AC 27-1B, Chg 1 2/12/03 Suggested Compliance Checklist: R=Report, D=Drawing, T=Test (continued)
REGULATION SUBJECT METHOD
27.605 Fabrication methods D
27.607 Fasteners D
27.609 Protection of Structure R
27.613 Material Strength R
27.685a,c Control system details D
27.831 Ventilation
27.853 Compartment interiors (a, b, c) T
27.855 Cargo compartments (a, b) D
27.863 Flammable fluid protection D
27.1301 Function and Installation
27.1307 Miscellaneous Equipment, 27(c, e) D
27.1309 Equipment systems and Installation R
27.1435 Hydraulic system T
27.1461 Equipment containing High energy rotors D, R
27.1541 Markings and placards D
d. Electrical System Considerations
(1) An electrical wiring diagram showing interconnections of all electrical components should be provided. The wiring diagram should show adequate circuit protection (circuit breakers). It should also indicate the use of wiring of adequate size and length to take maximum currents to which the system would be exposed. Power to air conditioning electrical system should be connected to an electrical power source that provides adequate power and does not interfere with essential electrical loads and provides solid electrical ground to airframe.
(2) An electrical load analysis should be provided to demonstrate the availability of adequate current to the air conditioning system from the helicopter electrical power source during all phases of flight and system operation. The system should also be powered from the helicopter electrical power source that provides adequate power and does not interfere with essential electrical loads.
(3) The air conditioning system should be capable of a successful functional test and electromagnetic compatibility test. It needs to be shown that air conditioning equipment will not be a source of interference with the essential equipment. Reference §§ 27.1351(a)(b), 27.1357, 27.1365, and 27.1367.
e. Structural Considerations
(1) Overall aircraft structure should be substantiated for the increased weight of the air conditioner modification. Each air conditioner component, its backup structure, and its attachment to the aircraft structure should be substantiated to the strength Page MG 14 - 2
requirements of Subpart C (14 CFR Part 27) and the design requirements of Subpart D (14 CFR 27). Load factors should be chosen considering the most critical of limit maneuvering load factor (§ 27.337), gust load factor (§ 27.341), or if applicable emergency landing conditions (§ 27.561). Load paths must be substantiated for the distribution of static and/or dynamic load conditions. Fatigue substantiation may be required depending on the installation (§ 27.571).
(2) The modifications done on the structure, due to air conditioner equipment installation, should not create any adverse qualities to the overall structural integrity of the aircraft. Any access holes cut in the aircraft structure for routing refrigerant/electrical line skin/stringer cutouts for intake or exhaust holes, etc., should be substantiated for overall structural integrity.
(3) All attachment hardware used for the air conditioner modification should be substantiated to meet the increased structural requirements.
f. System and Equipment Considerations
(1) The vapor cycle (Freon) system is properly considered to be a gaseous system. Granted, during some portion of the cycle, the Freon is in a liquid or liquid/vapor state; however, it is a gas under standard atmospheric conditions.
Therefore, the proper system test would be a pressure test for a gaseous (pneumatic) system.
(2) 14 CFR Part 27 does not call out specific testing criteria but instead relies on § 27.1309 to address potential hazards due to pressurized gas systems. A proof pressure test of 1.5 times the maximum normal operating pressure of the system is appropriate to satisfy the intent of § 27.1309.
(3) The Freon pressures vary throughout the system during operation, but the maximum normal operating pressure of the components upstream from and including the high-pressure side of the expansion valve can be regarded as the value limited by the overpressure switch. The condenser and receiver-dryer are of special concern as they are of relatively large volume and a failure could cause damage to the aircraft structure or essential mechanical components.
(4) The highest pressure normally experienced by the low pressure portion of the Freon system (downstream of the expansion valve to the suction side of the compressor) occurs when the system is shutdown; hence that pressure can be used as the "maximum normal operating pressure" for the proof and burst tests in this portion of the system.
(5) The burst pressure tests can be done on a component basis or on the entire system. The proof pressure test is best done on the entire system to allow observation Page MG 14 - 3
AC 27-1B, Chg 1 2/12/03 of any movements of the flex hoses and other components under pressure, which may interfere with essential helicopter components.
(6) System capacity or efficiency does not affect the review of the system from the standpoint of safety; however, § 27/29.1301(a) requires "Each item of installed equipment be of a kind and design appropriate to its intended function". Hence the calculations of heat load of the cabin to be cooled in (British thermal unit) Btu's and the cooling capacity of the air conditioner system may be required. The vapor cycle is a closed system (recirculating of existing air) with no fresh air make up capability.
g. Powerplant Considerations (for mechanically-driven air conditioning compressors :
(1) The drive systems and the drive system component supporting structure should be adequate both statically and in fatigue to handle any loads associated with the air conditioning drive mechanism. Both normal operating and failure conditions (compressor lockup) should be considered. For example, on systems which are belt driven off the tail rotor drive, all components should be substantiated at the highest torque, shear, and moment loads that can be imposed by the belt drive (compressor seizure as well as compressor start), in combination with the loads associated with max transient tail rotor drive torque.
(2) The compressor drive must not affect the normal function of the drive system. Additional load on the gearbox or the drive pulley should not cause a gearbox temperature increase (§ 27.1041). Exceeding the gearbox temperature limit can cause stud loosening.
(3) The mounting of a bracket (for a compressor) or an idler pulley on the transmission top case should not affect the structural integrity or the corrosion protection of the transmission. If a compressor/blower is mounted to the gearbox, the overhang moment (which is created by the weight of the compressor and its center of gravity distance), should not exceed the mount limit. The addition of a bracket which picks up several existing top case-to-main case attachment studs may provide an additional path for water to enter and corrode the cases around the studs. In some cases, the studs may not be adequate to carry the additional load, because the thickness of the top case where each of these studs is typically individually controlled could result in the bracket warping upon installation. This warping results in unequal axial clamp-up at the studs, which further aggravates the stud loading and may also lead to significant case fretting. Also, the original studs may not be of adequate length to maintain proper thread extension through the nut after the bracket is installed.
(4) In the event of a compressor seizure, it should be substantiated that no damage to the primary drive system or aircraft structure can occur. On belt driven installations, no damage to the primary drive system should occur due to burning or flailing belts. On a shaft driven compressor/blower installation, the shaft shear section should fail before exceeding the gearbox torque limit. When the shear section fails, the Page MG 14 - 4
shaft should be contained or otherwise prevented from interfering with the drive system or flight controls. Similarly, a failure of the compressor or drive belts should not damage the drive system or interfere with the flight control mechanism.
(5) The mechanically-driven compressor should not adversely affect the (vibration) dynamic characteristics of the drive system in any operating condition (§ 27.907(c)). Maximum vibration levels should be given in engine/drive system installation data (§§ 27.901(b) and 27.927(a)).
h. Flight Analyst/Pilot Considerations.
Update Rotorcraft Flight Manual supplements (RFM) to show performance effects. If the installation is such that it interferes with engine inlet airflow, then determine any pertormance loss, evaluate inlet distortion, and validate turbine engine operating characteristics. Reference §§ 27.45 and 27.939. TIA should include operational tests such as intended function and abnormal/emergency operation. Conduct EMI tests and evaluate the RFM supplement. Reference §§ 27.1581, 27.1583, 27.1585, and 27.1587.
Safety Devices / Failure Mode Effect Analysis
(1) SAFETY DEVICES:
Automatic Load shedding Current Limiter Compressor Temperature Limiter Compressor Electric Motor temperature limiter Compressor Discharge pressure limiter (VI Oil separator / Injector (VII) Containment shrouds (VilI) Belt guard
(ix) Pressure line gallery cover (×) Ignition source protection (Freon is flame suppressant)
(2) FAILURE MODE EFFECT ANALYSIS: A Failure Mode Effect Analysis is crucial to the safety evaluation of the systems. Consider the areas given below:
(i) The overpressure safety system assures there is a means to shut the system down prior to a critical pressure developing (overpressure switches, blowout plugs, redundant circuit breakers, etc.).
(ii) An electrical load analysis should show that the failures in the air conditioning system do not jeopardize the safe operation of flight essential and flight critical airborne systems.
(iii) For systems driven by engine/transmission/drive shaft, a powerplant evaluation should be made to determine power available, vibration characteristics, etc.
Page MG 14 - 5
AC 27-1B, Chg 1 2/12/03
(iv) Coupling/drive belt failure and its effect on adjacent components.
(v) The area around the condenser and receiver dryer (and any other high-pressure components) to determine if there are any critical components in the vicinity that could be damaged if a burst line occurs.
(vi) Assure that the Condenser blower/fan construction is such that if the fan or impeller fails, the pieces will not damage other components or helicopter structure (§ 27/29.1461).
(vii) The design should be such that Freon leakage cannot be ingested into the engines (§ 27.1309). Freon is an excellent fire suppressant. Ensure that no pressure relief valve or blow out plug (on the receiver dryer) is located inside the cabin.
Quantities of Freon should also be prevented, as much as possible, from entering the cabin in the event of a leak. The rapid expansion of liquid Freon to its gaseous state in the close proximity of the flight crew could be disconcerting (could fog up the cabin).
Liquid refrigerant, if allowed to strike the body, could cause frostbite, and if allowed to strike the eye, can cause blindness.
Page MG 14 - 6
Gaseous refrigerant under Compressor increasing pressure Gaseous refrigerant Evaporator Coil Condenser Cooled Receive Expansion Liquid refrigerant
REFRIGERATION CYCLE Figure AC 27.MG 14-1 Page MG 14 - 7
AC 27-1B, Chg 1 2/12/03
INTENTIONALLY LEFT BLANK Page MG 14 - 8
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 15. AIRWORTHINESS APPROVAL OF ROTORCRAFT HEALTH USAGE
MONITORING SYSTEMS (HUMS)
a. Purpose. The purpose of this section of the AC (AC 27 MG 15) is to provide guidance to achieve airworthiness approval for rotorcraft Health and Usage Monitoring System (HUMS) installation, credit validation, and Instructions for Continued Airworthiness (ICA) for the full range of HUMS applications. Mandatory terms used in this section of the AC, such as "must", are terms used only in the sense of ensuring the applicability of these particular methods of compliance when the acceptable means of compliance described herein are used. This section of the AC does not change regulatory requirements and does not authorize changes in, or deviations from, regulatory requirements. This section of the AC establishes an acceptable means, but not the only means of certifying a rotorcraft HUMS. AC 27 MG 15 addresses the most complex/extensive HUMS; systems of lesser complexity may be addressed by use of only the parts of this section of the AC that are pertinent. HUMS applications in the Catastrophic criticality category are not addressed herein.
b. References and Related Documents.
(1) Federal Aviation Regulations (FAR) Parts 21, 27, 33, 91, 125, 127, 129, 133, 135, 145 - Corresponding European Joint Aviation Requirements (JAR) 21, 27, JAR E, JAR-OPS 3.
(2) FAA Advisory Circular AC 27-1B and the European corresponding ACJs, AMJs where applicable.
(3) Standards - Latest revision of RTCA/DO-160/ED-14, RTCA/DO-178/ED-12, SAE documents ARP 4754, and ARP 4761.
c. Background.
(1) Various types of HUMS have been developed, and they are likely to be used more in the future. Initially, these systems were installed to show the feasibility of gathering meaningful data to modify required maintenance and/or operational actions.
The degree of qualification required for this type of installation is relatively low.
However, there is an increasing number of certification applications to install HUMS and use its data to intervene in maintenance and/or operations of the rotorcraft. This type of Page MG 15 - 1
AC 27-1B, Chg 1 2/12/03 installation requires a higher degree of qualification, commensurate to the criticality of the most severe effect of the intervention action(s) on the rotorcraft.
(2) HUMS typically consists of a variety of onboard sensors and data acquisition systems. The acquired data may be processed onboard the rotorcraft or on a ground station (or a combination of both) providing the means to measure against defined criteria and generate instructions for the maintenance staff and/or flight crew for intervention.
(3) The certification of HUMS must address the complete process, from the source of data to the intervention action. There are three basic aspects for certification of HUMS applications: installation, credit validation, and Instructions for Continued Airworthiness (ICA). These aspects are not totally independent and do have varying interactions with each other.
d. Definitions.
(1) END-TO-END: The term "end-to-end" as used in the text is intended to address the boundaries of the Health Usage Monitoring System (HUMS) application and the effect on the rotorcraft. As the term implies, the boundaries are the starting point that corresponds with the airborne data acquisition to the result that is meaningful in relation to the defined credit without further significant processing. In the case where credit is sought, the result must arise from the controlled HUMS process containing the three basic requirements for certification as follows:
(i) Equipment installation/qualification (both airborne and ground),
(ii) Credit validation activities, and
(ili) Instructions for Continued Airworthiness (ICA) activities.
(2) HUMS: Equipment, techniques, and/or procedures by which selected incipient failure or degradation and/or selected aspects of service history can be determined.
Health Monitoring System: Equipment, techniques, and/or procedures by which selected incipient failure or degradation can be determined.
(ii) Usage Monitoring System: Equipment, techniques, and/or procedures by which selected aspects of service history can be determined.
(3) Credit: To give approval to a HUMS application that adds to, replaces, or intervenes in industry accepted maintenance practices or flight operations.
Page MG 15 - 2
(4) Application(s): A HUMS process implemented for a distinct purpose(s).
(5) Criticality (1309): This term describes the severity of the end result of a HUMS application failure/malfunction. Criticality is determined by an assessment that considers the safety effect that the HUMS application can have on the aircraft. There are five criticality categories as tollows:
(i) Catastrophic: Failure conditions, which would prevent continued safe flight and landing.
(її) Hazardous/Severe Major: Failure conditions, which would reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be:
(A) A large reduction in safety margins or functional capabilities, (B) Physical distress or higher workload such that the flight crew could not be relied on to perform their tasks accurately or completely, or (C) Adverse effects on occupants including serious or potentially fatal injuries to a small number of those occupants.
(i¡i) Major: Failure conditions which would reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload or in conditions impairing crew efficiency, or discomfort to occupants, possibly including injuries.
(iv) Minor: Failure conditions which would not significantly reduce aircraft safety, and which would involve crew actions that are well within their capabilities. Minor failure conditions may include, for example, a slight reduction in safety margins or functional capabilities, a slight increase in crew workload such as routine flight plan changes, or some inconvenience to occupants.
(v) No-Effect (Non-hazardous class): Failure conditions which do not affect the operational capability or safety of the aircraft, or the crew workload.
(6) Integrity: Attribute of a system or a component that can be relied upon to function as required by the criticality determined by the Functional Hazard Assessment (FHA).
(7) Mitigating Action: An autonomous and continuing compensating factor which may modify the level of qualification associated with certification of a HUMS application. This action becomes a part of the certification requirements and, as such, Page MG 15 - 3
AC 27-1B, Chg 1 2/12/03 is required to be performed as long as that certification requirement is not changed by a subsequent re-certification. An example of a mitigating action is a pilot's comparison of airborne HUMS data with aircraft instrument data.
(8) Commercial Off-the-Shelf (COTS): This term defines equipment hardware and software that is not qualified to aircraft standards. An example of COTS equipment hardware and software is a personal computer (PC) and its operational software.
(9) Independent Verification Means: An independent process to verify the correct functionality of a HUMS application on a ground station that utilizes COTS. The intent of independent verification is to gain some degree of confidence in the COTS operational reliability.
NOTE: This process may be discontinued when sufficient confidence in the application has been achieved.
(10) Synthesis: The process of evaluating service history and any other relevant data with the objective of validating and, if necessary, refining the performance of an approved credit.
e. Certification Approach.
(1) There are three basic aspects to Health Usage Monitoring Systems (HUMS) certification. Certification of HUMS must address all three. The three aspects are installation, credit validation, and Instructions for Continued Airworthiness (ICA). These aspects are not totally independent and do have varying interactions with each other. A method to address these aspects is provided by the approach herein. Installation includes all the equipment needed for the end-to-end application that is associated with acquiring, storing, processing, and displaying the HUMS application data, including airborne and ground based equipment. Credit validation includes evidence of effectiveness for the developed algorithms, acceptance limits, trend setting data, tests, etc., and the demonstration methods employed. A plan is needed to ensure continued airworthiness of those parts that could change with time or usage and includes the methods used to ensure continued airworthiness.
(2) The certification process should begin with the declared application intent, and determination of the resultant criticality. This declared intent should consider whether this application is for credit, that it adds to, replaces, or intervenes in maintenance practices or flight operations. When the declared intent is for credit, the end-to-end criticality for such an application should be determined and used as an input to establish the integrity criteria. If the declared intent is for non-credit, it may be certified as long as it can be shown that the installation of the equipment will not result in a hazard to the aircraft.
(3) The end-to-end criticality can be determined by performing a Functional Hazard Assessment (FHA). The integrity level is required to be equivalent to the Page MG 15 - 4
determined end-to-end criticality. Compliance with the criticality level established by the FHA must be demonstrated. This may be achieved by a combination of application qualification plus appropriate mitigating actions.
(4) Applications are often qualified to a low level of integrity due to the assessment of criticality; however, it may be desirable to transition to a higher qualification level for future uses. Transition from one level of integrity to another will require re-evaluation.
NOTE: A certification plan may be provided to assist in the certification process. At a minimum, this plan should address the proposed means of compliance to each applicable paragraph of this advisory circular for a given application. Early submittal of this plan to the regulatory Authority is recommended.
f. Installation. Installation approval must cover systems and equipment that acquire, store, process, and display HUMS data and includes the airframe installation, or any one of these functions for a particular application. AC 27 MG 15 will address the most complex/extensive HUMS; systems of less complexity may be covered by use of only the parts of this AC that are pertinent. Different systems exhibit varying capabilities and configurations. Additionally, there may be different functional distributions between airborne and ground based equipment. HUMS equipment requirements consist of common requirements plus the unique requirements of airborne and ground based equipment.
(1) Common Requirements. A common requirement is one that applies to airborne, ground based, and installation equipment. These common requirements are discussed below.
Criticality Determination.
(A) Criticality determination is a primary decision point relating to the depth of requirements for certification. The intended application can range from systems that acquire data for proof of concept only, to a system that acquires and processes data to determine if a life-limited part should be replaced. This range of applications will have a corresponding range of criticality for the systems from No Effect to Hazardous/Severe-Major. Systems in the Catastrophic criticality category are not addressed in AC 27 MG 15.
(B) If any credit is to be gained, the general guidelines for determination of criticality levels will be either Minor, Major, or Hazardous/Severe-Major. They will be in agreement with the resulting effect of the end-to-end criticality assessment.
(C) Typical examples of applications which may be classified as Catastrophic are as tollows :
Page MG 15 - 5