CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 13. SYSTEMS CERTIFICATION CONSIDERATIONS.
a. Supporting Systems.
(1) Purpose. The purpose of this AC paragraph is to provide guidance on how to show compliance to Part 27 regulations as they apply to supporting systems for other systems that provide required functions. The systems that require support from supporting systems are defined as dependent systems in the following guidance.
Application of recent technology is one of the predominant causes of more dependent/supporting systems relationships. More systems are employing technology that is dependent on supporting systems such as electrical, hydraulic, and/or other power sources or signal inputs. Certification of systems that are dependent on supporting systems to provide required functionality must consider the issues associated with this interdependent relationship.
(2) Definitions.
Integrity. The term "integrity" for the purpose of this AC paragraph includes the hardware quality requirements, including reliability (availability); as well as the software level requirements, as defined in RTCA/DO-178B.
(ii) Criticality. The term "criticality" refers to the five levels of criticality addressed in this document in paragraph AC 27.1309.d. (2) (il)(B).
(iii) Supporting System(s). The term "supporting system(s)" as used in this paragraph means any systems) that provides an input to another "dependent" system, such that these dependent systems) cannot function correctly without that input being present/correct.
(iv) Dependent Systems). The term "dependent systems)" as used in this paragraph means any system/s that receives an input from another system or sensor.
(3) Related Documents.
Page MG 13 - 1
AC 27-1B, Chg 1 2/12/03
(i) Federal Aviation Regulations (FARS) Paragraphs 27.1301, 27.1309,
27.1351, and 27.1435.
(ii) Standards - Latest revision of RTCA/DO178 and RTCA/DO 160; Parts of SAE documents ARP4754 and ARP4761.
(4) History: Applications of recent technology for systems have, in many cases, resulted in systems that are dependent on one or more supporting systems) for inputs such as power or signal sources of any type. This relationship creates concerns for recognition that the criticality of the supporting system may be higher because of its role of supporting a dependent system of high criticality. The example of Liquid Crystal Displays (LCD) for engine instruments, in particular, has caused concern about the integrity of the supporting electrical power system. Past designs for engine instruments did not require electrical power for operation, but present designs with LCDs do require electrical power. Additionally, engine instruments of those older helicopter designs were driven from a mixture of sources such as independent wet line, pneumatic, and electrical drive (Tach Generator) inputs, and thus had independent failure modes from the sensor/power input aspects). This means that the integrity of the electrical power supplied to the dependent system must be commensurate with the level of integrity as required for the highest criticality engine instrument application(s). This also stimulates the concern that the electrical power system can become a common point for failure of all engine instruments simultaneously, as well as anything else powered by the electrical system. For this example, these considerations represent an increase of integrity requirements for the electrical power system over previous designs of electrical systems for VFR helicopters. In the past, these electrical systems did not support required functions of higher criticality and were allowed to be simple in design with low design integrity and susceptible to single point faults. Application of recent technologies for systems resulting in dependent systems that require supporting systems must address the concerns for higher integrity and single point faults.
(5) Discussion: Integrity of supporting systems must be sufficient to support the required integrity of their associated dependent systems. The relationship of supporting systems to dependent systems is similar to an analogy of them being links in a chain, where the weakest link must be able to support the required integrity level that is consistent with the associated criticality category assessment. This principle is not new, but there may not be recognition that systems previously accepted at low integrity levels may not be acceptable because of their new role as supporting systems). New emphasis must be applied to determine acceptability of previous designs that have become supporting systems through application of new technology or changes of system architecture. This is particularly true for derivative designs, or changes to existing design by either supplemental type certificate (STC) or field approval, where new technology system applications, or system architecture changes have been applied, that created a dependent/supporting system relationship. The main concerns are for systems such as electronic displays that are installed and supported by nonupgraded systems, such as single source and/or low reliability power generation and distribution systems. However the concerns related to supporting systems are not Page MG 13 - 2
limited to displays for dependent systems, since control systems could also be affected.
Integrity for fault considerations must be addressed for supporting systems in relation to dependent systems when the dependent system's provided functions are assessed at criticality levels of Major, Hazardous/Severe-Major, or Catastrophic. These integrity and fault considerations must address not only a particular dependent system, but also the accumulative effect on other systems that the same supporting system's malfunction may affect. This may, in turn, affect the aircraft level functional hazard assessment (FHA) as the supporting system could act as a common point for simultaneous failures of more than one system. Additionally, the design of the supporting systems should preclude single point failures/faults for systems that support dependent systems functions assessed to have a criticality of Catastrophic.
(6) Certification Approach. There are three basic parts to the supporting systems concerns addressed herein and they are the inclusion of supporting systems in the integrity determination process, the design considerations for supporting systems relating to more than one system, and single point faults for the supporting systems themselves.
A two-step procedure should be used to determine the adequate integrity level for supporting systems. The first step is to determine the level of criticality associated with loss/malfunction of all or any combination of the dependent system's functions and all combinations of other dependent system's functions that require support from the same supporting system. This can be achieved through the use of an FHA and associated FTA'S. The criticality category level determined from this assessment must be a product of failure/malfunction possibilities for all of the involved dependent/supporting systems combinations and the worst case operational consideration for the functions) provided by the dependent systems. The second step is to determine whether the supporting system's design integrity is sufficient to address the determined criticality category. The design integrity should address failures/malfunctions results of the dependent systems), any combination of failures/malfunctions due to effects on more than one dependent system, and single point failures of the supporting system itself.
(II) Analyses may be used to meet the criteria outlined in the second step above, for systems that support one or more dependent system functions whose loss or malfunction is assessed to be Hazardous/Severe-Major orCatastrophic. Analyses, such as a fault tree analysis, in combination with a common cause analysis to validate assumptions regarding the independence of faults, should be performed to show compliance. Testing may be required to validate the analysis, if the system is complex or dynamic in nature.
NOTE: Showing high reliability for a single thread system is not sufficient to meet the requirements for a Catastrophic failure condition category, thus reliability cannot be used to substitute for the preclusion of single point failures/faults.
Page MG 13 - 3
AC 27-1B, Chg 1 2/12/03
(7) Summary: Supporting systems should be considered an integral part of the dependent systems) that provides the required functions, for the purpose of addressing design integrity requirements.
b. Complex System Integration
(1) Explanation. Complex integrated systems addressed by this paragraph are those systems that provide more than one function from a single electronic device or from more than one inter-related electronic devices/components. The inter-relationship is based on common aspects) of providing the functions. The definition of complexity as it applies to integrated systems, is a design condition that exhibits the characteristic of possible combinations of simultaneous failures/faults, as opposed to simple systems where there exists only failures/faults that can be considered individually. Integration that results in providing several functions from one design source inherently increases complexity, thus the two describing terms of "complex" and "integrated" are not independent from one another. Computers have become more powerful with recent increases in technology. Also, related sensors and servomechanisms have greatly improved. This has created an atmosphere from which complex integrated systems have spawned. Integrated systems can have the effects of reduced weight, economic advantages, and system enhancements. However, with these advantages there are some concerns that must be addressed, as this concept inherently creates problems with showing compliance to system independence requirements.
(2) Procedure.
Integrated Systems typically compromise the concept of independence for failures/malfunctions and system/function separation. Using this as a given, the approach for showing compliance for systems that have a requirement for independence is to provide elevated system integrity to make up for the loss of independence. The requirements for independence are both direct and inferred. The direct requirements are defined by requirements for system separation and for specific systems. The inferred requirements for independence are those that inherently have independence by their method of implementation until integration of dissimilar functions by recent technology. They are inferred since past methods of implementation provided independence and therefore no direct requirement was defined.
(¡i) The elevated integrity typically consists of high software levels and high system reliability that addresses the failure condition categories determined by a Functional Hazard Assessment (FHA). This approach basically states that the independence for failures and function separation is absent, but the probability is small for loss or malfunction, and the software level will match the threat level identified by the FHA. Provided the integrity is a reality, this approach works pretty well for the loss and malfunction aspects. However, system separation requirements may not be satisfied as easily, as they are mostly concerned with common mode failures from external sources.
Some common mode concerns are temperature, fire, water, EMI, and physical mechanical threats.
Page MG 13 - 4
(iii) The combinations of systems/functions that comprise a single integrated system are important. If any of the systems or combinations of systems that make up the composite integrated system are assessed to have a high criticality level, then the design integrity of the composite integrated system should match the highest of those assessments. In infrequent cases, partitioning and unique hardware/software architecture may be exceptions to this determination. In cases where the FHA has determined low criticality for all combinations of systems/functions, many of the concerns associated with complex integration may be minimized.
(A) Concerns to be addressed for complex integrated systems that address failures and malfunctions:
(1) An FHA must be performed that considers each function individually and all combinations of functions for loss and malfunction. Additionally, all supporting systems, all combinations of supporting systems, and all combinations of supporting systems and dependent systems must be considered for loss and malfunction.
(2) After the criticality has been determined for all functions and combinations of functions, the design integrity can be defined in terms of reliability and software level. The reliability must match or exceed the requirements derived from the FHA and associated FTA results. This includes any supporting system as well as the primary system.
(3) The software integrity level must match or exceed the requirements derived from the FHA and associated FTA results. This is true generally, for all of the software, if a single computer is utilized and no software or architecture scheme is implemented to provide partitioning/protection.
(4) If redundancy is required to meet the reliability requirements, adequate redundancy failure management must be provided. Redundancy failure/malfunction management is required to eliminate latent failures or undetected malfunctions. Redundancy management must address latent failures. Without the detection and management of latent and unannounced failures and malfunctions, duplication of subsystem components may not be creditable redundancy. If the first failure can result in unknown loss of one of the system's functionally duplicated parts, then the second failure in combination with the first failure must be treated as a single failure and no design credit can be given for redundancy.
(5) Redundancy design must consider similarity of software between redundant system components.
(6) Electronic Devices (EDS) such as the Central Processing Unit (CPU), Programmable Logic Device (PLD), Application Specific Integrated Circuits (ASIC), or other types of data storage or computing devices must be considered to have common mode failure potential, especially for control systems. This concern may be addressed Page MG 13 - 5
AC 27-1B, Chg 1 2/12/03 in a variety of ways. One way would be to use dissimilar EDs between redundant implementations. Some other approaches may involve architectures with monitors that are dissimilar to the systems supplying the redundant functionality. Other hardware potential common mode failures must also be considered, such as power supplies, signal sources, and common Input/Output (I/Os) chips.
(B) The intent of system separation requirements is to minimize the possibility of total system failure/malfunction as a result of internal system failures or external influences. In some cases, system separation addresses systems that provide similar information by dissimilar means. An example of this type of system separation is the requirement for independence between the fuel quantity display system and the fuel low indication. This is a case where increased integrity can be accepted in lieu of total independence for small parts of an integrated system, depending on the extent of loss of independence and the associated failure condition category. Concerns to be addressed for system separation requirements are as follows:
(1) Internal concerns include common mode failures/malfunction that could result in unacceptable loss of satisfactory system functionality. Some of the sources of these failures/malfunctions include common electrical power supplies, common sensor sources, filtering referenced to common ground planes, common processing, and common threats from Electro-Magnetic Interference (EMI) sources.
(2) EMI from internal sources (Electro-Magnetic Compatibility (EMC)) and external sources (High Intensity Radiated Fields (HIRF)) must be addressed from systems separation aspects. Unless complete system immunity to EMI can be shown for designs of systems that provide functions to address catastrophic failures, the design should preclude influence from EMI events. This is of particular concern when redundancy is used to meet the criticality requirements. Designs should address the possibility of EMI affecting the required function because of close physical proximity between all or parts of the redundant sections of the system. Areas of design that have the most concerns are those that include redundant system sections in the same enclosure and the redundant sections have a common cavity for penetration of wiring connectors. Another significant area of concern is for redundant system sections that employ wiring cables with little physical separation between cables for the respective redundant sections. In these cases, different lengths of cables between these redundant sections would reduce the possibility that radiated EMI would affect the system sections simultaneously at the same frequency.
(3) Other separation concerns are associated with external physical installation aspects. These physical aspects include protection from fire, water, excessive thermal variations, excessive vibration damage, and any mechanical failure of another system/component that could possibly impair the integrated system's functionality and result in an unacceptable decrease in safety.
Page MG 13 - 6
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 14 CERTIFICATION PROCEDURE FOR INSTALLATION OF VAPOR CYCLE AIR CONDITIONING SYSTEMS.
a. FAAAUTHORITY Approval Philosophy. The vapor cycle (Freon) air conditioning system is generally considered "nonessential", that is, its function is not necessary for safe flight. Therefore, the FAA/AUTHORITY looks at it from the standpoint of its potential of posing a hazard to the aircraft in the course of its normal function/malfunction or in case of a failure. 14 CFR Part 27.1309 thus becomes the dominant regulation concerning the system. However, if an air conditioning system is required for electrically powered equipment cooling, then a criticality assessment may show that the criticality level may be higher than nonessential.
b. Type of Refrigerant/Regulations/Environmental Impact.
(1) The refrigerant commonly used in automobiles and aircraft is known as Freon R-12 (home air conditioners use R-22). This Freon is one of the CHLOROFLUROCARBONS (CCI F) or CFCS. This compound is blamed for eroding the ozone layer in the Stratosphere (the chlorine in CFCs attacks and destroys the ozone molecules). The U.S. Clean Air Act restricts the production of CFCs. In 1992, production was restricted to 50%. The United States and most other industrial countries have agreed to phase out CFC production by 1995. CFC is prohibited beginning in the year 2000. Beginning in June 1992, CFCs required recovery.
(2) The new refrigerant HYDROFLUROCARBONS (CH FCF) HFC-134а or R-134a does not deplete ozone. Automobile industries as well as some small aircraft manufacturers are designing air conditioning systems with this non-ozone-depleting refrigerant. This HFC-134a is currently available and manufactured by the Dupont Company.
c. Suggested Compliance Checklist: R=Report, D=Drawing, T=Test.
REGULATION SUBJECT METHOD
27.301 Loads R
27.303 Factor of safety R
27.305 Strength & Deformation R
27.307 Proof of structure R
27.561 Emergency Landing conditions R
27.603 Materials and Workmanship D Page MG 14 - 1
AC 27-1B, Chg 1 2/12/03 Suggested Compliance Checklist: R=Report, D=Drawing, T=Test (continued)
REGULATION SUBJECT METHOD
27.605 Fabrication methods D
27.607 Fasteners D
27.609 Protection of Structure R
27.613 Material Strength R
27.685a,c Control system details D
27.831 Ventilation
27.853 Compartment interiors (a, b, c) T
27.855 Cargo compartments (a, b) D
27.863 Flammable fluid protection D
27.1301 Function and Installation
27.1307 Miscellaneous Equipment, 27(c, e) D
27.1309 Equipment systems and Installation R
27.1435 Hydraulic system T
27.1461 Equipment containing High energy rotors D, R
27.1541 Markings and placards D
d. Electrical System Considerations
(1) An electrical wiring diagram showing interconnections of all electrical components should be provided. The wiring diagram should show adequate circuit protection (circuit breakers). It should also indicate the use of wiring of adequate size and length to take maximum currents to which the system would be exposed. Power to air conditioning electrical system should be connected to an electrical power source that provides adequate power and does not interfere with essential electrical loads and provides solid electrical ground to airframe.
(2) An electrical load analysis should be provided to demonstrate the availability of adequate current to the air conditioning system from the helicopter electrical power source during all phases of flight and system operation. The system should also be powered from the helicopter electrical power source that provides adequate power and does not interfere with essential electrical loads.
(3) The air conditioning system should be capable of a successful functional test and electromagnetic compatibility test. It needs to be shown that air conditioning equipment will not be a source of interference with the essential equipment. Reference §§ 27.1351(a)(b), 27.1357, 27.1365, and 27.1367.
e. Structural Considerations
(1) Overall aircraft structure should be substantiated for the increased weight of the air conditioner modification. Each air conditioner component, its backup structure, and its attachment to the aircraft structure should be substantiated to the strength Page MG 14 - 2
requirements of Subpart C (14 CFR Part 27) and the design requirements of Subpart D (14 CFR 27). Load factors should be chosen considering the most critical of limit maneuvering load factor (§ 27.337), gust load factor (§ 27.341), or if applicable emergency landing conditions (§ 27.561). Load paths must be substantiated for the distribution of static and/or dynamic load conditions. Fatigue substantiation may be required depending on the installation (§ 27.571).
(2) The modifications done on the structure, due to air conditioner equipment installation, should not create any adverse qualities to the overall structural integrity of the aircraft. Any access holes cut in the aircraft structure for routing refrigerant/electrical line skin/stringer cutouts for intake or exhaust holes, etc., should be substantiated for overall structural integrity.
(3) All attachment hardware used for the air conditioner modification should be substantiated to meet the increased structural requirements.
f. System and Equipment Considerations
(1) The vapor cycle (Freon) system is properly considered to be a gaseous system. Granted, during some portion of the cycle, the Freon is in a liquid or liquid/vapor state; however, it is a gas under standard atmospheric conditions.
Therefore, the proper system test would be a pressure test for a gaseous (pneumatic) system.
(2) 14 CFR Part 27 does not call out specific testing criteria but instead relies on § 27.1309 to address potential hazards due to pressurized gas systems. A proof pressure test of 1.5 times the maximum normal operating pressure of the system is appropriate to satisfy the intent of § 27.1309.
(3) The Freon pressures vary throughout the system during operation, but the maximum normal operating pressure of the components upstream from and including the high-pressure side of the expansion valve can be regarded as the value limited by the overpressure switch. The condenser and receiver-dryer are of special concern as they are of relatively large volume and a failure could cause damage to the aircraft structure or essential mechanical components.
(4) The highest pressure normally experienced by the low pressure portion of the Freon system (downstream of the expansion valve to the suction side of the compressor) occurs when the system is shutdown; hence that pressure can be used as the "maximum normal operating pressure" for the proof and burst tests in this portion of the system.
(5) The burst pressure tests can be done on a component basis or on the entire system. The proof pressure test is best done on the entire system to allow observation Page MG 14 - 3
AC 27-1B, Chg 1 2/12/03 of any movements of the flex hoses and other components under pressure, which may interfere with essential helicopter components.
(6) System capacity or efficiency does not affect the review of the system from the standpoint of safety; however, § 27/29.1301(a) requires "Each item of installed equipment be of a kind and design appropriate to its intended function". Hence the calculations of heat load of the cabin to be cooled in (British thermal unit) Btu's and the cooling capacity of the air conditioner system may be required. The vapor cycle is a closed system (recirculating of existing air) with no fresh air make up capability.
g. Powerplant Considerations (for mechanically-driven air conditioning compressors :
(1) The drive systems and the drive system component supporting structure should be adequate both statically and in fatigue to handle any loads associated with the air conditioning drive mechanism. Both normal operating and failure conditions (compressor lockup) should be considered. For example, on systems which are belt driven off the tail rotor drive, all components should be substantiated at the highest torque, shear, and moment loads that can be imposed by the belt drive (compressor seizure as well as compressor start), in combination with the loads associated with max transient tail rotor drive torque.
(2) The compressor drive must not affect the normal function of the drive system. Additional load on the gearbox or the drive pulley should not cause a gearbox temperature increase (§ 27.1041). Exceeding the gearbox temperature limit can cause stud loosening.
(3) The mounting of a bracket (for a compressor) or an idler pulley on the transmission top case should not affect the structural integrity or the corrosion protection of the transmission. If a compressor/blower is mounted to the gearbox, the overhang moment (which is created by the weight of the compressor and its center of gravity distance), should not exceed the mount limit. The addition of a bracket which picks up several existing top case-to-main case attachment studs may provide an additional path for water to enter and corrode the cases around the studs. In some cases, the studs may not be adequate to carry the additional load, because the thickness of the top case where each of these studs is typically individually controlled could result in the bracket warping upon installation. This warping results in unequal axial clamp-up at the studs, which further aggravates the stud loading and may also lead to significant case fretting. Also, the original studs may not be of adequate length to maintain proper thread extension through the nut after the bracket is installed.
(4) In the event of a compressor seizure, it should be substantiated that no damage to the primary drive system or aircraft structure can occur. On belt driven installations, no damage to the primary drive system should occur due to burning or flailing belts. On a shaft driven compressor/blower installation, the shaft shear section should fail before exceeding the gearbox torque limit. When the shear section fails, the Page MG 14 - 4
shaft should be contained or otherwise prevented from interfering with the drive system or flight controls. Similarly, a failure of the compressor or drive belts should not damage the drive system or interfere with the flight control mechanism.
(5) The mechanically-driven compressor should not adversely affect the (vibration) dynamic characteristics of the drive system in any operating condition (§ 27.907(c)). Maximum vibration levels should be given in engine/drive system installation data (§§ 27.901(b) and 27.927(a)).
h. Flight Analyst/Pilot Considerations.
Update Rotorcraft Flight Manual supplements (RFM) to show performance effects. If the installation is such that it interferes with engine inlet airflow, then determine any pertormance loss, evaluate inlet distortion, and validate turbine engine operating characteristics. Reference §§ 27.45 and 27.939. TIA should include operational tests such as intended function and abnormal/emergency operation. Conduct EMI tests and evaluate the RFM supplement. Reference §§ 27.1581, 27.1583, 27.1585, and 27.1587.
Safety Devices / Failure Mode Effect Analysis
(1) SAFETY DEVICES:
Automatic Load shedding Current Limiter Compressor Temperature Limiter Compressor Electric Motor temperature limiter Compressor Discharge pressure limiter (VI Oil separator / Injector (VII) Containment shrouds (VilI) Belt guard
(ix) Pressure line gallery cover (×) Ignition source protection (Freon is flame suppressant)
(2) FAILURE MODE EFFECT ANALYSIS: A Failure Mode Effect Analysis is crucial to the safety evaluation of the systems. Consider the areas given below:
(i) The overpressure safety system assures there is a means to shut the system down prior to a critical pressure developing (overpressure switches, blowout plugs, redundant circuit breakers, etc.).
(ii) An electrical load analysis should show that the failures in the air conditioning system do not jeopardize the safe operation of flight essential and flight critical airborne systems.
(iii) For systems driven by engine/transmission/drive shaft, a powerplant evaluation should be made to determine power available, vibration characteristics, etc.
Page MG 14 - 5
AC 27-1B, Chg 1 2/12/03
(iv) Coupling/drive belt failure and its effect on adjacent components.
(v) The area around the condenser and receiver dryer (and any other high-pressure components) to determine if there are any critical components in the vicinity that could be damaged if a burst line occurs.
(vi) Assure that the Condenser blower/fan construction is such that if the fan or impeller fails, the pieces will not damage other components or helicopter structure (§ 27/29.1461).
(vii) The design should be such that Freon leakage cannot be ingested into the engines (§ 27.1309). Freon is an excellent fire suppressant. Ensure that no pressure relief valve or blow out plug (on the receiver dryer) is located inside the cabin.
Quantities of Freon should also be prevented, as much as possible, from entering the cabin in the event of a leak. The rapid expansion of liquid Freon to its gaseous state in the close proximity of the flight crew could be disconcerting (could fog up the cabin).
Liquid refrigerant, if allowed to strike the body, could cause frostbite, and if allowed to strike the eye, can cause blindness.
Page MG 14 - 6