October 7, 2026 · 11 min read

14 CFR 33.65 / 33.75 / 25.903(e)MMEL Relief SubstantiationAD 2026-20-02 / MMEL 75-33-01

When the Relief Had No Data Behind It: The Trent 1000 IPBV Dispatch Ban (FAA AD 2026-20-02) Through a Part 33 and MMEL Substantiation Lens

Most airworthiness directives tell you what broke. This one tells you what nobody ever measured. The FAA has just removed a three-day dispatch allowance for Boeing 787s with Rolls-Royce Trent 1000 engines, not because a valve failed in service, but because the engine manufacturer reported it lacks the data to show the engine behaves safely with that valve inoperative. A dispatch relief that has been sitting in the MMEL, quietly used, with no substantiation underneath it. That is a different species of finding, and it is worth dissecting.

1. The public record

On September 29, 2026 the FAA published a final rule, AD 2026-20-02 (Amendment 39-23475, 91 FR 61302, Docket FAA-2026-11785, ATA 75), covering Boeing 787-8 and 787-9 airplanes powered by Rolls-Royce Deutschland Trent 1000 engines, all eighteen listed variants from -A through -L2. The effective date is October 14, 2026, the compliance date is 60 days later, December 13, 2026, and comments stay open through November 13 even though the rule is already final.

The origin is a report from Rolls-Royce Deutschland. Per the AD, the company reported insufficient data validating engine performance when an airplane is dispatched under MMEL item 75-33-01, "Engine Intermediate Pressure (IP) Bleed Valves (RR)". That item allows dispatch for three days with one intermediate pressure bleed valve (IPBV) inoperative per engine, with performance adjustments. The AD names what is unsubstantiated: compressor stability, relight capability, surge recovery, and inclement-weather operability.

The FAA's unsafe-condition statement is blunt: dispatching with an inoperative IPBV "could result in loss of engine thrust control and consequent loss of control of the airplane." The agency adds two scenarios worth reading slowly. If the condition exists on both engines, thrust control is at risk on both. If it exists on one, the airplane is a single failure away from a catastrophic outcome, and airplanes dispatched this way "are not assured to provide recovery from surges or flameouts."

The required action is one sentence: operators may not dispatch under the operational procedures of the MEL item corresponding to MMEL 75-33-01. The FAA estimates 16 U.S.-registered airplanes and one labor-hour at $85 each, $1,360 total, with no parts. GEnx-powered 787s and all 787-10s are outside the applicability (AeroCorner). The FAA invoked good cause to skip prior notice and comment, saying the risk to the flying public justified it.

Two pieces of context. First, the cost line is the tell: the fleet impact is a paperwork edit because the hardware is not the problem. Second, this is not the first time the Trent 1000 has constrained 787 operations. In 2018 the FAA cut extended-diversion capability for certain Trent 1000 airplanes from 330 minutes to 140 over compressor blade durability, affecting roughly 168 airplanes worldwide according to the Seattle Times coverage carried by HeraldNet and AvWeb. Different mechanism, same lesson: compressor behavior at the edges of the envelope is where this engine family keeps surprising people.

2. The standards lens

An IPBV is a compressor handling device. The Trent 1000 is a three-shaft engine, and valves that vent intermediate-pressure compressor air help keep that compressor away from surge at off-design conditions such as low power, transients and weather. It is not the airframe bleed system; the 787's bleedless architecture takes that off the table. This one is purely about whether the engine stays inside its stability margin.

So the engine-side obligations live in 14 CFR Part 33. §33.65 requires that surge and stall characteristics are such that no unacceptable mechanical damage or loss of thrust control occurs through the operating envelope. §33.75, the safety analysis, requires that hazardous engine effects are shown to be extremely remote and that major effects are remote, with the failure states assumed in the analysis stated. On the airframe side, §25.903(e) requires relight capability in the flight envelope, and §25.1309 with ARP4754B and ARP4761A governs the system-level safety assessment, including the assumption that a failure condition classified as catastrophic is not allowed to result from a single failure.

Here is the artifact chain that should have caught this. The certified safety analysis assumed an IPBV population at a given reliability and an engine in its type-design configuration. The MMEL relief was a separate decision: a justification, made through the operational suitability process, that operating for a bounded interval with a known component inoperative stays acceptable. That justification only works if the degraded configuration has been analyzed and, for stability-critical behavior, tested or otherwise substantiated across the dispatch envelope. The AD says that substantiation does not exist for four properties.

I want to be careful about what that means. It does not mean the engine surges with the valve stuck. It means the claim "this is acceptable" had no evidence behind it, and the manufacturer, to its credit, said so. An unsubstantiated safety claim and a disproven one are different, and the AD correctly treats the first as sufficient grounds to act, because an assumption nobody validated cannot carry a Catastrophic classification.

There is also a software seam. The engine control software that schedules the IPBVs and manages thrust is developed under DO-178C, and the thrust-control function sits at DAL A because loss of thrust control is a Catastrophic failure condition. DAL A assurance proves the software does what its requirements say. It cannot prove the requirements were written for the degraded plant, where one valve no longer follows commands. If the controller's stability logic was validated only against a healthy valve set, DAL A rigor was applied to an incomplete requirements baseline.

3. A worked snippet: the missing row

Here is the FHA row, and the fault-tree fragment that the MMEL relief quietly rewrites. The numbers are illustrative of the structure, not Rolls-Royce's certified figures.

| ID | Function | Failure condition | Phase | Effect | Classification | Objective | |---|---|---|---|---|---|---| | FHA-ENG-07 | Maintain compressor stability and thrust control | Loss of thrust control from surge or flameout that is not recoverable | Takeoff, climb, approach, go-around | Loss of thrust on one or both engines, potential loss of control | Catastrophic (both engines) / Hazardous (one engine) | Extremely improbable for the both-engine case; no single failure may produce it |

TOP: Unrecoverable surge/flameout, thrust control lost on both engines
     [Catastrophic]
        AND
        ├── G1: Compressor driven outside stability margin on each engine
        │        OR
        │        ├── BE1  Weather/transient excursion (ingestion, rain, ice, gust)
        │        ├── BE2  Power transient at low-handling-margin condition
        │        └── BE3  IPBV does not open when commanded
        │                 [MMEL 75-33-01: this state is DISPATCHED INTO, 3 days]
        │
        └── G2: Recovery fails (stall clearance and/or relight)
                 OR
                 ├── BE4  Surge recovery logic cannot clear stall
                 │        [NOT SUBSTANTIATED with BE3 present - per AD]
                 └── BE5  Relight not achieved in envelope
                          [NOT SUBSTANTIATED with BE3 present - per AD]

Read BE3 carefully. In the certified tree it is a rare basic event, multiplied by an exposure time. Under the MMEL it becomes a scheduled state: a configuration the operator may choose to enter, up to three days at a time, on an engine pair that shares the same maintenance and the same dispatch decision. The relief converts a random event into a deliberate one and, worse, makes common cause visible: the same station, the same parts availability, the same MEL, both engines. The both-engine branch of the AND stops being a product of two independent rare events.

The reframing in table form:

| Assumption in the certification basis | What MMEL 75-33-01 actually does | Status per AD | |---|---|---| | IPBV failure is a rare, independent event per engine | Allows the failed state on up to both engines for three days | Exposure and independence unquantified | | Surge recovery works with the type-design valve set | Operates with one valve per engine inoperative | Recovery not substantiated | | Relight works across the §25.903(e) envelope | Dispatch includes weather and altitude cases | Relight not substantiated | | Performance adjustments make the degraded state acceptable | Adjustments are in the relief text | No data tying adjustments to stability margin |

4. Derived requirements (excerpt)

If I owned the corrective-action package, these are the rows I would want in the baseline. Thresholds are illustrative targets, not certified values.

| Req ID | Requirement text | Trace | Verification | |---|---|---|---| | REQ-MMEL-201 | Every MMEL relief item that permits dispatch with an inoperative engine component shall cite a substantiation record covering stability, relight, surge recovery, and weather capability in that configuration. | AD 2026-20-02 unsafe condition | Document review; engine test or analysis report reference | | REQ-ENG-202 | With one IPBV inoperative per engine, the engine shall demonstrate surge-free operation and stall clearance within 5 seconds across the certified power-transient envelope. | BE3, BE4 / §33.65 | Engine test with seeded valve failure | | REQ-ENG-203 | With one IPBV inoperative per engine, in-flight relight shall succeed within the §25.903(e) envelope at the 95 percent confidence level. | BE5 / §25.903(e) | Altitude-cell relight test; flight test | | REQ-SW-204 | The EEC stability logic shall detect an IPBV that has not reached commanded position within 2 seconds and shall annunciate it to maintenance and to the crew. | BE3 | Software-in-the-loop fault injection; DO-178C requirements-based test | | REQ-MMEL-205 | Any MMEL relief shall be re-evaluated for common-cause exposure when it can apply to both engines of an airplane simultaneously, and the justification shall record the independence assumption. | G1 AND-gate independence | MMEL justification audit |

REQ-MMEL-201 is the one that does the work. It is a process requirement that sits between the engine certificate holder, the airframer, and the operator's MEL author, and that is exactly why it was missed: nobody owned the seam.

5. What the headline really tells us

The headline says the FAA banned dispatch with a bleed valve inoperative. What actually happened is smaller and more uncomfortable: a dispatch relief existed without the evidence file that should have justified it, and it took the manufacturer noticing the gap, years into service, for the paperwork to catch up. The missing artifact is not a bolt, a clip, or a line of code. It is a substantiation record for every relief item, linking the relief to the specific tests or analyses that make the degraded configuration acceptable, with the independence assumption written down. A relief without that record is not a margin. It is a hope with an effective date.

— Jherrod Thomas, The Lion of Functional Safety™