Par 2-6 Page 13
• Obtain a statement from the equipment manufacturer that the source code has been archived;
• Obtain a statement from the equipment manufacturer that the executable object code can be regenerated from the archived source code;
• Obtain from the equipment manufacturer information necessary to calculate transfer functions; and
• Demonstrate that the software to be loaded during DFDRS installation or during DFDRS maintenance can be successfully loaded through the use of released procedures. These procedures should be included as part of the installation instructions or the ICA, as appropriate.
2-7. COMPLEX ELECTRONIC HARDWARE. Reserved.
2-8. WEIGHT AND BALANCE. Installation or removal of equipment affects the aircraft weight and balance. A report must show the net change in weight and moment (or moment arm) and how the net change was determined. If the installation results in changes to the weight and balance procedures in the flight manual, submit a flight manual supplement to the ACO for approval. Adjust aircraft records to show such change.
2-9. ELECTRICAL LOADS ANALYSIS. Installation or removal of equipment affects the electrical load to the aircraft power distribution system. A report must show the net change in the electrical load on each affected bus and how the installer or applicant computed this net change.
The installer or applicant must also identify any necessary changes in circuit protective devices.
The net change to the load carrying capability of the essential bus must not result in interruption or otherwise adversely affect power distributed to other loads on that bus. Reference §§ 23, 25, 27, and 29.1351.
2-10. ELECTRICAL POWER SOURCE. The DFDR must receive its operating electrical power from the bus that allows maximum reliability for the DFDRS. The applicant may not add the DFDR to any bus if the addition would jeopardize essential or emergency loads.
a. Connect to Power Buses. The applicant must connect the DFDR and the CVR to power buses that are separate and supplied by independent power sources. If the DFDRS cannot be added to the emergency or essential bus, the applicant should consider providing two separate and independent sources of electrical power for each DFDR and its associated FDAU or DFDAU.
b. Automatic Switching. The applicant should consider providing that each DFDR and its associated FDAU or DFDAU automatically switch between the two power sources to maintain flight data recording in the event of a bus failure. Such provision of two separate and independent power sources would ensure that available data essential to accident investigation is recorded throughout the entire accident sequence.
c. External Power Sources. Separate aircraft external power sources are not required for installations of single combination CVR/DFDR unit. If there are more than one electrical power
Page 14 Par 2-10 inputs available on the combination CVR/DFDR units, then connection with a separate and independent electrical power bus is recommended.
d. Direct Wiring. We recommend equipment manufacturers specify in the installation instructions that the DFDR be wired directly to the primary electrical power source.
2-11. CIRCUIT PROTECTIVE DEVICES. Circuit protective devices must be capable of handling anticipated loads for the DFDRS. Reference parts 23, 25, 27, and 29, § 1357 in each.
2-12. PREFLIGHT MONITORING MEANS. An aural or visual indicator is activated in the cockpit when any one of a combination of system status monitors and built-in test capabilities fails. For example, failure of the following functions will produce an indication, depending upon availability of built-in test capability:
• System electrical power,
• Data acquisition and processing equipment, and
• Recording medium and/or drive mechanism.
2-13. AIRCRAFT FLIGHT MANUAL APPLICABILITY. The installer or applicant must review the AFM and supplements to determine whether they are compatible with the DFDRS installation. The installer or applicant must provide an approved AFM supplement to eliminate any incompatibilities.
2-14. INSTRUCTIONS FOR CONTINUED AIRWORTHINESS (ICA). The installer or applicant must provide ICAs as part of the substantiating data. Under the requirements of §§ 23, 25, 27, or § 29.1529, and guidance found in FAA Order 8110.54, these instructions must include as a minimum and be provided to the operator or maintainer:
a. Data Stream. The data stream format and correlation data outlined in Appendix 1 or Appendix 2 if applicable.
b. Dedicated Sources. A list of dedicated sources as defined in chapter 1, subparagraph 1-3f. Include procedures for a ground check of these sources. Provide sufficient information, including source, label and word, to verify the range and accuracy of the recorded data as specified in the applicable operating rule.
c. Procedures and Intervals. Procedures and recommended check intervals to functionally check parameters with dedicated sources that are not typically activated and recorded during normal aircraft operation.
d. Checks. The instructions may reference procedures for checks furnished in the ICA for the parameter source systems. See Appendix 4 for typical reasonableness and quality check instructions.
Par 2-14 Page 15 (and 16)
e. Removal and Replacement. Provide removal and replacement instructions for DFDRS equipment and dedicated sensors. Include instructions for conducting a functional check of the equipment.
f. Battery Replacement. If the retrofit includes a change to the ULD, provide instructions for periodically replacing the ULD battery and conducting an operational check of the ULD. The replacement period must be consistent with the battery manufacturer’s life limit. Include instructions for how to access the ULD. The current edition of AC 21-10, Flight Recorder and Cockpit Voice Recorder Underwater Locating Devices, provides information for ULD installations.
NOTE: If the ULD battery is not accessible, the instructions must be for replacement of the ULD itself.
g. Installation Design. The installer or applicant may design the installation to accommodate DFDRS equipment of different part numbers or of different models and part numbers. For example, the DFDRS equipment manufacturer may assign one part number to equipment that meets the requirements of TSO-C124 and another part number to equipment that meets TSO-C124a. The two different part-numbered DFDRs are identical except that the latter has been shown to withstand the more severe fire resistance test requirements of TSO-C124a.
Since the FAA accepts both DFDRs, the installers may select either DFDR for installation. In this case, provide a list identifying the interchangeable items of equipment by make, model, and part number.
Par 3-1 Page 17 CHAPTER 3. CONTINUED AIRWORTHINESS REQUIREMENTS
3-1. PURPOSE. This chapter provides information for aircraft operators in the development of continued airworthiness requirements of a DFDRS. The basic requirements for continued airworthiness of a DFDRS should be provided as part of the data package submitted during TC, amended TC, or STC installation. This chapter outlines those basic requirements in case the original information was insufficient or not provided as part of the system certification.
3-2. CONTINUOUS AIRWORTHINESS MAINTENANCE PROGRAM (CAMP). A typical maintenance program should include all the checks necessary to ensure that the DFDRS operates as certified at specified intervals. Such intervals, or schedules, are delineated and described in AC 120-16, Air Carrier Maintenance Programs, current edition. The aircraft manufacturer or system designer/installer should provide the basic maintenance program recommendations. However, factors such as aircraft age, system design, and aircraft operation must be taken into account when developing the maintenance program. The following are typical parts found in a DFDRS maintenance program:
a. Operational Check. Check that there are no failures in the DFDRS. The flightcrew usually accomplishes this task. The task typically verifies that there are no DFDRS system fault indications. We recommend that the checks occur before the first flight each day.
b. Reasonableness Check. Provide for a download of the DFDR to accomplish a reasonableness check of the data. The maintenance program task will typically require removal of the data or the DFDR. This completes the aircraft portion of the maintenance task. The reasonableness check of the data is performed off-aircraft. The check of the data should be accomplished as soon as possible. The operator should have provisions for addressing and correcting any discrepancies found during the reasonableness check.
c. System Functional. Check. Perform a complete functional check of certain parameter inputs to the DFDRS to ensure the system is as certified. This functional check may be done in conjunction with a reasonableness check. Identify signals from parameter sources that cannot be verified during checks of other aircraft systems and equipment.
(1) This is particularly important for older analog systems that use dedicated sensors to provide input to the DFDRS. Sensor type and installation often determine the level of check that is necessary to ensure they remain within the certificated tolerances. For example, some installations use a string potentiometer installed on the aileron bellcrank to provide control wheel input position. If the output of this sensor is only used for the DFDRS, then this is a dedicated sensor. There are several things that could happen to this type of sensor that could make the data provided invalid. It could be adjusted or repositioned during maintenance to the aileron system.
To ensure that the output from this sensor is still within the range and accuracy requirements of the installation, the output parameters must be verified. The following are some types of parameters that should be included in the system functional check:
(a) Dedicated sources.
(b) Analog discrete inputs or analog warning inputs that are not normally exercised during flight.
Page 18 Par 3-2
(2) The functional check need not include other parameters that verify the accuracy of the output during the source systems operational or functional check. This includes digital discrete input and digital warning input that are not normally exercised during flight.
3-3. ICA. The operator must maintain ICA as part of its manual. The aircraft manufacturer or the system installer typically provides the ICA but if they are not provided, the operator should develop them. The operator developed ICA must identify all requirements that would have been established at time of certification and any others subsequently identified by the FAA, e.g., those applicable under Airworthiness Directive (AD). These instructions must include as a minimum:
a. Data Stream. The data stream format and correlation data outlined in Appendix 1. If this is not available, it should be created from the document or software used to convert the raw data into EU. If the information needed cannot be derived from the download document/software, then the operator must perform the necessary test and analysis to reproduce the necessary documentation (see Appendix 2 if applicable).
b. Dedicated Sources. A list of dedicated sources is defined in chapter 1, subparagraph 1-3f. Include procedures for a ground check of these sources. Provide sufficient information, including source, label and word, to verify the range and accuracy of the recorded data as specified in the applicable operating rule.
c. Removal and Replacement. Include removal and replacement instructions for DFDRS equipment and dedicated sensors. Also include instructions for conducting a functional check of the equipment and verification of the parameter range and accuracy.
d. Software. If chapter 2, paragraph 2-6 applies, include procedures for loading software during DFDRS installation or during DFDRS maintenance. (See FAA Order 8110.49, Software Approval Guidelines.)
Appendix 1 APPENDIX 1. STANDARD DATA FORMAT FOR DIGITAL FLIGHT DATA
RECORDERS, DATA STREAM FORMAT, AND CORRELATION DOCUMENTATION
1. DFDR. The DFDR records flight data in a digital format. Data is normally grouped into words that are synchronized in a data stream. The data stream must be correlated to EU or to discrete states for an accident investigator to use the data. This appendix provides the specific information that operators must provide to the NTSB investigators for them to decode and convert the raw data stream recorded by the DFDR. This data format information can be contained within an electronic file or in hardcopy document format.
2. GUIDELINES FOR DOCUMENTATION. Information regarding acceptable guidelines for documentation of DFDR data content and format are also available in the FRED document, ARINC Specification 647A. The ARINC FRED specification provides a standard format for electronic documentation of DFDR data. This standard format supersedes an older electronic format, the Flight Recorder Configuration Standard, Document TP13140E. Although the FRCS documentation format is acceptable, because FRED supersedes TP13140E, the preferred electronic format is the ARINC FRED format. The FRED specification, ARINC 647A, can be obtained by contacting:
ARINC Inc.
Document Section 2551 Riva Road Annapolis, MD 21401-7465 Telephone: (410) 266-4117 Fax: (410) 266-2047 E-mail: standards@arinc.com
3. DEFINITIONS. The following definitions apply to terminology often used in the DFDR correlation documentation. These definitions are derived from ARINC Characteristic 717-10, Flight Data Acquisition and Recording System, dated April 1, 1998. An operator using another data stream format must provide definitions unique to its format in the correlation documentation.
a. DFDR Bit Number. Defines a specific bit location within a DFDR system word on the output from the DFDR. The DFDR bit number is used to locate the bits that are dedicated to a given parameter within the word. For example DFDR bit numbers 3-12 indicate bit 3 through bit 12. The lowest bit number is normally the least significant bit.
b. Lexicon. A dictionary of all mnemonic codes and the associated parameters each represents. To aid in the standardization of parameter identification, ARINC Specification 647A appendix C contains a recommended lexicon.
c. Mnemonic Code. An abbreviation of the parameter name. It is intended to be used in formats where the parameter name is too large. The mnemonic code must be unique and used to identify the parameter as described in the applicable appendix (part 121 appendix B or M, part 125 appendix E, or part 135 appendices B through F). The aircraft manufacturer normally assigns a mnemonic code to each parameter. This code is normally correlated to the parameter
Appendix 1 name in the aircraft manufacturer’s interface control document. However, an installer or an operator may assign a mnemonic code to an added parameter. The mnemonic code must uniquely identify the parameter relative to all other parameters being recorded by the DFDR.
Additional characters may be necessary to uniquely identify the parameter as installed on the aircraft.
d. Parameter Name. The name of the function being recorded. The documentation must contain a means to correlate each recorded parameter name to those in the applicable appendix (part 121 appendix B or M, part 125 appendix E, or part 135 appendices B through F). Where possible, the parameter name should correlate to the aircraft manufacturer’s or applicant’s interface control documentation. Sufficient information must be contained in the parameter name to make it unique and to convey information on its source.
e. Range. The full range of a parameter (minimum to maximum) expressed in EU. Where the parameter range accommodated in the aircraft exceeds the parameter range specified in the regulations, (e.g., pressure altitude in large aircraft) the applicant should provide for recording the range accommodated in the aircraft. Enter “NA” for discrete parameters. Range of a parameter is defined by either:
(1) The full recordable range of the parameter on the flight recorder, or
(2) The parameter’s operational range. The operational range is typically a subset of the recordable range. The inclusion of operational range is useful in analysis of the recorded data.
NOTE: The inclusion of a parameter’s recorded range does not imply that the parameter is recorded linearly on the flight recorder.
f. Signal Source. The aircraft subsystem, or the dedicated transducer or signal conditioner, used to provide the signal for the DFDR, FDAU, or DFDAU (or equivalent).
g. Superframe Cycle. A subdivision of a given word slot address in a subframe. This typically provides 16 additional addresses. A counter provides the cycle number reference. The cycle number must be documented as a parameter.
h. Word Number. The location of a 12-bit word within the subframe. Word numbering starts at 1 (the first word in the subframe).
4. DATA STREAM FORMAT.
a. Data Stream Format. The data stream format defines where an analyst must look in the DFDR output to find a selected parameter or other information. Data stream format and encoded data format characteristics must be described and accurate to the specification provided by the manufacturer. The output of the data stream format should provide clear header and parameter information from the DFDR. Most DFDR data are encoded using the ARINC Characteristic 573 or ARINC Characteristic 717. Although these ARINC data bus encoding systems do not specify the data format, they provide the framework within which the data is formatted, in a fixed-frame format.
Appendix 1
b. Frames and Subframes. Specifically, they generate 12-bit words with a word rate that may vary, i.e., 32, 64, 128, 256, 512, or 1024 (words/second). The data is organized into frames that are repeated every 4 seconds. Each frame consists of 4 subframes. Each subframe occupies 1 second in the data stream, however, not all data streams are ARINC compliant and a subframe may occupy more or less than 1 second. The first word in each subframe normally provides the frame synchronization pattern. The data stream format should enable the analyst to locate header information and parameter information in the DFDR output.
c. Header Information. For DFDRs that conform to ARINC characteristics, the following information should be stored in a header file. (For other DFDR frame structures, the number of subframes per frame must be omitted and the frame structure must be uniquely described.) The header file must include:
(1) Aircraft make and model.
(2) Aircraft serial number.
(3) DFDR make and model/part number.
(4) Number of subframes per frame, for a fixed-frame. Or a description of each of the frame formats in a multiple-frame format data stream.
d. Record Information.
(1) For a fixed-frame format:
(a) Bits in the DFDR word.
(b) Number of DFDR words in a subframe.
(c) Time duration of the subframe (seconds).
(2) For a multiple-frame format:
(a) List of parameters in the frame, in order.
(b) The number of bits used to store each parameter.
e. Parameter Information. The identification for each parameter should include:
(1) Parameter name—must be unique from all other parameters recorded.
(2) Mnemonic code—a common abbreviation for the parameter, which must be unique from the mnemonic codes of all other parameters recorded.
f. Parameter Location. Both component(s) and timing information should be provided for each parameter sample. Usually there is only one component. For samples having more than one component the components should be ordered from least significant to most significant in the
Appendix 1 data stream. Each sample location for a parameter should have the same total number of bits. The following items must be provided for a parameter sample location:
(1) Subframe number.
(2) Word number.
(3) Bit numbers.
(4) If superframe cycles are used, also provide:
(a) Cycle counter name.
(b) Cycle numbers.
5. LEXICON OF MNEMONIC CODES. If mnemonic codes are used, a lexicon of these codes must be provided.
6. EU CONVERSION. EU conversions must convert decimal counts to the parameter value measured. Where the parameter is used by the pilot in flight (e.g., airspeed, altitude, and heading), the conversion must be correlated to the value shown to the pilot. Other values must be correlated to values sensed by the aircraft. Where an EU conversion results in an interim parameter (e.g., alternating current voltage ratio No. 1, frequency, direct current voltage ratio No. 2, potentiometer, or synchro angle) the conversion formula that converts this interim parameter to the actual parameter must also be provided. Each recorded parameter must be converted to an EU. Both signage (whether or not the raw data contains a plus or minus sign and the location of the sign in the parameter bits) and raw data range must be provided. Standardized signage is provided in ARINC Specification 647A appendices E and F. Instructions must be provided to enable the accident investigator to convert the recorded data to EU An example of acceptable conversion equations are as follows:
a. Linear Equation.
1010 CNTSAAEU ×+= where: EU is the value in engineering units 0CNTSthewhenEUofnumbertheisA 100 = 1A is the slope of the line in EU per decimal count 10CNTS is the number of binary or binary coded decimal (BCD) counts converted to decimal counts
Appendix 1
b. Piece-wise Linear Equation. In some instances it may be necessary to correlate the data using multiple linear equations. For example, the data of Figure 1-1 was obtained using two linear equations as follows:
For Altitude (EU) feet500≤ For Altitude (EU) feet500> ()() 0200231.0A 002.0A10 = −= ( )() 013351.0A 29673.0A10 = −= where, ≤ indicates equal to or less than > indicates greater than
c. Polynomial Equation.
X2 10x1021010 CNTSACNTSACNTSAAEU ×+×+×+= K where, EU is the value in engineering units 10CNTS is the number of binary or BCD counts converted to decimal counts 0A is the number of EU when the 0CNTS10 = X21 A,A,A K are coefficients developed by a curve fit
d. Unique Equation. Where a unique equation applies, explicit documentation must be developed at the time of certification and approved by the FAA. This documentation may contain sufficient information to allow a tool programmer the ability to develop a conversion that uses his tool efficiently.
7. EU DATA CORRELATION. When certifying new parameter implementations, an acceptable procedure to correlate the recorded data to the data derived from the conversion equation follows:
(1) Set or read the device being measured (radio altimeter altitude for example) to a known fixed data point.
(2) Record the data in the Raw Data (EU) column of Table 1-2.
(3) Record the decimal counts from the DFDR record in the 10CNTS column of Table 1-2.
NOTE: The DFDR normally records counts in a binary format. Most equipment manufacturers provide a digital output port and test equipment to access the data. Data can be displayed in binary, octal, or hexadecimal format with octal being the most common. Convert the counts to decimals using instructions provided by the equipment manufacturer.
(4) Repeat steps (1) through (3) above until a sufficient number of data points have been collected for correlation.
Appendix 1 NOTE: The number of required data points will vary depending upon the parameter and the transducer. As a minimum, three data points must be recorded for linear equation parameters, one at the mid-point (or null point) and the others at each end point of the range for the parameter. For polynomial equation parameters, the more data points taken for correlation will produce a higher quality conversion formula. Also, the recorded data points must include one at each end of the range and sufficient intermediate points to produce an accurate conversion formula. For piece-wise linear equations, a minimum of three data points must be recorded for each linear segment of the equation.
(5) Derive the EU value for each recorded 10CNTS value using the conversion equation or method provided. Record the derived value for each data point. When necessary intermediate conversion methods may be used to improve conversion accuracy of the parameter.
(6) The tabulated raw data and the derived data must also be plotted to confirm the prediction capability of the equation (linear, piece-wise linear, polynomial or unique). The plot must cover the full operating range for the parameter. See Figure 1-1 for an example plot. In the example of Figure 1-1, the data is so closely correlated (correlation coefficient = 0.99985) that the raw data and the derived data appear to be superimposed on each other.
FIGURE 1-1. AN EXAMPLE PLOT OF THE RADIO ALTIMETER IN FEET VERSUS
DECIMAL COUNTS
8. DISCRETE DECIPHER LOGIC. The correlation documentation must contain decipher logic for discrete parameters. The decipher logic must identify the status of the discrete represented by each binary state (e.g., “0” =OFF, “1”=ON). In instances where a group of discrete states is represented by multiple binary bits, the entire discrete word must be presented in the correlation document. See Table 1-1. The word slot, subframe, and bit logic for the specific discrete codes must be identified in the documentation.