AC 20-141B

~GlQ.,,.._.

AdvisoryU.S. Department of Transportation Federal Aviation CircularAdministration Subject: Airworthiness and Operational Date: 8/17/10 AC No: 20-141B Approval of Digital Flight Data Recorder Initiated by: AIR-130 Change:

Systems

FOREWORD This advisory circular (AC) provides information on certification (design and installation) and continued airworthiness of digital flight data recorder systems (DFDRS). DFDRS provide information for an investigative authority—the National Transportation Safety Board (NTSB) in the United States—to conduct more thorough investigations of accidents and incidents. The data recorded is also used by operators to enable the prediction of trends that may be useful in determining modifications needed to avoid accidents and incidents.

This AC provides information to applicants for a supplemental type certificate (STC), and to individuals who are responsible for establishing and maintaining compliance under the operating rules for digital flight data recorders (DFDR). Aircraft manufacturers who intend to install DFDRs in newly manufactured aircraft could also use this information.

This AC is not mandatory and is not a regulation. This AC describes an acceptable means, but not the only means, to comply with Title 14 of the Code of Federal Regulations (14 CFR).

Susan J. M. Cabler Assistant Manager, Aircraft Engineering Division

TABLE OF CONTENTS

CHAPTER 1. GENERAL INFORMATION1

1-1. Purpose of this Advisory Circular1

1-2. Audience1

1-3. Cancellation1

1-4. Focus1

1-5. Related CFRs1

1-6. DFDRS purpose2

1-7. Operators2

CHAPTER 2. TYPE CERTIFICATION3

2-1. Purpose of this chapter3

2-2. DFDRS substantiating data3

2-3. Intended function4

2-4. Equipment and sensors6

2-5. Combination cockpit voice recorder (CVR)/DFDR units8

2-6. Software8

2-7. Complex electronic hardware9

2-8. Weight and balance9

2-9. Electrical loads analysis9

2-10. Electrical power source9

2-11. Circuit protective devices10

2-12. Preflight monitoring means10

2-13. Aircraft flight manual applicability10

2-14. Instructions for continued airworthiness (ICA)10

CHAPTER 3. CONTINUED AIRW ORTHINESS REQUIREMENTS12

3-1. Purpose of this chapter12

3-2. Continuous airworthiness maintenance program12

3-3. ICA13

APPENDIX 1. STANDARD DATA FORMAT FOR DIGITAL FLIGHT DATA

RECORDERS, DATA STREAM FORMAT, AND CORRELATION

DOCUMENTATIONA1-1

1. DFDR......................................................................................................................... A 1-1

2. Guidelines for documentationA1-1

3. Definitions.................................................................................................................. A 1-1

4. Data stream formatA1-2

5. Lexicon of mnemonic codesA1-4

6. EU conversionA1-4

7. EU data correlationA1-5

8. Discrete decipher logicA1-6

ii

9. Validation of EU correlationA1-7

APPENDIX 2. REVERSE DFDR DATA CORRELATION PROCEDURESA2-1

1. Purpose of this appendixA2-1

2. Definitions.................................................................................................................. A 2-1

3. Reverse DFDR data correlation Procedure AA2-3

4. Reverse DFDR data correlation Procedure BA2-6

5. Reverse DFDR data correlation Procedure CA2-7

APPENDIX 3. DIGITAL FLIGHT DATA RECORDER PARAMETER

REQUIREMENTS FLOWCHARTA3-1

APPENDIX 4. TYPICAL REASONABLENESS AND QUALITY CHECK

INSTRUCTIONSA4-1

1. GeneralA4-1

2. ChecklistA4-1

3. Flight segment selectionA4-1

4. Sign conventionsA4-1

5. Failed parametersA4-1

6. Correlation to other parametersA4-1

APPENDIX 5. CONSIDERATIONS FOR FILTERED FLIGHT DATAA5-1

1. Purpose of this appendixA5-1

2. Discussion of terms used in the regulationsA5-1

3. ScopeA5-2

4. Compliance times and documentationA5-3

5. FlowchartA5-5

APPENDIX 6. DEFINITIONSA6-1

iii

CHAPTER 1. GENERAL INFORMATION

1-1. Purpose of this Advisory Circular. This advisory circular (AC) provides guidance on compliance with the applicable regulations for the airworthiness and operational approval for digital flight data recorder systems (DFDRS).

1-2. Audience. The Federal Aviation Administration (FAA) wrote this AC for airframe manufacturers, DFDRS manufacturers, aircraft operators, and STC applicants. This AC is also for people modifying any of the systems whose data is recorded, to ensure the new system is correctly recording.

1-3. Cancellation. AC 20-141A, Airworthiness and Operational Approval of Digital Flight Data Recorder Systems, dated December 8, 2008, is canceled.

1-4. Focus. This AC provides information for the following:

a. Type certification of a DFDRS installation.

b. Continuous airworthiness maintenance program (CAMP) information for compliance with the operating rules after DFDRS installation.

1-5. Related CFRs. Sections of 14 CFR parts 23, 25, 27, 29, 91, 121, 125, 129, and 135 prescribe design substantiation and operational approval requirements directly applicable to the DFDRS. Listed below are the specific 14 CFR sectio ns applicable to this AC. See appendix 3 to determine the applicable regulations for your aircraft.

a. Section 23.1459, Flight data recorders.

b. Section 25.1459, Flight data recorders.

c. Section 27.1459, Flight data recorders.

d. Section 29.1459, Flight data recorders.

e. Section 23.1529, Instructions for continued airworthiness.

f. Section 25.1529, Instructions for continued airworthiness.

g. Section 27.1529, Instructions for continued airworthiness.

h. Section 29.1529, Instructions for continued airworthiness.

i. Section 91.609, Flight data recorders and cockpit voice recorders.

j. Section 91.1045, Additional equipment requirements.

k. Section 121.343, Flight data recorders.

l. Section 121.344, Digital flight data recorders for transport category airplanes.

m. Section 121.344a, Digital flight data recorders for 10-19 seat airplanes.

n. Section 121.346, Flight data recorders: filtered data.

o. Section 125.225, Flight data recorders.

p. Section 125.226, Digital flight data recorders.

q. Section 125.228, Flight data recorders: filtered data.

r. Section 129.20, Digital flight data recorders.

s. Section 135.152, Flight data recorders.

t. Section 135.156, Flight data recorders: filtered data.

1-6. DFDRS purpose. The purpose of a DFDRS is to collect accurate data to assist investigations of accidents and incidents. The objective is met by complying with the current requirements in 14 CFR parts 91, 121, 125, 129, and 135.

1-7. Operators. An operator may not operate an aircraft on its operations specifications in air transportation unless that aircraft complies with the flight data recorder (FDR) requirements of the appropriate 14 CFR part (91, 121, 125, 129, or 135).

CHAPTER 2. TYPE CERTIFICATION

2-1. Purpose of this chapter. This chapter provides information for type certification of a DFDRS. The applicant must obtain FAA approval to install or to retrofit a DFDR and components. The applicant may apply for a type certificate (TC), amended TC, STC, or other manner of approval. The applicant must demonstrate compliance with the applicable regulations included in the type certification basis for the aircraft. Appendix 4 lists typical certification requirements that are applicable depending upon the certification basis of the aircraft. The type certificate data sheet (TCDS) referenced in the TC normally identifies the applicable regulations.

An applicant must demonstrate compliance with the appropriate certification requirements as instructed by the approving aircraft certification office (ACO) or flight standards district office (FSDO). (See appendix 3.)

2-2. DFDRS substantiating data. The system description must include:

a. The make and the model or part number of the DFDR, flight data acquisition unit (FDAU), or digital FDAU (DFDAU) (or equivalent function).

b. A listing of each parameter recorded.

c. Documentation which shows the correlation data for each parameter.

d. Identification of all transducers or sensors installed specifically for the purpose of sensing required data. Include the manuf acturer and part number of the sensor.

e. Identification of sensors not dedicated exclusively to the DFDRS. Include the sensor source and the associated digital data bus source.

f. Identification of pneumatic inputs directly connected to the DFDRS for pitot-static information.

g. Identification of components of the DFDRS that meet Technical Standard Order (TSO) standards including the TSO number and any authorized deviations from the TSO requirements.

h. Description of structural alterations associated with the installation.

i. A wiring diagram and system schematic. Describe all dedicated wires. Identify all interfaces to other installed equipment and systems.

j. Identification of parameters recorded from data buses. Must include source data bus system, word, and label information.

Note: Acceptable guidelines for documentation of DFDR data content and format are available in appendix 1 and in the ARINC Flight Recorder Electronic Documentation (FRED) specification (ARINC Specification 647A). These data format guidelines provide the information necessary to decode the DFDR raw data stream. The information can be contained in hardcopy document or electronic format. Specifically, the ARINC FRED standard provides the 3

electronic format that supersedes a prior electronic format standard, the Flight Recorder Configuration Standard (FRCS), Document TP13140E. Although the FRCS standard is an acceptable electronic format for DFDR decoding information, the ARINC specification evolved from the FRCS format and includes information for various raw data stream formats. (See appendix 1.)

2-3. Intended function. The DFDRS records parametric data that represents (as closely as possible) the actual aircraft function. The applicant must provide a list of all parameters the DFDRS will record and their specifications (range, accuracy, sampling rate, and resolution). The applicant must demonstrate, by a first of type functional test, that the DFDRS meets these specifications under both static and dynamic conditions. (See definitions in appendix 6.) These tests are normally performed using simulated inputs to the DFDRS and by activating transducers and sensors installed as part of the DFDRS. When the installation design allows switching of the sensor or the digital bus during flight, the applicant must demonstrate performance in all switched positions. As part of this test, the applicant must provide a correlation document. See data stream format and correlation document as described in appendix 1 and, if applicable, reverse DFDR data correlation procedures in appendix 2.

Note: Before performing ground or flight tests on the DFDRS installation, the applicant must perform a conformity check. This check must demonstrate the DFDRS installation conforms to the design data cited on the TC, amended TC, or STC.

a. Identify parameters. The applicant must identify the specific parameters defined in appendix 5 are filtered before they are recorded. For these parameters, the applicant must show the actual sensed value of the parameter can be readily retrieved and unambiguously derived from the recorded value, and the derived value can be shown to be within the range, accuracy, sampling rate, and resolution as specified in the applicable operating rule appendix under both static and dynamic conditions. This must be shown by test, analysis, or simulation. See appendix 5 for more guidance on filtered flight data.

(1) If it is necessary to use a process or procedure for deriving the actual recorded data, that process or procedure must be documented and provided to the aircraft operator to satisfy 14 CFR §§ 121.344(j), 121.344a(d), 125.226(j), or 135.152(f)(2) requirements.

(2) The process or procedure must be performed during certification of the system.

(3) The applicant must perform a ground cockpit compatibility check to demonstrate performance of the DFDRS installation. This compatibility demonstration must include:

(a) A demonstration that the circuit breaker can be identified and reset from a flight crew position (if a circuit breaker is provided for crew reset),

(b) A check that the DFDR “preflight check” indicator or display is visible (or aural tone is audible) to the flight crew, and 4

(c) A demonstration of any DFDR-related items in the FAA approved flight manual supplement to verify that approved flight manual procedures have not been invalidated by the installation.

Note: The STC process does not provide for findings of compliance with operating rules such as 14 CFR § 121.344. An applicant for TC approval (TC, amended TC, or STC) may facilitate the operator’s later demonstration of compliance to the operating rule by referencing the appropriate appendix and parameter numbers of 14 CFR part 91, 121, 125, 129, or 135 for the specifications met when demonstrating the DFDRS performs its intended function. The FAA inspector may use the test report to support a finding of compliance with the operating rule. The applicant should substantiate any discrepancies between the parameter specifications in the appropriate appendix of the operating rule and those demonstrated by test. Such substantiation is needed for the ACO to find a “novel, unique design, or operational characteristic.” (See 14 CF R § 25.1459(e) or equivalent.) The applicant must include the substantiation as part of the operational specifications or minimum equipment list. The operator may later use this substantiation to support a petition for exemption from the operating rule.

For example, the applicant may need to substantiate a unique design characteristic to change the way the DFDR records a required parameter if such recording would compromise a critical function of the aircraft. In this case, the operator installing the FAA-approved system must then request an exemption from the parameter-recording requirement. (See 14 CFR § 11.63 for procedures to petition for an exemption.)

b. Demonstrate performance. The applicant must demonstrate the DFDRS performs as intended, does not cause electromagnetic interference (EMI) in essential or flight-critical systems, and electromagnetic fields from other operating electrical and electronic systems and components do not cause noise or data dropouts in the DFDR recorded data. If the applicant cannot demonstrate these capabilities using ground tests, a flight test must be performed. During this test, the applicant must demonstrate the DFDRS is not susceptible to EMI or radio frequency interference (RFI) and the DFDRS does not generate such interference in essential or flight-critical systems. After the ground or flight test, the applicant must conduct a reasonableness or system functional check of the DFDR data. The purpose of this test is to demonstrate each parameter is being recorded properly and any data dropouts or noise do not interfere with the ability to interpret the data.

Note: Using the flight test data, the applicant must confirm the DFDR begins to operate no later than the time the aircraft begins its takeoff roll and continues to operate until after the aircraft has completed its landing roll. For rotorcraft, the DFDR must operate continuously from the instant the rotorcraft begins its liftoff until it has landed.

c. Establish correlation. The applicant must establish the correlation between the raw data and the engineering units (EU) for all mandatory parameters. (Reference 14 CFR § 121.344(j).) The correlation requ ired in the type certification regulations described in 14 CFR 5

§ 25.1459(c) does not meet the correlation requirement of 14 CFR § 121.344(j). The correlation in 14 CFR § 25.1459(c) must be established between the flight recorder readings between airspeed, altitude, and heading and the corresponding readings of the captain’s instruments. The correlation in 14 CFR § 121.344(j) is between the values recorded by the recorder and the corresponding values being measured. The applicant must use the binary to EU conversion algorithm to describe this relationship in its correlation documentation.

2-4. Equipment and sensors. The applicant must present evidence that the equipment and sensors are to be installed as part of the retrofit are FAA-approved, or obtain FAA approval for them.

a. TSO-C124 (Flight Data Recorder Systems) authorization. The DFDR must meet the requirements of TSO-C124, or later revision, to comply with this rule and does not need to be further evaluated.

b. TSO-C121 (Underwater Locating Devices (Acoustic) (Self-Powered)) authorization. A ULD manufactured under TSO-C121 or later revision is FAA-approved.

c. Interleaving. Interleaving of certain parameters is permissible except where prohibited by the applicable operating rule. However, interleaving is discouraged unless there is insufficient recorder capacity. Interleaving is defined as recording samples from multiple parts of a system and combining them to meet the required sample rate for an individual parameter.

An example of interleaving is recording the left aileron input twice per second and the right aileron twice per second, and then combining both of those recorded parameters for a total aileron sample rate of four times per second.

d. Source selection. The source for the parameter should be selected to provide data as close (physically or electrically) to the original source as possible. Source selection is critical for providing accurate and timely data information for post accident and incident analysis. The data should be “handled” by as few components as possible before reaching the flight data acquisition function. When evaluating the su itability of a cockpit display as a DFDR data source, pay particular attention to nonflight critical information such as displayed flight control position, which is typically filtered to provide a smooth cockpit presentation. See appendix 5 for additional guidance for filtered flight data.

e. Altitude and airspeed sensors. When an air data computer (ADC) is installed, the pressure altitude and indicated or calibrated airspeed must be recorded from the air data computer. When two ADCs are installed, one supplying the captain’s instrumentation and the other supplying the first officer’s instrumentation, the pressure altitude and indicated or calibrated airspeed must be recorded from at least one ADC. When there is no ADC, or when independent altitude and airspeed indicators are installed, the pressure altitude and indicated or calibrated airspeed may be derived from either of the instrumentation systems or it may be derived from a separate pitot static system. When the data is derived, instrumentation systems must not be adversely affected.

f. Control position and forces (nonfly-by-wire). Control positions and control forces must be measured at the control columns, control wheels, and rudder pedals when practical.

Where the applicant shows this is impractical, the positions and forces may be measured on the first lever arm or on the first bellcrank in the control linkage from the control. Should the applicant determine that installation of the sensor on this first control arm or bellcrank is impractical, the applicant should conduct an analysis to show the hazard likelihood of mechanical interference that could invalidate the recorded position and force values is improbable (< 1x10-5).

Note: Installation of force sensors are usually made in series in the control system. The FAA recommends the TC holder review any STC force sensor implementation that revises or modifies the flight control system or that can affect the function of the autopilot or pilot controls.

g. Thrust command and thrust target. Thrust command and thrust target are typically available on aircraft equipped with a full authority digital electronic control (FADEC). Thrust command is the thrust required by the FADEC for some predefined schedule. Thrust target is the thrust to be achieved at the end of the thrust command schedule. Once the thrust target is achieved, the thrust command and the thrust target will be the same.

h. Computer failure discrete. This parameter is a discrete and should be activated upon failure of any computer that could directly affect the primary and secondary flight controls or the engine controls (primarily the throttles). Some examples of computers that should be monitored for failure are those that are a part of the flight management system, the auto-throttle system, and the autopilot. Furthermore, if a computer drives any of the above computers, and there is no discrete transmitted to that computer from the device, that device’s computer should also be monitored.

i. Multiple control surfaces (flap sections, aileron/spoiler speed brake panels) and combinations for lateral control.

(1) Ailerons on each wing must be monitored separately.

(2) Multiple aileron surfaces mounted on the same wing must be monitored separately.

(3) All secondary control surfaces (e.g., flaps, speed brakes, and spoilers) that normally activate together, but can activate independently of each other, should also be monitored separately.

j. Multiple thrust reverser buckets (or sleeves). Each individual thrust reverser bucket (sleeve) must be monitored unless the designer shows it is improbable that an individual bucket (sleeve) would deploy without intentional deployment of all buckets at once.

k. Hydraulic pressure. Hydraulic pressure low, each system (parameter 33) and hydraulic pressure, each system (parameter 77) are both mandatory parameters. For example, although hydraulic pressure low is defined as a discrete, the comment in the range column of 14 CFR part 121, appendix M indicates it may also be recorded as an analog signal representing the actual value of the hydraulic pressure. Thus, eith er the hydraulic pressure low discrete or the actual analog hydraulic pressure may be recorded for all DFDRS installations except those on 7

aircraft manufactured after August 19, 2002. For aircraft manufactured after August 19, 2002, both parameter 33 and parameter 77 are required.

l. Safety analysis of sensors installed in flight control systems. Some flight control surface and flight control input sensors consist of rotary synchros attached to the flight control system using mechanical arms and links. The ends of the links (rod ends) and the synchros have bearings that may be subject to seizure due to loss of lubrication. Such seizures may jam flight controls, resulting in a catastrophic failure condition. The applicant must conduct a safety analysis to evaluate the reliability and fail-safe aspects of sensor hardware installed in flight control paths. The analysis should demonstrat e the likelihood of a catastrophic failure would occur less than 1x10-9 times per aircraft flight-hour. As a result of this assessment, the applicant may find it necessary to prescribe periodic inspection or replacement of the sensor(s) in the ICA.

Note: When installation of the sensors requires direct attachment to control cables, the attachment hardware must have the same metallurgical properties as the control cables. In addition, periodic inspection of the attachment hardware must be included in the maintenance program.

m. Sensor reliability. Be careful when selecting sensor types for particular applications.

Specifically, certain sensors are less reliable in different applications than others. For instance, potentiometers have historically been unreliable on flight control surface applications where high vibration may be present. However, a similar sensor may be reliably used for other applications, such as pilot input controls.

Note: Potentiometers should be avoided in all cases for retrofit flight recording system design. Synchros, rotary variable differential transducers, and linear variable differential transducers are far more robust in the airplane environment.

2-5. Combination cockpit voice recorder (CVR)/DFDR units. An applicant may install a combination CVR and DFDR unit.

a. Airplane requirements. Two separate recorders are required for airplanes. Therefore, a single combination CVR/DFDR may not serve as both the required DFDR and the required CVR. That is, the applicant may use a comb ination CVR/DFDR unit for either the required DFDR or CVR. The applicant may install two combination CVR/DFDR units in the airplane, one taking credit for each required system.

b. Rotorcraft requirements. On rotorcraft, one combination CVR and DFDR unit may be installed to meet the requirement for a CVR and a DFDR. The combination CVR and DFDR unit must be installed such that no single electrical failure external to the recorder can disable both the cockpit voice recorder and the digital flight data recorder functions.

2-6. Software. For those DFDRs having RTCA, Inc. document RTCA/DO-178B Level E or DO-178A Level 3 software installed, and those DFDRs for which no software approval exists, the person performing the installation or the applicant must:

a. Obtain a statement from the equipment manufacturer that the source code has been archived;

b. Obtain a statement from the equipment manufacturer that the executable object code can be regenerated from the archived source code;

c. Obtain from the equipment manufacturer information necessary to calculate transfer functions; and

d. Demonstrate the software to be loaded during DFDRS installation or during DFDRS maintenance can be successfully loaded through the use of released procedures. These procedures should be included as part of the installation instructions or the ICA, as appropriate.

2-7. Complex electronic hardware. Reserved.

2-8. Weight and balance. Installation or removal of equipment affects the aircraft weight and balance. A report must show the net change in weight and moment (or moment arm) and how the net change was determined. If the installation results in changes to the weight and balance procedures in the flight manual, submit a flight manual supplement to the ACO for approval.

Adjust aircraft records to show such change.

2-9. Electrical loads analysis. Installation or removal of equipment affects the electrical load to the aircraft power distribution system. A repor t must show the net change in the electrical load on each affected bus and how the installer or applicant computed this net change. The installer or applicant must also identify any necessary changes in circuit protective devices. The net change to the load carrying capability of the essential bus must not result in interruption or otherwise adversely affect power distributed to other loads on that bus. Reference 14 CFR §§ 23, 25, 27, and 29.1351.

2-10. Electrical power source. The DFDR must receive its operating electrical power from the bus that allows maximum reliability for the DFDRS. The applicant may not add the DFDR to any bus if the addition would jeopardize essential or emergency loads.

a. Connect to power buses. The applicant must connect the DFDR and the CVR to power buses that are separate and supplied by independent power sources. If the DFDRS cannot be added to the emergency or essential bus, the applicant should consider providing two separate and independent sources of electrical power for each DFDR and its associated FDAU or DFDAU.

b. Automatic switching. The applicant should consider providing each DFDR and its associated FDAU or DFDAU automatically switch between the two power sources to maintain flight data recording in the event of a bus failure. Such provision of two separate and independent power sources would ensure available data essential to accident investigation is recorded throughout the entire accident sequence.

c. External power sources. Separate aircraft external power sources are not required for installation of a single combination CVR/DFDR unit. If there are more than one electrical power 9