used, it should represent the actual aircraft installation to the extent that components and wiring (type, gage, and length) are duplicated. Some retesting may be necessary on the aircraft to verify the bench test results.
b. Ground and Bench Test Procedures.
CAUTION: Prior to disconnecting the battery and removing or adding large loads, either isolate the avionics systems or assure that transients induced are within limits of the avionics equipment.
(1) Normal System Operation.
NOTE: Equipment should be operated for at least 10 minutes prior to each test as a warm-up.
(i) Minimum electrical load for paralleling and minimum engine RPM.
(ii) Vary RPM of all engines from low to high and back to low.
(iii) Repeat b(1)(ii) for maximum and 50 percent of maximum electrical loads.
(2) Parallel Load Division (if parallel system).
(i) Minimum electrical load for paralleling and minimum engine RPM.
(ii) Fifty percent of maximum electrical load and minimum engine RPM.
(iii) Maximum electrical load and minimum engine RPM.
(iv) Minimum electrical load for paralleling, vary No. 1 engine RPM from low to high and back to low while holding the RPM of the other engine at minimum (low).
(v) Repeat b(2) (iv) for each other engine on the rotorcraft.
(vi) Repeat b(2)(iv) and b(2)(v) procedures with 50 percent of maximum electrical load.
(vii) Repeat b(2)(iv) and b(2)(v) procedures with a maximum electrical load.
(3) Excitation.
Page MG 2 - 2
NOTE: All of these tests are to be conducted with the battery OFF since the purpose of the tests is to determine if the ship's battery is necessary for excitation of the alternator(s) /generator(s).
Minimum anticipated electrical load, low engine RPM, and alternators)/generators) OFF. Demonstrate that when an alternator/generator is turned ON, it will come on the line. Repeat for any other alternators/generators in the system.
(ii) Maximum electrical load, low engine RPM, and alternator(s)/generator(s) OFF. Demonstrate that each alternator/generator will individually come on the line.
(ili) Minimum anticipated electrical load, high engine RPM, and alternator(s)/generator(s) OFF. Demonstrate that each alternator/generator will individually come on the line.
(4) Stabilization.
NOTE: All of these tests are to be conducted with the ship's battery OFF, since the purpose of the tests is to determine if the ship's battery is necessary for stabilization of the alternator/generator. In each case, if the ship's battery is not necessary for stabilization, the alternator/generator should be on the line and remain there at a satisfactory voltage level.
(i) Minimum anticipated electrical load, low engine RPM, alternator(s)/generator(s) ON. Switch on the heaviest electrical load that is anticipated to be installed on the aircraft.
(ii) Repeat b(4)(i) for a maximum electrical load and low engine RPM.
(iii) Repeat b(4)(i) for a minimum anticipated electrical load and high engine RPM.
(iv) Repeat b(4)(i) for a maximum electrical load and high engine RPM.
(5) System Malfunctions.
(i) System malfunction testing should be conducted as necessary to verify a fault analysis of the proposed electrical system. Depending on the complexity of the proposed system and the comprehensive nature of the system fault analysis, these tests may be necessary. Analysis/testing is typically only required for IFR and CAT A complex electrical systems, not basic Part 27 systems. This satisfies the need to verify all analysis, and complex designs are usually verified by tests. IFR and CAT A electrical systems are complex in nature and tests are required to verify the analysis.
Page MG 2 - 3
Additionally, IFR and CAT A requirements refer back to Part 29 requirements for systems and these systems must meet their Part 29.1309 requirements.
(її) Overcurrent faults (faults to airframe ground that are less than 5.0 Milliohms) should be applied to buses and feeders as necessary to demonstrate that the system's overcurrent circuit protective devices are properly coordinated and provide adequate protection/fault isolation.
Simulate an overvoltage condition on each alternator/generator to demonstrate satisfactory operation of the overvoltage sensing network. On a multiengine configuration, the faulty alternator/generator should be removed without affecting operation of the remainder of the system.
(IV) As appropriate, the annunciation circuitry should be checked for indication of failures such as overvoltage, tripped generators, overcurrent, open feeders, open tie breakers, etc.
(6) Aircraft Ground Tests. If the above tests (reference b(1) through (4) inclusive) are conducted on a bench setup, enough tests should be repeated on the aircraft to validate the bench test results. The following tests should be conducted on the aircraft:
(i) Normal Battery Starts. Start all engines on the aircraft following the normal procedure prescribed in the flight manual. Record starter volts and amperes, time, and any other parameters deemed necessary.
(ii) Ground Power Cart Starts. If the aircraft is equipped with a plug for a ground power cart, use the procedure described in the flight manual and start all engines. Record starter volts and amperes, time, and any other parameters deemed necessary.
(iii) Emergency Battery Operation (if provided). The emergency battery mode of operation should be tested to assure at least proper switching, annunciation, and battery capacity. In some instances, an analysis of battery capacity may be adequate.
(iv) Distribution System Tests. With all systems operating individually, open and close feeder circuit breakers and system circuit breakers and assure separation of power sources. If the opening of the feeder protection has been satisfactorily demonstrated on a bench test facility, it should not be necessary to repeat that demonstration on the actual aircraft. The effect of loss of power sources should also be demonstrated on the aircraft.
(v) Other Tests. Conduct other tests as necessary to demonstrate proper operation of the specific design being evaluated.
Page MG 2 - 4
(7) Environmental Qualification. Each component of the system, such as relays, switches, alternator, generator, sensor, regulator, diode, etc., should be qualified to the critical environmental parameters. The temperature, altitude, humidity, and vibration expected in the approved aircraft operational envelope should fall within those limits the applicant substantiates for the electrical system components. (Refer to paragraph AC 27.1309.)
(8) Electromagnetic Compatibility. At no time during any of the qualification testing described herein should objectionable interference in the aircraft's radio, navigation, cockpit instrument, autopilot, or interphone system be considered acceptable.
NOTE: The quantitative type testing used for paragraphs b(7) and (8) above is outside the scope of this document. The latest revision of RTCA Document DO-160 is an acceptable standard.
(9) Transient Tests. The dc system should be tested and shown to exhibit surge, ripple, and spike voltages within the limits of the latest revision of RTCA Document DO-160.
The surge and ripple voltage tolerance of avionic equipment is defined by section 16 of the latest revision of RTCA Document DO-160. Category Z is considered applicable to rotorcraft dc systems.
(ii) The voltage spike tolerance of avionic equipment is defined by section 17 of the latest revision of RTCA Document DO-160.
(10) Ground and Bench Test Report. At the conclusion of the ground and bench test program, a report should be prepared and submitted that contains at least the following:
(i) System schematic (including instrumentation tie-in).
(ii) Instrumentation list (including calibration records).
(iii) Test result recordings.
(iv) Detailed procedures and results obtained.
(v) Conformity inspection records.
(vi) Other data, photographs, etc., to describe the test setup.
(vii) Summary of the test results. This summary should show the maximum load to which each bus, alternator/generator, etc., has been tested.
Page MG 2 - 5
(vili) Analysis of test results. This should describe how compliance with the regulations has been shown.
c. Flight Test Procedures.
(1) Alternator/generator cooling tests should be conducted in accordance with paragraph AC 27.1351.
(2) A cockpit evaluation of the electrical system should be conducted to evaluate:
(1) Switch, circuit breaker, and annunciator identification.
(ii) Visibility of placarding, switches, etc., during bright sunlight and night operation.
Color of annunciators as related to the function/malfunction annunciated.
(iv) Load meter readability, if appropriate.
(v) Access to essential switches, circuit breakers, etc.
(vi) Electromagnetic interference.
(vii) Compatibility of the electrical system with the rotorcraft flight manual and the need for additional procedures in the rotorcraft flight manual.
(viii) Clarity of functions such as opened feeder breakers, tie breakers, related annunciation, and necessary corrective action in the event of malfunction.
(ix) Absence of undesired functions in relation to switch combinations.
Page MG 2 - 6
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 3. DEFINITION OF ENGINE ISOLATION FEATURES AS APPLIED TO §§ 27.79(b)(2), 27.141(b)(1), and 27.143(d)(1) (Amendment 27-19).
a. Explanation.
(1) Each of the cited performance and flight characteristic sections of Part 27 mention multiengine rotorcraft meeting transport Category A engine isolation requirements or refer to engine isolation features which ensure continued operation of the remaining engine. Unlike normal category fixed-wing (Part 23, § 23.903(c)) and the transport category fixed-wind and rotorcraft regulations, Part 27 does not provide a general engine isolation rule to make this determination.
(2) While it is clear that Part 27 does not require complete engine isolation, if credit for this feature is claimed (i.e., sudden complete engine power failure is not considered in showing compliance with the cited section), criteria must be established to allow a satisfactory isolation assessment.
(3) An approach which the FAA/AUTHORITY would find acceptable in making a Part 27 engine isolation determination is given. The FAA/AUTHORITY logic for establishing this criteria is also presented.
b. Criteria.
(1) The engine isolation provided may be for an appropriate limited time period.
(2) The failure or malfunction of any engine or the failure of any system that can affect any engine will not-
(i) Prevent the continued safe operation of the remaining engines for the appropriate limited time period; or
(ii) Require immediate action by a crewmember for continued safe operation.
(3) Each engine must be isolated by a firewall, shroud, or equivalent means from the remaining engines.
c. Criteria Rationale.
Page MG 3 - 1
(1) Category A Minimum Time for Isolation. The acceptance of a limited time period for engine isolation is consistent with the acceptance of a reduced level of safety for a Part 27 rotorcraft. The criteria is also consistent with the Part 27 philosophy of allowing for a controlled landing following engine failure versus the Part 29 Category A principle of continued safe flight and a controlled landing.
(2) Installation Analysis.
The degree of engine isolation can be established by an installation assessment against the § 29.903(b) general isolation requirement, as modified for Part 27 by a limited time period concept.
(ii) Figure AC 27 MG 3-1 is a listing of the Part 29 sections that may be involved in Category A engine isolation considerations. Sections 29.901(c) and
29.903(b) are the general isolation regulations under which the other more specific rules naturally fall. The point that the selection of specific rules from figure AC 27 MG 3-1 does not achieve the desired degree of transport Category A engine isolation, and that the general isolation rules (§$ 29.901(c) and 29.903(b)) must be used, is illustrated by the following examples.
(A) Example #1. No specific requirement from Part 29 (or figure AC 27 MG 3-1) can be cited which precludes a common engine mount. The design of the mount could be such that its failure results in sudden, complete power loss from all engines.
(B) Example #2. No specific Part 29 requirement prohibits a common engine induction system. F.O.D., fire in the induction system, or the adverse affect of engine surge on the remaining engine could result in sudden, complete power loss from all engines.
(C) Example #3. Crosstalk between engine fuel controls (possibly used for power matching) or the use of a common input parameter signal to the fuel controls is not prohibited by any specific isolation rule. Signals could be received which command the simultaneous shutdown of all engines.
(™) These examples clearly illustrate that specific Part 29 isolation rules cannot be selected to establish appropriate Part 27 engine isolation, and that the installation must be evaluated by the general isolation policy set forth. This can be readily accomplished by a failure mode and effects analysis (FMEA).
(3) Firewalls.
CAR 6.483, prior to Amendment 6-4, effective May 15, 1953, requires "All engines, auxiliary power units, fuel burning heaters, and other combustion equipment which are intended for operation in flight shall be isolated from the remainder Page MG 3 - 2
of the rotorcraft by means of firewalls, shrouds, or other equivalent meansi This rule would clearly require a firewall between engines of multiengine rotorcraft.
(ii) Amendment 6-4 revised § 6.483 to read "Engines shall be isolated from personnel compartments by means of firewalls, shrouds, or other equivalent means. They shall be similarly isolated from the structure, controls, rotor mechanism, and other parts essential to a controlled landing of the rotorcraft..." (remainder essentially identical to current § 27.1191).
The preamble explanation of Amendment 6-4 states that these changes are "intended to afford greater protection to the crew and passengers in the event of fire during flighti This revision did not intend to authorize less firewall isolation between the engines than was required by the earlier version. Also, the subsequent paragraphs clearly require firewalls between other combustion equipment and the rest of the rotorcraft (§ 27.1191(b)). To accept anything less for the engine is clearly inappropriate. Further, § 23.1191 requires firewalls or equivalent means between each engine and the rest of the airplane, and current safety requirements pertaining to in-flight fires should be no less stringent for normal category rotorcraft.
The lack of a firewall between engines or any other design arrangements which, in the event of one engine failure creates definable jeopardy for the remaining engines, will result in a significantly lower level of safety than is being assumed by the operators.
(v) A regulation change to clarify this § 27.1191 rule is planned.
d. Guidance.
(1) The minimum appropriate limited time period of engine isolation which would allow establishment of a one-engine-inoperative HV diagram, § 27.79(b)(2), would be defined by the time increment to recognize the engine failure and to make a landing from the most critical point on the desired HV diagram.
(2) The minimum appropriate limited time period of engine isolation to show compliance with §§ 27.141(b)(1) and 27.143(d)(1) considering the sudden power failure of one engine (rather than sudden complete power failure) would be the time increment to recognize the engine failure and to transition to a flight condition where failure of the remaining engine can be tolerated.
(3) Some existing provisions of Part 27 require isolation of certain systems (oil, fuel, and engine controls) without regard to a limited time period. These existing Part 27 engine isolation provisions must be observed regardless of the policy discussed herein.
(4) The limited time period concept must not be utilized to eliminate protection otherwise required by specific rules of Part 27 or to reduce accepted test conditions.
For example, lines which carry flammable fluids in areas subject to engine fire Page MG 3 - 3
conditions must be fire resistant (§ 27.1183(a)). Fire resistant hose standards require testing for at least 5 minutes at 2000° F.
(5) A failure mode and effects analysis (FMEA) should establish that the failure or malfunction of any engine or the failure of any system that can affect any engine will not--
(i) Prevent the continued safe operation of the remaining engines for the appropriate limited time period.
(ii) Require immediate action by a crewmember for continued safe operation.
(6) As cited earlier, by example, selection of specific engine isolation rules from Part 29 is not effective in assuring that a sudden, complete engine power loss does not occur.
(7) Under the limited time period concept, failure of the second engine must be considered upon expiration of the limited time period. The Rotorcraft Flight Manual must provide the appropriate operating limitations, pilot operating procedures, and performance information limitations to assure continued safe operation following failure of the second engine.
Page MG 3 - 4
- GURE AC 27 MG 3-' Part 29 Engine Isolation Rules § 29.861(a) § 29.901(c) § 29.903(b) and (c) and (e) § 29.908(a) § 29.917(b) and (c)(1) § 29.927(c)(1) § 29.953(a) § 29.1027(a) § 29.1045 § 29.1047(a) § 29.1181(a) § 29.1189(c) § 29.1191(a)(1) § 29.1193(e) § 29.1195(a) and (d) § 29.1197 § 29.1199 § 29.1201 § 29.1305(a)(6) and (b) § 29.1309(b)(2)(i) and (d) § 29.1331(b) Page MG 3 - 5
Page MG 3 - 6
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 4. FULL AUTHORITY DIGITAL ELECTRONIC CONTROLS (FADEC)
a. FULL AUTHORITY DIGITAL ELECTRONIC CONTROLS (FADEC) FOR INSTALLATIONS WITH CATEGORY A ENGINE ISOLATION.
(1) Background. The advent of "microprocessor technology" has resulted in rotorcraft engine controls being implemented by digital process control rather than by conventional means. These digital, processor-based full authority engine controls offer many performance advantages (such as isochronous governing) which were not feasible with conventional technology, pneumatic or hydromechanical controls.
Because of the incorporation of this advanced technology, some additional considerations must be made of the engine installation to ensure regulatory compliance.
Part 27 does not require engine isolation. The guidance herein does not address FADEC installation certifications which do not desire engine isolation credit.
(ii) In showing compliance with certain performance and flight characteristic sections of Part 27, simultaneous malfunction of engines is not considered if Part 29 Category A engine isolation is achieved. Paragraph AC 27.MG 3 describes, in terms of Part 29 Category A requirements, an acceptable approach for determining that engine isolation, adequate for Part 27 performance and flight characteristic credit, has been achieved. That guidance material should be reviewed, but it is not believed that the limited-time-period concept for engine isolation which could be allowed under Part 27 would affect the FADEC installation requirements. Hence, the guidance for a Part 27 aircraft claiming credit for engine isolation is essentially the same as for a Part 29 Category A rotorcraft.
(2) Procedures. The following is a discussion of some special attention areas when a FADEC installation is to be shown to comply with the Part 29 Category A engine isolation requirements. Paragraph AC 27.1309b(4)(i)(D) of this AC contains a general definition of what constitutes a "full authority" control.
Software Qualifications.
(A) Paragraph AC 27.1309f contains a general discussion on the use of the RTCA/DO-178B document that is used for the approval of system software.
FADECs are generally developed to Level A software under RTCA Document DO-178B based on the hazard category of the FADEC failure condition(s). However, if an applicant proposes a FADEC with Level B software based on the Functional Hazard Page MG 4 - 1