us.Deportmenl ot Tronsportotion Federal Aviation Admlnlslrallo.i Advisory Circular su1,Jed?ES1GN CONSIDERATIONS FOR Date: 3/25/97MINIMIZING HAZARDS CAUSED BY Initiated by: ANM-l lO
UNCONT AINED TURBINE ENGINE AND
AUXILIARY POWER UNIT ROTOR
FAILURE
1. PURPOSE. This advisory circular (AC) sets forth a method of compliance with the requirements of§§ 23.901(±), 23.903(b)(l), 25.901(d) and 25.903(d)(l) of the Federal Aviation Regulations (FAR) pertaining to design precautions taken to minimize the hazards to an airplane in the event of uncontained engine or auxiliary power unit (APU) rotor failures. The guidance provided within this AC is harmoni zed with that of the European Joint Aviation Authorities (JAA) and is intended to provide a method of compliance that has been found acceptable . As with all AC material, it is not mandatory and does not constitute a regulation.
2. CANCELLATION. Advisory Circular 20-128, "Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor and Fan Blade Failures," dated March 9, 1988, is canceled .
3. APPLICABILITY. This AC applies to part 23 and part 25 airplanes (and airplanes typecertificated under predecessor parts 3 and 4b of the Civil Air Regulations) for which a new, amended, or supplemental type certificate is<;,.;quested.
4. RELATED DOCUMENTS. Sections 23.903, and 25.903 of the FAR, as amended through Amendments 23-43 and 25-73 respectively, and other sections relating to uncontained engine failures .
NOTE: APPENDIX 1 provides additional guidance for completion of the nwnerical analysis requested in Paragraph 10 of this AC.
a. Related Federal Aviation Regulations. Sections which prescribe requirements for the design , substantiat ion and certification relating to uncontained engine debri s include:
§ 23.863, 25.863 Flammab le fluid fire protection § 25.365 Pressurized compartment loads § 25.571 Damage -tolerance and fatigue evaluation of structure FAA Form 1320-15 (4-82 ) Supersedes WA Form 132~2
3/25/97AC 20-128A § 25.963 Fuel tanks : general § 25.1189 Shutoff means § 25.1461 Equipment containing high energy rotors (Note: An APU does not have its own type certificate and has been considered "equipment " installed on an airplane. As such, the provisions of § 25.1461 have occasionally been used in the approval of APU installations regardless of protection from high energy rotor disintegration. However, the more specific requirements of§ 25.903(d)(l) and associated guidance described within this AC take precedence over the requirements of§ 25.1461.)
b. Advisory Circulars (AC).
AC 25-8 Auxiliary Fuel System Installations AC 25-20 Pressurization, Ventilation and Oxygen Systems Assessment for Subsonic Flight Including High Altitude Operations AC 23-10 Auxiliary Fuel System Installations AC 20-135 Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria ( or the equivalent International Standard Order (ISO) 2685) AC 25-571-lA Damage Tolerance and Fatigue Evaluat ion of Structure Advisory Circulars can be obtained from the U.S. Department of Transportation, M-443.2, Subsequent Distribution Unit, Washington, D.C. 20590.
c. Technical Standard Orders (TSO).
TSO C77a Gas Turbine Auxiliary Power Units (orJARAPU) 2 Par 4
Technical Standard Orders can be obtained from the Federal Aviation Administration (FAA), Aircraft Certification Service, Aircraft Enginee ring Division, Technical Analysis Branch (AIR
120), 800 Independence Ave. S.W., Washington, DC, 205921.
d. Society of Automotive En~ineers (SAE) Documents.
AIR1537 Report on Aircraft Engine Containment, dated October, 1977.
AIR4003 Uncontained Turbine Rotor Events Data Period 1976 through 1983.
AIR4770 Uncontained Turbine Rotor Events Data Period 1984 (Draft) through 1989.
These documents can be obtained from the Society of Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale, Pennsylvania, 15096.
5. BACKGROUND. Although turbine engine and APU manufacturers are making efforts to reduce the probability of uncontained rotor failures, service experience shows that uncontained compressor and turbine rotor failures continue to occur. Turbine engine failures have resulted in high velocity fragment penetration of adjacent structures, fuel tanks, fuselage , system components and other engines on the airplane. While APU uncontained rotor failures do occur, and to date the impact damage to the airplane has been minimal, some rotor failures do produce fragments that should be considered . Since it is unlikely that uncontained rotor failures can be completely eliminated, parts 23 and 25 require that airplane design precauti ons be taken to minimize the hazard from such events.
a. Uncontained ~as turbine en~ine rotor failure statistics are presented in the Society of Automotive Engineers (SAE) reports covering time periods and number of uncontained events listed in the table shown below. The following statistics summarize 28 years of service experience for fixed wing airplanes and do not include data for rotorcraft and APU's:
NQ, Qf Ev~nts RegottNo, fe1fod Iotal Cate2oa 3 Cate~oa 4 AIR1537 AIR4003 AIR4770 (Draft) TOTAL 1962-75 1976-83 1984-89 275 237 164 676 44 27 22 93 5 3 7 15 Par 4 3
The total of 676 uncontained events includes 93 events classified in Category 3 and 15 events classified in Category 4 damage to the airplane . Category 3 damage is defined as significant airplane damage with the airplane capable of continuing flight and making a safe landing . Category 4 damage is defined as severe airplane damage involving a crash landing, critical injuries, fatalities or hull loss.
During this 28 year period there were 1,089.6 million engine operating hours on commercial transports. The events were caused by a wide variety of influences classed as environmental (bird ingestion, corrosion/erosion, foreign object damage (FOD)), manufacturing and material defect s, mechanical, and human factors (mainte nance and overhaul, inspection error and operational procedures).
b. Uncontained APU rotor failure statistics covering 1962 through 1993 indicate that there have been several uncontained failures in at least 250 million hours of operation on transport category airplanes. No Category 3 or 4 events were reported and all failures occurred during ground operation. These events were caused by a wide variety of influences such as corrosion, ingestion of deicing fluid, manufacturing and material defects, mechanical, and human factors (maintenance and overhaul, inspection error and operational procedures).
c. The statistics in the SAE studies indicate the existence of many different causes of failures not readily apparent or predictable by failure analysis methods. Because of the variety of causes of uncontained rotor failures, it is difficult to anticipate all possible causes of failure and to provide protection to all areas. However, design considerations outlined in this AC provide guidelines for achieving the desired objective of minimizing the hazard to an airplane from uncontained rotor failures. These guidelines, therefore, assume a rotor failure will occur and that analysis of the effects of this failure is necessary. These guidelines are based on service experience and tests but are not necessarily the only means available to the designer.
6. DEFINITIONS.
a. E.Q.tQr. Rotor mean s the rotating components of the engine and APU that analysis, test, and/or experience has shown can be released during uncontained failure. The engine or APU manufacturer shou ld define those components that constitute the rotor for each engine and APU type design . Typically rotors have included, as a minimum, disks, hubs, drums, seals, impellers , blades and spacers.
b. Blade. The airfoil sectio ns (excludin g platform and root) of the fan, compressor and turbine.
Par5 4
'3/25/97 AC 20-I28A
c. Uncontained Failure. For the purpose of airplane evaluations in accordance with this AC, uncontained failure of a turbine engine is any failure which results in the escape of rotor fragments from the engine or APU that could result in a hazard. Rotor failures which are of concern are those where released fragments have sufficient energy to create a hazard to the airplane.
d. Critical Component. A critical component is any component whose failure would contribute to or cause a failure condition which would prevent the continued safe flight and landing of the airplane. These components should be considered on an individual basis and in relation to other components which could be damaged by the same fragment or by other fragments from the same uncontained event.
e. Continued Safe Flight and Landin2. Continued safe flight and landing means that the airplane is capable of continued controlled flight and landing, possibly using emergency procedures and without exceptional pilot skill or strength, with conditions of considerably increased flightcrew workload and degraded flight characteristics of the airplane.
f. Fra2ment Spread Angle. The fragment spread angle is the angle measured, fore and aft from the center of the plane of rotation of an individual rotor stage , initiating at the engine or APU shaft centerline (see Figure 1).
Par 6 5
AC 20-128A
FANBLADE I
FRAGMENTS ---I ~::"~/ ::--] \ \ I f \ ,I V"'l' \ I FIGURE 1- ESTIMATED PATH OF FRAGMENTS 6 3/25/97 1I3RDDlSK
FRAGMENT (sec figure3)
INTERMEDIATE
FRAGMENT (see figure4)
SMALL FRAGMENTS (sec paragraph 9(d»
FRAGMENT SPREAD ANGLE IS THE ANGLE MEASURED, fORE AND AFT, FROM THE CENn:R or THE PLANE or ROTATION
INITIATING AT THE ENGINE OR APU SHAFT CENTERUNE.
Par 6 ~
g. Impact Area. The impact area is that area of the airplane likely to be impacted by uncontained fragments generated during a rotor failure (see Paragraph 9).
h. Eniine and APU Failure Model. A model describing the size, mass, spread angle, energy level and number of engine or APU rotor fragments to be considered when analyzing the airplane design is presented in Paragraph 9.
7. DESIGN CONSIDERATIONS. Practical design precautions should be used to minimize the damage that can be caused by uncontained engine and APU rotor fragments . The most effective methods for minimizing the hazards from uncontained rotor fragments include location of critical components outside the fragment impact areas or separation, isolation, redundancy, and shielding of critical airplane components and/or systems. The following design considerations are recommended:
a. Consider the location of the eniiue and APU rotors relative to critical components, systems or areas of the airplane such as:
(1) Any other engine(s) or an APU that provides an essential function;
(2) Pressurized sections of the fuselage and other primary structure of the fuselage, wings and empennage;
(3) Pilot compartment areas;
(4) Fuel system components, piping and tanks ;
(5) Control systems , such as primary and secondary flight controls, electrical power cables, wiring, hydraulic systems, engine control systems, flammable fluid shut-off valves, and the associated actuation wiring or cables;
(6) Any fire extinguisher system of a cargo compartment, an APU, or another engine including electrical wiring and fire extinguishing agent plumbing to these systems;
(7) Engine air inlet attachments and effects of engine case deformations caused by fan blade debris resulting in attachment failures;
(8) Instrumentation essential for continued safe flight and landin g;
(9) Thrust rever ser systems where inadvertent deployment could be catastrophic ; and Par6 7
(10) Oxygen systems for high altitude airplanes , where these are critical due to descent time .
b. Location of Critical Systems and Components. Critical airplane flight and engine control cables, wiring , flammable fluid carrying components and lines (including vent lines), hydraulic fluid lines and components, and pneumatic ducts should be located to minimize hazards caused by uncontained rotors and fan blade debris. The following design practices should be considered :
(1) Locate, if possible, critical components or systems outside the likely debris impact areas.
(2) Duplicate and separate critical components or systems, or provide suitable protection if located in debris impact areas.
(3) Protection of critical systems and components can be provided by using airframe structure or supplemental shielding.
These methods have been effective in mitigating the hazards from both sing le and multiple small fragments within the± 15 degree impact area. Separation of multiplicated critical systems and components by at least a distance equal to the 1/2 blade fragment dimension has been accepted for showing minimization from a single high energy small fragment when at least one of the related multiplicated critical components is shielded by significant structure such as aluminum lower wing skins, pylons , aluminum skin of the cabin pressure vessel, or equivalent structures.
Multiplicated critical systems and components positioned behind less significant structures should be separated by at least a distance equal to the 1/2 blade fragment dimension, and at least one of the multiplicated critical systems should be:
(i) Located such that equivalent protection is provided by other inherent structures such as pneumatic ducting, interiors, bulkheads , stringers, or
(ii) Protected by an additional shield such that the airframe structure and shield material provide equivalent shielding.
(4) Locate fluid shutoffs and actuation means so that flammable fluid can be isolated in the event of damage to the system.
Par 7 8
(5) Minimize the flammable fluid spillage which could contact an igni tion source.
(6) For airframe structural elements, provide redundant designs or crack stoppers to limit the subsequent tearing which could be caused by uncontain ed rotor fragments.
(7) Locate fuel tanks and other flammable fluid systems and route lines (including vent lines) behind airplane structure to reduce the hazards from spilled fuel or from tank penetrations. Fuel tank explosion-suppression materials, protective shields or deflectors on the fluid lines , have been used to minimize the damage and hazards.
c. External Shields and Deflectors. When shields, defle ction devices or airplane structure are proposed to be used to protect critical systems or components, the adequacy of the protection, including mounting points to the airframe structure, should be shown by testing or validated analyse s supported by test data , using the fragment energie s supplied by the engine or APU manufacturer or those defined in Paragraph 9. For protection against engine small :fragments, as defined in Paragraph 9, no quantitative validation as defined in Paragraph 10 is required if equivalency to the penetrati on resistant structures listed (e.g. pressure cabin skins, etc.) is shown.
8. ACCEPTED DESIGN PRECAUTIONS. Design practices currently in use by the aviation industry that have been shown to reduce the overall risk, by effectively elimina ting certain specific risks and reducing the remaining specific risks to a minimum level, are described within this paragraph of the AC. Airplane designs submitted for evaluation by the regulato ry authorities will be evaluated against these proven design practice s.
a. Uncontrolled Fire.
( 1) Fire Extin~ishin~ Systems. The engine / APU fire extinguishing systems currently in use rely on a fire zone with a fixed compartment air volume and a known air exchange rate to extinguish a fire. The effectiveness of this type of system along with firewal l integrity may therefo re be compromised for the torn/ruptured compartm ent of the failed engine /APU . Protection of the airplane following this type of failure relie s on the funct ion of the fire warning system and subsequent fire switch activation to isolate the engine/APU from airframe flammable fluid (fuel and hydraulic fluid) and external igniti on sources (pneumatic and electrical). Fire extingui shing protection of such a compromised system may not be effective due to the extent of dama ge. Continued function of any other engine, APU or cargo compartm ent fire warning and extinguisher system, i ncludin g electrical wirin g and fire extinguishing agent plumbing, should be considered as describe d in Paragraph 7.
Par 7 9
(2) Flammable Fluid ShutoffValve. As discussed above, shutoff of flammable fluid supply to the engine may be the only effective means to extinguish a fire following an uncontained failure, therefore the engine isolation/flammable fluid shutoff function should be assured following an uncontained rotor failure. Flammable fluid shutoff valves should be located outside the uncontained rotor impact area. Shutoff actuation controls that need to be routed through the impact area should be redundant and appropriately separated in relation to the one-third disc maximum dimension.
(3) Fire Protection ofCritical Functions. Flammable fluid shutoff and other critical controls should be located so that a fire (caused by an uncontained rotor event) will not prevent actuation of the shutoff function or loss of critical airplane functions. If shutoff or other critical controls are located where a fire is possible following an uncontained rotor failure (e.g. in compartments adjacent to fuel tanks) then these items should meet the applicable foe protection guidelines such as AC 20-135, "Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria" or the equivalent International Standard Order (ISO) 2685.
(4) Fuel Tanks. If fuel tanks are located in impact areas, the following precautions should be implemented:
(i) Protection from the effects of fuel leakage should be provided for any fuel tanks located above an engine or APU and within the one-third disc and intermediate fragment impact areas. Dry bays or shielding are acceptable means. The dry bay should be sized based on analysis of possible fragment trajectories through the fuel tank wall and the subsequent fuel leakage from the damaged fuel tank so that fuel will not migrate to an engine, APU or other ignition source during either in flight or ground operatio n. A minimum drip clearance distance of 10 inches from potential ignition sources of the engine nacelle, for static conditions, is acceptable (see Figure 2).
10 Par 8
3/25/97 AC20-128A
MINIMUM , ,
PLAN VIEW A 2 /
INTEGRAL
FUELTANK/ ~ '-~7~ ~LlADIl'fC EDCE 1• Lo••er WlDl SkiD PeaetnltioD
1. Fael Taakw.n Penetration \ \ ) ncnoNA-A et#===I • Mile Depends ODWine Skbllmpact Restslance (5 t.15DOlrees) SEcrIOf"f 8-.
ParS FIGURE 2- DRY BAY SIZING DETERMINATION EXAMPLE --- 11
AC20-l28A 3/25/97
(ii) Fueltankpenetration leakpaths shouldbedetermined and evaluated forhazardsduringflightandgroundphasesofoperation. Iffuelspillsintothe airstreamaway fromtheairplanenoadditionalprotection isneeded. Additional protection should beconsidered iffuelcouldspill,drainormigrateintoareashousing ignition sources,such asengineorAPU inletsorwheelwells. Damagetoadjacentsystems, wiringetc.,shouldbe evaluatedregardingthepotentialthatanuncontained fragmentwillcreatebothanignition source andfuelsource. Wheelbrakesmaybeconsideredasanignition sourceduringtakeoffandinitial climb. Protectionofthewheelwellsmaybeprovidedbyairflowdischarging fromgapsor openings,preventing entryoffuel,aventilationrateprecluding acombustible mixtureorother provisions indicatedin 23.863and25.863.
(iii) Areasoftheairplanewhereflammable fluidmigration ispossible thatarenotdrainedandventedandhaveignitionsourcesorpotential ignition sourcesshouldbe provided withameansoffiredetectionandsuppressionandbeexplosionvented orequivalently protected.
b. LossofThrust.
(I) FuelReserves Thefuelreservesshouldbeisolatable suchthatdamage fromadiscfragmentwillnotresultinlossoffuelrequiredtocompletetheflightorasafe diversion. Theeffectsoffuelloss,andtheresultantshiftofcenterofgravityorlateral imbalance onairplane controllability shouldalsobeconsidered.
(2) Encine Controls Enginecontrolcablesand/orwiring fortheremaining powerplants thatpassthroughtheimpactareashouldbeseparatedbyadistance equaltothe maximum dimension ofaone-thirddiscfragmentorthemaximum extentpossible.
(3) Other EncineDamace. Protectionofanyotherengines fromsome fragments shouldbeprovidedbylocatingcriticalcomponents, suchasengine accessories essential forpropercngineoperation (e.g.,highpressurefuellines,enginecontrols andwiring, etc.),inareaswhereinherentshieldingisprovidedbythefuselage,engine ornacelle(including thrustreverser)structure (seeParagraph7).
c. LossofAirplaneControl.
(I) F1icht Controls Elementsoftheflightcontrolsystemshould be adequately separatedorprotectedsothatthereleaseofasingleone-third discfragment willnot causelossofcontroloftheairplaneinanyaxis. Whereprimary flightcontrols haveduplicated (ormultiplicated) elements,theseelementsshouldbelocatedtoprevent allelements inanyaxis beinglostasaresultofthesingleone-thirddiscfragment. Creditformaintaining controlofthe 12 Par 8 ~~