CS 27.771  Pilot compartment

ED Decision 2003/15/RM

For each pilot compartment:

(a) The compartment and its equipment must allow each pilot to perform his duties without unreasonable concentration or fatigue;

(b) If there is provision for a second pilot, the rotorcraft must be controllable with equal safety from either pilot seat; and

(c) The vibration and noise characteristics of cockpit appurtenances may not interfere with safe operation.

CS 27.773 Pilot compartment view

ED Decision 2003/15/RM

(a) Each pilot compartment must be free from glare and reflections that could interfere with the pilot’s view, and designed so that:

(1) Each pilot’s view is sufficiently extensive, clear, and undistorted for safe operation; and

(2) Each pilot is protected from the elements so that moderate rain conditions do not unduly impair his view of the flight path in normal flight and while landing.

(b) If certification for night operation is requested, compliance with sub-paragraph (a) must be shown in night flight tests.

CS 27.775  Windshields and windows

ED Decision 2003/15/RM

Windshields and windows must be made of material that will not break into dangerous fragments.

CS 27.777  Cockpit controls

ED Decision 2003/15/RM

Cockpit controls must be:

(a) Located to provide convenient operation and to prevent confusion and inadvertent operation; and

(b) Located and arranged with respect to the pilots’ seats so that there is full and unrestricted movement of each control without interference from the cockpit structure or the pilot’s clothing when pilots from 1.57 m (5 ft 2 inches) to 1.83 m (6 ft) in height are seated.

CS 27.779  Motion and effect of cockpit controls

ED Decision 2003/15/RM

Cockpit controls must be designed so that they operate in accordance with the following movements and actuation:

(a) Flight controls, including the collective pitch control, must operate with a sense of motion which corresponds to the effect on the rotorcraft.

(b) Twist-grip engine power controls must be designed so that, for left-hand operation, the motion of the pilot’s hand is clockwise to increase power when the hand is viewed from the edge containing the index finger. Other engine power controls, excluding the collective control, must operate with a forward motion to increase power.

(c) Normal landing gear controls must operate downward to extend the landing gear.

CS 27.783  Doors

ED Decision 2018/007/R

(a) Each closed cabin must have at least one adequate and easily accessible external door.

(b) Each external door must be located where persons using it will not be endangered by the rotors, propellers, engine intakes and exhausts when appropriate operating procedures are used. If opening procedures are required, they must be the marked inside, on or adjacent to the door opening device.

(c)  If certification with ditching provisions is requested by the applicant, any non-jettisonable doors intended for use after a ditching must have means to enable them to be secured in the open position and remain secure for emergency egress in all sea conditions for which ditching capability is requested by the applicant.

[Amdt No: 27/5]

AMC 27.783  Doors

ED Decision 2018/007/R

This AMC provides further guidance and acceptable means of compliance to supplement FAA AC 27-1B AC 27.783 § 27.783 to meet EASA’s interpretation of CS 27.783. As such it should be used in conjunction with the FAA AC but take precedence over it, where stipulated, in the showing of compliance.

Specifically, this AMC addresses one area where the FAA AC has been deemed by EASA as being at variance to EASA’s interpretation. This area is as follows:

(a)  Explanation

(4)  Any means of egress (door, hatch, openable window) intended for use following ditching need not have a threshold above the waterline of the rotorcraft in calm water. However, the usability of the egress means should be substantiated in all sea conditions up to and including those chosen for showing compliance with CS 27.801(e) or 27.802(c) as appropriate. See also AMC 27.801 paragraph (b)(10) and AMC 27.802 paragraph (b)(7).

[Amdt No: 27/5]

CS 27.785  Seats, berths, safety belts, and harnesses

ED Decision 2003/15/RM

(a) Each seat, safety belt, harness, and adjacent part of the rotorcraft at each station designated for occupancy during take-off and landing must be free of potentially injurious objects, sharp edges, protuberances, and hard surfaces and must be designed so that a person making proper use of these facilities will not suffer serious injury in an emergency landing as a result of the static inertial load factors specified in CS 27.561(b) and dynamic conditions specified in CS 27.562.

(b) Each occupant must be protected from serious head injury by a safety belt plus a shoulder harness that will prevent the head from contacting any injurious object except as provided for in CS 27.562(c)(5). A shoulder harness (upper torso restraint), in combination with the safety belt, constitutes a torso restraint system as described in ETSO-C114.

(c) Each occupant’s seat must have a combined safety belt and shoulder harness with a single-point release. Each pilot’s combined safety belt and shoulder harness must allow each pilot when seated with safety belt and shoulder harness fastened, to perform all functions necessary for flight operations. There must be a means to secure belts and harnesses when not in use, to prevent interference with the operation of the rotorcraft and with rapid egress in an emergency.

(d) If seat backs do not have a firm handhold, there must be hand grips or rails along each aisle to enable the occupants to steady themselves while using the aisle in moderately rough air.

(e) Each projecting object that could injure persons seated or moving about in the rotorcraft in normal flight must be padded.

(f) Each seat and its supporting structure must designed for an occupant weight of at least 77 kg (170 lbs) considering the maximum load factors, inertial forces, and reactions between the occupant, seat, and safety belt or harness corresponding with the applicable flight and ground-load conditions, including the emergency landing conditions of CS 27.561(b). In addition:

(1) Each pilot seat must be designed for the reactions resulting from the application of the pilot forces prescribed in CS 27.397; and

(2) The inertial forces prescribed in CS 27.561(b) must be multiplied by a factor of 1.33 in determining the strength of the attachment of:

(i) Each seat to the structure; and

(ii) Each safety belt or harness to the seat or structure.

(g) When the safety belt and shoulder harness are combined, the rated strength of the safety belt and shoulder harness may not be less than that corresponding to the inertial forces specified in CS 27.561(b), considering the occupant weight of at least 77 kg (170 lbs), considering the dimensional characteristics of the restraint system installation, and using a distribution of at least a 60% load to the safety belt and at least a 40% load to the shoulder harness. If the safety belt is capable of being used without the shoulder harness, the inertial forces specified must be met by the safety belt alone.

(h) When a headrest is used, the headrest and its supporting structure must be designed to resist the inertia forces specified in CS 27.561, with a 1.33 fitting factor and a head weight of at least 5.9 kg (13 lbs).

(i) Each seating device system includes the device such as the seat, the cushions, the occupant restraint system, and attachment devices.

(j) Each seating device system may use design features such as crushing or separation of certain parts of the seats to reduce occupant loads for the emergency landing dynamic conditions of CS 27.562; otherwise, the system must remain intact and must not interfere with rapid evacuation of the rotorcraft.

(k) For the purposes of this paragraph, a litter is defined as a device designed to carry a non-ambulatory person, primarily in a recumbent position, into and on the rotorcraft. Each berth or litter must be designed to withstand the load reaction of an occupant weight of at least 77 kg (170 lbs) when the occupant is subjected to the forward inertial factors specified in CS 27.561(b). A berth or litter installed within 15° or less of the longitudinal axis of the rotorcraft must be provided with a padded end-board, cloth diaphragm, or equivalent means that can withstand the forward load reaction. A berth or litter oriented greater than 15° with the longitudinal axis of the rotorcraft must be equipped with appropriate restraints, such as straps or safety belts, to withstand the forward load reaction. In addition –

(1) The berth or litter must have a restraint system and must not have corners or other protuberances likely to cause serious injury to a person occupying it during emergency landing conditions; and

(2) The berth or litter attachment and the occupant restraint system attachments to the structure must be designed to withstand the critical loads resulting from flight and ground load conditions and from the conditions prescribed in CS 27.561(b). The fitting factor required by CS 27.625(d) shall be applied.

CS 27.787  Cargo and baggage compartments

ED Decision 2003/15/RM

(a) Each cargo and baggage compartment must be designed for its placarded maximum weight of contents and for the critical load distributions at the appropriate maximum load factors corresponding to the specified flight and ground load conditions, except the emergency landing conditions of CS 27.561.

(b) There must be means to prevent the contents of any compartment from becoming a hazard by shifting under the loads specified in sub-paragraph (a).

(c) Under the emergency landing conditions of CS 27.561, cargo and baggage compartments must:

(1) Be positioned so that if the contents break loose they are unlikely to cause injury to the occupants or restrict any of the escape facilities provided for use after an emergency landing; or

(2) Have sufficient strength to withstand the conditions specified in CS 27.561 including the means of restraint, and their attachments, required by sub-paragraph (b). Sufficent strength must be provided for the maximum authorised weight of cargo and baggage at the critical loading distribution.

(d) If cargo compartment lamps are installed, each lamp must be installed so as to prevent contact between lamp bulb and cargo.

CS 27.801  Ditching

ED Decision 2018/007/R

(a) If certification with ditching provisions is requested by the applicant, the rotorcraft must meet the requirements of this CS and CS 27.563, CS 27.783(c), CS 27.805(c), CS 27.807(d), CS 27.1411, CS 27.1415, CS 27.1470, CS 27.1555(d) and CS 27.1561.

(b) Each practicable design measure, compatible with the general characteristics of the rotorcraft, must be taken to minimise the probability that when ditching, the behaviour of the rotorcraft would cause immediate injury to the occupants or would make it impossible for them to escape.

(c)  An emergency flotation system that is stowed in a deflated condition during normal flight must:

(1) be designed such that the effects of a water impact (i.e. crash) on the emergency flotation system are minimised;

(2) have a means of automatic deployment following water entry.

(d) The probable behaviour of the rotorcraft during ditching water entry must be shown to exhibit no unsafe characteristics.

(e) The rotorcraft must be shown to resist capsize in the sea conditions selected by the applicant. The probability of capsizing in a 5-minute exposure to the sea conditions must be substantiated to be less than or equal to 3.0 % with a fully serviceable emergency flotation system and 30.0 % with the critical float compartment failed, with 95 % confidence.

Allowances must be made for probable structural damage and leakage.

(f) Unless the effects of the collapse of external doors and windows are accounted for in the investigation of the probable behaviour of the rotorcraft during ditching (as prescribed in (d) and (e)), the external doors and windows must be designed to withstand the probable maximum local pressures.

[Amdt No: 27/5]

AMC 27.801 Ditching

ED Decision 2018/007/R

This AMC replaces FAA AC 27.801.

(a)  Definitions

(1) Ditching: a controlled emergency landing on water, deliberately executed in accordance with rotorcraft flight manual (RFM) procedures, with the intent of abandoning the rotorcraft as soon as practicable.

(2)  Emergency flotation system (EFS): a system of floats and any associated parts (e.g. gas cylinders, means of deployment, pipework and electrical connections) that is designed and installed on a rotorcraft to provide buoyancy and flotation stability in a ditching.

(b) Explanation

(1)  Ditching certification is performed only if requested by the applicant.

(2) For a rotorcraft to be certified for ditching, in addition to the other applicable requirements of CS-27, the rotorcraft must specifically satisfy CS 27.801 together with the requirements referenced in CS 27.801(a).

(3) Ditching certification encompasses four primary areas of concern: rotorcraft water entry and flotation stability (including loads and flotation system design), occupant egress, and occupant survival. CS-27 Amendment 5 has developed enhanced standards in all of these areas.

(4) The scope of the ditching requirements is expanded at Amendment 5 through a change in the ditching definition. All potential failure conditions that could result in a controlled ‘land immediately’ action by the pilot are now included. This primarily relates to changes in water entry conditions. While the limiting conditions for water entry have been retained (15.4 m/s (30 kt), 1.5 m/s (5 ft/s)), the alleviation that previously allowed less than 15.4 m/s (30 kt) forward speed to be used as the maximum applicable value has been removed (also from CS 27.563).

(5)  Flotation stability is enhanced through the introduction of a new standard based on a probabilistic approach to capsizes.

(6)  Failure of the EFS to operate when required will lead to the rotorcraft rapidly capsizing and sinking. Operational experience has shown that localised damage or failure of a single component of an EFS, or the failure of the flight crew to activate or deploy the EFS, can lead to the loss of the complete system. Therefore, the design of the EFS needs careful consideration; automatic deployment has been shown to be practicable and to offer a significant safety benefit.

(7)  The sea conditions, on which certification with ditching provisions is to be based, are selected by the applicant and should take into account the expected sea conditions in the intended areas of operation. The wave climate of the northern North Sea is adopted as the default wave climate as it represents a conservative condition. The applicant may select alternative/additional sea areas, with any associated certification then being limited to those geographical regions. The significant wave height, and any geographical limitations (if applicable – see the AMC to CS 27.801(e) and 27.802(c)) should be included in the RFM as performance information.

(8)  During scale model testing, appropriate allowances should be made for probable structural damage and leakage. Previous model tests and other data from rotorcraft of similar configurations that have already been substantiated, based on equivalent test conditions, may be used to satisfy the ditching requirements. In regard to flotation stability, the test conditions should be equivalent to those defined in the AMC to CS 27.801(e) and 27.802(c).

(9)  CS 27.801 requires that after ditching in sea conditions for which certification with ditching provisions is requested by the applicant, the probability of capsizing in a 5 minute exposure is acceptably low in order to allow the occupants to leave the rotorcraft and enter life rafts. This should be interpreted to mean that up to and including the worst-case sea conditions for which certification with ditching provisions is requested by the applicant, the probability that the rotorcraft will capsize should be not higher than the target stated in CS 27.801(e). An acceptable means of demonstrating post-ditching flotation stability is through scale model testing using irregular waves. The AMC to CS 27.801(e) and 27.802(c) contains a test specification that has been developed for this purpose.

(10)  Providing a ‘wet floor’ concept (water in the cabin) by positioning the floats higher on the fuselage sides and allowing the rotorcraft to float lower in the water can be a way of increasing the stability of a ditched rotorcraft (although this would need to be verified for the individual rotorcraft type for all weight and loading conditions), or it may be desirable for other reasons. This is permissible provided that the mean static level of water in the cabin is limited to being lower than the upper surface of the seat cushion (for all rotorcraft mass and centre of gravity cases, with all flotation units intact), and that the presence of water will not unduly restrict the ability of occupants to evacuate the rotorcraft and enter the life raft.

(11) The sea conditions approved for ditching should be stated in the performance information section of the RFM.

(12) Current practices allow wide latitude in the design of cabin interiors and, consequently, of stowage provisions for safety and ditching equipment. Rotorcraft manufacturers may deliver aircraft with unfinished (green) interiors that are to be completed by a modifier.

(i)  Segmented certification is permitted to accommodate this practice. That is, the rotorcraft manufacturer shows compliance with the flotation time, stability, and emergency exit requirements while a modifier shows compliance with the equipment requirements and egress requirements with the interior completed. This procedure requires close cooperation and coordination between the manufacturer, modifier, and EASA.

(ii) The rotorcraft manufacturer may elect to establish a token interior for ditching certification. This interior may subsequently be modified by a supplemental type certificate (STC). The ditching provisions should be shown to be compliant with the applicable requirements after any interior configuration or limitation change.

(iii) The RFM and any RFM supplements deserve special attention if a segmented certification procedure is pursued.

(c)  Procedures

(1) Flotation system design

(i)  Structural integrity should be established in accordance with CS 27.563.

(ii)  Rotorcraft handling qualities should be verified to comply with the applicable certification specifications throughout the approved flight envelope with floats installed. Where floats are normally deflated, and deployed in flight, the handling qualities should be verified for the approved operating envelopes with the floats in:

(A)  the deflated and stowed condition;

(B)  the fully inflated condition; and

(C)  the in-flight inflation condition; for float systems which may be inflated in flight, rotorcraft controllability should be verified by test or analysis taking into account all possible emergency flotation system inflation failures.

(iii)  Reliability should be considered in the basic design to assure approximately equal inflation of the floats to preclude excessive yaw, roll, or pitch in flight or in the water:

(A)  Maintenance procedures should not degrade the flotation system (e.g. by introducing contaminants that could affect normal operation, etc.).

(B) The flotation system design should preclude inadvertent damage due to normal personnel traffic flow and wear and tear. Protection covers should be evaluated for function and reliability.

(C)  The designs of the floats should provide means to minimise the likelihood of damage or tear propagation between compartments. Single compartment float designs should be avoided.

(D)  When showing compliance with CS 27.801(c)(1), and where practicable, the design of the flotation system should consider the likely effects of water impact (i.e. crash) loads. For example:

(a)  locate system components away from the major effects of structural deformation;

(b)  use flexible pipes/hoses; and

(c)  avoid passing pipes/hoses or electrical wires through bulkheads that could act as a ‘guillotine’ when the structure is subject to water impact loads.

(iv)  The floats should be fabricated from highly conspicuous material of to assist in locating the rotorcraft following a ditching (and possible capsize).

(2) Flotation system inflation.

 Emergency flotation systems (EFSs) that are normally stowed in a deflated condition and are inflated either in flight or after contact with water should be evaluated as follows:

(i)  The emergency flotation system should include a means to verify its system integrity prior to each flight.

(ii)  Means should be provided to automatically trigger the inflation of the EFS upon water entry, irrespective of whether or not inflation prior to water entry is the intended operation mode. If a manual means of inflation is provided, the float activation switch should be located on one of the primary flight controls and should be safeguarded against inadvertent actuation.

(iii) The inflation system should be safeguarded against spontaneous or inadvertent actuation in flight conditions for which float deployment has not been demonstrated to be safe.

(iv)  The maximum airspeeds for intentional in-flight actuation of the emergency flotation system and for flight with the floats inflated should be established as limitations in the RFM unless in-flight actuation is prohibited by the RFM.

(v)  Activation of the emergency flotation system upon water entry (irrespective of whether or not inflation prior to water entry is the intended operation mode) should result in an inflation time short enough to prevent the rotorcraft from becoming excessively submerged.

(vi)  A means should be provided for checking the pressure of the gas stowage cylinders prior to take-off. A table of acceptable gas cylinder pressure variation with ambient temperature and altitude (if applicable) should be provided.

(vii)  A means should be provided to minimise the possibility of over inflation of the flotation units under any reasonably probable actuation conditions.

(viii) The ability of the floats to inflate without puncturing when subjected to actual water pressures should be substantiated. A demonstration of a full-scale float immersion in a calm body of water is one acceptable method of substantiation. Precautions should also be taken to avoid floats being punctured due to the proximity of sharp objects, during inflation in flight and with the helicopter in the water, and during subsequent movement of the helicopter in waves. Examples of objects that need to be considered are aerials, probes, overboard vents, unprotected split-pin tails, guttering and any projections sharper than a three-dimensional right-angled corner.

(3)  Injury prevention during and following water entry.

 An assessment of the cabin and cockpit layouts should be undertaken to minimise the potential for injury to occupants in a ditching. This may be performed as part of the compliance with CS 27.785. Attention should be given to the avoidance of injuries due to leg/arm flailing, as these can be a significant impediment to occupant egress and subsequent survivability. Practical steps that could be taken include:

(i)  locating potentially hazardous items away from the occupants;

(ii)  installing energy-absorbing padding onto interior components;

(iii) using frangible materials; and

(iv)  designs that exclude hard or sharp edges.

(4) Water entry procedures.

 Tests or simulations (or a combination of both) should be conducted to establish procedures and techniques to be used for water entry, based on the conditions given in (5). These tests/simulations should include determination of the optimum pitch attitude and forward velocity for ditching in a calm sea, as well as entry procedures for the most severe sea condition to be certified. Procedures for all failure conditions that may lead to a ‘land immediately’ action (e.g. one engine inoperative, all engines inoperative, tail rotor/drive failure) should be established. However, only the procedures for the most critical all-engines-inoperative condition need be verified by water entry test data.

(5)  Water entry behaviour.

 CS 27.801(d) requires the probable behaviour of the rotorcraft to be shown to exhibit no unsafe characteristics, e.g. that would lead to an inability to remain upright.

 This should be demonstrated by means of scale model testing, based on the following conditions:

(i) For entry into a calm sea:

(A) the optimum pitch, roll and yaw attitudes determined in (c)(4) above, with consideration for variations that would reasonably be expected to occur in service;

(B)  ground speeds from 0 to 15.4 m/s (0 to 30 kt); and

(C)  descent rate of 1.5 m/s (5 ft/s) or greater;

(ii)  For entry into the most severe sea condition:

(A) the optimum pitch attitude and entry procedure determined in (c)(4) above;

(B)  ground speed of 15.4 m/s (30 kt);

(C) descent rate of 1.5 m/s (5 ft/s) or greater;

(D)  likely roll and yaw attitudes; and

(E)  sea conditions may be represented by regular waves having a height at least equal to the significant wave height (H_s), and a period no larger than the wave zero-crossing period (T_z) for the wave spectrum chosen for demonstration of rotorcraft flotation stability after water entry (see (c)(6) below and AMC to 27.801(e) and 27.802(c));

(iii)  Scoops, flaps, projections, and any other factors likely to affect the hydrodynamic characteristics of the rotorcraft must be considered.

(iv)  Probable damage to the structure due to water entry should be considered during the water entry evaluations (e.g. failure of windows, doors, skins, panels, etc.); and

(v)  Rotor lift does not have to be considered.

Alternatively, if scale model test data for a helicopter of a similar configuration has been previously successfully used to justify water entry behaviour, this data could form the basis for a comparative analytical approach.

(6)  Flotation stability tests.

 An acceptable means of flotation stability testing is contained in the AMC to CS 27.801(e) and 27.802(c). Note that model tests in a wave basin on a number of different rotorcraft types have indicated that an improvement in seakeeping performance can consistently be achieved by fitting float scoops.

(7) Occupant egress and survival.

 The ability of the occupants to deploy life rafts, egress the rotorcraft, and board the life rafts should be evaluated. For configurations which are considered to have critical occupant egress capabilities due to the life raft locations or the emergency exit locations and the proximity of the float (or a combination of both), an actual demonstration of egress may be required. When a demonstration is required, it may be conducted on a full-scale rotorcraft actually immersed in a calm body of water or using any other rig or ground test facility shown to be representative. The demonstration should show that the floats do not impede a satisfactory evacuation. Service experience has shown that it is possible for occupants to have escaped from the cabin but to have not been able to board a life raft and to have had difficulty in finding handholds to stay afloat and together. Handholds or lifelines should be provided on appropriate parts of the rotorcraft. The normal attitude of the rotorcraft and the possibility of capsizing should be considered when positioning the handholds or lifelines.

[Amdt No: 27/5]

AMC to CS 27.801(e) and 27.802(c) Model test method for flotation stability

ED Decision 2018/007/R

This AMC should be used when showing compliance with CS 27.801(e) or CS 27.802(c) as introduced at Amendment 5.

(a)  Explanation

(1) Model test objectives

 The objective of the model tests described in the certification specification is to establish the performance of the rotorcraft in terms of its stability in waves. The wave conditions in which the rotorcraft is to be certified should be selected according to the desired level of operability (see (a)(2) below).

 This will enable the overall performance of the rotorcraft to be established for inclusion in the rotorcraft flight manual (RFM) as required by CS 27.1587(b)(3). In the case of approval with ditching provisions, the wave conditions selected for substantiation of behaviour during the water entry phase must also be taken into account.

 The rotorcraft design is to be tested, at each mass condition (see paragraph b(1)(ii) below), with its flotation system intact, and with its single most critical flotation compartment damaged (i.e. the single-puncture case which has the worst adverse effect on flotation stability).

(2)  Model test wave conditions

 The rotorcraft is to be tested in a single sea condition comprising a single combination of significant wave height (H_s) and zero-crossing period (T_z). The values of H_s and T_z should be no less than, and no more than, respectively, those chosen for certification, i.e. as selected from table 1. This approach is necessary in order to constrain the quantity of testing required within reasonable limits and is considered to be conservative. The justification is detailed in Appendix 2.

 The applicant is at liberty to certify the rotorcraft to any significant wave height Hs. This significant wave height will be noted as performance information in the RFM.

 Using reliable wave climate data for an appropriate region of the ocean for the anticipated flight operations, a T_z is selected to accompany the H_s. This T_z should be typical of those occurring at H_s as determined in the wave scatter table for the region. The mode or median of the T_z distribution at H_s should be used.

 It is considered that the northern North Sea represents a conservatively ‘hostile’ region of the ocean worldwide and should be adopted as the default wave climate for certification. However, this does not preclude an applicant from certifying a rotorcraft specifically for a different region. Such a certification for a specific region would require the geographical limits of that certification region to be noted as performance information in the RFM. Certification for the default northern North Sea wave climate does not require any geographical limits.

 In the case of an approval with emergency flotation provisions, operational limitations may limit flight to ‘non-hostile’ sea areas. For simplicity, the northern North Sea may still be selected as the wave climate for certification, or alternatively a wave climate derived from a non-hostile region’s data may be used. If the latter approach is chosen, and it is desired to avoid geographical limits, a ‘non-hostile’ default wave climate will need to be agreed with EASA.

 Wave climate data for the northern North Sea were obtained from the United Kingdom Meteorological Office (UK Met Office) for a typical ‘hostile’ helicopter route. The route selected was from Aberdeen to Block 211/27 in the UK sector of the North Sea. Data tables were derived from a UK Met Office analysis of 34 years of 3-hourly wave data generated within an 8-km, resolved wave model hindcast for European waters. This data represents the default wave climate.

 Table 1 below has been derived from this data and contains combinations of H_s and T_z. Table 1 also includes the probability of exceedance (P_e) of the H_s.

Table 1 — Northern North Sea wave climate

(3) Target probability of capsizing

 Target probabilities of capsizing have been derived from a risk assessment. The target probabilities to be applied are as stated in CS 27.801(e) and 27.802(c), as applicable.

 For ditching, the intact flotation system probability of capsizing of 3 % is derived from a historic ditching rate of 3.32 x 10^-6 per flight hour and an AMC 27.1309 consequence of hazardous, which implies a frequency of capsizing of less than 10^-7 per flight hour. The damaged flotation system probability of capsizing is increased by a factor of 10 to 30 % on the assumption that the probability of failure of the critical float compartment is 0.1; this probability has been estimated, as there is insufficient data on flotation system failure rates.

 For emergency flotation equipment, an increase of half an order (√10) is allowed on the assumption of a reduced exposure to the risk, resulting in a probability of capsizing of 10 %. The probability of a capsizing with a damaged flotation system is consequently increased to 100 %, hence no test is required.

(4)  Intact flotation system

 For the case of an intact flotation system, if the northern North Sea default wave climate has been chosen for certification, the rotorcraft should be shown to resist capsize in a sea condition selected from Table 1. The probability of capsizing in a 5-minute exposure to the selected sea condition is to be demonstrated to be less than or equal to the appropriate value provided in CS 27.801(e) or 27.802(c), as appropriate, with a confidence of 95 % or greater.

(5)  Damaged flotation system

 For the case of a damaged flotation compartment (see (1) above), the same sea condition may be used, but a 10-fold increased probability of capsizing is permitted. This is because it is assumed that flotation system damage will occur in approximately one out of ten emergency landings on water. Thus, the probability of capsizing in a 5-minute exposure to the sea condition is to be demonstrated to be less than or equal to 10 times the required probability for the intact flotation system case, with a confidence of 95 % or greater. Where a 10-times probability is equal to or greater than 100 %, it is not necessary to perform a model test to determine the capsize probability with a damaged flotation system.

 Alternatively, the applicant may select a wave condition with 10 times the probability of exceedance P_e of the significant wave height (H_s) selected for the intact flotation condition. In this case, the probability of capsizing in a 5-minute exposure to the sea condition is to be demonstrated to be less than or equal to the required value (see CS 27.801(e) or 27.802(c)), with a confidence of 95 % or greater.

(6)  Long-crested waves

 Whilst it is recognised that ocean waves are in general multidirectional (short-crested), the model tests are to be performed in unidirectional (long-crested) waves, this being regarded as a conservative approach to capsize probability.

(b)  Procedures

(1)  Rotorcraft model

(i) Construction and scale of the model

The rotorcraft model, including its emergency flotation, is to be constructed to be geometrically similar to the full-scale rotorcraft design at a scale that will permit the required wave conditions to be accurately represented in the model basin. It is recommended that the scale of the model should be not smaller than 1/15.

The construction of the model is to be sufficiently light to permit the model to be ballasted to achieve the desired weight and rotational inertias specified in the mass conditions (see (b)(1)(ii) below)³ It should be noted that rotorcraft tend to have a high centre of gravity due to the position of the engines and gearbox on top of the cabin. It therefore follows that most of the ballast is likely to be required to be installed in these high locations of the model..

Where it is likely that water may flood into the internal spaces following an emergency landing on water, for example through doors opened to permit escape, or any other opening, the model should represent these internal spaces and openings as realistically as possible.

It is permissible to omit the main rotor(s) from the model, but its (their) mass is to be represented in the mass and inertia conditions⁴ Rotors touching the waves can promote capsize, but they can also be a stabilising factor depending on the exact circumstances. Furthermore, rotor blades are often lost during the ditching due to contact with the sea. It is therefore considered acceptable to omit them from the model..

(ii)  Mass conditions

As it is unlikely that the most critical condition can be determined reliably prior to testing, the model is to be tested in two mass conditions:

(A)  maximum mass condition, mid C of G; and

(B)  minimum mass condition, mid C of G.

(iii)  Mass properties

The model is to be ballasted in order to achieve the required scale weight, centre of gravity, roll and yaw inertia for each of the mass conditions to be tested.

Once ballasted, the model’s floating draft and trim in calm water is to be checked and compared with the design floating attitude.

The required mass properties and floating draft and trim, and those measured during model preparation, are to be fully documented and compared in the report.

(iv)  Model restraint system

The primary method of testing is with a restrained model, but an alternative option is for a free-floating model (See (3)(iii) below).

For the primary restrained method, a flexible restraint or mooring system is to be provided to restrain the model in order for it to remain beam-on to the waves in the model basin⁵ In general the model cannot be permitted to float freely in the basin because in the necessarily long-wave test durations, the model would otherwise drift down the basin and out of the calibrated wave region. Constraining the model to remain beam-on to the waves and not float freely is regarded as a conservative approach to the capsize test. A free-floating test is optional after a specific capsize event, in order to investigate whether the restraint system contributed to the event. It may also be possible to perform a complete free-floating test campaign by combining many short exposures in a wave basin capable of demonstrating a large calibrated wave region..

This restraint system should fulfil the following criteria:

(A) be attached to the model on the centre line at the front and rear of the fuselage in such a position that roll motion coupling is minimised; an attachment at or near the waterline is preferred; and

(B)  be sufficiently flexible that the natural frequencies of the model surging/swaying on this restraint system are much lower than the lowest wave frequencies in the spectrum.

(v)  Sea anchor

Whether or not the rotorcraft is to be fitted with a sea anchor, such an anchor is not to be represented in these model tests⁶ A sea anchor deployed from the rotorcraft nose is intended to improve stability by keeping the rotorcraft nose into the waves. However, such devices take a significant time to deploy and become effective, and so, their beneficial effect is to be ignored. The rotorcraft model will be restrained to remain beam-on to the waves..

(2)  Test facility

 The model test facility is to have the capability to generate realistic long non-repeating sequences of unidirectional (long-crested) irregular waves, as well as the characteristic wave condition at the chosen model scale. The facility is to be deep enough to ensure that the waves are not influenced by the depth (i.e. deep-water waves).

 The dimensions of the test facility are to be sufficiently large to avoid any significant reflection/refraction effects influencing the behaviour of the rotorcraft model.

 The facility is to be fitted with a high-quality wave-absorbing system or beach.

 The model basin is to provide full details of the performance of the wave maker and the wave absorption system prior to testing.

(3)   Model test set-up

(i)  General

The model is to be installed in the wave facility in a location sufficiently distant from the wave maker, tank walls and beach/absorber such that the wave conditions are repeatable and not influenced by the boundaries.

The model is to be attached to the model restraint system (see (b)(1)(iv) above).

(ii)  Instrumentation and visual records

During wave calibration tests, three wave elevation probes are to be installed and their outputs continuously recorded. These probes are to be installed at the intended model location, a few metres to the side and a few metres ahead of this location.

The wave probe at the model location is to be removed during tests with the rotorcraft model present.

All tests are to be continuously recorded on digital video. It is required that at least two simultaneous views of the model are to be recorded. One is to be in line with the model axis (i.e. viewing along the wave crests), and the other is to be a three-quarter view of the model from the up-wave direction. Video records are to incorporate a time code to facilitate synchronisation with the wave elevation records in order to permit the investigation of the circumstances and details of a particular capsize event.

(iii) Wave conditions and calibration

Prior to the installation of the rotorcraft model in the test facility, the required wave conditions are to be pre-calibrated.

Wave elevation probes are to be installed at the model location, alongside and ahead of the intended model location.

The intended wave spectrum is to be run for the full exposure duration required to demonstrate the required probability of capsizing. The analysis of these wave calibration runs is to be used to:

(A)  confirm that the required wave spectrum has been obtained at the model location; and

(B) verify that the wave spectrum does not deteriorate appreciably during the run in order to help establish the maximum duration test that can be run before the test facility must be allowed to become calm again.

It should be demonstrated that the wave spectrum measured at each of the three locations is the same.

If a free-floating model is to be used, then the waves are to be calibrated for a range of locations down the basin, and the spectrum measured in each of these locations should be shown to be the same. The length of the basin covered by this range will be the permitted test region for the free-floating model, and the model will be recovered when it drifts outside this region (See Section 4). It should be demonstrated that the time series of the waves measured at the model location does not repeat during the run. Furthermore, it should be demonstrated that one or more continuation runs can be performed using exactly the same wave spectrum and period, but with different wave time series. This is to permit a long exposure to the wave conditions to be built up from a number of separate runs without any unrealistic repetition of the time series.

No wind simulation is to be used⁷ Wind generally has a tendency to redirect the rotorcraft nose into the wind/waves, thus reducing the likelihood of capsize. Therefore, this conservative testing approach does not include a wind simulation..

(iv)  Required wave run durations

The total duration of runs required to demonstrate that the required probability of capsizing has been achieved (or bettered) is dependent on that probability itself, and on the reliability or confidence of the capsize probability required to be demonstrated.

With the assumption that each 5-minute exposure to the wave conditions is independent, the equations provided in (b)(5) below can be used to determine the duration without a capsize that is required to demonstrate the required performance.⁸ Each 5-minute exposure might not be independent if, for example, there was flooding of the rotorcraft, progressively degrading its stability. However, in this context, it is considered that the assumption of independence is conservative. (See Appendix 1 below for examples.)

(4) Test execution and results

 Tests are to start with the model at rest and the wave basin calm.

 Following the start of the wave maker, sufficient time is to elapse to permit the slowest (highest-frequency) wave components to arrive at the model, before data recording starts.

 Wave runs are to continue for the maximum permitted duration determined in the wave calibration test, or in the flee-floating option for as long as the model remains in the calibrated wave region. Following sufficient time to allow the basin to become calm again, additional runs are to be conducted until the necessary total exposure duration (T_test) has been achieved (see (b)(5) below).

 In the case of the free-floating option, the model may be recovered and relaunched without stopping the wave maker, provided that the maximum permitted duration is not exceeded. See paragraph (4)(iv) for requirements regarding relaunching the free-floating model.

 If and when a model capsize occurs, the time of the capsize from the start of the run is to be recorded, and the run stopped. The model is to be recovered, drained of any water, and reset in the basin for a continuation run to be performed.

 There are a number of options that may be taken following a capsize event:

(i)  Continuing with the same model configuration.

If the test is to be continued with the same model configuration, the test can be restarted with a different wave time series, or continued from the point of capsizing in a pseudorandom time series.

(ii)  Reducing the wave severity to achieve certification at a lower significant wave height.

Provided that the same basic pseudorandom wave time series can be reproduced by the wave basin at a lower wave height and corresponding period, it is permitted to restart the wave maker time series at a point at least 5 minutes prior to the capsize event, and if the model is now seen to survive the wave sequence that caused a capsize in the more severe condition, then credit can then be taken for the run duration successfully achieved prior to the capsize. Clearly, such a restart is only possible with a model basin using pseudorandom wave generation.

This method is only permitted if the change in significant wave height and period is sufficiently small that the same sequence of capsizing waves, albeit at a lower amplitude, can be seen in the wave basin. If this is not the case, then credit cannot be taken for the exposure time prior to capsize, and the wave time series must be restarted from the beginning.

(iii)  Modifying the model with the intention of avoiding a capsize.

If it is decided to modify the model flotation with the intention of demonstrating that the modified model does not capsize in the wave condition, then the pseudorandom wave maker time series should be restarted at a point at least 5 minutes prior to the capsize event so that the model is seen to survive the wave that caused a capsize prior to the modification. Credit can then be taken for the duration of the run successfully achieved prior to the capsize.

(iv)  Repeating a restrained capsize event with a free-floating model.

If it is suspected that the model restraint system might have contributed to the capsize event, it is permitted to repeat that part of the pseudorandom time series with a free-floating model. The model is to be temporally restrained with light lines and then released beam-on to the waves such that the free-floating model is seen to experience the same wave time series that caused a capsize in exactly the same position in the basin. It is accepted that it might require several attempts to find the precise model release time and position to achieve this.

If the free-floating model, having been launched beam-on to the waves, is seen to yaw into a more beneficial heading once released, and seen to survive the wave that caused a capsize in the restrained model, then this is accepted as negating the capsize seen with the restrained model.

The test may then continue with a restrained model as with (i) above.

(v) Special considerations regarding relaunching a free-floating model into the calibrated wave region.

If a free-floating model is being used for the tests, then it is accepted that the model will need to be recovered as it leaves the calibrated wave region, and then relaunched at the top of that region. It is essential that this process does not introduce any statistical or other bias into the behaviour of the model. For example, there might be a natural tendency to wait for a spell of calmer waves into which to launch the model. This particular bias is to be avoided by strictly obeying a fixed time delay between recovery and relaunch.

Any water accumulated inside the model is not to be drained prior to the relaunch.

If the model has taken up a heading to the waves that is not beam-on, then it is permissible to relaunch the model at that same heading.

In all the above cases, continuation runs are to be performed until the total duration of exposure to the wave condition is sufficient to establish that the 5-minute probability of capsizing has been determined with the required confidence of 95 %.

(5)  Results analysis

 Given that it has been demonstrated that the wave time series are non-repeating and statistically random, the results of the tests may be analysed on the assumption that each 5-minute element of the total time series is independent.

 If the model rotorcraft has not capsized during the total duration of the tests, the confidence that the probability of capsizing within 5 minutes is less than the target value of P_{capsize(target)}, as shown below:

 and so the total duration of the model test required without capsize is provided by:

where:

(A)  Ttest is the required full-scale duration of the test (in seconds);

(B)  Pcapsize(target) is the required maximum probability of capsizing within 5 minutes;

(C)  Tcriterion is the duration (in seconds) in which the rotorcraft must meet the no-capsize probability (= 5 x 60 s), as defined in CS 27.801(e); and

(D)  C is the required confidence that the probability of capsizing has been achieved (0.95).

 If the rotorcraft has capsized Ncapsize times during the tests, the probability of capsizing within 5 minutes can be estimated as:

and the confidence that the required capsize criteria have been met is:

 It should be noted that, if the rotorcraft is permitted to fly over sea conditions with significant wave heights (Hs) above the certification limit, then Pcapsiz(target) should be reduced by the probability of exceedance of the certification limit for the significant wave height (Pe) (see Appendix 2 below).

(c) Deliverables

(1)  A comprehensive report describing the model tests, the facility they were performed in, the model properties, the wave conditions used, the results of the tests, and the method of analysis to demonstrate compliance with CS 27.801(d) and (e).

(2)  Conclusions in this report are to clarify the compliance (or otherwise) with those provisions.

(3)  Digital video and data records of all tests performed.

(4)  A specification for a certification model test should also be expected to include:

(i)  an execution plan and timescale;

(ii)  formal progress reports on content and frequency; and

(iii) quality assurance requirements.

[Amdt No: 27/5]

Appendix 1 — Worked example

ED Decision 2018/007/R

The target 5-minute capsize probabilities for a rotorcraft certified to CS 27.801 are:

Certification with ditching provisions:

Fully serviceable emergency flotation system (EFS)  – 3 %

Critical flotation compartment failed     – 30 %

Certification with emergency flotation provisions:

Fully serviceable emergency flotation system (EFS)  – 10 %

Critical flotation compartment failed     – no demonstration required

One option available to the rotorcraft designer is to test at the selected wave height and demonstrate a probability of capsizing no greater than these values. However, to enhance offshore helicopter safety, some national aviation authorities (NAAs) have imposed restrictions that prevent normal operations (i.e. excluding emergencies, search and rescue (SAR), etc.) over sea conditions that are more severe than those for which performance has been demonstrated. In such cases, the helicopter may be operationally limited.

These operational restrictions may be avoided by accounting for the probability of exposure to sea conditions that exceed the selected wave height by certifying the rotorcraft for a lower probability of capsizing. Since it is conservatively assumed that the probability of capsizing in sea conditions that exceed the certified wave height is unity, the lower capsize probability required to be met is the target value minus the probability of the selected wave height being exceeded. However, it should also be noted that, in addition to restricting normal helicopter overwater operations to the demonstrated capability, i.e. the applicant’s chosen significant wave height limit (H_s(limit)), an NAA may declare a maximum limit above which all operations will be suspended due to the difficulty of rescuing persons from the sea in extreme conditions. There will, therefore, be no operational benefit in certifying a rotorcraft for sea conditions that exceed the national limits for rescue.

In the following examples, we shall use the three target probabilities of capsizing without any reduction to avoid operational restrictions. The test times quoted are full-scale times; to obtain the actual model test run time, these times should be divided by the square root of the model scale.

Certification with ditching provisions — fully serviceable EFS

Taking this first case, we need to demonstrate a ≤ 3 % probability of capsizing with a 95 % confidence. Applying equation (5)(i) above, this can be achieved with a 499-minute (full-scale time) exposure to the sea condition without a capsize.

Rearranging this equation, we have:

Alternatively, applying equation (5)(ii) above, the criterion would also be met if the model were seen to capsize just three times (for example) in a total 21.5 hours of exposure to the sea condition, or four times (for example) in a total of 25.5 hours of exposure.

Equation (ii) cannot be readily rearranged to solve T_test, so the easiest way to solve it is by using a spreadsheet on a trial-and-error method. For the four-capsize case, we find that a 25.5-hour exposure gives a confidence of 0.95.

Certification with ditching provisions — critical flotation compartment failed

In this case, we need to demonstrate a ≤ 30 % probability of capsizing with a 95 % confidence. This can be achieved with a 50-minute (full-scale time) exposure to the sea condition without a capsize.

As above, the criterion would also be met if the model were seen to capsize just three times (for example) in a total 2.2 hours of exposure to the sea condition, or four times (for example) in a total of 2.6 hours of exposure.

Solving by trial and error in a spreadsheet, we find that a 2.6-hour exposure with no more than four capsizes gives a confidence of 0.95.

Certification with emergency flotation provisions — fully serviceable EFS

In this case, we need to demonstrate a ≤ 10 % probability of capsizing with a 95 % confidence. By solving the equations as above, this can be achieved with a 150-minute (full-scale time) exposure to the sea condition without a capsize.

As above, the criterion would also be met if the model were seen to capsize just three times (for example) in a total 6.5 hours of exposure to the sea condition, or four times (for example) in a total of 7.6 hours of exposure.

Solving by trial and error in a spreadsheet we find that a 7.6-hour exposure with no more than four capsizes gives a confidence of 0.95.

Certification with ditching provisions — critical flotation compartment failed

As stated in CS 27.802(c), no demonstration of capsize resistance is required for the case of the critical float compartment having failed.

This is because the allowed factor of ten increase in the probability of capsizing, as explained in (a)(3) above, results in a probability of 100 %.

[Amdt No: 27/5]

Appendix 2 — Test specification rationale

ED Decision 2018/007/R

(a)  Introduction

The overall risk of capsizing within the 5-minute exposure period consists of two components: the probability of capsizing in a given wave condition, and the probability of experiencing that wave condition in an emergency landing on water.

If it is assumed that an emergency landing on water occurs at random and is not linked with weather conditions, the overall risk of a capsizing can be established by combining two pieces of information:

(1)  The wave climate scatter table, which shows the probability of meeting any particular combination of Hs and Tz. An example scatter table is shown below in Figure 1 — Example of all-year wave scatter table. Each cell of the table contains the probability of experiencing a wave condition with Hs and Tz in the range provided. Thus, the total of all cells in the table adds up to unity.

(2)  The probability of a capsizing in a 5-minute exposure for each of these height/period combinations. This probability of capsizing is different for each helicopter design and for each wave height/period combination, and is to be established through scale model testing using the method defined above.

In theory, a model test for the rotorcraft design should be performed in the full range of wave height/period combinations covering all the cells in the scatter table. Clearly, wave height/period combinations with zero or very low probabilities of occurrence might be ignored. It might also be justifiably assumed that the probability of capsizing at very high wave heights is unity, and at very low wave heights, it is zero. However, there would still remain a very large number of intermediate wave height/period combinations that would need to be investigated in model tests, and it is considered that such a test programme would be too lengthy and costly to be practicable.

The objective here is therefore to establish a justifiable method of estimating the overall 5-minute capsize probability using model test results for a single-wave condition. That is a single combination of Hs and Tz. Such a method can never be rigorously linked with the safety objective, but it is proposed that it may be regarded as a conservative approximation.

(b)  Test methodology

The proposed test methodology is as follows:

The rotorcraft designer selects a desired significant wave height limit Hs(limit) for ditching or the emergency flotation certification of his helicopter. Model tests are performed in the sea condition Hs(limit) Tz(limit) (where Tz(limit) is the zero-crossing period most likely to accompany Hs(limit)) with the selected spectrum shape using the method specified above, and the 5-minute probability of capsizing (Pcapsize) established in this sea condition.

The way in which Pcapsize varies for other values of Hs and Tz is not known because it is not proposed to perform model tests in all the other possible combinations. Furthermore, there is no theoretical method to translate a probability of capsizing from one sea condition to another.

However, it is known that the probability of capsizing is related to the exposure to breaking waves of sufficient height, and that this is in turn linked with wave steepness. Hence:

(1) the probability of capsizing is likely to be higher for wave heights just less than H_s(limit) but with wave periods shorter than T_z(limit); and

(2)  the probability of capsizing will be lower for the larger population of wave conditions with wave heights less than H_s(limit) and with wave periods longer than T_z(limit).

So, a reasonable and conservative assumption is that on average, the same P_capsize holds good for all wave conditions with heights less than or equal to H_s(limit).

A further conservative assumption is that P_capsize is unity for all wave heights greater than H_s(limit).

Using these assumptions, a comparison of the measured P_capsize in H_s(limit) T_z(limit) against the target probability of capsizing (P_{capsize(target)}) can be performed.

In jurisdictions where flying is not permitted when the wave height is above H_s(limit), the rotorcraft will have passed the certification criteria provided that P_capsize ≤ P_{capsize(target)}.

In jurisdictions where flying over waves greater than Hs(limit) is permitted, the rotorcraft will have passed the certification criteria provided that: Pcapsize ≤ Pcapsize(target) – Pe, where Pe is the probability of exceedance of Hs(limit). Clearly, in this case, it can be seen that it would not be permissible for the rotorcraft designer to select an Hs(limit) which has a probability of exceedance greater than Pcapsize(target).

Figure 1 — Example of all-year wave scatter table

[Amdt No: 27/5]

CS 27.802  Emergency Flotation

ED Decision 2018/007/R

If operating rules allow, and only certification for emergency flotation equipment is requested by the applicant, the rotorcraft must be designed as follows:

(a) The rotorcraft must be equipped with an approved emergency flotation system.

(b) The flotation units of the emergency flotation system, and their attachments to the rotorcraft, must comply with CS 27.563.

(c) The rotorcraft must be shown to resist capsize in the sea conditions selected by the applicant. The probability of capsizing in a 5-minute exposure to the sea conditions must be demonstrated to be less than or equal to 10.0 % with a fully serviceable emergency flotation system, with 95 % confidence. No demonstration of capsize resistance is required for the case of the critical float compartment having failed.

Allowances must be made for probable structural damage and leakage.

[Amdt No: 27/5]

AMC 27.802 Emergency Flotation

ED Decision 2018/007/R

This AMC replaces FAA AC 27 MG 10.

(a)  Definitions

(1)  Ditching: a controlled emergency landing on the water, deliberately executed in accordance with rotorcraft flight manual (RFM) procedures, with the intent of abandoning the rotorcraft as soon as practicable.

 NOTE: Although the term ‘ditching’ is most commonly associated with the design standards related to CS 27.801, a rotorcraft equipped to the less demanding requirements of CS 27.802, when performing an emergency landing on water, would nevertheless be commonly described as carrying out the process of ditching. The term ‘ditching’ is therefore used in this AMC in this general sense.

(2)  Emergency flotation system (EFS): a system of floats and any associated parts (e.g. gas cylinders, means of deployment, pipework and electrical connections) that is designed and installed on a rotorcraft to provide buoyancy and flotation stability during and after ditching.

(b)  Explanation

(1) Approval of emergency flotation equipment is performed only if requested by the applicant. Operational rules may accept that a helicopter conducts flights over certain sea areas provided it is fitted with approved emergency flotation equipment (i.e. an EFS), rather than being certified with full ditching provisions.

(2)  Emergency flotation certification encompasses emergency flotation system loads and design, and rotorcraft flotation stability.

(3) Failure of the EFS to operate when required will lead to the rotorcraft rapidly capsizing and sinking. Operational experience has shown that localised damage or failure of a single component of an EFS can lead to the loss of the complete system. Therefore, the design of the EFS needs careful consideration.

(4) The sea conditions, on which certification with emergency flotation is to be based, are selected by the applicant and should take into account the expected sea conditions in the intended areas of operation. Capsize resistance is required to meet the same requirements as for full ditching approval but with the allowable capsize probability being set at 10 %. The default wave climate specified in this requirement is that of the northern North Sea, as it represents a conservative condition. An applicant might consider this to be inappropriate, as it represents a hostile sea area. The applicant may therefore propose a different wave climate based on data from a non-hostile sea area. The associated certification will then be limited to the geographical region(s) thus represented. Alternatively, a non-hostile default wave climate might be agreed, with no associated need for geographical limits to the certification. The significant wave height, and any geographical limitations (if applicable, see the AMC to 27.801(e) and 27.802(c)) should be included in the RFM as performance information.

(5)  During scale model testing, appropriate allowances should be made for probable structural damage and leakage. Previous model tests and other data from rotorcraft of similar configurations that have already been substantiated based on equivalent test conditions may be used to satisfy the emergency flotation requirements. In regard to flotation stability, test conditions should be equivalent to those defined in the AMC to 27.801(e) and 27.802(c).

(6)  CS 27.802 requires that in sea conditions for which certification with emergency flotation is requested by the applicant, the probability of capsizing in a 5-minute exposure is acceptably low in order to allow the occupants to leave the rotorcraft and enter the life rafts. This should be interpreted to mean that up to and including the worst-case sea conditions for which certification with emergency flotation is requested by the applicant, the probability that the rotorcraft will capsize should be not higher than the target stated in CS 27.802(c). An acceptable means of demonstrating post-ditching flotation stability is through scale model testing using irregular waves. The AMC to 27.801(e) and 27.802(c) contains a test specification that has been developed for this purpose.

(7)  Providing a ‘wet floor’ concept (water in the cabin) by positioning the floats higher on the fuselage sides and allowing the rotorcraft to float lower in the water can be a way of increasing the stability of a ditched rotorcraft (although this would need to be verified for the individual rotorcraft type for all weight and loading conditions), or it may be desirable for other reasons. This is permissible provided that the mean static level of water in the cabin is limited to being lower than the upper surface of the seat cushion (for all rotorcraft mass and centre of gravity cases, with all flotation units intact), and that the presence of water will not unduly restrict the ability of occupants to evacuate the rotorcraft and enter the life raft.

(8)  The sea conditions approved for ditching should be stated in the performance information section of the RFM.

(c)  Procedures

(1) Flotation system design

(i)  Structural integrity should be established in accordance with CS 27.563. CS 27.802(a) only requires the floats and their attachments to the rotorcraft to be designed to withstand the load conditions defined in CS 27.563. Other parts of the rotorcraft (e.g. fuselage underside structure, chin windows, doors) do not need to be shown to be capable of withstanding these load conditions.

(ii)  Rotorcraft handling qualities should be verified to comply with the applicable certification specifications throughout the approved flight envelope with floats installed. Where floats are normally deflated and deployed in flight, the handling qualities should be verified for the approved operating envelopes with the floats in:

(A) the deflated and stowed condition;

(B) the fully inflated condition; and

(C) the in-flight inflation condition; for float systems which may be inflated in flight, rotorcraft controllability should be verified by test or analysis taking into account all possible emergency flotation system inflation failures.

(iii)  Reliability should be considered in the basic design to assure approximately equal inflation of the floats to preclude excessive yaw, roll, or pitch in flight or in the water:

(A)  Maintenance procedures should not degrade the flotation system (e.g. introducing contaminants that could affect normal operation, etc.).

(B) The flotation system design should preclude inadvertent damage due to normal personnel traffic flow and wear and tear. Protection covers should be evaluated for function and reliability.

(C) The designs of the floats should provide means to minimise the likelihood of damage or tear propagation between compartments. Single compartment float designs should be avoided.

(iv) The floats should be fabricated from highly conspicuous materials to assist in locating the rotorcraft following a ditching (and possible capsize).

(2) Flotation system inflation

 Emergency flotation systems (EFSs) which are normally stowed in a deflated condition and are inflated either in flight or after water contact should be evaluated as follows:

(i) The emergency flotation system should include a means to verify system integrity prior to each flight.

(ii) If a manual means of inflation is provided, the float activation switch should be located on one of the primary flight controls and should be safeguarded against inadvertent actuation.

(iii)  The inflation system should be safeguarded against spontaneous or inadvertent actuation in flight conditions for which float deployment has not been demonstrated to be safe.

(iv)  The maximum airspeeds for intentional in-flight actuation of the emergency flotation system and for flight with the floats inflated should be established as limitations in the RFM unless in-flight actuation is prohibited by the RFM.

(v)  Activation of the emergency flotation system upon water entry (irrespective of whether or not inflation prior to water entry is the intended operation mode) should result in an inflation time short enough to prevent the rotorcraft from becoming excessively submerged.

(vi)  A means should be provided for checking the pressure of the gas stowage cylinders prior to take-off. A table of acceptable gas cylinder pressure variation with ambient temperature and altitude (if applicable) should be provided.

(vii)  A means should be provided to minimise the possibility of over-inflation of the flotation units under any reasonably probable actuation conditions.

(viii) The ability of the floats to inflate without puncturing when subjected to actual water pressures should be substantiated. A demonstration of a full-scale float immersion in a calm body of water is one acceptable method of substantiation. Precautions should also be taken to avoid floats being punctured due to the proximity of sharp objects, during inflation in flight or with the helicopter in the water, and during subsequent movement of the helicopter in waves. Examples of objects that need to be considered are aerials, probes, overboard vents, unprotected split-pin tails, guttering and any projections sharper than a three-dimensional right angled corner.

(3)  Injury prevention during and following water entry.

 An assessment of the cabin and cockpit layouts should be undertaken to minimise the potential for injury to occupants in a ditching. This may be performed as part of the compliance with CS 27.785. Attention should be given to the avoidance of injuries due to leg/arm flailing, as these can be a significant impediment to occupant egress and subsequent survivability. Practical steps that could be taken include:

(i)  locating potentially hazardous items away from the occupants;

(ii) installing energy-absorbing padding onto interior components;

(iii) using frangible materials; and

(iv) designs that exclude hard or sharp edges.

(4)  Water entry procedures.

 Tests or simulations (or a combination of both) should be conducted to establish procedures and techniques to be used for water entry. These tests/simulations should include determination of the optimum pitch attitude and forward velocity for ditching in a calm sea, as well as entry procedures for the most severe sea condition to be certified. Procedures for all failure conditions that may lead to a ‘land immediately’ action (e.g. one engine inoperative, all engines inoperative, tail rotor/drive failure) should be established.

(5) Flotation stability tests.

 An acceptable means of flotation stability testing is contained in AMC to 27.801(e) and 27.802(c). Note that model tests in a wave basin on a number of different rotorcraft types have indicated that an improvement in seakeeping performance can consistently be achieved by fitting float scoops.

(6) Occupant egress and survival.

 The ability of the occupants to deploy life rafts, egress the rotorcraft, and board the life rafts should be evaluated. For configurations which are considered to have critical occupant egress capabilities due to the life raft locations or the emergency exit locations and the proximity of the float (or a combination of both), an actual demonstration of egress may be required. When a demonstration is required, it may be conducted on a full-scale rotorcraft actually immersed in a calm body of water or using any other rig or ground test facility shown to be representative. The demonstration should show that floats do not impede a satisfactory evacuation. Service experience has shown that it is possible foroccupants to have escaped from the cabin but to have not been able to board a life raft and to have had difficulty in finding handholds to stay afloat and together. Handholds or lifelines should be provided on appropriate parts of the rotorcraft. The normal attitude of the rotorcraft and the possibility of a capsize should be considered when positioning the handholds or lifelines.

[Amdt No: 27/5]

CS 27.805  Flight crew emergency exits

ED Decision 2018/007/R

(a) For rotorcraft with passenger emergency exits that are not convenient to the flight crew, there must be flight crew emergency exits, on both sides of the rotorcraft or as a top hatch, in the flight crew area.

(b) Each flight crew emergency exit must be of sufficient size and must be located so as to allow rapid evacuation of the flight crew and must be marked so as to be readily located and operated even in darkness. This must be shown by test.

(c) Underwater emergency exits for flight crew. If certification with ditching provisions is requested by the applicant, none of the flight crew emergency exits required by (a) and (b) may be obstructed by water or flotation devices after an emergency landing on water and each exit must shown by test, demonstration, or analysis to provide for rapid escape with the rotorcraft in the upright floating position or capsized. Each operational device (pull tab(s), operating handle, ‘push here’ decal, etc.) must be marked with black and yellow stripes and must be shown to be accessible for the range of flight crew heights as required by CS 27.777(b) and for both the case of an un-deformed seat and a seat with any deformation resulting from the test conditions required by CS 27.562. Flight crew emergency exits must be reasonably protected from becoming jammed as a result of fuselage deformation. The markings required by (b) must remain visible if the rotorcraft is capsized and the cabin is submerged.

[Amdt No: 27/5]

AMC 27.805(c) Flight crew emergency exits

ED Decision 2018/007/R

This AMC supplements FAA AC 27.805.

(a) Explanation

To facilitate a rapid escape, flight crew underwater emergency exits should be designed for use with the rotorcraft in both the upright position and in any foreseeable floating attitude. The flight crew underwater emergency exits should not be obstructed during their operation by water or floats to the extent that rapid escape would not be possible or that damage to the flotation system may occur. This should be substantiated for any rotorcraft floating attitude, upright or capsized, and with the emergency flotation system intact and with any single compartment failed. With the rotorcraft capsized and floating, the flight crew underwater emergency exits should be usable with the cabin flooded, and the markings required to enable occupants to escape in darkness should continue to function when the rotorcraft is capsized and the cabin is submerged.

(b)  Procedures

(1) It should be shown by test, demonstration or analysis that there is no interference with the flight crew underwater emergency exits from water or any stowed or deployed emergency flotation devices, with the rotorcraft in any foreseeable floating attitude.

(2) Flight crew should be able to reach the operating device for their underwater emergency exit, whilst seated, with restraints fastened, with seat energy absorption features at any design position, and with the rotorcraft in any attitude.

(3) Likely damage sustained during a ditching should be considered.

(4) It is acceptable for the underwater emergency exit threshold to be below the waterline when the rotorcraft is floating upright, but in such a case, it should be substantiated that there is no obstruction to the use of the exit and that no excessive force (see FAA AC 29.809) is required to operate the exit.

(5) It is permissible for flight crew to be unable to directly enter life rafts from the underwater flight crew emergency exits and to have to take a more indirect route, e.g. by climbing over a forward flotation unit. In such a case, the feasibility of the exit procedure should be assessed. Handholds may need to be provided on the rotorcraft.

(6)  CS 27.807(b)(3) requires emergency exit markings to be provided and enable the emergency exit to be located and operated in darkness. Furthermore, CS 27.805(c) requires these illuminated markings to continue to function if the cabin becomes submerged. This should be shown by test, demonstration or analysis.

(7) To make it easier to recognise underwater, the operating device for the underwater emergency exit should have black and yellow markings with at least two bands of each colour of approximately equal widths. Any other operating feature, e.g. highlighted ‘push here’ decal(s) for openable windows, should also incorporate black-and-yellow-striped markings.

[Amdt No: 27/5]

CS 27.807  Passenger emergency exits

ED Decision 2018/007/R

(a) Number and location.

(1) There must be at least one emergency exit on each side of the cabin readily accessible to each passenger. One of these exits must be usable in any probable attitude that may result from a crash;

(2) Doors intended for normal use may also serve as emergency exits, provided that they meet the requirements of this CS; and

(3) If emergency flotation devices are installed, there must be an emergency exit accessible to each passenger on each side of the cabin that is shown by test, demonstration, or analysis to open without interference from flotation devices, whether stowed or deployed, and with the rotorcraft floating either upright or capsized.

(b) Type and operation. Each emergency exit prescribed by (a) or (d) must:

(1) Consist of a moveable window or panel, or additional external door, providing an unobstructed opening that will admit a 0.48 m by 0.66 m (19 inch by 26 inch) ellipse;

(2) Have simple and obvious methods of opening, from the inside and from the outside, which do not require exceptional effort;

(3) Be arranged and marked so as to be readily located and operated even in darkness; and

(4) Be reasonably protected from becoming jammed as result of fuselage deformation.

(c) Tests. The proper functioning of each emergency exit must be shown by test.

(d) Underwater emergency exits for passengers. If certification with ditching provisions is requested by the applicant, underwater emergency exits must be provided in accordance with the following requirements and must be proven by test, demonstration, or analysis to provide for rapid escape with the rotorcraft in the upright floating position or capsized:

(1) One underwater emergency exit, meeting the size requirements of (b) above, must be installed in each side of the rotorcraft for each unit (or part of a unit) of four passenger seats. However, the seat-to-exit ratio may be increased for underwater emergency exits large enough to permit the simultaneous egress of two passengers side by side. Passenger seats must be located in relation to the underwater emergency exits in a way to best facilitate escape with the rotorcraft capsized and the cabin flooded.

(2) Underwater emergency exits, including their means of operation, markings, lighting and accessibility, must be designed for use in a flooded and capsized cabin.

(3) Each underwater emergency exit must be provided with a suitable handhold, or handholds adjacently located inside the cabin, to assist occupants in locating and operating the exit, as well as in egressing through the underwater emergency exit.

(4) The markings required by sub-paragraph (b)(3) must be designed to remain visible if the rotorcraft is capsized and the cabin is submerged.

(5) Each operational marking (pull tab(s), operating handle, ‘push here’ decal, etc.) must be marked with black and yellow stripes.

[Amdt No: 27/5]

AMC 27.807(d) Underwater emergency exits for passengers

ED Decision 2018/007/R

This AMC replaces FAA AC 27.807, AC 27.807A and AC 27.807B.

(a) Explanation

CS-27 Amendment 5 re-evaluates the need for and the concept behind emergency exits for rotorcraft approved with ditching provisions. Prior to CS-27 Amendment 5, there were no additional ditching provisions for rotorcraft certified for ditching with regard to the number of emergency exits.

Operational experience has shown that in a ditching in which the rotorcraft remains upright, use of the passenger doors can be very beneficial in ensuring a rapid and orderly evacuation onto the life raft(s). However, when a rotorcraft capsizes, doors may be unusable and the number and availability of emergency exits that can be readily used underwater will be crucial to ensuring that passengers are able to escape in a timely manner. Experience has shown that the number of emergency exits required in the past by design requirements has been inadequate in a capsized situation, and a common design solution has been to use the passenger cabin windows as additional emergency egress means by including a jettison feature. The jettison feature has commonly been provided by modifying the elastomeric window seal such that its retention strength is either reduced, or can be reduced by providing a removable part of its cross section, i.e. the so called ‘push out’ window, although other design solutions have been employed. The provision of openable windows has been required by some air operations regulations.

In recognition of this identified need for an increased number of exits for underwater escape, Amendment 5 created a new set of exit terminology and CS 27.807(d)(1) was revised to require one pair of ‘underwater emergency exits’, i.e. one on each side of the rotorcraft, to be provided for each unit, or part of a unit, of four passenger seats, and passenger seats to be located relative to these exits in a way to best facilitate escape. This new terminology was seen as describing the real intent of this higher number of required emergency exits for rotorcraft approved with ditching provisions.

The objective is for no passenger to be in a worse position than the second person to egress through an exit. The size of each underwater emergency exit should at least meet the dimensional provisions of CS 27.807(b)(1), i.e. it should provide an unobstructed opening through which a 0.48 m x 0.66 m (19 in. x 26 in.) elliptical object could pass.

This provision is based on the need to facilitate egress in the case of a capsize that occurs soon after the rotorcraft has alighted on the water or in the event of a survivable water impact in which the cabin will likely be immediately flooded. The time available for evacuation is very short in such situations, and therefore, CS-27 Amendment 5 has increased the safety level by mandating additional exits, in the form of underwater emergency exits, to both shorten available escape routes and to ensure that no occupant should need to wait for more than one other person to escape before being able to make their own escape. The provision of an underwater emergency exit in each side of the fuselage for each unit (or part of a unit) of four passenger seats will make this possible, provided that seats are positioned relative to the exits in a favourable manner.

Critical evacuation factors are the distance to an underwater emergency exit and how direct and obvious the exit route is, taking into account that the passengers are likely to be disoriented.

So called ‘push-out’ windows (see above) have some advantages in that they are not susceptible to jamming and may open by themselves in a water impact due to flexing of the fuselage upon water entry and/or external water pressure.

The risk of a capsize during evacuation onto the life rafts can be mitigated to some extent by instructing passengers to open all the underwater emergency exits as a matter of course soon after the helicopter has alighted on the water, thus avoiding the delay due to opening the exits in the event that the exits are needed. Such advice should be considered for inclusion in the documentation provided to the helicopter operator.

(b)  Procedures

(1) The number and the size of underwater emergency exits should be as specified above.

(2)  Care should be taken regarding oversized exits to avoid them becoming blocked if more than one passenger attempts to use the same exit simultaneously.

(3)  A higher seat-to-exit ratio may be accepted if the exits are large enough to allow the simultaneous escape of more than one passenger. For example, a pair of exits may be approved for eight passengers if the size of each exit provides an unobstructed area that encompasses two ellipses of 0.48 m x 0.66 m (19 in. x 26 in.) side by side.

(4)  Test, demonstration, compliance inspection, or analysis is required to substantiate that an exit is free from interference from stowed or deployed emergency flotation devices. In the event that an analysis or inspection is insufficient or that a given design is questionable, a test or demonstration may be required. Such a test or demonstration would consist of an accurate, full-size replica (or true representation) of the rotorcraft and flotation devices, both when stowed and after their deployment.

(5)  Consideration should be given to reducing the potential confusion caused by the lack of standardisation of the location of the operating devices (pull tab, handle) for underwater emergency exits. For example, the operating device should be located next to the handhold (see (10) below). The occupant then has only to find the handhold to locate the operating device. Each adjacent occupant should be able to reach the handhold and operating device whilst seated, with restraints fastened, with seat energy absorption features at any design position, and with the rotorcraft in any attitude. If a single underwater emergency exit is designed for the simultaneous egress of two occupants side by side, a handhold and an operating device should be within reach of each occupant seated adjacent to the exit.

(6)  Underwater emergency exits should be shown to be operable with the rotorcraft in any foreseeable attitude, including with the rotorcraft capsized.

(7) Underwater emergency exits should be designed so that they are optimised for use with the rotorcraft capsized. For example, the handhold(s) should be located close to the bottom of the window (top if inverted) to assist an occupant in overcoming the buoyancy loads of an immersion suit, and by ensuring that markings and lighting will help identify the exit(s) and readily assist in an escape.

(8) The means to open an underwater emergency exit should be simple and obvious and should not require any exceptional effort. Designs with any of the following characteristics (non-exhaustive list) are considered to be non-compliant:

(i) More than one hand is needed to operate the exit itself (use of the handhold may occupy the other hand);

(ii)  Any part of the opening means, e.g. an operating handle or control, is located remotely from the exit such that it would be outside of a person’s direct vision when looking directly at the exit, or that the person needs to move away from the immediate vicinity of the exit in order to reach it; and

(iii)  The exit does not meet the opening effort limitations set by FAA AC 29.809.

(9)  It should be possible to readily grasp and operate any operating handle or control using either a bare or a gloved hand.

(10) Handholds, as required by CS 27.807(d)(3), should be mounted close to the bottom of each underwater emergency exit such that they fall easily to hand for a normally seated occupant. In the case of exits between face-to-face seating, the provision of two handholds is required. Handholds should be designed such that the risk is low of escapees’ clothing or emergency equipment snagging on them.

(11)  To make it easier to recognise underwater, the operating device for the underwater emergency exit should have black and yellow markings with at least two bands of each colour of approximately equal widths. Any other operating features, e.g. highlighted ‘push here’ decal(s) for openable windows, should also incorporate black-and-yellow-striped markings.

(12)  With regard to the location of seats relative to the exits, the most obvious layout that maximises achievement of the objective that no passenger is in a worse position than the second person to egress through an exit is a four-abreast arrangement with all the seats in each row located appropriately and directly next to the emergency exits. However, this might not be possible in all rotorcraft designs due to issues such as limited cabin width, the need to locate seats such as to accommodate normal boarding and egress, and the installation of items other than seats in the cabin. Notwithstanding this, an egress route necessitating movement such as along an aisle, around a cabin item, or in any way other than directly towards the nearest emergency exit, to escape the rotorcraft is not considered to be compliant with CS 27.807(d)(1).

[Amdt No: 27/5]

CS 27.831  Ventilation

ED Decision 2003/15/RM

(a) The ventilating system for the pilot and passenger compartments must be designed to prevent the presence of excessive quantities of fuel fumes and carbon monoxide.

(b) The concentration of carbon monoxide may not exceed one part in 20 000 parts of air during forward flight or hovering in still air. If the concentration exceeds this value under other conditions, there must be suitable operating restrictions.

CS 27.833  Heaters

ED Decision 2003/15/RM

Each combustion heater must be approved.