CS 25.1141 Powerplant controls: general

ED Decision 2016/010/R

(See AMC 25.1141)

Each powerplant control must be located, arranged, and designed under CS 25.777 to 25.781 and marked under CS 25.1555. In addition, it must meet the following requirements:

(a) Each control must be located so that it cannot be inadvertently operated by persons entering, leaving, or moving normally in, the cockpit.

(b) Each flexible control must be approved or must be shown to be suitable for the particular application.

(c) Each control must have sufficient strength and rigidity to withstand operating loads without failure and without excessive deflection.

(d) Each control must be able to maintain any set position without constant attention by flight-crew members and without creep due to control loads or vibration.

(e) The portion of each powerplant control located in a designated fire zone that is required to be operated in the event of fire must be at least fire resistant. (See CS 25.903(c).)

(f) For Powerplant valve controls located in the flight deck there must be a means:

(1) for the flightcrew to select each intended position or function of the valve; and

(2) to indicate to the flightcrew:

(i) the selected position or function of the valve; and

(ii) when the valve has not responded as intended to the selected position or function. (See AMC 25.1141(f))

[Amdt 25/1]

[Amdt 25/18]

AMC 25.1141(f) Powerplant controls, general

ED Decision 2003/2/RM

A continuous indicator need not be provided.

CS 25.1143 Engine controls

ED Decision 2003/2/RM

(a) There must be a separate power or thrust control for each engine.

(b) Power and thrust controls must be arranged to allow –

(1) Separate control of each engine; and

(2) Simultaneous control of all engines.

(c) Each power and thrust control must provide a positive and immediately responsive means of controlling its engine.

(d) For each fluid injection (other than fuel) system and its controls not provided and approved as part of the engine, the flow of the injection fluid must be adequately controlled.

(e) If a power or thrust control incorporates a fuel shut-off feature, the control must have a means to prevent the inadvertent movement of the control into the shut-off position. The means must –

(1) Have a positive lock or stop at the idle position; and

(2) Require a separate and distinct operation to place the control in the shut-off position.

CS 25.1145 Ignition switches

ED Decision 2003/2/RM

(a) Ignition switches must control each engine ignition circuit on each engine.

(b) There must be means to quickly shut off all ignition by the grouping of switches or by a master ignition control.

(c) Each group of ignition switches except ignition switches for turbine engines for which continuous ignition is not required, and each master ignition control must have a means to prevent its inadvertent operation.

CS 25.1149 Propeller speed and pitch controls

ED Decision 2003/2/RM

(a) There must be a separate propeller speed and pitch control for each propeller.

(b) The controls must be grouped and arranged to allow –

(1) Separate control of each propeller; and

(2) Simultaneous control of all propellers.

(c) The controls must allow synchronisation of all propellers.

(d) The propeller speed and pitch controls must be to the right of, and at least 25 mm (one inch) below, the pilot’s throttle controls.

CS 25.1153 Propeller feathering controls

ED Decision 2003/2/RM

(a) There must be a separate propeller feathering control for each propeller. The control must have means to prevent its inadvertent operation.

(b) If feathering is accomplished by movement of the propeller pitch or speed control lever, there must be means to prevent the inadvertent movement of this lever to the feathering position during normal operation.

CS 25.1155 Reverse thrust and propeller pitch settings below the flight regime

ED Decision 2016/010/R

(See AMC 25.1155)

Each control for selecting propeller pitch settings below the flight regime (reverse thrust for turbo-jet powered aeroplanes) must have the following:

(a) A positive lock or stop which requires a separate and distinct operation by the flight crew to displace the control from the flight regime (forward thrust regime for turbo-jet powered aeroplanes), and it must only be possible to make this separate and distinct operation once the control has reached the flight idle position.

(b) A means to prevent both inadvertent and intentional selection or activation of propeller pitch settings below the flight regime (reverse thrust for turbo-jet powered aeroplanes) when out of the approved in-flight operating envelope for that function, and override of that means is prohibited.

(c) A reliability, such that the loss of the means required by sub-paragraph (b) above is remote.

(d) A caution provided to the flight crew when the means required by sub-paragraph (b) above is lost.

(e) A caution provided to the flight crew when a cockpit control is displaced from the flight regime (forward thrust regime for turbo-jet powered aeroplanes) into a position to select propeller pitch settings below the flight regime (reverse thrust for turbo-jet powered aeroplanes) outside the approved in-flight operating envelope. This caution need not be provided if the means required by sub-paragraph (b) is a mechanical baulk that prevents movement of the control.

[Amdt 25/18]

AMC 25.1155 Reverse thrust and propeller pitch settings below the flight regime

ED Decision 2003/2/RM

1. PURPOSE. This AMC provides guidance for demonstrating compliance with the certification requirement relating to controls which regulate reverse thrust or propeller pitch settings below the flight regime on Large Aeroplanes.

2. RELATED CERTIFICATION SPECIFICATIONS.

Paragraphs which prescribe requirements for the design, substantiation, and certification relating to the control of reverse thrust and propeller pitch settings below the flight regime of Large Aeroplanes include:

§25.777

Cockpit Controls.

§25.779

Motion and effect of cockpit controls

§25.781

Cockpit control knob shape

§25.901

Installation

§25.903

Engines

§25.933

Reversing systems

§25.1141

Powerplant controls: General

§25.1143

Engine controls

§25.1149

Propeller speed and pitch controls

§25.1155

Reverse thrust and propeller pitch settings below the flight regime

§25.1305

Powerplant instruments

§25.1309

Equipment, systems, and installations.

§25.1322

Warning, caution, and advisory lights

§25.1337

Powerplant instruments

3. APPLICABILITY.

The basic provisions of CS 25.1155 require that the control for selecting reverse thrust (propeller pitch settings below the flight regime) have a positive lock or stop at the flight idle position as well as separate and distinct operation by the flight crew to displace the control from the in-flight regime. These basic provisions are applicable to all Large Aeroplanes.

The specific provisions of CS 25.1155 are applicable to the control system protecting against the intentional or the inadvertent in-flight selection of the thrust reverser for turbojet powered airplanes or propeller operation at pitch settings below the flight regime for turboprop powered airplanes. However, the specific provisions would not be applicable to a turbojet powered airplane whose reverser was certified for in-flight use or to a turbo-propeller powered airplane whose propellers were certified for pitch settings below the normal in-flight operating regime.

In addition to the 25.1155 applicability limitations noted above, the intentional selection provisions should not be interpreted to include a pilot who knowingly gains in-flight access to the prohibited engine control regime by:

a) disabling a protective control system (i.e. throttle baulk or warning) by pulling circuit breaker, or

b) ignoring a clearly annunciated protective control system failure warning or caution message.

4.  BACKGROUND.

CS 25.1155 was derived from the equivalent FAA rule and therefore the requirement history below relates to the development of FAR 25.1155. Also the operational occurrences and the development of continued airworthiness solutions mentioned below, are based, largely, on the U.S experience.

a. Requirement History. The requirements to guard against inadvertent operation of both cockpit mounted propeller and turbojet reverse control lever(s) date back to CAR 4b (4b.474a). When part 25 was codified in 1965, only the turbojet reverse section of the subject requirement was retained as FAR §25.1155. In 1967, Amendment 25-11 broadened §25.1155 to once again include protection against inadvertent inflight operation of thrust reversers and propeller pitch settings below the flight regime. This Amendment required the cockpit propeller control to incorporate positive locks or stops at the flight idle position, and further specified that the control means must require a separate and distinct operation by the crew, in order to displace the propeller control from the flight regime.

b. Operational Experience - Turbo-propeller powered Airplanes. In-service experience during the late 1980s and 1990s of some turbo-propeller powered transport category airplanes, has shown that intentional or inadvertent in-flight operation of the propeller control systems below flight idle has produced two types of hazardous, and in some cases, catastrophic conditions:

(i) Permanent engine damage and total loss of thrust on all engines when the propellers that were operating below the flight regime drove the engines to over-speed, and;

(ii) Loss of airplane control because at least one propeller operated below the flight regime during flight creating asymmetric control conditions.

As a result of this unsatisfactory service experience, in-flight beta lockout systems were retroactively required (via Airworthiness Directives) on several transport category turboprop airplanes. These beta lockout systems were required only after it was determined that increased crew training, installation of cockpit placards warning crews not to use beta in flight, and stronger wording in AFM warnings and limitations did not preclude additional in-flight beta events.

In addition to the continued airworthiness issues noted above, the FAA also recognized the need to update the FAR requirement to require some form of design improvements for new airplanes. {NOTE: RWB additional words to complete the sentence.} Until the rule changes noted above are complete, the FAA is using the no unsafe feature or characteristic provisions of 21.21(b)(2) to require installation of beta lockout systems on new transport category turbo-propeller powered airplanes.

Intentional selection of beta mode/reverse in flight for rapid aircraft deceleration was not specifically addressed by this regulation. Also, FAR 25.933(b) had been interpreted as not requiring, for turbo-propeller aircraft, an interlock or other automatic device to prohibit movement of the power lever by the flight crew below the flight idle stop when the aircraft is in flight.

Consequently, initial FAA certification of transport category turbo-propeller aircraft has not required an inflight beta lockout device to prevent intentional selection of the beta mode/reverse in flight.

Typical beta lockout systems currently use wheel spin-up, squat switch activation, gear-up switch activation, or combinations of these. Certain airplanes, especially those with low wings and without ground spoilers, have a tendency to float during landing. In the case of these airplanes, the application of beta may be delayed on a wet runway because, while the airplane is floating, the ground logic or the wheel spin-up may not activate immediately.

Landing performance of turbo-propeller-powered airplanes is based on ground idle availability, which is part of the beta range. Turbo-propeller-powered airplanes landing on field length-limited runways with delayed beta application present a potential hazard. Overruns are more likely to occur if operating under part 91 (unfactored field lengths); however, the risks are also present if operating under parts 121 or 135 (factored field lengths) on a wet runway. Paragraph (b) of the rule prohibits override, however, there are several acceptable methods that may be used to overcome the deficiencies of the squat switch or wheel spin-up logic alone, such as the use of a radar altimeter or multiple air/ground logic inputs.

c. Operational Experience - Turbo-jet (Turbo-fan) Powered Airplanes. For turbojet (turbofan) thrust reversers, there has not been such a bad accident experience of pilot initiated thrust reverser deployment as for the turbo-propeller airplanes, but they have occurred. There has also been a number of reported cases, where the thrust reversers have been selected before touch down, in order to minimize the landing roll. In these cases, the provision of a weight-on-wheels (WOW) interlock as part of the thrust reverser design, prevented the deployment of the reverser. However, the basic concern about the need to avoid a reversing condition, outside any approved operating regime, is the same for a thrust reverser equipped aircraft, as it is for a propeller powered aircraft i.e. the prevention of Catastrophic failure conditions.

§25.933(a) and its AC / AMC describe means by which the thrust reverser system can be shown to have sufficient system integrity, to meet the required Safety Objectives. If the reliability method of compliance with §25.933(a) is used, the probability of an unwanted reverser deployment in flight will be shown to be <1E-09. In this case, where very low probabilities of system failures are demonstrated, it was considered to be inappropriate that a single event of pilot selection could cause the same effect, - a reverser deployment. Recognition that occurrences of thrust reverser selection in flight have occurred, reinforced by the growing perception that human factors need to be considered, has resulted in thrust reverser controls being considered equally. This approach ensures consistency in the application of §25.1155 to both turbo-prop and turbo-jet (turbo-fan) reversing systems.

The design objective sought by §25.1155 has been a common design practice for many turbo-jet (turbofan) thrust reverser designs. This rule establishes that a means to prevent crew selection or activation of reverse thrust or propeller pitch settings below the flight regime must be provided, as the minimum required standard.

d. Override Systems. Historically, some turbo-propeller systems have been provided with an override capability, such that on landing, if the selection of pitch below flight idle is not successful - because of system failures or because signals used in the system may not have transitioned to the ground mode - the flight crew could select the override function to enable use of pitch below flight idle during ground operation.

As mentioned above, many turbo-jet (turbofan) powered airplanes equipped with thrust reversers have utilized weight-on-wheels, or other air-ground logic, to prevent selection or activation of thrust reversers in flight. Generally, these systems have been capable of successful operation, despite not being equipped with any form of over-ride. It is the intention of the revised version of §25.1155 to prevent any selection or activation of propeller pitch below the flight regime or reverse thrust in flight. The provision of any override, which would allow selection or activation of propeller pitch below the flight regime or reverse thrust out the approved in flight envelope for that function would not comply with the §25.1155. The design of the system to show compliance with §25.1155 will need to take into account the Safety Objectives associated with the maintenance of the required landing performance.

5.  DEFINITIONS.

a.  Approved in-flight operating envelope. An area of the Normal Flight Envelope where a function has been accepted as suitable by the Authorities.

b.  Catastrophic. See AMC 25.1309.

c. Continued Safe Flight and Landing. See AMC 25.1309.

d. Failure. See AMC 25.1309.

e. Flight idle position. The position of thrust/power lever corresponding to the minimum forward thrust, power or pitch setting authorized in flight.

f. Inadvertent. Action performed by the pilot who did not mean to do it.

g. In-flight. That part of aeroplane operation beginning when the wheels are no longer in contact with the ground during the takeoff and ending when the wheels again contact the ground during landing.

h.  Intentional. Action performed by the pilot who meant to do it

i. Propeller pitch control system. All those system components which enable the flight crew to command and control propeller pitch

j. Remote. See AMC 25.1309.

k. Reverse control system. All those system components which enable the flight crew to command and control the thrust reverser

l.  Separate and distinct. More than or in addition to a continuation of motion required for movement and obvious to each member of the flight crew

m. Thrust Reversal. A movement of all or part of the thrust reverser from the forward thrust position to a position that spoils or redirects the engine airflow.

n. Turbojet (or turbofan). A gas turbine engine in which propulsive thrust is developed by the reaction of gases being directed through a nozzle.

o. Turbo-propeller. A gas turbine engine in which propulsive thrust is developed by the propeller

6.  COMPLIANCE with CS 25.1155.

a. Cockpit controls. The cockpit controls mean the control devices used by the crew to select the reverse thrust or the propeller pitch below the flight regime. (See CS 25.1141, 25.1143 and 25.1149)

Cockpit controls design must be adequate to permit the crew to perform the handling of the aircraft and to follow the procedures as per AFM, while mitigating crew errors.

b. Preventative means. Acceptable means to prevent intentional or inadvertent selection or activation of reverse thrust or propeller pitch below the flight regime can be:

1)  Devices to prevent movement of the cockpit control which prevents selection, or

2)  Logic in the Thrust Reverser or Propeller Control which prevents activation.

c. Separate and distinct. To move cockpit controls from the Flight Idle position must require a separate and distinct operation of the control to pass from the Flight Idle position to positions approved only for ground operation. The control must also have features to prevent inadvertent movement of the control through the Flight Idle position. It must only be possible to make this separate and distinct operation once the control has reached the Flight Idle position.

Separate and distinct is more than or in addition to a continuation of motion required for movement to the Flight Idle setting and must be obvious to the flight crew.

Examples of separate and distinct controls that have been used in previous designs are as follows:

i) Physically separate forward/reverse [below flight idle] control levers or mechanisms.

ii) Manually actuated latches located on or in the vicinity of the control that cannot be actuated until Flight Idle.

iii) A required change in direction of operation of the control from that needed for movement to Flight Idle.

Examples of separate and distinct control operation, which would not be acceptable include:

i) a separate operation, which can be activated away from the Flight Idle position, so that movement of the control from forward thrust to below the flight regime or thrust reversal can be accomplished with a single action.

ii) any separate operation, where latches or equivalent devices can be pre-loaded by the pilot so that a single movement of the control, enables movement below flight idle.

iii) any control arrangement, where it can be ascertained that normal wear and tear could cause the separate and distinct action to be lost.

d. Cockpit indications. The overall indication requirements for Thrust Reverser Control System and Propeller Pitch Control System are given in the CS 25.933, 25.1305(d)(2), 25.1309(c), 25.1322, and 25.1337(e) paragraphs and their associated AMCs. The following text adds some specific guidance with respect to the requirements of paragraph CS 25.1155(d) and (e).

Sub-paragraphs “(d)” and “(e)” of the rule require crew cautions to be provided for two conditions:

“(d)”  when the means ‘to prevent both inadvertent and intentional selection of propeller pitch settings below the flight regime (thrust reversal for turbo-jet powered airplanes) when out of the approved in-flight operating envelope for that function’ is lost. The purpose of this caution is to inform the flight crew that a fault has occurred to the propeller pitch control system or the thrust reverser control system, so that the protection means is no longer available and any movement of the control below the flight regime (forward thrust regime) may cause a low pitch/high drag condition or thrust reverser deployment. With this information, the flight crew will be able to take appropriate precautions, as advised by approved Manuals and reinforced by their training, to minimise the possibility of a hazardous condition. Without this caution, a fault in the protection means could allow an unsafe condition to occur, whereby any inadvertent or intentional movement of the control below the flight regime could cause a hazardous low pitch or reverse thrust condition.

“(e)” when the cockpit control is displaced from the flight regime (forward thrust for turbo-jet powered airplanes) into a position to select propeller pitch settings below the flight regime (thrust reversal for turbo-jet powered airplanes) and the airplane is outside the approved in-flight operating envelope for that function. On some anticipated system designs, the pilot will have the ability to move the cockpit control below the flight regime (into thrust reverse for turbo-jet powered airplanes) with no restriction, other than the ‘separate and distinct operation’ required by CS 25.1155(a). For this type of design, the means to prevent propeller pitch settings below the flight regime (reverse thrust for turbo-jet powered airplanes) when out of the approved in-flight operating envelope for that function will be a part of the propeller pitch control system or the thrust reverser system. Whilst there is no immediate hazard at that point, the control is not in the proper position for flight operations and the flight crew need to be made aware of that situation, so that they can take the appropriate action. In some of the accidents, where the control had been moved into the ‘below flight‘ regime, it was not clear whether this control movement had been inadvertent or intentional. Provision of this caution will give the crew a clear indication of any incorrect placement of the control however the control was positioned. For any design, where there is approval for selection of propeller pitch settings below the flight regime (reverse thrust for turbo-jet powered airplanes), there will be no need to provide this caution when the aircraft is in the approved in-flight operating envelope for that function. Also, as made clear in CS 25.1155(e), there is no requirement to provide any caution for control movement, when on the ground.

e. Reliability considerations. The intention of CS 25.1155(b) is for the aircraft design to include a means to prevent the flight crew selecting (or activating) propeller pitch settings below the flight regime or reverser deployment, when the aircraft is not in the approved in-flight operating envelope for that function. The introduction of the rule stems directly from a number of cases, where such a selection has caused accidents. Because of a large variability in the current perception of the future occurrence rate for this type of flight crew error, a target reliability level for the prevention means is included in the rule, see CS 25.1155(c). This level of reliability is expected to give a high degree of protection from the unwanted selection or activation of low propeller pitch or reverser deployment. The provision of the cautions should provide the necessary safeguard, on the few occasions when the prevention means fails. Additionally, this target safety level should not be inconsistent with the required availability of the reversing function for landing performance.

The safety assessment methods established by CS 25.901(c) and CS 25.1309(b) are appropriate for the determination of the reliability level required by CS 25.1155(c) and for assessing the effects of any other failure conditions or malfunctions.

f. Reverser/pitch below flight regime availability on ground. Landing or Aborted take-off distances on wet runways usually take credit for the braking effect created by reverse thrust or propeller pitch below flight idle. Therefore availability of these systems when in the approved operating envelope must be maintained.

It must therefore be shown that failures in the system provided to meet CS 25.1155(b) do not degrade significantly the availability of the reverse thrust or low pitch selection on ground.

7.  INSTRUCTIONS FOR CONTINUED AIRWORTHINESS.

a. Manufacturing/Quality. Due to the criticality of the reverse thrust function or pitch below flight regime function, manufacturing and quality assurance processes should be assessed and implemented, as appropriate, to ensure the design integrity of the critical components.

b. Maintenance and Alterations. Reference to CS 25.901(b)(2) and CS 25.1529/Appendix H. The criticality of the control system requires that maintenance and maintainability be emphasized in the design process and derivation of the maintenance control program, as well as subsequent field maintenance, repairs, or alterations.

c. Manuals- Limitations/Procedures. Prohibition of use of reverse thrust or pitch settings below the flight regime when outside the approved in-flight operating envelope for that function should be introduced in AFM.

Cautions as described in 1155(d) and (e) and their related procedures should be included in the Operations Manual.

CS 25.1161 Fuel jettisoning system controls

ED Decision 2003/2/RM

Each fuel jettisoning system control must have guards to prevent inadvertent operation. No control may be near any fire extinguisher control or other control used to combat fire.

CS 25.1163 Powerplant accessories

ED Decision 2003/2/RM

(a) Each engine-mounted accessory must –

(1) Be approved for mounting on the engine involved;

(2) Use the provisions on the engine for mounting; and

(3) Be sealed to prevent contamination of the engine oil system and the accessory system.

(b) Electrical equipment subject to arcing or sparking must be installed to minimise the probability of contact with any flammable fluids or vapours that might be present in a free state.

(c) If continued rotation of an engine-driven cabin supercharger or of any remote accessory driven by the engine is hazardous if malfunctioning occurs, there must be means to prevent rotation without interfering with the continued operation of the engine.

CS 25.1165 Engine ignition systems

ED Decision 2003/2/RM

(a) Each battery ignition system must be supplemented by a generator that is automatically available as an alternate source of electrical energy to allow continued engine operation if any battery becomes depleted.

(b) The capacity of batteries and generators must be large enough to meet the simultaneous demands of the engine ignition system and the greatest demands of any electrical system components that draw electrical energy from the same source.

(c) The design of the engine ignition system must account for –

(1) The condition of an inoperative generator;

(2) The condition of a completely depleted battery with the generator running at its normal operating speed; and

(3) The condition of a completely depleted battery with the generator operating at idling speed, if there is only one battery.

(d) Reserved.

(e) No ground wire for any engine may be routed through a fire zone of another engine unless each part of that wire within that zone is fireproof.

(f) Each ignition system must be independent of any electrical circuit not used for assisting, controlling, or analysing the operation of that system.

(g) There must be means to warn appropriate flight-crew members if the malfunctioning of any part of the electrical system is causing the continuous discharge of any battery necessary for engine ignition.

(h) Each engine ignition system of a turbine powered aeroplane must be considered an essential electrical load.

CS 25.1167 Accessory gearboxes

ED Decision 2003/2/RM

For aeroplanes equipped with an accessory gearbox that is not certificated as part of an engine –

(a) The engine with gearbox and connecting transmissions and shafts attached must be subjected to the test specified in CS-E 160 and CS-E 740, as applicable.

(b) The accessory gearbox must meet the requirements of CS-E 80 and CS-E 590, as applicable; and

(c) Possible misalignments and torsional loadings of the gearbox, transmission, and shaft system, expected to result under normal operating conditions must be evaluated.