0 AdvisoryU.S. Department of Transportation Federal Aviation Circular Administration Subject: Guidance Material for 14 CFR Date: 2/20/15 AC No: AC 33 .75-lA § 33.75, Safety Analysis Initiated By: ANE-111 Change: 1
1. Purpose. This advisory circular (AC) change updates the references provided in the original document. The AC provides guidance for demonstrating compliance with the safety analysis requirements of Title 14, of the Code of Federal Regulations (14 CFR) 33.75.
2. Principal Changes.
a. Paragraphs 3.a.(1), 3.b.(1) and (2), and 3.c.(1) and (2) are revised.
b. The change number and the date of the changed material are shown at the top of each page. The change bar in the right or left margin indicates the change. The changes above may shift the original text.
Page Control Chart Remove Pages Dated Insert Pages Dated 2 9/26/07 2 2/20/15
3. Website Availability. To access this AC electronically, go to the AC library at http://www.faa.gov/regulations policies/advisory circulars /.
Colleen M. D' Alessandro Assistant Manager, Engine & Propeller Directorate Aircraft Certification Service
Subject: GUIDANCE MATERIAL FOR 14 CFR Date: 9/26/07 AC No: 33.75-1A § 33.75, SAFETY ANALYSIS Initiated by: ANE-110
1. WHAT IS THE PURPOSE OF THE ADVISORY CIRCULAR? This advisory circular (AC) provides guidance and describes acceptable methods, but not the only methods, for demonstrating compliance with the safety analysis requirements of § 33.75 of Title 14 of the Code of Federal Regulations (14 CFR). The information provided in this AC replaces the guidance in AC 33.75-1, issued on March 4, 2005.
2. WHO DOES THIS AC APPLY TO?
a. The guidance provided in this document is directed to engine manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) engine type certification engineers and their designees.
b. This material is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. The FAA will consider other methods of demonstrating compliance that an applicant may elect to present. Terms such as “should,” “shall,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. On the other hand, if the FAA becomes aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation as the basis for finding compliance.
c. This material does not change, create any additional, authorize changes in, or permit deviations from existing regulatory requirements.
3. RELATED REFERENCE MATERIAL.
a. FAA Documents.
(1) AC 23.1309-1E, Safety Analysis and Assessment for Part 23 Airplanes, issued November 17, 2011.
(2) AC 25.1309-1A, System Design Analysis, issued June 21, 1988.
(3) AC 27-1B, Certification of Normal Category Rotorcraft, issued February 12, 2003.
(4) AC 29-2C, Certification of Transport Category Rotorcraft, issued February 12, 2003.
(5) Significant Airworthiness Information Bulletin (SAIB) NE-00-12 on Multipleengine Maintenance, issued February 1, 2000.
b. European Aviation Safety Agency (EASA) Documents.
(1) EASA CS-E 510, Safety Analysis (JAR-E 510).
(2) Acceptable Means of Compliance (AMC) CS-E 510, Failure Analysis (ACJ-E 510).
c. Industry Documents.
(1) SAE International Document No. ARP4754A, Guidelines for Development of Civil Aircraft and Systems, issued December 21, 2010.
(2) SAE International Document No. ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, issued December 1996.
(3) Carter, A.D.S., Mechanical Reliability (2nd ed.). Macmillan, 1986.
(4) Systematic Safety Assessment (CAA Leaflet AD/IL/0092/1-7) Draft 4, Issue 2; July 9, 1970, Paper #484.
4. DEFINITIONS. For the purposes of this AC, the following definitions apply:
a. Analysis. A specific and detailed qualitative or quantitative evaluation of the engine relative to the requirements of § 33.75. Examples include: Fault Tree Analysis (FTA), Failure Mode and Effects Analysis (FMEA) and Markov Analysis.
b. Assessment. A more general or broad evaluation of the engine that may include the results of the analysis completed, as well as any other information, to support compliance with §
33.75.
c. Check. An examination, inspection, or test to determine the physical integrity or the functional capability of an item.
d. Error. An omission or incorrect action by a crew member or person in charge of the maintenance, or a mistake in requirements, design, or implementation. An error may result in a failure but is not considered a failure in and of itself.
e. External Event. An occurrence that originates apart from the engine or aircraft (for example, icing or bird strikes).
f. Failure Condition. A condition with a direct, consequential engine-level effect, caused or contributed to by one or more failures. Examples include limitation of thrust to idle or oil exhaustion.
g. Failure Mode. The cause of the failure or the manner in which an item or function can fail. Examples include failures due to corrosion or fatigue or failure in jammed open position.
h. Redundancy. Multiple independent methods incorporated to accomplish a given function, each one of which is sufficient to accomplish the function.
i. System. A combination of inter-related items arranged to perform a specific function(s).
j. Toxic Products. Products that act as or have the effect of a poison when humans are exposed to them.
5. BACKGROUND.
a. The ultimate objective of a safety analysis is to ensure that the risk to the aircraft from all engine failure conditions is acceptably low. The basis of a safety analysis is the concept that an acceptable total engine design risk is achievable by managing the individual engine risks to acceptable levels. This concept emphasizes reducing the likelihood or probability of an event proportionally with the severity of its effects. The safety analysis should support the engine design goals so that major or hazardous engine effects resulting from engine failure modes do not exceed the required probability of occurrence.
b. Engine manufacturers and modifiers may show compliance with § 33.75 through a safety analysis substantiated, when necessary, by appropriate testing, comparable service experience, or both. Depending on the circumstances of the application or modification, a safety analysis can be:
• a report describing details associated with a failure condition;
• an interpretation of test results;
• a comparison of two similar components or assemblies;
• other qualitative information; or
• a detailed, in-depth analysis.
c. The analysis should consider the range of expected operations. There are failure conditions that only exist in certain aspects of operation or in certain missions; an analysis of the probability of their occurrence must consider the probability of that aspect or mission, combined with the subsequent probability of failure.
d. The depth and scope of an acceptable safety analysis also depends on the following:
(1) The complexity and criticality of the functions performed by the system(s), components, or assemblies under consideration;
(2) The severity of related failure conditions;
(3) The uniqueness of the design and extent of relevant service experience;
(4) The number and complexity of the identified failures; and
(5) The detectability of contributing failures.
6. SECTION 33.75 - GENERAL.
a. Section 33.75 defines the engine-level effects and presumed severity levels. The severity classifications of aircraft-level failure effects do not apply directly to engine safety assessments because the aircraft may have features that could reduce or increase the consequences of an engine failure condition. Additionally, the same type-certificated engine may be used in a variety of installations, each with its own aircraft-level severity classification of the same failure effect.
b. Aircraft-level requirements for individual failure conditions may be more severe than the engine-level requirements. Therefore, the engine manufacturer and the aircraft manufacturer should coordinate with each other, as well as with the relevant FAA certification offices, to ensure that the engine may be installed in the aircraft. Applicants should be aware of the possibility of more restrictive regulations in the installed condition.
7. SECTION 33.75(a)(1).
a. Rule Text. Section 33.75(a)(1) reads as follows: “The applicant must analyze the engine, including the control system, to assess the likely consequences of all failures that can reasonably be expected to occur. This analysis will take into account, if applicable:
(i) Aircraft-level devices and procedures assumed to be associated with a typical installation. Such assumptions must be stated in the analysis.
(ii) Consequential secondary failures and latent failures.
(iii) Multiple failures referred to in paragraph (d) of this section or that result in the hazardous engine effects defined in paragraph (g)(2) of this section.”
b. Guidance.
(1) The reference to a typical installation in § 33.75(a)(1)(i) does not imply that the aircraft-level effects are known. Instead, “typical installation” means that any aircraft devices and procedures, such as fire-extinguishing equipment, annunciation devices, etc., that the safety analysis assumes to be present should be clearly stated in the analysis. The applicant should also include such assumptions in the installation instructions under § 33.5(c). Regulations that cover the certification of aircraft (14 CFR parts 23, 25, 27, and 29) contain aircraft-level device requirements. These regulations include xx.1305, Powerplant instruments.
(2) A component level safety analysis may be an auditable part of the design process or may be conducted specifically for demonstration of compliance with this rule.
(3) The applicant should include possible latency period of failures in the assessment of failure probabilities.
(4) ‘Multiple failures’ are several components failing or malfunctioning independently or in a cascading fashion.
8. SECTIONS 33.75(a)(2) and 33.75(a)(3).
a. Rule Text. Section 33.75(a)(2) reads as follows: “The applicant must summarize those failures that could result in major engine effects or hazardous engine effects, as defined in paragraph (g) of this section, and estimate the probability of occurrence of those effects. Any engine part the failure of which could reasonably result in a hazardous engine effect must be clearly identified in this summary”
b. Rule Text. Section 33.75(a)(3) reads as follows: “The applicant must show that hazardous engine effects are predicted to occur at a rate not in excess of that defined as extremely remote (probability range of 10-7 to 10-9 per engine flight hour). Since the estimated probability for individual failures may be insufficiently precise to enable the applicant to assess the total rate for hazardous engine effects, compliance may be shown by demonstrating that the probability of a hazardous engine effect arising from an individual failure can be predicted to be not greater than 10-8 per engine flight hour. In dealing with probabilities of this low order of magnitude, absolute proof is not possible, and compliance may be shown by reliance on engineering judgment and previous experience combined with sound design and test philosophies.”
c. Guidance.
(1) The occurrence rate for hazardous engine effects applies to each individual effect.
The probability target of 10-7 or less per engine flight hour for each hazardous engine effect applies to the summation of the probabilities of that effect arising from individual failure modes or combinations of failure modes other than the failure of critical components (that is, disks, hubs, spacers). For example, the total rate of occurrence of uncontrolled fires, obtained by adding up the individual failure modes and combination of failure modes leading to an uncontrolled fire, should not exceed 10-7 per engine flight hour. If each individual failure is less than 10-8 per engine flight hour, summation is not required. That is, compliance may be shown by demonstrating that either:
1. each individual way of causing the particular hazardous engine effect is less than 10-8 per engine flight hour, or
2. all ways combined of causing the particular hazardous engine effect sum to less than 10-7 per engine flight hour.
(2) There is inherent difficulty in demonstrating very low failure probabilities for the primary failure of single components or parts—for example, the primary structural failure of a disk. This failure condition, which likely results directly in a hazardous engine effect, should be extremely remote. However, the specific numerical probability cannot be reasonably estimated or demonstrated. If the primary failure of critical single components or parts (disks, hubs, impellers, large rotating seals, and other similar large rotating components) is likely to result in hazardous engine effects, the applicant should rely on meeting the prescribed integrity requirements, such as those in §§ 33.15, 33.27, and 33.70. These requirements support a design goal, among others, that primary low-cycles fatigue (LCF) failure of the component should be extremely remote throughout its operational life.
(3) The primary failure of critical components such as disks, hubs, impellers, large rotating seals, and other similar large rotating components need not be included in the summation required for each hazardous engine effect.
9. SECTION 33.75(a)(4).
a. Rule Text. Section 33.75(a)(4) reads as follows: “The applicant must show that major engine effects are predicted to occur at a rate not in excess of that defined as remote (probability range of 10-5 to 10-7 per engine flight hour).”
b. Guidance. Applicants may show compliance with (a)(4) by demonstrating that the individual failures or combinations of failures resulting in major engine effects have probabilities not greater than 10-5 per engine flight hour. No summation of the individual failure modes or combinations of failure modes is necessary for the major engine effects.
10. SECTION 33.75(b).
a. Rule Text. Section 33.75(b) reads as follows: “T he FAA may require that any assumption as to the effects of failures and likely combination of failures be verified by test.”
b. Guidance. Prediction of the likely progression of some engine failures may rely extensively upon engineering judgment and is not susceptible to absolute proof. If the validity of such engineering judgment is in question to the extent that the conclusions of the analysis could be invalid, additional substantiation may be required. Additional substantiation may consist of reference to previous relevant service experience, engineering analysis, material, component, rig or engine test or a combination of these. If doubt of the validity of the substantiation exists, additional testing or other validation may be required.
11. SECTION 33.75(c).
a. Rule Text. Section 33.75(c) reads as follows: “The primary failure of certain single elements cannot be sensibly estimated in numerical terms. If the failure of such elements is likely to result in hazardous engine effects, then compliance may be shown by reliance on the prescribed integrity requirements of §§ 33.15, 33.27, and 33.70 as applicable. These instances must be stated in the safety analysis.”
b. Guidance. The intent of this section is to take account of the inherent difficulty of demonstrating very low failure probabilities for the primary failure of single components or parts – for example, the primary structural failure of a disk. The expectation is that this failure condition, which likely results directly in the hazardous engine effect of non-containment of high-energy debris, should be extremely remote, but the specific numerical probability cannot be estimated or demonstrated.
12. SECTION 33.75(d).
a. Rule Text. Section 33.75(d) reads as follows: “If reliance is placed on a safety system to prevent a failure from progressing to hazardous engine effects, the possibility of a safety system failure in combination with a basic engine failure must be included in the analysis. Such a safety system may include safety devices, instrumentation, early warning devices, maintenance checks, and other similar equipment or procedures. If items of a safety system are outside the control of the engine manufacturer, the assumptions of the safety analysis with respect to the reliability of these parts must be clearly stated in the analysis and identified in the installation instructions under § 33.5 of this part.”
b. Guidance. The safety system failure may be present as a latent failure or may occur simultaneously with, or subsequent to, the basic engine failure.
13. SECTIONS 33.75(e) and (e)(1).
a. Rule Text. Section 33.75(e) reads as follows: “If the safety analysis depends on one or more of the following items, those items must be identified in the analysis and appropriately substantiated.”
b. Rule Text. Section 33.75(e)(1) reads as follows: “Maintenance actions being carried out at stated intervals. This includes the verification of the serviceability of items that could fail in a latent manner. When necessary to prevent hazardous engine effects, these maintenance actions and intervals must be published in the instructions for continued airworthiness required under § 33.4 of this part. Additionally, if errors in maintenance of the engine, including the control system, could lead to hazardous engine effects, the appropriate procedures must be included in the relevant engine manuals.”
c. Guidance.
(1) The analysis summary should include general statements that refer to regular maintenance in a shop as well as on the line. The analysis should also note any specific failure rates that rely on special or unique maintenance checks.
(2) The engine maintenance manual, overhaul manual, or other relevant manuals may serve as substantiation for § 33.75(e)(1). A listing of all possible incorrect maintenance actions is not required.
d. Maintenance error lessons learned. Maintenance errors have contributed to serious events at the aircraft level. Many of these events have arisen from similar maintenance being performed on multiple engines during the same maintenance availability by one maintenance crew and are therefore primarily an aircraft-level concern. If appropriate, the applicant should consider communicating strategies against performing maintenance on multiple engines installed on the same aircraft as part of the same maintenance action (see, for example, SAIB NE-00-12 on “Multiple-engine Maintenance” or various requirements for Extended Operations (ETOPS) with Multi-Engine Airplanes. The applicant should also consider mitigating the effects of maintenance errors in the design phase. Components undergoing frequent maintenance should be designed to facilitate the maintenance and correct re-assembly of the component. However, completely eliminating sources of maintenance error during design is not possible.
(1) The following multiple engine maintenance errors have repeatedly occurred in service and have caused one or more serious events:
(a) Failure to restore oil system or borescope access integrity after routine maintenance (oil chip detector or filter check). Similar consideration should be given to other systems.
(b) Misinstallation of O-rings.
(c) Servicing with incorrect fluids.
(2) Improper maintenance on parts such as disks, hubs, and spacers has led to failures resulting in hazardous engine effects. Examples of this type of improper maintenance that have occurred in service are overlooking existing cracks or damage during inspection and failure to apply or incorrect application of protective coatings (for example, anti-gallant or anti-corrosive).
14. SECTION 33.75(e)(2).
a. Rule Text. Section 33.75(e)(2) reads as follows: “Verification of the satisfactory functioning of safety or other devices at pre-flight or other stated periods. The details of this satisfactory functioning must be published in the appropriate manual.”
b. Guidance. If the safety analysis relies on special or unique maintenance checks for protective devices, these assumptions should be identified in the analysis and appropriately substantiated by reference to the appropriate manuals.
15. SECTION 33.75(e)(3).
a. Rule Text. Section 33.75(e)(3) reads as follows: “The provisions of specific instrumentation not otherwise required.”
b. Guidance. If the assumptions or provisions of the safety analysis rely on specific instrumentation not required elsewhere, the analysis should state that information.
16. SECTION 33.75(e)(4).
a. Rule Text. Section 33.75(e)(4) reads as follows; “Flig ht crew actions to be specified in the operating instructions established under § 33.5.”
b. Guidance. If the safety analysis relies on special actions by the flight crew, these actions must be specified in the operating instructions established under § 33.5.
17. SECTION 33.75(f).
a. Rule Text. Section 33.75(f) reads as follows: “If applicable, the safety analysis must also include, but not be limited to, investigation of the following:
(1) Indicating equipment;
(2) Manual and automatic controls;
(3) Compressor bleed systems;
(4) Refrigerant injection systems;
(5) Gas temperature control systems;
(6) Engine speed, power, or thrust governors and fuel control systems;
(7) Engine overspeed, overtemperature, or topping limiters;
(8) Propeller control systems; and
(9) Engine or propeller thrust reversal systems.”
b. Guidance. The safety analysis is not limited to the items listed in § 33.75(f).
18. SECTIONS 33.75(g) and (g)(1).
a. Rule Text. Section 33.75(g) reads as follows: “Unless otherwise approved by the FAA and stated in the safety analysis, for compliance with part 33, the following failure definitions apply to the engine:”
b. Rule Text. Section 33.75(g)(1) reads as follows: “An engine failure in which the only consequence is partial or complete loss of thrust or power (and associated engine services) from the engine will be regarded as a minor engine effect.”
c. Guidance.
(1) Engine failures involving complete loss of thrust or power from the affected engine can be expected to occur in service. For the purposes of the engine safety analysis, the aircraft is assumed to be capable of controlled flight following such an event. Therefore, for the purpose of the engine safety analysis and engine certification, engine failure with no effect other than loss of thrust and services may be regarded as a comparatively safe failure with a minor engine effect.
This assumption may be revisited during aircraft certification, when installation effects such as engine redundancy may be fully taken into consideration. This reexamination applies only to aircraft certification and is not intended to affect engine certification.
(2) The safety analysis should cover the failure to achieve any given power or thrust rating for which the engine is certificated. Failure to achieve power or rating is regarded as a minor engine effect. This assumption may be revisited during aircraft certification, particularly multi-engine rotorcraft certification. This reexamination applies only to aircraft certification and is not intended to affect engine certification.
19. SECTION 33.75(g)(2).
a. Rule Text. Section 33.75(g)(2) reads as follows: “The following effects will be regarded as hazardous engine effects:”
b. Rule Text. Section 33.75(g)(2)(i) reads as follows: “Non-containment of high- energy debris;”
c. Guidance.
(1) Uncontained debris covers a large spectrum of energy levels due to the various sizes and velocities of parts released by the engine. The engine has a containment structure that is designed to contain the release of a single blade and its consequences; it is also often adequate to contain additional released blades and static parts. The engine containment structure is not expected to contain major rotating parts if they fracture. Disks, hubs, impellers, large rotating seals, and other similar large rotating components therefore always represent potential highenergy debris (and, thus, a hazardous engine effect).
(2) Uncontained blades from a multiple blade release are typically considered lowenergy fragments because their energy has been significantly reduced in defeating the containment structure. These events may typically be considered major engine effects.
However, the release of significant numbers of blades (for example, corn-cobbed rotors) will likely include fragments exiting with high energy, and would therefore result in a hazardous engine effect.
(3) Fan blades may have significant residual energy after defeating the containment structure, depending on the specifics of engine size, bypass ratio, and other design elements. The applicant should carefully consider the inclusion of fan blade uncontainment under high energy debris (and thus, hazardous engine effects) or low energy debris (major engine effects).
(4) The engine casings generally serve as the engine containment structure, as well as pressure vessels. Thus, the rupture of an engine casing due to pressure loads is inherently not contained. Service experience has shown that the rupture of the highest-pressure casings (compressor delivery pressure) can generate high-energy debris; it should therefore be treated as a hazardous engine effect.
d. Rule Text. Section 33.75(g)(2)(ii) reads as follows: “Concentration of toxic products in the engine bleed air intended for the cabin sufficient to incapacitate crew or passengers;”
e. Guidance.
(1) The generation and delivery of toxic products is considered a hazardous engine effect if the toxic concentration level results from abnormal engine operation and is sufficient to incapacitate the crew or passengers during the subject flight. To be a hazardous engine effect:
(a) The flow of toxic products would be so quick-acting as to be impossible to stop before incapacitation occurred; or
(b) There would be no effective means to stop the flow of incapacitating toxic products to the crew compartment or passenger cabin; or 11