AC 27-1B, Chg 7 2/4/2016 (A) AFCS Malfunction Assessment. Failure conditions in the AFCS, including SAS, ATT, FD and AP functions, that are not shown to be extremely improbable must be demonstrated in flight.
Assessment of failure conditions has the following elements:
(1) Failure condition insertion.
(2) Pilot recognition of the effects of the failure condition.
(3) Pilot reaction time (that is, the time between pilot recognition of the failure condition and initiation of the recovery).
(4) Pilot recovery.
(B) Failure Condition.
(1) Failure Conditions. The AFCS failure conditions should be simulated such that overall response is representative of the actual effect of that failure condition on the aircraft and its systems.
(2) Most Critical Conditions. The aircraft loading and flight conditions under which the failure condition is inserted should be the most critical. Examples of these conditions are CG, weight, altitude, speed, and power. If the AFCS includes coupling to the collective axis, the tests should be performed with the collective axis both coupled and uncoupled.
(C) Pilot Recognition and Response Time.
(1) The pilot recognition and response time is dependent on pilot involvement in the flying task, which is defined as "active," "attentive," and "passive" flight. The pilot's involvement in the flying task is dependent on the level of stabilization provided by a particular mode of the AFCS, as well as the phase of flight.
(i) Active flight - any flight segment during which the characteristics of the aircraft necessitate continuous flying of the rotorcraft by the pilot using the primary flight controls. Active flight includes take-off, hover, and landing.
(I) Attentive flight - any flight segment requiring attention from the pilot for short periods. Attentive flight can be further subdivided into hands-on and hands-off. Attentive, hands-on addresses phases of flight where the AFCS is controlling the flight path, but close attention is required from the pilot. Examples include coupled hover and coupled approach. Attentive, hands-off addresses flight phases where the controls can be released for extended periods of time, but where the pilot is expected or required to continue to monitor the behavior of the aircraft and system. Examples include using the following AFCS modes in climb, cruise, hold, and descent: a more basic attitude hold such that the pilot is required to monitor the series actuator authority and correct as necessary; or an AP mode if an AFCS malfunction results in a caution message and the applicable emergency or abnormal procedure requires the pilot to be attentive.
(II) Passive flight - any flight segment of long duration requiring the minimum of attention from the pilot. This can be further subdivided into hands-on and hands-off, the latter being applicable if the rotorcraft automatic flight control system allows the pilot to release the flight controls for substantial periods of time. Passive hands-on flight may include using attitude retention modes of the AFCS in climb, cruise, hold, and descent. Passive hands-off flight may include using AP modes in climb, cruise, hold, and descent.
Note: It is not acceptable to use reduced pilot response times based on rotorcraft flight manual (RFM) limitations requiring the pilot to be hands-on if hands-on flight is not appropriate to the level of stabilization and flight path control provided by the AFCS operating mode.
Page Apdx B - 6
(2) Pilot recognition of AFCS malfunctions. The pilot may detect an AFCS failure condition through aircraft motion cues or by cockpit flight instruments or alerts. The specific recognition cues will vary with specific failure type, flight condition, phase of flight, and crew duties. When evaluating AFCS malfunctions for attentive hands-off and passive flight, it should be assumed that the flight crew is performing cockpit duties that require it to divert their attention away from the flight instruments.
(i) Hardover. The recognition point should be that at which a pilot operating in non-visual conditions may be expected to recognize the need to take action. Recognition of the failure may be through the behavior of the rotorcraft or through an appropriate alerting system. Flight control movements alone should not be used for recognition. The pilot recognition time will be the least of the time taken for the:
(A) Rotorcraft to achieve an angular rate of change about any axis of 3° per ) To rat achieve sec (active and attentive flight). The time taken for the rotorcraft to achieve an angular rate of change about any axis of 5° per sec (passive flight);
(B) Rotorcraft to increase or decrease acceleration along any axis by 0.2g (active and attentive flight). The time taken for the rotorcraft to achieve an acceleration about any axis of
0.25g (passive flight); or (C) Relevant alert to function.
(i) Slowover. This type of failure condition is typically recognized by a path deviation indicated on primary flight instruments (for example, course deviation indicator (CDI), altimeter, or vertical speed indicator). It is important that the recognition criteria are agreed upon with the FAA. The following identify examples of recognition criteria as a function of flight phase:
(A) En-route cruise. Recognition through the altitude alerting system can be assumed for vertical path deviation. The lateral motion of the rotorcraft may go unrecognized for a significant period of time, unless an alerting system is installed and the slowover results in a path or attitude deviation in excess of the limit allowed by the alerting system.
(B) Climb and descent. Recognition through increasing or decreasing vertical speed, pitch attitude, roll attitude, or heading can be assumed.
(C) On an approach with vertical path reference. A displacement recognition threshold should be identified and selected for testing that is appropriate for the display(s) and failure conditions) to be assessed.
D) On an approach without vertical path reference. Criteria similar to the climb or descent condition can be assumed.
Note: Credit may be taken for excessive deviation alerts, or other clear and unambiguous alerts provided to the pilots, if available.
(II) Oscillatory. Oscillatory failures having structural implications must be addressed under part 27, Subpart C and § 27.1309. The flight crew is expected to disengage the automatic control elements of the AFCS that have adverse oscillatory effects and not follow adverse oscillatory guidance. However, if unable to disconnect some elements of the AFCS in the presence of an oscillatory failure condition, there should be an evaluation of the long-term effects on crew workload and the occupants.
(3) Pilot response time. Pilot response time consists of pilot recognition time and pilot reaction time. The pilot response time is considered dependent upon the pilot attentiveness, based upon the phase of flight and associated duties. This period commences at the time the pilot is cued to the Page Apdx B - 7
AC 27-1B, Chg 7 2/4/2016 fact that something abnormal is occurring (at the end of the pilot recognition time) and terminates when the controls are moved to commence the recovery maneuver. The pilot recognition time is assumed to crease as the pilot relaxes his involvement level. The pilot reaction time is londer tor hands-off than t ands-on as the pilot has to locate the controls before he can move them. The following pilot respons times have been considered acceptable:
Page Apdx B - 8
Recognition Reaction Time Pilot Response Flight Segment Time (sec) Time (sec) (sec) Active 0.5 0.5 Attentive-Hands-On 1.0 0.5 1.5 Attentive-Hands-Off 1.0 1.0 2.0 Passive 2.0 1.0 3.0 Notes: Recovery from simulated malfunctions of any AFCS axis occurring while the pilot is applying control inputs to cause rotation about that axis may be initiated with normal pilot reaction; the 1- second delay (decision time) in maneuvering (attentive hands-on) flight pertains to established turns (level, climbing, and descending) only.
For rotorcraft requiring a minimum crew of two pilots and with AFCS systems that do not have the capability to couple to AP modes, it can be assumed that the pilot is attentive-hands-off during the climb, cruise, and descent phases of flight.
(D) Pilot Recovery.
(i) Pilot recovery action. The recovery action should be commenced after the pilot recognition and response times. Following such delay, the pilot should be able to return the rotorcraft to its normal flight attitude under full manual control without excessive pilot skill or strength. During the recovery, the pilot may overpower the autopilot or disengage it.
(il) AFCS Altitude Loss Testing. To determine the maximum altitude loss of the various AFCS modes during the different flight phases, a representative pilot recovery maneuver appropriate to the rotorcraft type and flight condition should be performed. This maneuver should not lead to an unsafe speed or attitude excursions to resume a normal flight path. An incremental normal acceleration in the order of 0.5 g is considered the maximum for this type of maneuver.
(7) Stability Augmentation System (SAS).
(i) If an SAS installation stabilizes the rotorcraft by allowing the pilot to "fly through" and perceive a stable, well-behaved vehicle, it qualifies as a SAS and, if reliable, receives credit under paragraphs III through VIl of Appendix B to part 27 for use in complying with all handling qualities requirements. If a conventional autopilot does not provide "fly through" capability or allow the pilot to perceive a stable, well-behaved vehicle through his manipulation of primary flight controls and feedback from those controls, then it tends to remove him from active involvement in flying and is eligible primarily
(il) If handling qualities credit is given for a SAS then it must be shown to be reliable in regards to § 27.1309. If a reliable SAS is incorporated, it should be operational during handling qualities testing for trim and stability. Reasonable single failures of the SAS must be evaluated and the resultant handling qualities must be evaluated to assure that in this degraded configuration: (1) handling qualities have not been degraded below "VFR" levels defined in part 27, Subpart B; (2) the rotorcraft is free from any tendency to diverge rapidly from stabilized flight conditions; and (3) the rotorcraft can be flown IFR throughout its endurance capability without undue difficulty by the minimum flightcrew. Compliance with a majority of the FR handling qualities requirements is desired, and the degraded characteristics should be documented and explained. Revised flight envelope boundaries for the failed condition may be considered if they are controllable by the pilot (e.g., altitude and airspeed). When loss of a SAS results in a need for minor adjustment of a flight condition, then a system can be accepted that allows failures during the life of each rotorcraft. If loss of the system will prevent continuation of safe flight and landing, the reliability of the system must be high enough to assure that failure of the system will not be expected to occur during the life of the rotorcraft fleet. When evaluating the reliability of a system, the installation of Page Apdx B - 9
AC 27-1B, Chg 7 2/4/2016 the system should be considered as part of the design. The total system including inputs, outputs, environment, isolation features, and exposure times is a pertinent consideration.
(iii) SAS reliability is evaluated by systems and equipment personnel. If credit is to be given for system reliability and the applicant exempted from consideration of malfunction, hardover and oscillatory conditions (limited to critical frequencies determined during autopilot failure analysis), a thorough system evaluation is needed. Flight test personnel should coordinate closely with the systems and equipment personnel whenever credit is given for advanced design and system reliability because the hardover or malfunction condition may not require in-flight testing. The decision is made on the basis of system design, failure analysis, and overall probability of malfunction. Multi-lane systems require careful consideration when determining the need for hardover or malfunction testing of second and subsequent failures. Factors to be taken into account are:
(A) Dissimilarity of architecture (hardware and software) between the multiple lanes (B) Cumulative probabilities. For example, in a quadruplex system where each lane has a failure probability of 1x10-4 and depending on system architecture, the level of criticality applied to the software, and the potential for generic failures the probability of three lanes failing leaving the remaining lane unmonitored would be a 1x10-12 event. In this case, testing of the third and fourth failures would not be required.
(C) Consequences of a multiple failure, considering § 27.1309. A multiple failure should not present a hazard to a category B rotorcraft or prevent continued safe flight and landing for a category A rotorcraft.
(D) Operational restrictions post-failure. If it were possible to recouple the upper modes and continue the flight without restrictions post-failure, then consider any subsequent failures with pilot intervention times relevant to the phase of flight. If a flight restriction is provided, it should be determined to be an appropriate and relevant operating limitation, and it should be specified in the RFM. Significant information regarding the restriction should be made available to the pilot in the operating procedures section of the RFM. If the restriction excludes operation under any of the flight conditions listed above, flight testing of the condition is not required. If the system is to be approved without flight restrictions (operating at all times), malfunctions should be demonstrated to be satisfactory during takeoff, climb,
(iv) Applicable procedures and techniques for conduct of hardover tests are contained in section 27.1329 of this AC. If a quick disconnect device is incorporated, it should be reachable with a finger on the hand operating the appropriate recovery control and should be operable without removing the hand from that control. A quick disconnect system can be used on duplex system if overall reliability of the system is acceptable. All cockpit emergency controls including emergency quick disconnects should be "red." The quick disconnect may be actuated at initiation of recovery. Other disconnects should only be actuated after full aircraft control has been achieved following recovery. Aircraft limits may not be exceeded during malfunction or recovery. If a monitor device automatically disconnects the SAS, it must be clearly annunciated to the crew. Appropriate delay times are shown in paragraph
b.(6) III)(C)(3).
(v) Series actuator hardover conditions in some rotorcraft can seriously degrade control margin. Critical loadings, power settings, RPM, and altitudes in conjunction with a SAS actuator hardover in an adverse direction can result in reduction of control travel requiring flight envelope constraints. Flight testing is usually necessary to determine the appropriate flight envelope reductions.
(vi) Subsequent failures and unrelated probable combinations of failures must be considered, including subsequent SAS failures. Systems and equipment section analysis should provide necessary SAS malfunction combinations for flight testing because of their system analysis. Minimum requirements for dispatch and procedures following failure should be included in the malfunction analysis. Results of
the probability analysis and the resultant malfunction configurations are primarily the responsibility of the systems and equipment section.
(vii) No reasonably probable failure should result in a worse condition than that tested for hardovers. For example, if a magnetic brake force trim system is employed, failure of electrical power to the magnetic brake circuit may cause the cyclic control to tail, which may result in a more dangerous flight condition than individual SAS hardovers. The overall control system is to be evaluated for all probable failures to preclude hazardous failure conditions. Other areas for investigation include beep trim and auto trim failures. The delay times of paragraph b. (6)(i)(C)(3) are appropriate for all such failures. System malfunctions may also include component failures that result in oscillatory outputs of the actuator(s).
These should be sustainable at least as long as the specified hardover delays, should be manageable thereafter with hands on the controls, and should allow disconnect of the malfunctioning system.
(viii) Engine failure requirements are not entirely consistent with the SAS failure time delays shown in paragraph b. (6)(iii)(C)(3). Engine failure time delays remain as specified in § 27.143(e), and they are lower than corresponding SAS failure delays. Critical engine failure conditions should be reverified during simulated instrument flight with primary reference to flight instruments. Lower time delays for engine failure have been justified on the basis of immediate cues for the critical high powered condition and requirements for engine failure warning systems. Many rotorcraft designs simply cannot endure a 3-second time delay for critical engine failure conditions. Nevertheless, engine failure, autorotation entries, and autorotation descent (for single-engine rotorcraft and multiengine rotorcraft without category A engine isolation) should be evaluated in simulated IFR conditions, and these flight characteristics must be acceptable.
(8) Controllability.
(i) Control harmony should be present. There should be no objectionable cyclic to collective or roll-yaw-pitch cross coupling.
(ii) Control forces following a control system malfunction such as a hydraulic system failure should be low enough to allow completion of the intended flight. It may not be possible to land early during an actual IFR flight.
(ilI) There should be no tendencies for pilot-induced oscillations; There should be no sustained or uncontrollable oscillations resulting from the efforts of the pilot to control the rotorcraft.
(iv) The control system should have sufficient resolution to permit accurate and precise instrument maneuvers. Some control systems with high breakout forces in conjunction with low control force gradients do not lend themselves to satisfactory instrument flight capability.
(9) Cockpit Arrangement.
(i) The primary flight instrument basic T (or a modified T with VS above the altimeter) should be located as nearly in front of the pilot as possible. All annunciations necessary for operation of stability systems should be readily in view. Secondary flight (or navigation) instruments such as radar altimeter and secondary radio course information, DME, etc., should be grouped around the periphery of the T.
Next in priority are primary power instruments such as torque and rotor RPM. Powerplant instruments and backup attitude information should be placed in the remaining panel areas. Various research and development efforts and previous certification programs have revealed that it is desirable not to locate the standby attitude indicator immediately adjacent to the basic flight instrument T. The standby attitude indicator must be usable and flyable from the primary pilot station (and any other pilot station); however, locating it too close to the primary instruments may be undesirable and should be evaluated. If the standby attitude information is close to the pilot's normal flight instrument scan, he may begin to compare attitude information between the two indicators in his normal instrument scan. Every pilot eye motion to compare these indicators could be a wasted motion that could be more efficiently applied in the normal scan. The pilot should fly either the primary or the backup indicator and it may be an aid if these Page Apdx B - 11
AC 27-1B, Chg 7 2/4/2016 indicators are noticeably separated. When the standby indicator is located apart from the normal scan and the primary indicator fails, the pilot is conscious of a distinctly different instrument scan and is less likely to be continuously coming back to the center of the basic T for attitude reference. Physical separation can assist the transition to standby attitude flight.
(ii) All cockpit controls necessary for normal and emergency operations should ideally be located so that they may be actuated without upper body movement. Moderate head and body movement has been accepted; however, these motions must be evaluated for their vertigo inducing effects. No IFR controls should be located aft of a vertical plane passing left to right (laterally) through the pilot's body.
(iii) If a copilot position is approved, the copilot must have a complete set of flight controls and must be capable of independently flying and navigating the rotorcraft from his position. The copilot must be capable of controlling at least one primary navigation source so that he can operate the rotorcraft during normal conditions without relying on the first pilot to perform needed cockpit functions. Some instruments can be shared between pilots depending on instrument panel presentation. Some examples from previous programs include standby attitude, rotor tachometer (if the aircraft has automatic governing and the crew is provided visual and aural RPM warning), and secondary powerplant instruments such as Ng, oil pressure, and temperature.
(iv) Proper cockpit annunciation is essential for safe operation. SAS and autopilot modes must be properly annunciated. Appropriate annunciator color coding is contained in § 27.1322. There must be no question in regard to the source of navigation information presented to the crew. Where navigation switching is available between individual displays and between pilot positions, the first pilot should have overriding control for his displays.
(v) Electromechanical Displays. Due to the increased complexity of instrumentation that is available and in use, it is appropriate to consider the extreme range of operational environments to which rotorcraft were being routinely exposed. It is the intent of Appendix B to part 27, VIll. (b)(5) to prevent degrading of the first pilot's instrument system, or the only pilot's instrument system in a single-pilotapproved rotorcraft, by not permitting connection of peripheral systems to it. In addition, equipment must not be connected to operating systems for the second pilot's required instruments unless it is extremely improbable that failure of such additional equipment would affect that operating system.
(vi) Advanced Display Systems. The increased use of microprocessor technology in avionic systems has resulted in the use of computer-generated graphics to replace conventional electromechanical instruments. These displays may replace individual instruments or may integrate several flight critical parameters into single displays. For display of redundant information, "crosstalk" between the pilot and copilot displays and supporting systems has been allowed to provide detection and annunciation of faults or "miscompare" of critical flight information. A level of safety finding equivalent to that level of satety provided by Appendix B to part 21, Vill. (p)(5)(I) through (III) may be possible through the implementation of integration technology that will assure that failure of one system does not and cannot adversely affect the other system. For those installation designs that employ integration technology, adequate system testing and any analysis necessary must be conducted to assure that failure of one system will not adversely affect the other system when demonstrating compliance to the minimum safety level established by Appendix B to part 27, ViII. (b)(5)(i) through (ili).
(10) IMC Evaluation.
(i) As part of the flight test program, new rotorcraft undergoing IFR certification should be flown in the air traffic control system in actual day and night instrument meteorological conditions. Items for consideration during the IMC evaluation include:
(A) Ability of the rotorcraft to safely operate in the National Airspace System, including crew capabilities to cope with probable malfunctions. Examples of failures imposed during this IMC evaluation on previous programs are shown below:
Page Apdx B - 12
(1) Hydraulic failure.
(2) Individual COMM, NAV, or intercom failure.
(3) Engine failure.
(4) Loss of any power input.
(5) SAS failure.
(6) Trim failure.
(7) Individual failure of each vertical and directional gyro.
(B) Visibility during low approach conditions in precipitation.
(C) Glare and reflections at night in clouds.
(D) Workload demands on the minimum flightcrew including the failures in paragraph
b.(10)(i)(A).
(E) Handling qualities in turbulence throughout the IFR approved envelope including typical IFR flight maneuvers with:
(1) Reasonably anticipated SAS failures,
(2) Reasonably probable control system failures (hydraulics, force trim, basic ship systems, etc.),
(3) The typical workload conditions associated with operating in high density traffic areas, and
(4) Other reasonable, probable failures.
(F) Cockpit leaks in precipitation that affect pilot efficiency, safety, or rotorcraft airworthiness.
(ii) Rotorcraft that are an improved, modified, or later model of previously approved type that have no significant changes in the fuselage and windshield configuration, the aircraft lighting system, and the rain removal systems do not need to be flown in clouds. They may need to be evaluated in clouds if, in the judgment of the flight test personnel, there is some doubt as to the similarity of the configuration.
However, a previously approved rotorcraft undergoing FR certification tests for a different SAS should not require a series of actual IFR flights just to determine pilot workload or whether it can be flown in
(11) Static Position Error. The static position error should be reevaluated to determine altimeter error during instrument approach conditions. This is particularly important when high angle approaches (above 3°) are approved. Static position error for 3° approaches can typically be approximated by the level flight error. The direction of error is important. If the indicated value is lower than actual value, the error is in a conservative direction and further investigation may not be required. The direction and magnitude of static position error should be determined for steep angle approach conditions and additional information provided when necessary in the RFM. An investigation of static system response during the go-around transition should be investigated.
Page Apdx B - 13
AC 27-1B, Chg 7 2/4/2016
(12) Cross Coupling. IFR handling qualities are enhanced by providing low levels of coupling between axes. During the flight evaluation, pilots should be alert for strong cross coupling tendencies between yaw and pitch, heave (collective) and pitch, heave and roll, or roll and pitch. Any strong coupling effects between these motions may produce unacceptable handling qualities for IF flight. The rotorcraft should be able to make a smooth transition from any flight condition. As an example, large rolling or pitching moments with collective application would represent questionable handling characteristics for the IFR missed approach condition.
(13) Electrical, Avionics, and Instruments. Some aircraft have been certificated with different equipment from that suggested in this subparagraph because the certification criteria for IFR have evolved in several stages. The following guidance refers to the latest certification requirements:
(i) Additional Avionics and Instruments. The avionics and instruments required for certification for operations under IFR beyond those required by § 27.1303 should meet the installation requirements of § 29.1303 as follows:
(A) Attitude Indicator. Power for operation and lighting must be independent from the rotorcraft electrical generating or starting system, and the instrument markings must meet the minimum usability requirements of §29.1303(g)(1). Section 29.1303 of this AC provides additional guidance on marking requirements for attitude indicators. Operation must be maintained for a minimum of 30 minutes after total aircraft electrical power generating system failure. For dual pilot configurations, one pilot's primary indicator may be designated for this purpose, provided standby batteries are provided.
(B) Alternate Static Source. An alternate static source with a means of selecting this source must be provided for single pilot configurations.
(C) Direction Indication. Gyro Stabilized. Magnetic in place of non-magnetic required by § 27.1303(h).
(D) Navigational Systems. Navigational systems required by the applicable operational rules must be provided.
(E) Communication Systems. Communication systems required by the applicable operational rules must be provided.
(F) Other electrical and electronic equipment. Other electrical and electronic equipment required by the applicable operational rules must be provided
(il) Electrical Power Availability for Avionic and Instrument Systems. Minimum avionic and instrument systems should remain operative after electrical power failures in relation to IFR operation.
The lists that follow suggest the minimum Avionic and Instrument Systems that should remain operational after a single failure of the generating system and after failure of all but the emergency power source.
These lists do not address the basic equipment required for non-IFR related operation. These basic equipment requirements are addressed by the appropriate paragraph of this guidance.
(A) Avionic and instrument systems that should remain operational, for FR approved rotorcraft, after a single failure of the electrical generating system. The rotorcraft must be capable of IFR flight to destination and alternate airports. The suggested minimum avionic and instrument systems are
(1) Flight Instruments - the same as § 27.1303 requirements, except as defined by paragraphs b. (13)(1)(A) and (C).
(2) Communications - one VHF radio.
Page Apdx B - 14
(3) Navigation System - one navigation system, including necessary sensor inputs such as directional gyros.
(4) Transponder.
(5) ICS System - required for two pilot approval.
(G) Instrument Lights (or equivalent).
(B) Avionic and instrument systems that should remain operational, for IF approved rotorcraft, after total failure of the electrical generating system. The rotorcraft must be capable of flight for a minimum of 30 minutes. The suggested minimum equipment is as follows:
(1) Magnetic Compass.
(2) Airspeed-Altitude Attitude Presentation.
(3) Communications One VHF System.
(4) Instrument Lights (or equivalent).
(5) ICS System-For Two Pilot Approval.
(iii) Directional Instruments. A magnetic, gyro stabilized direction indicator is specified because navigation in instrument flight must be precise. In rotorcraft, the nonstabilized magnetic indicator is subject to many errors, particularly in turbulence. Therefore, it is inappropriate as the primary source of directional information, but it is adequate as an emergency source. A nonslaved directional gyro is also inappropriate as the primary source of directional information because of drift and the requirement to set it to some other precise reterence.
(A) As a minimum for single pilot IFR, a nonstabilized magnetic indicator (such as a "whiskey compass") and a magnetic gyroscopically stabilized direction indicator system (slaved) are required.
(B) The minimum for dual pilot certification includes the instruments required for single pilot, and an additional independent gyroscopically stabilized directional indicator system (slaved or
(14) FR Electrical System.
(i) General.
(A) The entire electrical system, both AC and DC portions, should be reviewed with IFR operation in mind. This review is necessary since most of the rotorcraft presently certificated do not include IFR operation as part of their certification. Many aspects of normal operation and results of failure conditions may be entirely acceptable for VER operation but unacceptable for IFR operation.
(B) Provisions should be made for a capability to continue flight to destination and alternate airports in the event of a single failure in the electrical system. Section 27.1351 of this AC contains the definition of a "single failure." The evaluation of the system under failure conditions should consider not only the failure itself, but also the recommended cockpit procedure to respond to any failure.
(C) The fault analyses of the electrical system and the results of the system testing to validate that analysis serves as a good starting place for the electrical system review. Failure of each generator, each battery, and each component, such as switches and relays, should be accounted for first Page Apdx B - 15
AC 27-1B, Chg 7 2/4/2016 (D) System failure such as tripped circuit breakers, blown fuses, loss of busses, loss of feeders, loss of ground terminals, and failure of electrical disconnect plugs should also be considered.
(E) Routing of all wiring from each power source throughout the distribution system should be reviewed. In all instances, feeder wires should be routed separately from small gage control wiring. In addition, wiring for each power system should be separated to the maximum extent practical from the wiring associated with other required power systems.
(F) A single electrical disconnect plug should not contain wiring for more than one generating system. Many systems incorporate automatic feeder fault protection that disables a power source experiencing a short circuit on its feeder, and in some instances, passive protection has been provided for the feeders.
(G) There may be other failures that should be considered that are peculiar to the specific design being evaluated and, if so, an appropriate accounting of these failure should also be made.
(H) Single engine rotorcraft upgrades from VFR to IFR will require careful evaluation of the electrical system. These aircraft normally do not have distribution systems that can tolerate bus or feeder failures, and these failures would result in loss of the entire electrical system. Normally these systems are modified such that distribution system and power supply failures will only result in a partial loss of electrical capability. The power supply problem has been accounted for by the installation of a second generator in some instances or by adding extra battery capacity in others. When an extra battery is added, or a larger battery is substituted, the ampere-hour capacity should be based on one-half the time associated with a worst case maximum flight duration consideration. Additionally, in all instances so far the standby attitude system has been provided a separate power supply capability, in addition to the
(ii) Review of Regulations. The airworthiness regulations concerning electrical systems begin with § 27.1301 Subpart F (Equipment) and continue through § 27.1401. Other rules may also concern the electrical system; however, compliance with these sections should have been assured as part of the (Ili) Specific Emphasis Areas. In some previous installations, changes have been necessary in the areas listed below. Future installations should be checked carefully in these areas and other areas that indicate a need for attention.
(A) Systems Affected by Icing. Gross inaccuracies in altitude and airspeed indicators resulting from icing could be disastrous in IF flight. For rotorcraft not equipped with approved alternate static sources, static ports should be carefully evaluated and should either be heated or an analysis verified by flight test data submitted to substantiate leaving them unheated. Static line routing should be carefully evaluated for low spots. In addition, if static ports are on the side of the rotorcraft, the lines should be initially routed upward just behind the static ports, then down to a drain. If the lines are initially routed upward, the lines will not fill with water when the rotorcraft is flown through rain or is washed.
(B) Overvoltage Protection. A few rotorcraft may have this protection, but many do not.
Since overvoltage protection is specifically required for IFR operation, the rotorcraft's basic electrical system should be very carefully reviewed for this capability.
required flight instruments that are not provided with a visual means, the following should be accounted for:
(1) The visual means provided should be at least adjacent to the instrument.
Page Apdx B - 16
(2) The visual means should be adequately placarded.
(3) The power should be measured at or near the point where it enters the instrument.
(4) For electrical instruments, the power is considered adequate when the voltage is within approved limits. The source of power for the visual means of indication must be independent of the source of power for the instrument itself. Independent, in this case, means a separate circuit protective device and a separate distribution system bus.
(D) Multiple System Separation. Multiple systems performing the same function are required in certain instances because it is probable that a single system will fail. Separation of such systems would preclude a single fault from causing a multiple system failure. The following should be
(1) When possible, cable routing should be accomplished to ensure the maximum separation; for example, one system routed on one side of the rotorcraft and the other system on the opposite side. In some areas, physical separation may be minimal, as pedestals, junction boxes, and equipment racks bring systems close together.
(2) Systems that are required to be duplicated should not be routed through one electrical disconnect plug.
(3) System grounds should be evaluated to assure wiring for two required systems is not grounded to the same terminal. If a terminal strip contains grounds for multiple systems, it should be grounded to the rotorcraft's airframe in two places from two separate terminals.
(E) Circuit Protective Devices. All systems that are "required" for IFR operation are considered necessary for safe IFR operation, and the circuit protective devices for those systems should generally be accessible to the crew in the cockpit so they can be readily reset or replaced in flight. Where a capability is provided that is above the minimum certification requirements, accessibility may not be an issue while additional equipment may be required for dispatch in IFR operation. The location of the generator field protective devices has been a problem in some rotorcraft. The protective devices that can result in the loss of a required power system source should be capable of being reset or replaced in the cockpit while in flight. This position is further supported by the occurrence of nuisance opening of circuit protective devices in rotorcraft. Further discussion on this issue is included in section 27.1357 of this AC.
(F) Intercommunication System. All audio for the entire rotorcraft comes together at this system. An evaluation should be made to ensure that no single failure would result in the loss of all audio for the rotorcraft. Check for common grounds, common connectors, etc. Power inputs should also be disabled.
(15) REM Material.
(i) In addition to other required information, the limitations section of the RFM or RFM Supplement (RFMS) must include the approved IFR flight envelope, minimum IFR crew requirements, the minimum required equipment for dispatch into IFR conditions that is not covered by the operating regulations, and the maximum approach gradient that has been approved. If a significant loss of altitude is experienced in any flight regime or maneuver during certification analysis or testing, the emergency operating procedures should include a statement of this altitude loss along with any other appropriate information.
(il) The limitations section of the RFM should not include restrictions prohibiting external cargo operations. These operations are covered by parts 91 and 133, and all external load operations conducted under these parts must be approved by the controlling operations inspector. It is the Page Apdx B - 17