Postal Address: P.O.

Box 3000
2130 KA Hoofddorp
Visiting Address: Saturnusstraat 8-10
The Netherlands
oint Aviation Authorities
Tel.: 31 (0)23 - 5679700
Fax: 31 (0)23 - 5621714

Our reference number: 07/03-6-2 02L-027

Your reference number: 2 April 2002

NPA Distribution List

Re: NPA 25C-199 Revision 1 - Interaction of Systems and Structures

This revision 1 to NPA 25C-199 has been developed in the framework of the
Harmonisation Work Programme and is sponsored by the Structures Study Group.

Background

In December 1996 the JAA published NPA 25C-199 for comment. The comments
received were discussed by the JAR-25 Structures Study Group and were addressed
in a comment/response document (ref. SSG/98/3).

Since then, the harmonisation effort has continued and has now progressed to the
point that final proposals have been developed by the working group for the
interaction of systems and structures requirements (ref. Technical Agreement,
September 1999). This revision to NPA 25C-199 contains the proposals necessary to
achieve harmonisation of these interaction of systems and structures requirements.
The comments received on the December 1996 issue of this NPA (as far as they
were accepted and are still applicable) have been incorporated into this revision of
the NPA.

The Regulation Sectorial Team has been consulted and agreed for the circulation of
this NPA

General

The NPA is the standard JAA procedure for consultation with the aviation community.
In addition to this JAA process the National Authorities may perform their own
consultation.

Chief Executives office: 31 (0)23 - 5679741 Regulation division: 31 (0)23 - 5679712 Certification division: 31 (0)23 - 5679710/766
Resources and Development Licensing division: 31 (0)23 - 5679733/756 Maintenance division: 31 (0)23 - 5679711/780
Division: 31 (0)23 - 5679765 Operations division: 31 (0)23 5679743/764
The objective of the NPA consultation is to inform interested parties of the
current position and to receive comments on the draft. This means that the
draft text is not necessarily the final text.

The JAA Committee expects that within the above perspective your
organisation will participate efficiently in the NPA consultation. Your
organisation is now invited to consider the NPA and to submit comments by
2 July 2002. If no comments from your organisation by that date your
agreement will be assumed.

Y Morier
Regulation Director

Copy: W Doeland, SSG Chairman

JF van der Spek, Certification Division
I van Opzeeland, Regulation Division

2
Please note the revised guidelines on reverse side of this form! Comment nr:
(For Central JAA use only)

JOINT AVIATION AUTHORITIES

NOTICE OF PROPOSED AMENDMENT (NPA) COMMENT FORM

1. NPA NUMBER: NPA 25C-199 Rev. 1

Affected Requirement paragraph:
Affected ACJ/AMJ or AMC/IEM paragraph:

2. POSITION: (cross out the parts that are not applicable)

Agree / Accept / No comment

Propose different text / General comment
Propose to delete paragraph

3. PROPOSED TEXT/COMMENT:

Reason(s) for proposed text/comment:

4. ORGANISATION :
Address :

Phone :
Fax :

5. SIGNATURE . Date:
Name :

JAA Form 200 February 2001

 GUIDELINES TO COMMENT ON AN NPA

1.. For a better handling of comments we strongly recommend commentors to use this form.

2.. Please use one form per comment.

3.. If there is insufficient space on the form, use attachments and summarise your comments
on the form.

4.. In case of disagreement, commentors should be aware that failure to explain the
reason(s) for disagreeing may well result in the comments being laid aside for lack of
understanding.
For the same reason, the commentor should explain his/her position for deleting a
paragraph.

5.. All comments must be sent to the NPA Administrator at Central JAA unless otherwise
indicated in the NPA.

6.. Please note that, unless an extension period is granted, comments received after the
stated comment date (see letter) will only be taken into account if practical.

JAA Form 200 February 2001

NPA 25C-199 Rev.1 7 January 2002

JAR-25
LARGE AEROPLANES

ORIGIN: Structures Study Group

TITLE: INTERACTION OF SYSTEMS AND STRUCTURES

1. EXPLANATORY NOTE

In 1988, the JAA, the FAA and organisations representing the European and United States
aerospace industries, began a process to harmonise the airworthiness requirements of the
European authorities and the airworthiness requirements of the United States. The objective
was to achieve common requirements for the certification of large/transport aeroplanes
without a substantive change in the level of safety. Other airworthiness authorities such as
Transport Canada also participated in this process.

In 1991, the harmonisation effort was undertaken by the Aviation Regulatory Advisory
Committee (ARAC). By notice in the Federal Register (1993), a working group (Loads and
Dynamics Harmonisation Working Group, LDHWG) of industry and government structural
specialists of Europe, the U.S., and Canada was chartered to address the issue of interaction of
systems and structures.
In December 1996 the JAA published NPA 25C-199 for comment. The comments received
were discussed by the JAR-25 Structures Study Group and were addressed in a
comment/response document (ref. SSG/98/3).

Since then, the harmonisation effort has continued and has now progressed to the point that
final proposals have been developed by the working group for the interaction of systems and
structures requirements (ref. Technical Agreement, September 1999). This NPA contains the
proposals necessary to achieve harmonisation of these interaction of systems and structures
requirements. The comments received on the December 1996 issue of this NPA (as far as they
were accepted and are still applicable) have been incorporated into this issue of the NPA.

2. SAFETY JUSTIFICATION / EXPLANATION

Active flight control systems are capable of providing automatic responses to external inputs
from sources other than the pilots. Active flight control systems have been expanded in
function, effectiveness, and reliability to the point that fly-by-wire flight controls, without a
manual backup system in the event of system failures, are becoming standard equipment on
larger transport aeroplanes. As a result of these advancements in flight controls technology,
the current safety standards contained in JAR-25 do not provide an adequate basis to address

 RI 
an acceptable level of safety for aeroplanes equipped with these advanced systems. Instead,
certification of these systems has been achieved by issuance of special conditions under the
provisions of JAR 21.16.
For example, stability augmentation systems (SAS), and to a lesser extent load alleviation
systems (LAS), have been used on large/transport aeroplanes for many years. Past approvals
of these systems were based on individual findings of equivalent level of safety with existing
rules and on special conditions.

Although autopilots are also considered active control systems, typically their control
authority has been limited such that the consequences of system failures could be readily
counteracted by the pilot. Now, autopilot functions are integrated into the primary flight
controls and are given sufficient control authority to manoeuvre the aeroplane to its structural
design limits. This advanced technology with its expanded authority requires a new approach
to account for the interaction of control systems and structures.

The usual deterministic approach to defining the loads envelope contained in JAR-25 does not
fully account for system effectiveness and system reliability. These automatic systems may be
inoperative or may operate in a degraded mode with less than full system authority.
Therefore, it is necessary to determine the structural factors of safety and operating margins
such that the joint probability of structural failures due to application of loads during system
malfunctions is not greater than that found in aeroplanes equipped with earlier technology
control systems. To achieve this objective it is necessary to define the failure conditions with
their associated frequency of occurrence in order to determine the structural factors of safety
and operating margins that will ensure an acceptable level of safety.

Earlier automatic control systems usually provided two states, either fully functioning or a
total loss of function. These conditions were readily detected by the flightcrew. The new
active flight control systems have failure modes that allow the system to function in the
degraded mode without full authority. This degraded mode is not readily detectable by the
flightcrew. Therefore, monitoring systems are required on these new systems to provide an
annunciation of a condition of degraded system capability.

This NPA proposes to incorporate the safety requirements found necessary for aeroplanes
equipped with active flight controls and fly-by-wire flight control systems except that the
general philosophy of accounting for the impact of system failures on structural performance
would be extended to include any system whose partial or complete failure, alone or in
combination with other system partial or complete failures, would affect structural
performance. The required structural factors of safety would be defined as a function of
system reliability. This is an extension of the current philosophy that the aeroplane should be
capable of continued safe flight and landing after specific failure events not shown to be
extremely improbable.

Sub-paragraph JAR K25.2(e) of this proposal provides for the consideration of expected
operational limits in the establishment of the appropriate safety factors. These limits are the
expected maximum limits for dispatch in the failure condition and would be established
consistent with experience on similar equipment in service.

In addition to providing requirements for static strength this NPA proposes requirements that
account for the effects of system failures on fatigue, damage tolerance, residual strength,

 RI 
deformation and aeroelastic stability. The impact of all combinations of system failures not
shown to be extremely improbable need to be investigated.

This proposal would add a new JAR 25.302 and a new Appendix K to JAR-25 to incorporate
these latest safety standards. It would also amend 25.629 to make this rule compatible with the
new JAR 25.302 rule. Compatibility with NPA 25BCD-236 Vibration, Buffet and
Aeroelastic Stability Requirements also has been ensured. It is intended to introduce this
NPA and NPA 25BCD-236 concurrently into JAR-25.

3. COST / SAFETY BENEFIT ASSESSMENT

This NPA should not have a significant economic impact on the manufacturers of new
aeroplanes since it incorporates the criteria already applied by special conditions to new
technology aeroplanes. Nor would it place a significant design burden on the applicant
because there are many design options available including conventional control systems.
In addition, harmonisation of JAR-25 and FAR 25 would yield cost savings by eliminating
duplicate certification activities.

[intentionally left blank]

 RI 
4. PROPOSALS

1. To add a new paragraph JAR 25.302 to read as follows:

JAR 25.302 Interaction of systems and structures

For aeroplanes equipped with systems that affect structural performance, either directly
or as a result of a failure or malfunction, the influence of these systems and their failure
conditions must be taken into account when showing compliance with the requirements of
Subparts C and D. Appendix K of JAR-25 must be used to evaluate the structural performance
of aeroplanes equipped with these systems.

2. To renumber the existing Appendix K as Appendix L

3. To add a new Appendix K to read as follows:

APPENDIX K TO JAR-25 - INTERACTION OF SYSTEMS AND STRUCTURES

K25.1 General.
The following criteria must be used for showing compliance with JAR 25.302 for
aeroplanes equipped with flight control systems, autopilots, stability augmentation systems,
load alleviation systems, flutter control systems, and fuel management systems. If this
appendix is used for other systems, it may be necessary to adapt the criteria to the specific
system.
(a) The criteria defined herein only address the direct structural consequences of the
system responses and performances and cannot be considered in isolation but should be
included in the overall safety evaluation of the aeroplane. These criteria may in some
instances duplicate standards already established for this evaluation. These criteria are only
applicable to structure whose failure could prevent continued safe flight and landing. Specific
criteria that define acceptable limits on handling characteristics or stability requirements when
operating in the system degraded or inoperative mode are not provided in this appendix.
(b) Depending upon the specific characteristics of the aeroplane, additional studies may
be required that go beyond the criteria provided in this appendix in order to demonstrate the
capability of the aeroplane to meet other realistic conditions such as alternative gust or
manoeuvre descriptions for an aeroplane equipped with a load alleviation system.
(c) The following definitions are applicable to this appendix.
Structural performance: Capability of the aeroplane to meet the structural requirements of
JAR-25.
Flight limitations: Limitations that can be applied to the aeroplane flight conditions following
an in-flight occurrence and that are included in the flight manual (e.g., speed limitations,
avoidance of severe weather conditions, etc.).
Operational limitations: Limitations, including flight limitations, that can be applied to the
aeroplane operating conditions before dispatch (e.g., fuel, payload and Master Minimum
Equipment List limitations).
Probabilistic terms: The probabilistic terms (probable, improbable, extremely improbable)
used in this appendix are the same as those used in JAR 25.1309.
Failure condition: The term failure condition is the same as that used in JAR 25.1309,
however this appendix applies only to system failure conditions that affect the structural
performance of the aeroplane (e.g., system failure conditions that induce loads, change the
response of the aeroplane to inputs such as gusts or pilot actions, or lower flutter margins).

 RI 
K25.2 Effects of Systems on Structures.
(a) General. The following criteria will be used in determining the influence of a
system and its failure conditions on the aeroplane structure.
(b) System fully operative. With the system fully operative, the following apply:
(1) Limit loads must be derived in all normal operating configurations of the system
from all the limit conditions specified in Subpart C, taking into account any special behaviour
of such a system or associated functions or any effect on the structural performance of the
aeroplane that may occur up to the limit loads. In particular, any significant nonlinearity (rate
of displacement of control surface, thresholds or any other system nonlinearities) must be
accounted for in a realistic or conservative way when deriving limit loads from limit
conditions.
(2) The aeroplane must meet the strength requirements of JAR-25 (Static strength,
residual strength), using the specified factors to derive ultimate loads from the limit loads
defined above. The effect of nonlinearities must be investigated beyond limit conditions to
ensure the behaviour of the system presents no anomaly compared to the behaviour below
limit conditions. However, conditions beyond limit conditions need not be considered when it
can be shown that the aeroplane has design features that will not allow it to exceed those limit
conditions.
(3) The aeroplane must meet the aeroelastic stability requirements of JAR 25.629.
(c) System in the failure condition. For any system failure condition not shown to be
extremely improbable, the following apply:
(1) At the time of occurrence. Starting from 1-g level flight conditions, a realistic
scenario, including pilot corrective actions, must be established to determine the loads
occurring at the time of failure and immediately after failure.
(i) For static strength substantiation, these loads multiplied by an appropriate factor of
safety that is related to the probability of occurrence of the failure are ultimate loads to be
considered for design. The factor of safety (F.S.) is defined in Figure 1.

Figure 1
factor of safety at the time of occurrence

(ii) For residual strength substantiation, the aeroplane must be able to withstand two
thirds of the ultimate loads defined in subparagraph (c)(1)(i).
(iii) Freedom from aeroelastic instability must be shown up to the speeds defined in
JAR 25.629(b)(2). For failure conditions that result in speed increases beyond VC/MC,
freedom from aeroelastic instability must be shown to increased speeds, so that the margins
intended by JAR 25.629(b)(2) are maintained.

 RI 
 (iv) Failures of the system that result in forced structural vibrations (oscillatory failures)
must not produce loads that could result in detrimental deformation of primary structure.
(2) For the continuation of the flight. For the aeroplane, in the system failed state and
considering any appropriate reconfiguration and flight limitations, the following apply:
(i) The loads derived from the following conditions at speeds up to VC, or the speed
limitation prescribed for the remainder of the flight must be determined:
(A) the limit symmetrical manoeuvring conditions specified in JAR 25.331 and in
JAR 25.345.
(B) the limit gust and turbulence conditions specified in JAR 25.341 and in
JAR 25.345.
(C) the limit rolling conditions specified in JAR 25.349 and the limit unsymmetrical
conditions specified in JAR 25.367 and JAR 25.427(b) and (c).
(D) the limit yaw manoeuvring conditions specified in JAR 25.351.
(E) the limit ground loading conditions specified in JAR 25.473 and JAR 25.491.
(ii) For static strength substantiation, each part of the structure must be able to
withstand the loads in subparagraph (2)(i) of this paragraph multiplied by a factor of safety
depending on the probability of being in this failure state. The factor of safety is defined in
Figure 2.

Figure 2
Factor of safety for continuation of flight

Qj = (Tj)(Pj) where:
Tj = Average time spent in failure condition j (in hours)
Pj = Probability of occurrence of failure mode j (per hour)
Note: If Pj is greater than 10-3, per flight hour then a 1.5 factor of safety must
be applied to all limit load conditions specified in Subpart C.
(iii) For residual strength substantiation, the aeroplane must be able to withstand two
thirds of the ultimate loads defined in subparagraph (c) (2) (ii).
(iv) If the loads induced by the failure condition have a significant effect on fatigue or
damage tolerance then their effects must be taken into account.
(v) Freedom from aeroelastic instability must be shown up to a speed determined from
Figure 3. Flutter clearance speeds V' and V'' may be based on the speed limitation specified
for the remainder of the flight using the margins defined by JAR 25.629(b).

 RI 
 Figure 3
Clearance speed

V' = Clearance speed as defined by JAR 25.629(b)(2).

V'' = Clearance speed as defined by JAR 25.629(b)(1).
Qj = (Tj)(Pj) where:
Tj = Average time spent in failure condition j (in hours)
Pj = Probability of occurrence of failure mode j (per hour)
Note: If Pj is greater than 10-3 per flight hour, then the flutter clearance speed
must not be less than V''.
(vi) Freedom from aeroelastic instability must also be shown up to V' in Figure 3 above,
for any probable system failure condition combined with any damage required or selected for
investigation by JAR 25.571(b).
(3) Consideration of certain failure conditions may be required by other Subparts of
JAR-25 regardless of calculated system reliability. Where analysis shows the probability of
these failure conditions to be less than 10-9, criteria other than those specified in this
paragraph may be used for structural substantiation to show continued safe flight and landing.
(d) Warning considerations. For system failure detection and warning, the following
apply:
(1) The system must be checked for failure conditions, not extremely improbable, that
degrade the structural capability below the level required by JAR-25 or significantly reduce
the reliability of the remaining system. The flight crew must be made aware of these failures
before flight. Certain elements of the control system, such as mechanical and hydraulic
components, may use special periodic inspections, and electronic components may use daily
checks, in lieu of warning systems to achieve the objective of this requirement. These
certification maintenance requirements must be limited to components that are not readily
detectable by normal warning systems and where service history shows that inspections will
provide an adequate level of safety.
(2) The existence of any failure condition, not extremely improbable, during flight that
could significantly affect the structural capability of the aeroplane and for which the
associated reduction in airworthiness can be minimised by suitable flight limitations, must be
signalled to the flightcrew. For example, failure conditions that result in a factor of safety
between the aeroplane strength and the loads of Subpart C below 1.25, or flutter margins
below V", must be signalled to the crew during flight.
(e) Dispatch with known failure conditions. If the aeroplane is to be dispatched in a
known system failure condition that affects structural performance, or affects the reliability of
the remaining system to maintain structural performance, then the provisions of JAR 25.302
must be met for the dispatched condition and for subsequent failures. Flight limitations and
expected operational limitations may be taken into account in establishing Qj as the combined
probability of being in the dispatched failure condition and the subsequent failure condition

 RI 
for the safety margins in Figures 2 and 3. These limitations must be such that the probability
of being in this combined failure state and then subsequently encountering limit load
conditions is extremely improbable. No reduction in these safety margins is allowed if the
subsequent system failure rate is greater than 10-3 per hour.

4. To amend JAR 25.629 by revising paragraph 25.629(d)(2) and by adding a new

paragraph (b)(3) to read as follows:

JAR 25.629 Aeroelastic stability requirements

(b) * * *
(3) For failure conditions in those systems covered by JAR 25.302, the margins defined
in Appendix K of JAR-25 apply.
(d) * * *
(2) Any single failure in any flutter damper or flutter control system.

(Note: The corresponding FAA NPRM on Interaction of Systems and Structures also contains
proposals on 25.305(f), 25.629(a) and (c). These proposals however are already contained in
NPA 25BCD-236 and are not repeated here.)

5. To amend the reference to Appendix K in JAR 25.1435(a)(10) to refer to Appendix L

6. To amend the reference to Appendix K in JAR 25X1436(b)(7) to refer to Appendix L

 RI