CHAPTER 1. GENERAL INFORMATION
1-1. Purpose of this Advisory Circular. This advisory circular (AC) provides guidance on compliance with the applicable regulations for the airworthiness and operational approval for digital flight data recorder systems (DFDRS).
1-2. Audience. The Federal Aviation Administration (FAA) wrote this AC for airframe manufacturers, DFDRS manufacturers, aircraft operators, and STC applicants. This AC is also for people modifying any of the systems whose data is recorded, to ensure the new system is correctly recording.
1-3. Cancellation. AC 20-141A, Airworthiness and Operational Approval of Digital Flight Data Recorder Systems, dated December 8, 2008, is canceled.
1-4. Focus. This AC provides information for the following:
a. Type certification of a DFDRS installation.
b. Continuous airworthiness maintenance program (CAMP) information for compliance with the operating rules after DFDRS installation.
1-5. Related CFRs. Sections of 14 CFR parts 23, 25, 27, 29, 91, 121, 125, 129, and 135 prescribe design substantiation and operational approval requirements directly applicable to the DFDRS. Listed below are the specific 14 CFR sectio ns applicable to this AC. See appendix 3 to determine the applicable regulations for your aircraft.
a. Section 23.1459, Flight data recorders.
b. Section 25.1459, Flight data recorders.
c. Section 27.1459, Flight data recorders.
d. Section 29.1459, Flight data recorders.
e. Section 23.1529, Instructions for continued airworthiness.
f. Section 25.1529, Instructions for continued airworthiness.
g. Section 27.1529, Instructions for continued airworthiness.
h. Section 29.1529, Instructions for continued airworthiness.
i. Section 91.609, Flight data recorders and cockpit voice recorders.
j. Section 91.1045, Additional equipment requirements.
k. Section 121.343, Flight data recorders.
l. Section 121.344, Digital flight data recorders for transport category airplanes.
m. Section 121.344a, Digital flight data recorders for 10-19 seat airplanes.
n. Section 121.346, Flight data recorders: filtered data.
o. Section 125.225, Flight data recorders.
p. Section 125.226, Digital flight data recorders.
q. Section 125.228, Flight data recorders: filtered data.
r. Section 129.20, Digital flight data recorders.
s. Section 135.152, Flight data recorders.
t. Section 135.156, Flight data recorders: filtered data.
1-6. DFDRS purpose. The purpose of a DFDRS is to collect accurate data to assist investigations of accidents and incidents. The objective is met by complying with the current requirements in 14 CFR parts 91, 121, 125, 129, and 135.
1-7. Operators. An operator may not operate an aircraft on its operations specifications in air transportation unless that aircraft complies with the flight data recorder (FDR) requirements of the appropriate 14 CFR part (91, 121, 125, 129, or 135).
CHAPTER 2. TYPE CERTIFICATION
2-1. Purpose of this chapter. This chapter provides information for type certification of a DFDRS. The applicant must obtain FAA approval to install or to retrofit a DFDR and components. The applicant may apply for a type certificate (TC), amended TC, STC, or other manner of approval. The applicant must demonstrate compliance with the applicable regulations included in the type certification basis for the aircraft. Appendix 4 lists typical certification requirements that are applicable depending upon the certification basis of the aircraft. The type certificate data sheet (TCDS) referenced in the TC normally identifies the applicable regulations.
An applicant must demonstrate compliance with the appropriate certification requirements as instructed by the approving aircraft certification office (ACO) or flight standards district office (FSDO). (See appendix 3.)
2-2. DFDRS substantiating data. The system description must include:
a. The make and the model or part number of the DFDR, flight data acquisition unit (FDAU), or digital FDAU (DFDAU) (or equivalent function).
b. A listing of each parameter recorded.
c. Documentation which shows the correlation data for each parameter.
d. Identification of all transducers or sensors installed specifically for the purpose of sensing required data. Include the manuf acturer and part number of the sensor.
e. Identification of sensors not dedicated exclusively to the DFDRS. Include the sensor source and the associated digital data bus source.
f. Identification of pneumatic inputs directly connected to the DFDRS for pitot-static information.
g. Identification of components of the DFDRS that meet Technical Standard Order (TSO) standards including the TSO number and any authorized deviations from the TSO requirements.
h. Description of structural alterations associated with the installation.
i. A wiring diagram and system schematic. Describe all dedicated wires. Identify all interfaces to other installed equipment and systems.
j. Identification of parameters recorded from data buses. Must include source data bus system, word, and label information.
Note: Acceptable guidelines for documentation of DFDR data content and format are available in appendix 1 and in the ARINC Flight Recorder Electronic Documentation (FRED) specification (ARINC Specification 647A). These data format guidelines provide the information necessary to decode the DFDR raw data stream. The information can be contained in hardcopy document or electronic format. Specifically, the ARINC FRED standard provides the 3
electronic format that supersedes a prior electronic format standard, the Flight Recorder Configuration Standard (FRCS), Document TP13140E. Although the FRCS standard is an acceptable electronic format for DFDR decoding information, the ARINC specification evolved from the FRCS format and includes information for various raw data stream formats. (See appendix 1.)
2-3. Intended function. The DFDRS records parametric data that represents (as closely as possible) the actual aircraft function. The applicant must provide a list of all parameters the DFDRS will record and their specifications (range, accuracy, sampling rate, and resolution). The applicant must demonstrate, by a first of type functional test, that the DFDRS meets these specifications under both static and dynamic conditions. (See definitions in appendix 6.) These tests are normally performed using simulated inputs to the DFDRS and by activating transducers and sensors installed as part of the DFDRS. When the installation design allows switching of the sensor or the digital bus during flight, the applicant must demonstrate performance in all switched positions. As part of this test, the applicant must provide a correlation document. See data stream format and correlation document as described in appendix 1 and, if applicable, reverse DFDR data correlation procedures in appendix 2.
Note: Before performing ground or flight tests on the DFDRS installation, the applicant must perform a conformity check. This check must demonstrate the DFDRS installation conforms to the design data cited on the TC, amended TC, or STC.
a. Identify parameters. The applicant must identify the specific parameters defined in appendix 5 are filtered before they are recorded. For these parameters, the applicant must show the actual sensed value of the parameter can be readily retrieved and unambiguously derived from the recorded value, and the derived value can be shown to be within the range, accuracy, sampling rate, and resolution as specified in the applicable operating rule appendix under both static and dynamic conditions. This must be shown by test, analysis, or simulation. See appendix 5 for more guidance on filtered flight data.
(1) If it is necessary to use a process or procedure for deriving the actual recorded data, that process or procedure must be documented and provided to the aircraft operator to satisfy 14 CFR §§ 121.344(j), 121.344a(d), 125.226(j), or 135.152(f)(2) requirements.
(2) The process or procedure must be performed during certification of the system.
(3) The applicant must perform a ground cockpit compatibility check to demonstrate performance of the DFDRS installation. This compatibility demonstration must include:
(a) A demonstration that the circuit breaker can be identified and reset from a flight crew position (if a circuit breaker is provided for crew reset),
(b) A check that the DFDR “preflight check” indicator or display is visible (or aural tone is audible) to the flight crew, and 4
(c) A demonstration of any DFDR-related items in the FAA approved flight manual supplement to verify that approved flight manual procedures have not been invalidated by the installation.
Note: The STC process does not provide for findings of compliance with operating rules such as 14 CFR § 121.344. An applicant for TC approval (TC, amended TC, or STC) may facilitate the operator’s later demonstration of compliance to the operating rule by referencing the appropriate appendix and parameter numbers of 14 CFR part 91, 121, 125, 129, or 135 for the specifications met when demonstrating the DFDRS performs its intended function. The FAA inspector may use the test report to support a finding of compliance with the operating rule. The applicant should substantiate any discrepancies between the parameter specifications in the appropriate appendix of the operating rule and those demonstrated by test. Such substantiation is needed for the ACO to find a “novel, unique design, or operational characteristic.” (See 14 CF R § 25.1459(e) or equivalent.) The applicant must include the substantiation as part of the operational specifications or minimum equipment list. The operator may later use this substantiation to support a petition for exemption from the operating rule.
For example, the applicant may need to substantiate a unique design characteristic to change the way the DFDR records a required parameter if such recording would compromise a critical function of the aircraft. In this case, the operator installing the FAA-approved system must then request an exemption from the parameter-recording requirement. (See 14 CFR § 11.63 for procedures to petition for an exemption.)
b. Demonstrate performance. The applicant must demonstrate the DFDRS performs as intended, does not cause electromagnetic interference (EMI) in essential or flight-critical systems, and electromagnetic fields from other operating electrical and electronic systems and components do not cause noise or data dropouts in the DFDR recorded data. If the applicant cannot demonstrate these capabilities using ground tests, a flight test must be performed. During this test, the applicant must demonstrate the DFDRS is not susceptible to EMI or radio frequency interference (RFI) and the DFDRS does not generate such interference in essential or flight-critical systems. After the ground or flight test, the applicant must conduct a reasonableness or system functional check of the DFDR data. The purpose of this test is to demonstrate each parameter is being recorded properly and any data dropouts or noise do not interfere with the ability to interpret the data.
Note: Using the flight test data, the applicant must confirm the DFDR begins to operate no later than the time the aircraft begins its takeoff roll and continues to operate until after the aircraft has completed its landing roll. For rotorcraft, the DFDR must operate continuously from the instant the rotorcraft begins its liftoff until it has landed.
c. Establish correlation. The applicant must establish the correlation between the raw data and the engineering units (EU) for all mandatory parameters. (Reference 14 CFR § 121.344(j).) The correlation requ ired in the type certification regulations described in 14 CFR 5
§ 25.1459(c) does not meet the correlation requirement of 14 CFR § 121.344(j). The correlation in 14 CFR § 25.1459(c) must be established between the flight recorder readings between airspeed, altitude, and heading and the corresponding readings of the captain’s instruments. The correlation in 14 CFR § 121.344(j) is between the values recorded by the recorder and the corresponding values being measured. The applicant must use the binary to EU conversion algorithm to describe this relationship in its correlation documentation.
2-4. Equipment and sensors. The applicant must present evidence that the equipment and sensors are to be installed as part of the retrofit are FAA-approved, or obtain FAA approval for them.
a. TSO-C124 (Flight Data Recorder Systems) authorization. The DFDR must meet the requirements of TSO-C124, or later revision, to comply with this rule and does not need to be further evaluated.
b. TSO-C121 (Underwater Locating Devices (Acoustic) (Self-Powered)) authorization. A ULD manufactured under TSO-C121 or later revision is FAA-approved.
c. Interleaving. Interleaving of certain parameters is permissible except where prohibited by the applicable operating rule. However, interleaving is discouraged unless there is insufficient recorder capacity. Interleaving is defined as recording samples from multiple parts of a system and combining them to meet the required sample rate for an individual parameter.
An example of interleaving is recording the left aileron input twice per second and the right aileron twice per second, and then combining both of those recorded parameters for a total aileron sample rate of four times per second.
d. Source selection. The source for the parameter should be selected to provide data as close (physically or electrically) to the original source as possible. Source selection is critical for providing accurate and timely data information for post accident and incident analysis. The data should be “handled” by as few components as possible before reaching the flight data acquisition function. When evaluating the su itability of a cockpit display as a DFDR data source, pay particular attention to nonflight critical information such as displayed flight control position, which is typically filtered to provide a smooth cockpit presentation. See appendix 5 for additional guidance for filtered flight data.
e. Altitude and airspeed sensors. When an air data computer (ADC) is installed, the pressure altitude and indicated or calibrated airspeed must be recorded from the air data computer. When two ADCs are installed, one supplying the captain’s instrumentation and the other supplying the first officer’s instrumentation, the pressure altitude and indicated or calibrated airspeed must be recorded from at least one ADC. When there is no ADC, or when independent altitude and airspeed indicators are installed, the pressure altitude and indicated or calibrated airspeed may be derived from either of the instrumentation systems or it may be derived from a separate pitot static system. When the data is derived, instrumentation systems must not be adversely affected.
f. Control position and forces (nonfly-by-wire). Control positions and control forces must be measured at the control columns, control wheels, and rudder pedals when practical.
Where the applicant shows this is impractical, the positions and forces may be measured on the first lever arm or on the first bellcrank in the control linkage from the control. Should the applicant determine that installation of the sensor on this first control arm or bellcrank is impractical, the applicant should conduct an analysis to show the hazard likelihood of mechanical interference that could invalidate the recorded position and force values is improbable (< 1x10-5).
Note: Installation of force sensors are usually made in series in the control system. The FAA recommends the TC holder review any STC force sensor implementation that revises or modifies the flight control system or that can affect the function of the autopilot or pilot controls.
g. Thrust command and thrust target. Thrust command and thrust target are typically available on aircraft equipped with a full authority digital electronic control (FADEC). Thrust command is the thrust required by the FADEC for some predefined schedule. Thrust target is the thrust to be achieved at the end of the thrust command schedule. Once the thrust target is achieved, the thrust command and the thrust target will be the same.
h. Computer failure discrete. This parameter is a discrete and should be activated upon failure of any computer that could directly affect the primary and secondary flight controls or the engine controls (primarily the throttles). Some examples of computers that should be monitored for failure are those that are a part of the flight management system, the auto-throttle system, and the autopilot. Furthermore, if a computer drives any of the above computers, and there is no discrete transmitted to that computer from the device, that device’s computer should also be monitored.
i. Multiple control surfaces (flap sections, aileron/spoiler speed brake panels) and combinations for lateral control.
(1) Ailerons on each wing must be monitored separately.
(2) Multiple aileron surfaces mounted on the same wing must be monitored separately.
(3) All secondary control surfaces (e.g., flaps, speed brakes, and spoilers) that normally activate together, but can activate independently of each other, should also be monitored separately.
j. Multiple thrust reverser buckets (or sleeves). Each individual thrust reverser bucket (sleeve) must be monitored unless the designer shows it is improbable that an individual bucket (sleeve) would deploy without intentional deployment of all buckets at once.
k. Hydraulic pressure. Hydraulic pressure low, each system (parameter 33) and hydraulic pressure, each system (parameter 77) are both mandatory parameters. For example, although hydraulic pressure low is defined as a discrete, the comment in the range column of 14 CFR part 121, appendix M indicates it may also be recorded as an analog signal representing the actual value of the hydraulic pressure. Thus, eith er the hydraulic pressure low discrete or the actual analog hydraulic pressure may be recorded for all DFDRS installations except those on 7
aircraft manufactured after August 19, 2002. For aircraft manufactured after August 19, 2002, both parameter 33 and parameter 77 are required.
l. Safety analysis of sensors installed in flight control systems. Some flight control surface and flight control input sensors consist of rotary synchros attached to the flight control system using mechanical arms and links. The ends of the links (rod ends) and the synchros have bearings that may be subject to seizure due to loss of lubrication. Such seizures may jam flight controls, resulting in a catastrophic failure condition. The applicant must conduct a safety analysis to evaluate the reliability and fail-safe aspects of sensor hardware installed in flight control paths. The analysis should demonstrat e the likelihood of a catastrophic failure would occur less than 1x10-9 times per aircraft flight-hour. As a result of this assessment, the applicant may find it necessary to prescribe periodic inspection or replacement of the sensor(s) in the ICA.
Note: When installation of the sensors requires direct attachment to control cables, the attachment hardware must have the same metallurgical properties as the control cables. In addition, periodic inspection of the attachment hardware must be included in the maintenance program.
m. Sensor reliability. Be careful when selecting sensor types for particular applications.
Specifically, certain sensors are less reliable in different applications than others. For instance, potentiometers have historically been unreliable on flight control surface applications where high vibration may be present. However, a similar sensor may be reliably used for other applications, such as pilot input controls.
Note: Potentiometers should be avoided in all cases for retrofit flight recording system design. Synchros, rotary variable differential transducers, and linear variable differential transducers are far more robust in the airplane environment.
2-5. Combination cockpit voice recorder (CVR)/DFDR units. An applicant may install a combination CVR and DFDR unit.
a. Airplane requirements. Two separate recorders are required for airplanes. Therefore, a single combination CVR/DFDR may not serve as both the required DFDR and the required CVR. That is, the applicant may use a comb ination CVR/DFDR unit for either the required DFDR or CVR. The applicant may install two combination CVR/DFDR units in the airplane, one taking credit for each required system.
b. Rotorcraft requirements. On rotorcraft, one combination CVR and DFDR unit may be installed to meet the requirement for a CVR and a DFDR. The combination CVR and DFDR unit must be installed such that no single electrical failure external to the recorder can disable both the cockpit voice recorder and the digital flight data recorder functions.
2-6. Software. For those DFDRs having RTCA, Inc. document RTCA/DO-178B Level E or DO-178A Level 3 software installed, and those DFDRs for which no software approval exists, the person performing the installation or the applicant must:
a. Obtain a statement from the equipment manufacturer that the source code has been archived;
b. Obtain a statement from the equipment manufacturer that the executable object code can be regenerated from the archived source code;
c. Obtain from the equipment manufacturer information necessary to calculate transfer functions; and
d. Demonstrate the software to be loaded during DFDRS installation or during DFDRS maintenance can be successfully loaded through the use of released procedures. These procedures should be included as part of the installation instructions or the ICA, as appropriate.
2-7. Complex electronic hardware. Reserved.
2-8. Weight and balance. Installation or removal of equipment affects the aircraft weight and balance. A report must show the net change in weight and moment (or moment arm) and how the net change was determined. If the installation results in changes to the weight and balance procedures in the flight manual, submit a flight manual supplement to the ACO for approval.
Adjust aircraft records to show such change.
2-9. Electrical loads analysis. Installation or removal of equipment affects the electrical load to the aircraft power distribution system. A repor t must show the net change in the electrical load on each affected bus and how the installer or applicant computed this net change. The installer or applicant must also identify any necessary changes in circuit protective devices. The net change to the load carrying capability of the essential bus must not result in interruption or otherwise adversely affect power distributed to other loads on that bus. Reference 14 CFR §§ 23, 25, 27, and 29.1351.
2-10. Electrical power source. The DFDR must receive its operating electrical power from the bus that allows maximum reliability for the DFDRS. The applicant may not add the DFDR to any bus if the addition would jeopardize essential or emergency loads.
a. Connect to power buses. The applicant must connect the DFDR and the CVR to power buses that are separate and supplied by independent power sources. If the DFDRS cannot be added to the emergency or essential bus, the applicant should consider providing two separate and independent sources of electrical power for each DFDR and its associated FDAU or DFDAU.
b. Automatic switching. The applicant should consider providing each DFDR and its associated FDAU or DFDAU automatically switch between the two power sources to maintain flight data recording in the event of a bus failure. Such provision of two separate and independent power sources would ensure available data essential to accident investigation is recorded throughout the entire accident sequence.
c. External power sources. Separate aircraft external power sources are not required for installation of a single combination CVR/DFDR unit. If there are more than one electrical power 9
inputs available on the combination CVR/DFDR units, then connection with a separate and independent electrical power bus is recommended.
d. Direct wiring. We recommend the DFDR be wired directly to the primary electrical power source for installation as part of the type design.
2-11. Circuit protective devices. Circuit protective devices must be capable of handling anticipated loads for the DFDRS. Reference 14 CFR §§ 23.1357, 25.1357, 27.1357, and 29.1357 as appropriate.
2-12. Preflight monitoring means. An aural or visual indicator is activated in the cockpit when any one of a combination of system status monitors and built-in test capabilities fails. For example, failure of the following functions will produce an indication, depending upon availability of built-in test capability:
a. System electrical power,
b. Data acquisition and processing equipment, and
c. Recording medium or drive mechanism.
2-13. Flight manual applicability. The installer or applicant must review the AFM or RFM and supplements to determine whether they are compatible with the DFDRS installation. The installer or applicant must provide an approved AFM or RFM supplement to eliminate any incompatibilities.
2-14. Instructions for continued airworthiness (ICA). The installer or applicant must provide ICAs as part of the substantiating data. U nder the requirements of 14 CFR parts 23, 25, 27, or § 29.1529, and guidance found in FAA Order 8110.54, Instructions for Continued Airworthiness Responsibilities, Requirements, and Contents, these instructions must include as a minimum and be provided to the operator or maintainer.
a. Data stream. The data stream format and correlation data outlined in appendix 1 or appendix 2 if applicable.
b. Dedicated sources. A list of dedicated sources as defined in appendix 6. Include procedures for a ground check of these sources. Provide sufficient information, including source, label and word, to verify the range and accuracy of the recorded data as specified in the applicable operating rule.
c. Procedures and intervals. Procedures and recommended check intervals to functionally check parameters with dedicated sources not typically activated and recorded during normal aircraft operation.
d. Checks. The instructions may reference procedures for checks furnished in the ICA for the parameter source systems. See appendix 4 for typical reasonableness and quality check instructions.
e. Removal and replacement. Provide removal and replacement instructions for DFDRS equipment and dedicated sensors. Include instructions for conducting a functional check of the equipment.
f. Battery replacement. If the retrofit includes a change to the underwater locator device (ULD), provide instructions for periodically replacing the ULD battery and conducting an operational check of the ULD. The replacement period must be consistent with the battery manufacturer’s life limit. Include instructions for how to access the ULD. The current edition of AC 21-10, Flight Recorder and Cockpit Voice Recorder Underwater Locating Devices, provides information for ULD installations.
Note: If the ULD battery is not accessible, the instructions must be for replacement of the ULD itself.
g. Installation design. The installer or applicant may design the installation to accommodate DFDRS equipment of different part numbers or of different models and part numbers. For example, the DFDRS equipment manufacturer may assign one part number to equipment meeting the requirements of TSO-C124 and another part number to equipment that meets TSO-C124a. The two different part-numbered DFDRs are identical except that the latter was shown to withstand the more severe fire resistance test requirements of TSO-C124a. Since the FAA accepts both DFDRs, the installers may select either DFDR for installation. In this case, provide a list identifying the interchangeable items of equipment by make, model, and part number.
h. Electrical wire interconnection systems (EWIS). For installations of the DFDRS which require alteration or modification of EWIS components on certain 14 CFR part 25 aircraft, the installer or applicant must make an assessment whether EWIS ICA is required as part of the substantiating data. Under the requirements of 14 CFR § 26.11, these instructions, if required, must be provided to the operator or maintainer, as a minimum including the procedures and intervals to inspect and maintain any additional or modified EWIS components pertaining to the installation of the DFDRS.
CHAPTER 3. CONTINUED AIRWORTHINESS REQUIREMENTS
3-1. Purpose of this chapter. This chapter provides information for aircraft operators in the development of continued airworthiness requirements of a DFDRS. The basic requirements for continued airworthiness of a DFDRS must be provided as part of the data package submitted during TC, amended TC, or STC installation. This chapter outlines those basic requirements in case the original information was insufficient or not provided as part of the system certification.
3-2. Continuous airworthiness maintenance program. A typical maintenance program must include all the checks necessary to ensure the DFDRS operates as certified at specified intervals.
Such intervals, or schedules, are delineated and described in AC 120-16, Air Carrier Maintenance Programs, current edition. The aircraft manufacturer or system designer/installer must provide the basic maintenance program recommendations. However, factors such as aircraft age, system design, and aircraft operation must be taken into account when developing the maintenance program. The following are typical parts found in a DFDRS maintenance program:
a. Operational check. Check that there are no failures in the DFDRS. The flightcrew usually accomplishes this task. The task typically verifies that there are no DFDRS system fault indications. We recommend this check occurs befo re the first flight each day. A comprehensive self-test and automatic fault reporting may be used in lieu of a scheduled operational check.
b. Reasonableness check. Provide for a download of the DFDR to accomplish a reasonableness check of the data. The maintenance program task will typically require removal of the data or the DFDR. This completes the aircraft portion of the maintenance task. The reasonableness check of the data is performed off-aircraft. The check of the data should be accomplished as soon as possible. The operator should have provisions for addressing and correcting any discrepancies found during the reasonableness check. We recommend that this check occurs during an interval not to exceed 18 months.
c. System functional check. Perform a complete functional check of certain parameter inputs to the DFDRS to ensure the system is as certified. This functional check may be done in conjunction with a reasonableness check. Identify signals from parameter sources that cannot be verified during checks of other aircraft systems and equipment.
(1) This is particularly important for older analog systems that use dedicated sensors to provide input to the DFDRS. Sensor type and in stallation often determine the level of check that is necessary to ensure they remain within the certificated tolerances. For example, some installations use a string potentiometer installed on the aileron bellcrank to provide control wheel input position. If the output of this sensor is on ly used for the DFDRS, then this is a dedicated sensor. There are several things th at could happen to this type of sensor that could make the data provided invalid. It could be ad justed or repositioned during maintenance to the aileron system.
To ensure the output from this sensor is still within the range and accuracy requirements of the installation, the output parameters must be verified. The following are some types of parameters that should be included in the system functional check:
(a) Dedicated sources.