AMC 25.933(a)(1) Unwanted in-flight thrust reversal of turbojet thrust reversers

• ED Decision 2020/001/R found in: CS-25 Amdt 27 - Large Aeroplanes (Jan 2023)

AMC 25.933(a)(1) Unwanted in-flight thrust reversal of turbojet thrust reversers ED Decision 2020/001/R 1. PURPOSE. This Acceptable Means of Compliance (AMC) describes various acceptable means, for showing compliance with the requirements of CS 25.933(a)(1), "Reversing systems", of CS-25. These means are intended to provide guidance to supplement the engineering and operational judgement that must form the basis of any compliance findings relative to in-flight thrust reversal of turbojet thrust reversers. 2. RELATED CERTIFICATION SPECIFICATIONS. [CS 25.111](#_DxCrossRefBm1709820676), [CS 25.143](#_DxCrossRefBm1709820670), [CS 25.251](#_DxCrossRefBm1709820667), [CS 25.571](#_DxCrossRefBm1709820942), [CS 25.901](#_DxCrossRefBm1709820973), [CS 25.903](#_DxCrossRefBm1709821099), [CS 25.1155](#_DxCrossRefBm1709821410), [CS 25.1305](#_DxCrossRefBm1709821409), [CS 25.1309](#_DxCrossRefBm1709820691), [CS 25.1322](#_DxCrossRefBm1709821114) and [CS 25.1529](#_DxCrossRefBm1709821031) 3. APPLICABILITY. The requirements of [CS 25.933](#_DxCrossRefBm1709821386) apply to turbojet thrust reverser systems. [CS 25.933(a)](#_DxCrossRefBm1709821386) specifically applies to reversers intended for ground operation only, while [CS 25.933(b)](#_DxCrossRefBm1709821386) applies to reversers intended for both ground and in-flight use. This AMC applies only to unwanted thrust reversal in flight phases when the landing gear is not in contact with the ground; other phases (i.e., ground operation) are addressed by CS 25.901(c) and [CS 25.1309](#_DxCrossRefBm1709820691). 4. BACKGROUND. 4.a. General. Most thrust reversers are intended for ground operation only. Consequently, thrust reverser systems are generally sized and developed to provide high deceleration forces while avoiding foreign object debris (FOD) ingestion, aeroplane surface efflux impingement, and aeroplane handling difficulty during landing roll. Likewise, aircraft flight systems are generally sized and developed to provide lateral and directional controllability margins adequate for handling qualities, manoeuvrability requirements, and engine-out VMC lateral drift conditions. In early turbojet aeroplane designs, the combination of control system design and thrust reverser characteristics resulted in control margins that were capable of recovering from unwanted in-flight thrust reversal even on ground-use-only reversers; this was required by the previous versions of [CS 25.933](#_DxCrossRefBm1709821386). As the predominant large aeroplane configuration has developed into the high bypass ratio twin engine-powered model, control margins for the in-flight thrust reversal case have decreased. Clearly, whenever and wherever thrust reversal is intended, the focus must remain on limiting any adverse effects of thrust reversal. However, when demonstrating compliance with CS 25.933(a) or CS 25.933(b), the Authority has accepted that applicants may either provide assurance that the aeroplane is controllable after an in-flight thrust reversal event or that the unwanted in-flight thrust reversal event will not occur. Different historical forms of the rule have attempted to limit either the effect or the likelihood of unwanted thrust reversal during flight. However, experience has demonstrated that neither method is always both practical and effective. The current rule, and this related advisory material, are intended to allow either of these assurance methods to be applied in a manner which recognises the limitations of each, thereby maximising both the design flexibility and safety provided by compliance with the rule. 4.b. Minimising Adverse Effects. The primary purpose of reversing systems, especially those intended for ground operation only, is to assist in decelerating the aeroplane during landing and during an aborted take-off. As such, the reverser must be rapid-acting and must be effective in producing sufficient reverse thrust. These requirements result in design characteristics (actuator sizing, efflux characteristics, reverse thrust levels, etc.) that, in the event of thrust during flight, could cause significant adverse effects on aeroplane controllability and performance. If the effect of the thrust reversal occurring in flight produces an unacceptable risk to continued safe flight and landing, then the reverser operation and de-activation system must be designed to prevent unwanted thrust reversal. Alternatively, for certain aeroplane configurations, it may be possible to limit the adverse impacts of unwanted thrust reversal on aeroplane controllability and performance such that the risk to continued safe flight and landing is acceptable (discussed later in this AMC). For reversing systems intended for operation in flight, the reverser system must be designed to adequately protect against unwanted in-flight thrust reversal. CS 25.1309 and CS 25.901(c) and the associated AMC ([AMC 25.1309](#_DxCrossRefBm1709821113) and [AMC 25.901(c)](#_DxCrossRefBm1709821380) provide guidance for developing and assessing the safety of systems at the design stage. This methodology should be applied to the total reverser system, which includes: — the reverser; — the engine (if it can contribute to thrust reversal); — the reverser motive power source; — the reverser control system; — the reverser command system in the cockpit; and — the wiring, cable, or linkage system between the cockpit and engine. Approved removal, deactivation, reinstallation, and repair procedures for any element in the reverser or related systems should result in a safety level equivalent to the certified baseline system configuration. Qualitative assessments should be done, taking into account potential human errors (maintenance, aeroplane operation). Data required to determine the level of the hazard to the aeroplane in case of in-flight thrust reversal and, conversely, data necessary to define changes to the reverser or the aeroplane to eliminate the hazard, can be obtained from service experience, test, and/or analysis. These data also can be used to define the envelope for continued safe flight. There are many opportunities during the design of an aeroplane to minimise both the likelihood and severity of unwanted in-flight thrust reversal. These opportunities include design features of both the aeroplane and the engine/reverser system. During the design process, consideration should be given to the existing stability and control design features, while preserving the intended function of the thrust reverser system. Some design considerations, which may help reduce the risk from in-flight thrust reversal, include: 4.b.(1) Engine location to: (i) Reduce sensitivity to efflux impingement. (ii) Reduce effective reverse thrust moment arms 4.b.(2) Engine/Reverser System design to: (i) Optimise engine/reverser system integrity and reliability. (ii) Rapidly reduce engine airflow (i.e. auto-idle) in the event of an unwanted thrust reversal. Generally, such a feature is considered a beneficial safety item. In this case, the probability and effect of any unwanted idle command or failure to provide adequate reverse thrust when selected should be verified to be consistent with [AMC 25.1309](#_DxCrossRefBm1709821113) and [AMC 25.901(c)](#_DxCrossRefBm1709821380). (iii) Give consideration to the aeroplane pitch, yaw, and roll characteristics. (iv) Consider effective efflux diameter. (v) Consider efflux area. (vi) Direct reverser efflux away from critical areas of the aeroplane. (vii) Expedite detection of unwanted thrust reversal, and provide for rapid compensating action within the reversing system. (viii) Optimise positive aerodynamic stowing forces. (ix) Inhibit in-flight thrust reversal of ground-use-only reversers, even if commanded by the flight crew. (x) Consider incorporation of a restow capability for unwanted thrust reversal. 4.b.(3) Airframe/System design to: (i) Maximise aerodynamic control capability. (ii) Expedite detection of thrust reversal, and provide for rapid compensating action through other airframe systems. (iii) Consider crew procedures and responses. The use of formal «lessons learned»-based reviews early and often during design development may help avoid repeating previous errors and take advantage of previous successes. 5. DEFINITIONS. The following definitions apply for the purpose of this AMC: a. Catastrophic: see [AMC 25.1309](#_DxCrossRefBm1709821113) b. Continued Safe Flight and Landing: The capability for continued controlled flight and safe landing at an airport, possibly using emergency procedures, but without requiring exceptional pilot skill or strength. Some aeroplane damage may be associated with a failure condition, during flight or upon landing. c. Controllable Flight Envelope and Procedure: An area of the Normal Flight Envelope where, given an appropriate procedure, the aeroplane is capable of continued safe flight and landing following an in-flight thrust reversal. d. Deactivated Reverser: Any thrust reverser that has been deliberately inhibited such that it is precluded from performing a normal deploy/stow cycle, even if commanded to do so. e. Exceptional Piloting Skill and/or Strength: Refer to [CS 25.143(c)](#_DxCrossRefBm1709820670)(c) («Controllability and Manoeuvrability—General»). f. Extremely Improbable: see AMC 25.1309 g. Extremely Remote: see AMC 25.1309 h. Failure: see AMC 25.1309 i. Failure Situation: All failures that result in the malfunction of one independent command and/or restraint feature that directly contributes to the top level Fault Tree Analysis event (i.e., unwanted in-flight thrust reversal). For the purpose of illustration, Figure 1, below, provides a fault tree example for a scenario of three «failure situations» leading to unwanted in-flight thrust reversal. Figure 1: TOP EVENT  Reverser System with three independent command/restraint features shown for reference only. j. Hazardous: see [AMC 25.1309](#_DxCrossRefBm1709821113) k. In-flight: that part of aeroplane operation beginning when the wheels are no longer in contact with the ground during the take-off and ending when the wheels again contact the ground during landing. l. Light Crosswind: For purposes of this AMC, a light crosswind is a 19 km/h (10 Kt). wind at right angles to the direction of take-off or landing which is assumed to occur on every flight. m. Light Turbulence: Turbulence that momentarily causes slight, erratic changes in altitude and/or attitude (pitch, roll, and/or yaw), which is assumed to occur on every flight. n. Major: see AMC 25.1309 o. Maximum exposure time: The longest anticipated period between the occurrence and elimination of the failure. p. Normal Flight Envelope: An established boundary of parameters (velocity, altitude, angle of attack, attitude) associated with the practical and routine operation of a specific aeroplane that is likely to be encountered on a typical flight and in combination with prescribed conditions of light turbulence and light crosswind. q. Pre-existing failure: Failure that can be present for more than one flight. r. Thrust Reversal: A movement of all or part of the thrust reverser from the forward thrust position to a position that spoils or redirects the engine airflow. s. Thrust Reverser System: Those components that spoil or redirect the engine thrust to decelerate the aeroplane. The components include: — the engine-mounted hardware, — the reverser control system, — indication and actuation systems, and — any other aeroplane systems that have an effect on the thrust reverser operation. t. Turbojet thrust reversing system: Any device that redirects the airflow momentum from a turbojet engine so as to create reverse thrust. Systems may include: — cascade-type reversers, — target or clamshell-type reversers, — pivoted-door petal-type reversers, — deflectors articulated off either the engine cowling or aeroplane structure, — targetable thrust nozzles, or — a propulsive fan stage with reversing pitch. u. Turbojet (or turbofan): A gas turbine engine in which propulsive thrust is developed by the reaction of gases being directed through a nozzle. 6. DEMONSTRATING COMPLIANCE WITH [CS 25.933(a)](#_DxCrossRefBm1709821386). The following Sections 7 through 10 of this AMC provide guidance on specific aspects of compliance with CS 25.933(a), according to four different means or methods: — Controllability (Section 7), — Reliability (Section 8), — Mixed controllability / reliability (Section 9), — Deactivated reverser (Section 10). 7. «CONTROLLABILITY OPTION»: PROVIDE CONTINUED SAFE FLIGHT AND LANDING FOLLOWING ANY IN-FLIGHT THRUST REVERSAL. The following paragraphs provide guidance regarding an acceptable means of demonstrating compliance with [CS 25.933(a)(1)](#_DxCrossRefBm1709821386). 7.a. General. For compliance to be established with CS 25.933(a) by demonstrating that the aeroplane is capable of continued safe flight and landing following any in-flight thrust reversal (the «controllability option» provided for under CS 25.933(a)(1)), the aspects of structural integrity, performance, and handling qualities must be taken into account. The level of accountability should be appropriate to the probability of in-flight thrust reversal, in accordance with the following sections. To identify the corresponding failure conditions and determine the probability of their occurrence, a safety analysis should be carried out, using the methodology described in CS 25.1309. The reliability of design features, such as auto-idle and automatic control configurations critical to meeting the following controllability criteria, also should be considered in the safety analysis. Appropriate alerts and/or other indications should be provided to the crew, as required by CS 25.1309(c) (Ref. AMC 25.1309). The inhibition of alerts relating to the thrust reverser system during critical phases of flight should be evaluated in relation to the total effect on flight safety (Ref. AMC 25.1309). Thrust reversal of a cyclic or erratic nature (e.g., repeated deploy/stow movement of the thrust reverser) should be considered in the safety analysis and in the design of the alerting/indication systems. Input from the flight crew and human factors specialists should be considered in the design of the alerting and/or indication provisions. The controllability compliance analysis should include the relevant thrust reversal scenario that could be induced by a rotorburst event. When demonstrating compliance using this «controllability option» approach, if the aeroplane might experience an in-flight thrust reversal outside the «controllable flight envelope» anytime during the entire operational life of all aeroplanes of this type, then further compliance considerations as described in Section 9 («MIXED CONTROLLABILITY / RELIABILITY OPTION») of this AMC, below, should be taken into account. 7.b. Structural Integrity. For the «controllability option,» the aeroplane must be capable of successfully completing a flight during which an unwanted in-flight thrust reversal occurs. An assessment of the integrity of the aeroplane structure is necessary, including an assessment of the structure of the deployed thrust reverser and its attachments to the aeroplane. In conducting this assessment, the normal structural loads, as well as those induced by failures and forced vibration (including buffeting), both at the time of the event and for continuation of the flight, must be shown to be within the structural capability of the aeroplane. At the time of occurrence, starting from 1-g level flight conditions, at speeds up to VC, a realistic scenario, including pilot corrective actions, should be established to determine the loads occurring at the time of the event and during the recovery manoeuvre. The aeroplane should be able to withstand these loads multiplied by an appropriate factor of safety that is related to the probability of unwanted in-flight thrust reversal. The factor of safety is defined in Figure 2, below. Conditions with high lift devices deployed also should be considered at speeds up to the appropriate flap limitation speed. Figure 2: Factor of safety at the time of occurrence  For continuation of the flight following in-flight thrust reversal, considering any appropriate reconfiguration and flight limitations, the following apply: 7.b.(1) Static strength should be determined for loads derived from the following conditions at speeds up to VC, or the speed limitation prescribed for the remainder of the flight: (i) 70% of the limit flight manoeuvre loads; and separately (ii) the discrete gust conditions specified in [CS 25.341(a)](#_DxCrossRefBm1709820927) (but using 40% of the gust velocities specified for VC). 7.b.(2) For the aeroplane with high lift devices deployed, static strength should be determined for loads derived from the following conditions at speeds up the appropriate flap design speed, or any lower flap speed limitation prescribed for the remainder of the flight: (i) A balanced manoeuvre at a positive limit load factor of 1.4; and separately (ii) the discrete gust conditions specified in [CS 25.345(a)(2)](#_DxCrossRefBm1709820949) (but using 40% of the gust velocities specified). 7.b.(3) For static strength substantiation, each part of the structure must be able to withstand the loads specified in sub-paragraph 7.b.(1) and 7.b.(2) of this paragraph, multiplied by a factor of safety depending on the probability of being in this failure state. The factor of safety is defined in Figure 3, below. Figure 3: Factor of safety for continuation of flight  Qj = is the probability of being in the configuration with the unwanted in-flight thrust reversal Qj = (Tj)(Pj) where: Tj = average time spent with unwanted in-flight thrust reversal (in hours) Pj = probability of occurrence of unwanted in-flight thrust reversal (per hour) If the thrust reverser system is capable of being restowed following a thrust reversal, only those loads associated with the interval of thrust reversal need to be considered. Historically, thrust reversers have often been damaged as a result of unwanted thrust reversal during flight. Consequently, any claim that the thrust reverser is capable of being restowed must be adequately substantiated, taking into account this adverse service history. 7.c. Performance 7.c.(1) General Considerations: Most failure conditions that have an effect on performance are adequately accounted for by the requirements addressing a «regular» engine failure (i.e., involving only loss of thrust and not experiencing any reverser anomaly). This is unlikely to be the case for failures involving an unwanted in-flight thrust reversal, which can be expected to have a more adverse impact on thrust and drag than a regular engine failure. Such unwanted in-flight thrust reversals, therefore, should be accounted for specifically, to a level commensurate with their probability of occurrence. The performance accountability that should be provided is defined in Sections 7.c.(2) and 7.c.(3) as a function of the probability of the unwanted in-flight thrust reversal. Obviously, for unwanted in-flight thrust reversals less probable than 1x10- 9 /fh, certification may be based on reliability alone, as described in Section 8 («RELIABILITY OPTION») of this AMC. Furthermore, for any failure conditions where unwanted in-flight thrust reversal would impact safety, the aeroplane must meet the safety/reliability criteria delineated in CS 25.1309. 7.c.(2) Probability of unwanted in-flight thrust reversal greater than 1x10-7/fh: Full performance accountability must be provided for the more critical of a regular engine failure and an unwanted in-flight thrust reversal. To determine if the unwanted in-flight thrust reversal is more critical than a regular engine failure, the normal application of the performance requirements described in CS-25, Subpart B, as well as the applicable operating requirements, should be compared to the application of the following criteria, which replace the accountability for a critical engine failure with that of a critical unwanted in-flight thrust reversal: — [CS 25.111](#_DxCrossRefBm1709820676), «Take-off path»: The takeoff path should be determined with the critical unwanted thrust reversal occurring at VLOF instead of the critical engine failure at VEF. No change to the state of the engine with the thrust reversal that requires action by the pilot may be made until the aircraft is 122 m (400 ft) above the takeoff surface. — [CS 25.121](#_DxCrossRefBm1709820672), «Climb: one-engine-inoperative»: Compliance with the one-engine-inoperative climb gradients should be shown with the critical unwanted in-flight thrust reversal rather than the critical engine inoperative. — [CS 25.123](#_DxCrossRefBm1709820671), «En-route flight paths»: The en-route flight paths should be determined following occurrence of the critical unwanted in-flight thrust reversal(s) instead of the critical engine failure(s), and allowing for the execution of appropriate crew procedures. For compliance with the applicable operating rules, an unwanted in-flight thrust reversal(s) at the most critical point en-route should be substituted for the engine failure at the most critical point en-route. Performance data determined in accordance with these provisions, where critical, should be furnished in the Aeroplane Flight Manual as operating limitations. Operational data and advisory data related to fuel consumption and range should be provided for the critical unwanted in-flight thrust reversal to assist the crew in decision making. These data may be supplied as simple factors or additives to apply to normal all-engines-operating fuel consumption and range data. For approvals to conduct extended range operations with two-engine aeroplanes (ETOPS), the critical unwanted in-flight thrust reversal should be considered in the critical fuel scenario (paragraph 10d(4)(iii) of Information Leaflet no. 20: ETOPS). In addition to requiring full performance accountability as it relates to the specific aeroplane performance requirements of Subpart B, all other aspects of the aeroplane’s performance following a non-restowable in-flight thrust reversal (e.g. capability to climb and maintain 305m (1000 feet) AGL) must be found adequate to comply with the intent of CS 25.933(a)(1)(ii). 7.c.(3) Probability of unwanted in-flight thrust reversal equal to or less than 1x10-7/fh, but greater than 1x10-9/fh: With the exception of the takeoff phase of flight, which needs not account for unwanted in-flight thrust reversal, the same criteria should be applied as in Section 7.c.(2), above, for the purposes of providing advisory data and procedures to the flight crew. Such performance data, however, need not be applied as operating limitations. The takeoff data addressed by Section 7.c.(2), above (takeoff speeds, if limited by VMC, takeoff path, and takeoff climb gradients), does not need to be provided, as it would be of only limited usefulness if not applied as a dispatch limitation. However, the takeoff data should be determined and applied as operating limitations if the unwanted in-flight thrust reversal during the take-off phase is the result of a single failure. As part of this assessment, the effect of an unwanted in-flight thrust reversal on approach climb performance, and the ability to execute a go-around manoeuvre should be determined and used to specify crew procedures for an approach and landing following a thrust reversal. For example, the procedures may specify the use of a flap setting less than that specified for landing, or an airspeed greater than the stabilised final approach airspeed, until the flight crew is satisfied that a landing is assured and a go-around capability need no longer be maintained. Allowance may be assumed for execution of appropriate crew procedures subsequent to the unwanted thrust reversal having occurred. Where a number of thrust reversal states may occur, these procedures for approach and landing may, at the option of the applicant, be determined either for the critical thrust reversal state or for each thrust reversal state that is clearly distinguishable by the flight crew. Operational data and advice related to fuel consumption and range should be provided for the critical unwanted in-flight thrust reversal to assist the crew in decision-making. These data may be supplied as simple factors or additives to apply to normal all-engines-operating fuel consumption and range data. The aeroplane performance capabilities following a non-restowable in-flight thrust reversal must be such that the probability of preventing continued safe flight (e.g. capability to climb and maintain 305m (1000 feet) AGL) and landing at an airport (i.e. either destination or diversion) is extremely improbable. 7.d. Handling Qualities 7.d.(1) Probability of unwanted in-flight thrust reversal greater than 1x10-7/fh: The more critical of an engine failure (or flight with engine(s) inoperative), and an unwanted in-flight thrust reversal, should be used to show compliance with the controllability and trim requirements of CS-25, Subpart B. In addition, the criteria defined in Section 7.d.(2), below, also should be applied. To determine if the unwanted in-flight thrust reversal is more critical than an engine failure, the normal application of the CS-25, Subpart B, controllability and trim requirements should be compared to the application of the following criteria, which replace the accountability for a critical engine failure with that of a critical unwanted in-flight thrust reversal: — [CS 25.143](#_DxCrossRefBm1709820670), «Controllability and Manoeuvrability - General»: the effect of a sudden unwanted in-flight thrust reversal of the critical engine, rather than the sudden failure of the critical engine, should be evaluated in accordance with CS 25.143(b)(1) and the associated guidance material. Control forces associated with the failure should comply with CS 25.143(c). — [CS 25.147](#_DxCrossRefBm1709820699), «Directional and lateral control»: the requirements of [CS 25.147(a), (b), (c), and (d)](#_DxCrossRefBm1709820699) should be complied with following critical unwanted in-flight thrust reversal(s) rather than with one or more engines inoperative. — [CS 25.149](#_DxCrossRefBm1709820669), «Minimum control speed»: the values of VMC and VMCL should be determined with a sudden unwanted in-flight thrust reversal of the critical engine rather than a sudden failure of the critical engine. — [CS 25.161](#_DxCrossRefBm1709820698), «Trim» the trim requirements of [CS 25.161(d) and (e)](#_DxCrossRefBm1709820698)should be complied with following critical unwanted in-flight thrust reversal(s), rather than with one or more engines inoperative. Compliance with these requirements should be demonstrated by flight test. Simulation or analysis will not normally be an acceptable means of compliance for such probable failures. 7.d.(2) Probability of unwanted thrust reversal equal to or less than 1x10-7/fh, but greater than 1x10-9/fh: failure conditions with a probability equal to or less than 1x10-7/fh are not normally evaluated against the specific controllability and trim requirements of CS-25, Subpart B. Instead, the effects of unwanted in-flight thrust reversal should be evaluated on the basis of maintaining the capability for continued safe flight and landing, taking into account pilot recognition and reaction time. One exception is that the minimum control speed requirement of [CS 25.149](#_DxCrossRefBm1709820669) should be evaluated to the extent necessary to support the performance criteria specified in Section 7.c.(3), above, related to approach, landing, and go-around. Recognition of the failure may be through the behaviour of the aircraft or an appropriate failure alerting system, and the recognition time should not be less than one second. Following recognition, additional pilot reaction times should be taken into account, prior to any corrective pilot actions, as follows: — Landing: no additional delay — Approach: 1 second — Climb, cruise, and descent: 3 seconds; except when in auto-pilot engaged manoeuvring flight, or in manual flight, when 1 second should apply. Both auto-pilot engaged and manual flight should be considered. The unwanted in-flight thrust reversal should not result in any of the following: — exceedance of an airspeed halfway between VMO and VDF, or Mach Number halfway between MMO and MDF — a stall — a normal acceleration less than a value of 0g — bank angles of more than 60° en-route, or more than 30° below a height of 305m (1000 ft) — degradation of flying qualities assessed as greater than Major for unwanted in-flight thrust reversal more probable than 1x10-7/fh; or assessed as greater than Hazardous for failures with a probability equal to or less than 1x10-7/fh, but greater 1x10-9/fh — the roll control forces specified in CS 25.143(c), except that the long term roll control force should not exceed 10 lb — structural loads in excess of those specified in Section 7.b., above. Demonstrations of compliance may be by flight test, by simulation, or by analysis suitably validated by flight test or other data. 7.d.(3) Probability of in-flight thrust reversal less than 1x10-9/fh: Certification can be based on reliability alone as described in Section 8, below. 8. ‘RELIABILITY OPTION’: PROVIDE CONTINUED SAFE FLIGHT AND LANDING BY PREVENTING ANY IN-FLIGHT THRUST REVERSAL The following paragraphs provide guidance regarding an acceptable means of demonstrating compliance with CS 25.933(a)(1)(ii). 8.a. General. For compliance to be established with CS 25.933(a) by demonstrating that unwanted in-flight thrust reversal is not anticipated to occur (the «reliability option» provided for under CS 25.933(a)(1)(ii)), the aspects of system reliability, maintainability, and fault tolerance; structural integrity; and protection against zonal threats such as uncontained engine rotor failure or fire must be taken into account. 8.b. System Safety Assessment (SSA): Any demonstration of compliance should include an assessment of the thrust reverser control, indication and actuation system(s), including all interfacing power-plant and aeroplane systems (such as electrical supply, hydraulic supply, flight/ground status signals, thrust lever position signals, etc.) and maintenance. The reliability assessment should include: — the possible modes of normal operation and of failure; — the resulting effect on the aeroplane considering the phase of flight and operating conditions; — the crew awareness of the failure conditions and the corrective action required; — failure detection capabilities and maintenance procedures, etc.; and — the likelihood of the failure condition. Consideration should be given to failure conditions being accompanied or caused by external events or errors. The SSA should be used to identify critical failure paths for the purpose of conducting in-depth validation of their supporting failure mode, failure rates, exposure time, reliance on redundant subsystems, and assumptions, if any. In addition, the SSA can be used to determine acceptable time intervals for any required maintenance intervals (ref. AMC 25.1309 and AMC 25.19). The primary intent of this approach to compliance is to improve safety by promoting more reliable designs and better maintenance, including minimising pre-existing faults. Latent failures involved in unwanted in-flight thrust reversal should be avoided whenever practical. The design configurations in paragraphs 8.b.(2) and 8.b.(3) have traditionally been considered to be practical and considered to be acceptable to EASA. 8.b.(1) The thrust reverser system should be designed so that any in-flight thrust reversal that is not shown to be controllable in accordance with Section 7,above, is extremely improbable (i.e., average probability per hour of flight of the order of 1x10-9/fh. or less) and does not result from a single failure or malfunction. And 8.b.(2) For configurations in which combinations of two-failure situations (ref. Section 5, above) result in in-flight thrust reversal, the following apply: Neither failure may be pre-existing (i.e., neither failure situation can be undetected or exist for more than one flight); the means of failure detection must be appropriate in consideration of the monitoring device reliability, inspection intervals, and procedures. The occurrence of either failure should result in appropriate cockpit indication or be self-evident to the crew to enable the crew to take necessary actions such as discontinuing a take-off, going to a controllable flight envelope en-route, diverting to a suitable airport, or reconfiguring the system in order to recover single failure tolerance, etc. And 8.b.(3) For configurations in which combinations of three or more failure situations result in in-flight thrust reversal, the following applies: In order to limit the exposure to pre-existing failure situations, the maximum time each pre-existing failure situation is expected to be present should be related to the frequency with which the failure situation is anticipated to occur, such that their product is 1×10-3 or less. The time each failure situation is expected to be present should take into account the expected delays in detection, isolation, and repair of the causal failures. 8.c. Structural Aspects: For the «reliability option,» those structural load paths that affect thrust reversal should be shown to comply with the static strength, fatigue, damage tolerance, and deformation requirements of CS-25. This will ensure that unwanted in-flight thrust reversal is not anticipated to occur due to failure of a structural load path, or due to loss of retention under ultimate load throughout the operational life of the aeroplane. 8.d. Uncontained Rotor Failure: In case of rotor failure, compliance with [CS 25.903(d)(1)](#_DxCrossRefBm1709821099) should be shown, using advisory materials (AC, user manual, etc.) supplemented by the methods described below. The effects of associated loads and vibration on the reverser system should be considered in all of the following methods of minimising hazards: 8.d.(1) Show that engine spool-down characteristics or potential reverser damage are such that compliance with Section 7, above, can be shown. 8.d.(2) Show that forces that keep the thrust reverser in stable stowed position during and after the rotor burst event are adequate. 8.d.(3) Locate the thrust reverser outside the rotor burst zone. 8.d.(4) Protection of thrust reverser restraint devices: The following guidance material describes methods of minimising the hazard to thrust reverser stow position restraint devices located within rotorburst zones. The following guidance material has been developed on the basis of all of the data available to date and engineering judgement. 8.d.(4)(i) Fragment Hazard Model: (A) Large Fragments — Ring Disks (see Figure 4.a.) - Compressor drum rotors or spools with ring disks have typically failed in a rim peeling mode when failure origins are in the rim area. This type of failure typically produces uncontained fragment energies, which are mitigated by a single layer of conventional aluminium honeycomb structure. (Note: This guidance material is based upon field experience and, as such, its application should be limited to aluminium sheet and honeycomb fan reverser construction. Typical construction consists of 12.7 mm (a half inch) thickness of .003-.004” aluminium foil honeycomb with .030" thick aluminium facing sheets. Alternative materials and methods of construction should have at least equivalent impact energy absorption characteristics). Failures with the origins in the bore of these same drum sections have resulted in fragments which can be characterised as a single 1/3 disk fragment and multiple smaller fragments. The 1/3 disk fragment may or may not be contained by the thrust reverser structure. The remaining intermediate and small disk fragments, while escaping the engine case, have been contained by the thrust reverser structure. — Deep Bore Disks (see Figure 4.b.) and Single Disks (see Figure 4.c.) - For compressor drum rotors or spools with deep bore disks, and single compressor and turbine disks, the experience, while limited, indicates either a 1/3 and a 2/3 fragment, or a 1/3 fragment and multiple intermediate and small discrete fragments should be considered. These fragments can be randomly released within an impact area that ranges \* 5 degrees from the plane of rotation. (B) Small Fragments (Debris) Consider small fragments (reference AMC 20-128A, paragraph 9.d.) that could impact the thrust reverser at \* 15 degrees axial spread angle. 8.d.(4)(ii) Minimisation: Minimisation guidance provided below is for fragments from axial flow rotors surrounded by fan flow thrust reversers located over the intermediate or high-pressure core rotors. NOTE: See attached Figure 5: Typical High Bypass Turbofan Low and High Pressure Compressor with Fan Thrust Reverser Cross Section (A) Large Fragments For the large fragments defined in Section 8.d.(4)(i)(A), above, the thrust reverser retention systems should be redundant and separated as follows: — Ring Disks Compressor Spools: Retention systems located in the outer barrel section of the thrust reverser should be separated circumferentially (circumferential distance greater than the 1/3 disk fragment model as described in AMC20 128A) or axially (outside the \* 5 degree impact area) so that a 1/3 disk segment can not damage all redundant retention elements and allow thrust reversal (i.e., deployment of a door or translating reverser sleeve half). Retention systems located between the inner fan flow path wall and the engine casing should be located axially outside the + 5 degree impact area. — Deep-bore Disk Spools and Single Disks: Retention systems should be separated axially with at least one retention element located outside the \* 5 degree impact area. (B) Small Fragments For the small fragments defined in Section 8.d.(4)(i)(B), above, thrust reverser retention systems should be provided with either: — At least one retention element shielded in accordance with AMC 20-128A, paragraph 7(c), or capable of maintaining its retention capabilities after impact; or — One retention element located outside the \* 15 degree impact area. 9. «MIXED CONTROLLABILITY / RELIABILITY» OPTION. If the aeroplane might experience an unwanted in-flight thrust reversal outside the «controllable flight envelope» anytime during the entire operational life of all aeroplanes of this type, then outside the controllable envelope reliability compliance must be shown, taking into account associated risk exposure time and the other considerations described in Section 8, above. Conversely, if reliability compliance is selected to be shown within a given limited flight envelope with associated risk exposure time, then outside this envelope controllability must be demonstrated taking into account the considerations described in Section 7, above. Mixed controllability/reliability compliance should be shown in accordance with guidance developed in Sections 7 and 8, above, respectively. 10. DEACTIVATED REVERSER. The thrust reverser system deactivation design should follow the same «fail-safe» principles as the actuation system design, insofar as failure and systems/hardware integrity. The effects of thrust reverser system deactivation on other aeroplane systems, and on the new configuration of the thrust reverser system itself, should be evaluated according to Section 8.a., above. The location and load capability of the mechanical lock-out system (thrust reverser structure and lock-out device) should be evaluated according to Sections 8.b. and 8.d., above. The evaluation should show that the level of safety associated with the deactivated thrust reverser system is equivalent to or better than that associated with the active system. 11. [CS 25.933(b)](#_DxCrossRefBm1709821386) COMPLIANCE. For thrust reversing systems intended for in-flight use, compliance with CS 25.933(b) may be shown for unwanted in-flight thrust reversal, as appropriate, using the methods specified in Sections 7 through 10, above. 12. CONTINUED AIRWORTHINESS. 12.a. Manufacturing/Quality: Due to the criticality of the thrust reverser, manufacturing and quality assurance processes should be assessed and implemented, as appropriate, to ensure the design integrity of the critical components. 12.b. Reliability Monitoring: An appropriate system should be implemented for the purpose of periodic monitoring and reporting of in-service reliability performance. The system should also include reporting of in-service concerns related to design, quality, or maintenance that have the potential of affecting the reliability of the thrust reverser. 12.c. Maintenance and Alterations: The following material provides guidance for maintenance designs and activity to assist in demonstrating compliance with Sections 7 through 10, above (also reference CS 25.901(b)(2) and [CS 25.1529/Appendix H](#_DxCrossRefBm1709821031)). The criticality of the thrust reverser and its control system requires that maintenance and maintainability be emphasised in the design process and derivation of the maintenance control program, as well as subsequent field maintenance, repairs, or alterations. 12.c.(1) Design: Design aspects for providing adequate maintainability should address : 12.c.(1)(i) Ease of maintenance. The following items should be taken into consideration: — It should be possible to operate the thrust reverser for ground testing/trouble shooting without the engine operating. — Lock-out procedures (deactivation for flight) of the thrust reverser system should be simple, and clearly described in the maintenance manual. Additionally, a placard describing the procedure may be installed in a conspicuous place on the nacelle. — Provisions should be made in system design to allow easy and safe access to the components for fault isolation, replacement, inspection, lubrication, etc. This is particularly important where inspections are required to detect latent failures. Providing safe access should include consideration of risks both to the mechanic and to any critical design elements that might be inadvertently damaged during maintenance. — Provisions should be provided for easy rigging of the thrust reverser and adjustment of latches, switches, actuators, etc. 12.c.(1)(ii) Fault identification and elimination: — System design should allow simple, accurate fault isolation and repair. — System design personnel should be actively involved in the development, documentation, and validation of the troubleshooting/fault isolation manual and other maintenance publications. The systems design personnel should verify that maintenance assumptions critical to any SSA conclusion are supported by these publications (e.g., perform fault insertion testing to verify that the published means of detecting, isolating, and eliminating the fault are effective). — Thrust reverser unstowed and unlocked indications should be easily discernible during pre-flight inspections. — If the aeroplane has onboard maintenance monitoring and recording systems, the system should have provisions for storing all fault indications. This would be of significant help to maintenance personnel in locating the source of intermittent faults. 12.c.(1)(iii) Minimisation of errors: Minimisation of errors during maintenance activity should be addressed during the design process. Examples include physical design features, installation orientation markings, dissimilar connections, etc. The use of a formal «lessons learned»-based review early and often during design development may help avoid repeating previous errors. 12.c.(1)(iv) System Reliability: The design process should, where appropriate, use previous field reliability data for specific and similar components to ensure system design reliability. 12.c.(2) Maintenance Control: 12.c.(2)(i) Maintenance Program: The development of the initial maintenance plan for the aeroplane, including the thrust reverser, should consider, as necessary, the following: — Involvement of the manufacturers of the aeroplane, engine, and thrust reverser. — The compatibility of the SSA information and the Maintenance Review Board Report, Maintenance Planning Document, Master Minimum Equipment List, etc. (ref [AMC 25.19](#_DxCrossRefBm1709821408)). — Identification by the manufacturer of all maintenance tasks critical to continued safe flight. The operator should consider these tasks when identifying and documenting Required Inspection Items. — The complexity of lock-out procedures and appropriate verification. — Appropriate tests, including an operational tests, of the thrust reverser to verify correct system operation after the performance of any procedure that would require removal, installation, or adjustment of a component; or disconnection of a tube, hose, or electrical harness of the entire thrust reverser actuation control system. 12.c.(2)(ii) Training: The following considerations should be taken into account when developing training documentation: — The reason and the significance of accomplishing critical tasks as prescribed. This would clarify why a particular task needs to be performed in a certain manner. — Instructions or references as to what to do if the results of a check or operational test do not agree with those given in the Aeroplane Maintenance Manual (AMM). The manual should recommend some corrective action if a system fails a test or check. This would help ensure that the critical components are not overlooked in the trouble shooting process. — Emphasis on the total system training by a single training source (preferably the aeroplane manufacturer) to preclude fragmented information without a clear system understanding. This training concept should be used in the initial training and subsequent retraining. — Inclusion of fault isolation and troubleshooting using the material furnished for the respective manuals. — Evaluation of the training materials to assure consistency between the training material and the maintenance and troubleshooting manuals. 12.c.(2)(iii) Repairs and Alterations: The Instructions for Continued Airworthiness essential to ensure that subsequent repairs or alterations do not unintentionally violate the integrity of the original thrust reverser system type design approval should be provided by the original airframe manufacturer. Additionally, the original airframe manufacturer should define a method of ensuring that this essential information will be evident to those that may perform and approve such repairs and alterations. One example would be maintaining the wire separation between relevant thrust reverser control electrical circuits. This sensitivity could be communicated by statements in appropriate manuals such as the Wiring Diagram Manual, and by decals or placards placed on visible areas of the thrust reverser and/or aeroplane structure. 12.c.(2)(iv) Feedback of Service Experience: The maintenance process should initiate the feedback of service experience that will allow the monitoring of system reliability performance and improvements in system design and maintenance practices. Additionally, this service experience should be used to assure the most current and effective formal «lessons learned» design review process possible. (A) Reliability Performance: (Operators and Manufacturers should collaborate on these items:) — Accurate reporting of functional discrepancies. — Service investigation of hardware by manufacturer to confirm and determine failure modes and corrective actions if required. — Update of failure rate data. (This will require co-ordination between the manufacturers and airlines.) (B) Improvements suggested by maintenance experience: (This will provide data to effectively update these items:) — Manuals — Troubleshooting — Removal/replacement procedures. 12.c.(2)(v) Publications/Procedures: The following considerations should be addressed in the preparation and revisions of the publications and procedures to support the thrust reverser in the field in conjunction with CS 25.901(b)(2) and [CS 25.1529(Appendix H)](#_DxCrossRefBm1709821031). (A) Documentation should be provided that describes a rigging check, if required after adjustment of any thrust reverser actuator drive system component. (B) Documentation should be provided that describes powered cycling of the thrust reverser to verify system integrity whenever maintenance is performed. This could also apply to any manual actuation of the reverser. (C) The reasons and the significance of accomplishing critical tasks should be included in the AMM. (D) The AMM should include instructions or references as to what to do if the results of a check or operational test do not agree with those given in the AMM. (E) Provisions should be made to address inefficiencies and errors in the publications: — Identified in the validation process of both critical and troubleshooting procedures. — Input from field. — Operators conferences. (F) Development of the publications should be a co-ordinated effort between the thrust reverser, engine, aeroplane manufacturers and airline customers especially in the areas of: — AMM — Troubleshooting — Fault isolation — Maintenance data computer output — Procedure Validation — Master Minimum Equipment List (G) Initial issue of the publication should include the required serviceable limits for the complete thrust reverser system. 13. FLIGHT CREW TRAINING. In the case of compliance with the «controllability option,» and when the nature of the in-flight thrust reversal is judged as unusual (compared to expected consequences on the aeroplane of other failures, both basic and recurrent), flight crew training should be considered on a training simulator representative of the aeroplane, that is equipped with thrust reverser in-flight modelisation to avoid flight crew misunderstandings: 13.a. Transient manoeuvre: Recovery from the unwanted in-flight thrust reversal. 13.b Continued flight and landing: Manoeuvring appropriate to the recommended procedure (included trim and unattended operation) and precision tracking (ILS guide slope tracking, speed/altitude tracking, etc.). Figure 4 - Generic Disk and Rotor terminology used in interim thrust reverser guidance material for minimizing the hazard from engine rotor burst   [Amdt No: 25/1] [Amdt No: 25/24]