purposes not those monitors which are utilized as part of the control system for autopilot/flight controls or engine controls. At present, optional approvals are being requested for most of these systems not performing any required functions. However, most of the applicants anticipate requesting approval for the systems to be used in the future to perform some required function or to allow required maintenance to be predicated on the operation of the system. This consideration becomes particularly important if the system is software based. A further discussion of system software is included in Paragraph 776b(19) (IlI) (B).
(i) System Installation. The system installation should be shown to be free from hazards considering both normal operation and possible malfunctions.
Malfunctions which might be caused by software errors are discussed under Paragraph 776b(19) (ili)(B). The accuracy and response of the monitoring device/system should be sufficient to allow the operational and maintenance personnel to relate the data obtained to required maintenance actions. The exceedance (engine limit) information being acquired by these systems is or will be used in place of information previously acquired from field reports of operational personnel utilizing the basic aircraft instruments. In this case, the automated system will generally produce results which are more accurate than the basic aircraft instruments. However, in this circumstance, it is not appropriate to require the monitor system to be more accurate than the previously approved methods used to provide the required exceedance data.
If the data collected by the system require filtering prior to use, it is equally acceptable to accomplish this filtering either as the data are being acquired (airborne function) or when the data are analyzed (ground based function) and used in the maintenance of the rotorcraft.
(Ш) System Components.
(A) Hardware. The hardware of the system when operating under the control of the imbedded software should be shown to comply with § 29.1301.
Additionally, in showing compliance to § 29.1309(a), laboratory testing to the appropriate portions of the latest revision of RTCA Document DO-160 should be performed.
(B) Software. If the function of the monitor system depends on embedded airborne software to determine all or part of its functioning, Document DO-178 is the recommended standard to be used for the approval of the system software. A further discussion of the use of this document is included in Paragraph 621. The selection of the software level should be carefully considered because system approval is sometimes initially sought on the basis of the system being a non-required optional system. If it has further been shown that no dependence is made on the system software to preclude a hazardous failure mode, then a low sottware level would be acceptable. However, it is very difficult to qualify software to higher levels of "quality" once the software has been initially certified. Because of this, it is recommended that the software be chosen to the level consistent with the ultimate 1206 Par 776
use to which approval of the system is planned. If the system is to be approved only as non-required optional equipment, then the choice of a low level of software qualification may be appropriate. However, when more experience is gained with the operation of the system, and it is ultimately planned to seek approval to perform required functions, then an appropriate higher level of software should be initially obtained.
NOTE: Extensive service experience should not be considered as a basis for level of criticality without accomplishing RTCA DO-178 procedures.
(20) Night Vision Goggles (NVG).
(i> Background. Night vision goggles (NVG) have been used by U.S.
military pilots since the early 1970's. The first units (first generation or GEN I) were constructed from the rifle "Sniper-Scopes." These units did not provide much light amplification. The second generation (GEN II) were still primarily designed for ground use. Second generation high performance units (military designation AN/PVS-5C) had some consideration for flight use but were still lacking in several aspects. A light level of at least a quarter moon well above the horizon was required for operation of these NG. At first the normally helmet-mounted units covered the pilot's entire upper face and the pilot could only see through the NVG. In order to protect the light amplification system these NVG had an automatic shutoff feature when brighter than relatively low levels of light were encountered. Normal incandescent and especially red incandescent lights would cause these NG to shut down. Aircraft cockpit lights, especially the red warning lights, would cause "blooming" (an increased brightness of all or portions of the NVG field of view with the disappearance of the "picture" in that area or a total shutdown of the NVG. Military aircraft cockpits and lighting systems were significantly modified to avoid this problem. In the late 1980's the military pushed technology for better and aircraft compatible NVG. Third generation (GEN III, military designation ANVIS or AN/AVS-6) NVG systems became available about 1988. These systems require only star light for satisfactory operation.
(¡i) Procedures. As of January 1990, no approvals for civil rotorcraft operations with NVG have been issued. Since NVG are not installed in the rotorcraft, they are not required to be approved as part of the type design. However, since an operational approval would be required for use of NG, they should meet some acceptable performance standard. The minimum standard recommended is the GEN III NVG. The performance of these NVG are rated as their spectral response to irradiated light sources, measured as density of incident photons per square meter.
Third generation, AN/AVS-6, NVG have been evaluated for compatibility with a limited number of rotorcraft and were generally found to be usable during en route operations with no cockpit lighting systems modifications. It is anticipated, however, that some aircraft may require significant modifications to the existing cockpit lighting system. The FAA/AUTHORITY policy is that modification of the cockpit to a non-compliant configuration to accommodate NVG use is not acceptable. For instance, alteration of the required red warning annunciators to some other color is not acceptable. Since Par 776 1207
individual rotorcraft may have been modified with additional lights or systems, each rotorcraft being considered for use with NG should be evaluated by an FAAJAUTHORITY representative during a night flight. If it is anticipated that cockpit lighting system modifications will be required to achieve an adequate level of NVG compatibility FAA/AUTHORITY involvement should be arranged as soon as possible.
Preferably this evaluation flight would be made with two pilots or a pilot and safety observer, over a known area, where all the aircraft and cockpit lights are operated and their effect on the NVG determined. Reflections of landing or searchlights on windshields or other glass during approach or landing may affect NVG and may impose a minimum altitude restriction for use of NG. Failure of the NVG should be evaluated during any critical flight phase.
Note that the above discussion is purposely limited in scope. Issues such as crew training and operating limitations would have to be addressed in detail to obtain an operational approval.
(21) Rotorcraft Health and Usage Monitoring Systems (HUMS).
General. HUMS can be divided into two major categories: Health Monitoring Systems and Usage Monitoring Systems. The provisions of § 29.1301 are used to determine that the system performs its intended function. The provisions of § 29.1309(a) and (b) are used to look at the impact of environmental conditions and malfunctions. To date (mid-1990) HUMS have not been approved to replace service life or other specific physical limits but several systems are now in the process of seeking approval. Health monitoring systems are considered to be the serious applications of this technology, and it will probably be some time before the necessary data base to allow full reliance on this technology is available. There have been numerous approvals of usage monitoring systems as optional equipment, and a good example of this technology is a condition monitoring system described in 776b(19) above.
(iI) Health Monitoring Systems.
(A) It is anticipated these systems will begin as "optional" systems in order to build a data base to support expansion of the approval to achieve credit for extension of maintenance intervals, and so forth. Systems range from low to high integrity requirements depending on the determined criticality of application.
(B) Some systems that are being considered will utilize off aircraft processing of data. If this is to be pursued it should be assumed that the aircraft data will be lost or misplaced at the processing center, and the aircraft system design should consider this possibility. Some on-board data storage is one way to account for this lost data. The integrity of the processing center's software should be equal to that of the aircraft software. In addition the intervals for processing the data from each flight should be specified as part of the approval.
1208 Par 776
(C) Due to the limited experience with these systems it is suggested the issue paper process be utilized to record the progress of the approval, and to provide information for later updating of this AC material.
777. STANDARDIZED TEST PROCEDURE FOR ROTORCRAFT DC ELECTRICAL SYSTEM TESTS.
a. Test Requirements.
(1) General. The following functions and characteristics are to be evaluated:
(1) Normal System Operation.
(il) Parallel Load Division.
(IlI) Excitation.
(iv) Stabilization.
(v) Systems Malfunction.
(vi) Environmental Capability.
(vii) Electromagnetic Compatibility.
(vili) Cooling Capability.
(ix) Surge Characteristics, Ripple Voltage, and Voltage Spikes.
(2) Instrumentation. Calibration records should be available for all instrumentation. Current and voltage vs. time should be recorded in a permanent form.
Enough specific currents and voltages should be recorded to allow reconstruction of any sequence of events that would happen as a result of any system testing described herein.
(3) Regulatory References. Sections 29.1301, 29.1307(c), (d), (e), 29.1309,
29.1351, 29.1353, 29.1355, 29.1357, 29.1363.
(4) Miscellaneous. The assigned FAA/AUTHORITY systems and equipment engineer normally witnesses these tests and should be notified as far in advance of the testing as possible to minimize scheduling problems. Conformity of the test setup must be established prior to conducting any testing. Most of the above test categories can be conducted on a bench test setup. A bench test setup is especially recommended in the case of the system malfunction tests. It is the applicant's option to demonstrate his Par 776 1209
equipment either on the bench or installed for ground tests. When a bench setup is used, it should represent the actual aircraft installation to the extent that components and wiring (type, gage, and length) are duplicated. Some retesting may be necessary on the aircraft to verify the bench test results.
b. Ground and Bench Test Procedures.
CAUTION: Prior to disconnecting the battery and removing or adding large loads, either isolate the avionics systems or assure that transients induced are within limits of the avionics equipment.
(1) Normal System Operation.
NOTE: Equipment should be operated for at least 10 minutes prior to each test as a warmup.
Minimum electrical load for paralleling and minimum engine RPM.
(il) Vary RPM of all engines from low to high and back to low.
(iii) Repeat b(1)(iI) for maximum and 50 percent of maximum electrical loads.
(2) Parallel Load Division (if parallel system).
Minimum electrical load for paralleling and minimum engine RPM.
(ii) Fifty percent of maximum electrical load and minimum engine RPM.
(iii) Maximum electrical load and minimum engine RPM.
(iv) Minimum electrical load for paralleling, vary No. 1 engine RPM from low to high and back to low while holding the RPM of the other engine at minimum (low).
(V) Repeat b(2)(d) for each other engine on the rotorcraft.
(vi) Repeat b(2)(d) and b(2)(e) procedures with 50 percent of maximum electrical load.
(vii) Repeat b(2)(d) and b(2)(e) procedures with a maximum electrical load.
(3) Excitation.
1210 Par 777
NOTE: All of these tests are to be conducted with the battery OFF since the purpose of the tests is to determine if the ship's battery is necessary for excitation of the alternators)/generator(s).
(i> Minimum anticipated electrical load, low engine RPM, and alternator(s)/generator(s) OFF. Demonstrate that when an alternator/generator is turned ON, it will come on the line. Repeat for any other alternators/generators in the system.
(ii) Maximum electrical load, low engine RPM, and alternator(s)/generator(s) OFF. Demonstrate that each alternator/generator will individually come on the line.
(iii) Minimum anticipated electrical load, high engine RPM, and alternator(s)/generator(s) OFF. Demonstrate that each alternator/generator will individually come on the line.
(4) Stabilization.
NOTE: All of these tests are to be conducted with the ship's battery OFF, since the purpose of the tests is to determine if the ship's battery is necessary for stabilization of the alternator/generator. In each case, if the ship's battery is not necessary for stabilization, the alternator/generator should be on the line and remain there at a satisfactory voltage level.
(i) Minimum anticipated electrical load, low engine RPM, alternator(s)/generator(s) ON. Switch on the heaviest electrical load that is anticipated to be installed on the aircraft.
(її) Repeat b(4)(i) for a maximum electrical load and low engine RPM.
(iii) Repeat b(4)(i) for a minimum anticipated electrical load and high engine RPM.
(iv) Repeat b(4)(i) for a maximum electrical load and high engine RPM.
(5) System Malfunctions.
(i) Overcurrent faults (faults to airframe ground that are less than
5.0 Milliohms) should be applied to buses and feeders as necessary to demonstrate that the system's overcurrent circuit protective devices are properly coordinated and provide adequate protection/fault isolation.
(ii) Simulate an overvoltage condition on each alternator/generator to demonstrate satisfactory operation of the overvoltage sensing network. On a Par 777 1211
multiengine configuration, the faulty alternator/generator should be removed without affecting operation of the remainder of the system.
(ili) The annunciation circuitry should be checked for indication of failures such as overvoltage, tripped generators, overcurrent, open feeders, open tie breakers, etc.
(6) Aircraft Ground Tests. If the above tests (reference b(1) through (4) inclusive) are conducted on a bench setup, enough tests should be repeated on the aircraft to validate the bench test results. The following tests should be conducted on the aircraft:
Normal Battery Starts. Start all engines on the aircraft following the normal procedure prescribed in the flight manual. Record starter volts and amperes, time, and any other parameters deemed necessary.
Ground Power Cart Starts. If the aircraft is equipped with a plug for a ground power cart, use the procedure described in the flight manual and start all engines. Record starter volts and amperes, time, and any other parameters deemed necessary.
Emergency Battery Operation (if provided). The emergency battery mode of operation should be tested to assure at least proper switching, annunciation, and battery capacity. In some instances, an analysis of battery capacity may be adequate.
(iv) Other Tests. Conduct other tests as necessary to demonstrate proper operation of the specific design being evaluated.
(V) Distribution System Tests. With all systems operating individually, open and close feeder circuit breakers and system circuit breakers and assure separation of power sources for essential systems. For example, removing power from one bus by opening a feeder should not result in loss of both NAV 1 and NAV 2 or both COMM 1 and COMM 2 or both attitude gyros, or for example, opening NAV 1 circuit breaker should not affect NAV 2, etc. If the opening of the feeder protection has been satisfactorily demonstrated on a bench test facility, it should not be necessary to repeat that demonstration on the actual aircraft. The effect of loss of power sources should also be demonstrated on the aircraft. Reference §§ 29.1357 (e) and 29.1309.
(7) Environmental Qualification. Each component of the system, such as relays, switches, alternator, generator, sensor, regulator, diode, etc., should be qualified to the critical environmental parameters. The temperature, altitude, humidity, and vibration expected in the approved aircraft operational envelope should fall within those limits the applicant substantiates for the electrical system components. (Refer to Paragraph 621 of this advisory circular.)
1212 Par 777
(8) Electromagnetic Compatibility. At no time during any of the qualification testing described herein should objectionable interference in the aircraft's radio, navigation, cockpit instrument, autopilot, or interphone system be considered acceptable.
NOTE: The quantitative type testing used for Items (7) and (8) above is outside the scope of this document. The latest revision of RTCA Document DO-160 is an acceptable standard.
(9) Transient Tests. The D.C. system should be tested and shown to exhibit surge, ripple, and spike voltages within the limits of the latest revision of RTCA Document DO-160.
The surge and ripple voltage tolerance of avionic equipment is defined by the latest revision of RTCA Document DO-160. Category Z is considered applicable to rotorcraft D.C. systems.
The voltage spike tolerance of avionic equipment is defined by the latest revision of RTCA Document DO-160.
(10) Ground and Bench Test Report. At the conclusion of the ground and bench test program a report should be prepared and submitted that contains at least the following:
System schematic (including instrumentation tie-in).
(iT) Instrumentation list (including calibration records).
Test result recordings.
(iv) Detailed procedures and results obtained.
(v) Conformity inspection records.
(vi) Other data, photographs, etc., to describe the test setup.
(vii) Summary of the test results. This summary should show the maximum load to which each bus, alternator/generator, etc., has been tested.
(vili) Analysis of test results. This should describe how compliance with the regulations has been shown. It should include consideration of the critical failure modes. Refer to Paragraphs 776a(4) (ii) and 621c of this advisory circular for further information on failure analyses.
Par 777 1213
c. Flight Test Procedures.
(1) Alternator/generator cooling tests should be conducted in accordance with Paragraph 778 of this advisory circular.
(2) On multiengine rotorcraft, single-engine air starts should be conducted using the manufacturer's recommended procedures. This should be accomplished for each engine individually.
(3) A cockpit evaluation of the electrical system should be conducted to evaluate:
(i) Switch, circuit breaker, and annunciator identification.
(її) Visibility of placarding, switches, etc., during bright sunlight and night operation.
Color of annunciators as related to the function/malfunction annunciated.
(iv) Load meter readability.
(v) Access to essential switches, circuit breakers, etc.
(vi) Electromagnetic interference.
(vil) Compatibility of the electrical system with the rotorcraft flight manual and the need for additional procedures in the RFM.
(vili) Clarity of functions such as opened feeder breakers, tie breakers, related annunciation, and necessary corrective action in the event of malfunction.
(ix) Absence of undesired functions in relation to switch combinations.
778. STANDARDIZED TEST PROCEDURE FOR ROTORCRAFT GENERATOR COOLING.
a. Lest Requirements.
(1) General. The applicant should contact the generator (alternator) manufacturer and obtain the maximum limits for the unit to be tested. This will normally be in terms of temperatures at various locations within the unit (stator, bearings, diodes, heat sinks, brushes, etc.) or in terms of pressure drop across the generator. The manufacturer should either supply an instrumented unit or give complete details for instrumenting the test unit.
1214 Par 777
(2) Instrumentation.
Load Bank. A load bank will usually be necessary to load the test unit to the amperage limit for which approval is requested.
(Il) Ammeter. An ammeter should be provided with sufficient resolution to assure the amperage load is being maintained at the desired level.
(Il) Temperature/Pressure Readouts. Readouts which are compatible with the temperature or pressure sensors installed in the test unit should be provided.
(iv) Calibration Records. Calibration records should be available for all instrumentation.
(v) Recordings. Permanent recordings should be provided for time, temperatures, current and/or pressure. The recording device should have provisions for placing event marks on the recording medium.
(3) Regulatory References. Sections 29.1301, 29.1309, 29.1351, 29.1363(b),
29.1521(e), 29.1041, 29.1043, 29.1045, 29.1047, and 29.1049.
(4) Miscellaneous. The results obtained from the tests should be corrected for hot day conditions using a standard lapse rate (3.6° F/1,000 feet).
b. Test Procedures.
(1) Single Engine Procedure.
(i) The cooling test is to be conducted during ground operation and climb-out, cruise and approach flight regimes.
All ground operational and in-ground effect hover tests should be conducted in ambient winds of 5 knots or less. Wind direction relative to the aircraft should be from the most critical direction.
(ili) The battery may be connected to the bus during the generator/alternator cooling test. The generator/alternator temperatures should be recorded at intervals sufficiently close to show the rate of temperature increase and stabilization. The temperature may be considered stabilized when it peaks and has not increased in the last 5 minutes. The climb-out speed and power setting should correspond to the best rate of climb speed, using maximum continuous power or any other normal conditions of climb that would cause the generator/alternator temperatures to be critical. The cruise test should be conducted at maximum altitude in the cruise configuration. Generator/alternator cooling should be conducted at rated output Par 778 1215
consistent with the RPM at which it is operating. For instance, during the ground tests the engine RPM may be lower than that necessary to sustain maximum rated amperage output. In this case the maximum amperage output of the generator/alternator corresponding to the lower RPM should be assured.
(iv) The test sequence should begin with about 30 minutes of ground operation to account for taxi and holding times, and end 5 minutes after all temperatures have peaked after engine shut down.
(2) Multi-engine Procedures. Conduct a generator cooling test in accordance with the following procedure:
(i) All ground operational and in-ground effect hover tests should be conducted in ambient winds of 5 knots or less. Wind direction relative to the aircraft should be from the most critical direction.
(ii) After engine start, load the instrumented generator to its proposed amperage limit and begin recording temperatures.
(iii) A total of 30 minutes should be spent on the ground prior to takeoff.
This is to account for taxi and holding times.
(iv) After takeoff, climb at single-engine best-rate-of-climb speed using maximum continuous power, to the single-engine service ceiling. Above this, continue at twin-engine best-rate-of-climb speed, using maximum continuous power on both engines, to maximum altitude.
(V) Cruise at maximum altitude until all generator temperatures stabilize.
Temperatures shall be considered stabilized when they have peaked and have not increased for a period of 5 minutes.
(vi) Descend, conduct an approach to include a go-around, hover until temperature stabilizes, then land and continue to record temperatures after shut-down until 5 minutes after all temperatures have peaked.
(vii) Conduct cooling tests with the rotorcraft hovering at both the minimum and maximum hover altitudes.
(vill) Correct all results for hot day conditions. Use the standard lapse rate of 3.6° F/1,000 feet for consideration of altitude. See Paragraph 621 of this advisory circular for details on temperature correction.
(ix) If at any time during the testing it appears the manufacturer's limits are to be exceeded, the amperage load on the test generator/alternator should be reduced to prevent this from happening.
1216 Par 778
779. Sections 29.1301, 29.1309, and 29.1322 ANNUNCIATOR PANELS.
a. Explanation.
(1) The annunciator panel design should be reviewed for the presence of failure modes that can cause illumination of multiple panel segments.
(2) Many test circuits that are diode isolated are vulnerable to this condition. A typical sequence begins with the shorting of a test circuit diode. This failure is undetectable and goes unnoticed until an actual failure condition occurs which causes the associated panel segment to illuminate. At this time all panel segments connected to the test circuit will illuminate.
(3) This configuration becomes a special problem when one or more of the panel segments are red. A red light calls for immediate action by the crew, and the crew does not have adequate information for immediate action when many false panel segments are illuminated.
(4) If the design review indicates a problem, a redesign of the panel to eliminate the condition is considered to be the best solution and is highly encouraged.
b. Procedures.
(1) An alternative to panel redesign might be the following:
(i) Review the annunciator panel design and note which segments are red.
(її) Determine if cross reference information is available in the cockpit to allow elimination from consideration of any the red segments. (Example: Red low fuel pressure light and low fuel pressure gauge. Normal operation of the gauge would be a reason to assume the light did not cause the problem.)
(iii) Where a cross reference is available, further design review of that function is not necessary; however, it may be appropriate to include procedural information in the emergency procedures section of the rotorcraft flight manual.
(iv) If cross references are not available for red segments, additional isolation should be incorporated into the annunciator design for those functions.
(2) If cross referencing is not practical the following approach is encouraged.
(i) Review the annunciator panel design and note which segments are red.
Par 779 1217