(i) Pilot recovery action. The recovery action should be commenced after the pilot recognition and response times. Following such delay, the pilot should be able to return the rotorcraft to its normal flight attitude under full manual control without excessive pilot skill or strength. During the recovery, the pilot may overpower the autopilot or disengage it.
(ii) AFCS Altitude Loss Testing. To determine the maximum altitude loss of the various AFCS modes during the different flight phases, a representative pilot recovery maneuver appropriate to the rotorcraft type and flight condition should be performed. This maneuver should not lead to an unsafe speed or attitude excursions to resume a normal flight path. An incremental normal acceleration in the order of 0.5 g is considered the maximum for this type of maneuver.
(7) Stability Augmentation System (SAS).
(i) If an SAS installation stabilizes the rotorcraft by allowing the pilot to “fly through” and perceive a stable, well-behaved vehicle, it qualifies as a SAS, and if reliable, receives credit under paragraph III. through VII. of Appendix B to part 29 for use in complying with all-handling qualities requirements. If a conventional autopilot does not provide “fly through” capability or allow the pilot to perceive a stable, well behaved vehicle through his manipulation of primary flight controls and feedback from those controls, then it tends to remove him from active involvement in flying and is eligible primarily as a workload reliever.
(ii) If handling qualities credit is given for a SAS then it must be shown to be reliable in regards to § 29.1309. If a reliable SAS is incorporated, it should be operational during handling qualities testing for trim and stability. Reasonable single failures of the SAS must be evaluated and the resultant handling qualities must be evaluated to assure that in this degraded configuration: (1) handling qualities have not been degraded below “VFR” levels defined in part 29, Subpart B; (2) the rotorcraft is free from any tendency to diverge rapidly from stabilized flight conditions; and (3) the rotorcraft can be flown IFR throughout its endurance capability without undue difficulty by the minimum flight crew. Compliance with a majority of the IFR handling qualities requirements is desired and the degraded characteristics should be documented and explained. Revised flight envelope boundaries for the failed condition may be considered if they are controllable by the pilot (e.g., altitude and airspeed). When loss of a SAS results in a need for minor adjustment of a flight condition then a system can be accepted that allows failures during the life of each rotorcraft. If loss of the system will prevent continuation of safe flight and landing, the reliability of the system must be high enough to assure that failure of the system will not be expected to occur during the life of the rotorcraft fleet. When evaluating the reliability of a system, the installation of the system should be considered as part of the design. The total system including inputs, outputs, environment, isolation features, and exposure times is a pertinent consideration.
Page Apdx B - 11
- AC 29-2C, Chg 7 2/4/2016
(iii) SAS reliability is evaluated by Systems and Equipment personnel. If credit is to be given for system reliability and the applicant exempted from consideration of malfunction, hardover and oscillatory conditions (limited to critical frequencies determined during autopilot failure analysis), a thorough system evaluation is needed.
Flight test personnel should coordinate closely with the systems and equipment personnel whenever credit is given for advanced design and system reliability because the hardover or malfunction condition may not require in-flight testing. The decision is made on the basis of system design, failure analysis, and overall probability of malfunction. Multi-lane systems require careful consideration when determining the need for hardover or malfunction testing of second and subsequent failures. Factors to be taken into account are:
(A) Dissimilarity of architecture (hardware and software) between the multiple lanes.
(B) Cumulative probabilities. For example, in a quadruplex system where each lane has a failure probability of 1x10-4 and depending on system architecture, the level of criticality applied to the software, and the potential for generic failures the probability of three lanes failing leaving the remaining lane unmonitored would be a 1x10-12 event. In this case, testing of the third and fourth failures would not be required.
(C) Consequences of a multiple failure, considering § 29.1309. A multiple failure should not present a hazard to a category B rotorcraft or prevent continued safe flight and landing for a category A rotorcraft.
(D) Operational restrictions post-failure. If it were possible to recouple the upper modes and continue the flight without restrictions post-failure, then consider any subsequent failures with pilot intervention times relevant to the phase of flight. If a flight restriction is provided, it should be determined to be an appropriate and relevant operating limitation, and it should be specified in the RFM. Significant information regarding the restriction should be made available to the pilot in the operating procedures section of the RFM. If the restriction excludes operation under any of the flight conditions listed above, flight testing of the condition is not required. If the system is to be approved without flight restrictions (operating at all times), malfunctions should be demonstrated to be satisfactory during takeoff, climb, cruising, landing, maneuvering, and hovering.
(iv) Applicable procedures and techniques for conduct of hardover tests are contained in section 29.1329 of this AC. All cockpit emergency controls including emergency quick disconnects should be “red.” The quick disconnect may be actuated at initiation of recovery. Other disconnects should only be actuated after full aircraft control has been achieved following recovery. Aircraft limits may not be exceeded during malfunction or recovery. If a monitor device automatically disconnects the SAS, it must be clearly annunciated to the crew. Appropriate delay times are shown in paragraph b.(6)(iii)(C)(3).
Page Ap dx B - 12
(v) Series actuator hardover conditions in some rotorcraft can seriously degrade control margin. Critical loadings, power settings, RPM, and altitudes in conjunction with a SAS actuator hardover in an adverse direction can result in reduction of control travel requiring flight envelope constraints. Flight testing is usually necessary to determine the appropriate flight envelope reductions.
(vi) Subsequent failures and unrelated probable combinations of failures must be considered, including subsequent SAS failures. Systems and equipment section analysis should provide necessary SAS malfunction combinations for flight testing because of their system analysis. Minimum requirements for dispatch and procedures following failure should be included in the malfunction analysis. Results of the probability analysis and the resultant malfunction configurations are primarily the responsibility of the systems and equipment section.
(vii) No reasonably probable failure should result in a worse condition than that tested for hardovers. For example, if a magnetic brake force trim system is employed, failure of electrical power to the magnetic brake circuit may cause the cyclic control to fall, which may result in a more dangerous flight condition than individual SAS hardovers. The overall control system is to be evaluated for all probable failures to preclude hazardous failure conditions. Other areas for investigation include beep trim and auto trim failures. The delay times of paragraph b.(6)(iii)(C)( 3) are appropriate for all such failures. System malfunctions may also include component failures, which result in oscillatory outputs of the actuator(s). These should be sustainable at least as long as the specified hardover delays, should be manageable thereafter with hands on the controls, and should allow disconnect of the malfunctioning system.
(viii) Engine failure requirements are not entirely consistent with the SAS failure time delays shown in paragraph b.(6)(iii)(C)(3). Engine failure time delays remain as specified in § 29.143(e) and they are lower than corresponding SAS failure delays. Critical engine failure conditions should be reverified during simulated instrument flight with primary reference to flight instruments. Lower time delays for engine failure have been justified on the basis of immediate cues for the critical high powered condition, and requirements for engine failure warning systems. Many rotorcraft designs simply cannot endure a 3-second time delay for critical engine failure conditions. Nevertheless, engine failure, autorotation entries, and autorotation descent (for single engine rotorcraft and multiengine rotorcraft without category A engine isolation) must be evaluated in simulated IFR conditions and these flight characteristics must be acceptable.
(8) Controllability.
(i) Control harmony should be present. There should be no objectionable cyclic to collective or roll-yaw-pitch cross coupling.
Page Apdx B - 13
AC 29-2C, Chg 7 2/4/2016
(ii) Control forces following a control system malfunction such as a hydraulic system failure should be low enough to allow completion of the intended flight. It may not be possible to land early during an actual IFR flight.
(iii) There should be no tendencies for pilot induced oscillations; there should be no sustained or uncontrollable oscillations resulting from the efforts of the pilot to control the rotorcraft.
(iv) The control system must have sufficient resolution to permit accurate and precise instrument maneuvers. Some control systems with high breakout forces in conjunction with low control force gradients do not lend themselves to satisfactory instrument flight capability.
(9) Cockpit Arrangement.
(i) The primary flight instrument basic T (or a modified T with VSI above the altimeter) should be located directly in front of the pilot. All annunciations necessary for operation of stability systems should be readily in view. Secondary flight (or navigation) instruments such as radar altimeter and secondary radio course information, DME, etc., should be grouped around the periphery of the T. Next in priority are primary power instruments such as torque and rotor RPM. Powerplant instruments and backup attitude information should be placed in the remaining panel areas. Various research and development efforts and previous certification programs have revealed that it is desirable not to locate the standby attitude indicator immediately adjacent to the basic flight instrument T. The standby attitude indicator must be usable and flyable from the primary pilot station (and any other pilot station); however, locating it too close to the primary instruments may be undesirable and should be evaluated. If the standby attitude information is close to the pilot’s normal flight instrument scan, he may begin to compare attitude information between the two indicators in his normal instrument scan.
Every pilot eye motion to compare these indicators could be a wasted motion that could be more efficiently applied in the normal scan. The pilot should fly either the primary or the backup indicator and it may be an aid if these indicators are noticeably separated.
When the standby indicator is located apart from the normal scan and the primary indicator fails, the pilot is conscious of a distinctly different instrument scan and is less likely to be continuously coming back to the center of the basic T for attitude reference.
Physical separation can assist the transition to standby attitude flight.
(ii) All cockpit controls necessary for normal and emergency operations should ideally be located so that they may be actuated without upper body movement.
Moderate head and body movement has been accepted; however, these motions must be evaluated for their vertigo inducing effects. No IFR controls should be located aft of a vertical plane passing left to right (laterally) through the pilot’s body.
(iii) If a copilot position is approved, the copilot must have a complete set of flight controls, and a complete set of primary flight instruments. The copilot must be capable of independently flying and navigating the rotorcraft from his position. The Page Apdx B - 14
copilot must be capable of controlling at least one primary navigation source so that he can operate the rotorcraft during normal conditions without relying on the first pilot to perform needed cockpit functions. Some instruments can be shared between pilots depending on instrument panel presentation. Some examples from previous programs include standby attitude, rotor tachometer (if the aircraft has automatic governing and the crew is provided visual and aural RPM warning), and secondary powerplant instruments such as NG, oil pressure, and temperature.
(iv) Proper cockpit annunciation is essential for safe operation. SAS and autopilot modes must be properly annunciated. Appropriate annunciator color coding is contained in § 29.1322. There must be no question in regard to the source of navigation information presented to the crew. Where navigation switching is available between individual displays and between pilot positions, the first pilot should have overriding control for his displays.
(v) Electromechanical Displays. Due to the increased complexity of instrumentation that is available and in use, it is appropriate to consider the extreme range of operational environments to which rotorcraft were being routinely exposed. It is the intent of Appendix B to part 29, VIII.(b)(5) to prevent degrading of the first pilot’s instrument system, or the only pilot’s instrument system in a single-pilot-approved rotorcraft, by not permitting connection of peripheral systems to it. In addition, equipment must not be connected to operating systems for the second pilot’s required instruments unless it is extremely improbable that failure of such additional equipment would affect that operating system.
(vi) Advanced Display Systems. The increased use of mi croprocessor technology in avionic systems has resulted in the use of computer-generated graphics to replace conventional electromechanical instruments. These displays may replace individual instruments or may integrate several flight critical parameters into single displays. For display of redundant information, “crosstalk” between the pilot and copilot displays and supporting systems has been allowed to provide detection and annunciation of faults or “miscompare” of critical flight information. A level of safety finding equivalent to that level of safety provided by Appendix B to part 29, VIII.(b)(5)(i) through (iii) may be possible through the implementation of integration technology that will assure that failure of one system does not and can not adversely affect the other system. For those installation designs that employ integration technology, adequate system testing and any analysis necessary must be conducted to assure that failure of one system will not adversely affect the other system when demonstrating compliance to the minimum safety level established by Appendix B to part 29, VIII.(b)(5)(i) through
(iii).
(10) IMC Evaluation.
(i) As part of the flight test program, new rotorcraft undergoing IFR certification should be flown in the air traffic control system in actual day and night Page Apdx B - 15
AC 29-2C, Chg 7 2/4/2016 instrument meteorological conditions. Items for consideration during the IMC evaluation include:
(A) Ability of the rotorcraft to safely operate in the National Airspace System, including crew capabilities to cope with probable malfunctions. Examples of failures imposed during this IMC evaluation on previous programs are shown below:
(1) Hydraulic failure.
(2) Individual COMM, NAV, or intercom failure.
(3) Engine failure.
(4) Loss of any power input.
(5) SAS failure.
(6) Trim failure.
(7) Individual failure of each vertical and directional gyro.
(B) Visibility during low approach conditions in precipitation.
(C) Glare and reflections at night in clouds.
(D) Workload demands on the minimum flight crew including the failures in paragraph b.(10)(i)(A).
(E) Handling qualities in turbulence throughout the IFR approved envelope including typical IFR flight maneuvers with:
(1) reasonably anticipated SAS failures,
(2) reasonably probable control system failures (hydraulics, force trim, basic ship systems, etc.),
(3) the typical workload conditions associated with operating in high density traffic areas, and
(4) other reasonable, probable failures.
(F) Cockpit leaks in precipitation that affects pilot efficiency, safety, or rotorcraft airworthiness.
(ii) Rotorcraft that are an improved, modified, or later model of previously approved type that have no significant changes in the fuselage and windshield Page Apdx B - 16
configuration, the aircraft lighting system, and the rain removal systems do not need to be flown in clouds. They may need to be evaluated in clouds if, in the judgment of the flight test personnel, there is some doubt as to the similarity of the configuration.
However, a previously approved rotorcraft undergoing IFR certification tests for a different SAS should not require a series of actual IFR flights just to determine the pilot workload, or if it can be flown in clouds.
(11) Static Position Error. The static position error should be reevaluated to determine altimeter error during instrument approach conditions. This is particularly important when high angle approaches (above 3°) are approved. Static position error for 3° approaches can typically be approximated by the level flight error. Level flight error is constrained by the requirements of § 29.1325(f). The direction of error is important. If the indicated value is lower than actual value, the error is in a conservative direction and further investigation may not be required. The direction and magnitude of static position error should be determined for steep angle approach conditions and additional information provided when necessary in the RFM. An investigation of static system response during the go-around transition should be investigated.
(12) Cross Coupling. IFR handling qualities are enhanced by providing low levels of coupling between axes. During the flight evaluation, pilots should be alert for strong cross coupling tendencies between yaw and pitch, heave (collective) and pitch, heave and roll, or roll and pitch. Any strong coupling effects between these motions may produce unacceptable handling qualities for IFR flight. The rotorcraft must be a ble to make a smooth transition from any flight condition. As an example, large rolling or pitching moments with collective application would represent questionable handling characteristics for the IFR missed approach condition.
(13) Electrical, Avionics, and Instruments. Some aircraft have been certificated with different equipment from that suggested in this subparagraph because the certification criterion for IFR has evolved in several stages. The following guidance refers to the latest certification requirements:
(i) Additional Avionics and Instruments. The avionics and instruments required for certification for operations under IFR beyond those required for VFR certification should be as follows:
(A) Attitude Indicator Power for operation and lighting must be independent from the rotorcraft electrical generating or starting system, and the instrument markings must meet the minimum usability requirements of § 29.1303(g)(1).
Section 29.1303 of this AC provides additional guidance on marking requirements for attitude indicators. Operation must be maintained for a minimum of 30 minutes after total aircraft electrical power generating system failure. For dual pilot configurations, one pilot’s primary indicator may be designated for this purpose, provided standby batteries are provided.
Page Apdx B - 17
AC 29-2C, Chg 7 2/4/2016 (B) Alternate Static Source. An alternate static source with a means of selecting this source must be provided for single pilot configurations.
(C) Thunderstorm Lights. Thunderstorm lights are high intensity white lighting that floods the instrument panel area containing the basic flight instruments.
(D) Direction Indication, Gyro Stabilized. Magnetic in place of non-magnetic required by § 29.1303(h).
(E) Navigational Systems. Navigational systems required by the applicable operational rules must be provided.
(F) Communication Systems. Communication systems required by the applicable operational rules must be provided.
(G) Other electrical and electronic equipment. Oth er electrical and electronic equipment required by the applicable operational rules must be provided.
(ii) Electrical Power Availability for Avionic and Instrument Systems. Minimum avionic and instrument systems should remain operative after electrical power failures in relation to IFR operation. The lists that follow suggest the minimum Avionic and Instrument Systems that should remain operational after a single failure of the generating system and after failure of all but the emergency power source. These lists do not address the basic equipment required for non-IFR related operation. These basic equipment requirements are addressed by the appropriate paragraph of this guidance. Where a time- limited power source is provided for compliance with § 29.1351(d)(2), in determining the endurance it should be assumed that flight under instrument flight rules will be continued for a period of not less than 30 minutes following the failure of the normal electrical power generating system.
(A) Avionic and instrument systems that should remain operational, for IFR approved rotorcraft, after a single failure of the electrical generating system. The rotorcraft must be capable of continued safe IFR flight to destination, and subsequently to an alternate, and then effect a safe instrument approach and landing. The suggested minimum avionic and instrument systems are as follows:
(1) Flight Instruments - same as § 29.1303 requirements, except as defined by paragraphs b.(13)(i)(A) and (D).
(2) Communications - one VHF radio.
(3) Navigation System - one navigation system, including necessary sensor inputs such as directional gyros.
(4) Transponder.
Page Apdx B - 18
(5) ICS System - required for two pilot approval.
(6) Instrument Lights (or equivalent).
(B) Avionic and instrument systems that should remain operational, for IFR approved rotorcraft, after total failure of the electrical generating system. The rotorcraft must be capable of flight for a minimum of 30 minutes. The suggested minimum equipment is as follows:
(1) Magnetic Compass.
(2) Airspeed-Altitude-Attitude Presentation.
(3) Communications One VHF System.
(4) Instrument Lights (or equivalent).
(5) ICS System-For Two Pilot Approval.
(C) Additional requirements for Category A rotorcraft. Where a timelimited power source is provided for compliance with § 29.1351(d)(2), in determining the endurance it should be assumed that flight under instrument flight rules will be continued for a period of not less than 30 minutes following the failure of the normal electrical power generating system.
(iii) Directional Instruments. A magnetic, gyro stabilized direction indicator is specified because navigation in instrument flight must be precise. In rotorcraft, the nonstabilized magnetic indicator is subject to many errors, particularly in turbulence.
Therefore, it is inappropriate as the primary source of directional information, but it is adequate as an emergency source. A nonslaved directional gyro is also inappropriate as the primary source of directional information because of drift and the requirement to set it to some other precise reference.
(A) As a minimum for single pilot IFR, a nonstabilized magnetic indicator (such as a “whiskey compass”) and a magnetic gyroscopically stabilized direction indicator system (slaved) are required.
(B) The minimum for dual pilot certification includes the instruments required for single pilot, and an additional independent gyroscopically stabilized directional indicator system (slaved or unslaved).
(14) IFR Electrical System.
(i) General.
Page Apdx B - 19
AC 29-2C, Chg 7 2/4/2016 (A) The entire electrical system, both AC and DC portions, must be reviewed with IFR operation in mind. This review is necessary since most of the rotorcraft presently certificated do not include IFR operation as part of their certification.
Many aspects of normal operation and results of failure conditions may be entirely acceptable for VFR operation, but unacceptable for IFR operation.
(B) Provisions should be made for a capability to continue flight to destination and alternate airports in the event of a single failure in the electrical system.
Section 29.1351 of this AC contains the definition of a “single failure.” The evaluation of the system under failure conditions should consider not only the failure itself, but also the recommended cockpit procedure to respond to any failure.
(C) The fault analyses of the electrical system and the results of the system testing to validate that analysis serves as a good starting place for the electrical system review. Failure of each generator, each battery, and each component, such as switches and relays, should be accounted for first since failure of equipment and components are the most probable.
(D) System failure such as tripped circuit breakers, blown fuses, loss of busses, loss of feeders, loss of ground terminals, and failure of electrical disconnect plugs should also be considered.
(E) Routing of all wiring from each power source throughout the distribution system should be reviewed. In all instances, feeder wires should be routed separately from small gage control wiring. In addition, wiring for each power system should be separated to the maximum extent practical from the wiring associated with other required power systems.
(F) A single electrical disconnect plug should not contain wiring for more than one generating system. Many systems incorporate automatic feeder fault protection that disables a power source experiencing a short circuit on its feeder, and in some instances, passive protection has been provided for the feeders.
(G) There may be other failures that should be considered that are peculiar to the specific design being evaluated, and if so, an appropriate accounting of these failures should also be made.
(ii) Review of Regulations. The airworthiness regulations concerning electrical systems begin with § 29.1301 Subpart F (Equipment) and continue up to § 29.1411. Other rules may also concern the electrical system; however, compliance with these sections should have been assured as part of the original VFR approval.
(iii) Specific Emphasis Areas. In some previous installations, changes have been necessary in the areas listed below. Future installations should be checked carefully in these areas and other areas that indicate a need for attention.
Page Apdx B - 20
(A) Systems Affected by Icing. Gross inaccuracies in altitude and airspeed indicators resulting from icing could be disastrous in IFR flight. For rotorcraft not equipped with approved alternate static sources, static ports should be carefully evaluated and should either be heated or an analysis verified by flight test data submitted to substantiate leaving them unheated. Static line routing should be carefully evaluated for low spots. In addition, if static ports are on the side of the rotorcraft, the lines should be initially routed upward just behind the static ports, then down to a drain.
If the lines are initially routed upward, the lines will not fill with water when the rotorcraft is flown through rain or is washed.
(B) Overvoltage Protection. If the rotorcraft is certificated under part 29, Category A, it is required to have overvoltage protection. Other rotorcraft may have this protection, but many do not. Since overvoltage protection is specifically required for IFR operation, the rotorcraft’s basic electrical system should be very carefully reviewed for this capability.
(C) Power Adequacy Indication. Most flight instruments th at use a power supply have a visual means integral with the instrument to indicate the adequacy of the power being supplied. For those required flight instruments that are not provided with a visual means, the following must be accounted for:
(1) The visual means provided must be at least adjacent to the instrument.
(2) The visual means must be adequately placarded.
(3) The power must be measured at or near the point where it enters the instrument.
(4) For electrical instruments, the power is considered adequate when the voltage is within approved limits. The source of power for the visual means of indication must be independent of the source of power for the instrument itself.
Independent in this case means a separate circuit protective device and a separate distribution system bus.
(D) Multiple System Separation. Multiple systems performing the same function are required in certain instances because it is probable that a single system will fail. Separation of such systems would preclude a single fault from causing a multiple system failure. The following should be considered:
(1) When possible, cable routing should be accomplished to assure the maximum separation; for example, one system routed on one side of the rotorcraft and the other system on the opposite side. In some areas, physical separation may be minimal, as pedestals, junction boxes, and equipment racks bring systems close together.
Page Apdx B - 21
AC 29-2C, Chg 7 2/4/2016
(2) Systems that are required to be duplicated should not be routed through one electrical disconnect plug.
(3) System grounds should be evaluated to assure wiring for two required systems are not grounded to the same terminal. If a terminal strip contains grounds for multiple systems, it should be grounded to the rotorcraft’s airframe in two places from two separate terminals.
(E) Circuit Protective Devices. All systems that are “required” for IFR operation are considered necessary for safe IFR operation, and the circuit protective devices for those systems should generally be accessible to the crew in the cockpit so they can be readily reset or replaced in flight. For example, where a capability is provided that is above the minimum certification requirements, accessibility may not be an issue. A tradeoff here, however, is that additional equipment may be required for dispatch in IFR operation. The location of the generator field protective devices has been a problem in some rotorcraft. The protective devices that can result in the loss of a required power system source should be capable of being reset or replaced in the cockpit while in flight. This position is further supported by the occurrence of nuisance opening of circuit protective devices in rotorcraft. Further discussion on this issue is included in section 29.1357 of this AC.
(F) Intercommunication System. All audio for the entire rotorcraft comes together at this system. An evaluation should be made to assure that no single failure would result in the loss of all audio for the rotorcraft. Check for common grounds, common connectors, etc. Power inputs should also be disabled.
(15) RFM Material.
(i) In addition to other required information, the limitations section of the RFM or RFM Supplement (RFMS) must include the approved IFR flight envelope, minimum IFR crew requirements, the minimum required equipment for dispatch into IFR conditions that is not covered by the operating regulations, and the maximum approach gradient that has been approved. If a significant loss of altitude is experienced in any flight regime or maneuver during certification analysis or testing, the emergency operating procedures should include a statement of this altitude loss along with any other appropriate information.
(ii) The limitations section of the RFM should not include restrictions prohibiting external cargo operations. These operations are covered by parts 91 and 133, and all external load operations conducted under these parts must be approved by the controlling operations inspector. It is the responsibility of the operator to demonstrate and the operations inspector to confirm that any external load operation, including en route IFR, can be safely conducted.
(16) Rotorcraft Flight Below Instrument Flight Minimum Speed.
Page Apdx B - 22