AC 20-136C
11.2 Step 2 – Define System Lightning Protection F eatures.
Define the lightning protection features to be incorporated into the system designs, based on the lightning environments that are applicable to LCL B and C systems.
Equipment and system lightning protection design may occur before you perform aircraft-level tests and before you determine the actual internal lightning environment.
Therefore, you should base the equipment and system lightning protection design on an estimate of the expected internal lightning environment.
11.3 Step 3 – Establish ETDLs.
11.3.1 You may use the ATLs determined during aircraft tests or analyses performed for LCL A systems to establish appropriate ETDLs for LCL B and C systems.
11.3.2 Alternatively, you may use the definitions in RTCA/DO-160, section 22 to select appropriate ETDLs for your LCL B and C systems. The following should be considered when selecting an appropriate level:
• Use RTCA/DO-160, section 22, level 3 for most LCL B systems.
• For LCL B systems and associated wiring installed in aircraft areas with more severe lightning transients, use RTCA/DO-160, section 22, level 4 or 5 as appropriate to the environment. Examples of aircraft areas with more severe lightning transients are those external to the fuselage, areas with composite structures showing poor shielding effectiveness, and other open areas.
• Use RTCA/DO-160, section 22, level 2 for most LCL C systems.
• For LCL C systems installed in aircraft areas with more severe lightning transients, use RTCA/DO-160, section 22, level 3. Examples of aircraft areas with more severe lightning transients are those external to the fuselage, areas with composite structures showing poor shielding effectiveness, and other open areas.
• Provide the cognizant certification branch with a description of your aircraft and system installation features to substantiate the RTCA/DO-160, section 22 levels selected for your system.
11.4 Step 4 – Select the ETDL Verification Method.
Determine whether to perform equipment lightning tests on LCL B and C systems, or whether to base compliance on previous equipment qualification tests performed on a similar system.
11.5 Step 5 – Verify System ETDLs Using Equipment Qualification Tests.
11.5.1 You should perform equipment qualification tests using the selected test levels and single stroke, multiple stroke, and multiple burst waveform sets. Demonstrate that the equipment operates within the defined pass/fail criteria during these tests. No equipment damage should occur during these equipment qualification tests or during single stroke pin injection tests using the defined ETDLs. RTCA/DO-160, section 22, provides acceptable test procedures and waveform set definitions.
AC 20-136C
11.5.2 Y ou should evaluate any equipment effects observed during the qualification tests to ensure these do not adversely affect the system’s continued performance. You should obtain the cognizant certification branch’s approval of your evaluation.
11.5.3 Multiple stroke and multiple burst testing is not required if an analysis shows that the equipment is not susceptible to upset, or that the equipment may be susceptible to upset, but a reset capability exists so the system recovers in a timely manner.
11.6 Step 6 – Verify System ETDLs Using Existing Equipment Data (Similarity).
11.6.1 You may verify ETDLs by similarity to previously certified systems without performing more tests. You may do this when:
• There are only minor differences between the previously certified system and installation, and the system and installation to be certified;
• There are no unresolved in-service system problems related to lightning strikes on the previously certified system; and
• The previously certified system ETDLs were verified by qualification tests.
11.6.2 The assessment should cover:
• Equipment interface circuits;
• Wire size, routing, arrangement (parallel or twisted wires), connector types, wire shields, and shield terminations;
• Lightning protection devices such as transient suppressors and lightning arrestors;
• Grounding and bonding; and
• Equipment software, firmware, and hardware.
11.6.3 If significant differences are found that will affect the systems and installations, you should perform more tests and analyses to resolve the open issues.
11.7 Step 7 – Verify Compliance with the Requirements.
You should demonstrate that the LCL B and C systems meet their defined acceptance criteria during the qualification tests at the selected system ETDLs.
11.8 Step 8 – Take Corrective Measures.
When your system fails to meet the certification requirements, you should decide on corrective actions. If you change or modify the system or installation, you may need to repeat equipment qualification testing. You should review these changes or modifications with the cognizant certification branch to determine if they are significant. If these changes or modifications are significant, update your lightning certification plan accordingly. The updated certification plan should be resubmitted to the certification branch for review.
AC 20-136C 12 MAINTENANCE, PROTECTION ASSURANCE, AN D MODIFICATIONS.
12.1 The minimum maintenance necessary to support lightning certification must be identified in the instructions for continued airworthiness (ICA) as required by §§ 23.1529, 25.1529, 25.1729,
26.11, 27.1529, or § 29.1529.
12.2 Dedicated devices or specific features may be needed to provide lightning protection for an equipment or system installation. You should define appropriate maintenance procedures for these devices and features to ensure in-service protection integrity. The maintenance procedures should address the effects of corrosion, fretting, flexing cycles, or other causes that could degrade these lightning protection devices. Whenever applicable, you should identify specific replacement times of these devices and features.
12.3 A lightning protection assurance program may be necessary to verify that the maintenance procedures are adequate. This assurance program may propose a surveillance program based on a sampling of the fleet for monitoring the effectiveness of the protection features and/or maintenance procedures. See SAE ARP5415 for more information on these topics.
12.4 Aircraft or system modifications should be assessed for the impact any changes will have on the lightning protection. You should base this assessment on analysis and/or measurement.
AC 20-136C Appendix A Appendix A. Definitions The following definitions apply to this AC:
Adverse Effect A response that results in an unexpected and unacceptable operation of an aircraft system, or in an unexpected and unacceptable operation of a function performed by the system.
Actual Transient Level (ATL) The level of transient voltage or current that appears at the equipment interface circuits because of the external environment. This level may be less than or equal to the transient control level but should not be greater.
Aperture An electromagnetically transparent opening.
Attachment Point A point where the lightning flash contacts the aircraft.
Automatically Recover To return to normal operations without flightcrew action.
Channel A subset of a system consisting of equipment, components, and interconnections, which performs an aircraft function provided by the system. A system could be composed of redundant similar or dissimilar channels in order to maintain the function at the aircraft level in case of failure on one or several channels.
Component Damage A condition in which transients permanently alter the electrical characteristics of a circuit. Because of this, the component can no longer perform to its specifications.
Continued Safe Flight and Landing Capability for continued controlled flight and landing at a suitable location, possibly using emergency procedures, but without requiring exceptional pilot skill or strength. Some aircraft damage may occur as a result of the failure condition during flight or upon landing.
Direct Effects A-1
AC 20-136C Appendix A Physical damage to the aircraft or electrical and electronic systems. Direct attachment of lightning to the system’s hardware or components causes the damage. Examples of direct effects include tearing, bending, burning, vaporization, or blasting of aircraft surfaces and structures, and damage to electrical and electronic systems.
Electrical and Electronic System An electrical and electronic system means all electrical and electronic equipment, components, and the electrical interconnections that are required to perform a particular function.
Electrical Interface A location on electrical and electronic equipment where an electrical connection is established. The electrical interface may include individual wires or wire bundles which connect the equipment.
Equipment Component of an electrical or electronic system with interconnecting electrical conductors.
Equipment Transient Design Level (ETDL) The peak voltage and current amplitudes and transient waveforms that the equipment should withstand without any adverse effects during qualification testing.
External Environment The natural lightning environment, outside the aircraft, for design and certification purposes. See AC 20-155, which references documents that provide additional guidance on aircraft lightning environment and related waveforms.
Function The specific action of a system, equipment, and flight crew performance aboard the aircraft that, by itself, provides a completely recognizable operational capability. For example, “display aircraft heading to the pilots” is a function. One or more systems may perform a specific function, or one system may perform multiple functions.
Immunity Capacity of a system or piece of equipment to continue to perform its intended function, in an acceptable manner, in the presence of lightning currents.
Indirect Effects Electrical transients induced by lightning in aircraft electrical or electronic circuits.
A-2
AC 20-136C Appendix A
Internal Environment The potential fields and structural voltages inside the aircraft produced by the external environment.
Lightning Flash The total lightning event. It may occur in a cloud, among clouds, or between a cloud and the ground.
It can consist of one or more return strokes, plus intermediate or continuing currents.
Lightning Strike Attachment of the lightning flash to the aircraft.
Lightning Strike Zones Aircraft surface areas and structures that are susceptible to lightning attachment, dwell time, and current conduction. See AC 20-155, which references documents that provide additional guidance on aircraft lightning zoning.
Lightning Stroke (Return Stroke) A lightning current surge that occurs when the lightning leader (the initial current charge) makes contact with the ground or another charge center. A charge center is an area of high potential of opposite charge.
Margin The difference between the equipment transient design levels and the actual transient level.
Multiple Burst A randomly spaced series of bursts of short duration, low amplitude current pulses, with each pulse characterized by rapidly changing currents. These bursts may result as the lightning leader progresses or branches and are associated with the cloud-to-cloud and intra-cloud flashes. The multiple bursts appear most intense when the initial leader attaches to the aircraft. See AC 20-155.
Multiple Stroke Two or more lightning return strokes during a single lightning flash. See AC 20-155.
Non-Normal Situation An event, condition, or situation that requires non-normal, abnormal, emergency, or unusual procedures or configurations for operating the aircraft.
A-3
AC 20-136C Appendix A
Normal Operation The status where the system is performing its intended function.
Note: When addressing compliance with §§ 23.1306(a)(2) (amendment 23-61), 23.2515(a)(2),
25.1316(a)(2), 27.1316(a)(2), or § 29.1316(a)(2), the function whose failure is catastrophic (would prevent the continued safe flight and landing) should be in the same undisturbed state as before exposure to the lightning environment.
Timely Manner The maximum allowable period for a system to reconfigure safely after a disruption.
Note: Timely recovery has been introduced to account for this period. The meaning of ‘in a timely manner’ depends on the function performed by the system being evaluated, the specific system design, the interactions between the system and the flight crew, and the phase of flight. The definition of ‘in a timely manner’ should be determined for each system and for the specific functions performed by the system. The applicable definition may be included in the lightning certification plan.
Transient Control Level (TCL) The maximum allowable level of transients that appear at the equipment interface circuits because of the defined external environment.
Upset Impairment of system operation, either permanent or momentary. For example, a change of digital or analog state that may or may not require a manual reset.
A-4
AC 20-136C Appendix B Appendix B. Acronyms The following acronyms are referenced in this AC:
14 CFR Title 14 of the Code of Federal Regulations
AC Advisory Circular
ARP Aerospace Recommended Practice
ATL Actual Transient Level
EASA European Union Aviation Safety Agency
ETDL Equipment Transient Design Level
EUROCAE European Organization for Civil Aviation Equipment
FAA Federal Aviation Administration
HIRF High-intensity Radiated Fields
ICA Instructions for Continued Airworthiness
IFR Instrument Flight Rules
LCL Lightning Certification Level
SAE Society of Automotive Engineers
TCL Transient Control Level
VFR Visual Flight Rule B-1
AC 20-136C Appendix C
Appendix C. Examples of Lightning Safety Assessment Considerations - LCL A Systems on Transport Category Airplanes C.1 EXAMPLES OF LIGHTNING SAFETY ASSESSMENT CONSIDERATIONS C.1.1 This appendix contains examples of lightning safety assessment considerations for LCL A systems on transport category airplanes. These lightning safety assessment considerations for LCL A systems may be applicable to normal category airplanes and rotorcraft. Establishing appropriate pass-fail criteria for complying with § 25.1316(a) should be achieved through a comprehensive review of the system design using an acceptable lightning functional hazard assessment process to determine the system’s LCL. The following paragraphs summarize approaches whereby pass-fail criteria for compliance with § 25.1316(a) may depend on the specific system architecture attributes (for example, system with similar redundant channels, dissimilar redundant channels, combination of similar and dissimilar redundant channels).
C.1.2 For evaluation of the examples in paragraph C.1.3 of this appendix, consider the specific system architecture attributes. Systems are typically categorized with the following architectures:
C.1.2.1 Similar Redundant Channels.
The multiple channels consist of equipment, components, electrical interconnections, and configurations that are similar, typically with equipment that have identical part numbers. The channels should be independent. They may be configured in active, active-backup, and passive-backup modes.
C.1.2.2 Dissimilar Redundant Channels.
Each channel is independent of the others and unique (comprises different equipment, components, electrical interconnections, and configurations).
They may be configured in active, active-backup, and passive-backup modes.
C.1.2.3 Combination of Similar and Dissimilar Redundant Channels.
The combination of similar redundant channels and dissimilar redundant channels, as defined above, with independence between channels. They may be configured in active, active-backup, and passive-backup modes.
Note 1: Active mode means the channel is performing the aircraft function during normal operation.
Note 2: Active-backup mode means the channel is operational (in the ready state), but not used to perform the aircraft function until switched to active mode, either automatically or by flightcrew action.
C-1
AC 20-136C A ppendix C
Note 3: Passive-backup mode means the channel is not operational (not in the ready state). Switching to active mode is either automatic or by flightcrew action upon failure recognition.
C.1.2.4 Combination of Electrical and Electronic and Mechanical, Hydraulic, and/or Pneumatic Channels. Certain architectures combine electrical and electronic channels with mechanical, hydraulic, and/or pneumatic channels. These combinations of channels may be configured in active, active-backup, and passive-backup modes.
Note: The examples in paragraph C.1.3 of this appendix are theoretical and do not account for all possible configurations but instead represent common system architectures or those that present unique challenges.
C.1.3 This appendix illustrates the following examples (Example C-1 through Example C-8) of aircraft systems with multiple independent and redundant channels performing a function whose failure would prevent continued safe flight and landing of the aircraft.
C-2
AC 20-136C Appen dix C
Example C-1 Information Essential to Continued Safe Flight and Landing Function System Channel System Channel System Channel Display of attitude, altitude, and airspeed information to the pilots during operation under IFR (e.g., primary display system and associated sensors, with dissimilar standby display system and sensors).
Active (pilot displays and associated sensors).
Active (co-pilot displays and associated sensors).
Active-backup (dissimilar standby display and associated sensors).
Applicable paragraph in § 25.1316 (a)(1) and (2) (a)(1) and (2) (b) Discussion:
This example illustrates the requirement in § 25.1333 for the instruments at each pilot station to independently display information essential to the safety of flight. The standby display is necessary for the system to comply with § 25.1309. Either the pilot or co-pilot can be the pilot flying or pilot monitoring during normal operations, so both the pilot and co-pilot display system could be the active system.
Compliance with § 25.1316(a)(1) and (2) should demonstrate that each pilot instrument display of aircraft attitude, altitude, and airspeed is not adversely affected when the aircraft is exposed to lightning and recovers normal operation after the aircraft is exposed to lightning. The dissimilar standby display should comply with § 25.1316(b) based on the aircraft safety assessment identifying a hazardous failure condition (LCL B). Adverse effects include both loss of, and hazardously misleading, attitude, altitude, and airspeed information.
C-3
AC 20-136C Appendix C
Example C-2 Electronic Flight Control System Function System Channel System Channel System Channel Full authority control of pitch, yaw, and roll using electrical and electronic flight control systems Active or activebackup (flight control system #1) Active or activebackup (flight control system #2) Active or activebackup (flight control system #3) Applicable paragraph in § 25.1316 (a)(1) and (2) (a)(1) and (2) (a)(1) and (2) Discussion:
This example illustrates an electronic flight control system comprising three independent channels to comply with § 25.1309. At any time, any one of the three channels can operate as the active channel. This may be necessary to achieve the safety intent or maintain reliability, priority scheme, voting logic, etc.
Only one channel operates in active mode while others are in active-backup mode. Any channel can perform the control function at any one time; therefore, all channels must comply with § 25.1316(a)(1) and (2).
C-4