CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG)
AC 27 MG 3. DEFINITION OF ENGINE ISOLATION FEATURES AS APPLIED TO §§ 27.79(b)(2), 27.141(b)(1), and 27.143(d)(1) (Amendment 27-19).
a. Explanation.
(1) Each of the cited performance and flight characteristic sections of Part 27 mention multiengine rotorcraft meeting transport Category A engine isolation requirements or refer to engine isolation features which ensure continued operation of the remaining engine. Unlike normal category fixed- wing (Part 23, § 23.903(c)) and the transport category fixed-wind and rotorcraft regulations, Part 27 does not provide a general engine isolation rule to make this determination.
(2) While it is clear that Part 27 does not require complete engine isolation, if credit for this feature is claimed (i.e., sudden complete engine power failure is not considered in showing compliance with the cited section), criteria must be established to allow a satisfactory isolation assessment.
(3) An approach which the FAA/AUTHORITY would find acceptable in making a Part 27 engine isolation determination is given. The FAA/AUTHORITY logic for establishing this criteria is also presented.
b. Criteria.
(1) The engine isolation provided may be for an appropriate limited time period.
(2) The failure or malfunction of any engine or the failure of any system that can affect any engine will not--
(i) Prevent the continued safe operation of the remaining engines for the appropriate limited time period; or
(ii) Require immediate action by a crewmember for continued safe operation.
(3) Each engine must be isolated by a firewall, shroud, or equivalent means from the remaining engines.
c. Criteria Rationale.
Page MG 3 - 1
(1) Category A Minimum Time for Isolation. The acceptance of a limited time period for engine isolation is consistent with the acceptance of a reduced level of safety for a Part 27 rotorcraft. The criteria is also consistent with the Part 27 philosophy of allowing for a controlled landing following engine failure versus the Part 29 Category A principle of continued safe flight and a controlled landing.
(2) Installation Analysis.
(i) The degree of engine isolation can be established by an installation assessment against the § 29.903(b) general isolation requirement, as modified for Part 27 by a limited time period concept.
(ii) Figure AC 27 MG 3-1 is a listing of the Part 29 sections that may be involved in Category A engine isolation considerations. Sections 29.901(c) and
29.903(b) are the general isolation regulations under which the other more specific rules naturally fall. The point that the selection of specific rules from figure AC 27 MG 3-1 does not achieve the desired degree of transport Category A engine isolation, and that the general isolation rules (§§ 29.901(c) and 29.903(b)) must be used, is illustrated by the following examples.
(A) Example #1. No specific requirement from Part 29 (or figure AC 27 MG 3-1) can be cited which precludes a common engine mount. The design of the mount could be such that its failure results in sudden, complete power loss from all engines.
(B) Example #2. No specific Part 29 requirement prohibits a common engine induction system. F.O.D., fire in the induction system, or the adverse affect of engine surge on the remaining engine could result in sudden, complete power loss from all engines.
(C) Example #3. Crosstalk between engine fuel controls (possibly used for power matching) or the use of a common input parameter signal to the fuel controls is not prohibited by any specific isolation rule. Signals could be received which command the simultaneous shutdown of all engines.
(iii) These examples clearly illustrate that specific Part 29 isolation rules cannot be selected to establish appropriate Part 27 engine isolation, and that the installation must be evaluated by the general isolation policy set forth. This can be readily accomplished by a failure mode and effects analysis (FMEA).
(3) Firewalls.
(i) CAR 6.483, prior to Amendment 6-4, effective May 15, 1953, requires “All engines, auxiliary power units, fuel burning heaters, and other combustion equipment which are intended for operation in flight shall be isolated from the remainder Page MG 3 - 2
of the rotorcraft by means of firewalls, shrouds, or other equivalent means.” This rule would clearly require a firewall between engines of multiengine rotorcraft.
(ii) Amendment 6-4 revised § 6.483 to read “Engines shall be isolated from personnel compartments by means of firewalls, shrouds, or other equivalent means. They shall be similarly isolated from the structure, controls, rotor mechanism, and other parts essential to a controlled landing of the rotorcraft . . .” (remainder essentially identical to current § 27.1191).
(iii) The preamble explanation of Amendment 6-4 states that these changes are “intended to afford greater protection to the crew and passengers in the event of fire during flight.” This revision did not intend to authorize less firewall isolation between the engines than was required by the earlier version. Also, the subsequent paragraphs clearly require firewalls between other combustion equipment and the rest of the rotorcraft (§ 27.1191(b)). To accept anything less for the engine is clearly inappropriate. Further, § 23.1191 requires firewalls or equivalent means between each engine and the rest of the airplane, and current safety requirements pertaining to in-flight fires should be no less stringent for normal category rotorcraft.
(iv) The lack of a firewall between engines or any other design arrangements which, in the event of one engine failure creates definable jeopardy for the remaining engines, will result in a significantly lower level of safety than is being assumed by the operators.
(v) A regulation change to clarify this § 27.1191 rule is planned.
d. Guidance.
(1) The minimum appropriate limited time period of engine isolation which would allow establishment of a one-engine-inoperative HV diagram, § 27.79(b)(2), would be defined by the time increment to recognize the engine failure and to make a landing from the most critical point on the desired HV diagram.
(2) The minimum appropriate limited time period of engine isolation to show compliance with §§ 27.141(b)(1) and 27.143(d)(1) considering the sudden power failure of one engine (rather than sudden complete power failure) would be the time increment to recognize the engine failure and to transition to a flight condition where failure of the remaining engine can be tolerated.
(3) Some existing provisions of Part 27 require isolation of certain systems (oil, fuel, and engine controls) without regard to a limited time period. These existing Part 27 engine isolation provisions must be observed regardless of the policy discussed herein.
(4) The limited time period concept must not be utilized to eliminate protection otherwise required by specific rules of Part 27 or to reduce accepted test conditions.
For example, lines which carry flammable fluids in areas subject to engine fire Page MG 3 - 3
conditions must be fire resistant (§ 27.1183(a)). Fire resistant hose standards require testing for at least 5 minutes at 2000° F.
(5) A failure mode and effects analysis (FMEA) should establish that the failure or malfunction of any engine or the failure of any system that can affect any engine will not--
(i) Prevent the continued safe operation of the remaining engines for the appropriate limited time period.
(ii) Require immediate action by a crewmember for continued safe operation.
(6) As cited earlier, by example, selection of specific engine isolation rules from Part 29 is not effective in assuring that a sudden, complete engine power loss does not occur.
(7) Under the limited time period concept, failure of the second engine must be considered upon expiration of the limited time period. The Rotorcraft Flight Manual must provide the appropriate operating limitations, pilot operating procedures, and performance information limitations to assure continued safe operation following failure of the second engine.
Page MG 3 - 4
FIGURE AC 27 MG 3-1 Part 29 Engine Isolation Rules § 29.861(a)
§ 29.901(c)
§ 29.903(b) and (c) and (e)
§ 29.908(a)
§ 29.917(b) and (c)(1)
§ 29.927(c)(1)
§ 29.953(a)
§ 29.1027(a)
§ 29.1045
§ 29.1047(a)
§ 29.1181(a)
§ 29.1189(c)
§ 29.1191(a)(1)
§ 29.1193(e)
§ 29.1195(a) and (d)
§ 29.1197
§ 29.1199
§ 29.1201
§ 29.1305(a)(6) and (b)
§ 29.1309(b)(2)(i) and (d)
§ 29.1331(b)
Page MG 3 - 5
Page MG 3 - 6
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG)
AC 27 MG 4. FULL AUTHORITY DIGITAL ELECTRONIC CONTROLS (FADEC)
a. FULL AUTHORITY DIGITAL ELECTRONIC CONTROLS (FADEC) FOR INSTALLATIONS WITH CATEGORY A ENGINE ISOLATION.
(1) Background. The advent of “microprocessor technology” has resulted in rotorcraft engine controls being implemented by digital process control rather than by conventional means. These digital, processor -based full authority engine controls offer many performance advantages (such as isochronous governing) which were not feasible with conventional technology, pneumatic or hydromechanical controls.
Because of the incorporation of this advanced technology, some additional considerations must be made of the engine installation to ensure regulatory compliance.
(i) Part 27 does not require engine isolation. The guidance herein does not address FADEC installation certifications which do not desire engine isolation credit.
(ii) In showing compliance with certain performance and flight characteristic sections of Part 27, simultaneous malfunction of engines is not considered if Part 29 Category A engine isolation is achieved. Paragraph AC 27.MG 3 describes, in terms of Part 29 Category A requirements, an acceptable approach for determining that engine isolation, adequate for Part 27 performance and flight characteristic credit, has been achieved. That guidance material should be reviewed, but it is not believed that the limited-time-period concept for engine isolation which could be allowed under Part 27 would affect the FADEC installation requirements. Hence, the guidance for a Part 27 aircraft claiming credit for engine isolation is essentially the same as for a Part 29 Category A rotorcraft.
(2) Procedures. The following is a discussion of some special attention areas when a FADEC installation is to be shown to comply with the Part 29 Category A engine isolation requirements. Paragraph AC 27.1309b(4)(i)(D) of this AC contains a general definition of what constitutes a “full authority” control.
(i) Software Qualifications.
(A) Paragraph AC 27.1309f contains a general discussion on the use of the RTCA/DO-178B document that is used for the approval of system software.
FADECs are generally developed to Level A software under RTCA Document DO-178B based on the hazard category of the FADEC failure condition(s). However, if an applicant proposes a FADEC with Level B software based on the Functional Hazard Page MG 4 - 1
Assessment results, this will require the proposal to be reviewed and approved by both the Engine Directorate and the Rotorcraft Directorate.
(B) RTCA/DO-178A may still be applicable for those FADECs that were previously developed and approved under DO-178A and the applicant is proposing to make changes to the FADEC software. However, if the applicant proposes to make changes to a DO-178A approved FADEC, the determination on whether the changes should be made under DO-178B or DO-178A will need to be made by the Engine Directorate and Rotorcraft Directorate. When utilizing DO -178A, one might arrive at the conclusion that the engine control, as a required function, is essential; therefore, level 2 software under DO-178A would be appropriate for the control functions. However, for this level 2 category software, errors are presumed to exist and a software error in a full authority control could result in simultaneous unacceptable malfunctions in all engines.
The provisions of § 27.1309(b) for the rotorcraft installations to be designed such that no probable malfunction or failure would result in a hazard to the rotorcraft, and the Part 29 engine isolation rule § 29.903(b) would generally preclude this level 2 classification.
(C) System designs which provide redundant distinctive software or an alternate technology control which is automatically selected and meets all of the minimum regulatory requirements would reduce the impact of software errors and may allow the level 2; i.e., essential, software classification. At level 1, it is accepted that the software is sufficiently error free that the software does not require further verification in the installation evaluation.
(ii) Lightning Strike Protection. Paragraph AC 27.1309b(4) contains a complete discussion of an acceptable method of demonstrating that the FADEC, as installed, is adequately protected against the catastrophic effects of lightning.
(iii) Electrical Power System Considerations.
(A) Normal Operation. The system should be evaluated with all power sources operating normally. If additional power source capability is being provided that is above the minimum required for certification, a certain portion of the evaluation should be conducted while operating in the minimum configuration.
(B) Malfunction Conditions. Beginning with the minimum configuration that is required for certification, electrical power system malfunctions should be introduced and the impact on continued FADEC operation determined.
(C) Circuit Protection Location. The circuit protective devices for the FADEC should be located in the cockpit such that they can be readily reset or replaced in flight. The operation of the FADEC system is considered to be essential to safety in flight. Reference § 27.1357(d). The definition for “essential to safety in flight” is given in AC 27.1357b(1)(i).
Page MG 4 - 2
(D) System Separation. On multiengine applicat ions, each system should be separated from the other system to the maximum extent practical. Wiring should be routed separately. Power should be taken from independent busses and grounds, and system components should be independent of one another.
(E) Periodic Checks. Where periodic checks are appropriate, they should be made at reasonable intervals. This would normally range from preflight checks for certain items of greater concern to a tie-in with normal aircraft maintenance intervals for other items. If a crew check is specified, it should be evaluated to ensure it is a reasonable check. If items to be checked are located in an area that can be covered by interior upholstery, for example, a crew check would not be considered reasonable, and further design considerations may be in order.
(iv) Powerplant Installation Considerations.
(A) Paragraph AC 27 MG 3 cites certain Part 29 provisions as being appropriate if engine isolation is claimed for a Part 27 rotorcraft. The guidance which follows, in part, references two Part 29 general engine isolation rules, §§ 29.901(c) and
29.903(b)(2), which should be considered.
(B) A demonstration of compliance with § 29.901(c) would generally include a failure mode and effects analysis (FMEA) of the powerplant systems as installed. When a FADEC is utilized, the analysis would consider the control’s failure modes, the installed engine reaction, the affect on the aircraft, and the crew response to the situation. Combinations of undetected failures should be considered. Engine failures which may be escalated in severity by the FADEC’s response to the initial failure should be analyzed. Potentially hazardous failures should be evaluated during flight testing. The requirements of § 29.903(b)(2) and § 27.1309(b)(2)(i) should be reviewed in determining acceptability of failures.
(C) Section 29.903(b)(2), Category A engine isolation, is intended to ensure that a failure will not prevent the continued safe operation of the remaining engine(s) or require immediate action of the crew to ensure continued safe operation.
The FADEC’s of the individual engines should be independent. Where communication between FADEC’s is required (for example, for torque sharing), care should be exercised to ensure that failures which may occur will not result in a power loss to the extent that total power available is less than would be available under OEI conditions.
The no-required immediate-crew-action provision would preclude credit for manually selected or operated backup systems in meeting the § 29.903(b) rule. These unrequired backup systems, which may offer the advantage of get-home multiengine capability rather than forced OEI operation, would be evaluated on a no hazard basis.
(D) Section 27.939, turbine engine operating characteristics, intends a flight investigation to ensure that no adverse characteristics are present to a hazardous degree during normal and emergency operation in the allowed flight envelope. The evaluation should include assessment of the minimum FADEC system certification Page MG 4 - 3
configuration; i.e., the minimum proposed by the applicant to meet Part 27 requirements. Reduced capabilities (e.g., restrictions on normal collective movements, limited aircraft maneuvers, etc.) may be acceptable for degraded FADEC modes or backup systems not required to meet Part 27 requirements if those degraded capabilities are reasonable and not hazardous as determined by flight evaluation. The restrictions should be specified in the flight manual.
(E) The rotorcraft with FADEC engines must of course meet all of the Part 27 requirements, but the areas described herein are those which deserve special attention.
b. SINGLE CHANNEL FULL AUTHORITY DIGITAL ENGINE CONTROLS (FADEC) IN SINGLE ENGINE ROTORCRAFT APPLICATIONS.
(1) Background. The purpose of this appendix is to provide guidance for compliance to Part 27 and Part 29 Category B regulations when the powerplant installation is a single engine fitted with a single channel FADEC system. The application of single channel FADECs in single engine helicopters requires special considerations because this combination can have a higher probability of FADEC-related malfunctions that could result in loss of ability to execute a controlled power-on landing or operate safely throughout the flight envelope, relative to dual channel FADEC systems or multiengine installations. The issues that should be addressed by the applicant are criticality level of failures as determined from the engine system safety analysis (SSA), the resulting integrity requirements, capability to detect and present failure/fault data to the crew, and the ability of the crew to manage any failures/faults. The term “must” in this policy is used in the sense of ensuring the applicability of these particular methods of compliance when the acceptable means of compliance described herein is used. This policy establishes an acceptable means, but not the only means of certifying a single channel FADEC for single engine application.
(2) Definitions.
(i) Fault or Failure. An occurrence which affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
(ii) Integrity. The term “integrity” for the purpose of this policy includes the hardware reliability requirements as well as the software level requirements commensurate with the system criticality.
(iii) Single Channel FADEC. A single channel FADEC system is one which provides full authority control of the engine from below ground idle to 100 percent power and in some cases from engine start similar to more complex dual channel redundant FADEC systems, but without a fully capable second channel providing a dual redundant system. The backup for the single channel FADEC is Page MG 4 - 4
provided by a less capable channel either by hydromechanical or electronic means, usually for “get-home” purposes rather than for dispatchability.
(3) References. FAR paragraphs 27.901, 27.903, 27.927, 27.939, 27.1141,
27.1143, 27.1309, 27.1581.
(4) Related Documents.
(i) Federal Aviation Regulations (FARs) paragraphs 21.21, 27.1301,
33.28, 33.75
(ii) FAA Advisory Circular AC 29-2C
(iii) Standards - Latest revision of RTCA/DO-178 and RTCA/DO-160;
SAE documents
(iv) ARP4754 and ARP4761
(5) Design Requirements for Compliance with FARs 27.901 and 27.1141 FAR paragraph 27.901(b)(1) requires that each component of the installation be constructed, arranged and installed to ensure its continued safe operation between normal inspections or overhauls. FAR paragraph 27.1141 requires that no single failure or malfunction of the powerplant control system will jeopardize the safe operation of the rotorcraft. For an engine with a single channel FADEC some form of redundancy is needed to ensure the continued safe operation of the rotorcraft in the event of a random complete failure. This redundant system must be accessible and provide the pilot with the ability to perform a controlled power-on landing. In addition, FAR paragraph 27.939(a) requires that turbine engine operating characteristics be investigated in flight. Flight tests are required as noted below to demonstrate compliance with the FAR requirements. The following paragraphs provide guidance for meeting these general design requirements.
(i) Redundancy: Because of the random nature of electrical/electronic component failures, there is no assurance that the electronic system will operate safely between established inspection periods. Therefore, some redundancy technique should be applied to the electrical/electronic part of the FADEC system to reduce the probability of losing the ability to land safely or continue safe flight. This redundancy is usually provided by some form of backup system or alternate method of control of the engine. The requirement for a backup system can be achieved with a number of approaches that include a simple mechanical/hydromechanical system, a simple electrical/electronic system that is not a completely redundant channel, or a completely redundant system.
(ii) Availability: A means must be provided either by system design or operational procedures to ensure that the primary and the backup or alternate system are available functionally to serve the intended purpose. The Page MG 4 - 5
manufacturer’s required interval for testing the backup or alternate system should be based on the expected failure rate established during the failure analysis of the system. However, the pilot should have the capability to test the backup system at the pilot’s discretion. Additionally, failure of the primary system must not affect the safe operation of the backup or alternate system.
(iii) Capability of back-up system: Section 27.1143 requires that each power control provide a positive and immediately responsive means of controlling its engine. Additionally, § 27.903 requires that the powerplant systems associated with engine control systems are designed to give reasonable assurance that the engine operating limitations will not be exceeded in service. Although back-up control may be somewhat degraded, the system should allow for control of the engine and the aircraft within their operating limits. It should be demonstrated that upon failure of the primary control the aircraft can continue to be operated safely and execute a controlled power-on landing without creating an undue pilot workload. This includes demonstration of the ability to maintain rotor speed within acceptable limits while transitioning to the backup mode and while using the backup control.
(iv) Ability of crew to switch to back-up: If crew action is required for switching to the back-up mode, this ability must be demonstrated during all phases of flight from any seat which may be occupied by the pilot in command or the copilot.
The process to be used by the pilot to switch to the back-up mode should be clearly described in the Rotorcraft Flight Manual (RFM) as required by FAR paragraph
27.1581.
(v) Transfer to backup: The transfer to the back -up mode from the primary control mode or an intermediate mode (fixed position) should occur without excessive time delay or variation in power. Time delays and power variations experienced during the transfer should be evaluated during flight test for acceptability. A means should be provided to alert the pilot that transfer to the backup mode has occurred.
(vi) Annunciation: Adequate annunciations should be provided to cue the crew of faults/failures and/or transfer of engine controls. These annunciations are of visual and aural types and must be distinct as to purpose and should not be misleading, especially under any fault/failure. Flight evaluation of these annunciations is required before final acceptance can be made.
(vii) Automatic Transfer: If the system is designed to accomplish automatic transfer between control modes, the transfer should occur without excessive variation in power and a means should be provided to alert the pilot that transfer to the back-up mode has occurred. Multiple automatic transfers between control modes may cause aircraft instability. A method to lockout the primary control after its initial failure and automatic transfer to the backup should be Page MG 4 - 6