29-2C, Chg 1 2/12/03 (A) Stress analysis is sufficiently accurate. This can be achieved by similarity with full scale strain surveys, thermography, or other suitable testing approaches.
(B) Fracture mechanics is properly applied.
(C) Load interaction models are verified for the specific load histories.
(D) Consistent material data base is used.
(x) Inspection plan. Detection of flaws before they become dangerous is the ultimate control in ensuring the flaw tolerance characteristics of the structure.
Therefore, the applicant should provide sufficient guidance information to assist operators in establishing the frequency, extent, and methods of inspection of the critical structure, and this kind of information should, under § 29.571(a)(2), be included in the maintenance manual required by § 29.1529. Due to the inherent, complex interactions of the many parameters affecting flaw tolerance, such as operating practices, environmental effects, load sequence on flaw growth, and variations in inspection methods, related operational experience should be taken into account in establishing inspection procedures. Comparative analysis can be used to guide the changes from successful past practice, when necessary. Therefore, maintenance and inspection requirements should recognize the dependence on experience and should be specified in a document that provides for revision as a result of operational experience, such as the one containing the operator’s FAA/AUTHORITY-approved structural inspection program developed through the Maintenance Review Board (MRB) procedures for FAR Part 121 operators.
(4) Safe-Life Demonstration
(i) Information to guide fatigue evaluation based on the safe-life approach is described in details in AC 27-1B MG 11. The safe- life approach is used when both the fail-safe and flaw-tolerant safe-life methods are verified to be impractical due to considerations of inspectability, geometry, or good design practice as described above in paragraph d(2).
(ii) The safe-life approach may not account for flaws and imperfections due to manufacturing and in service conditions as compared to the flaw tolerant approaches. Therefore, conservative factors that adjust for variations in both load and strength are generally utilized when substantiating by the safe-life method.
(5) Combining Methods.
(i) Components may be managed by a retirement time based on the Flaw Tolerant Safe-Life method, paragraph g(2); by an inspection program based on the Fail-Safe method, paragraph g(3); or, if approved, a retirement time based on conventional Safe Life, paragraph g(4). In some cases it may be appropriate to Page MG 11 - 20
establish a retirement time based on the lowest from several methods, and in some cases it may be appropriate to establish both a retirement time and an inspection program for a given structure.
(ii) Retirement Times. The conventional Safe- Life retirement time determined from as-manufactured parts and conventional working curves may be lower than that determined from a Flaw Tolerant Safe-Life evaluation. In this event, the lower of the two retirement times should be used. Additionally, inspection intervals resulting from a Fail-Safe evaluation may be used as retirement times if practical, which removes the need to conduct that specific inspection. In this event, the conventional safe life retirement time should be used if lower.
Page MG 11 - 21
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 12. § 29.865 (Amendment 29-43) EXTERNAL LOADS.
This AC MG paragraph material is now contained in AC 29.865B, in Subpart D.
AC Page MG 12 - 1
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 13. SYSTEMS CERTIF ICATION CONSIDERATIONS.
a. Supporting Systems.
(1) Purpose Definitions.
. The purpose of this AC paragraph is to provide guidance on how to show compliance to Part 29 regulations as they apply to supporting systems for other systems that provide required functions. The applicability of this material to “systems” is defined by AC 29.1309.a.(1). The system s that require support from supporting systems are defined as dependent systems in the following guidance. Application of recent technology is one of the predominant causes of more dependent/supporting systems relationships. More systems are employing technology that is dependent on supporting systems such as electrical, hydraulic, and/or other power sources or signal inputs. Certification of systems that are dependent on supporting systems to provide required functionality must consider the issues associated with this interdependent relationship.
(2)
(i) Integrity. The term “integrit y” for the purpose of this AC paragraph includes the hardware quality requirements, including reliability (availability); as well as the software level requirements, as defined in RTCA/DO-178B.
(ii) Criticality. The term “criticality” refers to the five levels of criticality addressed in this document in paragraph AC 29.1309.b.(1).
(iii) Supporting System(s). The term “supporting system(s)” as used in this paragraph means any system(s) that provides an input to another “dependent” system, such that these dependent system(s) cannot function correctly without that input being present/correct.
(iv) Dependent System(s). The term “dependent system(s)” as used in this paragraph means any system/s that receives an input from another system or sensor.
(3) Related Documents.
(i) Federal Aviation Regulations (FARs) Paragraphs 29.1301, 29.1309,
29.1351, and 29.1435.
(ii) Standards - Latest revision of RTCA/DO178 and RTCA/DO 160; Parts of SAE documents ARP4754 and ARP4761.
Page MG 13 - 1
AC 29-2C, Chg 1 2/12/03
(4) History: Applications of recent technology for systems have, in many cases, resulted in systems that are dependent on one or more supporting system(s) for inputs such as power or signal sources of any type. This relationship creates concerns for recognition that the criticality of the supporting system may be higher because of its role of supporting a dependent system of high criticality. The example of Liquid Crystal Displays (LCD) for engine instruments, in particular, has caused concern about the integrity of the supporting electrical power system. Pa st designs for engine instruments did not require electrical power for operation, but present designs with LCDs do require electrical power. Additionally, engine inst ruments of those older helicopter designs were driven from a mixture of sources such as independent wet line, pneumatic, and electrical drive (Tach Generator) inputs, and thus had independent failure modes from the sensor/power input aspect(s). This means that the integrity of the electrical power supplied to the dependent system must be commensurate withthe level of integrity as required for the highest criticality engine instrument application(s). This also stimulates the concern that the electrical power system can become a common point for failure of all engine instruments simultaneously, as well as anything else powered by the electrical system. For this example, t hese considerations represent an increase of integrity requirements for the electrical power system over previous designs of electrical systems for VFR helicopters. In the past, these electrical systems did not support required functions of higher criticality and were allowed to be simple in design with low design integrity and susceptible to single point faults. Application of recent technologies for systems resulting in dependent systems that require supporting systems must address the concerns for higher integrity and single point faults.
(5) : Integrity of supporti ng systems must be sufficient to support the required integ Discussion rity of their associated dependent systems. The relationship of supporting systems to dependent systems is similar to an analogy of them being links in a chain, where the weakest link must be able to support the required integrity level that is consistent with the associated criticality category assessment. This principle is not new, but there may not be recognition that systems previously accepted at low integrity levels may not be acceptable because of their new role as supporting system(s). New emphasis must be applied to determine acceptability of previous designs that have become supporting systems through application of new technology or changes of system architecture. This is particularl y true for derivative designs, or changes to existing design by either supplemental type certificate (STC) or field approval, where new technology system applications, or system architecture changes have been applied, that created a dependent/supporting system relationship. The main concerns are for systems such as electronic displays that are installed and supported by nonupgraded systems, such as single source and/or low reliability power generation and distribution systems. However the concerns related to supporting systems are not limited to displays for dependent systems, since control systems could also be affected.
Integrity for fault considerations must be addressed for supporting systems in relation to dependent systems when the dependent system’s provided functions are assessed at criticality levels of Major, Hazardous/Severe-Major, or Catastrophic. These integrity and fault considerations must address not only a particular dependent system, but also the Page MG 13 - 2
accumulative effect on other systems that the same supporting system’s malfunction may affect. This may, in turn, affect the aircraft level functional hazard assessment (FHA) as the supporting system could act as a common point for simultaneous failures of more than one system. Additionally, the design of the supporting systems should preclude single point failures/faults for systems that support dependent systems functions assessed to have a criticality of Catastrophic.
(6) Certification Approach. There are three basic parts to the supporting systems concerns addressed herein and they are the inclusion of supporting systems in the integrity determination process, the design considerations for supporting systems relating to more than one system, and single point faults for the supporting systems themselves.
(i) A two-step procedure should be used to determine the adequate integrity level for supporting systems. The first step is to determine the level of criticality associated with loss/malfunction of all or any combination of the dependent system’s functions and all combinations of other dependent system’s functions that require support from the same supporting system. This can be achieved through the use of an FHA and associated FTA’s. The criticality category level determined from this assessment must be a product of failure/malfunction possibilities for all of the involved dependent/supporting systems combinations and the worst case operational consideration for the function(s) provided by the dependent systems. The second step is to determine whether the supporting system’s design integrity is sufficient to address the determined criticality category. The design integrity should address failures/malfunctions results of the dependent system(s), any combination of failures/malfunctions due to effects on more than one dependent system, and single point failures of the supporting system itself.
(ii) Analyses may be used to meet the criteria outlined in the second step above, for systems that support one or more dependent system functions whose loss or malfunction is assessed to be Hazardous/Severe-Major or Catastrophic. Analyses, such as a fault tree analysis, in combination with a common cause analysis to validate assumptions regarding the independence of faults, should be performed to show compliance. Testing may be required to validate the analysis, if the system is complex or dynamic in nature.
NOTE: Showing high reliability for a single thread system is not sufficient to meet the requirements for a Catastrophic failure condition category, thus reliability cannot be used to substitute for the preclusion of single point failures/faults.
(7) Summary: Supporting systems should be considered an integral part of the dependent system(s) that provides the required functions, for the purpose of addressing design integrity requirements.
b. Complex System Integration.
Page MG 13 - 3
AC 29-2C, Chg 1 2/12/03
(1) Explanation. Complex integrated systems addressed by this paragraph are those systems that provide more than one function from a single electronic device or from more than one inter-related electronic devices/components. The inter -relationship is based on common aspect(s) of providing the functions. The definition of complexity as it applies to integrated systems, is a design condition that exhibits the characteristic of possible combinations of simultaneous failures/faults, as opposed to simple systems where there exists only failures/faults that can be considered individually. Integration that results in providing several functions from one design source inherently increases complexity, thus the two describing terms of “complex” and “integrated” are not independent from one another. Computers have become more powerful with recent increases in technology. Also, related sensors and servomechanisms have greatly improved. This has created an atmosphere from which complex integrated systems have spawned. Integrated systems can have the effects of reduced weight, economic advantages, and system enhancements. However, with these advantages there are some concerns that must be addressed, as this concept inherently creates problems with showing compliance to system independence requirements.
(2) Procedure.
(i) Integrated Systems typically compromise the concept of independence for failures/malfunctions and system/function separation. Using this as a given, the approach for showing compliance for systems that have a requirement for independence is to provide elevated system integrity to make up for the loss of independence. The requirements for independence are both direct and inferred. The direct requirements are defined by requirements for system separation and for specific systems. The inferred requirements for independence are those that inherently have independence by their method of implementation until integration of dissimilar functions by recent technology. They are inferred since past methods of implementation provided independence and therefore no direct requirement was defined.
(ii) The elevated integrity typically consists of high software levels and high system reliability that addresses the failure condition categories determined by a Functional Hazard Assessment (FHA). This approach basically states that the independence for failures and function separation is absent, but the probability is small for loss or malfunction, and the software level will match the threat level identified by the FHA. Provided the integrity is a reality, this approach works pretty well for the loss and malfunction aspects. However, system separation requirements may not be satisfied as easily, as they are mostly concerned with common mode failures from external sources.
Some common mode concerns are temperature, fire, water, EMI, and physical mechanical threats.
(iii) The combinations of systems/functions that comprise a single integrated system are important. If any of the systems or combinations of systems that make up the composite integrated system are assessed to have a high criticality level, then the design integrity of the composite integrated system should match the highest of those assessments. In infrequent cases, partitioning and unique hardware/software Page MG 13 - 4
architecture may be exceptions to this determination. In cases where the FHA has determined low criticality for all combinations of systems/functions, many of the concerns associated with complex integration may be minimized.
(A) Concerns to be addressed for complex integrated systems that address failures and malfunctions:
(1 2 3 4 5 6 ) An FHA must be performed that considers each function individually and all combinations of functions for loss and malfunction. Additionally, all supporting systems, all combinations of supporting systems, and all combinations of supporting systems and dependent systems must be considered for loss and malfunction ( ) After the criticality has been determined for all functions and combinations of functions, the design integrity can be defined in terms of reliability and software level. The reliability must match or exceed the requirements derived from the FHA and associated FTA results. This includes any supporting system as well as the primary system.
( ) The software integrity level must match or exceed the requirements derived from the FHA and associated FTA results. This is true generally, for all of the software, if a single computer is utilized and no software or architecture scheme is implemented to provide partitioning/protection.
( ) If redundancy is required to meet the reliability requirements, adequate redundancy failure management must be provided. Redundancy failure/malfunction management is required to eliminate latent failures or undetected malfunctions. Redundancy management must address latent failures. Without the detection and management of latent and unannounced failures and malfunctions, duplication of subsystem components may not be creditable redundancy. If the first failure can result in unknown loss of one of the system’s functionally duplicated parts, then the second failure in combination with the first failure must be treated as a single failure and no design credit can be given for redundancy.
( ) Redundancy design must consider similarity of software between redundant system components.
( ) Electronic Devices (EDs) such as the Central Processing Unit (CPU), Programmable Logic Device (PLD), Application Specific Integrated Circuits (ASIC), or other types of data storage or computing devices must be considered to have common mode failure potential, especially for control systems. This concern may be addressed in a variety of ways. One way would be to use dissimilar EDs between redundant implementations. Some other approaches may involve architectures with monitors that are dissimilar to the systems supplying the redundant functionality. Other hardware potential common mode failures must also be considered, such as power supplies, signal sources, and common Input/Output (I/Os) chips.
Page MG 13 - 5
AC 29-2C, Chg 1 2/12/03 (B) The intent of system separation requirements is to minimize the possibility of total system failure/malfunction as a result of internal system failures or external influences. In some cases, system separation addresses systems that provide similar information by dissimilar means. An example of this type of system separ ation is the requirement for independence between the fuel quantity display system and the fuel low indication. This is a case where increased integrity can be accepted in lieu of total independence for small parts of an integrated system, depending on the extent of loss of independence and the associated failure condition category. Concerns to be addressed for system separation requirements are as follows:
(1) Internal concerns include common mode failures/malfunction that could result in unacceptable loss of satisfactory system functionality. Some of the sources of these failures/malfunctions include common electrical power supplies, common sensor sources, filtering referenced to common ground planes, common processing, and common threats from Electro–Magnetic Interference (EMI) sources.
(2) EMI from internal sources (Electro–Magnetic Compatibility (EMC)) and external sources (High Intensity Radiated Fields (HIRF)) must be addressed from systems separation aspects. Unless complete system immunity to EMI can be shown for designs of systems that provide functions to address catastrophic failures, the design should preclude influence from EMI events. This is of particular concern when redundancy is used to meet the criticality requirements. Designs should address the possibility of EMI affecting the required function because of close physical proximity between all or parts of the redundant sections of the system. Areas of design that have the most concerns are those that include redundant system sections in the same enclosure and the redundant sections have a common cavity for penetration of wiring connectors. Another significant area of concern is for redundant system sections that employ wiring cables with little physical separation between cables for the respective redundant sections. In these cases, different lengths of cables between these redundant sections would reduce the possibility that radiated EMI would affect the system sections simultaneously at the same frequency.
(3) Other separation concerns are associated with external physical installation aspects. These physical aspects include protection from fire, water, excessive thermal variations, excessive vibration damage, and any mechanical failure of another system/component that could possibly impair the integrated system’s functionality and result in an unacceptable decrease in safety.
Page MG 13 - 6
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 14 CERTIFICATION PROCEDURE FOR INSTALLATION OF VAPOR CYCLE AIR CONDITIONING SYSTEMS.
a. FAA/AUTHORITY Approval Philosophy. The vapor cycle (Freon) air conditioning system is generally considered "nonessential"; that is, its function is not necessary for safe flight. Therefore, the FAA/AUTHORITY looks at it from the standpoint of its potential of posing a hazard to the aircraft in the course of its normal function/malfunction or in case of a failure. 14 CFR Part 29.1309 thus becomes the dominant regulation concerning the system. However, if an air conditioning system is required for electrically powered equipment cooling, then a criticality assessment may show that the criticality level may be higher than nonessential.
b. Type of Refrigerant/Regulations/Environmental Impact.
(1) The refrigerant commonly used in automobiles and aircraft is known as Freon R-12 (home air conditioners use R-22). This Freon is one of the CHLOROFLUROCARBONS (CCl F) or CFCs. This compound is blamed for eroding the ozone layer in the Stratosphere (the chlorine in CFCs attacks and destroys the ozone molecules). The U.S. Clean Air Act restricts the production of CFCs. In 1992, production was restricted to 50%. The United States and most other industrial countries have agreed to phase out CFC production by 1995. CFC is prohibited beginning in the year 2000. Beginning in June 1992, CFCs required recovery.
(2) The new refrigerant HYDROFLUROCARBONS (CH FCF) HFC- 134a or R-134a does not deplete ozone. Automobile industries as well as some small aircraft manufacturers are designing air conditioning systems with this non-ozone-depleting refrigerant. This HFC -134a is currently available and manufactured by the Dupont Company.
c. Suggested Compliance Checklist: R=Report, D=Drawing, T=Test.
REGULATION SUBJECT METHOD
29.301 Loads R
29.303
29.305
29.307 Factor of safety Strength & Deformation Proof of structure R R R
29.561
29.603
29.605 Emergency Landing conditions Materials and Workmanship Fabrication methods R D D Page MG 14 - 1
AC 29-2C, Chg 1 2/12/03 Suggested Compliance Checklist: R=Report, D=Drawing, T=Test (continued)
REGULATION SUBJECT METHOD
29.607 Fasteners D
29.609 Protection of Structure R
29.613
29.685a,c
29.831 Material Strength Control system details Ventilation R D R
29.853
29.855
29.863
29.1301 Compartment interiors (a, b, c) Cargo compartments (a, b) Flammable fluid protection Function and Installation D D T T
29.1307
29.1309
29.1435
29.1461
29.1541 Miscellaneous Equipment, 29(b) Equipment systems and Installation Hydraulic system T Equipment containing High energy r Markings and placards D otors D R D, R
d. Electrical System Considerations
(1) An electrical wiring diagram showing interconnections of all electrical components should be provided. The wiring diagram should show adequate circuit protection (circuit breakers). It should also indicate the use of wiring of adequate size and length to take maximum currents to which the system would be exposed. Power to air conditioning electrical system should be connected to an electrical power source that provides adequate power and does not interfere with essential electrical loads and provides solid electrical ground to airframe.
(2) An electrical load analysis should be provided to demonstrate the availability of adequate current to the air conditioning system from the helicopter electrical power source during all phases of flight and system operation. The system should also be powered from the helicopter electrical power source that provides adequate power and does not interfere with essential electrical loads.
(3) The air conditioning system should be capable of a successful functional test and electromagnetic compatibility test. It needs to be shown that air conditioning equipment will not be a source of interference with the essential equipment. Reference §§ 29.1351(a)(b), 29.1357, 29.1365, and 29.1367.
e. Structural Considerations
(1) Overall aircraft structure should be substantiated for the increased weight of the air conditioner modification. Each air conditioner component, its backup structure, and its attachment to the aircraft structure should be substantiated to the strength requirements of Subpart C (14 CFR Part 29) and the design requirements of Subpart D Page MG 14 - 2
(14 CFR 29). Load factors should be chosen considering the most critical of limit maneuvering load factor (§ 29.337), gust load factor (§ 29.341), or if applicable, emergency landing conditions (§ 29.561). Load paths must be substantiated for the distribution of static and/or dynamic load conditions. Fatigue substantiation may be required depending on the installation (§ 29.571).
(2) The modifications done on the structure, due to air conditioner equipment installation, should not create any adverse qualities to the overall structural integrity of the aircraft. Any access holes cut in the aircraft structure for routing refrigerant/electrical line skin/stringer cutouts for intake or exhaust holes, etc., should be substantiated for overall structural integrity.
(3) All attachment hardware used for the air conditioner modification should be substantiated to meet the increased structural requirements.
f. System and Equipment Considerations
(1) The vapor cycle (Freon) system is properly considered to be a gaseous system. Granted, during some portion of the cycle, the Freon is in a liquid or liquid/vapor state; however, it is a gas under standard atmospheric conditions.
Therefore, the proper system test would be a pressure test for a gaseous (pneumatic) system.
(2) 14 CFR Part 29 does not call out specific testing criteria but instead relies on § 29.1309 to address potential hazards due to pressurized gas systems. A proof pressure test of 1.5 times the maximum normal operating pressure of the system is appropriate to satisfy the intent of § 29.1309.
(3) The Freon pressures vary throughout the system during operation, but the maximum normal operating pressure of the components upstream from and including the high-pressure side of the expansion valve can be regarded as the value limited by the overpressure switch. The condenser and receiver -dryer are of special concern as they are of relatively large volume and a failure could cause damage to the aircraft structure or essential mechanical components.
(4) The highest pressure normally experienced by the low pressure portion of the Freon system (downstream of the expansion valve to the suction side of the compressor) occurs when the system is shutdown; hence that pressure can be used as the "maximum normal operating pressure" for the proof and burst tests in this portion of the system.
(5) The burst pressure tests can be done on a component basis or on the entire system. The proof pressure test is best done on the entire system to allow observation of any movements of the flex hoses and other components under pressure, which may interfere with essential helicopter components.
Page MG 14 - 3