1 Purpose.
2 Applicability.
AC 25.933-1 1 PURPOSE.
This AC describes various acceptable means for showing compliance with the requirements of § 25.933(a)(1) and (a)(2), as they apply to unwanted in-flight turbojet thrust reversals on transport category airplanes. These means are intended to provide guidance to supplement the engineering and operational judgment that forms the basis of compliance findings relative to in-flight thrust reversal of turbojet thrust reversers.
The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing requirements under the law or agency policies.
2 APPLICABILITY.
2.1 Applicability of this AC.
2.1.1 The guidance in this AC is for airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) type certification engineers and the Administrator’s designees.
2.1.2 Conformity with the guidance is voluntary only and nonconformity will not affect rights and obligations under existing statutes and regulations. The FAA will consider other methods of showing compliance that an applicant may elect to present. Terms such as “should,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used. If the FAA becomes aware of circumstances in which following this AC would not result in compliance with the applicable regulations, the agency may require additional substantiation as the basis for finding compliance.
2.2 Applicability of § 25.933(a).
The requirements of § 25.933(a) apply to turbojet reversing systems, also known as thrust reversing systems. Section 25.933(a)(1) applies to reversers intended for ground operation only, while § 25.933(a)(2) applies to reversers intended for in-flight use. The guidance in this AC applies only to unwanted thrust reversal in flight. Thrust reverser failure conditions during ground operations, such as failure to stow or deploy as commanded, unlatching of reverser cowling, and unstow or deployment short of reversal, are addressed by §§ 25.901(c) and 25.1309 and associated guidance.
2.3 Applicability to Reversers Certified Under 14 CFR Part 33.
The airworthiness regulations are structured to allow the applicant to certify thrust reversers either at the airplane level under part 25, or at the engine level under part 33.
The aircraft installation requirements, such as § 25.933(a) still apply to the thrust reversing system, even if certified under part 33 with the engine type design. The applicant for airplane type certification may coordinate with the engine type certificate holder to determine whether any of the requirements of § 25.933(a) can be met coincidentally with showing compliance to part 33 requirements.
4 Background.
AC 25.933-1 3.2 Advisory Circulars.
The following ACs are related to the guidance in this AC. Please refer to the latest version of each AC referenced in this document; they are available on the FAA website at FAA Advisory Circulars and on the Dynamic Regulatory System .
• AC 20-128A, Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure.
• AC 20-166A, Issue Paper Process .
• AC 25-7D, Flight Test Guide for Certification of Transport Category Airplanes .
• AC 25-11B, Electronic Flight Displays .
• AC 25-19A, Certification Maintenance Requirements.
• AC 25.901-1, Safety Assessment of Powerplant Installations .
• AC 25.1309-1B, System Design and Analysis .
• AC 25.1322-1, Flightcrew Alerting .
• AC 120-42B, Extended Operations (ETOPS and Polar Operations) .
3.3 Industry Documents.
Aerospace Industries Association (AIA) Report, Criteria for Assessing Transport Turbojet Fleet Thrust Reverser System Safety , Revision A, dated June 1, 1994 .
4 BACKGROUND.
4.1 General.
4.1.1 Most thrust reverser systems are intended for ground operation only. Consequently, applicants generally size and develop them to provide high deceleration forces while avoiding ingestion of foreign object debris, efflux impingement of airplane surfaces, and airplane handling difficulty during the landing roll. Likewise, airplane flight control systems are generally sized and developed to provide lateral and directional controllability margins adequate for handling qualities, maneuverability requirements, and engine-out V lateral drift conditions.
MC 4.1.2 In early turbojet airplane designs, the combination of control system design and thrust reverser characteristics resulted in control margins that allowed the airplane to be capable of recovering from unwanted in-flight thrust reversal even on ground-use-only reversers; this capability was required by the versions of § 25.933 established by amendments 25-40 and 25-72.
4.1.3 As the predominant configuration of large transport category airplanes has developed into a high-bypass-ratio twin-engine-powered model, control margins affording See 14 CFR 1.2. V means minimum control speed with the critical engine inoperative.
MC AC 25.933-1 recovery from an unwanted in-flight thrust reversal have decreased. Whenever and wherever thrust reversal is intended, the applicant should maintain focus on limiting any adverse effects of thrust reversal. However, when showing compliance with § 25.933(a)(1) or § 25.933(a)(2), the FAA accepts that applicants may either provide assurance that the airplane is capable of continued safe flight and landing during and after any in-flight thrust reversal event (the airplane is “controllable”), or that the unwanted in-flight thrust reversal event is not anticipated to occur (by showing compliance with § 25.1309(b) assuming the airplane is not capable of continued safe flight and landing during and after any thrust reversal in flight).
4.1.4 The FAA, in several amendments to § 25.933, has sought to limit either the effect or the likelihood of an unwanted thrust reversal during flight on thrust reversers. However, service experience has shown the need to further amend requirements for ground-use- only thrust reversers, since previous methods did not always result in robust designs, and it was not practical for applicants to directly comply with those methods for some designs. The current rule, and this related advisory material, are intended to allow applicants to provide assurance in a manner that recognizes there may be limitations in the airplane design, thereby maximizing both the design flexibility and safety provided by compliance with the rule.
4.2 Minimizing Adverse Effects.
4.2.1 The primary purpose of reversing systems, especially those intended for ground operation only, is to assist in decelerating the airplane during landing and during an aborted takeoff. To accomplish this safety objective, the reverser needs to be quick-acting and effective in producing sufficient reverse thrust. These parameters often result in design characteristics (actuator sizing, efflux characteristics, reverse thrust levels, and so forth) that, in the event of thrust reversal during flight, could cause significant adverse effects on airplane controllability and performance.
4.2.2 If the effect of the thrust reversal occurring in flight produces an unacceptable risk to continued safe flight and landing, then the applicant must design the reverser operation and deactivation system to prevent unwanted thrust reversal to comply with § 25.933(a)(1) or § 25.933(a)(2). Alternatively, for certain airplane configurations, it may be possible to limit the adverse impacts of unwanted thrust reversal on airplane controllability and performance such that the risk to continued safe flight and landing is acceptable (discussed later in this AC).
4.2.3 For turbojet reversing systems intended for operation in flight, per § 25.933(a)(2), the reverser system must be designed to adequately protect against unwanted in-flight thrust reversal.
4.2.4 Advisory circular 25.1309-1B and AC 25.901-1 provide guidance for developing and assessing the safety of installed systems at the design stage. This methodology may also be applied to the installed reverser system, which includes all of the following: • Reverser.
AC 25.933-1 • Engine (if it can contribute to thrust reversal).
• Reverser motive power source.
• Reverser control system.
• Reverser command system in the flightdeck.
• Wiring, cable, or linkage system between the flightdeck, the reverser control system, and the engine that is used for reverser control or if its failure can contribute to thrust reversal.
4.2.5 Accepted removal, deactivation, reinstallation, and repair procedures for any element in the reverser system installation should result in a safety level equivalent to the certified baseline system configuration.
4.2.6 Qualitative assessments conducted pursuant to aspects of this AC that include evaluating human actions, such as maintenance tasks or airplane operation, should be done taking into account potential human errors. (See AC 25.1309-1B for information on errors.)
4.2.7 Data necessary to determine the level of hazard to the airplane in case of in-flight thrust reversal, and conversely data necessary to define changes to the reverser or the airplane to eliminate the hazard, can be obtained from service experience, test, and/or analysis.
These data also can be used to define the envelope for continued safe flight.
4.2.8 There are many opportunities during the design of an airplane to minimize both the likelihood and severity of unwanted in-flight thrust reversal. These opportunities include design features both of the airplane and of the integrated engine and reverser system. During the design process, consideration should be given to the aircraft stability and control design features, while preserving the intended function of the reversing system.
4.2.9 Some design considerations, which may help reduce the risk from in-flight thrust reversal, include: 4.2.9.1 Engine location to— 4.2.9.1.1 Reduce sensitivity to efflux impingement.
4.2.9.1.2 Reduce effective reverse thrust moment arms.
4.2.9.2 Integrated engine and reverser system design to— 4.2.9.2.1 Optimize integrated engine and reverser system integrity and reliability.
4.2.9.2.2 Inhibit in-flight thrust reversal of ground-use-only reversers, even if commanded by the flightcrew.
AC 25.933-1 4.2.9.2.3 Rapidly reduce engine airflow (in other words, auto-idle) in the event of an unwanted thrust reversal. Generally, such a feature is considered a beneficial safety item. In this case, the probability and effect of any unwanted idle command or failure to provide adequate reverse thrust when selected should be verified to be consistent with § 25.901(c). Also, some reversers are designed so that, at higher power, airloads help prevent deployment. (See paragraph 4.2.9.2.11 of this AC.) Therefore, for such reversers, an auto-idle feature may not have a net benefit.
4.2.9.2.4 Give consideration to the airplane pitch, yaw, and roll characteristics.
4.2.9.2.5 Ensure an undamaged reverser will respond to any anticipated flightcrew command as required by § 25.1309(a). As specified in AC 25.1309-1B, this should include any anticipated crew actions in response to abnormal conditions. Failure of the reverser or the propeller pitch control to respond to pilot commands were contributing factors in various accidents, such as the Cranbrook Boeing Model 737 accident in 1978 and the Luxair Fokker Model F27 accident in 2002.
4.2.9.2.6 Consider effective efflux diameter.
4.2.9.2.7 Consider efflux area.
4.2.9.2.8 Direct reverser efflux away from critical areas of the airplane where the efflux could be hazardous to the airplane. The thrust reverser pattern associated with high airspeed and high engine power caused significant airflow disruption over the upper wing surface and resulted in loss of airplane control in the Lauda Boeing Model 767 accident in 1991.
4.2.9.2.9 Expedite system detection of unwanted thrust reversal and provide for rapid compensating action within the reversing system. Consider incorporating an auto-restow capability for unwanted thrust reversal.
However, care should be taken to assure the design features facilitating restow capability do not unacceptably contribute to an unwanted stow or deploy failure condition. For example, a latent failure of the directional control valve might reverse an auto-restow feature and result in an auto- deploy command.
4.2.9.2.10 Optimize the use of aerodynamic forces to keep an unrestrained reverser from deploying.
See the FAA Lessons Learned from the Civil Aviation Accidents webpage, Cranbrook Boeing Model 737 Accident 1978 .
See the FAA Lessons Learned from the Civil Aviation Accidents webpage, Luxair Fokker Model F27 Accident 2002 .
See the FAA Lessons Learned from the Civil Aviation Accidents webpage, Lauda Boeing 767-300ER Accident 1991 AC 25.933-1 4.2.9.2.11 Optimize the use of aerodynamic forces to overpower the reverser actuation system preventing a powered deployment under operating conditions where use of reverse thrust is prohibited. Areas to consider might be airspeeds well above maximum V , or engine power levels above those where deployment is necessary to affect acceptable rejected takeoff (RTO) performance.
4.2.9.3 Airframe/system design to— 4.2.9.3.1 Maximize aerodynamic control capability.
4.2.9.3.2 Expedite detection of thrust reversal and provide for rapid compensating action through other airframe systems.
4.2.9.3.3 Consider crew procedures and foreseeable responses.
4.2.9.3.4 Minimize the potential for flight and maintenance crew error.
4.2.10 Any acceptable means of showing compliance with § 25.933(a) should ensure that the influences that could render the finding invalid are identified, and that acceptable means for managing these influences are defined. To this end, adequate design assurance and continued airworthiness features should be provided, including means to monitor and report in-service experience relative to thrust reverser system safety and effectively respond to any conditions that may substantially invalidate the finding.
4.2.11 The use of systematic “lessons learned” reviews early and often during design development that document how the design accounts for previous service experience may help avoid repeating errors and take advantage of previous successes. For some “lessons learned,” see FAA Memorandum, Criteria for Assessing Transport Turbojet Fleet Thrust Reverser System Safety , dated June 1, 1994, and the FAA Lessons Learned From Transport Airplane Accidents website.
4.3 Coordination With Engine Manufacturer.
4.3.1 The applicant should coordinate with the engine manufacturer to identify any aspects of the thrust reverser design that the engine manufacturer is addressing. This may include aspects that will be included and certified under the part 33 type design. Since it is permissible for the thrust reverser to be certified under part 33 requirements, the applicant may want to coordinate with the engine manufacturer to identify how any of the requirements in § 25.933(a) could be met with the part 33 compliance showing. This may include information on areas such as structural integrity, system reliability, fault See 14 CFR 1.2. Maximum V means the maximum speed in the takeoff at which the pilot must take the first action (e.g., apply brakes, reduce thrust, deploy speed brakes) to stop the airplane within the accelerate-stop distance.
See the FAA Memorandum, Criteria for Assessing Transport Turbojet Fleet Thrust Reverser System Safety, June 1, 1994 on the internet at FAA Files .
See footnote 3.
5 Definitions.
6 Demonstrating Compliance with § 25.933(a)(1).
7 Controllability Option.
AC 25.933-1 tolerance, maintenance, and operational assumptions. As such, when planning to certify a thrust reverser or any of thrust reverser system components at the part 33 level, the applicant may wish to coordinate with the engine manufacturer when applying AC 25.933-1 guidance for those aspects of the thrust reverser the engine manufacturer is addressing.
5 DEFINITIONS.
See appendix A for terms and definitions that apply to this AC.
6 DEMONSTRATING COMPLIANCE WITH § 25.933(a)(1).
Sections 7 through 10 of this AC provide guidance on specific aspects of complying with § 25.933(a)(1), according to four different means or methods: • Controllability. (See section 7 .)
• Reliability. (See section 8 .)
• Mixed controllability/reliability. (See section 9 .)
• Deactivated reverser. (See section 10 .)
7 CONTROLLABILITY OPTION.
The “controllability option” provides assurance that the airplane is capable of continued safe flight and landing during and after any in-flight thrust reversal event, which is considered “unwanted” for a ground-use-only thrust reverser. The following paragraphs provide guidance regarding an acceptable means of showing compliance with § 25.933(a)(1)(i).
7.1 General.
7.1.1 To show compliance with § 25.933(a)(1) by demonstrating that the airplane is capable of continued safe flight and landing following any unwanted in-flight thrust reversal (the “controllability option” provided by § 25.933(a)(1)(i)), an applicant should account for structural integrity, performance, and handling qualities as described in this AC.
7.1.2 To identify the corresponding failure conditions and determine the probability of their occurrence, a safety analysis should be carried out using the methodology described in AC 25.1309-1B. The reliability of design features, such as auto-idle and automatic control configurations critical to meeting the following controllability criteria, also should be considered in the safety analysis.
7.1.3 Appropriate alerts and/or other indications of the thrust reverser system and failure conditions should be provided to the crew, as required by regulations such as §§ 25.1141(f), 25.1305(d)(2), 25.1309(c), and 25.1322. (See ACs 25-11B, 25.1309-1B, and 25.1322-1.)
AC 25.933-1 7.1.4 The inhibition of alerts relating to the thrust reverser system during critical phases of flight should be evaluated in relation to the total effect on flight safety. (See AC 25.1309-1B.)
7.1.5 Thrust reversal of a cyclic or erratic nature (for example, repeated deploy/stow movement of the thrust reverser) should be considered in the safety analysis and in the design of the alerting/indication systems.
7.1.6 Input from the flightcrew and human factors specialists should be considered in the design of the alerting and/or indication provisions.
7.1.7 The controllability compliance analysis should include the relevant thrust reversal scenario that could be induced by zonal threats such as uncontained engine rotor failure, fan blade failure, case burn through, or other fire threats. These are examples of failure conditions that may not be catastrophic on their own but may result in an unwanted thrust reversal.
7.1.8 If showing compliance using this “controllability option,” and if the airplane might experience an in-flight thrust reversal outside the “controllable flight envelope” anytime during the entire operational life of all airplanes of this type, then the applicant should follow the mixed controllability and reliability option in section 9 of this AC.
7.2 Structural Integrity.
7.2.1 For the “controllability option” provided by § 25.933(a)(1)(i), the airplane must be capable of successfully completing a flight during which an unwanted in-flight thrust reversal occurs. An assessment of the integrity of the airplane structure is necessary, including an assessment of the structure of the deployed thrust reverser and its attachments to the airplane.
7.2.2 In conducting this assessment, the normal structural loads, as well as those induced by failures and forced vibration (including buffeting, refer to § 25.251), both at the time of the event and for continuation of the flight, must be shown to be within the structural capability of the airplane.
7.2.3 If the thrust reverser system is capable of being restowed following a thrust reversal, only those loads associated with the interval of thrust reversal need to be considered.
Historically, thrust reversers have often been damaged as a result of unwanted thrust reversal during flight. Consequently, any claim that the thrust reverser is capable of being restowed must be adequately substantiated, taking into account possible thrust reverser damage experienced during the unwanted thrust reversal.
7.3 Performance.
7.3.1 General Considerations.
Most failure conditions that have an effect on performance are adequately accounted for by the requirements addressing a “regular” engine failure (in other words, involving only loss of thrust and not experiencing any reverser anomaly). This is unlikely to be AC 25.933-1 the case for failures involving an unwanted in-flight thrust reversal, which can be expected to have a more adverse impact on thrust and drag than a regular engine failure.
Therefore, the appropriate probability of occurrence should be taken into account for unwanted in-flight thrust reversals. The applicant should account for performance as defined under paragraphs 7.3.2 and 7.3.3 of this AC as a function of the probability of the unwanted in-flight thrust reversal. For unwanted in-flight thrust reversals less -9 probable than 1 x 10 per flight hour, certification may be based on reliability alone, as described in section 8 of this AC.
-7 7.3.2 Probability of Unwanted In-Flight Thrust Reversal Greater than 1 x 10 per Flight Hour.
7.3.2.1 To show compliance with the “controllability option” provided by § 25.933(a)(1)(i), the applicant should account for performance based on the more critical of a traditional one-engine-inoperative (OEI) condition and an unwanted in-flight thrust reversal. To determine if the unwanted in-flight thrust reversal is more critical than an OEI, the traditional application of the performance requirements described in part 25, subpart B, as well as the applicable operating requirements, should be compared to the application of the criteria in paragraphs 7.3.2.1.1 through 7.3.2.1.3 below , which replace the airplane performance requirements that account for a critical engine inoperative with that of a critical unwanted in-flight thrust reversal: 7.3.2.1.1 Section 25.111, Takeoff Path.
The takeoff path should be determined with the critical unwanted thrust reversal occurring at V instead of the traditional critical engine LOF shutdown at V . No change to the state of the engine with the thrust EF reversal that requires action by the pilot may be made until the airplane is 400 feet above the takeoff surface.
7.3.2.1.2 Section 25.121, Climb: One-Engine-Inoperative.
Compliance with the climb gradients should be shown with the critical unwanted in-flight thrust reversal, rather than the critical engine inoperative.
7.3.2.1.3 Section 25.123, En Route Flight Paths.
The en route flight paths should be determined following occurrence of the critical unwanted in-flight thrust reversal(s) instead of the critical engine shutdown(s) and allowing for the execution of appropriate crew procedures validated in accordance with applicable human factors regulations such as §§ 25.1302, 25.1322, and so forth. For compliance See 14 CFR 1.2. V means lift-off speed and V means the speed at which the critical engine is assumed to LOF EF fail during takeoff.
This value is the minimum altitude at which flightcrews initiate configuration changes other than landing gear retraction. See AC 25-7D.
AC 25.933-1 with the applicable operating rules, an unwanted in-flight thrust reversal(s) at the most critical point en route should be substituted for the engine inoperative at the most critical point en route.
7.3.2.2 Performance data determined under the provisions of paragraphs 7.3.2.1.1 through 7.3.2.1.3 above , where critical, should be specified in the airplane flight manual as operating limitations.
7.3.2.3 The impact to airplane performance should be accounted for as a result of a critical unwanted in-flight thrust reversal at the most critical point in the route from the standpoint of the pertinent aspect under evaluation.
Operational data and advisory data related to fuel consumption, range, speeds, and any other pertinent performance impacts should be provided for the critical unwanted in-flight thrust reversal to assist the crew in decision making. The fuel consumption and range data may be supplied as simple factors or additives to apply to normal all-engines-operating fuel consumption and range data. For approvals to conduct extended operations, the critical unwanted in-flight thrust reversal should be considered when assessing compliance with § 25.1535 and applicable provisions of 14 CFR appendix K to part 25, as well as the critical fuel scenario (see AC 120-42B) associated with the applicable equal-time point (§ 121.646).
7.3.2.4 In addition to accounting for performance using the most critical of an OEI and an unwanted in-flight thrust reversal as it relates to the specific airplane performance requirements of subpart B, all other aspects of the airplane’s performance following a non-restowable in-flight thrust reversal (for example, capability to climb and maintain 1,000 feet above ground level (AGL)) should be shown to comply with the applicable subpart B requirements to comply with § 25.933(a)(1)(i).
-7 7.3.3 Probability of Unwanted In-Flight Thrust Reversal Equal to or Less than 1 x 10 per -9 Flight Hour, But Greater than 1 x 10 per Fight Hour.
7.3.3.1 The same criteria under paragraph 7.3.2 of this AC should be applied for the purposes of providing advisory data and procedures to the flightcrew, with the exception of the takeoff phase of flight, which does not need to account for unwanted in-flight thrust reversal unless the reversal is the result of a single failure. Such performance data, however, does not need to be applied as operating limitations. The takeoff data addressed by paragraph 7.3.2 (takeoff speeds, if limited by V , takeoff path, and MC takeoff climb gradients) does not need to be provided, as it would be of only limited value if not applied as a dispatch limitation. However, if the unwanted in-flight thrust reversal during the takeoff phase is the result of a This value represents the minimum safe altitude defined in 14 CFR 91.119(b).
AC 25.933-1 single failure, the takeoff data should be determined and applied as operating limitations.
7.3.3.2 As part of this assessment, the effect of an unwanted in-flight thrust reversal on approach climb performance (§ 25.121(d)), and the ability to execute a go-around maneuver, should be determined and used to specify crew procedures for an approach and landing following a thrust reversal.
For example, the procedures may specify the use of a flap setting less than that specified for landing, or an airspeed greater than the stabilized final approach airspeed, until the flightcrew is satisfied that a landing is assured, and a go-around capability no longer needs to be maintained.
Credit for the execution of such procedures, as well as consideration of alternative flightcrew behaviors, should be assessed in accordance with applicable human factors regulations. Where a number of thrust reversal states may occur, these procedures for approach and landing may be determined, at the option of the applicant, either for the critical thrust reversal state or for each thrust reversal state that is clearly distinguishable by the flightcrew.
7.3.3.3 Operational data and advice related to fuel consumption, range, speeds, and any other pertinent performance impacts should be provided for the critical unwanted in-flight thrust reversal to assist the crew in decision making. Fuel exhaustion risk should be addressed. The fuel consumption and range data may be supplied as simple factors or additives to apply to normal all-engines-operating fuel consumption and range data.
7.3.3.4 The airplane performance capabilities following a non-restowable in-flight thrust reversal should be shown such that the airplane is capable of continued safe flight and landing at a suitable airport (in other words, either destination or diversion). If the airplane cannot climb and maintain at least 1,000 feet AGL, this is considered preventing continued safe flight.
7.4 Handling Qualities.
-7 7.4.1 Probability of Unwanted In-Flight Thrust Reversal Greater than 1 x 10 per Flight Hour.
7.4.1.1 To show compliance with the controllability and trim requirements of part 25, subpart B when using the method in this section 7 , an applicant should use the more critical of an engine failure (i.e., flight with one engine inoperative) and an unwanted in-flight thrust reversal. In addition, the criteria defined under paragraph 7.4.2 of this AC also should be applied. To determine if the unwanted in-flight thrust reversal is more critical than an engine inoperative, the traditional application of the The minimum safe altitude defined in § 91.119(b) AC 25.933-1 controllability and trim requirements should be compared to the application of the criteria requirements in paragraphs 7.4.1.1.1 through 7.4.1.1.4 below . These criteria replace accounting for a critical engine failure with that of a critical unwanted in-flight thrust reversal.
7.4.1.1.1 Section 25.143, Controllability and Maneuverability—General.
The effect of a sudden unwanted in-flight thrust reversal of the critical engine, rather than the sudden shutdown of the critical engine, should be evaluated in accordance with § 25.143(b)(1) and the associated guidance material. Control forces associated with the failure should comply with § 25.143(d).
7.4.1.1.2 Section 25.147, Directional and Lateral Control.
The requirements of § 25.147(a) through (d) should be complied with following critical unwanted in-flight thrust reversal(s), rather than with one or more engines inoperative.
7.4.1.1.3 Section 25.149, Minimum Control Speed.
The values of V and V should be determined with a sudden MC MCL unwanted in-flight thrust reversal of the critical engine, rather than with a sudden shutdown of the critical engine.
7.4.1.1.4 Section 25.161, Trim.
The trim requirements of § 25.161(d) and (e) should be complied with following critical unwanted in-flight thrust reversal(s), rather than with one or more engines inoperative.
7.4.1.2 Compliance with the requirements in paragraphs 7.4.1.1.1 through 7.4.1.1.4 above should be shown by flight test. Simulation or analysis will not normally be an acceptable means of compliance for such probable failures.
-7 7.4.2 Probability of Unwanted Thrust Reversal Equal to or Less than 1 x 10 per Flight Hour, -9 But Greater than 1 x 10 per Flight Hour.
-7 7.4.2.1 Failure conditions with a probability equal to or less than 1 x 10 per flight hour are not normally evaluated against the specific controllability and trim requirements of part 25, subpart B. Instead, the effects of unwanted in-flight thrust reversal should be evaluated on the basis of maintaining the capability for continued safe flight and landing, taking into account pilot recognition and reaction time. One exception is that the minimum control speed requirement of § 25.149 should be evaluated to See 14 CFR 25.149(f). V , the minimum control speed during approach and landing with all engines MCL operating, is the calibrated airspeed at which, when the critical engine is suddenly made inoperative, it is possible to maintain control of the airplane with that engine still inoperative and maintain straight flight with an angle of bank of not more than 5 degrees.
AC 25.933-1 the extent necessary to support the performance criteria specified in paragraph 7.3.3 of this AC related to approach, landing, and go-around.
7.4.2.2 Recognition of the failure may be through the behavior of the airplane or an appropriate failure alerting system, and the recognition time should not be less than one second. It should be noted that § 25.1305(d)(2)(i) requires an indication when a thrust reversing device is not in the selected position; however, service experience shows that this indication may not be sufficient as the primary means of recognition for the crew in the event of an unwanted in-flight reversal. Following recognition, additional pilot reaction times should be taken into account, before any corrective pilot actions, as follows: 7.4.2.2.1 Landing—no additional delay.
7.4.2.2.2 Approach—one second.
7.4.2.2.3 Climb, cruise, and descent—three seconds; except when in auto-pilot engaged maneuvering flight, or in manual flight, when one second should apply.
7.4.2.3 Both auto-pilot engaged and manual flight should be considered.
7.4.2.4 The unwanted in-flight thrust reversal should not result in any of the following: 7.4.2.4.1 Exceedance of an airspeed halfway between V and V , or Mach MO DF number halfway between M and M .
MO DF 7.4.2.4.2 A stall.
7.4.2.4.3 A normal acceleration less than a value of 0g.
7.4.2.4.4 Bank angles of more than 60° en route, or more than 30° below a height of 1,000 feet AGL.
7.4.2.4.5 Degradation of flying qualities assessed as greater than major for -7 unwanted in-flight thrust reversal more probable than 1 x 10 per flight hour; or assessed as greater than hazardous for failures with a probability See AC 25-7D for further discussions on pilot reaction times. One second represents the lowest value of pilot reaction time if the pilot is not using autoflight (i.e., pilot is “in the loop”). Three seconds is used when the pilot is using autoflight (i.e., pilot is “out of the loop”).
This is derived from the definition of V /M (§ 25.253(b), Maximum speed for stability characteristics) and FC FC used throughout 14 CFR subpart B. As defined in 14 CFR 1.2, V / M means demonstrated flight diving speed DF DF and V / M means maximum operating limit speed.
MO MO These values come from the Aviation Rulemaking Advisory Committee (ARAC) Powerplant Installation Harmonization Working Group (PPIHWG) recommendation report to Task 4–Thrust Reversing Systems , available on the internet at FAA ARAC Recommendation Report .
8 Reliability Option: Provide Continued Safe Flight and Landing by Preventing any Unwanted In-flight Thrust Reversal.
AC 25.933-1 -7 -9 equal to or less than 1 x 10 per flight hour, but greater 1 x 10 per flight hour.
7.4.2.4.6 Roll control forces exceeding those specified in § 25.143(d), except that the long-term roll control force should not exceed 10 pounds.
7.4.2.4.7 Structural loads in excess of those specified under paragraph 7.2 of this AC.
7.4.2.5 Demonstrations of compliance may be by flight test, simulation, or analysis suitably validated by flight test or other data.
-9 7.4.3 Probability of Unwanted In-Flight Thrust Reversal Less than 1 x 10 per Flight Hour.
Certification can be based on reliability alone as described in section 8 of this AC.
7.5 Flightcrew Training.
For compliance with the “controllability option,” when the expected consequences on the airplane due to in-flight thrust reversal are judged to be unusual compared to those for other failures, both basic and recurrent training in a flight simulator equipped with thrust reverser in-flight modeling should be considered to help assure flightcrew understanding of the following: 7.5.1 Transient Maneuver.
Recovery from the in-flight thrust reversal.
7.5.2 Continued Flight and Landing.
Maneuvering appropriate to the recommended procedure (including trim and unattended operation) and precision tracking (instrument landing system (ILS) guide slope tracking, speed/altitude tracking, and so forth).
8 RELIABILITY OPTION: PROVIDE CONTINUED SAFE FLIGHT AND LANDING BY PREVENTING ANY UNWANTED IN-FLIGHT THRUST REVERSAL.
The following paragraphs provide guidance regarding an acceptable means of showing compliance with § 25.933(a)(1)(ii).
8.1 General.
For compliance to be established with § 25.933(a)(1) by showing that unwanted in-flight thrust reversal is not anticipated to occur (the “reliability option” provided for under § 25.933(a)(1)(ii)), the following must be taken into account if the applicant chooses to use the method provided by this section 8 : This value comes from the ARAC PPIHWG recommendation report for Task 4. See footnote 11. It represents relief from the value of 5 pounds required by § 25.143(d).
AC 25.933-1 8.1.1 Aspects of system reliability, maintainability, and fault tolerance.
8.1.2 Structural integrity.
8.1.3 Protection against zonal threats such as uncontained engine rotor failure, fan blade failure, case burn through, and other fire threats.
8.2 System Safety Assessment (SSA).
8.2.1 Any showing of compliance should include an assessment of the thrust reverser control, indication and actuation system(s), including all interfacing powerplant and airplane systems (such as electrical supply, hydraulic supply, flight/ground status signals, thrust lever position signals, and so forth), and maintenance. Refer to AC 25.1309-1B for more information on the methodology for safety analysis.
8.2.2 The reliability assessment should include: 8.2.2.1 All possible modes of normal operation and of failure. Possible modes of failure include full and partial reverse thrust conditions. Examples of partial reverse thrust conditions include, but are not limited to, asymmetric reverser deployment and arrested deployment (mechanically or electrically).
8.2.2.2 The resulting effect on the airplane considering the phase of flight and operating conditions.
8.2.2.3 The crew awareness of the failure conditions and the corrective action required.
8.2.2.4 Failure detection capabilities and maintenance procedures.
8.2.2.5 The likelihood of the failure condition.
8.2.3 Consideration should be given to failure conditions accompanied or caused by external events or errors.
8.2.4 The SSA should be used to identify critical failure paths for the purpose of conducting in-depth validation of their supporting failure modes, failure rates, exposure times, reliance on redundant subsystems, and assumptions, if any. In addition, the SSA can be used to determine acceptable time intervals for any required maintenance intervals per AC 25.1309-1B and AC 25-19A.
8.2.5 The primary intent of the reliability compliance option is to improve safety by promoting more reliable designs and better maintenance, including minimizing pre-existing faults, whether latent or detected and allowed to persist. However, it also recognizes that flexibility of design and maintenance are necessary for practical application.
AC 25.933-1 8.2.6 The thrust reverser system should be designed so that any in-flight thrust reversal that is not shown to be “controllable” in accordance with section 7 of this AC is extremely improbable and does not result from a single failure or malfunction (in other words, complies with § 25.1309(b)(1)).
8.2.7 Section 25.1309(b)(4) requires all practical action be taken to eliminate any significant latent failure that could contribute to an in-flight deployment not meeting § 25.933(a)(1). Where the FAA finds it is impractical to eliminate a given significant latent failure (SLF), the applicant must minimize the time the failure is expected to be present. The elimination and minimization requirement of § 25.1309(b)(4 ) does not apply to SLFs where the system failure condition meets the safety objectives of § 25.1309(b)(1) or (b)(2) with the assumption that the latent failure has occurred.
8.2.7.1 It has usually been deemed practical to limit the exposure to the presence of a latent failure that contributes to the risk of a catastrophic in-flight thrust reversal such that the product of that exposure and the frequency of -3 occurrence of the failure is 1 x 10 or less. This criterion was recommended by the Aviation Rulemaking Advisory Committee.
8.2.7.2 The exposure prediction should take into account the expected delays in detection, isolation, and repair. Any failure that does not meet this criterion should be highlighted and justified to the certifying authority as early as possible in the certification program.
8.2.8 Section 25.1309(b)(5) requires all practical actions be taken to avoid any catastrophic failure condition resulting from two failures, either of which could be latent for more than one flight. Modern thrust reverser designs have shown that it is practical to avoid catastrophic in-flight reversal due to such “latent plus one” failure conditions.
Therefore, for any new proposed designs where combinations of two-failures result in catastrophic in-flight thrust reversal, neither failure may be pre-existing (in other words, neither failure can be undetected nor allowed to exist for more than one flight). The means of failure detection must be appropriate in consideration of the monitoring device reliability, inspection intervals, and procedures.
8.2.9 As an alternative to meeting the criteria in paragraphs 8.2.7 and 8.2.8 of this AC to show compliance with § 25.1309(b)(4) and (b)(5), the FAA has made compliance findings based upon an applicant’s demonstrations that, in any anticipated dispatch configuration, the airplane will continue to meet the criteria that “no single failure” is catastrophic, and for specific combinations of pre-existing faults that the risk of -6 catastrophic in-flight deployment is less than 1 x 10 per flight hour. This analysis is only required if the design can have contributory pre-existing faults present, whether latent or detected and allowed to persist for more than one flight. This analysis must consider any airplane configuration (including latent faults) anticipated to occur in the fleet life of the airplane type. For the purpose of this analysis, a configuration at See ARAC PPIHWG recommendation report to Task 4–Thrust Reversing Systems , available on the internet at FAA ARAC Recommendation Report .
AC 25.933-1 -7 dispatch whose probability of occurrence is greater than 1 x 10 per flight hour must be expected to occur.
8.2.10 Section 25.1309(c) requires that information concerning unsafe system operating conditions be provided to the flightcrew to enable them to take appropriate corrective action in a timely manner, thereby mitigating the effects of the failure condition to an acceptable level. See AC 25.1309-1B and AC 25.1322-1 for additional guidance.
8.2.10.1 Any failure condition that leaves an airplane one failure away from a catastrophic in-flight thrust reversal is normally considered to be an unsafe system operating condition and should result in appropriate flightcrew alerting, in accordance with § 25.1322, or be self-evident to the crew.
8.2.10.2 In addition to crew awareness, any other flightdeck indications, procedures, and/or training required to enable the crew to take necessary actions, such as discontinuing a takeoff, going to a controllable flight envelope en route, diverting to a suitable airport, or reconfiguring the system in order to recover single failure tolerance, and so forth, should also be provided.
8.3 Structural Aspects.
For this “reliability option,” those structural load paths that affect thrust reversal should be shown to comply with the static strength, fatigue, damage tolerance, and deformation requirements of part 25. Further, there should be no single load path in which failure would result in a catastrophic thrust reversal. Taken together this will ensure that unwanted in-flight thrust reversal is not anticipated to occur due to failure of a structural load path, or due to loss of retention under ultimate load throughout the operational life of the airplane.
8.4 Uncontained Rotor Failure.
In case of rotor failure, compliance with § 25.903(d)(1) must be shown in addition to § 25.933(a)(1). Applicants should use advisory materials (e.g., AC 20-128A, its User’s Manual in Appendix 1, and so forth) supplemented by the methods described below.
The FAA considers it practical for applicants to show the airplane design has features to prevent a catastrophic in-flight thrust reversal due to an uncontained engine rotor failure. The effects of associated loads and vibration on the reverser system should be considered in all of the following methods of minimizing hazards: 8.4.1 Show that engine spool-down characteristics or potential reverser damage is such that compliance can be shown by means of the controllability option in section 7 of this AC.
8.4.2 Show that forces that keep the thrust reverser in a stable, stowed position during and after the rotor burst event are adequate.
8.4.3 Locate the thrust reverser system outside the rotor burst zone.
8.4.4 Protection of thrust reverser restraint devices. See paragraph 8.5 below for guidance.
AC 25.933-1 8.5 Protection of Thrust Reverser Restraint Devices.
The following guidance material describes methods of minimizing the hazard to restraint devices for thrust reverser stow position, located within rotorburst zones. The following guidance material has been developed on the basis of all of the data available to date and engineering judgment.
8.5.1 Fragment Hazard Model.
8.5.1.1 Large Fragments.
8.5.1.1.1 Ring Disks.
See figure 1 . Compressor drum rotors or spools with ring disks have typically failed in a rim peeling mode when failure origins are in the rim area. This type of failure typically produces uncontained fragment energies that are mitigated by a single layer of conventional aluminum honeycomb structure. It should be noted that this guidance material is based upon field experience and, as such, its application should be limited to aluminum sheet and honeycomb fan reverser construction. Typical construction consists of one-half inch thickness of 0.003 to 0.004 aluminum foil honeycomb with 0.030-inch thick aluminum facing sheets. Alternative materials and methods of construction should have at least equivalent impact energy absorption characteristics. Failures with the origins in the bore of these same drum sections have resulted in fragments that can be characterized as a single 1/3 disk fragment and multiple smaller fragments. The 1/3 disk fragment may or may not be contained by the thrust reverser structure. The remaining intermediate and small disk fragments, while escaping the engine case, have been contained by the thrust reverser structure.
Figure 1. Cross-Section of Ring Disk Drum Rotor See footnote 11.
AC 25.933-1 8.5.1.1.2 Deep Bore Disks and Single Disks.
For compressor drum rotors or spools with deep bore disks ( Figure 2 ), and single compressor and turbine disks ( Figure 3 ), the experience, while limited, indicates either a 1/3 and a 2/3 fragment, or a 1/3 fragment and multiple intermediate and small discrete fragments should be considered.
These fragments can be randomly released within an impact area that ranges ± 5° from the plane of rotation.
Figure 2. Cross-Section of Deep Bore Disk Drum Figure 3. Cross-Section of Single-Stage Deep Bore Disk 8.5.1.2 Small Fragments (Debris).
Consider small fragments (see paragraph 9d of AC 20-128A) that could impact the thrust reverser at ± 15° axial spread angle.
AC 25.933-1 8.5.2 Minimization.
Minimization guidance provided below is for fragments from axial flow rotors surrounded by fan flow thrust reversers located over the intermediate or high-pressure core rotors f (Figure 4 ).
Figure 4. Cross-Section of Typical High-Bypass Turbofan Low and High Compressor with Fan Thrust Reverser 8.5.2.1 Large Fragments.
For the large fragments defined under paragraph 8.5.1.1 of this AC, the thrust reverser retention systems should be redundant and separated as follows: 8.5.2.1.1 Ring Disks Compressor Spools.
Retention systems located in the outer barrel section of the thrust reverser should be separated circumferentially (circumferential distance greater than the 1/3 disk fragment model as described in AC 20-128A) or axially (outside the ± 5° impact area) so that a 1/3 disk segment cannot damage multiple redundant retention elements and allow thrust reversal (in other words, deployment of a door or translating reverser sleeve half). Retention systems located between the inner fan flow path wall and the engine casing should be located axially outside the ± 5° impact area.
8.5.2.1.2 Deep-Bore Disk Spools and Single Disks.
Retention systems should be separated axially with at least one effective retention element located outside the ± 5° impact area.
9 Mixed Controllability/Reliability Option.
10 Deactivated Reverser.
11 Demonstrating Compliance with § 25.933(a)(2).
AC 25.933-1 8.5.2.2 Small Fragments.
For the small fragments defined under paragraph 8.5.1.2 of this AC, thrust reverser retention systems should be provided with either— 8.5.2.2.1 At least one retention element shielded in accordance with paragraph 7(c) of AC 20-128A or capable of maintaining its retention capabilities after impact, or 8.5.2.2.2 One retention element located outside the ± 15° impact area.
9 MIXED CONTROLLABILITY/RELIABILITY OPTION.
If the proposed airplane design might experience an unwanted in-flight thrust reversal outside the “controllable flight envelope” anytime during the entire operational life of all airplanes of this type, then the applicant must show reliability compliance outside the controllable envelope, and should take into account associated risk exposure time and the other considerations described in section 8 of this AC. Conversely, if reliability compliance is selected to be shown within a given limited flight envelope with associated risk exposure time, then outside this envelope controllability must be shown taking into account the considerations described in section 7 of this AC. Mixed controllability and reliability compliance may be shown in accordance with guidance developed under sections 7 and 8 of this AC, respectively.
10 DEACTIVATED REVERSER.
The thrust reverser system deactivation design should follow the same “fail-safe” principles as the actuation system design. The applicant should evaluate the design following the guidance in paragraph 8.1 to show that an unwanted in flight thrust reversal is not anticipated to occur on a deactivated thrust reverser system. The effects of thrust reverser system deactivation on other airplane systems, and on the new configuration of the thrust reverser system itself, should be evaluated according to paragraph 8.2 of this AC. The location and load capability of the mechanical lock-out system (thrust reverser structure and lock-out device) should be evaluated according to paragraphs 8.3 and 8.4 of this AC. The evaluation should show that the level of safety associated with the deactivated thrust reverser system is equivalent to or better than that associated with the active system.
11 DEMONSTRATING COMPLIANCE WITH § 25.933(a)(2).
For thrust reversing systems intended for in-flight use, compliance with § 25.933(a)(2) must be shown for unwanted in-flight thrust reversal, as appropriate, and applicants may use the methods specified in sections 7 through 10 of this AC. While the guidance in section 7 is clearly relevant to § 25.933(a)(2), it is unlikely to be sufficient for showing compliance with § 25.933(a)(2) as it relates to intended use of reverse thrust in flight.
Given the rarity and novelty of such designs, development of an acceptable means of compliance for intended use should be done on a case-by-case basis. (See AC 20-166.)
AC 25.933-1 Appendix A Appendix A. Definitions The following definitions apply for the purpose of this AC. Also, see referenced ACs for other relevant definitions.
A.1 ANALYSIS.
See AC 25.1309-1B.
A.2 ASSESSMENT.
See AC 25.1309-1B.
A.3 CONTINUED SAFE FLIGHT AND LANDING.
The capability for continued controlled flight and safe landing at an airport, possibly using emergency procedures, but without requiring exceptional pilot skill or strength or causing serious injury. Some airplane damage may be associated with a failure condition, during flight or upon landing.
A.4 CONTROLLABLE FLIGHT ENVELOPE AND PROCEDURE.
An area of the normal flight envelope where, given a procedure defined by the applicant and accepted by the FAA as appropriate for the condition, the airplane is capable of continued safe flight and landing following an in-flight thrust reversal.
A.5 DEACTIVATED REVERSER.
Any reversing system that has been deliberately inhibited prior to flight such that it is precluded from performing a normal deploy/stow cycle, even if commanded to do so.
The deactivation procedure is sometimes referred to as a “lock-out” procedure.
A.6 EXCEPTIONAL PILOTING SKILL OR STRENGTH.
Skill or strength capabilities that exceed that of the anticipated pilot population. See § 25.143 and AC 25-7D.
A.7 IN-FLIGHT.
That part of airplane operation beginning when the airplane is no longer in contact with the ground during takeoff and ending when the airplane again contacts the ground during landing.
A.8 LIGHT CROSSWIND.
A-1 AC 25.933-1 Appendix A An up-to 10-knot wind at right angles to the direction of takeoff or landing, which is assumed to occur on every flight. See AC 25-7D.
A.9 LIGHT TURBULENCE.
Turbulence that momentarily causes slight, erratic changes in altitude and/or attitude (pitch, roll, and/or yaw), which is assumed to occur on every flight. See AC 25-7D.
A.10 NORMAL FLIGHT ENVELOPE.
An established boundary of parameters (velocity, altitude, angle of attack, attitude) associated with the practical and routine operation of a specific airplane that is likely to be encountered on a typical flight and in combination with prescribed conditions of light turbulence and light crosswind.
A.11 QUALITATIVE ANALYTICAL PROCESS.
See AC 25.1309-1B.
A.12 QUANTITATIVE ANALYSTICAL PROCESS.
See AC 25.1309-1B.
A.13 SYSTEM.
See AC 25.1309-1B.
A.14 THRUST REVERSAL.
A physical spoiling or redirection of all or part of engine airflow from the forward thrust position.
A.15 THRUST REVERSER SYSTEM.
Those components installed on the airplane that spoil or redirect the engine airflow to decelerate the airplane. The components include all of the following: • Engine-mounted hardware.
• Reverser control system.
• Indication and actuation systems.
• Any other airplane systems that have an effect on operation of the thrust reverser system.
A-2 AC 25.933-1 Appendix A A.16 TURBOJET THRUST REVERSING SYSTEM.
Any device that redirects the airflow from a turbojet engine so as to create reverse thrust. Systems may include any of the following: • Cascade-type reversers.
• Target or clamshell-type reversers.
• Pivoted-door petal-type reversers.
• Deflectors articulated off either the engine cowling or airplane structure.
• Targetable thrust nozzles.
• A propulsive fan stage with reversing pitch.
A-3 AC 25.933-1 Appendix B Appendix B. Best Practices This appendix provides the Aviation Rulemaking Advisory Committee (ARAC) Powerplant Installation Harmonization Working Group (PPIHWG) recommendations that the FAA considers best practices. Similar information is included in European Union Aviation Safety Agency (EASA) Acceptable Means of Compliance (AMC) 25.933. Thrust reverser system designers and airplane operators may consider these best practices when they design the system or establish the maintenance process for the system.
B.1 MANUFACTURING/QUALITY.
Due to the criticality of the thrust reverser, manufacturing and quality assurance processes should be assessed and implemented, as appropriate, to ensure the design integrity of the critical components.
B.2 RELIABILITY MONITORING.
An appropriate system should be implemented for the purpose of periodic monitoring and reporting of in-service reliability performance. The system should also include reporting of in-service concerns related to design, quality, or maintenance that have the potential of affecting the reliability of the thrust reverser.
B.3 MAINTENANCE AND ALTERATIONS.
The following material provides guidance for maintenance designs and activity to assist in showing compliance with sections 7 through 10 of this AC. (Also see §§ 25.901(b)(2) and 25.1529 (appendix H)). The criticality of the thrust reverser system requires that maintenance and maintainability be emphasized in the design process and development of the maintenance control program, as well as subsequent field maintenance, repairs, or alterations.
B.3.1 Design.
Design aspects for providing adequate maintainability should address the following: B.3.1.1 Ease of Maintenance.
The following items should be considered: B.3.1.1.1 It should be possible to operate the thrust reverser for ground testing/troubleshooting without the engine operating.
B.3.1.1.2 Lock-out procedures (deactivation for flight) of the thrust reverser system should be simple and clearly described in the maintenance manual.
Additionally, a placard describing the procedure may be installed in a conspicuous place on the nacelle.
B-1 AC 25.933-1 Appendix B B.3.1.1.3 Provisions should be made in system design to allow easy and safe access to the components for fault isolation, replacement, inspection, lubrication, and so forth. This is particularly important where inspections are required to detect latent failures. Providing safe access should include consideration of risks both to the mechanic and to any critical design elements that might be inadvertently damaged during maintenance.
B.3.1.1.4 Provisions should be provided for easy rigging of the thrust reverser and adjustment of latches, switches, actuators, and so forth.
B.3.1.2 Fault Identification and Elimination.
B.3.1.2.1 System design should allow simple, accurate fault isolation and repair.
B.3.1.2.2 System design personnel should be actively involved in the development, documentation, and validation of the troubleshooting/fault isolation manual and other maintenance publications. The systems design personnel should verify that maintenance assumptions critical to any SSA conclusion are supported by these publications (for example, perform fault insertion testing to verify that the published means of detecting, isolating, and eliminating the fault are effective).
B.3.1.2.3 Thrust reverser unstowed and unlocked indications should be easily discernible during pre-flight inspections.
B.3.1.2.4 If the airplane has onboard maintenance monitoring and recording systems, the system should have provisions for storing all fault indications. This would be of significant help to maintenance personnel in locating the source of intermittent faults.
B.3.1.3 Minimization of Errors.
Minimization of errors during maintenance activity should be addressed during the design process. Examples include physical design features, installation orientation markings, dissimilar connections, and so forth. The use of a formal “lessons learned” review early and often during design development may help avoid repeating previous errors.
B.3.1.4 System Reliability.
The design process should, where appropriate, use previous field reliability data for specific and similar components to ensure system design reliability.
B.3.2 Maintenance Control.
B.3.2.1 Maintenance Program.
When the applicant develops the initial maintenance plan for the airplane, they should consider, as necessary, the following: B-2 AC 25.933-1 Appendix B B.3.2.1.1 Involvement of the manufacturers of the airplane, engine, and thrust reverser.
B.3.2.1.2 The compatibility of the SSA information with the certification maintenance requirements (CMRs), airworthiness limitations (AWLs), maintenance review board report, master minimum equipment list (MMEL), and so forth.
Note: A CMR is a required scheduled maintenance task established during the design certification of the airplane systems as an operating limitation of the type certificate (TC) or supplemental type certificate (STC). The CMRs, including the interval, result from the thrust reverser SSA. For information on CMRs, see AC 25-19A.
B.3.2.1.3 Identification by the manufacturer of all airplane system maintenance tasks in which foreseeable errors could result in an in-flight thrust reversal preventing continued safe flight and landing. The manufacturer should take all practical actions to minimize the potential for such error, and the operator should consider these tasks when identifying and documenting the required inspection items for the airplane system.
B.3.2.1.4 The complexity of lock-out procedures and appropriate verification.
B.3.2.1.5 Appropriate tests, including an operational test, of the thrust reverser to verify correct system operation after the performance of any procedure that would require removal, installation, or adjustment of a component, or disconnection of a tube, hose, or electrical harness of the entire thrust reverser actuation control system.
B.3.2.2 Training.
The following items should be considered when developing training documentation for the thrust reverser system and other interfacing airplane systems: B.3.2.2.1 The reason and the significance of accomplishing critical tasks for the thrust reverser and interfacing systems as prescribed. This would clarify why a particular task needs to be performed in a certain manner.
B.3.2.1.2 Instructions or references as to what to do if the results of a check or operational test of the system do not agree with those given in the airplane maintenance manual (AMM). The manual should recommend some corrective action if a system fails a test or check. This would help ensure that the critical components are not overlooked in the troubleshooting process.
B.3.2.1.3 Emphasis on the total thrust reverser and interfacing systems training by a single training source to preclude fragmented information without a clear understanding of the thrust reverser system. This training concept should be used in the initial airplane system training and subsequent retraining.
B-3 AC 25.933-1 Appendix B B.3.2.1.4 Inclusion of airplane system fault isolation and troubleshooting using the material provided for the respective manuals.
B.3.2.1.5 Evaluation of the thrust reverser and interfacing systems training materials to assure consistency between the training material and the thrust reverser system maintenance and troubleshooting manuals.
B.3.2.3 Repairs and Alterations.
The original airframe manufacturer should provide, per § 25.1529, Instructions for Continued Airworthiness essential to ensure that subsequent repairs or alterations do not unintentionally violate the integrity of the type design approval for the original thrust reverser system. Additionally, the original airframe manufacturer should define a method of ensuring that this essential information will be evident to those that may perform and approve such repairs and alterations. One example would be maintaining the wire separation between relevant thrust reverser control electrical circuits. This sensitivity could be communicated by statements in appropriate manuals such as the wiring diagram manual and by decals or placards placed on visible areas of the thrust reverser and/or airplane structure.
B.3.2.4 Feedback of Service Experience.
The maintenance process should initiate the feedback of service experience that will allow the monitoring of system reliability performance and improvements in system design and maintenance practices. Additionally, this service experience should be used to assure the most current and effective formal “lessons learned” design review process possible.
B.3.2.4.1 Reliability Performance.
Operators and manufacturers should collaborate on these items and provide authorities visibility as required (e.g., refer to § 21.3, § 121.703, or § 135.65, as applicable): • Accurate reporting of functional discrepancies.
• Service investigation of hardware by manufacturer to confirm and determine failure modes and corrective actions if required.
• Update of failure rate data. (This will require coordination between the manufacturers and airlines.)
B.3.2.4.2 Improvements Suggested by Maintenance Experience.
This will provide data to update the following effectively and periodically: • Manuals.
• Troubleshooting.
• Removal/replacement procedures.
B-4 AC 25.933-1 Appendix B B.3.2.5 Documentation and Procedures.
The following considerations should be addressed when preparing and revising documents and procedures for the instructions for continued airworthiness to support the thrust reverser in the field in conjunction with §§ 25.901(b)(2) and 25.1529 and appendix H to part 25.
B.3.2.5.1 Documentation should describe a rigging check, if required after adjustment of any thrust reverser actuator drive system component.
B.3.2.5.2 Documentation should describe powered cycling of the thrust reverser to verify system integrity whenever maintenance is performed. This could also apply to any manual actuation of the reverser.
B.3.2.5.3 The AMM should include the reasons and the significance of accomplishing critical tasks.
B.3.2.5.4 The AMM should include instructions or references as to what to do if the results of a check or operational test do not agree with those given in the AMM.
B.3.2.5.5 Provisions should be made to address inefficiencies and errors in the documentation identified from— • The validation process of both critical and troubleshooting procedures.
• Input from field.
• Operators’ conferences.
B.3.2.5.6 Development of the documentation should be a coordinated effort between the thrust reverser, engine, and airplane manufacturers, as well as operators. This is especially important in the areas of— • AMM.
• Troubleshooting.
• Fault isolation.
• Maintenance data computer output.
• Procedure validation.
• MMEL.
B.3.2.5.7 Initial issue of the documentation should include the required serviceable limits for the complete thrust reverser system.
B-5 OMB Control Number: 2120-0746 Expiration Date: 11 /3 0 /202 4 Advisory Circular Feedback Form Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 20 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, completing and reviewing the collection of information.
All responses to this collection of information are voluntary FAA Order 1320.46D Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, Barbara Hall, 800 Independence Ave, Washington, D.C. 20590.
If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to ( ) or (2) faxing it to the attention of the LOB/SO ( ).
Subject: Date: Please mark all appropriate line items: □ An error (procedural or typographical) has been noted in paragraph on page .
□ Recommend paragraph on page be changed as follows: □ In a future change to this AC, please cover the following subject: (B riefly describe what you want added.)
□ Other comments: □ I would like to discuss the above. Please contact me.
Submitted b y: Date: FAA Form 1320-73 ( 09/22) SUPERSEDES PREVIOUS EDITIONS