angle of 3.5° and the minimum approach airspeed that meet flight manual limitations.
This is necessary until evaluations are accomplished and the determination is made that the autopilot-GPS integration supports steep-angle, low speed operations.
(2) Failure mode evaluations:
(1) Evaluate the loss of SBAS and all flight director or vertical guidance display behavior during all phases of operation.
(A) Indications of failure of the SBAS or loss of vertical guidance should be clear and unambiguous to the pilot.
(B) The pilot should be able to transition to degraded approach procedures without undue concentration or exceptional skill.
(i) Evaluate misleading guidance information. Evaluate performance of advisory vertical guidance provided for LNAV approaches when provided in accordance with AC 20-138 (current version) guidance.
(19) Rotorcraft Condition Monitoring System Installations.
(1) General. There are installations of avionic equipment and systems in rotorcraft to collect data for use in assessing engine and rotorcraft performance, and frequency of maintenance. Some of the items monitored are engine operating exceedances, hot starts, power assurance, and cycle counts. The monitoring systems addressed by this paragraph are those used to collect data for maintenance purposes and not those used in autopilot, flight control, or engine control systems. At present, there are optional approvals requests for most of these systems not performing any required functions. However, most of the applicants anticipate requesting approval for the system use in the future to perform some required function or to allow required maintenance predication on the operation of the system. This consideration becomes particularly important if the system is software based. A further discussion of system software is included in paragraph b.(19) (III)(B) below. Refer to section AC 27 MG 15 of this AC for guidance on certification of these systems, also referred to as Health Usage Monitoring Systems (HUMS).
(ii) System Installation. Show that system installations are free from hazards for both normal operation and possible malfunctions. Malfunctions which might be caused by software errors are discussed under paragraph b.(19) (ill)(B) below. The accuracy and response of the monitoring device or system should be sufficient to allow the operational and maintenance personnel to relate the data obtained to required maintenance actions. Use the exceedance (engine limit) information acquired by these systems in place of information previously acquired from field reports of operational personnel utilizing the basic aircraft instruments. In this case, the automated system will generally produce results, which are more accurate than the basic aircraft instruments. However, in this circumstance, it is not appropriate to require the monitor Page MG 1 -17
AC 27-1B, Chg 7 2/4/2016 system to be more accurate than the previously approved methods used to provide the required exceedance data. If the data collected by the system require filtering prior to use, it is equally acceptable to accomplish this filtering either as the data are being acquired (airborne function) or when the data are analyzed (ground based function) and used in the maintenance of the rotorcraft.
(iii) System Components.
(A) Hardware. The system hardware, including airborne electronic hardware, operated under the control of the imbedded software should be shown to comply with § 27.1301. Additionally, in showing compliance to § 27.1309(a), laboratory testing to the appropriate portions of RTCA Document DO-160 (current version) should be performed.
(B) Software. If the function of the monitor system depends on embedded airborne software to determine all or part of its functioning, RTCA Document DO-178 (current version) is the recommended standard to be used for the approval of the system software. A further discussion of the use of this document is included in section
27.1309 of this AC. Carefully consider the selection of the software level because sometimes the initial system approval basis is on the system being a non-required optional system. Further, if it shows that there is no dependence on the system software to preclude a hazardous failure mode, then a low software level would be acceptable. However, once initially certified, it is very difficult to qualify software to higher levels of "quality." Because of this, we recommend choosing the software at the level consistent with the ultimate use for the planned system approval. If the system approval is only to be as non-required optional equipment, then the choice of a low level of software qualification may be appropriate. However, when gaining more experience with the operation of the system, and ultimately planning to seek approval to perform required functions, then initially obtain an appropriate higher level of software.
Note: Consider extensive service experience as a basis for level of criticality without accomplishing RTCA Document DO-178 procedures.
(20) Rotorcraft Health and Usage Monitoring Systems (HUMS).
(i) General. There can be a division of HUMS into two major categories, health monitoring systems and usage monitoring systems. The provisions of § 27.1301 are used to determine that the system performs its intended function. The provisions of § 27.1309(a) and (b) are used to look at the impact of environmental conditions and malfunctions. There are no HUMS approvals to replace service life or other specific physical limits but several systems are now in the process of seeking approval. We consider health monitoring systems the serious applications of this technology, and it will probably be some time before the necessary database to allow full reliance on this technology is available. There have been numerous approvals of usage monitoring systems as optional equipment, and a good example of this technology is a condition Page MG 1 -18
monitoring system described in paragraph b. (19) above. Refer to section AC 27 MG 15 of this AC for guidance on the certification of HUMS.
(ii) Health Monitoring Systems.
(A) We anticipate that these systems will begin as "optional" systems in order to build a data base to support expansion of the approval to achieve credit for extension of maintenance intervals, and so forth. Some of these applications may require system redundancy and some may require level A or equivalent software as defined in RTCA Document DO-178.
(B) Some systems that are under consideration will utilize off aircraft processing of data. If pursuing this, assume that the aircraft data will be lost or misplaced at the processing center, and the aircraft system design should consider this possibility. Some on board data storage is one way to account for this lost data. The integrity of the processing center's software should be equal to that of the aircraft software. In addition, specify the intervals for processing the data from each flight as part of the approval.
(C) Due to the limited experience with these systems, we suggest using the issue paper process to record the progress of the approval, and to provide information for later updating of this guidance material.
Page MG 1 -19
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 2. STANDARDIZED TEST PROCEDURE FOR ROTORCRAFT DC ELECTRICAL SYSTEM TESTS.
a. Test Requirements.
(1) General. The following functions and characteristics are to be evaluated:
(i) Normal System Operation.
(ii) Parallel Load Division.
(iii) Excitation.
(iv) Stabilization.
(v) Systems Malfunction.
(vi) Environmental Capability.
(vii) Electromagnetic Compatibility.
(viii) Cooling Capability.
(ix) Surge Characteristics, Ripple Voltage, and Voltage Spikes.
(2) Instrumentation. Calibration records should be available for all instrumentation. Enough specific currents and voltages should be recorded to allow reconstruction of any sequence of events that would happen as a result of any system testing described herein.
(3) Regulatory References. Sections 27.1301, 27.1307(c), (d), (e), 27.1309,
27.1351, 27.1353, 27.1357, 27.1361, 27.1365, and 27.1367.
(4) Miscellaneous, The assigned FAA/AUTHORITY systems and equipment engineer normally witnesses these tests and should be notified as far in advance of the testing as possible to minimize scheduling problems. Conformity of the test setup must be established prior to conducting any testing. Most of the above test categories can be conducted on a bench test setup. A bench test setup is especially recommended in the case of the system malfunction test. It is the applicant's option to demonstrate his equipment either on the bench or installed for ground tests. When a bench setup is Page MG 2 - 1
used, it should represent the actual aircraft installation to the extent that components and wiring (type, gage, and length) are duplicated. Some retesting may be necessary on the aircraft to verify the bench test results.
b. Ground and Bench Test Procedures.
CAUTION: Prior to disconnecting the battery and removing or adding large loads, either isolate the avionics systems or assure that transients induced are within limits of the avionics equipment.
(1) Normal System Operation.
NOTE: Equipment should be operated for at least 10 minutes prior to each test as a warm-up.
(i) Minimum electrical load for paralleling and minimum engine RPM.
(ii) Vary RPM of all engines from low to high and back to low.
(iii) Repeat b(1)(ii) for maximum and 50 percent of maximum electrical loads.
(2) Parallel Load Division (if parallel system).
(i) Minimum electrical load for paralleling and minimum engine RPM.
(ii) Fifty percent of maximum electrical load and minimum engine RPM.
(iii) Maximum electrical load and minimum engine RPM.
(iv) Minimum electrical load for paralleling, vary No. 1 engine RPM from low to high and back to low while holding the RPM of the other engine at minimum (low).
(v) Repeat b(2) (iv) for each other engine on the rotorcraft.
(vi) Repeat b(2)(iv) and b(2)(v) procedures with 50 percent of maximum electrical load.
(vii) Repeat b(2)(iv) and b(2)(v) procedures with a maximum electrical load.
(3) Excitation.
Page MG 2 - 2
NOTE: All of these tests are to be conducted with the battery OFF since the purpose of the tests is to determine if the ship's battery is necessary for excitation of the alternator(s) /generator(s).
Minimum anticipated electrical load, low engine RPM, and alternators)/generators) OFF. Demonstrate that when an alternator/generator is turned ON, it will come on the line. Repeat for any other alternators/generators in the system.
(ii) Maximum electrical load, low engine RPM, and alternator(s)/generator(s) OFF. Demonstrate that each alternator/generator will individually come on the line.
(ili) Minimum anticipated electrical load, high engine RPM, and alternator(s)/generator(s) OFF. Demonstrate that each alternator/generator will individually come on the line.
(4) Stabilization.
NOTE: All of these tests are to be conducted with the ship's battery OFF, since the purpose of the tests is to determine if the ship's battery is necessary for stabilization of the alternator/generator. In each case, if the ship's battery is not necessary for stabilization, the alternator/generator should be on the line and remain there at a satisfactory voltage level.
(i) Minimum anticipated electrical load, low engine RPM, alternator(s)/generator(s) ON. Switch on the heaviest electrical load that is anticipated to be installed on the aircraft.
(ii) Repeat b(4)(i) for a maximum electrical load and low engine RPM.
(iii) Repeat b(4)(i) for a minimum anticipated electrical load and high engine RPM.
(iv) Repeat b(4)(i) for a maximum electrical load and high engine RPM.
(5) System Malfunctions.
(i) System malfunction testing should be conducted as necessary to verify a fault analysis of the proposed electrical system. Depending on the complexity of the proposed system and the comprehensive nature of the system fault analysis, these tests may be necessary. Analysis/testing is typically only required for IFR and CAT A complex electrical systems, not basic Part 27 systems. This satisfies the need to verify all analysis, and complex designs are usually verified by tests. IFR and CAT A electrical systems are complex in nature and tests are required to verify the analysis.
Page MG 2 - 3
Additionally, IFR and CAT A requirements refer back to Part 29 requirements for systems and these systems must meet their Part 29.1309 requirements.
(її) Overcurrent faults (faults to airframe ground that are less than 5.0 Milliohms) should be applied to buses and feeders as necessary to demonstrate that the system's overcurrent circuit protective devices are properly coordinated and provide adequate protection/fault isolation.
Simulate an overvoltage condition on each alternator/generator to demonstrate satisfactory operation of the overvoltage sensing network. On a multiengine configuration, the faulty alternator/generator should be removed without affecting operation of the remainder of the system.
(IV) As appropriate, the annunciation circuitry should be checked for indication of failures such as overvoltage, tripped generators, overcurrent, open feeders, open tie breakers, etc.
(6) Aircraft Ground Tests. If the above tests (reference b(1) through (4) inclusive) are conducted on a bench setup, enough tests should be repeated on the aircraft to validate the bench test results. The following tests should be conducted on the aircraft:
(i) Normal Battery Starts. Start all engines on the aircraft following the normal procedure prescribed in the flight manual. Record starter volts and amperes, time, and any other parameters deemed necessary.
(ii) Ground Power Cart Starts. If the aircraft is equipped with a plug for a ground power cart, use the procedure described in the flight manual and start all engines. Record starter volts and amperes, time, and any other parameters deemed necessary.
(iii) Emergency Battery Operation (if provided). The emergency battery mode of operation should be tested to assure at least proper switching, annunciation, and battery capacity. In some instances, an analysis of battery capacity may be adequate.
(iv) Distribution System Tests. With all systems operating individually, open and close feeder circuit breakers and system circuit breakers and assure separation of power sources. If the opening of the feeder protection has been satisfactorily demonstrated on a bench test facility, it should not be necessary to repeat that demonstration on the actual aircraft. The effect of loss of power sources should also be demonstrated on the aircraft.
(v) Other Tests. Conduct other tests as necessary to demonstrate proper operation of the specific design being evaluated.
Page MG 2 - 4
(7) Environmental Qualification. Each component of the system, such as relays, switches, alternator, generator, sensor, regulator, diode, etc., should be qualified to the critical environmental parameters. The temperature, altitude, humidity, and vibration expected in the approved aircraft operational envelope should fall within those limits the applicant substantiates for the electrical system components. (Refer to paragraph AC 27.1309.)
(8) Electromagnetic Compatibility. At no time during any of the qualification testing described herein should objectionable interference in the aircraft's radio, navigation, cockpit instrument, autopilot, or interphone system be considered acceptable.
NOTE: The quantitative type testing used for paragraphs b(7) and (8) above is outside the scope of this document. The latest revision of RTCA Document DO-160 is an acceptable standard.
(9) Transient Tests. The dc system should be tested and shown to exhibit surge, ripple, and spike voltages within the limits of the latest revision of RTCA Document DO-160.
The surge and ripple voltage tolerance of avionic equipment is defined by section 16 of the latest revision of RTCA Document DO-160. Category Z is considered applicable to rotorcraft dc systems.
(ii) The voltage spike tolerance of avionic equipment is defined by section 17 of the latest revision of RTCA Document DO-160.
(10) Ground and Bench Test Report. At the conclusion of the ground and bench test program, a report should be prepared and submitted that contains at least the following:
(i) System schematic (including instrumentation tie-in).
(ii) Instrumentation list (including calibration records).
(iii) Test result recordings.
(iv) Detailed procedures and results obtained.
(v) Conformity inspection records.
(vi) Other data, photographs, etc., to describe the test setup.
(vii) Summary of the test results. This summary should show the maximum load to which each bus, alternator/generator, etc., has been tested.
Page MG 2 - 5
(vili) Analysis of test results. This should describe how compliance with the regulations has been shown.
c. Flight Test Procedures.
(1) Alternator/generator cooling tests should be conducted in accordance with paragraph AC 27.1351.
(2) A cockpit evaluation of the electrical system should be conducted to evaluate:
(1) Switch, circuit breaker, and annunciator identification.
(ii) Visibility of placarding, switches, etc., during bright sunlight and night operation.
Color of annunciators as related to the function/malfunction annunciated.
(iv) Load meter readability, if appropriate.
(v) Access to essential switches, circuit breakers, etc.
(vi) Electromagnetic interference.
(vii) Compatibility of the electrical system with the rotorcraft flight manual and the need for additional procedures in the rotorcraft flight manual.
(viii) Clarity of functions such as opened feeder breakers, tie breakers, related annunciation, and necessary corrective action in the event of malfunction.
(ix) Absence of undesired functions in relation to switch combinations.
Page MG 2 - 6
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 3. DEFINITION OF ENGINE ISOLATION FEATURES AS APPLIED TO §§ 27.79(b)(2), 27.141(b)(1), and 27.143(d)(1) (Amendment 27-19).
a. Explanation.
(1) Each of the cited performance and flight characteristic sections of Part 27 mention multiengine rotorcraft meeting transport Category A engine isolation requirements or refer to engine isolation features which ensure continued operation of the remaining engine. Unlike normal category fixed-wing (Part 23, § 23.903(c)) and the transport category fixed-wind and rotorcraft regulations, Part 27 does not provide a general engine isolation rule to make this determination.
(2) While it is clear that Part 27 does not require complete engine isolation, if credit for this feature is claimed (i.e., sudden complete engine power failure is not considered in showing compliance with the cited section), criteria must be established to allow a satisfactory isolation assessment.
(3) An approach which the FAA/AUTHORITY would find acceptable in making a Part 27 engine isolation determination is given. The FAA/AUTHORITY logic for establishing this criteria is also presented.
b. Criteria.
(1) The engine isolation provided may be for an appropriate limited time period.
(2) The failure or malfunction of any engine or the failure of any system that can affect any engine will not-
(i) Prevent the continued safe operation of the remaining engines for the appropriate limited time period; or
(ii) Require immediate action by a crewmember for continued safe operation.
(3) Each engine must be isolated by a firewall, shroud, or equivalent means from the remaining engines.
c. Criteria Rationale.
Page MG 3 - 1
(1) Category A Minimum Time for Isolation. The acceptance of a limited time period for engine isolation is consistent with the acceptance of a reduced level of safety for a Part 27 rotorcraft. The criteria is also consistent with the Part 27 philosophy of allowing for a controlled landing following engine failure versus the Part 29 Category A principle of continued safe flight and a controlled landing.
(2) Installation Analysis.
The degree of engine isolation can be established by an installation assessment against the § 29.903(b) general isolation requirement, as modified for Part 27 by a limited time period concept.
(ii) Figure AC 27 MG 3-1 is a listing of the Part 29 sections that may be involved in Category A engine isolation considerations. Sections 29.901(c) and
29.903(b) are the general isolation regulations under which the other more specific rules naturally fall. The point that the selection of specific rules from figure AC 27 MG 3-1 does not achieve the desired degree of transport Category A engine isolation, and that the general isolation rules (§$ 29.901(c) and 29.903(b)) must be used, is illustrated by the following examples.
(A) Example #1. No specific requirement from Part 29 (or figure AC 27 MG 3-1) can be cited which precludes a common engine mount. The design of the mount could be such that its failure results in sudden, complete power loss from all engines.
(B) Example #2. No specific Part 29 requirement prohibits a common engine induction system. F.O.D., fire in the induction system, or the adverse affect of engine surge on the remaining engine could result in sudden, complete power loss from all engines.
(C) Example #3. Crosstalk between engine fuel controls (possibly used for power matching) or the use of a common input parameter signal to the fuel controls is not prohibited by any specific isolation rule. Signals could be received which command the simultaneous shutdown of all engines.
(™) These examples clearly illustrate that specific Part 29 isolation rules cannot be selected to establish appropriate Part 27 engine isolation, and that the installation must be evaluated by the general isolation policy set forth. This can be readily accomplished by a failure mode and effects analysis (FMEA).
(3) Firewalls.
CAR 6.483, prior to Amendment 6-4, effective May 15, 1953, requires "All engines, auxiliary power units, fuel burning heaters, and other combustion equipment which are intended for operation in flight shall be isolated from the remainder Page MG 3 - 2
of the rotorcraft by means of firewalls, shrouds, or other equivalent meansi This rule would clearly require a firewall between engines of multiengine rotorcraft.
(ii) Amendment 6-4 revised § 6.483 to read "Engines shall be isolated from personnel compartments by means of firewalls, shrouds, or other equivalent means. They shall be similarly isolated from the structure, controls, rotor mechanism, and other parts essential to a controlled landing of the rotorcraft..." (remainder essentially identical to current § 27.1191).
The preamble explanation of Amendment 6-4 states that these changes are "intended to afford greater protection to the crew and passengers in the event of fire during flighti This revision did not intend to authorize less firewall isolation between the engines than was required by the earlier version. Also, the subsequent paragraphs clearly require firewalls between other combustion equipment and the rest of the rotorcraft (§ 27.1191(b)). To accept anything less for the engine is clearly inappropriate. Further, § 23.1191 requires firewalls or equivalent means between each engine and the rest of the airplane, and current safety requirements pertaining to in-flight fires should be no less stringent for normal category rotorcraft.
The lack of a firewall between engines or any other design arrangements which, in the event of one engine failure creates definable jeopardy for the remaining engines, will result in a significantly lower level of safety than is being assumed by the operators.
(v) A regulation change to clarify this § 27.1191 rule is planned.
d. Guidance.
(1) The minimum appropriate limited time period of engine isolation which would allow establishment of a one-engine-inoperative HV diagram, § 27.79(b)(2), would be defined by the time increment to recognize the engine failure and to make a landing from the most critical point on the desired HV diagram.
(2) The minimum appropriate limited time period of engine isolation to show compliance with §§ 27.141(b)(1) and 27.143(d)(1) considering the sudden power failure of one engine (rather than sudden complete power failure) would be the time increment to recognize the engine failure and to transition to a flight condition where failure of the remaining engine can be tolerated.
(3) Some existing provisions of Part 27 require isolation of certain systems (oil, fuel, and engine controls) without regard to a limited time period. These existing Part 27 engine isolation provisions must be observed regardless of the policy discussed herein.
(4) The limited time period concept must not be utilized to eliminate protection otherwise required by specific rules of Part 27 or to reduce accepted test conditions.
For example, lines which carry flammable fluids in areas subject to engine fire Page MG 3 - 3