Appendix 1 to AMC 20-128A User’s Manual

ED Decision 2003/12/RM

RISK ANALYSIS METHODOLOGY for UNCONTAINED ENGINE/APU FAILURE

INDEX

1.0       GENERAL

2.0       SCOPE

3.0       FUNDAMENTAL COMPONENTS OF A SAFETY AND RISK ANALYSIS

4.0       ASSUMPTIONS

5.0       PLOTTING

6.0       METHODOLOGY – PROBABILITY ASSESSMENT

7.0       RESULTS ASSESSMENT

1.0       GENERAL

1.1       The design of aeroplane and engine systems and the location of the engines relative to critical systems and structure have a significant impact on survivability of the aeroplane following an uncontained engine failure. CS 23.903(b)(1) and 25.903(d)(1) of the EASA Certification Specifications (CS) require that design precautions be taken to minimise the hazard to the aeroplane due to uncontained failures of engine or auxiliary power unit (APU). AMC 20-128A provides guidance for demonstrating compliance with these requirements.

1.2       As a part of this compliance demonstration, it is necessary to quantitatively assess the risk of a catastrophic failure in the event of an uncontained engine failure. This User’s Manual describes an acceptable method for this purpose.

1.3       The objective of the risk analysis is to measure the remaining risk after prudent and practical design considerations have been taken. Since each aeroplane would have unique features which must be considered when applying the methods described in this manual, there should be some flexibility in the methods and procedures.

1.4       It is a preferred approach to use these methods throughout the development of an aeroplane design to identify problem areas at an early stage when appropriate design changes are least disruptive. It is also advisable to involve the European Aviation Safety Agency (EASA) in this process at an early stage when appropriate interpretation of the methodology and documentation requirements can be established.

1.5       It should be noted that although the risk analysis produces quantitative results, subjective assessments are inherent in the methods of the analysis regarding the criticality of specific types of aeroplane component failures. Assumptions for such assessments should be documented along with the numerical results.

1.6       Aeroplane manufacturers have each developed their own method of assessing the effects of rotor failure, as there are many ways to get to the same result. This User’s Manual identifies all the elements that should be contained in an analysis, so that it can be interpreted by a person not familiar with such a process.

1.7       The intent of this manual therefore is to aid in establishing how an analysis is prepared, without precluding any technological advances or existing proprietary processes.

1.8       AMC 20-128A makes allowance for the broad configuration of the aeroplane as such damage to the structure due to rotor failure generally allows for little flexibility in design. System lay-out within a rotor burst zone, however, can be optimized.

1.9       Damage to structure, which may involve stress analysis, generally can be analyzed separately, and later coordinated with simultaneous system effects.

1.10    For an analysis of the effects on systems due to a rotor failure the aeroplane must be evaluated as a whole; and a risk analysis must specifically highlight all critical cases identified which have any potential to result in a catastrophe.

1.11    Such an analysis can then be used to establish that reasonable precautions have been taken to minimise the hazards, and that the remaining hazards are an acceptable risk.

1.12    A safety and a risk analysis are interdependent, as the risk analysis must be based on the safety analysis.

The safety analysis therefore is the starting point that identifies potential hazardous or catastrophic effects from a rotor failure and is the basic tool to minimise the hazard in accordance with the guidelines of AMC 20-128A.

1.13    The risk analysis subsequently assesses and quantifies the residual risk to the aeroplane.

2.0       SCOPE

The following describes the scope of analyses required to assess the aeroplane risk levels against the criteria set forth in Paragraph 10 of AMC 20-128A.

2.1       Safety

Analysis is required to identify the critical hazards that may be numerically analyzed (hazards remaining after all practical design precautions have been taken).

Functional criticality will vary by aeroplane and may vary by flight phase.

Thorough understanding of each aeroplane structure and system functions is required to establish the criticality relative to each fragment trajectory path of the theoretical failure.

Assistance from experts within each discipline is typically required to assure accuracy of the analysis in such areas as effects of fuel tank penetration on leakage paths and ignition hazards, thrust level control (for loss of thrust assessment), structural capabilities (for fuselage impact assessment), aeroplane controllability (for control cables impact assessment), and fuel asymmetry.

2.2       Risk

For each remaining critical hazard, the following assessments may be prepared using the engine/APU failure models as defined in Paragraph 9 of AMC 20-128A:

a.         Flight mean risk for single 1/3 disc fragment.

b.        Flight mean risk for single intermediate fragment.

c.         Flight mean risk for alternate model (when used as an alternate to the 1/3 disc fragment and intermediate fragment).

d.        Multiple 1/3 disc fragments for duplicated or multiplicated systems.

e.        Specific risk for single 1/3 disc fragment and single intermediate fragment.

f.         Specific risk for any single disc fragment that may result in catastrophic structural damage.

The risk level criteria for each failure model are defined in Paragraph 10 of AMC 20-128A.

3.0       FUNDAMENTAL COMPONENTS OF A SAFETY AND RISK ANALYSIS

3.1       The logical steps for a complete analysis are:

a.         Establish at the design definition the functional hazards that can arise from the combined or concurrent failures of individual systems, including multiplicated systems and critical structure.

b.        Establish a Functional Hazard Tree (see Figure 1), or a System Matrix (see Figure 2) that identifies all system interdependencies and failure combinations that must be avoided (if possible) when locating equipment in the rotor burst impact area.

In theory, if this is carried out to the maximum, no critical system hazards other than opposite engine or fuel line hits would exist.

c.         Establish the fragment trajectories and trajectory ranges both for translational and spread risk angles for each damage. Plot these on a chart or graph, and identify the trajectory ranges that could result in hazardous combinations (threats) as per the above system matrix or functional hazard analysis.

d.        Apply risk factors, such as phase of flight or other, to these threats, and calculate the risk for each threat for each rotor stage.

e.        Tabulate, summarize and average all cases.

3.2       In accordance with AMC 20-128A the risk to the aeroplane due to uncontained rotor failure is assessed to the effects, once such a failure has occurred.

The probability of occurrence of rotor failure, as analyzed with the probability methods of AMC 25.1309 (i.e. probability as a function of critical uncontained rotor failure rate and exposure time), does not apply.

3.3       The total risk level to the aeroplane, as identified by the risk analysis, is the mean value obtained by averaging the values of all rotor stages of all engines of the aeroplane, expressed as Flight Mean Risk.

4.0       ASSUMPTIONS

4.1       The following conservative assumptions, in addition to those in Paragraphs 10(a)(1), (2) and (3) of AMC 20-128A, have been made in some previous analyses. However, each aeroplane design may have unique characteristics and therefore a unique basis for the safety assessment leading to the possibility of different assumptions. All assumptions should be substantiated within the analysis:

a.         The 1/3 disc fragment as modeled in Paragraph 9(a) of the AMC 20-128A travels along a trajectory path that is tangential to the sector centroid locus, in the direction of rotor rotation (Refer to Figure 3).

The sector fragment rotates about its centroid without tumbling and sweeps a path equal to twice the greatest radius that can be struck from the sector centroid that intersects its periphery.

The fragment is considered to possess infinite energy, and therefore to be capable of severing lines, wiring, cables and unprotected structure in its path, and to be undeflected from its original trajectory unless deflection shields are fitted. However, protective shielding or an engine being impacted may be assumed to have sufficient mass to stop even the most energetic fragment.

b.        The probability of release of debris within the maximum spread angle is uniformly distributed over all directions.

c.         The effects of severed electrical wiring are dependent on the configuration of the affected system. In general, severed wiring is assumed to not receive inadvertent positive voltage for any significant duration.

d.        Control cables that are struck by a fragment disconnect.

e.        Hydraulically actuated, cable driven control surfaces, which do not have designated “fail to” settings, tend to fail to null when control cables are severed. Subsequent surface float is progressive and predictable.

f.         Systems components are considered unserviceable if their envelope has been touched. In case of an engine being impacted, the nacelle structure may be regarded as engine envelope, unless damage is not likely to be hazardous.

g.         Uncontained events involving in-flight penetration of fuel tanks will not result in fuel tank explosion.

h.        Unpowered flight and off-airport landings, including ditching, may be assumed to be not catastrophic to the extent validated by accident statistics or other accepted factors.

i.          Damage to structure essential for completion of flight is catastrophic (Ref. AMC 20-128A, Paragraph 10.b(1)).

j.          The flight begins when engine power is advanced for takeoff and ends after landing when turning off the runway.

5.0       PLOTTING

5.1       Cross-section and plan view layouts of the aeroplane systems in the ranges of the rotor burst impact areas should be prepared, either as drawings, or as computer models

These layouts should plot the precise location of the critical system components, including fuel and hydraulic lines, flight control cables, electric wiring harnesses and junction boxes, pneumatic and environmental system ducting, fire extinguishing; critical structure, etc.

5.2       For every rotor stage a plane is developed. Each of these planes contains a view of all the system components respective outer envelopes, which is then used to generate a cross-section. See Figure 4.

5.3       Models or drawings representing the various engine rotor stages and their fore and aft deviation are then generated.

5.4       The various trajectory paths generated for each engine rotor stage are then superimposed on the cross-section layouts of the station planes that are in the range of that potential rotor burst in order to study the effects (see Figure 5). Thus separate plots are generated for each engine rotor stage or rotor group.

To reduce the amount of an analysis the engine rotor stages may also be considered as groups, as applicable for the engine type, using the largest rotor stage diameter of the group.

5.5       These trajectory paths may be generated as follows and as shown in Figure 6:

a.         Two tangent lines T1 are drawn between the locus of the centroid and the target envelope.

b.        At the tangent line touch points, lines N1 and N2 normal to the tangent lines, are drawn with the length equal to the radius of the fragment swept path (as also shown in Figure 1).

c.         Tangent lines T2 are drawn between the terminal point of the normal lines and the locus of the centroid. The angle between these two tangent lines is the translational risk angle.

5.6       The entry and exit angles are then calculated.

5.7       The initial angle of intersection and the final angle of intersection are recorded, and the trajectories in between are considered to be the range of trajectories in which this particular part would be impacted by a rotor sector, and destroyed (i.e. the impact area).

The intersections thus recorded are then entered on charts in tabular form so that the simultaneous effects can be studied. Refer to Figure 8.

Thus it will be seen that the total systems’ effects can be determined and the worst cases identified.

5.9       If a potentially serious multiple system damage case is identified, then a more detailed analysis of the trajectory range will be carried out by breaking the failure case down into the specific fore-aft spread angle, using the individual rotor stage width instead of combined groups, if applicable.

6.0       METHODOLOGY – PROBABILITY ASSESSMENT

6.1       Those rotor burst cases that have some potential of causing a catastrophe are evaluated in the analysis in an attempt to quantify an actual probability of a catastrophe, which will, in all cases, depend on the following factors:

a.         The location of the engine that is the origin of the fragment, and its direction of rotation.

b.        The location of critical systems and critical structure.

c.         The rotor stage and the fragment model.

d.        The translational trajectory of the rotor fragment,

e.        The specific spread angle range of the fragment.

f.         The specific phase of the flight at which the failure occurs.

g.         The specific risk factor associated with any particular loss of function.

6.2       Engine Location

The analysis should address the effects on systems during one flight after a single rotor burst has occurred, with a probability of 1.0. As the cause may be any one of the engines, the risk from each engine is later averaged for the number of engines.

The analysis trajectory charts will then clearly show that certain system damage is unique to rotor fragments from a particular engine due to the direction of rotation, or, that for similar system damage the trajectory range varies considerably between engines.

A risk summary should table each engine case separately with the engine location included.

6.3       Rotor Element

The probability of rotor failure is assumed to be 1.0 for each of all rotor stages. For the analysis the individual risk(s) from each rotor stage of the engine should be assessed and tabled.

6.4       Translational Risk Angle

The number of degrees of included arc (out of 360) at which a fragment intersects the component/structure being analyzed. Refer to Figure 6 and Figure 7.

6.5       Trajectory Probability (P)

The probability of a liberated rotor fragment leaving the engine case is equal over 360, thus the probability P of that fragment hitting a system component is the identified Translational Risk Angle ɸ in degrees °, divided by 360, i.e.

or

6.6       Spread Angle

If the failure model of the analysis assumes a (fore and aft) spread of ± 5°, then the spread angle is a total of 10°. If a critical component can only be hit at a limited position within that spread, then the exposure of that critical component can then be factored according to the longitudinal position within the spread angle, e.g.:

If a component can only be hit at the extreme forward range of +4° to +5°, then the factor is .1 (for one degree out of 10).

6.7       Threat Window

The definition of a typical threat window is shown in Figure 7.

6.8       Phase of Flight

Certain types of system damage may be catastrophic only during a specific portion of the flight profile, such as a strike on the opposite engine during take-off after V1 (i.e. a probability of 1.0), while with altitude a straight-ahead landing may be possible under certain favourable conditions (e.g. a probability of less than 1.0). The specific case can then be factored accordingly.

6.8.1   The most likely time for an uncontained rotor failure to occur is during take-off, when the engine is under highest stress. Using the industry accepted standards for the percentage of engine failures occurring within each flight phase, the following probabilities are assumed:

6.8.2   The flight phase failure distribution above is used in the calculations of catastrophic risk for all cases where this risk varies with flight phase.

6.9       Other Risk Factors

Risks such as fire, loss of pressurization, etc., are individually assessed for each case where applicable, using conservative engineering judgment. This may lead to a probability of catastrophe (i.e., risk factor) smaller than 1.0.

6.9.1   The above probabilities and factors are used in conjunction with the critical trajectory range defined to produce a probability of the specific event occurring from any random rotor burst.

This value is then factored by the "risk" factor assessed for the case, to derive a calculated probability of catastrophe for each specific case.

Typical conditional probability values for total loss of thrust causing catastrophic consequences are:

6.10    All individual case probabilities are then tabled and summarised.

6.11    The flight mean values are obtained by averaging those for all discs or rotor stages on all engines across a nominal flight profile.

The following process may be used to calculate the flight mean value for each Failure Model:

a.         Establish from the table in Figure 8 the threat windows where, due to combination of individual damages, a catastrophic risk exists.

b.        For each stage case calculate the risk for all Critical Hazards

c.         For each stage case apply all risk factors, and, if applicable, factor for Flight Phase-Failure distribution

d.        For each engine, average all stages over the total number of engine stages

e.        For each aeroplane, average all engines over the number of engines.

7.0       RESULTS ASSESSMENT

7.1       An applicant may show compliance with CS 23.903(b)(1) and CS 25.903(d)(1) using guidelines set forth in AMC 20-128A. The criteria contained in the AMC may be used to show that:

a.         Practical design precautions have been taken to minimise the damage that can be caused by uncontained engine debris, and

b.        Acceptable risk levels, as specified in AMC 20-128A, Paragraph 10, have been achieved for each critical Failure Model.

7.2       The summary of the applicable risk level criteria is shown in Table 1 below.

Table 1 Summary of Acceptable Risk Level Criteria

EXAMPLE – HAZARD TREE

FIGURE 1

FLIGHT CONTROLS – SYSTEM LOADING

Note 1:

Same fragment path must not sever:

ON-SIDE cables + OFF-SIDE hydraulic system + HYDRAULIC PWR #3

e.g.: Left elevator cable and HYDRAULIC PWR #2 and #3 or,

Right elevator cable and HYDRAULIC PWR # 1 and # 3

Note 2:

Same fragment path must not sever:

—             Both CHAN1 and CHAN2 circuits

—             ON-SIDE control circuit + OFF-SIDE power circuit

—             OFF-SIDE control circuit + ON-SIDE power circuit

EXAMPLE – SYSTEM LOADING MATRIX

FIGURE 2

TRI-SECTOR ROTOR BURST

FIGURE 3

TYPICAL LAYOUT OF SYSTEMS IN ROTOR PLANE

FIGURE 4

TRAJECTORY RANGE PLOTTING

FIGURE 5

TYPICAL TRAJECTORY PLOTTING

FIGURE 6

DEFINITION - THREAT WINDOW

FIGURE 7