AC 29-2C, Chg 1 2/12/03
(6) System capacity or efficiency does not affect the review of the system from the standpoint of safety; however, § 29.1301(a) requires "Each item of installed equipment be of a kind and design appropriate to its intended function". Hence the calculations of heat load of the cabin to be cooled in British thermal units (Btu) and the cooling capacity of the air conditioner system may be required. Care should be taken to assure that the § 29.831 required fresh air ventilation rate is maintained. The vapor cycle is a closed system (recirculating of existing air) with no fresh air make up capability.
g. Powerplant Considerations (for mechanically-driven air conditioning compressors):
(1) The drive systems and the drive system component supporting structure should be adequate both statically and in fatigue to handle any loads associated with the air conditioning drive mechanism. Both normal operating and failure conditions (compressor lockup) should be considered. For example, on systems which are belt driven off the tail rotor drive, all components should be substantiated at the highest torque, shear, and moment loads that can be imposed by the belt drive (compressor seizure as well as compressor start), in combination with the loads associated with max transient tail rotor drive torque.
(2) The compressor drive must not affect the normal function of the drive system. Additional load on the gearbox or the drive pulley should not cause gearbox temperature increase (§ 29.1041). Exceeding the gearbox temperature limit can cause stud loosening.
(3) The mounting of a bracket (for a compressor) or an idler pulley on the transmission top case should not affect the structural integrity or the corrosion protection of the transmission. If a compressor/blower is mounted to the gearbox, the overhang moment (which is created by the weight of the compressor and its center of gravity distance), should not exceed the mount limit. The addition of a bracket which picks up several existing top case-to-main case attachment studs may provide an additional path for water to enter and corrode the cases around the studs. In some cases, the studs may not be adequate to carry the additional load, because the thickness of the top case where each of these studs is typically individually controlled could result in the bracket warping upon installation. This warping results in unequal axial clamp-up at the studs, which further aggravates the stud loading and may also lead to significant case fretting. Also, the original studs may not be of adequate length to maintain proper thread extension through the nut after the bracket is installed.
(4) In the event of a compressor seizure, it should be substantiated that no damage to the primary drive system or aircraft structure can occur. On belt driven installations, no damage to the primary drive system should occur due to burning or flailing belts. On a shaft driven compressor/blower installation, the shaft shear section should fail before exceeding the gearbox torque limit. When the shear section fails, the Page MG 14 - 4
shaft should be contained or otherwise prevented from interfering with the drive system or flight controls. Similarly, a failure of the compressor or drive belts should not damage the drive system or interfere with the flight control mechanism.
(5) The mechanically-driven compressor should not adversely affect the (vibration) dynamic characteristics of the drive system in any operating condition (§ 29.907(b)). Maximum vibration levels should be given in engine/drive system installation data (§§ 29.901(b) and 29.927(a)).
h. Flight Analyst/Pilot Considerations.
Update Rotorcraft Flight Manual supplements (RFM) to show performance effects. If the installation is such that it interferes with engine inlet airflow, then determine any performance loss, evaluate inlet distortion, and validate turbine engine operating characteristics. Reference §§ 29.45 and 29.939. TIA should include operational tests such as intended function and abnormal/emergency operation. Conduct EMI tests and evaluate the RFM supplement. Reference §§ 29.1581, 29.1583, 29.1585, and 29.1587.
i. Safety Devices / Failure Mode Effect Analysis
(1) SAFETY DEVICES:
(i) Automatic Load shedding
(ii) Current Limiter
(iii) Compressor Temperature Limiter
(iv) Compressor Electric Motor temperature limiter
(v) Compressor Discharge pressure limiter
(vi) Oil separator / Injector
(vii) Containment shrouds
(viii) Belt guard
(ix) Pressure line gallery cover
(x) Ignition source protection (Freon is flame suppressant)
(2) FAILURE MODE EFFECT ANALYSIS: A Failure Mode Effect Analysis is crucial to the safety evaluation of the systems. Consider the areas given below:
(i) The overpressure safety system assures there is a means to shut the system down prior to a critical pressure developing (overpressure switches, blowout plugs, redundant circuit breakers, etc.).
(ii) An electrical load analysis should show that the failures in the air conditioning system do not jeopardize the safe operation of flight essential and flight critical airborne systems.
(iii) For systems driven by engine/transmission/drive shaft, a powerplant evaluation should be made to determine power available, vibration characteristics, etc.
Page MG 14 - 5
AC 29-2C, Chg 1 2/12/03
(iv) Coupling/drive belt failure and its effect on adjacent components.
(v) The area around the condenser and receiver dryer (and any other high-pressure components) to determine if there are any critical components in the vicinity that could be damaged if a burst line occurs.
(vi) Assure that the Condenser blower/fan construction is such that if the fan or impeller fails, the pieces will not damage other components or helicopter structure (§ 29.1461).
(vii) The design should be such that Freon leakage cannot be ingested into the engines (§ 29.1309). Freon is an excellent fire suppressant. Ensure that no pressure relief valve or blow out plug (on the receiver dryer) is located inside the cabin.
Quantities of Freon should also be prevented, as much as possible, from entering the cabin in the event of a leak. The rapid expansion of liquid Freon to its gaseous state in the close proximity of the flight crew could be disconcerting (could fog up the cabin).
Liquid refrigerant, if allowed to strike the body, could cause frostbite, and if allowed to strike the eye, can cause blindness.
Page MG 14 - 6
Gaseous refrigerant under Compressor increasing pressure Gaseous refrigerant Under low pressure
REFRIGERATION CYCLE Receiver Drier Liquid refrigerant Expans Condenser Coil Evaporator Coil Cooled
i t I I ~
• • ~ t I ~ I I
• I ~ I / i I I I L_ ...
/ Figure AC 29.MG 14-1 Page MG 14 - 7
AC 29-2 C, Chg 1 2/12/03
INTENTIONALLY LEFT BLANK Page MG 14 - 8
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 15. AIRWORTHINESS APPROVAL OF ROTORCRAFT HEALTH USAGE
MONITORING SYSTEMS (HUMS)
a. Purpose. The purpose of this section of the AC (AC 29 MG 15) is to provide guidance to achieve airworthiness approval for rotorcraft Health and Usage Monitoring System (HUMS) installation, credit validation, and Instructions for Continued Airworthiness (ICA) for the full range of HUMS applications. Mandatory terms used in this section of the AC, such as “must", are terms used only in the sense of ensuring the applicability of these particular methods of compliance when the acceptable means of compliance described herein are used. This section of the AC does not change regulatory requirements and does not authorize changes in, or deviations from, regulatory requirements. This section of the AC establishes an acceptable means, but not the only means of certifying a rotorcraft HUMS. AC 29 MG 15 addresses the most complex/extensive HUMS; systems of lesser complexity may be addressed by use of only the parts of this section of the AC that are pertinent. HUMS applications in the Catastrophic criticality category are not addressed herein.
b. References and Related Documents.
(1) Federal Aviation Regulations (FAR) Parts 21, 29, 33, 91, 125, 127, 129, 133, 135, 145 – Corresponding European Joint Aviation Requirements (JAR) 21, 29, JAR E, JAR-OPS 3.
(2) FAA Advisory Circular AC 29-2C and the European corresponding ACJs, AMJs where applicable.
(3) Standards - Latest revision of RTCA/DO-160/ED-14, RTCA/DO-178/ED-12, SAE documents ARP 4754, and ARP 4761.
c. Background.
(1) Various types of HUMS have been developed, and they are likely to be used more in the future. Initially, these systems were installed to show the feasibility of gathering meaningful data to modify required maintenance and/or operational actions.
The degree of qualification required for this type of installation is relatively low.
However, there is an increasing number of certification applications to install HUMS and use its data to intervene in maintenance and/or operations of the rotorcraft. This type of Page MG 15 - 1
AC 29-2C, Chg 1 2/12/03 installation requires a higher degree of qualification, commensurate to the criticality of the most severe effect of the intervention action(s) on the rotorcraft.
(2) HUMS typically consists of a variety of onboard sensors and data acquisition systems. The acquired data may be processed onboard the rotorcraft or on a ground station (or a combination of both) providing the means to measure against defined criteria and generate instructions for the maintenance staff and/or flight crew for intervention.
(3) The certification of HUMS must address the complete process, from the source of data to the intervention action. There are three basic aspects for certification of HUMS applications: installation, credit validation, and Instructions for Continued Airworthiness (ICA). These aspects are not totally independent and do have varying interactions with each other.
d. Definitions.
(1) END-TO-END: The term "end -to-end" as used in the text is intended to address the boundaries of the Health Usage Monitoring System (HUMS) application and the effect on the rotorcraft. As the term implies, the boundaries are the starting point that corresponds with the airborne data acquisition to the result that is meaningful in relation to the defined credit without further significant processing. In the case where credit is sought, the result must arise from the controlled HUMS process containing the three basic requirements for certification as follows:
(i) Equipment installation/qualification (both airborne and ground),
(ii) Credit validation activities, and
(iii) Instructions for Continued Airworthiness (ICA) activities.
(2) HUMS: Equipment, techniques, and/or procedures by which selected incipient failure or degradation and/or selected aspects of service history can be determined.
(i) Health Monitoring System: Equipment, techniques, and/or procedures by which selected incipient failure or degradation can be determined.
(ii) Usage Monitoring System: Equipment, techniques, and/or procedures by which selected aspects of service history can be determined.
(3) Credit: To give approval to a HUMS application that adds to, replaces, or intervenes in industry accepted maintenance practices or flight operations.
Page MG 15 - 2
(4) Application(s): A HUMS process implemented for a distinct purpose(s).
(5) Criticality (1309): This term describes the severity of the end result of a HUMS application failure/malfunction. Criticality is determined by an assessment that considers the safety effect that the HUMS application can have on the aircraft. There are five criticality categories as follows:
(i) Catastrophic: Failure conditions, which would prevent continued safe flight and landing.
(ii) Hazardous/Severe Major: Failure conditions, which would reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be:
(A) A large reduction in safety margins or functional capabilities, (B) Physical distress or higher workload such that the flight crew could not be relied on to perform their tasks accurately or completely, or (C) Adverse effects on occupants including serious or potentially fatal injuries to a small number of those occupants.
(iii) Major: Failure conditions which would reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload or in conditions impairing crew efficiency, or discomfort to occupants, possibly including injuries.
(iv) Minor: Failure conditions which would not significantly reduce aircraft safety, and which would involve crew actions that are well within their capabilities. Minor failure conditions may include, for example, a slight reduction in safety margins or functional capabilities, a slight increase in crew workload such as routine flight plan changes, or some inconvenience to occupants.
(v) No-Effect (Non-hazardous class): Failure conditions which do not affect the operational capability or safety of the aircraft, or the crew workload.
(6) Integrity: Attribute of a system or a component that can be relied upon to function as required by the criticality determined by the Functional Hazard Assessment (FHA).
(7) Mitigating Action: An autonomous and continuing compensating factor which may modify the level of qualification associated with certification of a HUMS Page MG 15 - 3
AC 29-2C, Chg 1 2/12/03 application. This action becomes a part of the certification requirements and, as such, is required to be performed as long as that certification requirement is not changed by a subsequent re-certification. An example of a mitigating action is a pilot's comparison of airborne HUMS data with aircraft instrument data.
(8) Commercial Off-the-Shelf (COTS): This term defines equipment hardware and software that is not qualified to aircraft standards. An example of COTS equipment hardware and software is a personal computer (PC) and its operational software.
(9) Independent Verification Means: An independent process to verify the correct functionality of a HUMS application on a ground station that utilizes COTS. The intent of independent verification is to gain some degree of confidence in the COTS operational reliability.
NOTE: This process may be discontinued when sufficient confidence in the application has been achieved.
(10) Synthesis: The p rocess of evaluating service history and any other relevant data with the objective of validating and, if necessary, refining the performance of an approved credit.
e. Certification Approach.
(1) There are three basic aspects to Health Usage Monitoring Systems (HUMS) certification. Certification of HUMS must address all three. The three aspects are installation, credit validation, and Instructions for Continued Airworthiness (ICA). These aspects are not totally independent and do have varying interactions with each other. A method to address these aspects is provided by the approach herein. Installation includes all the equipment needed for the end-to-end application that is associated with acquiring, storing, processing, and displaying the HUMS application data, including airborne and ground based equipment. Credit validation includes evidence of effectiveness for the developed algorithms, acceptance limits, trend setting data, tests, etc., and the demonstration methods employed. A plan is needed to ensure continued airworthiness of those parts that could change with time or usage and includes the methods used to ensure continued airworthiness.
(2) The certification process should begin with the declared application intent, and determination of the resultant criticality. This declared intent should consider whether this application is for credit, that it adds to, replaces, or intervenes in maintenance practices or flight operations. When the declared intent is for credit, the end-to-end criticality for such an application should be determined and used as an input to establish the integrity criteria. If the declared intent is for non- credit, it may be certified as long as it can be shown that the installation of the equipment will not result in a hazard to the aircraft.
Page MG 15 - 4
(3) The end-to-end criticality can be determined by performing a Functional Hazard Assessment (FHA). The integrity level is required to be equivalent to the determined end-to-end criticality. Compliance with the criticality level established by the FHA must be demonstrated. This may be achieved by a combination of application qualification plus appropriate mitigating actions.
(4) Applications are often qualified to a low level of integrity due to the assessment of criticality; however, it may be desirable to transition to a higher qualification level for future uses. Transition from one level of integrity to another will require re-evaluation.
NOTE: A certification plan may be provided to assist in the certification process. At a minimum, this plan should address the proposed means of compliance to each applicable paragraph of this advisory circular for a given application. Early submittal of this plan to the regulatory Authority is recommended.
f. Installation. Installation approval must cover systems and equipment that acquire, store, process, and display HUMS data and includes the airframe installation, or any one of these functions for a particular application. AC 29 MG 15 will address the most complex/extensive HUMS; systems of less complexity may be covered by use of only the parts of this AC that are pertinent. Different systems exhibit varying capabilities and configurations. Additionally, there may be different functional distributions between airborne and ground based equipment. HUMS equipment requirements consist of common requirements plus the unique requirements of airborne and ground based equipment.
(1) Common Requirements. A common requirement is one that applies to airborne, ground based, and installation equipment. These common requirements are discussed below.
(i) Criticality Determination.
(A) Criticality determination is a primary decision point relating to the depth of requirements for certification. The intended application can range from systems that acquire data for proof of concept only, to a system that acquires and processes data to determine if a life-limited part should be replaced. This range of applications will have a corresponding range of criticality for the systems from No Effect to Hazardous/Severe-Major. Systems in the Catastrophic criticality category are not addressed in AC 29 MG 15.
(B) If any credit is to be gained, the general guidelines for determination of criticality levels will be either Minor, Major, or Hazardous/Severe-Major. They will be in agreement with the resulting effect of the end-to-end criticality assessment.
Page MG 15 - 5
AC 29-2C, Chg 1 2/12/03 (C) Typical examples of applications which may be classified as Catastrophic are as follows :
(1) Applications providing cockpit warning(s) which are the only means of detection with associated flight manual instructions to land immediately.
(2) System applications, for which constantly misleading information could be assessed as leading to a Catastrophic condition, must be designed to either detect these errors (e.g. Built-In-Test, system redundancy, etc.) and/or be tolerant to these errors (i.e., procedural, etc.).
(D) The Functional Hazard Assessment (FHA) may be a preliminary document to the Preliminary Safety Assessment (PSA) or a part of the PSA. The FHA is a top down analysis (which should involve pilots and flight analysts as well as engineers) that starts with the hazards to the rotorcraft and traces these hazards to the system, subsystem, and component level in the areas affected by HUMS. This type of analysis starts with the determination of what undesirable effects can occur as a direct or indirect result of using HUMS for maintenance or operational actions. The level of severity associated with this effect will result in assigning a criticality level that uses the definitions of criticality contained herein.
(E) The final level of equipment qualification may not only be the result of technical considerations, but also of other mitigating actions, of which there are many types. Many of these actions can result in a reduction of qualification levels for equipment.
(ii) Mitigating Actions.
(A) A mitigating action is an autonomous and continuing compensating factor which may modify the level of qualification associated with certification of a HUMS application. These actions are often performed as part of continued airworthiness considerations and are also an integral part of the certification. As such, the continuation of certification limitations, where appropriate, must be included in the Instructions for Continued Airworthiness (ICA). Mitigating actions are subjective in nature and are an intended method(s) of application where the pre-mitigated levels of integrity are defined.
(B) Applications that use COTS software and therefore may not be fully qualified applying RTCA/DO-178/ED-12 methodology may be accepted by alternative qualification methods as stated in paragraph f(3). Therefore, the subsequent use of mitigating actions that are of themselves of a subjective nature should be approached with caution. A mitigating action must be based upon the integrity level derived from the FHA.
Page MG 15 - 6
(C) If the mitigating action is an operational consideration, the same concerns apply for continuing the mitigating action. The mitigating action should be recorded in the certification limitations and in the approved flight manual.
(iii) Performance. There must be minimum end- to-end performance criteria consistent with the application's intended use. Performance criteria, as a minimum, should consider accuracy, timing/sampling, resolution, event recognition, and consistency. The HUMS signal source must be compatible with the determined qualification level. Tests should be conducted to demonstrate that these criteria are met.
(2) Airborne Equipment Installation. Airborne equipment and the associated installation qualification procedures are the same as for any other airborne equipment.
The installation qualification and the equipment qualification may be considered two separate activities although there is an obvious relationship between them. Signal independence, irrespective of method of implementation, should exist to the extent that acquisition of HUMS signals should not compromise the level of safety or reliability of functions provided by other equipment as a result of signal sharing.
(i) Equipment Installation. Equipment not approved by other methods must be approved as part of the installation and must consider overall system requirements.
(A) Equipment Qualified as Part of Installation. Equipment qualified all or in part as a part of the installation includes minor and major parts. Examples of minor parts are: connectors, common usage relays, diodes, etc. Examples of major parts are non-prequalified equipment (equipment not TSO’d or not qualified under the TSO to the required level for installation approval), consisting of significant system components and as transducers with their interfaces. Equipment qualification must consider environmental qualification (RTCA/DO-160/ED 14) including high intensity radiated fields (HIRF) and lightning.
(B) Software. RTCA/DO-178/ED-12 should be used for the software development standard. (See following figure for typical airborne application process for software not containing COTS.)
Page MG 15 - 7