Par 2-3 Page 9
(c) A demonstration of any DFDR-related items in the Aircraft Flight Manual (AFM) (supplement) to verify that AFM procedures have not been invalidated by the installation.
NOTE: The STC process does not provide for findings of compliance with operating rules such as § 121.344. An applicant for TC approval (TC, amended TC, or STC) may facilitate the operator’s later demonstration of compliance to the operating rule by referencing the appropriate appendix and parameter numbers of part 91, 121, 125, 129, or 135 for the specifications met when demonstrating that the DFDRS performs its intended function. The FAA inspector may use the test report to support a finding of compliance with the operating rule. The applicant should substantiate any discrepancies between the parameter specifications in the appropriate appendix of the operating rule and those demonstrated by test.
Such substantiation is needed for the ACO to find “novel, unique design, or operational characteristic.” (See part 25, § 25.1459(e) or equivalent.) The applicant must include the substantiation as part of the operational specifications or minimum equipment list. The operator may later use this substantiation to support a petition for exemption from the operating rule.
For example, the applicant may need to substantiate a unique design characteristic to change the way the DFDR records a required parameter if such recording would compromise a critical function of the aircraft. In this case, the operator that installs the FAA-approved system must then request an exemption from the parameter-recording requirement. (See 14 CFR part 11, § 11.63 for procedures to petition for an exemption.)
b. Demonstrate Performance. The applicant must demonstrate that the DFDRS performs as intended, that it does not cause electromagnetic interference (EMI) in essential or flight-critical systems, and that electromagnetic fields from other operating electrical and electronic systems and components do not cause noise or data dropouts in the DFDR recorded data. If the applicant cannot demonstrate these capabilities using ground tests, a flight test must be performed. After the flight test, the applicant must conduct a correlation test of the DFDR data from the flight test. The purpose of this test is to demonstrate that each parameter is being recorded properly and that any data dropouts or noise do not interfere with the ability to interpret the data. During the flight test, the applicant must demonstrate that the DFDRS is not susceptible to EMI or radio frequency interference (RFI) and that the DFDRS does not generate such interference in essential or flight-critical systems.
NOTE: Using the flight test data, the applicant must confirm that the DFDR begins to operate no later than the time that the aircraft begins its takeoff roll and continues to operate until after the aircraft has completed its landing roll. For rotorcraft, the DFDR must operate from the instant the rotorcraft begins its liftoff until it has landed.
c. Establish Correlation. The applicant must establish the correlation between the raw data and the engineering unit for all mandatory parameters. (Reference § 121.344(j).) The correlation required in the type certification regulations (§ 25.1459(c), for example does not meet the requirement of § 121.344(j). The applicant should use the correlation coefficient to describe
Page 10 Par 2-3 this relationship. For example, the correlation in § 25.1459(c) must be established between the flight recorder readings between airspeed, altitude, and heading and the corresponding readings of the first pilot’s instruments. The correlation in § 121.344(j) is between the values recorded by the recorder and the corresponding values being measured.
2-4. EQUIPMENT AND SENSORS. The applicant must present evidence that the equipment and sensors that are to be installed as part of the retrofit are FAA-approved or obtain FAA approval for them.
a. TSO-C124 (Flight Data Recorder Systems) Authorization. A DFDR or DFDAU that has been manufactured under TSO-C124 or later revision (as required by the applicable operating rule) is FAA-approved.
b. TSO-C121 (Underwater Locating Devices (Acoustic) (Self-Powered)) Authorization. A ULD that has been manufactured under TSO-C121 or later revision is FAA-approved.
c. Interleaving. Interleaving of certain parameters is permissible unless prohibited by the applicable operation regulation. However, interleaving is discouraged unless there is insufficient recorder capacity. Interleaving is defined as recording samples from multiple parts of a system and then combining them to meet the required sample rate for an individual parameter. An example of interleaving is recording the left aileron input twice per second and the right aileron twice per second, and then combining both of those recorded parameters for a total aileron sample rate of four times per second.
d. Source Selection. The source for the parameter should be selected to provide data that is as close (physically or electrically) to the original source as possible. Source selection is critical for providing accurate and timely data information for post accident and incident analysis. The data should be “handled” by as few components as possible before reaching the flight data acquisition function. When evaluating the suitability of cockpit displays as a DFDR data source, pay particular attention to nonflight critical information such as displayed flight control position, which is typically filtered to provide a smooth cockpit presentation. See Appendix 5 for additional guidance for filtered flight data.
e. Altitude and Airspeed Sensors. When an air data computer is installed, the pressure altitude and indicated or calibrated airspeed must be recorded from the air data computer. When two air data computers are installed, one supplying the pilot’s instrumentation and the other supplying the copilot’s instrumentation, the pressure altitude and indicated or calibrated airspeed may be recorded from each air data computer. When there is no air data computer, or when independent altitude and airspeed indicators are installed, the pressure altitude and indicated or calibrated airspeed may be derived from either of the instrumentation systems or it may be derived from a separate pitot static system. When the data is derived, instrumentation systems must not be adversely affected.
f. Control Position and Forces (Nonfly-by-wire). Control positions and control forces must be measured at the control columns, control wheels, and rudder pedals when practical.
Where the applicant shows that this is impractical, the positions and forces may be measured on
Par 2-4 Page 11 the first lever arm or on the first bellcrank in the control linkage from the control. Should the applicant determine that installation of the sensor on this first control arm or bellcrank is impractical, the applicant should conduct an analysis to show that the hazard likelihood of mechanical interference that could invalidate the recorded position and force values is improbable (1x10-6).
NOTE: Installation of force sensors are usually made in series in the control system. It is recommended that the TC holder review any STC force sensor implementation that revises or modifies the flight control system or that can affect the function of the autopilot or pilot controls.
g. Thrust Command and Thrust Target. Thrust command and thrust target are typically available on aircraft equipped with a full authority digital electronic control (FADEC). Thrust command is the thrust required by the FADEC for some predefined schedule. Thrust target is the thrust to be achieved at the end of the thrust command schedule. Once the thrust target is achieved, the thrust command and the thrust target will be the same.
h. Computer Failure Discrete. This parameter is a discrete and should be activated upon failure of any computer that could directly affect the primary and secondary flight controls or the engine controls (primarily the throttles). Some examples of computers that should be monitored for failure are those that are a part of the flight management system, the auto-throttle system, and the autopilot. Furthermore, if a computer drives any of the above computers, and there is no discrete transmitted to that computer from the device, that device’s computer should also be monitored.
i. Multiple Control Surfaces (Flap Sections, Aileron/Spoiler Speed Brake Panels) and Combinations for Lateral Control. Unless there is insufficient recorder capacity on a retrofit aircraft and the designer can show that it is improbable that a surface would not deploy as intended:
(1) Ailerons on each wing must be monitored separately.
(2) Multiple aileron surfaces that are mounted on the same wing must be monitored separately.
(3) All secondary control surfaces (e.g., flaps, speed brakes, and spoilers) that normally activate together but can activate independently of each other should also be monitored separately.
j. Multiple Thrust Reverser Buckets (or Sleeves). Each individual thrust reverser bucket (sleeve) must be monitored unless the designer shows that it is improbable that an individual bucket (sleeve) would deploy without intentional deployment of all buckets at once.
k. Hydraulic Pressure. Hydraulic pressure low, each system (parameter 33) and hydraulic pressure, each system (parameter 77) are both mandatory parameters. For example, although hydraulic pressure low is defined as a discrete, the comment in the range column of part 121, appendix M indicates that it may also be recorded as an analog signal representing the actual value of the hydraulic pressure. Thus, either the hydraulic pressure low discrete or the actual
Page 12 Par 2-4 analog hydraulic pressure may be recorded for all DFDRS installations except those on aircraft manufactured after August 19, 2002. For aircraft manufactured after August 19, 2002, both parameter 33 and parameter 77 are required.
l. Safety Analysis of Sensors Installed in Flight Control Systems. Some flight control surface and flight control input sensors consist of rotary synchros that are attached to the flight control system using mechanical arms and links. The ends of the links (rod ends) and the synchros have bearings that may be subject to seizure due to loss of lubrication. Such seizures may jam flight controls, resulting in a catastrophic failure condition. The applicant must conduct a safety analysis to evaluate the reliability and fail-safe aspects of sensor hardware installed in flight control paths. The analysis should demonstrate that the likelihood of a catastrophic failure would occur 1x10-9 times per aircraft flight-hour. As a result of this assessment, the applicant may find it necessary to prescribe periodic inspection or replacement of the sensor(s) in the ICA.
NOTE: When installation of the sensors requires direct attachment to control cables, the attachment hardware must have the same metallurgical properties as the control cables. In addition, periodic inspection of the attachment hardware must be included in the maintenance program.
m. Sensor reliability. Be careful when selecting sensor types for particular applications.
Specifically, certain sensors are less reliable in different applications than others. For instance, potentiometers have historically been unreliable on flight control surface applications where high vibration may be present. However, a similar sensor may be reliably used for other applications, such as pilot input controls.
NOTE: Potentiometers should be avoided in all cases for retrofit flight recording system design. Synchros, rotary variable differential transducers, and linear variable differential transducers are far more robust in the airplane environment.
2-5. COMBINATION COCKPIT VOICE RECORDER (CVR)/DFDR UNITS. Under longstanding FAA policy, an applicant may install a combination CVR and DFDR unit.
a. Airplane Requirements. Two separate recorders are required for airplanes. Therefore, a single combination CVR/DFDR may not serve as both the required DFDR and the required CVR. That is, the applicant may use a combination CVR/DFDR unit for either the required DFDR or CVR. The applicant may install two combination CVR/DFDR units in the airplane, one taking credit for each required system.
b. Rotorcraft Requirements. On rotorcraft, one combination CVR and DFDR unit may be installed to meet the requirement for a CVR and a DFDR. The combination CVR and DFDR unit must be installed such that no single electrical failure external to the recorder can disable both the cockpit voice recorder and the digital flight data recorder functions.
2-6. SOFTWARE. For those DFDRs having RTCA, Inc. document RTCA/DO-178B Level E or DO-178A Level 3 software installed, and those DFDRs for which no software approval exists, the person performing the installation or the applicant must:
Par 2-6 Page 13
• Obtain a statement from the equipment manufacturer that the source code has been archived;
• Obtain a statement from the equipment manufacturer that the executable object code can be regenerated from the archived source code;
• Obtain from the equipment manufacturer information necessary to calculate transfer functions; and
• Demonstrate that the software to be loaded during DFDRS installation or during DFDRS maintenance can be successfully loaded through the use of released procedures. These procedures should be included as part of the installation instructions or the ICA, as appropriate.
2-7. COMPLEX ELECTRONIC HARDWARE. Reserved.
2-8. WEIGHT AND BALANCE. Installation or removal of equipment affects the aircraft weight and balance. A report must show the net change in weight and moment (or moment arm) and how the net change was determined. If the installation results in changes to the weight and balance procedures in the flight manual, submit a flight manual supplement to the ACO for approval. Adjust aircraft records to show such change.
2-9. ELECTRICAL LOADS ANALYSIS. Installation or removal of equipment affects the electrical load to the aircraft power distribution system. A report must show the net change in the electrical load on each affected bus and how the installer or applicant computed this net change.
The installer or applicant must also identify any necessary changes in circuit protective devices.
The net change to the load carrying capability of the essential bus must not result in interruption or otherwise adversely affect power distributed to other loads on that bus. Reference §§ 23, 25, 27, and 29.1351.
2-10. ELECTRICAL POWER SOURCE. The DFDR must receive its operating electrical power from the bus that allows maximum reliability for the DFDRS. The applicant may not add the DFDR to any bus if the addition would jeopardize essential or emergency loads.
a. Connect to Power Buses. The applicant must connect the DFDR and the CVR to power buses that are separate and supplied by independent power sources. If the DFDRS cannot be added to the emergency or essential bus, the applicant should consider providing two separate and independent sources of electrical power for each DFDR and its associated FDAU or DFDAU.
b. Automatic Switching. The applicant should consider providing that each DFDR and its associated FDAU or DFDAU automatically switch between the two power sources to maintain flight data recording in the event of a bus failure. Such provision of two separate and independent power sources would ensure that available data essential to accident investigation is recorded throughout the entire accident sequence.
c. External Power Sources. Separate aircraft external power sources are not required for installations of single combination CVR/DFDR unit. If there are more than one electrical power
Page 14 Par 2-10 inputs available on the combination CVR/DFDR units, then connection with a separate and independent electrical power bus is recommended.
d. Direct Wiring. We recommend equipment manufacturers specify in the installation instructions that the DFDR be wired directly to the primary electrical power source.
2-11. CIRCUIT PROTECTIVE DEVICES. Circuit protective devices must be capable of handling anticipated loads for the DFDRS. Reference parts 23, 25, 27, and 29, § 1357 in each.
2-12. PREFLIGHT MONITORING MEANS. An aural or visual indicator is activated in the cockpit when any one of a combination of system status monitors and built-in test capabilities fails. For example, failure of the following functions will produce an indication, depending upon availability of built-in test capability:
• System electrical power,
• Data acquisition and processing equipment, and
• Recording medium and/or drive mechanism.
2-13. AIRCRAFT FLIGHT MANUAL APPLICABILITY. The installer or applicant must review the AFM and supplements to determine whether they are compatible with the DFDRS installation. The installer or applicant must provide an approved AFM supplement to eliminate any incompatibilities.
2-14. INSTRUCTIONS FOR CONTINUED AIRWORTHINESS (ICA). The installer or applicant must provide ICAs as part of the substantiating data. Under the requirements of §§ 23, 25, 27, or § 29.1529, and guidance found in FAA Order 8110.54, these instructions must include as a minimum and be provided to the operator or maintainer:
a. Data Stream. The data stream format and correlation data outlined in Appendix 1 or Appendix 2 if applicable.
b. Dedicated Sources. A list of dedicated sources as defined in chapter 1, subparagraph 1-3f. Include procedures for a ground check of these sources. Provide sufficient information, including source, label and word, to verify the range and accuracy of the recorded data as specified in the applicable operating rule.
c. Procedures and Intervals. Procedures and recommended check intervals to functionally check parameters with dedicated sources that are not typically activated and recorded during normal aircraft operation.
d. Checks. The instructions may reference procedures for checks furnished in the ICA for the parameter source systems. See Appendix 4 for typical reasonableness and quality check instructions.
Par 2-14 Page 15 (and 16)
e. Removal and Replacement. Provide removal and replacement instructions for DFDRS equipment and dedicated sensors. Include instructions for conducting a functional check of the equipment.
f. Battery Replacement. If the retrofit includes a change to the ULD, provide instructions for periodically replacing the ULD battery and conducting an operational check of the ULD. The replacement period must be consistent with the battery manufacturer’s life limit. Include instructions for how to access the ULD. The current edition of AC 21-10, Flight Recorder and Cockpit Voice Recorder Underwater Locating Devices, provides information for ULD installations.
NOTE: If the ULD battery is not accessible, the instructions must be for replacement of the ULD itself.
g. Installation Design. The installer or applicant may design the installation to accommodate DFDRS equipment of different part numbers or of different models and part numbers. For example, the DFDRS equipment manufacturer may assign one part number to equipment that meets the requirements of TSO-C124 and another part number to equipment that meets TSO-C124a. The two different part-numbered DFDRs are identical except that the latter has been shown to withstand the more severe fire resistance test requirements of TSO-C124a.
Since the FAA accepts both DFDRs, the installers may select either DFDR for installation. In this case, provide a list identifying the interchangeable items of equipment by make, model, and part number.
Par 3-1 Page 17 CHAPTER 3. CONTINUED AIRWORTHINESS REQUIREMENTS
3-1. PURPOSE. This chapter provides information for aircraft operators in the development of continued airworthiness requirements of a DFDRS. The basic requirements for continued airworthiness of a DFDRS should be provided as part of the data package submitted during TC, amended TC, or STC installation. This chapter outlines those basic requirements in case the original information was insufficient or not provided as part of the system certification.
3-2. CONTINUOUS AIRWORTHINESS MAINTENANCE PROGRAM (CAMP). A typical maintenance program should include all the checks necessary to ensure that the DFDRS operates as certified at specified intervals. Such intervals, or schedules, are delineated and described in AC 120-16, Air Carrier Maintenance Programs, current edition. The aircraft manufacturer or system designer/installer should provide the basic maintenance program recommendations. However, factors such as aircraft age, system design, and aircraft operation must be taken into account when developing the maintenance program. The following are typical parts found in a DFDRS maintenance program:
a. Operational Check. Check that there are no failures in the DFDRS. The flightcrew usually accomplishes this task. The task typically verifies that there are no DFDRS system fault indications. We recommend that the checks occur before the first flight each day.
b. Reasonableness Check. Provide for a download of the DFDR to accomplish a reasonableness check of the data. The maintenance program task will typically require removal of the data or the DFDR. This completes the aircraft portion of the maintenance task. The reasonableness check of the data is performed off-aircraft. The check of the data should be accomplished as soon as possible. The operator should have provisions for addressing and correcting any discrepancies found during the reasonableness check.
c. System Functional. Check. Perform a complete functional check of certain parameter inputs to the DFDRS to ensure the system is as certified. This functional check may be done in conjunction with a reasonableness check. Identify signals from parameter sources that cannot be verified during checks of other aircraft systems and equipment.
(1) This is particularly important for older analog systems that use dedicated sensors to provide input to the DFDRS. Sensor type and installation often determine the level of check that is necessary to ensure they remain within the certificated tolerances. For example, some installations use a string potentiometer installed on the aileron bellcrank to provide control wheel input position. If the output of this sensor is only used for the DFDRS, then this is a dedicated sensor. There are several things that could happen to this type of sensor that could make the data provided invalid. It could be adjusted or repositioned during maintenance to the aileron system.
To ensure that the output from this sensor is still within the range and accuracy requirements of the installation, the output parameters must be verified. The following are some types of parameters that should be included in the system functional check:
(a) Dedicated sources.
(b) Analog discrete inputs or analog warning inputs that are not normally exercised during flight.
Page 18 Par 3-2
(2) The functional check need not include other parameters that verify the accuracy of the output during the source systems operational or functional check. This includes digital discrete input and digital warning input that are not normally exercised during flight.
3-3. ICA. The operator must maintain ICA as part of its manual. The aircraft manufacturer or the system installer typically provides the ICA but if they are not provided, the operator should develop them. The operator developed ICA must identify all requirements that would have been established at time of certification and any others subsequently identified by the FAA, e.g., those applicable under Airworthiness Directive (AD). These instructions must include as a minimum:
a. Data Stream. The data stream format and correlation data outlined in Appendix 1. If this is not available, it should be created from the document or software used to convert the raw data into EU. If the information needed cannot be derived from the download document/software, then the operator must perform the necessary test and analysis to reproduce the necessary documentation (see Appendix 2 if applicable).
b. Dedicated Sources. A list of dedicated sources is defined in chapter 1, subparagraph 1-3f. Include procedures for a ground check of these sources. Provide sufficient information, including source, label and word, to verify the range and accuracy of the recorded data as specified in the applicable operating rule.
c. Removal and Replacement. Include removal and replacement instructions for DFDRS equipment and dedicated sensors. Also include instructions for conducting a functional check of the equipment and verification of the parameter range and accuracy.
d. Software. If chapter 2, paragraph 2-6 applies, include procedures for loading software during DFDRS installation or during DFDRS maintenance. (See FAA Order 8110.49, Software Approval Guidelines.)
Appendix 1 APPENDIX 1. STANDARD DATA FORMAT FOR DIGITAL FLIGHT DATA
RECORDERS, DATA STREAM FORMAT, AND CORRELATION DOCUMENTATION
1. DFDR. The DFDR records flight data in a digital format. Data is normally grouped into words that are synchronized in a data stream. The data stream must be correlated to EU or to discrete states for an accident investigator to use the data. This appendix provides the specific information that operators must provide to the NTSB investigators for them to decode and convert the raw data stream recorded by the DFDR. This data format information can be contained within an electronic file or in hardcopy document format.
2. GUIDELINES FOR DOCUMENTATION. Information regarding acceptable guidelines for documentation of DFDR data content and format are also available in the FRED document, ARINC Specification 647A. The ARINC FRED specification provides a standard format for electronic documentation of DFDR data. This standard format supersedes an older electronic format, the Flight Recorder Configuration Standard, Document TP13140E. Although the FRCS documentation format is acceptable, because FRED supersedes TP13140E, the preferred electronic format is the ARINC FRED format. The FRED specification, ARINC 647A, can be obtained by contacting:
ARINC Inc.
Document Section 2551 Riva Road Annapolis, MD 21401-7465 Telephone: (410) 266-4117 Fax: (410) 266-2047 E-mail: standards@arinc.com
3. DEFINITIONS. The following definitions apply to terminology often used in the DFDR correlation documentation. These definitions are derived from ARINC Characteristic 717-10, Flight Data Acquisition and Recording System, dated April 1, 1998. An operator using another data stream format must provide definitions unique to its format in the correlation documentation.
a. DFDR Bit Number. Defines a specific bit location within a DFDR system word on the output from the DFDR. The DFDR bit number is used to locate the bits that are dedicated to a given parameter within the word. For example DFDR bit numbers 3-12 indicate bit 3 through bit 12. The lowest bit number is normally the least significant bit.
b. Lexicon. A dictionary of all mnemonic codes and the associated parameters each represents. To aid in the standardization of parameter identification, ARINC Specification 647A appendix C contains a recommended lexicon.
c. Mnemonic Code. An abbreviation of the parameter name. It is intended to be used in formats where the parameter name is too large. The mnemonic code must be unique and used to identify the parameter as described in the applicable appendix (part 121 appendix B or M, part 125 appendix E, or part 135 appendices B through F). The aircraft manufacturer normally assigns a mnemonic code to each parameter. This code is normally correlated to the parameter
Appendix 1 name in the aircraft manufacturer’s interface control document. However, an installer or an operator may assign a mnemonic code to an added parameter. The mnemonic code must uniquely identify the parameter relative to all other parameters being recorded by the DFDR.
Additional characters may be necessary to uniquely identify the parameter as installed on the aircraft.
d. Parameter Name. The name of the function being recorded. The documentation must contain a means to correlate each recorded parameter name to those in the applicable appendix (part 121 appendix B or M, part 125 appendix E, or part 135 appendices B through F). Where possible, the parameter name should correlate to the aircraft manufacturer’s or applicant’s interface control documentation. Sufficient information must be contained in the parameter name to make it unique and to convey information on its source.
e. Range. The full range of a parameter (minimum to maximum) expressed in EU. Where the parameter range accommodated in the aircraft exceeds the parameter range specified in the regulations, (e.g., pressure altitude in large aircraft) the applicant should provide for recording the range accommodated in the aircraft. Enter “NA” for discrete parameters. Range of a parameter is defined by either:
(1) The full recordable range of the parameter on the flight recorder, or
(2) The parameter’s operational range. The operational range is typically a subset of the recordable range. The inclusion of operational range is useful in analysis of the recorded data.
NOTE: The inclusion of a parameter’s recorded range does not imply that the parameter is recorded linearly on the flight recorder.
f. Signal Source. The aircraft subsystem, or the dedicated transducer or signal conditioner, used to provide the signal for the DFDR, FDAU, or DFDAU (or equivalent).
g. Superframe Cycle. A subdivision of a given word slot address in a subframe. This typically provides 16 additional addresses. A counter provides the cycle number reference. The cycle number must be documented as a parameter.
h. Word Number. The location of a 12-bit word within the subframe. Word numbering starts at 1 (the first word in the subframe).
4. DATA STREAM FORMAT.
a. Data Stream Format. The data stream format defines where an analyst must look in the DFDR output to find a selected parameter or other information. Data stream format and encoded data format characteristics must be described and accurate to the specification provided by the manufacturer. The output of the data stream format should provide clear header and parameter information from the DFDR. Most DFDR data are encoded using the ARINC Characteristic 573 or ARINC Characteristic 717. Although these ARINC data bus encoding systems do not specify the data format, they provide the framework within which the data is formatted, in a fixed-frame format.