AC 27-1B, Chg 7 2/4/2016 Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 73-00-00 - ENGINE FUEL AND CONTROL Failure Phase of Effect of the Failure Classification Notes Supporting Verification ATA Function Description (FC) Condition Operation on the Aircraft, Crew and Occupants of the FC (assumptions) Material Method 7331 Fuel Flow Loss of fuel ALL The reduction in safety Analysis Indicating flow. margins and functional capability in the system may prohibit continued safe flight and landing.
Malfunction ALL The failure can delay Analysis and loss of crew action long fuel flow enough to prevent indication. continued safe flight and landing.
Misleading ALL A large reduction in Analysis fuel flow safety margins or alert failed. functional capabilities.
7332 Fuel Pressure Loss of fuel ALL The reduction in safety Analysis Indicating pressure. margins and functional capability in the system may prohibit continued safe flight and landing.
Malfunction ALL A combination of a Analysis and loss of malfunction with a loss and Test fuel of indication in the pressure system can delay crew indication. action long enough causing a large reduction in safety margins or functional capabilities.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 38
Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 73-00-00 - ENGINE FUEL AND CONTROL Failure Phase of Effect of the Failure Classification Notes Supporting Verification Function ATA Description (FC) Condition Operation on the Aircraft, Crew and Occupants of the FC (assumptions) Material Method Misleading ALL If the indication to the Analysis fuel pilot is a warning, the pressure likely requirement is to indication. land immediately.
Worst case is ditching in poor conditions causing a large reduction in safety margins or functional capabilities.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 39
AC 27-1B, Chg 7 2/4/2016 Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 75-00-00 - AIR Failure Phase of Effect of the Failure Classification Notes Supporting Verification ATA Function Description (FC) Condition Operation and Occupants on the Aircraft, Crew of the FC (assumptions) Material Method 7510 Engine Anti- Loss of a Cruise A significant loss of Analysis and Icing (A/I) single safety margin due to Test System engine A/I loss of a critical system on a redundant system.
multi-engine aircraft. Significant increase in pilot workload Loss of Cruise Results in a large Analysis and engine A/I reduction in aircraft Test system on a safety margin and a single large increase in pilot engine workload.
aircraft.
7532 Compressor Malfunction Cruise May cause an engine Analysis and Bleed Valve - valve is stall or surge that leads Test failed OPEN loss of one engine.
on one Significant increase in engine of a pilot workload.
multi-engine aircraft.
Malfunction Cruise May cause an engine Analysis and
- valve is stall or surge that leads Test failed OPEN loss of the engine.
on one More than a significant engine on a increase in pilot single workload as the crew engine will likely have to land aircraft. as soon as possible.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 40
Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 75-00-00 - AIR Failure Phase of Effect of the Failure Classification Notes Supporting Verification ATA Function Description (FC) Condition Operation and Occupants on the Aircraft, Crew of the FC (assumptions) Material Method 7540 Bleed Air Loss of ALL A slight reduction in Analysis and Indicating bleed air safety margins. Test System indication.
A slight increase in pilot workload.
Misleading ALL Misleading indication Analysis and bleed air may cause an Test indication. inappropriate engine setting resulting in a significant reduction in system safety margins.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 41
AC 27-1B, Chg 7 2/4/2016 Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 79-00-00 - OIL Failure Phase of Effect of the Failure Classification Notes Supporting Verification ATA Function Description (FC) Condition Operation on the Aircraft, Crew and Occupants of the FC (assumptions) Material Method 7931 Engine Oil Loss of oil ALL Loss of indication can Analysis Pressure press delay crew action long indication. enough to prevent continued safe flight and landing.
Misleading ALL If the indication to the Analysis and oil press pilot is a warning, the Test indication. likely requirement is to land immediately.
Worst case is ditching in poor conditions causing a large reduction in safety margins or functional capabilities.
7932 Engine Oil Loss of oil ALL Loss of indication is Analysis Quantity quantity considered to be a indication. significant increase to pilot workload but only when required to be displayed per 14 CFR
27.1337(d)(2).
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 42
Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 79-00-00 - OIL Failure Phase of Effect of the Failure Classification Notes Supporting Verification ATA Function Description (FC) Condition Operation and Occupants on the Aircraft, Crew of the FC (assumptions) Material Method Misleading ALL If the indication to the Analysis and oil quantity pilot is a warning, the Test indication. likely pilot action is to land immediately.
Worst case is ditching in poor conditions causing a large reduction in safety margins or functional capabilities.
7933 Engine Oil Loss of oil ALL Loss of indication in Analysis and Temperature temperature the system can delay Test indication. crew action long enough to cause a large reduction in safety margins or functional capabilities.
Misleading ALL If the indication to the Analysis and oil pilot is a warning, the Test temperature likely requirement is to indication. land immediately.
Worst case is ditching in poor conditions causing a large reduction in safety margins or functional capabilities.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 43
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 22 ROTORCRAFT ONE ENGINE INOPERATIVE (OEI) TRAINING MODE.
a. Purpose. This guidance provides a means to achieve airworthiness approval for OEI training mode to be installed on rotorcraft. These devices have been mainly designed to allow category A training without using the OEI ratings thus eliminating the need of extra maintenance for the engines and drive system. This guidance does not change the regulatory requirements and does not authorize changes in, or deviations from, regulatory requirements. These guidelines are developed for category A rotorcraft. If an applicant would like to develop such a system for category B rotorcraft, additional requirements may be applied by the certification authority.
b. References and Related Documents.
falo Species 0n,s) pa 21, co, SEnding European Requirements
(2) ACs 27-1B and 29-2C.
c. Background. Different types of OE training modes and similar systems have been developed and are likely to be developed in the future. Their intent was to provide operators with a means to simulate OE conditions for training purposes without using the engine and drive system OE ratings. This type of installation requires an appropriate level of qualification, commensurate to the criticality of the most severe effects on the rotorcraft.
d. Definitions. OE Training mode: for the purpose of this guidance material, a system or device designed to train the flightcrew by simulating, with an appropriate weight, the OEI conditions, reducing the power of the engines without accessing the actual OEI engine and drive system ratings. This includes cockpit controls and display indications necessary for the flightcrew to safely operate the system or device.
e. Certification Approach. There are different basic aspects to consider when approaching an OEI training mode that should be addressed in the proposed certification plan.
(1) System purpose definition. The certification process should begin with a clear declaration of the objective of the OE training mode. Past experiences have shown that these type of systems have been mainly designed to allow operators to train their flightcrew on category A procedures without cutting one engine to idle through the Page MG 22 - 1
AC 27-1B, Chg 2 4/12/06 engine controls; however, the purpose could also be extended to simulate an engine failure during other conditions (i.e., failure during the cruise). In any case, the maneuver to be simulated with its initial and final points has to be clearly identified by the applicant in order to prepare the certification plan.
(2) Functional Hazard Assessment.
(i) The purpose of the system is the input for the hazard assessment where all the potential failures are identified and appropriately classified taking into account the most critical phase of flight, thus establishing in a systematic way the integrity levels required for each function provided. It is to be noted that an OEI Training Mode is designed to increase the level of safety relative to traditional training operations and therefore the design of the systems should be such that the associated functional failures are never more severe than those associated to an engine cut intentionally to idle. It should be recognized, however, that operation in training mode is an intentional operation in a degraded condition and that the consequences of certain failures may be more severe than those expected in normal operation.
(ii) The functional hazard assessment has to take into account the other systems that interact with the OEI Training Mode (typically the engine control system and the cockpit displays) and all the potential failures that can occur during operation of the training mode. The effect of engine failures and malfunctions that are likely to occur during the operation of the system need to be taken into account. The functional hazard assessment should also cover the failure associated with the safety devices introduced in the system.
(3) Engine failures. Actual engine failure while in OEI training mode should be addressed. While recognizing that an actual failure during training mode is potentially more severe than one during normal operation, adequate safety devices should be provided to minimize the consequences of actual engine failure during training mode.
(4) Display of powerplant instruments. There may be different ways to present the engine data during the OEI training mode functioning. Past experience has shown that some applicants have developed systems where during the simulation, engine limits and associated cautions and warnings are re-scaled in order to present to the flightcrew the same scenario that would occur in case of an actual engine failure. As the current part 29 requirements (including § 29.1305) do not allow displaying biased parameters, the applicant should show an equivalent level of safety with respect to §§ 29.1305 and
27.1549. In particular, while the training mode is engaged, the pilot being trained should be provided with a set of information related to the training drill and not be confused by other data; the safety pilot or instructor should be informed of any abnormal conditions. If a rotor droop is generated during the training maneuver, it is acceptable that the NR indicator shows the limits relevant to OEI conditions even if both engines are running.
(5) Management of Engine Power.
Page MG 22 - 2
(i) Careful consideration has to be given to the method implemented by the applicant to simulate the engine failure. As of today, two different methods have been used:
(A) Reducing one engine to flight idle and using the other engine up to a limit chosen by the applicant.
(B) Reducing both engines to an intermediate power and use the total power available to simulate the OEI power.
(ii) The second method is expected to provide better acceleration characteristics in case a failure occurs to one engine during the use of training mode.
However, if an applicant would like to implement the first method, evidence has to be provided that the engine accelerating characteristics are acceptable. In both cases, the OEI training engine acceleration characteristics have to be demonstrated by the applicant for the envelope for which approval of the system is sought.
(6) Human Interface Aspects. The human interface aspects of the system have to be carefully considered and appropriately addressed in the certification plan. The information provided to the flightcrew during normal operation of the system and during emergency situation is the main subject of the investigation in order to assess the effectiveness and avoid misleading information on the status of the system that can result in flightcrew errors. During the assessment, consideration should be given to:
(i) Color coding.
(Ii) Labeling of the controls (e.g., switches, buttons, etc.) used by the training mode.
(ili) Clear and unambiguous identification of the status of the system; all the parameters that are presented to the flightcrew in a modified scale have to be clearly identified and easily recognizable by the flightcrew.
(iv) OE training control segregated from the standard engine controls.
(v) Flightcrew alerts. If flightcrew alerts are generated by the OE training system, consideration should be given to the following points:
(A) Prioritization of OE training alerts with respect to those generated in case of actual failures. The OE training alerts should not change the priority given to the helicopter systems alerts or introduce a delay when these are generated.
(B) Capability of the flightcrew to distinguish the OE training alerts from those generated by the other helicopter systems. Distinguishable alerts will prevent flightcrew confusion of the actual status of the rotorcraft.
Page MG 22 - 3
AC 27-1B, Chg 2 4/12/06 (C) Representation of OE training alerts with respect to the actual case for which the system is designed. Lack of complete representation of the OEI training alerts can be accepted and documented in the rotorcraft flight manual (RFM).
(7) Representativeness of the maneuver. Although the final decision on the use of the system for training purposes is the responsibility of the national operational authority, the applicant and certificating authority should ensure that the system adequately represents the actual maneuvers the system is designed to simulate. In this regard, the certification team should:
(i) Ensure that the engine failure dynamics of the training mode favorably compare with an actual engine failure. This can be accomplished by comparing the time histories of Ng/torque during an actual engine failure and a training mode engine failure.
(II) Qualitatively evaluate the piloting techniques required for the training maneuver and the maneuvers used for certification. Ensure the techniques are sufficiently similar to provide adequate training.
(iii) If the training mode does not adequately replicate portions of an OEI event, to include a realistic reproduction of the resultant flight path, those areas should be identified in the RFM (e.g.iThe OEI training mode does not accurately represent second stage climb performance.").
(8) Limitations and Performance Charts.
(i) RFM data necessary for the use of the system typically include:
(A) Weight limitations for training.
(B) Performances associated to the system operative (e.g., rate of climb, take off, landing distances).
(ii) This data should be validated by actual tests or analysis validated by tests or a combination of both to assure the same level of accuracy as the other RFM data.
(9) RFM. The RFM should contain the following information:
(i) Description of the system and its functions.
(il) Clear statement on the scope of the training mode and the extent of the validity of the system.
(III) Limited to essential crew only.
Page MG 22 - 4
(iv) Detailed description of the safety features implemented in the system and their use during normal and emergency conditions.
(v) Weight limitations for training, which should be presented in the same format used for the category A Weight-Ambient-Temperature Charts.
(vi) Normal and emergency procedures to be applied; these procedures need to include those necessary to exit the training in case of emergency.
(vii) Performance information (l.e., rate of climb, take off, and landing distances), if different from non-training. Performance information in case of actual engine failure while in training mode is not required.
Page MG 22 - 5
AC 27-1B, Chg 2 4/12/06 Page MG 22 - 6