AC 25.901-1
• Magnitude of the thrust loss.
• Direction of thrust.
• Phase of flight.
• Impact of the thrust loss on airplane safety.
Note: Although it is common for safety analyses to consider the total loss of one engine’s thrust, a small undetected thrust loss that persists from the point of takeoff power set could have a more significant impact on the accelerate-stop distances and takeoff obstacle clearance capability than a detectable single-engine total loss of thrust failure condition at V1.
7.2.1.2 In addition, the level at which any thrust loss becomes detectable should be validated. This validation is typically influenced by—
• Whether or not the thrust loss is symmetric,
• Impact on airplane performance and handling,
• Resultant changes in powerplant indications,
• Instrument accuracy and visibility,
• Environmental and operating conditions, and
• Relevant crew procedures and capabilities.
7.2.2 Detected Thrust Loss.
While detectable engine thrust losses can range in magnitude from a few percent to 100 percent of total airplane thrust, the total loss of useful thrust (i.e., in-flight shutdown (IFSD)) of one or more engines usually has the largest impact on airplane capabilities and engine-dependent systems. Further, single- and multiple-engine IFSDs tend to be the dominant thrust loss-related failure conditions for most powerplant installations. In light of this, the guidance in this AC focuses on the IFSD failure conditions. The applicant must consider other engine thrust loss failure conditions as part of showing compliance with §§ 25.901(c) and 25.1309, if those conditions are anticipated to occur more often than the IFSD failure condition, or if they could be more severe than the related IFSD failure condition.
7.2.2.1 Single-Engine In-Flight Shutdown.
The FAA generally accepts that the effects of any single-engine thrust loss failure condition, including IFSD, on airplane performance, controllability, maneuverability, and crew workload are accounted for and meet the intent of § 25.901(c) if compliance is also shown with part 25, subpart B, and § 25.1523.
7.2.2.1.1 Nevertheless, an applicant using the method set forth in this AC must also assess the effects of an IFSD on other airplane systems or in combination with other conditions, as part of showing compliance with §§ 25.901(c) and 25.1309. In this case, it should be noted that a single-engine IFSD can 11
AC 25.901-1 result from any number of single failures, and that the rate of IFSDs for all causes ranges from approximately 1 x 10-4 to 1 x 10-5 per engine flight hour.2 This total IFSD rate includes all failures within a typical powerplant installation that affect one—and only one—engine. Those failures within a typical powerplant that can affect more than one engine are described in paragraph 7.2.2.3.2 of this AC.
7.2.2.1.2 For the purpose of showing compliance with § 25.1309(b)(5)(ii) or other aspects of § 25.1309(b), the probability of an IFSD for a turbofan engine installation of a design, build, and maintenance standard that is representative of the state of the art at the time this AC was published can be assumed to be “remote” (or 1 x 10-5 per flight hour). For all other engine types, an estimate of the IFSD rate may be necessary. If an estimate of the IFSD rate is needed for a specific turbine engine installation, any one of the following methods is suitable for the purposes of complying with §§ 25.901(c) and 25.1309(b):
1. Estimate the IFSD rate based on service experience of similar powerplant installations.
2. Perform a bottom-up reliability analysis using service, test, and any other relevant experience with similar components and/or technologies to predict component failure modes and rates.
3. Use a conservative value of 1 x 10-4 per flight hour.
7.2.2.1.3 If an estimate of the percentage of these IFSDs for which the engine can be restarted is required, then the estimate should be based on relevant service experience.
7.2.2.1.4 An applicant should only use the default value of “remote” delineated in paragraph 7.2.2.1.2 of this AC for state-of-the-art turbofan engine installations. Methods 1 and 2, specified under paragraph 7.2.2.1.2 of this AC, are acceptable for estimating the IFSD rates and restart capability for all types of engines, including reciprocating engines or some totally new type of engine or unusual powerplant installation with features such as a novel fuel feed system. In the case of new or novel components, significant non-service experience may be necessary to validate the reliability predictions. This is typically attained through test and/or technology transfer analysis.
7.2.2.1.5 The conservative value of 1 x 10-4 per flight hour (or once every 10,000 hours), specified in method 3 under paragraph 7.2.2.1.2 of this AC, can be used for any traditional turbine engine installation for which there is no reason to expect below-average reliability. An applicant should verify the use of a conservative IFSD rate is appropriate for their airplane design
2 This range of values originates from the ARAC PIHWG recommendation report in response to Task 1 — Installations (Engines), available on the Internet at Recommendation Report.
AC 25.901-1 since other airworthiness standards, such as the Early ETOPS IFSD rate objectives in section K25.2.2(b)(2) of 14 CFR, appendix K to part 25 may also be included in the certification basis of the airplane, and other considerations (e.g., unique installation or operational requirements)may apply.
7.2.2.2 Related Requirements That Influence Installed Engine Reliability.
7.2.2.2.1 Section 25.901(b)(2) sets an additional standard for installed engine reliability, that being: “The components of the installation must be constructed, arranged, and installed so as to ensure their continued safe operation between normal inspections or overhauls.” However, the very existence of the fail-safe design standards (for example, § 25.901(c)) recognizes that continued safe operation of each component cannot be fully assured. Therefore, an applicant could meet this requirement if its proposed design included technologically feasible and economically practical means, given the current state of the art in design and maintenance that are available at the time of application.
7.2.2.2.2 Scheduled maintenance based on the safe life, hard life, and fail-operational architecture concepts are some of the means of establishing the normal inspections and overhauls required to ensure continued safe operation. Under the safe life concept, a conservative and minimum expected operating life for each component is established, and then an inspection for impending failure or removal for overhaul or replacement is scheduled well within that expected safe life. Under the hard life concept, the component is removed and replaced with a new or overhauled component well within the established safe life of the component. Regarding fail-operational architecture, § 25.901(b)(2) implicitly assumes that each component either can be inspected for impending failure, or some minimum operating life can be acceptably assured. However, this is not always the case for some very small, complex, or deeply embedded components within the powerplant installations (for example, integrated circuit boards). In such cases, the FAA’s long-accepted practice has been to apply the “continued safe operation” objective to each related powerplant installation function, rather than each component. This leads to reliance on detecting and repairing one component failure before a functionally redundant component also fails. When failure of the first component is not directly operationally detectable, then an inspection for failure of that component must be scheduled frequently enough to provide acceptable assurance that a failed component will be found and repaired before the redundant component fails. Since § 25.901(b)(2) clearly requires “continued” as well as “safe” operation, this “fail-operational” concept is notably different from the “fail-safe” concept in that the former requires that the component failure have no effect on functionality, while the latter allows functionality to be degraded or lost depending on the resulting impact on safety.
AC 25.901-1
7.2.2.2.3 On-condition maintenance based on evident degradation in performance and fail-operational architecture are also means of establishing the normal inspections and overhauls required to ensure continued safe operation. For evident degradation in performance, if the impending failure of a component will be operationally evident while the component is still continuing to operate safely, then detection of such degraded performance can be used to schedule timely removal for overhaul or replacement.
Regarding fail-operational architecture, this concept is the same as described in paragraph 7.2.2.2.2 above for scheduled maintenance, except here the failure of the first component, or the functionally redundant components, is directly detectable in operation, so it can be used to schedule timely removal for overhaul or replacement.
7.2.2.2.4 The effectiveness of compliance with part 25, subpart B, and § 25.1523 in meeting the intent of § 25.901(c) for single engine thrust loss is dependent on the accuracy of the human factors assessment for the crew’s ability to take appropriate corrective action. For the purposes of compliance with § 25.901(c), it may be assumed that the crew will take the corrective actions called for in the airplane flight manual procedures and associated approved training when such actions have been acceptably validated in accordance with the relevant human factors and flight deck design standards such as §§ 25.1302, 25.1309(c), and 25.1322.
7.2.2.3 Multiple-Engine In-Flight Shutdown.
When evaluating the multiple engine IFSD failure condition, for some engines the predicted IFSD rates may not support meeting the guidance in AC 25.1309-1B that states a catastrophic failure condition should have an average probability per flight hour on the order of 1 x 10-9 or less.
However, engine IFSD rates have been part of the historically-accepted service experience upon which that guidance was based, and IFSD rates have been continuously improving.
7.2.2.3.1 Consequently, the FAA has considered typical modern turbine engine IFSD rates, and the resulting possibility of multiple independent IFSDs leading to a critical power loss, inherently acceptable for compliance with § 25.901(c) without the need for a quantitative assessment. Refer to paragraph 7.2.2.1.4 for discussion on IFSD rates for novel technologies.
7.2.2.3.2 Nevertheless, some failures within airplane systems common to multiple engines may cause a catastrophic multiple engine thrust loss. These should be assessed by the applicant to ensure that they meet the “no single failure” and “extremely improbable” criteria of §§ 25.901(c) and
25.1309(b), as well as the engine-to-engine isolation criteria of § 25.903(b). Systems to be considered include, but are not limited to:
AC 25.901-1
• Fuel system,
• Air data system,
• Electrical power system,
• Throttle assembly,
• Engine indication systems.
7.2.2.3.3 The means of compliance described above are only valid for typical modern turbine engines, and for engines that can show equivalent reliability to such engines, using the means outlined under paragraph 7.1 of this AC. The approach to showing equivalent reliability should be discussed with the FAA early in the program.
7.2.3 Unwanted Thrust Reversal.
For related propeller guidance, see paragraph 7.8.1 of this AC. For related thrust reverser guidance, see paragraph 7.8.5 of this AC.
7.2.4 Excess Drag.
See paragraph 7.8.1 for related propeller guidance, paragraph 7.8.5 for related thrust reverser guidance, and paragraph 7.8.9 for cowling guidance of this AC.
7.3 Uncontrollable High Thrust.
This class of failure conditions can also critically impact the performance and handling qualities of an airplane. For more guidance, see the Uncontrollable High Thrust (UHT) entry on the FAA Transport Airplane Issues List.3
7.4 Uncontrolled Fire.
See paragraph 7.8.6 of this AC for related fire prevention guidance; see paragraph 7.8.7 for related fuel system guidance.
7.5 Overloading of Structures.
See paragraph 6.2.2 of this AC for related structural guidance on general powerplant structural failure conditions. Paragraph 7.8.7 of this AC offers fuel system guidance and examples of fuel system failure conditions, where some may lead to overloading of structures.
7.6 Debris Release and Impact.
Some debris threats are specifically excepted under § 25.901(c) from compliance with § 25.1309(b), such as uncontained engine rotor failure and propeller debris release. For other debris threats, see related guidance for the thrust reverser in paragraph 7.8.5.4, overloading of structures in paragraph 7.5, and cowling in paragraph 7.8.9 of this AC.
3 See Uncontrollable High Thrust (UHT), Issue ID #T-1402, on the current Transport Airplane Issues List (faa.gov).
AC 25.901-1
7.7 Personnel Hazard.
Failures that can be foreseen to pose a hazard to personnel under the in-service operating conditions covered by §§ 25.901(c) and 25.1309(b) should be included in the SSA and shown to comply. In addition, the SSA should be utilized to the greatest extent practical to identify any failure condition that could pose a hazard to personnel, including on the ground or adjacent to the airplane, and during expected out-of-service activities, such as the following or similar situations:
• Electric shock threats to mechanics.
• Hazardous atmosphere threats to mechanics.
• Unwanted thrust reverser system movement.
• Cowling “hold open” mechanism failure.
7.8 System Level Failure Conditions.
Some of the most common powerplant systems and related failure conditions include the following:
• Propeller controls and indications.
• Engine controls and indications.
• Automatic takeoff thrust control system.
• Thrust management system.
• Thrust reverser.
• Fire protection system.
• Fuel system.
• Powerplant ice protection.
• Cowling, nacelle skins, and thrust reverser components.
7.8.1 Propeller Controls and Indications.
Failure conditions include the following:
7.8.1.1 Unwanted fine pitch (overspeed, excessive drag).
7.8.1.2 Unwanted coarse pitch (over-torque, thrust asymmetry).
7.8.1.3 Unwanted propeller feathering (thrust loss, over-torque, thrust asymmetry).
7.8.1.4 Failure to feather following in-flight engine failure (excessive drag).
7.8.1.5 Unwanted application of propeller brake in flight (thrust loss, structural overload, thrust asymmetry).
AC 25.901-1
7.8.1.6 Unwanted operation below the low pitch stop, which is also known as unwanted reverse thrust or beta range pitch (overspeed, excessive drag, thrust asymmetry, disruption of airflow over the wing on wing mounted engines).
7.8.2 Engine Controls and Indications.
Failure conditions include the following:
7.8.2.1 Loss of thrust.
7.8.2.2 Loss of thrust control, including asymmetric thrust, thrust increases, thrust decreases, thrust fail fixed, and unpredictable engine operation.
7.8.2.3 Hazardously misleading display of powerplant parameter(s).
7.8.3 Automatic Takeoff Thrust Control System.
Part 25, appendix I, Installation of an Automatic Takeoff Thrust Control System (ATTCS), specifies the minimum reliability levels for these automatic systems. In addition to showing compliance with these reliability levels for certain combinations of failures, other failure conditions that can arise as a result of introducing such a system must be shown to comply with §§ 25.901(c) and 25.1309(b).
7.8.4 Thrust Management System.
7.8.4.1 An SSA is essential, in order to show compliance with §§ 25.901(c) and
25.1309(b), for any airplane system that aids the crew in managing engine thrust (for example, computing target engine ratings, commanding engine thrust levels, and so forth). As with any acceptable SSA, the criticality and failure hazard classification must be assessed. The system criticality will depend on all of the following:
7.8.4.1.1 The range of thrust management errors it could cause.
7.8.4.1.2 The likelihood that the crew will detect these errors and take appropriate corrective action.
7.8.4.1.3 The severity of the effects of these errors with and without crew intervention.
7.8.4.2 The hazard classification will depend on the most severe effects anticipated from any system. The need for more in-depth analysis will depend upon the system’s complexity, novelty, initial failure hazard classification, relationship to other airplane systems, and so forth.
7.8.4.3 Automated thrust management features, such as autothrottles and target rating displays, traditionally have been certified by the FAA on the basis that they are only conveniences to reduce crew workload and do not relieve the crew of any responsibility for assuring proper thrust 17
AC 25.901-1 management. In some cases, malfunctions of these systems can be considered minor hazards, at most. However, for this assumption to be valid, even when the crew is no longer directly involved in performing a given thrust management function, the crew must be provided with clear, unambiguous, and timely attention-getting information concerning any unsafe system operating conditions to enable them to take appropriate corrective action. See §§ 25.1309(c) and 25.1322; and ACs 25-11B,
25.1309-1B, and 25.1322-1.
7.8.4.4 Appropriate flightcrew detection and accommodation of failures within any automated thrust management feature is necessary, including unannunciated failures. Consequently, when showing compliance with §§ 25.901(c) and 25.1309, failures within any automated thrust management feature that could create a catastrophic failure condition, if not detected and properly accommodated by crew action, either should be considered—
• A catastrophic failure condition when showing compliance with §§ 25.1309(b) and 25.901(c), or
• An unsafe system operating condition when showing compliance with the warning requirements of § 25.1309(c).
7.8.4.5 Additional relevant guidance can be found in AC 25.1329-1C.
7.8.5 Thrust Reverser.
Compliance with § 25.933(a) using the “reliability option” means delineated in § 25.933(a)(1)(ii) provides a direct showing of compliance with § 25.1309(b) and, by inference, with § 25.901(c) for the thrust reverser in-flight deployment failure conditions. However, compliance with § 25.933(a) using the “controllability option” means delineated in § 25.933(a)(1)(i) only regulates the severity of thrust reverser inflight deployment failure conditions. Therefore, a dedicated showing of compliance with §§ 25.901(c) and 25.1309 will be needed to ensure that the anticipated probability of in-flight deployment is appropriately assessed. Refer to AC 25.933-1 for guidance on unwanted in-flight thrust reversal of turbojet thrust reversers. In addition, a standard § 25.1309 SSA should be performed for any other thrust reverser-related failure conditions such as—
7.8.5.1 Unwanted thrust reversal during takeoff roll between power set and lift-off speed (VLOF) (thrust asymmetry, thrust loss). Unwanted thrust reversal is of particular concern between V1 and VLOF.
7.8.5.2 Failure of one or more reversers to deploy when commanded (thrust asymmetry, increased stopping distance).
7.8.5.3 Failure of one or more reversers to stow when commanded (thrust asymmetry, excess drag, and efflux impingement problems,( for example, engine inlet distortion, buffet, and lift loss)).
AC 25.901-1
7.8.5.4 Failure of reverser component restraints such as those that would allow unlatching of reverser cowling or ducting while the airplane is operating, release of cascades during reverser operation, and so forth (increased drag and/or buffet, thrust and/or drag asymmetry, debris impact threat).
7.8.5.5 Failure of reverser lock-out means during normal operation or posing a hazard to maintenance personnel.
7.8.6 Fire Protection System.
The requirements of § 25.1309 are intended to augment rather than replace the more specific fire protection requirements of part 25. The SSA provides an overall assessment of the airplane safety; thus § 25.1309 applies in addition to the more specific fire protection requirements in part 25. For more guidance, see the Flammable Fluid Fire Protection entry on the FAA Transport Airplane Issues List.4 The principal role of the SSA for §§ 25.901(c) and 25.1309(b) is to ensure that the normal means of fire protection are sufficiently reliable and fault tolerant. Some historically significant failure conditions include the following:
7.8.6.1 Single failures affecting multiple safeguards intended to be independent, such as a wire shorting to a flammable fluid line, a pin hole leak in a high pressure hydraulic flammable fluid line causing damage to and arcing in nearby wiring, a firewall fitting failure that causes both a flammable fluid leak into the fire zone and loss of firewall integrity, and so forth.
7.8.6.2 A latent failure causing a component or aspect in the fire protection system to not be explosion-proof or otherwise creating an ignition source within a flammable fluid leakage zone followed by a failure causing a significant leak in that zone.
7.8.6.3 Failures causing hazardous re-routing of flammable fluid drainage. Of particular historical concern have been single failures that could cause errant drainage into an area where ignition sources are nominally expected to exist, such as the wheel well. For example, significant leakage into a compartment has washed accumulated dirt and debris into, and clogged, the dedicated drainage provisions. Consequently, protections against such clogging or adequate alternate redundant drainage paths should be provided.
7.8.6.4 Failures causing greater leakage than can be acceptably accommodated by drainage provisions. For example, slat actuator failures have caused wing spar punctures resulting in hazardous leakage rates.
7.8.6.5 When combined with the presence of a fire, the reliability of normal fire protection means should be considered in addition to meeting other
4 See Flammable Fluid Fire Protection, Issue ID #T-0602, on the current Transport Airplane Issues List (faa.gov).
AC 25.901-1 standards that apply to fire protection means (see the Flammable Fluid Fire Protection issue on the FAA Transport Airplane Issues List5). The individual loss of the following normal fire protection means should be considered when evaluating their fault tolerance:
• Detection.
• Extinguishing.
• Fire Zone Integrity.
• Flammable fluid shut-off or drainage capability.
7.8.6.6 The creation of an ignition source outside a fire zone but in the presence of flammable fluids should also be considered when evaluating normal fire protection means reliability and fault tolerance.
7.8.7 Fuel System.
Failure conditions include the following:
7.8.7.1 Loss of fuel feed or fuel supply.
7.8.7.2 Inability to control CG (in other words, lateral and/or longitudinal imbalance). Fuel imbalance may also result in overloading of structure.
7.8.7.3 Hazardously misleading fuel indications.
7.8.7.4 Loss of fuel system integrity.
Note: The fuel system includes each aircraft fuel tank. Of particular historical concern has been any failure that could cause fuel leakage of unacceptable quantity or location. One example is any failure of a fuel-tooil heat exchanger that could allow higher volatility fuel to get into the engine oil or airplane hydraulic systems where it would pose an additional fire hazard. Another example is any fuel leak that cannot be detected and isolated before the quantity of fuel leaked prevents continued safe flight and landing due to effects such as fuel exhaustion, critical fuel imbalance, uncontrolled fire, or some other hazardous or catastrophic outcome. Loss of fuel system integrity may also result in overloading of structure.
7.8.7.5 Loss of fuel jettison. Loss of fuel jettison may also result in overloading of structure in an overweight landing.
7.8.7.6 Uncommanded fuel jettison.
5 See footnote 4 on page 18.
AC 25.901-1
7.8.7.7 Fuel tank ignition. Compliance with § 25.981 provides a showing of compliance with §§ 25.901(c) and 25.1309(b) for fuel system vapor ignition conditions.
7.8.8 Powerplant Ice Protection.
Failure conditions include the following:
7.8.8.1 Loss of propeller, inlet, engine, or other powerplant ice protection on multiple powerplants when required.
7.8.8.2 Loss of ice detection.
7.8.8.3 Activation of engine inlet ice protection above limit temperatures and/or pressures.
Note: While airframe anti-icing systems are not specifically covered in this AC, to the extent that powerplant installation component failures can often contribute to or cause adverse impacts on airframe anti-icing capability, these types of component failures should be highlighted to the appropriate mechanical systems personnel and included in the appropriate SSAs for compliance with § 25.1309. Conversely, any failure in the airframe anti-icing or environmental control system that could cause excessive temperatures and/or pressures or cross-bleeding that affects the safe operation of multiple engines may not comply with § 25.1309(b).
Even if the failure only affects one engine, it may not comply with §§ 25.901(b)(2), 25.901(c), and/or 25.1309(b), depending upon the frequency of occurrence.
7.8.9 Cowling, Nacelle Skins, Engine Inlets, and Thrust Reverser Components.
Failure conditions include the following:
7.8.9.1 Engine nacelle components that are not secured to the engine nacelle during flight may have hazardous or even catastrophic effects at the airplane level. Engine nacelle components include cowlings, nacelle skin, exhaust components, engine inlets, or thrust reverser components such as a translating sleeve.
7.8.9.1.1 Engine nacelle components that are not intended to move during airplane operation can cause damage to the engine or the airframe if they become unsecured. It is possible for an unsecured component to depart the nacelle and impact the same nacelle, another engine, or the airframe. It may also result in significant drag, which could deplete critical fuel reserves or lead to fuel exhaustion. Applicants should account for Extended Operations (ETOPS) flight in addition to non-ETOPS flight, if seeking ETOPS approval under § 25.1535.
7.8.9.1.2 Loss of engine nacelle components has occurred numerous times in service. Service history shows a large number of engine fan cowl door 21
AC 25.901-1 losses during flight have occurred. Engine fan cowl departures have damaged the fuselage and cabin windows resulting in depressurization (and in one event a fatality6), damaged the empennage, and damaged an engine fuel line leading to an engine fire7. Since the engine cowl doors are usually part of the fire containment design, their loss precludes the ability to contain a fire and compromises the fire extinguishing means. These events have also resulted in significant drag and increased fuel consumption. While most engine fan cowl losses have occurred shortly after takeoff or during the initial aircraft climb, events (including the fatal event referenced above) have occurred in other flight phases; therefore, the applicant should account for the risk of engine nacelle component loss in all flight phases.
7.8.9.1.3 Many of these events resulted from the maintenance crew improperly closing the fan cowl and securing the latches. In addition, flightcrew pre-flight walk-around inspection procedures were not effective because the maintenance error remained undetected. Maintenance crews have left nacelle fan cowl doors unlatched in service on some airplane models that are more susceptible to this maintenance error. Consequently, previously accepted assumptions that maintenance crews will properly latch nacelle cowls, and flightcrew and maintenance crew procedures will reliably detect an unlatched nacelle cowl during a visual inspection, are not valid for all airplane designs. Therefore, an unlatched cowl door, which may have hazardous or catastrophic effects at the airplane level, is an unsafe system operating condition. In accordance with the guidance in AC
25.1309-1B, an applicant should ensure the nacelle design is tolerant to foreseeable maintenance errors and should provide the capability to check for the nacelle cowls latching condition.
7.8.9.1.4 According to § 25.1309(c), information concerning unsafe system operating conditions must be provided to the crew in order to enable them to take appropriate corrective action if nacelle cowl doors or maintenance access doors are not properly latched. The applicant should use flight deck alerting to attract the attention of and identify to the flightcrew any improperly secured nacelle cowl doors and other maintenance access doors. Flightcrew alerts must be readily and easily detectable and intelligible to the flightcrew under all foreseeable operating conditions.
Refer to the requirements in §§ 25.1309(c) and 25.1322, and guidance in ACs 25-11B, 25.1309-1B, and 25.1322-1.
6 National Transportation Safety Board Aircraft Accident Report, Left Engine Failure and Subsequent Depressurization, Southwest Airlines Flight 1380, Boeing 737-7H4, N772SW, Philadelphia, Pennsylvania, April 17, 2018, dated November 19, 2019, NTSB Accident Report--AAR1903.
7 United Kingdom Air Accidents Investigation Branch Aircraft Accident Report 1/2015, Report on the accident to Airbus A319-131, G-EUOE, London Heathrow Airport, 24 May 2013, dated July 14, 2015, Aircraft Accident Report 1/2015 - Airbus A319-131, G-EUOE, 24 May 2013 - GOV.UK (www.gov.uk). AAIBA Accident Report 1/2015.