5.2.1 The probability of total failure of all
directional control systems should be extremely remote when the craft
is operating normally, i.e., excluding emergency situations such as
grounding, collision or a major fire.
5.2.2 A design incorporating a power drive or
an actuation system employing powered components for normal directional
control should provide a secondary means of actuating the device unless
an alternative system is provided.
5.2.3 The secondary means of actuating the directional
control device may be manually driven when the Administration is satisfied
that this is adequate, bearing in mind the craft's size and design
and any limitations of speed or other parameters that may be necessary.
5.2.4 The directional control systems should be
constructed so that a single failure in one drive or system, as appropriate,
will not render any other one inoperable or unable to bring the craft
to a safe situation. The Administration may allow a short period of
time to permit the connection of a secondary control device when the
design of the craft is such that such delay will not, in their opinion,
hazard the craft.
5.2.5 A failure mode and effect analysis should
include the directional control system.
5.2.6 If necessary to bring the craft to a safe
condition, power drives for directional control devices, including
those required to direct thrust forward or astern, should become operative
automatically, and respond correctly, within 5 s of power or other
failure. Back-up electrical systems may be required for the starting-up
time of an auxiliary diesel according to 12.2 or
an emergency diesel generator according to 12.3.6.
5.2.7 Directional control devices involving variable
geometry of the craft or its lift system components should, so far
as is practicable, be so constructed that any failure of the drive
linkage or actuating system will not significantly hazard the craft.