(a)(1) The applicant must analyze the propeller system to assess the likely consequences of all failures that can reasonably be expected to occur. This analysis will take into account, if applicable:

(i) The propeller system in a typical installation. When the analysis depends on representative components, assumed interfaces, or assumed installed conditions, the assumptions must be stated in the analysis.

(ii) Consequential secondary failures and dormant failures.

(iii) Multiple failures referred to in paragraph (d) of this section, or that result in the hazardous propeller effects defined in paragraph (g)(1) of this section.

(2) The applicant must summarize those failures that could result in major propeller effects or hazardous propeller effects defined in paragraph (g) of this section, and estimate the probability of occurrence of those effects.

(3) The applicant must show that hazardous propeller effects are not predicted to occur at a rate in excess of that defined as extremely remote (probability of 10−7 or less per propeller flight hour). Since the estimated probability for individual failures may be insufficiently precise to enable the applicant to assess the total rate for hazardous propeller effects, compliance may be shown by demonstrating that the probability of a hazardous propeller effect arising from an individual failure can be predicted to be not greater than 10−8 per propeller flight hour. In dealing with probabilities of this low order of magnitude, absolute proof is not possible and reliance must be placed on engineering judgment and previous experience combined with sound design and test philosophies.

(b) If significant doubt exists as to the effects of failures or likely combination of failures, the Administrator may require assumptions used in the analysis to be verified by test.

(c) The primary failures of certain single propeller elements (for example, blades) cannot be sensibly estimated in numerical terms. If the failure of such elements is likely to result in hazardous propeller effects, those elements must be identified as propeller critical parts. For propeller critical parts, applicants must meet the prescribed integrity specifications of § 35.16. These instances must be stated in the safety analysis.

(d) If reliance is placed on a safety system to prevent a failure progressing to hazardous propeller effects, the possibility of a safety system failure in combination with a basic propeller failure must be included in the analysis. Such a safety system may include safety devices, instrumentation, early warning devices, maintenance checks, and other similar equipment or procedures. If items of the safety system are outside the control of the propeller manufacturer, the assumptions of the safety analysis with respect to the reliability of these parts must be clearly stated in the analysis and identified in the propeller installation and operation instructions required under § 35.3.

(e) If the safety analysis depends on one or more of the following items, those items must be identified in the analysis and appropriately substantiated.

(1) Maintenance actions being carried out at stated intervals. This includes verifying that items that could fail in a latent manner are functioning properly. When necessary to prevent hazardous propeller effects, these maintenance actions and intervals must be published in the instructions for continued airworthiness required under § 35.4. Additionally, if errors in maintenance of the propeller system could lead to hazardous propeller effects, the appropriate maintenance procedures must be included in the relevant propeller manuals.

(2) Verification of the satisfactory functioning of safety or other devices at pre-flight or other stated periods. The details of this satisfactory functioning must be published in the appropriate manual.

(3) The provision of specific instrumentation not otherwise required. Such instrumentation must be published in the appropriate documentation.

(4) A fatigue assessment.

(f) If applicable, the safety analysis must include, but not be limited to, assessment of indicating equipment, manual and automatic controls, governors and propeller control systems, synchrophasers, synchronizers, and propeller thrust reversal systems.

(g) Unless otherwise approved by the Administrator and stated in the safety analysis, the following failure definitions apply to compliance with this part.

(1) The following are regarded as hazardous propeller effects:

(i) The development of excessive drag.

(ii) A significant thrust in the opposite direction to that commanded by the pilot.

(iii) The release of the propeller or any major portion of the propeller.

(iv) A failure that results in excessive unbalance.

(2) The following are regarded as major propeller effects for variable pitch propellers:

(i) An inability to feather the propeller for feathering propellers.

(ii) An inability to change propeller pitch when commanded.

(iii) A significant uncommanded change in pitch.

(iv) A significant uncontrollable torque or speed fluctuation.

The integrity of each propeller critical part identified by the safety analysis required by § 35.15 must be established by:

(a) A defined engineering process for ensuring the integrity of the propeller critical part throughout its service life,

(b) A defined manufacturing process that identifies the requirements to consistently produce the propeller critical part as required by the engineering process, and

(c) A defined service management process that identifies the continued airworthiness requirements of the propeller critical part as required by the engineering process.

(a) The suitability and durability of materials used in the propeller must:

(1) Be established on the basis of experience, tests, or both.

(2) Account for environmental conditions expected in service.

(b) All materials and manufacturing methods must conform to specifications acceptable to the Administrator.

(c) The design values of properties of materials must be suitably related to the most adverse properties stated in the material specification for applicable conditions expected in service.

Each part of the propeller must be designed and constructed to minimize the development of any unsafe condition of the propeller between overhaul periods.

(a) No single failure or malfunction in the propeller system will result in unintended travel of the propeller blades to a position below the in-flight low-pitch position. The extent of any intended travel below the in-flight low-pitch position must be documented by the applicant in the appropriate manuals. Failure of structural elements need not be considered if the occurrence of such a failure is shown to be extremely remote under § 35.15.

(b) For propellers incorporating a method to select blade pitch below the in-flight low pitch position, provisions must be made to sense and indicate to the flight crew that the propeller blades are below that position by an amount defined in the installation manual. The method for sensing and indicating the propeller blade pitch position must be such that its failure does not affect the control of the propeller.

(a) Feathering propellers are intended to feather from all flight conditions, taking into account expected wear and leakage. Any feathering and unfeathering limitations must be documented in the appropriate manuals.

(b) Propeller pitch control systems that use engine oil to feather must incorporate a method to allow the propeller to feather if the engine oil system fails.

(c) Feathering propellers must be designed to be capable of unfeathering after the propeller system has stabilized to the minimum declared outside air temperature.

The requirements of this section apply to any system or component that controls, limits or monitors propeller functions.

(a) The propeller control system must be designed, constructed and validated to show that:

(1) The propeller control system, operating in normal and alternative operating modes and in transition between operating modes, performs the functions defined by the applicant throughout the declared operating conditions and flight envelope.

(2) The propeller control system functionality is not adversely affected by the declared environmental conditions, including temperature, electromagnetic interference (EMI), high intensity radiated fields (HIRF) and lightning. The environmental limits to which the system has been satisfactorily validated must be documented in the appropriate propeller manuals.

(3) A method is provided to indicate that an operating mode change has occurred if flight crew action is required. In such an event, operating instructions must be provided in the appropriate manuals.

(b) The propeller control system must be designed and constructed so that, in addition to compliance with § 35.15:

(1) No single failure or malfunction of electrical or electronic components in the control system results in a hazardous propeller effect.

(2) Failures or malfunctions directly affecting the propeller control system in a typical airplane, such as structural failures of attachments to the control, fire, or overheat, do not lead to a hazardous propeller effect.

(3) The loss of normal propeller pitch control does not cause a hazardous propeller effect under the intended operating conditions.

(4) The failure or corruption of data or signals shared across propellers does not cause a hazardous propeller effect.

(c) Electronic propeller control system imbedded software must be designed and implemented by a method approved by the Administrator that is consistent with the criticality of the performed functions and that minimizes the existence of software errors.

(d) The propeller control system must be designed and constructed so that the failure or corruption of airplane-supplied data does not result in hazardous propeller effects.

(e) The propeller control system must be designed and constructed so that the loss, interruption or abnormal characteristic of airplane-supplied electrical power does not result in hazardous propeller effects. The power quality requirements must be described in the appropriate manuals.

The maximum stresses developed in the propeller may not exceed values acceptable to the Administrator considering the particular form of construction and the most severe operating conditions.