784. FULL AUTHORITY DIGITAL ELECTRONIC CONTROLS (FADEC) FOR INSTALLATIONS WITH CATEGORY A ENGINE ISOLATION.
a. Explanation.
(1) The advent of "microprocessor technology" has resulted in rotorcraft engine controls being implemented by digital process control rather than by conventional means. These digital, processor-based full authority engine controls offer many performance advantages (such as isochronous governing) which were not feasible with conventional technology pneumatic or hydromechanical controls. Because of the incorporation of this advanced technology, some additional considerations must be made of the engine installation to ensure regulatory compliance.
(2) Part 27 does not require engine isolation. The guidance herein does not address FADEC installation certifications which do not desire engine isolation credit.
(3) In showing compliance with certain performance and flight characteristic sections of Part 27, simultaneous malfunction of engines is not considered if Part 29 Category A engine isolation is achieved. Paragraph 780 of this AC describes, in terms of Part 29 Category A requirements, an acceptable approach for determining that engine isolation, adequate for Part 27 performance and flight characteristic credit, has been achieved. That guidance material should be reviewed, but it is not believed that the limited-time-period concept for engine isolation which could be allowed under Part 27 would affect the FADEC installation requirements. Hence, the guidance for a Part 27 aircraft claiming credit for engine isolation is essentially the same as for a Part 29 Category A rotorcraft.
b. Procedures. The following is a discussion of some special attention areas when a FADEC installation is to be shown to comply with the Part 29 Category A engine isolation requirements. Paragraph 621b(4)(i)(D) of this AC contains a general definition of what constitutes a "full authority" control.
(1) Software Qualifications.
Paragraph 621f contains a general discussion of the use of the recommended RTCA document DO-178A which is utilized for the approval of system software. When utilizing that document, one might arrive at the conclusion that the engine control as a required function is essential and thus level 2 software would be appropriate for the control. However, for this level 2 category software, errors are presumed to exist and a software error in a full authority control could result in simultaneous unacceptable malfunctions in all engines. The provisions of § 27.1309(b) for the rotorcraft installations to be designed such that no probable malfunction or failure would result in a hazard to the rotorcraft, and the Part 29 engine isolation rule § 29.903(b) would generally preclude this level 2 classification.
1084 Par 784
7/30/97 АС 27-1A (її) System designs which provide redundant distinctive software or an alternate technology control which is automatically selected and meets all of the minimum regulatory requirements would reduce the impact of software errors and may allow the level 2; i.e., essential, software classification. At level 1, it is accepted that the software is sufficiently error free that the software does not require further verification in the installation evaluation.
(2) Lightning Strike Protection. A complete discussion of an acceptable method of demonstrating that the FADEC, as installed, is adequately protected against the catastrophic effects of lightning is contained in Paragraph 621b(4) of this AC.
(3) Electrical Power System Considerations.
Normal Operation. The system should be evaluated with all power sources operating normally. If additional power source capability is being provided that is above the minimum required for certification, a certain portion of the evaluation should be conducted while operating in the minimum configuration.
(її) Malfunction Conditions. Beginning with the minimum configuration that is required for certification, electrical power system malfunctions should be introduced and the impact on continued FADEC operation determined.
(ill) Circuit Protection Location. The circuit protective devices for the FADEC should be located in the cockpit such that they can be readily reset or replaced in flight. The operation of the FADEC system is considered to be essential to safety in flight. Reference § 27.1357(d).
(iv) System Separation. On multiengine applications, each system should be separated from the other system to the maximum extent practical. Wiring should be routed separately. Power should be taken from independent busses and grounds, and system components should be independent of one another.
(v) Periodic Checks. Where periodic checks are appropriate, they should be made at reasonable intervals. This would normally range from preflight checks for certain items of greater concern to a tie-in with normal aircraft maintenance intervals for other items. If a crew check is specified, it should be evaluated to ensure it is a reasonable check. If items to be checked are located in an area that can be covered by interior upholstery, for example, a crew check would not be considered reasonable, and further design considerations may be in order.
(4) Powerplant Installation Considerations.
Paragraph 780 of this AC cites certain Part 29 provisions as being appropriate if engine isolation is claimed for a Part 27 rotorcraft. The guidance which Par 784 1085
follows, in part, references two Part 29 general engine isolation rules, §§ 29.901(c) and
29.903(b)(2), which should be considered.
(її) A demonstration of compliance with § 29.901(c) would generally include a failure mode and effects analysis (FMEA) of the powerplant systems as installed. When a FADEC is utilized, the analysis would consider the control's failure modes, the installed engine reaction, the affect on the aircraft, and the crew response to the situation. Combinations of undetected failures should be considered. Engine failures which may be escalated in severity by the FADEC's response to the initial failure should be analyzed. Potentially hazardous failures should be evaluated during flight testing. The requirements of § 29.903(b)(2) and § 27.1309(b)(2)(i) should be reviewed in determining acceptability of failures.
(iii) Section 29.903(b)(2), Category A engine isolation, is intended to ensure that a failure will not prevent the continued safe operation of the remaining engine (s) or require immediate action of the crew to ensure continued sate operation.
The FADEC's of the individual engines should be independent. Where communication between FADEC's is required (for example, for torque sharing), care should be exercised to ensure that failures which may occur will not result in a power loss to the extent that total power available is less than would be available under OEI conditions.
The no-required immediate-crew-action provision would preclude credit for manually selected or operated backup systems in meeting the § 29.903(b) rule. These unrequired backup systems, which may offer the advantage of get-home multiengine capability rather than forced OEI operation, would be evaluated on a no hazard basis.
(iv) Section 27.939, turbine engine operating characteristics, intends a flight investigation to ensure that no adverse characteristics are present to a hazardous degree during normal and emergency operation in the allowed flight envelope. The evaluation should include assessment of the minimum FADEC system certification configuration; i.e., the minimum proposed by the applicant to meet Part 27 requirements. Reduced capabilities (e.g., restrictions on normal collective movements, limited aircraft maneuvers, etc.) may be acceptable for degraded FADEC modes or backup systems not required to meet Part 27 requirements if those degraded capabilities are reasonable and not hazardous as determined by flight evaluation. The restrictions should be specified in the flight manual.
(v) The rotorcraft with FADEC engines must of course meet all of the Part 27 requirements, but the areas described herein are those which deserve special attention.
785. AGRICULTURAL DISPENSING EQUIPMENT INSTALLATION.
NOTE: This paragraph has been extensively revised and expanded to clarify the restricted category certification of agricultural dispensing equipment installations on rotorcraft.
1086 Par 784
a. Explanation. In the early development of the rotorcraft one of its primary usages was agricultural operation. The FAA recognized that the existing requirements, which were designed primarily to establish an appropriate level of safety for passenger-carrying aircraft, imposed an unnecessary economic burden and were unduly restrictive for the manufacture and operation of aircraft intended only for use in rural, sparsely settled areas. Therefore, a special document that established new standards for agricultural dispensing equipment and other special purposes was developed. Restricted Category CAM 8 became effective October 11, 1950.
(1) During the recodification of 1965, CAR 8 ceased to exist as a regulatory basis and selected portions addressing certification were incorporated into FAR 21.
While the specific standards in CAR 8 were not changed substantially when adopted into FAR 21, the less restrictive philosophy of CAM 8 and the policy material that was stated in the preamble to CAM 8 was not clearly conveyed.
(2) Advisory material published in 1965 and revised in 1975, summarized the information contained in the advisory portions of CAM 8. This new advisory material indicated that the CAM advisory material would be applicable to the related FAR's.
Unfortunately, this document specified that CAM 8 could be used in conjunction with certain FAR's for restricted category certification of small agricultural airplanes only.
Rotorcraft were omitted.
(3) A survey of restricted category rotorcraft projects related to agricultural modifications indicates that the CAM 8 philosophy was interpreted to allow the use of AC 43.13-2A structural criteria for most STC's issued through the early 1980's. Since then more restrictive guidance based on CAR 6 and FAR 27 requirements has been applied by some ACO's to several STC applications. Since the more restrictive guidance imposed a significant economic burden on the industry, the HAI requested a meeting with the FAA during the 1990 annual convention in Dallas. As a result of the meeting, an Action Notice to clarify the interpretation of FAR 21.25(a)(1) for restricted category aircraft has been issued.
(4) The following advisory material is a result of a reassessment of past and present policy.
b. Procedures. The certification basis for agricultural dispensing equipment in the restricted category is FAR 21.25(a)(1) as interpreted by Action Notice 8110.22. The accountable Directorate guidance for the substantiation requirements for rotorcraft is as follows:
(1) Substantiation of the agricultural dispensing system hoppers or spray tanks to the load factors provided in Figure 785-1 provides for proof of structure. The load factors of Figure 785-1 address the critical structural load conditions of dispensing equipment mounted in or near the fuselage and provide adequate margins of safety.
Par 785 1087
FIGURE 785-1
ACCEPTABLE ULTIMATE LOAD FACTOR FOR
AGRICULTURAL DISPENSING EQUIPMENT DESIGN
UP DOWN SIDE FORWARD AFT Tanks & Equipment Mounted 1.5g 4.0g 2.0g 4.0g - ...
In Or Near The Fuselage Note 1 Spray Booms 1.5g 2.5g Note 1 2.5g Note 2 Note 1: An ultimate load factor of 2 G's is acceptable for externally side or under fuselage mounted tank and forward mounted spray booms where failure in a minor crash landing will not create a hazard to occupants or prevent occupant exit from the rotorcraft.
Note 2: The aft loads for spray booms may be developed by the applicant based on the 111 percent of VNE for which certification is requested or the load factors of Figure 785-1, whichever is greater.
(2) The applicant may elect to substantiate his product by either static or dynamic testing, by analysis, or any combination thereof.
(3) Lower load factors may be used only when justified by manufacturer's data, rational analysis, or actual rotorcraft flight and ground load demonstrations.
(4) Tank pressure test, while not mandated, is recommended for safety reasons. An acceptable procedure is included in Paragraph c(4).
(5) Dispensing equipment installation attach points. If attach points exist which are an integral part of the rotorcraft and these attach points have been certified to the standard category requirements no further substantiation of the attach point is required if an analysis indicates the dispensing system does not impose loads which exceed those for standard category certification.
(6) Ground clearance for dispensing equipment installation. A 5-inch ground clearance has typically been used for skid gear equipped rotorcraft which incorporate belly mounted supply tanks/hoppers or systems which have dual side mounted supply tanks/hoppers and the design incorporates cross tubes or other system components which are located beneath the bottom of the fuselage when these components are rigidly attached to the airframe structure. The 5-inch dimension is measured vertically from the ground to the lowest point of the installed system, with the rotorcraft in its operational configuration and gross weight (including disposable load) and while resting 1088 Par 785
7/30/97 АС 27-1A on a smooth, level asphalt surface. For rotorcraft equipped with wheels and/or landing gear struts, the maximum system deflections should be considered when determining the 5 inches of acceptable static ground clearance. The 5-inch ground clearance would only apply to original configuration of newly manufactured rotorcraft. However, a 3-inch ground clearance has been found acceptable and may be approved for skid gear equipped rotorcraft to account for the in-service permanent set allowed for skid gear members, (i.e., cross tube deflections allowed per the maintenance manual). Cable supported systems, (i.e., cargo hook installations) or dispensing systems utilizing flexible ducts (certain types of dry material dispensing equipment which may or may not be retractable) have been approved even though portions of the system may contact the surface during a normal landing.
(7) A number of rotorcraft are approved for external cargo operations that allow a gross weight higher than the approved internal gross weight limit. This difference is usually due to the allowable weight limit restriction of the landing gear. (The gear is not approved for the higher weight.) Those types of dispensing equipment, that can be loaded in flight to a weight that exceeds the allowable limit of the landing gear should incorporate a reliable means that rapidly reduces the total aircraft gross weight to within allowable landing gear limits. In most cases, this will involve jettison of the disposable load. The time interval for this operation should be demonstrated, and should not exceed a recommended 3 seconds from a level flight condition.
(8) A flight check or demonstration of the agricultural dispensing equipment installation is normally conducted. This flight check should also qualitatively determine that no hazardous deflection or resonance in the rotorcraft or dispensing system exists.
This flight check should be conducted in accordance with the requirements of FAR 133.41.
(9) For rotorcraft certificated in dual categories, the inspection requirements of FAR 21.187(b) must be observed when converting from restricted to normal category.
c. Acceptable Means of Compliance.
(1) Analysis Method. Structural analysis (static) may be used if the structure is of a configuration for which experience has shown the method to be reliable. Structural substantiation of tanks that are designed to contain liquid materials may be accomplished by pressure testing. For tanks or hoppers designed to contain dry material, (e.g., dust or fertilizer) static load tests may be used to verify structural integrity. The tank/hopper, mounting hardware, and support structure should all be substantiated to the load conditions specified by this paragraph considering the effects of internal fluid pressures when applicable.
(2) Static Tests. Static tests of tank/hoppers, mounting hardware, and support structure for each critical load condition may be accomplished using conventional techniques; such as, dead weight loading, whiffletree systems, and hydraulic rams. If Par 785 1089
tests of the tank and its mounting hardware are conducted using a test fixture representing the rotorcraft, the rotorcraft support structure may be substantiated independently by means of test and/or analysis. Static test loads should be applied in combination with associated internal fluid pressure loadings. The ultimate loads specified in Paragraph 785 should be sustained for at least 3 seconds without failure.
(3) Dynamic Tests.
(i) If the applicant elects to test to the load factors noted herein, the maneuvering and gust loadings will be considered to be adequately substantiated. For each condition, the critical volume and density of fluid should be used.
(il) The tank and mounting hardware should support ultimate loads without detrimental permanent set or failure, respectively. The rotorcraft support structure may be included in the dynamic tests, or it may be substantiated separately via static test and/or analysis for each condition specified by this paragraph.
(4) Pressure Testing. Internal pressure loads may be applied using the water standpipe technique. Standpipe water height should be accurately computed for each critical spray tank static test loading. Pressure testing of spray tanks is not absolutely essential but is recommended for safety reasons. This testing will also determine whether the joints and connections are tight and will not leak in addition to determining any weak spots in the construction. Where spraying is done with highly volatile and flammable liquids, or where the tank has a return line, such as in an engine oil tank where the fluid is pumped back into the tank, it is recommended that the tank be tested for a pressure of 5 pounds per square inch. For other liquids, and where no fluid return line is used, testing to 3 ½ pounds per square inch should be satisfactory. There are many ways of pressure testing a tank, however, it is believed that the simplest and easiest method is to fill the tank with water and use a standpipe filled with water. A 1 1/8-inch pipe can be connected to the venting tube or one adapted to the filler opening. In either case the height of the pipe would be the same. For a 3 ½ PSI test of the tank the height of the water in the pipe would only need to be 8 feet and for a 5 PSI test only an 11 ½-foot height of water will be needed.
1090 Par 785
or 11 ½ TANK FIGURE 785-2. SKETCH OF TANK PRESSURE TEST Par 785 1091
АС 27-1А 7/30/97
786. EMERGENCY MEDICAL SERVICE (EMS) SYSTEMS, INSTALLATIONS, INTERIOR ARRANGEMENTS, AND EQUIPMENT.
a. Explanation. This paragraph pertains to EMS configurations and associated rotorcraft airworthiness standards. EMS configurations are usually unique interior arrangements that are subject to the appropriate airworthiness standards, FAR Part 27 or its predecessor CAR Part 6, to which the rotorcraft was certificated. No relief from the standards is intended except by § 21.21(b)(1) or exemption. EMS configurations are seldom, if ever, done by the original manufacturer.
(1) The FAA/AUTHORITY has not specified in the airworthiness or operating rules the minimum equipment for an EMS configuration. Whatever equipment is presented for evaluation and approval is subject to compliance with the airworthiness standards. Any equipment that is not essential to safe operation of the aircraft is evaluated for a "no hazard approval," i.e., it is optional equipment and may be approved provided the use, operation, and possible failure modes of the equipment are not hazardous to the aircraft. Safe flight, safe landing, and prompt evacuation of the rotorcraft, in the event of a minor crash landing, for any reason, are the objectives of the FAA/AUTHORITY evaluation of interiors and equipment unique to EMS.
For example, a rotorcraft equipped only for transportation of a nonambulatory person (a police rotorcraft with one litter) as well as a rotorcraft equipped with multiple litters and complete life support systems and two or more trained attendants/medical personnel may be submitted for approval. These configurations will be evaluated to the airworthiness standards appropriate to the rotorcraft certification basis.
(її) Normal category rotorcraft should comply with flightcrew and passenger satety standards which result in certain features of the basic certified rotorcraft which are related to the arrangement, to the doors and emergency exits, and to occupant protection. Compliance with the airworthiness standards results in placards or markings for doors and exits, exit size, exit quantity and location, exit access, safety belts, and possibly shoulder harnesses or other restraint or passenger protection means as a part of a rotorcraft type design. These features, including any placards and markings which are required to be a part of the rotorcraft type design, should be retained unless specific replacements or alternate designs are necessary for the EMS configuration to comply with the airworthiness standards.
(2) Many EMS configurations of normal rotorcraft are equipped with the tollowing:
Attendant/medical personnel seats, which may swivel.
(i) Multiple litters, some of which tilt.
1092 Par 786
(III) Medical equipment stowage compartments.
(iv) Life support and other complex medical equipment.
(v) Incubators for infants.
(vi) Curtains or other interior light shielding for the flightcrew station.
(vii) External loud speakers and search lights.
(vili) Special internal (intercom) and external communication radio equipment.
b. Procedures.
(1) General Original type design information and criteria may or may not be available from the manufacturer. This may be "public," not proprietary, information that is pertinent for interior modifications. It may be appropriate to include "standard" features, placards, and markings for the rotorcraft type design by reference in the applicant's modification design data.
(ii) The EMS modification presented for approval usually contains equipment of one manufacturer's model or design. The type design of the modification will have features to power and restrain the equipment, maintain the rotorcraft systems integrity, and to otherwise protect the occupants. See Paragraph b(15) which refers to equipment substitution.
(2) Evacuation and Interior Arrangements. Access to the emergency exits/doors from any location in the cabin/compartment, access to and use of the exit/door opening means or release device, and the unobstructed area of an exit are potential problems that should be addressed in the early design stage. Multilitter arrangements may be especially critical for normal category rotorcraft.
The operation or use of devices for locking the position of swivel seats, etc., and for rapid installation and removal of litters (incubators, etc.) should be labeled unless they are simple and obvious, and do not require exceptional effort. The design features of the device(s) and the seat and/or litter will influence the extent of information in any label necessary to insure proper and safe installation for routine use and for prompt evacuation when appropriate or necessary for the interior arrangement.
The requirement for labels or markings (instructions, etc.) that applies to operation of seat or litter features, release devices, etc., is not relieved even if trained attendants are necessary for an evacuation as discussed in c(2)(v). Placards or instruction cards that Par 786 1093
contain evacuation procedures do not necessarily contain detail procedures for individual seats, litters, and so forth. Release devices that are simple and obvious and do not require exceptional effort are recommended. For example, a single central control for litter release would be preferred over multiple action release devices. Seats and litters which require multiple actions or steps to position or release for an emergency evacuation after minor crash landing may be acceptable if properly scrutinized and evaluated for the effect on achieving a rapid evacuation.
The passenger compartment should not be partitioned to impede access to exits. Exit/doors should be readily accessible. A door or exit is required on each side of the rotorcraft. A demonstration or a "walk-through" of appropriate evacuation procedures may be necessary to insure the means and procedures are feasible and adequate. Rotorcraft with readily accessible exits, using simple and obvious means and procedures for an evacuation, may not require written procedures or a demonstration. Placards and durable markings, if necessary, may be sufficient to complement the exit markings and instructions required by the standards.
(i) It is preferable for the patient to remain strapped in the litter; however, the patient may be removed from the litter to facilitate prompt evacuation in the event of a minor crash landing as defined in § 27.561(b). If evacuation procedures and trained attendants are necessary for rapid evacuation, the procedures may be prominently displayed in durable markings, placards, cards, and summarized or condensed in the Emergency Procedures Section of the Rotorcraft Flight Manual (RFM) or an EMS configuration supplement to the RFM. If medical attendants are required for evacuation, the attendants should be trained in evacuation procedures and listed as trained attendants in the Limitations Section of the RFM or supplement. A trained attendant is not considered a flightcrew member but is a required "crewmember."
(3) Restraint of Occupants and Equipment.
The minor crash conditions specified in § 27.561(c) usually dictate all but the vertical (down and possibly up) design load conditions. The flight and landing loads, such as 13.5g limit (flight) vertical, usually override the minor crash loads. See Paragraphs 218 and 336 of this AC for further information.
Galleys, medical supplies, and equipment compartments or modules should be restrained and the individual compartments should also contain the contents therein for the conditions noted in b(3)(i)., Durable placards, decals, or markings should be used where appropriate to limit the maximum weight of any compartment and the whole module. Compartment latches having sufficient strength and displacement/engagement should be used to contain the contents for the conditions noted. If necessary, a static load test or analysis should be employed to insure the container/compartment remains intact and the latch does not disengage for the most critical conditions. Loose or unrestrained contents in an individual compartment, in combination with similar compartments, should require use of a magnification factor 1094 Par 786
with the design conditions noted. Prudent design and location of compartments having heavy, unrestrained (loose) equipment will mitigate the potential effects of minor crash impact loads.
(iii) Whether seated or recumbent, the occupants must be protected as prescribed in § 27.785. Swivel seats and tilt litters may be used provided they are substantiated for the appropriate loads for the positions selected for approval. Placards or markings may be used to assure proper orientation for flight takeoff and landing and minor crash conditions. For recumbent occupants, harnesses, straps, a padded headboard, a diaphragm, or safety belts may be used if proven for the forward and lateral loads of §27.561(c). Harnesses/straps are preferred, however, for the forward condition. When harnesses/straps are used, they should prevent the occupant from significant forward motion (4g condition) that would remove the support for the head as well as the shoulder for "head-down" motion. The litter design should become a part of the interior design approval. The type design for the interior should include the litter and incubator part numbers. Infants in incubators should be similarly protected by padding and containment within the incubator with the incubator restrained for the load cases noted. If the infant is strapped to a removable platform, the platform and infant should be properly restrained within the incubator for the load cases noted. Incubator materials are also subject to the flammability standards noted in Paragraph b(4) that follows.
(4) Flammability Standards for Materials.
Interior materials must meet the flammability standards in § 27.853, appropriate to the type design. The standard presently requires compartment materials to be at least flash resistant. The wall and ceiling linings, coverings of upholstery, floors and furnishings must be at least flame resistant.
(A) Flash-resistant material may be characterized as that not exceeding a 20-inch-per-minute (horizontal) burn rate. See AC 23-2 for further information.
(B) Flame-resistant material may be characterized as that not exceeding a 4-inch-per-minute (horizontal) burn rate.
(C) However, self-extinguishing materials that can meet the transport rotorcraft standards of § 29.853 of Amendment 29-17 are readily available.
These self-extinguishing materials are recommended for use in normal category rotorcraft.
(i) For incubators, transparencies must be flash resistant and fabric (padding, covers) straps, etc., must be flame resistant according to the standard.
Advisory Circular No. 23-2, Flammability Tests, dated August 20, 1984, contains test information about flash and flame-resistant material.
Par 786 1095