U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Airworthiness and Operational Approval of Digital Flight Data Recorder Systems Date: 12/08/08 Initiated by: AIR-130 AC No: 20-141A Change:
FOREWORD This advisory circular (AC) provides Federal Aviation Administration (FAA) information on certification (design and installation) and continued airworthiness of digital flight data recorder systems (DFDRS). DFDRS provide information for an investigative authority—the National Transportation Safety Board (NTSB) in the United States—to conduct more thorough investigations of accidents and incidents. The data recorded is also available to industry to enable the prediction of trends that may be useful in determining modifications needed to avoid accidents and incidents.
This AC provides information to applicants for a Supplemental Type Certificate (STC), and to individuals who are responsible for establishing and maintaining compliance under the operating rules for digital flight data recorders (DFDR). Aircraft manufacturers who intend to install DFDRs in newly manufactured aircraft could also use this information.
This AC is not mandatory and is not a regulation. It outlines one method of compliance with Title 14 of the Code of Federal Regulations (14 CFR). Applicants may follow alternate methods, provided the alternate method is acceptable to the Administrator for compliance with 14 CFR.
Because the method of compliance presented in this AC is not mandatory, the term “must” used herein applies only to an applicant who chooses to follow this particular method without deviation.
ORIGINAL SIGNED by ORIGINAL SIGNED by John M. Allen for Dorenda D. Baker for
James J. Ballough John Hickey Director, Flight Standards Service Dir ector, Aircraft Certification Service
Page iii (and iv)
CONTENTS Paragraph Page
CHAPTER 1. GENERAL1
1-1. Purpose1
1-2. Cancellation1
1-3. Definitions1
1-4. Focus5
1-5. Related CFRs5
1-6. DFDRS Purpose6
1-7. Operating Certificate Holders6
CHAPTER 2. TYPE CERTIFICATION7
2-1. Purpose7
2-2. DFDRs Substantiating Data7
2-3. Intended Function8
2-4. Equipment and Sensors10
2-5. Combination Cockpit Voice Recorder (CVR)/DFDR Units12
2-6. Software12
2-7. Complex Electronic Hardware13
2-8. Weight and Balance13
2-9. Electrical Loads Analysis13
2-10. Electrical Power Source13
2-11. Circuit Protective Devices14
2-12. Preflight Monitoring Means14
2-13. Aircraft Flight Manual Applicability14
2-14. Instructions for Continued Airworthiness (ICA)14
CHAPTER 3. CONTINUED AIRWORTHINESS REQUIREMENTS17
3-1. Purpose17
3-2. Continuous Airworthiness Maintenance Program (CAMP)17
3-3. ICA18
APPENDIX 1. STANDARD DATA FORMAT FOR DIGITAL FLIGHT DATA
RECORDERS, DATA STREAM FORMAT, AND CORRELATION
DOCUMENTATION (11 pages)1
APPENDIX 2. REVERSE DFDR DATA CORRELATION PROCEDURES (8 pages)1
APPENDIX 3. DIGITAL FLIGHT DATA RECORDER PARAMETER
REQUIREMENTS FLOWCHART (8 pages)1
APPENDIX 4. TYPICAL REASONABLENESS AND QUALITY CHECK
INSTRUCTIONS (4 pages)1
APPENDIX 5. CONSIDERATIONS FOR FILTERED FLIGHT DATA (1 page)1
Par 1-1 Page 1 CHAPTER 1. GENERAL
1-1. PURPOSE. AC 20-141A defines terms and identifies applicable regulations. Information is provided to determine to what and to whom this AC applies.
1-2. CANCELLATION. AC 20-141, Airworthiness and Operational Approval of Digital Flight Data Recorder Systems, dated October 5, 1999, is canceled.
1-3. DEFINITIONS.
a. Applicant. An individual or organization that is seeking Federal Aviation Administration (FAA) approval for a digital flight data recorder (DFDR) installation. The approval may be a type certificate (TC), amended TC, or Supplemental Type Certificate (STC).
The approval may apply to a single aircraft or to multiple aircraft of a single type design.
b. Correlation. Describes the relationship between two variables. In this case, the two variables are the raw data stored in the DFDR and its conversion into engineering units to the device being measured or the source that this raw data represents in engineering units.
c. Correlation Coefficient. A number that describes the degree of relation between the data being sampled and the data derived from the recorder. The correlation coefficient used here is the Pearson product-moment correlation coefficient, however the coefficient of determination R2 or the sum of least squares methods are acceptable. Its value may vary from minus one to plus one. A value of positive one (1.0) indicates a perfect direct correlation. A value of zero indicates that there is no correlation, or that any predictive capability between the derived data (using the equation) and the raw data is purely coincidental. A value of negative one (-1.0) indicates a perfect inverse relationship between the derived value and the raw data. The absolute value of the correlation coefficient must be equal to or greater than 0.99 over the entire operating range of each mandatory parameter to accurately establish the conversion of recorded values to engineering units (EU). See Appendix 1 for one method, but not the only method, to determine the correlation coefficient.
d. Correlation Data. The documentation that is required by Title 14 of the Code of Federal Regulations (14 CFR) part 121, §§ 121.344(j)(3), 121.344a(d)(3), 125.226(j)(3), and
135.152(f)(2)(iii). This documentation must show how each parameter was correlated and be maintained by the operating certificate holder.
e. Date Manufactured. The point in time at which the aircraft inspection acceptance records reflect that the aircraft is complete and meets the FAA-approved type design.
f. Dedicated Sources. Any digital system interface, analog discrete interface, or analog sensor interface installed solely to produce an input signal to the DFDRS. For example, if it is necessary to install a horizontally mounted accelerometer to sense lateral acceleration, then this accelerometer is considered a dedicated sensor. Conversely, the vertical accelerometer may exist on the aircraft for another reason (vertical flight control, for instance). If the DFDR takes vertical acceleration data from such an existing accelerometer, then the vertical accelerometer is not part of the DFDRS. However, the accelerometer must meet the accuracy requirements listed in the appropriate regulatory appendix.
Page 2 Par 1-3
g. Digital Flight Data Acquisition Unit (DFDAU). A DFDAU is an electronic device that collects, samples, reformats, and digitizes analog and digital signals representing aircraft flight data. See ARINC Characteristic 717. The equivalent of this function may be incorporated in other hardware which may not meet the classical definition of an ARINC 717 DFDAU.
h. Digital Flight Data Acquisition Function (DFDAF). A DFDAF is software that performs the function of a DFDAU in a larger avionics system.
i. DFDR. A recording device that uses a digital method to record and store data onto a storage medium and to retrieve that data from the medium. A DFDR may be the storage device in a recording system that includes a DFDAF, DFDAU, or an FDAU. Or, it may be a stand-alone device using an internal data collection system to convert aircraft analog and discrete signals to digital form.
j. Digital Flight Data Recorder System (DFDRS). The DFDRS is the software, equipment, sensors, wiring, equipment racks, and other items installed in the aircraft to record flight data. It includes the following equipment items: DFDR, dedicated sensors, underwater locating device (ULD), and a DFDAF, DFDAU, or FDAU.
k. Dynamic Condition. The parameter is experiencing change at the maximum rate available, including the maximum rate of reversal.
l. Flight Data Acquisition Unit (FDAU). The FDAU is the predecessor to the DFDAU, defined by ARINC 573. It is primarily designed to accept analog and analog discrete input data, and in some cases, it will accept digital data on predefined inputs.
m. Flight Data Recorder (FDR). An FDR is a recording device that directly receives analog signals representing various aircraft functions (e.g., vertical acceleration, heading, altitude, or airspeed) and records those signals in digital or analog format. Older FDRs recorded the signals by scratch with a stylus on a moving oscillographic medium, typically a foil formed from steel or steel alloy. These older analog FDR installations typically conformed to ARINC Characteristic 542. The FAA now requires that DFDRs be used in the U.S. commercial fleet.
n. Functional Check. A check to determine if one or more functions of a DFDRS perform within specified limits. The following identifies and defines three types of DFDRS functional checks.
(1) First of Type.
(a) The applicant must perform the first of type installation testing for an FAA approval (TC, amended TC, or STC). This check determines if the range, accuracy, sampling rate, and resolution of each parameter is within specified limits. During the first of type functional check, it may not be feasible to stimulate some sensors to their specified limits. In such instances it is acceptable to simulate the sensor output using suitable test equipment. This check collects correlation data in support of certification. See Appendix 2 for procedures when a DFDR data correlation document does not exist for an aircraft.
Par 1-3 Page 3
(b) For data received by the recording system in a digital means, credit may be given to the source system in determining the range and resolution of the parameter. Range and resolution are functions, not necessarily of the recording system, but of the source system.
However, the range and resolution of the source system must meet the minimum requirements of 14 CFR. If the range and resolution satisfy the requirements in 14 CFR, there is no need to repeat these checks for the purpose of meeting recording system requirements.
(c) For dedicated parameters that are analog and analog discrete in nature, all of these requirements should be checked.
(2) Operational: The operational check is a task to determine that an item is fulfilling its intended purpose. An operational check is a failure-finding task and does not determine if the item is performing within specified limits. When applied to a DFDR, the operational check determines that the DFDR is active and recording each parameter value within the normal operating range of the sensor. The operational check must also verify each electrical interface to the DFDRS. This may take place off the airplane.
(3) System: A system functional check confirms that interfaces to the recording system are present and functioning. This test confirms the presence of the electrical interfaces to the recording system and the function of dedicated sources. The operator must include a system functional check in the maintenance program. For dedicated sources, you may simulate sensor or transducer outputs to check the range, accuracy, sampling rate, and resolution of the recorded data. However, the instructions for continued airworthiness (ICA) and the operator’s maintenance program must prescribe a periodic system functional check of each of these transducers or sensors for range and accuracy.
o. Installed and Connected to the Recording System. This refers to the requirement to record parameters in addition to those specifically identified in the regulation (i.e., 22, 34, or 57 parameters, based on the date the aircraft was manufactured; see Appendix 3). The DFDRS must record the parameters that were recorded by the aircraft’s existing DFDRS on July 16, 1996 if sufficient capacity is available in the upgraded DFDR. However, an operator is not required to upgrade the capacity of an installed recording system beyond that needed to record the mandated parameters. In other words, a previously installed DFDR must continue to record parameters it was recording effective as of July 16, 1996, plus additional parameters if they are already connected and available to the system and if capacity exists in the system to record the parameters. Thus, if a retrofitted DFDRS can accommodate additional parameters, the retrofitted DFDR must continue to record any parameters that were not specifically mandated, but that may be accommodated by the upgraded DFDRS. The FAA considers a parameter to be easily accommodated if it is provided by an installed system and it is already connected to the data bus.
(See paragraph 1-3t, Sufficient Capacity.)
p. Readily Retrievable. This term means there is a method of readily retrieving data, actual sensor value of the mandatory parameter, from the storage medium by qualified personnel in 8 hours using:
(1) Existing, easily understood instructions and commonly available tools and techniques; and
Page 4 Par 1-3
(2) Step-by-step procedures, including all conversion algorithms, necessary to derive and validate the values.
NOTE: These procedures must be a permanent part of the aircraft-specific DFDRS documentation package. Portions of the documentation package pertaining to the format and conversion algorithms of the recorded data may be recorded within the crash-protected memory of the DFDR.
q. Reasonableness. An off-airplane review of recorded data to assess the overall health of the recording system parameter. The review requires technical judgment to assess a parameter’s health functions off the airplane. Typically, the data is downloaded from the airplane and reviewed in a ground station tool away from the airplane, using graphical and tabular means. The review identifies gross parameter anomalies, such as static parameters, missing parameters, random movement in parameters, parameters not in agreement with related parameters in a given operational range or mode, etc. Judgment is required so that the reviewer does not confuse acceptable airplane operational differences with parameter recording anomalies (i.e., the reasonability check is for parameter health and not piloting technique).
r. Single Source. The term single source applies to certain split flight control parameters.
It means that if it is necessary to conserve capacity in order to record the required parameters, the DFDR must record the position of only one of the two flight control positions.
(1) For example, the DFDR may record the position of the aileron bellcrank instead of each aileron surface position. However, any recording from a single source must be made so that the position of the flight control input can be differentiated from the position of the flight control surface.
(2) In the example given, the installation instructions must tell the installer to place the aileron surface position sensor on one or the other bellcrank lobes to which one of the aileron surface actuator arms is attached—not the lobe to which the control yoke is attached.
s. Split Flight Control Parameter. This applies to flight control and flight control surface parameters when the flight control system design allows the flightcrew to disconnect the pilot’s controls from the copilot’s controls. This flight control system design is also known as breakaway capability.
(1) The DFDRS must record multiple flight control positions, as well as multiple flight control surface positions.
(2) For example, an aircraft flight control system design may allow the flightcrew to disconnect the pilot lateral (aileron) control from the copilot lateral (aileron) control. The disconnection would leave the left aileron connected to the pilot lateral (aileron) control and the right aileron connected to the copilot lateral (aileron) control. This would leave the pilot capable of operating only the left aileron, and the copilot capable of operating the right only.
(3) The pilot and copilot control inputs (parameter 13) would be a split parameter necessitating that each pilot’s lateral control position be recorded. The DFDRS must record both the left and the right lateral control surface (aileron) position (parameter 16) as well.
Par 1-3 Page 5
t. Sufficient Capacity. This addresses the existing capacity of the installed DFDRS (either before retrofit or in new production) with regard to the addition of available parameters to be connected to the recording system. These parameters are in addition to the 22, 34, 57, or 88 parameter requirements, based on the aircraft date of manufacture (see Appendix 3). Adding these parameters should not force the installation of a higher capacity acquisition unit (FDAU or DFDAU) or DFDR to accommodate these parameters. For example, if the existing DFDRS functions at a 64 word-per-second rate, the rule does not require the applicant to upgrade the system to function at a 128 word-per-second rate to accommodate these parameters, even if it means disconnecting previously recorded parameters that are not required to be recorded. (See paragraph 1-3o, Installed and Connected to the Recording System.)
u. When an Information Source is Installed. When this term appears in the parameter listing in the 14 CFR section or appendix, the parameter is mandatory only if the aircraft is fitted with a system that provides that capability. For example, it is not necessary to install an ice detection system to comply with parameter 61, but, if an ice detection system is already installed on the aircraft, the DFDRS must record its operation.
1-4. FOCUS. This AC provides information for the following:
• Type certification of a DFDRS installation.
• Continuous Airworthiness Maintenance Program (CAMP) information for compliance with the operating rules after DFDRS installation.
1-5. RELATED CFRs. Sections of 14 CFR parts 23, 25, 27, 29, 91, 121, 125, 129, and 135 prescribe design substantiation and operational approval requirements directly applicable to the DFDRS. Listed below are the specific 14 CFR sections that apply to this AC. See Appendix 3 to determine the applicable regulations for your aircraft.
• Section 23.1459, Flight recorders.
• Section 25.1459, Flight recorders.
• Section 27.1459, Flight recorders.
• Section 29.1459, Flight recorders.
• Section 23.1529, Instructions for continued airworthiness.
• Section 25.1529, Instructions for continued airworthiness.
• Section 27.1529, Instructions for continued airworthiness.
• Section 29.1529, Instructions for continued airworthiness.
• Section 91.609, Flight recorders and cockpit voice recorders.
• Section 91.1045, Additional equipment requirements.
Page 6 Par 1-5
• Section 121.343, Flight recorders.
• Section 121.344, Digital flight data recorders for transport category airplanes.
• Section 121.344a, Digital flight data recorders for 10-19 seat airplanes.
• Section 125.225, Flight recorders.
• Section 125.226, Digital flight data recorders.
• Section 129.20, Digital flight data recorders.
• Section 135.152, Flight recorders.
1-6. DFDRS PURPOSE. The purpose of a DFDRS is to collect accurate data to assist investigations of accidents and incidents The objective is met by complying with the current requirements in parts 91, 121, 125, 129, and 135.
1-7. OPERATING CERTIFICATE HOLDERS. A holder of an air operator certificate may not operate an aircraft on its operations specifications in air transportation unless that aircraft complies with the FDR requirements of the appropriate part (91, 121, 125, 129, or 135). See Appendix 3 to determine the applicable regulations for your aircraft.
Par 2-1 Page 7 CHAPTER 2. TYPE CERTIFICATION
2-1. PURPOSE. This chapter provides information for type certification of a DFDRS. The applicant must obtain FAA approval to install or to retrofit a DFDR and components. The applicant may apply for a TC, amended TC, STC, or other manner of approval. The applicant must demonstrate compliance with the applicable regulations included in the type certification basis for the aircraft. Appendix 4 lists typical certification requirements that are applicable depending upon the certification basis of the aircraft. The type certificate data sheet (TCDS) referenced in the TC normally identifies the applicable regulations. An applicant must demonstrate compliance with the appropriate certification requirements as instructed by the approving Aircraft Certification Office (ACO) or Flight Standards District Office (FSDO). (See Appendix 3.)
2-2. DFDRS SUBSTANTIATING DATA. The system description must include:
• The make and the model or part number of the DFDR, FDAU, or DFDAU (or equivalent function).
• A listing of each parameter recorded.
• Documentation which shows the correlation data for each parameter.
• Identification of all transducers or sensors installed specifically for the purpose of sensing required data. Include the manufacturer and part number of the sensor.
• Identification of sensors not dedicated exclusively to the DFDRS. Include the sensor source and the associated digital data bus source.
• Identification of pneumatic inputs directly connected to the DFDRS for pitot-static information.
• Identification of components of the DFDRS that meet Technical Standard Order (TSO) standards including the TSO number and any authorized deviations from the TSO requirements.
• Description of structural alterations associated with the installation.
• A wiring diagram and system schematic. Describe all dedicated wires. Identify all interfaces to other installed equipment and systems.
• Identification of parameters recorded from data buses. Must include source data bus system, word, and label information.
NOTE: Acceptable guidelines for documentation of DFDR data content and format are available in Appendix 1 and in the ARINC Flight Recorder Electronic Documentation (FRED) specification (ARINC Specification 647A). These data format guidelines provide NTSB accident investigators with the information necessary to decode the DFDR raw data
Page 8 Par 2-2 stream. The information can be contained in hardcopy document or electronic format. Specifically, the ARINC FRED standard provides the electronic format that supercedes a prior electronic format standard, the Flight Recorder Configuration Standard (FRCS), Document TP13140E.
Although the FRCS standard is an acceptable electronic format for DFDR decoding information, the ARINC specification evolved from the FRCS format and includes information for various raw data stream formats. See Appendix 1.
2-3. INTENDED FUNCTION. The DFDRS records parametric data that represents (as closely as possible) the actual aircraft function. The applicant must provide a list of all parameters that the DFDRS will record and their specifications (range, accuracy, sampling rate, and resolution).
The applicant must demonstrate, by test, that the DFDRS meets these specifications under both static and dynamic conditions. (See definition in chapter 1.) These tests are normally performed using simulated inputs to the DFDRS and by activating transducers and sensors installed as part of the DFDRS. When the installation design allows switching of the sensor or the digital bus during flight, the applicant must demonstrate performance in all switched positions. As part of this test, the applicant must provide a correlation document. See data stream format and correlation document as described in Appendix 1 and, if applicable, reverse DFDR data correlation procedures in Appendix 2.
NOTE: Before performing ground or flight tests on the DFDRS installation, the applicant must perform a conformity check. This check must demonstrate that the DFDRS installation conforms to the design data that will be cited on the TC, amended TC, or STC.
a. Identify Parameters. The applicant must identify any parameters that are filtered before they are recorded. For these parameters, the applicant must show that the actual sensed value of the parameter can be readily retrieved and unambiguously derived from the recorded value, and the derived value can be shown to be within the range, accuracy, sampling rate, and resolution as specified in the applicable operating rule appendix under both static and dynamic conditions. This must be shown by test.
(1) If it is necessary to use a process or procedure for deriving the actual recorded data, that process or procedure must be documented and provided to the aircraft operator to satisfy requirement part 121, §§ 121.344(j), 121.344a(d), 125.226(j), or 135.152(f)(2).
(2) The process or procedure must be performed during certification of the system.
(3) The applicant must perform a ground cockpit compatibility check to demonstrate performance of the DFDRS installation. This compatibility demonstration must include:
(a) A demonstration that the circuit breaker can be identified and reset from a flightcrew position (if a circuit breaker is provided for crew reset),
(b) A check that the DFDR “preflight check” indicator or display is visible (or aural tone is audible) to the flightcrew, and