Appendix 2 APPENDIX 2
ROTORCRAFT ONE-ENGINE-INOPERATIVE POWER ASSURANCE
1. PURPOSE.
The purpose of this document is to establish an approach for an engine power assurance procedure which will assure that the required OEI power level can be achieved.
2. GENERAL.
The data and methods described herein are intended to be utilized as a guide and not necessarily the only means of achieving the desired result.
3. APPLICABILITY.
The applicability of the document is intended to be primarily in support of the new 30-second and 2-minute OE rotorcraft engine rating scheme.
4. PARTIAL POWER ASSURANCE (ENGINE "RUN-LINE").
a. Fundamental to the concept of limited-use one-engine-inoperative (OEI) ratings is the requirement to be certain that the rated OE power will indeed be available when needed. Conventional periodic power-assurance and topping checks are impractical with the limited-use rating concept because of the rapid expenditure of useful life during exposure at the engine speeds and temperatures consistent with limited-use ratings;
therefore, we require a means of assuring the power available, other than by actual demonstration on each service engine. The advent of more sophisticated controls and engine developments catering to the 30-second/2-minute OEI rating concepts can provide the means to determine: (1) that the thermodynamic/mechanical capability of the engine as tested at the prevailing ambient conditions, will permit reaching a specified power level at any other ambient condition and (2) the fuel system and the various limiters will not prevent the engine achieving OEI power on demand. Pending availability of these new methods, the "parallel run line check" approach is recommended.
b. The method commonly called the "parallel run-line check" that has been in use for two decades may require refinement for application to the new rating structure where the degree of extrapolation to the OEI power level is more extensive and the slope of the individual engine characteristic is important. As in any power assurance method, success is strongly dependent on the validity of the data base, the maintenance of the engines and sensor/indicating systems, and the care taken during the conduct of the power check. In addition, trending of individual engine pertormance Page A2-1
Appendix 2 by the operator and associated analyses can be used to avoid unnecessary flight delays and engine removals.
c. Thermodynamic/mechanical capability can be addressed by test stand mapping of development engines over a range of ambient conditions to establish an adequate data base of engine characteristics. This will address characteristic slope variations between engines and establish correction factors necessary for extrapolation of data from a power assurance checkpoint to the 30-second OEI rating. Statistical verification and/or modification of the data base may be necessary during production by mapping of sample production engines. Performance data, at the 30-second OEI condition, taken during the supplementary block test and also during the "overhaul test" will demonstrate the capability of an engine and its control system near the end of an overhaul period to produce the required power. This will demonstrate capability with a deteriorated base-performance engine.
d. The question of fuel system limitations and other various limiters, which could prevent the engine from achieving OEI power on demand, may be addressed by use of more sophisticated control systems, for example, electronic controls utilizing several engine parameter limiters each with automatic datum reset capability. Such control systems can sense an engine failure and automatically reset the operating limiters upward from "normal" to "OEI" limits. Conventional flow and electronic bench testing can be used to verify the function and limit setting of the units when new or after overhaul or repair. The reset features can be extended in function to include a fixed magnitude pulldown type reset for use in verifying new and field production engine/control combination function ability. Pulldown type resets are currently in use today for verification of limiter settings on some engines and can be utilized in this application to avoid unneeded exposure of the engine to the rapid life expenditure conditions.
e. While the above is envisioned as the probable means in which assurance of capability will occur early in the application of such engines, there will be other means developed. One such means would be utilization of modern electronic engine condition or health monitors to display "go" or "no go" conditions relative to the ability of the engine and its control system to produce 30-second OEI power if required. In this application the device would be a "power assurance meter" and could be used with electronic, hydro-mechanical, and pneumo-mechanical control systems. It is entirely reasonable to expect that self-taught or self-programmed power assurance meters can be used that continually program the actual performance slope of the subject engine and extrapolate to the 30-second OEl with continuous engine monitoring.
Self-programming occurs by sampling engine temperature, speed, torque, other characteristics (such as fuel pressure), and ambient conditions, resulting in the reflection of an actual characteristic for the installed engine. The availability of this information permits treating engines individually, whether it is a new or deteriorated engine or one with either minimum or maximum slope, without the necessary compromises to "best" engines that necessarily occurs using the earlier statistical Page A2-2
Appendix 2 approach. The question of instantaneous fuel system capacity could be addressed by fuel pump/control systems incorporating bypass systems equipped with flow meters.
The health monitor or power assurance meter can continually integrate the fuel flow increment available in terms of power increment required in the event of OEl and would include this intelligence in its pass-fail judgment criteria. Systems of this type would further be conducive to in-service ground checks by overt by-pass deactivation from low power settings to assure satisfactory mechanical function.
f. Power assurance for the limited-use OEl ratings depends on a complete understanding of the engine model's operating characteristics. Two approaches have been discussed, one where, with the aid of a sophisticated fuel control system, the engine "learns" its own characteristics, and the other where the performance extrapolation is compared with a known minimum standard. The establishment of the standard is obviously a vital part of the procedure, which depends to a large extent on the existence of a reliable data base. In a mature program this is relatively easy to maintain, since it is possible to use the new production engine acceptance data to establish engine-to-engine variation and also to test engines prior to overhaul to determine the effects of deterioration. Thus, an up-to-date minimum or worst-engine characteristic can be maintained and service engines would be compared with this minimum engine.
g. When the engine in question is a completely new design, or a remote derivative of an existing design, establishing the initial data base presents some problems which must be resolved. New production engines will eventually establish engine-to-engine variation, but initially an estimated worst variation must be assumed.
The rate of deterioration and its impact on the base standard must be accounted for from the first engine delivered, yet it may be some time before an acceptable number of engines can be tested after service.
h. A partial solution lies in the development and qualification cycle of the engine.
A typical new-design program requires several development engines, of which more than half can be expected to be used for endurance or accelerated endurance testing.
Furthermore, by the time certification is completed and production deliveries have commenced, these engines will normally have amassed several thousand hours of running usually to a schedule far more rigorous than normal service. The information gathered during these tests will provide the necessary data base for the assessment of in-service engines, and it can be progressively enlarged, and the derived data refined, as further production and service data are obtained.
ENGINE CONSIDERATIONS. This section describes the potential causes of an engine not delivering specification OEI power levels in spite of passing a parallel run-line power assurance check. Possible solutions are discussed in the context of one time use 30-second and 2-minute ratings.
a. Eue Flow.
Page A2-3
Appendix 2
(1) An engine may not achieve maximum power available or emergency rating because insufficient fuel is supplied. This condition has a number of possible causes:
(1) Low acceleration schedule
(ii) Low maximum fuel stop (ilI) Low fuel pump output
(iv) Restrictions between the fuel control and the combustor
(2) The proposed emergency ratings (OEI) may preclude the use of a topping check to uncover the above problems; therefore the following procedures are advanced which can be used either separately or in combination with other approved methods to assure that the required fuel flow is available.
(3) During engine acceleration the fuel flow rate is considerably higher when compared with the normal steady state condition. This fact can be used to verify the availability of OEl fuel flow. The verification can be done by a direct measurement of fuel flow during an acceleration or derived indirectly from the engine acceleration rate.
It is envisaged that the determination of fuel flow by these procedures should be done by some automatic means.
(4) Figure 1 is a bypass technique in which some of the fuel controls output is routed away from the engine and back to tank. This forces the fuel control onto the acceleration schedule in order to maintain gas generator speed. The design of the system should ensure that with the bypass flowing the fuel control outlet pressure and flow at the OEI ratings are simulated. The bypass system can be either permanently installed and operated in flight, (Failure Malfunction Effects Analysis must be provided), or as an item of ground test equipment. The quantity of fuel bypassed should be equivalent to the worst case difference between fuel flow at the 30-second rating and typical power assurance power levels. However, trend monitoring and service history may provide the basis of an alternative to periodic measurement.
b. Limiters. A means must be provided to assure that a lower than required (for OEI power) limiter setting does not exist. Limiters that could prohibit reaching OEI power are as follows:
(1) Ng Limiter - (Maximum Compressor Speed Limiter or Governor)
(2) Measured gas temperature limiter.
(3) Output shaft torque limiter.
Page A2- 4
Appendix 2
(4) Np limiter or power turbine governor - (Power turbine governors can be verified at lower than OEI power conditions.)
(5) Fuel flow limiter or maximum fuel flow stop - (Fuel flow limiting has been addressed in previous paragraphs.)
c. Failure Modes and Effects Analysis.
Failure modes and effects analysis, along with limited demonstration and suitable engine health monitoring procedures, may provide the basis of an acceptable solution to possible unexpected power limiting due to engine condition. It should be shown in the analysis that there is no probable event or combination of events which can cause a latent problem leading to inadequate tuel flow at high powers. The analysis should include all components of the fuel system such as: pump(s), control system (mechanical, hydromechanical, electronic, etc.) pipework, filters, fuel nozzle(s), and electrical interfaces. It should also address the probable effects of accumulated running time, dirty fuel, and hostile environment.
d. High Corrected Gas Producer Speed.
(1) The proposed OE ratings will cause the engine to run at high corrected gas producer speeds (Ng/Ve). At high Ng/Ve, performance characteristics of components, especially in the compressor, can change significantly and to an extent which would change the extrapolation of low speed run line data.
(2) In operation, the effects of the accretion of dirt, FOD, component deterioration, and erosion of blading may also cause changes in the high-speed performance of an engine.
(3) The above effects must be considered when developing power assurance procedures and data.
e. Special Devices.
(1) The satisfactory operation of devices or systems whose functioning is required in order to achieve the OEI powers should be verified. Devices or systems, which in normal operations are not exercised through the range of travel needed to achieve the OEI powers, may require special checks to assure adequate capability.
(2) Special devices that are required only in order to achieve the OEl powers (for example, solenoids to provide additional cooling flow to hot-section components or a water/anti-freeze mixture into the compressor), should be subjected to periodic checks and have a demonstrated high reliability.
Page A2-5
Appendix 2
6. AIRERAME CONSIDERATIONS.
a. Instrumentation Accuracy.
(1) The accuracy of any power assurance check is strongly dependent on the air data and engine parameters. SAE ARP 1217 (May 1979) provides guidance on the desired measurement accuracy for parameters used for engine health and diagnostic monitoring. The parameters to be considered with their respective functions include:
Pressure Altitude Air data basis for Flight Speed establishing power Free Air Temperature plant inlet pressure (stagnation) and temperature.
Torque Direct measurement of Power Turbine Speed power output.
Gas Generator Speed(s) Primary thermodynamic Measure Gas Temperature and limiting parameters Fuel Flow Secondary trend monitoring and potential limiting parameter
(2) The overall power check accuracy can be assessed on a suitable statistical basis using equations that link the measured parameters and inserting system accuracy distributions for each value. This approach will provide an overall assessment of power check accuracy and will highlight major contributors to error. The accuracy assessment at each parameter should include the following elements:
Sensor error Indicator error System error Reading error
(3) This assessment might show that while conventional instrument displays of air data are acceptable, servo driven digital displays are desired for engine parameters.
Further, displays that provide a "snapshot" of engine readings at a given moment may be useful in avoiding variation in power level during the finite period needed to manually read and log the set of parameters.
b. Installation Loss Definition.
(1) Installation loss definition is an extremely important aspect of any form of rotorcraft engine performance. Engines are certificated and sold with uninstalled.
performance guarantees and estimates as to the power output capabilities. Installation of the engine in the rotorcraft imposes power output penalties that must be accounted Page A2- 6
Appendix 2 for in any sort of power assurance check procedure. Normal practice dictates that the engine manufacturer provides a computer program that accurately predicts the engine power output capability throughout the approved flight envelope. This computer program has the capability to correct the power output for the losses incurred by the rotorcraft installation.
(2) Losses that can reduce engine power available are as follows:
(1) Air intake total pressure loss (II) Air intake total temperature rise
(iii) Exhaust back pressure
(iv) Accessory power extraction
(v) Compressor bleed air extraction
(vi) Off-optimum power turbine output speed effects
(3) The above items and methods of dealing with them are clearly defined in SAE Aerospace Recommended Practice (ARP) 1702. Typically, these losses will not be a fixed percentage but will vary with engine operating conditions and environment.
(4) Any calculations involving power assurance data should use the approved engine performance program, and the rotorcraft losses should be input on a discrete basis so that the interaction between losses and their independent variability is properly considered. This approach is clearly defined in ARP 1702. Accurate consideration of the losses should produce a Power Assurance Check that will preclude premature removal of acceptable engines or continued operation of inadequate power plants.
7. ROTORCRAFT FLIGHT MANUAL (RFM).
a. The Power Assurance Check data for the installed engine (engine data adjusted for inlet losses, exhaust losses, bleed extraction, power extraction, and off-optimum output shaft speed operation) should be presented in the RFM in an easily useable format. The data format may consist of charts of engine torque (at constant power turbine shaft speed) versus allowable values of gas generator speed and gas path temperature covering the range of ambient conditions for takeoff operations.
Associated limitations for the rotorcraft transmission and the engine should be noted.
b. The RFM should also address the following:
(1) Include succinct statements of the reason for the Power Assurance Check and what must be done if the Power Assurance Check results are not acceptable.
Page A2-7
Appendix 2
(2) Clearly state that Power Assurance Check either is a pre-takeoff or in-flight procedure, as required by operations, specifications and/or other approval authority documents.
(3) Be kept simple, easy to use, and identify equipment operation limitations and requirements.
Page A2- 8
Appendix 2
NEEDLE VALVE AIRCRAFT FUEL TANK
FUEL FLOW TRANSMITTER BY-PASS TEE FUEL PRESSURE TRANSMITTER FUEL PRESSURE GAGE INSTALLED ENGINE FUEL FLOW CAPACITY CHECK
FUEL NOZZLE COCKPIT FUEL FLOW GAGE
FUEL CONTROL FUEL PUMP _ FIGURE АРХ2-1 Page A2-9
Appendix 3 APPENDIX 3
ADVISORY MATERIAL FOR COMPLIANCE
WITH ROTORBURST RULE PURPOSE. This advisory material sets forth a method of compliance with the requirements of §§ 29.901, 29.903(b)(1), and 29.903(d)(1) of the Federal Aviation Regulations (FAR) pertaining to design precautions taken to minimize the hazards to rotorcraft in the event of uncontained engine rotor (compressor and turbine) failure. It is for guidance and to provide a method of compliance that has been found acceptable.
As with all AC material, it is not mandatory and does not constitute a regulation.
2. RELATED FAR/JAR SECTIONS. Sections 29.901(c) and 29.903(d) (1) of the FAR/JAR.
3. BACKGROUND. Although turbine engine manufacturers are making efforts to reduce the probability of uncontained rotor failures, service experience shows that such failures continue to occur. Failures have resulted in high velocity fragment penetration of fuel tanks, adjacent structures, fuselage, system components and other engines of the rotorcraft. Since it is unlikely that uncontained rotor failures can be completely eliminated, rotorcraft design precautions should be taken to minimize the hazard from such events. These design precautions should recognize rotorcraft design features that may differ significantly from that of an airplane, particularly regarding an engine location and its proximity to another engine or to other systems and components.
a. Uncontained gas turbine engine rotor failure statistics for rotorcraft are presented in the Society of Automotive Engineers (SAE) Report No.'s AIR 4003 (period 1976-83) and AIR 4770 (period 1984-89).
b. The statistics in the SAE studies indicate the existence of some failure modes not readily apparent or predictable by failure analysis methods. Because of the variety of uncontained rotor failures, it is difficult to analyze all possible failure modes and to provide protection to all areas. However, design considerations outlined in this AC provide guidelines for achieving the desired objective of minimizing the hazard to rotorcraft from uncontained rotor failures. These guidelines, therefore, assume a rotor failure will occur and that analysis of the effects or evaluation of this failure is necessary. These guidelines are based on service experience and tests but are not necessarily the only means available to the designer.
4. DEFINITIONS.
a. Minimize. Means to reduce to the least possible amount by means that can be shown to be both technically feasible and economically justifiable.
Page A3- 1
Appendix 3
b. Separation. Positioning of redundant critical structure, systems, or system components within the impact area such that the distance between the components minimizes the potential impact hazard. Redundant critical components should be separated within the spread angles of a rotor by a distance at least equal to either a ½ unbladed disk (hub, impeller) sector, or a 1/3 bladed disk (hub, impeller) sector with 1/3 blade height, with each rotating about its center of gravity (CG), whichever is greater (See Figure APX3-6).
c. Isolation. A means to limit system damage so as to maintain partial or full system function after the system has been damaged by fragments. Limiting the loss of hydraulic fluid by the use of check valves to retain the capability to operate flight controls is an example of "isolation." System damage is confined allowing the retention of critical system functions.
d. Rotor. Rotor means the rotating components of the engine and APU that analysis, test results, and/or experience has shown can be released during uncontained tallure with sufficient energy to hazard the rotorcraft.
The engine or APU manufacturer should define those components that constitute the rotor for each engine and APU type design. Typical rotors have included, as a minimum, disks, hubs, drums, seals, impellers, and spacers.
e. Uncontained Engine or APU Failure (or Rotorburst). For the purposes of rotorcraft evaluations in accordance with this AC, uncontained failure of a turbine engine is any failure which results in the escape of rotor fragments from the engine or APU that could create a hazard to the rotorcraft. Rotor failures of concern are those in which released fragments have sufficient energy to create a hazard to the rotorcraft.
Uncontained failures of APU's which are "ground operable only" are not considered hazardous to the rotorcraft.
f. Critical Component (System). A critical component is any component or system whose failure or malfunction would contribute to or cause a failure condition that would prevent the continued safe flight and landing of the rotorcraft. These components (systems) should be considered on an individual basis and in relation to other components (systems) that could be degraded or rendered inoperative by the same fragment or by other fragments during any uncontained failure event.
g. Fragment Spread Angle. The fragment spread angle is the angle measured, fore and aft, from the center of the plane of rotation of the disk (hub, impeller) or other rotor component initiating at the engine or APU shaft centerline or axis of rotation (See Figure APX3-1). The width of the fragment should be considered in defining the path of the fragment envelope's maximum dimension.
h. Ignition Source. Any component that could precipitate a fire or explosion. This includes existing ignition sources and potential ignition sources due to damage or fault Page A3-2
7130/97 АС 29-2B Appendix 3 from an uncontained rotor failure. Potential ignition sources include hot fragments, damage or faults that produce sparking, arcing, or overheating above the auto-ignition temperature of the fuel. Existing ignition sources include items such as unprotected engine or APU surfaces with temperature greater than the auto-ignition temperature of the fuel or any other flammable fluid.
5. SAFETY ASSESSMENT.
a. Procedure. Assess the potential hazard to the rotorcraft using the following procedure:
(1) Minimizing Rotorburst Hazard. The rotorburst hazard should be reduced to the lowest level that can be shown to be both technically feasible and economically justifiable. The extent of minimization that is possible will vary from new or amended certification projects and from design to design. Thus the effort to minimize must be determined uniquely for each certification project. Design precautions and techniques such as location, separation, isolation, redundancy, shielding, containment and/or other appropriate considerations should be employed, documented, agreed to by the certifying authority, and placed in the type data file. A discussion of these methods and techniques follows.
(2) Geometric Layout and Safety Analysis. The applicant should prepare a preliminary geometric layout and safety analysis for a minimum rotorburst hazard configuration determination early in the design process and present the results to the certification authority no later than when the initial design is complete. Early contact and coordination with the certifying authority will minimize the need for design modification later in the certification process. The hazard analysis should follow the guidelines indicated in Paragraph 397c(2) in this Advisory Circular and (5)(f) of this appendix. Geometric layouts and analysis should be used to evaluate and identify engine rotorburst hazards to critical systems, powerplants, and structural components from uncontained rotor fragments, and to determine any actions which may be necessary to further minimize the hazard. Calculated geometric risk quantities may be used in accordance with Paragraph (d) following, to define the rotorcraft configuration with the minimum physical rotorburst hazard.
b. Engine and APU Failure Model. The safety analysis should be made using the following engine and APU failure model, unless for the particular engine/APU type concerned, relevant service experience, design data, test results or other evidence justify the use of a different model. In particular, a suitable failure model may be provided by the engine/APU manufacturer. This may show that one or more of the considerations below do not need to be addressed.
(1) Single One-Third Disc Fragment. It should be assumed that the one-third disc fragment has the maximum dimension corresponding to one-third of the disc with one-third blade height and a fragment spread angle of +3°. Where energy Page А3- 3