European Aviation Safety Agency
Notice of Proposed Amendment 2017-18
Unintended or inappropriate rudder usage — rudder
reversals
RMT.0397
EXECUTIVE SUMMARY
The objective of this Notice of Proposed Amendment (NPA) is to mitigate the safety risk stemming from pilots of large
aeroplanes applying inappropriate rudder control inputs, in particular pedal reversals, which may create structural loads
that exceed limit loads or even ultimate loads. This may lead to the failure of primary structure and/or flight controls and
then to a catastrophic loss of control of the aeroplane.
This NPA proposes to amend CS-25 to:
— create a new CS 25.353 yaw manoeuvre condition, consisting of a two pedal doublet manoeuvre, and related
AMC 25.353, and
— clarify CS 25.1583(a)(3) regarding manoeuvring speed limitation statements in the aeroplane flight manual, amend
the related AMC 25.1581 and create a new AMC 25.1507.
The proposed changes are expected to ensure that large aeroplanes are designed with features protecting the structure
against rudder control pedal reversals like the ones demonstrated in several reported occurrences. This proposal would
thus ensure an increased level of safety, while creating little or no economic impact in most of the cases.
Action area: Loss of control in flight
Affected rules: CS-25
Affected stakeholders: Large aeroplane design organisations
Driver: Safety Rulemaking group: No
Impact assessment: Light Rulemaking Procedure: Standard
30.5.2017 27.11.2017 20XX/QX
TE.RPRO.00034-006 © European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 1 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
Table of contents
Table of contents
1. About this NPA ..................................................................................................................................... 3
1.1. How this NPA was developed ...................................................................................................................3
1.2. How to comment on this NPA...................................................................................................................3
1.3. The next steps ...........................................................................................................................................3
2. In summary — why and what ............................................................................................................... 4
2.1. Why we need to change the rules — issue/rationale...............................................................................4
2.2. What we want to achieve — objectives ...................................................................................................5
2.3. How we want to achieve it — overview of the proposals ........................................................................5
2.4. What are the expected benefits and drawbacks of the proposals ...........................................................5
3. Proposed amendments and rationale in detail ...................................................................................... 6
3.1. Draft certification specifications and acceptable means of compliance (Draft EASA decision) ...............6
4. Impact assessment (IA) ....................................................................................................................... 11
4.1. What is the issue .....................................................................................................................................11
4.2. What we want to achieve — objectives .................................................................................................16
4.3. How it could be achieved — options ......................................................................................................16
4.4. What are the impacts..............................................................................................................................17
4.5. Conclusion ...............................................................................................................................................21
4.6. Monitoring and evaluation .....................................................................................................................23
5. Proposed actions to support implementation...................................................................................... 24
6. References ......................................................................................................................................... 25
6.1. Related regulations .................................................................................................................................25
6.2. Affected decisions ...................................................................................................................................25
6.3. Other reference documents ...................................................................................................................25
7. Appendix ........................................................................................................................................... 26
TE.RPRO.00034-006 © European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 2 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
1. About this NPA
1. About this NPA
1.1. How this NPA was developed
The European Aviation Safety Agency (EASA) developed this NPA in line with Regulation (EC)
No 216/20081 (hereinafter referred to as the ‘Basic Regulation’) and the Rulemaking Procedure2. This
rulemaking activity is included in the EASA 5-year Rulemaking Programme3 under rulemaking task
RMT.0397. The text of this NPA has been developed by EASA. It is hereby submitted to all interested
parties4 for consultation.
1.2. How to comment on this NPA
Please submit your comments using the automated Comment-Response Tool (CRT) available at
http://hub.easa.europa.eu/crt/5.
The deadline for submission of comments is 27 February 2018.
1.3. The next steps
Following the closing of the public commenting period, EASA will review all comments.
Based on the comments received, EASA will develop a decision amending the certification
specifications (CSs) and acceptable means of compliance (AMC) for large aeroplanes (CS-25).
The comments received and the EASA responses will be reflected in a comment-response document
(CRD). The CRD will be annexed to the decision.
1
Regulation (EC) No 216/2008 of the European Parliament and of the Council of 20 February 2008 on common rules in the field of civil aviation and
establishing a European Aviation Safety Agency, and repealing Council Directive 91/670/EEC, Regulation (EC) No 1592/2002 and Directive
2004/36/EC (OJ L 79, 19.3.2008, p. 1) (http://eur-lex.europa.eu/legal-content/EN/ TXT/?qid= 1467719701894&uri=CELEX:32008R0216).
2
EASA is bound to follow a structured rulemaking process as required by Article 52(1) of Regulation (EC) No 216/2008. Such a process has been
adopted by the EASA Management Board (MB) and is referred to as the ‘Rulemaking Procedure’. See MB Decision No 18-2015 of 15 December 2015
replacing Decision 01/2012 concerning the procedure to be applied by EASA for the issuing of opinions, certification specifications and guidance
material (http://www.easa.europa.eu/the-agency/management-board/decisions/easa-mb-decision-18-2015-rulemaking-procedure).
3
http://easa.europa.eu/rulemaking/annual-programme-and-planning.php
4
In accordance with Article 52 of Regulation (EC) No 216/2008 and Articles 6(3) and 7) of the Rulemaking Procedure.
5
In case of technical problems, please contact the CRT webmaster (
[email protected]).
TE.RPRO.00034-006 © European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 3 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
2. In summary — why and what
2. In summary — why and what
2.1. Why we need to change the rules — issue/rationale
Loss of control usually occurs because the aircraft enters a flight regime which is outside its normal
envelope. Prevention of loss of control is a strategic priority of EASA.
64 % of fatal accidents in the last 10 years (in EASA Member States) involved loss of control. Events
such as a deviation from the flight path, abnormal airspeed or the triggering of stall protection, when
not dealt with properly, can lead to fatal consequences involving many fatalities. Technical failures as
well as ground handling safety issues can also be a precursor of this type of scenario.
Service experience and occurrence investigations show that, regardless of training, some pilots make
inadvertent and erroneous rudder inputs. Some pilots might also have misunderstood what the
manoeuvring speed is and the extent of structural protection that exists when an aeroplane is
operated at speeds below its manoeuvring speed.
Applying inappropriate rudder control inputs, in particular pedal reversals, may create structural loads
that exceed the limit loads or even the ultimate loads. The worst-case scenario is the failure of part of
the primary structure and/or the flight controls, which can lead to a catastrophic loss of control of the
aircraft.
The following accident, and the related safety recommendations, are considered in this RMT: on
12 November 2001, an Airbus A300–600 crashed at Belle Harbor (New York, USA) on climb-out,
resulting in 265 fatalities and an aeroplane hull loss. The National Transportation Safety Board (NTSB)
found6 that the probable cause of this accident was the in-flight separation of the vertical stabilizer as a
result of the loads beyond ultimate design that were created by the first officer’s unnecessary and
excessive rudder pedal inputs. Contributing to these rudder pedal inputs were characteristics of the
Airbus A300–600 rudder system design and elements of the American Airlines Advanced Aircraft
Manoeuvring Program.
In August 2010, the NTSB issued the following safety recommendation to EASA (ref. UNST-2010-119):
The National Transportation Safety Board recommends that the European Aviation Safety Agency
modify European Aviation Safety Agency Certification Specifications for Large Aeroplanes CS-25 to
ensure safe handling qualities in the yaw axis throughout the flight envelope, including limits for
rudder pedal sensitivity. (A-10-119).
Furthermore, the NTSB found that many pilots of transport category aeroplanes mistakenly believe
that, as long as the aeroplane’s speed is below the manoeuvring speed, they can make any control
input they desire without risking structural damage to the aeroplane. As a result, the NTSB
recommended in their final report that the United States Federal Aviation Administration (FAA) should
amend all relevant regulatory and advisory material to clarify that operating at or below manoeuvring
speed does not provide structural protection against multiple full control inputs in one axis or full
control inputs in more than one axis at the same time (recommendation ref. A-04-60).
Other incidents have occurred that involved inappropriate rudder control pedal inputs, including
reversals. These occurrences are taken into account in this NPA, although no safety recommendation
was addressed to EASA. Please refer to Section 4.1.1 for more information.
6
Refer to NTSB Aircraft Accident Report NTSB/AAR-04/04, adopted on 26 October 2004.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 4 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
2. In summary — why and what
For a more detailed analysis of the issues addressed by this NPA, please refer to the regulatory impact
assessment (RIA), Section 4.1.
2.2. What we want to achieve — objectives
The overall objectives of the EASA system are defined in Article 2 of the Basic Regulation. This proposal
will contribute to the achievement of the overall objectives by addressing the issues outlined in
Section 2.1.
The specific objectives of this proposal are to:
— mitigate, through design-related measures, the safety risk created by unintended or
inappropriate rudder pedal usage by pilots of large aeroplanes, in particular multiple rudder
pedal reversals, which can lead to overstress and failure of primary structure and/or flight
controls, and, consequently, loss of control of the aeroplane; and
— clarify the specification for provisions to be included in the aeroplane flight manual (AFM) to
alert the flight crew to the risk from rapid and large alternating control inputs in relation with
the manoeuvring speed. In addition, clarify that applicants should use the minimum (low
weight) manoeuvring speed.
2.3. How we want to achieve it — overview of the proposals
It is proposed to amend CS-25 to:
— create a new CS 25.353 yaw manoeuvre condition, consisting of a two-pedal doublet manoeuvre,
and related AMC 25.353; and
— clarify CS 25.1583(a)(3) regarding manoeuvring speed limitation statements in the AFM, amend
the related AMC 25.1581 and create a new AMC 25.1507.
2.4. What are the expected benefits and drawbacks of the proposals
The expected benefits and drawbacks of the proposal are summarised below. For the full impact
assessment of alternative options, please refer to Chapter 4.
The proposed new CS 25.353 specification for a yaw manoeuvre condition consisting of a two-pedal
doublet manoeuvre will ensure that large aeroplanes are designed with features protecting the
structure against rudder control pedal reversals like the ones in the reported occurrences. This
proposal would thus ensure an increased level of safety, while creating little or no economic impact in
most of the cases. For some aeroplanes, mainly the ones designed with a manual flight control system
(FCS), the economic impact may be higher than for the ones with a fly-by-wire FCS or a
hydromechanical FCS. However, the current trend in designs is to move away from mechanical
systems and towards electronic control systems; EASA estimates that the economic impact would
remain reasonable and acceptable to the manufacturer when a new design is developed. Furthermore,
several existing designs are already able to comply with the new specification.
The amendment of CS 25.1583(a)(3) will ensure that AFMs adequately warn flight crews on the risk
stemming from rapid and large alternating control inputs in relation with the manoeuvring speed, thus
decreasing the risk of inappropriate flight control system inputs, including rudder pedal inputs; no
economic impact would be induced by this specification. It also removes an existing inconsistency
which can create confusion between the ‘manoeuvring speed’ and the ‘design manoeuvring speed VA’.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 5 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
3. Proposed amendments and rationale in detail
3. Proposed amendments and rationale in detail
The text of the amendment is arranged to show deleted text, new or amended text as shown below:
— deleted text is struck through;
— new or amended text is highlighted in grey;
— an ellipsis ‘[…]’ indicates that the rest of the text is unchanged.
3.1. Draft certification specifications and acceptable means of compliance (Draft EASA decision)
Description
It is proposed to amend CS-25 as follows:
— create a new CS 25.353 yaw manoeuvre condition, consisting of a two-pedal doublet
manoeuvre, which is based on the text of the EASA Special Condition (SC) on Rudder Control
Reversal Load Conditions (refer to 4.1.1.3), itself prepared based on the FCHWG report
(attachment B of the report, Version 2 – Two Doublet Condition);
— create a new AMC 25.353, which is based on the proposed new AMC that was published by EASA
together with the SC mentioned above, itself based on the FCHWG report (attachment C of the
report, Version 2 – Two Doublet Condition);
— amend CS 25.1583(a)(3) by aligning it with the current FAA FAR 25.1583(a)(3) rule (Amendment
No. 25-130);
— amend the related text of AMC 25.1581 to align it with the new CS 25.1583(a)(3) text; and
— create a new AMC 25.1507 to clarify that applicants should determine the minimum (low
weight) manoeuvring speed, which is then indicated in the AFM per CS 25.1583(a)(3).
Proposed amendments
1. CS 25.353 is created as follows:
CS 25.353 Rudder control reversal load conditions
(See AMC 25.353)
The aeroplane must be designed for loads, considered as ultimate, resulting from the yaw manoeuvre
conditions specified in the following sub-paragraphs (a) through (e) from the highest airspeed for
which it is possible to achieve maximum rudder deflection at zero sideslip or VMC, whichever is greater,
to VC/MC. These conditions are to be considered with the landing gear retracted and speed brakes (or
spoilers when used as speed brakes) retracted. Flaps (or flaperons or any other aerodynamic devices
when used as flaps) and slats-extended configurations are also to be considered if they are used in
en-route conditions. Unbalanced aerodynamic moments about the centre of gravity must be reacted in
a rational or conservative manner considering the aeroplane inertia forces. In computing the loads on
the aeroplane, the yawing velocity may be assumed to be zero.
(a) With the aeroplane in un-accelerated flight at zero yaw, it is assumed that the cockpit rudder
control is displaced as specified in CS 25.351(a) and (b), with the exception that only 890 N (200 lbf)
needs to be applied.
(b) With the aeroplane yawed to the overswing sideslip angle, it is assumed that the cockpit rudder
control is suddenly displaced in the opposite direction to achieve the resulting rudder deflection, as
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 6 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
3. Proposed amendments and rationale in detail
limited by the control system or control surface stops, and as limited by the pilot force of 890 N (200
lbf).
(c) With the aeroplane yawed to the opposite overswing sideslip angle, it is assumed that the cockpit
rudder control is suddenly displaced in the opposite direction to achieve the resulting rudder
deflection, as limited by the control system or control surface stops, and as limited by the pilot force of
890 N (200 lbf).
(d) With the aeroplane yawed to the subsequent overswing sideslip angle, it is assumed that the
cockpit rudder control is suddenly displaced in the opposite direction to achieve the resulting rudder
deflection, as limited by the control system or control surface stops, and as limited by the pilot force of
890 N (200 lbf).
(e) With the aeroplane yawed to the opposite overswing sideslip angle, it is assumed that the cockpit
rudder control is suddenly returned to neutral.
2. AMC 25.353 is created as follows:
AMC 25.353
Rudder control reversal load conditions
1. Purpose.
This AMC describes acceptable means of compliance with the specifications of CS 25.353. These
specifications provide structural design load conditions that apply to the airframe, and that occur as a
result of multiple rudder pedal inputs.
2. Related CS-25 specifications.
a. CS 25.351, Yaw manoeuvre conditions.
b. CS 25.353, Rudder control reversal load conditions.
3. Background.
a. Specifications. CS 25.351 and CS 25.353 specify structural design load conditions that occur as a
result of rudder pedal inputs. These conditions are intended to encompass all of the rudder manoeuvre
loads expected to occur in service.
b. Yaw manoeuvre conditions. The design load conditions specified in CS 25.351 are considered limit
load conditions, and a safety factor of 1.5 is applied to obtain the ultimate loads.
c. Rudder control reversal load conditions. The design load conditions specified in this CS 25.353 are
more severe than those in CS 25.351 and include rudder control reversals. These conditions are
anticipated to occur very rarely, and therefore these are considered ultimate load conditions, and no
additional safety factor is applied.
d. Overswing sideslip angle definition: the maximum (peak) sideslip angle reached by the aeroplane
with the cockpit rudder control displaced as specified in paragraph 4.b below.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 7 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
3. Proposed amendments and rationale in detail
4. Application of the specifications.
a. General
(1) The aeroplane must be designed for the rudder control reversal load conditions specified in
CS 25.353. These are considered ultimate load conditions and, therefore, no additional factor of safety
is applied. However, any permanent deformation resulting from these ultimate load conditions must
not prevent continued safe flight and landing.
(2) Design loads must be determined as specified in CS 25.321. The load conditions are considered
from the maximum airspeed for which it is possible to achieve full rudder deflection at zero sideslip or
VMC, whichever is greater, to VC/MC. A pilot force of 890 N (200 lbf) is assumed to be applied for all
conditions. These conditions are to be considered with the landing gear retracted and speed brakes (or
spoilers when used as speed brakes) retracted.
Flaps (or flaperons or any other aerodynamic devices when used as flaps) and slats-extended
configurations are also to be considered if they are used in en-route conditions.
(3) System effects. System effects should be taken into account in the evaluation of this manoeuvre.
For example, fly-by-wire aeroplanes should be analysed assuming that the aeroplane is in the normal
control law mode. Any system function used to demonstrate compliance with these requirements
should meet the following criteria:
(i) The system is normally operative during flight in accordance with the aeroplane flight manual
procedures, although limited dispatch with the system inoperative could be allowed under
applicable master minimum equipment list (MMEL) provisions, provided that the MMEL
requirements are still complied with, taking into account the rudder reversal pedal inputs as the
next critical event under dispatch configuration; and
(ii) Appropriate crew procedures should be provided in the event of loss of function. If loss of
system function would not be detected by the crew, the probability of loss of function (failure
rate multiplied by maximum exposure period) should be less than 1/1000.
(4) Failure conditions. Due to the very low probability of a full rudder pedal doublet event, failure
scenarios do not need to be addressed in combination with the rudder control reversal load conditions
specified in CS 25.353.
b. CS 25.353 specifications (a) through (e)
(1) Specifications (a) through (e) of CS 25.353 are intended as a full displacement pedal input followed
by three pedal reversals and return to neutral. The aeroplane airspeed should be kept reasonably
constant throughout the manoeuvre using pitch control. Refer to the illustration by Figure 1 below.
(2) With the aeroplane in un-accelerated flight at zero yaw, it is assumed that the cockpit rudder
control is suddenly displaced to achieve the resulting rudder deflection, as limited by the control
system, control stops or pilot force of 890 N (200 lbf). In this context, ‘suddenly’ means as fast as
possible within human and system limitations. In the absence of a rational analysis, initial pedal
displacement is achieved in no more than 0.2 seconds, and full rudder control reversal displacement is
achieved in 0.4 seconds. Alternatively, the applicant may assume the rudder pedal is displaced
instantaneously.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 8 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
3. Proposed amendments and rationale in detail
(3) The resulting rudder displacement should take into account additional displacement caused by
sideslip build-up, and the effects of flexibility should be considered when relevant.
(4) As soon as the maximum overswing yaw angle is achieved, full opposite rudder pedal input is
applied. The achieved rudder deflection may be limited by control laws, system architecture, or air
loads, and may not be the same magnitude as the initial rudder deflection prior to the pedal reversal.
For critically damped aeroplane response, the maximum overswing yaw angle may be assumed to
occur when the sideslip angle is substantially stabilised.
(5) Two additional reversals are performed as defined in (4). After the second reversal, as soon as the
aeroplane yaws to the opposite overswing yaw angle, the cockpit rudder control is suddenly returned
to neutral.
Rudder pedal reversal
initiation at max
overswing sideslip angle
Rudder
t < 0.2 seconds First, second and third
pedal input rudder pedal reversal
1 2 3
Time
Rudder pedal Rudder pedal
doublet 1 doublet 2
Figure 1: Illustration of the rudder pedal inputs
3. CS 25.1583(a)(3) is amended as follows:
CS 25.1583 Operating limitations
(See AMC 25.1583)
(a) Airspeed limitations. The following airspeed limitations and any other airspeed limitations necessary
for safe operation must be furnished.
(…)
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 9 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
3. Proposed amendments and rationale in detail
(3) The manoeuvring speed VA established under CS 25.1507 and a statement statements, as
applicable to the particular design, explaining that:
(i) fFull application of rudder and aileron pitch, roll, or yaw controls, as well as
manoeuvres that involve angles of attack near the stall, should be confined to speeds
below this value the manoeuvring speed; and
(ii) Rapid and large alternating control inputs, especially in combination with large
changes in pitch, roll, or yaw, and full control inputs in more than one axis at the same
time, should be avoided as they may result in structural failures at any speed, including
below the manoeuvring speed.
4. AMC 25.1581 is amended as follows:
AMC 25.1581
Aeroplane Flight Manual
(…)
6 AEROPLANE FLIGHT MANUAL CONTENTS
(…)
b. Limitations Section
(…)
(7) Airspeed and Mach Number Limitations.
(…)
(ii) Manoeuvring speed, VA, together with a statement that full application of longitudinal, directional
and lateral flight controls, as well as manoeuvres that involve angles-of-attack near the stall, should be
confined to speeds below this value.
(ii) Manoeuvring speed (established under CS 25.1507) together with statements, as applicable to the
particular design, explaining that:
(a) Full application of pitch, roll, or yaw controls should be confined to speeds below the
manoeuvring speed; and
(b) Rapid and large alternating control inputs, especially in combination with large changes in
pitch, roll, or yaw, and full control inputs in more than one axis at the same time, should be
avoided as they may result in structural failures at any speed, including below the
manoeuvring speed.
5. AMC 25.1507 is created as follows:
AMC 25.1507
Manoeuvring speed
For pitch manoeuvres performed below the manoeuvring speed, exceedance of the design manoeuvre
load factor may be prevented by the maximum (static) lift coefficient (stall). However, this may not
always be the case, for example if the manoeuvring speed is not established based on the intersection
of the (static) stall curve and the manoeuvre load factor line, or if the lowest aeroplane weight
permissible in flight is not considered.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 10 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
4. Impact assessment (IA)
4.1. What is the issue
As explained in Section 2.1, service experience and occurrence investigations show that, regardless of
training, some pilots make inadvertent and erroneous rudder inputs. Furthermore, some pilots might
also have misunderstood what the manoeuvring speed is and the extent of structural protection that
exists when an aeroplane is operated at speeds below its manoeuvring speed.
Applying inappropriate rudder control inputs, in particular pedal reversals, may create structural loads
that exceed the limit loads or even the ultimate loads. The worst-case scenario is the failure of primary
structure and/or flight controls, which can lead to a catastrophic loss of control of the aircraft. Many
fatal accidents involve loss of control and it is considered to be a strategic priority in the European Plan
for Aviation Safety7 (EPAS).
4.1.1. Rudder pedal reversals input
4.1.1.1 Safety risk assessment
Occurrences
The following occurrences illustrate the issue and the safety risk:
— On 12 November 2001, an Airbus A300–600 operated as American Airlines Flight 587 crashed at
Belle Harbor (New York, USA) on climb-out resulting in 265 fatalities and an aeroplane hull loss.
The National Transportation Safety Board (NTSB)8 found that the probable cause of this accident
was the in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate
design that were created by the first officer’s unnecessary and excessive rudder pedal inputs.
Contributing to these rudder pedal inputs were characteristics of the Airbus A300–600 rudder
system design and elements of the American Airlines Advanced Aircraft Manoeuvring Program.’
In August 2010, the NTSB issued the following safety recommendation (EASA ref. UNST-2010-
119): The National Transportation Safety Board recommends that the European Aviation Safety
Agency modify European Aviation Safety Agency Certification Specifications for Large Aeroplanes
CS-25 to ensure safe handling qualities in the yaw axis throughout the flight envelope, including
limits for rudder pedal sensitivity. (A-10-119).
— In two previous events, commonly known as the Miami Flight 903 event (May 1997)9 and the
Interflug flight event (February 1991)10 (both events are presented in the AA587 report), the
pilot commanded pedal reversals caused loads on the A300–600/A310 fins exceeding their
certification ultimate load level. Both aeroplanes were designed with greater structural strength
than required by the current certification standards, and, therefore, there were no catastrophic
consequences.
— On 27 May 2005, a de Havilland DHC–8–100 (Dash 8) aeroplane (registration C–GZKH, serial
number 117) departed from St. John’s to Deer Lake, Newfoundland, Canada, with 36 passengers
7
https://www.easa.europa.eu/system/files/dfu/EPAS_2017-2021.pdf
8
Refer to NTSB Aircraft Accident Report NTSB/AAR-04/04, adopted on 26 October 2004.
9
Airbus A300-600, registered N90070, operated by American Airlines, flight 903 dated 12 May 1997, which experienced an in-flight loss of control
near West Palm Beach, Florida.
10
Airbus A310 operated by the German airline Interflug, 11 February 1991, which experienced an in-flight loss of control during a missed approach at
Sheremetyevo Airport in Moscow, Russia.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 11 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
and 3 crewmembers on board. During the climb-out from St. John’s, the indicated airspeed
gradually decreased to the point that the aeroplane entered an aerodynamic stall. The aeroplane
descended rapidly, out of control, losing 4,200 feet before the aircraft was recovered
approximately 40 seconds later. The incident occurred in instrument meteorological conditions
during daylight hours. There were no injuries and the aeroplane was not damaged. During this
event, the pilot commanded a pedal reversal.
— In January 2008, an Air Canada Airbus A319-114 (registration C-GBHZ), operating as flight
ACA190, was en-route from Victoria International Airport, British Columbia, to Toronto Lester B.
Pearson International Airport, Ontario, when it encountered a wake vortex. The pilot responded
with several pedal reversals. Analyses show that this caused a fin load exceeding the limit load
by approximately 29 %. The pilot eventually stabilised the aeroplane and landed safely.
The current yaw manoeuvre specifications in CS-25 (i.e. CS 25.351) address large rudder pedal inputs
at airspeeds up to the design dive airspeed (VD). This ensures safe structural aeroplane characteristics
throughout the flight envelope from single full rudder pedal inputs. However, the standard does not
address the loads imposed by rudder pedal reversals. Additionally, other CS-25 specifications
(CS 25.671) require that ‘each control and control system operate with ease, smoothness, and
positiveness appropriate to its function’. However, these specifications do not address specific control
system parameters such as inceptor travel, breakout force, or force gradient.
4.1.1.2 Third-country actions on this issue
Like CS-25, FAR Part-25 and ICAO Annex 8 do not have provisions addressing the whole safety risk
described above, i.e. protection against inappropriate multiple rudder pedal inputs.
The FAA
The FAA is, in part, addressing this condition for new designs by requiring under Part-25, §25.60111
that applicants for new type certificates show that their design is capable of continued safe flight and
landing after experiencing rudder pedal reversals. For fly-by-wire architectures, the applicants have
been able to show compliance with this requirement by using appropriate rudder control laws. These
control laws have been incorporated through software and, therefore, add no weight or maintenance
cost to the aeroplanes. However, such designs might only be capable of a limited number of pedal
reversals prior to exceeding airframe ultimate loads.
On 28 March 2011, the FAA published a notice of a new task assignment for the Aviation Rulemaking
Advisory Committee (ARAC) to consider whether changes to Part-25 are necessary to address rudder
pedal sensitivity and rudder reversals12. The task has been conducted by the Flight Controls
Harmonization Working Group (FCHWG).
EASA participated in the FCHWG group. The ARAC report was finalised in November 2013, and
approved by ARAC on 19 December 201313.
The majority of the FCHWG members believed that a rule change is needed, but they were not in
agreement on what it should require. Only one FCHWG member (Boeing) believed that no change to
11
Part-25, Section 25.601 General (identical to CS 25.601): ‘The aeroplane may not have design features or details that experience has shown to be
hazardous or unreliable. The suitability of each questionable design detail and part must be established by tests.’
12
The ARAC notice is available on the FAA Website using the following link: http://www.gpo.gov/fdsys/pkg/FR-2011-03-28/pdf/2011-7180.pdf
13
The ARAC report is available on the FAA Website using the following link: https://www.faa.gov/regulations_policies/rulemaking/committees/
documents/media/TAEfch-rpsrr-3282011.pdf
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 12 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
the subpart C manoeuvre load requirements is necessary; however, it should be noted that Boeing
implemented design protection means on their recent certification projects to protect against loads
induced by rudder pedal reversals. Finally, the FCHWG recommended to the FAA that a new
FAR Part-25 rule be adopted (25.353), together with a corresponding advisory circular (AC). These are
shown in Attachment B (the rule) and Attachment C (the AC) of the FCHWG report.
The FCHWG proposed new rule (25.353) includes a yaw manoeuvre condition that would be required
in addition to the current yaw manoeuvre condition specified in 25.351. The rule would add an
ultimate load design requirement that would consist of either a single pedal doublet manoeuvre, or a
two pedal doublet manoeuvre. Five members (Airbus, Bombardier, Cessna, Dassault, Embraer) were in
favour of the single doublet condition, and five (ALPA, ANAC, EASA, FAA, Transport Canada) were in
favour of the two doublet condition. This manoeuvre would be defined as either a full displacement
input, followed by one reversal and return to neutral (single doublet condition); or a full displacement
input, followed by three reversals and return to neutral (two doublet condition).
Furthermore, the FCHWG made the following recommendations:
— enhanced Flight Crew Training: the FCHWG recommended that more comprehensive pilot
training be required regarding pilot use of rudder on transport category aeroplanes;
— for existing transport aeroplanes, the FCHWG believes that retrofit should be considered on a
case-by-case basis and that if any potentially unsafe conditions are found, they should be
addressed using airworthiness directives. (Note: the FCHWG reviewed several aeroplanes as part
of the FCHWG deliberations. None were found to have an unsafe condition.)
4.1.1.3 EASA’s actions on this issue
Airworthiness Directives
Further to the occurrences mentioned in 4.1.1 above, Airbus developed modifications on the types
involved:
— Airbus A310/A300-600: a design change involving the installation of a ‘Stop Rudder Input’
Warning (SRIW) system, that monitors rudder inputs and triggers aural and visual warnings as
soon as one dangerous rudder doublet is detected;
— Airbus A318/319/320/321: a modification within the flight augmentation computer (FAC) to
reduce the vertical tailplane stress and to activate a conditional Stop Rudder Input Warning
within the flight warning computer (FWC) to further protect against pilot-induced rudder
doublets.
In accordance with Part-2114, point 21.A.3B, EASA issued Airworthiness Directives to mandate these
modifications on all in-service aeroplanes of these types15.
14
Annex I to Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down implementing rules for the airworthiness and environmental
certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations (OJ L 224,
21.8.2012, p.1-85) (http://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1473415871666&uri= CELEX:32012R0748)
15
For A310/A300-600: refer to AD 2012-0088 dated 25 June 2012, superseded by AD 2015-0174 dated 24 August 2015. For A318/319/320/321: refer
to AD 2014-0217 dated 26 September 2014, superseded by AD 2016-0132 dated 5 July 2016.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 13 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
Investigation of other designs
EASA will investigate the in-service experience of other aeroplanes inside and outside the European
Union (EU) to determine any indication of a potential unsafe condition, with regard rudder pedal
reversals.
EASA Special Condition
In December 2015, EASA published a Special Condition (SC) on ‘Rudder Control Reversal Load
Conditions’16. The SC, applicable to large aeroplanes, was prepared based on the ARAC
recommendations and is intended to ensure that aeroplanes are design tolerant to two rudder pedal
doublets. In addition to the SC consultation, EASA also provided new AMC for the information of
stakeholders.
During the public consultation, EASA received only a few comments. Boeing proposed a text
improvement, but did not oppose to the proposed rule. Embraer and Boeing recommended to use a
single doublet condition, instead of the double doublet condition. In the end, EASA retained the same
position like in the FCHWG.
4.1.2. Manoeuvring speed limitation
4.1.2.1 Safety risk assessment
The NTSB investigation of the accident to the Airbus A300–600 in Belle Harbor on 12 November 2001
concluded that pilots might have misunderstood what the manoeuvring speed is and the extent of
structural protection that exists when an aeroplane is operated at speeds below its manoeuvring
speed.
The manoeuvring speed is defined in CS 25.1507 as an operational speed which must not exceed the
design manoeuvring speed VA determined under CS 25.335 (c). VA is a structural design airspeed used
in determining the strength requirements for the aeroplane and its control surfaces. The structural
design requirements do not cover multiple control inputs in one axis or control inputs in more than
one axis at a time at any speed, even below VA.
Note: there is an inconsistency in the current CS 25.1583(a)(3), which refers to ‘manoeuvring speed
VA’. This terminology was probably introduced in the past because, in practice, the manoeuvring
speed has been identified as VA in AFMs, even though it is not always exactly the same as the design
manoeuvring speed defined in CS.25.335(c). This consistency will be removed in the proposed
amendment of this NPA.
The NTSB found that many pilots of transport category aeroplanes mistakenly believe that as long as
the aeroplane’s speed is below the manoeuvring speed, they can make any control input they desire
without risking structural damage to the aeroplane. As a result, the NTSB recommended that the FAA
should amend all relevant regulatory and advisory material to clarify that operating at or below the
manoeuvring speed does not provide structural protection against multiple full control inputs in one
axis or full control inputs in more than one axis at the same time.
16
The EASA Special Condition is available on the EASA website using the following link: https://www.easa.europa.eu/document-library/product-
certification-consultations/proposed-special-condition-c-xx
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 14 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
4.1.2.2 Third-country actions on this issue
The FAA agreed with the safety recommendation and amended FAR Part-25, §25.1583(a)(3) in August
2010. The final rule17 adopted clarifying changes to certain statements that must be furnished in each
AFM identifying the types of control inputs to avoid because they may result in structural failure. It
also removed an inconsistency concerning the reference to ‘manoeuvring speed VA’ in §25.1583(a)(3).
Sections 1.2 and 25.335(c) define ‘VA’ as the ‘design manoeuvring speed,’ not the ‘manoeuvring
speed.’
4.1.2.3 EASA’s actions on this issue
On the EASA side, CS 25.1583(a)(3) has not been amended and is consistent with the previous
FAR Part-25, §25.1583(a)(3).
An action is planned by EASA to ensure that AFMs of aeroplanes in service include adequate caution
statements (see Section 4.1.4 below).
4.1.3. Who is affected
Large aeroplane design organisations.
4.1.4. How could the issue/problem evolve
Rudder pedal reversals
In order to decrease the risk from exposure to inappropriate rudder pedal inputs, some actions have
already been implemented. AFM cautions have been introduced and pilot training programmes have
been improved to remind flight crews how to properly use flight controls and what kinds of rudder
pedal input must be avoided. Some airworthiness directives have also been issued by EASA to
mandate modifications on some in-service aeroplanes (refer to 4.1.1.3).
On recently certified fly-by-wire aeroplanes (for instance the Airbus A350, Boeing 787), some design
features have been included in the rudder control laws to cope with abnormal rudder pedal reversals
in order to protect the vertical tailplane from excessive loads.
If no regulatory change is made, EASA would raise the SC mentioned in Section 4.1.1.3 for each new
applicable large aeroplane certification project. This would allow EASA to also mitigate the safety risk
on new designs, but it is not the most efficient process in the long term.
Manoeuvring speed limitation
EASA found out that, in spite of the fact that CS 25.1583(a)(3) could have been improved, the vast
majority of the large aeroplanes operated in the EU currently have adequate caution statements in
their AFMs, although they are not completely harmonised. EASA will liaise with the EU manufacturers
who have not yet upgraded their AFM statements on this topic, and with third-country aviation
authorities, in order to make the necessary amendments. Such caution statements typically alert the
flight crew that rapid and large alternating control inputs, especially in combination with large changes
in pitch, roll or yaw (e.g. large sideslip angles), may result in structural failures at any speed, even
below the manoeuvring speed.
17
http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgFinalRule.nsf/861ae0b1f7efc3ee85256453007b0e8a/395c3f064247018a862577b200495
b5a!OpenDocument
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 15 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
Concerning future large aeroplane designs, their AFMs should be compliant with the FAA amended
FAR 25.1583(a)(3) rule.
However, CS-25 would not be harmonised with FAR 25.
4.2. What we want to achieve — objectives
The specific objectives of this proposal are to:
— mitigate, through design related measures, the safety risk created by unintended or
inappropriate rudder pedal usage by pilots of large aeroplanes, in particular multiple rudder
pedal reversals, which can lead to overstress and failure of primary structure and/or flight
controls, and, consequently, loss of control of the aeroplane; and
— clarify the specification for provisions to be included in the AFM to alert the flight crew to the
risk from rapid and large alternating control inputs in relation with the manoeuvring speed.
4.3. How it could be achieved — options
To meet these objectives, actions could be envisaged to address on the one hand new large aeroplane
certification projects, and on the other hand existing large aeroplane types. Such actions would be
intended to require design-related means of protection against rudder pedal reversals, and also clear
caution provisions in the AFM to alert the crew to the risk from rapid and large alternating control
inputs in relation with the manoeuvring speed.
The following options are considered:
Table 2: Selected policy options
Option Short title Description
No
0 SC Two doublets No regulation change: issue an SC on applicable large aeroplane
certification projects, check AFM statements.
1 CS-25 One Amend CS-25 to create a new CS 25.353 yaw manoeuvre condition,
doublet consisting of a single pedal doublet manoeuvre, together with an
AMC 25.353. Clarify CS 25.1583(a)(3) regarding manoeuvring speed
limitation statements in the AFM.
2 CS-25 Two Amend CS-25 to create a new CS 25.353 yaw manoeuvre condition,
doublets consisting of a two pedal doublet manoeuvre, together with an AMC
25.353. Clarify CS 25.1583(a)(3) regarding manoeuvring speed
limitation statements in the AFM.
Note: Discarded Option: rule applicable to existing aeroplanes
The analysis of the issue conducted in Section 4.1 above shows that the safety risk is under control and
at an acceptable level on existing aeroplanes, but that measures should be considered to prevent
unsafe conditions from developing on future designs.
It is therefore proposed to consider actions toward new large aeroplane certification projects only.
This proposal is in line with the recommendation made by the FCHWG, who also reviewed the existing
fleet of large aeroplanes and could not identify any additional relevant rudder reversal service events
beyond the five ones mentioned above.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 16 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
4.4. What are the impacts
4.4.1. Safety impact
Rudder pedal reversals
Occurrences have shown that some pilots apply multiple rudder pedal reversals, and in one case, this
included four full stroke displacements (the American Airline accident).
The FCHWG assessed that, out of the five occurrences analysed, there are four known notable rudder
reversal events in commercial aviation history, two of which occurred as a result of a wake encounter,
and the commercial aeroplane fleet has more than a combined 500 million flight hours. Assuming an
equal probability across all aeroplanes in the commercial fleet, the probability of a rudder reversal that
reaches or exceeds the design limit loading is approximately 10-8 per aeroplane flight hour. For this
reason, it was determined that the use of an ultimate load condition (factor of safety = 1.00) was
deemed appropriate.
The two pedal doublet manoeuvre proposal (Option 0 with the SC, Option 2) would protect against
two full stroke rudder control doublets. The American Airline accident reversals did not occur at the
Dutch roll frequency and may not have occurred at the maximum overswing yaw. The two doublet
proposed load conditions are conducted such that the reversals occur at the maximum overswing
condition. Therefore, the proposed load conditions would provide robust protection against events
with rudder reversal scenarios like the American Airline accident and other incidents that have
occurred to date.
It is noted that the second doublet would be applied with the aeroplane at a non-zero condition (at a
non-zero sideslip, etc.). This condition would more likely represent a pilot reaction to an unexpected
upset (such as a wake turbulence encounter) than a single doublet that begins at a zero state initial
condition. Therefore, the proposed two-doublet design condition would provide more capability to
better withstand a potential pilot response to an unexpected external condition such as a wake
turbulence encounter.
The single pedal doublet manoeuvre proposal (Option 1) would not protect against the American
Airline accident scenario, but would protect both against a single full stroke rudder control doublet, as
well as multiple rudder control doublets of reduced amplitude. It would rely on pilot training to
prevent such pedal reversals, which is not fully reliable given the fact that the reasons for such pilot
behaviour are not fully understood and controlled.
The assessment by the FCHWG of existing aeroplane capabilities (see Attachment E of the report)
revealed that among the 14 aeroplane models analysed (6 manufacturers), 11 models (79 %) would
meet the single doublet criteria, and only 6 models (43 %) would meet the two doublet criteria. This
shows that the single doublet (Option 1) would provide less benefit than the two doublet criteria
(Option 0 and 2).
Important note: The FCHWG also agreed that advancements in flight control features may result in
future designs having less inherent tolerance for rudder control doublets (such as overspeed
protection lessening the CS 25.351 loads at VD, other load alleviation functions, etc.) without including
codification regarding rudder control reversals in CS-25. Without any action, this may lead to a
decrease in the protection of aeroplanes regarding rudder pedal reversals.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 17 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
Manoeuvring speed limitation
The proposed amendment to CS 25.1583(a)(3) would follow the FAA action to clarify the required
statements that must be furnished in each AFM for identifying the types of control inputs to avoid
because they may result in structural failure. Although today, as explained above, the majority of
AFMs have already been updated to meet this expectation, the amended CS 25.1583(a)(3) will ensure
that future AFMs continue to include adequate statements for pilot awareness. This contributes to the
mitigation of the safety risk from inappropriate flight control inputs, including rudder pedals.
4.4.2. Environmental impact
Rudder pedal reversals
The proposed new rudder pedal manoeuvres would increase the vertical tail loads to be considered for
designs. This could result in increased vertical tail structure and aircraft weight, leading to increased
fuel burn and increased engine emissions.
The analysis in Attachment E of the FCHWG report (14 aeroplanes from 6 manufacturers) provides a
qualitative assessment of the fuel burn/emissions impact resulting from the application of the rules
proposed in the report (1 Doublet and 2 Doublet) to existing aeroplanes. The assessment identifies the
type of flight control system (FCS) (manual, hydromechanical, fly-by-wire).
Note that for some aeroplanes with yaw dampers whose commands cannot be nulled by the pilot
(‘unswampable’), it was conservatively assumed that the yaw damper function is NOT operational (for
2 manual FCS aeroplanes, and 2 hydromechanical FCS aeroplanes) although they are much more
tolerant to rudder pedal reversals than aeroplanes whose yaw dampers can be nulled by the pilots;
this has the effect of increasing the loads applied on the structure and therefore providing a higher
and more conservative impact on fuel burn/emissions.
In the following tables, we compare the impact on the engine emissions for the different types of FCS.
In order to facilitate the comparison, weightings are attributed to each category of impact as follows:
— None = 0,
— Negligible = 1,
— Low = 3,
— Medium = 5,
— High = 7.
The ‘total’ is the sum of all weightings, and the ‘average’ is the ‘total’ divided by the number of
aeroplanes analysed.
Single doublet criteria (Option 1)
FCS architecture Manual (2 a/c) Hydromechanical (6 a/c) Fly-by-wire (6 a/c)
Increased engine 1 * Negligible(1) + 4 * None(0) + 6 * None(0)
emissions 1 * Medium(5) 1 * Negligible(1) +
1 * Low(3)
Total emission increase 6 4 0
Average emission 6/2= 3 4/6= 0.67 0
increase
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 18 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
Two doublet criteria (Option 0 and 2)
FCS architecture Manual (2 a/c) Hydromechanical (6 a/c) Fly-by-wire (6 a/c)
Increased engine 2 * High(7) 1 * None(0) + 6 * None(0)
emissions 3 * Low(3) +
2 * Medium (5)
Total emission increase 14 19 0
Average emission 14/2= 7 19/6= 3.17 0
increase
No aircraft noise impact is foreseen for any of the options.
Manoeuvring speed limitation
No environmental impact has been identified.
4.4.3. Social impact
The amendment of CS 25.1583(a)(3) would improve the knowledge, awareness and skills of pilots, and
would therefore have a positive social impact. It should contribute to a better understanding among
pilots about the degree of structural protection that exists when full or abrupt flight control inputs are
made at airspeeds below the manoeuvring speed.
4.4.4. Economic impact
Rudder pedal reversals
The analysis in Attachment E of the FCHWG report (14 aeroplanes from 6 manufacturers) provides a
qualitative assessment of the cost impact resulting from the application of the rules proposed in the
report (1 Doublet and 2 Doublets) to existing aeroplanes. The assessment identifies the type of flight
control system (FCS) (manual, hydromechanical, fly-by-wire). Concerning the impact on
manufacturers, both non-recurring costs (NRCs) and recurring costs (RCs) are assessed; and for the
impact on operators, the fuel burn impact is assessed.
Note that for some aeroplanes with yaw dampers whose commands cannot be nulled by the pilot
(‘unswampable’), it was conservatively assumed that the yaw damper function is NOT operational (for
2 manual FCS aeroplanes, and 2 hydromechanical FCS aeroplanes) although they are much more
tolerant to rudder pedal reversals than aeroplanes whose yaw dampers can be nulled by the pilots;
this has the effect of increasing the loads applied on the structure and therefore providing a higher
and more conservative impact on costs for manufacturers and fuel burn.
In the following tables, we compare the cost impact for the different types of FCS.
In order to facilitate the comparison, weightings are attributed to each category of impact as follows:
— None = 0,
— Negligible = 1,
— Low = 3,
— Medium = 5,
— High = 7.
The ‘total’ is the sum of all weightings, and the ‘average’ is the ‘total’ divided by the number of
aeroplanes analysed.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 19 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
Single doublet criteria (Option 1)
FCS architecture Manual (2 a/c) Hydromechanical Fly-by-wire (6 a/c)
(6 a/c)
NRC to manufacturer 1 * Negligible(1) + 2 * Negligible(1) + 4 * Negligible(1) +
1 * High(7) 3 * Low(3) + 2 * Low(3)
1 * Medium(5)
RC to manufacturer 1 * Negligible(1) + 3 * None(0) + 3 * None(0) +
1 * High(7) 1 * Negligible(1) + 3 * Negligible(1)
1 * Low(3) +
1 * Medium(5)
Increased fuel burn 1 * Negligible(1) + 4 * None(0) + 6 * None(0)
1 * Medium(5) 1 * Negligible(1) +
1 * Low(3)
Total cost impact 14 26 13
Average cost impact 14/2= 7 26/6= 4.33 13/6= 2.17
Two doublet criteria (Option 0 and 2)
FCS architecture Manual (2 a/c) Hydromechanical (6 a/c) Fly-by-wire (6 a/c)
NRC to manufacturer 2 * High(7) 2 * Low(3) + 3 * Negligible(1) +
3 * Medium(5) + 3 * Low(3)
1 * High(7)
RC to manufacturer 2 * High(7) 1 * Negligible(1) + 2 * None(0) +
3 * Medium(5) + 3 * Negligible(1) +
2 * High(7) 1 * Low(3)
Increased fuel burn 2 * High(7) 1 * None(0) + 6 * None(0)
3 * Low(3) +
2 * Medium (5)
Total cost impact 42 77 18
Average cost impact 42/2= 21 77/6= 12.83 18/6= 3
Manoeuvring speed limitation
The amendment of CS 25.1583(a)(3) (AFM) would have a negligible economic impact. Applicants would
only have to ensure that their future AFMs include compliance statements and most of the current
type certificate holders have already updated their AFMs.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 20 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
4.4.5. ICAO and third-country references relevant to the content of this RMT
ICAO: The proposed new specifications would be more demanding than Annex 8 SARPs, which do not
address rudder reversal pilot inputs. Annex 8 also does not contain specific requirements regarding
manoeuvring speed limitation statements in the AFM to alert the crew to the risk from rapid and large
alternating control inputs in relation with VA.
FAA: The creation of CS 25.353 would create a difference from FAR 25, which does not contain an
equivalent rule. However, EASA is aware that the FAA is preparing an NPRM that should propose an
amendment of FAR 25 equivalent to this NPA.
In the end, the harmonisation or differences between CS-25 and the FAR 25 amendments will depend
on the final outcome of the rulemaking processes at both EASA and the FAA. The objective of EASA is
to harmonise with the FAA, as far as possible.
4.4.6. General Aviation and proportionality issues
This proposal has no impact on General Aviation or micro, small and medium-sized enterprises.
4.5. Conclusion
4.5.1. Comparison of options
Option 1 (single doublet pedal input) would provide a rather limited safety benefit, as it would not
materially increase the design load level from the current criteria for design loads. This is evident in the
table in Attachment E of the FCHWG report. 79 % of the aeroplanes analysed by the FCHWG are
already compliant with Option 1, and more importantly, this would not cover scenarios like the one
which led to the American Airline fatal accident. Evidence exists that pilots may make more than two
pedal inputs, so one doublet does not cover this risk.
Option 0 and option 2 (two doublet pedal input) would provide a fair amount of safety benefit,
protecting the aeroplane against a variety of multiple pedal reversals, including two full stroke
doublets and scenarios like the American Airline accident. Regarding this accident, it must be noted
that the pedal reversals did not occur at the Dutch roll frequency and may not have occurred at the
maximum overswing sideslip. The proposed load conditions under option 0 and option 2 are
conducted such that the reversals occur at the maximum overswing condition. Therefore, the
proposed load conditions would provide more capability to withstand an event like the American
Airline accident.
Although the proposed specifications of option 0 and option 2 (two doublet pedal input) entail a
higher cost impact than option 1 for manual and hydromechanical FCSs (for fly-by-wire the impact is
almost the same and close to 0), compliance can be ensured without significant strengthening of the
vertical tail or significant changes to system design. Various current aeroplanes are already able to
meet these specifications with no change required; for example, out of the 14 aeroplane models
analysed by the FCHWG, 6 models (43 %) already meet this criterion (1 model with a hydromechanical
FCS and 5 models with fly-by-wire FCSs). Such designs that are tolerant to multiple doublets have
actually existed since the 1980s without any concerns or negative effects.
The FCHWG overall assessment of the economic impact (of the proposed single doublet or two
doublet design load conditions) is as follows:
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 21 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
In general, Attachment E shows that advanced flight control architectures (FBW) are able to meet the
proposed criteria, whereas some hydro-mechanical and manual control architectures cannot. In some
cases, OEMs assumed the yaw damper was not operational for their loads analysis of the single
doublet and the two doublet conditions. (See line 17 of the table.) However, the yaw damper probably
would be considered operational according to the final versions of the proposed rule and advisory
material. If the yaw damper were ‘unswampable’ and assumed to be operational in those cases, the
loads (and the costs) would likely decrease. The use of an unswampable yaw damper (YD) may be able
to reduce the load levels for the single doublet to a ‘low’ or ‘no’ economic impact. However, it might
not adequately reduce the large loads of the two-doublet condition to a ‘low’ economic impact. It
would depend on the YD authority to reduce pilot commanded side slip angles to safe limits and the
cost to redesign these items. Also the use of a high authority YD would need to consider the
ramifications of failures and reliability.
Furthermore, as noted previously in Section 4.4.1, there is a risk that future designs may include load
alleviation features (e.g. speed protection systems, or other load alleviation features) and may
therefore become less resilient to pedal reversals; certification requirements should therefore be
created to prevent this risk, and only option 0 and 2 achieve this objective.
Concerning aeroplanes with manual FCSs, it must be noted that the pedal force which would be
specified in the new specifications (single and two doublet options) would be reduced from the levels
in CS 25.351 to 890 N (200 lbf), recognising that it would be difficult for a pilot to maintain a high level
of force (1335 N (300 lbf) up to VC) while performing rapid alternating inputs. This reduction in pedal
force would reduce the loads for aeroplanes with manual control systems.
Finally, as explained in position 3 provided in the FCHWG, an FAA issue paper has been applied on
recent certification projects and compliance has been demonstrated with few technical or cost issues.
EASA has issued an SC requiring a two doublet load case; this SC has been applied since February 2016
to all new type certification projects, and on a case-by-case basis to projects involving significant
changes.
4.5.2. Conclusion and recommended option
It is recommended that one of the two options specifying a yaw manoeuvre condition consisting of a
two pedal doublet manoeuvre, i.e. option 0 or option 2, should be selected. This new specification will
ensure that future large aeroplane are designed with features protecting the structure against rudder
control pedal reversals like the ones demonstrated in the reported occurrences. This proposal would
thus ensure an increased level of safety, while creating little or no economic impact in most cases.
For some aeroplanes, mainly the ones with manual FCSs, the economic impact may be higher than on
those with fly-by-wire or hydromechanical FCSs. However the current trend in designs is to move away
from mechanical systems and towards electronic control systems. EASA estimates that the economic
impact would remain reasonable and acceptable to the manufacturer when a new design is
developed. Furthermore, several existing designs are already able to comply with the new
specification. Technically, both options 0 and 2 would allow the same result to be achieved. However,
using the CRI process to issue an SC for each application is not the most efficient process for either
applicants or EASA, as it increases workloads and costs for both applicants and EASA. It is therefore
more efficient to amend CS-25.
Concerning the amendment of CS 25.1583(a)(3), this will ensure that AFMs adequately warn flight
crews of the risk from rapid and large alternating control inputs in relation with the manoeuvring
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 22 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
4. Impact assessment
speed, thus decreasing the risk of inappropriate flight control system inputs, including (but not only)
rudder pedal inputs; no economic impact would be induced by this last specification. This is included in
options 1 and 2.
The following table provides a qualitative summary of the impact assessment:
Option 0 Option 1 Option 2
Safety +++ 0/+ +++
Environmental -/0 0 -/0
Economic ---- - --
Overall - 0 +
Therefore, Option 2 is the preferred option.
Question to stakeholders
Stakeholders are invited to provide quantified justification inputs on the possible economic impacts of
the options proposed, or alternatively to propose another justified solution to the issue.
Furthermore, stakeholders are also invited to provide any other quantitative information they may
find necessary to bring to the attention of EASA.
As a result, the relevant parts of the RIA might be adjusted on a case-by-case basis.
4.6. Monitoring and evaluation
It is proposed to monitor and analyse new reported occurrences involving inappropriate rudder pedal
inputs, in particular multiple reversals. This will allow EASA to evaluate the efficiency and adequacy of
the new CS 25.353 rule when the occurrence concerns an aeroplane certified in compliance with this
rule. Whenever the occurrence concerns an aeroplane which does not have the new CS 25.353 rule in
its certification basis, the analysis of the occurrence will be used by EASA and type certificate holders
to determine whether an unsafe condition exists and whether mandatory corrective actions must be
taken in agreement with Part-21, point 21.A.3B.
The monitoring will be ensured in the frame of the usual continuing airworthiness process followed by
EASA and type certificate holders, and also through the investigations of occurrences and safety
recommendations from designated safety investigation authorities.
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 23 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
5. Proposed actions to support implementation
5. Proposed actions to support implementation
N/A
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 24 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
6. References
6. References
6.1. Related regulations
N/A
6.2. Affected decisions
ED Decision 2003/2/RM of 17 October 2003 on certification specifications, including airworthiness
codes and acceptable means of compliance, for large aeroplanes («CS-25»)
6.3. Other reference documents
— Federal Register /Vol. 76, No. 59 /Monday, March 28, 2011 /Notices - Notice of new task
assignment for the Aviation Rulemaking Advisory Committee (ARAC) on rudder pedal sensitivity
and rudder reversals. Task assigned to the re-established Flight Controls Harmonization Working
Group, under Transport Airplane and Engine Issues (https://www.gpo.gov/fdsys/pkg/FR-2011-
03-28/pdf/2011-7180.pdf)
— Report submitted to the FAA by the Aviation Rulemaking Advisory Committee (ARAC) and the
Flight Controls Harmonization Working Group (FCHWG) of the Transport Airplane and Engine
Subcommittee, dated 30 December 2013
(https://www.faa.gov/regulations_policies/rulemaking/committees/documents/media/TAEfch-
rpsrr-3282011.pdf)
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 25 of 26
An agency of the European Union
European Aviation Safety Agency NPA 2017-18
7. Appendix
7. Appendix
N/A
TE.RPRO.00034-006© European Aviation Safety Agency. All rights reserved. ISO 9001 certified.
Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 26 of 26
An agency of the European Union