Appendix 2
(1) An engine may not achieve maximum power available or emergency rating because insufficient fuel is supplied. This condition has a number of possible causes:
(1) Low acceleration schedule
(ii) Low maximum fuel stop (ilI) Low fuel pump output
(iv) Restrictions between the fuel control and the combustor
(2) The proposed emergency ratings (OEI) may preclude the use of a topping check to uncover the above problems; therefore the following procedures are advanced which can be used either separately or in combination with other approved methods to assure that the required fuel flow is available.
(3) During engine acceleration the fuel flow rate is considerably higher when compared with the normal steady state condition. This fact can be used to verify the availability of OEl fuel flow. The verification can be done by a direct measurement of fuel flow during an acceleration or derived indirectly from the engine acceleration rate.
It is envisaged that the determination of fuel flow by these procedures should be done by some automatic means.
(4) Figure 1 is a bypass technique in which some of the fuel controls output is routed away from the engine and back to tank. This forces the fuel control onto the acceleration schedule in order to maintain gas generator speed. The design of the system should ensure that with the bypass flowing the fuel control outlet pressure and flow at the OEI ratings are simulated. The bypass system can be either permanently installed and operated in flight, (Failure Malfunction Effects Analysis must be provided), or as an item of ground test equipment. The quantity of fuel bypassed should be equivalent to the worst case difference between fuel flow at the 30-second rating and typical power assurance power levels. However, trend monitoring and service history may provide the basis of an alternative to periodic measurement.
b. Limiters. A means must be provided to assure that a lower than required (for OEI power) limiter setting does not exist. Limiters that could prohibit reaching OEI power are as follows:
(1) Ng Limiter - (Maximum Compressor Speed Limiter or Governor)
(2) Measured gas temperature limiter.
(3) Output shaft torque limiter.
Page A2- 4
Appendix 2
(4) Np limiter or power turbine governor - (Power turbine governors can be verified at lower than OEI power conditions.)
(5) Fuel flow limiter or maximum fuel flow stop - (Fuel flow limiting has been addressed in previous paragraphs.)
c. Failure Modes and Effects Analysis.
Failure modes and effects analysis, along with limited demonstration and suitable engine health monitoring procedures, may provide the basis of an acceptable solution to possible unexpected power limiting due to engine condition. It should be shown in the analysis that there is no probable event or combination of events which can cause a latent problem leading to inadequate tuel flow at high powers. The analysis should include all components of the fuel system such as: pump(s), control system (mechanical, hydromechanical, electronic, etc.) pipework, filters, fuel nozzle(s), and electrical interfaces. It should also address the probable effects of accumulated running time, dirty fuel, and hostile environment.
d. High Corrected Gas Producer Speed.
(1) The proposed OE ratings will cause the engine to run at high corrected gas producer speeds (Ng/Ve). At high Ng/Ve, performance characteristics of components, especially in the compressor, can change significantly and to an extent which would change the extrapolation of low speed run line data.
(2) In operation, the effects of the accretion of dirt, FOD, component deterioration, and erosion of blading may also cause changes in the high-speed performance of an engine.
(3) The above effects must be considered when developing power assurance procedures and data.
e. Special Devices.
(1) The satisfactory operation of devices or systems whose functioning is required in order to achieve the OEI powers should be verified. Devices or systems, which in normal operations are not exercised through the range of travel needed to achieve the OEI powers, may require special checks to assure adequate capability.
(2) Special devices that are required only in order to achieve the OEl powers (for example, solenoids to provide additional cooling flow to hot-section components or a water/anti-freeze mixture into the compressor), should be subjected to periodic checks and have a demonstrated high reliability.
Page A2-5
Appendix 2
6. AIRERAME CONSIDERATIONS.
a. Instrumentation Accuracy.
(1) The accuracy of any power assurance check is strongly dependent on the air data and engine parameters. SAE ARP 1217 (May 1979) provides guidance on the desired measurement accuracy for parameters used for engine health and diagnostic monitoring. The parameters to be considered with their respective functions include:
Pressure Altitude Air data basis for Flight Speed establishing power Free Air Temperature plant inlet pressure (stagnation) and temperature.
Torque Direct measurement of Power Turbine Speed power output.
Gas Generator Speed(s) Primary thermodynamic Measure Gas Temperature and limiting parameters Fuel Flow Secondary trend monitoring and potential limiting parameter
(2) The overall power check accuracy can be assessed on a suitable statistical basis using equations that link the measured parameters and inserting system accuracy distributions for each value. This approach will provide an overall assessment of power check accuracy and will highlight major contributors to error. The accuracy assessment at each parameter should include the following elements:
Sensor error Indicator error System error Reading error
(3) This assessment might show that while conventional instrument displays of air data are acceptable, servo driven digital displays are desired for engine parameters.
Further, displays that provide a "snapshot" of engine readings at a given moment may be useful in avoiding variation in power level during the finite period needed to manually read and log the set of parameters.
b. Installation Loss Definition.
(1) Installation loss definition is an extremely important aspect of any form of rotorcraft engine performance. Engines are certificated and sold with uninstalled.
performance guarantees and estimates as to the power output capabilities. Installation of the engine in the rotorcraft imposes power output penalties that must be accounted Page A2- 6
Appendix 2 for in any sort of power assurance check procedure. Normal practice dictates that the engine manufacturer provides a computer program that accurately predicts the engine power output capability throughout the approved flight envelope. This computer program has the capability to correct the power output for the losses incurred by the rotorcraft installation.
(2) Losses that can reduce engine power available are as follows:
(1) Air intake total pressure loss (II) Air intake total temperature rise
(iii) Exhaust back pressure
(iv) Accessory power extraction
(v) Compressor bleed air extraction
(vi) Off-optimum power turbine output speed effects
(3) The above items and methods of dealing with them are clearly defined in SAE Aerospace Recommended Practice (ARP) 1702. Typically, these losses will not be a fixed percentage but will vary with engine operating conditions and environment.
(4) Any calculations involving power assurance data should use the approved engine performance program, and the rotorcraft losses should be input on a discrete basis so that the interaction between losses and their independent variability is properly considered. This approach is clearly defined in ARP 1702. Accurate consideration of the losses should produce a Power Assurance Check that will preclude premature removal of acceptable engines or continued operation of inadequate power plants.
7. ROTORCRAFT FLIGHT MANUAL (RFM).
a. The Power Assurance Check data for the installed engine (engine data adjusted for inlet losses, exhaust losses, bleed extraction, power extraction, and off-optimum output shaft speed operation) should be presented in the RFM in an easily useable format. The data format may consist of charts of engine torque (at constant power turbine shaft speed) versus allowable values of gas generator speed and gas path temperature covering the range of ambient conditions for takeoff operations.
Associated limitations for the rotorcraft transmission and the engine should be noted.
b. The RFM should also address the following:
(1) Include succinct statements of the reason for the Power Assurance Check and what must be done if the Power Assurance Check results are not acceptable.
Page A2-7
Appendix 2
(2) Clearly state that Power Assurance Check either is a pre-takeoff or in-flight procedure, as required by operations, specifications and/or other approval authority documents.
(3) Be kept simple, easy to use, and identify equipment operation limitations and requirements.
Page A2- 8
Appendix 2
NEEDLE VALVE AIRCRAFT FUEL TANK
FUEL FLOW TRANSMITTER BY-PASS TEE FUEL PRESSURE TRANSMITTER FUEL PRESSURE GAGE INSTALLED ENGINE FUEL FLOW CAPACITY CHECK
FUEL NOZZLE COCKPIT FUEL FLOW GAGE
FUEL CONTROL FUEL PUMP _ FIGURE АРХ2-1 Page A2-9
Appendix 3 APPENDIX 3
ADVISORY MATERIAL FOR COMPLIANCE
WITH ROTORBURST RULE PURPOSE. This advisory material sets forth a method of compliance with the requirements of §§ 29.901, 29.903(b)(1), and 29.903(d)(1) of the Federal Aviation Regulations (FAR) pertaining to design precautions taken to minimize the hazards to rotorcraft in the event of uncontained engine rotor (compressor and turbine) failure. It is for guidance and to provide a method of compliance that has been found acceptable.
As with all AC material, it is not mandatory and does not constitute a regulation.
2. RELATED FAR/JAR SECTIONS. Sections 29.901(c) and 29.903(d) (1) of the FAR/JAR.
3. BACKGROUND. Although turbine engine manufacturers are making efforts to reduce the probability of uncontained rotor failures, service experience shows that such failures continue to occur. Failures have resulted in high velocity fragment penetration of fuel tanks, adjacent structures, fuselage, system components and other engines of the rotorcraft. Since it is unlikely that uncontained rotor failures can be completely eliminated, rotorcraft design precautions should be taken to minimize the hazard from such events. These design precautions should recognize rotorcraft design features that may differ significantly from that of an airplane, particularly regarding an engine location and its proximity to another engine or to other systems and components.
a. Uncontained gas turbine engine rotor failure statistics for rotorcraft are presented in the Society of Automotive Engineers (SAE) Report No.'s AIR 4003 (period 1976-83) and AIR 4770 (period 1984-89).
b. The statistics in the SAE studies indicate the existence of some failure modes not readily apparent or predictable by failure analysis methods. Because of the variety of uncontained rotor failures, it is difficult to analyze all possible failure modes and to provide protection to all areas. However, design considerations outlined in this AC provide guidelines for achieving the desired objective of minimizing the hazard to rotorcraft from uncontained rotor failures. These guidelines, therefore, assume a rotor failure will occur and that analysis of the effects or evaluation of this failure is necessary. These guidelines are based on service experience and tests but are not necessarily the only means available to the designer.
4. DEFINITIONS.
a. Minimize. Means to reduce to the least possible amount by means that can be shown to be both technically feasible and economically justifiable.
Page A3- 1
Appendix 3
b. Separation. Positioning of redundant critical structure, systems, or system components within the impact area such that the distance between the components minimizes the potential impact hazard. Redundant critical components should be separated within the spread angles of a rotor by a distance at least equal to either a ½ unbladed disk (hub, impeller) sector, or a 1/3 bladed disk (hub, impeller) sector with 1/3 blade height, with each rotating about its center of gravity (CG), whichever is greater (See Figure APX3-6).
c. Isolation. A means to limit system damage so as to maintain partial or full system function after the system has been damaged by fragments. Limiting the loss of hydraulic fluid by the use of check valves to retain the capability to operate flight controls is an example of "isolation." System damage is confined allowing the retention of critical system functions.
d. Rotor. Rotor means the rotating components of the engine and APU that analysis, test results, and/or experience has shown can be released during uncontained tallure with sufficient energy to hazard the rotorcraft.
The engine or APU manufacturer should define those components that constitute the rotor for each engine and APU type design. Typical rotors have included, as a minimum, disks, hubs, drums, seals, impellers, and spacers.
e. Uncontained Engine or APU Failure (or Rotorburst). For the purposes of rotorcraft evaluations in accordance with this AC, uncontained failure of a turbine engine is any failure which results in the escape of rotor fragments from the engine or APU that could create a hazard to the rotorcraft. Rotor failures of concern are those in which released fragments have sufficient energy to create a hazard to the rotorcraft.
Uncontained failures of APU's which are "ground operable only" are not considered hazardous to the rotorcraft.
f. Critical Component (System). A critical component is any component or system whose failure or malfunction would contribute to or cause a failure condition that would prevent the continued safe flight and landing of the rotorcraft. These components (systems) should be considered on an individual basis and in relation to other components (systems) that could be degraded or rendered inoperative by the same fragment or by other fragments during any uncontained failure event.
g. Fragment Spread Angle. The fragment spread angle is the angle measured, fore and aft, from the center of the plane of rotation of the disk (hub, impeller) or other rotor component initiating at the engine or APU shaft centerline or axis of rotation (See Figure APX3-1). The width of the fragment should be considered in defining the path of the fragment envelope's maximum dimension.
h. Ignition Source. Any component that could precipitate a fire or explosion. This includes existing ignition sources and potential ignition sources due to damage or fault Page A3-2
7130/97 АС 29-2B Appendix 3 from an uncontained rotor failure. Potential ignition sources include hot fragments, damage or faults that produce sparking, arcing, or overheating above the auto-ignition temperature of the fuel. Existing ignition sources include items such as unprotected engine or APU surfaces with temperature greater than the auto-ignition temperature of the fuel or any other flammable fluid.
5. SAFETY ASSESSMENT.
a. Procedure. Assess the potential hazard to the rotorcraft using the following procedure:
(1) Minimizing Rotorburst Hazard. The rotorburst hazard should be reduced to the lowest level that can be shown to be both technically feasible and economically justifiable. The extent of minimization that is possible will vary from new or amended certification projects and from design to design. Thus the effort to minimize must be determined uniquely for each certification project. Design precautions and techniques such as location, separation, isolation, redundancy, shielding, containment and/or other appropriate considerations should be employed, documented, agreed to by the certifying authority, and placed in the type data file. A discussion of these methods and techniques follows.
(2) Geometric Layout and Safety Analysis. The applicant should prepare a preliminary geometric layout and safety analysis for a minimum rotorburst hazard configuration determination early in the design process and present the results to the certification authority no later than when the initial design is complete. Early contact and coordination with the certifying authority will minimize the need for design modification later in the certification process. The hazard analysis should follow the guidelines indicated in Paragraph 397c(2) in this Advisory Circular and (5)(f) of this appendix. Geometric layouts and analysis should be used to evaluate and identify engine rotorburst hazards to critical systems, powerplants, and structural components from uncontained rotor fragments, and to determine any actions which may be necessary to further minimize the hazard. Calculated geometric risk quantities may be used in accordance with Paragraph (d) following, to define the rotorcraft configuration with the minimum physical rotorburst hazard.
b. Engine and APU Failure Model. The safety analysis should be made using the following engine and APU failure model, unless for the particular engine/APU type concerned, relevant service experience, design data, test results or other evidence justify the use of a different model. In particular, a suitable failure model may be provided by the engine/APU manufacturer. This may show that one or more of the considerations below do not need to be addressed.
(1) Single One-Third Disc Fragment. It should be assumed that the one-third disc fragment has the maximum dimension corresponding to one-third of the disc with one-third blade height and a fragment spread angle of +3°. Where energy Page А3- 3
АС 29-2B 7/30/97 Appendix 3 considerations are relevant, the mass should be assumed to be one-third of the bladed disc mass and its energy--the translational energy (i.e., neglecting rotational energy) of the sector (See Figure АPX3-2).
(2) Intermediate Fragments. It should be assumed that the intermediate fragment has a maximum dimension corresponding to one third or the disc radius with one-third blade height and a fragment spread angle of t5°. Where energy considerations are relevant, the mass should be assumed to be 1/30th of the bladed disc mass and its energy--the translational energy (neglecting rotational energy) of the piece traveling at rim speed (See Figure APX3-3).
(3) Alternative Engine Failure Model. For the purpose of the analysis, as an alternative to the engine failure model of sections (1) and (2) above, the use of a single one-third piece of disc having a fragment spread angle of t5° would be acceptable, provided that the objectives of the analysis are satisfied.
(4) Small Fragments. It should be assumed that small fragments have a maximum dimension corresponding to the tip half of the blade airfoil and a fragment spread angle of t15°. Where energy considerations are relevant, the mass should be assumed to be corresponding to the above fragment dimensions and the energy is the translational energy (neglecting rotational energy) of the fragment traveling at the speed of its CG location. The effects of multiple small fragments should be considered during this assessment.
(5) Critical Engine Speed. Where energy considerations are relevant, the uncontained rotor event should be assumed to occur at the engine shaft speed for the maximum rating appropriate to the flight phase (exclusive of OEI ratings), unless the most probable mode of failure would be expected to result in the engine rotor reaching a red line speed or a design burst speed. For APU's, use the maximum rating appropriate to the flight phase or the speed resulting from a failure of any one of the normal engine control systems.
(6) APU Failure Model. Service experience has shown that some APU rotor failures produced fragments having significant energy to have been expelled through the APU tailpipe. For the analysis, the applicable APU service history and test results should be considered in addition to the failure model as discussed in Paragraph 5(b) above for certification of APU installations near critical items. In addition, the APU installer needs to address the rotorcraft hazard associated with APU debris exiting the tailpipe. Applicable service history or test results provided by the APU manufacturer may be used to define the tailpipe debris size, mass, and energy. The uncontained APU rotor failure model is dependent upon the design/analysis, test results and service experience.
(A) For APU's in which rotor integrity and blade containment have been demonstrated in accordance with TSO-C77a/JAR APU, i.e., without specific Page A3-4
Appendix 3 containment testing, paragraphs 5(b)(1), 5(b)(2), and 5(b)(4) or Paragraph 5(b)(3) and 5(b)(4) apply. If shielding of critical airframe components is proposed, the energy level that should be considered is that of the tri-hub failure released at the critical speed as defined in Paragraph 5(b)(5). The shield and airframe mounting points) should be shown to be effective at containing both primary and secondary debris at angles specified by the failure model.
(B) For APU rotor stages qualified as contained in accordance with the TSO, an objective review of the APU location should be made to ensure the hazard is minimized in the event of an uncontained APU rotor failure. Historical data shows that in-service uncontained failures have occurred on APU rotor stages qualified as contained per the TSO. These failure modes have included bi-hub and overspeed failure resulting in some fragments missing the containment ring. In order to address these hazards, the installer should use the small fragment failure model, or substantiated in-service data supplied by the APU manufacturer. Analytical substantiation for the shielding system if proposed is acceptable for showing compliance.
c. Engine/APU Rotorburst Data. The engine or APU manufacturer should provide the required engine data to accomplish the evaluation and analysis necessary to minimize the rotorburst hazard such as:
(1) Engine failure model (range of fragment sizes, spread angles and energy).
(2) Engine rotorburst probability assessment.
(3) List of components constituting the rotors.
d. Fragment Impact Risks. FAA/AUTHORITY research and development studies have shown that, for rotorcraft conventional configurations (one main rotor and one tail rotor), the main and tail rotorblades have minimal risks from a rotorburst, and thus, they require no special protection. However, unique main and tail rotor blade configurations should be carefully reviewed. Certain zones of the tail rotor drive shaft and other critical parts which may be necessary for continued safe flight and landing may not have natural, minimal risk from uncontained rotor fragments.
e. Engine Service History/Design. For the purpose of a gross assessment of the vulnerability of the rotorcraft to an uncontained rotorburst, it must be taken that an uncontained engine rotor failure (burst) will occur. However, in determining the overall risk to the rotorcraft, engine service history and engine design features should be included in showing compliance with § 29.903 to minimize the hazard from uncontained rotor failures. This is extremely important since the engine design and/or the service history may provide valuable information in assessing the potential for a rotorburst occurring and this should be considered in the overall safety analysis.
Page A3- 5
Appendix 3 Information contained in the recent SAE studies (see Paragraph (3)(a) should be considered in this evaluation.
f. Certification Data File. A report, including all geometric layouts, that details all the aspects of minimizing the engine rotorburst hazards to the rotorcraft should be prepared by the applicant and submitted to the certification authority. Items which should be included in this report are the identification of all hazardous failures that could result from engine rotor failure strikes and their consequences (i.e., an FMEA or equivalent analysis) and the design precautions and features taken to minimize the identified hazards that could result from rotor failure fragment strikes. Thus an analysis that lists all the critical components; quantifies and ranks their associated rotorburst hazard; and clearly shows the minimization of that quantified, ranked hazard to the "maximum practicable extent" should be generated and agreed upon during certification. Critical components should all be identified and their rotorburst hazard quantified, ranked, and minimized where necessary. Design features in which the design precautions of this guidance material are not accomplished should be identified along with the alternate means used to minimize the hazard. To adequately address minimizing the hazards, all rotorcraft design disciplines should be involved in the applicant's compliance efforts and report preparation.
6. DESIGN CONSIDERATIONS. Practical design precautions should be used to minimize the damage that can be caused by uncontained engine and APU rotor debris.
The following design considerations are recommended:
a. Consider the location of the engine and APU rotors relative to critical components, or areas of the rotorcraft such as:
(1) Opposite Engine - Protection of the opposite engine from damage from 1/3 disc rotor fragments may not be feasible. Protection of the opposite engine from other fragments may be provided by locating critical components, such as engine accessories essential for proper engine operation (e.g. high pressure fuel lines, engine controls and wiring, etc.), in areas where inherent shielding is provided by the fuselage, engine, or other structure.
(2) Engine Controls - Controls for the remaining engine(s) that pass through the uncontained engine failure zone should be separated/protected to the maximum extent practicable.
(3) Primary Structure of the Fuselage.
(4) Flight Crew - The flight crew is considered a critical component.
(5) Fuel system components, piping and tanks, including fuel tank access panels (NOTE: Spilled fuel into the engine or APU compartments, on engine cases or on other critical components or areas could create a fire hazard.)
Page A3-6