigation ofa 1997 accident involving a Saudi Arabian Airlines Boeing 737-200 airplane 4determined that this type ofnon-compliance had long been endemic in the state-of-the-art engine control architectures ofmost transport category airplanes. Until recently, most type certification programs have included some sort ofexemption for UHT failure conditions. However, one of the conditions for granting each ofthose exemptions has been that the applicant takes all practicable actions to minimize the adverse effects on safety associated with granting the exemption.
The FAA has reviewed the Model BD-500-lAlO and BD-500-lAll type design and acknowledges that Bombardierhas taken all practicable actions to eliminate or further reduce the risks associated with this non-compliance. Specifically, thrust malfunction accommodation logic (i.e., logic that identifies and safely accommodates any sustained, substantial discrepancy between the actual and commanded thrust, as sensed and validated by the engine control) has been implemented for those applicable UHT scenarios. Suchthrust malfunction accommodation logic incorporated into airplane type designs has proven to be practical and effective at eliminating most noncompliant UHT failures except for those associated with the airplane throttle system (e.g., stuckthrottle or disagreementbetweenthe throttle input to the engine control and the actual throttle position).
While some recent airplane throttle system designs have managed to fully comply with § 25.901(c), this has notyet become the industry norm. The BombardierTQA design includes redundant features intended to prevent a stuckthrottle at the high powerposition. The TQA design also has robust features intended to preventthe introduction offoreign objects or debris into the TQA. Otherthan debrisjammingthe TQA, Bombardier has identified only one remaining single failure ofthe drive train gearthat could result in a UHT event. Since the conditions ofthis exemption only allow a very low overall predicted UHT occurrence rate, the FAA has usually found it is not in the public interest to require these systems be redesigned.
The conditions under which a UHT failure mayjeopardizethe safe operation ofthe airplane are limited to specific aborted takeoffor approach-and-landing scenarios. Given that these scenarios occur, there is still a low probabilitythat a serious injury will result. This limited exposure, in conjunction with the historically low occurrence rates, makes this a relatively lowrisk per flight hour. Bombardier will be required, by the conditions for granting this exemption, to demonstrate that the risks due to UHT failure conditions on any airplane certificated underthis exemption will not exceed those currently known and accepted for comparable existing transport category airplanes. Making this a condition ofthis exemption, in combination with the conditionthat all practical actions are taken to eliminate orfurther reduce that risk, means that granting this exemption should not adversely affect, and in fact should improve,the average per-flight-hour risk withinthe current transport airplane fleet.
This exemption allows a slightly greater hazard than full compliance with§ 25.901(c) but given the fact that the per-flight-hourrisks associated with this non-compliance are low and the conditions under which a UHT failure is limited to specific aborted takeoff, approach, and landing conditions and that ifthese scenarios occur, there is still a lowprobability that a serious injury will result. The limited exposure, in conjunction with the historically low occurrence rate, makes this a relatively lowrisk per flight hour. The FAA has determined that the proposed 5exemptionprovides a level ofsafety equivalentto that ofthe existing fleet ofsimilar transport airplanes. Therefore, we conclude that granting this petition would not adversely affect safety.


### TheFAA's decision
In consideration ofthe foregoing, I find that a grant ofexemption is in the public interest and will not adversely affect safety

. Therefore, pursuantto the authority contained in 49 U

.S.C. 40113 and 44701 delegated to me by the Administrator, I grant BombardierAerospace an exemption from 14 CFR 25.901(c). I grantthis exemptionto the extent necessaryto allowtype certification ofModel BD-500-1A10 and Model BD-500-1A11 airplanes without an exact showing of compliance with the "no single failure" requirement of§ 25.901(c) relatingto UHT from a single failure ofthe TQA and the previously-described landing scenarios combined with crosswinds in excess of 15 knots.
This exemption is subjectto the following conditions and limitations:
1. Forthe Model BD-500-1A10 and BD-500

-1A11 airplanes, Bombardiermust demonstrate, in accordance with an FAA-approved Airworthiness Assessment and Risk ManagementPlanthat all practicable actions have beentaken to minimize the adverse effects on safety associated with grantingthis exemption. These must include, but are not limited to, practical actions to eliminate orfurther reduce the risks by improving designs, training, procedures, and instructions for continued airworthiness (ICA).
2. Forthe Model BD-500-1A10 and BD-500-1A11 airplanes, Bombardiermust demonstrate, in accordance with an FAA-approved Airworthiness Assessment and Risk ManagementPlan, thatthe risks associated with relieving the UHT failure condition from the "no single failure" requirement of§ 25.901(c) are no greater than those currently known and accepted for comparable airplanes withinthe current transport fleet. Acceptable risk for this provision can be characterized as:

a. The airplane complies with§ 25.901(c) for any foreseeable UHTfailure conditions in flight, exceptpossibly during approach below400 feet; and
b. The expected frequency ofthe occurrence ofa UHTfailure condition is less than once per 1 0 million airplane flight hours.
3. The following "Note" will be added to the Model BD-500-1A10 and BD-500-1A11 type certificate data sheet for any airplane certificated underthis exemption:


### TheFAA has concluded thatthe occurrence ofany uncontrollable highthrustfailure condition, or any ofthe associated causal failures listed within BombardierAerospace Document[reference TBD], 

### may endangerthe safe operation ofan airplane. Consequently, the FAA recommends that

6operators be encouraged to report any such failures in accordance with Title 14, Code ofFederal Regulations 121.703(c), 125.409(c), and 135.415(c).
4. In support ofthe "Note" in condition 3 above, Bombardiermust develop the document referenced in condition 3 and obtainFAA approval priorto United States customer delivery ofthe BD-500-lAl0 and BD-500-lAll airplanes. That document will listthe failures that can contribute to or cause a UHT failure condition covered underthis exemption

. This document will ultimately be made available as part ofthe ICA. Furthermore, for any airplane certificated underthis exemption, failures ofthe type listed withinthat document must be promptlyreported to the FAA. The reporting method and report timeliness requirements should be the same as those for reporting events under 14 CFR21.3.
The granting ofthis exemption does not relieve any regulatory obligation to identify and correct unsafe conditionsrelated to UHTfailure conditions.

Issued in Renton, Washington, on 

### JUN 

## 1 02016

# ~~
Michael Kaszycki Assistant Manager, Transport Airplane Directorate Aircraft Certification Service

7