Compare and highlight differences

Compare / EASA/ Incorporated Amendments/ Compare & Highlight Differences

AMC 20-128A Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure

Available versions for ERULES-1963177438-6768

ED Decision 2003/12/RM found in: AMC-20 Amdt 22 - Airworthiness of Products, Parts and Appliances (May 2021)

Select original version

Select changed version

Removed: 0 Added: 0

AMC 20-128A Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure

ED Decision 2003/12/RM

1 PURPOSE.

This acceptable means of compliance (AMC) sets forth a method of compliance with the requirements of CS 23.901(f), 23.903(b)(1), 25.903(d)(1) and 25A903(d)(1)of the EASA Certification Specifications (CS) pertaining to design precautions taken to minimise the hazards to an aeroplane in the event of uncontained engine or auxiliary power unit (APU) rotor failures. The guidance provided within this AMC is harmonised with that of the Federal Aviation Administration (FAA) and is intended to provide a method of compliance that has been found acceptable. As with all AMC material, it is not mandatory and does not constitute a regulation.

2 RESERVED

3 APPLICABILITY.

This AMC applies to CS-23 and CS-25 aeroplanes.

4 RELATED DOCUMENTS.

Paragraphs 23.903, and 25.903 of the CS and other paragraphs relating to uncontained engine failures.

a. Related Joint Aviation Requirements. Sections which prescribe requirements for the design, substantiation and certification relating to uncontained engine debris include:

<table border="1" cellpadding="0" cellspacing="0" width="531"><tr><td valign="top" width="119">§ 23.863, 25.863</td><td valign="top" width="412">Flammable fluid fire protection</td></tr><tr><td valign="top" width="119">§ 25.365</td><td valign="top" width="412">Pressurised compartment loads</td></tr><tr><td valign="top" width="119">§ 25.571</td><td valign="top" width="412">Damage-tolerance and fatigue evaluation of structure</td></tr><tr><td valign="top" width="119">§ 25.963</td><td valign="top" width="412">Fuel tanks: general</td></tr><tr><td valign="top" width="119">§ 25.1189</td><td valign="top" width="412">Shut-off means</td></tr><tr><td valign="top" width="119">§ 25.1461</td><td valign="top" width="412">Equipment containing high energy rotors </td></tr><tr><td valign="top" width="119">CS-APU</td><td valign="top" width="412">Auxiliary Power Units</td></tr></table>

NOTE: The provisions of § 25.1461 have occasionally been used in the approval of APU installations regardless of protection from high energy rotor disintegration. However, the more specific requirements of CS 25.903(d)(1) and associated guidance described within this AMC take precedence over the requirements of CS 25.1461.

b. Other Documents

<table border="1" cellpadding="0" cellspacing="0" width="530"><tr><td valign="top" width="100">ISO 2685:1992 </td><td valign="top" width="430">Aircraft – Environmental conditions and test procedures for airborne equipment – Resistance to fire in designated fire zones</td></tr><tr><td valign="top" width="100">AC 20–135</td><td valign="top" width="430">Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria.</td></tr></table>

c. Society of Automotive Engineers (SAE) Documents.

<table border="1" cellpadding="0" cellspacing="0" width="530"><tr><td valign="top" width="100">AIR1537</td><td valign="top" width="430">Report on Aircraft Engine Containment, October, 1977.</td></tr><tr><td valign="top" width="100">AIR4003</td><td valign="top" width="430">Uncontained Turbine Rotor Events Data Period 1976 through 1983. </td></tr><tr><td valign="top" width="100">AIR4770</td><td valign="top" width="430">Uncontained Turbine Rotor Events Data Period 1984 (Draft) through 1989.</td></tr></table>

These documents can be obtained from the Society of Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale, Pennsylvania, 15096.

5 BACKGROUND.

Although turbine engine and APU manufacturers are making efforts to reduce the probability of uncontained rotor failures, service experience shows that uncontained compressor and turbine rotor failures continue to occur. Turbine engine failures have resulted in high velocity fragment penetration of adjacent structures, fuel tanks, fuselage, system components and other engines on the aeroplane. While APU uncontained rotor failures do occur, and to date the impact damage to the aeroplane has been minimal, some rotor failures do produce fragments that should be considered. Since it is unlikely that uncontained rotor failures can be completely eliminated, CS-23 and CS-25 require that aeroplane design precautions be taken to minimise the hazard from such events.

a. Uncontained gas turbine engine rotor failure statistics are presented in the Society of Automotive Engineers (SAE) reports covering time periods and number of uncontained events listed in the table shown below. The following statistics summarise 28 years of service experience for fixed wing aeroplanes and do not include data for rotorcraft and APUs:

<table border="1" cellpadding="0" cellspacing="0" width="528"><thead><tr><td colspan="3" valign="top" width="317">No. of Events</td></tr><tr><td valign="top" width="106">Report No.</td><td valign="top" width="106">Period</td><td valign="top" width="106">Total</td><td valign="top" width="106">Category 3</td><td valign="top" width="106">Category 4</td></tr></thead><tr><td valign="top" width="106">AIR1537</td><td valign="top" width="106">1962–75</td><td valign="top" width="106">275</td><td valign="top" width="106">44</td><td valign="top" width="106">5</td></tr><tr><td valign="top" width="106">AIR4003</td><td valign="top" width="106">1976–83</td><td valign="top" width="106">237</td><td valign="top" width="106">27</td><td valign="top" width="106">3</td></tr><tr><td valign="top" width="106">AIR4770 (Draft)</td><td valign="top" width="106">1984–89</td><td valign="top" width="106">164</td><td valign="top" width="106">22</td><td valign="top" width="106">7</td></tr><tr><td colspan="2" valign="top" width="211">TOTAL</td><td valign="top" width="106">676</td><td valign="top" width="106">93</td><td valign="top" width="106">15</td></tr></table>

The total of 676 uncontained events includes 93 events classified in Category 3 and 15 events classified in Category 4 damage to the aeroplane. Category 3 damage is defined as significant aeroplane damage with the aeroplane capable of continuing flight and making a safe landing. Category 4 damage is defined as severe aeroplane damage involving a crash landing, critical injuries, fatalities or hull loss.

During this 28 year period there were 1,089.6 million engine operating hours on commercial transports. The events were caused by a wide variety of influences classed as environmental (bird ingestion, corrosion/erosion, foreign object damage (FOD)), manufacturing and material defects, mechanical, and human factors (maintenance and overhaul, inspection error and operational procedures).

b. Uncontained APU rotor failure statistics covering 1962 through 1993 indicate that there have been several uncontained failures in at least 250 million hours of operation on transport category aeroplanes. No Category 3 or 4 events were reported and all failures occurred during ground operation. These events were caused by a wide variety of influences such as corrosion, ingestion of de-icing fluid, manufacturing and material defects, mechanical, and human factors (maintenance and overhaul, inspection error and operational procedures).

c. The statistics in the SAE studies indicate the existence of many different causes of failures not readily apparent or predictable by failure analysis methods. Because of the variety of causes of uncontained rotor failures, it is difficult to anticipate all possible causes of failure and to provide protection to all areas. However, design considerations outlined in this AMC provide guidelines for achieving the desired objective of minimising the hazard to an aeroplane from uncontained rotor failures. These guidelines, therefore, assume a rotor failure will occur and that analysis of the effects of this failure is necessary. These guidelines are based on service experience and tests but are not necessarily the only means available to the designer.

6 TERMINOILOGY.

a. Rotor. Rotor means the rotating components of the engine and APU that analysis, test, and/or experience has shown can be released during uncontained failure. The engine or APU manufacturer should define those components that constitute the rotor for each engine and APU type design. Typically rotors have included, as a minimum, discs, hubs, drums, seals, impellers, blades and spacers.

b. Blade. The airfoil sections (excluding platform and root) of the fan, compressor and turbine.

c. Uncontained Failure. For the purpose of aeroplane evaluations in accordance with this AMC, uncontained failure of a turbine engine is any failure which results in the escape of rotor fragments from the engine or APU that could result in a hazard. Rotor failures which are of concern are those where released fragments have sufficient energy to create a hazard to the aeroplane.

d. Critical Component. A critical component is any component whose failure would contribute to or cause a failure condition which would prevent the continued safe flight and landing of the aeroplane. These components should be considered on an individual basis and in relation to other components which could be damaged by the same fragment or by other fragments from the same uncontained event.

e. Continued Safe Flight and Landing. Continued safe flight and landing means that the aeroplane is capable of continued controlled flight and landing, possibly using emergency procedures and without exceptional pilot skill or strength, with conditions of considerably increased flightcrew workload and degraded flight characteristics of the aeroplane.

f. Fragment Spread Angle. The fragment spread angle is the angle measured, fore and aft from the centre of the plane of rotation of an individual rotor stage, initiating at the engine or APU shaft centreline (see Figure 1).

![Picture Alt](/static/files/file_ftLzkYEblJP/image042.png)

FIGURE 1 – ESTIMATED PATH OF FRAGMENTS

g. Impact Area. The impact area is that area of the aeroplane likely to be impacted by uncontained fragments generated during a rotor failure (see Paragraph 9).

h. Engine and APU Failure Model. A model describing the size, mass, spread angle, energy level and number of engine or APU rotor fragments to be considered when analysing the aeroplane design is presented in Paragraph 9.

7 DESIGN CONSIDERATIONS.

Practical design precautions should be used to minimise the damage that can be caused by uncontained engine and APU rotor fragments. The most effective methods for minimising the hazards from uncontained rotor fragments include location of critical components outside the fragment impact areas or separation, isolation, redundancy, and shielding of critical aeroplane components and/or systems. The following design considerations are recommended:

a. Consider the location of the engine and APU rotors relative to critical components, systems or areas of the aeroplane such as:

(1) Any other engine(s) or an APU that provides an essential function;

(2) Pressurised sections of the fuselage and other primary structure of the fuselage, wings and empennage;

(3) Pilot compartment areas;

(4) Fuel system components, piping and tanks;

(5) Control systems, such as primary and secondary flight controls, electrical power cables, wiring, hydraulic systems, engine control systems, flammable fluid shut-off valves, and the associated actuation wiring or cables;

(6) Any fire extinguisher system of a cargo compartment, an APU, or another engine including electrical wiring and fire extinguishing agent plumbing to these systems;

(7) Engine air inlet attachments and effects of engine case deformations caused by fan blade debris resulting in attachment failures;

(8) Instrumentation essential for continued safe flight and landing;

(9) Thrust reverser systems where inadvertent deployment could be catastrophic; and

(10) Oxygen systems for high altitude aeroplanes, where these are critical due to descent time.

b. Location of Critical Systems and Components. Critical aeroplane flight and engine control cables, wiring, flammable fluid carrying components and lines (including vent lines), hydraulic fluid lines and components, and pneumatic ducts should be located to minimise hazards caused by uncontained rotors and fan blade debris. The following design practices should be considered:

(1) Locate, if possible, critical components or systems outside the likely debris impact areas.

(2) Duplicate and separate critical components or systems, or provide suitable protection if located in debris impact areas.

(3) Protection of critical systems and components can be provided by using airframe structure or supplemental shielding.

These methods have been effective in mitigating the hazards from both single and multiple small fragments within the ± 15 impact area. Separation of multiplicated critical systems and components by at least a distance equal to the 1/2 blade fragment dimension has been accepted for showing minimisation from a single high energy small fragment when at least one of the related multiplicated critical components is shielded by significant structure such as aluminium lower wing skins, pylons, aluminium skin of the cabin pressure vessel, or equivalent structures.

Multiplicated critical systems and components positioned behind less significant structures should be separated by at least a distance equal to the 1/2 blade fragment dimension, and at least one of the multiplicated critical systems should be:

(i) Located such that equivalent protection is provided by other inherent structures such as pneumatic ducting, interiors, bulkheads, stringers, or

(ii) Protected by an additional shield such that the airframe structure and shield material provide equivalent shielding.

(4) Locate fluid shut-offs and actuation means so that flammable fluid can be isolated in the event of damage to the system.

(5) Minimise the flammable fluid spillage which could contact an ignition source.

(6) For airframe structural elements, provide redundant designs or crack stoppers to limit the subsequent tearing which could be caused by uncontained rotor fragments.

(7) Locate fuel tanks and other flammable fluid systems and route lines (including vent lines) behind aeroplane structure to reduce the hazards from spilled fuel or from tank penetrations. Fuel tankexplosion-suppression materials, protective shields or deflectors on the fluid lines, have been used to minimise the damage and hazards.

c. External Shields and Deflectors. When shields, deflection devices or aeroplane structure are proposed to be used to protect critical systems or components, the adequacy of the protection, including mounting points to the airframe structure, should be shown by testing or validated analyses supported by test data, using the fragment energies supplied by the engine or APU manufacturer or those defined in Paragraph 9. For protection against engine small fragments, as defined in Paragraph 9, no quantitative validation as defined in Paragraph 10 is required if equivalency to the penetration resistant structures listed (e.g. pressure cabin skins, etc.) is shown.

8 ACCEPTED DESIGN PRECAUTIONS.

Design practices currently in use by the aviation industry that have been shown to reduce the overall risk, by effectively eliminating certain specific risks and reducing the remaining specific risks to a minimum level, are described within this paragraph of the AMC. Aeroplane designs submitted for evaluation by the regulatory authorities will be evaluated against these proven design practices.

a. Uncontrolled Fire.

(1) Fire Extinguishing Systems. The engine/APU fire extinguishing systems currently in use rely on a fire zone with a fixed compartment air volume and a known air exchange rate to extinguish a fire. The effectiveness of this type of system along with firewall integrity may therefore be compromised for the torn/ruptured compartment of the failed engine/APU. Protection of the aeroplane following this type of failure relies on the function of the fire warning system and subsequent fire switch activation to isolate the engine/APU from airframe flammable fluid (fuel and hydraulic fluid) and external ignition sources (pneumatic and electrical). Fire extinguishing protection of such a compromised system may not be effective due to the extent of damage. Continued function of any other engine, APU or cargo compartment fire warning and extinguisher system, including electrical wiring and fire extinguishing agent plumbing, should be considered as described in Paragraph 7.

(2) Flammable Fluid Shut-off Valve. As discussed above, shut-off of flammable fluid supply to the engine may be the only effective means to extinguish a fire following an uncontained failure, therefore the engine isolation/flammable fluid shut-off function should be assured following an uncontained rotor failure. Flammable fluid shut-off valves should be located outside the uncontained rotor impact area. Shut-off actuation controls that need to be routed through the impact area should be redundant and appropriately separated in relation to the one-third disc maximum dimension.

(3) Fire Protection of Critical Functions. Flammable fluid shut-off and other critical controls should be located so that a fire (caused by an uncontained rotor event) will not prevent actuation of the shut- off function or loss of critical aeroplane functions. If shut-off or other critical controls are located where a fire is possible following an uncontained rotor failure (e.g. in compartments adjacent to fuel tanks) then these items should meet the applicable fire protection guidelines such as ISO 2685:1992 or AC 20-135.

(4) Fuel Tanks. If fuel tanks are located in impact areas, the following precautions should be implemented:

(i) Protection from the effects of fuel leakage should be provided for any fuel tanks located above an engine or APU and within the one-third disc and intermediate fragment impact areas. Dry bays or shielding are acceptable means. The dry bay should be sized based on analysis of possible fragment trajectories through the fuel tank wall and the subsequent fuel leakage from the damaged fuel tank so that fuel will not migrate to an engine, APU or other ignition source during either – flight or ground operation. A minimum drip clearance distance of 10 inches (254 mm) from potential ignition sources of the engine nacelle, for static conditions, has been acceptable (see Figure 2).

![am20image3](/static/files/file_ftLzkYEblJP/image043.png)

FIGURE 2 – DRY BAY SIZING DETERMINATION EXAMPLE

(ii) Fuel tank penetration leak paths should be determined and evaluated for hazards during flight and ground phases of operation. If fuel spills into the airstream away from the aeroplane no additional protection is needed. Additional protection should be considered if fuel could spill, drain or migrate into areas housing ignition sources, such as engine or APU inlets or wheel wells. Damage to adjacent systems, wiring etc., should be evaluated regarding the potential that an uncontained fragment will create both an ignition source and fuel source. Wheel brakes may be considered as an ignition source during take-off and initial climb. Protection of the wheel wells may be provided by airflow discharging from gaps or openings, preventing entry of fuel, a ventilation rate precluding a combustible mixture or other provisions indicated in CS 23.863 and CS 25.863.

(iii) Areas of the aeroplane where flammable fluid migration is possible that are not drained and vented and have ignition sources or potential ignition sources should be provided with a means of fire detection and suppression and be explosion vented or equivalently protected.

b. Loss of Thrust.

(1) Fuel Reserves. The fuel reserves should be isolatable such that damage from a disc fragment will not result in loss of fuel required to complete the flight or a safe diversion. The effects of fuel loss, and the resultant shift of centre of gravity or lateral imbalance on aeroplane controllability should also be considered.

(2) Engine Controls. Engine control cables and/or wiring for the remaining powerplants that pass through the impact area should be separated by a distance equal to the maximum dimension of a one- third disc fragment or the maximum extent possible.

(3) Other Engine Damage. Protection of any other engines from some fragments should be provided by locating critical components, such as engine accessories essential for proper engine operation (e.g., high pressure fuel lines, engine controls and wiring, etc.), in areas where inherent shielding is provided by the fuselage, engine or nacelle (including thrust reverser) structure (see Paragraph 7).

c. Loss of Aeroplane Control

(1) Flight Controls. Elements of the flight control system should be adequately separated or protected so that the release of a single one-third disc fragment will not cause loss of control of the aeroplane in any axis. Where primary flight controls have duplicated (or multiplicated) elements, these elements should be located to prevent all elements in any axis being lost as a result of the single one- third disc fragment. Credit for maintaining control of the aeroplane by the use of trim controls or other means may be obtained, providing evidence shows that these means will enable the pilot to retain control.

(2) Emergency Power. Loss of electrical power to critical functions following an uncontained rotor event should be minimised. The determination of electrical system criticality is dependent upon aeroplane operations. For example, aeroplanes approved for Extended Twin Engine Operations (ETOPS) that rely on alternate power sources such as hydraulic motor generators or APUs may be configured with the electrical wiring separated to the maximum extent possible within the one-third disc impact zone.

(3) Hydraulic Supply. Any essential hydraulic system supply that is routed within an impact area should have means to isolate the hydraulic supply required to maintain control of the aeroplane. The single one-third disc should not result in loss of all essential hydraulic systems or loss of all flight controls in any axis of the aeroplane.

(4) Thrust reverser systems. The effect of an uncontained rotor failure on inadvertent in-flight deployment of each thrust reverser and possible loss of aeroplane control shall be considered. The impact area for components located on the failed engine may be different from the impact area defined in Paragraph 6. If uncontained failure could cause thrust reverser deployment, the enginemanufacturer should be consulted to establish the failure model to be considered. One acceptable method of minimisation is to locate reverser restraints such that not all restraints can be made ineffective by the fragments of a single rotor.

d. Passenger and Crew Incapacitation.

(1) Pilot Compartment. The pilot compartment of large aeroplanes should not be located within the ± 15° spread angle of any engine rotor stage or APU rotor stage that has not been qualified as contained, unless adequate shielding, deflectors or equivalent protection is provided for the rotor stage in accordance with Paragraph 7c. Due to design constraints inherent in smaller CS-23 aeroplanes, it is not considered practical to locate the pilot compartment outside the ±15° spread angle. Therefore for other aeroplanes (such as new CS-23 commuter category aeroplanes) the pilot compartment area should not be located within the ±5° spread angle of any engine rotor stage or APU rotor stage unless adequate shielding, deflectors, or equivalent protection is provided for the rotor stage in accordance with Paragraph 7c of this AMC, except for the following:

(i) For derivative CS-23 category aeroplanes where the engine location has been previously established, the engine location in relation to the pilot compartment need not be changed.

(ii) For non-commuter CS-23 category aeroplanes, satisfactory service experience relative to rotor integrity and containment in similar engine installations may be considered in assessing the acceptability of installing engines in line with the pilot compartment.

(iii) For non-commuter new CS-23 category aeroplanes, where due to size and/or design considerations the ± 5° spread angle cannot be adhered to, the pilot compartment/engine location should be analysed and accepted in accordance with Paragraphs 9 and 10.

(2) Pressure Vessel. For aeroplanes that are certificated for operation above 41,000 feet, the engines should be located such that the pressure cabin cannot be affected by an uncontained one- third or intermediate disc fragment. Alternatively, it may be shown that rapid decompression due to the maximum hole size caused by fragments within the ± 15° zone and the associated cabin pressure decay rate will allow an emergency descent without incapacitation of the flightcrew or passengers. A pilot reaction time of 17 seconds for initiation of the emergency decent has been accepted. Where the pressure cabin could be affected by a one-third disc or intermediate fragments, design precautions should be taken to preclude incapacitation of crew and passengers. Examples of design precautions that have been previously accepted are:

(i) Provisions for a second pressure or bleed down bulkhead outside the impact area of a one- third or intermediate disc fragment.

(ii) The affected compartment in between the primary and secondary bulkhead was made inaccessible, by operating limitations, above the minimum altitude where incapacitation could occur due to the above hole size.

(iii) Air supply ducts running through this compartment were provided with non-return valves to prevent pressure cabin leakage through damaged ducts.

NOTE: If a bleed down bulkhead is used it should be shown that the rate of pressure decay and minimum achieved cabin pressure would not incapacitate the crew, and the rate of pressure decay would not preclude a safe emergency descent.

e. Structural Integrity. Installation of tear straps and shear ties within the uncontained fan blade and engine rotor debris zone to prevent catastrophic structural damage has been utilised to address this threat.

9. ENGINE AND APU FAILURE MODEL.

The safety analysis recommended in Paragraph 10 should be made using the following engine and APU failure model, unless for the particular engine/APU type concerned, relevant service experience, design data, test results or other evidence justify the use of a different model.

a. Single One-Third Disc fragment. It should be assumed that the one-third disc fragment has the maximum dimension corresponding to one-third of the disc with one-third blade height and a fragment spread angle of ± 3°. Where energy considerations are relevant, the mass should be assumed to be one-third of the bladed disc mass and its energy, the translational energy (i.e., neglecting rotational energy) of the sector travelling at the speed of its c.g. location as defined in Figure 3.

b. Intermediate Fragment. It should be assumed that the intermediate fragment has a maximum dimension corresponding to one-third of the bladed disc radius and a fragment spread angle of ± 5°. Where energy considerations are relevant, the mass should be assumed to be 1/30 of the bladed disc mass and its energy the transitional energy (i.e. neglecting rotational energy) of the piece travelling at rim speed (see Figure 4).

![am20image4](/static/files/file_ftLzkYEblJP/image044.png)

FIGURE 3 – SINGLE ONE-THIRD ROTOR FRAGMENT

![am20image5](/static/files/file_ftLzkYEblJP/image045.png)

FIGURE 4 – INTERMEDIATE FRAGMENT

c. Alternative Engine Failure Model. For the purpose of the analysis, as an alternative to the engine failure model of Paragraphs 9a and b, the use of a single one-third piece of disc having a fragment spread angle ± 5° would be acceptable, provided the objectives of Paragraph 10c are satisfied.

d. Small Fragments. It should be assumed that small fragments (shrapnel) range in size up to a maximum dimension corresponding to the tip half of the blade airfoil (with exception of fan blades) and a fragment spread angle of ± 15°. Service history has shown that aluminium lower wing skins, pylons, and pressure cabin skin and equivalent structures typically resist penetration from all but one of the most energetic of these fragments. The effects of multiple small fragments should also be considered. Penetration of less significant structures such as fairings, empennage, control surfaces and unpressurised unpressurized skin has typically occurred at the rate of 2½ percent of the number of blades of the failed rotor stage. Refer to paragraph 7b and 7c for methods of minimisation of the hazards. Where the applicant wishes to show compliance by considering the energy required for penetration of structure (or shielding) the engine manufacturer should be consulted for guidance as to the size and energy of small fragments within the impact area.

For APUs, where energy considerations are relevant, it should be assumed that the mass will correspond to the above fragment dimensions and that it has a translational energy level of one percent of the total rotational energy of the original rotor stage.

e. Fan Blade Fragment. It should be assumed that the fan blade fragment has a maximum dimension corresponding to the blade tip with one-third the blade airfoil height and a fragment spread angle of ± 15°. Where energy considerations are relevant the mass should be assumed to be corresponding to the one-third of the airfoil including any part span shroud and the transitional energy (neglecting rotational energy) of the fragment travelling at the speed of its c.g. location as defined inFigure 5. As an alternative, the engine manufacturer may be consulted for guidance as to the size and energy of the fragment.

![am20image6](/static/files/file_ftLzkYEblJP/image046.png)

FIGURE 5 – FAN BLADE FRAGMENT DEFINITION

f. Critical Engine Speed. Where energy considerations are relevant, the uncontained rotor event should be assumed to occur at the engine or APU shaft red line speed.

g. APU Failure Model. For all APU's, the installer also needs to address any hazard to the aeroplane associated with APU debris (up to and including a complete rotor where applicable) exiting the tailpipe. Paragraphs 9g(1) or (2) below or applicable service history provided by the APU manufacturer may be used to define the size, mass, and energy of debris exiting that tailpipe. The APU rotor failure model applicable for a particular APU installation is dependent upon the provisions of CS-APU that were utilised for receiving approval:

(1) For APU's where rotor integrity has been demonstrated in accordance with CS-APU, i.e. without specific containment testing, Paragraphs 9a, b, and d, or Paragraphs 9c and 9d apply.

(2) For APU rotor stages qualified as contained in accordance with CS-APU, historical data shows that in-service uncontained failures have occurred. These failure modes have included bi-hub, overspeed, and fragments missing the containment ring which are not addressed by the CS-APU containment test. In order to address these hazards, the installer should use the APU small fragment definition of Paragraph 9d or substantiated in-service data supplied by the APU manufacturer.

10 SAFETY ANALYSIS.

The numerical assessment requested in Paragraph 10c(3) is derived from methods previously prescribed in ACJ No. 2 to CS 25.903(d)(1). The hazard ratios provided are based upon evaluation of various configurations of large aeroplanes, made over a period of time, incorporating practical methods of minimising the hazard to the aeroplane from uncontained engine debris.

a. Analysis. An analysis should be made using the engine/APU model defined in Paragraph 9 to determine the critical areas of the aeroplane likely to be damaged by rotor debris and to evaluate the consequences of an uncontained failure. This analysis should be conducted in relation to all normal phases of flight, or portions thereof.

NOTE: APPENDIX 1 provides additional guidance for completion of the numerical analysis requested by this paragraph.

(1) A delay of at least 15 seconds should be assumed before start of the emergency engine shut down. The extent of the delay is dependent upon circumstances resulting from the uncontained failure including increased flightcrew workload stemming from multiplicity of warnings which require analysis by the flightcrew.

(2) Some degradation of the flight characteristics of the aeroplane or operation of a system is permissible, provided the aeroplane is capable of continued safe flight and landing. Account should be taken of the behaviour of the aeroplane under asymmetrical engine thrust or power conditions together with any possible damage to the flight control system, and of the predicted aeroplane recovery manoeuvre.

(3) When considering how or whether to mitigate any potential hazard identified by the model, credit may be given to flight phase, service experience, or other data, as noted in Paragraph 7.

b. Drawings. Drawings should be provided to define the uncontained rotor impact threat relative to the areas of design consideration defined in Paragraphs 7a(1) through (10) showing the trajectory paths of engine and APU debris relative to critical areas. The analysis should include at least the following:

(1) Damage to primary structure including the pressure cabin, engine/APU mountings and airframe surfaces.

NOTE: Any structural damage resulting from uncontained rotor debris should be considered catastrophic unless the residual strength and flutter criteria of ACJ 25.571(a) subparagraph 2.7.2 can be met without failure of any part of the structure essential for completion of the flight. In addition, the pressurised compartment loads of CS 25.365(e)(1) and (g) must be met.

(2) Damage to any other engines (the consequences of subsequent uncontained debris from the other engine(s), need not be considered).

(3) Damage to services and equipment essential for safe flight and landing (including indicating and monitoring systems), particularly control systems for flight, engine power, engine fuel supply and shut-off means and fire indication and extinguishing systems.

(4) Pilot incapacitation, (see also paragraph 8 d(1)).

(5) Penetration of the fuel system, where this could result in the release of fuel into personnel compartments or an engine compartment or other regions of the aeroplane where this could lead to a fire or explosion.

(6) Damage to the fuel system, especially tanks, resulting in the release of a large quantity of fuel.

(7) Penetration and distortion of firewalls and cowling permitting a spread of fire.

(8) Damage to or inadvertent movement of aerodynamic surfaces (e.g.. flaps, slats, stabilisers, ailerons, spoilers, thrust reversers, elevators, rudders, strakes, winglets, etc.) and the resultant effect on safe flight and landing.

c. Safety Analysis Objectives. It is considered that the objective of minimising hazards will have been met if:

(1) The practical design considerations and precautions of Paragraphs 7 and 8 have been taken;

(2) The safety analysis has been completed using the engine/APU model defined in Paragraph 9;

(3) For CS-25 large aeroplanes and CS-23 commuter category aeroplanes, the following hazard ratio guidelines have been achieved:

(i) Single One-Third Disc Fragment. There is not more than a 1 in 20 chance of catastrophe resulting from the release of a single one-third disc fragment as defined in Paragraph 9a.

(ii) Intermediate Fragment. There is not more than a 1 in 40 chance of catastrophe resulting from the release of a piece of debris as defined in Paragraph 9b.

(iii) Multiple Disc Fragments. (Only applicable to any duplicated or multiplicated system when all of the system channels contributing to its functions have some part which is within a distance equal to the diameter of the largest bladed rotor, measured from the engine centreline). There is not more than 1 in 10 chance of catastrophe resulting from the release in three random directions of three one-third fragments of a disc each having a uniform probability of ejection over the 360° (assuming an angular spread of ±3° relative to the plane of the disc) causing coincidental damage to systems which are duplicated or multiplicated.

NOTE: Where dissimilar systems can be used to carry out the same function (e.g. elevator control and pitch trim), they should be regarded as duplicated (or multiplicated) systems for the purpose of this subparagraph provided control can be maintained.

The numerical assessments described above may be used to judge the relative values of minimisation. The degree of minimisation that is feasible may vary depending upon aeroplane size and configuration and this variation may prevent the specific hazard ratio from being achieved. These levels are design goals and should not be treated as absolute targets. It is possible that any one of these levels may not be practical to achieve.

(4) For newly designed non-commuter CS-23 aeroplanes the chance of catastrophe is not more than twice that of Paragraph 10(c)(3)(i), (ii) and (iii) for each of these fragment types.

(5) A numerical risk assessment is not requested for the single fan blade fragment, small fragments, and APU and engine rotor stages which are qualified as contained.

d. APU Analysis For APU's that are located where no hazardous consequences would result from an uncontained failure, a limited qualitative assessment showing the relative location of critical systems/components and APU impact areas is all that is needed. If critical systems/components are located within the impact area, more extensive analysis is needed. For APUs which have demonstrated rotor integrity only, the failure model outlined in Paragraph 9g(1) should be consideredas a basis for this safety assessment. For APU rotor stages qualified as contained per CS–APU, the aeroplane safety analysis may be limited to an assessment of the effects of the failure model outlined in Paragraph 9g(2).

e. Specific Risk The aeroplane risk levels specified in Paragraph 10c, resulting from the release of rotor fragments, are the mean values obtained by averaging those for all rotors on all engines of the aeroplane, assuming a typical flight. Individual rotors or engines need not meet these risk levels nor need these risk levels be met for each phase of flight if either:

(1) No rotor stage shows a higher level of risk averaged throughout the flight greater than twice those stated in Paragraph 10c.

NOTE: The purpose of this Paragraph is to ensure that a fault which results in repeated failures of any particular rotor stage design, would have only a limited effect on aeroplane safety.

![EASA EAR image](/static/files/file_ftLzkYEblJP/image047.jpg)

FIGURE 6 – ALL NON-CONTAINMENTS BY PHASE OF FLIGHT

(2) Where failures would be catastrophic in particular portions of flight, allowance is made for this on the basis of conservative assumptions as to the proportion of failures likely to occur in these phases. A greater level of risk could be accepted if the exposure exists only during a particular phase of flight e.g., during take-off. The proportional risk of engine failure during the particular phases of flight is given in SAE Papers referenced in Paragraph 4d. See also data contained in the CAA paper "Engine Non-Containments – The CAA View", which includes Figure 6. This paper is published in NASA Report CP-2017, "An Assessment of Technology for Turbo-jet Engine Rotor Failures", dated August 1977.

AMC 20-128A Design Considerations for Minimizing Hazards Caused by
Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure

ED Decision 2003/12/RM

1          PURPOSE.

This acceptable means of compliance (AMC)
sets forth a method of compliance with the requirements of CS 23.901(f),
23.903(b)(1), 25.903(d)(1) and 25A903(d)(1)of the EASA Certification
Specifications (CS) pertaining to design precautions taken to minimise the
hazards to an aeroplane in the event of uncontained engine or auxiliary power
unit (APU) rotor failures. The guidance provided within this AMC is harmonised
with that of the Federal Aviation Administration (FAA) and is intended to
provide a method of compliance that has been found acceptable. As with all AMC
material, it is not mandatory and does not constitute a regulation.

2          RESERVED

3          APPLICABILITY.

This AMC applies to CS-23 and CS-25
aeroplanes.

4          RELATED DOCUMENTS.

Paragraphs 23.903, and 25.903 of the CS and
other paragraphs relating to uncontained engine failures.

a.         Related
Joint Aviation Requirements. Sections which prescribe requirements for the
design, substantiation and certification relating to uncontained engine debris
include:

<table border="1" cellpadding="0" cellspacing="0" width="531">
<tr>
<td valign="top" width="119">
§
 23.863, 25.863
</td>
<td valign="top" width="412">
Flammable
 fluid fire protection
</td>
</tr>
<tr>
<td valign="top" width="119">
§
 25.365
</td>
<td valign="top" width="412">
Pressurised
 compartment loads
</td>
</tr>
<tr>
<td valign="top" width="119">
§
 25.571
</td>
<td valign="top" width="412">
Damage-tolerance
 and fatigue evaluation of structure
</td>
</tr>
<tr>
<td valign="top" width="119">
§
 25.963
</td>
<td valign="top" width="412">
Fuel
 tanks: general
</td>
</tr>
<tr>
<td valign="top" width="119">
§
 25.1189
</td>
<td valign="top" width="412">
Shut-off
 means
</td>
</tr>
<tr>
<td valign="top" width="119">
§ 25.1461
</td>
<td valign="top" width="412">
Equipment
 containing high energy rotors 
</td>
</tr>
<tr>
<td valign="top" width="119">
CS-APU
</td>
<td valign="top" width="412">
Auxiliary
 Power Units
</td>
</tr>
</table>

NOTE: The provisions of § 25.1461 have
occasionally been used in the approval of APU installations regardless of
protection from high energy rotor disintegration. However, the more specific
requirements of CS 25.903(d)(1) and associated guidance described within this
AMC take precedence over the requirements of CS 25.1461.

b.         Other
Documents

<table border="1" cellpadding="0" cellspacing="0" width="530">
<tr>
<td valign="top" width="100">
ISO
 2685:1992 
</td>
<td valign="top" width="430">
Aircraft
 – Environmental conditions and test procedures for airborne equipment –
 Resistance to fire in designated fire zones
</td>
</tr>
<tr>
<td valign="top" width="100">
AC
 20–135
</td>
<td valign="top" width="430">
Powerplant
 Installation and Propulsion System Component Fire Protection Test Methods,
 Standards, and Criteria.
</td>
</tr>
</table>

c.         Society
of Automotive Engineers (SAE) Documents.

<table border="1" cellpadding="0" cellspacing="0" width="530">
<tr>
<td valign="top" width="100">
AIR1537
</td>
<td valign="top" width="430">
Report
 on Aircraft Engine Containment, October, 1977.
</td>
</tr>
<tr>
<td valign="top" width="100">
AIR4003
</td>
<td valign="top" width="430">
Uncontained
 Turbine Rotor Events Data Period 1976 through 1983. 
</td>
</tr>
<tr>
<td valign="top" width="100">
AIR4770
</td>
<td valign="top" width="430">
Uncontained
 Turbine Rotor Events Data Period 1984 (Draft) through 1989.
</td>
</tr>
</table>

These documents can be obtained from the
Society of Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale,
Pennsylvania, 15096.

5          BACKGROUND.

Although turbine engine and APU
manufacturers are making efforts to reduce the probability of uncontained
rotor failures, service experience shows that uncontained compressor and
turbine rotor failures continue to occur. Turbine engine failures have resulted
in high velocity fragment penetration of adjacent structures, fuel tanks,
fuselage, system components and other engines on the aeroplane. While APU
uncontained rotor failures do occur, and to date the impact damage to the
aeroplane has been minimal, some rotor failures do produce fragments that
should be considered. Since it is unlikely that uncontained rotor failures can
be completely eliminated, CS-23 and CS-25 require that aeroplane design
precautions be taken to minimise the hazard from such events.

a.         Uncontained
gas turbine engine rotor failure statistics are presented in the Society of
Automotive Engineers (SAE) reports covering time periods and number of
uncontained events listed in the table shown below. The following statistics
summarise 28 years of service experience for fixed wing aeroplanes and do not
include data for rotorcraft and APUs:

<table border="1" cellpadding="0" cellspacing="0" width="528">
<thead>
<tr>
<td colspan="3" valign="top" width="317">
No.
 of Events
</td>
</tr>
<tr>
<td valign="top" width="106">
Report
 No.
</td>
<td valign="top" width="106">
Period
</td>
<td valign="top" width="106">
Total
</td>
<td valign="top" width="106">
Category
 3
</td>
<td valign="top" width="106">
Category
 4
</td>
</tr>
</thead>
<tr>
<td valign="top" width="106">
AIR1537
</td>
<td valign="top" width="106">
1962–75
</td>
<td valign="top" width="106">
275
</td>
<td valign="top" width="106">
44
</td>
<td valign="top" width="106">
5
</td>
</tr>
<tr>
<td valign="top" width="106">
AIR4003
</td>
<td valign="top" width="106">
1976–83
</td>
<td valign="top" width="106">
237
</td>
<td valign="top" width="106">
27
</td>
<td valign="top" width="106">
3
</td>
</tr>
<tr>
<td valign="top" width="106">
AIR4770
 (Draft)
</td>
<td valign="top" width="106">
1984–89
</td>
<td valign="top" width="106">
164
</td>
<td valign="top" width="106">
22
</td>
<td valign="top" width="106">
7
</td>
</tr>
<tr>
<td colspan="2" valign="top" width="211">
TOTAL
</td>
<td valign="top" width="106">
676
</td>
<td valign="top" width="106">
93
</td>
<td valign="top" width="106">
15
</td>
</tr>
</table>

The total of 676 uncontained events includes
93 events classified in Category 3 and 15 events classified in Category 4
damage to the aeroplane. Category 3 damage is defined as significant aeroplane
damage with the aeroplane capable of continuing flight and making a safe
landing. Category 4 damage is defined as severe aeroplane damage involving a
crash landing, critical injuries, fatalities or hull loss.

During this 28 year period there were
1,089.6 million engine operating hours on commercial transports. The events
were caused by a wide variety of influences classed as environmental (bird
ingestion, corrosion/erosion, foreign object damage (FOD)), manufacturing and
material defects, mechanical, and human factors (maintenance and overhaul,
inspection error and operational procedures).

b.         Uncontained
APU rotor failure statistics covering 1962 through 1993 indicate that there
have been several uncontained failures in at least 250 million hours of
operation on transport category aeroplanes. No Category 3 or 4 events were
reported and all failures occurred during ground operation. These events were
caused by a wide variety of influences such as corrosion, ingestion of
de-icing fluid, manufacturing and material defects, mechanical, and human
factors (maintenance and overhaul, inspection error and operational
procedures).

c.         The
statistics in the SAE studies indicate the existence of many different causes
of failures not readily apparent or predictable by failure analysis methods.
Because of the variety of causes of uncontained rotor failures, it is
difficult to anticipate all possible causes of failure and to provide
protection to all areas. However, design considerations outlined in this AMC
provide guidelines for achieving the desired objective of minimising the
hazard to an aeroplane from uncontained rotor failures. These guidelines,
therefore, assume a rotor failure will occur and that analysis of the effects
of this failure is necessary. These guidelines are based on service experience
and tests but are not necessarily the only means available to the designer.

6          TERMINOILOGY.

a.         Rotor.
Rotor means the rotating components of the engine and APU that analysis, test,
and/or experience has shown can be released during uncontained failure. The
engine or APU manufacturer should define those components that constitute the
rotor for each engine and APU type design. Typically rotors have included, as
a minimum, discs, hubs, drums, seals, impellers, blades and spacers.

b.         Blade.
The airfoil sections (excluding platform and root) of the fan, compressor and
turbine.

c.         Uncontained
Failure. For the purpose of aeroplane evaluations in accordance with this AMC,
uncontained failure of a turbine engine is any failure which results in the
escape of rotor fragments from the engine or APU that could result in a
hazard. Rotor failures which are of concern are those where released fragments
have sufficient energy to create a hazard to the aeroplane.

d.         Critical
Component. A critical component is any component whose failure would
contribute to or cause a failure condition which would prevent the continued
safe flight and landing of the aeroplane. These components should be
considered on an individual basis and in relation to other components which
could be damaged by the same fragment or by other fragments from the same
uncontained event.

e.         Continued
Safe Flight and Landing. Continued safe flight and landing means that the
aeroplane is capable of continued controlled flight and landing, possibly
using emergency procedures and without exceptional pilot skill or strength,
with conditions of considerably increased flightcrew workload and degraded
flight characteristics of the aeroplane.

f.          Fragment
Spread Angle. The fragment spread angle is the angle measured, fore and aft
from the centre of the plane of rotation of an individual rotor stage,
initiating at the engine or APU shaft centreline (see Figure 1).

![Aviation.Bot AI suggestion, not from EASA source: This image is a cross-sectional diagram illustrating the estimated paths and spread angles of various types of fragments resulting from an uncontained turbine engine or Auxiliary Power Unit (APU) rotor failure.

Detailed Description: The diagram presents a simplified, two-dimensional, cutaway view of a turbine engine or APU, oriented horizontally. A central horizontal dashed line runs through the entire length of the engine, labeled "ENGINE OR APU SHAFT CENTERLINE" at its right end.

On the left side of the engine, a large fan assembly is depicted, labeled "FAN," consisting of a central hub and multiple fan blades extending radially outwards. To the right of the fan, the internal components of the engine are shown as multiple stages of rotor assemblies, represented by shaded rectangular blocks with vertical lines, arranged concentrically around the shaft centerline. The engine is enclosed by an outer casing, with an inlet opening on the left and an exhaust nozzle on the right.

Various types of fragments and their estimated spread angles are indicated by dashed lines originating from different rotor stages and extending outwards from the engine casing. 1. **FAN BLADE FRAGMENTS:** Originating from the fan section, dashed lines extend outwards and slightly aft. These lines are associated with a `±15°` angle, measured from a vertical line representing the fan's plane of rotation. A text label "FAN BLADE FRAGMENTS (see figure 5)" points to these lines. 2. **1/3RD DISK FRAGMENT:** Originating from an internal rotor stage towards the rear of the engine, dashed lines extend outwards, both fore and aft. These lines are associated with a `±3°` angle, measured from a vertical line representing the fragment's plane of rotation. A text label "1/3RD DISK FRAGMENT (see figure 3)" points to a small, curved, serrated graphic representing this fragment type, located above and to the right of the engine. 3. **INTERMEDIATE FRAGMENT:** Also originating from an internal rotor stage, slightly forward of the 1/3rd disk fragment's origin, dashed lines extend outwards, both fore and aft. These lines are associated with a `±5°` angle, measured from a vertical line representing the fragment's plane of rotation. A text label "INTERMEDIATE FRAGMENT (see figure 4)" points to a small, irregular, serrated graphic representing this fragment type, located below the "1/3RD DISK FRAGMENT" graphic. 4. **SMALL FRAGMENTS:** Originating from the same internal rotor stage as the intermediate fragment, dashed lines extend outwards, both fore and aft, at a wider angle. These lines are associated with a `±15°` angle, measured from a vertical line representing the fragment's plane of rotation. A text label "SMALL FRAGMENTS (see paragraph 9(d))" points to these lines.

At the bottom right of the diagram, a descriptive text block states: "FRAGMENT SPREAD ANGLE IS THE ANGLE MEASURED, FORE AND AFT, FROM THE CENTER OF THE PLANE OF ROTATION INITIATING AT THE ENGINE OR APU SHAFT CENTERLINE."

Contextual Linkage: The diagram visually defines and illustrates the concept of "Fragment Spread Angle" as described in the accompanying text. It shows how different types of rotor fragments (fan blade fragments, 1/3rd disk fragments, intermediate fragments, and small fragments) are expected to exit the engine casing at specific angular dispersions relative to their plane of rotation and the engine's axial centerline. The angles `±3°`, `±5°`, and `±15°` quantify these spread angles for various fragment types, indicating the potential impact zones fore and aft of the failure point.](file_wSyEACTCE2d/image041.png)

FIGURE 1 – ESTIMATED PATH OF FRAGMENTS

g.         Impact
Area. The impact area is that area of the aeroplane likely to be impacted by
uncontained fragments generated during a rotor failure (see Paragraph 9).

h.         Engine
and APU Failure Model. A model describing the size, mass, spread angle, energy
level and number of engine or APU rotor fragments to be considered when
analysing the aeroplane design is presented in Paragraph 9.

7          DESIGN CONSIDERATIONS.

Practical design precautions should be used
to minimise the damage that can be caused by uncontained engine and APU rotor
fragments. The most effective methods for minimising the hazards from
uncontained rotor fragments include location of critical components outside
the fragment impact areas or separation, isolation, redundancy, and shielding
of critical aeroplane components and/or systems. The following design considerations
are recommended:

a.         Consider
the location of the engine and APU rotors relative to critical components,
systems or areas of the aeroplane such as:

(1)       Any
other engine(s) or an APU that provides an essential function;

(2)       Pressurised
sections of the fuselage and other primary structure of the fuselage, wings
and empennage;

(3)       Pilot
compartment areas;

(4)       Fuel
system components, piping and tanks;

(5)       Control
systems, such as primary and secondary flight controls, electrical power
cables, wiring, hydraulic systems, engine control systems, flammable fluid
shut-off valves, and the associated actuation wiring or cables;

(6)       Any
fire extinguisher system of a cargo compartment, an APU, or another engine
including electrical wiring and fire extinguishing agent plumbing to these
systems;

(7)       Engine
air inlet attachments and effects of engine case deformations caused by fan
blade debris resulting in attachment failures;

(8)       Instrumentation
essential for continued safe flight and landing;

(9)       Thrust
reverser systems where inadvertent deployment could be catastrophic; and

(10)    Oxygen
systems for high altitude aeroplanes, where these are critical due to descent
time.

b.         Location
of Critical Systems and Components. Critical aeroplane flight and engine
control cables, wiring, flammable fluid carrying components and lines
(including vent lines), hydraulic fluid lines and components, and pneumatic
ducts should be located to minimise hazards caused by uncontained rotors and
fan blade debris. The following design practices should be considered:

(1)       Locate,
if possible, critical components or systems outside the likely debris impact
areas.

(2)                   Duplicate
and separate critical components or systems, or provide suitable protection if
located in debris impact areas.

(3)       Protection
of critical systems and components can be provided by using airframe structure
or supplemental shielding.

These methods have been effective in
mitigating the hazards from both single and multiple small fragments within
the ± 15 impact area. Separation of multiplicated critical systems and
components by at least a distance equal to the 1/2 blade fragment dimension
has been accepted for showing minimisation from a single high energy small
fragment when at least one of the related multiplicated critical components is
shielded by significant structure such as aluminium lower wing skins, pylons,
aluminium skin of the cabin pressure vessel, or equivalent structures.

Multiplicated critical systems and
components positioned behind less significant structures should be separated
by at least a distance equal to the 1/2 blade fragment dimension, and at least
one of the multiplicated critical systems should be:

(i)        Located
such that equivalent protection is provided by other inherent structures such
as pneumatic ducting, interiors, bulkheads, stringers, or

(ii)       Protected
by an additional shield such that the airframe structure and shield material
provide equivalent shielding.

(4)       Locate
fluid shut-offs and actuation means so that flammable fluid can be isolated in
the event of damage to the system.

(5)       Minimise
the flammable fluid spillage which could contact an ignition source.

(6)       For
airframe structural elements, provide redundant designs or crack stoppers to
limit the subsequent tearing which could be caused by uncontained rotor
fragments.

(7)       Locate
fuel tanks and other flammable fluid systems and route lines (including vent
lines) behind aeroplane structure to reduce the hazards from spilled fuel or
from tank penetrations. Fuel tankexplosion-suppression materials, protective
shields or deflectors on the fluid lines, have been used to minimise the
damage and hazards.

c.         External
Shields and Deflectors. When shields, deflection devices or aeroplane
structure are proposed to be used to protect critical systems or components,
the adequacy of the protection, including mounting points to the airframe
structure, should be shown by testing or validated analyses supported by test
data, using the fragment energies supplied by the engine or APU manufacturer
or those defined in Paragraph 9. For protection against engine small
fragments, as defined in Paragraph 9, no quantitative validation as defined in
Paragraph 10 is required if equivalency to the penetration resistant
structures listed (e.g. pressure cabin skins, etc.) is shown.

8          ACCEPTED DESIGN PRECAUTIONS.

Design practices currently in use by the
aviation industry that have been shown to reduce the overall risk, by
effectively eliminating certain specific risks and reducing the remaining specific
risks to a minimum level, are described within this paragraph of the AMC.
Aeroplane designs submitted for evaluation by the regulatory authorities will
be evaluated against these proven design practices.

a.         Uncontrolled
Fire.

(1)       Fire
Extinguishing Systems. The engine/APU fire extinguishing systems currently in
use rely on a fire zone with a fixed compartment air volume and a known air
exchange rate to extinguish a fire. The effectiveness of this type of system
along with firewall integrity may therefore be compromised for the
torn/ruptured compartment of the failed engine/APU. Protection of the
aeroplane following this type of failure relies on the function of the fire
warning system and subsequent fire switch activation to isolate the engine/APU
from airframe flammable fluid (fuel and hydraulic fluid) and external ignition
sources (pneumatic and electrical). Fire extinguishing protection of such a
compromised system may not be effective due to the extent of damage. Continued
function of any other engine, APU or cargo compartment fire warning and
extinguisher system, including electrical wiring and fire extinguishing agent
plumbing, should be considered as described in Paragraph 7.

(2)       Flammable
Fluid Shut-off Valve. As discussed above, shut-off of flammable fluid supply
to the engine may be the only effective means to extinguish a fire following
an uncontained failure, therefore the engine isolation/flammable fluid
shut-off function should be assured following an uncontained rotor failure.
Flammable fluid shut-off valves should be located outside the uncontained
rotor impact area. Shut-off actuation controls that need to be routed through
the impact area should be redundant and appropriately separated in relation to
the one-third disc maximum dimension.

(3)       Fire
Protection of Critical Functions. Flammable fluid shut-off and other critical
controls should be located so that a fire (caused by an uncontained rotor
event) will not prevent actuation of the shut- off function or loss of
critical aeroplane functions. If shut-off or other critical controls are
located where a fire is possible following an uncontained rotor failure (e.g.
in compartments adjacent to fuel tanks) then these items should meet the
applicable fire protection guidelines such as ISO 2685:1992 or AC 20-135.

(4)       Fuel
Tanks. If fuel tanks are located in impact areas, the following precautions
should be implemented:

(i)        Protection
from the effects of fuel leakage should be provided for any fuel tanks located
above an engine or APU and within the one-third disc and intermediate fragment
impact areas. Dry bays or shielding are acceptable means. The dry bay should
be sized based on analysis of possible fragment trajectories through the fuel
tank wall and the subsequent fuel leakage from the damaged fuel tank so that
fuel will not migrate to an engine, APU or other ignition source during either
– flight or ground operation. A minimum drip clearance distance of 10 inches
(254 mm) from potential ignition sources of the engine nacelle, for static
conditions, has been acceptable (see Figure 2).

![Aviation.Bot AI suggestion, not from EASA source: This image provides a three-view engineering diagram illustrating the design considerations for a "dry bay" to mitigate hazards from fuel leakage following an uncontained engine rotor failure, specifically focusing on the required clearance and fragment trajectory angles.

Detailed Description:
The image consists of three distinct engineering drawings: a "PLAN VIEW" at the top, and two cross-sectional views below it, "SECTION A-A" on the bottom left and "SECTION B-B" on the bottom right. All drawings are rendered with black lines on a white background, using solid and dashed lines, and hatched shading for specific areas.

**PLAN VIEW:**
This top drawing depicts a partial overhead view of an aircraft wing and an adjacent engine nacelle. On the right, a large, irregularly shaped area is labeled "INTEGRAL FUEL TANK", representing a section of the wing structure. It features a curved edge labeled "LEADING EDGE" and a straight edge labeled "FRONT SPAR". To the left of the "INTEGRAL FUEL TANK", a portion of an engine nacelle is shown. A rectangular outline, representing a component or area, is positioned between the fuel tank and the nacelle. Two diagonal dashed lines extend from the corners of this rectangular outline towards the wing, indicating a cone of influence or trajectory. A triangular area, shaded with a cross-hatch pattern, is located on the wing, forward and outboard of the rectangular outline. This hatched area is labeled "MINIMUM DRY BAY" with an arrow pointing to it. Within the "MINIMUM DRY BAY", two points are marked with numbers: "1" is closer to the rectangular outline, and "2" is further outboard. Two sets of cutting plane lines are indicated: "A-A" lines cut vertically through the wing and the "MINIMUM DRY BAY" area, with arrows pointing towards the rectangular outline. "B-B" lines cut horizontally through the engine nacelle, with arrows pointing towards the wing. The entire view is labeled "PLAN VIEW" with an underline below the text.

**SECTION A-A:**
This bottom-left drawing presents a cross-sectional view of the wing and engine nacelle, cut along the "A-A" plane indicated in the "PLAN VIEW". It shows the airfoil profile of the wing at the top and a circular profile representing the engine nacelle at the bottom. A circular element with an internal curved arrow indicates a rotating engine rotor. A rectangular shape, representing a fragment, is depicted originating from the rotor and impacting the lower surface of the wing structure. Two diagonal lines extend upwards from the impact point, defining a cone of potential fragment trajectories. A hatched, shaded area is shown within the wing structure, directly above the engine nacelle, representing the "MINIMUM DRY BAY". This area is bounded by the lower wing skin and the fuel tank wall. Two points within this shaded area are marked with numbers "1" and "2". Text labels clarify these points: "1 - Lower Wing Skin Penetration" and "2 - Fuel Tank Wall Penetration". A vertical double-headed arrow indicates a distance labeled "10 inch Minimum Clearance" between the lowest point of the hatched "MINIMUM DRY BAY" area and a horizontal dashed line labeled "Fuel Drip Line". The entire view is labeled "SECTION A-A" with an underline below the text.

**SECTION B-B:**
This bottom-right drawing displays a cross-sectional view of the wing, cut along the "B-B" plane indicated in the "PLAN VIEW". It shows the airfoil shape of the wing. A vertical rectangular shape is depicted within the wing structure. Two diverging vertical lines originate from the bottom of this rectangle, indicating an angle of spread. A text label "Angle Depends On Wing Skin Impact Resistance (5 to 15 Degrees)" is positioned next to these diverging lines, specifying the range of the angle. The entire view is labeled "SECTION B-B" with an underline below the text.

Contextual Linkage:
The image illustrates the engineering principles for designing a "dry bay" to contain fuel leakage resulting from an uncontained engine rotor failure. The "PLAN VIEW" establishes the spatial relationship of the "MINIMUM DRY BAY" relative to the "INTEGRAL FUEL TANK" and the engine. "SECTION A-A" details the critical vertical separation, showing that a "10 inch Minimum Clearance" is required between the "Fuel Drip Line" (representing potential fuel leakage from penetrations 1 and 2) and potential ignition sources within the engine nacelle. This ensures that any fuel leaking from the "Lower Wing Skin Penetration" or "Fuel Tank Wall Penetration" is contained within the dry bay and does not reach ignition sources. "SECTION B-B" provides a design parameter for the angular spread of damage or fragments within the wing structure, indicating that this "Angle Depends On Wing Skin Impact Resistance" and typically ranges from "5 to 15 Degrees", which is relevant for determining the lateral extent of the dry bay or protected area.](file_wSyEACTCE2d/image042.png)

FIGURE
2 – DRY BAY SIZING DETERMINATION EXAMPLE

(ii)       Fuel
tank penetration leak paths should be determined and evaluated for hazards
during flight and ground phases of operation. If fuel spills into the
airstream away from the aeroplane no additional protection is needed.
Additional protection should be considered if fuel could spill, drain or
migrate into areas housing ignition sources, such as engine or APU inlets or
wheel wells. Damage to adjacent systems, wiring etc., should be evaluated
regarding the potential that an uncontained fragment will create both an
ignition source and fuel source. Wheel brakes may be considered as an ignition
source during take-off and initial climb. Protection of the wheel wells may be
provided by airflow discharging from gaps or openings, preventing entry of
fuel, a ventilation rate precluding a combustible mixture or other provisions
indicated in CS 23.863 and CS 25.863.

(iii)      Areas
of the aeroplane where flammable fluid migration is possible that are not
drained and vented and have ignition sources or potential ignition sources
should be provided with a means of fire detection and suppression and be
explosion vented or equivalently protected.

b.         Loss
of Thrust.

(1)       Fuel
Reserves. The fuel reserves should be isolatable such that damage from a disc
fragment will not result in loss of fuel required to complete the flight or a
safe diversion. The effects of fuel loss, and the resultant shift of centre of
gravity or lateral imbalance on aeroplane controllability should also be
considered.

(2)       Engine
Controls. Engine control cables and/or wiring for the remaining powerplants
that pass through the impact area should be separated by a distance equal to
the maximum dimension of a one- third disc fragment or the maximum extent
possible.

(3)       Other
Engine Damage. Protection of any other engines from some fragments should be
provided by locating critical components, such as engine accessories essential
for proper engine operation (e.g., high pressure fuel lines, engine controls
and wiring, etc.), in areas where inherent shielding is provided by the
fuselage, engine or nacelle (including thrust reverser) structure (see
Paragraph 7).

c.         Loss
of Aeroplane Control

(1)       Flight
Controls. Elements of the flight control system should be adequately separated
or protected so that the release of a single one-third disc fragment will not
cause loss of control of the aeroplane in any axis. Where primary flight
controls have duplicated (or multiplicated) elements, these elements should be
located to prevent all elements in any axis being lost as a result of the
single one- third disc fragment. Credit for maintaining control of the
aeroplane by the use of trim controls or other means may be obtained,
providing evidence shows that these means will enable the pilot to retain
control.

(2)       Emergency
Power. Loss of electrical power to critical functions following an uncontained
rotor event should be minimised. The determination of electrical system
criticality is dependent upon aeroplane operations. For example, aeroplanes
approved for Extended Twin Engine Operations (ETOPS) that rely on alternate
power sources such as hydraulic motor generators or APUs may be configured
with the electrical wiring separated to the maximum extent possible within the
one-third disc impact zone.

(3)       Hydraulic
Supply. Any essential hydraulic system supply that is routed within an impact
area should have means to isolate the hydraulic supply required to maintain
control of the aeroplane. The single one-third disc should not result in loss
of all essential hydraulic systems or loss of all flight controls in any axis
of the aeroplane.

(4)       Thrust
reverser systems. The effect of an uncontained rotor failure on inadvertent
in-flight deployment of each thrust reverser and possible loss of aeroplane
control shall be considered. The impact area for components located on the
failed engine may be different from the impact area defined in Paragraph 6. If
uncontained failure could cause thrust reverser deployment, the
enginemanufacturer should be consulted to establish the failure model to be
considered. One acceptable method of minimisation is to locate reverser
restraints such that not all restraints can be made ineffective by the
fragments of a single rotor.

d.         Passenger
and Crew Incapacitation.

(1)       Pilot
Compartment. The pilot compartment of large aeroplanes should not be located
within the ± 15° spread angle of any engine rotor stage or APU rotor stage
that has not been qualified as contained, unless adequate shielding,
deflectors or equivalent protection is provided for the rotor stage in
accordance with Paragraph 7c. Due to design constraints inherent in smaller
CS-23 aeroplanes, it is not considered practical to locate the pilot
compartment outside the ±15° spread angle. Therefore for other aeroplanes
(such as new CS-23 commuter category aeroplanes) the pilot compartment area
should not be located within the ±5° spread angle of any engine rotor stage or
APU rotor stage unless adequate shielding, deflectors, or equivalent
protection is provided for the rotor stage in accordance with Paragraph 7c of
this AMC, except for the following:

(i)        For
derivative CS-23 category aeroplanes where the engine location has been
previously established, the engine location in relation to the pilot
compartment need not be changed.

(ii)       For
non-commuter CS-23 category aeroplanes, satisfactory service experience
relative to rotor integrity and containment in similar engine installations
may be considered in assessing the acceptability of installing engines in line
with the pilot compartment.

(iii)      For
non-commuter new CS-23 category aeroplanes, where due to size and/or design
considerations the ± 5° spread angle cannot be adhered to, the pilot
compartment/engine location should be analysed and accepted in accordance with
Paragraphs 9 and 10.

(2)       Pressure
Vessel. For aeroplanes that are certificated for operation above 41,000 feet,
the engines should be located such that the pressure cabin cannot be affected
by an uncontained one- third or intermediate disc fragment. Alternatively, it
may be shown that rapid decompression due to the maximum hole size caused by
fragments within the ± 15° zone and the associated cabin pressure decay rate
will allow an emergency descent without incapacitation of the flightcrew or
passengers. A pilot reaction time of 17 seconds for initiation of the
emergency decent has been accepted. Where the pressure cabin could be affected
by a one-third disc or intermediate fragments, design precautions should be
taken to preclude incapacitation of crew and passengers. Examples of design
precautions that have been previously accepted are:

(i)        Provisions
for a second pressure or bleed down bulkhead outside the impact area of a one-
third or intermediate disc fragment.

(ii)       The
affected compartment in between the primary and secondary bulkhead was made
inaccessible, by operating limitations, above the minimum altitude where
incapacitation could occur due to the above hole size.

(iii)      Air
supply ducts running through this compartment were provided with non-return
valves to prevent pressure cabin leakage through damaged ducts.

NOTE: If a bleed down bulkhead is used it
should be shown that the rate of pressure decay and minimum achieved cabin
pressure would not incapacitate the crew, and the rate of pressure decay would
not preclude a safe emergency descent.

e.         Structural
Integrity. Installation of tear straps and shear ties within the uncontained
fan blade and engine rotor debris zone to prevent catastrophic structural
damage has been utilised to address this threat.

9.         ENGINE AND APU FAILURE MODEL.

The safety analysis recommended in Paragraph
10 should be made using the following engine and APU failure model, unless for
the particular engine/APU type concerned, relevant service experience, design
data, test results or other evidence justify the use of a different model.

a.         Single
One-Third Disc fragment. It should be assumed that the one-third disc fragment
has the maximum dimension corresponding to one-third of the disc with
one-third blade height and a fragment spread angle of ± 3°. Where energy
considerations are relevant, the mass should be assumed to be one-third of the
bladed disc mass and its energy, the translational energy (i.e., neglecting
rotational energy) of the sector travelling at the speed of its c.g. location
as defined in Figure 3.

b.         Intermediate
Fragment. It should be assumed that the intermediate fragment has a maximum
dimension corresponding to one-third of the bladed disc radius and a fragment
spread angle of ± 5°. Where energy considerations are relevant, the mass
should be assumed to be 1/30 of the bladed disc mass and its energy the
transitional energy (i.e. neglecting rotational energy) of the piece
travelling at rim speed (see Figure 4).

![Aviation.Bot AI suggestion, not from EASA source: A diagram illustrating the definition and key dimensions of a single one-third rotor fragment, including its angular extent, blade height, and the location of its center of gravity.

Detailed Description:
The image displays a two-dimensional schematic diagram of a single one-third rotor fragment, presented as a sector of a circular disc.
At the center of the diagram, a solid black dot is marked and labeled "CG" (Center of Gravity). A horizontal solid black line passes through the "CG" point, extending across the width of the fragment. A vertical solid black line also passes through the "CG" point, extending upwards from the horizontal line.
The main body of the fragment is defined by a solid black arc, which forms the outer boundary, and two solid black radial lines extending from the "CG" point to the ends of the arc. These radial lines form an angle of "120°" at the "CG" point, indicated by an arc and the numerical label.
A dimension labeled "R*" is indicated along the lower-left radial line, extending from the "CG" to the solid arc, representing a radius.
At the outer ends of the solid arc, two small, solid black rectangular shapes are depicted, representing blade sections.
On the left blade section, a dimension "b" is indicated by a short line segment with inward-pointing arrows, positioned perpendicular to the radial line, representing the full blade height.
On the right blade section, a dimension "1/3 b" is indicated similarly, perpendicular to the radial line, representing one-third of the blade height.
Above the solid arc, two dashed black arcs are shown, concentric with the solid arc, suggesting a wider potential spread or boundary.
A horizontal double-headed arrow is positioned above the entire fragment, spanning its maximum horizontal extent, and is labeled "MAXIMUM DIMENSION". Vertical dashed black lines extend downwards from the ends of this arrow to the outermost dashed arc, indicating the boundaries of this maximum dimension.
Below the diagram, explanatory text is provided:
"Where R = disc radius"
"b = blade length"
"The CG is taken to lie on the maximum dimension as shown."

Contextual Linkage:
This diagram visually defines the characteristics of a "Single One-Third Disc fragment" as described in Paragraph 9a of the accompanying text. The "120°" angle directly corresponds to the "one-third disc" aspect (1/3 of 360°). The dimensions "b" and "1/3 b" on the blade sections illustrate the "one-third blade height" concept mentioned in the text. The "MAXIMUM DIMENSION" label and the statement "The CG is taken to lie on the maximum dimension as shown" clarify the reference point for the fragment's center of gravity (CG) location, which is relevant for determining its translational energy as specified in the text. The "R*" dimension is a visual representation of a radius, likely related to the "disc radius" 'R' defined in the legend.](file_wSyEACTCE2d/image043.png)
FIGURE 3 – SINGLE ONE-THIRD ROTOR FRAGMENT

![Aviation.Bot AI suggestion, not from EASA source: This image provides a diagrammatic definition and key parameters for an intermediate fragment resulting from an uncontained turbine engine rotor failure.

Detailed Description:
The image presents a two-dimensional cross-sectional view illustrating the geometry of an intermediate fragment relative to a rotating disc. At the bottom center, a crosshair symbol denotes the center of rotation. A solid black arc, originating from this center, represents the disc rim. An arrow labeled "R" extends from the center of rotation to this solid arc, indicating the "disc radius". Concentric with the solid arc, a dashed black arc is positioned radially outwards.

An irregular, roughly rectangular, blob-like shape, representing the intermediate fragment, is depicted in the upper right portion of the diagram. The lower edge of this fragment aligns with the solid arc (disc rim), and its upper edge extends beyond the dashed arc. The text "CG" is inscribed within this fragment, signifying its center of gravity.

Two dimension lines with arrows indicate specific measurements:
1.  A vertical dimension line, located to the right of the fragment, spans from the uppermost point of the fragment down to the solid arc. This dimension is labeled "1/3 (R + b)".
2.  A short horizontal dimension line, positioned to the right of the solid arc, measures the radial distance between the solid arc and the dashed arc. This dimension is labeled "b".

Below the diagram, a text block provides definitions and assumptions:
*   "Where R = disc radius"
*   "b = blade length"
*   "Maximum dimension = 1/3 (R + b)"
*   "Mass assumed to be 1/30th of bladed disc"
*   "CG is taken to lie on the disc rim"

Contextual Linkage:
This diagram visually defines the characteristics of an "intermediate fragment" as specified in regulatory guidance for engine failure models. The solid arc represents the original disc rim, and the dashed arc, separated by dimension 'b', indicates the outer extent of the blade length from the disc rim. The fragment's center of gravity (CG) is explicitly shown and stated to lie on the disc rim, which is relevant for energy considerations. The diagram precisely illustrates the "Maximum dimension" of the fragment as 1/3 of the sum of the disc radius (R) and the blade length (b), and specifies that the fragment's mass is assumed to be 1/30th of the total bladed disc mass.](file_wSyEACTCE2d/image044.png)

FIGURE
4 – INTERMEDIATE FRAGMENT

c.         Alternative
Engine Failure Model. For the purpose of the analysis, as an alternative to
the engine failure model of Paragraphs 9a and b, the use of a single one-third
piece of disc having a fragment spread angle ± 5° would be acceptable,
provided the objectives of Paragraph 10c are satisfied.

d.         Small
Fragments. It should be assumed that small fragments (shrapnel) range in size
up to a maximum dimension corresponding to the tip half of the blade airfoil
(with exception of fan blades) and a fragment spread angle of ± 15°. Service
history has shown that aluminium lower wing skins, pylons, and pressure cabin
skin and equivalent structures typically resist penetration from all but one
of the most energetic of these fragments. The effects of multiple small
fragments should also be considered. Penetration of less significant
structures such as fairings, empennage, control surfaces and unpressurised
unpressurized skin has typically occurred at the rate of 2½ percent of the
number of blades of the failed rotor stage. Refer to paragraph 7b and 7c for
methods of minimisation of the hazards. Where the applicant wishes to show
compliance by considering the energy required for penetration of structure (or
shielding) the engine manufacturer should be consulted for guidance as to the
size and energy of small fragments within the impact area.

For APUs, where energy considerations are
relevant, it should be assumed that the mass will correspond to the above
fragment dimensions and that it has a translational energy level of one
percent of the total rotational energy of the original rotor stage.

e.         Fan
Blade Fragment. It should be assumed that the fan blade fragment has a maximum
dimension corresponding to the blade tip with one-third the blade airfoil
height and a fragment spread angle of ± 15°. Where energy considerations are
relevant the mass should be assumed to be corresponding to the one-third of
the airfoil including any part span shroud and the transitional energy
(neglecting rotational energy) of the fragment travelling at the speed of its
c.g. location as defined inFigure 5. As an alternative, the engine
manufacturer may be consulted for guidance as to the size and energy of the
fragment.

![Aviation.Bot AI suggestion, not from EASA source: A diagram illustrating the geometric definition and key parameters of a fan blade fragment for uncontained rotor failure analysis.

Detailed Description:
The image displays a simplified, two-dimensional, black-and-white diagram of a fan blade fragment, depicted as a tall, slender, rectangular shape with a rounded top and a slightly flared base. The outline of the fragment is drawn with a solid black line.

On the left side of the fragment, a vertical bracket indicates a dimension labeled "1/3 X", corresponding to the height of the uppermost section of the fragment. This section is delineated by a horizontal solid black line extending across the width of the fragment. Within this upper section, two diagonal solid black lines intersect to form an 'X' shape. At the precise intersection of these diagonal lines, a small circle is drawn, representing a specific point. An arrow, originating from the text "Geometric Center of Gravity", points directly to this small circle. Below the intersection of the diagonal lines, within the same upper section, a small, flat, rectangular shape with a horizontal line on its top surface is depicted, suggesting a cross-section or feature of the fragment.

On the right side of the fragment, a larger vertical bracket spans the entire height of the fragment, labeled "X", indicating the total length or height of the fragment.

To the right of the diagram, a block of text provides definitions and assumptions related to the fragment:
*   "Where X = Airfoil Length (less blade root & platform)"
*   "CG is taken to lie at the centerline of the 1/3 fragment"
*   "Fragment velocity taken at geometric CG"
*   "Fragment mass assumed to be 1/3 of the airfoil mass"

Contextual Linkage:
The diagram visually defines the "Fan Blade Fragment" as described in regulatory guidance, specifically detailing its dimensions and the assumed location for its geometric center of gravity (CG). The total length of the fragment is denoted by 'X', which is explicitly defined as the "Airfoil Length (less blade root & platform)". The upper portion, representing one-third of the total length (1/3 X), is where the geometric center of gravity is located, specifically at the centerline of this one-third segment. This geometric CG is the point at which the fragment's velocity is assumed to be measured for energy considerations. Furthermore, the fragment's mass is assumed to be one-third of the total airfoil mass. These parameters are crucial for calculating the translational energy of the fragment in uncontained rotor failure analysis.](file_wSyEACTCE2d/image045.png)

FIGURE
5 – FAN BLADE FRAGMENT DEFINITION

f.          Critical
Engine Speed. Where energy considerations are relevant, the uncontained rotor
event should be assumed to occur at the engine or APU shaft red line speed.

g.         APU
Failure Model. For all APU's, the installer also needs to address any hazard
to the aeroplane associated with APU debris (up to and including a complete
rotor where applicable) exiting the tailpipe. Paragraphs 9g(1) or (2) below or
applicable service history provided by the APU manufacturer may be used to
define the size, mass, and energy of debris exiting that tailpipe. The APU
rotor failure model applicable for a particular APU installation is dependent
upon the provisions of CS-APU that were utilised for receiving approval:

(1)       For
APU's where rotor integrity has been demonstrated in accordance with CS-APU,
i.e. without specific containment testing, Paragraphs 9a, b, and d, or
Paragraphs 9c and 9d apply.

(2)       For
APU rotor stages qualified as contained in accordance with CS-APU, historical
data shows that in-service uncontained failures have occurred. These failure
modes have included bi-hub, overspeed, and fragments missing the containment
ring which are not addressed by the CS-APU containment test. In order to
address these hazards, the installer should use the APU small fragment
definition of Paragraph 9d or substantiated in-service data supplied by the
APU manufacturer.

10        SAFETY ANALYSIS.

The numerical assessment requested in
Paragraph 10c(3) is derived from methods previously prescribed in ACJ No. 2 to
CS 25.903(d)(1). The hazard ratios provided are based upon evaluation of
various configurations of large aeroplanes, made over a period of time,
incorporating practical methods of minimising the hazard to the aeroplane from
uncontained engine debris.

a.         Analysis.
An analysis should be made using the engine/APU model defined in Paragraph 9
to determine the critical areas of the aeroplane likely to be damaged by rotor
debris and to evaluate the consequences of an uncontained failure. This
analysis should be conducted in relation to all normal phases of flight, or
portions thereof.

NOTE: APPENDIX 1 provides additional
guidance for completion of the numerical analysis requested by this paragraph.

(1)       A
delay of at least 15 seconds should be assumed before start of the emergency
engine shut down. The extent of the delay is dependent upon circumstances
resulting from the uncontained failure including increased flightcrew workload
stemming from multiplicity of warnings which require analysis by the
flightcrew.

(2)       Some
degradation of the flight characteristics of the aeroplane or operation of a
system is permissible, provided the aeroplane is capable of continued safe
flight and landing. Account should be taken of the behaviour of the aeroplane
under asymmetrical engine thrust or power conditions together with any
possible damage to the flight control system, and of the predicted aeroplane
recovery manoeuvre.

(3)       When
considering how or whether to mitigate any potential hazard identified by the
model, credit may be given to flight phase, service experience, or other data,
as noted in Paragraph 7.

b.         Drawings.
Drawings should be provided to define the uncontained rotor impact threat
relative to the areas of design consideration defined in Paragraphs 7a(1)
through (10) showing the trajectory paths of engine and APU debris relative to
critical areas. The analysis should include at least the following:

(1)       Damage
to primary structure including the pressure cabin, engine/APU mountings and
airframe surfaces.

NOTE: Any structural damage resulting from
uncontained rotor debris should be considered catastrophic unless the residual
strength and flutter criteria of ACJ 25.571(a) subparagraph 2.7.2 can be met
without failure of any part of the structure essential for completion of the
flight. In addition, the pressurised compartment loads of CS 25.365(e)(1) and
(g) must be met.

(2)       Damage
to any other engines (the consequences of subsequent uncontained debris from
the other engine(s), need not be considered).

(3)       Damage
to services and equipment essential for safe flight and landing (including
indicating and monitoring systems), particularly control systems for flight,
engine power, engine fuel supply and shut-off means and fire indication and
extinguishing systems.

(4)       Pilot
incapacitation, (see also paragraph 8 d(1)).

(5)       Penetration
of the fuel system, where this could result in the release of fuel into
personnel compartments or an engine compartment or other regions of the
aeroplane where this could lead to a fire or explosion.

(6)       Damage
to the fuel system, especially tanks, resulting in the release of a large
quantity of fuel.

(7)       Penetration
and distortion of firewalls and cowling permitting a spread of fire.

(8)       Damage
to or inadvertent movement of aerodynamic surfaces (e.g.. flaps, slats,
stabilisers, ailerons, spoilers, thrust reversers, elevators, rudders,
strakes, winglets, etc.) and the resultant effect on safe flight and landing.

c.         Safety
Analysis Objectives. It is considered that the objective of minimising hazards
will have been met if:

(1)       The
practical design considerations and precautions of Paragraphs 7 and 8 have
been taken;

(2)       The
safety analysis has been completed using the engine/APU model defined in
Paragraph 9;

(3)       For
CS-25 large aeroplanes and CS-23 commuter category aeroplanes, the following
hazard ratio guidelines have been achieved:

(i)        Single
One-Third Disc Fragment. There is not more than a 1 in 20 chance of
catastrophe resulting from the release of a single one-third disc fragment as
defined in Paragraph 9a.

(ii)       Intermediate
Fragment. There is not more than a 1 in 40 chance of catastrophe resulting
from the release of a piece of debris as defined in Paragraph 9b.

(iii)      Multiple
Disc Fragments. (Only applicable to any duplicated or multiplicated system
when all of the system channels contributing to its functions have some part
which is within a distance equal to the diameter of the largest bladed rotor,
measured from the engine centreline). There is not more than 1 in 10 chance of
catastrophe resulting from the release in three random directions of three
one-third fragments of a disc each having a uniform probability of ejection
over the 360° (assuming an angular spread of ±3° relative to the plane of the
disc) causing coincidental damage to systems which are duplicated or
multiplicated.

NOTE: Where dissimilar systems can be used
to carry out the same function (e.g. elevator control and pitch trim), they
should be regarded as duplicated (or multiplicated) systems for the purpose of
this subparagraph provided control can be maintained.

The numerical assessments described above
may be used to judge the relative values of minimisation. The degree of
minimisation that is feasible may vary depending upon aeroplane size and
configuration and this variation may prevent the specific hazard ratio from
being achieved. These levels are design goals and should not be treated as
absolute targets. It is possible that any one of these levels may not be
practical to achieve.

(4)       For
newly designed non-commuter CS-23 aeroplanes the chance of catastrophe is not
more than twice that of Paragraph 10(c)(3)(i), (ii) and (iii) for each of
these fragment types.

(5)       A
numerical risk assessment is not requested for the single fan blade fragment,
small fragments, and APU and engine rotor stages which are qualified as
contained.

d.         APU
Analysis For APU's that are located where no hazardous consequences would
result from an uncontained failure, a limited qualitative assessment showing
the relative location of critical systems/components and APU impact areas is
all that is needed. If critical systems/components are located within the
impact area, more extensive analysis is needed. For APUs which have
demonstrated rotor integrity only, the failure model outlined in Paragraph
9g(1) should be consideredas a basis for this safety assessment. For APU rotor
stages qualified as contained per CS–APU, the aeroplane safety analysis may be
limited to an assessment of the effects of the failure model outlined in
Paragraph 9g(2).

e.         Specific
Risk The aeroplane risk levels specified in Paragraph 10c, resulting from the
release of rotor fragments, are the mean values obtained by averaging those
for all rotors on all engines of the aeroplane, assuming a typical flight.
Individual rotors or engines need not meet these risk levels nor need these
risk levels be met for each phase of flight if either:

(1)       No
rotor stage shows a higher level of risk averaged throughout the flight
greater than twice those stated in Paragraph 10c.

NOTE: The purpose of this Paragraph is to
ensure that a fault which results in repeated failures of any particular rotor
stage design, would have only a limited effect on aeroplane safety.

![Aviation.Bot AI suggestion, not from EASA source: A bar chart illustrating the percentage distribution of uncontained turbine engine and auxiliary power unit rotor failure incidents across different phases of flight, based on average UK and US data from 1966-1976.

Detailed Description:
The image displays a bar chart titled "Average of UK and US Data (1966-76)*". Below the main title, a smaller asterisked note reads "* SAE data for the period 1962 to 1989 shows a similar distribution."

The chart features a vertical Y-axis labeled "% OF INCIDENTS", with major tick marks and numerical labels at 0, 5, 10, 15, 20, 25, 30, and 35. The horizontal X-axis is labeled "PHASE OF FLIGHT" and lists seven distinct categories, each corresponding to a vertical bar: "Take-off before V1", "V1 to first Power Reduction", "Climb", "Cruise", "Approach", "Descent", and "Landing/Reverse".

Seven vertical bars, each filled with a speckled grey pattern, represent the percentage of incidents for each phase of flight. A numerical value is displayed directly above each bar, indicating its precise percentage:
*   The bar for "Take-off before V1" is the tallest, reaching the 35% mark, with the number "35" displayed above it.
*   The bar for "V1 to first Power Reduction" reaches the 20% mark, with "20" displayed above it.
*   The bar for "Climb" reaches the 22% mark, with "22" displayed above it.
*   The bar for "Cruise" reaches the 14% mark, with "14" displayed above it.
*   The bar for "Approach" reaches the 2% mark, with "2" displayed above it.
*   The bar for "Descent" reaches the 3% mark, with "3" displayed above it.
*   The bar for "Landing/Reverse" reaches the 4% mark, with "4" displayed above it.

Contextual Linkage:
This bar chart visually presents historical data on the distribution of uncontained engine and APU rotor failure incidents across various flight phases. The percentages shown for each phase of flight indicate the relative frequency of such incidents occurring during that specific operational segment. For example, "Take-off before V1" accounts for the highest percentage of incidents (35%), while "Approach" accounts for the lowest (2%). This data can be used to understand the proportional risk of engine failure during particular phases of flight, as referenced in the surrounding EASA regulatory text concerning design considerations for minimizing hazards from uncontained rotor failure.](file_wSyEACTCE2d/image046.jpg)

FIGURE
6 – ALL NON-CONTAINMENTS BY PHASE OF FLIGHT

(2)       Where
failures would be catastrophic in particular portions of flight, allowance is
made for this on the basis of conservative assumptions as to the proportion of
failures likely to occur in these phases. A greater level of risk could be
accepted if the exposure exists only during a particular phase of flight e.g.,
during take-off. The proportional risk of engine failure during the particular
phases of flight is given in SAE Papers referenced in Paragraph 4d. See also
data contained in the CAA paper "Engine Non-Containments – The CAA
View", which includes Figure 6. This paper is published in NASA Report
CP-2017, "An Assessment of Technology for Turbo-jet Engine Rotor
Failures", dated August 1977.

AMC 20-128A Design Considerations for Minimizing Hazards Caused by
Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure

ED Decision 2003/12/RM

1          PURPOSE.

This acceptable means of compliance (AMC) sets forth a method
of compliance with the requirements of CS 23.901(f), 23.903(b)(1),
25.903(d)(1) and 25A903(d)(1)of the EASA Certification Specifications (CS)
pertaining to design precautions taken to minimise the hazards to an aeroplane
in the event of uncontained engine or auxiliary power unit (APU) rotor failures.
The guidance provided within this AMC is harmonised with that of the Federal
Aviation Administration (FAA) and is intended to provide a method of compliance
that has been found acceptable. As with all AMC material, it is not mandatory
and does not constitute a regulation.

2          RESERVED

3          APPLICABILITY.

This AMC applies to CS-23 and CS-25 aeroplanes.

4          RELATED
DOCUMENTS.

Paragraphs 23.903, and 25.903 of the CS and other paragraphs
relating to uncontained engine failures.

a.         Related
Joint Aviation Requirements. Sections which prescribe requirements for the
design, substantiation and certification relating to uncontained engine debris
include:

<table border="1" cellpadding="0" cellspacing="0" width="531">
<tr>
<td valign="top" width="119">
§ 23.863,
 25.863
</td>
<td valign="top" width="412">
Flammable
 fluid fire protection
</td>
</tr>
<tr>
<td valign="top" width="119">
§ 25.365
</td>
<td valign="top" width="412">
Pressurised
 compartment loads
</td>
</tr>
<tr>
<td valign="top" width="119">
§ 25.571
</td>
<td valign="top" width="412">
Damage-tolerance
 and fatigue evaluation of structure
</td>
</tr>
<tr>
<td valign="top" width="119">
§ 25.963
</td>
<td valign="top" width="412">
Fuel
 tanks: general
</td>
</tr>
<tr>
<td valign="top" width="119">
§ 25.1189
</td>
<td valign="top" width="412">
Shut-off
 means
</td>
</tr>
<tr>
<td valign="top" width="119">
§ 25.1461
</td>
<td valign="top" width="412">
Equipment
 containing high energy rotors 
</td>
</tr>
<tr>
<td valign="top" width="119">
CS-APU
</td>
<td valign="top" width="412">
Auxiliary
 Power Units
</td>
</tr>
</table>

NOTE: The provisions of § 25.1461 have occasionally been used
in the approval of APU installations regardless of protection from high energy
rotor disintegration. However, the more specific requirements of CS
25.903(d)(1) and associated guidance described within this AMC take precedence
over the requirements of CS 25.1461.

b.         Other
Documents

<table border="1" cellpadding="0" cellspacing="0" width="530">
<tr>
<td valign="top" width="100">
ISO 2685:1992 
</td>
<td valign="top" width="430">
Aircraft
 – Environmental conditions and test procedures for airborne equipment –
 Resistance to fire in designated fire zones
</td>
</tr>
<tr>
<td valign="top" width="100">
AC 20–135
</td>
<td valign="top" width="430">
Powerplant
 Installation and Propulsion System Component Fire Protection Test Methods,
 Standards, and Criteria.
</td>
</tr>
</table>

c.         Society of
Automotive Engineers (SAE) Documents.

<table border="1" cellpadding="0" cellspacing="0" width="530">
<tr>
<td valign="top" width="100">
AIR1537
</td>
<td valign="top" width="430">
Report
 on Aircraft Engine Containment, October, 1977.
</td>
</tr>
<tr>
<td valign="top" width="100">
AIR4003
</td>
<td valign="top" width="430">
Uncontained
 Turbine Rotor Events Data Period 1976 through 1983. 
</td>
</tr>
<tr>
<td valign="top" width="100">
AIR4770
</td>
<td valign="top" width="430">
Uncontained
 Turbine Rotor Events Data Period 1984 (Draft) through 1989.
</td>
</tr>
</table>

These documents can be obtained from the Society of
Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale, Pennsylvania,
15096.

5          BACKGROUND.

Although turbine engine and APU manufacturers are making
efforts to reduce the probability of uncontained rotor failures, service
experience shows that uncontained compressor and turbine rotor failures
continue to occur. Turbine engine failures have resulted in high velocity
fragment penetration of adjacent structures, fuel tanks, fuselage, system
components and other engines on the aeroplane. While APU uncontained rotor
failures do occur, and to date the impact damage to the aeroplane has been
minimal, some rotor failures do produce fragments that should be considered.
Since it is unlikely that uncontained rotor failures can be completely
eliminated, CS-23 and CS-25 require that aeroplane design precautions be taken
to minimise the hazard from such events.

a.         Uncontained
gas turbine engine rotor failure statistics are presented in the Society of
Automotive Engineers (SAE) reports covering time periods and number of
uncontained events listed in the table shown below. The following statistics
summarise 28 years of service experience for fixed wing aeroplanes and do not
include data for rotorcraft and APUs:

<table border="1" cellpadding="0" cellspacing="0" width="528">
<thead>
<tr>
<td colspan="3" valign="top" width="317">
No. of Events
</td>
</tr>
<tr>
<td valign="top" width="106">
Report No.
</td>
<td valign="top" width="106">
Period
</td>
<td valign="top" width="106">
Total
</td>
<td valign="top" width="106">
Category 3
</td>
<td valign="top" width="106">
Category 4
</td>
</tr>
</thead>
<tr>
<td valign="top" width="106">
AIR1537
</td>
<td valign="top" width="106">
1962–75
</td>
<td valign="top" width="106">
275
</td>
<td valign="top" width="106">
44
</td>
<td valign="top" width="106">
5
</td>
</tr>
<tr>
<td valign="top" width="106">
AIR4003
</td>
<td valign="top" width="106">
1976–83
</td>
<td valign="top" width="106">
237
</td>
<td valign="top" width="106">
27
</td>
<td valign="top" width="106">
3
</td>
</tr>
<tr>
<td valign="top" width="106">
AIR4770
 (Draft)
</td>
<td valign="top" width="106">
1984–89
</td>
<td valign="top" width="106">
164
</td>
<td valign="top" width="106">
22
</td>
<td valign="top" width="106">
7
</td>
</tr>
<tr>
<td colspan="2" valign="top" width="211">
TOTAL
</td>
<td valign="top" width="106">
676
</td>
<td valign="top" width="106">
93
</td>
<td valign="top" width="106">
15
</td>
</tr>
</table>

The total of 676 uncontained events includes 93 events
classified in Category 3 and 15 events classified in Category 4 damage to the
aeroplane. Category 3 damage is defined as significant aeroplane damage with
the aeroplane capable of continuing flight and making a safe landing. Category
4 damage is defined as severe aeroplane damage involving a crash landing,
critical injuries, fatalities or hull loss.

During this 28 year period there were 1,089.6 million engine
operating hours on commercial transports. The events were caused by a wide
variety of influences classed as environmental (bird ingestion,
corrosion/erosion, foreign object damage (FOD)), manufacturing and material
defects, mechanical, and human factors (maintenance and overhaul, inspection
error and operational procedures).

b.         Uncontained
APU rotor failure statistics covering 1962 through 1993 indicate that there
have been several uncontained failures in at least 250 million hours of
operation on transport category aeroplanes. No Category 3 or 4 events were
reported and all failures occurred during ground operation. These events were
caused by a wide variety of influences such as corrosion, ingestion of
de-icing fluid, manufacturing and material defects, mechanical, and human
factors (maintenance and overhaul, inspection error and operational
procedures).

c.         The
statistics in the SAE studies indicate the existence of many different causes
of failures not readily apparent or predictable by failure analysis methods.
Because of the variety of causes of uncontained rotor failures, it is
difficult to anticipate all possible causes of failure and to provide
protection to all areas. However, design considerations outlined in this AMC
provide guidelines for achieving the desired objective of minimising the
hazard to an aeroplane from uncontained rotor failures. These guidelines,
therefore, assume a rotor failure will occur and that analysis of the effects
of this failure is necessary. These guidelines are based on service experience
and tests but are not necessarily the only means available to the designer.

6          TERMINOILOGY.

a.         Rotor.
Rotor means the rotating components of the engine and APU that analysis, test,
and/or experience has shown can be released during uncontained failure. The
engine or APU manufacturer should define those components that constitute the
rotor for each engine and APU type design. Typically rotors have included, as
a minimum, discs, hubs, drums, seals, impellers, blades and spacers.

b.         Blade. The
airfoil sections (excluding platform and root) of the fan, compressor and
turbine.

c.         Uncontained
Failure. For the purpose of aeroplane evaluations in accordance with this AMC,
uncontained failure of a turbine engine is any failure which results in the
escape of rotor fragments from the engine or APU that could result in a
hazard. Rotor failures which are of concern are those where released fragments
have sufficient energy to create a hazard to the aeroplane.

d.         Critical
Component. A critical component is any component whose failure would
contribute to or cause a failure condition which would prevent the continued
safe flight and landing of the aeroplane. These components should be
considered on an individual basis and in relation to other components which
could be damaged by the same fragment or by other fragments from the same
uncontained event.

e.         Continued
Safe Flight and Landing. Continued safe flight and landing means that the
aeroplane is capable of continued controlled flight and landing, possibly
using emergency procedures and without exceptional pilot skill or strength,
with conditions of considerably increased flightcrew workload and degraded
flight characteristics of the aeroplane.

f.          Fragment
Spread Angle. The fragment spread angle is the angle measured, fore and aft
from the centre of the plane of rotation of an individual rotor stage,
initiating at the engine or APU shaft centreline (see Figure 1).

![Aviation.Bot AI suggestion, not from EASA source: This image is a schematic cross-sectional diagram of a turbine engine or Auxiliary Power Unit (APU), illustrating the estimated paths and spread angles of various uncontained rotor fragments.

Detailed Description:
The image presents a black and white line drawing of a turbine engine or APU in a side, cross-sectional view. A horizontal dashed line runs through the center of the engine, representing the "ENGINE OR APU SHAFT CENTERLINE".

From left to right, the engine components are depicted:
1. **Fan Section:** On the far left, a large fan assembly is shown, labeled "FAN". It consists of a central hub and large blades extending radially.
2. **Internal Engine Stages:** To the right of the fan, the internal rotating components of the engine (e.g., compressor and turbine stages) are represented by shaded rectangular blocks with vertical lines, indicating multiple stages. These are enclosed within the engine casing, which tapers towards the right.

Above the engine, various types of rotor fragments and their estimated spread angles are illustrated using dashed lines and labels:

* **Fan Blade Fragments:** Originating from the plane of rotation of the "FAN" section, multiple dashed lines diverge upwards and downwards, indicating the spread of "FAN BLADE FRAGMENTS (see figure 5)". A vertical line extends upwards from the fan's plane of rotation, and an angular measurement of "±15°" is indicated relative to this vertical line, encompassing the spread of these fragments.

* **Internal Engine Fragments:** Originating from a plane of rotation further aft within the engine's internal stages, three distinct types of fragments are depicted with their respective spread angles:
 * **1/3RD DISK FRAGMENT:** Illustrated as a large, arc-shaped fragment with radial lines, positioned above the engine. A vertical line extends upwards from its plane of origin, and an angular measurement of "±3°" is indicated relative to this vertical line, showing its spread. This fragment is labeled "1/3RD DISK FRAGMENT (see figure 3)".
 * **INTERMEDIATE FRAGMENT:** Illustrated as a smaller, irregular fragment with radial lines, positioned below the 1/3rd Disk Fragment. A vertical line extends upwards from its plane of origin, and an angular measurement of "±5°" is indicated relative to this vertical line, showing its spread. This fragment is labeled "INTERMEDIATE FRAGMENT (see figure 4)".
 * **SMALL FRAGMENTS:** Illustrated as a very small, irregular fragment, positioned below the Intermediate Fragment. A vertical line extends upwards from its plane of origin, and an angular measurement of "±15°" is indicated relative to this vertical line, showing its spread. This fragment is labeled "SMALL FRAGMENTS (see paragraph 9(d))".

At the bottom right of the diagram, a block of text provides a definition: "FRAGMENT SPREAD ANGLE IS THE ANGLE MEASURED, FORE AND AFT, FROM THE CENTER OF THE PLANE OF ROTATION INITIATING AT THE ENGINE OR APU SHAFT CENTERLINE."

Contextual Linkage:
The diagram visually defines and illustrates the concept of "Fragment Spread Angle" for different types of uncontained rotor fragments (fan blades, disk fragments, intermediate fragments, and small fragments) that could be released from a turbine engine or APU. It shows how these angles are measured relative to the engine's shaft centerline and the specific plane of rotation from which the fragment originates, providing a visual reference for the potential impact areas of such fragments. The varying angles for different fragment types (e.g., ±3°, ±5°, ±15°) indicate different hazard zones.](file_tNNDI2wQkpg/image051.png)

FIGURE
1 – ESTIMATED PATH OF FRAGMENTS

g.         Impact
Area. The impact area is that area of the aeroplane likely to be impacted by
uncontained fragments generated during a rotor failure (see Paragraph 9).

h.         Engine and
APU Failure Model. A model describing the size, mass, spread angle, energy
level and number of engine or APU rotor fragments to be considered when
analysing the aeroplane design is presented in Paragraph 9.

7          DESIGN
CONSIDERATIONS.

Practical design precautions should be used to minimise the
damage that can be caused by uncontained engine and APU rotor fragments. The
most effective methods for minimising the hazards from uncontained rotor fragments
include location of critical components outside the fragment impact areas or
separation, isolation, redundancy, and shielding of critical aeroplane
components and/or systems. The following design considerations are
recommended:

a.         Consider
the location of the engine and APU rotors relative to critical components,
systems or areas of the aeroplane such as:

(1)       Any other
engine(s) or an APU that provides an essential function;

(2)       Pressurised
sections of the fuselage and other primary structure of the fuselage, wings
and empennage;

(3)       Pilot
compartment areas;

(4)       Fuel system
components, piping and tanks;

(5)       Control
systems, such as primary and secondary flight controls, electrical power
cables, wiring, hydraulic systems, engine control systems, flammable fluid
shut-off valves, and the associated actuation wiring or cables;

(6)       Any fire
extinguisher system of a cargo compartment, an APU, or another engine
including electrical wiring and fire extinguishing agent plumbing to these
systems;

(7)       Engine air
inlet attachments and effects of engine case deformations caused by fan blade
debris resulting in attachment failures;

(8)       Instrumentation
essential for continued safe flight and landing;

(9)       Thrust
reverser systems where inadvertent deployment could be catastrophic; and

(10)    Oxygen
systems for high altitude aeroplanes, where these are critical due to descent
time.

b.         Location
of Critical Systems and Components. Critical aeroplane flight and engine
control cables, wiring, flammable fluid carrying components and lines
(including vent lines), hydraulic fluid lines and components, and pneumatic
ducts should be located to minimise hazards caused by uncontained rotors and
fan blade debris. The following design practices should be considered:

(1)       Locate, if
possible, critical components or systems outside the likely debris impact
areas.

(2)                   Duplicate
and separate critical components or systems, or provide suitable protection if
located in debris impact areas.

(3)       Protection
of critical systems and components can be provided by using airframe structure
or supplemental shielding.

These methods have been effective in mitigating the hazards
from both single and multiple small fragments within the ± 15 impact area.
Separation of multiplicated critical systems and components by at least a
distance equal to the 1/2 blade fragment dimension has been accepted for
showing minimisation from a single high energy small fragment when at least
one of the related multiplicated critical components is shielded by
significant structure such as aluminium lower wing skins, pylons, aluminium
skin of the cabin pressure vessel, or equivalent structures.

Multiplicated critical systems and components positioned
behind less significant structures should be separated by at least a distance
equal to the 1/2 blade fragment dimension, and at least one of the
multiplicated critical systems should be:

(i)        Located
such that equivalent protection is provided by other inherent structures such
as pneumatic ducting, interiors, bulkheads, stringers, or

(ii)       Protected
by an additional shield such that the airframe structure and shield material
provide equivalent shielding.

(4)       Locate
fluid shut-offs and actuation means so that flammable fluid can be isolated in
the event of damage to the system.

(5)       Minimise
the flammable fluid spillage which could contact an ignition source.

(6)       For
airframe structural elements, provide redundant designs or crack stoppers to
limit the subsequent tearing which could be caused by uncontained rotor
fragments.

(7)       Locate fuel
tanks and other flammable fluid systems and route lines (including vent lines)
behind aeroplane structure to reduce the hazards from spilled fuel or from
tank penetrations. Fuel tankexplosion-suppression materials, protective
shields or deflectors on the fluid lines, have been used to minimise the
damage and hazards.

c.         External
Shields and Deflectors. When shields, deflection devices or aeroplane
structure are proposed to be used to protect critical systems or components,
the adequacy of the protection, including mounting points to the airframe
structure, should be shown by testing or validated analyses supported by test
data, using the fragment energies supplied by the engine or APU manufacturer
or those defined in Paragraph 9. For protection against engine small
fragments, as defined in Paragraph 9, no quantitative validation as defined in
Paragraph 10 is required if equivalency to the penetration resistant
structures listed (e.g. pressure cabin skins, etc.) is shown.

8          ACCEPTED
DESIGN PRECAUTIONS.

Design practices currently in use by the aviation industry
that have been shown to reduce the overall risk, by effectively eliminating
certain specific risks and reducing the remaining specific risks to a minimum
level, are described within this paragraph of the AMC. Aeroplane designs
submitted for evaluation by the regulatory authorities will be evaluated
against these proven design practices.

a.         Uncontrolled
Fire.

(1)       Fire
Extinguishing Systems. The engine/APU fire extinguishing systems currently in
use rely on a fire zone with a fixed compartment air volume and a known air
exchange rate to extinguish a fire. The effectiveness of this type of system
along with firewall integrity may therefore be compromised for the
torn/ruptured compartment of the failed engine/APU. Protection of the
aeroplane following this type of failure relies on the function of the fire
warning system and subsequent fire switch activation to isolate the engine/APU
from airframe flammable fluid (fuel and hydraulic fluid) and external ignition
sources (pneumatic and electrical). Fire extinguishing protection of such a
compromised system may not be effective due to the extent of damage. Continued
function of any other engine, APU or cargo compartment fire warning and
extinguisher system, including electrical wiring and fire extinguishing agent
plumbing, should be considered as described in Paragraph 7.

(2)       Flammable
Fluid Shut-off Valve. As discussed above, shut-off of flammable fluid supply
to the engine may be the only effective means to extinguish a fire following
an uncontained failure, therefore the engine isolation/flammable fluid
shut-off function should be assured following an uncontained rotor failure.
Flammable fluid shut-off valves should be located outside the uncontained
rotor impact area. Shut-off actuation controls that need to be routed through
the impact area should be redundant and appropriately separated in relation to
the one-third disc maximum dimension.

(3)       Fire
Protection of Critical Functions. Flammable fluid shut-off and other critical
controls should be located so that a fire (caused by an uncontained rotor
event) will not prevent actuation of the shut- off function or loss of
critical aeroplane functions. If shut-off or other critical controls are
located where a fire is possible following an uncontained rotor failure (e.g.
in compartments adjacent to fuel tanks) then these items should meet the
applicable fire protection guidelines such as ISO 2685:1992 or AC 20-135.

(4)       Fuel Tanks.
If fuel tanks are located in impact areas, the following precautions should be
implemented:

(i)        Protection
from the effects of fuel leakage should be provided for any fuel tanks located
above an engine or APU and within the one-third disc and intermediate fragment
impact areas. Dry bays or shielding are acceptable means. The dry bay should
be sized based on analysis of possible fragment trajectories through the fuel
tank wall and the subsequent fuel leakage from the damaged fuel tank so that
fuel will not migrate to an engine, APU or other ignition source during either
– flight or ground operation. A minimum drip clearance distance of 10 inches
(254 mm) from potential ignition sources of the engine nacelle, for static
conditions, has been acceptable (see Figure 2).

![Aviation.Bot AI suggestion, not from EASA source: **Overall Summary:** This image provides a technical drawing illustrating the design concept of a "minimum dry bay" for an aircraft wing and engine nacelle, intended to prevent fuel leakage from reaching ignition sources following an uncontained rotor failure.

**Detailed Description:** The image consists of three distinct black and white line drawings: a "PLAN VIEW" at the top, and "SECTION A-A" and "SECTION B-B" below it.

The **PLAN VIEW** depicts a partial top-down view of an aircraft wing and an adjacent engine nacelle.
* A large, irregular polygonal shape on the right is labeled "INTEGRAL FUEL TANK", representing a fuel containment area within the wing structure.
* Two straight lines, one labeled "LEADING EDGE" and another labeled "FRONT SPAR", define structural elements of the wing. The "LEADING EDGE" is positioned forward of the "FRONT SPAR".
* An engine nacelle, partially shown on the left, is attached to the wing.
* A triangular area, shaded with a cross-hatch pattern, is located between the wing and the engine nacelle. This area is labeled "MINIMUM DRY BAY".
* Within the "MINIMUM DRY BAY", two numerical labels, "1" and "2", indicate specific points.
* Two sets of dashed lines with arrows indicate the cutting planes for the cross-sectional views: "A" and "B". The "A" lines cut across the wing and nacelle, while the "B" lines cut longitudinally through the wing.

**SECTION A-A** is a cross-sectional view of the wing and engine nacelle, cut along the A-A plane shown in the "PLAN VIEW".
* The wing profile is shown at the top, containing the "INTEGRAL FUEL TANK".
* Below the wing, the engine nacelle is depicted, with a circular element inside representing an engine rotor, indicated by a curved arrow suggesting rotation.
* The "MINIMUM DRY BAY" is again shown as a shaded, cross-hatched area, positioned directly below the "INTEGRAL FUEL TANK" and above the engine nacelle.
* Two labels are associated with points "1" and "2" from the "PLAN VIEW":
 * "1 - Lower Wing Skin Penetration" points to the lower boundary of the "MINIMUM DRY BAY" where it meets the wing structure.
 * "2 - Fuel Tank Wall Penetration" points to the upper boundary of the "MINIMUM DRY BAY" where it meets the "INTEGRAL FUEL TANK".
* A horizontal line labeled "Fuel Drip Line" is shown below the engine nacelle.
* A vertical double-headed arrow indicates a distance between the bottom of the "MINIMUM DRY BAY" and the "Fuel Drip Line", labeled "10 inch Minimum Clearance".

**SECTION B-B** is a cross-sectional view of the wing, cut along the B-B plane shown in the "PLAN VIEW".
* This view shows the airfoil shape of the wing.
* Two vertical lines originate from the wing's upper and lower surfaces, converging downwards.
* Text adjacent to these lines states: "Angle Depends On Wing Skin Impact Resistance (5 to 15 Degrees)". This text describes the angle formed by these converging lines.

**Contextual Linkage:** The image illustrates the design principle for a dry bay to mitigate hazards from uncontained engine rotor failure. The "MINIMUM DRY BAY" is strategically located to contain fuel leakage resulting from penetrations (points 1 and 2) in the lower wing skin and fuel tank wall, which could be caused by fragments from an uncontained engine event. The "10 inch Minimum Clearance" from the "MINIMUM DRY BAY" to the "Fuel Drip Line" ensures that any leaked fuel is kept a safe distance from potential ignition sources within the engine nacelle. "SECTION B-B" provides guidance on the angular spread (5 to 15 degrees) of potential fragment trajectories, which is a factor in determining the required size and shape of the dry bay based on the wing skin's impact resistance.](file_tNNDI2wQkpg/image052.png)

FIGURE 2 –
DRY BAY SIZING DETERMINATION EXAMPLE

(ii)       Fuel tank
penetration leak paths should be determined and evaluated for hazards during
flight and ground phases of operation. If fuel spills into the airstream away
from the aeroplane no additional protection is needed. Additional protection
should be considered if fuel could spill, drain or migrate into areas housing
ignition sources, such as engine or APU inlets or wheel wells. Damage to
adjacent systems, wiring etc., should be evaluated regarding the potential
that an uncontained fragment will create both an ignition source and fuel
source. Wheel brakes may be considered as an ignition source during take-off
and initial climb. Protection of the wheel wells may be provided by airflow
discharging from gaps or openings, preventing entry of fuel, a ventilation
rate precluding a combustible mixture or other provisions indicated in CS
23.863 and CS 25.863.

(iii)      Areas of
the aeroplane where flammable fluid migration is possible that are not drained
and vented and have ignition sources or potential ignition sources should be
provided with a means of fire detection and suppression and be explosion
vented or equivalently protected.

b.         Loss of
Thrust.

(1)       Fuel
Reserves. The fuel reserves should be isolatable such that damage from a disc
fragment will not result in loss of fuel required to complete the flight or a
safe diversion. The effects of fuel loss, and the resultant shift of centre of
gravity or lateral imbalance on aeroplane controllability should also be
considered.

(2)       Engine
Controls. Engine control cables and/or wiring for the remaining powerplants
that pass through the impact area should be separated by a distance equal to
the maximum dimension of a one- third disc fragment or the maximum extent
possible.

(3)       Other
Engine Damage. Protection of any other engines from some fragments should be
provided by locating critical components, such as engine accessories essential
for proper engine operation (e.g., high pressure fuel lines, engine controls
and wiring, etc.), in areas where inherent shielding is provided by the
fuselage, engine or nacelle (including thrust reverser) structure (see
Paragraph 7).

c.         Loss of
Aeroplane Control

(1)       Flight
Controls. Elements of the flight control system should be adequately separated
or protected so that the release of a single one-third disc fragment will not
cause loss of control of the aeroplane in any axis. Where primary flight
controls have duplicated (or multiplicated) elements, these elements should be
located to prevent all elements in any axis being lost as a result of the
single one- third disc fragment. Credit for maintaining control of the
aeroplane by the use of trim controls or other means may be obtained,
providing evidence shows that these means will enable the pilot to retain
control.

(2)       Emergency
Power. Loss of electrical power to critical functions following an uncontained
rotor event should be minimised. The determination of electrical system
criticality is dependent upon aeroplane operations. For example, aeroplanes
approved for Extended Twin Engine Operations (ETOPS) that rely on alternate
power sources such as hydraulic motor generators or APUs may be configured
with the electrical wiring separated to the maximum extent possible within the
one-third disc impact zone.

(3)       Hydraulic
Supply. Any essential hydraulic system supply that is routed within an impact
area should have means to isolate the hydraulic supply required to maintain
control of the aeroplane. The single one-third disc should not result in loss
of all essential hydraulic systems or loss of all flight controls in any axis
of the aeroplane.

(4)       Thrust
reverser systems. The effect of an uncontained rotor failure on inadvertent
in-flight deployment of each thrust reverser and possible loss of aeroplane
control shall be considered. The impact area for components located on the
failed engine may be different from the impact area defined in Paragraph 6. If
uncontained failure could cause thrust reverser deployment, the
enginemanufacturer should be consulted to establish the failure model to be
considered. One acceptable method of minimisation is to locate reverser
restraints such that not all restraints can be made ineffective by the
fragments of a single rotor.

d.         Passenger
and Crew Incapacitation.

(1)       Pilot
Compartment. The pilot compartment of large aeroplanes should not be located
within the ± 15° spread angle of any engine rotor stage or APU rotor stage
that has not been qualified as contained, unless adequate shielding,
deflectors or equivalent protection is provided for the rotor stage in
accordance with Paragraph 7c. Due to design constraints inherent in smaller
CS-23 aeroplanes, it is not considered practical to locate the pilot
compartment outside the ±15° spread angle. Therefore for other aeroplanes
(such as new CS-23 commuter category aeroplanes) the pilot compartment area
should not be located within the ±5° spread angle of any engine rotor stage or
APU rotor stage unless adequate shielding, deflectors, or equivalent
protection is provided for the rotor stage in accordance with Paragraph 7c of
this AMC, except for the following:

(i)        For
derivative CS-23 category aeroplanes where the engine location has been
previously established, the engine location in relation to the pilot
compartment need not be changed.

(ii)       For non-commuter
CS-23 category aeroplanes, satisfactory service experience relative to rotor
integrity and containment in similar engine installations may be considered in
assessing the acceptability of installing engines in line with the pilot
compartment.

(iii)      For non-commuter
new CS-23 category aeroplanes, where due to size and/or design considerations
the ± 5° spread angle cannot be adhered to, the pilot compartment/engine
location should be analysed and accepted in accordance with Paragraphs 9 and
10.

(2)       Pressure
Vessel. For aeroplanes that are certificated for operation above 41,000 feet,
the engines should be located such that the pressure cabin cannot be affected
by an uncontained one- third or intermediate disc fragment. Alternatively, it
may be shown that rapid decompression due to the maximum hole size caused by
fragments within the ± 15° zone and the associated cabin pressure decay rate
will allow an emergency descent without incapacitation of the flightcrew or
passengers. A pilot reaction time of 17 seconds for initiation of the
emergency decent has been accepted. Where the pressure cabin could be affected
by a one-third disc or intermediate fragments, design precautions should be
taken to preclude incapacitation of crew and passengers. Examples of design
precautions that have been previously accepted are:

(i)        Provisions
for a second pressure or bleed down bulkhead outside the impact area of a one-
third or intermediate disc fragment.

(ii)       The
affected compartment in between the primary and secondary bulkhead was made
inaccessible, by operating limitations, above the minimum altitude where
incapacitation could occur due to the above hole size.

(iii)      Air supply
ducts running through this compartment were provided with non-return valves to
prevent pressure cabin leakage through damaged ducts.

NOTE: If a bleed down bulkhead is used it should be shown
that the rate of pressure decay and minimum achieved cabin pressure would not
incapacitate the crew, and the rate of pressure decay would not preclude a
safe emergency descent.

e.         Structural
Integrity. Installation of tear straps and shear ties within the uncontained
fan blade and engine rotor debris zone to prevent catastrophic structural
damage has been utilised to address this threat.

9.         ENGINE
AND APU FAILURE MODEL.

The safety analysis recommended in Paragraph 10 should be
made using the following engine and APU failure model, unless for the
particular engine/APU type concerned, relevant service experience, design
data, test results or other evidence justify the use of a different model.

a.         Single
One-Third Disc fragment. It should be assumed that the one-third disc fragment
has the maximum dimension corresponding to one-third of the disc with
one-third blade height and a fragment spread angle of ± 3°. Where energy
considerations are relevant, the mass should be assumed to be one-third of the
bladed disc mass and its energy, the translational energy (i.e., neglecting
rotational energy) of the sector travelling at the speed of its c.g. location
as defined in Figure 3.

b.         Intermediate
Fragment. It should be assumed that the intermediate fragment has a maximum
dimension corresponding to one-third of the bladed disc radius and a fragment
spread angle of ± 5°. Where energy considerations are relevant, the mass
should be assumed to be 1/30 of the bladed disc mass and its energy the
transitional energy (i.e. neglecting rotational energy) of the piece
travelling at rim speed (see Figure 4).

![Aviation.Bot AI suggestion, not from EASA source: **Overall Summary:** A technical diagram illustrating the geometric definition of a single one-third rotor fragment, including its dimensions, angular spread, and the location of its center of gravity.

**Detailed Description:** The image displays a two-dimensional schematic of a rotor fragment, depicted as a sector of a circle. At the center of the diagram is a black dot labeled "CG", representing the Center of Gravity. A solid horizontal line extends from the "CG" to the left and right edges of the fragment. Two solid diagonal lines originate from the "CG", extending downwards and outwards to the left and right, forming an angle of "120°" at the "CG". This 120-degree angle is explicitly marked by an arc and the text "120°". The outer boundary of the fragment is defined by a solid curved line connecting the ends of the two diagonal lines. This curved line represents the outer radius of the disc. A dimension line with arrows points from the "CG" to this solid curved line, labeled "R", indicating the disc radius. Two dashed curved lines are drawn concentrically outside the solid curved line, extending from the vertical lines that define the "MAXIMUM DIMENSION". These dashed lines, along with the solid curved line, are encompassed by a horizontal double-headed arrow labeled "MAXIMUM DIMENSION" positioned above the fragment, indicating the overall width of the fragment. At the left end of the fragment, a small rectangular shape is depicted, representing a blade. A dimension line with arrows indicates its length, labeled "b". This blade is positioned at the outer edge of the fragment, perpendicular to the radial line. Similarly, at the right end of the fragment, another small rectangular shape represents a blade. A dimension line with arrows indicates its length, labeled "1/3 b". This blade is also positioned at the outer edge of the fragment, perpendicular to the radial line. Below the main diagram, there are three lines of text: 1. "Where R = disc radius" 2. "b = blade length" 3. "The CG is taken to lie on the maximum dimension as shown."

**Contextual Linkage:** This diagram visually defines the "Single One-Third Disc fragment" as described in Paragraph 9a of the surrounding text. The "120°" angle corresponds to one-third of a full circle, representing the "one-third of the disc". The fragment includes "one-third blade height" as indicated by the "1/3 b" label, and the "b" label represents the full "blade length". The diagram also illustrates that the "CG" (center of gravity) is located on the "maximum dimension" of the fragment, which is relevant for calculating translational energy as mentioned in the text. The "R" (disc radius) is also a key dimension for defining the fragment.](file_tNNDI2wQkpg/image053.png)FIGURE 3 –
SINGLE ONE-THIRD ROTOR FRAGMENT

![Aviation.Bot AI suggestion, not from EASA source: The image is a technical diagram illustrating the definition and key characteristics of an intermediate fragment resulting from an uncontained turbine engine rotor failure, specifically detailing its dimensions, mass assumption, and center of gravity location relative to the bladed disc.

Detailed Description:
The diagram depicts a partial cross-section of a bladed disc, viewed from the side. At the bottom center, a small black crosshair symbol represents the rotational center of the disc. Extending diagonally upwards and to the right from this crosshair is a solid black arrow labeled "R", pointing to a solid black curved line. This solid curved line represents a segment of the disc rim. Concentric with and radially outward from this solid curved line is a dashed black curved line, representing the outer tip of the blades. A horizontal double-headed arrow, positioned to the right of the curved lines, indicates the radial distance between the solid curved line and the dashed curved line, and is labeled "b".

An irregular, blob-like shape, representing the "Intermediate Fragment," is positioned in the upper central part of the diagram. The lower edge of this fragment aligns with the solid curved line (disc rim), and its upper edge extends radially outward beyond the dashed curved line (blade tip). Inside this fragment, the letters "CG" are inscribed, indicating its center of gravity. A vertical double-headed arrow is positioned to the right of the fragment, measuring the vertical distance from the solid curved line (disc rim) to the uppermost point of the fragment. This dimension is labeled "1/3 (R + b)".

Below the diagram, a block of text provides definitions and assumptions:
"Where R = disc radius"
"b = blade length"
"Maximum dimension = 1/3 (R + b)"
"Mass assumed to be 1/30th of bladed disc"
"CG is taken to lie on the disc rim"

Contextual Linkage:
This diagram, labeled "FIGURE 4 – INTERMEDIATE FRAGMENT," visually defines the characteristics of an intermediate fragment as described in regulatory guidance. The diagram illustrates the "Maximum dimension" of the fragment as 1/3 (R + b), where 'R' is the disc radius and 'b' is the blade length, consistent with the concept of a fragment having a maximum dimension corresponding to one-third of the bladed disc radius. It explicitly states that the "Mass assumed to be 1/30th of bladed disc," directly correlating with the mass assumption for intermediate fragments. Furthermore, the diagram indicates that the "CG is taken to lie on the disc rim," which supports the assumption that the fragment's translational energy is based on it traveling at rim speed.](file_tNNDI2wQkpg/image054.png)

FIGURE 4 –
INTERMEDIATE FRAGMENT

c.         Alternative
Engine Failure Model. For the purpose of the analysis, as an alternative to
the engine failure model of Paragraphs 9a and b, the use of a single one-third
piece of disc having a fragment spread angle ± 5° would be acceptable,
provided the objectives of Paragraph 10c are satisfied.

d.         Small
Fragments. It should be assumed that small fragments (shrapnel) range in size
up to a maximum dimension corresponding to the tip half of the blade airfoil
(with exception of fan blades) and a fragment spread angle of ± 15°. Service
history has shown that aluminium lower wing skins, pylons, and pressure cabin
skin and equivalent structures typically resist penetration from all but one
of the most energetic of these fragments. The effects of multiple small
fragments should also be considered. Penetration of less significant
structures such as fairings, empennage, control surfaces and unpressurised
unpressurized skin has typically occurred at the rate of 2½ percent of the
number of blades of the failed rotor stage. Refer to paragraph 7b and 7c for
methods of minimisation of the hazards. Where the applicant wishes to show
compliance by considering the energy required for penetration of structure (or
shielding) the engine manufacturer should be consulted for guidance as to the
size and energy of small fragments within the impact area.

For APUs, where energy considerations are relevant, it should
be assumed that the mass will correspond to the above fragment dimensions and
that it has a translational energy level of one percent of the total
rotational energy of the original rotor stage.

e.         Fan Blade
Fragment. It should be assumed that the fan blade fragment has a maximum
dimension corresponding to the blade tip with one-third the blade airfoil
height and a fragment spread angle of ± 15°. Where energy considerations are
relevant the mass should be assumed to be corresponding to the one-third of
the airfoil including any part span shroud and the transitional energy
(neglecting rotational energy) of the fragment travelling at the speed of its
c.g. location as defined inFigure 5. As an alternative, the engine
manufacturer may be consulted for guidance as to the size and energy of the
fragment.

![Aviation.Bot AI suggestion, not from EASA source: The image provides a diagrammatic definition of a fan blade fragment, illustrating its dimensions, the location of its geometric center of gravity (CG), and associated parameters for mass and velocity.

Detailed Description:
The image displays a vertical, elongated, rectangular shape with rounded corners at the top and a slightly flared base, representing an airfoil. A horizontal line divides the top portion of this shape from the larger lower portion. Within the top portion, two diagonal lines intersect, forming an 'X' pattern. An arrow labeled "Geometric Center of Gravity" points from above to a small circle with a cross inside, located precisely at the intersection of these diagonal lines.

On the left side of the airfoil diagram, two vertical dimension lines with horizontal end-caps indicate specific lengths:
*   A shorter dimension line spans the height of the top portion of the airfoil, labeled "1/3 X".
*   A longer dimension line spans the entire height of the airfoil, labeled "X".

To the right of the airfoil diagram, four lines of text provide definitions and assumptions:
*   "Where X = Airfoil Length (less blade root & platform)"
*   "CG is taken to lie at the centerline of the 1/3 fragment"
*   "Fragment velocity taken at geometric CG"
*   "Fragment mass assumed to be 1/3 of the airfoil mass"

Contextual Linkage:
This diagram visually defines the parameters for a "Fan Blade Fragment" as referenced in regulatory guidance for uncontained turbine engine rotor failure analysis. The 'X' dimension represents the total effective airfoil length, excluding the blade root and platform. The fragment itself is defined as the top one-third (1/3 X) of this airfoil. The diagram specifies that the fragment's geometric center of gravity (CG) is located at the centerline of this one-third fragment. Furthermore, it clarifies that the fragment's velocity should be considered at this geometric CG, and its mass is assumed to be one-third of the total airfoil mass. These definitions are crucial for energy considerations in safety analyses related to uncontained fan blade failures.](file_tNNDI2wQkpg/image055.png)

FIGURE 5 –
FAN BLADE FRAGMENT DEFINITION

f.          Critical
Engine Speed. Where energy considerations are relevant, the uncontained rotor
event should be assumed to occur at the engine or APU shaft red line speed.

g.         APU
Failure Model. For all APU's, the installer also needs to address any hazard
to the aeroplane associated with APU debris (up to and including a complete
rotor where applicable) exiting the tailpipe. Paragraphs 9g(1) or (2) below or
applicable service history provided by the APU manufacturer may be used to
define the size, mass, and energy of debris exiting that tailpipe. The APU
rotor failure model applicable for a particular APU installation is dependent
upon the provisions of CS-APU that were utilised for receiving approval:

(1)       For APU's
where rotor integrity has been demonstrated in accordance with CS-APU, i.e.
without specific containment testing, Paragraphs 9a, b, and d, or Paragraphs
9c and 9d apply.

(2)       For APU
rotor stages qualified as contained in accordance with CS-APU, historical data
shows that in-service uncontained failures have occurred. These failure modes
have included bi-hub, overspeed, and fragments missing the containment ring which
are not addressed by the CS-APU containment test. In order to address these
hazards, the installer should use the APU small fragment definition of
Paragraph 9d or substantiated in-service data supplied by the APU
manufacturer.

10        SAFETY
ANALYSIS.

The numerical assessment requested in Paragraph 10c(3) is
derived from methods previously prescribed in ACJ No. 2 to CS 25.903(d)(1).
The hazard ratios provided are based upon evaluation of various configurations
of large aeroplanes, made over a period of time, incorporating practical
methods of minimising the hazard to the aeroplane from uncontained engine
debris.

a.         Analysis.
An analysis should be made using the engine/APU model defined in Paragraph 9
to determine the critical areas of the aeroplane likely to be damaged by rotor
debris and to evaluate the consequences of an uncontained failure. This
analysis should be conducted in relation to all normal phases of flight, or
portions thereof.

NOTE: APPENDIX 1 provides additional guidance for completion
of the numerical analysis requested by this paragraph.

(1)       A delay of
at least 15 seconds should be assumed before start of the emergency engine
shut down. The extent of the delay is dependent upon circumstances resulting
from the uncontained failure including increased flightcrew workload stemming
from multiplicity of warnings which require analysis by the flightcrew.

(2)       Some
degradation of the flight characteristics of the aeroplane or operation of a
system is permissible, provided the aeroplane is capable of continued safe
flight and landing. Account should be taken of the behaviour of the aeroplane
under asymmetrical engine thrust or power conditions together with any
possible damage to the flight control system, and of the predicted aeroplane
recovery manoeuvre.

b.         Drawings.
Drawings should be provided to define the uncontained rotor impact threat
relative to the areas of design consideration defined in Paragraphs 7a(1)
through (10) showing the trajectory paths of engine and APU debris relative to
critical areas. The analysis should include at least the following:

(1)       Damage to
primary structure including the pressure cabin, engine/APU mountings and
airframe surfaces.

NOTE: Any structural damage resulting from uncontained rotor
debris should be considered catastrophic unless the residual strength and
flutter criteria of ACJ 25.571(a) subparagraph 2.7.2 can be met without
failure of any part of the structure essential for completion of the flight.
In addition, the pressurised compartment loads of CS 25.365(e)(1) and (g) must
be met.

(2)       Damage to
any other engines (the consequences of subsequent uncontained debris from the
other engine(s), need not be considered).

(3)       Damage to
services and equipment essential for safe flight and landing (including
indicating and monitoring systems), particularly control systems for flight,
engine power, engine fuel supply and shut-off means and fire indication and
extinguishing systems.

(4)       Pilot
incapacitation, (see also paragraph 8 d(1)).

(5)       Penetration
of the fuel system, where this could result in the release of fuel into
personnel compartments or an engine compartment or other regions of the
aeroplane where this could lead to a fire or explosion.

(6)       Damage to
the fuel system, especially tanks, resulting in the release of a large
quantity of fuel.

(7)       Penetration
and distortion of firewalls and cowling permitting a spread of fire.

(8)       Damage to
or inadvertent movement of aerodynamic surfaces (e.g.. flaps, slats,
stabilisers, ailerons, spoilers, thrust reversers, elevators, rudders,
strakes, winglets, etc.) and the resultant effect on safe flight and landing.

c.         Safety
Analysis Objectives. It is considered that the objective of minimising hazards
will have been met if:

(1)       The
practical design considerations and precautions of Paragraphs 7 and 8 have
been taken;

(2)       The safety
analysis has been completed using the engine/APU model defined in Paragraph 9;

(3)       For CS-25
large aeroplanes and CS-23 commuter category aeroplanes, the following hazard
ratio guidelines have been achieved:

(i)        Single
One-Third Disc Fragment. There is not more than a 1 in 20 chance of
catastrophe resulting from the release of a single one-third disc fragment as
defined in Paragraph 9a.

(ii)       Intermediate
Fragment. There is not more than a 1 in 40 chance of catastrophe resulting
from the release of a piece of debris as defined in Paragraph 9b.

(iii)      Multiple
Disc Fragments. (Only applicable to any duplicated or multiplicated system
when all of the system channels contributing to its functions have some part
which is within a distance equal to the diameter of the largest bladed rotor,
measured from the engine centreline). There is not more than 1 in 10 chance of
catastrophe resulting from the release in three random directions of three
one-third fragments of a disc each having a uniform probability of ejection
over the 360° (assuming an angular spread of ±3° relative to the plane of the
disc) causing coincidental damage to systems which are duplicated or
multiplicated.

NOTE: Where dissimilar systems can be used to carry out the
same function (e.g. elevator control and pitch trim), they should be regarded
as duplicated (or multiplicated) systems for the purpose of this subparagraph
provided control can be maintained.

The numerical assessments described above may be used to
judge the relative values of minimisation. The degree of minimisation that is
feasible may vary depending upon aeroplane size and configuration and this
variation may prevent the specific hazard ratio from being achieved. These
levels are design goals and should not be treated as absolute targets. It is
possible that any one of these levels may not be practical to achieve.

(4)       For newly
designed non-commuter CS-23 aeroplanes the chance of catastrophe is not more
than twice that of Paragraph 10(c)(3)(i), (ii) and (iii) for each of these
fragment types.

(5)       A numerical
risk assessment is not requested for the single fan blade fragment, small
fragments, and APU and engine rotor stages which are qualified as contained.

d.         APU
Analysis For APU's that are located where no hazardous consequences would
result from an uncontained failure, a limited qualitative assessment showing
the relative location of critical systems/components and APU impact areas is
all that is needed. If critical systems/components are located within the
impact area, more extensive analysis is needed. For APUs which have
demonstrated rotor integrity only, the failure model outlined in Paragraph
9g(1) should be consideredas a basis for this safety assessment. For APU rotor
stages qualified as contained per CS–APU, the aeroplane safety analysis may be
limited to an assessment of the effects of the failure model outlined in
Paragraph 9g(2).

e.         Specific
Risk The aeroplane risk levels specified in Paragraph 10c, resulting from the
release of rotor fragments, are the mean values obtained by averaging those
for all rotors on all engines of the aeroplane, assuming a typical flight.
Individual rotors or engines need not meet these risk levels nor need these
risk levels be met for each phase of flight if either:

(1)       No rotor
stage shows a higher level of risk averaged throughout the flight greater than
twice those stated in Paragraph 10c.

NOTE: The purpose of this Paragraph is to ensure that a fault
which results in repeated failures of any particular rotor stage design, would
have only a limited effect on aeroplane safety.

![Aviation.Bot AI suggestion, not from EASA source: **Overall Summary:**
A bar chart illustrating the percentage distribution of uncontained turbine engine and auxiliary power unit rotor failure incidents across different phases of flight, based on average UK and US data from 1966-1976.

**Detailed Description:**
The image displays a bar chart titled "Average of UK and US Data (1966-76)*". Below the main title, a smaller asterisked note reads "* SAE data for the period 1962 to 1989 shows a similar distribution."

The chart features a vertical Y-axis labeled "% OF INCIDENTS", with major tick marks and numerical labels at 0, 5, 10, 15, 20, 25, 30, and 35. Horizontal grid lines extend from these Y-axis tick marks across the plotting area.

The horizontal X-axis is labeled "PHASE OF FLIGHT" and presents seven distinct categories, each represented by a vertical bar. All bars are solid, dark grey with a speckled texture. From left to right, the categories and their corresponding incident percentages are:
1.  "Take-off before V1": A bar extending to 35% on the Y-axis, with the numerical value "35" displayed directly above it.
2.  "V1 to first Power Reduction": A bar extending to 20% on the Y-axis, with the numerical value "20" displayed directly above it.
3.  "Climb": A bar extending to 22% on the Y-axis, with the numerical value "22" displayed directly above it.
4.  "Cruise": A bar extending to 14% on the Y-axis, with the numerical value "14" displayed directly above it.
5.  "Approach": A bar extending to 2% on the Y-axis, with the numerical value "2" displayed directly above it.
6.  "Descent": A bar extending to 3% on the Y-axis, with the numerical value "3" displayed directly above it.
7.  "Landing/Reverse": A bar extending to 4% on the Y-axis, with the numerical value "4" displayed directly above it.

**Contextual Linkage:**
The bar chart visually represents the distribution of uncontained engine failure incidents across various flight phases. Each bar's height and the numerical value displayed above it directly indicate the percentage of total incidents occurring within that specific phase of flight, based on the aggregated UK and US data from the specified period. This data provides a quantitative breakdown of where such incidents are most prevalent during an aircraft's operation.](file_tNNDI2wQkpg/image056.jpg)

FIGURE 6 –
ALL NON-CONTAINMENTS BY PHASE OF FLIGHT

(2)       Where
failures would be catastrophic in particular portions of flight, allowance is
made for this on the basis of conservative assumptions as to the proportion of
failures likely to occur in these phases. A greater level of risk could be
accepted if the exposure exists only during a particular phase of flight e.g.,
during take-off. The proportional risk of engine failure during the particular
phases of flight is given in SAE Papers referenced in Paragraph 4d. See also
data contained in the CAA paper "Engine Non-Containments – The CAA
View", which includes Figure 6. This paper is published in NASA Report
CP-2017, "An Assessment of Technology for Turbo-jet Engine Rotor
Failures", dated August 1977.