airplane by the use of trim controls or other means may be obtained, providing evidence shows that these means will enable the pilot to retain control.
Emergency Power. Loss of electrical power to critical functions following an uncontained rotor event should be minimized. The determination of electrical system criticality is dependent upon airplane operations. For example, airplanes approved for Extended Twin Engine Operations (ETOPS) that rely on alternate power sources such as hydraulic motor generators or APUs may be configured with the electrical wiring separated to the maximum extent possible within the one-third disc impact zone.
(3) Hydraulic Supply. Any essential hydraulic system supply that is routed within an impact area should have means to isolate the hydraulic supply required to maintain control of the airplane. The single one-third disc should not result in loss of all essential hydraulic systems or loss of all flight controls in any axis of the airplane.
(4) Thrust reverser systems. The effect of an uncontained rotor failure on inadvertent in-flight deployment of each thrust reverser and possible loss of airplane control shall The impact area for components located on the failed engine may be different from the impact area defined in Paragraph 6. If uncontained failure could cause thrust reverser deployment, the engine manufacturer should be consulted to establish the failure model to be considered. One acceptable method of minimization is to locate reverser restraints such that not
d. Passenger and Crew Incapacitation
(1) Pilot Compartment. The pilot compartment of transport category airplanes should not be located within the +15 degree spread angle of any engine rotor stage or APU rotor stage that has not been qualified as contained, unless adequate shielding, deflectors or equivalent protection is provided for the rotor stage in accordance with Paragraph 7c. Due to design constraints inherent in smaller Par 25 airplanes it is not considered practical to locate the pilot compartment outside the +15 degree spread angle. Therefore, for other airplanes (such as new part 23 commuter category airplanes) the pilot compartment area should not be located within the +5 degree spread angle of any engine rotor stage or APU rotor stage unless adequate shielding, deflectors, or equivalent protection is provided for the rotor stage in accordance with Paragraph 7c of this AC, except for the following:
(1) For derivative part 23 category airplanes where the engine location has been previously established, the engine location in relation to the pilot compartment need not be changed.
Par 8 13
(ii) For noncommuter part 23 category airplanes, satisfactory service experience relative to rotor integrity and containment in similar engine installations may be considered in assessing the acceptability of installing engines in line with the pilot compartment.
(111) For noncommuter new part 23 category airplanes, where due to size and/or design considerations the #5 degree spread angle cannot be adhered to, the pilot compartment/engine location should be analyzed and accepted in accordance with Paragraphs 9 and 10.
Pressure Vessel. For airplanes that are certificated for operation above 41,000 feet, the engines should be located such that the pressure cabin cannot be affected by uncontained debris. Alternatively, it may be shown that rapid decompression due to the maximum hole size caused by debris and the associated cabin pressure decay rate will allow an emergency descent without incapacitation of the flightcrew or passengers. A pilot reaction time of 17 seconds for initiation of the emergency decent has been accepted. Where the pressure cabin could be affected by a one-third disc or intermediate fragments, design precautions should be taken to preclude incapacitation of crew and passengers. Examples of design precautions that have been previously accepted are:
(1) Provisions for a second pressure or bleed down bulkhead outside the impact area of a one-third or intermediate disc fragment.
(il) The affected compartment in between the primary and secondary bulkhead was made inaccessible, by operating limitations, above the minimum altitude where incapacitation could occur due to the above hole size.
(iii) Air supply ducts running through this compartment were provided with nonreturn valves to prevent pressure cabin leakage through damaged ducts.
NOTE: If a bleed down bulkhead is used it should be shown that the rate of pressure decay and minimum achieved cabin pressure would not incapacitate the crew, and the rate of pressure decay would not preclude a safe emergency descent. Further guidance regarding compliance with the high altitude operations requirements is provided in AC 25-20, "Pressurization, Ventilation and Oxygen Systems Assessment for Subsonic Flight Including High Altitude Operations."
e. Structural Integrity. Installation of tear straps and shear ties within the uncontained fan blade and engine rotor debris zone to prevent catastrophic structural damage has been utilized to address this threat.
ENGINE AND APU FAILURE MODEL. The safety analysis recommended in Paragraph 10 should be made using the following engine and APU failure model, unless for the particular 14 Par 8
engine/APU type concerned, relevant service experience, design data, test results or other evidence justify the use of a different model.
a. Single One-Third Disc fragment. It should be assumed that the one-third disc fragment has the maximum dimension corresponding to one-third of the disc with one-third blade height and a fragment spread angle of + 3 degrees. Where energy considerations are relevant, the mass should be assumed to be one-third of the bladed disc mass and its energy, the translational energy (i.e., neglecting rotational energy) of the sector traveling at the speed of its c.g. location as defined in Figure 3.
b. Intermediate Fragment. It should be assumed that the intermediate fragment has a maximum dimension corresponding to one-third of the bladed disc radius and a fragment spread angle of + 5 degrees. Where energy considerations are relevant, the mass should be assumed to be 1/30 of the bladed disc mass and its energy the transitional energy (neglecting rotational energy) of the piece traveling at rim speed (see Figure 4).
Par 9 15
AC 20-128A 3/25/97
MAXIMUM DIMENSION 13 b 120° Where R = disc radius b = blade length The CG is taken to lie on the maximum dimension as shown.
FIGURE 3 - SINGLE ONE-THIRD ROTOR FRAGMENT /⅓ (R + bl Where R = disc radius b blade length Maximum dimension = · (R + b) Mass assumed to be oth of bladed disc CG is taken to lie on the disc rim FIGURE 4 - INTERMEDIATE FRAGMENT 16 Par 9
Alternative Engine Failure Model. For the purpose of the analysis, as an alternative to the engine failure model of Paragraphs 9a and b, the use of a single one-third piece of disc having a fragment spread angle * 5° would be acceptable, provided the objectives of Paragraph 10a are satisfied
d. Small Fragments. It should be assumed that small fragments (shrapnel) range in size up to a maximum dimension corresponding to the tip half of the blade airfoil (with exception of fan blades) and a fragment spread angle of 15 degrees. Service history has shown that aluminum lower wing skins, pylons, and pressure cabin skin and equivalent structures typically resist penetration from all but one of the most energetic of these fragments. The effects of multiple small fragments should also be considered. Penetration of less significant structures such as fairings, empennage, control surfaces and unpressurized skin has typically occurred at the rate of 2 1/2 percent of the number of blades of the failed rotor stage. Refer to paragraph 7b and 7c for methods of minimization of the hazards. Where the applicant wishes to show compliance by considering the energy required for penetration of structure (or shielding) the engine manufacturer should be consulted for guidance as to the size and energy of small fragments within the impact area.
For APUs, where energy considerations are relevant, it should be assumed that the mass will correspond to the above fragment dimensions and that it has a translational energy level of one percent of the total rotational energy of the original rotor stage.
e. Fan Blade Fragment. It should be assumed that the fan blade fragment has a maximum dimension corresponding to the blade tip with one-third the blade airfoil height and a fragment spread angle of + 15°. Where energy considerations are relevant the mass should be assumed to be corresponding to the one-third of the airfoil including any part span shroud and the transitional energy (neglecting rotational energy) of the fragment traveling at the speed of its c.g.
location as defined in Figure 5. As an alternative, the engine manufacturer may be consulted for guidance as to the size and energy of the fragment.
Par 9 17
Geometric Center of Gravity 1/3 X Where X = Airfoil Length (less blade root & platform) CG is taken to lie at the centerline of the 1/3 fragment Fragment velocity taken at geometric CG Fragment mass assumed to be 1/3 of the airfoil mass FIGURE 5 = FAN BLADE FRAGMENT DEFINITION 18 Par 9
f. Critical Engine Speed. Where energy considerations are relevant, the uncontained rotor event should be assumed to occur at the engine or APU shaft red line speed.
APU Failure Model. For all APU's, the installer also needs to address any hazard to the airplane associated with APU debris (up to and including a complete rotor where applicable) exiting the tailpipe. Paragraphs 9g(1) or (2) below or applicable service history provided by the APU manufacturer may be used to define the size, mass, and energy of debris exiting that tailpipe. The APU rotor failure model applicable for a particular APU installation is dependent upon the provisions of the Technical Standard Orders (TSO) that were utilized for receiving approval:
(1) For APU's where rotor integrity has been demonstrated in accordance with TSO C77a/JAR APU, i.e. without specific containment testing, Paragraphs 9a, b, and d, or Paragraphs 9c and 9d apply.
(2) For APU rotor stages qualified as contained in accordance with the TSO, historical data shows that in-service uncontained failures have occurred. These failure modes have included bi-hub, overspeed, and fragments missing the containment ring which are not addressed by the TSO containment test. In order to address these hazards, the installer should use the APU small fragment definition of Paragraph 9d or substantiated in-service data supplied by the APU manufacturer.
10. SAFETY ANALYSIS The numerical assessment requested in paragraph 10 (c)(3) is derived from methods previously prescribed in ACJ 25.903. The hazard ratios provided are based upon evaluation of various configurations of transport category airplanes, made over a period of time, incorporating practical methods of minimizing the hazard to the airplane from uncontained engine debris.
a. Analysis. An analysis should be made using the engine/APU model defined in Paragraph 9 to determine the critical areas of the airplane likely to be damaged by rotor debris and to evaluate the consequences of an uncontained failure. This analysis should be conducted in relation to all normal phases of flight, or portions thereof.
(1) A delay of at least 15 seconds should be assumed before start of the emergency engine shut down. The extent of the delay is dependent upon circumstances resulting from the uncontained failure including increased flightcrew workload stemming from multiplicity of warnings which require analysis by the flightcrew.
(2) Some degradation of the flight characteristics of the airplane or operation of a system is permissible, provided the airplane is capable of continued safe flight and landing.
Par 9 19
Account should be taken of the behavior of the airplane under asymmetrical engine thrust or power conditions together with any possible damage to the flight control system, and of the predicted airplane recovery maneuver.
(3) When considering how or whether to mitigate any potential hazard identified by the model, credit may be given to flight phase, service experience, or other data, as noted in Paragraph 7.
b. Drawings. Drawings should be provided to define the uncontained rotor impact threat relative to the areas of design consideration defined in Paragraphs 7a(1) through (10) showing the trajectory paths of engine and APU debris relative to critical areas. The analysis should include at least the following:
() Damage to primary structure including the pressure cabin, engine/APU mountings and airframe surfaces.
NOTE: Any structural damage resulting from uncontained rotor debris should be considered catastrophic unless the residual strength and flutter criteria of AC 25.571, Paragraph 8(c), can be met without failure of any part of the structure essential for completion of the flight. In addition, the pressurized compartment loads of & 25.365(e)(1) and (g) must be met.
(2) Damage to any other engines (the consequences of subsequent uncontained debris from the other engine(s), need not be considered).
(G) Damage to services and equipment essential for safe flight and landing (including indicating and monitoring systems), particularly control systems for flight, engine power, engine fuel supply and shut-off means and fire indication and extinguishing systems.
(4) Pilot incapacitance, (see also paragraph 8 d(1)).
(5) Penetration of the fuel system, where this could result in the release of fuel into personnel compartments or an engine compartment or other regions of the airplane where this could lead to a fire or explosion.
(G) Damage to the fuel system, especially tanks, resulting in the release of a large quantity of fuel.
(7) Penetration and distortion of firewalls and cowling permitting a spread of fire.
20 Par 10
(8) Damage to or inadvertent movement of aerodynamic surfaces (e.g.. flaps, slats, stabilizers, ailerons, spoilers, thrust reversers, elevators, rudders, strakes, winglets, etc.) and the resultant effect on safe flight and landing.
C. Safety Analysis Objectives. It is considered that the objective of minimizing hazards will have been met if:
(1) The practical design considerations and precautions of Paragraphs 7 and 8 have been taken;
(2) The safety analysis has been completed using the engine/APU model defined in Paragraph 9;
(3) For part 25 transport and part 23 commuter category airplanes, the following hazard ratio guidelines have been achieved:
(1) Single One-Third Disc Fragment. There is not more than a 1 in 20 chance of catastrophe resulting from the release of a single one-third disc fragment as defined in Paragraph 9a.
Intermediate Fragment. There is not more than a 1 in 40 chance of catastrophe resulting from the release of a piece of debris as defined in Paragraph 9.
(111) Multiple Disc Fragments. (Only applicable to any duplicated or multiplicated system when all of the system channels contributing to its functions have some part which is within a distance equal to the diameter of the largest bladed rotor, measured from the engine centerline). There is not more than 1 in 10 chance of catastrophe resulting from the release in three random directions of three one-third fragments of a disc each having a uniform probability of ejection over the 360° (assuming an angular spread of +3° relative to the plane of the disc) causing coincidental damage to systems which are duplicated or multiplicated.
NOTE: Where dissimilar systems can be used to carry out the same function (e.g. elevator control and pitch trim), they should be regarded as duplicated (or multiplicated) systems for the purpose of this subparagraph provided control can be maintained. The numerical assessments described above may be used to judge the relative values of minimization. The degree of minimization that is feasible may vary depending upon airplane size and configuration and this variation may prevent the specific hazard ratio from being achieved. These levels are design goals and should not be treated as absolute targets. It is possible that any one of these levels may not be practical to achieve.
Par 10 21
(4) For newly designed non-commuter part 23 airplanes the chance of catastrophe is not more than twice that of Paragraph 10c(3)(i), (ii) and (iii) for each of these fragment types.
(5) A numerical risk assessment is not requested for the single fan blade fragment, small fragments, and APU and engine rotor stages which are qualified as contained
d. APU Analysis For APU's that are located where no hazardous consequences would result from an uncontained failure, a limited qualitative assessment showing the relative location of critical systems/components and APU impact areas is all that is needed. If critical systems/components are located within the impact area, more extensive analysis is needed. For APU's which have demonstrated rotor integrity only, the failure model outlined in Paragraph 9g(1) should be considered as a basis for this safety assessment. For APU rotor stages qualified as contained per the TSO, the airplane safety analysis may be limited to an assessment of the effects of the failure model outlined in Paragraph 9g(2).
e. Specific Risk The airplane risk levels specified in Paragraph 10c, resulting from the release of rotor fragments, are the mean values obtained by averaging those for all rotor on all engines of the airplane, assuming a typical flight. Individual rotors or engines need not meet these risk levels nor need these risk levels be met for each phase of flight if either--
(1) No rotor stage shows a higher level of risk averaged throughout the flight greater than twice those stated in Paragraph 10c.
NOTE: The purpose of this Paragraph is to ensure that a fault which results in repeated failures of any particular rotor stage design, would have only a limited effect on airplane safety.
22 Par 10
Average of UK and US Data (1966-76)* 35 * SAE data for the period 1962 to 1989 35 shows a similar distribution.
30 25 * OF INCIDENTS 15 Take-off before V1 V1 to first Power Climb Cruise Approach Descent Landing/Reverse Reduction
PHASE OF FLIGHT FIGURE 6 - ALL NON-CONTAINMENTS BY PHASE OF FLIGHT Par 10 23
AC 20-128A •3/25/97
(2) Where failures would be catastrophic in particular portions of flight, allowance is made for this on the basis of conservative assumptions as to the proportion of failures likely to occur in these phases. A greater level of risk could be accepted if the exposure exists only during a particular phase of flight e.g., during takeoff. The proportional risk of engine failure during the particular phases of flight is given in SAE Papers referenced in Paragraph 4d. See also data contained in the CAA paper "Engine Non-Containments - The CAA View", which includes Figure 6. This paper is published in NASA Report CP-2017, "An Assessment of Technology for Turbo-jet Engine Rotor Failures", dated August 1977.
ohn K. McGrath Manager, Aircraft Engineering Division, AIR-100 24 Par 10