Easy Access Rules for Large Rotorcraft (CS-29)

ED Decision 2023/001/R

1Introduction

(a)Accidents most often result from a sequence or combination of different errors and safety-related events (e.g. equipment failures and weather conditions). Analyses show that the design of the cockpit and other systems can influence the crew’s task performance and the occurrence and effects of some crew member errors.

(b)Crew members make a positive contribution to the safety of the aviation system because of their ability to continuously assess changing conditions and situations, analyse potential actions, and make reasoned decisions. However, even well-trained, qualified, healthy, alert crew members make errors. Some of these errors may be induced or influenced by the designs of the systems and their crew interfaces, even with those that are carefully designed. Most of these errors have no significant safety effects, or are detected and mitigated in the normal course of events. However, some of them may lead or contribute to the occurrence of unsafe conditions. Accident analyses have identified crew member performance and errors as recurrent factors in the majority of accidents involving rotorcraft.

(c)Some current requirements are intended to improve safety by requiring the cockpit and its equipment to be designed with certain capabilities and characteristics. The approval of cockpit systems with respect to design-related crew member error has typically been addressed by referring to system-specific or general applicability requirements, such as CS 29.1301(a), CS 29.771(a), and CS 29.1523. However, little or no guidance exists to show how the applicant may address potential crew member limitations and errors. That is why CS 29.1302 and this guidance material have been developed.

(d)CS 29.1302 was developed to provide a basis for addressing the design-related aspects of the avoidance and management of crew member errors by taking the following approach.

(i)Firstly, by providing means to address the design characteristics that are known to reduce or avoid crew member error and that address crew member capabilities and limitations. CS 29.1302(a) to (c) are intended to reduce the design contribution to such errors by ensuring that the information and controls needed by the crew members to perform the tasks associated with the intended function of installed equipment are provided, and that they are provided in a usable form.

In addition, operationally relevant system behaviour must be understandable, predictable, and supportive of the crew’s tasks. Guidance is provided in this paragraph on the avoidance of design-induced crew member errors.

(ii)Secondly, CS 29.1302(d) addresses the fact that since crew member errors will occur, even with a well trained and proficient crew operating well-designed systems, the design must support the management of those errors to avoid any safety consequences. Paragraph 5.7 below on crew member error management provides the relevant guidance.

(e)EASA would like to bring the applicants’ attention to the fact that the implementation of the CS 29.1302 process may require up to several years, depending on the characteristics of the project. However, STCs may require much less time.

2CS 29.1302: applicability and explanatory material

(a)CS-29 contains certification specifications for the design of cockpit equipment that is system specific (refer to AMC 29.1302, Table 1, in paragraph 2), generally applicable (e.g. CS 29.1301(a), CS 29.1309(c), CS 29.771(a)), and establishes minimum crew requirements (e.g. CS 29.1523). CS 29.1302 complements the generally applicable requirements by adding more explicit objectives for the design attributes related to the avoidance and management of crew member errors. Other ways to avoid and manage crew member errors are regulated through the requirements governing the licensing and qualifications of crew members and rotorcraft operations. Taken together, these complementary approaches provide an adequate level of safety.

(b)The complementary approach is important. It is based upon the recognition that equipment design, training/licensing/qualifications and operations/procedures each provide safety contributions to risk mitigation. An appropriate balance is needed between them. There have been cases in the past where design characteristics known to contribute to crew member errors were accepted based upon the rationale that training or procedures would mitigate that risk. We now know that this can often be an inappropriate approach. Similarly, due to unintended consequences, it would not be appropriate to require equipment design to provide total risk mitigation.

(c)A proper balance is needed between certification specifications in CS-29 and the requirements for training/licensing/qualifications and operations/procedures. CS 29.1302 and this GM were developed with the intent of achieving that appropriate balance.

(1)Introduction. The introductory sentence of CS 29.1302 states that ‘this paragraph applies to installed systems and equipment intended to be used by the crew members when operating the rotorcraft from their normal seating positions in the cockpit or their operating positions in the cabin’.

(i)‘Intended to be used by the crew members when operating the rotorcraft from their normal seating positions in the cockpit or their operating positions in the cabin’ means that the intended function of the installed equipment includes its use by the crew members when operating the rotorcraft. An example of such installed equipment would be a display that provides information enabling the crew to navigate. The term ‘crew members’ is intended to include any or all individuals comprising the minimum crew as determined for compliance with CS 29.1523. The phrase ‘from their normal seating positions in the cockpit’ means that the crew members are seated at their normal duty stations for operating the rotorcraft.

(ii)The phrase ‘from their normal seating positions in the cockpit or their operating positions in the cabin’ means that the crew members are positioned at their normal duty stations in the cabin. These phrases are intended to limit the scope of this requirement so that it does not address the systems or equipment that are/is not used by the crew members while performing their duties in operating the rotorcraft in normal, abnormal/malfunction and emergency conditions. For example, this paragraph is not intended to apply to design items such as certain circuit breakers or maintenance controls intended for use by the maintenance crew (or by the crew when not operating the rotorcraft).

(iii)The phrase ‘The installed systems and equipment must be shown […]’ in the first paragraph means that the applicant must provide sufficient evidence to support compliance determinations for each of the CS 29.1302 objectives. This is not intended to require a demonstration of compliance beyond that required by point 21.A.21(a) of Part 21. Accordingly, for simple design items or items similar to previously approved equipment and installations, the demonstrations, assessments or data needed to demonstrate compliance with CS 29.1302 are not expected to entail more extensive or onerous efforts than are necessary to demonstrate compliance with the previous requirements.

(iv)The phrase ‘individually and in combination with other such equipment’ means that the objectives of this paragraph must be met when equipment is installed in the cockpit with other equipment. The installed equipment must not prevent other equipment from complying with these objectives. For example, applicants must not design a display so that the information it provides is inconsistent or is in conflict with information provided from other installed equipment.

(v)In addition, this paragraph presumes a qualified crew member that is trained to use the installed equipment. This means that the design must meet these objectives for crew members who are allowed to fly the rotorcraft by meeting the qualification requirements of the operating rules. If the applicant seeks a type design or supplemental type design approval before a training programme is accepted, the applicant should document any novel, complex or highly integrated design items and assumptions made during the design phase that have the potential to affect the training time or the crew member procedures. The certification specification and associated material are written assuming that either these design items and assumptions or the knowledge of a training programme (proposed or in the process of being developed) will be coordinated with the appropriate operational approval organisation when assessing the adequacy of the design.

(vi)The objective for the equipment to be designed so that the crew members can safely perform their tasks associated with the intended function of the equipment applies in normal, abnormal/malfunction and emergency conditions. The tasks intended to be performed under all the above conditions are generally those prescribed by the crew member procedures. The phrase ‘safely perform their tasks’ is intended to describe one of the safety objectives of this certification specification. The objective is for the equipment design to enable the crew members to perform their tasks with sufficient accuracy and in a timely manner, without unduly interfering with their other required tasks. The phrase ‘tasks associated with its intended function’ is intended to characterise either the tasks required to operate the equipment or the tasks for which the intended function of the equipment provides support.

(2)CS 29.1302(a) requires the applicant to install the appropriate controls and provide the necessary information for any cockpit equipment identified in the first paragraph of CS 29.1302. The controls and the information displays must be sufficient to allow the crew members to accomplish their tasks. Although this may seem obvious, this objective is included because a review of CS-29 on the subject of HFs revealed that a specific objective for cockpit controls and information to meet the crew member needs is necessary. This objective is not reflected in other parts of the rules, so it is important to be explicit.

(3)CS 29.1302(b) addresses the objective for cockpit controls and information that are/is necessary and appropriate for the crew members to accomplish their tasks, as determined in (a) above. The intent is to ensure that the design of the controls and information devices makes them usable by the crew members. This subparagraph seeks to reduce design induced crew member errors by imposing design objectives for cockpit information presentation and controls. Subparagraphs (1) through (3) specify these design objectives. The design objectives for information and controls are necessary to:

(i)properly support the crew members in planning their tasks;

(ii)make available to the crew members appropriate, effective means to carry out planned actions; and

(iii)enable the crew members to have appropriate feedback information about the effects of their actions on the rotorcraft.

(4)CS 29.1302(b)(1) specifically requires controls and information to be designed in a clear and unambiguous form, at a resolution and precision appropriate to the task.

(i)As applied to information, ‘clear and unambiguous’ means that it can be perceived correctly (is legible) and can be comprehended in the context of the crew member tasks associated with the intended functions of the equipment, such that the crew members can perform all the associated tasks.

(ii)For controls, the objective for ‘clear and unambiguous’ presentation means that the crew members must be able to use them appropriately to achieve the intended functions of the equipment. The general intent is to foster the design of equipment controls whose operation is intuitive, consistent with the effects on the parameters or states that they affect, and compatible with the operation of the other controls in the cockpit.

(iii)29.1302(b)(1) also requires the information or control to be provided, or to operate, at a level of detail and accuracy appropriate for accomplishing the task. Insufficient resolution or precision would mean the crew members could not perform the task adequately. Conversely, excessive resolution has the potential to make a task too difficult because of poor readability or the implication that the task should be accomplished more precisely than is actually necessary.

(5)CS 29.1302(b)(2) requires controls and information to be accessible and usable by the crew members in a manner appropriate to the urgency, frequency, and duration of their tasks. For example, controls that are used more frequently or urgently must be readily accessible, or require fewer steps or actions to perform the task. Less accessible controls may be acceptable if they are needed less frequently or less urgently. Controls that are used less frequently or less urgently should not interfere with those used more urgently or more frequently. Similarly, tasks requiring a longer time for interaction should not interfere with the accessibility to information required for urgent or frequent tasks.

(6)CS 29.1302(b)(3) requires equipment to present information that makes the crew members aware of the effects of their actions on the rotorcraft or systems, if that awareness is required for the safe operation of the rotorcraft. The intent is for the crew members to be aware of the system or rotorcraft states resulting from crew actions, permitting them to detect and correct their own errors. This subparagraph is included because new technology enables new kinds of crew member interfaces that previous objectives did not address. Specific deficiencies of existing objectives in addressing HFs are described below:

(i)CS 29.771(a) addresses this topic for controls, but does not include criteria for the presentation of information;

(ii)CS 29.777(a) addresses controls, but only their location;

(iii)CS 29.777(b) and CS 29.779 address the direction of motion and actuation but do not encompass new types of controls, such as cursor-control devices. These requirements also do not encompass types of control interfaces that can be incorporated into displays via menus, for example, thus affecting their accessibility;

(iv)CS 29.1523 has a different context and purpose (determining the minimum crew), so it does not address these requirements in a sufficiently general way.

(7)CS 29.1302(c) requires installed equipment to be designed so that its behaviour that is operationally relevant to crew member tasks is:

(i)predictable and unambiguous, and

(ii)designed to enable the crew members to intervene in a manner appropriate to the task (and intended function).

Other related considerations are the following:

(iii)Improved cockpit technologies involving integrated and complex information and control systems have increased safety and performance. However, they have also introduced the need to ensure proper interactions between the crew and those systems. In-service experience has shown that some equipment behaviour (especially from automated systems) is excessively complex or dependent upon logical states or mode transitions that are not well understood or expected by the crew members. Such design characteristics can confuse the crew members and have been determined to contribute to incidents and accidents.

(8)CS 29.1302(c)(1) requires the behaviour of a system to be such that a qualified crew member knows what the system is doing and why it is doing it. It requires operationally relevant system behaviour to be ‘predictable and unambiguous’. This means that a crew can retain enough information about what their action or a changing situation will cause the system to do under foreseeable circumstances, so they can operate the system safely.

The behaviour of a system must be unambiguous because the actions of the crew may have different effects on the rotorcraft, depending on its current state or operational circumstances.

(9)CS 29.1302(c)(2) requires the design to be such that the crew members will be able to take some action, or change or alter an input to the system, in a manner appropriate to the task.

(10)CS 29.1302(d) addresses the reality that even well-trained, proficient crews using well designed systems will make errors. It requires the equipment to be designed such in order to enable the crew members to manage such errors. For the purpose of this CS, errors ‘resulting from crew interaction with the equipment’ are those errors that are in some way attributable, or related, to the design of the controls, the behaviour of the equipment, or the information presented. Examples of designs or information that could cause errors are indications and controls that are complex and inconsistent with each other or with other systems on the cockpit. Another example is a procedure that is inconsistent with the design of the equipment. Such errors are considered to be within the scope of this CS and the related AMC.

(i)What is meant by a design which enables the crew members to ‘manage errors’ is that:

(A)the crew members must be able to detect and/or recover from errors resulting from their interaction with the equipment; or

(B)the effects of such crew member errors on the rotorcraft functions or capabilities must be evident to the crew members, and continued safe flight and landing must be possible; or

(C)crew member errors must be prevented by switch guards, interlocks, confirmation actions, or other effective means; or

(D)the effects of errors must be precluded by system logic or redundant, robust, or fault-tolerant system design.

(ii)The objective to manage errors applies to those errors that can be reasonably expected in service from qualified and trained crews. The term ‘reasonably expected in service’ means errors that have occurred in service with similar or comparable equipment. It also means errors that can be predicted to occur based on general experience and knowledge of human performance capabilities and limitations related to the use of the type of controls, information, or system logic being assessed.

(iii)CS 29.1302(d) includes the following statement: ‘This subparagraph does not apply to skill-related errors associated with the manual control of the rotorcraft.’
That statement is intended to exclude errors resulting from the crew’s proficiency in the control of the flight path and attitude with the primary roll, pitch, yaw and thrust controls, and which are related to the design of the flight control systems. These issues are considered to be adequately addressed by the existing certification specifications, such as CS-29 Subpart B and CS 29.671(a). It is not intended that the design should be required to compensate for deficiencies in crew training or experience. This assumes at least the minimum crew requirements for the intended operation, as discussed at the beginning of paragraph 5.1 above.

(iv)This objective is intended to exclude the management of errors resulting from crew member decisions, acts or omissions that are not in good faith. It is intended to avoid imposing requirements on the design to accommodate errors committed with malicious or purely contrary intent. CS 29.1302 is not intended to require applicants to consider errors resulting from acts of violence or threats of violence.

This ‘good faith’ exclusion is also intended to avoid imposing requirements on designs to accommodate errors due to a crew member’s obvious disregard for safety. However, it is recognised that errors committed intentionally may still be in good faith, but could be influenced by the characteristics of the design under certain circumstances. An example would be a poorly designed procedure that is not compatible with the controls or information provided to the crew members.

Imposing requirements without considering their economic feasibility or the commensurate safety benefits should be avoided. Operational practicability should also be addressed, such as the need to avoid introducing error management features into the design that would inappropriately impede crew actions or decisions in normal, abnormal/malfunction and emergency conditions. For example, it is not intended to require so many guards or interlocks on the means to shut down an engine that the crew members would be unable to do this reliably within the available time. Similarly, it is not intended to reduce the authority or means for the crew to intervene or carry out an action when it is their responsibility to do so using their best judgment in good faith.

This subparagraph is included because managing errors (which can be reasonably expected in service) that result from crew member interactions with the equipment is an important safety objective. Even though the scope of applicability of this material is limited to errors for which there is a contribution from or a relationship to the design, CS 29.1302(d) is expected to result in design changes that will contribute to safety. One example, among others, would be the use of ‘undo’ functions in certain designs.

[Amdt 29/9]

[Amdt No: 29/11]

ED Decision 2021/010/R

The compliance matrix developed by the applicant should provide the essential information in order to understand the relationship between the following elements:

—the design items,

—the applicable certification specifications,

—the test objectives,

—the means of compliance, and

—the deliverables.

The two matrices below are provided as examples only. The applicant might present the necessary information through any format that meets the above objectives.

An example with a design item entry:

Another example with a certification specification entry:

[Amdt 29/9]

ED Decision 2003/16/RM

The following are required flight and navigational instruments:

(a)An airspeed indicator. For Category A rotorcraft with VNE less than a speed at which unmistakable pilot cues provide overspeed warning, a maximum allowable airspeed indicator must be provided. If maximum allowable airspeed varies with weight, altitude, temperature, or rpm, the indicator must show that variation.

(b)A sensitive altimeter.

(c)A magnetic direction indicator.

(d)A clock displaying hours, minutes, and seconds with a sweep-second pointer or digital presentation.

(e)A free-air temperature indicator.

(f)A non-tumbling gyroscopic bank and pitch indicator.

(g)A gyroscopic rate-of-turn indicator combined with an integral slip-skid indicator (turn-and-bank indicator) except that only a slip- skid indicator is required on rotorcraft with a third attitude instrument system that:

(1)Is usable through flight attitudes of ± 80° of pitch and ± 120° of roll;

(2)Is powered from a source independent of the electrical generating system;

(3)Continues reliable operation for a minimum of 30 minutes after total failure of the electrical generating system;

(4)Operates independently of any other attitude indicating system;

(5)Is operative without selection after total failure of the electrical generating system;

(6)Is located on the instrument panel in a position acceptable to the Agency that will make it plainly visible to and usable by any pilot at his station; and

(7)Is appropriately lighted during all phases of operation.

(h)A gyroscopic direction indicator.

(i)A rate-of-climb (vertical speed) indicator.

(j)For Category A rotorcraft, a speed warning device when VNE is less than the speed at which unmistakable overspeed warning is provided by other pilot cues. The speed warning device must give effective aural warning (differing distinctly from aural warnings used for other purposes) to the pilots whenever the indicated speed exceeds VNE plus 5.6 km/h (3 knots) and must operate satisfactorily throughout the approved range of altitudes and temperatures.

ED Decision 2018/015/R

This AMC provides further guidance and acceptable means of compliance to supplement FAA AC 29-2C Change 7 AC 29.1303. § 29.1303 which is the EASA acceptable means of compliance, as provided for in AMC 29 General. However, some aspects of the FAA AC are deemed by EASA to be at variance with EASA’s interpretation or its regulatory system. EASA’s interpretation of these aspects is described below. Paragraphs of FAA AC 29.1303. § 29.1303 that are not amended below are considered to be EASA acceptable means of compliance.

a.Explanation

[...]

(2) For rotorcraft, loss of or misleading primary flight information (attitude, altitude, and airspeed) is considered to be a catastrophic failure condition in instrument meteorological conditions. For an attitude instrument to be usable, it should be capable of providing the pilot with reliable references to pitch and roll attitudes throughout the possible rotorcraft angular position and rotational operating ranges so that a pilot can correctly recognise the extent of the unusual or extreme attitude and initiate an appropriate recovery manoeuvre. As indicated previously in paragraph a., an ETSO approval does not ensure compliance with the CS-29 installation requirements, including those requirements in CS 29.1303(g)(1).

(i)The minimum usability requirements for the aircraft attitude systems are defined in CS 29.1303(g)(1). The phrase in CS 29.1303(g)(1) ‘…is usable through +/-80 degrees of pitch and +/-120 degrees of roll’ means that the pilot should be able to quickly and accurately determine the aircraft’s pitch attitudes up to 80 degrees nose up and 80 degrees nose down. The ADI should also allow the pilot to quickly and accurately determine the aircraft’s roll attitude to 120 degrees of left and right roll.

(ii)The minimum usability requirement for the aircraft attitude system defined in CS 29.1303(g)(1) applies to all attitude systems installed in the aircraft. Attitude systems that do not meet the minimum usability requirements can provide misleading information to the pilot.

[Amdt No: 29/6]

ED Decision 2023/001/R

The following are the required powerplant instruments:

(a)For each rotorcraft:

(1)A carburettor air temperature indicator for each reciprocating engine;

(2)A cylinder head temperature indicator for each air-cooled reciprocating engine, and a coolant temperature indicator for each liquid-cooled reciprocating engine;

(3)A fuel quantity indicator for each fuel tank;

(4)A low-fuel warning device for each fuel tank which feeds an engine. This device must:

(i)Provide a warning to the crew when approximately 10 minutes of usable fuel remains in the tank; and

(ii)Be independent of the normal fuel quantity indicating system or be designed and constructed so as to meet the minimum safety objectives compatible with the most severe hazard induced by the combination of any failures of the fuel quantity indicator device and the low-fuel level warning device.

(5)A means to indicate the manifold pressure for each reciprocating engine of the altitude type;

(6)An oil pressure indicator for each pressure-lubricated gearbox;

(7)An oil pressure warning device for each pressure-lubricated gearbox to indicate when the oil pressure falls below a safe value;

(8)An oil quantity indicator for each oil tank and each rotor drive gearbox, if lubricant is self-contained;

(9)An oil temperature indicator for each engine;

(10)An oil temperature warning device to indicate unsafe oil temperatures in each main rotor drive gearbox, including gearboxes necessary for rotor phasing;

(11)A means to indicate the gas temperature for each turbine engine;

(12)A means to indicate the gas producer speed for each turbine engine;

(13)A tachometer for each engine that, if combined with the applicable instrument required by sub-paragraph (a)(14), indicates rotor rpm during autorotation;

(14)At least one tachometer to indicate, as applicable:

(i)The rpm of the single main rotor;

(ii)The common rpm of any main rotors whose speeds cannot vary appreciably with respect to each other; and

(iii)The rpm of each main rotor whose speed can vary appreciably with respect to that of another main rotor;

(15)A free power turbine tachometer for each turbine engine;

(16)A means, for each turbine engine, to indicate power for that engine;

(17)For each turbine engine, an indicator to indicate the functioning of the power plant ice protection system;

(18)An indicator for the fuel filter required by CS 29.997 to indicate the occurrence of contamination of the filter to the degree established in compliance with CS 29.955;

(19)For each turbine engine, a warning means for the oil strainer or filter required by CS 29.1019, if it has no bypass, to warn the pilot of the occurrence of contamination of the strainer or filter before it reaches the capacity established in accordance with CS 29.1019(a)(2);

(20)An indicator to indicate the functioning of any selectable or controllable heater used to prevent ice clogging of fuel system components;

(21)An individual fuel pressure indicator for each engine, unless the fuel system which supplies that engine does not employ any pumps, filters, or other components subject to degradation or failure which may adversely affect fuel pressure at the engine;

(22)A means to indicate to the flight crew the failure of any fuel pump installed to show compliance with CS 29.955;

(23)Warning or caution devices to signal to the flight crew when ferromagnetic particles are detected by the chip detection system required by CS 29.1337(e); and

(24)For auxiliary power units, an individual indicator, warning or caution device, or other means to advise the flight crew that limits are being exceeded, if exceeding these limits can be hazardous, for:

(i)Gas temperature;

(ii)Oil pressure; and

(iii)Rotor speed.

(25)For rotorcraft for which a 30-second/2-minute OEI power rating is requested, a means must be provided to alert the pilot when the engine is at the 30-second and 2-minute OEI power levels, when the event begins, and when the time interval expires.

(26)For each turbine engine utilising 30-second/2-minute OEI power, a device or system must be provided for use by ground personnel which:

(i)Automatically records each usage and duration of power at the 30-second and 2-minute OEI levels;

(ii)Permits retrieval of the recorded data;

(iii)Can be reset only by ground maintenance personnel; and

(iv)Has a means to verify proper operation of the system or device.

(27)For rotorcraft for which a 30-minute power rating is claimed, a means must be provided to alert the pilot when the engines are at the 30-minute power rating levels, when the event begins, when the time interval expires and, if a cumulative limit in one flight exists, when the cumulative time in one flight is reached.

(b)For Category A rotorcraft:

(1)An individual oil pressure indicator for each engine, and either an oil pressure warning for each engine or a master warning device for all engines with means for isolating the individual warning circuit from the master warning device;

(2)An independent fuel pressure warning device for each engine or a master warning device for all engines with provision for isolating the individual warning device from the master warning device;

(3)Fire warning indicators; and

(4)When the OEI Training Mode is prescribed, a means must be provided to indicate to the pilot the simulation of an engine failure, the annunciation of that simulation, and a representation of the OEI power being provided.

(c)For Category B rotorcraft:

(1)An individual oil pressure indicator for each engine; and

(2)Fire warning indicators, when fire detection is required.

[Amdt. No. 29/2]

[Amdt No: 29/10]

[Amdt No: 29/11]

ED Decision 2023/001/R

FUEL QUANTITY INDICATOR AND LOW-FUEL LEVEL WARNING

This AMC provides guidance in the case where the fuel quantity indicator and the low-fuel warning device are not fully independent.

AC 29.1305 provides guidance that supports the use of specific instruments that do not meet the principle of independence (integrated avionics, ECAS, etc.). However, it does not provide guidance regarding the independence between the fuel quantity sensor and the fuel low-level sensor.

The fuel quantity sensor and the fuel low-level sensor should be independent. However, it is considered to be acceptable to place them on the same supporting structure providing that the following design precautions are ensured:

(a)They are electrically independent. Each sensor should be connected to the aircraft systems via a dedicated connector and a dedicated harness;

(b)A test capability is provided for each sensor to preclude an associated latent failure; and

(c)It is demonstrated by tests such as equipment qualification tests, slosh and vibration tests as requested in CS 29.965, analysis (such as safety analysis, particular risk analysis, zonal safety analysis, comparison with a fully independent design), or a combination thereof that no common modes can lead to the most severe hazard determined in CS 29.1305(a)(4)(ii).

[Amdt No: 29/11]

ED Decision 2003/16/RM

The following is required miscellaneous equipment:

(a)An approved seat for each occupant.

(b)A master switch arrangement for electrical circuits other than ignition.

(c)Hand fire extinguishers.

(d)A windshield wiper or equivalent device for each pilot station.

(e)A two-way radio communication system.

ED Decision 2023/001/R

(a)Equipment and systems required to comply with type-certification requirements, airspace requirements or operating rules, or whose improper functioning would lead to a hazard, must be designed and installed so that they perform their intended function throughout the operating and environmental conditions for which the rotorcraft is certified.

(b)The equipment and systems covered by sub-paragraph (a), considered separately and in relation to other systems, must be designed and installed such that:

(1)each catastrophic failure condition is extremely improbable and does not result from a single failure, and for Category A rotorcraft, the occurrence of any failure condition which would prevent the continued safe flight and landing of the rotorcraft is considered as catastrophic;

(2)each hazardous failure condition is extremely remote; and

(3)each major failure condition is remote.

(c)The operation of equipment and systems not covered by sub-paragraph (a) must not cause a hazard to the rotorcraft or its occupants throughout the operating and environmental conditions for which the rotorcraft is certified.

(d)Information concerning an unsafe system operating condition must be provided in a timely manner to the flight crew member responsible for taking corrective action. The information must be clear enough to avoid likely flight crew member errors.

[Amdt 29/4]

[Amdt No: 29/11]

ED Decision 2023/001/R

As defined in AMC 29.1, the AMC to CS-29 consists of FAA AC 29-2C Change 7, dated 4 February 2016. AMC 29.1309 provides further guidance and acceptable means of compliance to supplement FAA AC 29-2C Change 7 § AC 29.1309. As such, it should be used in conjunction with FAA AC 29-2C Change 7, but should take precedence over it, where stipulated, in the demonstration of compliance.

Single failure and common-cause considerations

According to CS 29.1309(b)(1), a catastrophic failure condition must not result from the failure of a single component, part, or element of a system. Failure containment should be provided by the system design to limit the propagation of the effects of any single failure to preclude catastrophic failure conditions. In addition, there must be no common-cause failure which could affect both the single component, part, or element, and its failure containment provisions. A single failure includes any set of failures, which cannot be shown to be independent from each other. Common-cause failures (including common-mode failures) and cascading failures should be evaluated as dependent failures from the point of the root cause or the initiator. Errors in development, manufacturing, installation, and maintenance can result in common-cause failures (including common-mode failures) and cascading failures. They should, therefore, be assessed and mitigated in the frame of the common-cause and cascading failures consideration.

Sources of common-cause and cascading failures include development, manufacturing, installation, maintenance, shared resource, event outside the system(s) concerned, etc. SAE ARP4761 describes types of common-cause analyses, which may be conducted, to ensure that independence is maintained (e.g. particular risk analyses, zonal safety analyses, common-mode analyses).

While single failures should normally be assumed to occur, experienced engineering judgement and relevant service history may show that a catastrophic failure condition by a single-failure mode is not a practical possibility. The logic and rationale used in the assessment should be straightforward and obvious that the failure mode simply would not occur unless it is associated with an unrelated failure condition that would, in itself, result in a catastrophic failure condition.

By detecting the presence of, and thereby limiting the exposure time to significant latent failures that would, in combination with one or more other specific failures or events identified by safety analysis, result in a hazardous or catastrophic failure condition, periodic maintenance or flight crew checks may be used to help demonstrate compliance with CS 29.1309(b).

Development assurance process

Any analysis necessary to show compliance with CS 29.1309 (a) and (b) should consider the possibility of development errors and should focus on minimising the likelihood of those errors.

Errors made during the development of systems have traditionally been detected and corrected by exhaustive tests conducted on the system and its components, by direct inspection, and by other direct verification methods capable of completely characterising the performance of the system.

These tests and direct verification methods may be appropriate for systems containing non-complex items (i.e. items that are fully assured by a combination of testing and analysis) that perform a limited number of functions and that are not highly integrated with other rotorcraft systems. For more complex or integrated systems, exhaustive testing may either be impossible because not all system states can be determined or impractical because of the number of tests that must be accomplished. For these types of systems, compliance may be demonstrated using development assurance.

(a)System development assurance

The applicability of system development assurance should also be considered for modifications to previously certificated aircraft.

ED-79A/ARP4754A is recognised as providing acceptable guidelines for establishing a development assurance process from aircraft and systems levels down to the level where software/airborne electronic hardware (AEH) development assurance is applied.

The extent of application of ED-79A/ARP4754A to substantiate development assurance activities depends on the complexity of the systems and on their level of interaction with other systems.

(b)Software development assurance

This AMC recognises AMC 20-115 as an accepted means of compliance with CS 29.1309 (a), (b) and (c).

(c)AEH development assurance

This AMC recognises AMC 20-152 as an acceptable means of compliance with the requirements in CS 29.1309 (a), (b) and (c).

(d)Open problem report management

This AMC recognises AMC 20-189 as an acceptable means of compliance for establishing an open problem report management process for the system, software and AEH domains.

Integrated Modular Avionics (IMA)

This AMC recognises AMC 20-170 as an acceptable means of compliance for development and integration of IMA.

[Amdt No: 29/11]

ED Decision 2023/001/R

For Category A rotorcraft, each installation whose functioning is required to comply with type-certification requirements, airspace requirements or operating rules, and which requires a power supply, is an ‘essential load’ on the power supply. The power sources and the system must be able to supply the following power loads in probable operating combinations and for probable durations:

(a)Loads connected to the system with the system functioning normally.

(b)Essential loads, after failure of any one prime mover, or one power source.

(c)Essential loads, after failure of:

(1)any one engine, on rotorcraft with two engines; and

(2)any two engines, on rotorcraft with three or more engines.

[Amdt No: 29/11]

ED Decision 2023/001/R

In determining compliance with sub-paragraphs (b) and (c) of CS 29.1310, the power loads may be assumed to be reduced under a monitoring procedure consistent with safety in the kinds of operations authorised. Loads not required for controlled flight need not be considered for the two-engine inoperative condition on rotorcraft with three or more engines.

[Amdt No: 29/11]

ED Decision 2016/025/R

(a)Each electrical and electronic system that performs a function whose failure would prevent the continued safe flight and landing of the rotorcraft, must be designed and installed in a way that:

(1)the function is not adversely affected during and after the time the rotorcraft’s exposure to lightning; and

(2)the system automatically recovers normal operation of that function, in a timely manner, after the rotorcraft’s exposure to lightning, unless the system’s recovery conflicts with other operational or functional requirements of the system that would prevent continued safe flight and landing of the rotorcraft.

(b)For rotorcraft approved for instrument flight rules operation, each electrical and electronic system that performs a function whose failure would reduce the capability of the rotorcraft or the ability of the flight crew to respond to an adverse operating condition, must be designed and installed in a way that the function recovers normal operation in a timely manner after the rotorcraft’s exposure to lightning.

[Amdt 29/4]

ED Decision 2016/025/R

(a)Each electrical and electronic system that performs a function whose failure would prevent the continued safe flight and landing of the rotorcraft, must be designed and installed in a way that:

(1)the function is not adversely affected during and after the time the rotorcraft’s exposure to HIRF environment I as described in Appendix E;

(2)the system automatically recovers normal operation of that function, in a timely manner after the rotorcraft’s exposure to a HIRF environment I as described in Appendix E unless the system’s recovery conflicts with other operational or functional requirements of the system that would prevent continued safe flight and landing of the rotorcraft;

(3)the system is not adversely affected during and after the time the rotorcraft’s exposure to a HIRF environment II as described in Appendix E; and

(4)each function required during operation under visual flight rules is not adversely affected during and after the time the rotorcraft’s exposure to a HIRF environment III as described in Appendix E.

(b)Each electrical and electronic system that performs a function whose failure would significantly reduce the capability of the rotorcraft or the ability of the flight crew to respond to an adverse operating condition must be designed and installed in a way that the system is not adversely affected when the equipment providing the function is exposed to equipment HIRF test level 1 or 2, as described in Appendix E.

(c)Each electrical and electronic system that performs a function whose failure would reduce the capability of the rotorcraft or the ability of the flight crew to respond to an adverse operating condition must be designed and installed in a way that the system is not adversely affected when the equipment providing the function is exposed to equipment HIRF test level 3, as described in Appendix E.

[Amdt 29/4]

ED Decision 2016/025/R

This Appendix specifies the HIRF environments and equipment HIRF test levels for electrical and electronic systems under CS 29.1317. The field strength values for the HIRF environments and equipment HIRF test levels are expressed in root-mean-square units measured during the peak of the modulation cycle.

(a)HIRF environment I is specified in the following table:

Table I — HIRF Environment I

In this table, the higher field strength applies to the frequency band edges.

(b)HIRF environment II is specified in the following table:

Table II — HIRF Environment II

In this table, the higher field strength applies to the frequency band edges.

(c)HIRF environment III is specified in the following table:

Table III — HIRF Environment III

In this table, the higher field strength applies at the frequency band edges.

(d)Equipment HIRF Test Level 1

(1)From 10 kilohertz (kHz) to 400 megahertz (MHz), use conducted susceptibility tests with continuous wave (CW) and 1 kHz square wave modulation with 90 % depth or greater. The conducted susceptibility current must start at a minimum of 0.6 milliamperes (mA) at 10 kHz, increasing 20 decibels (dB) per frequency decade to a minimum of 30 mA at 500 kHz.

(2)From 500 kHz to 40 MHz, the conducted susceptibility current must be at least 30 mA.

(3)From 40 MHz to 400 MHz, use conducted susceptibility tests, starting at a minimum of 30 mA at 40 MHz, decreasing 20 dB per frequency decade to a minimum of 3 mA at 400 MHz.

(4)From 100 MHz to 400 MHz, use radiated susceptibility tests at a minimum of 20 volts per meter (V/m) peak with CW and 1 kHz square wave modulation with 90 % depth or greater.

(5)From 400 MHz to 8 gigahertz (GHz), use radiated susceptibility tests at a minimum of 150 V/m peak with pulse modulation of 4 % duty cycle with a 1 kHz pulse repetition frequency. This signal must be switched on and off at a rate of 1 Hz with a duty cycle of 50 %.

(e)Equipment HIRF Test Level 2. Equipment HIRF Test Level 2 is HIRF environment II in Table II of this Appendix reduced by acceptable aircraft transfer function and attenuation curves. Testing must cover the frequency band of 10 kHz to 8 GHz.

(f)Equipment HIRF Test Level 3

(1)From 10 kHz to 400 MHz, use conducted susceptibility tests, starting at a minimum of 0.15 mA at 10 kHz, increasing 20 dB per frequency decade to a minimum of 7.5 mA at 500 kHz.

(2)From 500 kHz to 40 MHz, use conducted susceptibility tests at a minimum of 7.5 mA.

(3)From 40 MHz to 400 MHz, use conducted susceptibility tests, starting at a minimum of 7.5 mA at 40 MHz, decreasing 20 dB per frequency decade to a minimum of 0.75 mA at 400 MHz.

(4)From 100 MHz to 8 GHz, use radiated susceptibility tests at a minimum of 5 V/m.

[Amdt 29/4]

ED Decision 2020/006/R

(a)Rotorcraft equipment, systems and networks, considered separately and in relation to other systems, must be protected from intentional unauthorised electronic interactions (IUEIs) that may result in adverse effects on the safety of the rotorcraft. Protection must be ensured by showing that the security risks have been identified, assessed and mitigated as necessary.

(b)When required by paragraph (a), the applicant must make procedures and Instructions for Continued Airworthiness (ICA) available that ensure that the security protections of the rotorcraft equipment, systems and networks are maintained.

[Amdt No: 29/8]

ED Decision 2023/001/R

In showing compliance with CS 29.1319, the applicant may consider AMC 20-42, which provides acceptable means, guidance and methods to perform security risk assessments and mitigation for aircraft information systems.

The term ‘adverse effects on the safety of the rotorcraft’ should be understood in the context of information security as catastrophic or hazardous.

The term ‘mitigated as necessary’ clarifies that the applicant has the discretion to establish appropriate means of mitigation against security risks.

[Amdt No: 29/8]

[Amdt No: 29/11]

INSTRUMENTS: INSTALLATION

ED Decision 2003/16/RM

(a)Each flight, navigation, and powerplant instrument for use by any pilot must be easily visible to him from his station with the minimum practicable deviation from his normal position and line of vision when he is looking forward along the flight path.

(b)Each instrument necessary for safe operation, including the airspeed indicator, gyroscopic direction indicator, gyroscopic bank-and-pitch indicator, slip-skid indicator, altimeter, rate-of-climb indicator, rotor tachometers, and the indicator most representative of engine power, must be grouped and centred as nearly as practicable about the vertical plane of the pilot’s forward vision. In addition, for rotorcraft approved for IFR flight:

(1)The instrument that most effectively indicates attitude must be on the panel in the top centre position;

(2)The instrument that most effectively indicates direction of flight must be adjacent to and directly below the attitude instrument;

(3)The instrument that most effectively indicates airspeed must be adjacent to and to the left of the attitude instrument; and

(4)The instrument that most effectively indicates altitude or is most frequently utilised in control of altitude must be adjacent to and to the right of the attitude instrument.

(c)Other required powerplant instruments must be closely grouped on the instrument panel.

(d)Identical powerplant instruments for the engines must be located so as to prevent any confusion as to which engine each instrument relates.

(e)Each powerplant instrument vital to safe operation must be plainly visible to appropriate crew members.

(f)Instrument panel vibration may not damage, or impair the readability or accuracy of, any instrument.

(g)If a visual indicator is provided to indicate malfunction of an instrument, it must be effective under all probable cockpit lighting conditions.

ED Decision 2003/16/RM

If warning, caution or advisory lights are installed in the cockpit they must, unless otherwise approved by the Agency, be:

(a)Red, for warning lights (lights indicating a hazard which may require immediate corrective action);

(b)Amber, for caution lights (lights indicating the possible need for future corrective action);

(c)Green, for safe operation lights; and

(d)Any other colour, including white, for lights not described in sub-paragraphs (a) to (c), provided the colour differs sufficiently from the colours prescribed in sub-paragraphs (a) to (c) to avoid possible confusion.

ED Decision 2003/16/RM

For each airspeed indicating system, the following apply:

(a)Each airspeed indicating instrument must be calibrated to indicate true airspeed (at sea-level with a standard atmosphere) with a minimum practicable instrument calibration error when the corresponding pitot and static pressures are applied.

(b)Each system must be calibrated to determine system error excluding airspeed instrument error. This calibration must be determined:

(1)In level flight at speeds of 37 km/h (20 knots) and greater, and over an appropriate range of speeds for flight conditions of climb and autorotation; and

(2)During take-off, with repeatable and readable indications that ensure:

(i)Consistent realisation of the field lengths specified in the Rotorcraft Flight Manual; and

(ii)Avoidance of the critical areas of the height-velocity envelope as established under CS 29.87.

(c)For Category A rotorcraft:

(1)The indication must allow consistent definition of the take-off decision point; and

(2)The system error, excluding the airspeed instrument calibration error, may not exceed –

(i)3% or 9.3 km/h (5 knots), whichever is greater, in level flight at speeds above 80% of take-off safety speed; and

(ii)19 km/h (10 knots) in climb at speeds from 19 km/h (10 knots) below take-off safety speed to 19 km/h (10 knots) above VY.

(d)For Category B rotorcraft, the system error, excluding the airspeed instrument calibration error, may not exceed 3% or 9.3 km/h (5 knots), whichever is greater, in level flight at speeds above 80% of the climbout speed attained at 15 m (50 ft) when complying with CS 29.63.

(e)Each system must be arranged, so far as practicable, to prevent malfunction or serious error due to the entry of moisture, dirt, or other substances.

(f)Each system must have a heated pitot tube or an equivalent means of preventing malfunction due to icing.

ED Decision 2003/16/RM

(a)Each instrument with static air case connections must be vented to the outside atmosphere through an appropriate piping system.

(b)Each vent must be located where its orifices are least affected by airflow variation, moisture, or other foreign matter.

(c)Each static pressure port must be designed and located in such manner that the correlation between air pressure in the static pressure system and true ambient atmospheric static pressure is not altered when the rotorcraft encounters icing conditions. An anti-icing means or an alternate source of static pressure may be used in showing compliance with this requirement.

If the reading of the altimeter, when on the alternate static pressure system, differs from the reading of the altimeter when on the primary static system by more than 15 m (50 ft), a correction card must be provided for the alternate static system.

(d)Except for the vent into the atmosphere, each system must be airtight.

(e)Each pressure altimeter must be approved and calibrated to indicate pressure altitude in a standard atmosphere with a minimum practicable calibration error when the corresponding static pressures are applied.

(f)Each system must be designed and installed so that an error in indicated pressure altitude, at sea-level, with a standard atmosphere, excluding instrument calibration error, does not result in an error of more than ±9 m (±30 ft) per 185 km/h (100 knots) speed. However, the error need not be less than ±9 m (±30 ft).

(g)Except as provided in sub-paragraph (h) if the static pressure system incorporates both a primary and an alternate static pressure source, the means for selecting one or the other source must be designed so that:

(1)When either source is selected, the other is blocked off; and

(2)Both sources cannot be blocked off simultaneously.

(h)For unpressurised rotorcraft, sub-paragraph (g)(1) does not apply if it can be demonstrated that the static pressure system calibration, when either static pressure source is selected, is not changed by the other static pressure source being open or blocked.

ED Decision 2003/16/RM

(a)Each magnetic direction indicator must be installed so that its accuracy is not excessively affected by the rotorcraft’s vibration or magnetic fields.

(b)The compensated installation may not have a deviation, in level flight, greater than 10° on any heading.

ED Decision 2003/16/RM

(a)Each automatic pilot system must be designed so that the automatic pilot can:

(1)Be sufficiently overpowered by one pilot to allow control of the rotorcraft; and

(2)Be readily and positively disengaged by each pilot to prevent it from interfering with the control of the rotorcraft.

(b)Unless there is automatic synchronisation, each system must have a means to readily indicate to the pilot the alignment of the actuating device in relation to the control system it operates.

(c)Each manually operated control for the system’s operation must be readily accessible to the pilots.

(d)The system must be designed and adjusted so that, within the range of adjustment available to the pilot, it cannot produce hazardous loads on the rotorcraft, or create hazardous deviations in the flight path, under any flight condition appropriate to its use, either during normal operation or in the event of a malfunction, assuming that corrective action begins within a reasonable period of time.

(e)If the automatic pilot integrates signals from auxiliary controls or furnishes signals for operation of other equipment, there must be positive interlocks and sequencing of engagement to prevent improper operation.

(f)If the automatic pilot system can be coupled to airborne navigation equipment, means must be provided to indicate to the pilots the current mode of operation. Selector switch position is not acceptable as a means of indication.

ED Decision 2003/16/RM

For Category A rotorcraft:

(a)Each required flight instrument using a power supply must have –

(1)Two independent sources of power;

(2)A means of selecting either power source; and

(3)A visual means integral with each instrument to indicate when the power adequate to sustain proper instrument performance is not being supplied. The power must be measured at or near the point where it enters the instrument. For electrical instruments, the power is considered to be adequate when the voltage is within approved limits; and

(b)The installation and power supply system must be such that failure of any flight instrument connected to one source, or of the energy supply from one source, or a fault in any part of the power distribution system does not interfere with the proper supply of energy from any other source.

ED Decision 2003/16/RM

For systems that operate the required flight instruments which are located at each pilot’s station, the following apply:

(a)Only the required flight instruments for the first pilot may be connected to that operating system.

(b)The equipment, systems, and installations must be designed so that one display of the information essential to the safety of flight which is provided by the flight instruments remains available to a pilot, without additional crew member action, after any single failure or combination of failures that are not shown to be extremely improbable.

(c)Additional instruments, systems, or equipment may not be connected to the operating system for a second pilot unless provisions are made to ensure the continued normal functioning of the required flight instruments in the event of any malfunction of the additional instruments, systems, or equipment which is not shown to be extremely improbable.

ED Decision 2003/16/RM

If a flight director system is installed, means must be provided to indicate to the flight crew its current mode of operation. Selector switch position is not acceptable as a means of indication.

ED Decision 2021/016/R

(a)Instruments and instrument lines

(1)Each powerplant and auxiliary power unit instrument line must meet the requirements of CS 29.993 and 29.1183.

(2)Each line carrying flammable fluids under pressure must:

(i)Have restricting orifices or other safety devices at the source of pressure to prevent the escape of excessive fluid if the line fails; and

(ii)Be installed and located so that the escape of fluids would not create a hazard.

(3)Each power plant and auxiliary power unit instrument that utilises flammable fluids must be installed and located so that the escape of fluid would not create a hazard.

(b)Fuel quantity indicator. There must be means to indicate to the flight-crew members the quantity, in US-gallons or equivalent units, of usable fuel in each tank during flight. In addition:

(1)Each fuel quantity indicator must be calibrated to read ‘zero’ during level flight when the quantity of fuel remaining in the tank is equal to the unusable fuel supply determined under CS 29.959;

(2)When two or more tanks are closely interconnected by a gravity feed system and vented, and when it is impossible to feed from each tank separately, at least one fuel quantity indicator must be installed;

(3)Tanks with interconnected outlets and airspaces may be treated as one tank and need not have separate indicators; and

(4)Each exposed sight gauge used as a fuel quantity indicator must be protected against damage.

(c)Fuel flowmeter system. If a fuel flowmeter system is installed, each metering component must have a means for bypassing the fuel supply if malfunction of that component severely restricts fuel flow.

(d)Oil quantity indicator. There must be a stick gauge or equivalent means to indicate the quantity of oil:

(1)In each tank; and

(2)In each transmission gearbox.

(e)Chip detection system. Rotor drive system transmissions and gearboxes utilising ferromagnetic materials must be equipped with chip detection systems designed and demonstrated to effectively indicate the presence of ferromagnetic particles resulting from damage or excessive wear within the transmission or gearbox. Each chip detection system must:

(1)be designed to provide a signal to the warning or caution devices in accordance with CS 29.1305(a)(23); and

(2)be provided with a means to allow crew members to check or to be informed of, in flight, whether the electrical circuit of the chip detection system function correctly.

[Amdt No: 29/10]

ED Decision 2023/001/R

CHIP DETECTION SYSTEM

This AMC provides further guidance and acceptable means of compliance to supplement Federal Aviation Administration (FAA) Advisory Circular (AC) 29 1B, § AC 29.1337. As such, it should be used in conjunction with the FAA AC.

The applicant should consider the following aspects of chip detection systems:

(a)Chip detection effectiveness

The effectiveness of the chip detection system should be understood as its capability to indicate the presence of ferromagnetic particles within a transmission or a gearbox. As a chip detection system requires these ferromagnetic particles to be near its sensing element(s) (chip detector(s)), its effectiveness depends on the following:

the design of the rotor drive system’s transmission or gearbox, which may help or prevent released ferromagnetic particles to move to the chip detector location(s);

the location of the chip detector; and

the design of the chip detector.

(b)Demonstration of effectiveness

As specified in CS 29.1337(e), the applicant should demonstrate that a chip detection system that is installed in a rotor drive system’s transmission or gearbox effectively indicates the presence of ferromagnetic particles resulting from damage or excessive wear within the transmission or gearbox. For this purpose, the applicant should consider the approach that is described in this section.

As mentioned above, the design of the transmission or gearbox, and the location of the chip detectors within them also affect the effectiveness of a chip detection system. As a result, when assessing the effectiveness of a chip detection system, the applicant should consider the characteristics of the complete transmission or gearbox. Hence, as part of the demonstration of the effectiveness of a chip detection system, the applicant should demonstrate that the system can consistently generate a caution/warning signal, within an acceptable period of time, of a limited amount of representative ferromagnetic particles being released. In doing so, the applicant should also consider the characteristics of the corresponding transmission or gearbox, such as oil ways and flow paths towards the chip detectors.

To demonstrate the effectiveness of a chip detection system, the applicant should perform a preliminary design assessment. This assessment should address all the areas of the transmission or gearbox from which ferromagnetic particles could be released, as well as the expected paths through which the particles reach the chip detectors. The assessment should identify those design features that might prevent particles from reaching a chip detector. In general, the areas of the transmission or gearbox to be considered for this evaluation should:

include main and/or tail rotor drive path;

include other areas that could affect the correct transmission of torque to main and/or tail rotors; and

focus on features such as the contact locations of bearings, gears, and shafts that are internal to the transmission or gearbox.

The applicant should use the outcome of the preliminary design assessment to determine the need for testing of each relevant area of the rotor drive system transmissions and gearboxes. If the applicant can justify that a location or area provides a conservative result, compared to other locations, the number of areas to be tested could be optimised. The preliminary design assessment should also determine those areas for which sufficient information is available from representative tests and in-service experience from previous designs.

Based on the conclusions of the preliminary design assessment, the applicant should determine the effectiveness of a chip detection system through a combination of the following two elements:

(1)a full-scale certification test of the transmission or gearbox by artificially introducing ferromagnetic particles.

The applicant should run this test in a series of phases, with measured amounts of ferromagnetic particles. The applicant should establish the quantity of ferromagnetic particles and the time needed to generate the caution/warning signal specified by CS 29.1305(a)(23) for each relevant area of the transmission or gearbox. The applicant should use this compliance method for those areas of transmissions or gearboxes whose effectiveness cannot be confidently established by a detailed design assessment as described in point (2).

In addition, the applicant should:

—perform the full-scale certification test in a fully representative gearbox, including its lubrication system. For gearboxes with pressurised lubrication, the applicant may replace some external elements of the lubrication system by test equipment, which can be justified to have no impact on the results.

—perform the full-scale certification test at a fixed attitude, rotational speed, and lubricating-oil temperature, corresponding to those at which the gearbox is expected to operate the most. The torque that is transmitted by the gearbox is considered irrelevant for this test.

—introduce the measured amount of ferromagnetic particles while the gearbox is rotating in stabilised conditions, wherever possible. Each introduction of particles should be performed in a way that represents as closely as possible the expected behaviour of particles that are produced by damage or wear.

—test each area that is identified for testing in a dedicated test phase, unless the applicant can justify that testing more than one area at the same time will still produce representative results for each area; and

—have a test procedure that ensures no contamination between the test phases. This often requires disassembling and thoroughly cleaning the gearbox being tested after each test phase.

(2)Detailed design assessment, using test data to support the performance of the relevant chip detectors in their local environments.

The applicant should use this assessment to demonstrate that the design provisions are adequate to ensure that the ferromagnetic particles that are released due to damage or excessive wear in the relevant locations will reach at least one chip detector. Sufficient test data to support the performance of the relevant chip detectors in representative environments should be available to demonstrate that the caution/warning signal that is specified in CS 29.1305(a)(23) is generated. When assessing the available test data, the applicant should consider that based on the area of the transmission or gearbox where the particles originate, additional test points may be needed, depending on the design of the chip detectors and of the areas around them. If the design of the transmission or gearbox has questionable features that may trap particles or impede their progress, representative test data or in-service experience that demonstrate the impact of these features on the effectiveness of the chip detection system should be available to support the assessment.

The applicant may obtain supporting test data from representative full scale tests, previous similar designs and/or components, or sub-assembly tests, as appropriate.

To demonstrate the effectiveness of the chip detection system, as described in this section, the applicant should also ensure that the chip detection system performs its intended function under any expected operating conditions. Therefore, the applicant should consider, through design analysis and/or dedicated testing, any aspects of the chip detection system and of the elements in which it is installed (i.e. gearboxes and transmissions) that could affect the effectiveness of the system. These aspects should include the following:

—attitude of the rotorcraft;

—temperature and viscosity of the oil; and

—exact location from which the ferromagnetic particles originate, and the vicinity of potential retention features.

(c)Acceptable level of effectiveness

This section provides an acceptable measure for demonstrating the effectiveness of the chip detection system that is described in point (b).

An acceptable level of effectiveness is demonstrated when the chip detection system generates a caution/warning signal following the release of an amount of ferromagnetic particles. The applicant should justify that this amount results from the damage or excessive wear caused by the failure modes of the specific area of the transmission or gearbox under assessment. Alternatively, the applicant may choose to use 60 mg of ferromagnetic particles.

In addition, no more than 20 minutes should elapse between the introduction of the first ferromagnetic particles and the generation of the caution/warning signal by the chip detection system. However, if the applicant demonstrates that a specific design feature of the chip detection systems consistently leads to effective detection in a period greater than 20 min, the adequacy of that system may be considered on a case-by-case basis.

When demonstrating the effectiveness of the chip detection system, the applicant should consider particles with characteristics (shapes, sizes, densities, and magnetic properties) representative of the damage or excessive wear associated with the areas being tested.

(d)Other considerations

(1)Reliability considerations

CS 29.1337(e) focuses on the overall effectiveness of the chip detection system. The assumption is made that the electrical elements of the system, the chip detector(s), and the instruments function reliably due to good design practices and compliance with the applicable requirements for electrical systems.

(2)Design considerations

(i)Flat oil sumps can significantly limit the capability of ferromagnetic particles, coming from different locations in the transmission or gearbox, that need to move across the sump to reach a chip detector. Therefore, the applicant should normally use substantiating test data to support the certification of this type of design feature.

Note: if the applicant has successfully performed tests in accordance with point (b), no further test data are necessary.

(ii)When designing rotor drive system transmissions and gearboxes, the applicant should ensure that the flow path of the lubricating oil that is intended to carry ferromagnetic particles is directed to the locations of the chip detectors. The location, orientation, and flow of oil jets may affect the movement of the ferromagnetic particles subject to their influence.

(iii)The applicant should avoid, wherever possible, specific features, such as cavities or pockets that could act as retention features for ferromagnetic particles.

(iv)In pressure-lubricated gearboxes, ferromagnetic particles may be drawn into the lubrication circuit at the pump intake. This can be advantageous for locating chip detectors. However, the applicant should carefully consider that the chip detection system may require particles to be acquired and retained, allowing them to be recovered and analysed. Thus, areas of strong oil flow should be carefully considered, ensuring that final location is defined and implemented in the design for particle recovery.

For non-pressure-lubricated gearboxes, the applicant should place the chip detector at the lowest point of the system.

(3)Maintenance and ICA considerations

The applicant should consider that CS 29.1337(e) focuses on the fitment of a chip detection system. That system should be an effective means to indicate the presence of ferromagnetic particles in rotor drive system transmissions and gearboxes, which may be caused by damage or excessive wear. It should also be capable to indicate the presence of such particles and to be checked in flight. However, following the detection of such particles by the rotorcraft chip detection system, additional actions are typically needed to ensure the airworthiness of the rotorcraft. The applicant should define the following actions in the instructions for continuing airworthiness (ICA):

—instructions to assess findings from any indication from the chip detection system, which may involve:

—analysis of the quantity and characteristics of the ferromagnetic particles that are detected and retrieved, and/or

—maintenance checks to retrieve additional ferromagnetic particles from other areas of the rotor drive system, such as the oil filter of the lubrication system;

—specific criteria to establish whether any findings may indicate that parts of the affected transmission or gearbox are subject to damage or wear and require to be restored to a serviceable condition; and

—additional inspections in support of continued operation when the aforementioned criteria are not reached.

In addition, the applicant may consider complementing the caution/warning signal of the chip detection system by regular inspection of the chip detector(s) and/or other elements of the transmission or gearbox where ferromagnetic particles may be located.

Finally, the applicant should ensure that the reliability of the system is maintained in service by conducting the necessary in-flight and maintenance checks to verify that the elements of the chip detection system function correctly.

[Amdt No: 29/10]

[Amdt No: 29/11]

ED Decision 2021/016/R

CHIP DETECTION SYSTEM

The chip detection system typically includes one or more sensing elements (i.e. ‘chip detectors’) per transmission or gearbox. Those chip detectors have the function of detecting the presence of ferromagnetic particles and generating a caution/warning signal. The chip detection system also includes the connectors’ wiring, as well as the hardware unit for processing the caution/warning signal, if needed, transferring it, and generating the warning or caution required by CS 29.1305(a)(23).

[Amdt No: 29/10]

ELECTRICAL SYSTEMS AND EQUIPMENT

ED Decision 2003/16/RM

(a)Electrical system capacity. The required generating capacity and the number and kind of power sources must:

(1)Be determined by an electrical load analysis; and

(2)Meet the requirements of CS 29.1309.

(b)Generating system. The generating system includes electrical power sources, main power busses, transmission cables, and associated control, regulation, and protective devices. It must be designed so that:

(1)Power sources function properly when independent and when connected in combination;

(2)No failure or malfunction of any power source can create a hazard or impair the ability of remaining sources to supply essential loads;

(3)The system voltage and frequency (as applicable) at the terminals of essential load equipment can be maintained within the limits for which the equipment is designed, during any probable operating condition;

(4)System transients due to switching, fault clearing, or other causes do not make essential loads inoperative, and do not cause a smoke or fire hazard;

(5)There are means accessible in flight to appropriate crew members for the individual and collective disconnection of the electrical power sources from the main bus; and

(6)There are means to indicate to appropriate crew members the generating system quantities essential for the safe operation of the system, such as the voltage and current supplied by each generator.

(c)External power. If provisions are made for connecting external power to the rotorcraft, and that external power can be electrically connected to equipment other than that used for engine starting, means must be provided to ensure that no external power supply having a reverse polarity, or a reverse phase sequence, can supply power to the rotorcraft’s electrical system.

(d)Operation with the normal electrical power generating system inoperative.

(1)It must be shown by analysis, tests, or both, that the rotorcraft can be operated safely in VFR conditions, for a period of not less than five minutes, with the normal electrical power generating system inoperative, with critical type fuel (from the stand-point of flameout and restart capability), and with the rotorcraft initially at the maximum certificated altitude. Parts of the electrical system may remain on if:

(i)A single malfunction, including a wire bundle or junction box fire, cannot result in loss of the part turned off and the part turned on; and

(ii)The parts turned on are electrically and mechanically isolated from the parts turned off.

(2)Additional requirements for Category A Rotorcraft

(i)Unless it can be shown that the loss of the normal electrical power generating system is extremely improbable, an emergency electrical power system, independent of the normal electrical power generating system, must be provided with sufficient capacity to power all systems necessary for continued safe flight and landing.

(ii)Failures, including junction box, control panel or wire bundle fires, which would result in the loss of the normal and emergency systems must be shown to be extremely improbable.

(iii)Systems necessary for immediate safety must continue to operate following the loss of the normal electrical power generating system, without the need for flight crew action.

ED Decision 2003/16/RM

(a)Electrical equipment, controls, and wiring must be installed so that operation of any one unit or system of units will not adversely affect the simultaneous operation of any other electrical unit or system essential to safe operation.

(b)Cables must be grouped, routed, and spaced so that damage to essential circuits will be minimised if there are faults in heavy current-carrying cables.

(c)Storage batteries must be designed and installed as follows:

(1)Safe cell temperatures and pressures must be maintained during any probable charging and discharging condition. No uncontrolled increase in cell temperature may result when the battery is recharged (after previous complete discharge):

(i)At maximum regulated voltage or power;

(ii)During a flight of maximum duration; and

(iii)Under the most adverse cooling condition likely in service.

(2)Compliance with sub-paragraph (c)(1) must be shown by test unless experience with similar batteries and installations has shown that maintaining safe cell temperatures and pressures presents no problem.

(3)No explosive or toxic gases emitted by any battery in normal operation, or as the result of any probable malfunction in the charging system or battery installation, may accumulate in hazardous quantities within the rotorcraft.

(4)No corrosive fluids or gases that may escape from the battery may damage surrounding structures or adjacent essential equipment.

(5)Each nickel cadmium battery installation capable of being used to start an engine or auxiliary power unit must have provisions to prevent any hazardous effect on structure or essential systems that may be caused by the maximum amount of heat the battery can generate during a short circuit of the battery or of its individual cells.

(6)Nickel cadmium battery installations capable of being used to start an engine or auxiliary power unit must have:

(i)A system to control the charging rate of the battery automatically so as to prevent battery overheating;

(ii)A battery temperature sensing and over-temperature warning system with a means for disconnecting the battery from its charging source in the event of an over- temperature condition; or

(iii)A battery failure sensing and warning system with a means for disconnecting the battery from its charging source in the event of battery failure.

ED Decision 2003/16/RM

(a)The distribution system includes the distribution busses, their associated feeders, and each control and protective device.

(b)If two independent sources of electrical power for particular equipment or systems are required by any applicable CS or operating rule, in the event of the failure of one power source for such equipment or system, another power source (including its separate feeder) must be provided automatically or be manually selectable to maintain equipment or system operation.

ED Decision 2003/16/RM

(a)Automatic protective devices must be used to minimise distress to the electrical system and hazard to the rotorcraft in the event of wiring faults or serious malfunction of the system or connected equipment.

(b)The protective and control devices in the generating system must be designed to de-energise and disconnect faulty power sources and power transmission equipment from their associated busses with sufficient rapidity to provide protection from hazardous overvoltage and other malfunctioning.

(c)Each resettable circuit protective device must be designed so that, when an overload or circuit fault exists, it will open the circuit regardless of the position of the operating control.

(d)If the ability to reset a circuit breaker or replace a fuse is essential to safety in flight, that circuit breaker or fuse must be located and identified so that it can be readily reset or replaced in flight.

(e)Each essential load must have individual circuit protection. However, individual protection for each circuit in an essential load system (such as each position light circuit in a system) is not required.

(f)If fuses are used, there must be spare fuses for use in flight equal to at least 50% of the number of fuses of each rating required for complete circuit protection.

(g)Automatic reset circuit breakers may be used as integral protectors for electrical equipment provided there is circuit protection for the cable supplying power to the equipment.

ED Decision 2003/16/RM

(a)Components of the electrical system must meet the applicable fire and smoke protection provisions of CS 29.831 and 29.863.

(b)Electrical cables, terminals, and equipment, in designated fire zones, and that are used in emergency procedures, must be at least fire resistant.

(c)Insulation on electrical wire and cable installed in the rotorcraft must be self-extinguishing when tested in accordance with CS-25, Appendix F, Part I (a)(3).

ED Decision 2003/16/RM

(a)When laboratory tests of the electrical system are conducted:

(1)The tests must be performed on a mock-up using the same generating equipment used in the rotorcraft;

(2)The equipment must simulate the electrical characteristics of the distribution wiring and connected loads to the extent necessary for valid test results; and

(3)Laboratory generator drives must simulate the prime movers on the rotorcraft with respect to their reaction to generator loading, including loading due to faults.

(b)For each flight condition that cannot be simulated adequately in the laboratory or by ground tests on the rotorcraft, flight tests must be made.

LIGHTS

ED Decision 2003/16/RM

The instrument lights must:

(a)Make each instrument, switch, and other device for which they are provided easily readable; and

(b)Be installed so that:

(1)Their direct rays are shielded from the pilot’s eyes; and

(2)No objectionable reflections are visible to the pilot.

ED Decision 2003/16/RM

(a)Each required landing or hovering light must be approved.

(b)Each landing light must be installed so that:

(1)No objectionable glare is visible to the pilot;

(2)The pilot is not adversely affected by halation; and

(3)It provides enough light for night operation, including hovering and landing.

(c)At least one separate switch must be provided, as applicable:

(1)For each separately installed landing light; and

(2)For each group of landing lights installed at a common location.

ED Decision 2003/16/RM

(a)General. Each part of each position light system must meet the applicable requirements of this paragraph and each system as a whole must meet the requirements of CS 29.1387 to 29.1397.

(b)Forward position lights. Forward position lights must consist of a red and a green light spaced laterally as far apart as practicable and installed forward on the rotorcraft so that, with the rotorcraft in the normal flying position, the red light is on the left side, and the green light is on the right side. Each light must be approved.

(c)Rear position light. The rear position light must be a white light mounted as far aft as practicable, and must be approved.

(d)Circuit. The two forward position lights and the rear position light must make a single circuit.

(e)Light covers and colour filters. Each light cover or colour filter must be at least flame resistant and may not change colour or shape or lose any appreciable light transmission during normal use.

ED Decision 2003/16/RM

(a)Except as provided in sub-paragraph (e), each forward and rear position light must, as installed, show unbroken light within the dihedral angles described in this paragraph.

(b)Dihedral angle L (left) is formed by two intersecting vertical planes, the first parallel to the longitudinal axis of the rotorcraft, and the other at 110° to the left of the first, as viewed when looking forward along the longitudinal axis.

(c)Dihedral angle R (right) is formed by two intersecting vertical planes, the first parallel to the longitudinal axis of the rotorcraft, and the other at 110° to the right of the first, as viewed when looking forward along the longitudinal axis.

(d)Dihedral angle A (aft) is formed by two intersecting vertical planes making angles of 70° to the right and to the left, respectively, to a vertical plane passing through the longitudinal axis, as viewed when looking aft along the longitudinal axis.

(e)If the rear position light, when mounted as far aft as practicable in accordance with CS 29.1385(c), cannot show unbroken light within dihedral angle A (as defined in sub-paragraph (d)), a solid angle or angles of obstructed visibility totalling not more than 0.04 steradians is allowable within that dihedral angle, if such solid angle is within a cone whose apex is at the rear position light and whose elements make an angle of 30° with a vertical line passing through the rear position light.

ED Decision 2003/16/RM

(a)General. The intensities prescribed in this paragraph must be provided by new equipment with light covers and colour filters in place. Intensities must be determined with the light source operating at a steady value equal to the average luminous output of the source at the normal operating voltage of the rotorcraft. The light distribution and intensity of each position light must meet the requirements of sub-paragraph (b).

(b)Forward and rear position lights. The light distribution and intensities of forward and rear position lights must be expressed in terms of minimum intensities in the horizontal plane, minimum intensities in any vertical plane, and maximum intensities in overlapping beams, within dihedral angles, L, R and A, and must meet the following requirements:

(1)Intensities in the horizontal plane. Each intensity in the horizontal plane (the plane containing the longitudinal axis of the rotorcraft and perpendicular to the plane of symmetry of the rotorcraft), must equal or exceed the values in CS 29.1391.

(2)Intensities in the vertical plane. Each intensity in any vertical plane (the plane perpendicular to the horizontal plane) must equal or exceed the appropriate value in CS 29.1393 where I is the minimum intensity prescribed in CS 29.1391 for the corresponding angles in the horizontal plane.

(3)Intensities in overlaps between adjacent signals. No intensity in any overlap between adjacent signals may exceed the values in CS 29.1395, except that higher intensities in overlaps may be used with the use of main beam intensities substantially greater than the minima specified in CS 29.1391 and 29.1393 if the overlap intensities in relation to the main beam intensities do not adversely affect signal clarity.