AC 27-1B, Chg 9 (A) The energy storage system capacity must be sufficient to supply the required current at a voltage level that allows proper operation of the equipment or functions dependent on the energy storage system. This capacity must be shown to be sufficient at the proper voltage levels for all operational and environmental conditions, as required by § 27.1351(a)(1). Any energy storage system required for continued safe flight and landing of the rotorcraft must have monitoring features and the means to indicate to the pilot the status of all critical system parameters (see § 27.1353(e)).
Accordingly, warning, caution, or advisory indication must be provided appropriate to any hazard condition. Section 91.167 requires Rotorcrafts approved for IFR operations have sufficient back-up power to operate a minimum set of required equipment for a time long enough to find a suitable place to land and effect a safe landing if primary power generation fails. The minimum time for IFR is 30 minutes. Additionally, for rotorcraft that employ electrical power for starting, to meet the requirements in § 27.1351, the energy storage system must have sufficient capacity to provide adequate engine starting on the ground, and also to provide power for the air start function, when required. The power requirement for air start could have high-level safety considerations depending on the rotorcraft power distribution system and the number of engines.
(B) The energy storage system must be qualified for the specific location and rotorcraft environment. Acceptable environmental test procedures may be found in RTCA DO-160, which provides test procedures to meet a wide range of environmental conditions that may exist on a wide variety of aircraft. Environmental tests should meet or exceed the expected installation environment. In addition to the environmental qualification, the equipment and installation design should consider the risk of explosion presented by the production of gases that occur during normal operation or as a result of any failed condition. An explosive resistant case or safe venting may be an acceptable way of showing compliance if it is shown that structure and essential systems do not suffer hazardous effects that jeopardize continued safe flight and landing.
(C) Energy storage systems shall have protective features to prevent unsafe conditions during operation. The protective features shall automatically control all critical operational parameters of the system in order to prevent any unsafe condition. The term “automatically” is intended to preclude pilot action as a mitigating feature and is not intended to require a specific mitigating design feature. Development assurance levels (DAL) for hardware and software that implement monitoring and control functions should be commensurate with the effect associated with system failure. An acceptable certification process for airborne software is found in AC 20-115 and, for complex hardware, in AC 20-152.
(D) The occurrence of self-sustaining, uncontrolled increases in temperature or pressure must be prevented for normal energy storage system operation or as a result of a failure of any part of the system installation (see § 27.1353(d)).
System architecture should ensure that a component failure does not propagate to adjacent components. A safe design may require a compartmentalized structure to prevent cascading failures. Any required monitoring and control functions implemented in hardware or software should have a DAL commensurate with the hazard associated Page F - 62.3
AC 27-1B, Chg 9 with the loss of function. Installation design features to mitigate explosive increases in temperature or pressure may be required if energy storage system DALs are not suitable for the inherent hazard.
(E) Fluids or gases that may escape from an energy storage system or its installation may not damage surrounding structure or any adjacent systems, equipment, or electrical wiring of the rotorcraft (see § 27.1353(c)). Installation design data should include features to contain, vent, or drain these fluids or gases away from the rotorcraft. Flight tests may be required to evaluate the effectiveness of venting or draining throughout the normal operating envelope.
(F) Explosive or toxic gases that may be emitted by an energy storage system must not accumulate in hazardous quantities within the rotorcraft (see § 27.1353(b)). Installation design data should include features to contain or vent these gases away from the rotorcraft. Flight tests may be required to evaluate the effectiveness of venting or draining throughout the normal operating envelope.
(G) The energy storage system and its installation must prevent any hazardous effects on the rotorcraft structure or other installed systems caused by the maximum amount of heat generated during normal operation or by a failure of any part of the energy storage system or its installation (see § 27.1353(d)). Shielding, cooling, or venting provisions may be required to ensure that temperatures do not exceed allowed temperatures of any adjacent equipment, electrical wiring, hydraulic lines, or structure.
(H) Energy storage system temperatures and pressures must be maintained within a safe operating range during all foreseeable charging and discharging conditions, and during any failure of the control or monitoring functions (see § 27.1353(d)). Energy storage system installation design features must mitigate all hazards associated with monitoring and control failures (see § 27.1353(e)). The monitoring and control function implemented in hardware or software should have a DAL commensurate with the hazard associated with the loss of function.
(I) The instructions for continued airworthiness (ICA) must include maintenance requirements to ensure that required energy storage system maintenance functions are performed at appropriate intervals specified for each energy storage system component, to meet the requirements in Appendix A to Part 27. This is necessary to ensure system performance will not degrade below specified energy levels sufficient to power Rotorcraft systems for intended applications. Similarly, the ICA must also include procedures for the maintenance of energy storage system components in spares storage to prevent the replacement of components with stored components that have experienced degraded functional capability or other damage due to prolonged storage. Replacement energy storage system components must be of the same manufacturer and part number as initially approved, unless additional installation approval is obtained (see § 21.9(a)). Precautions should be included in the ICA maintenance instructions to prevent mishandling of the energy storage system components that could result in unintentional impact damage caused by dropping or other destructive means that could result in personal injury or property damage.
Page F - 62.4
AC 27-1B, Chg 9 (J) The energy storage system installation approval should consider the adequacy of associated interface components that may affect system performance.
Components necessary to interface with the energy storage system to provide functionality should be shown to perform their intended function for the installation environment and operations. These components should be qualified to meet the most severe environment of the installation and operate properly within all specified limits.
Operational limits should be set for all energy storage system parameters identified as critical for safely performing the intended function. The intended function of energy storage system and knowledge of the charging function supplied by the rotorcraft are major design considerations. The type of charging function may be a major factor in determining the required design assurance level. If the energy storage system is not adequately charged, the capacity may not be available, when required, to meet emergency power demands. Overcharging has been shown to result in a thermal runaway with certain battery chemistries. Monitoring and control functions may be required to prevent safety critical parameters from exceeding specified limits. Such critical parameters may include charging currents, fault currents, temperature, or pressure.
(iii) Batteries are widely used as energy storage devices and utilize different chemistries that may affect their performance. For the purpose of this guidance, a battery or battery system is referred to as a battery.
Battery chemistries in widespread use today are lead acid, nickel cadmium, and lithium.
Each type exhibits different failure modes. These batteries also come in a wide range of sizes and energy density. Large batteries are used for engine starting and as systems’ backup power in the event all electrical generation capacity is lost. Smaller batteries are used in many electrical components independent of the aircraft power generation and distribution systems. Some of these batteries are non-rechargeable and some are recharged by an electrical generation system. The hazard analysis should take into account the failure modes, the intended function, and the supporting rotorcraft interface.
(iv) A significant design issue associated with batteries is internal impedance.
Low internal impedance usually characterizes batteries capable of high discharge rates.
Starting and fault clearing requirements are typically best satisfied by batteries with low internal impedance. The other extreme is batteries with high internal impedances that are generally more economical and perform low rate, long-time interval discharges well.
These types of batteries can provide the emergency power for equipment efficiently. If both starting/fault clearing and emergency power requirements are to be provided using a single battery, a workable compromise on the internal impedance should be accomplished.
(v) Lead acid batteries have been used in aircraft for many years. As such, the failure modes are well documented. These batteries contain corrosive materials, and consideration should be given to protect rotorcraft structures and systems from inadvertent leakage. Hazardous gases may also be released under certain conditions;
Page F - 62.5
AC 27-1B, Chg 9 thus, a means to safely contain, vent, or drain hazardous fluids or gases should be employed.
(vi) Nickel cadmium (Ni-CAD) batteries have also been used for many years in aircraft. These batteries have a wide application from the main starting battery to smaller batteries integrated into individual equipment.
(A) Twenty cell Ni-CAD batteries have been used to prevent thermal runaway; however, aircraft bus level voltage may not be an adequate source to properly charge a 20 cell Ni-CAD battery. The nominal voltage of a Ni-CAD cell is 1.5 volts and if the number of battery cells is 20 then; 1.5 Volts/Cell X 20 Cells = 30 volts required to even match the nominal voltage of the installed battery. (This is actually inadequate to charge the Ni-CAD cell, as a few tenth volts above that of the nominal voltage is required.) The maximum rotorcraft bus voltage available is typically 28.5 volts, which is deficient by 1.5 volts to just meet the nominal battery voltage. A compensating factor for this battery charging design is to require frequent battery maintenance activities. Future battery installation designs should not depend on the use of frequent battery maintenance as a compensating factor for designs that are inherently deficient in battery charging capability. Battery charging from the rotorcraft bus voltage is the prevalent method used to charge batteries, since no separate battery charger is needed. However, for the 20 cell Ni-CAD example, using the rotorcraft bus voltage as the battery-charging source can introduce battery capacity limitations. Several options are available to address these concerns. One option would be to use a 19-cell battery.
Since Ni-CAD batteries were first introduced, much has been learned about their care and use, plus design improvements have been made that lessen the possibility of thermal runaways. Another approach could be to oversize the battery capacity, recognizing that the battery will be in a “less than” nominal capacity condition. This philosophy would also carry with it a Certification Maintenance Requirement.
Compliance could also be shown by using a dedicated battery charger that can profile the charging based on state of charge. This can be much more efficient and make it possible to have a better charged battery with less frequent maintenance and increased battery life.
(B) If Ni-CAD batteries are used for engine starts and compliance with a requirement is achieved through the use of a temperature monitoring system, the temperature sensor should be located in a position that will most accurately reflect the internal battery temperature without causing adverse effects to the sensor. The location normally used is near the center of the battery. If the sensor is placed between two cells, the indication should be very close to the actual temperature within the cell. If the sensor is placed in a cell strap, there will normally be a period of time just after a heavy current drain (e.g., engine start) when the sensor shows a temperature that is hotter than the actual cell temperature.
Page F - 62.6
AC 27-1B, Chg 9
(vii) For battery replacement with any battery other than the one that was installed and accepted as part of the original type design, consideration of several aspects of battery design and installation is important to ensure that the type design is not negatively impacted.
(A) The replacement battery should provide at least the minimum usable capacity as required by the current load analysis. This requirement of minimum usable capacity should be valid over the entire range of environmental conditions. Different types of batteries have different inherent characteristics. Ni-CAD batteries have a voltage discharge curve that allows most of the amp-hour capacity to be usable from a delivered voltage standpoint, where only about 66% of the amp-hour capacity for lead acid batteries is usable due to the delivered voltage becoming too low to use. If a replacement battery has a similar discharge rate, and the capacity is similar throughout the original battery’s environmental range, then no further testing should be needed.
(B) An analysis for a replacement or system modification may be needed to show that the electrical system still complies to the original operation under IFR and Category A certification requirements for rotorcraft that depend on fault clearing features. Subsequent analysis validation by testing may be needed in those cases where the system that provides fault clearing is difficult to evaluate by analysis alone. In these cases, the effects of a change in battery internal impedance on the fault clearing features is uncertain and may not be adequately determined by analysis. There are high rate discharge types of batteries and slow-rate discharge batteries that have different internal impedances and their behavior in a fault clearing circuit is also different. The regulatory basis for analysis and testing for fault clearing is contained in Appendix B to part 27 and appropriate Category A requirements.
(viii) There are widespread applications of batteries utilizing various lithium chemistries in aircraft today. These batteries are used as the main start battery and can be found integrated into various equipment installations. They furnish independent back up power to required equipment and many non-required applications such as entertainment systems. There are several different lithium battery chemistries available with a range of stability. Some of these lithium chemistries have been shown to be relatively unstable with failure modes that can result in explosive thermal runaway under certain conditions. A hazard analysis and system safety analysis should be accomplished, and design mitigation features should be tailored to mitigate hazards associated with the particular application.
(A) An acceptable means to show compliance with the § 27.1353 airworthiness requirements for installed rechargeable lithium battery and battery systems on rotorcraft is found in AC 20-184, Guidance on Testing and Installation of Rechargeable Lithium Batteries and Battery Systems on Aircraft. AC 20-184 provides Page F - 62.7
AC 27-1B, Chg 9 guidance for obtaining installation approval for installed rechargeable lithium battery and battery systems on rotorcraft.
(B) Installation requirements for installed non-rechargeable lithium batteries have some common attributes with rechargeable lithium batteries. These batteries usually exhibit less capacity and a hazard risk proportional to the capacity, but may also supply a critical and required function.
1. Each non-rechargeable lithium battery installation should address the following ten objectives, which are critical for safe installation:
Objective 1: Maintain safe cell temperatures and pressures under all foreseeable operating conditions to prevent fire and explosion.
Objective 2: Prevent the occurrence of self-sustaining, uncontrollable increases in temperature or pressure.
Objective 3: Prevent any emission of explosive or toxic gases that may accumulate in hazardous quantities, either during normal operation or as a result of a failure.
Objective 4: Meet the flammable fluid fire protection requirements of § 27.863.
Objective 5: Prevent corrosive fluids or gases that may escape from damaging surrounding structure or adjacent systems, equipment, or electrical wiring.
Objective 6: Prevent any hazardous effect on rotorcraft structure or systems caused by the maximum amount of heat generated from any battery or individual cell failure.
Objective 7: Automatically control the discharge rate of each cell to prevent cell imbalance, back charging, overheating, and uncontrollable temperature and pressure.
Objective 8: Automatically disconnect the battery in the event of an overtemperature condition, cell failure, or battery failure.
Objective 9: Alert the flight crew if an equipment state or failure affects safe operation of the rotorcraft.
Objective 10: Have a means for the flight crew to determine the battery charge state (for required battery systems).
Note: A battery system consists of the battery and any protective, monitoring, and alerting circuitry or hardware inside or outside of the battery. It also includes vents (where necessary) and packaging.
Page F - 62.8
AC 27-1B, Chg 9
2. The following means of compliance (MOC) have been accepted to ensure that the battery meets the objectives discussed above. Some failures may still occur due to various factors beyond the control of the designer; these MOCs are also intended to protect the rotorcraft if such failures occur.
Note: Some of the methods below reference RTCA DO-347, Certification Test Guidance for Small and Medium Size Rechargeable Lithium Batteries and Battery Systems, dated December 18, 2013. Although DO-347 provides standards for small and medium sized rechargeable lithium batteries, the FAA considers these tests appropriate as guidance for similar sized non-rechargeable lithium batteries. Procedures that are only applicable to rechargeable batteries (such as connecting input power) need not be performed. When a test method specifies charging the battery before the test, a new fully charged battery should be used.
i. MOC for Objectives 1, 2, and 7:
(a) Meets the requirements in paragraph 3 of TSO-C142a, Nonrechargeable Lithium Cells and Batteries;
(b) Meets the criteria to pass in Appendix 1, Table 2 of TSO-C142a;
and
(c) Passes the following tests in RTCA Document DO-347:
1. Section 2.3.7 Short-circuit Test of a Cell
2. Section 2.3.8 Short-circuit Test with Protection Enabled
3. Section 2.3.9 Short-circuit Test with Protection Disabled
4. Section 2.3.10 Insulation Resistance Test
5. Section 2.3.15 Thermal Runaway Containment Test: Perform step e. of test method 2.3.15.1 in lieu of steps c. and d.
(d) Objective 1 requires that each individual cell within a battery be designed to maintain safe temperatures and pressures. These same issues are also critical at the battery level. Objective 2 requires the battery to be designed to prevent propagation of a thermal event (i.e., self-sustained, uncontrollable increases in temperature or pressure) from one cell to adjacent cells.
ii. MOC for Objective 3: RTCA Document DO-347, section 3.1.3 discusses potential gas emissions from batteries and their effects. Acceptable means of Page F - 62.9
AC 27-1B, Chg 9 complying with Objective 3 include using the tests required by the MOC for Objectives 1, 2 and 7 to demonstrate that all emitted gasses are contained or vented overboard through designed ports. Objective 3 does allow explosive and toxic gases to be uncontained and not vented overboard if they do not accumulate in hazardous quantities within the rotorcraft. If you choose to use the test data to demonstrate compliance by this means, explain how you will demonstrate that hazardous quantities of gases will not accumulate within the rotorcraft. If your design will have ports to vent gases overboard, ensure there is a means to protect ground personnel from exposure to these gases.
iii. MOC for Objective 4: Section AC 27.863 of this guidance, subparagraph (c), provides an acceptable method of compliance for flammable fluids.
iv. MOC for Objective 5:
(a) Show that if fluid escapes the battery, it is not corrosive or it is managed in a way (e.g., contained, isolated or vented overboard) that protects the surrounding structure and adjacent systems, equipment, and electrical wiring.
(b) Any failure of the battery includes, but is not limited to, internal and external short circuit. See the tests listed in the MOC for Objectives 1, 2, and 7 for Failure Conditions that are evaluated.
v. MOC for Objective 6:
(a) Force a cell in the battery into thermal runaway by conducting the RTCA Document DO-347, section 2.3.15, Thermal Runaway Containment Test.
Perform step e. of test method 2.3.15.1 in lieu of steps c. and d. when conducting this test.
(b) Show that the effects of the heat and any related effects do not constitute a hazard to the structure or systems of the rotorcraft. If the effects of the heat or any related effects constitute a hazard to the structure or systems of the rotorcraft, design mitigation at the aircraft level may be applied to bring the design into compliance with Objective 6.
vi. MOC for Objective 8: A well designed disconnection system will function during the tests required by the MOC for Objectives 1, 2, and 7, except for the test in RTCA Document DO-347, section 2.3.9, where the protection is already disabled.
This is one of the means of preventing the Failure Conditions discussed in the Evaluation Criteria sections of RTCA Document DO-347 for these tests. Confirm the battery automatically disconnects from its discharging circuit during these tests.
Page F - 62.10
AC 27-1B, Chg 9 vii. MOC for Objective 9: Objective 9 specifies flight crew alerting if the failure of a battery installation, in itself or in relation to a system that performs an aircraft-level function, could result in “unsafe system operating conditions.” The alert should comply with the applicable color requirements in § 27.1322. The applicant should refer to Section AC 27.1322 for an acceptable method of compliance.
viii. MOC for Objective 10: The following are examples of “means” for flight crew or maintenance personnel to determine the battery charge state:
(a) A manually activated system (e.g., push button) that displays the available charge of each battery unit.
(b) An automatic system that records the available charge of each battery unit on an appropriate interval and makes it available to maintenance personnel before the next flight.
(c) Physical access that allows a maintenance person to measure the battery charge state.
3. The MOCs for Objectives 1 through 10 are only acceptable for required functions if ICAs include a check of the battery charge state within an interval that will ensure sufficient charge for each flight considering the worst case scenario and replacement of the battery when the charge is not sufficient.
4. MOC for Very Small Non-Rechargeable Lithium Batteries:
An acceptable MOC for Objectives 1 through 8 for non-rechargeable lithium battery installations that have less than 2 watt-hours of energy is showing these batteries meet Underwriters Laboratories (UL) 1642 or UL 2054.
(ix) Part 27 Compliance. Non-rechargeable lithium battery installations should satisfy each of the MOCs identified in this guidance to comply with all applicable part 27 requirements. The following provides means of compliance and other information on some part 27 requirements:
(A) System Safety Assessment. Although these hazard conditions require specific functionalities and capabilities and address certain critical failure modes of nonrechargeable lithium batteries and their installations, the applicant must also meet the requirements of § § 27.1301 and 27.1309. To date, in-service experience has shown that non-rechargeable lithium battery thermal/pressure runaway conditions are not extremely improbable. Assume such failures could occur sometime during the life of the battery installation when demonstrating compliance with § 27.1309. Application of Page F - 62.11
AC 27-1B, Chg 9 § 27.1309(b) and (c) may result in required periodic maintenance actions or flight crew alerting features. For example, an over-temperature warning system may be necessary to allow the flight crew to manage potentially unsafe system operating conditions.
Provide rationale for alerting requirements (or for why an alert is not needed) in the system safety assessment of the battery installations to demonstrate compliance with § 27.1309(c). Such alerts, if provided, must comply with § 27.1322.
(B) The ICA should include the following provisions to comply with § 27.1529:
1. Maintenance requirements to replace each non-rechargeable lithium battery within an interval that will ensure there is sufficient charge to power equipment.
2. A requirement to only replace non-rechargeable lithium batteries with batteries from the same manufacturer with the same part number or to obtain a new FAA approval for installing a different battery. Refer to the battery Original Equipment Manufacturer’s maintenance manual.
3. Procedures to ensure that each non-rechargeable lithium battery has not:
i. Experienced degraded charge retention ability or other damage during storage.
ii. Been damaged from environmental or physical impacts such as mechanical shock, vibration, heat and possible abuses encountered during storage, transportation prior to their installation, or maintenance activities on or around them.
iii. Precautions to prevent mishandling of replacement nonrechargeable lithium batteries prior to their installation that could result in short-circuit or other unintentional damage.
Note: Acceptable procedures for paragraphs b(2)(ix)(B)3.i. and b(2)(ix)(B)3.ii. may include a quality control process for packaging, storing, maintaining, and transporting non-rechargeable lithium batteries, including reporting of dropped or damaged batteries.
Page F - 62.12
AC 27.1357. § 27.1357 (Amendment 27-13) CIRCUIT PROTECTIVE DEVICES.
a. Explanation. Circuit protective devices are normally installed to limit the hazardous consequences of overloaded or faulted electrical circuits. These devices are resettable (circuit breakers) or replaceable (fuses) to permit the crew to restore service when nuisance trips occur or when the abnormal circuit condition can be corrected in flight.
b. Procedures.
(1) The circuit protective devices for systems essential to safety in flight should not be tripped by faults in other circuits.
(i) Systems that are essential to safety in flight are generally those systems that are required to show compliance with the regulations. These essential systems include the basic electrical system, the distribution system, and many electrical utilization systems.
(ii) An electrical ut ilization system is a system of electrical equipment, devices, and connected wiring using electrical energy to perform a specific aircraft function.
(iii) The specific utilization systems, which are necessary to maintain controlled flight and land safely, will vary w it h the type of rotorcraft and with the nature of operations. Examples of systems that may be essential are basic flight instruments, minimum navigation equipment, minimum radio communications, and flight control systems.
(2) Automatic reset circuit breakers, which automatically reset themselves, should not be used as circuit pr otectiv e devices. If an abnormal circuit condition cannot be corrected in flight, the decision to restore power to the circuit should result from a careful analysis by the flightcrew and cannot be performed by automatic reset circuit breakers. To ensur e crew supervision over the reset operation, circuit protective Page F - 62.13 AC 27-1B, Chg 4 3/31/2014
devices should be designed to require a manual operation to restore service after tripping. Circuit breakers must be designed such that the tripping mechanism cannot be overridden by the operating control. These are known as the “trip free” type.
(3) This section requires protective devices for circuits essential to safety in flight to be accessible to the flight crew in the cockpit. These devices should be also readily accessible to the flight crew in the event it becomes necessary to manage smoke caused by an electrical failure. Their accessibility should also permit the flight crew to easily determine if they are in the “tripped” position prior to flight. Again, this generally applies to systems required for compliance as discussed above. If continued safe flight to the destination is sufficiently assured, certain required circuits have been excepted from this accessibility. Voltmeter and ammeter circuit protective devices are examples of ones that have been excepted. Some utilization systems, although not specifically required by part 27, may be required for the particular design to be certified.
Circuit protective devices for these systems should be accessible. The following are considered acceptable compliance with the “readily reset” provision of this guidance:
(i) For operation by a single pilot with seat belt and shoulder harness normally adjusted, the pilot should be able to identify and reset or replace the opened circuit protector while flying the rotorcraft. Circuit protection should not be located aft of a vertical plane passing left to right (laterally) through the pilot’s body.
(ii) For a crew of two, it is satisfactory for one crewmember to move his seat and loosen his shoulder harness to identify and reset or replace the circuit protective device. It is not satisfactory for one of the crewmembers to leave his seat to reset or replace the circuit protective device.
(4) A switch is a device intended for regular use to open or close a circuit. A circuit breaker is a device that protects a circuit by opening automatically at a predetermined current overload. Systems should be designed such that the primary means to remove or reset the power supply in normal operations is by means of a switch. The use of a circuit breaker for such normal operations is unacceptable, as it is not being used for its intended function.
Note: A switch-rated circuit breaker may be used for this function if it can be shown to be suitable for the number of switch cycles expected to be performed during the service life of the system.
(5) The spare fuse requirement applies only to fuses protecting systems required to show compliance with the regulations. Spare provisions need not be made for non-required convenience type installations, although it is encouraged. The spare fuses should be stored in a location readily accessible to the crew. For spare fuses not directly visible to the crew, location information should be provided. One acceptable location is on the fuse panel in a holder without wire terminations. The spare fuse should be identified “spare” with the fuse rating.
Page F - 63