Advisory U.S. Department of Transportation Circular Federal Aviation Administration SubjecD ESIGN CONSIDERATIONS FOR Date: 3/25/97 AC No20-128A MINIMIZING HAZARDS CAUSED BY Initiated by: ANM-110 Change:
UNCONTAINED TURBINE ENGINE AND
AUXILIARY POWER UNIT ROTOR
FAILURE
1. PURPOSE. This advisory circular (AC) sets forth a method of compliance with the requirements of §§ 23.901(f), 23.903(b)(1), 25.901(d) and 25.903(d)(1) of the Federal Aviation Regulations (FAR) pertaining to design precautions taken to minimize the hazards to an airplane in the event of uncontained engine or auxiliary power unit (APU) rotor failures. The guidance provided within this AC is harmonized with that of the European Joint Aviation Authorities (JAA) and is intended to provide a method of compliance that has been found acceptable. As with all AC material, it is not mandatory and does not constitute a regulation.
2. CANCELLATION. Advisory Circular 20-128, "Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor and Fan Blade Failures," dated March 9, 1988, is canceled.
3. APPLICABILITY. This AC applies to part 23 and part 25 airplanes (and airplanes typecertificated under predecessor parts 3 and 4b of the Civil Air Regulations) for which a new, amended, or supplemental type certificate is S quested.
4. RELATED DOCUMENTS. Sections 23.903, and 25.903 of the FAR, as amended through Amendments 23-43 and 25-73 respectively, and other sections relating to uncontained engine failures.
NOTE: APPENDIX 1 provides additional guidance for completion of the numerical analysis requested in Paragraph 10 of this AC.
a. Related Federal Aviation Regulations. Sections which prescribe requirements for the design, substantiation and certification relating to uncontained engine debris include:
8 23.863, 25.863 Flammable fluid fire protection § 25.365 Pressurized compartment loads § 25.571 Damage-tolerance and fatigue evaluation of structure FAA Form 1320-15 (4-82) Supersedes WA Form 1320-2
$ 25.963 Fuel tanks: general § 25.1189 Shutoff means § 25.1461 Equipment containing high energy rotors (Note: An APU does not have its own type certificate and has been considered "equipment" installed on an airplane. As such, the provisions of § 25.1461 have occasionally been used in the approval of APU installations regardless of protection from high energy rotor disintegration. However, the more specific requirements of § 25.903(d)(1) and associated guidance described within this AC take precedence over the requirements of § 25.1461.)
Advisory Circulars (AC).
AC 25-8 Auxiliary Fuel System Installations AC 25-20 Pressurization, Ventilation and Oxygen Systems Assessment for Subsonic Flight Including High Altitude Operations AC 23-10 Auxiliary Fuel System Installations AC 20-135 Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria (or the equivalent International Standard Order (ISO) 2685) AC 25-571-1A Damage Tolerance and Fatigue Evaluation of Structure Advisory Circulars can be obtained from the U.S. Department of Transportation, M-443.2, Subsequent Distribution Unit, Washington, D.C. 20590.
c. Technical Standard Orders (TSO).
TSO C77a Gas Turbine Auxiliary Power Units (or JAR APU) 2 Par 4
Technical Standard Orders can be obtained from the Federal Aviation Administration (FAA), Aircraft Certification Service, Aircraft Engineering Division, Technical Analysis Branch (AIR-
120), 800 Independence Ave. S.W., Washington, DC, 205921.
d. Society of Automotive Engineers (SAE) Documents.
AIR 1537 Report on Aircraft Engine Containment, dated October, 1977.
AIR4003 Uncontained Turbine Rotor Events Data Period 1976 through 1983.
AIR4770 Uncontained Turbine Rotor Events Data Period 1984 (Draft) through 1989.
These documents can be obtained from the Society of Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale, Pennsylvania, 15096.
5. BACKGROUND. Although turbine engine and APU manufacturers are making efforts to reduce the probability of uncontained rotor failures, service experience shows that uncontained compressor and turbine rotor failures continue to occur. Turbine engine failures have resulted in high velocity fragment penetration of adjacent structures, fuel tanks, fuselage, system components and other engines on the airplane. While APU uncontained rotor failures do occur, and to date the impact damage to the airplane has been minimal, some rotor failures do produce fragments that should be considered. Since it is unlikely that uncontained rotor failures can be completely eliminated, parts 23 and 25 require that airplane design precautions be taken to minimize the hazard from such events.
a. Uncontained gas turbine engine rotor failure statistics are presented in the Society of Automotive Engineers (SAE) reports covering time periods and number of uncontained events listed in the table shown below. The following statistics summarize 28 years of service experience for fixed wing airplanes and do not include data for rotorcraft and APU's:
No. of Events Report No Period Total Category 3 _ Category 4 AIR 1537 1962-75 275 44 AIR4003 1976-83 237 27 3 AIR4770 (Draft) 1984-89 164 22 TOTAL 676 93 15 Par 4 3
The total of 676 uncontained events includes 93 events classified in Category 3 and 15 events classified in Category 4 damage to the airplane. Category 3 damage is defined as significant airplane damage with the airplane capable of continuing flight and making a safe landing. Category 4 damage is defined as severe airplane damage involving a crash landing, critical injuries, fatalities or hull loss.
During this 28 year period there were 1,089.6 million engine operating hours on commercial transports. The events were caused by a wide variety of influences classed as environmental (bird ingestion, corrosion/erosion, foreign object damage (FOD)), manufacturing and material defects, mechanical, and human factors (maintenance and overhaul, inspection error and operational procedures).
b. Uncontained APU rotor failure statistics covering 1962 through 1993 indicate that there have been several uncontained failures in at least 250 million hours of operation on transport category airplanes. No Category 3 or 4 events were reported and all failures occurred during ground operation. These events were caused by a wide variety of influences such as corrosion, ingestion of deicing fluid, manufacturing and material defects, mechanical, and human factors (maintenance and overhaul, inspection error and operational procedures).
c. The statistics in the SAE studies indicate the existence of many different causes of failures not readily apparent or predictable by failure analysis methods. Because of the variety of causes of uncontained rotor failures, it is difficult to anticipate all possible causes of failure and to provide protection to all areas. However, design considerations outlined in this AC provide guidelines for achieving the desired objective of minimizing the hazard to an airplane from uncontained rotor failures. These guidelines, therefore, assume a rotor failure will occur and that analysis of the effects of this failure is necessary. These guidelines are based on service experience and tests but are not necessarily the only means available to the designer.
6. DEFINITIONS.
a. Rotor. Rotor means the rotating components of the engine and APU that analysis, test, and/or experience has shown can be released during uncontained failure. The engine or APU manufacturer should define those components that constitute the rotor for each engine and APU type design. Typically rotors have included, as a minimum, disks, hubs, drums, seals, impellers, blades and spacers.
b. Blade. The airfoil sections (excluding platform and root) of the fan, compressor and turbine.
4 Par 5
c. Uncontained Failure. For the purpose of airplane evaluations in accordance with this AC, uncontained failure of a turbine engine is any failure which results in the escape of rotor fragments from the engine or APU that could result in a hazard. Rotor failures which are of concern are those where released fragments have sufficient energy to create a hazard to the airplane.
d. Critical Component. A critical component is any component whose failure would contribute to or cause a failure condition which would prevent the continued safe flight and landing of the airplane. These components should be considered on an individual basis and in relation to other components which could be damaged by the same fragment or by other fragments from the same uncontained event.
e. Continued Safe Flight and Landing. Continued safe flight and landing means that the airplane is capable of continued controlled flight and landing, possibly using emergency procedures and without exceptional pilot skill or strength, with conditions of considerably increased flightcrew workload and degraded flight characteristics of the airplane.
Fragment Spread Angle. The fragment spread angle is the angle measured, fore and aft from the center of the plane of rotation of an individual rotor stage, initiating at the engine or APU shaft centerline (see Figure 1).
Par 6 5
1/3RD DISK
FAN BLADE FRAGMENT FRAGMENTS (see figure 3) (see figure 5) ‡ 3 + 15* ‡ 5 INTERMEDIATE
FRAGMENT (see figure 4)
SMALL FRAGMENTS (see paragraph 9(d))
FRAGMENT SPREAD ANGLE IS THE ANGLE
MEASURED, FORE AND AFT, FROM THE
CENTER OF THE PLANE OF ROTATION
INITIATING AT THE ENGINE OR APU SHAFT CENTERLINE.
FIGURE 1 - ESTIMATED PATH OF FRAGMENTS Par 6
Impact Area. The impact area is that area of the airplane likely to be impacted by uncontained fragments generated during a rotor failure (see Paragraph 9).
h. Engine and APU Failure Model. A model describing the size, mass, spread angle, energy level and number of engine or APU rotor fragments to be considered when analyzing the airplane design is presented in Paragraph 9. DESIGN CONSIDERATIONS. Practical design precautions should be used to minimize ESIGN CONSIDERAIONS. Practical de a APU Prothe damage that can be caused by uncontained engine and APU rotor fragments. The most effective methods for minimizing the hazards from uncontained rotor fragments include location of critical components outside the fragment impact areas or separation, isolation, redundancy, and shielding of critical airplane components and/or systems. The following design considerations are recommended:
a. Consider the location of the engine and APU rotors relative to critical components, systems or areas of the airplane such as:
Any other engine(s) or an APU that provides an essential function;
(2) Pressurized sections of the fuselage and other primary structure of the fuselage, wings and empennage;
(3) Pilot compartment areas;
(4) Fuel system components, piping and tanks;
(5) Control systems, such as primary and secondary flight controls, electrical power cables, wiring, hydraulic systems, engine control systems, flammable fluid shut-off valves, and the associated actuation wiring or cables;
(б) Any fire extinguisher system of a cargo compartment, an APU, or another engine including electrical wiring and fire extinguishing agent plumbing to these systems;
(7) Engine air inlet attachments and effects of engine case deformations caused by fan blade debris resulting in attachment failures;
(8) Instrumentation essential for continued safe flight and landing;
(9) Thrust reverser systems where inadvertent deployment could be catastrophic; and Par 6 ~
(10) Oxygen systems for high altitude airplanes, where these are critical due to descent time.
Location of Critical Systems and Components. Critical airplane flight and engine control cables, wiring, flammable fluid carrying components and lines (including vent lines), hydraulic fluid lines and components, and pneumatic ducts should be located to minimize hazards caused by uncontained rotors and fan blade debris. The following design practices should be considered:
Locate, if possible, critical components or systems outside the likely debris impact areas.
(2) Duplicate and separate critical components or systems, or provide suitable protection if located in debris impact areas.
(3) Protection of critical systems and components can be provided by using airframe structure or supplemental shielding.
These methods have been effective in mitigating the hazards from both single and multiple small fragments within the + 15 degree impact area. Separation of multiplicated critical systems and components by at least a distance equal to the 1/2 blade fragment dimension has been accepted for showing minimization from a single high energy small fragment when at least one of the related multiplicated critical components is shielded by significant structure such as aluminum lower wing skins, pylons, aluminum skin of the cabin pressure vessel, or equivalent Multiplicated critical systems and components positioned behind less significant structures should be separated by at least a distance equal to the 1/2 blade fragment dimension, and at least one of the multiplicated critical systems should be:
Located such that equivalent protection is provided by other inherent structures such as pneumatic ducting, interiors, bulkheads, stringers, or
(11) Protected by an additional shield such that the airframe structure and shield material provide equivalent shielding.
(4) Locate fluid shutoffs and actuation means so that flammable fluid can be isolated in the event of damage to the system.
Par 7
(5) Minimize the flammable fluid spillage which could contact an ignition source.
(G) For airframe structural elements, provide redundant designs or crack stoppers to limit the subsequent tearing which could be caused by uncontained rotor fragments.
(7) Locate fuel tanks and other flammable fluid systems and route lines (including vent lines) behind airplane structure to reduce the hazards from spilled fuel or from tank penetrations. Fuel tank explosion-suppression materials, protective shields or deflectors on the fluid lines, have been used to minimize the damage and hazards.
c. External Shields and Deflectors. When shields, deflection devices or airplane structure are proposed to be used to protect critical systems or components, the adequacy of the protection, including mounting points to the airframe structure, should be shown by testing or validated analyses supported by test data, using the fragment energies supplied by the engine or APU manufacturer or those defined in Paragraph 9. For protection against engine small fragments, as defined in Paragraph 9, no quantitative validation as defined in Paragraph 10 is Pare pent a, on required if equivalency to the penetration resistant structures listed (e.g. pressure cabin skins, etc.) is shown.
ACCEPTED DESIGN PRECAUTIONS. Design practices currently in use by the aviation industry that have been shown to reduce the overall risk, by effectively eliminating certain specific risks and reducing the remaining specific risks to a minimum level, are described within this paragraph of the AC. Airplane designs submitted for evaluation by the regulatory authorities will be evaluated against these proven design practices.
a. Uncontrolled Fire.
(1) Eire Extinguishing Systems. The engine/APU fire extinguishing systems currently in use rely on a fire zone with a fixed compartment air volume and a known air exchange rate to extinguish a fire. The effectiveness of this type of system along with firewall integrity may therefore be compromised for the torn/ruptured compartment of the failed engine/APU. Protection of the airplane following this type of failure relies on the function of the fire warning system and subsequent fire switch activation to isolate the engine/APU from airframe flammable fluid (fuel and hydraulic fluid) and external ignition sources (pneumatic and electrical). Fire extinguishing protection of such a compromised system may not be effective due to the extent of damage. Continued function of any other engine, APU or cargo compartment fire warning and extinguisher system, including electrical wiring and fire extinguishing agent plumbing, should be considered as described in Paragraph 7.
Par 7
Flammable Fluid Shutoff Valve, As discussed above, shutoff of flammable fluid supply to the engine may be the only effective means to extinguish a fire following an uncontained failure, therefore the engine isolation/flammable fluid shutoff function should be assured following an uncontained rotor failure. Flammable fluid shutoff valves should be located outside the uncontained rotor impact area. Shutoff actuation controls that need to be routed through the impact area should be redundant and appropriately separated in relation to the
(3) Fire Protection of Critical Functions. Flammable fluid shutoff and other critical controls should be located so that a fire (caused by an uncontained rotor event) will not prevent actuation of the shutoff function or loss of critical airplane functions. If shutoff or other critical controls are located where a fire is possible following an uncontained rotor failure (e.g. in compartments adjacent to fuel tanks) then these items should meet the applicable fire protection guidelines such as AC 20-135,Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria" or the equivalent International Standard Order (ISO) 2685.
(4) Fuel Tanks. If fuel tanks are located in impact areas, the following precautions should be implemented:
Protection from the effects of fuel leakage should be provided for any fuel tanks located above an engine or APU and within the one-third disc and intermediate fragment impact areas. Dry bays or shielding are acceptable means. The dry bay should be sized based on analysis of possible fragment trajectories through the fuel tank wall and the subsequent fuel leakage from the damaged fuel tank so that fuel will not migrate to an engine, APU or other ignition source during either in flight or ground operation. A minimum drip clearance distance of 10 inches from potential ignition sources of the engine nacelle, for static conditions, is acceptable (see Figure 2).
10 Par 8
MINIMUM DRY BAY
INTEGRAL
FUEL TANK
- FRONT SPAR
PLAN VIEW LEADING EDGE 1 - Lower Wing Skin Penetration 2 - Fuel Tank Wall Penetration Angle Depends On Wing Skin Impact Resistance (5 to 15 Degrees) 10 Inch Minimum Clearance Fuel Drip Line
SECTION B-B
SECTION A-A FIGURE 2- DRY BAY SIZING DETERMINATION EXAMPLE Par 8
(11) Fuel tank penetration leak paths should be determined and evaluated for hazards during flight and ground phases of operation. If fuel spills into the airstream away from the airplane no additional protection is needed. Additional protection should be considered if fuel could spill, drain or migrate into areas housing ignition sources, such as engine or APU inlets or wheel wells. Damage to adjacent systems, wiring etc., should be evaluated regarding the potential that an uncontained fragment will create both an ignition source and fuel source. Wheel brakes may be considered as an ignition source during takeoff and initial climb. Protection of the wheel wells may be provided by airflow discharging from gaps or openings, preventing entry of fuel, a ventilation rate precluding a combustible mixture or other provisions indicated in §$ 23.863 and 25.863.
Areas of the airplane where flammable fluid migration is possible that are not drained and vented and have ignition sources or potential ignition sources should be provided with a means of fire detection and suppression and be explosion vented or equivalently protected.
b. Loss of Thrust.
() Fuel Reserves. The fuel reserves should be isolatable such that damage from a disc fragment will not result in loss of fuel required to complete the flight or a safe diversion. The effects of fuel loss, and the resultant shift of center of gravity or lateral imbalance on airplane controllability should also be considered.
(2) Engine Controls. Engine control cables and/or wiring for the remaining powerplants that pass through the impact area should be separated by a distance equal to the maximum dimension of a one-third disc fragment or the maximum extent possible.
(3) Other Engine Damage. Protection of any other engines from some fragments should be provided by locating critical components, such as engine accessories essential for proper engine operation (e.g., high pressure fuel lines, engine controls and wiring, etc.), in areas where inherent shielding is provided by the fuselage, engine or nacelle (including thrust reverser) structure (see Paragraph 7).
c. Loss of Airplane Control.
Flight Controls. Elements of the flight control system should be adequately separated or protected so that the release of a single one-third disc fragment will not cause loss of control of the airplane in any axis. Where primary flight controls have duplicated (or multiplicated) elements, these elements should be located to prevent all elements in any axis being lost as a result of the single one-third disc fragment. Credit for maintaining control of the 12 Par 8