AC 29-2C, Chg 4 5/1/2014 certification rules (CAR Part 13 and FAR § 21.29, for imported engines) are also eligible. If a component, sys tem, or arrangement is certified under Part 33 or other requirement, the applicant is not relieved of the necessity to comply with the requirements of Part 29. If the component, system, or arrangement, supplied as a part of a certificated engine, meets the Part 33 and Part 29 requirements, subsequent changes to these components, systems, or arrangements could negate compliance with Part 29. For example, an engine may init ially be equipped by the engine manufacturer with an oil tank filler cap that complies with the Category A requirements of § 29.1013(c)(2) but is subsequently changed to a simpler and less expensive cap that complies with § 33.71(c)(4). The airfra me manufacturer should ensure that the requirements of § 29.1013(c)(2) are maintained.
(2) Category A: control of engine rotation. Section 29.903(c)(3) requires an engine restart capability which is appropriate to the rotorcraft. T he minimum envelope for the restart capability should be equal to or better than the rotorcraft takeoff/landing maximum altitude and temperature limits. Compliance is usually shown by conducting actual in-flight restarts during flight tests and/or other tests in accordance with an approved test plan. Restarts should be conducted at various altitudes, ambient temperatures, and fuel temperatures using the fuel type most critical, unless the applicant can show that this parameter is not pertinent. Other concerns involve the pilot station arrangement for flight controls and engine starting controls. It should be verified that the engine start can be accomplished without jeopardizing continued safe operation of the rotorcraft. Pilot wo rkload for a preexisting one-engine-inoperative situation, the location of the restart system controls, and the availability of a second pilot should be considered. The emergency/malfunction instruction sections of the rotorcraft flight manual (RFM) should present a detailed definition of the approved restart envelope and detailed instructions for the restart. Eligible ambient atmo spheric conditions, prestart requirements (to allow for waste fuel drainage), starter duty cycle (if different from the ground start duty cycle), and prestart situation analysis should be included. The prestart situation analysis should consider the following questions:
Should a restart be attempted in view of the cause for initial shutdown?
Is inlet system ice ingestion a possibility?
Is reignition of fuel in the engine nacelle a possibility?
Is sufficient restart time available?
Is power available?
Is altitude sufficient to maintain terrain clearance?
Although restart capability from an all-engines-out flight condition is not required, special instructions for restarting from this situation should also be included commensurate with the system capability to accomplish the starts.
AC 29.903B. § 29.903 (Amendment 29-31) ENGINES.
a. Explanation. Amendment 29-31 clarif ied the requirements for control of engine rotation and in-flight restart of engines. Section 29.903(c)(1) was changed by adding Page E - 12
the word “or” at the end of the paragraph, which provided an option on how to protect the engine stopping system from fire.
b. Procedures. All of the policy material per taining to this section remains in effect.
Additionally, the new § 29.903(e) requires that any engine should have a restart capability that has been demonstrated throughout a flight envelope to be certificated for the rotorcraft. However, § 29.903(e)(2) does not require in-flight demonstration of restart capability for single-engine rotorcraft or for all-engine shutdown of multi-engine rotorcraft. In the past, engine relight c apability for single engine rotorcraft has been demonstrated on the ground taking into account altitude effects, warm engine characteristics, depleted battery, etc. The minimum restart envelope for category A rotorcraft is discussed in section 29.903A of this AC. The restart capability can consider windmilling of the engine as part of this restart capability; however, most rotorcraft airspeeds and the locations of the engines do not support engine windmilling up to start speeds. Only electrical power requirements were considered for restarting; however, other factors that may affect this capability are permitted to be considered. Engine restart capability following an in-flight shutdown of the engine in single-engine rotorcraft, or all engines in a multi-engine rotorcraft, is the primary requirement, and the means of providing this capability is left to the applicant. To minimize any potential height loss following the failure of one or more engines, engine restart should be available at the earliest opportunity. T he engine certification should be checked to ensure that the flight manual instructions for in-flight restart are consistent with any specific engine restart requirements.
AC 29.903C. § 29.903 (Amendment 29-36) TURBINE ENGINE INSTALLATION.
a. Explanation. Amendment 29-36 revises § 29.903(d) to require that design precautions should be taken to minimize hazards to the rotorcraft in the event of an engine failure. This advisory material sets forth a method of compliance with the requirements of §§ 29.901, 29.903(b)(1), and 29.903(d)(1) of the Federal Aviation Regulations (FAR) pertaining to design precautions taken to minimize the hazards to rotorcraft in the event of uncontained engine rotor (compressor and turbine) failure. It is for guidance and to provide a method of compliance that has been found acceptable.
As with all AC material, it is not mandatory and does not constitute a regulation.
b. Procedures. Although turbine engine manufacturers are making efforts to reduce the probability of uncontained rotor failures, service experience shows that such failures continue to occur. Failures have re sulted in high velocity fragment penetration of fuel tanks, adjacent structures, fuselage, system components and other engines of the rotorcraft. Since it is unlikely that uncontained rotor failures can be completely eliminated, rotorcraft design precautions should be taken to minimize the hazard from such events. These design precautions should recognize rotorcraft design features that may differ significantly from that of an airplane, particularly regarding an engine location and its proximity to another engine or to other systems and components.
Page E - 13
AC 29-2C, Chg 4 5/1/2014
(1) Uncontained gas turbine engine rotor failure statistics for rotorcraft are presented in the Society of Automotive Engineers (SAE) Report No.’s AIR 4003 (period 1976-83) and AIR 4770 (period 1984-89).
(2) The statistics in the SAE studies indicate the existence of some failure modes not readily apparent or predictable by failure analysis methods. Because of the variety of uncontained rotor failures, it is difficult to analyze all possible failure modes and to provide protection to all areas. Howeve r, design considerations outlined in this AC provide guidelines for achieving the desired objective of minimizing the hazard to rotorcraft from uncontained rotor failures. These guidelines, therefore, assume a rotor failure will occur and that analysis of the effects or evaluation of this failure is necessary.
These guidelines are based on service experience and tests but are not necessarily the only means available to the designer.
c. Definitions.
(1) Minimize. Reduce to the least possible amount by means that can be shown to be both technically feasible and economically justifiable.
(2) Separation. Positioning of redundant critical structure, systems, or system components within the impact area such that the distance between the components minimizes the potential impact hazard. Redundant critical components should be separated within the spread angles of a rotor by a distance at least equal to either a ½ unbladed disk (hub, impeller) sector, or a 1/3 bladed disk (hub, impeller) sector with 1/3 blade height, with each rotating about its center of gravity (CG), whichever is greater (see figure AC 29.903C-6).
(3) Isolation. A means to limit system damage so as to maintain partial or full system function after the system has been damaged by fragments. Limiting the loss of hydraulic fluid by the use of check valves to retain the capability to operate flight controls is an example of “isolation.” S ystem damage is confined allowing the retention of critical system functions.
(4) Rotor.
(i) Rotor means the rotating components of the engine and APU that analysis, test results, and/or experience has shown can be released during uncontained failure with sufficient energy to hazard the rotorcraft.
(ii) The engine or APU manufacturer should define those components that constitute the rotor for each engine and APU type design. Typical rotors have included, as a minimum, disks, hubs, drums, seals, impellers, and spacers.
(5) Uncontained Engine or APU Failure (or Rotorburst). For the purposes of rotorcraft evaluations in accordance with this AC, uncontained failure of a turbine engine is any failure which results in the escape of rotor fragments from the engine or Page E - 14
could create a hazard to the rotorcraft. Rotor failures of concern are those in which released fragments have sufficient energy to create a hazard to the rotorcraft.
Uncontained failures of APU’s which are “ground operable only” are not considered hazardous to the rotorcraft.
(6) Critical Component (System). A critical component is any component or system whose failure or malfunction would contribute to or cause a failure condition that would prevent the continued safe flight and landing of the rotorcraft. These components (systems) should be considered on an individual basis and in relation to other components (systems) that could be degraded or rendered inoperative by the same fragment or by other fragments during any uncontained failure event.
(7) Fragment Spread Angle. The fragment spread angle is the angle measured, fore and aft, from the center of the plane of rotation of the disk (hub, impeller) or other rotor component initiating at the engine or APU shaft centerline or axis of rotation (see figure AC 29.903C-1). The width of the fragment should be considered in defining the path of the fragment envelope’s maximum dimension.
(8) Ignition Source. Any component that could precipitate a fire or explosion.
This includes existing ignition sources and potential ignition sources due to damage or fault from an uncontained rotor failure. Potential ignition sources include hot fragments, damage or faults that produce sparking, arcing, or overheating above the auto-ignition temperature of the fuel. Existing ignition sources include items such as unprotected engine or APU surfaces with temperature greater than the auto-ignition temperature of the fuel or any other flammable fluid.
d. Safety Assessment.
(1) Procedure. Assess the potential hazard to the rotorcraft using the following procedure:
(i) Minimizing Rotorburst Hazard. The rotorburst hazard should be reduced to the lowest level that can be shown to be both technically feasible and economically justifiable. The extent of minimization that is possible will vary from new or amended certification projects and from design to design. Thus the effort to minimize must be determined uniquely for each certification project. Design precautions and techniques such as location, separation, isolation, redundancy, shielding, containment and/or other appropriate considerations should be employed, documented, agreed to by the certifying authority, and placed in the type data file. A discussion of these methods and techniques follows.
(ii) Geometric Layout and Safety Analysis. The applicant should prepare a preliminary geometric layout and safety analysis for a minimum rotorburst hazard configuration determination early in the design process and present the results to the certification authority no later than when the initial design is complete. Early contact and coordination with the certifying authority will minimize the need for design Page E - 15
modification later in the certification process. The hazard analysis should follow the guidelines indicated in paragraphs AC 29.901c(2) and AC 29.903Cd(6). Geometric layouts and analysis should be used to evaluate and identify engine rotorburst hazards to critical systems, powerplants, and structural components from uncontained rotor fragments, and to determine any actions which may be necessary to further minimize the hazard. Calculated geometric risk quantities may be used in accordance with paragraph d(4) following, to define the rotorcraft configuration with the minimum physical rotorburst hazard.
(2) Engine and APU Failure Model. The safety analysis should be made using the following engine and APU failure model, unless for the particular engine/APU type concerned, relevant service experience, design data, test results or other evidence justify the use of a different model. In particular, a suitable failure model may be provided by the engine/APU manufacturer. This may show that one or more of the considerations below do not need to be addressed.
(i) Single One-Third Disc Fragment. It should be assumed that the one-third disc fragment has the maximum dimension corresponding to one-third of the disc with one-third blade height and a fragment spread angle of ±3°. Where energy considerations are relevant, the mass should be assumed to be one-third of the bladed disc mass and its energy--the translational energy (i.e., neglecting rotational energy) of the sector (see figure AC 29.903C-2).
(ii) Intermediate Fragments. It should be assumed that the intermediate fragment has a maximum dimension corresponding to one third or the disc radius with one-third blade height and a fragment spread angle of ±5°. Where energy considerations are relevant, the mass should be assumed to be 1/30th of the bladed disc mass and its energy--the translational energy (neglecting rotational energy) of the piece traveling at rim speed (see figure AC 29.903C-3).
(iii) Alternative Engine Failure Model. For the purpose of the analysis, as an alternative to the engine failure model of paragraphs d(2)(i) and d(2)(ii) above, the use of a single one-third piece of disc having a fragment spread angle of ±5° would be acceptable, provided that the objectives of the analysis are satisfied.
(iv) Small Fragments. It should be assumed that small fragments have a maximum dimension corresponding to the tip half of the blade airfoil and a fragment spread angle of ±15°. Where energy considerations are relevant, the mass should be assumed to be corresponding to the above fragment dimensions and the energy is the translational energy (neglecting rotational energy) of the fragment traveling at the speed of its CG location. The effects of multiple small fragments should be considered during this assessment.
(v) Critical Engine Speed. Where energy considerations are relevant, the uncontained rotor event should be assumed to occur at the engine shaft speed for the maximum rating appropriate to the flight phase (exclusive of OEI ratings), unless the Page E - 16
most probable mode of failure would be expected to result in the engine rotor reaching a red line speed or a design burst speed. For APU’s, use the maximum rating appropriate to the flight phase or the speed resulting from a failure of any one of the normal engine control systems.
(vi) APU Failure Model. Service experience has shown that some APU rotor failures produced fragments having significant energy to have been expelled through the APU tailpipe. For the analysis, the applicable APU service history and test results should be considered in addition to the failure model as discussed in paragraph d(2) above for certification of APU installations near critical items. In addition, the APU installer needs to address the rotorcraft hazard associated with APU debris exiting the tailpipe. Applicable service history or test results provided by the APU manufacturer may be used to define the tailpipe debris size, mass, and energy. The uncontained APU rotor failure model is dependent upon the design/analysis, test results and service experience.
(A) For APU’s in which rotor integrity and blade containment have been demonstrated in accordance with TSO-C77a/JAR APU, i.e., without specific containment testing, paragraphs d(2)(i), d(2)(ii), and d(2)(iv) or paragraph d(2)(iii) and d(2)(iv) apply. If shielding of critical airframe components is proposed, the energy level that should be considered is that of the tri-hub failure released at the critical speed as defined in paragraph d(2)(v). The shield and airframe mounting point(s) should be shown to be effective at containing both primary and secondary debris at angles specified by the failure model.
(B) For APU rotor stages qualified as contained in accordance with the TSO, an objective review of the APU location should be made to ensure the hazard is minimized in the event of an uncontained APU rotor failure. Historical data shows that in-service uncontained failures have occurred on APU rotor stages qualified as contained per the TSO. These failure modes have included bi -hub and overspeed failure resulting in some fragments missing the containment ring. In order to address these hazards, the installer should use the small fragment failure model, or substantiated in-service data supplied by the APU manufacturer. Analytical substantiation for the shielding system if proposed is acceptable for showing compliance.
(3) Engine/APU Rotorburst Data. The engine or APU manufacturer should provide the required engine data to accomplish the evaluation and analysis necessary to minimize the rotorburst hazard such as:
(i) Engine failure model (range of fragment sizes, spread angles and energy).
(ii) Engine rotorburst probability assessment.
(iii) List of components constituting the rotors.
Page E - 17
(4) Fragment Impact Risks. FAA/AUTHORITY research and development studies have shown that, for rotorcraft conventional configurations (one main rotor and one tail rotor), the main and tail rotorblades have minimal risks from a rotorburst, and thus, they require no special protection. However, unique main and tail rotor blade configurations should be carefully reviewed. Certain zones of the tail rotor drive shaft and other critical parts which may be necessary for continued safe flight and landing may not have natural, minimal risk from uncontained rotor fragments.
(5) Engine Service History/Design.
(i) For the purpose of a gross assessment of the vulnerability of the rotorcraft to an uncontained rotorburst, it must be taken that an uncontained engine rotor failure (burst) will occur. However, in determining the overall risk to the rotorcraft, engine service history and engine design features should be included in showing compliance with § 29.903 to minimize the hazard from uncontained rotor failures. This is extremely important since the engine design and/or the service history may provide valuable information in assessing the potential for a rotorburst occurring and this should be considered in the overall safety analysis.
(ii) Information contained in the recent SAE studies should be considered in this evaluation (see paragraph b(1) above).
(6) Certification Data File. A report, including all geometric layouts, that details all the aspects of minimizing the engine rotorburst hazards to the rotorcraft should be prepared by the applicant and submitted to the certification authority. Items which should be included in this report are the identification of all hazardous failures that could result from engine rotor failure strikes and their consequences (i.e., an FMEA or equivalent analysis) and the design precautions and features taken to minimize the identified hazards that could result from rotor failure fragment strikes. Thus an analysis that lists all the critical components; quantifies and ranks their associated rotorburst hazard; and clearly shows the minimization of that quantified, ranked hazard to the “maximum practicable extent” should be generated and agreed upon during certification. Critical components should all be identified and their rotorburst hazard quantified, ranked, and minimized where necessary. Design features in which the design precautions of this guidance material are not accomplished should be identified along with the alternate means used to minimize the hazard. To adequately address minimizing the hazards, all rotorcraft design disciplines should be involved in the applicant’s compliance efforts and report preparation.
e. Design Considerations. Practical design precautions should be used to minimize the damage that can be caused by uncontained engine and APU rotor debris.
The following design considerations are recommended:
(1) Consider the location of the engine and APU rotors relative to critical components, or areas of the rotorcraft such as:
Page E - 18
(i) Opposite Engine - Protection of the opposite engine from damage from 1/3 disc rotor fragments may not be feasible. Protection of the opposite engine from other fragments may be provided by locating critical components, such as engine accessories essential for proper engine operation (e.g. high pressure fuel lines, engine controls and wiring, etc.), in areas where inherent shielding is provided by the fuselage, engine, or other structure.
(ii) Engine Controls - Controls for the remaining engine(s) that pass through the uncontained engine failure zone should be separated/protected to the maximum extent practicable.
(iii) Primary Structure of the Fuselage.
(iv) Flight Crew - The flight crew is considered a critical component.
(v) Fuel system components, piping and tanks, including fuel tank access panels (NOTE: Spilled fuel into the engine or APU compartments, on engine cases or on other critical components or areas could create a fire hazard.)
(vi) Critical control systems, such as primary and secondary flight controls, electrical power cables, systems and wiring, hydraulic systems, engines control systems, flammable fluid shut-off valves, and the associated actuation wiring or cables.
(vii) Engine and APU fire extinguisher systems including electrical wiring and fire extinguishing agent plumbing to engine and APU compartments.
(viii) Instrumentation necessary for continued safe flight and landing.
(ix) Transmission and rotor drive shafts.
(2) Location of Critical Systems and Components. The following design practices have been used to minimize hazards to critical components:
(i) Locate, if possible, critical components or systems outside the likely debris impact areas.
(ii) Duplicate and separate critical components or systems if located in debris impact areas or provide suitable protection.
(iii) Protection of critical systems and components can be provided by using airframe structure where shown to be suitable.
Page E - 19
(iv) Locate fluid shutoffs so that flammable fluids can be isolated in the event of damage to the system. Design and locate the shut -off actuation means in protected areas or outside debris impact areas.
(v) Minimize the flammable fluid spillage which could contact an ignition source.
(vi) For airframe structural elements, provide redundant designs or crack stoppers to limit the subsequent tearing which could be caused by uncontained rotor fragments.
(vii) Consider the likely damage caused by multiple fragments.
(viii) Fuel tanks should not be located in impact areas. However, if necessitated by the basic configuration requirements of the rotorcraft type to locate fuel tanks in impact areas, then the engine rotorburst hazard should be minimized by use of design features such as minimization of hazardous fuel spillage (that could contact an ignition source by drainage or migration); by drainage of leaked fuel quickly and safely into the airstream; by proper ventilation of potential spillage areas; by use of shielding;
by use of explosion suppression devices (i.e., explosion resistant foam or inert gases);
and by minimization of potential fuel ignition sources or by other methods to reduce the hazard.
(ix) The rotor integrity or containment capability demonstrated during APU evaluation to TSO-C77a, or JAR-APU should be considered for installation certification.
(x) The flight data recorder, cockpit voice recorder, and emergency locator transmitter, if required, should be located outside the impact zone when practical.
(xi) Items such as human factors, pilot reaction time, and correct critical system status indication in the pilot compartment after an uncontained engine failure has occurred should be considered in design to permit continued safe flight and landing.
(3) Rotorcraft Modifications. Modifications made to rotorcraft certified to this rule should be assessed with the considerations of this AC. These modifications include but are not limited to re-engining installations (including conversion from reciprocating to turbine powered), APU installations, fuselage stretch, and auxiliary fuel tank installations. Auxiliary fuel tank(s) should be located as much as practical so as to minimize the risk that this tank(s) will be hit by rotor failure fragments. The need to remain within the approved CG limits of the aircraft will of necessity limit the degree to which the risk may be minimized.
f. Protective Measures. The following list is provided for consideration as some measures which may be used to minimize effects of a rotorburst:
Page E - 20
(1) Powerplant Containment.
(i) Engine Rotor Fragment Containment. It should be clearly understood that containment of rotor fragments is not a requirement. However, it is one of many options which may be used to minimize the hazards of an engine rotorburst.
Containment structures (either around the engine, or APU, or on the rotorcraft) that have been demonstrated to provide containment should be accepted as minimizing the hazard defined by the rotor failure model for that particular rotor component. Contained rotor in-service failures may be used to augment any design or test data. Containment material stretch and geometric deformation should be considered in conjunction with fragment energies and trajectories in defining the hazards to adjacent critical components such as structures, system components, fluid lines, and control systems.
Data obtained during containment system testing along with analytical data and service experience should be used for this evaluation.
(ii) APU Containment. Rotor integrity or containment capability demonstrated during APU TSO evaluation should be considered for installation certification. If rotor containment option was shown by analysis or rig test an objective review of the APU location should be made to ensure the hazard is minimized in the event of an uncontained APU rotor failure.
(2) Shields and Deflectors. When shields, deflection devices, or intervening rotorcraft structure are used to protect critical systems or components, the adequacy of the protection should be shown by testing or analysis supported by test data, using the impact area, fragment mass, and fragment energies based on the definitions stated herein. Analytical methods used to compute protective armor or shielding t hicknesses and energy absorption requirements should reflect established methods, acceptable to the certifying authority, that are supported by adequate test evidence. Protective armor, shielding, or deflectors that stop, slow down, or redirect uncontained fragments redistribute absorbed energy into the airframe. The resulting loads are significant for large fragments and should be considered as basic load cases for structural analysis purposes (reference § 29.301). These structural loads should be defined and approved as ultimate loads acting alone. The protective devices and their supporting airframe structures should be able to absorb or deflect the fragment energies defined herein and still continue safe flight and landing. If hazardous, the deflected fragment trajectories and residual energies should also be considered.
(3) Isolation or Redundancy.
(i) Other Engines - Although other engines may be considered critical, engine isolation from rotorburst on multi-engine rotorcraft is not mandatory. Other methods of minimizing the risk to the engine(s) may be acceptable.
(ii) Other Critical Components - Isolation or redundancy of other critical components, the failure of which would not allow continued safe flight and landing should be evaluated relative to the risk of occurrence and where the risk is deemed Page E - 21
unacceptable isolation or shielding or other means of reducing the risk should be incorporated.
(4) Composite Materials. If containment devices, shields, or deflectors are chosen by the applicant to be wholly or partially made from composites; they should comply with the structural requirements of AC 20-107A, “Composite Aircraft Structure,” and paragraph AC 29 MG 8, “Substantiation of Composite Rotorcraft Structure,” (which includes glass transition temperature considerations). Glass transition temperature considerations are critical for proper certification of composite or composite hybrid structures used in temperature zones that reach or exceed 200° to 250°F (93° to 121°C) for significant time periods. Hot fragment containment is typically accommodated in such protective devices by use of metal-composite hybrid designs that use the metal component’s properties to absorb the fragment heat load after the entire hybrid structure has absorbed the fragment’s impact load. These devices should comply with §§ 29.609 and 29.1529 to ensure continued airworthiness.
Page E - 22
/ 1/GRD AND LARGER BLADED MASS (SEE FIGURE 2) +3°4 + 5 ° 1/30 BLADED MASS (INTERMEDIATE) (SEE FIGURE 3) + 15 %
SMALL FRAGMENT S (SEE PARAGRAPH 5B(4))
FRAGMENT SPREAD ANGLE IS THE ANGLE
MEASURED FORE AND AFT, FROM THE
CENTER OF THE PLANE OF ROTATION
INITIATING AT THE ENGINE OR APU SHAFT
CENTERLINE NOTE: 1) THE POSSIBILITY OF TURBINE MOVEMENT SHOULD BE CONSIDERED.
2) ALL ROTORS ARE CONSIDERED TO BE FULLY BLADED FOR CALCULATING MASS.
3) FAILURE OF EACH ROTOR STAGE SHOULD BE CONSIDERED.
FIGURE AC 29.903C-1 ESTIMATED PATH OF FRAGMENTS Page E - 23