AC 27-1B, Chg 1 2/12/03 FIGURE AC 27.MG 11-9. EXAMPLE OF TWIN TURBINE USAGE SPECTRUM (continued) CONDITION % of time Nb per hour TURNS 30 TURNS/60% MCP/NZ 1.2G/RIGHT 0.2667 Speed rep. Nz rep TURNS/60% MCP/NZ 1.2G/LEFT 0.2667 10.00% 60% MCP 10 > 1.2g TURNS/60% MCP/NZ 1.4G/RIGHT 0.0989 0.3709 30.00% 80% MCP 20 1.2g TURNS/60% MCP/NZ 1.4G/LEFT 0.0989 0.3709 35.00% 90% MCP TURNS/60% MCP/NZ 1.6G/RIGHT 0.0330 0.1237 25.00% MCP TURNS/60% MCP/NZ 1.6G/LEFT 0.0330 0.1237 TURNS/60% MCP/NZ 1.8G/RIGHT 0.0013 0.005 Nb per hour TURNS/60% MCP/NZ 1.8G/LEFT 0.0013 0.005 20 1.2g 1.4/1.6g rep.
TURNS/60% MCP/V.LIM +0.1G/RIGHT 0.00013 0.0005 7.4175 1.4g 75.00% 1.4g IURNS/60% MCP/V.LIM +0.1G/LEFT 0.00013 0.0005 2.4725 1.6g 25.00% 1.6g TURNS/80% MCP/NZ 1.2G/RIGHT 0.8 0.1 1.8g TURNS/80% MCP/NZ 1.2G/LEFT 0.8 3 0.01 V.limt0.1G TURNS/80% MCP/NZ 1.4G/RIGHT 0.2967 1.1126 URNS/80% MCP/NZ 1.4G/LEFT 0.2967 1.1126 TURNS/80% MCP/NZ 1.6G/RIGHT 0.0989 0.3709 TURNS/80% MCP/NZ 1.6G/LEFT 0.0989 0.3709 TURNS/80% MCP/NZ 1.8G/RIGHT 0.004 0.015 TURNS/80% MCP/NZ 1.8G/LEFT 0.004 0.015 TURNS/80% MCP/V. LIM +0.1G/RIGHT 0.0004 0.0015 TURNS/80% MCP/V.LIM +0.1G/LEFT 0.0004 0.0015 TURNS/90% MCP/NZ 1.2G/RIGHT 0.9333 3.5 TURNS/90% MCP/NZ 1.2G/LEFT 0.9333 3.5 TURNS/90% MCP/NZ 1.4G/RIGHT 0.3461 1.298 TURNS/90% MCP/NZ 1.4G/LEFT 0.3461 1.298 TURNS/90% MCP/NZ 1.6G/RIGHT 0.1154 0.4327 TURNS/90% MCP/NZ 1.6G/LEFT 0.1154 0.4327 TURNS/90% MCP/NZ 1.8G/RIGHT 0.0046 0.0175 TURNS/90% MCP/NZ 1.8G/LEFT 0.0046 0.0175 TURNS/90% MCP/V.LIM +0.1G/RIGHT 0.0004 0.00175 TURNS/90% MCP/V.LIM +0.1G/LEFT 0.0004 0.00175 TURNS/MCP/NZ 1.2G/RIGHT 0.6667 2.5 TURNS/MCP/NZ 1.2G/LEFT 0.6667 2.5 TURNS/MCP/NZ 1.4G/RIGHT 0.2473 0.9272 TURNS/MCP/NZ 1.4G/LEFT 0.2473 0.9272 TURNS/MCP/NZ 1.6G/RIGHT 0.0824 0.3091 TURNS/MCP/NZ 1.6G/LEFT 0.0824 0.3091 TURNS/MCP/NZ 1.8G/RIGHT 0.0033 0.0125 TURNS/MCP/NZ 1.8G/LEFT 0.0033 0.0125 TURNS/MCP/V.LIM +0.1G/RIGHT 0.0003 0.0013 TURNS/MCP/V.LIM +0.1G/LEFT 0.0003 0.0013 Dur. 9.6 (s) SPECIAL TURNS 0.76 2.025 TURNS/VNE(30DEG)/*/RIGHT 0.0038 0.01 TURNS/VNE(30DEG)/*/LEFT 0.0038 0.01 TURNS/VNE IN AUTO. (30DEG)/*/RIGHT 0.00094 0.0025 TURNS/VNE IN AUTO. (30DEG)/*/LEFT 0.00094 0.0025 TRANSITION/TURN IN TRANSITION/*/RIGHT 0.3753 1 TRANSITION/TURN IN TRANSITION/*/LEFT 0.3753 Dur. 14 (s) Page MG 11 - 26
FIGURE AC 27.MG 11-9. EXAMPLE OF TWIN TURBINE USAGE SPECTRUM (continued) CONDITION % of time Nb per hour LATERAL FLIGHT Dur. 9 (s) 5 KTS/*/RIGHT 0.095 0.38 Lat.Back rep. Speed rep.
5 KTS/*/LEFT 0.095 0.38 95.00% Lateral 10.00% 5 kts 10 KTS/*/RIGHT 0.095 0.38 5.00% Backward 10.00% 10 kts 10 KTS/*/LEFT 0.095 0.38 10.00% 15 kts 15 KTS/*/RIGHT 0.095 0.38 40.00% 17 kts 15 KTS/*/LEFT 0.095 0.38 10.00% 19 kts 17 KTS/*/RIGHT 0.38 1.52 5.00% 21 kts 17 KTS/*/LEFT 0.38 1.52 5.00% 25 kts 19 KTS/*/RIGHT 0.095 0.38 5.00% 35 kts 19 KTS/*/LEFT 0.095 0.38 5.00% max 21 KTS/*/RIGHT 0.0475 0.19 21 KTS/*/LEFT 0.0475 0.19 25 KTS/*/RIGHT 0.0475 0.19 25 KTS/*/LEFT 0.0475 0.19 35 KTS/*/RIGHT 0.0475 0.19 35 KTS/*/LEFT 0.0475 0.19 VMAX/*/RIGHT 0.0475 0.19 CONDITION % of time Nb per hour VMAx/*/LEFT 0.0475 0.19 VMAX/*/REARWARD 0.1 0.4 100 AC Page MG 11 - 27
AC 27-1B, Chg 1 2/12/03
INTENTIONALLY LEFT BLANK Page MG 11 - 28
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 12. § 27.865 (Amendment 27-36) EXTERNAL LOADS.
This AC MG paragraph material is now contained in AC 27.865B, in Subpart D.
Page MG 12 - 1
AC 27-1B, Chg 1 2/12/03 Page MG 12 - 2
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 13. SYSTEMS CERTIFICATION CONSIDERATIONS.
a. Supporting Systems.
(1) Purpose. The purpose of this AC paragraph is to provide guidance on how to show compliance to Part 27 regulations as they apply to supporting systems for other systems that provide required functions. The systems that require support from supporting systems are defined as dependent systems in the following guidance.
Application of recent technology is one of the predominant causes of more dependent/supporting systems relationships. More systems are employing technology that is dependent on supporting systems such as electrical, hydraulic, and/or other power sources or signal inputs. Certification of systems that are dependent on supporting systems to provide required functionality must consider the issues associated with this interdependent relationship.
(2) Definitions.
Integrity. The term "integrity" for the purpose of this AC paragraph includes the hardware quality requirements, including reliability (availability); as well as the software level requirements, as defined in RTCA/DO-178B.
(ii) Criticality. The term "criticality" refers to the five levels of criticality addressed in this document in paragraph AC 27.1309.d. (2) (il)(B).
(iii) Supporting System(s). The term "supporting system(s)" as used in this paragraph means any systems) that provides an input to another "dependent" system, such that these dependent systems) cannot function correctly without that input being present/correct.
(iv) Dependent Systems). The term "dependent systems)" as used in this paragraph means any system/s that receives an input from another system or sensor.
(3) Related Documents.
Page MG 13 - 1
AC 27-1B, Chg 1 2/12/03
(i) Federal Aviation Regulations (FARS) Paragraphs 27.1301, 27.1309,
27.1351, and 27.1435.
(ii) Standards - Latest revision of RTCA/DO178 and RTCA/DO 160; Parts of SAE documents ARP4754 and ARP4761.
(4) History: Applications of recent technology for systems have, in many cases, resulted in systems that are dependent on one or more supporting systems) for inputs such as power or signal sources of any type. This relationship creates concerns for recognition that the criticality of the supporting system may be higher because of its role of supporting a dependent system of high criticality. The example of Liquid Crystal Displays (LCD) for engine instruments, in particular, has caused concern about the integrity of the supporting electrical power system. Past designs for engine instruments did not require electrical power for operation, but present designs with LCDs do require electrical power. Additionally, engine instruments of those older helicopter designs were driven from a mixture of sources such as independent wet line, pneumatic, and electrical drive (Tach Generator) inputs, and thus had independent failure modes from the sensor/power input aspects). This means that the integrity of the electrical power supplied to the dependent system must be commensurate with the level of integrity as required for the highest criticality engine instrument application(s). This also stimulates the concern that the electrical power system can become a common point for failure of all engine instruments simultaneously, as well as anything else powered by the electrical system. For this example, these considerations represent an increase of integrity requirements for the electrical power system over previous designs of electrical systems for VFR helicopters. In the past, these electrical systems did not support required functions of higher criticality and were allowed to be simple in design with low design integrity and susceptible to single point faults. Application of recent technologies for systems resulting in dependent systems that require supporting systems must address the concerns for higher integrity and single point faults.
(5) Discussion: Integrity of supporting systems must be sufficient to support the required integrity of their associated dependent systems. The relationship of supporting systems to dependent systems is similar to an analogy of them being links in a chain, where the weakest link must be able to support the required integrity level that is consistent with the associated criticality category assessment. This principle is not new, but there may not be recognition that systems previously accepted at low integrity levels may not be acceptable because of their new role as supporting systems). New emphasis must be applied to determine acceptability of previous designs that have become supporting systems through application of new technology or changes of system architecture. This is particularly true for derivative designs, or changes to existing design by either supplemental type certificate (STC) or field approval, where new technology system applications, or system architecture changes have been applied, that created a dependent/supporting system relationship. The main concerns are for systems such as electronic displays that are installed and supported by nonupgraded systems, such as single source and/or low reliability power generation and distribution systems. However the concerns related to supporting systems are not Page MG 13 - 2
limited to displays for dependent systems, since control systems could also be affected.
Integrity for fault considerations must be addressed for supporting systems in relation to dependent systems when the dependent system's provided functions are assessed at criticality levels of Major, Hazardous/Severe-Major, or Catastrophic. These integrity and fault considerations must address not only a particular dependent system, but also the accumulative effect on other systems that the same supporting system's malfunction may affect. This may, in turn, affect the aircraft level functional hazard assessment (FHA) as the supporting system could act as a common point for simultaneous failures of more than one system. Additionally, the design of the supporting systems should preclude single point failures/faults for systems that support dependent systems functions assessed to have a criticality of Catastrophic.
(6) Certification Approach. There are three basic parts to the supporting systems concerns addressed herein and they are the inclusion of supporting systems in the integrity determination process, the design considerations for supporting systems relating to more than one system, and single point faults for the supporting systems themselves.
A two-step procedure should be used to determine the adequate integrity level for supporting systems. The first step is to determine the level of criticality associated with loss/malfunction of all or any combination of the dependent system's functions and all combinations of other dependent system's functions that require support from the same supporting system. This can be achieved through the use of an FHA and associated FTA'S. The criticality category level determined from this assessment must be a product of failure/malfunction possibilities for all of the involved dependent/supporting systems combinations and the worst case operational consideration for the functions) provided by the dependent systems. The second step is to determine whether the supporting system's design integrity is sufficient to address the determined criticality category. The design integrity should address failures/malfunctions results of the dependent systems), any combination of failures/malfunctions due to effects on more than one dependent system, and single point failures of the supporting system itself.
(II) Analyses may be used to meet the criteria outlined in the second step above, for systems that support one or more dependent system functions whose loss or malfunction is assessed to be Hazardous/Severe-Major orCatastrophic. Analyses, such as a fault tree analysis, in combination with a common cause analysis to validate assumptions regarding the independence of faults, should be performed to show compliance. Testing may be required to validate the analysis, if the system is complex or dynamic in nature.
NOTE: Showing high reliability for a single thread system is not sufficient to meet the requirements for a Catastrophic failure condition category, thus reliability cannot be used to substitute for the preclusion of single point failures/faults.
Page MG 13 - 3
AC 27-1B, Chg 1 2/12/03
(7) Summary: Supporting systems should be considered an integral part of the dependent systems) that provides the required functions, for the purpose of addressing design integrity requirements.
b. Complex System Integration
(1) Explanation. Complex integrated systems addressed by this paragraph are those systems that provide more than one function from a single electronic device or from more than one inter-related electronic devices/components. The inter-relationship is based on common aspects) of providing the functions. The definition of complexity as it applies to integrated systems, is a design condition that exhibits the characteristic of possible combinations of simultaneous failures/faults, as opposed to simple systems where there exists only failures/faults that can be considered individually. Integration that results in providing several functions from one design source inherently increases complexity, thus the two describing terms of "complex" and "integrated" are not independent from one another. Computers have become more powerful with recent increases in technology. Also, related sensors and servomechanisms have greatly improved. This has created an atmosphere from which complex integrated systems have spawned. Integrated systems can have the effects of reduced weight, economic advantages, and system enhancements. However, with these advantages there are some concerns that must be addressed, as this concept inherently creates problems with showing compliance to system independence requirements.
(2) Procedure.
Integrated Systems typically compromise the concept of independence for failures/malfunctions and system/function separation. Using this as a given, the approach for showing compliance for systems that have a requirement for independence is to provide elevated system integrity to make up for the loss of independence. The requirements for independence are both direct and inferred. The direct requirements are defined by requirements for system separation and for specific systems. The inferred requirements for independence are those that inherently have independence by their method of implementation until integration of dissimilar functions by recent technology. They are inferred since past methods of implementation provided independence and therefore no direct requirement was defined.
(¡i) The elevated integrity typically consists of high software levels and high system reliability that addresses the failure condition categories determined by a Functional Hazard Assessment (FHA). This approach basically states that the independence for failures and function separation is absent, but the probability is small for loss or malfunction, and the software level will match the threat level identified by the FHA. Provided the integrity is a reality, this approach works pretty well for the loss and malfunction aspects. However, system separation requirements may not be satisfied as easily, as they are mostly concerned with common mode failures from external sources.
Some common mode concerns are temperature, fire, water, EMI, and physical mechanical threats.
Page MG 13 - 4
(iii) The combinations of systems/functions that comprise a single integrated system are important. If any of the systems or combinations of systems that make up the composite integrated system are assessed to have a high criticality level, then the design integrity of the composite integrated system should match the highest of those assessments. In infrequent cases, partitioning and unique hardware/software architecture may be exceptions to this determination. In cases where the FHA has determined low criticality for all combinations of systems/functions, many of the concerns associated with complex integration may be minimized.
(A) Concerns to be addressed for complex integrated systems that address failures and malfunctions:
(1) An FHA must be performed that considers each function individually and all combinations of functions for loss and malfunction. Additionally, all supporting systems, all combinations of supporting systems, and all combinations of supporting systems and dependent systems must be considered for loss and malfunction.
(2) After the criticality has been determined for all functions and combinations of functions, the design integrity can be defined in terms of reliability and software level. The reliability must match or exceed the requirements derived from the FHA and associated FTA results. This includes any supporting system as well as the primary system.
(3) The software integrity level must match or exceed the requirements derived from the FHA and associated FTA results. This is true generally, for all of the software, if a single computer is utilized and no software or architecture scheme is implemented to provide partitioning/protection.
(4) If redundancy is required to meet the reliability requirements, adequate redundancy failure management must be provided. Redundancy failure/malfunction management is required to eliminate latent failures or undetected malfunctions. Redundancy management must address latent failures. Without the detection and management of latent and unannounced failures and malfunctions, duplication of subsystem components may not be creditable redundancy. If the first failure can result in unknown loss of one of the system's functionally duplicated parts, then the second failure in combination with the first failure must be treated as a single failure and no design credit can be given for redundancy.
(5) Redundancy design must consider similarity of software between redundant system components.
(6) Electronic Devices (EDS) such as the Central Processing Unit (CPU), Programmable Logic Device (PLD), Application Specific Integrated Circuits (ASIC), or other types of data storage or computing devices must be considered to have common mode failure potential, especially for control systems. This concern may be addressed Page MG 13 - 5
AC 27-1B, Chg 1 2/12/03 in a variety of ways. One way would be to use dissimilar EDs between redundant implementations. Some other approaches may involve architectures with monitors that are dissimilar to the systems supplying the redundant functionality. Other hardware potential common mode failures must also be considered, such as power supplies, signal sources, and common Input/Output (I/Os) chips.
(B) The intent of system separation requirements is to minimize the possibility of total system failure/malfunction as a result of internal system failures or external influences. In some cases, system separation addresses systems that provide similar information by dissimilar means. An example of this type of system separation is the requirement for independence between the fuel quantity display system and the fuel low indication. This is a case where increased integrity can be accepted in lieu of total independence for small parts of an integrated system, depending on the extent of loss of independence and the associated failure condition category. Concerns to be addressed for system separation requirements are as follows:
(1) Internal concerns include common mode failures/malfunction that could result in unacceptable loss of satisfactory system functionality. Some of the sources of these failures/malfunctions include common electrical power supplies, common sensor sources, filtering referenced to common ground planes, common processing, and common threats from Electro-Magnetic Interference (EMI) sources.
(2) EMI from internal sources (Electro-Magnetic Compatibility (EMC)) and external sources (High Intensity Radiated Fields (HIRF)) must be addressed from systems separation aspects. Unless complete system immunity to EMI can be shown for designs of systems that provide functions to address catastrophic failures, the design should preclude influence from EMI events. This is of particular concern when redundancy is used to meet the criticality requirements. Designs should address the possibility of EMI affecting the required function because of close physical proximity between all or parts of the redundant sections of the system. Areas of design that have the most concerns are those that include redundant system sections in the same enclosure and the redundant sections have a common cavity for penetration of wiring connectors. Another significant area of concern is for redundant system sections that employ wiring cables with little physical separation between cables for the respective redundant sections. In these cases, different lengths of cables between these redundant sections would reduce the possibility that radiated EMI would affect the system sections simultaneously at the same frequency.
(3) Other separation concerns are associated with external physical installation aspects. These physical aspects include protection from fire, water, excessive thermal variations, excessive vibration damage, and any mechanical failure of another system/component that could possibly impair the integrated system's functionality and result in an unacceptable decrease in safety.
Page MG 13 - 6
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 14 CERTIFICATION PROCEDURE FOR INSTALLATION OF VAPOR CYCLE AIR CONDITIONING SYSTEMS.
a. FAAAUTHORITY Approval Philosophy. The vapor cycle (Freon) air conditioning system is generally considered "nonessential", that is, its function is not necessary for safe flight. Therefore, the FAA/AUTHORITY looks at it from the standpoint of its potential of posing a hazard to the aircraft in the course of its normal function/malfunction or in case of a failure. 14 CFR Part 27.1309 thus becomes the dominant regulation concerning the system. However, if an air conditioning system is required for electrically powered equipment cooling, then a criticality assessment may show that the criticality level may be higher than nonessential.
b. Type of Refrigerant/Regulations/Environmental Impact.
(1) The refrigerant commonly used in automobiles and aircraft is known as Freon R-12 (home air conditioners use R-22). This Freon is one of the CHLOROFLUROCARBONS (CCI F) or CFCS. This compound is blamed for eroding the ozone layer in the Stratosphere (the chlorine in CFCs attacks and destroys the ozone molecules). The U.S. Clean Air Act restricts the production of CFCs. In 1992, production was restricted to 50%. The United States and most other industrial countries have agreed to phase out CFC production by 1995. CFC is prohibited beginning in the year 2000. Beginning in June 1992, CFCs required recovery.
(2) The new refrigerant HYDROFLUROCARBONS (CH FCF) HFC-134а or R-134a does not deplete ozone. Automobile industries as well as some small aircraft manufacturers are designing air conditioning systems with this non-ozone-depleting refrigerant. This HFC-134a is currently available and manufactured by the Dupont Company.
c. Suggested Compliance Checklist: R=Report, D=Drawing, T=Test.
REGULATION SUBJECT METHOD
27.301 Loads R
27.303 Factor of safety R
27.305 Strength & Deformation R
27.307 Proof of structure R
27.561 Emergency Landing conditions R
27.603 Materials and Workmanship D Page MG 14 - 1