U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Safety Assessment of Powerplant Installations Date: 08/30/2024 AC No: 25.901-1 Initiated By: AIR-600 This advisory circular (AC) describes acceptable means for showing compliance with paragraph (c) of Title 14, Code of Federal Regulations (14 CFR) 25.901, Installation, of subpart E, Powerplant. Section 25.901(c) is intended to ensure that the applicant conducts an overall safety assessment of the powerplant and auxiliary power unit (APU) installations that meets the requirements of § 25.1309, while also addressing the unique compliance concerns involved in powerplant and APU installations. The regulation is intended to augment other applicable part 25 design and performance standards for transport category airplanes. This document describes a method of conducting a system safety assessment (SSA) of the powerplant installation.
If you have suggestions for improving this AC, you may use the Advisory Circular Feedback form at the end of this AC.
DANIEL J.
Digitally signed by DANIEL J. ELGAS ELGAS Date: 2024.08.30 15:01:41 -04'00' Daniel Elgas Director, Policy and Standards Division Aircraft Certification Service
AC 25.901-1 Cont ents Paragraph Page
1 Purpose1
2 Applicability1
2.1 Applicability of this AC1
2.2 Applicability of § 25.901(c)1
3 Cancellation3
4 Related Documents3
4.1 Regulations3
4.2 Advisory Circulars4
4.3Industry Documents4
5 Background4
6 General System Safety Assessment Guidance6
6.1 General6
6.2 Structural Considerations8
6.3 Crew and Maintenance Considerations9
7 Specific § 25.901(c) System Safety Assessment Guidance9
7.1 General9
7.2 Thrust Loss and/or Excess Drag10
7.3 Uncontrollable High Thrust15
7.4 Uncontrolled Fire15
7.5 Overloading of Structures15
7.6 Debris Release and Impact15
7.7 Personnel Hazard16
7.8 System Level Failure Conditions16
ii
AC 25.901-1 1 PURPOSE.
1.1 This AC describes an acceptable means for showing compliance with the requirements of § 25.901(c), including guidance for conducting an SSA of the powerplant installation. This guidance is intended to supplement the engineering and operational judgment that forms the basis of any compliance findings. The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing requirements under the law or agency policies.
1.2 This AC is not intended to provide specific guidance for compliance of APU installations with §§ 25.901(c) and 25.1309. There are unique considerations when applying these regulations to APU installations, which may be better addressed with specific guidance considering the unique hazards from APUs. The European Union Aviation Safety Agency (EASA) has specific requirements for APU installations, in EASA CS-25 subpart J. The Federal Aviation Administration (FAA) may harmonize its regulations with CS-25 subpart J at some point in the future. While the general SSA guidance in AC 25.1309-1B and some aspects of the general powerplant installation guidance of this AC may be used for APU installations, applicants should use any other available resources to identify potential hazards due to the APU installation to account for in the powerplant installation SSA.
2 APPLICABILITY.
2.1 Applicability of this AC.
2.1.1 The guidance in this AC is for airplane manufacturers, modifiers, foreign regulatory authorities, and FAA type certification engineers and the Administrator’s designees.
This AC is intended specifically for transport category airplanes proposed to be certified under 14 CFR part 25.
2.1.2 Conformity with the guidance is voluntary only and nonconformity will not affect rights and obligations under existing statutes and regulations. The FAA will consider other methods of showing compliance that an applicant may elect to present. Terms such as “should,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used. If the FAA becomes aware of circumstances in which following this AC would not result in compliance with the applicable regulations, the agency may require additional substantiation as the basis for finding compliance.
2.2 Applicability of § 25.901(c).
2.2.1 The guidance provided in this document applies to proposed powerplant installations on transport category airplanes that are subject to the requirements of § 25.901. This guidance specifically concerns showing compliance with the requirements of § 25.901(c), amendment 25-152 (89 FR 68706, August 27, 2024), which states:
AC 25.901-1
(c) For each powerplant and auxiliary power unit installation, the applicant must comply with the requirements of § 25.1309, except that the effects of the following failures need not comply with § 25.1309(b) —
(1) Engine case burn-through or rupture,
(2) Uncontained engine rotor failure, and
(3) Propeller debris release.
2.2.2 Section 25.901(c) requires an applicant to provide an overall safety assessment of powerplant and APU installations that meets the requirements of § 25.1309, while accommodating the unique compliance concerns for powerplant and APU installations.
Section 25.901(c) is intended to augment rather than replace other applicable part 25 design and performance standards for transport category airplanes.
2.2.3 In accommodating the unique concerns related to powerplant compliance, the FAA has determined that specific guidance for showing these installations’ compliance with § 25.1309(b) is needed; such guidance is contained in this AC.
2.2.4 Wherever this AC indicates that compliance with other applicable regulations has been accepted as also meeting the intent of § 25.901(c) for a specific failure condition, no additional dedicated safety analysis should be necessary. If any guidance in this AC conflicts or is inconsistent with guidance in AC 25.1309-1B, System Design and Analysis, the more specific guidance in this AC takes precedence in showing compliance with § 25.901(c).
2.2.5 When assessing the potential hazards to the airplane caused by the powerplant installation, the effects of an engine case rupture, uncontained engine rotor failure, engine case burn-through, and propeller debris release are excluded from §§ 25.901(c) and 25.1309(b). The effects and rates of these failures are minimized by compliance with 14 CFR part 33, Airworthiness Standards: Aircraft Engines; 14 CFR part 35, Airworthiness Standards: Propellers; and §§ 25.903(d)(1), 25.905(d), and 25.1193. In addition, §§ 25.365(e) and 25.571(e) require that the airplane structure be capable of withstanding the effects of an uncontained engine failure.
2.2.6 Further, the effects of encountering environmental threats or other operating conditions more severe than those for which the airplane is certified (such as volcanic ash or operation above placard speeds) need not be considered in the §§ 25.901(c) and
25.1309(b) compliance process. However, if a failure or malfunction can affect the subsequent environmental qualification or other operational capability of the installation, this effect should be accounted for in the §§ 25.901(c) and 25.1309(b) compliance assessment.
2.2.7 The terms defined in AC 25.1309-1B have the same meaning as the terms used in this AC.
AC 25.901-1 3 CANCELLATION.
This AC cancels FAA Policy Statement PS-ANM-01-02, FAA Policy on Type Certification Assessment of Thrust Management Systems, February 22, 2002.
4 RELATED DOCUMENTS.
4.1 Regulations.
The following 14 CFR part 25 regulations are related to this AC. You can download the full text of these regulations from the Federal Register website at Electronic Code of Federal Regulations, jointly administered by the Office of the Federal Register (OFR) of the National Archives and Records Administration (NARA) and the U.S.
Government Publishing Office (GPO). You can order a paper copy from the U.S.
Superintendent of Documents, U.S. Government Publishing Office, Washington, D.C.
20401; at Government Publishing Office, by calling telephone number (202) 512-1800;
or by sending a fax to (202) 512-2250.
• Section 25.4, Definitions.
• Section 25.365, Pressurized compartment loads.
• Section 25.571, Damage-tolerance and fatigue evaluation of structure.
• Section 25.903, Engines.
• Section 25.905, Propellers.
• Section 25.933, Reversing systems.
• Section 25.981, Fuel tank explosion prevention.
• Section 25.1193, Cowling and nacelle skin.
• Section 25.1309, Equipment, systems, and installations.
• Section 25.1322, Flightcrew alerting.
• Section 25.1329, Flight guidance system.
• Section 25.1529, Instructions for Continued Airworthiness.
• Section 25.1535, ETOPS approval.
• Section 33.28, Engine control systems.
• Section 33.75, Safety analysis.
• Section 35.15, Safety analysis.
• Section 35.23, Propeller control system.
AC 25.901-1
4.2 Advisory Circulars.
The following ACs are related to the guidance in this AC. Please refer to the latest version of each AC referenced in this document; they are available at FAA Advisory Circulars and in the Dynamic Regulatory System (DRS).
• AC 25-11B, Electronic Flight Deck Display.
• AC 25-24, Sustained Engine Imbalance.
• AC 25.933-1, Unwanted In-flight Thrust Reversal of Turbojet Thrust Reversers.
• AC 25.1309-1B, System Design and Analysis.
• AC 25.1322-1, Flightcrew Alerting.
• AC 25.1329-1C, Approval of Flight Guidance Systems.
• AC 25-19A, Certification Maintenance Requirements.
• AC 120-17B, Reliability Program Methods – Standards for Determining Life Limitations.
4.3 Industry Documents
• SAE ARP5150A, Safety Assessment of Transport Airplanes in Commercial Service.
• SAE JA1012, A Guide to the Reliability-Centered Maintenance (RCM) Standard.
5 BACKGROUND.
5.1 The “fail-safe” design concept (described further in AC 25.1309-1B), which instructs the engineer to assume that single failures will happen, and to consider the effects of those failures and combinations of failures in defining a safe design, was inherent in § 25.1309(b) when that regulation was codified in 1964 and has its origins in the preceding Civil Air Regulations. That regulation originally stated:
The equipment, systems, and installations must be designed to prevent hazards to the airplane if they malfunction or fail.
5.2 Compliance with that rule was normally shown for only one failure or malfunction at a time. However, as stated in the preamble of Notice of Proposed Rulemaking (NPRM) Notice No. 68-18 (Docket No. 9079, 33 FR 11913, August 22, 1968), which proposed new § 25.1309(b), (c), and (d) requirements, the trend towards more critical, complex, and integrated airplane systems made it clear that the co-existence of multiple failures must be addressed. The question of how many co-existent failures must be tolerated without posing a hazard to the airplane was answered in that proposal by establishing a “logical and acceptable inverse relationship between the probability and the severity of each failure condition.” This concept was adopted in § 25.1309 and applied specifically to powerplant installations through the creation of § 25.901(c) in amendment 25-23 (35 FR 5676, April 8, 1970).
AC 25.901-1
5.3 As the first version of AC 25.1309-1 was being drafted, some powerplant specialists, both within the FAA and industry, became concerned that this new policy focused too much on the “frequency of occurrence” aspect of the new fail-safe rule and not enough on the “prevention of hazards” inherent in traditional fail-safe practices. While “average risk,” which is the risk on a typical flight of all airplanes of a particular model for a typical duration, was seen as an appropriate guide to help an engineer determine the level of redundancy required in the design, it was considered inappropriate to use frequency of occurrence to justify exposure to a hazard that could be eliminated or further reduced through practical means. Further, the FAA placed no restriction on the applicant’s use of the low probability of a failure in order to show its acceptability for compliance. This absence was of particular concern if this new advisory material could be used to accept the kinds of potentially catastrophic single failures that had been prohibited as far back as the early 1950s, in Civil Air Regulation 4b.606(b).
5.4 These concerns led the FAA to revise § 25.901(c) in amendment 25-40 (42 FR 15042, March 17, 1977) to read:
(c) For each powerplant…installation, it must be established that no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane, except that the failure of structural elements need not be considered if the probability of such failure is extremely remote.
5.5 By changing § 25.901(c) as indicated above, the FAA intended to safeguard the protections of the traditional “no single failure” concept, while allowing for some consideration of “frequency of occurrence” in the likelihood of multiple failures.
However, unlike § 25.1309(b)(2) of the time, § 25.901(c) did not regulate hazards that did not jeopardize the safe operation of the airplane.
5.6 Despite the fact that the FAA stated in the preamble of NPRM Notice No. 75-19 (Docket No. 14606, 40 FR 21866, May 19, 1975) that § 25.1309 still applied to powerplant installations by that regulation’s own terms, there was much controversy following issuance of amendment 25-40 as to whether the more generally applicable § 25.1309 still applied to powerplant installations. At the very least, the amendment 25-40 revision to § 25.901(c) created standards and undefined terminology that were inconsistent with the terms of the more generally applicable § 25.1309; this fact has caused significant difficulty both for applicants and the FAA.
5.7 The FAA’s revision, at amendment 25-152, of §§ 25.901(c) and 25.1309, and its revisions to the associated advisory material, address shortcomings of both §§ 25.901(c) and 25.1309. These changes implement recommendations from the Aviation Rulemaking Advisory Committee (ARAC)1 on engine installations. The
1 See Notice of establishment of installation harmonization working group, Task 1—Installations (Engines) (57 FR 58844, December 11, 1992), available at Notice--Installation Harmonization Working Group. The ARAC Powerplant Installation Harmonization Working Group (PIHWG) recommendation report for Task 1 is available at Recommendation Report.
AC 25.901-1 ARAC recommendations have prompted the FAA to adopt more consistent standards in these two rules and also harmonize FAA and EASA rules and guidance material.
5.8 The latest § 25.901(c) references § 25.1309. The latest § 25.1309 preserves the “no single failure will jeopardize” concept of § 25.901(c), while clarifying the “inverse relationship between probability and severity” concept.
5.9 This AC has been developed to—
• Ensure that the intent of § 25.901(c) is understood and applied by applicants, and by the FAA when finding compliance,
• Advise applicants on § 25.1309 concepts as they relate to the powerplant installations, and
• Ensure that the applicant identifies any uncertainty in the SSA and suitably manages the uncertainty.
6 GENERAL SYSTEM SAFETY ASSESSMENT GUIDANCE.
6.1 General.
6.1.1 Applicants may show compliance with §§ 25.901(c) and 25.1309(b) by preparing an SSA that is substantiated by appropriate testing and/or analysis, or reference to comparable service experience on other airplanes if shown to be valid for the proposed installation. Such assessment may range from a simple report (providing descriptive details of failure conditions, interpreting test results, comparing two similar systems, similarity analysis, or offering other qualitative information) to a detailed failure analysis that may include estimated numerical probabilities. The depth and scope of an acceptable SSA depends on all of the following:
6.1.1.1 The complexity and criticality of the functions performed by the system(s) under consideration.
6.1.1.2 The severity of related failure conditions.
6.1.1.3 The uniqueness of the design and extent of relevant service experience.
6.1.1.4 The number and complexity of the identified causal failure scenarios.
6.1.1.5 The detectability of contributing failures.
6.1.2 The SSA criteria, process, analysis methods, validation, and documentation should be consistent with the guidance in AC 25.1309-1B. Wherever there is guidance specifically applicable to powerplant installations, this is delineated in paragraph 7 of this AC.
AC 25.901-1
6.1.3 In carrying out the SSA for the powerplant installation for §§ 25.901(c) and 25.1309(b), the results of the engine (and propeller) failure analyses (see §§ 33.28, 33.75, 35.15 and
35.23) should be used as inputs for those powerplant failure effects that can have an impact on the airplane, as appropriate. However, the SSA undertaken to meet part 33 and part 35 airworthiness requirements might not address all the potential effects that an engine and propeller, as installed, may have on the airplane under evaluation since the objectives under parts 33 and 35 differ from part 25.
6.1.3.1 For example, failures within the part 33 and part 35 hardware can cause uncontrollable high thrust (UHT). However, the acceptability of the resulting airplane level failure conditions can only be assessed on an installation-by-installation basis. Therefore, it is necessary for the part 25 SSA to be complete, taking into account the anticipated failures of the part 33 and part 35 hardware. This, at times, has meant that a part 33 and/or part 35 analysis had to be expanded or altered through coordination with the applicable part 33 or part 35 certificate holders and the applicable certifying authority.
6.1.3.2 For those failure conditions covered by analysis under part 33 and/or part 35, and for which the installation has no effect on the conclusions derived from these analyses, it is possible that no additional analyses would be necessary in order to show compliance with §§ 25.901(c) and 25.1309(b). However, the part 25 applicant should provide, at a minimum, acceptable evidence that the part 33 and/or part 35 finding was directly relevant to the part 25 standards, the installation assumptions used under part 33 and/or part 35 remain valid, and that the propulsion installation has no effect on the conclusions. An applicant for a type certificate must show compliance with all applicable requirements per § 21.20(a), and as such all the data required to show compliance with §§ 25.901(c) and 25.1309(b), whether it originated as part 33 or part 35 compliance data, must be reflected within the applicant’s means to show compliance, if only by reference to files accessible through the applicable certification office.
6.1.3.3 In addition, the minimum acceptable level of safety required to comply with part 33 and/or part 35 provisions might not be equivalent to that required under part 25. For example, there will be instances when an engine type design that just meets the minimum standards set by § 33.75 will not be acceptable under § 25.1309(b). Not only does § 25.1309(b) require lower predicted frequencies of occurrence for some of the failure conditions covered by § 33.75, but it also prohibits any “catastrophic failure condition” due to single failures. Section 33.75 does not specifically prohibit single failures from causing conditions like concentration of toxic products in the engine bleed air intended for the cabin that may cause crew incapacitation; significant thrust in the opposite direction to that commanded by the pilot; and uncontrolled fire. All of these are typically considered “catastrophic” under § 25.1309(b).
AC 25.901-1 However, given that there are very few, if any, single failures that could be credibly shown to meet the probability-of-occurrence requirements in § 33.75 for these conditions, the lack of any specific prohibition against catastrophic single failures in § 33.75 is much less likely to pose an engine installation approval issue than is the difference in the required probabilities for such conditions. So, while there are almost always many elements of part 33 and part 35 compliance data that are of significant value to the part 25 analyses, in most cases, a dedicated part 25 analysis is required to demonstrate compliance with §§ 25.901(c) and 25.1309(b).
6.2 Structural Considerations.
The effects of structural failures on the powerplant installation, and vice versa, should be carefully considered by applicants when conducting SSAs. The applicant may use compliance with the requirements of subparts C and D of part 25 to support compliance with §§ 25.901(c) and 25.1309; however, meeting the damage tolerance requirement of § 25.571 by itself is not sufficient to justify the assumption that a single failure will not occur. This is because single failure of structural elements can occur due to causes other than those addressed by § 25.571.
6.2.1 Effects of Structural Failures on Powerplant Installation.
The applicant must account for powerplant installation structural failures that are anticipated to occur within the fleet life of the airplane type, including the foreseeable failure of any single structural element of the powerplant installation, to comply with § 25.901(c), unless specifically excepted in the rule (for example, a structural failure due to an uncontained engine rotor failure). The following are examples of structural failures that have been of concern in previous powerplant installations:
6.2.1.1 Thrust reverser restraining load path failure that may cause a catastrophic inadvertent deployment.
6.2.1.2 Throttle quadrant framing or mounting failure that causes loss of control of multiple engines or causes UHT on one or more engines.
6.2.1.3 Structural failures in an avionics rack or related mounting that cause loss of multiple, otherwise independent powerplant functions, components, and/or systems.
6.2.1.4 Engine mounting system single failures or malfunctions that are not failsafe.
6.2.2 Effects of Powerplant Installation Failures on Structural Elements.
Any powerplant installation failures that could have adverse effects on the performance of affected structures should be identified during the § 25.901(c) assessment and accounted for when showing compliance with the requirements of part 25, subpart C, Structure, and subpart D, Design and Construction. This should be part of the assessment of failure condition effects for powerplant installation. Some examples of 8
AC 25.901-1 historical interdependencies between powerplant installations and structures include the following:
6.2.2.1 Fuel system failures that cause excessive fuel load imbalance.
6.2.2.2 Fuel vent, refueling, and feed system failures that cause abnormal internal fuel tank pressures.
6.2.2.3 Engine and propeller failures that cause excessive loads and/or vibration.
(See AC 25-24).
6.2.2.4 Powerplant installation failures that expose structures to extreme temperatures or corrosive material.
6.3 Crew and Maintenance Considerations.
Where the applicant’s analysis identifies that some indication to, and/or action by, the flightcrew or maintenance personnel is necessary to show that the design complies with §§ 25.901(c) and 25.1309(b), the applicant should refer to the guidance in AC 25.1309- 1B on crew and maintenance actions, as well as guidance in AC 25-19A on certification maintenance requirements (CMRs). Applicants may also find additional information in AC 120-17B, and SAE JA1012 for evaluating the effects of inspection and maintenance strategies on failure rates and effects.
7 SPECIFIC § 25.901(c) SYSTEM SAFETY ASSESSMENT GUIDANCE.
The purpose of § 25.901(c), in requiring compliance with § 25.1309, is to prompt the applicant to identify functional hazards and system level failure conditions applicable to powerplant installations. The following list of failure conditions that applicants should consider is by no means complete, but it captures many of the functional hazards and failure conditions that have been of concern in previous powerplant systems and installations.
7.1 General.
7.1.1 Some of the system level failure conditions related to powerplants can contribute to more than one airplane level failure condition (for example, fuel leakage can contribute to or cause loss of thrust, loss of center-of-gravity (CG) control, uncontrolled fire, and so forth). Likewise, several different system level failure conditions may contribute to the probability of the same airplane level failure condition (for example, catastrophic thrust loss may result from failures within the core engine, engine controls or indications, fuel system, and so forth). Hence, any one system level failure condition contributing to an airplane level failure condition often cannot be allowed to consume all the acceptable risk for that airplane level condition. The applicant should review the specific failure conditions identified during the preliminary SSA (refer to AC 25.1309- 1B for additional guidance on the analyses of preliminary or proposed systems design) for its installation against this guidance to assist in ensuring that all failure conditions have been identified and properly addressed.
AC 25.901-1
7.1.2 As stated in paragraph 6.1.1 of this AC, the assessment of these failure conditions may range from a simple report to a detailed failure analysis. The assessment criteria, process, analysis methods, validation, and documentation should be consistent with the guidance in AC 25.1309-1B.
7.1.3 The applicant should validate any assumption of fault isolation between redundancies or other safeguards. The engine-to-engine isolation requirement of § 25.903(b) is one area where this objective is prescribed in the regulations. Another example would be, if a fuel line passes through a firewall, care must be taken to ensure that no failure mode of the fireproof fitting would cause both a leak and violation of the firewall integrity.
Various methods can be used to corroborate an assumption of fault independence.
These include, but are not limited to, zonal analysis, fault insertion testing, and fault tree analysis AND-gate reviews (in other words, using targeted “common cause” assessments and structured methods documentation to verify that there are no foreseeable failures, operating, and/or environmental conditions that can affect the probability of multiple legs under an AND-gate within a fault tree).
7.1.4 A standard SSA used to show compliance with § 25.1309(b) per the guidance in AC
25.1309-1B should be performed to identify and assess all foreseeable failure conditions. This includes accounting for the potential loss of function, partial loss of function, malfunction, erroneous function, etc., as appropriate, using the guidance in AC 25.1309-1B. Paragraphs 7.2 through 7.8 describe some of the general airplane level failure conditions, functional hazards, and related powerplant system level failure conditions of concern.
7.1.5 Industry guidance in Appendix A of SAE ARP5150A, Safety Assessment of Transport Airplanes in Commercial Service, also provides examples of powerplant failures and their potential effects on airplane safety.
7.2 Thrust Loss and/or Excess Drag.
Thrust loss and/or excess drag can critically impact the performance and handling qualities of an airplane. These impacts may be a function of magnitude, direction, and the symmetry of the residual thrust and/or resultant drag. Some key types of these failure conditions include undetected thrust loss, detected thrust loss, unwanted thrust reversal, and excess drag.
7.2.1 Undetected Thrust Loss.
The SSA discussed in paragraph 6 of this AC should consider undetected thrust loss and its effect on airplane safety. The assessment should include an evaluation of the failure of components and systems that could cause an undetected thrust loss, except those already accounted for by the approved average-to-minimum engine assessment.
7.2.1.1 In determining the criticality of undetected thrust losses from a system design and installation perspective, all of the following should be considered: