x72rp0614312 v3.0 Uerf Guidelines

UERF GUIDELINES
Technical Report REFERENCE X72RP0614312

ISSUE 3.0 DATE 31 May 2012
UERF GUIDELINES
Technical Report
REFERENCE X72RP0614312
A/C APPLICABILITY
ATA APPLICABILITY
CUSTOMER
CONFIDENTIALITY Company Use Only
DOCUMENT LEVEL 3
SUMMARY:
<SUMMARY_BEGIN>
This document on Uncontained Engine Rotor Failure aims at providing useful data on this
Particular Risk Analysis.
This report allows to understand the Rotor Burst exercise, by providing:

- The reason for a need of a specific certification exercise,
- The origin and the reasons of the proposed regulation analyses,
- Statistics on in service events and certified data.
This report defines the Rotor Burst exercise by providing:

- UERF analysis work in particular:
- Process / actors / organisation
- Design precautions aspects
- Residual risk computation
- Certification work for UERF
Preliminary data on future projects/developments UERF consideration & In service events analysis
is also provided and will be completed in next issue.
This document shall be used as a common source of information to any person working on
UERF analysis.
KEYWORDS
<SUMMARY_END>
UERF ; ROTOR BURST ; ENGINE FAILURE ; POLICY

RELATED DOCUMENTS
NAME SIGLUM - FUNCTION DATE & SIGNATURE
AUTHOR(S) Antoine PILON EET14

Hubert PARINAUD EET14
Sylvain ROUMEGAS EET14
APPROVAL Charlie RULLEAU Head of EET14
AUTHORIZATION Johann HERVAULT Head of EET1
© AIRBUS FRANCE S.A.S. 2012. All rights reserved. Confidential and proprietary document.
This document and all information contained herein is the sole property of AIRBUS FRANCE S.A.S.. No intellectual property rights are granted by the delivery of this document or the disclosure of its content. This
document shall not be reproduced or disclosed to a third party without the express written consent of AIRBUS FRANCE S.A.S.. This document and its content shall not be used for any purpose other than that for which
it is supplied.
AN EADS COMPANY AIRBUS FRANCE S.A.S SIÈGE SOCIAL:

SOCIÉTÉ PAR ACTIONS SIMPLIFIÉE 316 ROUTE DE BAYONNE
AU CAPITAL DE 76.558.233 EUROS 31060 TOULOUSE CEDEX 03, FRANCE
R.C.S. N° 393 341 532 TOULOUSE PHONE +33 (0)5 61 93 55 55
Technical_Report_FM0200016_v2.1 Page 1 of 150

UERF GUIDELINES
LIST OF DISTRIBUTION
DEPARTMENT/ NAME P.O. BOX COVER NOTE NOTE
COMPANY PAGE WITHOUT WITH
ONLY ATTACH- ATTACH-
MENT MENT
EET14 Daniel STALPH
EET14 Charlie RULLEAU
EET14 Hubert PARINAUD
EET14 Sylvain ROUMEGAS
EET14 Antoine PILON
EET1 Johann HERVAULT
EET10 Philippe VIGARIOS
EET13 Stéphane PUGLIESE
EET Thierry BOUISSET
EE Sébastien REMY
EEDX Fabienne DEVEAUX
NO. OF COPIES 0 0 0
© AIRBUS FRANCE S.A.S. 2012. ALL RIGHTS RESERVED. CONFIDENTIAL AND PROPRIETARY DOCUMENT.
Page 2 of 150
UERF GUIDELINES
RECORD OF REVISIONS
ISSUE DATE EFFECT ON REASONS FOR REVISION
PAGE PARA
1 Creation
2 Chapter reordering
2 Thrust reverser retention means update
2 Hydraulic assumption update
2 Table of reference addition
2.2 April 2011 Establishment of subject to be detailed
3 May 2012 All General update of content and structure of the
document
Page 3 of 150
UERF GUIDELINES
TABLE OF FIGURES
Figure 1: Typical Risk Window (Top +/-3°, Bottom +/-5°) ............................................................... 28
Figure 2: Blade Length Definition ..................................................................................................36
Figure 3: Typical Assembled Rotor Stage......................................................................................40
Figure 4: Drum Rotor Stage ..........................................................................................................41
Figure 5: Integrated Rotor Stage ...................................................................................................42
Figure 6: Assembled Rotor Stage ..................................................................................................43
Figure 7: Thi[Disc Fragment ..........................................................................................................44
Figure 8: Intermediate Fragment ...................................................................................................45
Figure 9: Small Fragment ..............................................................................................................46
Figure 10: Fan Blade Fragment .....................................................................................................47
Figure 11: PRA organisation .........................................................................................................50
Figure 12: A350XWB PDD simplified flow chart for system activities .............................................55
Figure 13: Propeller blade release failure model............................................................................66
Figure 14: T105G V&V process - Global overview.........................................................................70
Figure 15: Window frame doubler ..................................................................................................73
Figure 16: Centre Wing Box structure............................................................................................74
Figure 17: Wing general assembly ................................................................................................75
Figure 18: Front spar (inner shown) integrally stiffened .................................................................76
Figure 19: Inner fixed leading structure including bath-tub region ..................................................77
Figure 20: Mid-Fixed leading edge structure .................................................................................77
Figure 21: Fixed Trailing Edge Secondary Structure .....................................................................78
Figure 22: Engine mount modification to improve UERF situation .................................................79
Figure 23: Thrust system view .......................................................................................................80
Figure 24: Rear engine mount view ...............................................................................................81
Figure 25: Pylon to wing attachments ............................................................................................81
Figure 26: Pylon primary structure assembly .................................................................................82
Figure 27 : A350 LHS LPSOV segregation ....................................................................................84
Figure 28 : A350 G LHS FSOV segregation ..................................................................................85
Figure 29 : A350 Y RHS FSOV segregation ..................................................................................85
Figure 30: A350 Electrical routes with deviations outside risk areas ..............................................87
Figure 31: A350 – example of 1MB deviation routings (ceiling within UERF area) ......................... 88
Figure 32: A30X Status B3 Detached ice accretion CAT area .......................................................89
Figure 33: Example of Internal fire critical trajectory (A350 XWB) ..................................................91
Figure 34: Single wing shot / Cross wing shot external fire (A380) ................................................93
Figure 35: Rear passenger door location .......................................................................................95
Figure 36: Pressure Bulkhead location ..........................................................................................96
Figure 37: HTP/VTP design solution..............................................................................................97
Figure 38: HTP/VTP design solution..............................................................................................97
Figure 39: A350XWB fuel tank arrangements vs LPT2 5° debris ...................................................98
Figure 40: A380 least risk area ......................................................................................................99
Figure 41: Dry Bay analysis ...........................................................................................................99
Figure 42: Engine and pylon mounts location vs. risk area. ......................................................... 100
Figure 43: Significant Structure protection ...................................................................................102
Figure 44: Impacts definitions ...................................................................................................... 102
Figure 45: Cross engine impact areas definition .......................................................................... 103
Figure 46: Engine Externals (Wet Side) ....................................................................................... 103
Figure 47: Engine Externals (Dry side) ........................................................................................ 104
Figure 48: Protection with Nacelle stiffeners ................................................................................ 105
Figure 49: Architecture solution 1 ................................................................................................ 105
Page 4 of 150
UERF GUIDELINES
Figure 52: BAE 146 engine 1 impacts ............................................................................................ 106

Figure 53: BAE 146 engine 2 bursting ........................................................................................... 107
Figure 54: A330 leading edge impacts ........................................................................................ 107
Figure 55: Boeing 747-200 engine 1 bursting & leading edge impacts ........................................ 108
Figure 56: Disc and blade after bursting event ............................................................................ 108
Figure 57: Typical combination of impacts to be considered (example on Trent-XWB) ................ 110
Figure 58: Trent 900 (A380) T/R actuator impacts ....................................................................... 110
Figure 59: T-XWB 84K IPT1 third disc +/-5° risk area – impact on T/R integration ...................... 111
Figure 60: T-XWB IPT mini disc potential impact on PLS & TLS at +/-5° degree for 1/3rd disc ..... 112
Figure 61: T/R ircumferential segregation .................................................................................... 113
Figure 62: Probability distribution for hole size ............................................................................115
Figure 63: AC25-20 altitude distribution ....................................................................................... 115
Figure 64: ATA35 Oxygen - Fault Tree ........................................................................................ 117
Figure 65: Example of Depressurization risk exposure for A30X program ................................... 117
Figure 66: Debris Trajectory angles definition .............................................................................. 121
Figure 67: Risk Window definition ............................................................................................... 122
Figure 68 : Flight Phase probability distribution ........................................................................... 123
Figure 69: Example of systems OVYSICA function ..................................................................... 124
Figure 70: A350 Residual risk sharing between contributors ....................................................... 125
Figure 71: A350 Residual risk sharing between system contributors ........................................... 125
Figure 72: A380 Own pylon ......................................................................................................... 128
Figure 73: Risk volumes generated with Roll Royce -Txwb84k motorization file (A350 XWB) ..... 129
Figure 74: Risk volume creation mode ........................................................................................ 130
Figure 75: Particular UERF trajectory .......................................................................................... 130
Figure 76: Step 2: Computation clash.......................................................................................... 131
Figure 77: Step 3: Target file management.................................................................................. 132
Figure 78: Example of target file .................................................................................................. 132
Figure 79: Step 4: Export impacts for a given target .................................................................... 132
Figure 80: Example of impact file ................................................................................................ 133
Figure 81: Step 5: Post Process results....................................................................................... 133
Figure 82: Step 6: CSVtoIMP Translator ..................................................................................... 134
Figure 83: Database configuration (A320neo / CFM LeapX 1A 3.1 / Alternative) ......................... 135
Figure 84: Target files acquisition ................................................................................................ 136
Figure 85: Example of function / OVISYCA ................................................................................. 136
Figure 86: Example of risk window generated with OVISYCA ..................................................... 137
Figure 87: MV² overview.............................................................................................................. 139
Figure 88: DOORS module overview........................................................................................... 139
Figure 89: DOORS module overview........................................................................................... 140
Figure 90: Txwb84k / T772 stage repartition ................................................................................ 145
Page 5 of 150
UERF GUIDELINES
TABLE OF TABLES
Table 1: Wide Body UERF certification reports ..............................................................................32
Table 2: Single Aisle UERF certification reports ............................................................................33
Table 3: Long Range UERF certification reports............................................................................34
Table 4: Double Deck UERF certification reports...........................................................................35
Table 5: A400M UERF certification reports....................................................................................35
Table 6: Fuel tank filling reduction factors (Sij) ..............................................................................91
Table 7: Emergency evacuation reduction factors (Sij) ..................................................................92
Table 8: ECS packs auto-ignition risk reduction factors (Sij) ..........................................................92
Table 9: Sparking risk reduction factors (Sij) .................................................................................92
Table 10: Leakage of on ECS packs reduction factors ..................................................................93
Table 11: Sparking risk reduction factors .......................................................................................93
Table 12: External fire reduction factors ........................................................................................94
Table 13: A30X RB 3011-16 motorization file .............................................................................. 131
Table 14: Reduction factors input ................................................................................................ 137
Table 15: 1/20 residual risk ......................................................................................................... 138
Page 6 of 150
UERF GUIDELINES
TABLE OF REFERENCES
N° TITLE REFERENCE ISSUE DATE SOURCE
SIGLUM NAME
1 CS/JAR/FAR 25
2 AMC/AC 20-128A
3 AIA survey Airbus X72RP1017424
4 Disc Fragment Cinematic X72RP0605550
Model
5 BLADE TUMBLING X72RP1104024
TRAJECTORY
SYNTHESIS
6 Blade Design Principles - X72ME0711282
Failsafe or Safelife
7 Unbladed disc policy X70ME1028024
8 UEF Characteristics X72RP0720169
Request
9 Methodology for N72RP1111620
Uncontained Engine
Failure Risk Factors
Determination
10 UERF NORMAL VS X72PP0800592
ALTERNATIVE MODEL
COMPARISON
11 Engine Detachment N72RP1104098
Trajectory Synthesis
12 NASA CP2017
13 Analysis of world wide ME1113944
rotor burst events in the
frame of A30X
14 Analyse de trajectoires ME1114774
cinématiques dans le
cadre d’éclatements
moteurs avion
15 A350 XWB / UERF PRA V72RP0510393 4 05/12/2006 EEI14 Michel
PDD KIPPER
16 A350 UERF general policy V72PP0500318 4 15/12/2006 EEI14 Michel
KIPPER
17 Particular Risk Analysis AM2616.3.3 A 17/10/2011 EYDS François
RAILLAT
18 UERF Tank boundaries X28RP1216564 1 04/12/2008 EET14 Charlie
and dry bays digest RULLEAU
19 EPW validation for UERF SA710ME1013097 3 31/03/2012 EIX Antoine
pre-studies ABELE
20 UNCONTAINED ENGINE L72RP0615202 2.0 27/09/2007 EEI3 Charlie
ROTOR FAILURE RULLEAU
DESIGN PRECAUTIONS
Page 7 of 150
UERF GUIDELINES
TABLE OF CONTENTS
1 Introduction ......................................................................................................................14
2 History .............................................................................................................................15
2.1 Statistics and safety aspects ............................................................................................15
2.1.1 Links between 1/20, 1/40 and 10-9 ..........................................................................15
2.1.2 Probability for disc type to be ejected .....................................................................15
2.2 In service events ..............................................................................................................15
3 Regulation .......................................................................................................................16
3.1 History & reference text ...................................................................................................16
3.1.1 Requirement ...........................................................................................................16
3.1.1.1 Section 25.903 Engines ..........................................................................................16
3.1.1.1.1 Rule Text ................................................................................................................16
3.1.1.1.2 Intent of Rule ..........................................................................................................17
3.1.1.1.3 References .............................................................................................................17
3.1.1.2 Section 25.903(d) Turbine engine installations .......................................................18
3.1.1.2.1 Rule text .................................................................................................................18
3.1.1.2.2 Intent of Subparagraph ...........................................................................................18
3.1.1.2.3 Background ............................................................................................................18
3.1.1.2.4 Policy/Compliance Methods....................................................................................19
3.1.2 Small fragments......................................................................................................19
3.2 Philosophy / goals............................................................................................................23
3.2.1 Airworthiness Authorities meaning ..........................................................................23
3.2.2 World wide activities ...............................................................................................23
3.2.2.1 Why choosing the one-third disc fragment ..............................................................23
3.2.2.2 Engine and Aircraft Certification versus UERF........................................................23
3.2.2.3 Fan Blade Off test ................................................................................................... 25
3.2.3 Airbus way ..............................................................................................................26
3.3 Politics .............................................................................................................................26
3.3.1 Airbus view .............................................................................................................26
3.3.1.1 Why choosing Alternative Engine Failure Model .....................................................26
3.3.2 Forces in the world .................................................................................................30
4 In Service Airbus A/C certified data .................................................................................31
4.1 Certification basis for each A/C ........................................................................................31
4.1.1 Single Aisle .............................................................................................................31
4.1.1.1 A320-321-319-318 except PW6000 engines ..........................................................31
Page 8 of 150
UERF GUIDELINES
4.1.1.2 A318-121 and A318-122 fitted with Pratt & Whitney engines ..................................31
4.1.1.3 A320 NEO ..............................................................................................................31
4.1.2 Wide Body (A300 and A310) .................................................................................. 31
4.1.3 Long Range ............................................................................................................31
4.1.3.1 A330 and A340-200/300 .........................................................................................31
4.1.3.2 A340-500/600 .........................................................................................................31
4.1.4 A380 .......................................................................................................................31
4.1.5 A400M ....................................................................................................................31
4.1.6 A350 .......................................................................................................................32
4.2 Certification reports..........................................................................................................32
4.2.1 Wide Body ..............................................................................................................32
4.2.2 Single Aisle .............................................................................................................33
4.2.3 Long Range ............................................................................................................34
4.2.4 Double Deck (A380) ............................................................................................... 35
4.2.5 A400M ....................................................................................................................35
5 Powerplant characteristics and debris model ...................................................................36
5.1 Differences between engine’s manufacturer and UERF data ...........................................36
5.2 Power plant Geometrical characteristics (UERF-Data) ....................................................37
5.3 Power plant Geometrical characteristics (PBR-Data) .......................................................38
5.4 General-Data for dedicated consideration ........................................................................39
5.5 Aircraft-Datum for Power plant location............................................................................40
5.6 Power plant Characteristics reference .............................................................................40
5.7 UERF Fragment characteristics .......................................................................................44
5.7.1 One-third Disc Fragment characteristics .................................................................44
5.7.2 Intermediate Fragment characteristics ....................................................................45
5.7.3 Small Fragment characteristics ...............................................................................46
5.7.4 Fan Blade Fragment characteristics .......................................................................47
5.7.5 Fragment thickness definition .................................................................................48
5.8 Ejection and spread angle definition ................................................................................48
5.9 Fragment trajectory..........................................................................................................49
6 UERF analysis for development A/C ................................................................................ 50
6.1 Process & organisation ....................................................................................................50
6.1.1 Generic PRA organisation ......................................................................................50
6.1.2 UERF Actors and responsibilities............................................................................50
6.1.3 UERF Process overview .........................................................................................53
6.1.4 Process Description Document / Analysis...............................................................53
Page 9 of 150
UERF GUIDELINES
6.1.5 Trajectory booklet ...................................................................................................55

6.1.6 System Segregation Diagrams and Aircraft level synthesis ....................................55
6.1.7 Typical schedule .....................................................................................................57
6.2 Policy and usual assumptions ..........................................................................................58
6.2.1 A/C status - environmental conditions – crew response ..........................................58
6.2.2 Geometrical analysis assumptions..........................................................................59
6.2.3 Hypothesis for impacted components .....................................................................59
6.2.4 Specific hypothesis .................................................................................................60
6.2.4.1 Shielding offered by the engine case ......................................................................60
6.2.4.2 Hypothesis linked to composite wing and/or fuselage .............................................61
6.2.4.3 Propeller hypothesis ............................................................................................... 61
6.2.4.4 Hydraulic Assumption .............................................................................................61
6.2.4.5 Electrical generation ...............................................................................................63
6.2.4.5.1 RAT characteristics ................................................................................................64
6.2.4.5.2 APU characteristics ................................................................................................64
6.3 Propeller Blade Release (A400M) ....................................................................................64
6.3.1 Engine / Propeller Imbalance Particular Risk Analysis ............................................65
6.3.1.1 Regulation ..............................................................................................................65
6.3.1.2 Assumptions ...........................................................................................................65
6.3.1.2.1 Propeller Blade Release ......................................................................................... 65
6.3.1.2.2 Nickel sheath loss...................................................................................................66
6.3.2 Propeller Blade Release Particular Risk Analysis ...................................................66
6.3.2.1 Regulation ..............................................................................................................66
6.3.2.2 Assumptions ...........................................................................................................66
6.3.2.2.1 Model .....................................................................................................................66
6.3.2.2.2 Process ..................................................................................................................67
6.4 Design precautions ..........................................................................................................67
6.4.1 Requirement Based Engineering / V&V ..................................................................67
6.4.1.1 Cascading and Traceability..................................................................................... 67
6.4.1.2 PRA Safety Requirements Transfer Document (T105G) .........................................68
6.4.1.3 Requirements verification .......................................................................................70
6.4.2 Structure .................................................................................................................71
6.4.2.1 Overview ................................................................................................................71
6.4.2.2 Surface detachment................................................................................................71
6.4.2.3 Protection against fragments ..................................................................................72
6.4.2.4 Fuselage structure ..................................................................................................72
Page 10 of 150
UERF GUIDELINES
6.4.2.4.1 Section 15 - upper & lateral shells & lower shell .....................................................72
6.4.2.4.2 Section 15 / Landing Gear Bay (LGB) and Rear lower shell....................................73
6.4.2.4.3 Section Keel Beam .................................................................................................73
6.4.2.4.4 Section 21 / Center Wing Box .................................................................................73
6.4.2.5 Wing structure ........................................................................................................74
6.4.2.5.1 Wingbox .................................................................................................................75
6.4.2.5.2 Trailing edge control surfaces (specific to quad) .....................................................76
6.4.2.5.3 Fixed Leading Edge structure ................................................................................. 76
6.4.2.5.4 Fixed Trailing Edge secondary structure .................................................................78
6.4.2.5.5 Pylon/wing attachments (forward and spigot) .........................................................79
6.4.2.6 Pylon structure........................................................................................................79
6.4.2.7 Structure damage tolerance criteria ........................................................................82
6.4.2.8 Composite structure................................................................................................82
6.4.2.9 Energy consideration ..............................................................................................82
6.4.2.9.1 Small fragment's energy vs. Nacelle ....................................................................... 82
6.4.3 Systems..................................................................................................................83
6.4.3.1 Uncontrolled Fire ....................................................................................................83
6.4.3.1.1 Fire Extinguishing Systems.....................................................................................83
6.4.3.1.2 Flammable Fluid Shutoff Valve ...............................................................................83
6.4.3.2 Loss of Thrust .........................................................................................................85
6.4.3.3 Loss of Airplane Control ......................................................................................... 86
6.4.3.4 Passenger and Crew Incapacitation .......................................................................87
6.4.3.5 Other functions usual design precautions ............................................................... 87
6.4.3.5.1 Electrical routes installation / segregation ...............................................................87
6.4.3.5.2 Wing Anti-ice ..........................................................................................................88
6.4.3.5.3 Deceleration ...........................................................................................................89
6.4.3.5.4 Extension retraction ................................................................................................89
6.4.3.5.5 Communication & Navigation ..................................................................................90
6.4.4 Fire Risk .................................................................................................................90
6.4.4.1 Internal fire .............................................................................................................90
6.4.4.2 External fire ............................................................................................................93
6.4.5 Engine Integration ..................................................................................................94
6.4.5.1 Engine positioning versus critical elements .............................................................94
6.4.5.1.1 Wing mounted engines ...........................................................................................95
6.4.5.1.1.1 Engines position’s guidelines considering a 4 engines aircraft 95
6.4.5.1.1.2 General aircraft arrangement 95
Page 11 of 150
UERF GUIDELINES
6.4.5.1.2 Rear end engine integration....................................................................................95

6.4.5.2 Fuel tank boundaries layout rules ...........................................................................97
6.4.5.3 Least risk area ........................................................................................................98
6.4.5.4 Dry bays .................................................................................................................99
6.4.5.5 Engine & pylon wing mount .................................................................................. 100
6.4.6 Engine & nacelle design precautions .................................................................... 100
6.4.6.1 Cross engine debris .............................................................................................. 101
6.4.6.2 Thrust reversers retention means ......................................................................... 109
6.4.6.2.1 Regulation and past programs demonstration....................................................... 109
6.4.6.2.2 Compliance demonstration ................................................................................... 111
6.4.6.2.2.1 Hypothesis 111
6.4.6.2.2.2 Conservative analysis 111
6.4.6.2.2.3 Refined analysis 112
6.4.7 Rapid Decompression .......................................................................................... 114
6.4.7.1 Structural aspect................................................................................................... 114
6.4.7.2 Physiological aspect ............................................................................................. 114
6.4.7.3 Contribution to residual risk: ................................................................................. 116
6.5 Residual Risk................................................................................................................. 118
6.5.1 1/20 Origin ............................................................................................................ 118
6.5.2 Level of risk calculation......................................................................................... 121
6.5.3 Relevant stages .................................................................................................... 123
6.5.4 System contribution .............................................................................................. 124
6.5.5 Structure contribution............................................................................................ 126
6.5.6 Reduction factors.................................................................................................. 126
6.5.6.1 Risk families ......................................................................................................... 126
6.5.6.2 Example of reduction factor assessment .............................................................. 128
6.5.7 Calendar ............................................................................................................... 129
6.6 Tools.............................................................................................................................. 129
6.6.1 ARIAS .................................................................................................................. 129
6.6.1.1 Generalities .......................................................................................................... 129
6.6.1.2 Process ................................................................................................................ 129
6.6.2 OVISYCA ............................................................................................................. 135
6.6.3 MV² - DOORS....................................................................................................... 138
6.6.4 EPW ..................................................................................................................... 140
6.6.5 ABSENER ............................................................................................................ 140
6.7 Certification.................................................................................................................... 141
Page 12 of 150
UERF GUIDELINES
6.7.1 Organisation ......................................................................................................... 141

6.7.2 Meetings with AA .................................................................................................. 142
6.7.3 Certification documents ........................................................................................ 142
6.7.3.1 CRI/IP ................................................................................................................... 142
6.7.3.2 Main Certification document ................................................................................. 143
6.7.3.3 Others documents ................................................................................................ 143
7 Modification & UERF ..................................................................................................... 144
7.1 A/C design modification certification process ................................................................. 144
7.2 A320-NEO .....................................................................................................................144
7.3 One Example: A380 EBHA removal .............................................................................. 144
8 Future projects/developments UERF consideration: prepare the future ......................... 145
8.1 Introduction .................................................................................................................... 145
8.2 Engine size influence ..................................................................................................... 145
8.3 Higher bypass ratio turbofan .......................................................................................... 147
8.4 Open Rotor .................................................................................................................... 147
8.5 Engine more aft under wing ........................................................................................... 147
8.6 Engine in semi buried configuration ............................................................................... 147
8.7 Engine on rear end section ............................................................................................ 147
8.8 Previous studies ............................................................................................................ 147
8.9 Engine Detachment and power plant dynamics ............................................................. 147
8.10 Rule making CROR ....................................................................................................... 147
8.10.1 Objective .............................................................................................................. 147
8.10.2 Process ................................................................................................................ 147
8.10.3 Actors ................................................................................................................... 147
9 In service events UERF analysis ................................................................................... 148
9.1 Process ......................................................................................................................... 148
9.2 Importance of certified level of risk and retrievable data ................................................ 148
9.3 Example of A380 QF32 event ........................................................................................ 148
10 Open points ................................................................................................................... 149
10.1 Averaged disc or statistic mean of the bursting stage .................................................... 149
11 Conclusion ..................................................................................................................... 150
Page 13 of 150
UERF GUIDELINES
1 Introduction
This document on Uncontained Engine Rotor Failure aims at providing useful data on this
Particular Risk Analysis.
This report allows understanding the Rotor Burst exercise, by providing:

- The reason for a need of a specific certification exercise,
- The origin and the reasons of the proposed regulation analyses,
- Statistics on in service events and certified data.
This report defines the Rotor Burst exercise by providing:

- UERF analysis work in particular:
- Process / actors / organisation
- Design precautions aspects
- Residual risk computation
- Certification work for UERF
Preliminary data on future projects/developments UERF consideration & In service events

analysis is also provided and will be completed in next issue.
Page 14 of 150
UERF GUIDELINES
2 History
2.1 Statistics and safety aspects
2.1.1 Links between 1/20, 1/40 and 10-9
Refer to ME1113944 report [13]
2.1.2 Probability for disc type to be ejected
Considering the §25.903d1 and its mean of compliance AMC20-128A, the probability of
release of debris is assumed to be uniformly distributed over all directions and the probability
of release of any engine stage is assumed to be 1. In conclusion, the use of probability is not
foreseen.
Looking at service experience data, it appears useful to look deeper on the ejected stage as,
some of the stage, due to involved technology, have not experienced some Rotor Burst.
Data collected in this way may help in defining requirement evolution.
More details are provided in AIA survey outputs [3]
2.2 In service events

An UERF database of referenced events is available on the UERF shared folder. More
information is also available in:
x AIA survey outputs [3]
x Report ME1113944 [13]
Page 15 of 150
UERF GUIDELINES
3 Regulation
3.1 History & reference text
3.1.1 Requirement
3.1.1.1 Section 25.903 Engines
3.1.1.1.1 Rule Text
(a) Engine type certificate.
(1) Each engine must have a type certificate and must meet the applicable requirements of
part 34 of this chapter.
(2) Each turbine engine must either --
(i) Comply with § 33.77 of this chapter in effect on October 31, 1974, or as subsequently
amended; or
(ii) Be shown to have a foreign object ingestion service history in similar installation locations
which has not resulted in any unsafe condition.
(b) Engine isolation. The power plants must be arranged and isolated from each other to allow
operation, in at least one configuration, so that the failure or malfunction of any engine, or of
any system that can affect the engine, will not --
(1) Prevent the continued safe operation of the remaining engines; or
(2) Require immediate action by any crewmember for continued safe operation.
(c) Control of engine rotation. There must be means for stopping the rotation of any engine
individually in flight, except that, for turbine engine installations, the means for stopping the
rotation of any engine need be provided only where continued rotation could jeopardize the
safety of the airplane. Each component of the stopping and restarting system on the engine
side of the firewall that might be exposed to fire must be at least fire-resistant. If hydraulic
propeller feathering systems are used for this purpose, the feathering lines must be at least
fire resistant under the operating conditions that may be expected to exist during feathering.
(d) Turbine engine installations. For turbine engine installations -
(1) Design precautions must be taken to minimize the hazards to the airplane in the event of
an engine rotor failure or of a fire originating within the engine which burns through the engine
case.
(2) The power plant systems associated with engine control devices, systems, and
instrumentation, must be designed to give reasonable assurance that those engine operating
limitations that adversely affect turbine rotor structural integrity will not be exceeded in service.
(e) Restart capability.
(1) Means to restart any engine in flight must be provided.
(2) An altitude and airspeed envelope must be established for in-flight engine restarting, and
each engine must have a restart capability within that envelope.
(3) For turbine engine powered airplanes, if the minimum windmilling speed of the engines,
following the in-flight shutdown of all engines, is insufficient to provide the necessary electrical
power for engine ignition, a power source independent of the engine-driven electrical power
generating system must be provided to permit in-flight engine ignition for restarting.
Page 16 of 150
UERF GUIDELINES
(f) Auxiliary power unit. Each auxiliary power unit must be approved or meet the requirements
of the category for its intended use.
(Doc. No. 5066, 29 FR 18291, Dec. 24, 1964, as amended by Amdt. 25-23, 35 FR 5676, April
8, 1970; Amdt. 25-40, 42 FR 15042, March 17, 1977; Amdt. 25-57, 49 FR 6848, Feb. 23,
1984; Amdt. 25-72, 55 FR 29784, July 20, 1990; Amdt. 25-73, 55 FR 32861, August 10, 1990)
3.1.1.1.2 Intent of Rule
(1) The intent of this rule can be separated into 5 distinct subjects that are covered by each of
the subparagraphs:
Subparagraph (a) Engine type certificate
Subparagraph (b) Engine isolation
Subparagraph (c) Control of engine rotation
Subparagraph (d) Turbine engine installations
Subparagraph (e) Restart capability
Details on each of the 5 subparagraphs of this section will be discussed separately, as follows.
(2) It must be noted that the current FAA interpretation of “power plant components” includes
engines and propellers and their parts, appurtenances, and accessories that are furnished by
the engine or propeller manufacturer, and all other components of the power plant installation
that are furnished by the airplane manufacturer. Examples of the former may include fuel
pumps, lines, valves, etc.; examples of the latter may include main inlet, auxiliary inlet doors
(take-off doors), heat-exchangers, lines to provide cabin cooling, etc.
[reference Civil Air Regulations (Civil Aeronautics Manual) 4b, “Airplane Airworthiness
Transport Categories,,” Federal Aviation Agency, May 1, 1960.]
3.1.1.1.3 References
(1) Civil Air Regulations 4b, December 31, 1953; including Civil Air Regulations 4b, “Airplane
Airworthiness Transport Categories,” Federal Aviation Agency, May 1, 1960.
(2) Amendment 25-23 (35 FR 5676, April 8, 1970).
(3) Amendment 25-40 (42 FR 15042, March 17, 1977).
(4) Amendment 25-46 (43 FR 50597, Oct. 30, 1978).
(5) Advisory Circular 20-128, “Design Considerations for Minimizing Hazards Caused by
Uncontained Turbine Engine and Auxiliary Power Unit Rotor and Fan Blade Failures,” March
9, 1988.
(6) Advisory Circular 20-128A, “Design Considerations for Minimizing Hazards Caused by
Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failures,” March 25, 1997.
(7) Advisory Circular 20-135, “Power plant Installation and Propulsion System Component Fire
Protection Test Methods, Standards, and Criteria,” February 15, 1990.
(8) Advisory Circular 120-42A, “Extended Range Operation with Two-Engine Airplanes
(ETOPS),” December 30, 1988.
(9) FAA Order 8110.11, “Design Considerations for Minimizing Damage Caused by
Uncontained Aircraft Turbine Engine Rotor Failures,” November 19, 1975.
Page 17 of 150
UERF GUIDELINES
3.1.1.2 Section 25.903(d) Turbine engine installations

3.1.1.2.1 Rule text
(d) Turbine engine installations. For turbine engine installations -
(1) Design precautions must be taken to minimize the hazards to the airplane in the event of
an engine rotor failure or of a fire originating within the engine which burns through the engine
case.
(2) The power plant systems associated with engine control devices, systems, and
instrumentation, must be designed to give reasonable assurance that those engine operating
limitations that adversely affect turbine rotor structural integrity will not be exceeded in service.
3.1.1.2.2 Intent of Subparagraph
The intent of this subparagraph is to ensure that practical design precautions are taken such
that hazards to the airplane are minimized following an uncontained engine failure. It requires
design features to protect structure, systems, and components that would be adversely
affected by the heat and pressure conditions resulting from an engine case burn-through.
3.1.1.2.3 Background
(1) The regulatory history shows that § 25.903(d) originated from Section 401(d) of the Civil Air
Regulations (CAR) 4b, December 31, 1953. That paragraph required that the engine
installation “include a means of protection such that the occurrence of rotor blade failure in any
engine will not affect the operation of the remaining engines or jeopardize the continued safe
operation of the airplane . . .” [CAR 4b.401(e) included a requirement for minimizing the
probability of jeopardizing the safety of the airplane in the event of an uncontained turbine
rotor failure, unless the engine type certificate specified that exceedance of rotor limits could
not occur in service.] Amendment 25-AD (29 FR 18289, December 24, 1964) added Part 25
[New] to the Federal Aviation Regulations and replaced Part 4b of the CAR. It was part of the
Agency recodification program announced in Draft Release 61-25, published in the Federal
Register on November 15, 1961 (26 FR 10698). This rule was recodified from CAR 4b.401(d)
without any substantive changes.
(2) Notice of Proposed Rulemaking 68-18 (33 FR 11913, August 22, 1968) proposed to delete
the requirement for the engine installer to provide a means of protection from the effects of
blade failure. The following excerpt from the preamble to the Notice discusses the reasoning
behind the proposed revision:
The engine rotor blade containment requirement of § 25.903(d) is redundant, since §
25.903(a) requires each engine to be type certificated under Part 33 and § 33.19 requires
rotor blade containment as a condition for engine certification. The proposal would delete
that portion of § 25.903(d) pertaining to rotor blade failure considerations.
Also, all engines certificated to the requirements of § 33.27 must have (a) turbine rotors
capable of withstanding damage inducing factors and (b) control devices, systems, and
instrumentation that will preserve the engine rotor structural integrity. Since all certificated
engines must incorporate turbine rotors capable of withstanding damage inducing factors,
the proposal would delete this requirement from § 25.903(d)(1).
However, the requirement of § 25.903(d)(2) pertaining to control devices, systems, and
instrumentation to protect the engine is still necessary in some installations to provide
such protection as a result of installation features. In addition, even though § 33.27
contains specific requirements to minimize the probability of turbine rotor failure, turbine
and compressor rotors have failed in service. Engine fires have burned through the engine
case with torch-like effectiveness. These failures were due to maintenance factors, engine
defects due to service uses, material defects, and to some extent, design deficiencies.
Page 18 of 150
UERF GUIDELINES
The incidents have not caused catastrophic damage because of the basic engine location
in under-wing pods. However, the present rules do not preclude engine locations in other
areas of an airplane where severe damage is more likely to be caused by engine failures.
The proposal would permit flexibility in the design of engine installations and, at the same
time, it would minimize any hazards to flight safety.
Amendment 25-23 (35 FR 5665, April 8, 1970) followed Notice 68-18 and adopted the
proposed revision. At the same time, § 33.19 was amended to require the engine
manufacturer to provide blade containment. The following excerpt from the preamble to
Amendment 25-23, provides additional guidance:
The purpose of the proposed amendment to § 25.903(d) is to ensure that, for turbine
engine installations, design precautions are taken to minimize the hazards to the airplane
in the event of an engine rotor failure or of a fire originating in the engine which burns
through the engine case. Comments were received objecting to the proposed words
“design precautions to minimize hazards to the airplane” in that they would be subject to
interpretation. However, this wording is contained in the current regulations and no
change to these words or their meaning is intended. Another comment stated that
containment precautions and engine integrity should be the engine manufacturer’s
responsibility and covered under Part 33. The FAA does not agree. Service experience
has shown that additional safeguards in the installation of the engine is necessary over
and above those provided by Part 33 to minimize hazards resulting from engine rotor
failure or engine case burn-through.
3.1.1.2.4 Policy/Compliance Methods
Acceptable methods of compliance, and in certain cases “required compliance methods,”
include drawing and schematic review together with compliance (mock-up) inspections,
system descriptions, fail safe analysis, ground and flight test. Flight testing involves
demonstration of safe flight and landing with (simulated) damaged systems and controls and
external airflow tuft studies of nacelle strut-airframe boundary layer conditions. The applicant
must supply system functioning and test proposals that address each design provision cited in
this subpart. Consideration can be given to compliance by design similarity and service
experience on applicants approved existing design on other model aircraft.
The FAA has issued guidance for compliance with this paragraph in :
x FAA Order 8110.11, “Design Considerations for Minimizing Damage Caused by Uncontained
Aircraft Turbine Engine Rotor Failures,” November 19, 1975.
x Advisory Circular 20-128A, “Design Considerations for Minimizing Hazards Caused by
Uncontained Turbine Engine and Auxiliary Power Unit Rotor and Fan Bald Failures,” March
25, 1997.*
x Advisory Circular 20-135, “Power plant Installation and Propulsion System Component Fire
Protection Test Methods, Standards, and Criteria,” February 15, 1990.
Advisory Circular (AC) 20-128A contains the most recent guidance regarding minimization of
damage to the airplane from uncontained engine and APU failure. The AC/AMC is a product of
an ARAC harmonization committee.
3.1.2 Small fragments
Interpretation of the AMC concerning the small fragments can be summarised thus, there is
not a quantification of catastrophic cases to make because we should have taken all the
precautions necessary to avoid these situations.
There is no paragraph that indicates neither that we should not have catastrophic case for
small fragments nor that authorises us to have some.
Page 19 of 150
UERF GUIDELINES
All the items contained in the AMC are dealing with precautions which are possible to take and
which, with rega[to small fragments proved their efficiency (segregation, duplication, protection
by the structure of the aircraft) but, all that turns around systems.
It should be noted that inside paragraph 7b3, it is possible to shield components by a
supplemental element providing equivalent structure.
Dealing with structure means to consider design precautions in order to cope with thi[disc and
intermediate fragments. No consideration is taken into account for small fragment as they are
considered to not be significant and able to be stopped or deviated by several elements.
If some catastrophic cases appear with respect to small fragments, concerning systems, they
can be assessed as non-compliance of the design goal.
Extracts of AMC20-128A considering small fragments :
AMC20-128A §7. DESIGN CONSIDERATIONS.
Practical design precautions should be used to minimize the damage that can be caused
by uncontained engine and APU rotor fragments. The most effective methods for
minimizing the hazards from uncontained rotor fragments include location of critical
components outside the fragment impact areas or separation, isolation, redundancy, and
shielding of critical airplane components and/or systems. The following design
considerations are recommended:
(...)
AMC20-128A §7.b. Location of Critical Systems and Components
Critical airplane flight and engine control cables, wiring, flammable fluid carrying
components and lines (including vent lines), hydraulic fluid lines and components, and
pneumatic ducts should be located to minimize hazards caused by uncontained rotors and
fan blade debris. The following design practices should be considered:
AMC20-128A §7.b.(1).
Locate, if possible, critical components or systems outside the likely debris impact areas.
AMC20-128A §7.b.(2).
Duplicate and separate critical components or systems, or provide suitable protection if
located in debris impact areas.
AMC20-128A §7.b.(3).
Protection of critical systems and components can be provided by using airframe structure
or supplemental shielding.
These methods have been effective in mitigating the hazards from both single and
multiple small fragments within the ±15 degree impact area. Separation of multiplicated
critical systems and components by at least a distance equal to the 1/2 blade fragment
dimension has been accepted for showing minimization from a single high energy small
fragment when at least one of the related multiplicated critical components is shielded by
significant structure such as aluminium lower wing skins, pylons, aluminium skin of the
cabin pressure vessel, or equivalent structures.
Multiplicated critical systems and components positioned behind less significant structures
should be separated by at least a distance equal to the 1/2 blade fragment dimension, and
at least one of the multiplicated critical systems should be:
AMC20-128A §7.b.(3).(i).
Page 20 of 150
UERF GUIDELINES
Located such that equivalent protection is provided by other inherent structures such as
pneumatic ducting, interiors, bulkheads, stringers, or
AMC20-128A §7.b.(3).(ii).
Protected by an additional shield such that the airframe structure and shield material
provide equivalent shielding.
(...)
AMC20-128A §7.c. External Shields and Deflectors
When shields, deflection devices or airplane structure are proposed to be used to protect
critical systems or components, the adequacy of the protection, including mounting points
to the airframe structure, should be shown by testing or validated analyses supported by
test data, using the fragment energies supplied by the engine or APU manufacturer or
those defined in Paragraph 9. For protection against engine small fragments, as defined in
Paragraph 9, no quantitative validation as defined in Paragraph 10 is required if
equivalency to the penetration resistant structures listed (e.g. pressure cabin skins, etc.) is
shown.
AMC20-128A §8. ACCEPTED DESIGN PRECAUTIONS
Design practices currently in use by the aviation industry that have been shown to reduce
the overall risk, by effectively eliminating certain specific risks and reducing the remaining
specific risks to a minimum level, are described within this paragraph of the AC. Airplane
designs submitted for evaluation by the regulatory authorities will be evaluated against
these proven design practices.
(...)
AMC20-128A §8.b. Loss of Thrust
(...)
AMC20-128A §8.b.(3). Other Engine Damage
Protection of any other engines from some fragments should be provided by locating
critical components, such as engine accessories essential for proper engine operation
(e.g., high pressure fuel lines, engine controls and wiring, etc.), in areas where inherent
shielding is provided by the fuselage, engine or nacelle (including thrust reverser)
structure (see Paragraph 7).
(...)
AMC20-128A §8.e. Structural Integrity
Installation of tear straps and shear ties within the uncontained fan blade and engine rotor
debris zone to prevent catastrophic structural damage has been utilized to address this
threat.
AMC20-128A §9. ENGINE AND APU FAILURE MODEL
The safety analysis recommended in Paragraph 10 should be made using the following
engine and APU failure model, unless for the particular engine/APU type concerned,
relevant service experience, design data, test results or other evidence justify the use of a
different model.
(...)
AMC20-128A §9.d. Small Fragments
Page 21 of 150
UERF GUIDELINES
It should be assumed that small fragments (shrapnel) range in size up to a maximum

dimension corresponding to the tip half of the blade airfoil (with exception of fan blades)
and a fragment spread angle of ± 15 degrees. Service history has shown that aluminium
lower wing skins, pylons, and pressure cabin skin and equivalent structures typically resist
penetration from all but one of the most energetic of these fragments. The effects of
multiple small fragments should also be considered. Penetration of less significant
structures such as fairings, empennage, control surfaces and unpressurised skin has
typically occurred at the rate of 2 1/2 percent of the number of blades of the failed rotor
stage. Refer to paragraph 7b and 7c for methods of minimization of the hazards. Where
the applicant wishes to show compliance by considering the energy required for
penetration of structure (or shielding) the engine manufacturer should be consulted for
guidance as to the size and energy of small fragments within the impact area.
For APUs, where energy considerations are relevant, it should be assumed that the mass
will correspond to the above fragment dimensions and that it has a translational energy
level of one percent of the total rotational energy of the original rotor stage.
(...)
AMC20-128A §10. SAFETY ANALYSIS
The numerical assessment requested in paragraph 10 (c)(3) is derived from methods
previously prescribed in ACJ25.903. The haza[ratios provided are based upon evaluation
of various configurations of transport category airplanes, made over a period of time,
incorporating practical methods of minimizing the haza[to the airplane from uncontained
engine debris.
(...)
AMC20-128A §10.b. Drawings
Drawings should be provided to define the uncontained rotor impact threat relative to the
areas of design consideration defined in Paragraphs 7a(1) through (10) showing the
trajectory paths of engine and APU debris relative to critical areas. The analysis should
include at least the following:
AMC20-128A §10.b.(1).
Damage to primary structure including the pressure cabin, engine/APU mountings and
airframe surfaces.
NOTE: Any structural damage resulting from uncontained rotor debris should be
considered catastrophic unless the residual strength and flutter criteria of AC 25.571,
Paragraph 8(c), can be met without failure of any part of the structure essential for
completion of the flight. In addition, the pressurized compartment loads of § 25.365(e)(1)
and (g) must be met.
AMC20-128A §10.b.(2).
Damage to any other engines (the consequences of subsequent uncontained debris from
the other engine(s), need not be considered).
(...)
AMC20-128A §10.b.(8).
Damage to or inadvertent movement of aerodynamic surfaces (e.g.. flaps, slats,
stabilizers, ailerons, spoilers, thrust reversers, elevators, rudders, strakes, winglets, etc.)
and the resultant effect on safe flight and landing.
AMC20-128A §10.c. Safety Analysis Objectives.
Page 22 of 150
UERF GUIDELINES
(...)
AMC20-128A §10.c.(5).
A numerical risk assessment is not requested for the single fan blade fragment, small
fragments, and APU and engine rotor stages which are qualified as contained.
3.2 Philosophy / goals
This paragraph will cover the general meaning of the requirement, how Airbus interprets the
rules inside his aircraft design and some global understanding.
3.2.1 Airworthiness Authorities meaning
Concerning the Airworthiness Authorities, they would like to have the best aircraft in terms of
safety. That means to not suffer some accidents with loss of passengers.
In that way, they sponsored some task group to make evolve the requirement in a safer
objective. So they will take credit of any design precaution that are implemented onto the
aircraft, they will detail any information provided by the aircraft manufacturer in terms of safety
objective and they will accept the aircraft safety level if Airbus is compliant with the Rotor Burst
requirement objective.
3.2.2 World wide activities
3.2.2.1 Why choosing the one-third disc fragment
See document: Engine Disc Fragment Cinematic Model ref X72RP0605550.
3.2.2.2 Engine and Aircraft Certification versus UERF
In the frame of certification exercise, engine and aircraft manufacturers have to show
compliance with their own Airworthiness Authorities rules. Some mismatches between rules
can have great impacts on the mean of compliance that would be used for the exercise. One
example is the engine compliance with retention capability where aircraft compliance must be
shown for uncontained engine rotor failure small fragments.
It should be remind that in the Aircraft certification exercise, small fragments ejection is taken
into account because, it is assumed that a rotor stage will primarily create a hole inside the
engine case, leading the small fragment to not meet any engine case element and escape
throw the nacelle.
Aircraft rotor burst certification is made according to AMC20-128A objectives and definitions:
AMC20-128A§ 6. DEFINITIONS
AMC20-128A § 6.c. Uncontained Failure
For the purpose of airplane evaluations in accordance with this AC, uncontained failure of
a turbine engine is any failure which results in the escape of rotor fragments from the
engine or APU that could result in a hazard. Rotor failures which are of concern are those
where released fragments have sufficient energy to create a haza[to the airplane.
AMC20-128A § 6.f. Fragment Spread Angle
The fragment spread angle is the angle measured, fore and aft from the centre of the
plane of rotation of an individual rotor stage, initiating at the engine or APU shaft
centreline. Fan blade fragment spread angle is +- 15 degrees.
AMC20-128A § 7. DESIGN CONSIDERATIONS.
Practical design precautions should be used to minimize the damage that can be caused
by uncontained engine and APU rotor fragments. The most effective methods for
Page 23 of 150
UERF GUIDELINES
minimizing the hazards from uncontained rotor fragments include location of critical
components outside the fragment impact areas or separation, isolation, redundancy, and
shielding of critical airplane components and/or systems. The following design
considerations are recommended:
AMC20-128A § 7.a. Consider the location of the engine and APU rotors relative to critical
components, systems or areas of the airplane such as:
AMC20-128A § 7.a.(7). Engine air inlet attachments and effects of engine case
deformations caused by fan blade debris resulting in attachment failures;
AMC20-128A § 9. ENGINE AND APU FAILURE MODEL
AMC20-128A §9.d. Small Fragments
It should be assumed that small fragments (shrapnel) range in size up to a maximum
dimension corresponding to the tip half of the blade airfoil (with exception of fan blades)
and a fragment spread angle of ± 15 degrees. Service history has shown that aluminium
lower wing skins, pylons, and pressure cabin skin and equivalent structures typically resist
penetration from all but one of the most energetic of these fragments. The effects of
multiple small fragments should also be considered. Penetration of less significant
structures such as fairings, empennage, control surfaces and un-pressurized skin has
typically occurred at the rate of 2 1/2 percent of the number of blades of the failed rotor
stage. Refer to paragraph 7b and 7c for methods of minimization of the hazards. Where
the applicant wishes to show compliance by considering the energy required for
penetration of structure (or shielding) the engine manufacturer should be consulted for
guidance as to the size and energy of small fragments within the impact area.
For APUs, where energy considerations are relevant, it should be assumed that the mass
will correspond to the above fragment dimensions and that it has a translational energy
level of one percent of the total rotational energy of the original rotor stage.
AMC20-128A § 9.e. Fan Blade Fragment
It should be assumed that the fan blade fragment has a maximum dimension
corresponding to the blade tip with one-thi[the blade airfoil height and a fragment spread
angle of ± 15°. Where energy considerations are relevant the mass should be assumed to
be corresponding to the one-thi[of the airfoil including any part span shroud and the
transitional energy (neglecting rotational energy) of the fragment travelling at the speed of
its centre of gravity location as defined in Figure 5. As an alternative, the engine
manufacturer may be consulted for guidance as to the size and energy of the fragment.
The consideration taken for Fan blade fragment and Small fragment, inside the rotor burst
analysis is much more oriented on design precaution and installation of deviated routes over-
cross out of the ±15° impact area. The ejection of a Fan blade fragment and small fragment is
considered regardless of any containment capability from the engine case. No consideration is
taken to a complete airfoil ejection.
Engine certification is made by showing compliance with retention capability of the engine
case for one blade and for any stage and also on no hazardous condition to the aircraft.
Extracts of CS E requirement, more focussed on :
CS E 810 Compressor and Turbine Blade Failure (See AMC E 810)
(a) It shall be demonstrated that any single compressor or turbine blade will be contained
after failure and that no hazardous condition can arise to the aircraft as a result of other
Engine damage likely to occur before Engine shut down following a blade failure.
AMC E 810 Compressor and Turbine Blade Failure
Page 24 of 150
UERF GUIDELINES
AMC E 810 §1.1 Compliance with the requirements of JAR-E 810(a) may be shown in
accordance with either (a), (b) or (c) -
AMC E 810§1.1(a) By compliance with the tests detailed in 2 and 3,
…..
AMC E 810 §1.2 Tests for containment are detailed in 2 and those for running following
blade failure are detailed in 3, but where the most critical blade from the point of view of
blade containment is the same as that for the subsequent out-of-balance running, it is
acceptable to combine the test of 2 and 3.
……
AMC E 810 §2 Containment
AMC E 810 §2.1 General. Containment tests should be made, either -
AMC E 810 §2.1(a) On the complete Engine, or
AMC E 810 §2.1(b) On the individual stage concerned with the adjacent stators, where -
AMC E 810 §2.1 (b)(i) The actual strength of casing under the anticipated operation
conditions (e.g. temperature and pressure) is taken into account, and
AMC E 810 §2.1 (b)(ii) Adequate evidence is available such as to indicate that the aircraft
would not be endangered by the effect of the blade failure on subsequent blade rows.
AMC E 810 §2.2 Test Conditions. Separate tests on each compressor and turbine stage
adjudged to be most critical from the point of view of blade containment (account being
taken of blade size, material, radius of rotation, Rotational Speed and the relative strength
of the adjacent Engine casing under operating temperature and pressure conditions)
should be carried out in accordance with the conditions of (a) and (b).
NOTE: Where the Engine design is such that potentially critical parts overlie the
compressor or turbine casing (e.g. by-pass Engines, or reverse flow Engines where the
combustion systems may be outside the rotors) consideration should also be given to
possible hazardous internal damage caused by blades penetrating the rotor casings, even
though they are contained within the external geometry of the Engine. Consideration
should also be given to ACJ E 520(c)(2).
…….
AMC E 810 §2.3 Condition after Tests. On completion of the tests, complete power failure
is acceptable, but there should be -
AMC E 810 §2.3(a) Containment by the Engine without causing significant rupture or
hazardous distortion of the Engine outer casing or the expulsion of blades through the
Engine casing or shield.
NOTE: Should debris be ejected from the Engine intake or exhaust, the approximate size
and weight should be reported with an estimate of its trajectory and velocity, so that the
effect upon the aircraft can be assessed.
AMC E 810 §2.3(b) No haza[to the aircraft from possible internal damage to the Engine as
a result of blades penetrating the rotor casings even though contained within the external
geometry of the Engine.
3.2.2.3 Fan Blade Off test
In the frame of Fan Blade Off certification test, some fragments of the blade may not be
contained by the engine’s case. If this situation heaper the engine’s manufacturer may ask the
Page 25 of 150
UERF GUIDELINES
aircraft’s manufacturer to consider the fragment ejection and to assess the consequences on
the aircraft safety level is negligible. This assessment would be done in the frame of CS E
engine certification exercise and conclusions could potentially be included into the engine
certification dossier.
Two categories of impacts can be identified :
x Fuselage impacts : Airbus demonstrate that the level of risk for this kind of impacts is
minimized by the design precaution that are implemented on the aircraft (systems segregation,
structure protection, ...). These design precautions are implemented on the whole aircraft, also
for areas outside the +/-15° requested in FAR/CS25 (it must be noted that outside this limit,
neither justification is requested by the AA nor provided by the aircraft manufacturer in the
frame of the certification),
x Cross engine impacts : Engine manufacturer carried out a study on the fragments trajectories
by taking into account the effects of aerodynamic drag. The goal being to know if the
fragments ejected by an internal engine could have an impact on the external adjacent, and
conversely. This method has never been used by Airbus for aircraft certification and thus
refused to validate this method. The only justification provided for this type of impact was
made by the nacelle manufacturer, which ruled on the fact that the damage inflicted on the
nacelle (nozzle especially) by the fragments listed would not have serious consequences on
the aircraft safety level.
3.2.3 Airbus way
In a general way of working, Airbus has participated to the requirement evolution in order to be
able to get benefit for his aircraft development and safety level.
It must be noted that the mean of compliance provided inside the requirement is more or less
open in compliance methodology. It is possible for aircraft manufacturer to use some other
meaning but, in that case he must demonstrate that the mean of compliance used is
equivalent or better than what was proposed by the requirement itself.
3.3 Politics
3.3.1 Airbus view
In the aircraft manufacturing, Airbus is a greater competitor and has to make effort to get the
best aircraft. During a project development, especially for Rotor Burst activities, there are
some time consuming works. One of them is the quantification of the remaining risk where no
design modification would improve the situation. The requirement offers several ways and
decision to do one instead of the other is not always well understood.
3.3.1.1 Why choosing Alternative Engine Failure Model
For each new aircraft, the same question comes about the use of +/-5° chi spread angle for
the one-thi[disc fragment analysis instead of a +/-3° chi spread angle.
AMC20-128A §9. ENGINE AND APU FAILURE MODEL. The safety analysis
recommended in Paragraph 10 should be made using the following engine and APU
failure model, unless for the particular engine/APU type concerned, relevant service
experience, design data, test results or other evidence justify the use of a different model.
AMC20-128A §9a. Single One-Thi[Disc fragment. It should be assumed that the one-
thi[disc fragment has the maximum dimension corresponding to one-thi[of the disc with
one-thi[blade height and a fragment spread angle of +/-3°.(...)
AMC20-128A §9b. Intermediate Fragment. It should be assumed that the intermediate
fragment has a maximum dimension corresponding to one-thi[of the bladed disc radius
and a fragment spread angle of +/-5°. (...)
Page 26 of 150
UERF GUIDELINES
AMC20-128A §9c. Alternative Engine Failure Model. For the purpose of the analysis, as
an alternative to the engine failure model of Paragraphs 9a and b, the use of a single one-
thi[piece of disc having a fragment spread angle +/-5° would be acceptable, provided the
objectives of Paragraph 10c are satisfied.
(...)
AMC20-128A §10 SAFETY ANALYSIS.
The numerical assessment requested in Paragraph 10c(3) is derived from methods
previously prescribed in ACJ No. 2 to CS 25.903(d)(1). The haza[ratios provided are
based upon evaluation of various configurations of large aeroplanes, made over a period
of time, incorporating practical methods of minimising the haza[to the aeroplane from
uncontained engine debris.
(...)
AMC20-128A §10c. Safety Analysis Objectives. It is considered that the objective of
minimising hazards will have been met if:
AMC20-128A §10c(1) The practical design considerations and precautions of Paragraphs
7 and 8 have been taken;
AMC20-128A §10c(2) The safety analysis has been completed using the engine/APU
model defined in Paragraph 9;
AMC20-128A §10c(3) For CS–25 large aeroplanes and CS–23 commuter category
aeroplanes, the following haza[ratio guidelines have been achieved:
AMC20-128A §10c(3) (i) Single One-Thi[Disc Fragment. There is not more than a 1 in 20
chance of catastrophe resulting from the release of a single one-thi[disc fragment as
defined in Paragraph 9a.
AMC20-128A §10c(3) (ii) Intermediate Fragment. There is not more than a 1 in 40 chance
of catastrophe resulting from the release of a piece of debris as defined in Paragraph 9b.
AMC20-128A §10c(3) (iii) Multiple Disc Fragments. (Only applicable to any duplicated or
multiplicated system when all of the system channels contributing to its functions have
some part which is within a distance equal to the diameter of the largest bladed rotor,
measured from the engine centreline). There is not more than 1 in 10 chance of
catastrophe resulting from the release in three random directions of three one-
thi[fragments of a disc each having a uniform probability of ejection over the 360°
(assuming an angular spread of ±3° relative to the plane of the disc) causing coincidental
damage to systems which are duplicated or multiplicated.
NOTE: Where dissimilar systems can be used to carry out the same function (e.g.
elevator control and pitch trim), they should be regarded as duplicated (or multiplicated)
systems for the purpose of this subparagraph provided control can be maintained.
The numerical assessments described above may be used to judge the relative values of
minimisation. The degree of minimisation that is feasible may vary depending upon aeroplane
size and configuration and this variation may prevent the specific haza[ratio from being
achieved. These levels are design goals and should not be treated as absolute targets. It is
possible that any one of these levels may not be practical to achieve.
Taking into the above requirement, aircraft manufacturer has to demonstrate that the
remaining risk level is compliant with either 1/20 for one-thi[disc fragments with +/-5° chi
spread angle or, 1/20 for one-thi[disc fragments with +/-3° chi spread angle and 1/40 for
intermediate fragments with +/-5° chi spread angle.
Page 27 of 150
UERF GUIDELINES
Considering that most of the systems or structures are continuous along the aircraft, there is
no reduction, by using +/-3° chi spread angle instead of +/-5° chi spread angle, for the 1/20
contribution. In other terms, dividing a straight risk window by 10 (for +/-5° chi spread angle),
or dividing a reduced one by 6 (for a +/-3° chi spread angle) will not reduce the contribution.
The following example aim at providing data to highlight what is stated above. Example treated
in the following paragraph deal with : 'M risk window of 1° over +/-3° and +/-5° chi spread
angle :
Figure 1: Typical Risk Window (Top +/-3°, Bottom +/-5°)
1 E °1 D § N ª T § 'M ·¸º ·¸½

F 5q M
'F
max
°
Probability equation : P * ¦ ® * ¦ ¨ ¦ «¦ ¨ K ij * ³ * ³ f ( F ,M ) * » ¾
E l 1 °̄ D k 1 ¨ j 1 « i 1 ¨© F 5q 10q M 360q ¸¹» ¸°
© ¬ min ¼ ¹¿
F 5q M 94q
'F 'M
³
F 5q 10q
* ³ f ( F ,M ) *
M 93q 360q
which correspond to “Target solid angle viewed from disc” divided
'F 'M 'F * 'M

by “Potential released solid angle” moreover * which provide for the
10q 360q 3600q
5 (5) 94 93 10 *1 1
above example a contribution of *
10q 360q 10 * 360 360
F 3q M 92q
'F 'M
³
F 3q
* ³ f ( F ,M ) *
6q M 91q 360q
which correspond to “Target solid angle viewed from disc” divided
'F 'M 'F * 'M

by “Potential released solid angle” moreover * which provide for the
6q 360q 2160q
3 (3) 92 91 6 *1 1
above example a contribution of *
6q 360q 6 * 360 360
Therefore, using the +/-3° approach may only bring a benefit if a significant portion of the risk
is provided by a risk window ranging between +3° and +5° or -3° and -5°. Moreover, the
demonstration of the 1/40 would require a full investigation for intermediate fragment risk
windows over the +/-5° as, if the one-thi[disc risk windows over +/-3° are used to represent the
intermediate fragment risk inside the same spread angle, it would be difficult to demonstrate
that the 1/40 objective is reached.
During A3456 certification exercise, the +/-3° one-thi[disc fragment approach was investigated
for 1/20 evaluation, the conclusion was that the risk level was almost similar and that there
was no benefit in pursuing it.
As a conclusion, the table below describe which objective must be reached :
BASIC MODEL ALTERNATIVE ENGINE FAILURE MODEL
Fragment Spread Quantitative Fragment Spread Quantitative
angle Objectives angle Objectives
Page 28 of 150
UERF GUIDELINES
Single 1/3rd +/-3° 1/20

Single 1/3rd
Disc +/-5° 1/20
Disc
Intermediate +/-5° 1/40
Fan Blade +/-15° No quantitative Fan Blade +/-15° No quantitative
analysis analysis
Small +/-15° No quantitative Small +/-15° No quantitative
analysis analysis
See X72PP0800592 UERF NORMAL VS ALTERNATIVE MODEL COMPARISON
Page 29 of 150
UERF GUIDELINES
3.3.2 Forces in the world

The Uncontained Engine Rotor Failure is a world wide concern, either in terms of
airworthiness authorities or in terms of aircraft manufacturer.
In airworthiness team is focussing on the European Aviation Safety Agency (EASA) and on the
Federal Aviation Administration (FAA). Some other agency are existing in the world and are in
concern for particular issue that have interest for them, e.g. : Transport Canada – Civil Aviation
with the Ram Air Turbine blade failure.
It must be noted that the EASA is a merged agency for the European country either they have
kept their own authority.
Some interest must be paid to international offices such as :
x International Civil Aviation Organisation (ICAO),
x Aerospace Industry Association (AIA),
x European Association of Aerospace Industries (AECMA)
Concerning the aircraft manufacturer, Airbus and Boeing are the biggest but it must be remind
that Bombardier or Dassault are concerned by the Rotor Burst state of the art.
From several years, the Power plant Integration Harmonisation Working Group (PPIHWG)
constituted by either Engine and Aircraft manufacturer and also by Airworthiness Authorities
has produced documents and recommendations for requirement evolution proposal. Some of
them have been published as rules text and some others as draft.
Page 30 of 150
UERF GUIDELINES
4 In Service Airbus A/C certified data

4.1 Certification basis for each A/C
Since 1980, UERF certification is done according to ACJ n°2 to 25.903d1 and AC/ACJ 20-
128A dated 1997.The up to date requirement compliance method is included inside the EASA
AMC 20-128A.
4.1.1 Single Aisle
4.1.1.1 A320-321-319-318 except PW6000 engines
The A320 Joint Certification Basis is defined in document AA/J/G/120/86.
The Single Aisle family (except of A318-121 and A318-122 both fitted with Pratt & Whitney
engines) is certified versus JAR-25 change 11 to14 that are roughly the same for UERF
concerns.
For showing compliance with JAR-25.903(d)(1) mean of compliance is taken from ACJ No. 2
to JAR 25.903 (d)(1).
4.1.1.2 A318-121 and A318-122 fitted with Pratt & Whitney engines
The certification basis for such aircraft is JAR25 change 15 and referring to 25.903d1 mean of
compliance is taken from AMJ20-128A dated 2000.
4.1.1.3 A320 NEO
The certification basis for such aircrafts is CS 25 amendment 11 & FAR 25 amendment 135.
4.1.2 Wide Body (A300 and A310)
The certification basis for such aircrafts shows compliance of the design with the requirements
of the FAR 25, Parag. 25 903 (d) (1) with regard to an uncontained engine rotor failure
4.1.3 Long Range
4.1.3.1 A330 and A340-200/300
Demonstration of compliance is achieved according to a Certification Authorities accepted
Method (ACJ N°2 to JAR 25.903 d1).
4.1.3.2 A340-500/600
This Airbus product has been certified under JAR-25 change 14 and Interpretative Materials
issued for A340-500/-600 Type Certification ( IM P-1017 Engine and APU uncontained rotor
failure). Reference to AMJ20-128A is taken into consideration for Dray Bay sizing and
Shielding definition.
4.1.4 A380
The product has been certified in accordance with AMC/AC 20-128A following CS/FAR
25.0903 d01 philosophy.
4.1.5 A400M
The product has been certified in accordance with AMC/AC 20-128A following CS/FAR
25.0903 d01 philosophy.
Page 31 of 150
UERF GUIDELINES
4.1.6 A350
The certification will be performed using a demonstrating compliance with CS / FAR
25.903(d)(1) with respect to the A350 UERF PRA regarding method, responsibilities and
schedule.
4.2 Certification reports
This chapter provides up to date data on certification reports for Airbus Aircraft certified in
2012 at latest. Details on enclosed memos and level of certified residual risk is also provided.
4.2.1 Wide Body

Residual Risk
REFERENCE ISSUE TITLE DATE ENCLOSED REFERENCES AIRCRAFTS ENGINES ENG1 ENG2 AVERAGE %
00//A.000.10110
DOCUMENTS DE AI/V-C 1106/82
SYNTHESE SUR LES 458.146/70
A300 (B2-1A, B4-203,
DONNEES DE 461.175/72 [05]
AI/V-C 1130/82 1 16/6/82 B2-1A FAA, B2-1C FAA, 1,6E-09 /FH 1,6E-09 /FH
CERTIFICATION RELATIVES 461.079/74
B4-2C FAA)
AUX ECLATEMENTS DE 00//A.002.10201
MOTEUR SUR A300 497.060/79 [02]
AI/V-C 826/82
461.016/83 [01]
461.415/83
DRW A310-05-54-0003 [B]
UNCONTAINED ENGINE A310-200-00 and A310-
42X00210000/C22 2 12/9/83 DRW A310-05-54-0004 [B] P&W JT9D-7R4 D1/E1 0,049 0,05 0,0495 99,0%
ROTOR FAILURE 200-01
DRW A310 09 29 043
DRW A310 09 29 0432
454.031/81
A310-200-00, A310-200-
461.016/83 [02]
01, A310-200-04, A310-
A310-324/A310-325 14/11/84 461.074/86
200-C-01, A310-322-00
42X00210000/C22 4 to 13 UNCONTAINED ENGINE to 461.220/87 [02] none none
and 01, A310-304-00
ROTOR FAILURE 31/01/92 461.394/87 [02]
and 01, A310-324-00,
461.473/85 [03]
A310-300-05
SUMMARY VALIDATION
461.016/84 [05]
42X00210006/C30 1 NOTE FOR A300C4-605R 9/6/99 A300-C4-605 Variant F none none
461.062/88 [05]
VARIANT F
A300B4-620 UNCONTAINED
42X00210006/C32 1 14/2/84 461.016/84 [01] A300-B4-620-00 P&W JT9D-7R4-H1 0,0496 0,0455 0,04755 95,1%
ENGINE ROTOR FAILURE
A300B4-601 UNCONTAINED 05/04/84 A300-B4-620-00, A300-

42X00210006/C32 2 to 3 ENGINE ROTOR FAILURE to 461.016/84 [03] C4-620-00, A300-B4-601- P&W JT9D-7R4H1 0,0488 0,0494 0,0491 98,2%
JUSTIFICATION 08/08/85 00
461.016/84 [03] A300-B4-620-00, A300-

ENGINE ROTOR BURST P&W JT9D-7R4H1
42X00210006/C32 5 2/3/88 461.062/88 [01] C4-620-00, A300-B4- 0,0488 0,0494 0,0491 98,2%
ANALYSIS (covers GE CF6-80-C2)
461.394/86 600R-01
A300-B4-620-00, A300-
A300F4-605R
C4-620-00, A300-B4-
42X00210006/C32 6 UNCONTAINED ENGINE 16/12/93 424.853/93 [01] none none
600R-01, A300-F4-605R-
ROTOR FAILURE
00
UNCONTAINED ENGINE
42K710P1012/C12 2 ROTOR FAILURE ON A300- 30/8/95 461.0735/95 [02] A300-600ST P&W JT9D-7R4H1 0,0488 0,0494 0,0491 98,2%
600ST
461.016/84 [01] A300-B4-620-00, A300-

ENGINE ROTOR BURST
461.016/84 [02] C4-620-00, A300-B4-
42X00210206/C30 2 SUMMARY VALIDATION 30/6/00 P&W JT9D-7R4H1 0,0488 0,0494 0,0491 98,2%
461.016/84 [03] 600R-01, A300-F4-605R-
NOTE FOR A300F4-622R
461.062/88 [01] 00, A300-F4-622R-00
Table 1: Wide Body UERF certification reports
Page 32 of 150
UERF GUIDELINES
4.2.2 Single Aisle

Residual Risk
ENCLOSED
REFERENCE ISSUE TITLE DATE REFERENCES AIRCRAFTS ENGINES ENG1 ENG2 AVERAGE %
COMPLIANCE SHEETS FOR TURBINE A320-111 BASIC CERTIFICATION JOINT
00D720P0000/C00 01 06/01/1988 418.773/87
ENGINE ROTOR FAILURE AA (DGAC/CAA/LBA/RLD)
A320-111 BASIC CERTIFICATION JOINT
COMPLIANCE SHEETS FOR TURBINE
00D720P0000/C00 02 28/01/1988 418.088/88 AA (DGAC/CAA/LBA/RLD)
ENGINE ROTOR FAILURE
A320-212 BASIC JAA CERTIFICATION
UNCONTAINED ENGINE ROTOR A320-111 BASIC CERTIFICATION JOINT
00D720P0001/C0S 02 FAILURES - ANALYSIS OF 28/01/1988 418.157/87 [04] AA (DGAC/CAA/LBA/RLD) CFM56-5A 0,0467 0,0463 0,0465 93,0%
CONSEQUENCES A320-212 BASIC JAA CERTIFICATION
UNCONTAINED ENGINE ROTOR
A320-231 BASIC CERTIFICATION IAE
00D720P0501/C2S 01 FAILURES - ANALYSIS OF 07/09/1988 418.118/88 [01] IAE - V2500 0,0474 0,0476 0,0475 95,0%
ENGINES (RSN° 2)
CONSEQUENCES 418.157/87 [04]
418.097/89 [01]
UERF - ETOPS FOR FUEL SYSTEM, A320-100/-200: DESIGN ETOPS
00D720P0002/C22 01 06/03/1989 418.137/89 [01]
HYDRAULIC AND ELECTRIC POWER CLEARANCE
459.350/88 [03]
418.118/88 [03] A320-232 / A320-233: TYPE
00D720P0501/C2S 03 FAILURES - ANALYSIS OF 01/07/1993 IAE - V2500 0,0474 0,0476 0,0475 95,0%
418.157/87 [04] CERTIFICATION JAA
CONSEQUENCES
COMPLIANCE SHEETS FOR TURBINE A320-232 - A320-233 : JAA TYPE
00D720P0570/C20 01 07/07/1993 418.372/93 [01]
ENGINE ROTOR FAILURE CERTIFICATION
UNCONTAINED ENGINE ROTOR 418.424/93 [01]
A321-131 : JAA CERTIFICATION IAE
00E720P0501/C2S 01 FAILURES - ANALYSIS OF 15/11/1993 418.118/88 [03] IAE - V2500 0,0474 0,0476 0,0475 95,0%
ENGINES
CONSEQUENCES 418.157/87 [04]
COMPLIANCE SHEETS FOR TURBINE A321-131 : JAA CERTIFICATION IAE
00E720P0500/C20 01 26/11/1993 418.543/93 [01]
ENGINE ROTOR FAILURE ENGINES
COMPLIANCE SHEETS FOR TURBINE A321-111 - A321-112 : JAA TYPE
00E720P0000/C00 01 08/02/1994 418.102/94 [01]
ENGINE ROTOR FAILURE CERTIFICATION CFM ENGINES 5B1
UNCONTAINED ENGINE ROTOR A321-111, A321-112, A321-212, A321-
418.069/94 [01]
00E720P0001/C0S 01 FAILURES - ANALYSIS OF 14/02/1994 213: JAA TYPE CERTIFICATION CFM CFM56-5B 0,046 0,0467 0,04635 92,7%
418.157/87 [04]
CONSEQUENCES ENGINES 5B1
418.073/94 [01] A320-214 : JAA TYPE CERTIFICATION CFM56-5B
00D720P0001/C0S 03 FAILURES - ANALYSIS OF 30/01/1995 0,0467 0,0463 0,0465 93,0%
418.157/87 [04] A319: CORPORATE JET (5A still valid)
CONSEQUENCES
COMPLIANCE SHEETS FOR TURBINE A320-231 BASIC CERTIFICATION IAE
00D720P0500/C20 01 30/01/1995 461.0038/95 [01]
ENGINE ROTOR FAILURE ENGINES (RSN° 2)
415.018/94 [01]
UNCONTAINED ENGINE ROTOR 415.163/93 [01] A321-131, A321-111/112: ETOPS
00E720P0002/C02 01 13/04/1995
FAILURES - ETOPS RISK INCREASE 461.0309/95 [01] CLEARANCE
461.0310/95 [01]
461.1862/95 [01]
A319-112 : JAA CERTIFICATION
00J720P0031/C0S 01 A319/CFM 56-5B ANALYSIS 27/02/1996 418.157/87 [04] CFM56-5B 0,0458 0,0454 0,0456 91,2%
A319: CORPORATE JET
418.073/94 [01]
COMPLIANCE SHEETS FOR TURBINE A319-112 : JAA CERTIFICATION
00J720P0070/C00 01 27/02/1996 461.0287/96 [01]
ENGINE ROTOR FAILURE A319: CORPORATE JET
A319-112, A319-115, A319CJ : JAA
461.1862/95 [02]
CERTIFICATION
00J720P0031/C0S 02 A319/CFM 56-5B ANALYSIS 04/04/1996 418.157/87 [04] CFM56-5B 0,0458 0,0454 0,0456 91,2%
A318-111, A318-112 JAA TYPE
418.073/94 [01]
CERTIFICATION
A319-112 : JAA CERTIFICATION
COMPLIANCE SHEETS FOR TURBINE A319: CORPORATE JET
00J720P0070/C00 02 04/04/1996 461.0287/96 [02]
ENGINE ROTOR FAILURE A318-111, A318-112 JAA TYPE
CERTIFICATION
UERF ANALYSIS - CFM56-5A ENGINE 461.0633/96 [01]
00J720P0001/C0S 01 15/05/1996 A319-113: JAA CERTIFICATION CFM56-5A 0,0476 0,0474 0,0475 95,0%
ON A319 A/C 418.157/87 [04]
461.1560/96 [01]
418.157/87 [04] A319-132, A319-133 JAA
00J720P0501/C0S 01 A319/IAE V2500-A5 ANALYSIS 27/11/1996 IAE - V2500 0,0487 0,048 0,04835 96,7%
418.118/88 [03] CERTIFICATION
418.424/93 [01]
415.0059/96 [01]
A319 ETOPS-UNCONTAINED ENGINE 415.163/93 [02] A319/IAE ETOPS CLEARANCE AGAINST
00J720P0002/C02 01 04/12/1996
ROTOR FAILURES - RISK ANALYSIS 461.0309/95 [02] AMJ120-42 / IL20
461.2183/96 [01]
415.0059/96 [01]
A319/CFMI CLEARANCE FOR ETOPS
A319 ETOPS-UNCONTAINED ENGINE 415.163/93 [02]
00J720P0002/C02 01 05/12/1996 A318-111/-112/-121/-122 JAA ETOPS
ROTOR FAILURES - RISK ANALYSIS 461.0309/95 [02]
CERTIFICATION
461.2183/96 [01]
SUMMARY/VALIDATION FOR A319-
00J720P0015/C00 01 09/06/1999 A319-115 JAA CERTIFICATION
115 WITH CFM56-5B
COMPLIANCE SHEETS FOR TURBINE A321-212/-213: JAA TYPE
00E720P0000/C00 02 05/06/2001 526.0734/200
ENGINE ROTOR FAILURE CERTIFICATION
BASIC DEFINITION FOR A321-200 A321-212/-213: JAA TYPE
00E720P0020/C00 02 05/06/2001 526.0735/2001
WITH CFM 56-5B CERTIFICATION
BASIC DEFINITION FOR A321-200
00E720P0520/C00 02 05/06/2001 526.0733/2001 A321-232: JAA TYPE CERTIFICATION
WITH IAE V2500-A5
00P720P0001/C0S 01 A318 / CFM 56-5B UERF analysis 18/03/2003 P72RP0300594 [01] A318-111 JAA TYPE CERTIFICATION CFM 56-5B 0,0482 0,0464 0,0473 94,6%
00P720PW020/C00 01 A318 - PW 6000 CERTIFICATION PROG 24/11/2004 P72RP0412155 [01] A318-PW
00P720PW001/C0S 01 A318 - PW 6000 UERF ANALYSIS 11/08/2005 P72RP0508177 [01] A318-121/-122 JAA CERTIFICATION PW6000 0,0464 0,0456 0,046 92,0%
00P720PW001/C0S 02 A318 - PW 6000 UERF ANALYSIS 03/05/2007 P72RP0508177 [02] A318-121/-122 JAA CERTIFICATION PW6000 0,0476 0,0473 0,04745 94,9%
Table 2: Single Aisle UERF certification reports
Page 33 of 150
UERF GUIDELINES
4.2.3 Long Range

Long range
Residual Risk
ENCLOSED
REFERENCE ISSUE TITLE DATE REFERENCES AIRCRAFTS ENGINES ENG1 ENG2 ENG3 ENG4 AVERAGE %
COMPLIANCE SHEETS FOR TURBINE A340-211/-212/-311/-312/-313
00F720P0000/C00 01 13/11/1992 461.842/92 [01]
ENGINE ROTOR FAILURE JAA CERTIFICATION
A340-211/-212/-311/-312 JAA
00F720P0001/C0S 02 FAILURES - ANALYSIS OF 18/11/1992 461.198/92 [02] CFM56-5C 0,0402 0,0297 0,0313 0,0368 0,0345 69,0%
CERTIFICATION
CONSEQUENCES
461.078/93 [02] A340-211/-311 BASIC
00G720P0001/C0S 02 FAILURES - ANALYSIS OF 13/09/1993
CONSEQUENCES
461.078/93 [02] A330-301 JAA
00G720P0001/C0S 02 FAILURES - ANALYSIS OF 13/09/1993 GE CF6-80-E1 0,0402 0,0424 0,0413 82,6%
CONSEQUENCES
UNCONTAINED ENGINE ROTOR A330-201/-202/-203/-301/-
461.078/93 [03]
00G720P0001/C0S 03 FAILURES - ANALYSIS OF 06/10/1993 341/-342 JAA & ETOPS GE CF6-80-E1 0,0402 0,0424 0,0413 82,6%
461.410/94 [01]
CONSEQUENCES CERTIFICATION
UNCONTAINED ENGINE ROTOR A330-223/-321/-322/-323:
00G720P0021/C0S 01 FAILURES - ANALYSIS OF 10/05/1994 461.200/94 [01] JAA & ETOPS PW 4164/4168 0,0399 0,0429 0,0414 82,8%
A330-243/-341/-342/-343 :
00G720P0041/C0S 01 FAILURES - ANALYSIS OF 04/10/1994 461.697/94 [01] RR TRENT 700 0,045 0,0476 0,0463 92,6%
JAA CERTIFICATION
CONSEQUENCES
A340-213/-313 : JAA
00F720P0001/C0S 03 FAILURES - ANALYSIS OF 06/03/1995 461.198/92 [02] CFM56-5C 0,0402 0,0297 0,0313 0,0368 0,0345 69,0%
CERTIFICATION
CONSEQUENCES
UNCONTAINED ENGINE ROTOR A330-201/-202/-203/-223/-243
00G720P0200/C0S 01 FAILURES - ANALYSIS OF 11/02/1998 520.2216/97 [01] JAA & ETOPS GE CF6-80E1 0,0406 0,0427 0,04165 83,3%
00G720P0200/C0S 01 FAILURES - ANALYSIS OF 11/02/1998 520.2216/97 [01] JAA & ETOPS PW 4164/4168 0,0405 0,0433 0,0419 83,8%
00G720P0200/C0S 01 FAILURES - ANALYSIS OF 11/02/1998 520.2216/97 [01] JAA & ETOPS RR TRENT 772 0,0452 0,0481 0,04665 93,3%
A330-201/-202/-203 JAA
00G720P4202/C0S 01 COMPLIANCE RECORD SHEET A330-200 30/03/1998 520.1008/98 [01]
CERTIFICATION
A330-223: JAA
CERTIFICATION
A340-211/-212/-213/-311/-
00F720P0001/C0S 04 FAILURES - ANALYSIS OF 15/07/1998 461.198/92 [03]
312/-313
CONSEQUENCES
COMPLIANCE RECORD SHEET A330-243 A330-243 : JAA & ETOPS
00G720P4243/C0S 01 16/12/1998 520.3678/98 [01]
UERF CERTIFICATION
A330-323 JAA
CERTIFICATION
COMPLIANCE RECORD SHEET A330-343 A330-343 : JAA
00G720P4343/C0S 01 10/08/1999 520.2492/99 [01]
VERF CERTIFICATION
Uncontained Engine Rotor Failure
526.0368/2002 [02] A340-600 JAA
00F720PA001/C6S 02 Analysis of consequences 19/07/2002 RR TRENT 500 0,051 0,0569 0,0513 0,05 0,0523 104,6%
for A340-600 equipped with Trent 500
Uncontained Engine Rotor Failure, analysis
526.1453/2002 [02] A340-500 JAA
00F720PA001/C5S 02 of consequences for A340-500 equipped 28/10/2002 RR TRENT 500 0,0517 0,0576 0,0522 0,0504 0,052975 106,0%
with Trent 500
A330-323/-343 & A330-202/-
GE CF6-80E1
00G720P0050/C0S 01 A330 ENHANCED UERF ANALYSIS 26/05/2003 G72RP0302948 [01] 223/-243 JAA 0,0404 0,0463 0,04335 86,7%
(A330-300)
CERTIFICATION
A330-243/-341/-342/-343 : PW 4164/4168
00G720P0050/C0S 01 A330 ENHANCED UERF ANALYSIS 26/05/2003 G72RP0302948 [01] 0,0394 0,0461 0,04275 85,5%
JAA CERTIFICATION (A330-300)
RR TRENT
A330-243/-341/-342/-343 :
00G720P0050/C0S 01 A330 ENHANCED UERF ANALYSIS 26/05/2003 G72RP0302948 [01] 700 0,0455 0,0525 0,049 98,0%
JAA CERTIF
(A330-300)
A330-323/-343 & A330-202/-
GE CF6-80E1
00G720P0050/C0S 01 A330 ENHANCED UERF ANALYSIS 26/05/2003 G72RP0302948 [01] 223/-243 JAA 0,0407 0,0466 0,04365 87,3%
(A330-200)
CERTIFICATION
A330-243/-341/-342/-343 : PW 4164/4168
00G720P0050/C0S 01 A330 ENHANCED UERF ANALYSIS 26/05/2003 G72RP0302948 [01] 0,0399 0,0465 0,0432 86,4%
JAA CERTIF (A330-200)
RR TRENT
A330-243/-341/-342/-343 :
00G720P0050/C0S 01 A330 ENHANCED UERF ANALYSIS 26/05/2003 G72RP0302948 [01] 700 0,0457 0,053 0,04935 98,7%*
JAA CERTIF
(A330-200)
A330-223F/-243F JAA
00G720PF200/C0S 01 A330-200 FREIGHTER UERF ANALYSIS 17/02/2010 G72RP0929220 [01] PW 4170 91%**
CERTIFICATION
A330-223F/-243F JAA
00G720PF200/C0S 01 A330-200 FREIGHTER UERF ANALYSIS 17/02/2010 G72RP0929220 [01] RR TRENT 700 99,0%
CERTIFICATION
TBC with Hubert A3456 Enhanced
TBC with Hubert A3456-HGW
TBC with Hubert A340-500 SIA
TBC with Hubert A340-600 SIA
TBC with Hubert A330 MRTT
Table 3: Long Range UERF certification reports
* 92% with energy absorption consideration **93% with energy absorption consideration
Page 34 of 150
UERF GUIDELINES
4.2.4 Double Deck (A380)

Residual Risk
ENCLOSED
Rotor Burst
Analysis on
L72RP0615202 [01] A380-841 & Rolls-Royce
00L720V0401/P8S 01 A380-800 24/08/2006 91,4%
L72RP0615204 [01] A380-842 T900-16
powered with
RR engine
Rotor Burst
Analysis on
L72RP0615202 [02] A380-841 & Engine Alliance
00L720V0601/C8S 01 A380-800 24/08/2006 91,9%
L72RP0615204 [01] A380-842 GP7200
powered with
RR engine
Table 4: Double Deck UERF certification reports
4.2.5 A400M
Residual Risk
ENCLOSED
EuroProp
International
A400M UERF
M72RP1101203 [01] TP400-D6
CCM720A0020/C1S 01 and PBR 12/10/2011 A400M 102,2%
M72RP1115625 [01] engines and
analysis
FH386
propellers
Table 5: A400M UERF certification reports
Page 35 of 150
UERF GUIDELINES
5 Powerplant characteristics and debris model
5.1 Differences between engine’s manufacturer and UERF data

The main difference between engine and UERF data is for the blade length definition.
For the engine manufacturer, the blade length is the part of the blade which is inside the air
vain that means, no credit is taken from the blade root.
For the UERF point of view, as a general state of the art, the blade length is the difference
between the Rotor Tip Radius and the Rotor Rim Radius, taking into account the blade root.
Figure 2: Blade Length Definition
This difference has an impact on the small fragment definition and on the fragment energy
definition.
Fragment energy is assumed to be the translation one neglecting the rotation energy. UERF
energy data is obtain by calculation whereas the engine manufacturer provide an energy
which is obtained by digital mock up modelling.
Using energy data from UERF point of view would lead us to be conservative, using energy
from engine manufacturer would lead us to be optimistic / realistic.
Page 36 of 150
UERF GUIDELINES
5.2 Power plant Geometrical characteristics (UERF-Data)

ACRONYM CHARACTERISTIC UNIT DESCRIPTION
Datum system same referential as per PPS geometry CATIA model
STAGE Stage Name of the stage
DOR Direction of 1 = clockwise; -1 = counterclockwise (remember, view
rotation looking forward)
XSTA Axial Station mm Axial Station in Datum system
RT Rotor Tip radius mm
RR Rotor Rim Radius mm
RB Rotor Bore mm
Radius
RH Rotor Hub Radius mm
BL Blade Length mm
DT Disc Thickness mm Thickness given by measuring size Max of disc
BT Projected Blade mm Width given by measuring size Max of blade
width
NBRB Number of Blade
TBM Total Blade Mass Kg Mass of all the blades
AM Aerofoil mass Kg Mass of one aerofoil
WBM Whole blade KG Total mass per blade including root and aerofoil
mass
DM Disc Mass Kg Mass of the disc only
REDLINE Redline speed RPM Redline speed of the dedicated stage
RCOGA Aerofoil CoG mm Radial position of the centre of gravity of the airfoil
radius only
XCOGA Aerofoil CoG mm Axial position of the centre of gravity of the airfoil only
station
RCOGB Blade CoG radius mm Radial position of the centre of gravity of a whole
blade
XCOGB Blade CoG station mm Axial position of the centre of gravity of a whole blade
XCOGD Disc CoG station mm Axial position of the centre of gravity of the disc
ABL Airbus Blade mm Related to RT - RR to define biggest small fragment
Length
Page 37 of 150
UERF GUIDELINES
5.3 Power plant Geometrical characteristics (PBR-Data)

STAGE Stage Name of the stage
DOR Direction of rotation 1 = clockwise; -1 = counterclockwise (remember,
view looking forward)
REDLINE Redline speed RPM Redline speed of the dedicated stage
NBRB Number of blades
AM Aerofoil mass kg mass of the aerofoil part
WBM Whole Blade mass kg total mass per blade including root and aerofoil
TBM Total Blade mass kg total mass per blade including root, aerofoil,
counter weigth
RCOGA Aerofoil CoG radius mm Radial position of the centre of gravity of the airfoil
only
XCOGA Aerofoil CoG station mm Axial position of the centre of gravity of the airfoil
only
RCOGB Blade CoG radius mm Radial position of the centre of gravity of a whole
blade
XCOGB Blade CoG station mm Axial position of the centre of gravity of a whole
blade
AL Aerofoil length mm
ATP Aerofoil Tip radius mm
RL Root length mm
RTR Distance centreline to mm
top of root
TAW True aerofoil width mm
ATH Aerofoil thickness mm
PMAW Projected maximum mm
aerofoil width
XPCA Axial position of the mm Axial position in Datum system
Pitch change axis
RTC Blade thrust centre mm Radial position of the blade thrust centre
radius
XTC Blade thrust centre mm Axial position of the blade thrust centre
station
Page 38 of 150
UERF GUIDELINES
5.4 General-Data for dedicated consideration

PHASE Flight CR; CL; TO; DE; TAXI
RC Rating Code
ALT Altitude ft
MN Mach Number
FN Net Thrust lbf
FP Propeller Thrust lbf
XNL LP Shaft Physical rpm
Speed
XNI IP Shaft Physical rpm
Speed
XNH HP Shaft Physical rpm
Speed
XNP1 Front propeller rpm
physical speed
XNP2 Rear propeller rpm
physical speed
FPITCH Front Propeller degrees in the XY plane and in relation to Datum system
Pitch angle
RPITCH Rear Propeller degrees in the XY plane and in relation to Datum system
Pitch angle
PTO Pitch Nominal degrees in the XY plane and in relation to Datum system
angle at Take off
PCL Pitch Nominal degrees in the XY plane and in relation to Datum system
angle at Climb
PCR Pitch Nominal degrees in the XY plane and in relation to Datum system
angle at Cruise
PDE Pitch Nominal degrees in the XY plane and in relation to Datum system
angle at Descent
FEA Forwa[ejection degrees +X=forwa[plane of rotation; -X=rearwa[plane of
angle rotation
REA Rearwa[ejection degrees +X=forwa[plane of rotation; -X=rearwa[plane of
angle rotation
Page 39 of 150
UERF GUIDELINES
5.5 Aircraft-Datum for Power plant location

X Mm X value in Aircraft datum
Y Mm Y value in Aircraft datum
Z Mm Z value in Aircraft datum
Pitch up angle Degrees
Toe in angle Degrees
5.6 Power plant Characteristics reference
Figure 3: Typical Assembled Rotor Stage
Page 40 of 150
UERF GUIDELINES
Figure 4: Drum Rotor Stage
Page 41 of 150
UERF GUIDELINES
Figure 5: Integrated Rotor Stage
Page 42 of 150
UERF GUIDELINES
Figure 6: Assembled Rotor Stage
Page 43 of 150
UERF GUIDELINES
5.7 UERF Fragment characteristics

5.7.1 One-third Disc Fragment characteristics
CHARACTERISTICS ACRONYM INFORMATION UNIT AIRBUS FORMULA
Centre of Gravity RCG mm 1§ BL ·
Radius ¨ RR ¸
2© 3 ¹
Maximum dimension MaxDim mm § BL ·
3¨ RR ¸
© 3 ¹
Fragment thickness mm Maximum thickness
between Disc and
Blade
Mass moment Kg.m2
of Inertia
Tangential
energy
kinetic released at
RCG location
J 1
2

FM * FV 2
Rotational kinetic released at J
energy RCG location
Redline Speed RPM Rotation RPM
Per Minute
Fragment velocity FV M/s § RCG ·§ RPM * 2S ·
¨ ¸¨ ¸
© 1000 ¹© 60 ¹
Fragment mass FM Kg BM DM
3
Figure 7: Thi[Disc Fragment
Page 44 of 150
UERF GUIDELINES
5.7.2 Intermediate Fragment characteristics

Centre of Gravity RCG mm RR
Radius
Maximum MaxDim mm RR BL
dimension
3
Mass moment Kg.m2
of Inertia
Fragment thickness mm Maximum thickness
between Disc and
Blade
Tangential
energy
kinetic released at
RCG location
J 1
2

FM * FV 2
energy RCG location
Per Minute
¨ ¸¨ ¸
© 1000 ¹© 60 ¹
Fragment mass FM Kg BM DM
30
Figure 8: Intermediate Fragment
Page 45 of 150
UERF GUIDELINES
5.7.3 Small Fragment characteristics

AMC 20-128A states that small fragment’s definition is not to be considered for Fan stage.
Centre of Gravity RCG mm 3 * BL
Radius RR
4
Maximum MaxDim mm BL
dimension
2
Mass moment Kg.m2
of Inertia
Fragment thickness mm Blade thickness
Tangential kinetic
energy
released at
RCG location
J 1
2

FM * FV 2
energy RCG location
Per Minute
¨ ¸¨ ¸
© 1000 ¹© 60 ¹
Fragment mass FM Kg 1 § BM ·
¨ ¸
2 © nbrB ¹
Figure 9: Small Fragment
Page 46 of 150
UERF GUIDELINES
5.7.4 Fan Blade Fragment characteristics

Centre of Gravity RCG mm 5 * BL
Radius RR
6
Maximum MaxDim mm BL
dimension
3
Mass moment Kg.m2
of Inertia
Fragment thickness mm Blade thickness
Tangential kinetic
energy
Released at
RCG location
J 1
2

FM * FV 2
Rotational kinetic Released at J
energy RCG location
Per Minute
Fragment velocity FV m/s § RCG ·§ RPM * 2S ·
¨ ¸¨ ¸
© 1000 ¹© 60 ¹
Fragment mass FM Kg 1 § BM ·
¨ ¸
3 © nbrB ¹
Figure 10: Fan Blade Fragment
Page 47 of 150
UERF GUIDELINES
5.7.5 Fragment thickness definition

Fragment thickness uses the projection onto an engine cross section of the external limits of
the stage. This means the forwa[and aft limits of the disc or the forwa[of aft limits of the blade
when a rotation around the engine centre line is made.
Considering propeller blade, particular attention should be taken on the fragment thickness as,
the Blade Pitch setting has a direct impact on the thickness of the trajectory path. Example of
Rolls-Royce RB3011-16 engine shows a difference of fragment thickness from ~520mm for
feather pitch angle to ~370mm for take of pitch angle.
The fragment thickness has also a direct effect on the risk exposure level when considering
failure criteria with a relation along aircraft x axis (e.g. stringers on wing or fuselage frames)
5.8 Ejection and spread angle definition
As defined inside AMC 20-128A and AC25.905-1, fragment’s trajectory is defined by :
x “Ȯ” the spread angle measured between P, the plane of rotation of the stage and the debris‘
trajectory. Its range depends on the analysis (e.g. +/-5° or +25°/-5° or +15°/-15°).
x “M” the angle between the projection of the debris’ centre of gravity onto P and the engine Z
axis (0° being 12 o’clock). Its range is 0° to 360°
Page 48 of 150
UERF GUIDELINES
5.9 Fragment trajectory

AMC20-128A, AMC25.905 & AC25-905 are addressing in a same manner the release of
fragment then the trajectory to be considered. Fragment is considered to turn around the
fragment centre of gravity making a path during its travel. Trajectory considers the envelop of
the path and then describes a simplified parallelepiped. Some studies are conducted in order
to address the real fragment path and then to use a more complex trajectory.
Example of Propeller-Open Rotor Blade Release fragment trajectory path is described on the
following figure, extracted from AC25.905-1.
Analyses conducted so far are

x disc fragment cinematic model X72RP0605550
x Blade Tumbling Trajectory synthesis X72RP1104024
x Analyse de trajectoires cinématiques dans le cadre d’éclatements moteurs avion
ME1114774 [14]
Page 49 of 150
UERF GUIDELINES
6 UERF analysis for development A/C

6.1 Process & organisation
6.1.1 Generic PRA organisation
PRA organization is described in AM2616 3.3 “Particular Risk Analysis” ref [17]. Each PRA
task owner reports to a PRA integration leader and safety director belonging to Chief Engineer
team. The PRA task owner the coordinates a team of focal points operationally reporting to
him/her.
CHIEF ENGINEER
SAFETY DIRECTOR
PRA Integration leader
PRA TASK OWNER (TO)
PRA FOCAL PRA FOCAL PRA FOCAL PRA FOCAL

POINT (FP) POINT (FP) POINT (FP) POINT (FP)
SYS SYS SYS SYS SYS SYS SYS SYS SYS SYS
A/C A/C
component component
Figure 11: PRA organisation
6.1.2 UERF Actors and responsibilities

Main roles and responsibilities are described in AM2616 3.3 “Particular Risk Analysis” ref
[17]. Some roles are specific to UERF and are described in the PDD.
Role of the Safety director includes:
x Lead and ensure performance of PRA activity within schedule
x Manage PRA inter-dependence (conflicting PRA requirements)
x Consolidate PRA work at A/C level
x Endorse policy and assumptions for each PRA
x Ensure major issues/non-compliances are addressed in the most effective / practical way and
analyse trade-offs. Support the Chief Engineer for arbitration regarding conflicting
requirements and choice of the best A/C level solution. Agree change requests and deviations
for Chief Engineer validation
x Supports the Task Owners for safety requests and recovery actions
Page 50 of 150
UERF GUIDELINES
x Report to the Chief Engineer and raises main technical issues in DPM for decision
x Authorizes all relevant deliverables
PRA integration leader role includes:
x Ensure full support to chief engineer architects and PDTs in the role of PRA expert
x Be a permanent member of SITMT team (System Installation Transverse Management
Team) representing Safety
x Be the A350 PRA representative in Programme workshops, Tiger Teams
x Be accountable for performance of the PRA process meeting program needs
x Provide technical and Programme assistance to the PRA Task Owners at their request
x Chair the PRA pre-DPM and PRA workshops
PRA Task Owner role:

x The Task Owner operationally reports to the Safety Director or his representatives. He
ensures the management of the PRA at aircraft level (trans-national and trans-functional)
x Identifies Engineering and Programme entities involved in the PRA
x Defines, adapts and ensures application for the related A/C program:
The PRA Model
The PRA Policy Document
The PRA methodology and schedule through PRA Process Description Document
x Defines and allocates the PRA requirements
x Ensures the correct sequencing of each step of the PRA process defined in the PDD
x Establishes budget and resources needs (raises issues regarding skill/resources/budget) to
transmit to the Programme Team
x Reports the PRA progress to the Safety Director, highlights major technical, planning and
certification issues and identifies way forwards
x Organises regular progress meetings for progress assessment and reporting. Standard project
management methods apply (drumbeat, reporting, visual management, project risk analysis)
x Launches PRA reviews at aircraft level
x Validates and verifies compliance of the A/C design regarding PRA with support from PRA
focal points
x Launches recovery actions if need be with support of the Safety Director
x Ensures A/C level Summary preparation based on deliverables from PRA focal points
x Depending on the Particular Risk: ensures Certification Dossier Preparation or provides
support to the DCS for this purpose
x Provides support to the DCS regarding issues related to the PRA during certification phases
(for UERF, PRA Task Owner may also be the DCS. Role of the DCS is explained in
Certification chapter)
System Safety focal point:
x Support the TO in the validation and verification of the compliance of the A/C design regarding
PRA
x Are appointed at various levels: Site, Aircraft Components, Systems, …
x Coordinates or performs the necessary technical tasks within their perimeter of responsibility
in accordance with the PDD
x Participates to Progress Meetings
x Represent the Task-Owner on their site
x Prepare the T105G for ATAs of their site
UERF system safety representative:
x Manages overall A/C activities related to systems
x Coordinates and homogenize system activities from UERF site safety focal points
Page 51 of 150
UERF GUIDELINES
x Synthesizes system UERF results at A/C level

The group composed by these key actors of the system related activities (UERF safety
representative /UERF site safety focal points) is named UERF system safety working group.
Additionally to these actors directly in the PRA organization, some specialists in their dedicated
fields supports the analysis:
System Design Team Focal Points:

In the perimeter of responsibility of a given aircraft component design team, the role of the System
Design Team Focal Point is to:
x Ensure transverse coordination between PRAs at System Design Team level,
x Maintain an overview of all PRA issues in the System Design Team,
x Manage trade-offs within its domain of responsibility and develop design solutions
compliant with design directives derived from PRAs,
x Act as an interface to the System Design Team for the PRA Task Owner,
x Support the PRA Task Owner,
x As a customer, provides PRA Task Owner with System Design Team needs regarding PRA
(deliverables and timing).
Transverse Disciplines Supporting PRA Activities:

x Specialists may be appointed to support PRA assessment within their fields of skills:
x System Layout
x Structure stress and thermal
x A/C performances
x A/C handling qualities
x Safety, including System Safety specialists, ZSA specialists, PRA specialists
x Environmental
x Aerodynamics
x Flight Tests
x Human Factors
x Aircraft Geometry
Design Specialists:
Their role in PRA activities is to:
x Support the Task Owner in establishing and validating PRA requirements,
x Ensure cascading and implementation of PRA requirements applicable to their field of
responsibility,
x Provide evidence that PRA requirements are implemented in the design/product
(verification).
x Potentially involved design specialists are:
x System design specialists
x System Installation design specialists
x Structure design specialists
x Wiring Diagrams specialists
Designated Certification Specialist (DCS) (more details in certification chapter):

In cases where the PRA is requested for Certification (this is the case for UERF), a Designated
Certification Specialist (DCS) or a Certification Manager:
Page 52 of 150
UERF GUIDELINES
x Ensures relationship and interface with Airworthiness Authorities (AA) in the frame of the
PRA,
x Provides support to the PRA Task Owner regarding certification issues related to the PRA
during development phases (model definition and early negotiation with AA if need be),
x Ensures Certification Dossier Preparation with the support of the Task Owner.
6.1.3 UERF Process overview

This chapter is derived from A350 XWB PDD ref [15]
CS / FAR 25.903(d)(1) Regulation require that design precautions are taken to minimise the
haza[to the aircraft due to Uncontained Engine Rotor Failure.
Means of compliance are given in AMC/AC 20-128A. Compliance demonstration is mainly based
on qualitative assessment, but quantitative assessment of the risk to the aircraft after a rotor burst
event has also to be performed.
The UERF analysis is performed in order to:

- Identify the risk area at an early stage of the development
- Contribute to the design process by providing design directives to ensure safety requirements
have been taken into account
- Minimise the risks
- Evaluate the remaining risk after practical design precautions have been taken
The development of the A/C design is supported by preliminary analysis; identification of

vulnerable safety-critical components / systems must be performed so that rotor burst effect can be
minimised by:
- Removal from potential debris trajectories,
- Segregation, duplication
- Adequate structure / system architecture selection / modification,
- Protection.
Analysis must be carried out as early as possible in the design stage to avoid late and expensive
redesign. Detail of the assumptions made for such analysis should be documented.
On A350 XWB, the UERF studies have begun in early design stages before M3, and will have
to be performed until the end of the development. Early analysis have been performed as soon as
M2/M3 (feasibility phase) to take into account general requirements, like constraints on engine
position, but also to built the baseline of the A/C in terms of hydraulic installation, primary flight
controls and fuel tank partitioning.
6.1.4 Process Description Document / Analysis
Each task of the analysis is identified in a Process Description Document (PDD). A PDD is
dedicated to one development and is authorized by Chief Engineer.
For each task, the PDD describes:
- The objectives,
- The inputs
- The outputs.
More precisely, for each sub-task, the following elements are defined:
Page 53 of 150
UERF GUIDELINES
- Task description
- Responsible of the Task
- Timeframe (expressed in term of Milestones or delta vs Milestones)
- Deliverables
- Customers
The major analysis phases are provided below and shall be detailed in the PDD:
1. Provide input data for UERF activities :
1.1. Provide UERF general working basis
1.2. Define design requirements
2. Review high level 3D structure / system architecture :
2.1. Check high level 3D structure architecture check vs. UERF and provide preliminary
structure analysis
2.2. Validate high level 3D system architecture vs. functional requirements
3. Perform refined structure analysis :
3.1. Provide structure contribution to A/C level residual risk, including structure risk
windows
3.2. Provide structure design precautions
4. Perform refined system analysis :
4.1. Consolidate the 3D system architecture installation / integration at A/C level
4.2. Protect critical components exposed to small fragments
4.3. Provide trajectory booklet
4.4. Provide systems segregation diagrams
4.5. Identify catastrophic cases involving single system
4.6. Provide UERF A/C level synthesis based on all system segregation diagrams
4.7. Provide list of equation for system combination leading to catastrophic cases, and
associated system contribution to A/C level residual risk
4.8. Provide synthesis of design precaution
5. Finalize UERF analysis :
5.1. Provide quantitative analysis for the 1 in 20 catastrophic cases
5.2. Prepare certification documents
5.3. Present certification documents
Each phase may be subjected to an AA review under EET14 responsibility with potential
participation of other CoC / CoE if required.
The figure below provides a simplified vision of the process tasks integrated in the
development cycle.
Page 54 of 150
UERF GUIDELINES
Figure 12: A350XWB PDD simplified flow chart for system activities
6.1.5 Trajectory booklet

Trajectory booklet is a common tool for system segregation diagram definition and safety
analyses.
It provides only one template and a global view of the aircraft.
This is done to combine aircraft area that can be affected at the same time and identified
combined effects due to damages to this area.
It is an envelope, not a detailed analysis in order to be conservative and to go deeper in
accuracy level during the development phase.
On latest program (A350XWB), trajectory booklet provides status of shared resources
(hydraulic power, electrical power, AFDX/ADCN) on each swathe (envelope trajectory) of the
trajectory booklet.
6.1.6 System Segregation Diagrams and Aircraft level synthesis

System Segregation Diagrams (SSDs) are the main UERF mean to show the robustness of a
system against UERF threat. Thanks to the UERF Trajectory booklet, effects can be cumulated on
a given set of trajectories.
x The objectives are:
Page 55 of 150
UERF GUIDELINES
x Determine and validate the optimum segregation for each critical system, in order to minimise
the risk of catastrophic effects following an UERF event. Inputs from system providing shared
resources shall be taken into account
x Implement and document design precautions taken for each critical system
x When the design is more mature, status of compliance to UERF requirements can also be
included in the SSD.
The inputs used to build the SSDs are:

x Trajectory booklet
x Architecture of the systems
x System installation
x Refined UERF design reqs. at A/C level for systems / functions and UERF PRA - Safety reqs.
for the aircraft design
x System FHAs
The outputs are:

x As defined per safety worksharing, each UERF site safety focal point to provide “(Sub-)
system segregation diagrams” ; for all (sub-) system involved in catastrophic failure scenarios
exposed to UERF, this document shall include :
o Principles and assumptions
o Summary of system description
o UERF design precautions
o List of system failure condition (with statement of applicability after UERF and
associated justification)
o List of applicable UERF requirements and their compliance status (by MG7)
o 3D description of electrical routing (including at least reference of principle diagrams
and connected electrical sub-bus bar)
o Analysis of the remaining functions after each of the UERF events defined in the
trajectory booklet, taking into account the effects to considered (sub-) system
hardware and the effects to system in interface
Once the individual system SSDs are issued, they can be combined in an A/C level
synthesis in order to have an overview of the functional effects and classify the scenarios.
Objectives of the A/C level synthesis:

x Provide an overall A/C synthesis based on system segregation diagrams documents
x Give an overview of the A/C systems condition after an UERF event
As soon as any data is available it is transmitted to handling qualities and A/C performance
departments to perform a study based on all system segregation diagram documents. The aim
of such study is to assess the combination of degraded equipment / systems / functions for the
overall A/C from handling qualities and performance point of view, and to identify minimum
failure conditions leading to CAT scenario at A/C level.
It is an iterative process between UERF task owner (EEI14), UERF system safety
representative (EYDSA), handling qualities department (EYCDA) and A/C level performance
department (EGVT).
The inputs used for this analysis are:
x System segregation diagram for each system
x Handling qualities and performance assessment report
Page 56 of 150
UERF GUIDELINES
x Refined UERF design reqs. at A/C level for systems / functions and UERF PRA - Safety reqs.
for the aircraft design
x System FHAs
The outputs are:
x UERF synthesis at aircraft level ("UERF A/C level synthesis") including minimum failure
conditions leading to CAT scenario at A/C level and associated risk time / flight phase
exposure.
x Updated list of accepted non-compliances and associated rationales
6.1.7 Typical schedule

This paragraph is built around the definition of the DARE programme maturity gates (must
be adapted according to the definition of the maturity gates of the programme under
consideration):
MG1 Entry into Scenarios Analysis
MG2 Entry into Concept Selection
MG3 Entry into Concept
MG4.1 Ready for Authority to Offer
MG4.2 Entry into Definition
MG5 End of A/C Concept
MG6 End of MCA Concept
MG7 Freeze of Definition
MG8 Entry into MCA/CA (Constituent Assembly)
MG9 Entry into FAL
MG10 Ready for Power On
MG11 Ready for Flight Test
MG12 Type Certification
MG13 Entry-Into-Service
MG14 Entry into Steady State
Before MG4.1
x Provide PRA expertise during structure and system design concepts selection phases
At MG4.1
x PRA 3D models available
x Define main structural requirements with respect to PRA on the basis of previous
programme experience
x Elaborate list of key driver requirements for systems on the basis of previous programme
experience and preliminary list of Failure Conditions, when applicable
x Identify potential show stoppers
At MG4.2
x Refine structural requirements and define appropriate means of compliance
x Establish list of system requirements in line with available list of Failure Conditions, when
applicable
x Check that preliminary layouts of major systems are consistent with PRA requirements
x Identify worst repercussions following PRA events (including HQ, Performance
assessments when relevant)
At MG5
x All PRA issues identified, with route to comply defined
Page 57 of 150
UERF GUIDELINES
x Detailed structural requirements available and means of compliance agreed

x All system architectures validated with respect to PRA requirements
x PRA system installation requirements verified in 3D installation mock-up
x Complete loop of PRAs consequence assessments (including HQ, Performance
assessments when relevant)
x All PRA requirements validated by designers
At MG7
x Freeze of PRA requirements
x Full verification of design against PRA requirements showing that the A/C definition at
MG7 is acceptable
x Identification of remaining uncertainties and risks to be cleared before First Flight,
certification or EIS
x Contribution to A/C Safety Synthesis
Between MG7 and MG11
x Follow-up of design changes and verification of modified design against PRA
requirements
x Reduction of number of remaining open items identified at MG7
At MG11
x First flight clearance and identification of applicable A/C limitations, if any
x Contribution to First Flight A/C Safety Synthesis
At MG12
x Closure of all remaining open items relevant for certification
x Deliver certification documents for the PRAs required by AA
x Deliver compliance summary for non-certification related PRAs
x Contribution to A/C Safety Synthesis for Certification
6.2 Policy and usual assumptions

At the beginning of a program, a policy document providing input data for UERF Particular
Risk Analysis is issued. This document aims to provide information to facilitate the understanding
and the interpretation of this Particular Risk by all actors of the PRA.
The data presented in this chapter is derived from A350XWB UERF general policy ref [16].
6.2.1 A/C status - environmental conditions – crew response

No combination with other PRA should be considered; design precautions should nevertheless
be provided in order to prevent / minimize such cascading failures :
o Prevent / minimize UERF leading to failure / detachment of categories A & B structure
o Prevent / minimize UERF impact on equipment with high internal pressure (hydraulic
accumulator, pressurized oxygen container …).
Additional conditions associated with the Master Minimum Equipment List (MMEL) or
Component Deviation List (CDL) must not be considered in combination with the UERF event. It
has been considered that no independent failure has occurred during the flight before the UERF
event or will occur during the flight after the event.
Page 58 of 150
UERF GUIDELINES
In a general way, status of the aircraft should be assessed considering the diversion time to the
nearest diversion airport. For ETOPS certification, greater diversion time must be considered (as
per A/C CDD).
UERF can be combined with the following environmental conditions:

- Normal icing conditions (severe icing conditions shall not be considered),
- Crosswind (strong crosswind above 18 kts shall not be considered),
- Instrument Meteorological (IM) conditions (UERF is not combined with CAT III auto land)
The A/C is operated in compliance with FCOM and Airbus Standard Operating Procedures,
normal revenue service (eg ferry flight with gear extended not to be considered). An UERF event is
not considered detectable. The UERF could not be visible from cockpit or cabin. However, the
flight crew could suspect an UERF event has occurred due to the effect on engine parameters, A/C
manoeuvrability and on the systems (bleed, hydraulic, electrical generation…).
It has to be considered, that UERF occurring on ground during take off, can lead to RTO / HERTO.
6.2.2 Geometrical analysis assumptions

The following assumptions are generally applicable to all kind of fragments.
- The rotor fragment is supposed to have a straight trajectory before and after any
structure/system perforation. So, only straight trajectories have to be considered when
analyses are carried out inside the aircraft.
- The probability of release of debris within the maximum spread angle is uniformly distributed
over all directions. Same hypothesis is considered in the plane of rotation of the discs, along
the 360°.
- UERF trajectory analysis is performed on A/C in jig position (position of A/C in 3D digital Mock-
up).
- Only one UERF event and one fragment are considered all along the flight. Multiple fragments
are considered only for dedicated analysis (e.g.: close domain, thrust reverser).
This applies to 1/3rd discs & to intermediate fragments, but is under review for small fragments,
because of extended use of composite material on A350-XWB (see § 4.2.16).
6.2.3 Hypothesis for impacted components

The table below gives the generic failure mode to be considered following an UERF
according to the kind of debris.
All other realistic types of failure mode, which may be identified by engineering judgment
have also to be considered. Particular hazards that can be generated after an UERF such as
uncontrolled fire, leakage, detachment of an A/C part will also be considered when necessary.
Systems components are considered unserviceable if their envelope has been touched. In
case of an engine being impacted, the nacelle structure may be regarded as engine envelope,
unless damage is not likely to be hazardous (AMC / AC 20-128A appendix § 4.a.6).
Page 59 of 150
UERF GUIDELINES
Failure Mode to be considered

rd
1/3 Disc,
Type of component intermediate
Small Fragment
fragment, fan blade
fragment
1st equipment impacted after penetration of
Equipment (computer,
Lost “equivalent” structure (as defined in § 4.2.16) is
power source…)
considered lost.
Cut open
1st equipment impacted after penetration of
No consideration of “equivalent” structure is considered lost.
Wiring
inadvertent voltage / Control cables that are struck by a fragment
signal for any disconnect.
significant duration
Mechanical part Broken or jammed Structural assessment to be performed.
Clean cut of 1st pipe impacted after penetration of

Pipe* Clean cut
“equivalent” structure.
Structure Clean cut Structural assessment to be performed.
* For the hydraulic pipes located in the nacelle, a potential small leakage is also considered since
secondary damaged shall be considered at engine level. See details in hydraulic §.
6.2.4 Specific hypothesis
6.2.4.1 Shielding offered by the engine case
AMC 20–128A USER’S provide the information from which it is possible to use an engine as
being to able to stop a fragment. This kind of consideration is not usually taken into account for
aircraft design, the A400M will take credit from such definition for the 1/20 remaining risk
assessment and not in the design goal.
4.0 ASSUMPTIONS
4.1 The following conservative assumptions, in addition to those in Paragraphs 10(a) (1),
(2) and
(3) of AMC 20-128A, have been made in some previous analyses. However, each
aeroplane design may have unique characteristics and therefore a unique basis for the
safety assessment leading to the possibility of different assumptions. All assumptions
should be substantiated within the analysis:
a. The 1/3 disc fragment as modeled in Paragraph 9(a) of the AMC 20-128A travels along
a trajectory path that is tangential to the sector centroid locus, in the direction of rotor
rotation (Refer to Figure 3).
The sector fragment rotates about its centroid without tumbling and sweeps a path equal to twice
the greatest radius that can be struck from the sector centroid that intersects its periphery. The
fragment is considered to possess infinite energy, and therefore to be capable of severing lines,
wiring, cables and unprotected structure in its path, and to be undeflected from its original
Page 60 of 150
UERF GUIDELINES
trajectory unless deflection shields are fitted. However, protective shielding or an engine being
impacted may be assumed to have sufficient mass to stop even the most energetic fragment.
6.2.4.2 Hypothesis linked to composite wing and/or fuselage
A400M has a composite wing. A350XWB has a composite wing and a composite fuselage.
This was not considered in the AC20.128A so special certification conditions have been raised to
address this novelty, in particular with respect to small fragments. The goal was to demonstrate
equivalence between composite and conventional aluminum skins with respect to small fragments
penetration.
For A350, it has been shown that it was necessary to have a ratio of 1.8 between the
thicknesses of lower wing skin in composite compared to an aluminum skin. This has been
introduced in the design. For fuselage, a different strategy has been selected, as the goal is to
preserve redundant signals. Whenever possible, the redundant signals are segregated left / right
but since it is not always possible, Airbus has chosen to demonstrate that for elements routed in
ceiling, the penetration of composite fuselage skin plus electrical raceway will be equivalent to the
penetration of conventional aluminum pressurized fuselage. Those approaches have been agreed
by airworthiness authorities.
6.2.4.3 Propeller hypothesis
On A400M, design has been done considering the propeller wouldn’t have sufficient energy
to reach the opposite side of the fuselage.
6.2.4.4 Hydraulic Assumption
During an UERF event, it is considered that on bursting engine:
x Hydraulic pressurization mean(s) is (are) lost
x Pipe / equipment locally installed at engine – nacelle – pylon level (within UERF risk area)
could leak, either due to direct fragment impact, or due to fire, or due to high vibrations /
accelerations loads at the time of the failure.
In consequence, if hydraulic architecture do not consider specific leak prevention feature &
redundant pressurization mean, for the bursting engine, the associated hydraulic system is
considered lost.
x In fact, local behaviour can’t be predicted in the nacelle of the bursting engine following the
release of one-third disc fragment, keeping in mind that the remaining two thirds of disc will not
wait on the engine shaft as it can be shown on the picture below :
A400M:
Page 61 of 150
UERF GUIDELINES
A400M is first Airbus A/C on which it is intended to detect at take off on which engine / nacelle
the pipe(s) / equipment(s) have been damaged in order to isolate the leak and keep the hydraulic
power generation from a remaining engine. Concern being L/G retraction performance at take off, it
has been focussed on full pipe section cut with high leak rates causing pressure drops in hydraulic
lines & detected by pressure switches. Low leak rates are not relevant; because hydraulic circuit
will remain temporary available, allowing complete L/G retraction.
A350XWB:
A350XWB is first Airbus A/C on which it is intended to detect during the complete flight on
which engine / nacelle the pipe(s) / equipment(s) have been damaged in order to isolate the leak
and keep the hydraulic power generation from the remaining engine. Concern are L/G retraction
performance at take off, as well as A/C controllability in flight :
- Full pipe section cut with high leak rates
- & Partial rupture – disconnection with low leak rates (< 30 l/min) have been considered.
High leak rates causing pressure drops in pressure or case drain hydraulic lines are detected by
pressure transmitters (PT). In A/C nominal case, high leak rates on suction pipe will also cause
pressure drop, directly detected by PT, but this may not be the case under MMEL with hyd. tank
pressurization failures, that is why suction line is not efficient, and optimized pipe integration is
preferred (such as its rupture will be associated to rupture of pressure & / or case drain line(s)).
Detection logic is fitted on both hydraulic circuit so for dissimilarity reasons, for the Yellow
hydraulic, the low pressure detection shall be confirmed by the loss of some primary flight controls
cables to allow FSOV closure. Those cables have been selected to be cut on trajectories where
the Yellow hydraulic can be saved and is useful due to damages to electrical channels in particular.
Low leak rates are covered through:
x Hydraulic tank low level detection
x Hydraulic tank sizing, allowing half a minute leakage at low rate
x Engine information allowing identification of failed engine in half a minute following engine
failure.
LR:
On LR A/C (A330 / A340), specific logic has already been developed in order to allow green
hyd. circuit isolation on both engines & pressurization through RAT in case of low level detection
(detailed logic is more complicated, & depends on considered A/C, to minimize erroneous green
hydraulic circuit isolation).
SA / WB / DD:
On other programs (SA / WB / LA), it was considered there is no way to detect on which
engine / nacelle the pipes have been damaged in order to isolate the leak and keep the hydraulic
power generation from the remaining engine. This approach is fully agreed by the Airworthiness
Authorities to assess the UERF analysis.
Concerning the assumption of no leakage on the bursting engine, in case of trajectory not
impacting the fluids pipes directly, there is no evidence of thinking that there will not be leakage
after an UERF event as shown in the pictures below. What can be said regarding in service events
is that with an UERF event, there are some leakages leading to a fire and so to the engine’s fluids
isolation. In service event [for instance SR ref. : SEEE3-2008-267309 Id: 1-11WWTJ : IFSD DUE
TO ENGINE#2 HIGH N2 VIBS on A330-321 MSN 122 flight 609 (29/06/08)] have also brought
some evidence that pipe disconnection (suction pipe in case here above) due to high vibrations /
acceleration loads have to be considered.
Page 62 of 150
UERF GUIDELINES
For information, it has nevertheless to be noted that during early programs (WB / SA) certification
demonstration, hydraulic circuit were only assumed as damaged by UERF as result of direct
(large) debris impact.
What regards damages on hydraulic circuit in other A/C areas (wing or fuselage), full section
pipe rupture is considered, allowing use of fuses closing in case of flow rate higher than the one
associated to full pipe rupture.
6.2.4.5 Electrical generation
In flight conditions, the normal electrical generation is supplied by Integrated Drive Generators
(IDG) or by Variable Frequency Generator (VFG) of the engines.
In case of engine failure, electrical reconfiguration is such that the remaining engine provides
the electrical power. Should the normal generation be lost then:
x The Auxiliary Power Unit (APU) generator can replace the failed engine(s) electrical
generator(s),
x A Ram Air Turbine (RAT) is available.
Page 63 of 150
UERF GUIDELINES
These solutions are respectively called the “Auxiliary Electrical Generation” and the
“Emergency Electrical Generation”.
The Electrical Generation is resumed in the table:
ELECTRICAL GENERATION DEVICE PER GENERATION TYPE

Engine 1 Generator(s) Normal generation
Engine 2 Generator(s) Normal generation
APU Generator Auxiliary generation
RAT Generator Emergency generation
Batteries also provide a power supply for DC consumers only. Nevertheless this available
electrical power is currently not sized to be able to be considered as a backup solution.
After a rotor burst event, the Electrical Generation Loss may be catastrophic because of:
x The loss of all the engine feeders or,
x The debris impact on the opposite engine (including opposite engine detachment)
To identify if Emergency and Auxiliary Electrical Generation would be available, it is necessary
to characterize RAT and APU systems.
6.2.4.5.1 RAT characteristics
According to Single Aisle RAT specialists, the typical time of Ram Air Turbine extension and
start is between 5 and 10 seconds. For A350, it is 6 to 8 seconds at low speed and down to 2
seconds in cruise.
The RAT extension logic depends on:
x The aircraft speed for RAT efficiency that is 140 kts for A30X (125kts for adapted laws).
x The extension of main landing gears: The RAT deployment is inhibited when the aircraft is on
the ground, with the main landing gears extended and compressed.
x The total engine flame out event.
x The slats and flap extension.
x L/G extension (if L/G pass in front of the RAT)
No other limitation is defined and identified.
6.2.4.5.2 APU characteristics
APU is usually not considered in UERF demonstration.
Concerning Auxiliary Power Unit, the Auxiliary Electrical Generator could be:
- Used directly if it was operating before the rotor burst event.
- Started in flight - There are limitations of altitude for starting and performance which
depend on the A/C.
Thus the APU generator can be operated on a large part of the aircraft flight envelope.
6.3 Propeller Blade Release (A400M)
The aim of this section is to summarize A400M studies with respect to Propeller Blade
detachment.
This risk is divided in two Particular Risk Analyses (PRA). First, the Engine & Propeller
Imbalance (E&PI) studies the vibration due to a partial or complete propeller blade separation.
Then, the Propeller Blade Release (PBR) considers all the trajectories of the debris and the
consequences of those impacts at aircraft level.
Page 64 of 150
UERF GUIDELINES
6.3.1 Engine / Propeller Imbalance Particular Risk Analysis

This analysis is performed in order to demonstrate that, following the release of a part of the
propeller, the resulting loads and vibrations will not:
x Cause damage either to the primary structure of the aeroplane or to systems that would
jeopardise continued safe flight and landing,
x Result in cockpit vibration environment that could prevent the flight crew from operating the
aeroplane in a safe flight manner.
It should be shown that means remain to unambiguously identify the failed propeller and to
shut off this engine and feather the propeller.
6.3.1.1 Regulation
CS 25.905(d) requires minimising the hazards to the aeroplane in the event a propeller blade
fails or is released by a hub failure.
The CRI E-08 (closed at Iss 3) addresses the consequences of unbalance loads resulting from
total or partial propeller blade release. It contains the frame for the demonstration to the
certification Authorities.
6.3.1.2 Assumptions
The analysis is based on the following points that have been substantiated by the propeller
manufacturers:
x Loss of a portion of a blade is not considered a possible scenario.
x Only two large parts are added on the leading edge of the composite blade: the de icer and
the nickel sheath. The worst case is the loss of the nickel sheath due to improper bonding.
According to the propeller manufacturer, no cases of de icer detachment in service have been
reported.
x There are two scenarios of propeller blade release: loss of the complete blade from the hub
and loss of the composite part of the blade (excluding the steel retention). The first one
produces the highest imbalance loads.
Thus, the following main sources of imbalance have been identified:
x Nickel Sheath Loss (NSL),
x Propeller Blade Release (PBR).
6.3.1.2.1 Propeller Blade Release
It should be shown that the load levels on the engine due to PBR are highly exceeding the
ultimate design loads in multiple locations and peak load amplitudes are already reached
within 0.2 s. The engine will stop transmitting power in some seconds (Generated load by PBR
for the engine is up to a factor of 9.3 times higher than any other worst ultimate load). Based
on this it is assumed that no loads/accelerations are transmitted to the aircraft. However, to be
on the conservative side by assuming that the engine will not structurally fail and thereby loads
would be transmitted, a structural analysis will be made to show that in the vast majority of
load cases one or several parts of the pylon (pylon-engine or pylon-wing attachments) will fail
at a lower load level than any part of the wing, thereby minimising the haza[to the aeroplane.
The following scenarios could be possible:
x Engine shaft failure, leading to overspeed and automatic shutdown of the engine
x Engine mounting failure, leading to (partial) detachment of the engine from the pylon.
Although the failure mode and dynamic of such event can not be predicted, Airbus will analyse
the nacelle strength capability to determine if it could statically hold the engine.
Furthermore it will be ensured that shutoff means are still operational after the event.
Page 65 of 150
UERF GUIDELINES
6.3.1.2.2 Nickel sheath loss

It will be determined the time the engine and engine mounts can withstand the effects of this
event. If this time needs to be limited, Airbus needs to consider to give a warning to the crew in
order to shutdown the engine and feather the propeller. Otherwise, the same philosophy will
be used as on other Airbus a/c, i.e. caution to the crew to monitor the engine parameters
closely and reduce power until the vibration levels go below the advisory.
Airbus will review the loads and acceleration on the aircraft and will take design precaution as
far as practical and feasible such that the structure and critical equipment can withstand these
conditions. It will be shown that the pilot can feather the propeller after a certain period, after
which the unbalance will disappear.
6.3.2 Propeller Blade Release Particular Risk Analysis
This analysis is performed in order to demonstrate that, following the release of a part of the
propeller, the consequences on aircraft systems and structure of the ensuing propeller debris
impacts are minimised.
6.3.2.1 Regulation
CS 25.905(d) requires minimising the hazards to the aeroplane in the event a propeller blade
fails or is released by a hub failure.
The PBR compliance demonstration is done in accordance with advisory material AMC
25.905(d). Guidance has also been taken from FAR 25 AC 25.905-1 to define the propeller
failure model.
No dedicated CRI.
6.3.2.2 Assumptions
6.3.2.2.1 Model
The propeller manufacturer was consulted and advised the A400M propeller blades are
comparable for all geometric characteristics to traditional propeller blades.
Figure 13: Propeller blade release failure model
Single propeller blade release characteristics:

x Max dimension (fragment swept path): 2,93 m
x Width (max blade chord): 0,693 m
x Spread angle: ±5° from the centre of the propeller hub is considered for all systems (-5°/+10°
being taken into account when it can be practically achieved, which is the case for electrical
segregation)
Page 66 of 150
UERF GUIDELINES
x Finite energy
The complete hub detachment is covered by single propeller blade release design
precautions. Indeed, due to the size of the propeller hub (propeller diameter is 5.33m vs.
fuselage height 5.11m), design precautions taken with respect to single propeller blade
release allow to minimise consequences of a total propeller hub detachment. No further
minimisation effort is practically achievable.
6.3.2.2.2 Process
The single propeller blade release is considered for design precautions only (no quantitative
risk analysis).
The single propeller blade release is considered for systems only (no structural analysis).
x Indeed, in the design phase, fuselage design precautions have been taken to minimise the
structural effects of a single engine 1/3[of disc as far as possible/practicable. The continuity of
the fuselage design allows to extend those precautions to the propeller blade release area.
That resulted in the position that residual strength analysis vs. PBR fragment is proposed not
to be made due to the propeller blade debris Max dimension and Width (2.9mx0.69m) with
respect to the fuselage height (5.11m) that would theoretically lead to a too large peace of
structure being cut though the A/C.
The single propeller blade release is considered as being able to damage only one side of the
aircraft.
Indeed, due to the propeller blade release Max dimension and Width (2.9mx0.69m) with respect to
the fuselage height (5.11m) considering full penetration of the fuselage prevents practical design
precautions to be taken. Airbus proposed a philosophy based on LH / RH segregation for fuselage
electrical routes vs. PBR trajectories.
6.4 Design precautions
6.4.1 Requirement Based Engineering / V&V
The first two paragraphs below are extracted from AM2616 3.3 ref [17]. The rest is derived
from A350XWB experience.
6.4.1.1 Cascading and Traceability
Particular Risk Analyses shall be drivers for the design.
The design requirements derived from Particular Risk Analyses shall be properly cascaded and
traced:
Top level requirements shall be cascaded down to a level that is fully understandable and
directly applicable by the involved designers, mainly:
x system designers,
x system installation designers,
x structure designers.
The full cascade of requirements shall be recorded in order to:
x keep trace of the rationale that led to choice or elimination of design solutions,
x ensure that no design change could be initiated after a solution has been validated
and approved by PRA specialists without having first been checked compliant with
the requirements set up during the analysis process,
x allow designers to challenge the requirements up to the right level when a design
change needs to be investigated.
A key objective for most Particular Risk Analyses is to ensure the aircraft is designed to minimize
the risk of repercussions having a safety classification (with respect to § 25.1309) higher than a
given level. In this context early requirements can be derived from A/C or system Functional
Page 67 of 150
UERF GUIDELINES
Hazard Assessments. For example, if Failure Condition A is identified as having Catastrophic

repercussions in a given system FHA, a requirement can be expressed under the form "aircraft
shall be designed such that an Uncontained Engine Rotor Failure cannot result in Failure Condition
A". Such "functional" requirements that are easily understood by safety specialists and system
designers are meaningless to installation designers or structure designers. They shall therefore be
refined and cascaded down to "practical" design requirements that can be allocated to the
appropriate design teams.
If no low-level requirement can be expressed in terms of practical & unambiguous objectives, then
the implementation of the validated detailed design solution shall be traced as a requirement.
Similarly, if compliance with top-level PRA requirements can be shown without additional effort, on
the basis of already existing design solutions, all features of these design solutions that have been
used to show compliance shall be traced as requirements.
Furthermore, if a higher-level requirement can be cascaded in several different lower-level
branches (because the analysis identifies different ways to achieve this higher level requirement),
the different branches shall be recorded to keep trace of all the analysis outcomes, and simplify
subsequent design change investigation work.
The PRA Task Owner is responsible for the establishment of the relevant PRA requirements and
for ensuring these requirements are properly addressed in the design. The Task Owner may
delegate part of this responsibility to other actors of the PRA as appropriate (other actors may be
tasked to establish requirements in their scope of competence provided these are validated at the
end of the process and formally approved by the Task Owner).
Proper refinement and cascading of the top level functional requirements must be based on a
sound understanding of system operation, of interfaces and potential interdependences between
subcomponents or with other systems, about pursued functional independences between
components, subsystems or subparts. This process relies on a close collaboration between the
relevant PRA stakeholders and involved system designers. The different Task Owners must
coordinate their action to optimize system designers' contribution.
A key element for efficient work is to ensure requirements are fully understood and accepted. The
Task Owner shall organize as many presentations, meetings, workshops as necessary to get
common understanding on the requirement objectives.
The PRA Task Owner is responsible for the validation, formal approval of the design solutions put
in place to answer the requirements and the verification.
6.4.1.2 PRA Safety Requirements Transfer Document (T105G)
A PRA Safety Requirements Transfer Document (T105G) shall be written for each Particular Risk
in order to gather all input & output requirements relating to a PRA.
The expected contents of the different chapters are developed hereafter.
§ 1 - Introduction
§ 1.1 - Referenced Documents
§ 1.2 - Aim of the Document
§ 1.3 - Scope
§ 2 - PRA Input Requirements

PRA input requirements are those requirements which are allocated to the PRA itself and
which will contribute to the T105G process of generating subsequent output requirements.
Page 68 of 150
UERF GUIDELINES
The Input Requirements will not be allocated outside of the PRA process but will be used for
justification and organization of the T105G.
It should be noted that such PRA input requirements are NOT received from other T105Gs,
but are requirements that have been generated within the PRA Process itself (e.g. PRA
Policy document or lessons learned) or have been received from other safety activities on
systems (EDR or safety parameters).
Three categories of Input Requirements are defined in T105G:
§ 2.1 - General Input Requirements
The general input requirements shall be proposed by the Task Owner (TO) based on
the Regulation Materials, the PRA Policy Document, etc.
§ 2.2 - PRA Lessons Learned
Allows collecting lessons learnt from previous Development Programs or In-Service
Events.
§ 2.3 - Parameters Defined in System Safety Analyses for PRA Activity
Allows collecting parameters from SSA if they address PRA.
§ 3 - PRA Output Requirements

PRA Output Requirements are those requirements that are the result of the PRA. Output
requirement identification, break down and allocation is summarised in the Output
Requirements section.
Several levels of output requirements may result from the PRA process, in particular when
they are derived from A/C or System Failure Conditions.
Only output requirements having been broken down to a suitable level of detail shall be
considered as an applicable Output Requirement and transferred to designers.
The following wording will be used in this document in order to classify the requirements:
Shall: The word “shall” denotes a mandatory requirement. Departure from such a
requirement is not permissible without the formal agreement by the requirement
stakeholder.
Should: The word “should” denotes a recommendation or advice on implementing such a
requirement. The requirement stakeholder expects that such recommendations or
advice be followed unless good reasons are stated for not doing so.
§ 3.1 - Output Requirements Derived from A/C and System Failure Conditions
§ 3.1.1 - A/C Level
Applicable Failure Conditions (FC) shall be identified and selected from A/C
FHA, in accordance with the input requirements defined in the PRA Policy
Document.
§ 3.1.2 - System Level
Applicable Failure Conditions (FC) shall be identified and selected from System FHA,
in accordance with the input requirements defined in the PRA policy.
§ 3.2 - Output requirements not derived from Failure Conditions
Page 69 of 150
UERF GUIDELINES
When they are not directly issued from Failure Conditions, these specific output
requirements shall be written in the § 3.2 of T105G. For instance this applies to
Requirements derived from lessons learnt of § 2.2 of T105G.
Requirements allocations have to be defined between Task Owner and system
specialists potentially impacted.
6.4.1.3 Requirements verification
The global T105G V&V process is described by the figure below.
Figure 14: T105G V&V process - Global overview
It is designers’ duty to provide verification evidence that design satisfies the requirements. All
requirements being stored in DOORS, a Proof Of Compliance (PoC) shall be associated to each
requirement.
The nominal associated V&V process generates V&V evidences in DOORS, complemented by
other technical information to consolidate the V&V exercise.
- V&V evidences from SIRD (System Installation) are gathered from the DOORS database (+ the
SIRD collaborative iShare for “functional” requirements”).
- V&V evidences from TLxxRD (Structure) and SRD (System Design) are gathered from the
DOORS database
- Verification of PTS requirements are performed by system Designers as per the Supplier
Review Process (based on suppliers Compliances Matrixes). System Designers provide the
necessary data to PRA teams for T105G verification.
- PRA Task owners may be consulted to provide guidance on verification and acceptance of the
final PoC.
To ensure full verification coverage, PRA teams gather verification proofs they obtained from
DOORS and non DOORS sources. They manage the T105G verification statuses in V&V portal
extracts (common dedicated template):
Page 70 of 150
UERF GUIDELINES
- POC references,
- POC issues,
- POC status,
- Deviations if necessary.
Note: no verification activity is performed in the T105G DOORS PRA modules (2b3.2 and 3b3.2).
For each PRA, the final verification dossier will be the printed T105G achieving the verification of
the “internal” T105G requirements and formally closing the verification loop in SRMV2. The final
excel verification template will be attached as an annex of the Verification Dossier.
6.4.2 Structure
6.4.2.1 Overview
The aircraft structure is analysed in several parts : the Fuselage structure, the Wing structure
and the Pylon structure. The general requirement that is used to demonstrate compliance is
the §25.571 Damage-tolerance and fatigue evaluation of structure. The several analyses are
made in a static way.
Some structures parts are more sensitive to UERF impact than the others, they are : upper
fuselage shell, centre wing box, wing stringer.
Why the clean cut for the whole structure analysis ? This statement has been used on
numerous Airbus aircraft as it is the simple one, that can lead us to assess the risk and that
damage propagation consideration is not feasible. Remind that design features are
implemented such as crack stoppers.
The structural analyses are looking at the number of constrained elements
nbre_ eng nbre_ stage
§ HXij HYij · § 1 · §¨ ¦ koeff _ flight _ phase ·¸
¦ ¦ ¨¨ ¸¸ * ¨¨ ¸¸ *
j 1 i 1 © 'Xij 'Yij ¹ © nbre _ eng ¹ ¨© 1 ¸
¹
exp osure _ time Catastrophic cases
koef _ flight _ phase k* * Pr obability
flight _ phase _ duration Possible _ cases
exp osure _ time
koef _ glight _ phase (ex _ 0.35) * * (exemple _ slat det achment )
flight _ phase _ duration
6.4.2.2 Surface detachment

Keeping in mind that flight controls surfaces are mandatory to ensure a continued safe flight
and landing, it is necessary to look at slats or flaps surfaces. Another consideration must be taken
for detachment of such surfaces, which can have some impacts on the whole aircraft structure
such as, vertical tail plane strike, fuselage hole…
Following Wing elements may lead this particular catastrophic scenario:
x Flaps
x Droop Nose / Slats
x Spoilers
Page 71 of 150
UERF GUIDELINES
Analysis has proved that the configuration of these different elements (extended or
retracted) did not impact significantly the Risk Window on A380 program. Conservatively, the
configuration with the biggest risk window was taken for the risk quantification.
These CAT detachments are considered for “V1 to first power reduction” & “Approach” flight
phases, as they are highly loaded only during those phases. Probabilities of impacts are
considered, depending on the location of the impacted flight control part.
The following table list the different probabilities considered, depending on impacted flight
control part and aircraft programs.
Impacted
Flaps, Inner Slats (Droop Nose) and Outer Slats
part
Program spoiler
1 (no consideration of detached part 1/178 (defined by ejection
A380
trajectory) analyses and simulations)
=> Conservative hypothesis
1 (no consideration of detached part 1/10 (conservative probability
A350
trajectory) in relation with A380)
=> Conservative hypothesis
Doors detachment must also be analyzed as it may provide sudden decompression.
6.4.2.3 Protection against fragments

Shielding and energy absorption concepts will be detailed in a next version of this document.
6.4.2.4 Fuselage structure
The purpose of this paragraph is to present the design precautions implemented on the
A380 structure design in order to minimize the consequences of a rotor burst as per JAR
25.0903(d)(1). Some design precautions are specific to but the majority remains applicable to other
programs. For a given program design precautions, you can refer to the certification report listed in
§4.
The S15/21 fuselage structure is a damage tolerance design, which limits the extension of
damage propagation.
The S15/21 structure is designed as well to withstand the effects of rapid decompression
generated by rotor debris damages (see §6.4.7.1). On A380, The large volume of the cabin
compartment and the good venting down to the main deck compensates the larger UERF hole size
applied in this region. In the engine burst zone a larger opening due to the impact of a single
engine fragment is not possible.
6.4.2.4.1 Section 15 - upper & lateral shells & lower shell
The upper shells are made with 2524 skin (Aluminum alloy selected for its crack
propagation and residual strength properties) together with 7349 stringers (high strength Al alloy
leading to high level of residual strength).
The lateral upper & lower shells are made in 7475 skin (high strength properties) together with
7349 stringers (high strength aluminum alloy leading to high level of residual strength).
Door U2 is located out of the ±5° engine debris trajectories.
Lower shell & upper and lateral shells are designed:
x With the ability to withstand limit loads with two frames bay crack and two stringers bay crack.
Page 72 of 150
UERF GUIDELINES
x With riveted stringers with skin pad-up over-thickness which limits the extension of damage
propagation.
x In 4 different panels (framewise) with over lap joints which limits the extension of damage
propagation.
Frames 58 and 60 have been designed with lower allowable stress values than the other frames to
reinforce the area near door M3 which is located within burst area.
The frames of the upper crown are sheet metal frames with separate cleats, which limits the
extension of damage propagation.
x The door cut-outs are reinforced by titanium doublers.
x Window cut-outs are reinforced with separate window frames.
Figure 15: Window frame doubler
6.4.2.4.2 Section 15 / Landing Gear Bay (LGB) and Rear lower shell
Specific A380 design precautions are taken due to the particular configuration. They are described
in ref [20]
6.4.2.4.3 Section Keel Beam
Not applicable to A380. Extract of A340-600 design precautions ref 526.0368/2002.
x 2 keel beams are fitted.
x Major part of the keel beam-fuselage junction areas are outside of the rotor burst large
fragments impact zones.
x Keel beam connections are built of several connecting elements.
6.4.2.4.4 Section 21 / Center Wing Box
The upper/bottom skins, front/central/rear spars are made in CFRP, which is a good
material in terms of damage propagation.
The centre wing box has three spars (specific to A380).
Page 73 of 150
UERF GUIDELINES
The upper (or the bottom) skins are made in two different panels. The skin panels are
joined together with the spars with a separate angle which limits the extension of damage
propagation.
The diagonal struts are designed with the ability to withstand the limit loads with one strut
broken.
The wing joint is perpendicular to the engine debris trajectories thus the complete loss of
the wing joint integrity is not possible.
At the rear spar the junction between wing box and fuselage is a fail-safe design.
In case of failure of the front spar frame, the adjacent frames can withstand the get home
loads.
Front and rear spar frames
Fail safe design
Wing joint perpendicular to

debris trajectory
Upper & lower skins in 2 3 spars
different panels
Figure 16: Centre Wing Box structure
6.4.2.5 Wing structure

Here again, design precautions are extracted from A380 certification report. Some of them are
specific, others are general.
The A380 wing (as shown below) has many comparable design features and materials as
previous Airbus products with the exception to the Inner Fixed Leading Structure, kinked-spar at
wingbox rib 14, a number of carbon ribs used in the wingbox and a more highly optimised
structure.
The layout of the primary structural components provides a degree of redundancy as previous
Airbus aircraft. All main components; skins and stringers, spars and ribs, include the same damage
Page 74 of 150
UERF GUIDELINES
tolerant design features. Bolted or riveted joints provide crack arresting features including crack
stoppers on spars, helping to contain damage within individual components.
In addition, design principles for LE surfaces in line of flight of HTP include multiple supports to
enhance continued safe flight following UERF event.
Figure 17: Wing general assembly
6.4.2.5.1 Wingbox
x Covers
The main wingbox covers are primary target within the trajectory range of the ±5° 1/3 disc
debris.
In the ±5° UERF zone , the top and bottom wing skins are constructed from 4 separate panels
(see figure 19), preventing crack propagation across the wing. The lower skin and stringer material
(Al 2024) provides good damage tolerance properties; and for cuts within individual panels, crack
arrest will occur at the panel joints thus preventing damage propagation across the wing.
The stringer areas and pitches are proportioned to the skin thicknesses to give them a near
optimum crack retarding ability. For static considerations, in the event of damage to the lower skin,
the yield/ultimate strengths and good ductility of the Al 2024 material enhance the capability of the
skin to redistribute load in a chordwise direction to remaining intact structure, including the spars.
x Spars (front, rear & centre)

The spars have features to limit the propagation of damage and the degradation of static
strength when partially damaged.
Kinked front spar (at wingbox rib 14) is less likely to be hit than if the spar was straight.
All spars are designed with closely pitched vertical stiffeners as shown below. All vertical and
horizontal stiffeners act as crack retardation features, helping to contain damage. In the event of
Page 75 of 150
UERF GUIDELINES
damage, the stiffeners act as shear panel boundaries, providing edge support and helping to
maintain the static strength of the remaining intact panels.
Top Flange
Vertical Stiffener
Bottom Flange
Web
Figure 18: Front spar (inner shown) integrally stiffened

x Ribs
Metallic and hybrid ribs were used in the wingbox design. The ribs contain both local and global
redundancy features and act as supporting structure to the main skins and spars.
Metallic ribs, as current aircraft ribs, are designed with closely pitched vertical stiffeners. Following
damage, the majority of stiffeners will remain intact - rib will maintain Brazier load capability.
Hybrid ribs have Carbon web, vertical and horizontal stiffeners with metallic foot rib and boom. The
Joint between the metallic rib foot and the composite provide a crack/delamination retardation
capability. Hybrid ribs have a limit load residual strength capability with one complete vertical
stiffener debonded.
6.4.2.5.2 Trailing edge control surfaces (specific to quad)
x Spoilers 1 to 4
Each spoiler is supported on 4 hinges and loss of 1 hinge does not lead to spoiler detachment.
6.4.2.5.3 Fixed Leading Edge structure
x Inner Fixed Leading Edge including bath-tub region

IFLE structure including Bath-Tub region is supported on truss ribs. It is a damage tolerant
design. Bath-Tub can take limit loads with 1 node failed. IFLE can take limit loads with 1 node
failed.
x Mid and Outer Fixed Leading Edge

Mid and outer fixed leading edge structures are constructed from thermoplastic/glass materials,
i.e. similar design to the A340-600 inboard fixed leading edge structure. They are supported on LE
ribs.
Loss of more than 1 rib does not lead to the detachment of mid and outer FLE. Slats in retracted
configuration covers the mid and outer FLE structures.
Page 76 of 150
UERF GUIDELINES
front spar Droop nose Twin bleed

drive ribs air ducts
Bath tub ribs
Droop Nose
hinge ribs
sub spars
Figure 19: Inner fixed leading structure including bath-tub region
Figure 20: Mid-Fixed leading edge structure
Page 77 of 150
UERF GUIDELINES
x AGU attachments (specific to A380)

AGU mounting concept (see Figure 24) has multiple struts (3-way mount bracket covered by its
position to the rear of AGU and 2-way bracket covered by structural shield) provide structural
redundancy. In addition to the shield on front of fwd attachment point, failure of one strut does not
lead to AGU detachment.
6.4.2.5.4 Fixed Trailing Edge secondary structure

This chapter is specific to quad since the area is usually out of UERF area for twin aircrafts.
x Overwing panel
The Overwing panel is designed to withstand 100% limit load with failure of any single
attachment. Overwing panel can sustain the loss of any two of the attachments points 1 to 6, even
if adjacent.
Three waiting fail-safe joints were introduced between the aft edge of the Overwing panel and
forward edge of the Shroud box. In the event of failure of the aft pair of inboard support struts the
waiting fail-safe joints would carry the transfer of load from Overwing panel to the Shroud box.
Inner Rear
Spar *
WLG Hinged Door
False Over-wing Panel

Rear
Spar *
Inner Fixed
Shroud
Shroud
Box
WLG Leg Under-wing
Faring Panel
Figure 21: Fixed Trailing Edge Secondary Structure
x Shroud box (specific to A380)

The Shroud Box incorporates all practicable design features (multiple attachments, see figure
26) to minimise the risk of it becoming detached. Three waiting fail-safe joints between the
Overwing panel and Shroud Box come together with a continuous buttstrap along the joint.
Any 2 adjacent struts along the shroud box and overwing panel can fail without leading to its
detachment. Three waiting fail-safe joints can fail without leading to the Shroud Box detachment
provided that other attachments remain undamaged.
Any two adjacent nodes can be destroyed with no risk of Shroud Box to detach.
x Inner Fixed Shroud box (specific to A380)

The Inner Fixed Shroud Box incorporates all practicable design features (multiple attachments)
to minimise the risk of it becoming detached. It can survive the loss of any one-rib top and bottom
attachments to the false rear spar.
Page 78 of 150
UERF GUIDELINES
x FTE skin extension

The FTE skin extension can sustain 70% limit load with the loss of 2 stringers and skin in the
upper panel between gear rib and aft rib 10.
6.4.2.5.5 Pylon/wing attachments (forward and spigot)
The A380 pylon to wing forward mountings are made of two swinging links on the pylon
side and four fixed lugs on the wing side. Failure can occur in either of the links or any of the lugs
and limit load can still be carried.
The spigot fitting has a fail-safe capability thanks to incorporation of a ‘fail safe’ pin passing
through the spigot boss. Failure of the spigot boss can occur and limit load can still be carried.
Layout of the engine pylon fittings is designed such that no uncontained debris from an outboard
engine within a ±5° risk volume, should impact the fittings on the inboard engine on the same wing.
The outer engine Toe-in angle has been set to 2º to achieve this objective.
Due to engine positioning, it is not possible to loose both engines on the same wing following an
UERF event.
The structure is designed so that the outboard engine burst at +3º cannot impact the
opposite inboard engine/pylon wing attachments i.e. the rear pick-up point of the inner pylon has
been shifted 140 mm forward to recover disc burst situations with respect to original A380 design
prior engine fan diameter setting to 116” (+3º opposite wing side fan burst trajectory, +5º same
side fan burst trajectory).
Toe-in increase
1.7° 2° to recover disc
burst situation
(5° same wing)
3 5
Forward. shift of I/B wing-to-pylon rear

pick-up point by 140 mm to recover disc
burst situation
(3° opp. wing)
Figure 22: Engine mount modification to improve UERF situation
6.4.2.6 Pylon structure

The engine mounts and pylons have a damage tolerant design or a good level of redundancy
which allows to withstand loads following a partial failure due to an UERF event.
x Front engine mounts
The front mount beam is split in two parts, each half beam being capable to withstand limit
loads.
Page 79 of 150
UERF GUIDELINES
x Thrust system
The thrust system is made of two thrust links, two swinging beams and two thrust pins. Each
of those redundant parts is capable to withstand limit loads in case of failure of the other one.
Figure 23: Thrust system view
x Rear engine mounts
Page 80 of 150
UERF GUIDELINES
x The rear mount incorporates two fail safe designs which lead to the following load
capabilities:
o The mount is able to withstand limit load with either link or boomerang failed,
o The mount can withstand limit load with one lateral fitting or 2 pylon bolts failed.
Figure 24: Rear engine mount view
x Pylon to wing attachments

The attachments between the pylon and the wing are located out of the trajectories (at +/-5° &
+/-15°) of the debris coming from their own engine.
The front and the rear wing/pylon attachments are fail-safe design with double
links/fittings/pins. In case of failure of any of those elements, the remaining ones can withstand the
limit loads.
Forward Pylon /
Wing attachment
Aft Pylon / Wing

attachment
Figure 25: Pylon to wing attachments
x Pylon box
Page 81 of 150
UERF GUIDELINES
The pylon box is a multiple elements construction (i.e. 3 spars and two lateral panels) which
limits the propagation of damage.
The door cut-outs into the lateral panels are staggered between the LHS & RHS of the pylon
which offers a good load redundancy.
The pylon box is made of Titanium alloy, the heat treatment of this material has been tuned to
achieve a high level of fracture toughness.
Figure 26: Pylon primary structure assembly
.
6.4.2.7 Structure damage tolerance criteria
This chapter will be detailed in a next issue of this document.
This should capture what are the considerations by structure specialist to set the damage
tolerance criteria. This section should provide data for design precaution, damage tolerance and
take credit of the drafted structure guidelines.
6.4.2.8 Composite structure
This should capture what exist today to assess the composite structure, assuming infinite
energy, to be significant structure as defined in AMC20-128A. Attention must be paid to tests
provided by the FAA and on the several studies that are in the loop. Feedback from Airworthiness
Authorities is pessimistic and easy way to introduce energy absorption is not foreseen.
6.4.2.9 Energy consideration

This section should capture What is feasible for the one-thi[disc fragment, What is realistic
considering small fragments and How to consider the Functional Digital Mock Up (FDMU)
6.4.2.9.1 Small fragment's energy vs. Nacelle
Page 82 of 150
UERF GUIDELINES
This section should capture small fragment energy provided by engine manufacturer or
calculated by air framer. This should identify that air framer considers that a large debris has made
a hole inside the engine core and the nacelle then a small fragment is able to go through this hole
without energy absorption.
6.4.3 Systems
This chapter is organized in functions as AC20.128A §8 “Accepted design precautions” to
detail Airbus usual response to certification requirements. Some additional usual design
precautions are also provided.
6.4.3.1 Uncontrolled Fire
6.4.3.1.1 Fire Extinguishing Systems

AC20.128A requires (§ 8.a.(1)):
- Detection of failed engine fire
- Detection and extinction of any other engine, APU or cargo compartment
It is clearly identified that extinguishing of failed engine may not be effective due to the loss of
containment of the extinguishing agent.
In practice, detection of engine fire is ensured by two loops of detection segregated in a way
(typically deck/leading edge and ceiling/trailing edge for a twin aircraft) that both can’t be impacted
on the same trajectory except for failed engine. For that purpose, a specific logic is implemented.
The so-called flame torch logic ensures that fire warning will be triggered if both loops are
damaged in a very short time frame (typically 5 sec).
If extinguishing system offers a lot of redundancy (more than 2 signals), it is an objective to
maintain the capacity to activate one extinguishing bottle.
For all the other detection system, usual precaution is a segregation of redundant signals
inside the fuselage ensuring the availability of the fire warning. The same applies to the
extinguishing system for areas not directly exposed to the UERF fragments. For areas that can be
impacted by an UERF (e.g. forward cargo on twin aircraft), it may not be possible to keep
extinguishing operational but this is often an objective, although the damages to this area will be
combined with a depressurization that would lead to decrease the risk for the fire to be
uncontrolled.
6.4.3.1.2 Flammable Fluid Shutoff Valve

AC20.128A requires (§ 8.a.(2)) requires isolation of any flammable fluid since shutoff of
flammable fluid supply to the engine may be the only effective means to extinguish a fire following
an uncontained failure.
In practice, several elements are used to isolate an engine fire

- Fuel isolation:
Page 83 of 150
UERF GUIDELINES
o Either by closure of Low Pressure Shut Off Valve (LPSOV ATA28 commanded
through Engine Master Switch & Fire Push-Button). This is the privileged mean
since the LPSOV is dual commanded and has at least one channel supplied in
EMER (since A320) and segregation can be put in place to ensure its availability
(see figure below) As far as practicable LPSOVs shall be located outside +/-5°
UERF risk area from both engine and outside +/-15° area of failed engine. If it can’t
be located outside small fragments area, It shall be protected by accurate shielding.
Figure 27 : A350 LHS LPSOV segregation
o
Or by closure of High Pressure Shut Off Valve (HPSOV ATA70 commanded
through Engine Master Switch). Whenever possible, the HPSOV route is
segregated from the LPSOV routes.
- Hydraulic fluid isolation:
o By closure of associated Hydraulic Fire Shut Off Valves (FSOV ATA29). FSOV
valves are double commanded and supplied in EMER so electrical segregation shall
ensure its operability. Example of segregation for FSOV located outside UERF area
(G FSOV on A350) and inside UERF area (Y FSOV on A350) are provided below.
Page 84 of 150
UERF GUIDELINES
Figure 28 : A350 G LHS FSOV segregation
Figure 29 : A350 Y RHS FSOV segregation
- Hot air isolation:

o By closure of Bleed shutoff valve at engine level (OPSOV (A350) ATA36). If it is
double commanded (as on A350), it is possible to keep it operational by accurate
segregation except for direct impacts on the valve itself.
o Or closure of Cross Bleed Valve in case of impact on the engine valve (XBV
ATA36). The XBV routings shall be segregated from those of the engine bleed
valve.
Other precautions have to be taken with respect to risk of fuel leak, see §6.4.5.4 Dry Bays.
6.4.3.2 Loss of Thrust
AC20.128A addresses 3 aspects:
Page 85 of 150
UERF GUIDELINES
- Fuel reserves (§8.b.(1))

- Engine controls §(8.b.(2))
- Other engine damages (§8.b.(3)). Associated design precautions are addressed in § 6.4.6.1
cross engine debris
For Fuel reserve, the goal is to keep sufficient fuel to reach a diversion airport by minimizing
the amount of fuel lost either by tank puncture or fuel pumps leading to unusable fuel. First
precaution is on the location of the tanks as described in §6.4.5.2 fuel tank boundary layout rule.
Design precautions are then taken to avoid losing all pumps in a fuel tank. This implies appropriate
electrical segregation taking credit of power supply sources. Additionally, fuel maybe available on
the opposite side of a remaining engine so that Crossfeed function shall be available. Usually two
Crossfeed valve are fitted in parallel such that the opening of one valve is sufficient. The valves
wirings are thus segregated so that a single one-third disc can’t impact both of them.
Usual design precautions implemented on control of the engine thrust:

- EEC is supplied by a PMA (permanent Magnet Alternator) ensuring independence from A/C
power
- 2 different means to provide the inputs to the EEC (throttles + auto pilot)
- EEC itself is composed of two independent channels, each being able to control the engine.
- These 4 redundancies are segregated such as they can’t all be lost on the same trajectory
except close to the engine.
- Since A380, an accommodation logic has been implemented to cover those impacts: when
EEC receives no throttle lever information, it sets a thrust level using local Mach number and
previous engine setting
With those design precautions, remaining engine(s) thrust is always controllable and is available as
soon as the engine itself is not impacted.
6.4.3.3 Loss of Airplane Control
- Flight Controls (§8.c.(1))
- Emergency Power (§8.c.(2))
- Hydraulic Supply (§8.c.(3))
- Thrust reverser systems (§8.c.(4)). This chapter is covered here in §6.4.6.2
For flight controls, the architecture is built with different sources of power. On Airbus A/C
the architecture is either a 3H (3 Hydraulics (Green, Blue, Yellow) – WB/SA/LR) or 2H2E
(2Hydraulic, 2 Electric – A380/A400M/A350). In all cases, design precautions are taken in order to
keep sufficient control on all the axis (pitch, yaw, roll) but it is not always possible to avoid CAT
repercussions and loss of airplane control is a usual contributor to the residual risk. Usual design
precautions are :
- Segregation of different signals associated to the different power sources,
- Keep minimum aircraft control on trajectories leading to lose all engines (cross engine
trajectories on twin aircraft) by ensuring control of the surfaces associated to the circuit
powered by the RAT (Ram Air Turbine) are not installed on those trajectories (e.g ceiling for
classical twin with wing mounted engines).
Emergency power:
Here again, main design precaution is to locate emergency generation channel and the RAT
itself (and associated hydraulic circuit + CSMG if it is hydraulic) outside UERF trajectories leading
to lose all engine power.
Hydraulic supply:
Page 86 of 150
UERF GUIDELINES
For hydraulics, a mean to keep sufficient hydraulic power is implemented in order to maximise
hydraulic availability. Ideally, at least one hydraulic is located outside UERF area (except at engine
level if it is pressurized by the engine power) and isolation means are put in place in order to
isolate any leakage if the circuit as another mean of pressurization than the failed engine. Logics
are put in place to detect leaks either by pressure drop (A400M/A350) and/or fluid loss (LR/A350)
and isolate the leak by closure of appropriate FSOV.
6.4.3.4 Passenger and Crew Incapacitation

- Pilot Compartment (8.d.(1)) which shall be outside +/- 15° risk area which is always the case on
Airbus A/C.
- Pressure Vessel (8.d.(2)). It is requested either to ensure that the debris can’t impact the
pressurized cabin or to show that A/C will sustain the rapid decompression and that the cabin
pressure decay rate will allow an emergency descent without incapacitation of the crew or
passengers. Such studies are done by air conditioning teams and design precautions are taken
to ensure flight crew oxygen availability (fully outside UERF area) and maximise passengers
oxygen supply by accurate segregation and duplication.
6.4.3.5 Other functions usual design precautions
This chapter lists some usual design precautions taken on Airbus A/C. The list shall not be
considered as exhaustive and certification reports detail the precautions taken on each type of
aircraft.
6.4.3.5.1 Electrical routes installation / segregation
Figure 30: A350 Electrical routes with deviations outside risk areas
Electrical routes segregation from floor to ceiling or keel routes is being done with respect
to the maximum affected area. This means that electrical routes deviation should be done outside
of the +15/-15 degrees risk area for a turbofan (note: for the aft deviation, this could be inside the
risk area of small fragments provided it is shielded by the wing. Attention should also be taken for
segregation between keel and floor routes or floor and ceiling routes in order to not jeopardized at
the same time electrical redundancy, meaning a one third disc shall not be able to impact two
redundant route on the same trajectory: one on the floor on one side, one on keel or ceiling on the
other side.
Page 87 of 150
UERF GUIDELINES
Figure 31: A350 – example of 1MB deviation routings (ceiling within UERF area)
6.4.3.5.2 Wing Anti-ice

Wing-mounted aircrafts
Loss of WIPS (Wing Icing Protection System) may lead to 3 possible CAT scenarios:
¾ Aircraft controllability at low speed: the possible phenomenon of ice accretion on
wings, during a flight in icing conditions, drives to a degradation of the aerodynamic
performances of the aircraft. In combination with a high angle of attack, extreme flight
attitudes could lead to the loss of aircraft controllability and to CAT scenario.
¾ Deceleration on track risk: the main consequence of the ice accretion is the
degradation of aerodynamic performances involving an additional landing speed
penalty (estimated to 15kts for A350XWB program by HQ Teams). This additional
speed means an increase of the landing distance length and reduces the number of
possible deviation airports in case of an UERF event.
In A350XWB program, calculation of WIPS loss impact on the aerodynamic performance
degradation or the detached ice accretion risk is assumed as very conservative:
¾ as long as thrust is available crew will follow the recommendation and avoid icing
condition
¾ In case of TEFO, remaining flight duration is very limited and it can be considered that
ice accretion will be very limited.
As result, WIPS loss could be managed at crew level and could no more be considered in the
frame of UERF - low speed performances analyses.
Rear end engine aircrafts
In this kind of engine integration, a particular risk scenario is added (all other risk remain
possible). Ice stab from the wing, taken down, may impact the remaining functional engine and
lead to a TEFO – Loss of thrust failure scenario.
In A30X program, a conservative risk volume has been defined on the wing. This security
perimeter includes all the possible locations of stabs which trajectories are susceptible to
impact the engine in the rear part of the plane. This volume has been reduced to Slat 1.
Page 88 of 150
UERF GUIDELINES
Figure 32: A30X Status B3 Detached ice accretion CAT area
In A3OX program, aerodynamic degradation by ice accretions is not considered as CAT. As

engines are located in the Rear End Fuselage, secondary debris, detached from wing
accretions may impact the remaining engine and lead to a TEFO CAT scenario.
Conservatively, all airborne flight phases are considered as CAT. This assumption may be
refined by performance analysis.
6.4.3.5.3 Deceleration
Several systems are contributing to the deceleration:
- Braking system which commands wheel brakes
- Thrust reverser system which commands reverse thrust on remaining engine(s)
- Secondary flight control system, which, by means of slats and/or flaps extension increases
aircraft lift and drag to decrease approach speed.
- Primary flight control system, which by mean of ground spoilers provides lift dumping, and
increases brakes efficiency by maintaining aircraft on ground.
Design precautions are taken to maximise the availability of those systems:

- Braking: The different braking modes (Normal / alternate / emergency) use different power
sources (hydraulic / accumulators). Whenever possible, accumulators are put outside risk area
to maximise power availability in case of hydraulic loss. Segregation of antiskid signals
(tachometers) is also implemented to minimize their loss. On A350, those signals have even be
duplicated ensuring antiskid is always available.
- Thrust reversers: it is a design objective to maximise thrust reverser availability. As design is
such that in case of loss of any element the system won’t deploy (due to the objective to avoid
in flight deployment), all commands / wirings are routed as close as possible using the shortest
route within UERF area.
- Secondary flight control: Slats / flaps are either actuated by 2 hydraulic systems or one
hydraulic / one electric (case of slats for A380/A350). Commands of those systems are
segregated taking into account the trajectories leading to lose the different power sources.
- Primary flight controls: Spoilers segregation is driven by the roll control aspects but design
precautions are also implemented to ensure flight/ground logic is available. The mean used is
the introduction of several redundant signals, which are segregated when crossing UERF area.
The logic is tolerant to partial loss of signals and is able to build a robust flight/ground status
with a mix of Weight on Wheels, Radio Altimeter and Tachometers signals.
6.4.3.5.4 Extension retraction
Page 89 of 150
UERF GUIDELINES
Maximizing retraction to limit additional drag is essential since the aircraft climb
performance is impaired by the loss of at least one engine due to UERF. Retraction is always
powered by hydraulics so it can’t be maintained when the hydraulic is loss. Design precautions are
taken to segregate the electrical signals and then ensure the retraction unless the hydraulic is lost /
the aircraft is in emergency electrical configuration / the gear itself is impacted (quad engines
aircrafts only usually).
For extension, there is an alternate (gravity) extension system to enable gears extension in
the case of loss of hydraulic power. Design precautions are implemented by the mean of
segregation to ensure the extension is always available (not always possible on quad engines
aircrafts due to gears location within risk area).
6.4.3.5.5 Communication & Navigation
Navigating and communicating are essential functions for the flight crew. Critical sensors,
antennas and computers are usually located forward UERF area and the classical design
precaution consist in ensuring that a minimum of elements are supplied in Emergency so that they
are always available after an UERF.
6.4.4 Fire Risk

6.4.4.1 Internal fire
According to AMC §25.903 (d) (1), 2.1: “consideration has been given to spillage of fuel into
the engine compartment and any other region of aeroplane where a fire hazard could result”.
Risk of Internal Fire function corresponds to fragments impacting tanks or pipes containing
flammable fluids. Internal Fire may occur if there is a leakage directly on a source of ignition
identified, inside the aircraft (belly fairing, wing, pylon).
Flammable fluids :
¾ Hydraulic (ATA 27 / 29) : Oil auto-ignition temperature 400 °C.
¾ Fuel (ATA 28) : Fuel auto-ignition temperature : 200 °C.
Source of ignition :
¾ Electrical equipment creating sparking (ATA 24 / 92) : maximum temperature 500 °C
¾ Hot surfaces (ATA 21) : maximum temperature on ECS packs 260 °C
¾ Hot air (ATA 36) : maximum temperature on bleed pipes 230 °C
Main risk usually identified is a fuel leakage directly on ECS packs (hot surfaces) at belly
fairing level.
Page 90 of 150
UERF GUIDELINES
Figure 33: Example of Internal fire critical trajectory (A350 XWB)
Reduction factors calculation (A350 XWB):
Hereafter are described the different parameters which determine reduction factors
associated to Internal Fire risk. Figures below must be mitigated with Flight Phase distribution
number (Fj).
Fuel tank filling: Risk exists whether Center fuel tank is filled (half of A350 flights) or almost
empty (fuel residue impossible to drain during Descent / Approach / Landing flight phases). In
consequence, maximum probability is applied (=1) for all flight phases.
V1 to first
Take-off Landing/
Flight phases power Climb Cruise Descent Approach
before V1 Reverse
reduction
Fuel Tank filling 1 1 1 1 1 1 1
Table 6: Fuel tank filling reduction factors (Sij)
Emergency evacuation: During Take-Off and Landing flight phases, an emergency evacuation
might still be possible in case of internal fire. In this case, reduction factors associated to External
fire / Cross wing shot are applied.
V1 to first
Take-off Landing/
before V1 Reverse
reduction
Page 91 of 150
UERF GUIDELINES
Emergency
6/9 1 1 1 1 1 6/9
evacuation
Table 7: Emergency evacuation reduction factors (Sij)
ECS packs auto-ignition risk: It is considered that there is ½ probability for a fuel leakage to
cause an Internal fire on ECS packs. Same probability is applied in case of fuel leakage on hot
brakes. Given that hot brake temperature is higher than ECS packs, this assumption is rather
conservative.
V1 to first
Take-off Landing/
before V1 Reverse
reduction
ECS packs
1/2 1/2 1/2 1/2 1/2 1/2 1/2
auto-ignition risk
Table 8: ECS packs auto-ignition risk reduction factors (Sij)
Sparking risk : There is 1/20 probability for an electrical wire cut to generate a continuous
sparking. In the frame of previous aircraft certifications (A320, A340) 1/10 probability has been
applied. It corresponds to two electrical wire cut. Same probability is applied here.
V1 to first
Take-off Landing/
before V1 Reverse
reduction
Sparking risk 1/10 1/10 1/10 1/10 1/10 1/10 1/10
Table 9: Sparking risk reduction factors (Sij)
Regarding previous assumptions, internal fire risk can be characterized through following
functions:
Function 2: Impact on [Center Fuel Tank] and [Drip shields]: leakage on ECS
packs risk.
Function 3: Impact on [Center Fuel Tank] and [Electrical wires]: sparking risk.
Leakage on ECS packs:
- Sij = [Tank Filling] x [Emergency Evacuation] x [Hot wall auto-ignition risk]
V1 to first
Take-off Landing/
before V1 Reverse
reduction
Fj 0.350 0.200 0.220 0.140 0.030 0.020 0.040
1*6/9*1/2 1*1*1/2 1*1*1/2 1*1*1/2 1*1*1/2 1*1*1/2 1*6/9*1/2
Sij
= 0.333 = 0.500 = 0.500 = 0.500 = 0.500 = 0.500 = 0.333
FjxSij = Kij 0.117 0.100 0.110 0.070 0.015 0.010 0.013
Page 92 of 150
UERF GUIDELINES
Table 10: Leakage of on ECS packs reduction factors
Sparking risk:
- Sij = [Tank Filling] x [Emergency Evacuation] x [Sparking risk]
V1 to first
Take-off Landing/
before V1 Reverse
reduction
Fj 0.350 0.200 0.220 0.140 0.030 0.020 0.040
1*6/9*1/10 1*1*1/10 1*1*1/10 1*1*1/10 1*1*1/10 1*1*1/10 1*6/9*1/10
Sij
= 0.067 = 0.100 = 0.100 = 0.100 = 0.100 = 0.100 = 0.067
FjxSij = Kij 0.023 0.020 0.022 0.014 0.003 0.002 0.003
Table 11: Sparking risk reduction factors
6.4.4.2 External fire
External fire function corresponds to fragments impacting fuels tanks and generating a
leakage close to an “external” source of ignition : the wheel brakes. In consequence, external
fire might only occur when landing gears are deployed, during Take-Off and Landing flight
phases.
The fuel tank lower cover laterally cut at 1 meter from hot wheels external parts constitutes the
UERF area (assumed as exterior surface of the wheel rim). If a release fragment hits the lower
cover target, the fuel will leak on the landing gears. If it hits the front spar as well as the bottom
surface of the leading edge, it is considered that fuel will fill the leading edge before leaking
through the fragment’s hole on the bottom surface of the wing.
A distinction is established between Single wing shots and Cross-wing shots : single wing shot
corresponds to a fragment impacting only one wing (one fuel leakage) and Cross-wing shots,
impacting both wings (two fuel leakage, risk increased). This distinction has been firstly
established in the frame of A380 UERF certification.
Figure 34: Single wing shot / Cross wing shot external fire (A380)
Page 93 of 150
UERF GUIDELINES
Once fire is propagated, risk is estimated according to wind directions and the number /
repartition of emergency exits. The objective is to estimate the possibility for passengers to
evacuate if a fire propagates and to mitigate residual risk.
Reduction factors calculation:
Combined to this reduction factor, a Fire ignition factor of ½, as for previous Airbus UERF
certifications programs, is applied to both cases. This leads to total reduction factors of 2/9 for
Single Wing Shots and 1/3 for Cross Wing Shots, taking into account ground phases only,
hence Take-Off and Landing flight phases.
st
Risk of V1 to 1 Power
Take-Off Climb Cruise Descent Approach Landing
External Fire Reduction
Single Wing 0.07778 0.00889

0 0 0 0 0
Shots (0.35x[2/9]) (0.04x[2/9])
Cross Wing 0.1167 0.01333

0 0 0 0 0
Shots (0.35x[1/3]) (0.04x[1/3])
Table 12: External fire reduction factors
6.4.5 Engine Integration

The most effective method to minimize the damage that can be caused by UERF is location of
critical components outside the fragment impact areas. Engine location is a main driver for the
definition of the risk area, according to the debris spread angle of +/-5° and +/-15°. Therefore
the overlap of the risk area with regard to critical airframe components should be carefully
assessed.
When engine location is studied, UERF constraints should be considered, among other design
constraints (cargo door clearance, ground clearance, slat kinetic clearance, aero lines, engine
length). These studies are usually performed by aircraft architects and future project office, so
a close collaboration with these teams is essential.
6.4.5.1 Engine positioning versus critical elements
The list of components that need to be considered when locating the engine is given by AMC
20-128A § 7a. For Airbus aircraft, following items are usually in a safe area: pilot compartment,
APU, instrumentation essential for aircraft control, cabin pressure bulkhead, vertical tail plane.
The analysis of engine location for Airbus aircraft includes the following items:
x Other engine (in case of 4 engine aircraft configuration)
x Wing joint root (for wing mounted engine)
x Vertical tail plane (for rear mounted engine)
x Cabin pressure bulkhead (for rear mounted engine)
x Fuel tanks and crossfeed components
x Power generation systems.
Page 94 of 150
UERF GUIDELINES
6.4.5.1.1 Wing mounted engines

The specific components that are considered for a wing mounted engine configuration are
considered according to the approach detailed in the following sub parts.
6.4.5.1.1.1 Engines position’s guidelines considering a 4 engines aircraft
In case of 4 engines aircraft development, it is important to well define the engine position
regarding ground clearance criteria, nacelle fan cowl interferences and UERF requirement by
example.
The UERF requirements that would be taken into account is divided in several criterion :
x One-third disc fragment ejected with +/-5° from a given engine is only able to impact the
engine case of the one located at the same position on the opposite wing,
x An outboard rd engine one-third disc fragment with+/-5° chi spread angle must not impact the
rear mount of his adjacent inboard engine,
x An outboard engine one-third disc fragment with+/-3° chi spread angle must not impact the
rear mount of the opposite inboard engine,
x An outboard engine fan blade or small fragment with +/-15° chi spread angle must not impact
the tail bearing housing of the opposite inboard engine,
x An inboard engine small fragment with +/-15° chi spread must not impact the flange A
(containment casing) of the opposite outboard engine,
6.4.5.1.1.2 General aircraft arrangement
The flight deck, including essential instrumentation must be outside the +/-15°burst area,
The avionics bay must be outside the +/-15° burst area,
6.4.5.1.2 Rear end engine integration
Engine x-positioning
Rear passenger door clearance is a constraint in nacelle & pylon fairing position.
Figure 35: Rear passenger door location
Pressure Bulkhead locations must be out of UERF/PORBR Risk volume, as illustrated in the
figure below.
Page 95 of 150
UERF GUIDELINES
Figure 36: Pressure Bulkhead location
At least, most forward one-third disc must not hit pressure bulkhead and forward
pylon/fuselage mount must be located one frame behind pressure bulkhead.
Ways of mitigation exist:
x Reducing inlet length
x Reducing pylon fairing sweep angleVTP/APU relative position
VTP position constrained by engine location
In case of a UERF event, flight controls on VTP and HTP must be located out of UERF risk
volume. Design precautions must prevent engine fragment from impacting hydraulic circuit
combinations or directly, flight surfaces of VTP/HTP.
However, this particular structure may be helpful in shielding technology. It is possible to:
x Use VTP to shield opposite rotor against small fragments
x Use VTP to shield opposite engine against small fragments
Following figure illustrates a HTP/VTP shape, with respect to these design precautions.
Page 96 of 150
UERF GUIDELINES
Figure 37: HTP/VTP design solution
Fuselage shape
Fuselage shape is conditioned by aerodynamical performances of the aircraft. AERO/propeller
interactions need to be minimized in order to optimize propulsion.
Figure 38: HTP/VTP design solution
Particular attention must be paid to:

x Smoothing of the junction at the RPB (1)
x Refinement of the VTP-fuselage intersection (2)
Curvature inflexion at the bottom (3)
6.4.5.2 Fuel tank boundaries layout rules
Starvation of fuel will lead to loss of thrust. In order to minimize this risk, engine location is a
key driver to the design of fuel tanks arrangement. The aim is to provide a configuration that
enables fuel reserves after the event, in the required quantity to complete the flight or a safe
diversion.
This item is one of the main concern for the Authorities. For recent programs, Airbus has
minimized this risk until some limits, and claimed for impracticability about further design
modifications. It was a long process to convince the Authorities on such an approach, and
required a significant amount of detailed investigations.
Page 97 of 150
UERF GUIDELINES
The general approach for fuel tank arrangement design is to set the boundaries of the outer
tanks outside of the +/-5° risk area. But this constraint reveals often very challenging, and
optimized designs are studied with regard to outer tank capacity and refined model (third disc
at +/-3° and finite energy approach for intermediate fragment at +/-5°).
The aircraft fuel tank arrangements are detailed in the note [18].
Figure 39: A350XWB fuel tank arrangements vs LPT2 5° debris
6.4.5.3 Least risk area

Critical fuel system components could lead to total loss of fuel. Particularly, the crossfeed
system is a common point between the fuel tanks, and allows the use of fuel from one side to
the other side engine. Such components need to be installed in the fuel tanks, but outside of
the risk area.
In order to achieve this system installation, a least risk area must be arranged in the centre
wing box area. This least risk area is a space outside of the +/-5° risk area, but still in the
boundaries of the fuel tanks. It is managed by locating and setting the engine relatively to the
centre wingbox rear spar, in order to secure some margin in front of the rear spar.
On a twin engine aircraft, the engine location is only constrained by an aft clearance with the
rear spar. On a four engine aircraft, the inner and outer engine must be positionned so that a
free risk space is secured in the middle of the inner engine and the outer engine risk areas. On
the A380, the outer engine tilt angle was increased in order to move rearward the risk area
and provide some space aft of the front engine risk area.
Page 98 of 150
UERF GUIDELINES
Figure 40: A380 least risk area
6.4.5.4 Dry bays

“The dry bay should be sized based on analysis of possible fragment trajectories through the
fuel tank wall and the subsequent fuel leakage from the damaged fuel tank so that fuel will not
migrate to an engine, APU or other ignition source during either – flight or ground operation. A
minimum drip clearance distance of 10 inches (254 mm) from potential ignition sources of the
engine nacelle, for static conditions, has been acceptable” from AMC-20-128A
Figure 41: Dry Bay analysis
A320 re-motorization (A320NEO)

In the frame of a certification, an aircraft is certified with a type of engine. In a case of a re-
motorization, the design/architecture of the aircraft exists and the aim of this exercise is to
minimize aircraft modifications.
Page 99 of 150
UERF GUIDELINES
In the case of the A320NEO, the engine characteristics (length, fragment size, etc..) are higher
than on previous programs. Thus, the main difficulties on this program is to :
- check cross areas as the engine is longer than on previous programs,
- check design precautions (ex. Dry bay, LPSOV location),
- check system segregation,
- challenge wing contribution. As the engine is moved backward compared to the previous
program and fragments are higher on LPT discs, the wing contribution increases significantly
at iso set of criteria.
6.4.5.5 Engine & pylon wing mount

The engine mounts and the pylon/wing attachments are usually fail safe parts, including dual
load paths. But the small volumes of these parts cannot prevent the risk of a big debris
damaging both load paths at once. On such trajectories, the pylon box will also be damaged to
a significant extend, therefore the pylon structure could also fail. That could render the engine
mounts as useless for such trajectories.
On Airbus aircraft, the pylon/wing attachments are out of the +/-5° risk area. The rear engine
mount is outside of the risk area for the A380 GP7200; the A320, and the A350XWB. For the
A380 T900, a little part of the mount is in the risk area.
Figure 42: Engine and pylon mounts location vs. risk area.
6.4.6 Engine & nacelle design precautions

There are 2 different cases to consider for engine & nacelle impacts.
For the bursting engine, the thrust and the associated systems are considered to be lost. The
only concern is the thrust reverse system. An inadvertent deployment shall be prevented, as a
residual thrust could be expected for a short period of time after the event.
Page 100 of 150

UERF GUIDELINES
For the opposite engine, an impact by a large debris could lead to its failure and subsequently
to a total loss of thrust. Therefore, the threat to consider is the small fragment and the fan
debris. The engine casing should protect the gas generator from impacts by that debris. The
aim is to minimize the risk of impact on opposite engine systems, and potential loss of
opposite engine thrust.
6.4.6.1 Cross engine debris
For every cross engine debris impacts, the maximum should be done to demonstrated that
practical design precaution have been taken into account. Effective segregation of
multiplicated electrical signal should be implemented and , protection by the nacelle structure
could be used to demonstrate compliance. In the lower part of the engine, at 6 o’clock, no
modification can be required taking into account, that the impact angle is significantly reduced
and that the fragment would be deviated.
Aircraft manufacturer would demonstrate compliance with AMC20-128A§7c
AMC20-128A §8 ACCEPTED DESIGN PRECAUTIONS.
(...)
AMC20-128A §8.b. Loss of Thrust.
(...)
AMC20-128A §8.b.(3) Other Engine Damage. Protection of any other engines from some
fragments should be provided by locating critical components, such as engine accessories
essential for proper engine operation (e.g., high pressure fuel lines, engine controls and
wiring, etc.), in areas where inherent shielding is provided by the fuselage, engine or
nacelle (including thrust reverser) structure (see Paragraph 7).
The goal of the UERF study is to minimise the risk of small fragments impacts on the engines.
It is necessary to demonstrate until the certification of the aircraft that all precautions have
been used and to improve the systems and structures to the next aircraft.
Example : Most penalising Small Fragments trajectories are tangent to the keel-beam(s) (finite
energy fragment stopped by significant structures as per AMC 20-128A §9.d).
Engine 3
Keel beam
Engine 2
D
FW
Page 101 of 150

UERF GUIDELINES
Figure 43: Significant Structure protection
Figure 44: Impacts definitions
Page 102 of 150

UERF GUIDELINES
Figure 45: Cross engine impact areas definition
Cross engine debris requirement will help to locate the wet (with hydraulics and fuel
components) and the dry (with electrics components) side around the engine case.
In case of twin-engine’s aircraft, the analysis concerns all the engines. In case of 4-engine’s
aircraft, the inboa[engines are generally concerned because many trajectories are not hidden
by “significant structure” as defined into the AMC20-128A.
Attention must be paid to engine debris from adjacent engine impacts (engine 1 onto engine 2,
engine 3 onto engine 4 and vice versa).
Figure 46: Engine Externals (Wet Side)
Page 103 of 150

UERF GUIDELINES
Figure 47: Engine Externals (Dry side)
With the engine manufacturer, the position of each system has to be analysed in order to
demonstrate that the engine integration has reached an optimum level of system behaviour
(e.g. : EEC or FADEC position and dedicated harnesses; FOHE or Fuel/Oil Heat Exchanger
position; Oil tank position; HMU position; Gearbox position; Hydraulic pipes; Fuel pipes; Other
systems pipes; ...).
Several way of compliance may be used to reach the objective, one way is to :
x Locate the systems above Rotor Burst limit and according to that, engine’s systems are fitted
in the correct place. Attention must be taken for the wet and the dry side.
The other way is to :
x Provide duplication and segregation of systems or signals inside the impacts area,
x Segregate the duplicated channels according to the thickness of the biggest small fragments,
x Locate electrical harnesses above fluid carrying pipes.
x Protect harnesses, fuel and hydraulic pipes behind the nacelle structure (e.g.: stiffeners),
x Demonstrate that the system structure casing (e.g.: Oil tank) is able to withstand the fragment
energy and not to be lost.
In particular place : consider the incidence’s angle of the fragment to ensure fragment
deviation and if not feasible add a shield in the high level of risk area. Validation of structure
impacts (cases or systems) with the engine fragment following the Aga[method can be used
but, attention must be taken as this method is validated for energy less than 20KJ.
Cross engine process :
x Analyse the engine installation provided by the engine manufacturer,
x Highlight critical equipments and define the installation requirements,
x Analyse engine manufacturer proposals (environment, feasibility, maintainability, ...),
x Discuss / Status with all involved persons on the best solutions to implement,
x Write the chosen solutions,
x Provide a report with all installation precaution taken on the engine.
Page 104 of 150

UERF GUIDELINES
Example of A330 / Trent engine accessory categories

CATEGORY ITEM
Primary Loss results in immediate loss Fuel pumps & pipes
of engine power Fuel control & associated hardware
EEC & Wiring
Oil pumps & pipes
Oil tank
Shielding Potential protection for primary IDG
items Hydraulic pumps
Starter
Figure 48: Protection with Nacelle stiffeners
Several architectures of pipes or harnesses can be implemented within the nacelle’s stiffeners
protection, examples are listed below :
Engine case
Engine axis
Nacelle
Small fragment
Stiffener
Pipe 1 & 2
Figure 49: Architecture solution 1
Page 105 of 150

UERF GUIDELINES
Engine axis
Engine case Nacelle
Small fragment
Stiffener
Pipe 1 & 2
Engine axis
Engine case Nacelle
Small fragment
Stiffener
Pipe 1 & 2
Example of in-service events
Figure 52: BAE 146 engine 1 impacts
Page 106 of 150

UERF GUIDELINES
Figure 53: BAE 146 engine 2 bursting
Figure 54: A330 leading edge impacts
Page 107 of 150

UERF GUIDELINES
Figure 55: Boeing 747-200 engine 1 bursting & leading edge impacts
Figure 56: Disc and blade after bursting event
Page 108 of 150

UERF GUIDELINES
6.4.6.2 Thrust reversers retention means

6.4.6.2.1 Regulation and past programs demonstration
FAR/CS 25.933 Reversing systems, requires that an airplane is capable of continued safe
flight and landing during & after any in flight T/R deployment or, in flight T/R deployment is
extremely improbable & does not result from a single failure condition or malfunction.
At engine nacelle local level, CS 25.933.a.1 & associated AMC 25.933.a.1 § 8.d provides
different approached to comply for the T/R design vs. engine rotor burst threat ; compliance
with at least one of two following approaches is sufficient :
x Since issue of JAR 25.933 & associated AMJ 25.933.a.1, Airbus always complied with §
8.d.4 which provides methods to minimize the haza[for thrust reverser restraining means
located within engine rotor burst zones. Provided method includes haza[model &
minimization means for the T/R analysis versus engine rotor burst threat. It requires
separation between primary & tertiary T/R retention systems. EDET14 recommends also
to use this usual mean of compliance for further engine.
x § 8.d.1 requests to “show that engine spool-down characteristics or potential reverser
damage are such that compliance with section 7 […], can be shown”.
Section 7 describes how to comply with “controllability option”, which provides continued
safe flight & landing following any in flight thrust reversal. Compliance with section 7,
means detailed demonstration in term of structure integrity, in term of performances & in
term of handling qualities ; it has also to be supported by wind tunnel test, simulation & /
or flight tests. Such a demonstration has never been performed within Airbus since issue
of JAR 25.933 & associated AMJ 25.933.a.1; it would be a heavy & complicated
demonstration.
On A340 with CFM56-5C, as there were some in flight opening of 1 pivoting door & as
1.E-09 requirement no longer matches, preliminary investigations have been performed to
assess compliance with “controllability option” in case of permanent reverse thrust of one
T/R door opening out of four of an internal engine. In this context some flight tests have
been done on A340 MSN 001 and shows that on inner engine whatever is the door and
for engine N1 at 70% demonstration of “controllability option” is granted. Nevertheless for
upper door when alpha goes to 10° and above, buffet is manifest and crew stopped the
test.
Assessment of behaviour for higher angle of attack or even for higher engine thrust and of
course for outer engines was not decided by end 2008. Considering that sleeve T/R (as
on T-XWB) have better efficiency (meaning a significant effect in terms of handling quality)
that door T/R (as on A340 with CFM56-5C), it may be even more difficult to comply for
sleeve T/R.
In consequence, even if ability to comply with § 8.d.1 can not be negated, EDET14
considers high risk to enter such compliance approach.
AC/J 25.933 provides method for the T/R analysis versus rotor burst : for deep bore disk, at
least one retention mean should be outside the ± 5° risk area whatever the considered rotor
stage. As per regulation, following impact combination is explicitly to be considered:
o A 1/3rd disc fragment
o & Multiple small & intermediate fragments
o Fragments released in +/-5° cone
o It is considered that the 1/3rd disc is not contained by engine / nacelle structure, but it is
considered that small & intermediate fragments are contained by nacelle structure
Page 109 of 150

UERF GUIDELINES
Figure 57: Typical combination of impacts to be considered (example on Trent-XWB)
On A380, worst scenario which has been demonstrated as acceptable from structural point of
view is as follows :one-third of disc ejected in the lower part of the nacelle, impacting the 6
O’clock beam with a spread angle of –5° and two or more intermediate fragments will
disconnect the primary actuators with a spread angle of +5°.
Figure 58: Trent 900 (A380) T/R actuator impacts
Page 110 of 150

UERF GUIDELINES
6.4.6.2.2 Compliance demonstration

Some dedicated analyses have to be carried out in order to cope with this requirement, the
first goal is to design the nacelle and especially the thrust reverser actuator such that, it is not
possible to hit all the retention means at the same time: as far as possible, this +/-5° separation
applies between 3rd lock & primary lock (including actuator & associated fitting) ; this has been
achieved on all AIRBUS nacelle. On the particular case of A340-500 / -600 with T500, special
primary lock fitting arrangement has been designed, such as massive part of the fitting is fwd
actuator head.
6.4.6.2.2.1 Hypothesis
Cold engine conditions have always been considered for separation demonstration.
6.4.6.2.2.2 Conservative analysis
This kind of analysis is done to demonstrate that sufficient axial separation exists allowing
to show that at least one retention mean is outside +/-5° of a given stage. T/R retention systems
should be separated axially, with at least one of the retention means (listed below), located outside
of the ±5 degree impact area cone.
x Upper Primary Lock (including actuator & fitting)
x Lower Primary Lock (including actuator & fitting)
x Third Lock (including plate)
For A350XWB, this analysis has been able to clear all stages except IPT mini disc. Figure
below shows the situation of one stage impacting only PLS and not TLS.
Figure 59: T-XWB 84K IPT1 third disc +/-5° risk area – impact on T/R integration
For some stages, it may be possible to damage the 3rd lock at –5° as well as fwd part of the
primary actuator fitting at +5°. This is the case of IPT mini disc on Trent-XWB 84K (December
2010 validation study which may change but this might be true for 97K engine) as shown on the
picture below.
Page 111 of 150

UERF GUIDELINES
rd
Figure 60: T-XWB IPT mini disc potential impact on PLS & TLS at +/-5° degree for 1/3 disc
In that case a refined analysis is needed to show compliance.

6.4.6.2.2.3 Refined analysis
In the refined analysis, several fragments are considered to show that in the end all locks
can’t be impacted. The following combinations have to be considered:
x One third disc and one two-third disc
x One third disc and multiple small and intermediate fragments.
On T-XWB (December 2010 analysis), this is demonstrated as follows:

x A 1/3 and a 2/3 fragment at +/-5°:
o Circumferential segregation ensures that both PLS are sufficiently separated so that
they can neither be damaged by same 1/3 disc trajectory, nor by same 2/3 disc.
This is mainly ensured by circumferential separation of more than 2500 mm to be
compared to 1120 mm of biggest IPT stage diameter (see next figure)
o Longitudinal segregation ensures that lower PLS & TLS are sufficiently separated
so that they can neither be damaged by same 1/3 disc trajectory, nor by same 2/3
disc (see figure above)
This is mainly ensured by longitudinal separation of 300 mm to be compared to 90
mm of thickest IPT stage
x A 1/3 fragment and multiple intermediate and small discrete fragments at +/-5°:
o PLS installation out of intermediate fragment risk area at +/-5° ensures that at least
one PLS remain safe even for a 1/3 fragment and multiple intermediate fragment in
+/-5° risk area. Small fragments remain contained except if they escape by the hole
Page 112 of 150

UERF GUIDELINES
created by the 1/3 fragment. In that case, they can’t damage other elements than
the one already damaged by the 1/3 fragment.
Figure 61: T/R ircumferential segregation
Page 113 of 150

UERF GUIDELINES
6.4.7 Rapid Decompression

The three following rules, : §25.365; amd 87; §25.841, are used to assess the decompression
onto the aircraft. Two ideas are covered, on structural aspect, one physiological aspect.
6.4.7.1 Structural aspect
The structural cover the need of floor and system attachment. That means that the dimension
of all the element is done to keep them in place either in case of rapid decompression.
The §25.365 Pressurised Compartment loads provides the equation to be used for hole size
definition for each aircraft : H o P * As where
x Ho maximum opening in square feet, need not exceed 20 square feet
As
x P 0.024
6240
x As maximum cross sectional area of the pressurised shell normal to the longitudinal axis, in
square feet
Even if it is an enclosed area attention must be paid to belly fairing and landing gear bay for
hole size opening.
Rapid decompression can lead to catastrophic structure cases during :
x The whole cruise flight phase
x The end of the climb flight phase
x The beginning of the descent flight phase
Types of trajectory to be considered are those impacting the pressurized area such as tangent
cut of the ceiling, tangent cut on the centre wing box and the floor, tangent cut on the landing
bay and the floor.
6.4.7.2 Physiological aspect
Amendment 87 et §EASA high altitude operation
It is necessary to look at the oxygen crew architecture and at the passenger oxygen
architecture. Concerning the passenger architecture, a level of 20% of passenger with no
oxygen distribution has been founded acceptable and used in past certification.
Attention must also be paid to the probability of having a hole leading to rapid decompression
Page 114 of 150

UERF GUIDELINES
Impact on the fuselage (pressurised and unpressurised)

Probability for an area greater than S
during cruis e phase
9.0E-09
8.0E-09
7.0E-09
6.0E-09 S = 0,357 m² for P = 1e-9 / FH

Probability per FH
5.0E-09
4.0E-09
3.0E-09
2.0E-09
1.0E-09
0.0E+00
0 0.5 1 1.5 2 2.5 3 3.5
Opening area S (m²)
Figure 62: Probability distribution for hole size
Figure 63: AC25-20 altitude distribution
Page 115 of 150

UERF GUIDELINES
For the pressurisation exercise, it is worst to used the realistic dimension of the one-third disc
fragment (according to AMC20-128A) than the one used for the system assessment.
During some aircraft certification exercise, it has been decided to used only the disc
dimensions instead of the proposed one (A3456 et A380)
For business jet which are certified for over 41000fts altitude operation, the pressurised
bulkhead is installed out of the +/-5° burst area. This statement is mandatory to fulfil the
fuselage pressurisation criteria.
6.4.7.3 Contribution to residual risk:

The main function of the oxygen system is to supply the aircraft occupants with Oxygen for
breathing in case of cabin decompression. The oxygen for the flight crew can also deliver
diluted oxygen so that the partial oxygen pressure inhaled by the flight crewmember is
equivalent to the conditions of a regular cruise cabin altitude. Flight crew oxygen is also used,
if there are toxic gases or fumes in the cockpit.
An UERF impact on the skin of the aircraft would increase the outflow of air from the
pressurized fuselage. For small holes, closing the OFVs could compensate it. This requires
the capability to keep control over the OFVs after an UERF impact. In case the hole is larger,
the outflow valves cannot prevent decompression. The decompression speed after an UERF
is investigated for each aircraft. Depressurization, in combination with non-available ATA35 -
oxygen for the crew, leads to a catastrophic condition, if it exceeds a Depressurization
Exposure Integral (DEI) limit.
The depressurization risk in case of a perforation of the fuselage is related to the flight altitude
of the plane that involves different conditions of pressure/temperature, influencing the
passenger survivability. Maximum acceptable cabin altitude in failure cases is limited by the
setting of the "excessive cabin altitude" alert, which is slightly below 10000 ft. A cabin altitude
in excess of 15000 ft is always classified MAJ. Depending on the relation between cabin
altitude and exposure time, a cabin altitude above 25000 ft would be classified CAT.
Page 116 of 150

UERF GUIDELINES
Figure 64: ATA35 Oxygen - Fault Tree

Depressurization risk exposure is limited to:
¾ Last ¼ duration of Climb phase
¾ Cruise phase
¾ First ¼ duration of Descent phase
Figure 65: Example of Depressurization risk exposure for A30X program
Page 117 of 150

UERF GUIDELINES
6.5 Residual Risk
6.5.1 1/20 Origin
The origin of the 1/20 requirement is an UERF rulemaking in 1978, and the rule proposition
“Engine non-containment of debris” (ref. NPA25E-11).
During that rulemaking, the British Airworthiness CAA exposed their philosophy for defining an
acceptable remaining hazard, based on:
The need to have a consistent interpretation across the industries and agencies of
level of minimization
The reasonable chance of survival to be provided if such an event occurs
The technical challenge for a design, to remain in bound of practicality
The relevant analysis based on measurable quantities and relatively simple to perform.
From these considerations, the necessary safety assessment should be based on numerical
approach. The aim was to meet a 10-8 per hour risk probability at aircraft level in case of
UERF, considering that such an event occurs at 10-6 per hour at engine level.
The definition of acceptable ratio has been proposed by the report “Engine Non containment –
the CAA view” from GL Gunstone (1977). It considered that objective should be split between
third of disc and intermediate debris, and that expressed that 1/20 rate for third of disc and
1/60 rate for intermediate fragment gives an overall rate of catastrophe of 10-8 per aircraft
hour.
Dealing with the factors, the CAA considered that:
A figure of 1/20 gives a reasonable chance of survival, provided that after it happened
measures were taken to prevent repetition of the particular failure.
The investigation on several conventional aircraft proved that, taking into account
infinite energy, these ratios could be achieved.
Using a simple failure model and the assumption of infinite energy, the analysis can be
kept in reasonable bounds.
Origin of the 1/20 has been identified in report NASA CP2017 dated 1977, Engine Non-
Containment - - The UK CAA view, G.L. Gunstone.
PART 1 and 2, Perspective and Engine statistics are providing accidents records covering a
period from 1966 to 1976, where statistics are :
NUMBER OF AIRCRAFT FLIGHT RATE IN AFH RATE IN %
ACCIDENTS HOURS
513 103*106 513 100%
5*106 AFH
103*106
369 non fatal 103*106 369 72%
3.6*106 AFH
103*106
144 fatal 103*106 144 28%
1.4*106 AFH
103*106
REASON NBR OF ACCIDENTS NBR OF FATAL RATE IN AFH
ACCIDENTS
Page 118 of 150

UERF GUIDELINES
513 100% 144 513

28% 5*106 AFH
513 103*106
Operation 299 299
58% 3*106 AFH
513 103*106
Operation 82 82 82
fatal 27.42% 16% 0.8*106 AFH
299 513 103*106
Unknown / Others 80 80
16% 0.7*106 AFH
513 103*106
Unknown / Others 49 49 49
fatal 61.25% 9.5% 0.47*106 AFH
80 513 103*106
Airworthiness 134 134
26% 1.3*106 AFH
513 103*106
Airworthiness 52+27 52 27
Nonpowerplant 15.3% 0.7*106 AFH
513 103*106
Airworthiness 55 55
Powerplant 10.7% 0.53*106 AFH
513 103*106
Airworthiness 41 41
Powerplant Uncontained 0.8% 0.4*106 AFH
513 103*106
Airworthiness fatal 13 13 13
9.7% 2.5% 0.126*106 AFH
134 513 103*106
Airworthiness 3 3 3
Powerplant Uncontained 7.3% 0.58% 0.03*106 AFH
41 513 103*106
fatal
The CAA suggested a target of 0.01*106 AFH 1*108 AFH for a single engineering cause
involving fatalities. Figure related to uncontained powerplant fatal event is three time the goal.
Figure relative to non-containment rate, for the period from 1966 to 1976, is 1 event per 106
engine hours and is reasonably constant over the period.
Note : Dealing with non-containment event rate, 1*106 EFH 0.4*106 AFH * Nbr eng it
can be assumed that for the whole aircraft fleet, average number of engine is Nbr-eng = 2.5
per aircraft.
It can be noticed that over the year, the distribution for compressors and turbine stages
uncontained event has been the same. It can be stated that there is a homogenous rate for
each stage, which would provide the same probability of non-containment for each stage.
PART 4, The UK requirements
Page 18
It is stated that an uerf event will occur every million aircraft hours. This is described in the
§ 1 · 1 _ event
equation by ¨ 6 ¸
© 10 ¹ 1 _ million _ aircraft _ hours
x First step in the 1/20 equation could be written as follow:
Page 119 of 150

UERF GUIDELINES
2 § 1 ·§ 1 · 1 § 1 ·§ 1 · 1
¨ 6 ¸¨ ¸ ¨ 6 ¸¨ ¸ d 8 , witch take into account the intermediate and one-
3 © 10 ¹© 133 ¹ 3 © 10 ¹© 66 ¹ 10
thi[disc fragments.
1 1 § 1 ·§ 1 ·
Where the objective of can be written as follow. 8 ¨ 6 ¸¨ ¸
© 10 ¹© 100 ¹
8
10 10
This is extracted from CP2017 p17 :
“I have already shown that a figure for debris generation of 1 per 10 6 engine hours was
well founded as an average, and not subject to a particularly wide variation over a range
of current engines. Knowing that about a quarter of the incidents caused 'significant'
aircraft damage, i.e. damage outside the nacelle, the 'significant' rate may be expressed
as being in the order of 1 per 106 aircraft hours. Starting from this precept therefore, the
aircraft constructor needed to provide an additional factor of about 1 per 100 against a
'significant' engine non-containment ending in catastrophe.”
For intermediate fragment contribution is described such as :
2 § 1 ·§ 1 · § 1 · 2
¨ 6 ¸¨ ¸ with ¨ ¸ a reduction factor and represent
3 © 10 ¹© 133 ¹ © 133 ¹ 3
x Second step in the 1/20 equation could be written as follow:
2 § 1 ·§ 1 · 1 § 1 ·§ 1 · 1
¨ 6 ¸¨ ¸ ¨ 6 ¸¨ ¸ d 8
3 © 10 ¹© 100 ¹ 3 © 10 ¹© 30 ¹ 10
x Third step in the 1/20 equation could be written as follow:
2 § 1 ·§ 1 · 1 § 1 ·§ 1 · 1
¨ 6 ¸¨ ¸ ¨ 6 ¸¨ ¸ d 8
3 © 10 ¹© 60 ¹ 3 © 10 ¹© 20 ¹ 10
The 10-8 should be considered as : “Chance of an aircraft being stuck by a debris resulting
in catastrophe should be less than 10-8” (NASA CP2017 page 17)
Page 120 of 150

UERF GUIDELINES
6.5.2 Level of risk calculation

Residual risk calculation process is as follow:
Identification and characterization of CAT Targets
Target impacts or combination of target impacts may lead to a failure scenario. In accordance
with Airbus methodology, following angles are considered to define the impact capability of
engine fragments on targets.
Considering the plane P of rotation of the engine disc, the trajectory of debris is identified by:
x “F” the spread angle measured between P and the debris‘ trajectory. Its range is –5° to
+5° (according to the alternative Engine Failure Model from the AMC/AC 20-128A §9c)
x “M” the angle between the projection of the debris’ centre of gravity onto P and the
engine Z axis (0° being 12 o’clock). Its range is 0° to 360°
Figure 66: Debris Trajectory angles definition
Damage (Risk Windows)

Impacts on targets can be plotted on Risk Windows, which are formatted as shown on the
following sketch:
Page 121 of 150

UERF GUIDELINES
Phi
'χ = χ2 - χ1
φ1
'φ = φ2 - φ1
φ2
Khi
Χ1 Χ2
-5 0 +5
Figure 67: Risk Window definition
Calculation of No Reduction Factor Contributions

To calculate the probability for the remaining risk evaluation, it is necessary to:
x Calculate the probability of hitting the targets “i” (or combinations of targets) leading to
catastrophic scenarios. In other words, the ratio of Catastrophic Risk Windows:
T § F 5q 'F M max
'M ·
P ¦ ¨
¨ ³
i 1 © F 5q 10q
u ³ f ( F ,M ) u 360q ¸¸
M min ¹
With, T the number of catastrophic scenarios / targets
Weighting of No Reduction Factor contributions
In order to quantify the residual risk, Reduction factor Kij can be applied with regards to
different elements:
Kij = Fj x Sij
Fj => flight phases: the rate of UERF event for each flight phase is defined in AMC/AC 20-
128A & pasted just below:
Page 122 of 150

UERF GUIDELINES
40
35
% OF
INCIDENTS
23
22
Landing/Reverse 4%
20 Approach 2%
20
Descent 3%
Cruise 14%
Take-off V1 to first Climb Remainder PHASE OF FLIGHT

Before V1 Power of flight
Reduction
Figure 68 : Flight Phase probability distribution
Sij => remaining risk factor: in regards to probability of occurrence, influence of the
environment, permit to:
x Select appropriate flight phases; in other words, if a specific scenario is catastrophic
only on ground, all flight phases, which are airborne, will be multiplied by the reduction
factor: zero.
x Reduce the flight phase(s) contribution(s) if it is demonstrated that only a portion of the
flight phase(s) must be considered
x Take into account the likelihood of the scenario to be catastrophic.
Calculation of 1in20 contribution
Taking into considerations the Kij reduction factors:
N ªT § F 5q
'F
M max
'M ·¸º
P ¦ «¦ K ij u ³
¨
¨
u ³ f (F ,M ) u »
360q ¸¹»
j 1«i 1 ©
¬ F 5q 10q M min ¼
K ij F j u S ij
With, ,
Fj S ij
being the flight phase distribution and the reduction factor
N the number of flight phases
Looking at all stages “k” and all engines “l” :
6.5.3 Relevant stages
Within the 1/20 calculation activity, the first tools did not have the processing power that is
affordable since the A380. In order to limit the computation cycle, a simplified model was
needed. The limitation of engine stages to consider was decided, as it offers a simple solution,
and still provides an appropriate result by weighing the relevant stages with some ratio.
Page 123 of 150

UERF GUIDELINES
These relevant stages are selected according to 2 main criteria: their dimension, and their
position along the engine axis. The engine stages are splitted in several groups: fan, low
pressure compressor, high pressure compressor, high pressure turbine and low pressure
turbine. For each group, the biggest stages and/or the stages at the extremity of the group
provide with the most conservative threat for the aircraft parts. Such a selection enables to
have less than half of the total engine stages to include in the computation process.
The reflection of this choice is a modification of the motorization file for ARIAS and OVISYCA.
Recently, concern was raised by engine manufacturer on unbladed discs (such as sealing
disc). The regulation material lets room for interpretation whether such discs need to be
included in the failure model. So it is the engine manufacturer responsibility to analyse its
design and provide with the rationale to consider it as a potential source of uncontained failure.
During the process, the notion of engine critical part needs to be considered. This approach is
defined in the Unbladed Disc Policy ref X70ME0711282.
6.5.4 System contribution
Using the Trajectory Booklet (see §6.1.5), System Segregation Diagrams and A/C level
synthesis (see §6.1.6) are performed in order to determine the critical (CATastrophic) scenarios at
A/C level.
The critical combinations considered are linked to:

- Handling qualities: Flight or Ground Controllability
- Performances:
o Continued Take off capability (ability to climb clear of obstacle plan)
o Deceleration capacity (take-off and landing)
o Diversion capability
The combinations linked to other kind of critical failures are not part of the A/C level
synthesis (e.g. Lack of oxygen after depressurisation) as they are treated in dedicated documents.
Specific CAT cases directly derived from SSD analysis are also accounted.
For each critical scenario, a failure tree (called equation sheet) of all the combinations
needed to generate the case is provided and is used to build the OVYSICA function. The failure
tree uses the operators OR / AND / NOT.
Figure 69: Example of systems OVYSICA function
As shown on the two next figures, on A350, at MG9, systems represent around 7% of the
residual risk contribution, the rest being structure / fire / total loss of thrust. Among the system
contribution, deceleration is the main source of critical scenarios.
Page 124 of 150

UERF GUIDELINES
Figure 70: A350 Residual risk sharing between contributors
Figure 71: A350 Residual risk sharing between system contributors
Note: Total engine thrust loss is assumed to be potentially catastrophic near the ground and during
certain portion of climb. It must be noted that to be consistent with an AA requirement, it was
decided to put a 1/10 coefficient for the cruise phase on latest certified single aisle aircraft, as it
was not the case in the past. Same reduction factor has been used on A350 and EASA agreed by
saying this was consistent with in service experience. Refer to Methodology for UEF risk factors
determination N72RP1111620. On A350, the TEFO (Total Engine Flame Out) function what
regards loss of thrust is considered inside structure contribution, as fire aspects. The effects of
TEFO on deceleration are taken into account in the systems part.
Page 125 of 150

UERF GUIDELINES
6.5.5 Structure contribution

This chapter will be detailed in next issue.
Structure specialists provide CAT criteria based on damages survivability with Get Home
Loads (0.7 Limit Loads). Based on those criteria, the combinations are considered CAT for any
airborne phase and the risk accounted in the 1/20 residual risk.
An example can be found in the latest available A350 residual risk report, which is, to date,
“A350XWB - MG9 UERF 1in 20 residual risk” ref V72RP1137167 issue 2.0.
6.5.6 Reduction factors

In the 1/20 residual risk computation, one of the key step is the determination of the reduction
S
factor, called ij in the formulae. This factor is to be used for selecting the relevant flight
phases or portion of flight phases a scenario appears to be CAT, and taking into account the
likelihood a scenario may be CAT. This factor has a significant effect on the risk probability,
therefore it should be assessed carefully.
When defining the reduction factor, the applicant should refer to Methodology for
Uncontained Engine Failure Risk Factors Determination N72RP1111620.
6.5.6.1 Risk families
The reduction factors assessment is highly dependant of the considered scenario. The
parameters that would influence the criticality of a scenario will be the same for risks of the
same nature. In order to ensure a consistency for the assessment of the reduction factors, all
the scenario have been sorted in main risks family:
x Controllability in flight
x Controllability on ground
x Pax survivability
x Loss of thrust
x Fire
x Structural integrity.
Inside each family, there are several potential scenario, resulting from different impact on
aircraft components. Some of these scenario have already been assessed in the frame of a
certification and presented to the EASA. The table here below shows the known scenario at
this time.
The term “RED” in the table means that the reduction factor needs to be set according to a
specific analysis based on the aircraft design, the operational context, and potentially other
elements that are not generic.
Page 126 of 150

UERF GUIDELINES
Page 127 of 150

UERF GUIDELINES
6.5.6.2 Example of reduction factor assessment

Scenario analysis:
Large engine debris impact on their own pylon could lead to engine detachment if the pylon is
not strong enough to sustain the remaining loads during this phase. The high level of energy
inside the engine combined with the speed of the aircraft on ground could lead to engine
disintegrating, and parts bouncing and hitting the wing and penetrating the wing fuel tank
bottom cover. This case could generate a significant fuel leak, close to ignition sources
(landing gear brakes).
Figure 72: A380 Own pylon
Reduction factors assessment:

It is assumed that the engine itself will not ignite the fuel from the wing leak. Therefore, the
“Risk of External Fire” reduction factor for “Single Wing Shots” (fire on one wing only) can be
defined as follow.
The reduction factor from the “Risk of External Fire” for the Single Wing Shots is 2/9, however
an additional 2/3 probability is taken into account in this function due to the fact that the engine
is far from the Landing gears. Indeed, three detachment scenarios can be considered:
¾ A probability of 2/3 is assumed for engine parts creating a fuel leak close to landing
gear brakes,
¾ A probability of ½ is considered for fuel being ignited by the brakes,
¾ A probability of 2/3 is defined for wind conditions that would jeopardize a safe
evacuation through half of emergency exits, due to fire propagation.
Overall, it is a 4/27 factor for the scenario of external fire risk on one wing due to engine
detachment. This scenario could be CAT only during ground phases, so following factors
apply.
V1 to 1st
Take-Off Power Climb Cruise Descent Approach Landing
Reduction
Own 0.0518 0.00592
0 0 0 0 0
Pylon (0.35x[4/27]) (0.04x[4/27])
Page 128 of 150

UERF GUIDELINES
6.5.7 Calendar
It will explain when the residual risk is first computed and what is its usual tendency depending on
the maturity.
6.6 Tools
6.6.1 ARIAS
6.6.1.1 Generalities
The aim of ARIAS software is to:
Determine the fragment trajectories that could impact any A/C systems/structure for a
dedicated Particular Risk,
Determine the trajectories resulting in a CAT case,
Export results (risk windows) to the dedicated database.
The ARIAS tool is integrated into Catia V5 in order to handle analysis directly in the DMU.
Firstly, UERF risk volumes associated to each engine stage are generated, by means of
motorization files.
Figure 73: Risk volumes generated with Roll Royce -Txwb84k motorization file (A350 XWB)
Secondly, all impacts detected by ARIAS between targets and risks volumes are gathered in
Compute clash files (one per engine).
Thirdly, Impact files associated to each target are generated. They detail Impact between each
target and risk volumes for each engine stage.
6.6.1.2 Process
Page 129 of 150

UERF GUIDELINES
STEP 1: Risk volumes are generated by means of motorisation files. Single trajectories can
also be created in order to highlight a particular combination of targets impacted.
Figure 74: Risk volume creation mode
Figure 75: Particular UERF trajectory
Motorisation files are excel table which gather all characteristics associated to one engine (x
station, rotation direction, blade / disc thickness…):
Page 130 of 150

UERF GUIDELINES
Table 13: A30X RB 3011-16 motorization file
STEP 2: ”Computation clash option” reports all clashes detected between risk volumes
previously created and displayed targets.
Figure 76: Step 2: Computation clash
STEP 3: “Target management” option permit to build target files that associate one part to
one target.
Page 131 of 150

UERF GUIDELINES
Figure 77: Step 3: Target file management
Figure 78: Example of target file
STEP 4: “Export in Database” option allows generating Impact files data. They include
impacts reported for each engine stage and they are essential to build functions with OVISYCA
software.
Figure 79: Step 4: Export impacts for a given target
Page 132 of 150

UERF GUIDELINES
Aircraft
Motorization file
Type of fragment
Target designation
Impacts associated to
one engine stage
Figure 80: Example of impact file
STEP 5: “Post Process results” option can be used to perform two different tasks:
1. To generate risk windows associated to one impact files previously created,
2. To build combination of targets impact by means of Consequence Analysis option.
Risk windows creation
Consequence Analysis
option
Figure 81: Step 5: Post Process results
STEP 6: To export to OVISYCA the post processed results which are generated in .csv file
format, it is necessary to translate them into impact files through a specifc tool.
CSVtoIMP Translator tool has been developed in order to convert .csv and .csa files into an impact
file that can be imported in Ovisyca.
Page 133 of 150

UERF GUIDELINES
Figure 82: Step 6: CSVtoIMP Translator
1. Fill Aircraft/Motorization/fragment defintion as any impact file created with the same
motorization file (for compatibility purpose)
2. Fill all discs used in the motorization file following the recommendations on the side
3. Set the location and the name of the created impact file
4. Find the associated csa folders by the selection panel
Page 134 of 150

UERF GUIDELINES
6.6.2 OVISYCA
By means of phi / chi angle intervals associated to one target included in Impact files
generated with ARIAS, OVISYCA software allows to:
Provide a synthesis of aircraft functions,
View risk windows,
Perform a probability calculation, which corresponds to 1/20 final residual risk.
Hereafter is shortly described the process to obtain final results:
A database associated to each aircraft / engine / type of fragment is created. As for
ARIAS, motorization files retrace engine characteristics and are essential to generate a
new database.
Figure 83: Database configuration (A320neo / CFM LeapX 1A 3.1 / Alternative)
Page 135 of 150

UERF GUIDELINES
Impact files generated with ARIAS are loaded in database to be included in functions
as targets,
Figure 84: Target files acquisition
Functions are built by means of impact files or other sub-functions. They represent fault
three associated to one particular risk,
Figure 85: Example of function / OVISYCA
Once functions or targets are available, OVISYCA permits to:

1. Generate risk windows that are a graphical representation of impacts detected:
Page 136 of 150

UERF GUIDELINES
Figure 86: Example of risk window generated with OVISYCA
2. To calculate 1/20 residual once reduction factors are filled in.
Table 14: Reduction factors input
Page 137 of 150

UERF GUIDELINES
Table 15: 1/20 residual risk
6.6.3 MV² - DOORS

MV² and DOORS are two tools supporting the V&V process. Details on the process are
provided in §6.4.1 Requirement Based Engineering / V&V.
Rise MV² is the tool where PRA requirements are captured. Under applicable Failure
Conditions requirements are written, then derived to design level and allocated to a
component that shall take it into account. An overview of MV² tool is provided below.
Page 138 of 150

UERF GUIDELINES
Figure 87: MV² overview

The requirements captured in MV² are then transferred in DOORS, which is the designers
V&V tool. The following chart illustrates this process:
Figure 88: DOORS module overview
Page 139 of 150

UERF GUIDELINES
DOORS (Dynamic Object Oriented Requirements System) is a Requirements Management

Tool used at Airbus within the RBE Process for the A/C programs A400M, A380, A350XWB, A320
Sharklet, A320 NEO and also some multi program projects. The tool itself provides functions for
Requirements Based Engineering and is normally adapted to the need of the organisation to avoid
inconsistent use and to assure proper process embedding.
It supports writing of requirements in a "document-like" representation. These document-like
entities are called modules, which includes dynamic objects. DOORS provides a multi-user access
at different levels for any Airbus site. Requirements can be exchanged with suppliers and changes
can be tracked, validated and versioned. Another basic function is the capability to establish
traceability-links within or across different modules and even to external resources. These
traceability-links allow various functions, e.g. impact analysis, checking compliance etc.
Figure 89: DOORS module overview
6.6.4 EPW
EIX has agreed with EET14 (UERF specialists) to use the tool “Engine Positioning Wizard”
(EPW) for derivation of the rotor burst risk area. EPW is a CATIA-based tool that has been
developed internally in EIX to perform engine installation studies.
EET14 has validated this tool for the use by EIX for this specific purpose. More details are provided
in ref [19]
6.6.5 ABSENER
This tool is a tool used to estimate energy absorption.
Page 140 of 150

UERF GUIDELINES
6.7 Certification
The Designated certification specialist (DCS) is the certification focal point for the A/C
program management (See § 6.1.2 UERF Actors and responsibilities).
The DCS is in charge of ensuring all along the A/C design development process that design option
will meet applicable certification requirements.
In parallel to Airbus management interface, the DCS has to build strong and efficient relationship
with Airworthiness Authorities.
The DCS is the main interface with AA for presenting design, showing compliance to requirement
and negotiating means of compliance.
He is also responsible for securing all certification activities (in particular Type certificate document
delivery & acceptance to AA) in the time frame required by Program management.
For the specific purpose of UERF, he has to :
- Provide support to the PRA Task Owner regarding certification issues related to the PRA during
development phases (model definition and early negotiation with AA)
x Issue a certification plan
x Prepare regular presentation and ensure validation by AA, by:
x Feeding AA with regular design precautions progress
x Sharing regular picture of “1/20”
x Ensure Certification Dossier Preparation with the support of the Task Owner.
Note: the main certification paragraph for UERF is the 903d1, but other paragraphs exists (see §3
Regulation).
6.7.1 Organisation
Type certification process is described in AP 2184 (and guidances M20024) which:
x Provide Key Instructions and Guidelines to Process Actors to perform and fulfil Certification
Plans and Certification Documents
x Propose some rules when meeting with Airworthiness Authorities (Kick-off Meeting,
Certification Review Meetings, Type Board Meetings)
x Provide guidance and best practices for Type Certification related processes (PAR, CRI/IP
and CPR)
x Address Final Compliance Statement Concept and Requirements cascade
A CMPP (Certification Management Procedures and Policies) is provided for each program to:
x Provide additional information, data, procedures needed to support Programmes needs
when applying AP2184
x Define the Aircraft Certification Objectives and the Programme Certification Organisation
x Propose information on the Airbus Certification Team (DCS/CM) and the A/W Signatories
More details are available in Airbus People / Eng. Product Integrity / Airworthiness Assurance /
Training
Page 141 of 150

UERF GUIDELINES
For the specific purpose of UERF, the aim is to finalize the UERF analysis for MG12 (See § 6.1.3
PDD (A350) page 57 and § 6.1.7 Page 61&62 ).
Nevertheless, from the very beginning of the A/C program, regular AA reviews are performed.
6.7.2 Meetings with AA
A certification exercise is made for an Aircraft + Engine type (for example: A319 – IAE
V2500). Furthermore it could be based on previous certification.(for the above example, on A320
equipped with CFM & IAE)
Particular Risk Analysis activities are lead by a Task Owner, as far as practical he is also
DCS (a DCS deputy is also nominated)
Many Certification reviews are performed from the very beginning of the design.
It allows to get an early AA approval for each critical systems or structure architecture:
x Kick-Off Meeting ( around MG3)
x Certif Plan ( near to MG5)
x Regular reviews for Design Precautions & Risk analysis status ( 1 or 2 / a year)
x AA validation before big milestones:
o MG5 for design precautions
o MG7 for first quantitative assessment (mainly for structure)
o MG11 ( first flight) for delta with the A/C certification design
At the end, a summary document including, Part 1 : design precautions & Part 2 : risk
analysis, is provided (see next chapter)
Furthermore, for Foreign certification: a dedicated certification compliance exercise is
presented ( ex: China,...) ,based on the certification dossier released and agreed by EASA & FAA.
6.7.3 Certification documents
6.7.3.1 CRI/IP
A CRI can be written for clarification with EASA ( or an IP with FAA)
Example on A350 composite structure versus UERF Small Fragment to ensure that extensive use
of composite material provides equivalent protection to UERF small debris threat (this applies
mainly to fire risk due to punctured fuel tank):
- CRI C03 “Uncontained Engine Rotor Failure Small Fragments vs. CFRP Fuel Tanks and related
Structures”
- IP P5 “Uncontained Engine Failure - Debris Penetration of Fuel Tank Structure”
Other Example: use of AMJ when not in the regulation ( A3456)

Other Example: Fuel reserve on NEO
Page 142 of 150

UERF GUIDELINES
6.7.3.2 Main Certification document
A list of certification documents (and ref. of included parts) is shown in § 4.2 Certification reports.
This summary document is an analysis showing compliance of an A/C equipped with a

dedicated Engine to the 25.903 d1 requirements.
Demonstration of compliance is achieved according to a certification authorities accepted method
(AMC / AC 20-128A) consisting of :
x Part 1: A detailed description showing that all practical design precautions to minimise the
consequences of an engine rotor failure have been taken.
UERF PRA is a driver for the design solutions and design precautions are shown for
validation by AA as soon as design is frozen. (refer to § 6.4 Design precautions)page...
At the end, Part 1 contains the description of practical design precautions taken to minimise
the risk in critical areas likely to be damaged by an uncontained engine debris.
x Part 2: A safety analysis ensuring that risks of hazard to the airplane which could remain
when all practical precautions have been taken are within the acceptable level of risk
objectives specified in the AMC / AC 20-128A, paragraph 10 c (3)(i).
When all practical design precautions have been taken, a safety analysis shall be done to
show that for the remaining cases that could hazard the aeroplane, the calculated level of
risk is compatible with the objective. ( refer to §6.5 Residual risk)page...
Quantitative assessment is shown to the AA at different maturity level:
o Estimation (Based on statistical (past experience),empirical and analytical
(geometry) data);
o Knowledge (Rely on engineering judgment);
o Preliminary 1 (Rough computation);
o Preliminary 2 (Refined computation);
o Certification (Final computation).
At the end, Part 2 includes the description of the models, the assumptions, the methods of
analysis and of quantification used as well as providing all the figures for all contributors to
the 1/20 Objective.
6.7.3.3 Others documents
Compliance sheets ( and /or Certification summary)

The DCS, using the appropriate template, provides an outline of results of activities established in
Certification Plan.
He ensures that Compliance Record Sheet is complete and quality of proof of compliance
statement in NECTAR is acceptable.
A/C –UERF analysis feedback

This internal technical note is provided in order to summarize all the work done and to get the link
with referenced documents.
Page 143 of 150

UERF GUIDELINES
7 Modification & UERF

Change Product Rule (CPR) process is applied to Major Type Design changes under 21A.101
for aeronautical products type certified.
For classification ( Major ,minor ), refer to AP2243 on Change to Type Design process and
M2978 (for FAA).
7.1 A/C design modification certification process
Example of the A320 to be equipped with Sharklet:
As pre-requisites to Sharklet modification (n°160500), a top-level modification ( 160001) is certified in a
standalone way. EASA approval covers the approval of the Major Mods included in the modification
tree.
Therefore, Airbus provided to EASA:
x A Major Change Certification Plan (MCCP),
x Compliance demonstrations,
x A Major Change Certification Summary (MCCS).
7.2 A320-NEO
“Significant” Major changes:
Objective of project is the re-engining of A319/A320/A321 in Sharklet configuration.
According AMC & GM for Part21 (appendix 1), the projects (A319-151/-171, A320-251/-271 and
A321-251/-271) are classified as Significant Major changes to the design.
Indeed, the introduction of the new engines is considered as a change in general configuration,
likely requiring extensive structural, systems, flying qualities & performances re-investigations and
requiring new AFM to address performances and flight characteristics.
Major Non-Significant Changes:

Projects covering the certification of neo de-rated models (A319-1x2/-1x3, A320-2x2/-2x3 and
A321-2x2) are classified as Major Non-Significant Changes.
7.3 One Example: A380 EBHA removal

Page 144 of 150

UERF GUIDELINES
8 Future projects/developments UERF consideration: prepare the

future
8.1 Introduction
Engine evolution due to optimize fuel burn saving. Turbofan engine size increases, new engine
technologies are developed.
x Higher bypass ratio turbofan
x Open Rotor
Engine integration evolution due to optimize aerodynamics and take into account engine evolution.
x Engine more aft under wing
x Engine in semi buried configuration
x Engine on rear end section
Such evolutions may lead to new design constraints, related to debris size, risk area, or even
failure model and safety objectives evolution.
In order to cope with new challenges, new means of compliance must be investigated. Engine
related solutions and aircraft related solutions.
Engine related solutions are essentially for new engine design, such as open rotors. The main
reason is those existing engines provide an acceptable minimization of uncontainment risk, and
can be mitigated at aircraft level. This part will be developed in the open rotor section.
Aircraft related solutions are investigated
Shielding high and low energy, engine detachment trajectory prediction, debris trajectory, high
energy debris containment, finite energy, composite/metallic equivalence......
8.2 Engine size influence

In order to illustrate engine size influence on residual risk, following section presents the
results of a Trent 772 engine preliminary integration analysis on the A350XWB. Fragment and
size characteristics of both engines are different:
x Trent772 is a shorter engine than the Txwb84k
Figure 90: Txwb84k / T772 stage repartition
x Trent772 Average Max dim is lower than for Txwb84k Average Max dim (-5.8%)
Page 145 of 150

UERF GUIDELINES
Average Maximum Dimension (mm)

Group Stages
Txwb84k T772 Delta %
Fan 1246.6 1106.8 -11.2
IPC 707.0 798.0 12.9
HPC 497.9 570.7 14.6
HPT 592.0 654.1 10.5
IPT 794.3 794.8 0.1
LPT 1142.2 807.5 -29.3
All 788.5 742.6 -5.8
Consequences on the residual risk quantification
+ Decrease of the S15 fuselage risk

- A smallest proportion of the lower shell is in the risk volume
- Size of the fragment has a high influence on results
+ Decrease of the wing risk

- Size of the LPT fragments has a significant influence on results
- Number of LPT discs has a significant influence on results
+ Decrease of the system opportunity risk

- Size of the fragment has an influence on results
- No significant impact on the opposite pylon and TEFO risks

- Target is far from the UERF event; influence of the fragment size is limited
Residual risk aircraft contribution is mainly influenced by:

¾ Fragments characteristics (Max Dim)
¾ Number of LPT discs
¾ Size of the engine
Page 146 of 150

UERF GUIDELINES
8.3 Higher bypass ratio turbofan

8.4 Open Rotor
8.5 Engine more aft under wing
8.6 Engine in semi buried configuration
8.7 Engine on rear end section
8.8 Previous studies
It will provide a list of project studied and a short summary of their objectives / perimeter and
achievements.
8.9 Engine Detachment and power plant dynamics
Refer to Engine detachment trajectory synthesis N72RP1104098

8.10 Rule making CROR
8.10.1 Objective
8.10.2 Process
8.10.3 Actors
Page 147 of 150

UERF GUIDELINES
9 In service events UERF analysis

9.1 Process
9.2 Importance of certified level of risk and retrievable data
9.3 Example of A380 QF32 event
Page 148 of 150

UERF GUIDELINES
10 Open points
List of chapters not yet completed
10.1 Averaged disc or statistic mean of the bursting stage

This subject was identified in 2007 by Head of Propulsion Airworthiness & Aircraft Risk and not
deeper addressed.
Page 149 of 150

UERF GUIDELINES
11 Conclusion
This document shall be used as a common source of information to any person working on
UERF analysis.
It provides useful information on UERF PRA by gathering:
x Historical information about the origin of the analysis and the associated hypothesis
x Statistical data on events
x Applicable regulations depending on the Airbus aircraft
x A reminder of the in service aircrafts certified data
x Hypothesis and UERF model assumptions
x UERF analysis work in particular:
o Process / actors / organisation
o Design precautions aspects
o Residual risk computation
o Associated tools
x Certification work for UERF
x Preliminary data on:
o Future projects/developments UERF consideration
o In service events analysis
Some chapters will be completed in next issue.
Page 150 of 150

x72rp0614312 v3.0 Uerf Guidelines

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

x72rp0614312 v3.0 Uerf Guidelines

Uploaded by

Copyright:

Available Formats

UERF GUIDELINES

Technical Report REFERENCE X72RP0614312

This report allows to understand the Rotor Burst exercise, by providing:

This report defines the Rotor Burst exercise by providing:

UERF ; ROTOR BURST ; ENGINE FAILURE ; POLICY

NAME SIGLUM - FUNCTION DATE & SIGNATURE

AUTHOR(S) Antoine PILON EET14

AUTHORIZATION Johann HERVAULT Head of EET1

AN EADS COMPANY AIRBUS FRANCE S.A.S SIÈGE SOCIAL:

Technical_Report_FM0200016_v2.1 Page 1 of 150

Figure 52: BAE 146 engine 1 impacts ............................................................................................ 106

6.1.5 Trajectory booklet ...................................................................................................55

6.4.5.1.2 Rear end engine integration....................................................................................95

6.7.1 Organisation ......................................................................................................... 141

This report allows understanding the Rotor Burst exercise, by providing:

This report defines the Rotor Burst exercise by providing:

Preliminary data on future projects/developments UERF consideration & In service events

2.2 In service events

3.1.1.2 Section 25.903(d) Turbine engine installations

It should be assumed that small fragments (shrapnel) range in size up to a maximum

Figure 1: Typical Risk Window (Top +/-3°, Bottom +/-5°)

1 E ­ °1 D § N ª T § 'M ·¸º ·¸½

'F 'M 'F * 'M

'F 'M 'F * 'M

Single 1/3rd +/-3° 1/20

3.3.2 Forces in the world

4 In Service Airbus A/C certified data

4.2.1 Wide Body

A300B4-601 UNCONTAINED 05/04/84 A300-B4-620-00, A300-

461.016/84 [03] A300-B4-620-00, A300-

461.016/84 [01] A300-B4-620-00, A300-

Table 1: Wide Body UERF certification reports

4.2.2 Single Aisle

Table 2: Single Aisle UERF certification reports

4.2.3 Long Range

Table 3: Long Range UERF certification reports

4.2.4 Double Deck (A380)

Table 4: Double Deck UERF certification reports

Table 5: A400M UERF certification reports

5 Powerplant characteristics and debris model

5.1 Differences between engine’s manufacturer and UERF data

Figure 2: Blade Length Definition

5.2 Power plant Geometrical characteristics (UERF-Data)

5.3 Power plant Geometrical characteristics (PBR-Data)

5.4 General-Data for dedicated consideration

5.5 Aircraft-Datum for Power plant location

5.6 Power plant Characteristics reference

Figure 3: Typical Assembled Rotor Stage

Figure 4: Drum Rotor Stage

Figure 5: Integrated Rotor Stage

Figure 6: Assembled Rotor Stage

5.7 UERF Fragment characteristics

Figure 7: Thi[Disc Fragment

5.7.2 Intermediate Fragment characteristics

CHARACTERISTICS ACRONYM INFORMATION UNIT AIRBUS FORMULA

Figure 8: Intermediate Fragment

5.7.3 Small Fragment characteristics

Figure 9: Small Fragment

5.7.4 Fan Blade Fragment characteristics

Figure 10: Fan Blade Fragment

5.7.5 Fragment thickness definition

5.9 Fragment trajectory

Analyses conducted so far are

6 UERF analysis for development A/C

1 E °1 D § N ª T § 'M ·¸º ·¸½