RA-17-00224 Enclosure G-1 INTRODUCTION Appendix G describes the design changes to the stabilizer trim system for the 737-7/-8/-9 (hereafter referred to as the 737 MAX), the applicable Federal Aviation Administration (FAA) and European Aviation Safety Agency (EASA) regulatory requirements, and the method of compliance to those requirements. This safety analysis was developed in order to ensure the safe operation of the 737 MAX stabilizer trim system and to show compliance with certification agency requirements. As a result of this analysis, it is concluded that the changes to the 737 MAX stabilizer trim system comply with all applicable FAA Regulations and EASA Requirements. The Functional Hazard Assessment (FHA) in Section G-4 of this appendix identifies the severity of potential hazards to the airplane due to the implementation of the 737 MAX stabilizer trim system changes. The Failure Modes and Effects Analysis (FMEA) in Section G-5 of this appendix ensures that continued safe-flight-and-landing is possible, without requiring exceptional pilot skill or strength, following any single failure of the 737 MAX stabilizer trim system. Each single failure meets the requirements of the CFRs and CSs. A Fault Tree Analysis (FTA) in Section G-6 of this appendix ensures that continued safe-flight­ and-landing is possible, without requiring exceptional pilot skill or strength, following any combination of failures not extremely improbable for the 73 7 MAX stabilizer trim system. EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0001 RA-17-00224 Enclosure G-2 DESCRIPTION OF SYSTEM CHANGES EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0002 RA-17-00224 Enclosure EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/167614232 Page 0003 RA-17-00224 Enclosure EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/167614232 Page 0004 I RA-17-00224 Enclosure EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0005 RA-17-00224 Enclosure EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0006 RA-17-00224 Enclosure EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0007 RA-17-00224 Enclosure EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0008 RA-17-00224 Enclosure EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0009 RA-17-00224 Enclosure EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0010 RA-17--00224 Enclosure EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0011 RA-17-00224 Enclosure EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0012 RA-17-00224 Enclosure G-3 CERTIFICATION REQUIREMENTS AND MEANS OF COMPLIANCE When it is stated that compliance is shown through safety analysis, a reference to the appropriate section in this document will be made. For particular regulations, compliance may also be based on design, test or flight demonstrations, which are noted below but documented elsewhere. When appropriate, this section may point to another section of this document for sup portingda ta. Table G3-l Compliance Matrix 737 MAX Stabilizer Trim Control System CFR/ CS # CFR/CS Text Compliance liance 25.21(e) (e) Ifcompliance with the flight characteristics requirements is dependent upon a stability augmentation system or upon any other automatic or power-operated system, compliance must be shown with §25.671 and §25.672. 25.601 General 25.601 The airplane may not have design features or derails that experience has shown to be hazardous or unreliable. The suitability ofeach I questionable design detail and part must be established by tests. No self-locking nut may be used on any bolt subject to rotation during airplane operation. 25.611 Provisions 25.6 11(a) (a) Means must be provided to allow inspection (including inspection of principal structural elements and control systems). replacement of parts nonnally requiring replacement., adjustment, and lubrication as necessary for continued airworthiness. The inspection means for each item must be practicable for the inspection interval for the item. Nondestructive inspection aids may be used to inspect structural elements where it is impracticable to provide means for direct visual inspection ifit is shown that the inspection is effective and the inspection procedures are specified in the maintenance manual required by Sec. 25.1529. EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1 676/4232 Page 0013 RA-17-00224 Enclosure liance Matrix 737 MAX Stabilizer Trim Control S stem CFR/ CS# CFR/CS Text Compliance 25.655 25.655(b) (b) Ifan adjustable stabilizer is used, it must have stops that will limit its range oftravel to the maximum for which the airplane is shown to meet thetrim requirements of §25. 161. 25.671 General 14 CFR 25.671(a) (a) Each control and control system must operate with the ease, smoothness, and positiveness appropriate to its function . cs (a) Each control and control system must operate with 1he ease, smoothness, and positivenessappropri ate to its func tion. (See AMC 25 671 (a).) 14 CFR 25.671(b) (b)Each element ofea ch flight control system must be designed, or distinctively and permanently marked, to minimize the probability ofi ncorrect assembly that could result in the malfunctioning ofthe system. CS (b) Each element ofeach flight control systc,n must be designed, or distinctively and pennanently marked, to minimise the probability of incorrect assembly that could result in the malfunctioning ofthe system. (See AMC 25.671 (b).) EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0014 RA-17-00224 Enclosure Table G3-l Com liance Matrix 737 MAX Stabilizer Trim Control System CPR/ CS# CFR/CS Text 14CFR 25.671(c) (c) The airplane must be shown by analysis, tests, or both, to be capable ofcontinued safe flis),t and landing after any of the following failures or jamming in the flight control system and surfaces (including trim, lift. drag, aod feel systems). within the normal flight envelope, without requiring exceptional piloting skill or strength. Probable malfunctions must have only minor effectS on control system operation and must be capable of being readily counteracted by the pilot. (I) Any single failure, excludingjamming (for example, disconnection or failure ofmechanical elements, or SITUCtural failure of hydraulic components, such as actuators, control spool housing, and valves). (2) Any combination offailures 001 shown to be extremely improbable, excludingjamming (for example, dual electrical or bydrauuc system failures, or any single fuilure in combination with any probable hydraulic or electrical fuilure). (3) Any jam in a control position normally encountered during takeoff, climb, cruise, normal turns, descent, and landing unless the jam is shown to be extremely improbable, or can be alleviated. A runaway of a flight control to an adverse position and jam must be accounted for ifsuch runaway and subsequent jamming is not extremely improbable. cs (cXI) Any single failure not show11 to be extreme)y jmprobab)e, excludingjamming (for example, disconnection or fai lure of mechanical elements, or structural failure of hydraulic components, such as actuators, control spool housin& and valves). (See also AMC 25.671 (c)(I),) 25.671(d) (d) The airplane must be designed so that it is controUable ifall engines fail. Compliance with this requirement may be shown by analysis where that method has been shown to be reliable. entation and Automatic and Power If the functioning ofstability augmentation or other automatic or 25.672 power-operated systems is necessary to show oomplianee with the flight characteristics requirements ofthis part, such systems must comply with§ 25.671 aod the following: EXPORT CONTROLLED ECCN: 9E991 FAAFO!A 19-1943/1676/4232 Page 0015 RA-17-00224 Enclosure liance Matrix 737 MAX Stabilizer Trim Control S stem CFR/ CS# CFR/CS Text (a) A warning which is clearly distinguishable to the pilot under 25.672(a) expected flight conditions without requiring bis attention must be provided for any failure in the stability augmentationsystem or in any other automatic or power-operated system which could result in I an unsafe condition if the pilot were not aware of the failure. Warning systems must oot activate the control systems. (b) The design of the stability augmentation system or ofany other 25.672(b) automatic or power-operated system must permit initial counteraction of failures of the type specified in§ 25.67J(c) without requiring cxeeptional pilot skill or strength, by either the deactivation of the system, or a failed portion thereof,or by oveniding the failure by movement ofth e flight controls in the normal sense. 14 CFR 25.672(c) (c) It must be shown that after any single failure of the stability augmentation system or any other automatic or power-operated system- (!)The airplane is safely controllable when the failure or malfunction occurs at any speed or altin,de within the approved operating limitacions that is critical for the type of failure being considered; (2) The controllability and maneuverability requirements of this part arc met within a practical operational flight envelope (for example, speed, altitude, normal acceleration, and airplane. configurations) which is described in the Airplane Flight Manual; and (3)The trim, stability, and stall characteristics are not impaired below a level needed to pennit continued safe flight and landing. CS (c)(I) The aeroplane is safely controllable when the failure or malfunction occurs at any speed or altitude within the approved operating limitations that is critical for the type of failure being considered. (See AMC 25.672 (c)(1).) 25.675 (a) Each control system must have stops that positively limit the range 2S.67S(a) ofmotion ofeach movable aerodynamic surface controlled by the system. EXPORT CONTROLLED ECCN: 9E991 FAAFOIA 19-1943/1676/4232 Page 0016 RA-17-00224 Enclosure , I e I I Iiance Matrix 737 MAX Stabilizer Trim Control S stem CFR/ CS# C CFR/CS Text (b) Each stop must be located so that wear, slackness.