AFCS operating mode.
(2) Pilot recognition of AFCS malfunctions. The pilot may detect an AFCS failure condition through aircraft motion cues or by cockpit flight instruments or alerts. The specific recognition cues will vary with specific failure type, flight condition, phase of flight, and crew duties. When evaluating AFCS malfunctions for attentive hands-off and passive flight, it should be assumed that the flight crew is performing cockpit duties that require it to divert their attention away from the flight instruments.
(i) Hardover. The recognition point should be that at which a pilot operating in non-visual conditions may be expected to recognize the need to take action. Recognition of the effect of the failure may be through the behavior of the rotorcraft or through an appropriate alerting system. Flight control movements alone should not be used for recognition. The pilot recognition time will be the least of the time taken for the:
(A) rotorcraft to achieve an angular rate of change about any axis of 3° per sec (active and attentive flight). The time taken for the rotorcraft to achieve an angular rate of change about any axis of 5° per sec (passive flight);
(B) rotorcraft to increase or decrease acceleration along any axis by 0.2g (active and attentive flight). The time taken for the aircraft to achieve an acceleration about any axis of 0.25g (passive flight); or (C) relevant alert to function.
(ii) Slowover. This type of failure condition is typically recognized by a path deviation indicated on primary flight instruments (for example, course deviation indicator (CDI), altimeter, or vertical speed indicator). It is important that the recognition criteria are agreed upon with the FAA. The following identify examples of recognition criteria as a function of flight phase:
(A) En-route cruise. Recognition through the altitude alerting system can be assumed for vertical path deviation. The lateral motion of the rotorcraft may go unrecognized for a significant period of time, unless an alerting system is installed and the slowover results in a path or attitude deviation in excess of the limit allowed by the alerting system.
(B) Climb and descent. Recognition through increasing or decreasing vertical speed, pitch attitude, roll attitude, or heading can be assumed.
(C) On an approach with vertical path reference. A displacement recognition threshold should be identified and selected for testing that is appropriate for the display(s) and failure condition(s) to be assessed.
Page Apdx B - 9
AC 29-2C, Chg 7 2/4/2016 (D) On an approach without vertical path reference. Criteria similar to the climb or descent condition can be assumed.
Note: Credit may be taken for excessive deviation alerts, or other clear and unambiguous alerts provided to the pilots, if available.
(iii) Oscillatory. Oscillatory failures having structural implications must be addressed under part 29, Subpart C and § 29.1309. The flight crew is expected to disengage the automatic control elements of the AFCS that have adverse oscillatory effects and not follow adverse oscillatory guidance. However, if unable to disconnect some elements of the AFCS in the presence of an oscillatory failure condition, there should be an evaluation of the long-term effects on crew workload and the occupants.
(3) Pilot response time. Pilot response time consists of pilot recognition time + pilot reaction time. The pilot response time is considered dependent upon the pilot attentiveness, based upon the phase of flight and associated duties. This period commences at the time the pilot is cued to the fact that something abnormal is occurring (at the end of the pilot recognition time) and terminates when the controls are moved to commence the recovery maneuver. The pilot recognition time is assumed to increase as the pilot relaxes his involvement level. The pilot reaction time is longer for 'hands-off’ than for 'hands-on' as the pilot has to locate the controls before he can move them. The following pilot response times have been considered acceptable:
Flight Segment Recognition Time (sec) Reaction Time (sec) Pilot Response Time (sec) Active - 0.5 0.5 Attentive–Hands-On 1.0 0.5 1.5 Attentive–Hands-Off 1.0 1.0 2.0 Passive 2.0 1.0 3.0 Notes: Recovery from simulated malfunctions of any AFCS axis occurring while the pilot is applying control inputs to cause rotation about that axis may be initiated with normal pilot reaction; the 1-second delay (decision time) in maneuvering (attentive hands-on) flight pertains to established turns (level, climbing, and descending) only.
For rotorcraft requiring a minimum crew of two pilots and with AFCS systems that do not have the capability to couple to AP modes, it can be assumed that the pilot is attentive-hands-off during the climb, cruise, and descent phases of flight.
(D) Pilot Recovery.
Page Apdx B -10
(i) Pilot recovery action. The recovery action should be commenced after the pilot recognition and response times. Following such delay, the pilot should be able to return the rotorcraft to its normal flight attitude under full manual control without excessive pilot skill or strength. During the recovery, the pilot may overpower the autopilot or disengage it.
(ii) AFCS Altitude Loss Testing. To determine the maximum altitude loss of the various AFCS modes during the different flight phases, a representative pilot recovery maneuver appropriate to the rotorcraft type and flight condition should be performed. This maneuver should not lead to an unsafe speed or attitude excursions to resume a normal flight path. An incremental normal acceleration in the order of 0.5 g is considered the maximum for this type of maneuver.
(7) Stability Augmentation System (SAS).
(i) If an SAS installation stabilizes the rotorcraft by allowing the pilot to “fly through” and perceive a stable, well-behaved vehicle, it qualifies as a SAS, and if reliable, receives credit under paragraph III. through VII. of Appendix B to part 29 for use in complying with all-handling qualities requirements. If a conventional autopilot does not provide “fly through” capability or allow the pilot to perceive a stable, well behaved vehicle through his manipulation of primary flight controls and feedback from those controls, then it tends to remove him from active involvement in flying and is eligible primarily as a workload reliever.
(ii) If handling qualities credit is given for a SAS then it must be shown to be reliable in regards to § 29.1309. If a reliable SAS is incorporated, it should be operational during handling qualities testing for trim and stability. Reasonable single failures of the SAS must be evaluated and the resultant handling qualities must be evaluated to assure that in this degraded configuration: (1) handling qualities have not been degraded below “VFR” levels defined in part 29, Subpart B; (2) the rotorcraft is free from any tendency to diverge rapidly from stabilized flight conditions; and (3) the rotorcraft can be flown IFR throughout its endurance capability without undue difficulty by the minimum flight crew. Compliance with a majority of the IFR handling qualities requirements is desired and the degraded characteristics should be documented and explained. Revised flight envelope boundaries for the failed condition may be considered if they are controllable by the pilot (e.g., altitude and airspeed). When loss of a SAS results in a need for minor adjustment of a flight condition then a system can be accepted that allows failures during the life of each rotorcraft. If loss of the system will prevent continuation of safe flight and landing, the reliability of the system must be high enough to assure that failure of the system will not be expected to occur during the life of the rotorcraft fleet. When evaluating the reliability of a system, the installation of the system should be considered as part of the design. The total system including inputs, outputs, environment, isolation features, and exposure times is a pertinent consideration.
Page Apdx B - 11
- AC 29-2C, Chg 7 2/4/2016
(iii) SAS reliability is evaluated by Systems and Equipment personnel. If credit is to be given for system reliability and the applicant exempted from consideration of malfunction, hardover and oscillatory conditions (limited to critical frequencies determined during autopilot failure analysis), a thorough system evaluation is needed.
Flight test personnel should coordinate closely with the systems and equipment personnel whenever credit is given for advanced design and system reliability because the hardover or malfunction condition may not require in-flight testing. The decision is made on the basis of system design, failure analysis, and overall probability of malfunction. Multi-lane systems require careful consideration when determining the need for hardover or malfunction testing of second and subsequent failures. Factors to be taken into account are:
(A) Dissimilarity of architecture (hardware and software) between the multiple lanes.
(B) Cumulative probabilities. For example, in a quadruplex system where each lane has a failure probability of 1x10-4 and depending on system architecture, the level of criticality applied to the software, and the potential for generic failures the probability of three lanes failing leaving the remaining lane unmonitored would be a 1x10-12 event. In this case, testing of the third and fourth failures would not be required.
(C) Consequences of a multiple failure, considering § 29.1309. A multiple failure should not present a hazard to a category B rotorcraft or prevent continued safe flight and landing for a category A rotorcraft.
(D) Operational restrictions post-failure. If it were possible to recouple the upper modes and continue the flight without restrictions post-failure, then consider any subsequent failures with pilot intervention times relevant to the phase of flight. If a flight restriction is provided, it should be determined to be an appropriate and relevant operating limitation, and it should be specified in the RFM. Significant information regarding the restriction should be made available to the pilot in the operating procedures section of the RFM. If the restriction excludes operation under any of the flight conditions listed above, flight testing of the condition is not required. If the system is to be approved without flight restrictions (operating at all times), malfunctions should be demonstrated to be satisfactory during takeoff, climb, cruising, landing, maneuvering, and hovering.
(iv) Applicable procedures and techniques for conduct of hardover tests are contained in section 29.1329 of this AC. All cockpit emergency controls including emergency quick disconnects should be “red.” The quick disconnect may be actuated at initiation of recovery. Other disconnects should only be actuated after full aircraft control has been achieved following recovery. Aircraft limits may not be exceeded during malfunction or recovery. If a monitor device automatically disconnects the SAS, it must be clearly annunciated to the crew. Appropriate delay times are shown in paragraph b.(6)(iii)(C)(3).
Page Ap dx B - 12
(v) Series actuator hardover conditions in some rotorcraft can seriously degrade control margin. Critical loadings, power settings, RPM, and altitudes in conjunction with a SAS actuator hardover in an adverse direction can result in reduction of control travel requiring flight envelope constraints. Flight testing is usually necessary to determine the appropriate flight envelope reductions.
(vi) Subsequent failures and unrelated probable combinations of failures must be considered, including subsequent SAS failures. Systems and equipment section analysis should provide necessary SAS malfunction combinations for flight testing because of their system analysis. Minimum requirements for dispatch and procedures following failure should be included in the malfunction analysis. Results of the probability analysis and the resultant malfunction configurations are primarily the responsibility of the systems and equipment section.
(vii) No reasonably probable failure should result in a worse condition than that tested for hardovers. For example, if a magnetic brake force trim system is employed, failure of electrical power to the magnetic brake circuit may cause the cyclic control to fall, which may result in a more dangerous flight condition than individual SAS hardovers. The overall control system is to be evaluated for all probable failures to preclude hazardous failure conditions. Other areas for investigation include beep trim and auto trim failures. The delay times of paragraph b.(6)(iii)(C)( 3) are appropriate for all such failures. System malfunctions may also include component failures, which result in oscillatory outputs of the actuator(s). These should be sustainable at least as long as the specified hardover delays, should be manageable thereafter with hands on the controls, and should allow disconnect of the malfunctioning system.
(viii) Engine failure requirements are not entirely consistent with the SAS failure time delays shown in paragraph b.(6)(iii)(C)(3). Engine failure time delays remain as specified in § 29.143(e) and they are lower than corresponding SAS failure delays. Critical engine failure conditions should be reverified during simulated instrument flight with primary reference to flight instruments. Lower time delays for engine failure have been justified on the basis of immediate cues for the critical high powered condition, and requirements for engine failure warning systems. Many rotorcraft designs simply cannot endure a 3-second time delay for critical engine failure conditions. Nevertheless, engine failure, autorotation entries, and autorotation descent (for single engine rotorcraft and multiengine rotorcraft without category A engine isolation) must be evaluated in simulated IFR conditions and these flight characteristics must be acceptable.
(8) Controllability.
(i) Control harmony should be present. There should be no objectionable cyclic to collective or roll-yaw-pitch cross coupling.
Page Apdx B - 13
AC 29-2C, Chg 7 2/4/2016
(ii) Control forces following a control system malfunction such as a hydraulic system failure should be low enough to allow completion of the intended flight. It may not be possible to land early during an actual IFR flight.
(iii) There should be no tendencies for pilot induced oscillations; there should be no sustained or uncontrollable oscillations resulting from the efforts of the pilot to control the rotorcraft.
(iv) The control system must have sufficient resolution to permit accurate and precise instrument maneuvers. Some control systems with high breakout forces in conjunction with low control force gradients do not lend themselves to satisfactory instrument flight capability.
(9) Cockpit Arrangement.
(i) The primary flight instrument basic T (or a modified T with VSI above the altimeter) should be located directly in front of the pilot. All annunciations necessary for operation of stability systems should be readily in view. Secondary flight (or navigation) instruments such as radar altimeter and secondary radio course information, DME, etc., should be grouped around the periphery of the T. Next in priority are primary power instruments such as torque and rotor RPM. Powerplant instruments and backup attitude information should be placed in the remaining panel areas. Various research and development efforts and previous certification programs have revealed that it is desirable not to locate the standby attitude indicator immediately adjacent to the basic flight instrument T. The standby attitude indicator must be usable and flyable from the primary pilot station (and any other pilot station); however, locating it too close to the primary instruments may be undesirable and should be evaluated. If the standby attitude information is close to the pilot’s normal flight instrument scan, he may begin to compare attitude information between the two indicators in his normal instrument scan.
Every pilot eye motion to compare these indicators could be a wasted motion that could be more efficiently applied in the normal scan. The pilot should fly either the primary or the backup indicator and it may be an aid if these indicators are noticeably separated.
When the standby indicator is located apart from the normal scan and the primary indicator fails, the pilot is conscious of a distinctly different instrument scan and is less likely to be continuously coming back to the center of the basic T for attitude reference.
Physical separation can assist the transition to standby attitude flight.
(ii) All cockpit controls necessary for normal and emergency operations should ideally be located so that they may be actuated without upper body movement.
Moderate head and body movement has been accepted; however, these motions must be evaluated for their vertigo inducing effects. No IFR controls should be located aft of a vertical plane passing left to right (laterally) through the pilot’s body.
(iii) If a copilot position is approved, the copilot must have a complete set of flight controls, and a complete set of primary flight instruments. The copilot must be capable of independently flying and navigating the rotorcraft from his position. The Page Apdx B - 14
copilot must be capable of controlling at least one primary navigation source so that he can operate the rotorcraft during normal conditions without relying on the first pilot to perform needed cockpit functions. Some instruments can be shared between pilots depending on instrument panel presentation. Some examples from previous programs include standby attitude, rotor tachometer (if the aircraft has automatic governing and the crew is provided visual and aural RPM warning), and secondary powerplant instruments such as NG, oil pressure, and temperature.
(iv) Proper cockpit annunciation is essential for safe operation. SAS and autopilot modes must be properly annunciated. Appropriate annunciator color coding is contained in § 29.1322. There must be no question in regard to the source of navigation information presented to the crew. Where navigation switching is available between individual displays and between pilot positions, the first pilot should have overriding control for his displays.
(v) Electromechanical Displays. Due to the increased complexity of instrumentation that is available and in use, it is appropriate to consider the extreme range of operational environments to which rotorcraft were being routinely exposed. It is the intent of Appendix B to part 29, VIII.(b)(5) to prevent degrading of the first pilot’s instrument system, or the only pilot’s instrument system in a single-pilot-approved rotorcraft, by not permitting connection of peripheral systems to it. In addition, equipment must not be connected to operating systems for the second pilot’s required instruments unless it is extremely improbable that failure of such additional equipment would affect that operating system.
(vi) Advanced Display Systems. The increased use of mi croprocessor technology in avionic systems has resulted in the use of computer-generated graphics to replace conventional electromechanical instruments. These displays may replace individual instruments or may integrate several flight critical parameters into single displays. For display of redundant information, “crosstalk” between the pilot and copilot displays and supporting systems has been allowed to provide detection and annunciation of faults or “miscompare” of critical flight information. A level of safety finding equivalent to that level of safety provided by Appendix B to part 29, VIII.(b)(5)(i) through (iii) may be possible through the implementation of integration technology that will assure that failure of one system does not and can not adversely affect the other system. For those installation designs that employ integration technology, adequate system testing and any analysis necessary must be conducted to assure that failure of one system will not adversely affect the other system when demonstrating compliance to the minimum safety level established by Appendix B to part 29, VIII.(b)(5)(i) through
(iii).
(10) IMC Evaluation.
(i) As part of the flight test program, new rotorcraft undergoing IFR certification should be flown in the air traffic control system in actual day and night Page Apdx B - 15
AC 29-2C, Chg 7 2/4/2016 instrument meteorological conditions. Items for consideration during the IMC evaluation include:
(A) Ability of the rotorcraft to safely operate in the National Airspace System, including crew capabilities to cope with probable malfunctions. Examples of failures imposed during this IMC evaluation on previous programs are shown below:
(1) Hydraulic failure.
(2) Individual COMM, NAV, or intercom failure.
(3) Engine failure.
(4) Loss of any power input.
(5) SAS failure.
(6) Trim failure.
(7) Individual failure of each vertical and directional gyro.
(B) Visibility during low approach conditions in precipitation.
(C) Glare and reflections at night in clouds.
(D) Workload demands on the minimum flight crew including the failures in paragraph b.(10)(i)(A).
(E) Handling qualities in turbulence throughout the IFR approved envelope including typical IFR flight maneuvers with:
(1) reasonably anticipated SAS failures,
(2) reasonably probable control system failures (hydraulics, force trim, basic ship systems, etc.),
(3) the typical workload conditions associated with operating in high density traffic areas, and
(4) other reasonable, probable failures.
(F) Cockpit leaks in precipitation that affects pilot efficiency, safety, or rotorcraft airworthiness.
(ii) Rotorcraft that are an improved, modified, or later model of previously approved type that have no significant changes in the fuselage and windshield Page Apdx B - 16
configuration, the aircraft lighting system, and the rain removal systems do not need to be flown in clouds. They may need to be evaluated in clouds if, in the judgment of the flight test personnel, there is some doubt as to the similarity of the configuration.
However, a previously approved rotorcraft undergoing IFR certification tests for a different SAS should not require a series of actual IFR flights just to determine the pilot workload, or if it can be flown in clouds.
(11) Static Position Error. The static position error should be reevaluated to determine altimeter error during instrument approach conditions. This is particularly important when high angle approaches (above 3°) are approved. Static position error for 3° approaches can typically be approximated by the level flight error. Level flight error is constrained by the requirements of § 29.1325(f). The direction of error is important. If the indicated value is lower than actual value, the error is in a conservative direction and further investigation may not be required. The direction and magnitude of static position error should be determined for steep angle approach conditions and additional information provided when necessary in the RFM. An investigation of static system response during the go-around transition should be investigated.
(12) Cross Coupling. IFR handling qualities are enhanced by providing low levels of coupling between axes. During the flight evaluation, pilots should be alert for strong cross coupling tendencies between yaw and pitch, heave (collective) and pitch, heave and roll, or roll and pitch. Any strong coupling effects between these motions may produce unacceptable handling qualities for IFR flight. The rotorcraft must be a ble to make a smooth transition from any flight condition. As an example, large rolling or pitching moments with collective application would represent questionable handling characteristics for the IFR missed approach condition.
(13) Electrical, Avionics, and Instruments. Some aircraft have been certificated with different equipment from that suggested in this subparagraph because the certification criterion for IFR has evolved in several stages. The following guidance refers to the latest certification requirements:
(i) Additional Avionics and Instruments. The avionics and instruments required for certification for operations under IFR beyond those required for VFR certification should be as follows:
(A) Attitude Indicator Power for operation and lighting must be independent from the rotorcraft electrical generating or starting system, and the instrument markings must meet the minimum usability requirements of § 29.1303(g)(1).
Section 29.1303 of this AC provides additional guidance on marking requirements for attitude indicators. Operation must be maintained for a minimum of 30 minutes after total aircraft electrical power generating system failure. For dual pilot configurations, one pilot’s primary indicator may be designated for this purpose, provided standby batteries are provided.
Page Apdx B - 17
AC 29-2C, Chg 7 2/4/2016 (B) Alternate Static Source. An alternate static source with a means of selecting this source must be provided for single pilot configurations.
(C) Thunderstorm Lights. Thunderstorm lights are high intensity white lighting that floods the instrument panel area containing the basic flight instruments.
(D) Direction Indication, Gyro Stabilized. Magnetic in place of non-magnetic required by § 29.1303(h).
(E) Navigational Systems. Navigational systems required by the applicable operational rules must be provided.
(F) Communication Systems. Communication systems required by the applicable operational rules must be provided.
(G) Other electrical and electronic equipment. Oth er electrical and electronic equipment required by the applicable operational rules must be provided.
(ii) Electrical Power Availability for Avionic and Instrument Systems. Minimum avionic and instrument systems should remain operative after electrical power failures in relation to IFR operation. The lists that follow suggest the minimum Avionic and Instrument Systems that should remain operational after a single failure of the generating system and after failure of all but the emergency power source. These lists do not address the basic equipment required for non-IFR related operation. These basic equipment requirements are addressed by the appropriate paragraph of this guidance. Where a time- limited power source is provided for compliance with § 29.1351(d)(2), in determining the endurance it should be assumed that flight under instrument flight rules will be continued for a period of not less than 30 minutes following the failure of the normal electrical power generating system.
(A) Avionic and instrument systems that should remain operational, for IFR approved rotorcraft, after a single failure of the electrical generating system. The rotorcraft must be capable of continued safe IFR flight to destination, and subsequently to an alternate, and then effect a safe instrument approach and landing. The suggested minimum avionic and instrument systems are as follows:
(1) Flight Instruments - same as § 29.1303 requirements, except as defined by paragraphs b.(13)(i)(A) and (D).
(2) Communications - one VHF radio.
(3) Navigation System - one navigation system, including necessary sensor inputs such as directional gyros.
(4) Transponder.
Page Apdx B - 18
(5) ICS System - required for two pilot approval.
(6) Instrument Lights (or equivalent).
(B) Avionic and instrument systems that should remain operational, for IFR approved rotorcraft, after total failure of the electrical generating system. The rotorcraft must be capable of flight for a minimum of 30 minutes. The suggested minimum equipment is as follows:
(1) Magnetic Compass.
(2) Airspeed-Altitude-Attitude Presentation.
(3) Communications One VHF System.
(4) Instrument Lights (or equivalent).
(5) ICS System-For Two Pilot Approval.
(C) Additional requirements for Category A rotorcraft. Where a timelimited power source is provided for compliance with § 29.1351(d)(2), in determining the endurance it should be assumed that flight under instrument flight rules will be continued for a period of not less than 30 minutes following the failure of the normal electrical power generating system.
(iii) Directional Instruments. A magnetic, gyro stabilized direction indicator is specified because navigation in instrument flight must be precise. In rotorcraft, the nonstabilized magnetic indicator is subject to many errors, particularly in turbulence.
Therefore, it is inappropriate as the primary source of directional information, but it is adequate as an emergency source. A nonslaved directional gyro is also inappropriate as the primary source of directional information because of drift and the requirement to set it to some other precise reference.
(A) As a minimum for single pilot IFR, a nonstabilized magnetic indicator (such as a “whiskey compass”) and a magnetic gyroscopically stabilized direction indicator system (slaved) are required.
(B) The minimum for dual pilot certification includes the instruments required for single pilot, and an additional independent gyroscopically stabilized directional indicator system (slaved or unslaved).
(14) IFR Electrical System.
(i) General.
Page Apdx B - 19
AC 29-2C, Chg 7 2/4/2016 (A) The entire electrical system, both AC and DC portions, must be reviewed with IFR operation in mind. This review is necessary since most of the rotorcraft presently certificated do not include IFR operation as part of their certification.
Many aspects of normal operation and results of failure conditions may be entirely acceptable for VFR operation, but unacceptable for IFR operation.
(B) Provisions should be made for a capability to continue flight to destination and alternate airports in the event of a single failure in the electrical system.
Section 29.1351 of this AC contains the definition of a “single failure.” The evaluation of the system under failure conditions should consider not only the failure itself, but also the recommended cockpit procedure to respond to any failure.
(C) The fault analyses of the electrical system and the results of the system testing to validate that analysis serves as a good starting place for the electrical system review. Failure of each generator, each battery, and each component, such as switches and relays, should be accounted for first since failure of equipment and components are the most probable.
(D) System failure such as tripped circuit breakers, blown fuses, loss of busses, loss of feeders, loss of ground terminals, and failure of electrical disconnect plugs should also be considered.
(E) Routing of all wiring from each power source throughout the distribution system should be reviewed. In all instances, feeder wires should be routed separately from small gage control wiring. In addition, wiring for each power system should be separated to the maximum extent practical from the wiring associated with other required power systems.
(F) A single electrical disconnect plug should not contain wiring for more than one generating system. Many systems incorporate automatic feeder fault protection that disables a power source experiencing a short circuit on its feeder, and in some instances, passive protection has been provided for the feeders.
(G) There may be other failures that should be considered that are peculiar to the specific design being evaluated, and if so, an appropriate accounting of these failures should also be made.
(ii) Review of Regulations. The airworthiness regulations concerning electrical systems begin with § 29.1301 Subpart F (Equipment) and continue up to § 29.1411. Other rules may also concern the electrical system; however, compliance with these sections should have been assured as part of the original VFR approval.
(iii) Specific Emphasis Areas. In some previous installations, changes have been necessary in the areas listed below. Future installations should be checked carefully in these areas and other areas that indicate a need for attention.
Page Apdx B - 20