AC 27-1B, Chg 9 20-136B, Aircraft Electrical and Electronic System Lightning Protection, dated September 7, 2011, should be used.
(iv) Certification Plan. The following subjects are not intended to provide a complete list of the items that should be included in the certification plan, but rather highlight some of the areas that should receive consideration. The certification plan should address the total protection required to allow the FADEC to continue to operate properly when the rotorcraft experiences a worst-case lightning strike encounter.
(A) Determination of Lightning Strike Attachments. Determine the locations on the rotorcraft where lightning strike attachment is likely to occur and the portions of the airframe through which currents may flow between attachments. The main and tail rotors are recognized as likely attachment points; however, consideration should be given to all possible attachment points. The swept stroke phenomenon may not exist for all lightning strike encounters due to the fact that the rotorcraft may be airborne with little or no airspeed.
(B) Establish the Lightning Environment. Establish the components of the total lightning event to be considered. These are the currents and voltages that are described in the definition of the environment.
(C) Full-Level, Complete Vehicle Testing. In accordance with traditional FAA policy, the demonstration that the FADEC installed in a complete type design rotorcraft will continue to operate properly when exposed to a worst-case lightning strike is sufficient to demonstrate compliance with § 27.1309(a). Because of the difficulties involved in utilizing this type of an approach, it is generally not used.
(D) Analytical Processes. A description should be given in the certification plan of the analytical process and certification tests to be utilized to demonstrate protection effectiveness. Typically, the certification plan will include a combination of analysis and tests. (Analytical techniques are most often utilized to predict the levels of lightning-induced transients in interconnecting wiring.) In most cases, successful analyses are based upon well-defined geometrical or electrical parameters such as structural dimensions and materials resistivity. When electrical characteristics of structural materials are not well established, development tests are often utilized to obtain this data, which is subsequently utilized in an analysis. In more complex structures or electrical and electronic system installations, it is sometimes difficult or impossible to define the problem in terms that can be analyzed. In these cases, development or verification testing is often relied upon. The purpose of the certification plan is to show how developmental tests, analyses, and verification tests are combined to demonstrate protection design adequacy. In certain cases, previously verified designs can be incorporated and their adequacy confirmed by reference to previous verifications. Such reference should also be incorporated in the certification plan.
Page F - 30.23
AC 27-1B, Chg 9
1. The verification testing should be conducted on a system that simulates as closely as possible the installed configuration. As few items as possible of actual hardware should be simulated.
2. Unless the applicant has opted to follow the guidance in AC 20-136B as a means of showing compliance with § 27.1309(d), then the following or other acceptable guidance should be followed. The use of various analytical processes usually requires that the system component tolerance is established. The SAE AE4L Committee Report No. AE4L-81-2 is one example of an acceptable reference to the testing that will determine these tolerances. The testing performed to determine the tolerance level of the control computer should include a consideration for the occurrence of a nonrecoverable digital upset. One method to provide this consideration is to have the unit powered and the processor operating normally under software control (usually this should be the exact software for which approval is sought) when the test is performed. If strike testing is used, then several shots should be made to develop enough data to provide a reasonable confidence level. It is acceptable for the engine manufacturer, while it is obtaining the engine type certificate, to accomplish this bench testing to determine the level of tolerance of the FADEC system components to lightning encounter indirect effects. This approach has the advantages that the bench tests are not necessarily required to be repeated when the engine is installed in a different airframe. This recommendation is not meant to add a requirement to the engine manufacturer but to propose a more efficient method of certification. If this tolerance was not determined by the engine manufacturer, the applicant installing the FADEC in a rotorcraft would be expected to furnish this data.
3. As with any analytical method, it is prudent to include a margin of safety to account for the uncertainties involved in the analytical and testing processes. Margins account for uncertainty in the compliance method. As confidence in the compliance method increases, the margin can decrease. A factor of two is an acceptable margin for systems with catastrophic Failure Conditions, if this margin is verified by aircraft test or by analysis supported by aircraft tests. For other verification methods, the margin should be approved by the cognizant certification office.
4. When an analysis has no associated full-scale vehicle testing to confirm the analysis, the analysis should be very rigorous. Additionally, it should be expected in this situation that this analysis indicates a very large margin of protection. Many factors need to be considered in determining what constitutes an acceptably large margin. The specific additional margin required should be based on an assessment of the inherent uncertainty of a given analysis.
(E) Pass or Fail Criteria. The certification plan should address pass or fail criteria for the testing and analysis to be performed. The following items should be satisfied to assure acceptable system performance:
1. No immediate crew action must be needed.
Page F - 30.24
AC 27-1B, Chg 9
2. Automatic control of the engine cannot be lost for any appreciable period of time. The engine should not be allowed to be out of control for a period of time that will result in a hazard in a worst-case flight condition. Any rapid, uncontrolled divergence would not be acceptable.
3. No crew action should be required to reset the system. This is not to imply that the system cannot be designed with a manual reset, but the manual reset cannot be used to show compliance to recover from a digital upset.
4. The resumption of engine control after an upset should be reasonably within the range that existed before the upset.
5. No critical data can be lost.
6. After the system recovers, if the performance of the system has been degraded in a noncritical manner that would reduce the capability of the rotorcraft or the ability of the pilot to cope with adverse operating conditions, then an alert to the crew about this system degradation is needed.
(F) System Installation Considerations. In most cases, the installation of the system components is a constituent part of the lightning protection. This is particularly true in the use of shielding techniques. If these installation features are required for adequate lightning protection, consideration should be given to ensure that their effectiveness is not derogated in service. ICAs must be furnished to the aircraft owner on initial delivery, and thereafter made available to parties who service and operate the rotorcraft, to allow them to take actions necessary to ensure the continued effectiveness of the system lightning protection. See § 21.50(b).
Page F - 30.25
AC 27.1316 § 27.1316 (Amendment 27-46) ELECTRICAL AND ELECTRONIC SYSTEM LIGHTNING PROTECTION.
a. Explanation.
(1) During the original design and development of rotorcraft and the development of regulations concerning these aircraft, little attention was given to protection from the meteorological phenomenon of lightning. This was, in part, because the early aircraft were constructed mostly of metal and had little, if any, dependence on advanced technology systems. Contemporary design of rotorcraft utilizes the same advanced technology systems and materials as airplanes. Because of this, a specific requirement was added by Amendment 27-46 establishing standards for lightning strike protection of required systems, equipment, and installations. Section 27.1316 replaces paragraph (d) of § 27.1309, which previously defined the consideration required for the foreseeable operating condition of a lightning strike encounter on the rotorcraft and systems.
Note: Aviation authorities in other countries may not have issued regulations or standards similar to § 27.1316 for lightning protection. As a result, authorities in other countries may use other means, such as special conditions, to establish requirements for lightning protection.
b. Procedures.
(1) Guidance for you to show compliance with the applicable sections of § 27.1316 is available in a dedicated AC 20-136B. AC 20-136B is available for download from the FAA Regulatory Guidance Library website at http://rgl.faa.gov/.
(2) EASA Interpretative Material is introduced by a CRI referring to EUROCAE documents (ED) ED-113, ED-81, and FAA AC 20-136B.
Page F - 31
AC 27-1B, Chg 4 3/31/2014 AC 27.1317. § 27.1317 (Amendment 27-42) HIGH INTENSITY RADIATED FIELDS (HIRF) PROTECTION.
a. Explanation.
(1) Regulations amendments in 2007 added requirements for the protection of aircraft electrical and electronic systems from the effects of High Intensity Radio Frequency (HIRF) environment. This effort was due to technological advances in airframe and electronic systems design and a concurrent increase in the levels of radiated power in the aircraft environment. These changes have raised vulnerability to the electromagnetic environment of the electrical and electronic systems, which perform critical and essential functions. Prior to this regulatory requirement, the issuance of special conditions for products involving advanced electrical and electronic systems provided an adequate level of safety. The new regulation included a five-year period of relief from the new testing requirements by allowing an applicant to show that the system continues to comply with previously issued HIRF special conditions. Beginning December 1, 2012, data used to show compliance as part of a previously issued special condition is no longer accepted as a means of showing compliance with paragraph (a) of § 27.1317. All systems will be required to show compliance data to the appropriate paragraphs and sections of the regulation, based on the HIRF safety analysis.
(2) EASA has not yet adopted regulatory requirements for HIRF protection.
EASA is using special conditions invoking the JAA INT POL 27/29-1 Issue 3, dated January 10, 2003. The requirements addressed in the JAA INT POL are similar to those of § 27.1317(a)(b)(c).
b. Procedures.
(1) Guidance for you to show compliance with the applicable sections of § 27.1317 is available in AC 20-158. This AC is available for download from the FAA Regulatory Guidance Library website: http://rgl.faa.gov/ .
(2) EASA Interpretative Material provided in EUROCAE ED-107 and AMJ 20.1317 is considered by the FAA to be technically equivalent to the guidance material in AC 20-158 and may be used as a means of compliance with § 27.1317.
Page F - 32
AC 27-1B, Chg 7 2/4/2016 [This page intentionally blank.] Page F - 33
AC 27.1321. § 27.1321 (Amendment 27-13) ARRANGEMENT AND VISIBILITY.
a. Background. Part 27 contains specific requirements for locating instruments to allow pilots to operate the rotorcraft safely within authorized limits and to indicate system conditions. The instruments should be arranged for use by any pilot and must be readily visible to the pilot. The design for the instrument location and arrangement, with respect to the pilot’s seat, should accommodate 5th to the 95th percentile of male and female pilots. Pilots within this height range should be able to see and, where necessary, reach and operate all of the displays.
b. Procedures.
(1) When evaluating the location of the instruments for rotorcraft approved for VFR (IFR locations are discussed in section AC 27 Appendix B of this AC), the placement of flight, navigation, and powerplant instruments should be such that the pilot(s) can easily see and read the instruments when seated normally. Additionally, the instruments’ location should minimize unnecessary pilot head turning.
(i) Primary field of view (FOV): Figure AC 27.1321-1 depicts the primary FOV for rotorcraft. Display high priority information and the primary flight information in the primary FOV.
Figure AC 27.1321-1 PRIMARY FIELDS OF VIEW
(ii) Secondary FOV: Figure AC 27.1321-2 depicts the secondary fields of view. Signals and information pilots scan as part of monitoring the aircraft and its performance are located in the secondary FOV. The priority of the information and signals when locating information in the secondary field of view should be considered.
The farther away from the primary field of view a signal is located, decreases the chance a pilot will notice it without a prompt. Additionally, the pilot’s scan workload to see information increases the farther away from the pilot’s primary field of view it is located. The secondary FOV is bound laterally to minimize the need for pilots to turn their heads to view the information. Examples of information typically located in the secondary FOV are:
Page F - 34
(A) Ancillary navigation information (moving maps, weather displays, etc).
(B) Secondary powerplant information, such as engine oil pressures and temperatures.
(C) caution advisory and warning system (CAWS) panel (unless a master caution or warning indicator is not located in the primary FOV, in which case the CAWS panel should be as close to the pilots primary FOV as possible).
(D) Autopilot (if installed).
(E) Navigation controls.
Figure AC 27.1321-2 SECONDARY FIELDS OF VIEW
(2) On multiengine rotorcraft, the required powerplant instruments should be grouped so there will be no confusion regarding which engine an individual gage represents. This is usually accomplished by mounting the engine gages in a vertical grouping. Identical parameter gages are placed next to each other and positioned from left to right in the same position and sequence as the engine location in the airframe.
(3) An evaluation should be made to determine that vibration of the instrument panel does not exceed the tolerances of the instrument. The instrument manufacturer will usually provide data that indicate the level of vibration for which the instrument has been qualified. The flight test evaluation of the rotorcraft should explore and determine that the vibration of the instrument panel does not affect the readability of the instrument. To meet these two criteria, it has been necessary in some installations to “shock mount” or otherwise isolate the instrument panel.
Page F – 34.1
AC 27-1B, Chg 7 2/4/2016
(4) The flight test evaluation should also determine that the flags or malfunction indicators of the instruments are readily visible in all combinations of lighting for approved kinds of operations.
AC 27.1322. § 27.1322 (Amendment 27-11) WARNING, CAUTION, AND
ADVISORY LIGHTS.
a. Explanation.
[Section AC 27.1322 continued on Page F – 35.] Page F - 34.2
(1) Cockpit devices are color-coded to symbolically represent various functions and varying levels of importance for flightcrew operation. From early times, an attempt has been made to take full advantage of associations developed early in life as a result of continuous exposure to our daily environment.
(2) Military design specifications were the first to reference color-coding in cockpit design requirements. In the mid-1940s, the CAA initiated the first color-coding requirements for civil cockpit design. Color-coding standards for cockpit visual signals soon followed. MIL-STD-411, May 31, 1957, identified three separate categories of light signals:
(i) Warning Light - indicates the existence of a hazardous condition which may require immediate corrective action.
(ii) Caution Light - serves to alert the operator to an impending dangerous condition requiring attention but not necessarily immediate action.
(iii) Advisory Light - indicates safe or normal configuration, condition of performance, operation of essential equipment, or attracts attention for routine purposes.
(3) Examples of warning and caution signals are included in later versions of the military standard, and a few of those are shown below:
Warning Signals Caution Signals Cabin Pressure Failure Trim Failure Fire Fuel Low Fuel System Failure Generator Inoperative Landing Gear Unsafe Defrosting Failure
(4) Specific color designation for civil advisory lights was first addressed in Amendment 3 to the rotorcraft certification rules (Parts 27 and 29) on January 19, 1968, with adoption of new §§ 27.1322 and 29.1322.
(5) In a subsequent revision (Amendment 27-11), green lights were redesignated and additional colors introduced for flexibility in the requirement.
b. Procedures.
Page F - 35
(1) Red shall be reserved for annunciation of emergency conditions requiring immediate corrective action. Typical examples include fire, transmission oil pressure, engine failure, and battery overheat. The use of red for annunciators which do not require immediate action must be avoided. Use of red when it is not needed tends to lessen the impact of a red annunciator and the needed pilot association for immediate action. In evaluating cockpit annunciators for acceptability, the FAA should ensure all annunciators which require immediate action are red and that only those requiring such action are red. If a master warning light is provided, it should be red, and it should be powered by the same signal that powers any of the individual red warning signals. An aural warning may accompany visual warning signals to enhance pilot response. Care should be taken that any aural signal is sufficiently distinct from other aural warnings, such as low rotor RPM to prevent confusion and to ensure proper crew response. A means to deactivate and reset the master warning (visual and aural) is required.
Resetting the master warning must not deactivate any individual warning signal.
(2) Amber shall be reserved for indicating malfunction or failure conditions which do not require immediate crew action to ensure safe flight. Typical examples include door unlatched, inverter failure, generator failure, fuel filter clogged, and parking brake engaged. Amber should generally be utilized for malfunct ion and failure conditions which do not require immediate action. The key word here is “require.”
Obviously, a pilot should perform corrective action for malfunction or failure conditions in a timely manner as soon as other cockpit priorities allow. The time increment associated with “immediate action” may vary with the system involved, the flight regime, and the aircraft; however, 15 seconds is a representative value in evaluating this term.
This by no means indicates that any red annunciator can be ignored for 15 seconds.
For red annunciators, some type of immediate pilot response is expected. If immediate pilot action is not required, the FAA should recommend the use of an amber designation. If a master caution light is provided in addition to a master warning light, the master caution annunciator should be amber, and should be powered by the same signal that powers any of the individual amber caution signals. Reset considerations for the master caution are the same as those detailed above for the master warning.
(3) Green signifies a safe operating condition and more specifically has come to signify landing gear extended and locked. Extensive use of green annunciators throughout the cockpit should generally be avoided due to possible confusion with the special use of green for landing gear. If green annunciators are physically and functionally removed from the landing gear operation, they may be found acceptable for a variety of “safe operating” applications. One such application is “all green for approach” used in autopilot, flight director, and other navigation system displays.
(4) Other colors may be utilized as advisory lights in accordance with § 27.1322(d). Red and amber must not be used as advisory lights due to the possibility of introducing confusion into the cockpit. Obviously, yellow and pink annunciators should be avoided due to their similarity to amber and red. White and blue have been successfully utilized as advisory segments in past civil designs.
Page F - 36
(5) The primary test for designation of color is:
(i) Red - Is immediate action required?
(ii) Amber - Is pilot action (other than immediate) required?
(iii) Green - Is safe operation indicated, and is the indication sufficiently distinct to prevent confusion with the landing gear down indication?
(iv) Other advisory lights - Is the meaning clear and distinct enough to prevent confusion with other annunciations? Do the colors which are utilized differ sufficiently from the colors specified in paragraphs b(1), (2), and (3) above?
(6) Annunciator lights should be visible during bright daylight conditions. This should include visibility in direct sunlight unless lights are located in such a manner that direct sunlight cannot impinge on them.
(7) If dimming capability is provided, all annunciators, including master warning and caution, may be dimmable so long as the annunciation is clearly discernable for night operation at the lower lighting level. Undimmed annunciations have been found unacceptable for night operation due to disruption of cockpit vision at the high intensity.
The dimming circuit should automatically revert to the high intensity setting when power is removed. Automatic dimming/brightening through the use of a photo cell is also acceptable, as are circuits which enable a dimming switch through a position light or other cockpit lighting controls.
(8) The use of flashing lights should be minimized. If a flashing feature is used, it should be controllable through pilot action so that flashing annunciation does not persist indefinitely. The indicator should be so designed that if it is energized and the flasher device fails, the light will illuminate and burn steadily.
(9) The activation of caution and warning lights should readily attract the attention of the appropriate crewmember while performing duties under both normal and high workload conditions.
c. Annunciator Panel Design
(1) Explanation.
(i) The annunciator panel design should be reviewed for the presence of failure modes that can cause illumination of multiple panel segments.
(ii) Many test circuits that are diode isolated are vulnerable to this condition. A typical sequence begins with the shorting of a test circuit diode. This failure is undetectable and goes unnoticed until an actual failure condition occurs which Page F - 37