2-11 numbers) as the installation seeking certification. You can satisfy interoperability bench tests by either of the following:
2.3.3.2 Conduct the following RTCA/DO-185A or RTCA/DO-185B tests as applicable, using the actual TCAS unit and Mode S transponder seeking certification:
2.4.2.2.3.1 2.4.2.2.3.2, 2.4.2.2.4.1, 2.4.2.2.4.2.1, 2.4.2.2.4.2.3, 2.4.2.2.4.2.5, 2.4.2.2.4.2.6, 2.4.2.2.4.2.7, 2.4.2.2.4.2.8, and, 2.4.2.2.5.
2.3.3.3 Conduct the following tests in RTCA/DO-181E as applicable, Minimum Operational Performance Standards for Air Traffic Control Radar Beacon System/Mode Select (ATCRBS/Mode S) Airborne Equipment, using the actual TCAS unit and Mode S transponder seeking certification:
Procedure 30, Procedure 31 a-d, Procedure 32a-c and d (1 & 2), Procedure 34, Procedure 36 a and c, and, Procedure 37 a and b.
2.3.3.4 In addition, conduct the following RTCA/DO-181E tests as applicable, using a TCAS simulator coupled with the actual Mode S transponder:
Procedure 31e, Procedure 32d (3-16), Procedure 33, Procedure 35, Procedure 36b,
2-12 Procedure 37c and, Procedure 38.
Note: These equipment compatibility requirements are only necessary for the initial approval.
2.3.4 Aircraft Performance Considerations. Use paragraphs 2.3.4 through 2.3.5 and Table 1 of this AC to help you evaluate the need to inhibit TCAS II CLIMB and/or INCREASE CLIMB RAs resulting from inadequate aircraft climb performance. The collision avoidance maneuvers the TCAS II commands as RAs assume an aircraft’s ability to safely achieve them. If it’s likely the required response to CLIMB and INCREASE CLIMB RAs are beyond the performance capability of the aircraft, then TCAS II must know beforehand so it can change strategy and issue an alternative RA. The aircraft interface and discrete settings relative to altitude and/or aircraft configuration must provide these performance limits to TCAS II. However, carefully consider the need to inhibit TCAS II CLIMB or INCREASE CLIMB RAs since the alternative RAs may not provide the optimum solution to the encounter. Inhibiting these RAs will increase the likelihood of TCAS II:
2.3.4.1 Issuing crossing maneuvers (crossing through an intruder’s altitude), thus increasing the probability that an RA may be thwarted by the intruder maneuvering,
2.3.4.2 Causing an increase in DESCEND RAs at low altitude, and
2.3.4.3 Providing no RAs if below the descend inhibit altitude of 1200 feet AGL during takeoff and 1000 feet AGL on approach.
2.3.5 Evaluating Aircraft Performance. The configuration interface may need switches or sensors, besides the basic airplane flap position switches, to prevent unnecessary TCAS II inhibits. For example, if you need to inhibit CLIMB RAs for the maximum takeoff flap setting only, and no switch exists to sense that position, install an additional switch instead of simply using one that may exist at lesser flap angle settings.
2.3.5.1 Because TCAS II can only accept a limited number of inputs related to airplane performance, it’s not possible to automatically inhibit CLIMB and INCREASE CLIMB RAs in all cases where it may be appropriate to inhibit such RAs. In these cases, TCAS II may command maneuvers that may significantly reduce stall margins or result in stall warnings.
Conditions where this may occur include bank angles greater than 15 degrees, weight/altitude/temperature combinations outside the envelope shown in Table 1, initial speeds below those shown in Table 1, one engine inoperative, leaving the aircraft configuration fixed for climb RAs on landing transition to go-around, and abnormal configurations such as landing gear not retractable. Provide information concerning this aspect of TCAS in the airplane flight manual (AFM) or airplane flight manual supplement (AFMS) so that flight crews may take appropriate action.
2-13
2.3.5.2 Aircraft configuration, true airspeed available during initial climb (to safely trade for climb rate if needed), and the initial airspeed margin from the current stall speed all significantly affect an aircraft’s low altitude climb capability during takeoff, approach, or landing.
2.3.5.2.1 Table 1, Conditions 1 through 3 apply to the takeoff and initial climb configuration analysis.
2.3.5.2.2 Table 1, Conditions 4 through 6 apply to the approach flap configuration analysis when operating in the terminal area with the flaps set at less than the landing flaps.
2.3.5.2.3 Table 1, Conditions 7 through 9 apply to the landing flight regime analysis. To be consistent with normal operation, indicate in the AFM or AFMS that when a climb RA occurs with the aircraft in the landing configuration, the pilot should initiate the normal go-around procedure when complying with the TCAS II RA. Therefore, you can assume that the flaps are retracted from the landing position to the go-around position when evaluating Table 1, Conditions 7 through 9.
2.3.5.3 To prevent very unlikely combinations of events, such as weight/altitude/temperature limiting conditions, in conjunction with low airspeed, high drag configurations, and unusual encounter geometries causing climb inhibits when the aircraft’s performance is more than adequate, Table 1 places the entry and exit conditions and RAs into two classes of encounters.
2.3.5.3.1 Maneuvers A and B represent reasonably severe combinations of entry conditions and RAs, and restricts the exit conditions to an airspeed of
1.2VS1 (or 1.13VSR1 for those airplanes that use reference stall speed (VSR) in lieu of stalling speed (VS)).
2.3.5.3.2 Maneuver C represents reasonably worst-case combinations of entry conditions and RAs, and this very unlikely event may require flying near stall warning conditions through the recovery.
2.3.5.3.3 Airspeeds between 1.2VS1 (or 1.13VSR1 for those airplanes that use reference stall speed (VSR) in lieu of stalling speed (VS)) and stall warning represent a range of usable airspeeds that the flight crew can trade for climb performance (the same as current wind shear recovery procedures recommend) for evaluation of this low probability event. The altitude/temperature envelope represents a range of values that exist at busy airports in the continental United States. Operations outside this envelope may require special crew procedures if the normal AFM weight, altitude, temperature, and configuration limitations are not sufficiently compensating, such as operation at Mexico City.
2-14
2.3.5.4 For those airplanes that may routinely operate at low climb airspeeds during the clean configuration, enroute phase of flight, such as propeller commuter airplanes, consider providing a discrete to the TCAS II based on airspeed. Such an input, derived from a TCAS II interface system, would provide for CLIMB or INCREASE CLIMB RA inhibits when the airplane is in the clean configuration and operating below a certain airspeed. We consider such a scheme appropriate instead of an across-the-board inhibit for the clean configuration regardless of flight regime (which does not provide the best overall level of safety for other configurations).
2.3.5.5 Excess power (propeller-driven) or excess thrust (turbojet) and true airspeed (that may be available to safely trade for climb rate) are also significant factors in aircraft’s climb capability when operating at or near maximum approved operating altitude. The system should not inhibit climb RAs if the aircraft has adequate performance available or because it may exceed its maximum certificated altitude by several hundred feet during an RA. Table 1, Conditions 10 and 11, shows configurations that you should evaluate in this flight regime. If the aircraft has approval for significant alternative configurations, (such as spare engine pod and gear down operation,) then the initial airspeed you use for the analysis should be appropriate for them. In the analysis of the aircraft’s ability to accelerate and return to the initial speed and altitude following the RA, an undershoot of approximately 200 feet is permissible.
2.3.5.6 In icing conditions, the aircraft limited performance weights are lower, and sometimes the operating speeds are higher, to account for icing system bleeds and residual ice drag on the unprotected surfaces. Therefore, the capability to perform the TCAS II maneuvers remains essentially unchanged, eliminating the need to provide additional RA inhibits under these circumstances. However, if a particular aircraft design shows marginal capability to operate in the icing environment, consider additional RA inhibits enabled by icing system activation.
2.3.5.7 If Table 1, Maneuver A causes operation at airspeeds below the minimum, then inhibit the CLIMB RA. If Table 1, Maneuver B or C causes operation at airspeeds below the minimum, then inhibit the INCREASE CLIMB RA. However, early recovery of 1 to 2 seconds is of little or no consequence on the collision avoidance maneuver and the system will achieve a higher overall level of safety if it does not provide inhibits under these circumstances, as this AC has previously discussed in paragraph
2.3.4.
2-15 Table 1. Maneuvers
CONDITION FLIGHT REGIME WEIGHT
ALTITUDE,
TEMPERATUR E1 THRUST FLAPS GEAR INITIAL AIRSPEED2 MINIMUM AIRSPEED2 MANEUVER3 1 Takeoff Part 25 climb limit Maximum rated takeoff All takeoff Up V2+204 1.2VS15 thru RA A 2 Takeoff Part 25 climb limit Maximum rated takeoff All takeoff Up V2+204 1.2VS15 thru RA B 3 Takeoff Part 25 Climb limit Maximum rated takeoff All takeoff Up AFM allengine takeoff speed6 15° bank to stall warning7 thru recovery C 4 Approach Part 25 Climb limit Spin up to max go-around thrust during maneuver from thrust for level flight Less than landing Up 1.6VS1 1.2VS15 thru RA A 5 Approach Part 25 Climb limit Spin up to max go-around thrust during maneuver from thrust for level flight Less than landing Up 1.6VS1 1.2VS15 thru RA B 6 Approach Part 25 Climb limit Spin up to max go-around thrust during maneuver from thrust for level flight Less than landing Up, or down to up Min.
maneuver speed from training procedures 15° bank to stall warning7 thru recovery C
2-16
CONDITION FLIGHT REGIME WEIGHT
ALTITUDE,
TEMPERATUR E1 THRUST FLAPS GEAR INITIAL AIRSPEED2 MINIMUM AIRSPEED2 MANEUVER3 7 Landing, Transition to Go-Around at RA Part 25 Climb limit Spin up to max go-around thrust during maneuver from thrust required for 3° glideslope Transition from landing flap to goaround flap Down to up VREF + 10 1.2VS15 thru RA A 8 Landing, Transition to Go-Around at RA Part 25 Climb limit Spin up to max go-around thrust during maneuver from thrust required for 3° glideslope Transition from landing flap to goaround flap Down to up VREF + 10 1.2VS15 thru RA B 9 Landing, Transition to Go-Around at RA Part 25 climb limit Spin up to max go-around thrust during maneuver from thrust required for 3° glideslope Transition from landing flap to goaround flap Down to up VREF + airspeed addition from training procedures 15° bank to stall warning7 thru recovery C 10 En Route Critical Wt/Alt giving 0.3g to buffet onset Thrust for level flight increased to max continuous, if required Up Up Long-range cruise Higher of
1.2VS5 if defined or buffet onset A 11 En Route Critical Wt/Alt giving 0.3g to buffet onset Thrust for level flight increased to max continuous, if required Up Up Long-range cruise Higher of
1.2VS5 if defined or buffet onset B
2-17 Notes:
1. Weight = Lesser of climb limit or structural; Airport Pressure Altitude = sea level to 5300 ft; Temperature = ISA ± 50 °F; Evaluate conditions 1 through 3 700 ft above airport; evaluate conditions 4 - 9 1700 ft above airport.
2. For those airplanes that use reference stall speed (VSR) in lieu of stalling speed (VS), replace 1.2 VS1 with 1.13 VSR1, 1.2VS with
1.13VSR and 1.6 VS1 with 1.5 VSR1.
3. Maneuvers:
a. Maneuver A evaluates the TCAS II CLIMB RA. From the initial steady-state condition, after a 3-second pilot-reaction time delay, rotate the aircraft at 1.25 g to attain +1500 feet per minute climb. Hold until the total duration of the RA of 25 seconds has elapsed. Recover to attain the initial trim airspeed.
b. Maneuver B evaluates the TCAS II INCREASE CLIMB RA following a CLIMB RA. From the initial steady-state condition, after a 3-second pilot-reaction time delay, rotate the aircraft at 1.25 g to attain +1500 feet per minute climb. Hold until 15 seconds has elapsed from when the CLIMB RA was issued. Then, after a 1-second pilot reaction time-delay to the INCREASE CLIMB RA, rotate the aircraft again at 1.25 g to attain +2500 feet per minute climb and hold until the total duration of the RA of 25 seconds has elapsed. Recover to attain the initial trim airspeed.
c. Maneuver C evaluates a maximum duration TCAS II INCREASE CLIMB RA following a minimum duration CLIMB RA.
From the initial steady-state condition, after a 3-second pilot-reaction time delay, rotate the aircraft at 1.25 g targeting +1500 feet per minute climb until 6 seconds has elapsed from when the the system issued the CLIMB RA. Then, after a 1-second pilot-reaction time delay to the INCREASE CLIMB RA, rotate the aircraft again at 1.25 g to attain +2500 feet per minute climb and hold until the total duration of the RA of 25 seconds has elapsed. Recover to attain the initial trim airspeed.
4. VY + 10 for nontransport category aircraft without a defined V2.
5. For those airplanes where the power-on stalling speed is significantly lower than the power-off stalling speed, use 1.1VS or
1.08VSR for those airplanes that use reference stall speed (VSR) in lieu of stalling speed (VS).
6. VY for nontransport category aircraft without a defined V2
7. For those airplanes where the power-on stalling speed is significantly lower than the power-off stalling speed, use VS1 or 0.94VSR1 for those airplanes that use reference stall speed (VSR) in lieu of stalling speed (VS).
2-18
2.3.5.8 A summary of the system inhibits (limitations) programmed into the TCAS II computer is given in Table 2 below.
Table 2 System Inhibits
INHIBIT PARAMETERS Increase Descent RA Inhibited below 1650 ft AGL while climbing and inhibited below 1450 ft AGL while descending.
Descend RA Inhibited below 1200 ft AGL while climbing and inhibited below 1000 ft AGL while descending.
TA Voice Messages Inhibited below 400 ft AGL while descending and inhibited below 600 ft AGL while climbing.
RAs Inhibited below 1100 ft AGL while climbing, and inhibited below 900 ft AGL while descending. (TCAS automatically reverts to TA only).
Self-Test Can be inhibited when airborne.
Advisory Priority Automatically reverts to TA only when higher priority advisories (such as GPWS/TAWS and windshear) occur.
Climb RA Can be inhibited, based upon aircraft performance capability.
Increase Climb RA Can be inhibited, based upon aircraft performance capability.
2.3.6 How Aircraft Systems Should Interface with TCAS II.
2.3.6.1 Pressure altitude information.
The pressure altitude data must be from the most accurate source available in the aircraft and it must be the same data the associated Mode S transponder transmits. The accuracy of the altitude data must be at least that specified in RTCA/DO-185A or RTCA/DO-185B, paragraph 3.2.8 as applicable. You must show that the resolution of the altimetry source is compatible with TCAS II. The altitude source with the finest compatible resolution must be used. When available, the resolution should be in increments of 10 feet or less. Also provide information to indicate when the pressure altitude information is invalid.
2.3.6.2 Radio altitude information.
2.3.6.2.1 Provide radio altitude information to the TCAS II to inhibit:
2-19
2.3.6.2.2 INCREASE DESCENT RAs below 1650 ft AGL while climbing and below 1450 ft AGL while descending,
2.3.6.2.3 DESCEND RAs below 1200 ft AGL while climbing and below 1000 ft AGL while descending,
2.3.6.2.4 All TA voice messages (aural traffic advisories) below 400 ft AGL while descending and below 600 ft AGL while climbing, and
2.3.6.2.5 All RAs below 1100 ft AGL while climbing and below 900 ft AGL while descending, to allow automatic sensitivity level selection when close to the ground, and to determine that individual targets are on the ground.
2.3.6.2.6 Also provide information to indicate when the radio altitude information is invalid.
2.3.6.3 Aircraft configuration.
Use discrete information from flaps, slat, landing gear, and/or other aircraft configuration sensors to ensure that TCAS II appropriately inhibits CLIMB and INCREASE CLIMB RAs to the airplane performance limits as described in paragraph 2.3.4 and 2.3.5.
2.3.6.4 Aircraft identification.
Provide discrete information to the Mode S transponder for the unique aircraft Mode S identification code and its maximum airspeed capability.
2.3.6.5 Attitude.
The system may provide aircraft pitch and roll attitude to assist with stabilization of the directional antenna function to assure surveillance and to ensure normal aircraft maneuvers don’t affect TA display data. If TCAS II uses attitude information, provide information to indicate when the attitude data are invalid.
2.3.6.6 Heading.
The system may provide aircraft heading for the TA display reference presentation. If it does, it must also indicate when the heading data are invalid.
2.3.6.7 System failure display.
Provide an appropriate level alert in accordance with Section 2.2.10 to indicate when RAs are not possible due to failure of the TCAS II equipment or any of its sensors or displays.
Note: Section 2.3.8.2 has system safety analysis requirements for failure to provide an RA when required without indication of loss of RA capability.
2-20
2.3.6.8 Altitude alerter data.
You may provide the current clearance altitude from the altitude alerter to enable TCAS II to select RAs that are more consistent with the aircraft’s altitude clearance once it resolves the immediate collision threat.
Note: Altitude alert functionality is optional per RTCA/DO-185A and RTCA/DO-185B. Not all TSO-C119( ) TCAS II units will have this option available.
2.3.6.9 Mode S Transponder Gillham altitude input requirements.
The Gillham format uses 11 discrete wires that, depending on which wires are turned off or on, represent an altitude value. The Gillham format is sometimes called a blind encoder, as there is no error detection and/or correction on the wires. For this reason, ARINC 718, Mark 3 Air Traffic Control Transponder (ATCRBS/MODE S), dated December 1989, states:
“Pins have been reserved to permit the direct application of Gillham code data to the transponder. This practice is not encouraged because of concerns that a “stuck bit” in the coded input could be the cause of serious errors in TCAS II resolution advisories.” This is a failure mode peculiar to the Gillham code against which protection is virtually impossible. If you cannot avoid using Gillham coded altitude for the TCAS II installations, you must connect two sources of altitude information to the transponder and compare their values. The system must annunciate all transponder altitude comparator failures.
2.3.6.10 Hybrid surveillance failure annunciations (TSO-C119d and later units).
For aircraft equipped with centralized alert and warning system and or an onboard maintenance system, you should consider integrating the hybrid surveillance alerting functionality into the system so as to alert the crew with an appropriate failure annunciation. Refer to section 2.3.9 for more information.
2.3.7 Verifying and Validating TCAS II Software. For the first installation of a manufacturer’s TCAS II equipment, you must verify and validate TCAS II software using the procedures below. Also, apply these procedures to subsequent software changes to a manufacturer’s TCAS II equipment. A manufacturer may provide a design that partitions the software that affects RAs from other software, such as that necessary for the traffic display. The TCAS II manufacturer may not use the minor change authority of the TSO system to change any software in the same partition as the software that affects RAs.
2.3.7.1 Verification and validation of TCAS II software represents a unique challenge. A formal statechart representation in the CAS requirements specification (CRS) in RTCA/DO-185A, Volume II and RTCA/DO-185B, Volume II, specifies collision avoidance algorithms, commonly called “the CAS logic,” in detail. In addition, Attachment A of Volume II provides a
2-21 software design specification in pseudocode that meets these requirements. We require this level of detail because the coordination algorithms in the CAS logic assume that the software that all manufacturers implement will have exactly the same CAS logic.
However, the manufacturer of the TCAS II equipment must develop the surveillance software necessary to establish and maintain the relative tracks of nearby transponder-equipped aircraft and the software necessary to provide the interface with the Mode S transponder and with other aircraft sensors and displays. This hybrid approach to the specification of the software requirements means that the FAA and our contractors have satisfied the application of the software criteria in RTCA/DO-178B, Software Considerations in Airborne Systems and Equipment Certification, dated December 1, 1992, for the detailed CAS requirements and the pseudocode software design, while the remaining requirements of RTCA/DO-178B (considering any applicable provisions of AC 20-115C, Airborne Software Assurance, dated July 19, 2013) or DO-178C, dated December 13, 2011, as applicable, are the responsibility of the manufacturer.
2.3.7.2 If the system uses software for the display of TCAS II RAs or in the operation of the Mode S transponder data link, you must do the verification and validation of this software to Level B requirements, as defined in RTCA/DO-178B/C. Also, apply these procedures when the TCAS II manufacturer develops the software requirements for the TCAS II processor associated with functions other than surveillance or the CAS logic. With the software design specified in RTCA/DO-185A, Volume II or RTCA/DO-185B, Volume II, the manufacturer of the TCAS II processor should conduct code walk-throughs and develop and perform module tests and module integration tests to verify that the implementation of the specified software design is correct. This includes the surveillance software necessary to establish and maintain the relative tracks of nearby transponder-equipped aircraft.
2.3.7.3 The functional tests required by TSO-C119b and TSO-C119c/d/e, as described in RTCA/DO-185A, Volume I and RTCA/DO-185B, Volume I respectively, do not provide complete testing for the TCAS II processor software. However, coverage analysis performed on the CAS test suite, described in Volume I, demonstrated that the CAS test suite tests each column of every transition table and macro, and each identity transition in the CAS requirements specification in RTCA/DO-185A, Volume II or RTCA/DO-185B, Volume II. Thus, the CAS test suite provides more than full decision coverage (but not full condition coverage) as defined in RTCA/DO-178B. TCAS II manufacturers must develop additional functional tests that correspond to the detailed requirements that they develop for the TCAS II processor. The potential consequences of software errors in the TCAS II processor or resolution display require the manufacturer to provide a structural coverage analysis showing single
2-22 condition test coverage of all instructions at the source code that can affect the generation and display of RAs. These tests may be a combination of module tests, module integration tests and functional tests.
2.3.7.4 Equipment produced under a TSO has obtained FAA concurrence that the software for the equipment was developed in accordance with RTCA/DO- 178B/C to the software level the TSO specifies. Subsequent installations of the same TCAS II equipment on other aircraft types do not require any additional verification if the software and the interface is not changed.
2.3.8 Failure Conditions System Safety Assessment and Design Assurance. Unannunciated failures of the TCAS II equipment, its associated transponder, or sensors or displays that could generate an incorrect or false RA, or result in a missing RA, must be improbable. This can be accomplished using the methods described in AC 25.1309-1A, System Design and Analysis. A functional hazard assessment (FHA), a failure modes and effects analysis (FMEA), and a quantitative probability analysis of the TCAS II equipment, Mode S transponder, displays, and sensors (including altitude information sources) will normally be necessary to show that the system design meets the probabilities specified for the following failure conditions.
Note: Appendix E, Section E.1, Definitions, gives the definitions of a missing RA, incorrect RA, and false RA.
2.3.8.1 The probability of failure of the installed system to perform its intended function from a reliability and availability perspective should be shown to be no greater than 1.0 x10-3 per flight hour.
2.3.8.2 The probability of a missing RA, without indication of loss of capability to generate an RA, should be shown to be no greater than 1.0 x 10-4 per flight hour in the terminal environment and 1.0 x 10-5 per flight hour in the enroute environment.
2.3.8.3 The probability of a false RA aural and visual alert due to a failure of the system should be shown to be no greater than 1.0 x 10-4 per flight hour in the terminal environment and 1.0 x 10-5 per flight hour in the enroute environment.
2.3.8.4 Software that presents incorrect RA aural and visual alerts, or results in a missing RA, is considered a hazardous failure condition. Develop software involved in generating RAs to RTCA/DO-178B/C, Level B standards.
2.3.8.5 The probability of an incorrect RA aural and visual alert due to a failure of the hardware should be shown to be no greater than 1.0 x 10-4 per flight hour in the terminal environment and 1.0 x 10-5 per flight hour in the enroute environment.