MOC VTOL.2240(d) High Energy Fragments – Particular Risk Analysis

The objective of VTOL.2240(d) and this particular risk analysis applies to lift/thrust unit or rotating-machinery failures, such as propellers, rotors that provide lift, compressor and turbine rotors of turbine engines and APUs and, electric engine rotor and cooling fans. Service experience of conventional aircraft has shown that damages due to high-energy fragments, for example following uncontained compressor and turbine rotor failures, continue to occur. VTOL capable aircraft have no service experience while the introduction of new technology and architectures means that VTOL capable aircraft cannot directly use conventional aircraft service experience to determine the likelihood and effects of failures. For Category Enhanced the failure of a lift/thrust unit or other rotating-machinery should therefore be assumed and the corresponding risk should be assessed, in line with the objective of VTOL.2250(c), with specific considerations for simultaneous or cascading effects presented in this Particular Risk Analysis. For Category Basic, a lower safety objective, in line with VTOL.2510 and the current approach on conventional products, is accepted.

Applicants for either Basic or Enhanced category who wish to utilize a means to shut down or stop individual rotor systems to mitigate hazards considered under this risk analysis should ensure that sufficient and reliable indications, control means and operational procedures are included in the design to allow for correct identification of a failed or hazardous lift/thrust unit and an effective means to meet the analysis assumptions of imbalance exposure herein (see also MOC VTOL.2425(b)).

This MOC does not address the risk to people on the ground, which should be addressed separately.

1.      For Category Basic:

(a)      For Category Basic 1 and Basic 2 aircraft (0 to 6 passengers), no Particular Risk Analysis is requested for high energy fragments.

(b)     For Category Basic 3 (7 to 9 passengers) the following methodology should be applied:

(1)     For turbine engines, the paths and sizes of fragments described in AMC 20-128A and AMC 25.963(e) in Book 2 of CS-25 Amdt. 24 can be used.

(2)     For propellers and other types of fragments, the impact area should be established based on test, analysis, or both. Applicants may use data from propellers with similar physical and operating characteristics to establish the impact area.

(3)     The lift/thrust unit or rotating-machinery probability of a Catastrophic effect due to a fragment release should be extremely improbable, in accordance with VTOL.2510, or the risk should be acceptably minimised by the design to the maximum practicable extent.

(i)      An applicant may choose to not calculate the probability of a fragment release or impact and demonstrate minimisation directly.

(ii)     If the risk is only minimised when impacting a lift/thrust unit, the analysis should be carried further to the next release.

(iii)     All consequences of the impact should be considered including possible cascading effects taking into account the overall probability of failure (Figure 1).

Figure 1: Methodology for the cascading failure evaluation for Category Basic 3

2.      For Category Enhanced

(a)      Fragments to consider:

A failure of a lift/thrust unit or other rotating-machinery should be assumed. The Safety Analysis should consider all fragments that are released with residual energy. For propellers this could be the complete blade from the aerofoil surface to the retention and any component attached to the blade/hub. This could include counterweights, clamps, erosion shields, cuffs, de-ice boots, and pitch change pins.

(b)     Path and size of fragments:

For turbine engines, the paths and sizes of fragments described in AMC 20-128A and AMC 25.963(e) in Book 2 of CS-25 Amdt. 24 can be used. For propellers and other types of fragments the impact area should be established based on test, analysis, or both. Applicants may use data from propellers with similar physical and operating characteristics to establish the impact area.

(c)      Hazards:

Hazards from the failure of a lift/thrust unit or other rotating-machinery to be considered should include damage due to the impact of the high-energy fragments and the imbalance created by such failure. Further guidance material on engine imbalance, including windmilling considerations, can be found in AMC 25-24. Applicants may utilize design means of control and the stoppage of those lift/thrust units, for which the probability of failure of those control means is shown to be commensurate with the objectives of VTOL.2510, and should rationally consider the environment of operation under the expected imbalance conditions.

(d)     Safety Analysis:

(1)     It should be assessed that the failure of a lift/thrust unit or rotating-machinery does not have a catastrophic effect as defined in MOC VTOL.2510.

(2)     The assessment should include aircraft systems, structures (including energy storage), occupants and other lift/thrust units.

(3)     Due to the distributed propulsion, the failure of a lift/thrust unit may, for some architectures, potentially cause other lift/thrust failures in a chain reaction. Specifically, the assessment of simultaneous or cascading failures of lift/thrust units through fragment release should use the following methodology:

(i)      The first release shall not have an immediate catastrophic effect, that is:

(A)     no catastrophic effect due to the lift/thrust unit failure, and

(B)     no catastrophic effect due to a fragment impact into systems, structure, occupants or other lift/thrust units.

(ii)     The first release may however have a catastrophic effect by cascading events if extremely improbable. This is determined as follows:

(A)     If the first impact can cause a second release of a fragment from a lift/thrust unit, the probability of the second release should be evaluated.

(B)     In the determination of the overall probability of the second release, consideration can be given to the probability of occurrence of the first release and the probability of chain reaction (incl. hazardous trajectory probability and associated second release probability).

(C)     If this overall probability of the second release (P_r) is less than 10^-9 per flight hour, the hazards can be considered to have been minimised and the analysis can stop there.

(D)     If this overall probability of the second release (P_r) is higher than 10^-9 per flight hour, the effect of the second impact should be assessed:

(a)     If the effect of the second impact is catastrophic, it must be extremely improbable (  per flight hour).

(b)     If the effect of the second impact is not catastrophic, the overall probability of the third release should then be evaluated.

(E)      The analysis should continue until the overall probability of the next release (P_r) or impact (P_i) is less than  per flight hour, or all lift/thrust units have been assessed (Figure 2).

(iii)     The residual risk for each lift/thrust unit and the whole aircraft should then be quantified to verify that the combined risks do not exceed an acceptable level.

Figure 2: Methodology for the cascading failure evaluation for Category Enhanced

3.      Structural Failure Rate (Category Basic and Enhanced)

(a)      The framework outlined in section (b) “Structural Failure Rate” of MOC VTOL.2250(c) may be used to determine the probability of occurrence of the first failure, which is then subsequently used in the cascading scenario.

(b)     The qualitative approach of section (b) “Structural Failure Rate” of MOC VTOL.2250(c) cannot be used to justify a Structural Failure Rate lower that 10^-7 per flight hour. All three aspects should be addressed, i.e. design robustness, quality of the part and in-service continued structural robustness, however not necessarily equally.