AC 25.933-1
7.1.4 The inhibition of alerts relating to the thrust reverser system during critical phases of flight should be evaluated in relation to the total effect on flight safety. (See AC 25.1309-1B.)
7.1.5 Thrust reversal of a cyclic or erratic nature (for example, repeated deploy/stow movement of the thrust reverser) should be considered in the safety analysis and in the design of the alerting/indication systems.
7.1.6 Input from the flightcrew and human factors specialists should be considered in the design of the alerting and/or indication provisions.
7.1.7 The controllability compliance analysis should include the relevant thrust reversal scenario that could be induced by zonal threats such as uncontained engine rotor failure, fan blade failure, case burn through, or other fire threats. These are examples of failure conditions that may not be catastrophic on their own but may result in an unwanted thrust reversal.
7.1.8 If showing compliance using this “controllability option,” and if the airplane might experience an in-flight thrust reversal outside the “controllable flight envelope” anytime during the entire operational life of all airplanes of this type, then the applicant should follow the mixed controllability and reliability option in section 9 of this AC.
7.2 Structural Integrity.
7.2.1 For the “controllability option” provided by § 25.933(a)(1)(i), the airplane must be capable of successfully completing a flight during which an unwanted in-flight thrust reversal occurs. An assessment of the integrity of the airplane structure is necessary, including an assessment of the structure of the deployed thrust reverser and its attachments to the airplane.
7.2.2 In conducting this assessment, the normal structural loads, as well as those induced by failures and forced vibration (including buffeting, refer to § 25.251), both at the time of the event and for continuation of the flight, must be shown to be within the structural capability of the airplane.
7.2.3 If the thrust reverser system is capable of being restowed following a thrust reversal, only those loads associated with the interval of thrust reversal need to be considered.
Historically, thrust reversers have often been damaged as a result of unwanted thrust reversal during flight. Consequently, any claim that the thrust reverser is capable of being restowed must be adequately substantiated, taking into account possible thrust reverser damage experienced during the unwanted thrust reversal.
7.3 Performance.
7.3.1 General Considerations.
Most failure conditions that have an effect on performance are adequately accounted for by the requirements addressing a “regular” engine failure (in other words, involving only loss of thrust and not experiencing any reverser anomaly). This is unlikely to be 9
AC 25.933-1 the case for failures involving an unwanted in-flight thrust reversal, which can be expected to have a more adverse impact on thrust and drag than a regular engine failure.
Therefore, the appropriate probability of occurrence should be taken into account for unwanted in-flight thrust reversals. The applicant should account for performance as defined under paragraphs 7.3.2 and 7.3.3 of this AC as a function of the probability of the unwanted in-flight thrust reversal. For unwanted in-flight thrust reversals less probable than 1 x 10-9 per flight hour, certification may be based on reliability alone, as described in section 8 of this AC.
7.3.2 Probability of Unwanted In-Flight Thrust Reversal Greater than 1 x 10-7 per Flight Hour.
7.3.2.1 To show compliance with the “controllability option” provided by § 25.933(a)(1)(i), the applicant should account for performance based on the more critical of a traditional one-engine-inoperative (OEI) condition and an unwanted in-flight thrust reversal. To determine if the unwanted in-flight thrust reversal is more critical than an OEI, the traditional application of the performance requirements described in part 25, subpart B, as well as the applicable operating requirements, should be compared to the application of the criteria in paragraphs 7.3.2.1.1 through
7.3.2.1.3 below, which replace the airplane performance requirements that account for a critical engine inoperative with that of a critical unwanted in-flight thrust reversal:
7.3.2.1.1 Section 25.111, Takeoff Path.
The takeoff path should be determined with the critical unwanted thrust reversal occurring at VLOF instead of the traditional critical engine shutdown at VEF.8 No change to the state of the engine with the thrust reversal that requires action by the pilot may be made until the airplane is 400 feet above the takeoff surface.9
7.3.2.1.2 Section 25.121, Climb: One-Engine-Inoperative.
Compliance with the climb gradients should be shown with the critical unwanted in-flight thrust reversal, rather than the critical engine inoperative.
7.3.2.1.3 Section 25.123, En Route Flight Paths.
The en route flight paths should be determined following occurrence of the critical unwanted in-flight thrust reversal(s) instead of the critical engine shutdown(s) and allowing for the execution of appropriate crew procedures validated in accordance with applicable human factors regulations such as §§ 25.1302, 25.1322, and so forth. For compliance
8 See 14 CFR 1.2. VLOF means lift-off speed and VEF means the speed at which the critical engine is assumed to fail during takeoff.
9 This value is the minimum altitude at which flightcrews initiate configuration changes other than landing gear retraction. See AC 25-7D.
AC 25.933-1 with the applicable operating rules, an unwanted in-flight thrust reversal(s) at the most critical point en route should be substituted for the engine inoperative at the most critical point en route.
7.3.2.2 Performance data determined under the provisions of paragraphs 7.3.2.1.1 through 7.3.2.1.3 above, where critical, should be specified in the airplane flight manual as operating limitations.
7.3.2.3 The impact to airplane performance should be accounted for as a result of a critical unwanted in-flight thrust reversal at the most critical point in the route from the standpoint of the pertinent aspect under evaluation.
Operational data and advisory data related to fuel consumption, range, speeds, and any other pertinent performance impacts should be provided for the critical unwanted in-flight thrust reversal to assist the crew in decision making. The fuel consumption and range data may be supplied as simple factors or additives to apply to normal all-engines-operating fuel consumption and range data. For approvals to conduct extended operations, the critical unwanted in-flight thrust reversal should be considered when assessing compliance with § 25.1535 and applicable provisions of 14 CFR appendix K to part 25, as well as the critical fuel scenario (see AC 120-42B) associated with the applicable equal-time point (§ 121.646).
7.3.2.4 In addition to accounting for performance using the most critical of an OEI and an unwanted in-flight thrust reversal as it relates to the specific airplane performance requirements of subpart B, all other aspects of the airplane’s performance following a non-restowable in-flight thrust reversal (for example, capability to climb and maintain 1,000 feet above ground level (AGL))10 should be shown to comply with the applicable subpart B requirements to comply with § 25.933(a)(1)(i).
7.3.3 Probability of Unwanted In-Flight Thrust Reversal Equal to or Less than 1 x 10-7 per Flight Hour, But Greater than 1 x 10-9 per Fight Hour.
7.3.3.1 The same criteria under paragraph 7.3.2 of this AC should be applied for the purposes of providing advisory data and procedures to the flightcrew, with the exception of the takeoff phase of flight, which does not need to account for unwanted in-flight thrust reversal unless the reversal is the result of a single failure. Such performance data, however, does not need to be applied as operating limitations. The takeoff data addressed by paragraph 7.3.2 (takeoff speeds, if limited by VMC, takeoff path, and takeoff climb gradients) does not need to be provided, as it would be of only limited value if not applied as a dispatch limitation. However, if the unwanted in-flight thrust reversal during the takeoff phase is the result of a
10 This value represents the minimum safe altitude defined in 14 CFR 91.119(b).
AC 25.933-1 single failure, the takeoff data should be determined and applied as operating limitations.
7.3.3.2 As part of this assessment, the effect of an unwanted in-flight thrust reversal on approach climb performance (§ 25.121(d)), and the ability to execute a go-around maneuver, should be determined and used to specify crew procedures for an approach and landing following a thrust reversal.
For example, the procedures may specify the use of a flap setting less than that specified for landing, or an airspeed greater than the stabilized final approach airspeed, until the flightcrew is satisfied that a landing is assured, and a go-around capability no longer needs to be maintained.
Credit for the execution of such procedures, as well as consideration of alternative flightcrew behaviors, should be assessed in accordance with applicable human factors regulations. Where a number of thrust reversal states may occur, these procedures for approach and landing may be determined, at the option of the applicant, either for the critical thrust reversal state or for each thrust reversal state that is clearly distinguishable by the flightcrew.
7.3.3.3 Operational data and advice related to fuel consumption, range, speeds, and any other pertinent performance impacts should be provided for the critical unwanted in-flight thrust reversal to assist the crew in decision making. Fuel exhaustion risk should be addressed. The fuel consumption and range data may be supplied as simple factors or additives to apply to normal all-engines-operating fuel consumption and range data.
7.3.3.4 The airplane performance capabilities following a non-restowable in-flight thrust reversal should be shown such that the airplane is capable of continued safe flight and landing at a suitable airport (in other words, either destination or diversion). If the airplane cannot climb and maintain at least 1,000 feet AGL,11 this is considered preventing continued safe flight.
7.4 Handling Qualities.
7.4.1 Probability of Unwanted In-Flight Thrust Reversal Greater than 1 x 10-7 per Flight Hour.
7.4.1.1 To show compliance with the controllability and trim requirements of part 25, subpart B when using the method in this section 7, an applicant should use the more critical of an engine failure (i.e., flight with one engine inoperative) and an unwanted in-flight thrust reversal. In addition, the criteria defined under paragraph 7.4.2 of this AC also should be applied. To determine if the unwanted in-flight thrust reversal is more critical than an engine inoperative, the traditional application of the
11 The minimum safe altitude defined in § 91.119(b) 12
AC 25.933-1 controllability and trim requirements should be compared to the application of the criteria requirements in paragraphs 7.4.1.1.1 through
7.4.1.1.4 below. These criteria replace accounting for a critical engine failure with that of a critical unwanted in-flight thrust reversal.
7.4.1.1.1 Section 25.143, Controllability and Maneuverability—General.
The effect of a sudden unwanted in-flight thrust reversal of the critical engine, rather than the sudden shutdown of the critical engine, should be evaluated in accordance with § 25.143(b)(1) and the associated guidance material. Control forces associated with the failure should comply with § 25.143(d).
7.4.1.1.2 Section 25.147, Directional and Lateral Control.
The requirements of § 25.147(a) through (d) should be complied with following critical unwanted in-flight thrust reversal(s), rather than with one or more engines inoperative.
7.4.1.1.3 Section 25.149, Minimum Control Speed.
The values of VMC and VMCL12 should be determined with a sudden unwanted in-flight thrust reversal of the critical engine, rather than with a sudden shutdown of the critical engine.
7.4.1.1.4 Section 25.161, Trim.
The trim requirements of § 25.161(d) and (e) should be complied with following critical unwanted in-flight thrust reversal(s), rather than with one or more engines inoperative.
7.4.1.2 Compliance with the requirements in paragraphs 7.4.1.1.1 through
7.4.1.1.4 above should be shown by flight test. Simulation or analysis will not normally be an acceptable means of compliance for such probable failures.
7.4.2 Probability of Unwanted Thrust Reversal Equal to or Less than 1 x 10-7 per Flight Hour, But Greater than 1 x 10-9 per Flight Hour.
7.4.2.1 Failure conditions with a probability equal to or less than 1 x 10-7 per flight hour are not normally evaluated against the specific controllability and trim requirements of part 25, subpart B. Instead, the effects of unwanted in-flight thrust reversal should be evaluated on the basis of maintaining the capability for continued safe flight and landing, taking into account pilot recognition and reaction time. One exception is that the minimum control speed requirement of § 25.149 should be evaluated to
12 See 14 CFR 25.149(f). VMCL, the minimum control speed during approach and landing with all engines operating, is the calibrated airspeed at which, when the critical engine is suddenly made inoperative, it is possible to maintain control of the airplane with that engine still inoperative and maintain straight flight with an angle of bank of not more than 5 degrees.
AC 25.933-1 the extent necessary to support the performance criteria specified in paragraph 7.3.3 of this AC related to approach, landing, and go-around.
7.4.2.2 Recognition of the failure may be through the behavior of the airplane or an appropriate failure alerting system, and the recognition time should not be less than one second.13 It should be noted that § 25.1305(d)(2)(i) requires an indication when a thrust reversing device is not in the selected position; however, service experience shows that this indication may not be sufficient as the primary means of recognition for the crew in the event of an unwanted in-flight reversal. Following recognition, additional pilot reaction times should be taken into account, before any corrective pilot actions, as follows:
7.4.2.2.1 Landing—no additional delay.
7.4.2.2.2 Approach—one second.13
7.4.2.2.3 Climb, cruise, and descent—three seconds; except when in auto-pilot engaged maneuvering flight, or in manual flight, when one second should apply.13
7.4.2.3 Both auto-pilot engaged and manual flight should be considered.
7.4.2.4 The unwanted in-flight thrust reversal should not result in any of the following:
7.4.2.4.1 Exceedance of an airspeed halfway between VMO and VDF, or Mach number halfway between MMO and MDF.14
7.4.2.4.2 A stall.
7.4.2.4.3 A normal acceleration less than a value of 0g.
7.4.2.4.4 Bank angles of more than 60° en route, or more than 30° below a height of 1,000 feet AGL.15
7.4.2.4.5 Degradation of flying qualities assessed as greater than major for unwanted in-flight thrust reversal more probable than 1 x 10-7 per flight hour; or assessed as greater than hazardous for failures with a probability
13 See AC 25-7D for further discussions on pilot reaction times. One second represents the lowest value of pilot reaction time if the pilot is not using autoflight (i.e., pilot is “in the loop”). Three seconds is used when the pilot is using autoflight (i.e., pilot is “out of the loop”).
14 This is derived from the definition of VFC/MFC (§ 25.253(b), Maximum speed for stability characteristics) and used throughout 14 CFR subpart B. As defined in 14 CFR 1.2, VDF / MDF means demonstrated flight diving speed and VMO / MMO means maximum operating limit speed.
15 These values come from the Aviation Rulemaking Advisory Committee (ARAC) Powerplant Installation Harmonization Working Group (PPIHWG) recommendation report to Task 4–Thrust Reversing Systems, available on the internet at FAA ARAC Recommendation Report.
AC 25.933-1 equal to or less than 1 x 10-7 per flight hour, but greater 1 x 10-9 per flight hour.
7.4.2.4.6 Roll control forces exceeding those specified in § 25.143(d), except that the long-term roll control force should not exceed 10 pounds.16
7.4.2.4.7 Structural loads in excess of those specified under paragraph 7.2 of this AC.
7.4.2.5 Demonstrations of compliance may be by flight test, simulation, or analysis suitably validated by flight test or other data.
7.4.3 Probability of Unwanted In-Flight Thrust Reversal Less than 1 x 10-9 per Flight Hour.
Certification can be based on reliability alone as described in section 8 of this AC.
7.5 Flightcrew Training.
For compliance with the “controllability option,” when the expected consequences on the airplane due to in-flight thrust reversal are judged to be unusual compared to those for other failures, both basic and recurrent training in a flight simulator equipped with thrust reverser in-flight modeling should be considered to help assure flightcrew understanding of the following:
7.5.1 Transient Maneuver.
Recovery from the in-flight thrust reversal.
7.5.2 Continued Flight and Landing.
Maneuvering appropriate to the recommended procedure (including trim and unattended operation) and precision tracking (instrument landing system (ILS) guide slope tracking, speed/altitude tracking, and so forth).
8 RELIABILITY OPTION: PROVIDE CONTINUED SAFE FLIGHT AND
LANDING BY PREVENTING ANY UNWANTED IN-FLIGHT THRUST REVERSAL.
The following paragraphs provide guidance regarding an acceptable means of showing compliance with § 25.933(a)(1)(ii).
8.1 General.
For compliance to be established with § 25.933(a)(1) by showing that unwanted in-flight thrust reversal is not anticipated to occur (the “reliability option” provided for under § 25.933(a)(1)(ii)), the following must be taken into account if the applicant chooses to use the method provided by this section 8:
16 This value comes from the ARAC PPIHWG recommendation report for Task 4. See footnote 11. It represents relief from the value of 5 pounds required by § 25.143(d).
AC 25.933-1
8.1.1 Aspects of system reliability, maintainability, and fault tolerance.
8.1.2 Structural integrity.
8.1.3 Protection against zonal threats such as uncontained engine rotor failure, fan blade failure, case burn through, and other fire threats.
8.2 System Safety Assessment (SSA).
8.2.1 Any showing of compliance should include an assessment of the thrust reverser control, indication and actuation system(s), including all interfacing powerplant and airplane systems (such as electrical supply, hydraulic supply, flight/ground status signals, thrust lever position signals, and so forth), and maintenance. Refer to AC 25.1309-1B for more information on the methodology for safety analysis.
8.2.2 The reliability assessment should include:
8.2.2.1 All possible modes of normal operation and of failure. Possible modes of failure include full and partial reverse thrust conditions. Examples of partial reverse thrust conditions include, but are not limited to, asymmetric reverser deployment and arrested deployment (mechanically or electrically).
8.2.2.2 The resulting effect on the airplane considering the phase of flight and operating conditions.
8.2.2.3 The crew awareness of the failure conditions and the corrective action required.
8.2.2.4 Failure detection capabilities and maintenance procedures.
8.2.2.5 The likelihood of the failure condition.
8.2.3 Consideration should be given to failure conditions accompanied or caused by external events or errors.
8.2.4 The SSA should be used to identify critical failure paths for the purpose of conducting in-depth validation of their supporting failure modes, failure rates, exposure times, reliance on redundant subsystems, and assumptions, if any. In addition, the SSA can be used to determine acceptable time intervals for any required maintenance intervals per AC 25.1309-1B and AC 25-19A.
8.2.5 The primary intent of the reliability compliance option is to improve safety by promoting more reliable designs and better maintenance, including minimizing pre-existing faults, whether latent or detected and allowed to persist. However, it also recognizes that flexibility of design and maintenance are necessary for practical application.
AC 25.933-1
8.2.6 The thrust reverser system should be designed so that any in-flight thrust reversal that is not shown to be “controllable” in accordance with section 7 of this AC is extremely improbable and does not result from a single failure or malfunction (in other words, complies with § 25.1309(b)(1)).
8.2.7 Section 25.1309(b)(4) requires all practical action be taken to eliminate any significant latent failure that could contribute to an in-flight deployment not meeting § 25.933(a)(1). Where the FAA finds it is impractical to eliminate a given significant latent failure (SLF), the applicant must minimize the time the failure is expected to be present. The elimination and minimization requirement of § 25.1309(b)(4) does not apply to SLFs where the system failure condition meets the safety objectives of § 25.1309(b)(1) or (b)(2) with the assumption that the latent failure has occurred.
8.2.7.1 It has usually been deemed practical to limit the exposure to the presence of a latent failure that contributes to the risk of a catastrophic in-flight thrust reversal such that the product of that exposure and the frequency of occurrence of the failure is 1 x 10-3 or less. This criterion was recommended by the Aviation Rulemaking Advisory Committee.17
8.2.7.2 The exposure prediction should take into account the expected delays in detection, isolation, and repair. Any failure that does not meet this criterion should be highlighted and justified to the certifying authority as early as possible in the certification program.
8.2.8 Section 25.1309(b)(5) requires all practical actions be taken to avoid any catastrophic failure condition resulting from two failures, either of which could be latent for more than one flight. Modern thrust reverser designs have shown that it is practical to avoid catastrophic in-flight reversal due to such “latent plus one” failure conditions.
Therefore, for any new proposed designs where combinations of two-failures result in catastrophic in-flight thrust reversal, neither failure may be pre-existing (in other words, neither failure can be undetected nor allowed to exist for more than one flight). The means of failure detection must be appropriate in consideration of the monitoring device reliability, inspection intervals, and procedures.
8.2.9 As an alternative to meeting the criteria in paragraphs 8.2.7 and 8.2.8 of this AC to show compliance with § 25.1309(b)(4) and (b)(5), the FAA has made compliance findings based upon an applicant’s demonstrations that, in any anticipated dispatch configuration, the airplane will continue to meet the criteria that “no single failure” is catastrophic, and for specific combinations of pre-existing faults that the risk of catastrophic in-flight deployment is less than 1 x 10-6 per flight hour. This analysis is only required if the design can have contributory pre-existing faults present, whether latent or detected and allowed to persist for more than one flight. This analysis must consider any airplane configuration (including latent faults) anticipated to occur in the fleet life of the airplane type. For the purpose of this analysis, a configuration at
17 See ARAC PPIHWG recommendation report to Task 4–Thrust Reversing Systems, available on the internet at FAA ARAC Recommendation Report.
AC 25.933-1 dispatch whose probability of occurrence is greater than 1 x 10-7 per flight hour must be expected to occur.
8.2.10 Section 25.1309(c) requires that information concerning unsafe system operating conditions be provided to the flightcrew to enable them to take appropriate corrective action in a timely manner, thereby mitigating the effects of the failure condition to an acceptable level. See AC 25.1309-1B and AC 25.1322-1 for additional guidance.
8.2.10.1 Any failure condition that leaves an airplane one failure away from a catastrophic in-flight thrust reversal is normally considered to be an unsafe system operating condition and should result in appropriate flightcrew alerting, in accordance with § 25.1322, or be self-evident to the crew.
8.2.10.2 In addition to crew awareness, any other flightdeck indications, procedures, and/or training required to enable the crew to take necessary actions, such as discontinuing a takeoff, going to a controllable flight envelope en route, diverting to a suitable airport, or reconfiguring the system in order to recover single failure tolerance, and so forth, should also be provided.
8.3 Structural Aspects.
For this “reliability option,” those structural load paths that affect thrust reversal should be shown to comply with the static strength, fatigue, damage tolerance, and deformation requirements of part 25. Further, there should be no single load path in which failure would result in a catastrophic thrust reversal. Taken together this will ensure that unwanted in-flight thrust reversal is not anticipated to occur due to failure of a structural load path, or due to loss of retention under ultimate load throughout the operational life of the airplane.
8.4 Uncontained Rotor Failure.
In case of rotor failure, compliance with § 25.903(d)(1) must be shown in addition to § 25.933(a)(1). Applicants should use advisory materials (e.g., AC 20-128A, its User’s Manual in Appendix 1, and so forth) supplemented by the methods described below.
The FAA considers it practical for applicants to show the airplane design has features to prevent a catastrophic in-flight thrust reversal due to an uncontained engine rotor failure. The effects of associated loads and vibration on the reverser system should be considered in all of the following methods of minimizing hazards:
8.4.1 Show that engine spool-down characteristics or potential reverser damage is such that compliance can be shown by means of the controllability option in section 7 of this AC.
8.4.2 Show that forces that keep the thrust reverser in a stable, stowed position during and after the rotor burst event are adequate.
8.4.3 Locate the thrust reverser system outside the rotor burst zone.
8.4.4 Protection of thrust reverser restraint devices. See paragraph 8.5 below for guidance.
AC 25.933-1
8.5 Protection of Thrust Reverser Restraint Devices.
The following guidance material describes methods of minimizing the hazard to restraint devices for thrust reverser stow position, located within rotorburst zones. The following guidance material has been developed on the basis of all of the data available to date and engineering judgment.
8.5.1 Fragment Hazard Model.
8.5.1.1 Large Fragments.
8.5.1.1.1 Ring Disks.
See figure 1. Compressor drum rotors or spools with ring disks have typically failed in a rim peeling mode when failure origins are in the rim area. This type of failure typically produces uncontained fragment energies that are mitigated by a single layer of conventional aluminum honeycomb structure. It should be noted that this guidance material is based upon field experience and, as such, its application should be limited to aluminum sheet and honeycomb fan reverser construction. Typical construction consists of one-half inch thickness of 0.003 to 0.004 aluminum foil honeycomb with 0.030-inch thick aluminum facing sheets.18 Alternative materials and methods of construction should have at least equivalent impact energy absorption characteristics. Failures with the origins in the bore of these same drum sections have resulted in fragments that can be characterized as a single 1/3 disk fragment and multiple smaller fragments. The 1/3 disk fragment may or may not be contained by the thrust reverser structure. The remaining intermediate and small disk fragments, while escaping the engine case, have been contained by the thrust reverser structure.
Figure 1. Cross-Section of Ring Disk Drum Rotor
18 See footnote 11.
AC 25.933-1
8.5.1.1.2 Deep Bore Disks and Single Disks.
For compressor drum rotors or spools with deep bore disks (Figure 2), and single compressor and turbine disks (Figure 3), the experience, while limited, indicates either a 1/3 and a 2/3 fragment, or a 1/3 fragment and multiple intermediate and small discrete fragments should be considered.
These fragments can be randomly released within an impact area that ranges ±5° from the plane of rotation.
Figure 2. Cross-Section of Deep Bore Disk Drum
Fi gure 3. Cross-Section of Single-Stage Deep Bore Disk
8.5.1.2 S mall Fragments (Debris).
Consider small fragments (see paragraph 9d of AC 20-128A) that could impact the thrust reverser at ±15° axial spread angle.