AC 29-2C, Chg 1 2/12/03 (B) The intent of system separation requirements is to minimize the possibility of total system failure/malfunction as a result of internal system failures or external influences. In some cases, system separation addresses systems that provide similar information by dissimilar means. An example of this type of system separ ation is the requirement for independence between the fuel quantity display system and the fuel low indication. This is a case where increased integrity can be accepted in lieu of total independence for small parts of an integrated system, depending on the extent of loss of independence and the associated failure condition category. Concerns to be addressed for system separation requirements are as follows:
(1) Internal concerns include common mode failures/malfunction that could result in unacceptable loss of satisfactory system functionality. Some of the sources of these failures/malfunctions include common electrical power supplies, common sensor sources, filtering referenced to common ground planes, common processing, and common threats from Electro–Magnetic Interference (EMI) sources.
(2) EMI from internal sources (Electro–Magnetic Compatibility (EMC)) and external sources (High Intensity Radiated Fields (HIRF)) must be addressed from systems separation aspects. Unless complete system immunity to EMI can be shown for designs of systems that provide functions to address catastrophic failures, the design should preclude influence from EMI events. This is of particular concern when redundancy is used to meet the criticality requirements. Designs should address the possibility of EMI affecting the required function because of close physical proximity between all or parts of the redundant sections of the system. Areas of design that have the most concerns are those that include redundant system sections in the same enclosure and the redundant sections have a common cavity for penetration of wiring connectors. Another significant area of concern is for redundant system sections that employ wiring cables with little physical separation between cables for the respective redundant sections. In these cases, different lengths of cables between these redundant sections would reduce the possibility that radiated EMI would affect the system sections simultaneously at the same frequency.
(3) Other separation concerns are associated with external physical installation aspects. These physical aspects include protection from fire, water, excessive thermal variations, excessive vibration damage, and any mechanical failure of another system/component that could possibly impair the integrated system’s functionality and result in an unacceptable decrease in safety.
Page MG 13 - 6
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 14 CERTIFICATION PROCEDURE FOR INSTALLATION OF VAPOR CYCLE AIR CONDITIONING SYSTEMS.
a. FAA/AUTHORITY Approval Philosophy. The vapor cycle (Freon) air conditioning system is generally considered "nonessential"; that is, its function is not necessary for safe flight. Therefore, the FAA/AUTHORITY looks at it from the standpoint of its potential of posing a hazard to the aircraft in the course of its normal function/malfunction or in case of a failure. 14 CFR Part 29.1309 thus becomes the dominant regulation concerning the system. However, if an air conditioning system is required for electrically powered equipment cooling, then a criticality assessment may show that the criticality level may be higher than nonessential.
b. Type of Refrigerant/Regulations/Environmental Impact.
(1) The refrigerant commonly used in automobiles and aircraft is known as Freon R-12 (home air conditioners use R-22). This Freon is one of the CHLOROFLUROCARBONS (CCl F) or CFCs. This compound is blamed for eroding the ozone layer in the Stratosphere (the chlorine in CFCs attacks and destroys the ozone molecules). The U.S. Clean Air Act restricts the production of CFCs. In 1992, production was restricted to 50%. The United States and most other industrial countries have agreed to phase out CFC production by 1995. CFC is prohibited beginning in the year 2000. Beginning in June 1992, CFCs required recovery.
(2) The new refrigerant HYDROFLUROCARBONS (CH FCF) HFC- 134a or R-134a does not deplete ozone. Automobile industries as well as some small aircraft manufacturers are designing air conditioning systems with this non-ozone-depleting refrigerant. This HFC -134a is currently available and manufactured by the Dupont Company.
c. Suggested Compliance Checklist: R=Report, D=Drawing, T=Test.
REGULATION SUBJECT METHOD
29.301 Loads R
29.303
29.305
29.307 Factor of safety Strength & Deformation Proof of structure R R R
29.561
29.603
29.605 Emergency Landing conditions Materials and Workmanship Fabrication methods R D D Page MG 14 - 1
AC 29-2C, Chg 1 2/12/03 Suggested Compliance Checklist: R=Report, D=Drawing, T=Test (continued)
REGULATION SUBJECT METHOD
29.607 Fasteners D
29.609 Protection of Structure R
29.613
29.685a,c
29.831 Material Strength Control system details Ventilation R D R
29.853
29.855
29.863
29.1301 Compartment interiors (a, b, c) Cargo compartments (a, b) Flammable fluid protection Function and Installation D D T T
29.1307
29.1309
29.1435
29.1461
29.1541 Miscellaneous Equipment, 29(b) Equipment systems and Installation Hydraulic system T Equipment containing High energy r Markings and placards D otors D R D, R
d. Electrical System Considerations
(1) An electrical wiring diagram showing interconnections of all electrical components should be provided. The wiring diagram should show adequate circuit protection (circuit breakers). It should also indicate the use of wiring of adequate size and length to take maximum currents to which the system would be exposed. Power to air conditioning electrical system should be connected to an electrical power source that provides adequate power and does not interfere with essential electrical loads and provides solid electrical ground to airframe.
(2) An electrical load analysis should be provided to demonstrate the availability of adequate current to the air conditioning system from the helicopter electrical power source during all phases of flight and system operation. The system should also be powered from the helicopter electrical power source that provides adequate power and does not interfere with essential electrical loads.
(3) The air conditioning system should be capable of a successful functional test and electromagnetic compatibility test. It needs to be shown that air conditioning equipment will not be a source of interference with the essential equipment. Reference §§ 29.1351(a)(b), 29.1357, 29.1365, and 29.1367.
e. Structural Considerations
(1) Overall aircraft structure should be substantiated for the increased weight of the air conditioner modification. Each air conditioner component, its backup structure, and its attachment to the aircraft structure should be substantiated to the strength requirements of Subpart C (14 CFR Part 29) and the design requirements of Subpart D Page MG 14 - 2
(14 CFR 29). Load factors should be chosen considering the most critical of limit maneuvering load factor (§ 29.337), gust load factor (§ 29.341), or if applicable, emergency landing conditions (§ 29.561). Load paths must be substantiated for the distribution of static and/or dynamic load conditions. Fatigue substantiation may be required depending on the installation (§ 29.571).
(2) The modifications done on the structure, due to air conditioner equipment installation, should not create any adverse qualities to the overall structural integrity of the aircraft. Any access holes cut in the aircraft structure for routing refrigerant/electrical line skin/stringer cutouts for intake or exhaust holes, etc., should be substantiated for overall structural integrity.
(3) All attachment hardware used for the air conditioner modification should be substantiated to meet the increased structural requirements.
f. System and Equipment Considerations
(1) The vapor cycle (Freon) system is properly considered to be a gaseous system. Granted, during some portion of the cycle, the Freon is in a liquid or liquid/vapor state; however, it is a gas under standard atmospheric conditions.
Therefore, the proper system test would be a pressure test for a gaseous (pneumatic) system.
(2) 14 CFR Part 29 does not call out specific testing criteria but instead relies on § 29.1309 to address potential hazards due to pressurized gas systems. A proof pressure test of 1.5 times the maximum normal operating pressure of the system is appropriate to satisfy the intent of § 29.1309.
(3) The Freon pressures vary throughout the system during operation, but the maximum normal operating pressure of the components upstream from and including the high-pressure side of the expansion valve can be regarded as the value limited by the overpressure switch. The condenser and receiver -dryer are of special concern as they are of relatively large volume and a failure could cause damage to the aircraft structure or essential mechanical components.
(4) The highest pressure normally experienced by the low pressure portion of the Freon system (downstream of the expansion valve to the suction side of the compressor) occurs when the system is shutdown; hence that pressure can be used as the "maximum normal operating pressure" for the proof and burst tests in this portion of the system.
(5) The burst pressure tests can be done on a component basis or on the entire system. The proof pressure test is best done on the entire system to allow observation of any movements of the flex hoses and other components under pressure, which may interfere with essential helicopter components.
Page MG 14 - 3
AC 29-2C, Chg 1 2/12/03
(6) System capacity or efficiency does not affect the review of the system from the standpoint of safety; however, § 29.1301(a) requires "Each item of installed equipment be of a kind and design appropriate to its intended function". Hence the calculations of heat load of the cabin to be cooled in British thermal units (Btu) and the cooling capacity of the air conditioner system may be required. Care should be taken to assure that the § 29.831 required fresh air ventilation rate is maintained. The vapor cycle is a closed system (recirculating of existing air) with no fresh air make up capability.
g. Powerplant Considerations (for mechanically-driven air conditioning compressors):
(1) The drive systems and the drive system component supporting structure should be adequate both statically and in fatigue to handle any loads associated with the air conditioning drive mechanism. Both normal operating and failure conditions (compressor lockup) should be considered. For example, on systems which are belt driven off the tail rotor drive, all components should be substantiated at the highest torque, shear, and moment loads that can be imposed by the belt drive (compressor seizure as well as compressor start), in combination with the loads associated with max transient tail rotor drive torque.
(2) The compressor drive must not affect the normal function of the drive system. Additional load on the gearbox or the drive pulley should not cause gearbox temperature increase (§ 29.1041). Exceeding the gearbox temperature limit can cause stud loosening.
(3) The mounting of a bracket (for a compressor) or an idler pulley on the transmission top case should not affect the structural integrity or the corrosion protection of the transmission. If a compressor/blower is mounted to the gearbox, the overhang moment (which is created by the weight of the compressor and its center of gravity distance), should not exceed the mount limit. The addition of a bracket which picks up several existing top case-to-main case attachment studs may provide an additional path for water to enter and corrode the cases around the studs. In some cases, the studs may not be adequate to carry the additional load, because the thickness of the top case where each of these studs is typically individually controlled could result in the bracket warping upon installation. This warping results in unequal axial clamp-up at the studs, which further aggravates the stud loading and may also lead to significant case fretting. Also, the original studs may not be of adequate length to maintain proper thread extension through the nut after the bracket is installed.
(4) In the event of a compressor seizure, it should be substantiated that no damage to the primary drive system or aircraft structure can occur. On belt driven installations, no damage to the primary drive system should occur due to burning or flailing belts. On a shaft driven compressor/blower installation, the shaft shear section should fail before exceeding the gearbox torque limit. When the shear section fails, the Page MG 14 - 4
shaft should be contained or otherwise prevented from interfering with the drive system or flight controls. Similarly, a failure of the compressor or drive belts should not damage the drive system or interfere with the flight control mechanism.
(5) The mechanically-driven compressor should not adversely affect the (vibration) dynamic characteristics of the drive system in any operating condition (§ 29.907(b)). Maximum vibration levels should be given in engine/drive system installation data (§§ 29.901(b) and 29.927(a)).
h. Flight Analyst/Pilot Considerations.
Update Rotorcraft Flight Manual supplements (RFM) to show performance effects. If the installation is such that it interferes with engine inlet airflow, then determine any performance loss, evaluate inlet distortion, and validate turbine engine operating characteristics. Reference §§ 29.45 and 29.939. TIA should include operational tests such as intended function and abnormal/emergency operation. Conduct EMI tests and evaluate the RFM supplement. Reference §§ 29.1581, 29.1583, 29.1585, and 29.1587.
i. Safety Devices / Failure Mode Effect Analysis
(1) SAFETY DEVICES:
(i) Automatic Load shedding
(ii) Current Limiter
(iii) Compressor Temperature Limiter
(iv) Compressor Electric Motor temperature limiter
(v) Compressor Discharge pressure limiter
(vi) Oil separator / Injector
(vii) Containment shrouds
(viii) Belt guard
(ix) Pressure line gallery cover
(x) Ignition source protection (Freon is flame suppressant)
(2) FAILURE MODE EFFECT ANALYSIS: A Failure Mode Effect Analysis is crucial to the safety evaluation of the systems. Consider the areas given below:
(i) The overpressure safety system assures there is a means to shut the system down prior to a critical pressure developing (overpressure switches, blowout plugs, redundant circuit breakers, etc.).
(ii) An electrical load analysis should show that the failures in the air conditioning system do not jeopardize the safe operation of flight essential and flight critical airborne systems.
(iii) For systems driven by engine/transmission/drive shaft, a powerplant evaluation should be made to determine power available, vibration characteristics, etc.
Page MG 14 - 5
AC 29-2C, Chg 1 2/12/03
(iv) Coupling/drive belt failure and its effect on adjacent components.
(v) The area around the condenser and receiver dryer (and any other high-pressure components) to determine if there are any critical components in the vicinity that could be damaged if a burst line occurs.
(vi) Assure that the Condenser blower/fan construction is such that if the fan or impeller fails, the pieces will not damage other components or helicopter structure (§ 29.1461).
(vii) The design should be such that Freon leakage cannot be ingested into the engines (§ 29.1309). Freon is an excellent fire suppressant. Ensure that no pressure relief valve or blow out plug (on the receiver dryer) is located inside the cabin.
Quantities of Freon should also be prevented, as much as possible, from entering the cabin in the event of a leak. The rapid expansion of liquid Freon to its gaseous state in the close proximity of the flight crew could be disconcerting (could fog up the cabin).
Liquid refrigerant, if allowed to strike the body, could cause frostbite, and if allowed to strike the eye, can cause blindness.
Page MG 14 - 6
Gaseous refrigerant under Compressor increasing pressure Gaseous refrigerant Under low pressure
REFRIGERATION CYCLE Receiver Drier Liquid refrigerant Expans Condenser Coil Evaporator Coil Cooled
i t I I ~
• • ~ t I ~ I I
• I ~ I / i I I I L_ ...
/ Figure AC 29.MG 14-1 Page MG 14 - 7
AC 29-2 C, Chg 1 2/12/03
INTENTIONALLY LEFT BLANK Page MG 14 - 8
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 15. AIRWORTHINESS APPROVAL OF ROTORCRAFT HEALTH USAGE
MONITORING SYSTEMS (HUMS)
a. Purpose. The purpose of this section of the AC (AC 29 MG 15) is to provide guidance to achieve airworthiness approval for rotorcraft Health and Usage Monitoring System (HUMS) installation, credit validation, and Instructions for Continued Airworthiness (ICA) for the full range of HUMS applications. Mandatory terms used in this section of the AC, such as “must", are terms used only in the sense of ensuring the applicability of these particular methods of compliance when the acceptable means of compliance described herein are used. This section of the AC does not change regulatory requirements and does not authorize changes in, or deviations from, regulatory requirements. This section of the AC establishes an acceptable means, but not the only means of certifying a rotorcraft HUMS. AC 29 MG 15 addresses the most complex/extensive HUMS; systems of lesser complexity may be addressed by use of only the parts of this section of the AC that are pertinent. HUMS applications in the Catastrophic criticality category are not addressed herein.
b. References and Related Documents.
(1) Federal Aviation Regulations (FAR) Parts 21, 29, 33, 91, 125, 127, 129, 133, 135, 145 – Corresponding European Joint Aviation Requirements (JAR) 21, 29, JAR E, JAR-OPS 3.
(2) FAA Advisory Circular AC 29-2C and the European corresponding ACJs, AMJs where applicable.
(3) Standards - Latest revision of RTCA/DO-160/ED-14, RTCA/DO-178/ED-12, SAE documents ARP 4754, and ARP 4761.
c. Background.
(1) Various types of HUMS have been developed, and they are likely to be used more in the future. Initially, these systems were installed to show the feasibility of gathering meaningful data to modify required maintenance and/or operational actions.
The degree of qualification required for this type of installation is relatively low.
However, there is an increasing number of certification applications to install HUMS and use its data to intervene in maintenance and/or operations of the rotorcraft. This type of Page MG 15 - 1
AC 29-2C, Chg 1 2/12/03 installation requires a higher degree of qualification, commensurate to the criticality of the most severe effect of the intervention action(s) on the rotorcraft.
(2) HUMS typically consists of a variety of onboard sensors and data acquisition systems. The acquired data may be processed onboard the rotorcraft or on a ground station (or a combination of both) providing the means to measure against defined criteria and generate instructions for the maintenance staff and/or flight crew for intervention.
(3) The certification of HUMS must address the complete process, from the source of data to the intervention action. There are three basic aspects for certification of HUMS applications: installation, credit validation, and Instructions for Continued Airworthiness (ICA). These aspects are not totally independent and do have varying interactions with each other.
d. Definitions.
(1) END-TO-END: The term "end -to-end" as used in the text is intended to address the boundaries of the Health Usage Monitoring System (HUMS) application and the effect on the rotorcraft. As the term implies, the boundaries are the starting point that corresponds with the airborne data acquisition to the result that is meaningful in relation to the defined credit without further significant processing. In the case where credit is sought, the result must arise from the controlled HUMS process containing the three basic requirements for certification as follows:
(i) Equipment installation/qualification (both airborne and ground),
(ii) Credit validation activities, and
(iii) Instructions for Continued Airworthiness (ICA) activities.
(2) HUMS: Equipment, techniques, and/or procedures by which selected incipient failure or degradation and/or selected aspects of service history can be determined.
(i) Health Monitoring System: Equipment, techniques, and/or procedures by which selected incipient failure or degradation can be determined.
(ii) Usage Monitoring System: Equipment, techniques, and/or procedures by which selected aspects of service history can be determined.
(3) Credit: To give approval to a HUMS application that adds to, replaces, or intervenes in industry accepted maintenance practices or flight operations.
Page MG 15 - 2
(4) Application(s): A HUMS process implemented for a distinct purpose(s).
(5) Criticality (1309): This term describes the severity of the end result of a HUMS application failure/malfunction. Criticality is determined by an assessment that considers the safety effect that the HUMS application can have on the aircraft. There are five criticality categories as follows:
(i) Catastrophic: Failure conditions, which would prevent continued safe flight and landing.
(ii) Hazardous/Severe Major: Failure conditions, which would reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be:
(A) A large reduction in safety margins or functional capabilities, (B) Physical distress or higher workload such that the flight crew could not be relied on to perform their tasks accurately or completely, or (C) Adverse effects on occupants including serious or potentially fatal injuries to a small number of those occupants.
(iii) Major: Failure conditions which would reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload or in conditions impairing crew efficiency, or discomfort to occupants, possibly including injuries.
(iv) Minor: Failure conditions which would not significantly reduce aircraft safety, and which would involve crew actions that are well within their capabilities. Minor failure conditions may include, for example, a slight reduction in safety margins or functional capabilities, a slight increase in crew workload such as routine flight plan changes, or some inconvenience to occupants.
(v) No-Effect (Non-hazardous class): Failure conditions which do not affect the operational capability or safety of the aircraft, or the crew workload.
(6) Integrity: Attribute of a system or a component that can be relied upon to function as required by the criticality determined by the Functional Hazard Assessment (FHA).
(7) Mitigating Action: An autonomous and continuing compensating factor which may modify the level of qualification associated with certification of a HUMS Page MG 15 - 3