1 Purpose.
2 Applicability.
AC 25.901-1 1 PURPOSE.
1.1 This AC describes an acceptable means for showing compliance with the requirements of § 25.901(c), including guidance for conducting an SSA of the powerplant installation. This guidance is intended to supplement the engineering and operational judgment that forms the basis of any compliance findings. The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing requirements under the law or agency policies.
1.2 This AC is not intended to provide specific guidance for compliance of APU installations with §§ 25.901(c) and 25.1309. There are unique considerations when applying these regulations to APU installations, which may be better addressed with specific guidance considering the unique hazards from APUs. The European Union Aviation Safety Agency (EASA) has specific requirements for APU installations, in EASA CS-25 subpart J. The Federal Aviation Administration (FAA) may harmonize its regulations with CS-25 subpart J at some point in the future. While the general SSA guidance in AC 25.1309-1B and some aspects of the general powerplant installation guidance of this AC may be used for APU installations, applicants should use any other available resources to identify potential hazards due to the APU installation to account for in the powerplant installation SSA.
2 APPLICABILITY.
2.1 Applicability of this AC.
2.1.1 The guidance in this AC is for airplane manufacturers, modifiers, foreign regulatory authorities, and FAA type certification engineers and the Administrator’s designees.
This AC is intended specifically for transport category airplanes proposed to be certified under 14 CFR part 25.
2.1.2 Conformity with the guidance is voluntary only and nonconformity will not affect rights and obligations under existing statutes and regulations. The FAA will consider other methods of showing compliance that an applicant may elect to present. Terms such as “should,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used. If the FAA becomes aware of circumstances in which following this AC would not result in compliance with the applicable regulations, the agency may require additional substantiation as the basis for finding compliance.
2.2 Applicability of § 25.901(c).
2.2.1 The guidance provided in this document applies to proposed powerplant installations on transport category airplanes that are subject to the requirements of § 25.901. This guidance specifically concerns showing compliance with the requirements of § 25.901(c), amendment 25-152 (89 FR 68706, August 27, 2024), which states: AC 25.901-1 (c) For each powerplant and auxiliary power unit installation, the applicant must comply with the requirements of § 25.1309, except that the effects of the following failures need not comply with § 25.1309(b) — (1) Engine case burn-through or rupture, (2) Uncontained engine rotor failure, and (3) Propeller debris release.
2.2.2 Section 25.901(c) requires an applicant to provide an overall safety assessment of powerplant and APU installations that meets the requirements of § 25.1309, while accommodating the unique compliance concerns for powerplant and APU installations.
Section 25.901(c) is intended to augment rather than replace other applicable part 25 design and performance standards for transport category airplanes.
2.2.3 In accommodating the unique concerns related to powerplant compliance, the FAA has determined that specific guidance for showing these installations’ compliance with § 25.1309(b) is needed; such guidance is contained in this AC.
2.2.4 Wherever this AC indicates that compliance with other applicable regulations has been accepted as also meeting the intent of § 25.901(c) for a specific failure condition, no additional dedicated safety analysis should be necessary. If any guidance in this AC conflicts or is inconsistent with guidance in AC 25.1309-1B, System Design and Analysis , the more specific guidance in this AC takes precedence in showing compliance with § 25.901(c).
2.2.5 When assessing the potential hazards to the airplane caused by the powerplant installation, the effects of an engine case rupture, uncontained engine rotor failure, engine case burn-through, and propeller debris release are excluded from §§ 25.901(c) and 25.1309(b). The effects and rates of these failures are minimized by compliance with 14 CFR part 33, Airworthiness Standards: Aircraft Engines ; 14 CFR part 35, Airworthiness Standards: Propellers ; and §§ 25.903(d)(1), 25.905(d), and 25.1193. In addition, §§ 25.365(e) and 25.571(e) require that the airplane structure be capable of withstanding the effects of an uncontained engine failure.
2.2.6 Further, the effects of encountering environmental threats or other operating conditions more severe than those for which the airplane is certified (such as volcanic ash or operation above placard speeds) need not be considered in the §§ 25.901(c) and 25.1309(b) compliance process. However, if a failure or malfunction can affect the subsequent environmental qualification or other operational capability of the installation, this effect should be accounted for in the §§ 25.901(c) and 25.1309(b) compliance assessment.
2.2.7 The terms defined in AC 25.1309-1B have the same meaning as the terms used in this AC.
3 Cancellation.
5 Background.
AC 25.901-1 4.2 Advisory Circulars.
The following ACs are related to the guidance in this AC. Please refer to the latest version of each AC referenced in this document; they are available at FAA Advisory Circulars and in the Dynamic Regulatory System (DRS) .
• AC 25-11B, Electronic Flight Deck Display.
• AC 25-24, Sustained Engine Imbalance.
• AC 25.933-1, Unwanted In-flight Thrust Reversal of Turbojet Thrust Reversers.
• AC 25.1309-1B, System Design and Analysis.
• AC 25.1322-1, Flightcrew Alerting.
• AC 25.1329-1C, Approval of Flight Guidance Systems .
• AC 25-19A, Certification Maintenance Requirements.
• AC 120-17B, Reliability Program Methods – Standards for Determining Life Limitations.
4.3 Industry Documents • SAE ARP5150A, Safety Assessment of Transport Airplanes in Commercial Service .
• SAE JA1012, A Guide to the Reliability-Centered Maintenance (RCM) Standard .
5 BACKGROUND.
5.1 The “fail-safe” design concept (described further in AC 25.1309-1B), which instructs the engineer to assume that single failures will happen, and to consider the effects of those failures and combinations of failures in defining a safe design, was inherent in § 25.1309(b) when that regulation was codified in 1964 and has its origins in the preceding Civil Air Regulations. That regulation originally stated: The equipment, systems, and installations must be designed to prevent hazards to the airplane if they malfunction or fail.
5.2 Compliance with that rule was normally shown for only one failure or malfunction at a time. However, as stated in the preamble of Notice of Proposed Rulemaking (NPRM) Notice No. 68-18 (Docket No. 9079, 33 FR 11913, August 22, 1968), which proposed new § 25.1309(b), (c), and (d) requirements, the trend towards more critical, complex, and integrated airplane systems made it clear that the co-existence of multiple failures must be addressed. The question of how many co-existent failures must be tolerated without posing a hazard to the airplane was answered in that proposal by establishing a “logical and acceptable inverse relationship between the probability and the severity of each failure condition.” This concept was adopted in § 25.1309 and applied specifically to powerplant installations through the creation of § 25.901(c) in amendment 25-23 (35 FR 5676, April 8, 1970).
AC 25.901-1 5.3 As the first version of AC 25.1309-1 was being drafted, some powerplant specialists, both within the FAA and industry, became concerned that this new policy focused too much on the “frequency of occurrence” aspect of the new fail-safe rule and not enough on the “prevention of hazards” inherent in traditional fail-safe practices. While “average risk,” which is the risk on a typical flight of all airplanes of a particular model for a typical duration, was seen as an appropriate guide to help an engineer determine the level of redundancy required in the design, it was considered inappropriate to use frequency of occurrence to justify exposure to a hazard that could be eliminated or further reduced through practical means. Further, the FAA placed no restriction on the applicant’s use of the low probability of a failure in order to show its acceptability for compliance. This absence was of particular concern if this new advisory material could be used to accept the kinds of potentially catastrophic single failures that had been prohibited as far back as the early 1950s, in Civil Air Regulation 4b.606(b).
5.4 These concerns led the FAA to revise § 25.901(c) in amendment 25-40 (42 FR 15042, March 17, 1977) to read: (c) For each powerplant…installation, it must be established that no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane, except that the failure of structural elements need not be considered if the probability of such failure is extremely remote.
5.5 By changing § 25.901(c) as indicated above, the FAA intended to safeguard the protections of the traditional “no single failure” concept, while allowing for some consideration of “frequency of occurrence” in the likelihood of multiple failures.
However, unlike § 25.1309(b)(2) of the time, § 25.901(c) did not regulate hazards that did not jeopardize the safe operation of the airplane.
5.6 Despite the fact that the FAA stated in the preamble of NPRM Notice No. 75-19 (Docket No. 14606, 40 FR 21866, May 19, 1975) that § 25.1309 still applied to powerplant installations by that regulation’s own terms, there was much controversy following issuance of amendment 25-40 as to whether the more generally applicable § 25.1309 still applied to powerplant installations. At the very least, the amendment 25-40 revision to § 25.901(c) created standards and undefined terminology that were inconsistent with the terms of the more generally applicable § 25.1309; this fact has caused significant difficulty both for applicants and the FAA.
5.7 The FAA’s revision, at amendment 25-152, of §§ 25.901(c) and 25.1309, and its revisions to the associated advisory material, address shortcomings of both §§ 25.901(c) and 25.1309. These changes implement recommendations from the Aviation Rulemaking Advisory Committee (ARAC) on engine installations. The See Notice of establishment of installation harmonization working group, Task 1—Installations (Engines) (57 FR 58844, December 11, 1992), available at Notice--Installation Harmonization Working Group . The ARAC Powerplant Installation Harmonization Working Group (PIHWG) recommendation report for Task 1 is available at Recommendation Report .
6 General System Safety Assessment Guidance.
AC 25.901-1 ARAC recommendations have prompted the FAA to adopt more consistent standards in these two rules and also harmonize FAA and EASA rules and guidance material.
5.8 The latest § 25.901(c) references § 25.1309. The latest § 25.1309 preserves the “no single failure will jeopardize” concept of § 25.901(c), while clarifying the “inverse relationship between probability and severity” concept.
5.9 This AC has been developed to— • Ensure that the intent of § 25.901(c) is understood and applied by applicants, and by the FAA when finding compliance, • Advise applicants on § 25.1309 concepts as they relate to the powerplant installations, and • Ensure that the applicant identifies any uncertainty in the SSA and suitably manages the uncertainty.
6 GENERAL SYSTEM SAFETY ASSESSMENT GUIDANCE.
6.1 General.
6.1.1 Applicants may show compliance with §§ 25.901(c) and 25.1309(b) by preparing an SSA that is substantiated by appropriate testing and/or analysis, or reference to comparable service experience on other airplanes if shown to be valid for the proposed installation. Such assessment may range from a simple report (providing descriptive details of failure conditions, interpreting test results, comparing two similar systems, similarity analysis, or offering other qualitative information) to a detailed failure analysis that may include estimated numerical probabilities. The depth and scope of an acceptable SSA depends on all of the following: 6.1.1.1 The complexity and criticality of the functions performed by the system(s) under consideration.
6.1.1.2 The severity of related failure conditions.
6.1.1.3 The uniqueness of the design and extent of relevant service experience.
6.1.1.4 The number and complexity of the identified causal failure scenarios.
6.1.1.5 The detectability of contributing failures.
6.1.2 The SSA criteria, process, analysis methods, validation, and documentation should be consistent with the guidance in AC 25.1309-1B. Wherever there is guidance specifically applicable to powerplant installations, this is delineated in paragraph 7 of this AC.
AC 25.901-1 6.1.3 In carrying out the SSA for the powerplant installation for §§ 25.901(c) and 25.1309(b), the results of the engine (and propeller) failure analyses (see §§ 33.28, 33.75, 35.15 and 35.23) should be used as inputs for those powerplant failure effects that can have an impact on the airplane, as appropriate. However, the SSA undertaken to meet part 33 and part 35 airworthiness requirements might not address all the potential effects that an engine and propeller, as installed, may have on the airplane under evaluation since the objectives under parts 33 and 35 differ from part 25.
6.1.3.1 For example, failures within the part 33 and part 35 hardware can cause uncontrollable high thrust (UHT). However, the acceptability of the resulting airplane level failure conditions can only be assessed on an installation-by-installation basis. Therefore, it is necessary for the part 25 SSA to be complete, taking into account the anticipated failures of the part 33 and part 35 hardware. This, at times, has meant that a part 33 and/or part 35 analysis had to be expanded or altered through coordination with the applicable part 33 or part 35 certificate holders and the applicable certifying authority.
6.1.3.2 For those failure conditions covered by analysis under part 33 and/or part 35, and for which the installation has no effect on the conclusions derived from these analyses, it is possible that no additional analyses would be necessary in order to show compliance with §§ 25.901(c) and 25.1309(b). However, the part 25 applicant should provide, at a minimum, acceptable evidence that the part 33 and/or part 35 finding was directly relevant to the part 25 standards, the installation assumptions used under part 33 and/or part 35 remain valid, and that the propulsion installation has no effect on the conclusions. An applicant for a type certificate must show compliance with all applicable requirements per § 21.20(a), and as such all the data required to show compliance with §§ 25.901(c) and 25.1309(b), whether it originated as part 33 or part 35 compliance data, must be reflected within the applicant’s means to show compliance, if only by reference to files accessible through the applicable certification office.
6.1.3.3 In addition, the minimum acceptable level of safety required to comply with part 33 and/or part 35 provisions might not be equivalent to that required under part 25. For example, there will be instances when an engine type design that just meets the minimum standards set by § 33.75 will not be acceptable under § 25.1309(b). Not only does § 25.1309(b) require lower predicted frequencies of occurrence for some of the failure conditions covered by § 33.75, but it also prohibits any “catastrophic failure condition” due to single failures. Section 33.75 does not specifically prohibit single failures from causing conditions like concentration of toxic products in the engine bleed air intended for the cabin that may cause crew incapacitation; significant thrust in the opposite direction to that commanded by the pilot; and uncontrolled fire. All of these are typically considered “catastrophic” under § 25.1309(b).
AC 25.901-1 However, given that there are very few, if any, single failures that could be credibly shown to meet the probability-of-occurrence requirements in § 33.75 for these conditions, the lack of any specific prohibition against catastrophic single failures in § 33.75 is much less likely to pose an engine installation approval issue than is the difference in the required probabilities for such conditions. So, while there are almost always many elements of part 33 and part 35 compliance data that are of significant value to the part 25 analyses, in most cases, a dedicated part 25 analysis is required to demonstrate compliance with §§ 25.901(c) and 25.1309(b).
6.2 Structural Considerations.
The effects of structural failures on the powerplant installation, and vice versa, should be carefully considered by applicants when conducting SSAs. The applicant may use compliance with the requirements of subparts C and D of part 25 to support compliance with §§ 25.901(c) and 25.1309; however, meeting the damage tolerance requirement of § 25.571 by itself is not sufficient to justify the assumption that a single failure will not occur. This is because single failure of structural elements can occur due to causes other than those addressed by § 25.571.
6.2.1 Effects of Structural Failures on Powerplant Installation.
The applicant must account for powerplant installation structural failures that are anticipated to occur within the fleet life of the airplane type, including the foreseeable failure of any single structural element of the powerplant installation, to comply with § 25.901(c), unless specifically excepted in the rule (for example, a structural failure due to an uncontained engine rotor failure). The following are examples of structural failures that have been of concern in previous powerplant installations: 6.2.1.1 Thrust reverser restraining load path failure that may cause a catastrophic inadvertent deployment.
6.2.1.2 Throttle quadrant framing or mounting failure that causes loss of control of multiple engines or causes UHT on one or more engines.
6.2.1.3 Structural failures in an avionics rack or related mounting that cause loss of multiple, otherwise independent powerplant functions, components, and/or systems.
6.2.1.4 Engine mounting system single failures or malfunctions that are not fail- safe.
6.2.2 Effects of Powerplant Installation Failures on Structural Elements.
Any powerplant installation failures that could have adverse effects on the performance of affected structures should be identified during the § 25.901(c) assessment and accounted for when showing compliance with the requirements of part 25, subpart C, Structure , and subpart D, Design and Construction . This should be part of the assessment of failure condition effects for powerplant installation. Some examples of
7 Specific § 25.901(c) System Safety Assessment Guidance.
AC 25.901-1 historical interdependencies between powerplant installations and structures include the following: 6.2.2.1 Fuel system failures that cause excessive fuel load imbalance.
6.2.2.2 Fuel vent, refueling, and feed system failures that cause abnormal internal fuel tank pressures.
6.2.2.3 Engine and propeller failures that cause excessive loads and/or vibration.
(See AC 25-24).
6.2.2.4 Powerplant installation failures that expose structures to extreme temperatures or corrosive material.
6.3 Crew and Maintenance Considerations.
Where the applicant’s analysis identifies that some indication to, and/or action by, the flightcrew or maintenance personnel is necessary to show that the design complies with §§ 25.901(c) and 25.1309(b), the applicant should refer to the guidance in AC 25.1309- 1B on crew and maintenance actions, as well as guidance in AC 25-19A on certification maintenance requirements (CMRs). Applicants may also find additional information in AC 120-17B, and SAE JA1012 for evaluating the effects of inspection and maintenance strategies on failure rates and effects.
7 SPECIFIC § 25.901(c) SYSTEM SAFETY ASSESSMENT GUIDANCE.
The purpose of § 25.901(c), in requiring compliance with § 25.1309, is to prompt the applicant to identify functional hazards and system level failure conditions applicable to powerplant installations. The following list of failure conditions that applicants should consider is by no means complete, but it captures many of the functional hazards and failure conditions that have been of concern in previous powerplant systems and installations.
7.1 General.
7.1.1 Some of the system level failure conditions related to powerplants can contribute to more than one airplane level failure condition (for example, fuel leakage can contribute to or cause loss of thrust, loss of center-of-gravity (CG) control, uncontrolled fire, and so forth). Likewise, several different system level failure conditions may contribute to the probability of the same airplane level failure condition (for example, catastrophic thrust loss may result from failures within the core engine, engine controls or indications, fuel system, and so forth). Hence, any one system level failure condition contributing to an airplane level failure condition often cannot be allowed to consume all the acceptable risk for that airplane level condition. The applicant should review the specific failure conditions identified during the preliminary SSA (refer to AC 25.1309- 1B for additional guidance on the analyses of preliminary or proposed systems design) for its installation against this guidance to assist in ensuring that all failure conditions have been identified and properly addressed.
AC 25.901-1 7.1.2 As stated in paragraph 6.1.1 of this AC, the assessment of these failure conditions may range from a simple report to a detailed failure analysis. The assessment criteria, process, analysis methods, validation, and documentation should be consistent with the guidance in AC 25.1309-1B.
7.1.3 The applicant should validate any assumption of fault isolation between redundancies or other safeguards. The engine-to-engine isolation requirement of § 25.903(b) is one area where this objective is prescribed in the regulations. Another example would be, if a fuel line passes through a firewall, care must be taken to ensure that no failure mode of the fireproof fitting would cause both a leak and violation of the firewall integrity.
Various methods can be used to corroborate an assumption of fault independence.
These include, but are not limited to, zonal analysis, fault insertion testing, and fault tree analysis AND-gate reviews (in other words, using targeted “common cause” assessments and structured methods documentation to verify that there are no foreseeable failures, operating, and/or environmental conditions that can affect the probability of multiple legs under an AND-gate within a fault tree).
7.1.4 A standard SSA used to show compliance with § 25.1309(b) per the guidance in AC 25.1309-1B should be performed to identify and assess all foreseeable failure conditions. This includes accounting for the potential loss of function, partial loss of function, malfunction, erroneous function, etc., as appropriate, using the guidance in AC 25.1309-1B. Paragraphs 7.2 through 7.8 describe some of the general airplane level failure conditions, functional hazards, and related powerplant system level failure conditions of concern.
7.1.5 Industry guidance in Appendix A of SAE ARP5150A, Safety Assessment of Transport Airplanes in Commercial Service, also provides examples of powerplant failures and their potential effects on airplane safety.
7.2 Thrust Loss and/or Excess Drag.
Thrust loss and/or excess drag can critically impact the performance and handling qualities of an airplane. These impacts may be a function of magnitude, direction, and the symmetry of the residual thrust and/or resultant drag. Some key types of these failure conditions include undetected thrust loss, detected thrust loss, unwanted thrust reversal, and excess drag.
7.2.1 Undetected Thrust Loss.
The SSA discussed in paragraph 6 of this AC should consider undetected thrust loss and its effect on airplane safety. The assessment should include an evaluation of the failure of components and systems that could cause an undetected thrust loss, except those already accounted for by the approved average-to-minimum engine assessment.
7.2.1.1 In determining the criticality of undetected thrust losses from a system design and installation perspective, all of the following should be considered: AC 25.901-1 • Magnitude of the thrust loss.
• Direction of thrust.
• Phase of flight.
• Impact of the thrust loss on airplane safety.
Note: Although it is common for safety analyses to consider the total loss of one engine’s thrust, a small undetected thrust loss that persists from the point of takeoff power set could have a more significant impact on the accelerate-stop distances and takeoff obstacle clearance capability than a detectable single-engine total loss of thrust failure condition at V .
7.2.1.2 In addition, the level at which any thrust loss becomes detectable should be validated. This validation is typically influenced by— • Whether or not the thrust loss is symmetric, • Impact on airplane performance and handling, • Resultant changes in powerplant indications, • Instrument accuracy and visibility, • Environmental and operating conditions, and • Relevant crew procedures and capabilities.
7.2.2 Detected Thrust Loss.
While detectable engine thrust losses can range in magnitude from a few percent to 100 percent of total airplane thrust, the total loss of useful thrust (i.e., in-flight shutdown (IFSD)) of one or more engines usually has the largest impact on airplane capabilities and engine-dependent systems. Further, single- and multiple-engine IFSDs tend to be the dominant thrust loss-related failure conditions for most powerplant installations. In light of this, the guidance in this AC focuses on the IFSD failure conditions. The applicant must consider other engine thrust loss failure conditions as part of showing compliance with §§ 25.901(c) and 25.1309, if those conditions are anticipated to occur more often than the IFSD failure condition, or if they could be more severe than the related IFSD failure condition.
7.2.2.1 Single-Engine In-Flight Shutdown.
The FAA generally accepts that the effects of any single-engine thrust loss failure condition, including IFSD, on airplane performance, controllability, maneuverability, and crew workload are accounted for and meet the intent of § 25.901(c) if compliance is also shown with part 25, subpart B, and § 25.1523.
7.2.2.1.1 Nevertheless, an applicant using the method set forth in this AC must also assess the effects of an IFSD on other airplane systems or in combination with other conditions, as part of showing compliance with §§ 25.901(c) and 25.1309. In this case, it should be noted that a single-engine IFSD can AC 25.901-1 result from any number of single failures, and that the rate of IFSDs for all -4 -5 causes ranges from approximately 1 x 10 to 1 x 10 per engine flight hour. This total IFSD rate includes all failures within a typical powerplant installation that affect one—and only one—engine. Those failures within a typical powerplant that can affect more than one engine are described in paragraph 7.2.2.3.2 of this AC.
7.2.2.1.2 For the purpose of showing compliance with § 25.1309(b)(5)(ii) or other aspects of § 25.1309(b), the probability of an IFSD for a turbofan engine installation of a design, build, and maintenance standard that is representative of the state of the art at the time this AC was published can -5 be assumed to be “remote” (or 1 x 10 per flight hour). For all other engine types, an estimate of the IFSD rate may be necessary. If an estimate of the IFSD rate is needed for a specific turbine engine installation, any one of the following methods is suitable for the purposes of complying with §§ 25.901(c) and 25.1309(b): 1. Estimate the IFSD rate based on service experience of similar powerplant installations.
2. Perform a bottom-up reliability analysis using service, test, and any other relevant experience with similar components and/or technologies to predict component failure modes and rates.
-4 3. Use a conservative value of 1 x 10 per flight hour.
7.2.2.1.3 If an estimate of the percentage of these IFSDs for which the engine can be restarted is required, then the estimate should be based on relevant service experience.
7.2.2.1.4 An applicant should only use the default value of “remote” delineated in paragraph 7.2.2.1.2 of this AC for state-of-the-art turbofan engine installations. Methods 1 and 2 , specified under paragraph 7.2.2.1.2 of this AC, are acceptable for estimating the IFSD rates and restart capability for all types of engines, including reciprocating engines or some totally new type of engine or unusual powerplant installation with features such as a novel fuel feed system. In the case of new or novel components, significant non-service experience may be necessary to validate the reliability predictions. This is typically attained through test and/or technology transfer analysis.
-4 7.2.2.1.5 The conservative value of 1 x 10 per flight hour (or once every 10,000 hours), specified in method 3 under paragraph 7.2.2.1.2 of this AC, can be used for any traditional turbine engine installation for which there is no reason to expect below-average reliability. An applicant should verify the use of a conservative IFSD rate is appropriate for their airplane design This range of values originates from the ARAC PIHWG recommendation report in response to Task 1— Installations (Engines) , available on the Internet at Recommendation Report .
AC 25.901-1 since other airworthiness standards, such as the Early ETOPS IFSD rate objectives in section K25.2.2(b)(2) of 14 CFR, appendix K to part 25 may also be included in the certification basis of the airplane, and other considerations (e.g., unique installation or operational requirements)may apply.
7.2.2.2 Related Requirements That Influence Installed Engine Reliability.
7.2.2.2.1 Section 25.901(b)(2) sets an additional standard for installed engine reliability, that being: “The components of the installation must be constructed, arranged, and installed so as to ensure their continued safe operation between normal inspections or overhauls.” However, the very existence of the fail-safe design standards (for example, § 25.901(c)) recognizes that continued safe operation of each component cannot be fully assured. Therefore, an applicant could meet this requirement if its proposed design included technologically feasible and economically practical means, given the current state of the art in design and maintenance that are available at the time of application.
7.2.2.2.2 Scheduled maintenance based on the safe life, hard life, and fail-operational architecture concepts are some of the means of establishing the normal inspections and overhauls required to ensure continued safe operation. Under the safe life concept, a conservative and minimum expected operating life for each component is established, and then an inspection for impending failure or removal for overhaul or replacement is scheduled well within that expected safe life. Under the hard life concept, the component is removed and replaced with a new or overhauled component well within the established safe life of the component. Regarding fail-operational architecture, § 25.901(b)(2) implicitly assumes that each component either can be inspected for impending failure, or some minimum operating life can be acceptably assured. However, this is not always the case for some very small, complex, or deeply embedded components within the powerplant installations (for example, integrated circuit boards). In such cases, the FAA’s long-accepted practice has been to apply the “continued safe operation” objective to each related powerplant installation function, rather than each component. This leads to reliance on detecting and repairing one component failure before a functionally redundant component also fails. When failure of the first component is not directly operationally detectable, then an inspection for failure of that component must be scheduled frequently enough to provide acceptable assurance that a failed component will be found and repaired before the redundant component fails. Since § 25.901(b)(2) clearly requires “continued” as well as “safe” operation, this “fail-operational” concept is notably different from the “fail-safe” concept in that the former requires that the component failure have no effect on functionality, while the latter allows functionality to be degraded or lost depending on the resulting impact on safety.
AC 25.901-1 7.2.2.2.3 On-condition maintenance based on evident degradation in performance and fail-operational architecture are also means of establishing the normal inspections and overhauls required to ensure continued safe operation. For evident degradation in performance, if the impending failure of a component will be operationally evident while the component is still continuing to operate safely, then detection of such degraded performance can be used to schedule timely removal for overhaul or replacement.
Regarding fail-operational architecture, this concept is the same as described in paragraph 7.2.2.2.2 above for scheduled maintenance, except here the failure of the first component, or the functionally redundant components, is directly detectable in operation, so it can be used to schedule timely removal for overhaul or replacement.
7.2.2.2.4 The effectiveness of compliance with part 25, subpart B, and § 25.1523 in meeting the intent of § 25.901(c) for single engine thrust loss is dependent on the accuracy of the human factors assessment for the crew’s ability to take appropriate corrective action. For the purposes of compliance with § 25.901(c), it may be assumed that the crew will take the corrective actions called for in the airplane flight manual procedures and associated approved training when such actions have been acceptably validated in accordance with the relevant human factors and flight deck design standards such as §§ 25.1302, 25.1309(c), and 25.1322.
7.2.2.3 Multiple-Engine In-Flight Shutdown.
When evaluating the multiple engine IFSD failure condition, for some engines the predicted IFSD rates may not support meeting the guidance in AC 25.1309-1B that states a catastrophic failure condition should have an -9 average probability per flight hour on the order of 1 x 10 or less.
However, engine IFSD rates have been part of the historically-accepted service experience upon which that guidance was based, and IFSD rates have been continuously improving.
7.2.2.3.1 Consequently, the FAA has considered typical modern turbine engine IFSD rates, and the resulting possibility of multiple independent IFSDs leading to a critical power loss, inherently acceptable for compliance with § 25.901(c) without the need for a quantitative assessment. Refer to paragraph 7.2.2.1.4 for discussion on IFSD rates for novel technologies.
7.2.2.3.2 Nevertheless, some failures within airplane systems common to multiple engines may cause a catastrophic multiple engine thrust loss. These should be assessed by the applicant to ensure that they meet the “no single failure” and “extremely improbable” criteria of §§ 25.901(c) and 25.1309(b), as well as the engine-to-engine isolation criteria of § 25.903(b). Systems to be considered include, but are not limited to: AC 25.901-1 • Fuel system, • Air data system, • Electrical power system, • Throttle assembly, • Engine indication systems.
7.2.2.3.3 The means of compliance described above are only valid for typical modern turbine engines, and for engines that can show equivalent reliability to such engines, using the means outlined under paragraph 7.1 of this AC. The approach to showing equivalent reliability should be discussed with the FAA early in the program.
7.2.3 Unwanted Thrust Reversal.
For related propeller guidance, see paragraph 7.8.1 of this AC. For related thrust reverser guidance, see p aragraph 7.8.5 of this AC.
7.2.4 Excess Drag.
See paragraph 7.8.1 for related propeller guidance, paragraph 7.8.5 for related thrust reverser guidance, and paragraph 7.8.9 for cowling guidance of this AC.
7.3 Uncontrollable High Thrust.
This class of failure conditions can also critically impact the performance and handling qualities of an airplane. For more guidance, see the Uncontrollable High Thrust (UHT) entry on the FAA Transport Airplane Issues List .
7.4 Uncontrolled Fire.
See paragraph 7.8.6 of this AC for related fire prevention guidance; see paragraph 7.8.7 for related fuel system guidance.
7.5 Overloading of Structures.
See paragraph 6.2.2 of this AC for related structural guidance on general powerplant structural failure conditions. Paragraph 7.8.7 of this AC offers fuel system guidance and examples of fuel system failure conditions, where some may lead to overloading of structures.
7.6 Debris Release and Impact.
Some debris threats are specifically excepted under § 25.901(c) from compliance with § 25.1309(b), such as uncontained engine rotor failure and propeller debris release. For other debris threats, see related guidance for the thrust reverser in paragraph 7.8.5.4 , overloading of structures in paragraph 7.5 , and cowling in paragraph 7.8.9 of this AC.
See Uncontrollable High Thrust (UHT) , Issue ID #T-1402, on the current Transport Airplane Issues List (faa.gov) .
AC 25.901-1 7.7 Personnel Hazard.
Failures that can be foreseen to pose a hazard to personnel under the in-service operating conditions covered by §§ 25.901(c) and 25.1309(b) should be included in the SSA and shown to comply. In addition, the SSA should be utilized to the greatest extent practical to identify any failure condition that could pose a hazard to personnel, including on the ground or adjacent to the airplane, and during expected out-of-service activities, such as the following or similar situations: • Electric shock threats to mechanics.
• Hazardous atmosphere threats to mechanics.
• Unwanted thrust reverser system movement.
• Cowling “hold open” mechanism failure.
7.8 System Level Failure Conditions.
Some of the most common powerplant systems and related failure conditions include the following: • Propeller controls and indications.
• Engine controls and indications.
• Automatic takeoff thrust control system.
• Thrust management system.
• Thrust reverser.
• Fire protection system.
• Fuel system.
• Powerplant ice protection.
• Cowling, nacelle skins, and thrust reverser components.
7.8.1 Propeller Controls and Indications.
Failure conditions include the following: 7.8.1.1 Unwanted fine pitch (overspeed, excessive drag).
7.8.1.2 Unwanted coarse pitch (over-torque, thrust asymmetry).
7.8.1.3 Unwanted propeller feathering (thrust loss, over-torque, thrust asymmetry).
7.8.1.4 Failure to feather following in-flight engine failure (excessive drag).
7.8.1.5 Unwanted application of propeller brake in flight (thrust loss, structural overload, thrust asymmetry).
AC 25.901-1 7.8.1.6 Unwanted operation below the low pitch stop, which is also known as unwanted reverse thrust or beta range pitch (overspeed, excessive drag, thrust asymmetry, disruption of airflow over the wing on wing mounted engines).
7.8.2 Engine Controls and Indications.
Failure conditions include the following: 7.8.2.1 Loss of thrust.
7.8.2.2 Loss of thrust control, including asymmetric thrust, thrust increases, thrust decreases, thrust fail fixed, and unpredictable engine operation.
7.8.2.3 Hazardously misleading display of powerplant parameter(s).
7.8.3 Automatic Takeoff Thrust Control System.
Part 25, appendix I, Installation of an Automatic Takeoff Thrust Control System (ATTCS) , specifies the minimum reliability levels for these automatic systems. In addition to showing compliance with these reliability levels for certain combinations of failures, other failure conditions that can arise as a result of introducing such a system must be shown to comply with §§ 25.901(c) and 25.1309(b).
7.8.4 Thrust Management System.
7.8.4.1 An SSA is essential, in order to show compliance with §§ 25.901(c) and 25.1309(b), for any airplane system that aids the crew in managing engine thrust (for example, computing target engine ratings, commanding engine thrust levels, and so forth). As with any acceptable SSA, the criticality and failure hazard classification must be assessed. The system criticality will depend on all of the following: 7.8.4.1.1 The range of thrust management errors it could cause.
7.8.4.1.2 The likelihood that the crew will detect these errors and take appropriate corrective action.
7.8.4.1.3 The severity of the effects of these errors with and without crew intervention.
7.8.4.2 The hazard classification will depend on the most severe effects anticipated from any system. The need for more in-depth analysis will depend upon the system’s complexity, novelty, initial failure hazard classification, relationship to other airplane systems, and so forth.
7.8.4.3 Automated thrust management features, such as autothrottles and target rating displays, traditionally have been certified by the FAA on the basis that they are only conveniences to reduce crew workload and do not relieve the crew of any responsibility for assuring proper thrust AC 25.901-1 management. In some cases, malfunctions of these systems can be considered minor hazards, at most. However, for this assumption to be valid, even when the crew is no longer directly involved in performing a given thrust management function, the crew must be provided with clear, unambiguous, and timely attention-getting information concerning any unsafe system operating conditions to enable them to take appropriate corrective action. See §§ 25.1309(c) and 25.1322; and ACs 25-11B, 25.1309-1B, and 25.1322-1.
7.8.4.4 Appropriate flightcrew detection and accommodation of failures within any automated thrust management feature is necessary, including unannunciated failures. Consequently, when showing compliance with §§ 25.901(c) and 25.1309, failures within any automated thrust management feature that could create a catastrophic failure condition, if not detected and properly accommodated by crew action, either should be considered— • A catastrophic failure condition when showing compliance with §§ 25.1309(b) and 25.901(c), or • An unsafe system operating condition when showing compliance with the warning requirements of § 25.1309(c).
7.8.4.5 Additional relevant guidance can be found in AC 25.1329-1C.
7.8.5 Thrust Reverser.
Compliance with § 25.933(a) using the “reliability option” means delineated in § 25.933(a)(1)(ii) provides a direct showing of compliance with § 25.1309(b) and, by inference, with § 25.901(c) for the thrust reverser in-flight deployment failure conditions. However, compliance with § 25.933(a) using the “controllability option” means delineated in § 25.933(a)(1)(i) only regulates the severity of thrust reverser in- flight deployment failure conditions. Therefore, a dedicated showing of compliance with §§ 25.901(c) and 25.1309 will be needed to ensure that the anticipated probability of in-flight deployment is appropriately assessed. Refer to AC 25.933-1 for guidance on unwanted in-flight thrust reversal of turbojet thrust reversers. In addition, a standard § 25.1309 SSA should be performed for any other thrust reverser-related failure conditions such as— 7.8.5.1 Unwanted thrust reversal during takeoff roll between power set and lift-off speed (V ) (thrust asymmetry, thrust loss). Unwanted thrust reversal is LOF of particular concern between V V 1 and LOF.
7.8.5.2 Failure of one or more reversers to deploy when commanded (thrust asymmetry, increased stopping distance).
7.8.5.3 Failure of one or more reversers to stow when commanded (thrust asymmetry, excess drag, and efflux impingement problems,( for example, engine inlet distortion, buffet, and lift loss)).
AC 25.901-1 7.8.5.4 Failure of reverser component restraints such as those that would allow unlatching of reverser cowling or ducting while the airplane is operating, release of cascades during reverser operation, and so forth (increased drag and/or buffet, thrust and/or drag asymmetry, debris impact threat).
7.8.5.5 Failure of reverser lock-out means during normal operation or posing a hazard to maintenance personnel.
7.8.6 Fire Protection System.
The requirements of § 25.1309 are intended to augment rather than replace the more specific fire protection requirements of part 25. The SSA provides an overall assessment of the airplane safety; thus § 25.1309 applies in addition to the more specific fire protection requirements in part 25. For more guidance, see the Flammable Fluid Fire Protection entry on the FAA Transport Airplane Issues List. The principal role of the SSA for §§ 25.901(c) and 25.1309(b) is to ensure that the normal means of fire protection are sufficiently reliable and fault tolerant. Some historically significant failure conditions include the following: 7.8.6.1 Single failures affecting multiple safeguards intended to be independent, such as a wire shorting to a flammable fluid line, a pin hole leak in a high pressure hydraulic flammable fluid line causing damage to and arcing in nearby wiring, a firewall fitting failure that causes both a flammable fluid leak into the fire zone and loss of firewall integrity, and so forth.
7.8.6.2 A latent failure causing a component or aspect in the fire protection system to not be explosion-proof or otherwise creating an ignition source within a flammable fluid leakage zone followed by a failure causing a significant leak in that zone.
7.8.6.3 Failures causing hazardous re-routing of flammable fluid drainage. Of particular historical concern have been single failures that could cause errant drainage into an area where ignition sources are nominally expected to exist, such as the wheel well. For example, significant leakage into a compartment has washed accumulated dirt and debris into, and clogged, the dedicated drainage provisions. Consequently, protections against such clogging or adequate alternate redundant drainage paths should be provided.
7.8.6.4 Failures causing greater leakage than can be acceptably accommodated by drainage provisions. For example, slat actuator failures have caused wing spar punctures resulting in hazardous leakage rates.
7.8.6.5 When combined with the presence of a fire, the reliability of normal fire protection means should be considered in addition to meeting other See Flammable Fluid Fire Protection , Issue ID #T-0602, on the current Transport Airplane Issues List (faa.gov) .
AC 25.901-1 standards that apply to fire protection means (see the Flammable Fluid Fire Protection issue on the FAA Transport Airplane Issues List ). The individual loss of the following normal fire protection means should be considered when evaluating their fault tolerance: • Detection.
• Extinguishing.
• Fire Zone Integrity.
• Flammable fluid shut-off or drainage capability.
7.8.6.6 The creation of an ignition source outside a fire zone but in the presence of flammable fluids should also be considered when evaluating normal fire protection means reliability and fault tolerance.
7.8.7 Fuel System.
Failure conditions include the following: 7.8.7.1 Loss of fuel feed or fuel supply.
7.8.7.2 Inability to control CG (in other words, lateral and/or longitudinal imbalance). Fuel imbalance may also result in overloading of structure.
7.8.7.3 Hazardously misleading fuel indications.
7.8.7.4 Loss of fuel system integrity.
Note: The fuel system includes each aircraft fuel tank. Of particular historical concern has been any failure that could cause fuel leakage of unacceptable quantity or location. One example is any failure of a fuel-to- oil heat exchanger that could allow higher volatility fuel to get into the engine oil or airplane hydraulic systems where it would pose an additional fire hazard. Another example is any fuel leak that cannot be detected and isolated before the quantity of fuel leaked prevents continued safe flight and landing due to effects such as fuel exhaustion, critical fuel imbalance, uncontrolled fire, or some other hazardous or catastrophic outcome. Loss of fuel system integrity may also result in overloading of structure.
7.8.7.5 Loss of fuel jettison. Loss of fuel jettison may also result in overloading of structure in an overweight landing.
7.8.7.6 Uncommanded fuel jettison.
See footnote 4 on page 18.
AC 25.901-1 7.8.7.7 Fuel tank ignition. Compliance with § 25.981 provides a showing of compliance with §§ 25.901(c) and 25.1309(b) for fuel system vapor ignition conditions.
7.8.8 Powerplant Ice Protection.
Failure conditions include the following: 7.8.8.1 Loss of propeller, inlet, engine, or other powerplant ice protection on multiple powerplants when required.
7.8.8.2 Loss of ice detection.
7.8.8.3 Activation of engine inlet ice protection above limit temperatures and/or pressures.
Note: While airframe anti-icing systems are not specifically covered in this AC, to the extent that powerplant installation component failures can often contribute to or cause adverse impacts on airframe anti-icing capability, these types of component failures should be highlighted to the appropriate mechanical systems personnel and included in the appropriate SSAs for compliance with § 25.1309. Conversely, any failure in the airframe anti-icing or environmental control system that could cause excessive temperatures and/or pressures or cross-bleeding that affects the safe operation of multiple engines may not comply with § 25.1309(b).
Even if the failure only affects one engine, it may not comply with §§ 25.901(b)(2), 25.901(c), and/or 25.1309(b), depending upon the frequency of occurrence.
7.8.9 Cowling, Nacelle Skins, Engine Inlets, and Thrust Reverser Components.
Failure conditions include the following: 7.8.9.1 Engine nacelle components that are not secured to the engine nacelle during flight may have hazardous or even catastrophic effects at the airplane level. Engine nacelle components include cowlings, nacelle skin, exhaust components, engine inlets, or thrust reverser components such as a translating sleeve.
7.8.9.1.1 Engine nacelle components that are not intended to move during airplane operation can cause damage to the engine or the airframe if they become unsecured. It is possible for an unsecured component to depart the nacelle and impact the same nacelle, another engine, or the airframe. It may also result in significant drag, which could deplete critical fuel reserves or lead to fuel exhaustion. Applicants should account for Extended Operations (ETOPS) flight in addition to non-ETOPS flight, if seeking ETOPS approval under § 25.1535.
7.8.9.1.2 Loss of engine nacelle components has occurred numerous times in service. Service history shows a large number of engine fan cowl door AC 25.901-1 losses during flight have occurred. Engine fan cowl departures have damaged the fuselage and cabin windows resulting in depressurization (and in one event a fatality ), damaged the empennage, and damaged an engine fuel line leading to an engine fire . Since the engine cowl doors are usually part of the fire containment design, their loss precludes the ability to contain a fire and compromises the fire extinguishing means. These events have also resulted in significant drag and increased fuel consumption. While most engine fan cowl losses have occurred shortly after takeoff or during the initial aircraft climb, events (including the fatal event referenced above) have occurred in other flight phases; therefore, the applicant should account for the risk of engine nacelle component loss in all flight phases.
7.8.9.1.3 Many of these events resulted from the maintenance crew improperly closing the fan cowl and securing the latches. In addition, flightcrew pre-flight walk-around inspection procedures were not effective because the maintenance error remained undetected. Maintenance crews have left nacelle fan cowl doors unlatched in service on some airplane models that are more susceptible to this maintenance error. Consequently, previously accepted assumptions that maintenance crews will properly latch nacelle cowls, and flightcrew and maintenance crew procedures will reliably detect an unlatched nacelle cowl during a visual inspection, are not valid for all airplane designs. Therefore, an unlatched cowl door, which may have hazardous or catastrophic effects at the airplane level, is an unsafe system operating condition. In accordance with the guidance in AC 25.1309-1B, an applicant should ensure the nacelle design is tolerant to foreseeable maintenance errors and should provide the capability to check for the nacelle cowls latching condition.
7.8.9.1.4 According to § 25.1309(c), information concerning unsafe system operating conditions must be provided to the crew in order to enable them to take appropriate corrective action if nacelle cowl doors or maintenance access doors are not properly latched. The applicant should use flight deck alerting to attract the attention of and identify to the flightcrew any improperly secured nacelle cowl doors and other maintenance access doors. Flightcrew alerts must be readily and easily detectable and intelligible to the flightcrew under all foreseeable operating conditions.
Refer to the requirements in §§ 25.1309(c) and 25.1322, and guidance in ACs 25-11B, 25.1309-1B, and 25.1322-1.
National Transportation Safety Board Aircraft Accident Report, Left Engine Failure and Subsequent Depressurization, Southwest Airlines Flight 1380, Boeing 737-7H4, N772SW, Philadelphia, Pennsylvania, April 17, 2018 , dated November 19, 2019, NTSB Accident Report--AAR1903 .
United Kingdom Air Accidents Investigation Branch Aircraft Accident Report 1/2015, Report on the accident to Airbus A319-131, G-EUOE, London Heathrow Airport, 24 May 2013 , dated July 14, 2015, Aircraft Accident Report 1/2015 - Airbus A319-131, G-EUOE, 24 May 2013 - GOV.UK (www.gov.uk) . AAIBA Accident Report 1/2015 .
AC 25.901-1 7.8.9.1.5 Alternatively, if in lieu of a flight deck alert the applicant relies on visual detection means to annunciate improperly latched nacelle cowl doors and other maintenance access doors during pre-flight inspection, the applicant should provide sufficient attention-getting characteristics and appropriate design features in order to reduce exposure to an unsafe system operating condition and validate the effectiveness of those means per the following: 1. Provide clearly visible detection means under all anticipated operating and environmental conditions that can occur during pre-flight inspection. Airplane features should not obscure visual detection means. A visual inspection should not require maintenance crew or flightcrew to lie on the ground or bend low.
2. Provide features that are easily distinguishable, such as brightly colored markings. Other features could include a design that holds cowls, access doors, or latches open with a large visible gap between surfaces (for example, the cowls remain clearly open when not properly latched).
3. Evaluate detection at various distances and locations around the airplane.
4. Evaluate detection in anticipated environmental and operating conditions. The detection means should be effective at night and during adverse weather expected to occur within allowable airplane dispatch conditions.
5. Evaluate detection accounting for the flightcrew’s pre-flight walk-around inspection procedure for the airplane design.
7.8.9.2 Failure of cowling latches or other restraints may cause a significant displacement of a surface and result in drag that adversely affects airplane performance or significantly increases fuel consumption.
7.8.9.3 Failure of cowling seals, pressure relief doors, and other surfaces that allow hazardous drainage of flammable fluid, violation of fire containment integrity, or impede passenger egress during an engine fire.
7.8.9.4 Failure of the cowling “hold open” mechanisms that pose a hazard to maintenance personnel. See related guidance in paragraph 7.7 on personnel hazards.
OMB Control Number: 2120-0746 Expiration Date: 11 /3 0 /202 4 Advisory Circular Feedback Form Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 20 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, completing and reviewing the collection of information.
All responses to this collection of information are voluntary FAA Order 1320.46D Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, Barbara Hall, 800 Independence Ave, Washington, D.C. 20590.
If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to ( ) or (2) faxing it to the attention of the LOB/SO ( ).
Subject: Date: Please mark all appropriate line items: □ An error (procedural or typographical) has been noted in paragraph on page .
□ Recommend paragraph on page be changed as follows: □ In a future change to this AC, please cover the following subject: (B riefly describe what you want added.)
□ Other comments: □ I would like to discuss the above. Please contact me.
Submitted b y: Date: FAA Form 1320-73 ( 09/22) SUPERSEDES PREVIOUS EDITIONS