(c) The toxic products would be undetectable before incapacitation.
Toxic products could result from the degradation of abradable materials in the compressor when rubbed by rotating blades or from the degradation of oil that could leak into the compressor air flow.
(2) Applicants should not make assumptions about cabin air dilution or mixing in this engine-level analysis. Those assumptions can only be properly evaluated during aircraft certification. Applicants may show compliance with § 33.75(g)(2)(ii) through analyzing the relative concentration of toxic products in engine bleed air.
(3) Since these concentrations are of interest to the installer, the applicant should provide information on delivery rates and concentrations of toxic products in the engine bleed air for the cabin to the installer as part of the installation instructions.
f. Rule Text. Section 33.75(g)(2)(iii) reads as follows: “Significant thrust in the opposite direction to that commanded by the pilot;”
g. Guidance. Engine failures resulting in significant thrust in the opposite direction to that commanded by the pilot can, depending on the flight phase, result in a hazardous condition relating to aircraft controllability. Those failures, if applicable to part 33 certification, that could be classified as hazardous engine events include:
(1) Uncommanded thrust reverser deployment;
(2) The unintended movement of the propeller blades below the established minimum in-flight low-pitch position; and
(3) High forward thrust when reverse thrust is commanded.
h. Rule Text. Section 33.75(g)(2)(iv) reads as follows: “Uncontrolled fire;”
i. Guidance. An uncontrolled fire is an extensive or persistent fire that is not effectively confined to a designated fire zone or that cannot be extinguished by using the aircraft means identified by the assumptions of the safety analysis. Provision for flammable fluid drainage, fire containment, fire detection, and fire extinguishing, may be considered when assessing the severity of the effects of a fire.
j. Rule Text. Section 33.75(g)(2)(v) reads as follows: “Failure of the engine mount system leading to inadvertent engine separation;”
k. Guidance. Failure of the engine mount system leading to engine separation is considered a hazardous engine effect since the separated engine may impact the aircraft and destroy critical systems or structures in flight. Service experience has shown that this level of 12
damage may occur during separations at high engine thrust levels. Causes of engine mount system failure may include not only the high loads associated with severe engine damage, but also fatigue originating from handling damage, or from corrosion or inadequate strength associated with manufacturing or maintenance error.
l. Rule Text. Section 33.75(g)(2)(vi) reads as follows: “Release of the propeller by the engine, if applicable; and”
m. Guidance. If the engine is designed for use with a propeller, release of the propeller due to engine failure modes is considered a hazardous engine effect.
n. Rule Text. Section 33.75(g)(2)(vii) r eads as follows: “Complete inability to shut the engine down.”
o. Guidance.
(1) Complete inability to shut down the engine is considered a hazardous engine effect because some circumstances of continued engine operation, even at low thrust or power, could represent a hazard. These circumstances include the inhibition of the safe evacuation of passengers and crew, directional control problems during landing due to the inability to eliminate thrust or power, and the inability to ensure safe shut down when required following a failure.
(2) Allowing for aircraft-supplied equipment (fuel cutoff means, etc.) to protect against the “complete inability” to shut down the engine is acceptable. A time delay of several minutes, but normally not more than 5 minutes, is acceptable between initiation of the shutdown and termination of the combustion cycle.
(3) The inclusion of “complete inability to shut the engine down” as a hazardous engine effect does not preclude hardware or software intended to protect against inadvertent engine shutdown, including aircraft logic to mitigate against the inadvertent shutdown of all engines.
20. SECTION 33.75(g)(3).
a. Rule Text. Section 33.75(g)(3) reads as follows: “An effect whose severity falls between those effects covered in paragraphs (g)(1) and (g)(2) of this section will be regarded as a major engine effect.”
b. Guidance. Major engine effects are those effects likely to significantly increase crew workload or reduce the safety margins between the engine operating condition and a hazardous engine failure. The items listed below represent a guide to the scope of major engine effects.
Not all of these items apply to all engines due to differing engine design features, and the list does not include all possible effects.
(1) Controlled fires (that is, those fires brought under control by shutting down the engine or by on-board extinguishing systems).
(2) Case burnthrough when it can be shown that there is no propagation to hazardous engine effects.
(3) Release of low-energy debris when applicants can show that the release does not progress to a hazardous engine effect.
(4) Vibration levels that result in crew discomfort.
(5) Concentration of toxic products in the engine bleed air for the cabin sufficient to degrade crew performance. Note: This is the same consideration as for a hazardous engine effect, but the toxic products are slow-enough acting or are readily detectable so that crew action is able to stop the toxic product generation or delivery prior to incapacitation. If appropriate, applicants should also consider the possible reduction in crew capabilities due to exposure while the crew is identifying and stopping the toxic products. Because these concentrations are of interest to the installer, the applicant should provide information on delivery rates and concentrations of toxic products in the engine bleed air for the cabin to the installer as part of the installation instructions.
(6) Thrust in the opposite direction to that commanded by the pilot, below the level defined as a hazardous engine effect.
(7) Generation of thrust greater than maximum rated thrust.
(8) Loss of engine support loadpath integrity without actual engine separation.
(9) Significant uncontrollable thrust oscillation.
21. OTHER CONSIDERATIONS.
a. Improper operation. Errors in engine operation have contributed to serious events at the aircraft level. The applicant should consider mitigating the effects of improper engine operation or providing operating instructions that reduce the likelihood of improper operation. In particular, abnormal engine symptoms and the desired response or appropriate procedures for trouble-shooting these symptoms should be communicated to the installer (reference § 33.5).
b. Assembly. If the incorrect assembly of parts could result in hazardous engine effects, those parts should be designed to minimize the risk of incorrect assembly, or, if this is not practical, be permanently marked to indicate their correct position when assembled.
22. ANALYTICAL TECHNIQUES.
a. The depth and scope of an acceptable safety assessment depends on the complexity and criticality of the functions performed by the system(s), components, or assemblies under consideration, the severity of related failure conditions, the uniqueness of the design and extent of relevant service experience, the number and complexity of the identified causal failure scenarios, and the detectability of contributing failures.
b. There are various techniques for performing a safety analysis; the ones listed below represent two of the most commonly used methods. An applicant may propose other comparable techniques, and variations or combinations of these techniques are also acceptable. For derivative engines, limiting the scope of the analysis to modified components or operating conditions and their effects on the rest of the engine is acceptable. The applicant and the engine certification office should agree early in the certification program on the scope and methods of assessment to be used.
c. Various methods for assessing the causes, severity levels, and likelihood of potential failure conditions are available to support experienced engineering judgment. The various types of analyses are based on either inductive or deductive approaches. Brief descriptions of typical methods are provided below; more detailed descriptions of analytical techniques may be found in the documents referenced in paragraph 3 of this AC.
(1) Failure Modes and Effects Analysis. An FMEA is a structured, inductive, bottomup analysis that is used to evaluate the effects on the engine system of each possible element or component failure. When properly formatted, it will aid in identifying latent failures and the possible causes of each failure mode.
(2) Fault Tree or Dependence Diagram (Reliability Block Diagram) Analyses. These analyses are structured, deductive, top-down analyses that are used to identify the conditions, failures, and events that would cause each defined failure condition. These analyses are graphical methods of identifying the logical relationship between each particular failure condition and the primary element or component failures, other events, or their combinations that can cause the failure condition. A Fault Tree Analysis is failure-oriented and is conducted from the perspective of which failures must occur to cause a defined failure condition. A Dependence Diagram Analysis is success-oriented and is conducted from the perspective of which failures must not occur to preclude a defined failure condition.
//signed by Thomas A. Boudreau// Thomas A. Boudreau Acting Manager, Engine & Propeller Directorate Aircraft Certification Service 15